diff --git a/.github/workflows/_memwaste.yml b/.github/workflows/_memwaste.yml
new file mode 100644
index 000000000..174490db6
--- /dev/null
+++ b/.github/workflows/_memwaste.yml
@@ -0,0 +1,183 @@
+# Reusable: the waste sanitizer (memory + CPU waste), REPORT-ONLY.
+#
+# What runs (scripts/memwaste.sh, memwaste-scaling.py, memwaste-ratchet.py):
+#   mode=pr    Linux: the event lane (memory waste + CPU work) indexing this
+#              repository at the checked-out commit, and the CPU scaling lane
+#              (src/ replicated 2x against 4x, per-function counter ratios).
+#   mode=full  the same, plus the event lane on macOS and Windows and the access
+#              lane (read/write verdicts per allocation) on Linux.
+#
+# The corpus is the repository itself: pinned by the commit, no network, and a
+# real mix of C, C++, Python, JavaScript and vendored code.
+#
+# REPORT-ONLY: every job uploads its report and prints the ratchet comparison
+# against scripts/memwaste-baseline.json, but nothing here can turn a PR red --
+# the ratchet runs without --enforce and the PR's ci-ok gate does not depend on
+# these jobs. A job fails only when the MEASUREMENT is unsound (a table
+# overflowed, frees the layer never saw): that is a defect of the tool, and a
+# red job is how it gets noticed. Switching the ratchet to --enforce is a
+# separate, deliberate change once the numbers have been stable across reruns.
+name: Memwaste
+
+on:
+  workflow_call:
+    inputs:
+      mode:
+        description: "pr (Linux event + scaling) or full (all platforms, access lane)"
+        type: string
+        default: pr
+
+permissions:
+  contents: read
+
+jobs:
+  event-linux:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install deps
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev python3 clang llvm
+      - name: Event lane on this repository
+        run: |
+          # `cmd | tee` reports TEE's status: without this a failing lane
+          # (a missing exec bit, a build error) passes the step and only
+          # surfaces as the ratchet not finding its JSON.
+          set -o pipefail
+          mkdir -p "$RUNNER_TEMP/memwaste-event"
+          scripts/memwaste.sh "$GITHUB_WORKSPACE" --top 40 --out "$RUNNER_TEMP/memwaste-event" \
+            | tee "$RUNNER_TEMP/memwaste-event/report.txt"
+      - name: Ratchet (report-only)
+        run: python3 scripts/memwaste-ratchet.py --out "$RUNNER_TEMP/memwaste-event" --venue ${{ inputs.mode }}-linux
+      - name: Upload report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: memwaste-event-linux-${{ inputs.mode }}
+          path: |
+            ${{ runner.temp }}/memwaste-event/report.txt
+            ${{ runner.temp }}/memwaste-event/memwaste.json
+            ${{ runner.temp }}/memwaste-event/index.json
+          if-no-files-found: warn
+
+  scaling-linux:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install deps
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev python3 clang llvm
+      - name: CPU scaling lane (src/ at 2x against 4x)
+        # Report-only: the script exits 1 when it flags a super-linear function.
+        continue-on-error: true
+        run: |
+          # `cmd | tee` reports TEE's status: without this a failing lane
+          # (a missing exec bit, a build error) passes the step and only
+          # surfaces as the ratchet not finding its JSON.
+          set -o pipefail
+          mkdir -p "$RUNNER_TEMP/memwaste-scaling"
+          python3 scripts/memwaste-scaling.py --corpus src --replicas 2 \
+            --out "$RUNNER_TEMP/memwaste-scaling" | tee "$RUNNER_TEMP/memwaste-scaling/report.txt"
+      - name: Upload report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: memwaste-scaling-linux-${{ inputs.mode }}
+          path: ${{ runner.temp }}/memwaste-scaling/report.txt
+          if-no-files-found: warn
+
+  access-linux:
+    if: ${{ inputs.mode == 'full' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install deps
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev python3 clang llvm
+      - name: Access lane on this repository
+        run: |
+          # `cmd | tee` reports TEE's status: without this a failing lane
+          # (a missing exec bit, a build error) passes the step and only
+          # surfaces as the ratchet not finding its JSON.
+          set -o pipefail
+          mkdir -p "$RUNNER_TEMP/memwaste-access"
+          scripts/memwaste.sh "$GITHUB_WORKSPACE" --lane access --top 40 --sort untouched \
+            --out "$RUNNER_TEMP/memwaste-access" | tee "$RUNNER_TEMP/memwaste-access/report.txt"
+      - name: Upload report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: memwaste-access-linux-${{ inputs.mode }}
+          path: |
+            ${{ runner.temp }}/memwaste-access/report.txt
+            ${{ runner.temp }}/memwaste-access/memwaste.json
+          if-no-files-found: warn
+
+  event-macos:
+    if: ${{ inputs.mode == 'full' }}
+    runs-on: macos-14
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Event lane on this repository
+        run: |
+          # `cmd | tee` reports TEE's status: without this a failing lane
+          # (a missing exec bit, a build error) passes the step and only
+          # surfaces as the ratchet not finding its JSON.
+          set -o pipefail
+          mkdir -p "$RUNNER_TEMP/memwaste-event"
+          scripts/memwaste.sh "$GITHUB_WORKSPACE" --top 40 --out "$RUNNER_TEMP/memwaste-event" \
+            | tee "$RUNNER_TEMP/memwaste-event/report.txt"
+      - name: Ratchet (report-only)
+        run: python3 scripts/memwaste-ratchet.py --out "$RUNNER_TEMP/memwaste-event" --venue full-macos
+      - name: Upload report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: memwaste-event-macos-${{ inputs.mode }}
+          path: |
+            ${{ runner.temp }}/memwaste-event/report.txt
+            ${{ runner.temp }}/memwaste-event/memwaste.json
+          if-no-files-found: warn
+
+  event-windows:
+    if: ${{ inputs.mode == 'full' }}
+    runs-on: windows-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
+        with:
+          msystem: CLANG64
+          path-type: inherit
+          install: >-
+            mingw-w64-clang-x86_64-clang
+            mingw-w64-clang-x86_64-llvm
+            mingw-w64-clang-x86_64-zlib
+            mingw-w64-clang-x86_64-python3
+            make
+            git
+            coreutils
+      - name: Event lane on this repository
+        shell: msys2 {0}
+        run: |
+          # `cmd | tee` reports TEE's status: without this a failing lane
+          # (a missing exec bit, a build error) passes the step and only
+          # surfaces as the ratchet not finding its JSON.
+          set -o pipefail
+          out="$(cygpath -u "$RUNNER_TEMP")/memwaste-event"
+          mkdir -p "$out"
+          CC=clang CXX=clang++ scripts/memwaste.sh "$(cygpath -u "$GITHUB_WORKSPACE")" --top 40 --out "$out" \
+            | tee "$out/report.txt"
+      - name: Ratchet (report-only)
+        shell: msys2 {0}
+        run: python3 scripts/memwaste-ratchet.py --out "$(cygpath -u "$RUNNER_TEMP")/memwaste-event" --venue full-windows
+      - name: Upload report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: memwaste-event-windows-${{ inputs.mode }}
+          path: |
+            ${{ runner.temp }}/memwaste-event/report.txt
+            ${{ runner.temp }}/memwaste-event/memwaste.json
+          if-no-files-found: warn
diff --git a/.github/workflows/_security.yml b/.github/workflows/_security.yml
index dd6f3400c..ce044eed2 100644
--- a/.github/workflows/_security.yml
+++ b/.github/workflows/_security.yml
@@ -41,6 +41,14 @@ jobs:
   codeql-gate:
     runs-on: ubuntu-latest
     timeout-minutes: 240
+    # Without security-events:read this job inherits the workflow's
+    # contents:read, the code-scanning alert API answers 403, and the gate
+    # below reported "0 alerts" on every run it has ever made. actions:read is
+    # what the CodeQL-run poll above needs for the same reason.
+    permissions:
+      contents: read
+      security-events: read
+      actions: read
     steps:
       - name: Wait for CodeQL on current commit (max 150 min)
         env:
@@ -77,11 +85,43 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          # FAIL CLOSED. The previous form was `gh api ... 2>/dev/null || echo "0"`,
+          # which looks defensive and is the opposite. gh writes the API error
+          # BODY to stdout, so a 403 made ALERTS the string
+          #   {"message":"Resource not accessible by integration",...,"status":"403"}0
+          # every `[` comparison then failed as non-integer, the `if` took its
+          # false branch, and the step printed "CodeQL gate passed (0 alerts)"
+          # and exited 0. That is exactly how a security gate should NEVER fail:
+          # silently, in the direction of "everything is fine". An unreadable
+          # alert list is now an error, not a zero.
+          # NOTE: this runs in a command substitution, so it must `return`, not
+          # `exit` -- an `exit` here would only end the subshell and let the
+          # caller continue with an empty count, recreating the very bug this
+          # replaces. The callers below check the status explicitly.
+          count_open_alerts() {
+            local body status
+            body=$(gh api 'repos/${{ github.repository }}/code-scanning/alerts?state=open' \
+                     --jq 'length' 2>/dev/null)
+            status=$?
+            if [ $status -ne 0 ]; then
+              echo "BLOCKED: cannot read code scanning alerts (gh exit $status)." >&2
+              echo "  Refusing to treat an unreadable alert list as zero." >&2
+              echo "  Most likely cause: the job lacks security-events:read." >&2
+              return 1
+            fi
+            case "$body" in
+              ''|*[!0-9]*)
+                echo "BLOCKED: alert count was not a number: ${body:-<empty>}" >&2
+                return 1
+                ;;
+            esac
+            printf '%s' "$body"
+          }
           echo "Waiting 60s for alert API to settle..."
           sleep 60
-          ALERTS=$(gh api 'repos/${{ github.repository }}/code-scanning/alerts?state=open' --jq 'length' 2>/dev/null || echo "0")
+          ALERTS=$(count_open_alerts) || exit 1
           sleep 15
-          ALERTS2=$(gh api 'repos/${{ github.repository }}/code-scanning/alerts?state=open' --jq 'length' 2>/dev/null || echo "0")
+          ALERTS2=$(count_open_alerts) || exit 1
           [ "$ALERTS" -lt "$ALERTS2" ] && ALERTS=$ALERTS2
           if [ "$ALERTS" -gt 0 ]; then
             echo "BLOCKED: $ALERTS open alert(s)"
diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index d915eb243..7ccd56bf5 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -107,6 +107,32 @@ jobs:
         if: startsWith(matrix.os, 'ubuntu')
         run: sudo apt-get update && sudo apt-get install -y zlib1g-dev ccache
 
+      # Ubuntu 23.10+ ships kernel.apparmor_restrict_unprivileged_userns=1, which
+      # blocks unshare(CLONE_NEWUSER) for unprivileged users. Without this, the
+      # #1830 single-uid-userns smoke test SKIPS on every 24.04 leg, and its only
+      # real-namespace coverage lived on the two ubuntu-22.04 legs -- which are
+      # broad-matrix only (never PR CI) and which GitHub retires on 2027-04-17.
+      # A deliberate relaxation of a security check was therefore guarded by a
+      # test that ran in no PR and was on a clock. Hosted runners have
+      # passwordless sudo, so one sysctl puts it on the CORE matrix instead.
+      # Best-effort: a runner that refuses simply returns to skipping.
+      - name: Permit unprivileged user namespaces (Ubuntu)
+        if: startsWith(matrix.os, 'ubuntu')
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || \
+            echo "could not lift the userns restriction; namespace tests will skip"
+          # Then SAY whether it worked. The runner prints per-shard aggregates
+          # ("N passed, M skipped") and never individual test names, so a
+          # namespace test that silently returns to skipping is invisible in a
+          # green log -- the same false assurance that let #1830 ship with a
+          # test that never executed. This line is the evidence. Probed exactly
+          # as the test does it: unprivileged, no sudo.
+          if unshare -U -r true 2>/dev/null; then
+            echo "CBM_USERNS_AVAILABLE=yes"
+          else
+            echo "CBM_USERNS_AVAILABLE=no (namespace-dependent tests will skip)"
+          fi
+
       - name: Install ccache (macOS)
         if: startsWith(matrix.os, 'macos')
         run: command -v ccache >/dev/null 2>&1 || brew install ccache
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index dbaa52a6c..e83a82d06 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,7 +29,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: c-cpp
           build-mode: manual
@@ -38,6 +38,6 @@ jobs:
         run: scripts/build.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           category: "/language:c-cpp"
diff --git a/.github/workflows/dry-run.yml b/.github/workflows/dry-run.yml
index 43a6b6bd9..600dbad04 100644
--- a/.github/workflows/dry-run.yml
+++ b/.github/workflows/dry-run.yml
@@ -45,6 +45,10 @@ on:
         description: 'Skip candidate scan; mark unscanned and default to stripped'
         type: boolean
         default: false
+      skip_memwaste:
+        description: 'Skip the waste sanitizer (report-only) and the fuzz smoke'
+        type: boolean
+        default: false
       soak_level:
         description: 'Soak: full (quick+asan), quick (10min), none'
         type: choice
@@ -58,6 +62,13 @@ jobs:
   # ── Security (independent island — does not block main pipeline) ──
   security:
     uses: ./.github/workflows/_security.yml
+    # The called job requests security-events:read to count code-scanning
+    # alerts; a reusable workflow cannot request more than its caller grants,
+    # so withholding this here fails the whole run at startup.
+    permissions:
+      contents: read
+      security-events: read
+      actions: read
     secrets: inherit
 
   # ── Lint (cppcheck + clang-format) ────────────────────────────
@@ -100,6 +111,38 @@ jobs:
     with:
       broad_platforms: true
 
+  # ── Waste sanitizer, REPORT-ONLY (independent island) ─────────
+  # Event lane on Linux, macOS and Windows, access lane and the per-function
+  # scaling lane on Linux. Uploads reports; fails only when the measurement is
+  # unsound (a defect of the tool itself).
+  memwaste:
+    if: ${{ inputs.skip_memwaste != true }}
+    uses: ./.github/workflows/_memwaste.yml
+    with:
+      mode: full
+
+  # ── Fuzz smoke (independent island) ───────────────────────────
+  # A fixed number of executions from a fixed seed per target, so the verdict is
+  # a function of the commit (O9). A crash here is a real defect in a parser
+  # that reads untrusted input; its reproducer is uploaded.
+  fuzz:
+    if: ${{ inputs.skip_memwaste != true }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install deps
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev clang llvm libclang-rt-dev
+      - name: Fuzz smoke (extract, cypher, config)
+        run: scripts/fuzz.sh all --runs 20000 --seed 1
+      - name: Upload reproducers
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: fuzz-artifacts
+          path: build/fuzz/artifacts-*/
+          if-no-files-found: ignore
+
   # ── Soak tests (optional, parallel with smoke) ────────────────
   soak:
     if: ${{ inputs.soak_level != 'none' && !cancelled() && needs.build.result != 'failure' && needs.build.result != 'skipped' }}
diff --git a/.github/workflows/nightly-soak.yml b/.github/workflows/nightly-soak.yml
index 4c8abeb28..2bd5bc7e8 100644
--- a/.github/workflows/nightly-soak.yml
+++ b/.github/workflows/nightly-soak.yml
@@ -35,6 +35,27 @@ permissions:
   contents: read
 
 jobs:
+  # Fuzz exploration: new inputs are the point here, so it runs for a time
+  # budget instead of a fixed count. NON-GATING like the soak; a crash uploads
+  # its reproducer, which becomes a fixed-seed regression input once fixed.
+  fuzz:
+    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install deps
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev clang llvm libclang-rt-dev
+      - name: Fuzz exploration (30 min per target)
+        run: scripts/fuzz.sh all --max-total-time 1800 --seed 0
+      - name: Upload reproducers
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: fuzz-artifacts-nightly
+          path: build/fuzz/artifacts-*/
+          if-no-files-found: ignore
+
   soak:
     uses: ./.github/workflows/_soak.yml
     with:
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index c18a45d13..8cb464b19 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -22,6 +22,13 @@ concurrency:
 jobs:
   security:
     uses: ./.github/workflows/_security.yml
+    # The called job requests security-events:read to count code-scanning
+    # alerts; a reusable workflow cannot request more than its caller grants,
+    # so withholding this here fails the whole run at startup.
+    permissions:
+      contents: read
+      security-events: read
+      actions: read
     secrets: inherit
 
   lint:
@@ -57,9 +64,29 @@ jobs:
         run: |
           # The full .diff endpoint rejects large-but-valid PRs at 20k lines.
           # The paginated files endpoint remains filename-only for this gate.
-          FILES=$(gh api --paginate "repos/$REPO/pulls/$PR/files?per_page=100" --jq '.[].filename')
+          if FILES=$(gh api --paginate "repos/$REPO/pulls/$PR/files?per_page=100" --jq '.[].filename'); then
+            echo "file list: pulls/files API"
+          else
+            # The files endpoint renders the diff server-side too, and answers
+            # 422 "this diff is taking too long to generate" for a PR that
+            # regenerates a vendored parser (#2246: a 42 MB sql/parser.c) --
+            # so does the compare endpoint. The PR merge ref's first parent is
+            # the base, so a name-only diff across it is the same file list.
+            # depth 2 + blob:none fetches commits and trees only (well under
+            # 1 MB, under a second); nothing from the PR is checked out or run.
+            echo "::notice::pulls/files API failed; file list taken from refs/pull/$PR/merge"
+            CHANGES_GIT="$RUNNER_TEMP/changes.git"
+            git init -q --bare "$CHANGES_GIT"
+            git --git-dir="$CHANGES_GIT" fetch -q --depth=2 --filter=blob:none \
+              "https://github.com/$REPO" "refs/pull/$PR/merge"
+            FILES=$(git --git-dir="$CHANGES_GIT" diff --name-only --no-renames FETCH_HEAD^1 FETCH_HEAD)
+          fi
           printf '%s\n' "$FILES"
-          if printf '%s\n' "$FILES" | grep -qE '^(src/|internal/|install\.(sh|ps1)|scripts/build\.sh|scripts/smoke-test\.sh|scripts/smoke-local\.sh|scripts/smoke-fixture-server\.py|scripts/gen-third-party-notices\.sh|scripts/env\.sh|test-infrastructure/vm/(vm-smoke\.sh|windows-user-path-guard\.ps1)|Makefile\.cbm)'; then
+          # A here-string, not a pipe: under this shell's pipefail, grep -q
+          # exits on its first match, printf dies of SIGPIPE once the list
+          # outgrows the pipe buffer, and the MATCH is then reported as a
+          # failure -- product=false, smoke skipped, on the largest PRs.
+          if grep -qE '^(src/|internal/|install\.(sh|ps1)|scripts/build\.sh|scripts/smoke-test\.sh|scripts/smoke-local\.sh|scripts/smoke-fixture-server\.py|scripts/gen-third-party-notices\.sh|scripts/env\.sh|test-infrastructure/vm/(vm-smoke\.sh|windows-user-path-guard\.ps1)|Makefile\.cbm)' <<<"$FILES"; then
             echo "product=true" >> "$GITHUB_OUTPUT"
           else
             echo "product=false" >> "$GITHUB_OUTPUT"
@@ -147,6 +174,17 @@ jobs:
           CCACHE_DIR: ${{ github.workspace }}/.ccache
           CCACHE_MAXSIZE: 1000M
 
+  # ── Waste sanitizer, REPORT-ONLY: memory + CPU waste on this repository and
+  #    the per-function scaling lane (Linux). Deliberately NOT in ci-ok's needs:
+  #    it uploads evidence and prints the ratchet, it never blocks a merge. Only
+  #    product-code PRs pay for it. ──
+  memwaste:
+    needs: [changes]
+    if: ${{ !cancelled() && needs.changes.outputs.product == 'true' }}
+    uses: ./.github/workflows/_memwaste.yml
+    with:
+      mode: pr
+
   ci-ok:
     # The one required context (besides dco) — fails unless every PR stage
     # succeeded, so matrix renames can never silently deadlock merges. `skipped`
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 03abb518e..c0e796364 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,6 +44,13 @@ jobs:
   # ── Security (starts immediately, blocks only verify) ───────────
   security:
     uses: ./.github/workflows/_security.yml
+    # The called job requests security-events:read to count code-scanning
+    # alerts; a reusable workflow cannot request more than its caller grants,
+    # so withholding this here fails the whole run at startup.
+    permissions:
+      contents: read
+      security-events: read
+      actions: read
     secrets: inherit
 
   # ── 0. Preflight: refuse malformed dispatch inputs ──────────────
@@ -138,6 +145,15 @@ jobs:
       version: ${{ inputs.version }}
       use_release_artifacts: true
 
+  # ── Waste sanitizer, REPORT-ONLY ────────────────────────────────
+  # The same full run as the dry run, on the release commit. Not in
+  # release-draft's needs: the report is evidence for the release notes, never
+  # a publication gate.
+  memwaste:
+    uses: ./.github/workflows/_memwaste.yml
+    with:
+      mode: full
+
   # ── 6. Create DRAFT release ────────────────────────────────────
   # Requires smoke to have actually SUCCEEDED, not merely "not failed". The bare
   # !cancelled() && !failure() form is fail-OPEN: a skipped smoke is neither
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a208a62ca..f2d8bcb92 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -27,6 +27,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index aa91f91c3..e9b4f9357 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -1,7 +1,7 @@
 # Smoke invariants across the WIDEST set of GitHub-hosted runners. Builds the
 # production source path with explicit fault-injection test seams and runs
 # scripts/smoke-invariants.sh
-# (version/help, MCP initialize handshake [#513], all 14 tools invocable, malformed-
+# (version/help, MCP initialize handshake [#513], all registered tools invocable, malformed-
 # input resilience, clean EOF exit, shared-lib resolution, install dry-run).
 #
 # Maximizing platforms is the point: ubuntu-22.04 (older glibc → AlmaLinux/#182
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 96ce8f861..93596d06f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -55,7 +55,7 @@ src/
   foundation/       Arena allocator, hash table, string utils, platform compat
   store/            SQLite graph storage (WAL mode, FTS5)
   cypher/           Cypher query → SQL translation
-  mcp/              MCP server (JSON-RPC 2.0 over stdio, 14 tools)
+  mcp/              MCP server (JSON-RPC 2.0 over stdio, 17 tools)
   pipeline/         Multi-pass indexing pipeline
     pass_*.c        Individual pipeline passes (definitions, calls, usages, etc.)
     httplink.c      HTTP route extraction (Go/Express/Laravel/Ktor/Python)
@@ -149,6 +149,25 @@ If in doubt, open an issue and ask.
 - Run `scripts/test.sh` and `scripts/lint.sh` before submitting
 - Keep PRs focused — avoid unrelated reformatting or refactoring
 
+## AI-assisted and AI-authored contributions
+
+Contributions written with the help of an AI tool, or written by an AI agent acting for a person, are welcome here on the same terms as any other. What we review is the change, not who or what typed it. Three things make that work:
+
+- **Say so.** If an agent wrote the PR or is answering in the thread, disclose it — a line in the PR description or at the top of a comment is enough ("written with X", "this account is operated by an AI agent on behalf of Y"). Disclosure is never held against a contribution. Finding out later is.
+- **A person is accountable.** The [DCO sign-off](#license-and-sign-off-dco--required-on-every-commit) is a legal certification, and only a person can make it. The human behind the account certifies every commit, answers for it, and is who we talk to if something goes wrong. An agent may carry the conversation; it cannot carry the responsibility.
+- **The bar does not move.** Every claim in a PR must be something a reviewer can check: the failing test, the command that was run, the numbers and the machine they came from. "The model says it works" is not evidence, and a confident description does not replace a test that fails without the fix. We read AI-written PRs exactly as carefully as human-written ones — no more suspiciously, and no less.
+
+Two practical notes:
+
+- `Co-authored-by:` trailers naming a tool are fine. Links to private chat or agent sessions are not — they are dead to everyone else and do not belong in permanent history; we will ask you to remove them.
+- High-volume, low-effort submissions — many near-identical PRs, changes nobody ran, replies that do not engage with the review — will be closed, whoever or whatever produced them. One careful PR is worth more than twenty generated ones.
+
+### Who speaks for the project
+
+Only the maintainer account ([@DeusData](https://github.com/DeusData)) speaks for this project. A review, an approval, a "this will be merged" or a "this is a duplicate" from any other account is that person's opinion, however official it sounds — helpful reviews from the community are very welcome, and that is what they are.
+
+**Impersonating a maintainer is not acceptable**, by a person or by an agent: presenting yourself as part of the maintainer team, posting approvals or change requests styled as maintainer decisions, or telling other contributors what the project has decided. We dismiss such reviews, hide the comments, say publicly in the affected threads that they were not ours, and report and block the account. If you are unsure whether a response you received is from the project, check the account name — and ask.
+
 ## Security
 
 We take security seriously. All PRs go through:
diff --git a/Makefile.cbm b/Makefile.cbm
index 35844a529..7a3cd31e1 100644
--- a/Makefile.cbm
+++ b/Makefile.cbm
@@ -76,14 +76,15 @@ endif
 # the prod build uses mimalloc (MI_OVERRIDE=1); the test build is CRT+ASan, where
 # binding would create an alloc/free mismatch, so the guard is prod-only.
 CFLAGS_PROD = $(CFLAGS_COMMON) -O2 -DCBM_BIND_TS_ALLOCATOR=1 $(TEST_SEAM_DEFINE) \
-              $(GLOBAL_OVERRIDE_DEFINE) $(CFLAGS_EXTRA)
-CXXFLAGS_PROD = $(CXXFLAGS_COMMON) -O2
+              $(GLOBAL_OVERRIDE_DEFINE) $(MEMWASTE_CFLAGS) $(CFLAGS_EXTRA)
+CXXFLAGS_PROD = $(CXXFLAGS_COMMON) -O2 $(MEMWASTE_VENDOR_CFLAGS)
 
 # Test flags: debug + sanitizers (override SANITIZE= to disable on Windows)
 SANITIZE = -fsanitize=address,undefined -fno-omit-frame-pointer
 EDITOR_TEST_DEFINES = -DCBM_JSON_LIKE_ENABLE_TEST_API=1 \
 	-DCBM_TOML_EDIT_ENABLE_TEST_API=1 -DCBM_YAML_ENABLE_TEST_API=1 \
 	-DCBM_TEXT_EDIT_ENABLE_TEST_API=1 -DCBM_CLI_ENABLE_TEST_API=1 \
+	-DCBM_CONFIG_EDIT_PATH_ENABLE_TEST_API=1 \
 	-DCBM_DIAGNOSTICS_ENABLE_TEST_API=1 -DCBM_ENABLE_TEST_SEAMS=1
 # The build system is the single source of truth for "is this binary
 # instrumented": compiler-specific probes (__SANITIZE_ADDRESS__) miss
@@ -215,6 +216,75 @@ ELF_HARDENING_FLAGS := -Wl,-z,noexecstack -Wl,-z,separate-code \
 endif
 endif
 
+# MEMWASTE=1: the waste-sanitizer flavour (src/foundation/mem_events.h). Built
+# like production -- -O2, mimalloc, the real allocator routing -- plus the event
+# layer and its observers, because waste measured under ASan's allocator would
+# describe ASan. Frame pointers stay so the macOS observer can walk to the
+# caller. On Linux this is also what finally LINKS the --wrap observation shim:
+# its flags and source were defined here but never reached a link line, so the
+# Linux profiler had been reporting nothing.
+#
+# Every object is built this way, VENDORED ones included (grammars, the
+# tree-sitter runtime, SQLite, tre, lz4, zstd, the C++ preprocessor): waste in
+# a vendored parser is waste in this program. mimalloc alone is left as it is --
+# its reads and writes are the allocator's own bookkeeping, not program data.
+#
+# MEMWASTE_ACCESS=1 adds the access lane (reads and writes of every tracked
+# block through the compiler's load/store callbacks; clang only). It builds at
+# -O1 without vectorisation: at -O2 the callbacks describe the OPTIMISED program,
+# and reads the optimiser removed would be reported as never read.
+# MEMWASTE_PROFILE=1 adds clang's execution counters (-fprofile-instr-generate)
+# for the CPU scaling lane (scripts/memwaste-scaling.py).
+# Each flavour needs its own BUILD_DIR: vendored objects are not rebuilt when
+# only the flavour changes.
+#
+# The libc wrappers (mem_override_libc.c) need --wrap on Linux and Windows;
+# macOS defines the symbols instead. STATIC=1 (musl) is not a memwaste target.
+MEMWASTE ?= 0
+MEMWASTE_ACCESS ?= 0
+MEMWASTE_PROFILE ?= 0
+ifeq ($(MEMWASTE_ACCESS),1)
+override MEMWASTE := 1
+endif
+ifeq ($(MEMWASTE_PROFILE),1)
+override MEMWASTE := 1
+endif
+MEMWASTE_CFLAGS :=
+MEMWASTE_VENDOR_CFLAGS :=
+MEMWASTE_LDFLAGS :=
+MEMWASTE_SRCS :=
+MEMWASTE_ALLOC_SYMS_LINUX := malloc calloc realloc free strdup strndup posix_memalign \
+                             aligned_alloc memalign
+MEMWASTE_LIBC_SYMS_LINUX := memcpy memmove memset memcmp strlen strcmp strncmp \
+                            __memcpy_chk __memmove_chk __memset_chk read __read_chk write \
+                            pread pwrite pread64 pwrite64 open open64 __open_2 __open64_2 \
+                            stat lstat fopen fopen64 fread __fread_chk fwrite opendir readdir \
+                            pthread_mutex_lock
+MEMWASTE_LIBC_SYMS_WIN := memcpy memmove memset memcmp strlen strcmp strncmp _wfopen fread fwrite
+ifeq ($(MEMWASTE),1)
+MEMWASTE_CFLAGS := -DCBM_MEMWASTE=1 -fno-omit-frame-pointer
+MEMWASTE_VENDOR_CFLAGS := -DCBM_MEMWASTE=1 -fno-omit-frame-pointer
+ifeq ($(IS_LINUX),yes)
+MEMWASTE_LDFLAGS := $(foreach sym,$(MEMWASTE_ALLOC_SYMS_LINUX) $(MEMWASTE_LIBC_SYMS_LINUX),-Wl,--wrap=$(sym))
+MEMWASTE_SRCS := src/foundation/mem_override_posix.c
+endif
+ifeq ($(IS_MINGW),yes)
+MEMWASTE_LDFLAGS := $(foreach sym,$(MEMWASTE_LIBC_SYMS_WIN),-Wl,--wrap=$(sym))
+endif
+endif
+ifeq ($(MEMWASTE_ACCESS),1)
+MEMWASTE_ACCESS_FLAGS := -DCBM_MEMWASTE_ACCESS=1 -O1 -fno-vectorize -fno-slp-vectorize \
+                         -fsanitize-coverage=inline-bool-flag,trace-loads,trace-stores
+MEMWASTE_CFLAGS += $(MEMWASTE_ACCESS_FLAGS)
+MEMWASTE_VENDOR_CFLAGS += $(MEMWASTE_ACCESS_FLAGS)
+endif
+ifeq ($(MEMWASTE_PROFILE),1)
+MEMWASTE_PROFILE_FLAGS := -DCBM_MEMWASTE_PROFILE=1 -fprofile-instr-generate -fprofile-update=atomic
+MEMWASTE_CFLAGS += $(MEMWASTE_PROFILE_FLAGS)
+MEMWASTE_VENDOR_CFLAGS += $(MEMWASTE_PROFILE_FLAGS)
+MEMWASTE_LDFLAGS += $(MEMWASTE_PROFILE_FLAGS)
+endif
+
 # The POSIX wrap shim exists only so the profiler can observe allocations. It
 # must never reach a sanitized build: the Linux/macOS test builds are CRT+ASan,
 # and redirecting malloc into mimalloc underneath ASan's own interception mixes
@@ -224,7 +294,7 @@ endif
 # instead of the system libstdc++ (scripts/msan.sh overrides both vars).
 CXX_STDLIB ?= -lstdc++
 CXX_STDLIB_FLAGS ?=
-LDFLAGS = -lm $(CXX_STDLIB) -lpthread -lz $(WIN32_LIBS) $(STATIC_FLAGS) $(MIMALLOC_WRAP_FLAGS) $(ELF_HARDENING_FLAGS)
+LDFLAGS = -lm $(CXX_STDLIB) -lpthread -lz $(WIN32_LIBS) $(STATIC_FLAGS) $(MIMALLOC_WRAP_FLAGS) $(MEMWASTE_LDFLAGS) $(ELF_HARDENING_FLAGS)
 LDFLAGS_TEST = -lm $(CXX_STDLIB) -lpthread -lz $(SANITIZE) $(WIN32_LIBS) $(MIMALLOC_WRAP_FLAGS) $(ELF_HARDENING_FLAGS)
 LDFLAGS_TSAN = -lm $(CXX_STDLIB) -lpthread -lz $(TSAN_SANITIZE) $(WIN32_LIBS) $(MIMALLOC_WRAP_FLAGS) $(ELF_HARDENING_FLAGS)
 
@@ -247,10 +317,15 @@ FOUNDATION_SRCS = \
     src/foundation/compat_fs.c \
     src/foundation/compat_regex.c \
     src/foundation/mem.c \
+    src/foundation/mem_core.c \
+    src/foundation/mem_events.c \
+    src/foundation/mem_override_darwin.c \
+    src/foundation/mem_override_libc.c \
     src/foundation/diagnostics.c \
     src/foundation/profile.c \
     src/foundation/dump_verify.c \
     src/foundation/limits.c \
+    src/foundation/index_policy.c \
     src/foundation/subprocess.c \
     src/foundation/sha256.c \
     src/foundation/secure_random.c \
@@ -274,6 +349,8 @@ EXTRACTION_SRCS = \
     $(CBM_DIR)/extract_k8s.c \
     $(CBM_DIR)/extract_dbt.c \
     $(CBM_DIR)/helpers.c \
+    $(CBM_DIR)/result_compact.c \
+    $(CBM_DIR)/result_spill.c \
     $(CBM_DIR)/lang_specs.c \
     $(CBM_DIR)/macro_table.c \
     $(CBM_DIR)/iris_export_xml.c \
@@ -372,6 +449,7 @@ PIPELINE_SRCS = \
     src/pipeline/pass_gitdiff.c \
     src/pipeline/pass_configures.c \
     src/pipeline/pass_configlink.c \
+    src/pipeline/pass_doclinks.c \
     src/pipeline/pass_route_nodes.c \
     src/pipeline/pass_enrichment.c \
     src/pipeline/pass_envscan.c \
@@ -409,7 +487,7 @@ GIT_SRCS = src/git/git_context.c
 CLI_SRCS = src/cli/cli.c src/cli/progress_sink.c src/cli/hook_augment.c src/cli/client_adapter.c \
 	src/cli/agent_clients.c src/cli/agent_profiles.c \
 	src/cli/config_json_like.c src/cli/config_toml_edit.c src/cli/config_yaml_edit.c \
-	src/cli/config_text_edit.c src/cli/activation_transaction.c
+	src/cli/config_text_edit.c src/cli/config_edit_path.c src/cli/activation_transaction.c
 
 # UI module (graph visualization)
 UI_SRCS = \
@@ -468,10 +546,19 @@ ifneq ($(filter yes,$(IS_MINGW) $(IS_LINUX)),)
 MIMALLOC_OVERRIDE_DEFINE := -DMI_MALLOC_OVERRIDE=1
 GLOBAL_OVERRIDE_DEFINE := -DCBM_MEM_GLOBAL_OVERRIDE=1
 endif
+# MI_DEBUG=0: the production allocator is mimalloc's RELEASE build. Its header
+# defaults to MI_DEBUG=2 unless NDEBUG is defined, and nothing here defined it,
+# so every shipped binary up to v0.11.0 ran mimalloc's debug build: internal
+# assertions, fine-grained statistics, padding on every block and a memset of
+# every freed block. The waste sanitizer measured it on the Go corpus as 92 GB
+# (macOS) and 444 GB (Linux, where mimalloc also serves libc's malloc) of byte
+# work inside the allocator (2026-09-17). Committed-bytes accounting, which the
+# memory budget reads, is kept in every build (subproc stats, not MI_STAT).
+# The TEST build below keeps mimalloc's debug checks.
 MIMALLOC_CFLAGS = -std=c11 -O2 -w \
                   -Ivendored/mimalloc/include \
                   -Ivendored/mimalloc/src \
-                  -DMI_OVERRIDE=1 \
+                  -DMI_OVERRIDE=1 -DMI_DEBUG=0 \
                   $(MIMALLOC_OVERRIDE_DEFINE)
 MIMALLOC_CFLAGS_TEST = -std=c11 -g -O1 -w \
                        -Ivendored/mimalloc/include \
@@ -492,7 +579,7 @@ MIMALLOC_CFLAGS_TEST = -std=c11 -g -O1 -w \
 SQLITE3_OMIT_FLAGS = -DSQLITE_OMIT_LOAD_EXTENSION
 SQLITE3_SRC = vendored/sqlite3/sqlite3.c
 SQLITE3_CFLAGS = -std=c11 -O2 -w -DSQLITE_DQS=0 -DSQLITE_THREADSAFE=1 -DSQLITE_ENABLE_FTS5 \
-                 $(SQLITE3_OMIT_FLAGS)
+                 $(SQLITE3_OMIT_FLAGS) $(MEMWASTE_VENDOR_CFLAGS)
 SQLITE3_CFLAGS_TEST = -std=c11 -g -O1 -w -DSQLITE_DQS=0 -DSQLITE_THREADSAFE=1 -DSQLITE_ENABLE_FTS5 \
                       $(SQLITE3_OMIT_FLAGS)
 
@@ -504,7 +591,7 @@ TRE_CFLAGS = -std=c11 -g -O1 -w -Ivendored/tre
 YYJSON_SRC = vendored/yyjson/yyjson.c
 
 # All production sources
-PROD_SRCS = $(FOUNDATION_SRCS) $(STORE_SRCS) $(CYPHER_SRCS) $(MCP_SRCS) $(DAEMON_SRCS) $(DISCOVER_SRCS) $(GRAPH_BUFFER_SRCS) $(PIPELINE_SRCS) $(SIMHASH_SRCS) $(SEMANTIC_SRCS) $(TRACES_SRCS) $(WATCHER_SRCS) $(GIT_SRCS) $(CLI_SRCS) $(UI_SRCS) $(YYJSON_SRC)
+PROD_SRCS = $(MEMWASTE_SRCS) $(FOUNDATION_SRCS) $(STORE_SRCS) $(CYPHER_SRCS) $(MCP_SRCS) $(DAEMON_SRCS) $(DISCOVER_SRCS) $(GRAPH_BUFFER_SRCS) $(PIPELINE_SRCS) $(SIMHASH_SRCS) $(SEMANTIC_SRCS) $(TRACES_SRCS) $(WATCHER_SRCS) $(GIT_SRCS) $(CLI_SRCS) $(UI_SRCS) $(YYJSON_SRC)
 EXISTING_C_SRCS = $(EXTRACTION_SRCS) $(LSP_SRCS) $(TS_RUNTIME_SRC) \
                   $(GRAMMAR_SRCS) $(AC_LZ4_SRCS) $(ZSTD_SRCS) $(SQLITE_WRITER_SRC)
 
@@ -532,6 +619,7 @@ TEST_FOUNDATION_SRCS = \
     tests/test_str_intern.c \
     tests/test_log.c \
     tests/test_str_util.c \
+    tests/test_index_policy.c \
     tests/test_workspace.c \
     tests/test_platform.c \
     tests/test_diagnostics.c \
@@ -588,7 +676,7 @@ TEST_DISCOVER_SRCS = \
 
 TEST_GRAPH_BUFFER_SRCS = tests/test_graph_buffer.c
 
-TEST_PIPELINE_SRCS = tests/test_registry.c tests/test_pipeline.c tests/test_importance.c tests/test_cross_repo.c tests/test_fqn.c tests/test_route_canon.c tests/test_path_alias.c tests/test_configlink.c tests/test_infrascan.c tests/test_worker_pool.c tests/test_parallel.c tests/test_index_resilience.c tests/test_index_format.c tests/test_call_reference_contract.c tests/repro/repro_call_scope_usages.c tests/repro/repro_call_argument_usages.c tests/repro/repro_reference_precision.c tests/repro/repro_lexical_binding_precision.c tests/repro/repro_call_argument_matrix_a.c tests/repro/repro_call_argument_matrix_b.c tests/repro/repro_call_node_behaviors.c tests/repro/repro_language_registry.c tests/repro/repro_call_node_manifest.c tests/repro/repro_lsp_ordered_signatures.c tests/repro/repro_lsp_ordered_local.c tests/repro/repro_ts_overload_return_chains.c tests/repro/repro_harness_cleanup.c tests/repro/repro_runner_filter.c
+TEST_PIPELINE_SRCS = tests/test_registry.c tests/test_pipeline.c tests/test_importance.c tests/test_cross_repo.c tests/test_fqn.c tests/test_route_canon.c tests/test_path_alias.c tests/test_configlink.c tests/test_doclinks.c tests/test_infrascan.c tests/test_worker_pool.c tests/test_parallel.c tests/test_index_resilience.c tests/test_index_format.c tests/test_call_reference_contract.c tests/repro/repro_call_scope_usages.c tests/repro/repro_call_argument_usages.c tests/repro/repro_reference_precision.c tests/repro/repro_lexical_binding_precision.c tests/repro/repro_call_argument_matrix_a.c tests/repro/repro_call_argument_matrix_b.c tests/repro/repro_call_node_behaviors.c tests/repro/repro_language_registry.c tests/repro/repro_call_node_manifest.c tests/repro/repro_lsp_ordered_signatures.c tests/repro/repro_lsp_ordered_local.c tests/repro/repro_ts_overload_return_chains.c tests/repro/repro_harness_cleanup.c tests/repro/repro_runner_filter.c
 
 TEST_WATCHER_SRCS = tests/test_watcher.c
 
@@ -637,7 +725,7 @@ TEST_CLI_SRCS = tests/test_cli.c tests/test_agent_clients.c tests/test_agent_pro
 	tests/test_config_toml_edit.c tests/test_config_yaml_edit.c tests/test_config_text_edit.c \
 	tests/test_activation_transaction.c
 
-TEST_MEM_SRCS = tests/test_mem.c
+TEST_MEM_SRCS = tests/test_mem.c tests/test_mem_events.c
 
 TEST_UI_SRCS = tests/test_ui.c
 TEST_HTTPD_SRCS = tests/test_httpd.c
@@ -742,7 +830,8 @@ BUILD_DIR = build/c
 # ── Object file compilation (grammars need relaxed warnings) ─────
 
 # Grammar + tree-sitter runtime: compiled without -Werror (upstream code has warnings)
-GRAMMAR_CFLAGS = -std=c11 -D_DEFAULT_SOURCE -O2 -w -I$(CBM_DIR) -I$(TS_INCLUDE) -I$(TS_SRC)
+GRAMMAR_CFLAGS = -std=c11 -D_DEFAULT_SOURCE -O2 -w -I$(CBM_DIR) -I$(TS_INCLUDE) -I$(TS_SRC) \
+                 $(MEMWASTE_VENDOR_CFLAGS)
 GRAMMAR_CFLAGS_TEST = -std=c11 -D_DEFAULT_SOURCE -g -O1 -w -I$(CBM_DIR) -I$(TS_INCLUDE) -I$(TS_SRC) \
                       -DCBM_ENABLE_TEST_SEAMS=1 $(SANITIZED_DEFINE) $(SANITIZE)
 GRAMMAR_CFLAGS_TSAN = -std=c11 -D_DEFAULT_SOURCE -g -O1 -w -I$(CBM_DIR) -I$(TS_INCLUDE) -I$(TS_SRC) \
@@ -760,7 +849,7 @@ PP_OBJ_TSAN = $(BUILD_DIR)/tsan_preprocessor.o
 
 # ── Targets ──────────────────────────────────────────────────────
 
-.PHONY: test test-par test-repro test-foundation test-tsan test-daemon-smoke cbm cbm-with-ui frontend embed clean-c lint lint-tidy lint-tidy-diff lint-cppcheck lint-format security
+.PHONY: test test-par test-repro test-foundation test-tsan test-daemon-smoke cbm cbm-with-ui frontend embed clean-c lint lint-tidy lint-tidy-diff lint-cppcheck lint-format security fuzz
 
 $(BUILD_DIR):
 	mkdir -p $(BUILD_DIR)
@@ -775,7 +864,24 @@ test-foundation: $(BUILD_DIR)/test-foundation
 
 # ── Grammar/TS/LSP object files (compiled with relaxed warnings) ─
 
-$(BUILD_DIR)/%.o: $(CBM_DIR)/%.c | $(BUILD_DIR)
+# Each grammar_<lang>.c is a unity object that #includes its own vendored
+# parser.c and, where the grammar has one, scanner.c. Those includes were
+# prerequisites of nothing, so editing a vendored scanner left the object
+# untouched and the edit silently absent from the binary: on 2026-09-19 a fix
+# to properties/scanner.c appeared not to work at all, and `nm` showed the old
+# symbol still sitting in prod_grammar_properties.o. MANIFEST.md's "Local
+# source patches" table means patching a vendored scanner is expected, so this
+# trap is reachable by design. Same reasoning as LSP_UNITY_DEPS and
+# TS_RUNTIME_DEPS above; secondary expansion is what lets one pattern rule name
+# each grammar's own directory ($$* is the stem, grammar_properties ->
+# properties). Non-grammar objects match no directory and gain no prerequisite.
+GRAMMAR_VENDOR_DIR = $(CBM_DIR)/vendored/grammars/$$(subst grammar_,,$$*)
+GRAMMAR_UNITY_DEPS = $$(wildcard $(GRAMMAR_VENDOR_DIR)/*.c) \
+                     $$(wildcard $(GRAMMAR_VENDOR_DIR)/*.h) \
+                     $$(wildcard $(GRAMMAR_VENDOR_DIR)/tree_sitter/*.h)
+.SECONDEXPANSION:
+
+$(BUILD_DIR)/%.o: $(CBM_DIR)/%.c $(GRAMMAR_UNITY_DEPS) | $(BUILD_DIR)
 	$(CC) $(GRAMMAR_CFLAGS_TEST) -c -o $@ $<
 
 $(BUILD_DIR)/ts_runtime.o: $(TS_RUNTIME_DEPS) | $(BUILD_DIR)
@@ -787,7 +893,7 @@ $(BUILD_DIR)/lsp_all.o: $(LSP_UNITY_DEPS) | $(BUILD_DIR)
 $(BUILD_DIR)/preprocessor.o: $(CBM_DIR)/preprocessor.cpp | $(BUILD_DIR)
 	$(CXX) $(CXXFLAGS_TEST) -w -I$(CBM_DIR)/vendored -c -o $@ $<
 
-$(BUILD_DIR)/tsan_%.o: $(CBM_DIR)/%.c | $(BUILD_DIR)
+$(BUILD_DIR)/tsan_%.o: $(CBM_DIR)/%.c $(GRAMMAR_UNITY_DEPS) | $(BUILD_DIR)
 	$(CC) $(GRAMMAR_CFLAGS_TSAN) -c -o $@ $<
 
 $(BUILD_DIR)/tsan_ts_runtime.o: $(TS_RUNTIME_DEPS) | $(BUILD_DIR)
@@ -864,7 +970,7 @@ $(BUILD_DIR)/tsan_tre.o: $(TRE_SRC) | $(BUILD_DIR)
 	$(CC) $(TRE_CFLAGS) $(TSAN_SANITIZE) -c -o $@ $<
 
 $(BUILD_DIR)/prod_tre.o: $(TRE_SRC) | $(BUILD_DIR)
-	$(CC) $(TRE_CFLAGS) -O2 -c -o $@ $<
+	$(CC) $(TRE_CFLAGS) -O2 $(MEMWASTE_VENDOR_CFLAGS) -c -o $@ $<
 endif
 
 # Vendored LZ4 (test build)
@@ -1017,7 +1123,7 @@ TS_RUNTIME_OBJ_PROD = $(BUILD_DIR)/prod_ts_runtime.o
 LSP_OBJ_PROD = $(BUILD_DIR)/prod_lsp_all.o
 PP_OBJ_PROD = $(BUILD_DIR)/prod_preprocessor.o
 
-$(BUILD_DIR)/prod_%.o: $(CBM_DIR)/%.c | $(BUILD_DIR)
+$(BUILD_DIR)/prod_%.o: $(CBM_DIR)/%.c $(GRAMMAR_UNITY_DEPS) | $(BUILD_DIR)
 	$(CC) $(GRAMMAR_CFLAGS) -c -o $@ $<
 
 $(BUILD_DIR)/prod_ts_runtime.o: $(TS_RUNTIME_DEPS) | $(BUILD_DIR)
@@ -1032,14 +1138,14 @@ $(BUILD_DIR)/prod_preprocessor.o: $(CBM_DIR)/preprocessor.cpp | $(BUILD_DIR)
 # Vendored LZ4 (compiled separately, not unity-built via lz4_store.c)
 LZ4_OBJ_PROD = $(BUILD_DIR)/prod_lz4.o $(BUILD_DIR)/prod_lz4hc.o
 $(BUILD_DIR)/prod_lz4.o: $(CBM_DIR)/vendored/lz4/lz4.c | $(BUILD_DIR)
-	$(CC) -std=c11 -D_DEFAULT_SOURCE -O2 -w -I$(CBM_DIR) -c -o $@ $<
+	$(CC) -std=c11 -D_DEFAULT_SOURCE -O2 -w $(MEMWASTE_VENDOR_CFLAGS) -I$(CBM_DIR) -c -o $@ $<
 $(BUILD_DIR)/prod_lz4hc.o: $(CBM_DIR)/vendored/lz4/lz4hc.c | $(BUILD_DIR)
-	$(CC) -std=c11 -D_DEFAULT_SOURCE -O2 -w -I$(CBM_DIR)/vendored/lz4 -c -o $@ $<
+	$(CC) -std=c11 -D_DEFAULT_SOURCE -O2 -w $(MEMWASTE_VENDOR_CFLAGS) -I$(CBM_DIR)/vendored/lz4 -c -o $@ $<
 
 # Vendored zstd (compiled separately, not unity-built via zstd_store.c)
 ZSTD_OBJ_PROD = $(BUILD_DIR)/prod_zstd.o
 $(BUILD_DIR)/prod_zstd.o: $(CBM_DIR)/vendored/zstd/zstd.c | $(BUILD_DIR)
-	$(CC) -std=c11 -D_DEFAULT_SOURCE -O2 -w -I$(CBM_DIR)/vendored/zstd -c -o $@ $<
+	$(CC) -std=c11 -D_DEFAULT_SOURCE -O2 -w $(MEMWASTE_VENDOR_CFLAGS) -I$(CBM_DIR)/vendored/zstd -c -o $@ $<
 
 OBJS_VENDORED_PROD = $(MIMALLOC_OBJ_PROD) $(SQLITE3_OBJ_PROD) $(TRE_OBJ_PROD) $(GRAMMAR_OBJS_PROD) $(TS_RUNTIME_OBJ_PROD) $(LSP_OBJ_PROD) $(PP_OBJ_PROD) $(LZ4_OBJ_PROD) $(ZSTD_OBJ_PROD) $(UNIXCODER_OBJ)
 
@@ -1061,7 +1167,7 @@ MAIN_SRC = src/main.c
 # for trap debugging -- silently re-run the previously instrumented binary,
 # which during this bisect produced a "crashes without sanitizers too" result
 # that was pure artifact and sent the investigation down the wrong path.
-BUILD_CONFIG_SIG := TEST_SEAMS=$(TEST_SEAMS)|CFLAGS_EXTRA=$(CFLAGS_EXTRA)|SANITIZE=$(SANITIZE)
+BUILD_CONFIG_SIG := TEST_SEAMS=$(TEST_SEAMS)|CFLAGS_EXTRA=$(CFLAGS_EXTRA)|SANITIZE=$(SANITIZE)|MEMWASTE=$(MEMWASTE)|MEMWASTE_ACCESS=$(MEMWASTE_ACCESS)|MEMWASTE_PROFILE=$(MEMWASTE_PROFILE)
 .PHONY: build-config-check
 build-config-check:
 $(BUILD_DIR)/.build-config: build-config-check | $(BUILD_DIR)
@@ -1187,8 +1293,17 @@ lint-no-suppress:
 lint: lint-tidy lint-cppcheck lint-format lint-no-suppress
 	@echo "=== All linters passed ==="
 
+# Memory-core linter: memory is allocated through src/foundation/mem_core.h,
+# not through raw malloc/calloc/realloc/free/strdup. A checked-in baseline
+# (scripts/memory-core-baseline.txt) records each file's raw-site count and the
+# gate goes red the moment any file grows. Files only ever go down; lower the
+# baseline line in the same change that migrates the file.
+lint-memory-core:
+	@echo "=== memory-core linter ==="
+	@python3 scripts/lint-memory-core.py
+
 # CI linters (no clang-tidy — platform-dependent, enforced locally via pre-commit)
-lint-ci: lint-cppcheck lint-format lint-no-suppress
+lint-ci: lint-cppcheck lint-format lint-no-suppress lint-memory-core
 	@echo "=== CI linters passed ==="
 
 # ── Local memory-diagnostic lanes (not PR-CI gates by decision: the diag
@@ -1248,6 +1363,28 @@ test-lsan:
 	cd $(CURDIR) && ASAN_OPTIONS="detect_leaks=1:halt_on_error=1" \
 		./build/lsan/test-runner $(LSAN_SUITES)
 
+# ── Coverage-guided fuzzing (libFuzzer) ─────────────────────────
+# One binary, three targets (tests/fuzz/cbm_fuzz.c): the per-file extractor,
+# the Cypher parser, the TOML/YAML/JSON config editors. ASan+UBSan as in the
+# test lane, plus fuzzer-no-link on EVERY object -- the vendored grammars and
+# the tree-sitter runtime feed coverage back, which is where the parser state
+# space lives. Needs a clang that ships libFuzzer (Homebrew LLVM on macOS; Apple
+# clang does not). Run through scripts/fuzz.sh.
+FUZZ_CC ?= clang
+FUZZ_CXX ?= clang++
+FUZZ_SANITIZE = -fsanitize=address,undefined,fuzzer-no-link -fno-omit-frame-pointer
+FUZZ_SRC = tests/fuzz/cbm_fuzz.c
+fuzz:
+	$(MAKE) -f Makefile.cbm build/fuzz/cbm-fuzz BUILD_DIR=build/fuzz \
+		CC=$(FUZZ_CC) CXX=$(FUZZ_CXX) SANITIZE="$(FUZZ_SANITIZE)"
+
+$(BUILD_DIR)/cbm-fuzz: $(FUZZ_SRC) $(PROD_SRCS) $(EXTRACTION_SRCS) $(AC_LZ4_SRCS) $(ZSTD_SRCS) $(SQLITE_WRITER_SRC) $(OBJS_VENDORED_TEST) $(PROJECT_HDRS) | $(BUILD_DIR)
+	$(CC) $(CFLAGS_TEST) -fsanitize=fuzzer -o $@ \
+		$(FUZZ_SRC) $(PROD_SRCS) \
+		$(EXTRACTION_SRCS) $(AC_LZ4_SRCS) $(ZSTD_SRCS) $(SQLITE_WRITER_SRC) \
+		$(OBJS_VENDORED_TEST) \
+		$(LDFLAGS_TEST)
+
 # Path-sensitive memory analysis: leak paths, null derefs, uninitialized reads.
 # Non-gating: triage findings against the code (this lane's first run produced
 # 9 real fixes and 6 recorded false positives — see the analyzer batch commit).
diff --git a/README.md b/README.md
index c6ab67ee2..9c82c18ae 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 [![GitHub Release](https://img.shields.io/github/v/release/DeusData/codebase-memory-mcp?style=flat&color=blue)](https://github.com/DeusData/codebase-memory-mcp/releases/latest)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![CI](https://img.shields.io/github/actions/workflow/status/DeusData/codebase-memory-mcp/dry-run.yml?label=CI)](https://github.com/DeusData/codebase-memory-mcp/actions/workflows/dry-run.yml)
-[![Tests](https://img.shields.io/badge/tests-6768_passing-brightgreen)](https://github.com/DeusData/codebase-memory-mcp)
+[![Tests](https://img.shields.io/badge/tests-8050_passing-brightgreen)](https://github.com/DeusData/codebase-memory-mcp)
 [![Languages](https://img.shields.io/badge/languages-162-orange)](https://github.com/DeusData/codebase-memory-mcp)
 [![Hybrid LSP](https://img.shields.io/badge/Hybrid_LSP-10_languages-blue)](#hybrid-lsp)
 [![Agents](https://img.shields.io/badge/agent_surfaces-45-purple)](https://github.com/DeusData/codebase-memory-mcp)
@@ -16,7 +16,7 @@
 
 **The fastest and most efficient code intelligence engine for AI coding agents.** Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. Ships as a native executable with a small verified runtime-asset set for macOS, Linux, and Windows — download, run `install`, done.
 
-High-quality parsing through [tree-sitter](https://tree-sitter.github.io/tree-sitter/) AST analysis across all 162 languages, enhanced with [**Hybrid LSP** semantic type resolution](#hybrid-lsp) for Python, TypeScript / JavaScript / JSX / TSX, PHP, C#, Go, C, C++, Java, Kotlin, Rust, and Perl — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 15 MCP tools. No language runtime, hosted service, or API key. Plug and play across 45 supported automatic/conditional client surfaces.
+High-quality parsing through [tree-sitter](https://tree-sitter.github.io/tree-sitter/) AST analysis across all 162 languages, enhanced with [**Hybrid LSP** semantic type resolution](#hybrid-lsp) for Python, TypeScript / JavaScript / JSX / TSX, PHP, C#, Go, C, C++, Java, Kotlin, Rust, and Perl — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 17 MCP tools. No language runtime, hosted service, or API key. Plug and play across 45 supported automatic/conditional client surfaces.
 
 > **Research** — The design and benchmarks behind this project are described in the preprint [*Codebase-Memory: Tree-Sitter-Based Knowledge Graphs for LLM Code Exploration via MCP*](https://arxiv.org/abs/2603.27277) (arXiv:2603.27277). Evaluated across 31 real-world repositories: 83% answer quality, 10× fewer tokens, 2.1× fewer tool calls vs. file-by-file exploration.
 
@@ -37,7 +37,7 @@ High-quality parsing through [tree-sitter](https://tree-sitter.github.io/tree-si
 - **45 supported automatic/conditional client surfaces** — `install` configures detected clients and safely activates conditional clients only when their documented platform, marker, or explicit existing config path is present. See [Multi-Agent Support](#multi-agent-support) for the complete matrix and manual/UI-only boundaries.
 - **Built-in graph visualization** — 3D interactive UI at `localhost:9749`, served from the binary itself.
 - **Infrastructure-as-code indexing** — Dockerfiles, Kubernetes manifests, and Kustomize overlays indexed as graph nodes with cross-references. `Resource` nodes for K8s kinds, `Module` nodes for Kustomize overlays with `IMPORTS` edges to referenced resources.
-- **15 MCP tools** — search, trace, architecture, impact analysis, targeted index-coverage checks, Cypher queries, dead code detection, cross-service HTTP linking, ADR management, and more.
+- **17 MCP tools** — search, trace, architecture, impact analysis, targeted index-coverage checks, Cypher queries, dead code detection, cross-service HTTP linking, ADR management, and more.
 
 ## Quick Start
 
@@ -425,7 +425,7 @@ scripts/build.sh                    # without the UI (development only)
 
 Every platform ships **one self-contained executable**: the graph UI and the agent integration templates are linked into the binary, so an extracted archive is immediately complete.
 
-Run the test suite (6,768 tests across 120 suites):
+Run the test suite (8,060 tests across 141 suites):
 
 ```bash
 scripts/test.sh                     # full: clean sanitizer build + all suites + guards
@@ -461,7 +461,7 @@ Add to `~/.claude.json` (user scope) or project `.mcp.json`:
 }
 ```
 
-Restart your agent. Verify with `/mcp` — you should see `codebase-memory-mcp` with 15 tools.
+Restart your agent. Verify with `/mcp` — you should see `codebase-memory-mcp` with 17 tools.
 
 </details>
 
@@ -673,6 +673,7 @@ JSON arguments can also be piped on stdin, for tools that take arguments. A tool
 | `list_projects` | List all indexed projects with node/edge counts. |
 | `delete_project` | Remove a project and all its graph data. |
 | `index_status` | Check indexing status of a project. |
+| `check_index_coverage` | Check whether exact paths or a scope are indexed and fresh. A clean result means no recorded gap, not proof of completeness. |
 
 ### Querying
 
@@ -683,7 +684,9 @@ JSON arguments can also be piped on stdin, for tools that take arguments. A tool
 | `detect_changes` | Map git diff to affected symbols + blast radius with risk classification. |
 | `query_graph` | Execute Cypher-like graph queries (read-only). |
 | `get_graph_schema` | Node/edge counts, relationship patterns, property definitions per label. Run this first. |
+| `compare_graphs` | Compare two indexed snapshots: node/edge additions and removals between a base and a target. |
 | `get_code_snippet` | Read source code for a function by qualified name. |
+| `get_file_outline` | Declaration outline of one repository-relative file in source order, with optional label filter and paging. |
 | `get_architecture` | Codebase overview: languages, packages, routes, hotspots, clusters, ADR. |
 | `search_code` | Grep-like text search within indexed project files. |
 | `manage_adr` | CRUD for Architecture Decision Records (`get` reads, `update` replaces the whole document, `set_sections` rewrites only the named sections and leaves every other byte untouched, `sections` lists headings). Query modes do not wait behind a same-project reindex; writes remain serialized. |
@@ -701,7 +704,7 @@ JSON arguments can also be piped on stdin, for tools that take arguments. A tool
 
 ### Edge Types
 
-`CONTAINS_PACKAGE`, `CONTAINS_FOLDER`, `CONTAINS_FILE`, `DEFINES`, `DEFINES_METHOD`, `IMPORTS`, `CALLS`, `CALL_REFERENCE`, `HTTP_CALLS`, `ASYNC_CALLS`, `IMPLEMENTS`, `HANDLES`, `USAGE`, `CONFIGURES`, `WRITES`, `MEMBER_OF`, `TESTS`, `USES_TYPE`, `FILE_CHANGES_WITH`
+`CONTAINS_PACKAGE`, `CONTAINS_FOLDER`, `CONTAINS_FILE`, `DEFINES`, `DEFINES_METHOD`, `IMPORTS`, `CALLS`, `CALL_REFERENCE`, `HTTP_CALLS`, `ASYNC_CALLS`, `IMPLEMENTS`, `HANDLES`, `USAGE`, `CONFIGURES`, `REFERENCES_FILE`, `WRITES`, `MEMBER_OF`, `TESTS`, `USES_TYPE`, `FILE_CHANGES_WITH`
 
 ### Qualified Names
 
@@ -733,9 +736,15 @@ codebase-memory-mcp config set auto_index true           # auto-index on session
 codebase-memory-mcp config set auto_index_limit 50000    # max files for auto-index
 codebase-memory-mcp config set auto_watch false          # don't register background git watcher (default: true)
 codebase-memory-mcp config set watcher_enabled false     # stop the watcher thread entirely (default: true)
+codebase-memory-mcp config set index_max_files 250000    # optional per-index source-file limit
+codebase-memory-mcp config set index_max_source_mb 16384 # optional per-index source-size limit
 codebase-memory-mcp config reset auto_index              # reset to default
 ```
 
+The two `index_max_*` settings default to `off`. Exceeding one fails the complete
+index attempt rather than publishing a partial graph; an existing serving index
+is preserved. See [Index resource limits](docs/INDEX_RESOURCE_LIMITS.md).
+
 ### Environment Variables
 
 | Variable | Default | Description |
@@ -843,7 +852,7 @@ Also supported (not yet benchmarked): Ada, Agda, Apex, Assembly (NASM), Astro, A
 src/
   main.c              Entry point (MCP stdio server + CLI + install/update/config)
   daemon/             Per-account session coordination, IPC, lifecycle, shared jobs/watchers
-  mcp/                MCP server (15 tools, JSON-RPC 2.0, session detection, auto-index)
+  mcp/                MCP server (17 tools, JSON-RPC 2.0, session detection, auto-index)
   cli/                Install/uninstall/update/config (45 client surfaces, hooks, instructions)
   store/              SQLite graph storage (nodes, edges, traversal, search, Louvain)
   pipeline/           Multi-pass indexing (structure → definitions → calls → HTTP links → config → tests)
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 862d591c3..038256976 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -89,6 +89,8 @@ Current keys:
 | `auto_index_limit` | `50000` | Maximum file count allowed for automatic indexing of a new project. |
 | `auto_watch` | `true` | Register the session's project with the background git watcher on connect. Set `false` to keep a session from registering its project (the watcher still runs for other projects). |
 | `watcher_enabled` | `true` | Master switch for the background watcher subsystem. Set `false` to stop the watcher from starting at all — no poll thread and no project registration. Reindex manually with `index_repository` when disabled. |
+| `index_max_files` | `off` | Optional maximum number of accepted source files in one discovery run. |
+| `index_max_source_mb` | `off` | Optional maximum accepted source size in MiB in one discovery run. |
 
 > **`watcher_enabled` vs `auto_watch`.** `watcher_enabled` controls whether the
 > watcher *subsystem* starts at all (the background poll thread). `auto_watch` is
@@ -116,6 +118,14 @@ Current keys:
 > `auto_index` still runs, and `index_repository` stays available for manual
 > reindexing.
 
+The two `index_max_*` settings are independent and disabled by default. They
+apply to explicit indexing, automatic indexing, and watcher re-indexing, but not
+to `cross-repo-intelligence`, which does not scan repository source files.
+Equality is allowed; exceeding either setting fails the complete index request
+and preserves any previously serving database. See
+[Index resource limits](INDEX_RESOURCE_LIMITS.md) for counting, validation, and
+error-response details.
+
 ## 3. UI Settings
 
 The optional built-in graph UI stores its settings in:
diff --git a/docs/INDEX_RESOURCE_LIMITS.md b/docs/INDEX_RESOURCE_LIMITS.md
new file mode 100644
index 000000000..a3d57e015
--- /dev/null
+++ b/docs/INDEX_RESOURCE_LIMITS.md
@@ -0,0 +1,68 @@
+# Index resource limits
+
+Index resource limits are optional operator controls for repositories whose
+discovery breadth is not known in advance. They are disabled by default so
+existing large-repository workloads retain their current behavior.
+
+## Discovery settings
+
+| Key | Default | Accepted value | Protects |
+|---|---:|---:|---|
+| `index_max_files` | `off` | `off` or `1..10000000` | Accepted source-file count |
+| `index_max_source_mb` | `off` | `off` or `1..1048576` | Accepted source-file bytes |
+
+Set or reset them with the normal configuration command:
+
+```bash
+codebase-memory-mcp config set index_max_files 250000
+codebase-memory-mcp config set index_max_source_mb 16384
+codebase-memory-mcp config reset index_max_files
+```
+
+Values use base-10 integers. MiB means 1,048,576 bytes. Empty values, zero,
+negative values, suffixes, trailing characters, and values outside the stated
+ranges are rejected without changing the stored value.
+
+## Counting and failure semantics
+
+`index_max_files` counts a file only after it passes directory pruning, ignore
+rules, filename and suffix filters, language detection, and the existing
+per-file size rule. `index_max_source_mb` sums the filesystem sizes of that same
+accepted set.
+
+Equality is allowed. The first file or byte that makes an observed value greater
+than its limit stops discovery. CBM discards the partial file list and does not
+publish a partial graph as a complete index.
+
+For an explicit MCP request the error payload contains:
+
+```json
+{
+  "status": "error",
+  "code": "resource_limit_exceeded",
+  "stage": "discovery",
+  "resource": "files",
+  "observed": 250001,
+  "limit": 250000,
+  "unit": "files",
+  "retryable": true,
+  "serving_index_preserved": true,
+  "message": "Index discovery exceeded index_max_files"
+}
+```
+
+The previous database remains available because publication occurs only after a
+complete discovery and successful staged build. If no previous database exists,
+`serving_index_preserved` is false.
+
+## Trust and compatibility
+
+Limits are read from the CLI-managed `_config.db`; they are not MCP request
+arguments. A supervised parent replaces any caller-supplied internal policy
+before spawning its worker, and the worker rejects a missing or incomplete
+parent policy.
+
+These settings do not replace or increase `auto_index_limit`, change the 512 MiB
+single-file cap, alter workspace-root authorization, or affect
+`cross-repo-intelligence`. With both settings `off`, discovery follows the
+existing unbounded path.
diff --git a/docs/index.html b/docs/index.html
index 56496d5d8..fdfde941e 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -56,7 +56,7 @@
       "featureList": [
         "Indexes 158 programming languages via vendored tree-sitter grammars",
         "Hybrid LSP semantic type resolution for Python, TypeScript/JavaScript, PHP, C#, Go, C/C++, Java, Kotlin, and Rust",
-        "15 MCP tools for structural search, call-path tracing, targeted coverage checks, and Cypher graph queries",
+        "17 MCP tools for structural search, call-path tracing, targeted coverage checks, and Cypher graph queries",
         "Semantic vector code search via bundled nomic-embed-code embeddings (no API key, fully local)",
         "Semantic graph edges (SEMANTICALLY_RELATED) and near-clone detection (SIMILAR_TO, MinHash + LSH)",
         "Cross-service linking for HTTP, gRPC, GraphQL, tRPC, and pub/sub channels with confidence scoring",
@@ -739,8 +739,8 @@
                 <p>The optional UI variant adds one verified, content-addressed frontend pack and serves an interactive 3D graph at <code>localhost:9749</code> to explore nodes, edges, and clusters visually.</p>
             </div>
             <div class="feature">
-                <h3>15 MCP tools</h3>
-                <p><code>search_graph</code>, <code>trace_path</code>, <code>detect_changes</code>, <code>query_graph</code> (Cypher), <code>get_architecture</code>, <code>get_code_snippet</code>, <code>check_index_coverage</code>, <code>manage_adr</code>, and 7 more.</p>
+                <h3>17 MCP tools</h3>
+                <p><code>search_graph</code>, <code>trace_path</code>, <code>detect_changes</code>, <code>query_graph</code> (Cypher), <code>get_architecture</code>, <code>get_code_snippet</code>, <code>check_index_coverage</code>, <code>manage_adr</code>, and 9 more.</p>
             </div>
             <div class="feature">
                 <h3>Cypher graph queries</h3>
diff --git a/flake.nix b/flake.nix
index 50f6319ba..5a0afbb98 100644
--- a/flake.nix
+++ b/flake.nix
@@ -63,7 +63,7 @@
       packages = forAllSystems (pkgs: rec {
         default = pkgs.stdenv.mkDerivation {
           pname = "codebase-memory-mcp";
-          version = "0.10.8";
+          version = "0.11.0";
 
           src = ./.;
 
diff --git a/graph-ui/package-lock.json b/graph-ui/package-lock.json
index 1065f3783..b5441de62 100644
--- a/graph-ui/package-lock.json
+++ b/graph-ui/package-lock.json
@@ -33,7 +33,7 @@
         "tailwindcss": "^4.1.0",
         "typescript": "^5.7.0",
         "vite": "^6.4.3",
-        "vitest": "^4.1.0"
+        "vitest": "^4.1.11"
       }
     },
     "node_modules/@adobe/css-tools": {
@@ -3603,16 +3603,16 @@
       }
     },
     "node_modules/@vitest/expect": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.8.tgz",
-      "integrity": "sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz",
+      "integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.8",
-        "@vitest/utils": "4.1.8",
+        "@vitest/spy": "4.1.11",
+        "@vitest/utils": "4.1.11",
         "chai": "^6.2.2",
         "tinyrainbow": "^3.1.0"
       },
@@ -3621,13 +3621,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.8.tgz",
-      "integrity": "sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz",
+      "integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.8",
+        "@vitest/spy": "4.1.11",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -3648,9 +3648,9 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.8.tgz",
-      "integrity": "sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz",
+      "integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3661,13 +3661,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.8.tgz",
-      "integrity": "sha512-EmVxeBAfMJvycdjd6Hm+RbFBbA9fKvo0Kx37hNpBYoYeavH3RNsBXWDooR1mgD52dCrxIIuP7UotpfiwOikvcg==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz",
+      "integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.8",
+        "@vitest/utils": "4.1.11",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -3675,14 +3675,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.8.tgz",
-      "integrity": "sha512-acfZboRmAIf05DEKcBQy33VXojFJjtUdLyo7oOmV9kebb2xdU01UknNiPuPZoJZQyO7DF0gZdTGTpeAzET9QPQ==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz",
+      "integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.8",
-        "@vitest/utils": "4.1.8",
+        "@vitest/pretty-format": "4.1.11",
+        "@vitest/utils": "4.1.11",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -3691,9 +3691,9 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.8.tgz",
-      "integrity": "sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz",
+      "integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -3701,13 +3701,13 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.8.tgz",
-      "integrity": "sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz",
+      "integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.8",
+        "@vitest/pretty-format": "4.1.11",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -5831,9 +5831,9 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
-      "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz",
+      "integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6141,19 +6141,19 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.8.tgz",
-      "integrity": "sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig==",
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
+      "integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.8",
-        "@vitest/mocker": "4.1.8",
-        "@vitest/pretty-format": "4.1.8",
-        "@vitest/runner": "4.1.8",
-        "@vitest/snapshot": "4.1.8",
-        "@vitest/spy": "4.1.8",
-        "@vitest/utils": "4.1.8",
+        "@vitest/expect": "4.1.11",
+        "@vitest/mocker": "4.1.11",
+        "@vitest/pretty-format": "4.1.11",
+        "@vitest/runner": "4.1.11",
+        "@vitest/snapshot": "4.1.11",
+        "@vitest/spy": "4.1.11",
+        "@vitest/utils": "4.1.11",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -6181,12 +6181,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.8",
-        "@vitest/browser-preview": "4.1.8",
-        "@vitest/browser-webdriverio": "4.1.8",
-        "@vitest/coverage-istanbul": "4.1.8",
-        "@vitest/coverage-v8": "4.1.8",
-        "@vitest/ui": "4.1.8",
+        "@vitest/browser-playwright": "4.1.11",
+        "@vitest/browser-preview": "4.1.11",
+        "@vitest/browser-webdriverio": "4.1.11",
+        "@vitest/coverage-istanbul": "4.1.11",
+        "@vitest/coverage-v8": "4.1.11",
+        "@vitest/ui": "4.1.11",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
diff --git a/graph-ui/package.json b/graph-ui/package.json
index b1aa3998b..b023560e8 100644
--- a/graph-ui/package.json
+++ b/graph-ui/package.json
@@ -37,7 +37,7 @@
     "tailwindcss": "^4.1.0",
     "typescript": "^5.7.0",
     "vite": "^6.4.3",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.11"
   },
   "overrides": {
     "form-data": ">=4.0.6",
diff --git a/install.ps1 b/install.ps1
index d63f1001d..3b087321b 100644
--- a/install.ps1
+++ b/install.ps1
@@ -7,8 +7,22 @@
 
 $ErrorActionPreference = "Stop"
 
-# Enforce TLS 1.2+ (older PowerShell defaults to TLS 1.0 which GitHub rejects)
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13
+# Enforce TLS 1.2+ (older PowerShell defaults to TLS 1.0 which GitHub rejects).
+#
+# TLS 1.3 is added ONLY where schannel can actually negotiate it: Windows 11 and
+# Server 2022 (build 20348+). On Windows 10 the enum value still exists from
+# .NET Framework 4.8 onward, so the assignment succeeds and nothing warns -- but
+# the handshake then fails outright with "The request was aborted: Could not
+# create SSL/TLS secure channel". An unsupported protocol flag in this bitmask
+# is a hard failure, not a graceful downgrade, so every Windows 10 user was
+# blocked at the first download (#1856). The enum-name probe additionally keeps
+# the script parsing on .NET Framework 4.7, where Tls13 is not defined at all.
+$CbmProtocols = [Net.SecurityProtocolType]::Tls12
+if ([Environment]::OSVersion.Version.Build -ge 20348 -and
+    ([enum]::GetNames([Net.SecurityProtocolType]) -contains 'Tls13')) {
+    $CbmProtocols = $CbmProtocols -bor [Net.SecurityProtocolType]::Tls13
+}
+[Net.ServicePointManager]::SecurityProtocol = $CbmProtocols
 Add-Type -AssemblyName System.Net.Http
 
 $Repo = "DeusData/codebase-memory-mcp"
diff --git a/internal/cbm/arena.h b/internal/cbm/arena.h
index 5c6bef9f0..a451e4cf1 100644
--- a/internal/cbm/arena.h
+++ b/internal/cbm/arena.h
@@ -1,41 +1,7 @@
-#ifndef CBM_ARENA_H
-#define CBM_ARENA_H
-
-#include <stddef.h>
-
-// CBMArena is a simple bump allocator that allocates from fixed-size blocks.
-// All memory is freed at once via cbm_arena_destroy(). Individual frees are not
-// supported — this is by design for per-file extraction where all data has the
-// same lifetime.
-#define CBM_ARENA_MAX_BLOCKS 256
-#define CBM_ARENA_DEFAULT_BLOCK_SIZE (64 * 1024) // 64KB initial
-
-typedef struct {
-    char *blocks[CBM_ARENA_MAX_BLOCKS];
-    size_t block_sizes[CBM_ARENA_MAX_BLOCKS]; // per-block sizes (for stats)
-    int nblocks;
-    size_t block_size;
-    size_t used;        // bytes used in current block
-    size_t total_alloc; // cumulative bytes allocated (for stats)
-} CBMArena;
-
-// Initialize an arena with the default block size.
-void cbm_arena_init(CBMArena *a);
-
-// Allocate n bytes from the arena. Returns NULL on OOM or block exhaustion.
-// All returned pointers are 8-byte aligned.
-void *cbm_arena_alloc(CBMArena *a, size_t n);
-
-// Duplicate a string into arena memory. Returns arena-owned copy.
-char *cbm_arena_strdup(CBMArena *a, const char *s);
-
-// Duplicate a string of known length into arena memory. NUL-terminates.
-char *cbm_arena_strndup(CBMArena *a, const char *s, size_t len);
-
-// sprintf into arena memory. Returns arena-owned string.
-char *cbm_arena_sprintf(CBMArena *a, const char *fmt, ...) __attribute__((format(printf, 2, 3)));
-
-// Free all blocks. Arena is invalid after this call.
-void cbm_arena_destroy(CBMArena *a);
-
-#endif // CBM_ARENA_H
+/* The arena lives in src/foundation/arena.h. This file used to be a stale
+ * copy with the same include guard and a shorter API; whichever header a
+ * translation unit included first won, silently. One definition now. */
+#ifndef CBM_INTERNAL_ARENA_SHIM_H
+#define CBM_INTERNAL_ARENA_SHIM_H
+#include "../../src/foundation/arena.h" /* relative: the lsp_all unit has no -Isrc */
+#endif                                  /* CBM_INTERNAL_ARENA_SHIM_H */
diff --git a/internal/cbm/cbm.c b/internal/cbm/cbm.c
index 0bd718f82..b54fb54a7 100644
--- a/internal/cbm/cbm.c
+++ b/internal/cbm/cbm.c
@@ -1,7 +1,10 @@
 /* Full declaration set for the same CBMArena, and it must precede cbm.h:
  * internal/cbm/arena.h declares a subset and the two share the CBM_ARENA_H
  * guard, so whichever is included first is the one this file sees. */
-#include "foundation/arena.h" // cbm_arena_init_sized
+#include "foundation/arena.h"      // cbm_arena_init_sized
+#include "foundation/mem_core.h"   // class accounting for the bound allocators
+#include "foundation/mem_events.h" // waste sanitizer: the bound allocators bypass every observer
+#include "foundation/log.h"        // cbm_log_warn -- extract.lsp.skipped
 #include "cbm.h"
 #include "arena.h" // CBMArena, cbm_arena_init/alloc/strdup/destroy
 #include "helpers.h"
@@ -122,7 +125,79 @@ void cbm_reset_profile(void) {
         }                                                                                        \
     } while (0)
 
+/* A definition name never spans lines. Config extractors hand over a node's
+ * whole text — a YAML block key, a Makefile recipe (`endif\n\n$(obj)/x.h`), a
+ * ktest .conf directive — and the line break rode into the graph (2026-09-16
+ * probe: 8,301 Field nodes on elastic/elasticsearch, 91 kernel nodes). Cut at
+ * the first line break and drop trailing blanks; the qualified name carries
+ * the same text as its last segment and is cut the same way. */
+static const char *cbm_first_line(CBMArena *a, const char *text) {
+    if (!text) {
+        return text;
+    }
+    const char *nl = strpbrk(text, "\r\n");
+    if (!nl) {
+        return text;
+    }
+    size_t n = (size_t)(nl - text);
+    while (n > 0 && (text[n - 1] == ' ' || text[n - 1] == '\t')) {
+        n--;
+    }
+    char *cut = (char *)cbm_arena_alloc(a, n + 1);
+    if (!cut) {
+        return text;
+    }
+    memcpy(cut, text, n);
+    cut[n] = '\0';
+    return cut;
+}
+
+/* JS/TS files: a definition named by a literal token is the walker naming a
+ * function or variable from an object key or a numeric pattern element —
+ * `{}` (1,534 incoming CALLS on microsoft/TypeScript's test baselines), `1`
+ * (38 nodes), a quoted string. An identifier starts with a letter, `_`, `$`,
+ * `#` (private members) or a non-ASCII byte; anything else is not a name. */
+static bool cbm_js_family_path(const char *path) {
+    if (!path) {
+        return false;
+    }
+    const char *dot = strrchr(path, '.');
+    if (!dot) {
+        return false;
+    }
+    static const char *const exts[] = {".js",  ".mjs", ".cjs", ".jsx", ".ts",
+                                       ".mts", ".cts", ".tsx", ".ets", NULL};
+    for (int i = 0; exts[i]; i++) {
+        if (strcmp(dot, exts[i]) == 0) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static bool cbm_js_name_is_junk(const char *name) {
+    if (!name || !name[0]) {
+        return false; /* empty names are handled by the callers' own rules */
+    }
+    unsigned char c = (unsigned char)name[0];
+    bool identifier_start = (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || c == '_' ||
+                            c == '$' || c == '#' || c >= 0x80;
+    /* Member names JS spells without an identifier start are still names:
+     * computed keys (`[Symbol.iterator]`), string-literal keys (`"my-key"`,
+     * `'x'`) and escaped identifiers (`А`). Measured on the TypeScript
+     * corpus: 1,531 `[…]` members, 97 quoted members, 154 escaped
+     * identifiers — all real definitions. What remains ({…} patterns, numeric
+     * literals, parenthesised types, `...rest`) is a token, not a name. */
+    bool member_key_start = c == '[' || c == '"' || c == '\'' || c == '\\';
+    return !identifier_start && !member_key_start;
+}
+
 void cbm_defs_push(CBMDefArray *arr, CBMArena *a, CBMDefinition def) {
+    def.name = cbm_first_line(a, def.name);
+    def.qualified_name = cbm_first_line(a, def.qualified_name);
+    if (cbm_js_family_path(def.file_path) && cbm_js_name_is_junk(def.name)) {
+        return;
+    }
     GROW_ARRAY(arr, a);
     arr->items[arr->count++] = def;
 }
@@ -213,9 +288,93 @@ static const char *cbm_string_read(void *payload, uint32_t byte, TSPoint point,
 
 // --- Parse timeout callback ---
 
+/* Budget for the tree-sitter progress callback. The PRIMARY gate is per-thread
+ * CPU time: a worker descheduled under CI contention burns WALL time but not
+ * CPU, so a starved-but-parseable file must NOT be abandoned merely because the
+ * 5 s budget elapsed in wall-clock against near-zero CPU. That false "parse
+ * timeout" silently dropped a file's defs and, with them, every cross-file edge
+ * those defs anchored (e.g. a Celery.send_task definition backing an ASYNC_CALLS
+ * edge). A generous WALL ceiling stays as a backstop so a genuinely
+ * stuck/spinning parse still terminates in bounded time. */
+#define CBM_PARSE_WALL_CEILING_FACTOR 12ULL /* ~60 s ceiling for the 5 s CPU budget */
+/* The unified walk has NO budget: it walks every node of every file.
+ *
+ * It used to stop on a thread-CPU deadline, which made the GRAPH a function of
+ * how fast the machine happened to be running. Two indexes of the same C#
+ * corpus, same machine, minutes apart, stopped the walk of
+ * src/tests/JIT/jit64/opt/cse/hugeSimpleExpr1.cs at node 2,660,352 and at node
+ * 2,574,336 (measured 2026-09-19). That file's tail is all field assignments,
+ * so the two runs disagreed by 10 WRITES edges: a graph that differed run to
+ * run for a reason no user could see or reproduce. A budget in NODES would at
+ * least have been reproducible, but it still answers "what is in this repo?"
+ * with "depends how much we felt like reading" — so there is no budget at all.
+ * Everything the walk does is a pure function of the tree, and now so is when
+ * it stops: at the end.
+ *
+ * What the deadline was protecting against is real and is handled where it
+ * belongs — in the cost per node, not in a clock. Generated blobs (2.7-8.2 M
+ * node trees) used to cost 18-48 us per node because usage stamping called
+ * ts_node_parent, which descends from the root; the walk now carries its own
+ * parent chain, so a deep tree costs what a shallow one does.
+ *
+ * CBM_WALK_MAX_NODES reinstates a budget for an operator who needs one
+ * (0 = the default, no budget). */
+#define CBM_WALK_MAX_NODES_DEFAULT 0u
+
+/* Read fresh each call, like cbm_max_file_bytes: cheap next to a file walk, and
+ * no memoized copy to go stale between runs in the same process. */
+static uint32_t cbm_walk_max_nodes(void) {
+    const char *raw = getenv("CBM_WALK_MAX_NODES");
+    if (raw && raw[0]) {
+        errno = 0;
+        char *end = NULL;
+        unsigned long v = strtoul(raw, &end, 10);
+        if (errno == 0 && end != raw && *end == '\0' && v <= UINT32_MAX) {
+            return (uint32_t)v; /* 0 is a legitimate choice: no budget */
+        }
+        /* Unparseable / out-of-range → the default, never an accidental 0. */
+    }
+    return CBM_WALK_MAX_NODES_DEFAULT;
+}
+
+typedef struct {
+    uint64_t cpu_deadline_ns; // trip once this thread's CPU time passes it
+    uint64_t wall_ceiling_ns; // hard wall backstop for a spinning/stuck parse
+    /* Set by the callback when IT ended the parse. ts_parser_parse_with_options
+     * returns NULL for several reasons and the budget is only one of them, but
+     * the failure used to be reported as "parse timeout" whenever a budget was
+     * configured at all. A 7-line .properties file was accused of timing out
+     * (2026-09-19); whatever really happened to it, saying "timeout" sent the
+     * next reader looking at the clock. */
+    bool tripped;
+} CBMParseBudget;
+
+#ifdef CBM_ENABLE_TEST_SEAMS
+/* Deterministic RED-repro seam (armed by CBM_TEST_WALL_STALL_ON in
+ * cbm_extract_file_ex): when set, the timeout callback reads the WALL clock this
+ * many ns ahead of reality while CPU time is untouched — emulating a worker
+ * descheduled long enough for the old wall-only budget to elapse against
+ * near-zero CPU. With the CPU-time budget the parse still completes; a wall-only
+ * / tight-ceiling budget drops the file. Thread-local so it cannot leak across
+ * worker threads. Compiled only into seam-enabled test artifacts. */
+static CBM_TLS uint64_t tl_parse_wall_seam_offset_ns = 0;
+#endif
+
+/* tree-sitter's TSProgressCallback mandates a non-const TSParseState*; a const
+ * parameter here would not match the opts.progress_callback assignment below. */
+// cppcheck-suppress constParameterCallback
 static bool cbm_timeout_cb(TSParseState *state) {
-    uint64_t deadline = *(uint64_t *)state->payload;
-    return now_ns() > deadline;
+    CBMParseBudget *budget = (CBMParseBudget *)state->payload;
+    uint64_t wall = now_ns();
+#ifdef CBM_ENABLE_TEST_SEAMS
+    wall += tl_parse_wall_seam_offset_ns;
+#endif
+    bool over =
+        cbm_thread_cpu_time_ns() > budget->cpu_deadline_ns || wall > budget->wall_ceiling_ns;
+    if (over) {
+        budget->tripped = true; /* so a NULL tree can name its real cause */
+    }
+    return over;
 }
 
 // --- Thread-local parser pool ---
@@ -258,6 +417,20 @@ static TSParser *get_thread_parser(const TSLanguage *ts_lang, CBMLanguage lang)
  * to mimalloc would mismatch ASan/CRT frees — there these binds compile to
  * no-ops and the build stays unchanged. */
 
+/* SQLite on a dedicated mimalloc heap per thread: ON only in the index worker,
+ * whose default heap holds the graph (SQLite churn on that heap paid a page
+ * walk per allocation: 132 s vs 9.7 s on the kernel's coverage publish). OFF
+ * everywhere else: the daemon runs a thread per connection, and a heap
+ * created per such thread pins every SQLite block the shared connection
+ * keeps (page cache, statement cache) to pages nobody's heap owns any more --
+ * the Linux soak grew 180 KB per query, 11 -> 144 MB in ten minutes, where
+ * the default thread heap had been flat (2026-09-14). */
+static _Atomic int g_sqlite_dedicated_heap;
+
+void cbm_sqlite_dedicated_heap(bool on) {
+    atomic_store_explicit(&g_sqlite_dedicated_heap, on ? 1 : 0, memory_order_relaxed);
+}
+
 #if defined(CBM_BIND_TS_ALLOCATOR) && CBM_BIND_TS_ALLOCATOR
 #include <assert.h>
 
@@ -270,16 +443,76 @@ static TSParser *get_thread_parser(const TSLanguage *ts_lang, CBMLanguage lang)
  * hook here the biggest per-request allocations in the process — SQLite's page
  * cache and its query working set — are invisible to the attribution profile
  * (#581). */
+/* SQLite allocates from a mimalloc heap of its own, one per thread. Its page
+ * queues then hold SQLite blocks only. Sharing the thread's default heap with
+ * the graph -- 40M+ blocks, millions of pages once the graph moved onto the
+ * core -- made every statement-journal chunk of the coverage publish step pay
+ * a walk over the graph's pages: 132 s on the kernel where v0.10.8, whose
+ * graph lived outside mimalloc, took 9.7 s (sampled 2026-09-14). mi_free
+ * works across heaps, so xFree and cross-thread frees are unchanged; a
+ * thread's heap is released with the thread. */
+static _Thread_local mi_heap_t *tl_sqlite_heap;
+
+/* NULL = the calling thread's default heap (mi_malloc); see the switch above. */
+static mi_heap_t *sqlite_heap(void) {
+    if (!atomic_load_explicit(&g_sqlite_dedicated_heap, memory_order_relaxed)) {
+        return NULL;
+    }
+    if (!tl_sqlite_heap) {
+        tl_sqlite_heap = mi_heap_new();
+    }
+    return tl_sqlite_heap;
+}
+
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+#define BOUND_ALLOC(block, n, flags)                                                             \
+    do {                                                                                         \
+        if ((block) && cbm_memev_enabled()) {                                                    \
+            cbm_memev_alloc_ex((block), (n), mi_usable_size(block), __builtin_return_address(0), \
+                               (unsigned)(flags));                                               \
+        }                                                                                        \
+    } while (0)
+#define BOUND_REALLOC(old_block, grown, n)                                      \
+    do {                                                                        \
+        if ((grown) && cbm_memev_enabled()) {                                   \
+            cbm_memev_realloc((old_block), (grown), (n), mi_usable_size(grown), \
+                              __builtin_return_address(0));                     \
+        }                                                                       \
+    } while (0)
+#define BOUND_FREE(block) cbm_memev_free(block)
+#else
+#define BOUND_ALLOC(block, n, flags) ((void)0)
+#define BOUND_REALLOC(old_block, grown, n) ((void)0)
+#define BOUND_FREE(block) ((void)0)
+#endif
+
 static void *cbm_sqlite_malloc(int n) {
-    void *block = mi_malloc((size_t)n);
+    mi_heap_t *heap = sqlite_heap();
+    void *block = heap ? mi_heap_malloc(heap, (size_t)n) : mi_malloc((size_t)n);
+    if (block) {
+        cbm_mem_class_add_external(CBM_MEM_CLASS_STORE, mi_usable_size(block));
+    }
+    BOUND_ALLOC(block, (size_t)n, 0);
     return block;
 }
 static void cbm_sqlite_free(void *p) {
+    if (p) {
+        cbm_mem_class_remove_external(CBM_MEM_CLASS_STORE, mi_usable_size(p));
+        BOUND_FREE(p);
+    }
     mi_free(p);
 }
 static void *cbm_sqlite_realloc(void *p, int n) {
-    if (p) {}
-    void *grown = mi_realloc(p, (size_t)n);
+    size_t old_size = p ? mi_usable_size(p) : 0;
+    mi_heap_t *heap = sqlite_heap();
+    CBM_MEMEV_BACKING(1);
+    void *grown = heap ? mi_heap_realloc(heap, p, (size_t)n) : mi_realloc(p, (size_t)n);
+    CBM_MEMEV_BACKING(-1);
+    if (grown) {
+        cbm_mem_class_remove_external(CBM_MEM_CLASS_STORE, old_size);
+        cbm_mem_class_add_external(CBM_MEM_CLASS_STORE, mi_usable_size(grown));
+    }
+    BOUND_REALLOC(p, grown, (size_t)n);
     return grown;
 }
 static int cbm_sqlite_size(void *p) {
@@ -292,18 +525,37 @@ static int cbm_sqlite_roundup(int n) {
  * through these, and they too skip the interposer. */
 static void *cbm_ts_malloc(size_t n) {
     void *block = mi_malloc(n);
+    if (block) {
+        cbm_mem_class_add_external(CBM_MEM_CLASS_TS_TREE, mi_usable_size(block));
+    }
+    BOUND_ALLOC(block, n, 0);
     return block;
 }
 static void *cbm_ts_calloc(size_t count, size_t size) {
     void *block = mi_calloc(count, size);
+    if (block) {
+        cbm_mem_class_add_external(CBM_MEM_CLASS_TS_TREE, mi_usable_size(block));
+    }
+    BOUND_ALLOC(block, count * size, CBM_MEMEV_ZEROED);
     return block;
 }
 static void *cbm_ts_realloc(void *p, size_t n) {
-    if (p) {}
+    size_t old_size = p ? mi_usable_size(p) : 0;
+    CBM_MEMEV_BACKING(1);
     void *grown = mi_realloc(p, n);
+    CBM_MEMEV_BACKING(-1);
+    if (grown) {
+        cbm_mem_class_remove_external(CBM_MEM_CLASS_TS_TREE, old_size);
+        cbm_mem_class_add_external(CBM_MEM_CLASS_TS_TREE, mi_usable_size(grown));
+    }
+    BOUND_REALLOC(p, grown, n);
     return grown;
 }
 static void cbm_ts_free(void *p) {
+    if (p) {
+        cbm_mem_class_remove_external(CBM_MEM_CLASS_TS_TREE, mi_usable_size(p));
+        BOUND_FREE(p);
+    }
     mi_free(p);
 }
 
@@ -375,6 +627,120 @@ void cbm_reset_thread_parser(void) {
     }
 }
 
+enum { FIELD_CACHE_SLOTS = 512, FIELD_NAME_CACHED_MAX = 31 };
+typedef struct {
+    const TSLanguage *lang;
+    uint32_t len;
+    TSFieldId id;
+    char name[FIELD_NAME_CACHED_MAX + 1];
+} field_id_slot_t;
+/* On the HEAP behind a thread-local pointer, not a thread-local array: glibc
+ * takes the static TLS block out of each thread's stack allocation, so a 24 KB
+ * array here is 24 KB every thread must fit — and the threads that ask for a
+ * small stack (the 64 KB parent-death watchdog) then fail to start at all,
+ * with EINVAL surfacing nowhere near the growth that caused it. See
+ * cbm_thread_create's fallback for the other half of that lesson. */
+static CBM_TLS field_id_slot_t *tl_field_ids;
+
+static field_id_slot_t *field_cache(void) {
+    if (!tl_field_ids) {
+        tl_field_ids = cbm_calloc(CBM_MEM_CLASS_OTHER, FIELD_CACHE_SLOTS * sizeof(field_id_slot_t));
+    }
+    return tl_field_ids;
+}
+
+static void cbm_ts_field_cache_release_thread(void) {
+    cbm_free(CBM_MEM_CLASS_OTHER, tl_field_ids);
+    tl_field_ids = NULL;
+}
+
+TSNode cbm_ts_child_by_field_name(TSNode node, const char *name, uint32_t name_length) {
+    if (!name || name_length == 0 || name_length > FIELD_NAME_CACHED_MAX || ts_node_is_null(node)) {
+        return (ts_node_child_by_field_name)(node, name, name_length); /* the real one */
+    }
+    field_id_slot_t *cache = field_cache();
+    if (!cache) {
+        return (ts_node_child_by_field_name)(node, name, name_length); /* uncached, still correct */
+    }
+    const TSLanguage *lang = ts_node_language(node);
+    uint64_t h = 0xcbf29ce484222325ULL ^ (uint64_t)(uintptr_t)lang;
+    for (uint32_t i = 0; i < name_length; i++) {
+        h ^= (uint8_t)name[i];
+        h *= 0x100000001b3ULL;
+    }
+    field_id_slot_t *slot = &cache[h & (FIELD_CACHE_SLOTS - 1)];
+    if (slot->lang != lang || slot->len != name_length ||
+        memcmp(slot->name, name, name_length) != 0) {
+        /* The content is compared, never just the pointer: callers also pass
+         * names built in reused buffers. */
+        slot->id = ts_language_field_id_for_name(lang, name, name_length);
+        slot->lang = lang;
+        slot->len = name_length;
+        memcpy(slot->name, name, name_length);
+    }
+    return ts_node_child_by_field_id(node, slot->id);
+}
+
+static CBM_TLS TSTreeCursor tl_cursor;
+static CBM_TLS bool tl_cursor_live = false;
+
+TSTreeCursor *cbm_thread_cursor(TSNode node) {
+    if (tl_cursor_live) {
+        ts_tree_cursor_reset(&tl_cursor, node);
+    } else {
+        tl_cursor = ts_tree_cursor_new(node);
+        tl_cursor_live = true;
+    }
+    return &tl_cursor;
+}
+
+/* Per-depth cursors for recursive walks (cbm_cursor_acquire). A walk at depth d
+ * holds slot d while it recurses into depth d + 1; the LSP call walkers used to
+ * create and delete a cursor at EVERY node -- 49.8 M cursor stacks on the Go
+ * corpus (waste sanitizer, 2026-09-17). Deeper than the pool: private cursors. */
+enum { CURSOR_POOL_DEPTH = 128 };
+/* Heap-backed for the same reason as the field cache: 4 KB of cursors plus
+ * their state in static TLS is 4 KB charged to every thread in the image, and
+ * it is the kind of growth that makes a small-stack thread refuse to start. */
+typedef struct {
+    TSTreeCursor cursors[CURSOR_POOL_DEPTH];
+    uint8_t state[CURSOR_POOL_DEPTH]; /* bit0 live, bit1 busy */
+} cursor_pool_t;
+static CBM_TLS cursor_pool_t *tl_cursor_pool;
+enum { CURSOR_LIVE = 1, CURSOR_BUSY = 2 };
+
+TSTreeCursor *cbm_cursor_acquire(cbm_cursor_lease_t *lease, int depth, TSNode node) {
+    if (!tl_cursor_pool) {
+        tl_cursor_pool = cbm_calloc(CBM_MEM_CLASS_OTHER, sizeof(cursor_pool_t));
+    }
+    cursor_pool_t *pool = tl_cursor_pool;
+    if (pool && depth >= 0 && depth < CURSOR_POOL_DEPTH && !(pool->state[depth] & CURSOR_BUSY)) {
+        if (pool->state[depth] & CURSOR_LIVE) {
+            ts_tree_cursor_reset(&pool->cursors[depth], node);
+        } else {
+            pool->cursors[depth] = ts_tree_cursor_new(node);
+        }
+        pool->state[depth] = CURSOR_LIVE | CURSOR_BUSY;
+        lease->slot = depth;
+        lease->cursor = &pool->cursors[depth];
+        return lease->cursor;
+    }
+    /* No pool (or the slot is taken): a private cursor is always correct. */
+    lease->private_cursor = ts_tree_cursor_new(node);
+    lease->slot = -1;
+    lease->cursor = &lease->private_cursor;
+    return lease->cursor;
+}
+
+void cbm_cursor_release(cbm_cursor_lease_t *lease) {
+    if (lease->slot < 0) {
+        ts_tree_cursor_delete(&lease->private_cursor);
+    } else if (tl_cursor_pool) {
+        tl_cursor_pool->state[lease->slot] &= (uint8_t)~CURSOR_BUSY;
+    }
+    lease->cursor = NULL;
+}
+
 void cbm_destroy_thread_parser(void) {
     // Full cleanup: delete the parser. Call on worker thread exit.
     if (tl_parser) {
@@ -382,6 +748,29 @@ void cbm_destroy_thread_parser(void) {
         tl_parser = NULL;
         tl_parser_lang = CBM_LANG_COUNT;
     }
+    if (tl_cursor_live) {
+        ts_tree_cursor_delete(&tl_cursor);
+        tl_cursor_live = false;
+    }
+    if (tl_cursor_pool) {
+        bool busy = false;
+        for (int d = 0; d < CURSOR_POOL_DEPTH; d++) {
+            /* a busy slot belongs to a walk still on this stack: leave it */
+            if (tl_cursor_pool->state[d] == CURSOR_LIVE) {
+                ts_tree_cursor_delete(&tl_cursor_pool->cursors[d]);
+                tl_cursor_pool->state[d] = 0;
+            } else if (tl_cursor_pool->state[d] & CURSOR_BUSY) {
+                busy = true;
+            }
+        }
+        /* Outstanding leases point INTO this block, so it is only released once
+         * no walk still holds a slot. */
+        if (!busy) {
+            cbm_free(CBM_MEM_CLASS_OTHER, tl_cursor_pool);
+            tl_cursor_pool = NULL;
+        }
+    }
+    cbm_ts_field_cache_release_thread();
 }
 
 void cbm_shutdown(void) {
@@ -1041,14 +1430,89 @@ static void cbm_mark_pp_error_rows(TSNode n, uint8_t *rows, uint32_t row_count,
 /* Recovery subtraction (#963): tree-sitter error recovery plus the
  * ERROR-descending def walker often still extract constructs INSIDE a failed
  * region (verified: a function in an #ifdef-split ERROR region and even a
- * `def broken(:` both came back as defs). A region whose every line is
- * covered by definitions that START inside it is definitely recovered — its
- * constructs ARE in the graph — so flagging it would be a false miss.
- * Container defs (Module/Package) are ignored: a file-spanning Module node is
- * not evidence the region's constructs survived. Conservative: partially
- * covered regions stay flagged. */
-static bool cbm_region_is_recovered(uint32_t rs, uint32_t re, const CBMDefArray *defs) {
-    enum { MAX_COVER_DEFS = 256 };
+ * `def broken(:` both came back as defs). The lines a definition that STARTS
+ * inside the region covers are therefore in the graph, and only the lines no
+ * definition covers can honestly be called missed. Container defs
+ * (Module/Package) are ignored: a file-spanning Module node is not evidence
+ * the region's constructs survived.
+ *
+ * This used to be all-or-nothing — a region stayed flagged whole unless every
+ * line was covered. On torvalds/linux (2026-09-16 probe) one ERROR node that
+ * swallowed the second half of kernel/sched/core.c (lines 5522–11284) survived
+ * because of the comment and macro lines between its 286 extracted functions,
+ * and the coverage report told a reader 68 % of the scheduler was unindexed.
+ * Now the uncovered gaps are reported instead, and a gap holding only blank,
+ * comment or preprocessor lines is not a miss at all. */
+static uint32_t *cbm_line_offsets(const char *src, int src_len, uint32_t *out_lines) {
+    uint32_t lines = 1;
+    for (int i = 0; i < src_len; i++) {
+        if (src[i] == '\n') {
+            lines++;
+        }
+    }
+    uint32_t *offs =
+        (uint32_t *)cbm_alloc(CBM_MEM_CLASS_EXTRACT, (size_t)(lines + 1) * sizeof(uint32_t));
+    if (!offs) {
+        *out_lines = 0;
+        return NULL;
+    }
+    uint32_t n = 0;
+    offs[n++] = 0;
+    for (int i = 0; i < src_len && n < lines; i++) {
+        if (src[i] == '\n') {
+            offs[n++] = (uint32_t)i + 1;
+        }
+    }
+    offs[n] = (uint32_t)src_len;
+    *out_lines = n;
+    return offs;
+}
+
+/* A 1-based line that holds nothing a reader would call missed code: blank,
+ * a comment line, or a preprocessor directive (the import pass owns #include;
+ * #if/#endif carry no construct of their own). */
+static bool cbm_line_is_inert(const char *src, const uint32_t *offs, uint32_t nlines,
+                              uint32_t line) {
+    if (!src || !offs || line == 0 || line > nlines) {
+        return true;
+    }
+    const char *p = src + offs[line - 1];
+    const char *end = src + offs[line];
+    while (p < end && (*p == ' ' || *p == '\t' || *p == '\r')) {
+        p++;
+    }
+    if (p >= end || *p == '\n') {
+        return true;
+    }
+    if (p[0] == '/' && p + 1 < end && (p[1] == '/' || p[1] == '*')) {
+        return true;
+    }
+    return p[0] == '*' || p[0] == '#';
+}
+
+static void cbm_regions_emit_gap(cbm_error_regions_t *out, uint32_t gs, uint32_t ge,
+                                 const char *src, const uint32_t *offs, uint32_t nlines) {
+    bool live = false;
+    for (uint32_t l = gs; l <= ge && !live; l++) {
+        live = !cbm_line_is_inert(src, offs, nlines, l);
+    }
+    if (!live) {
+        return;
+    }
+    if (out->count < CBM_MAX_ERROR_REGIONS) {
+        out->starts[out->count] = gs;
+        out->ends[out->count] = ge;
+        out->count++;
+    } else {
+        out->dropped++;
+    }
+}
+
+/* Replace [rs, re] by the sub-ranges no in-region definition covers. */
+static void cbm_region_uncovered_gaps(uint32_t rs, uint32_t re, const CBMDefArray *defs,
+                                      const char *src, const uint32_t *offs, uint32_t nlines,
+                                      cbm_error_regions_t *out) {
+    enum { MAX_COVER_DEFS = 1024 };
     uint32_t starts[MAX_COVER_DEFS];
     uint32_t ends[MAX_COVER_DEFS];
     int n = 0;
@@ -1060,14 +1524,25 @@ static bool cbm_region_is_recovered(uint32_t rs, uint32_t re, const CBMDefArray
         if (d->start_line < rs || d->start_line > re) {
             continue; /* recovery evidence must originate inside the region */
         }
+        /* A one-line definition salvaged from inside an error region is the
+         * walker's guess at broken text (`def x(:` comes back as a def, a
+         * mis-parsed `static _Thread_local int x` as a Variable named `int`,
+         * and Python's synthetic builtins all sit on line 1); only a construct
+         * whose body spans lines proves it was understood. Conservative: real
+         * one-line variables and macros inside a failed region keep their line
+         * flagged. */
+        if (d->end_line <= d->start_line) {
+            continue;
+        }
         starts[n] = d->start_line;
-        ends[n] = d->end_line < d->start_line ? d->start_line : d->end_line;
+        ends[n] = d->end_line;
         n++;
     }
     if (n == 0) {
-        return false;
+        cbm_regions_emit_gap(out, rs, re, src, offs, nlines);
+        return;
     }
-    /* Insertion-sort by start, then sweep for gaps in [rs, re]. */
+    /* Insertion-sort by start, then sweep and emit the gaps in [rs, re]. */
     for (int i = 1; i < n; i++) {
         uint32_t s = starts[i];
         uint32_t e = ends[i];
@@ -1080,16 +1555,18 @@ static bool cbm_region_is_recovered(uint32_t rs, uint32_t re, const CBMDefArray
         starts[j + 1] = s;
         ends[j + 1] = e;
     }
-    uint32_t covered_to = rs - 1;
+    uint32_t cursor = rs;
     for (int i = 0; i < n; i++) {
-        if (starts[i] > covered_to + 1) {
-            return false; /* uncovered gap */
+        if (starts[i] > cursor) {
+            cbm_regions_emit_gap(out, cursor, starts[i] - 1, src, offs, nlines);
         }
-        if (ends[i] > covered_to) {
-            covered_to = ends[i];
+        if (ends[i] + 1 > cursor) {
+            cursor = ends[i] + 1;
         }
     }
-    return covered_to >= re;
+    if (cursor <= re) {
+        cbm_regions_emit_gap(out, cursor, re, src, offs, nlines);
+    }
 }
 
 /* #961: true when 1-based `line` of `src` contains `name` (used to verify a
@@ -1197,6 +1674,63 @@ static bool cbm_span_contains_callable_def(const char *src, int src_len, uint32_
     return false;
 }
 
+/* #1989: type-def counterpart of cbm_span_contains_callable_def. A rescued
+ * class/struct/enum definition has its name followed by a base clause (':') or
+ * a body ('{'), not a parameter list, so the callable validator would reject
+ * every type def pulled from the expanded tree. */
+static bool cbm_span_contains_type_def(const char *src, int src_len, uint32_t start_line,
+                                       uint32_t end_line, const char *name) {
+    if (!src || src_len <= 0 || !name || !name[0] || start_line == 0 || end_line < start_line) {
+        return false;
+    }
+    int span_start = 0;
+    uint32_t line = 1;
+    while (span_start < src_len && line < start_line) {
+        if (src[span_start++] == '\n') {
+            line++;
+        }
+    }
+    if (line != start_line) {
+        return false;
+    }
+    int span_end = span_start;
+    while (span_end < src_len && line <= end_line) {
+        if (src[span_end++] == '\n') {
+            line++;
+        }
+    }
+    size_t name_len = strlen(name);
+    for (int pos = span_start; pos + (int)name_len <= span_end; pos++) {
+        if (strncmp(src + pos, name, name_len) != 0 ||
+            (pos > 0 && cbm_identifier_char(src[pos - 1])) ||
+            (pos + (int)name_len < src_len && cbm_identifier_char(src[pos + name_len]))) {
+            continue;
+        }
+        int open = pos + (int)name_len;
+        while (open < span_end && isspace((unsigned char)src[open])) {
+            open++;
+        }
+        // Base clause (": public B"), body ("{"), or template args ("<...").
+        if (open < span_end && (src[open] == ':' || src[open] == '{' || src[open] == '<')) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/* #1989: label buckets for the misparse-correction gates. A raw def extracted
+ * from a broken `class MOD_API Foo` shape lands under a callable label while
+ * the expanded tree yields a proper type label for the same name. */
+static bool cbm_def_label_is_type(const char *label) {
+    return label != NULL && (strcmp(label, "Class") == 0 || strcmp(label, "Enum") == 0 ||
+                             strcmp(label, "Interface") == 0 || strcmp(label, "Type") == 0 ||
+                             strcmp(label, "Struct") == 0 || strcmp(label, "Union") == 0);
+}
+
+static bool cbm_def_label_is_callable(const char *label) {
+    return label != NULL && (strcmp(label, "Function") == 0 || strcmp(label, "Method") == 0);
+}
+
 /* Remap an expanded-source definition back to the original input file. Every
  * line in the definition must be attributable to the main file; generated
  * macro bodies, included headers, and ambiguous spans fail closed. */
@@ -1224,16 +1758,19 @@ static bool cbm_remap_preprocessed_def(CBMDefinition *def, const CBMPreprocessed
     return true;
 }
 
-static void cbm_subtract_recovered_regions(cbm_error_regions_t *regs, const CBMDefArray *defs) {
-    int kept = 0;
-    for (int i = 0; i < regs->count; i++) {
-        if (!cbm_region_is_recovered(regs->starts[i], regs->ends[i], defs)) {
-            regs->starts[kept] = regs->starts[i];
-            regs->ends[kept] = regs->ends[i];
-            kept++;
-        }
+static void cbm_subtract_recovered_regions(cbm_error_regions_t *regs, const CBMDefArray *defs,
+                                           const char *src, int src_len) {
+    if (regs->count <= 0) {
+        return;
     }
-    regs->count = kept;
+    uint32_t nlines = 0;
+    uint32_t *offs = cbm_line_offsets(src, src_len, &nlines);
+    cbm_error_regions_t out = {{0}, {0}, 0, regs->dropped};
+    for (int i = 0; i < regs->count; i++) {
+        cbm_region_uncovered_gaps(regs->starts[i], regs->ends[i], defs, src, offs, nlines, &out);
+    }
+    cbm_free(CBM_MEM_CLASS_EXTRACT, offs);
+    *regs = out;
 }
 
 /* #1071: a function-like macro invocation whose argument is a type token
@@ -1533,6 +2070,7 @@ CBMFileResult *cbm_extract_file(const char *source, int source_len, CBMLanguage
  * that bound and so a singleton OS allocation. One file in twelve thousand
  * pays it, which is why the cost is accepted. */
 enum { CBM_EXTRACT_SCRATCH_BLOCK = CBM_SZ_512 * CBM_SZ_1K };
+enum { CBM_EXTRACT_SCRATCH_KEEP_BYTES = 4 * CBM_SZ_1K * CBM_SZ_1K };
 
 static CBMFileResult *extract_file_ex_body(const char *source, int source_len, CBMLanguage language,
                                            const char *project, const char *rel_path,
@@ -1542,13 +2080,12 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
                                            const CBMReturnTypeTable *return_type_table,
                                            CBMArena *scratch) {
     // Allocate result on heap (arena inside for all string data)
-    enum { SINGLE = 1 };
-    CBMFileResult *result = (CBMFileResult *)calloc(SINGLE, sizeof(CBMFileResult));
+    CBMFileResult *result = cbm_result_alloc();
     if (!result) {
         return NULL;
     }
 
-    cbm_arena_init(&result->arena);
+    cbm_work_arena_take(&result->arena);
     CBMArena *a = &result->arena;
 
     /* Crash-quarantine hard guard (Stage 3c): a file the supervisor pinned as a
@@ -1620,26 +2157,79 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
     };
 
     TSParseOptions opts = {0};
-    uint64_t deadline_ns = 0; // cppcheck-suppress unreadVariable
+    CBMParseBudget budget = {0}; // cppcheck-suppress unreadVariable
+    uint64_t budget_ns = 0;
     if (timeout_micros > 0) {
-        deadline_ns = t0 + ((uint64_t)timeout_micros * USEC_TO_NSEC);
-        opts.payload = &deadline_ns;
+        budget_ns = (uint64_t)timeout_micros * USEC_TO_NSEC;
+        // Descheduling burns wall time but not CPU: gate on this thread's CPU
+        // time so a starved-but-parseable file is not abandoned, with a generous
+        // wall ceiling as a backstop against a genuinely spinning/stuck parse.
+        budget.cpu_deadline_ns = cbm_thread_cpu_time_ns() + budget_ns;
+        budget.wall_ceiling_ns = t0 + budget_ns * CBM_PARSE_WALL_CEILING_FACTOR;
+        opts.payload = &budget;
         opts.progress_callback = cbm_timeout_cb;
+#ifdef CBM_ENABLE_TEST_SEAMS
+        tl_parse_wall_seam_offset_ns = 0;
+        const char *stall_on = getenv("CBM_TEST_WALL_STALL_ON");
+        if (stall_on && stall_on[0] && rel_path && strstr(rel_path, stall_on)) {
+            // Push the wall reading past the 1x budget (the old wall-only budget
+            // trips) but well under the generous ceiling (the CPU-time budget
+            // survives): budget + 1 s, deterministic, no real timing involved.
+            tl_parse_wall_seam_offset_ns = budget_ns + NSEC_PER_SEC;
+        }
+#endif
     }
 
     TSTree *tree = ts_parser_parse_with_options(parser, NULL, ts_input, opts);
     uint64_t t1 = now_ns();
+#ifdef CBM_ENABLE_TEST_SEAMS
+    t1 += tl_parse_wall_seam_offset_ns; /* the stall seam inflates every wall reading */
+#endif
 
     if (!tree) {
         result->has_error = true;
-        result->error_msg =
-            cbm_arena_strdup(a, timeout_micros > 0 ? "parse timeout" : "parse failed");
+        /* Only the budget's own callback may call this a timeout. Any other
+         * NULL is a parse failure, and saying so is the difference between a
+         * reader chasing the clock and a reader chasing the real cause. */
+        result->error_msg = cbm_arena_strdup(a, budget.tripped ? "parse timeout" : "parse failed");
         cbm_index_mark_done(rel_path);
         return result;
     }
 
     TSNode root = ts_tree_root_node(tree);
 
+    /* No file is disqualified from the LSP walks by how long its parse took.
+     *
+     * The rule used to be "a parse that spent more than half its budget means
+     * this tree is too heavy for the walks" — a clock deciding which files get
+     * type-aware refinement, so the same repo could come back with different
+     * graphs. It was added on 2026-09-14 against a 23 MB single-expression C#
+     * JIT test that cost 354 s in the per-file walk and then crashed the
+     * cross-file resolve.
+     *
+     * Removing it was checked against exactly that file and that path
+     * (2026-09-19): the whole 12k-file C# corpus twice, cross-file resolve
+     * included, and hugeexpr1.cs on its own — no crash, same 1,224,981 nodes /
+     * 5,794,873 edges as with the rule in place, same ~100 s. Synthetic C# with
+     * valid nesting 10,000 levels deep indexes fine; past roughly that depth
+     * tree-sitter itself stops producing a usable tree, so a tree deep enough
+     * to endanger a recursive walk never reaches one. The 354 s is gone for a
+     * different reason: the walk that spent it was C#'s own, climbing with
+     * ts_node_parent, and it now uses the cursor (extract_usages.c).
+     *
+     * CBM_TEST_LSP_SKIP_ON still names a file for the tests that pin the
+     * skipped-file behaviour itself. */
+#ifdef CBM_ENABLE_TEST_SEAMS
+    {
+        const char *skip_on = getenv("CBM_TEST_LSP_SKIP_ON");
+        if (skip_on && skip_on[0] && rel_path && strstr(rel_path, skip_on)) {
+            result->lsp_skipped = true; /* the test names the file; no timing involved */
+            cbm_log_warn("extract.lsp.skipped", "reason", "test_seam", "path",
+                         rel_path ? rel_path : "");
+        }
+    }
+#endif
+
     // Compute module QN. Java/Go derive the module from the CONTAINING
     // DIRECTORY (package semantics) rather than baking the filename stem in,
     // so def QNs, the LSP caller_qn, and the textual calls-enclosing QN all
@@ -1662,6 +2252,7 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
         .root = root,
         .macro_table = macro_table,
         .return_type_table = return_type_table,
+        .walk_budget_nodes = cbm_walk_max_nodes(),
     };
 
     // Run extractors: defs + imports use separate walks (unique recursion patterns),
@@ -1669,6 +2260,14 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
     cbm_extract_definitions(&ctx);
     cbm_extract_imports(&ctx);
     cbm_extract_unified(&ctx);
+    result->tree_nodes = ts_node_descendant_count(root);
+    result->walk_nodes_visited = ctx.walk_nodes_visited;
+    if (ctx.walk_budget_exhausted) {
+        result->walk_truncated = true;
+        result->lsp_skipped = true;
+        cbm_log_warn("extract.walk.truncated", "reason", "node_budget", "path",
+                     rel_path ? rel_path : "");
+    }
 
     // Channel detection (Socket.IO / EventEmitter) — JS/TS only.
     cbm_extract_channels(&ctx);
@@ -1688,7 +2287,7 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
     // LSP type-aware call/usage resolution (per-file). Runs in every mode;
     // refines the tree-sitter + textual-resolution graph with type info.
     uint64_t lsp_start = now_ns();
-    {
+    if (!result->lsp_skipped) {
         if (language == CBM_LANG_GO) {
             cbm_run_go_lsp(a, result, source, source_len, root);
         }
@@ -1727,15 +2326,15 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
         if (language == CBM_LANG_CSHARP) {
             cbm_run_cs_lsp(a, result, source, source_len, root);
         }
-    }
-    if (language == CBM_LANG_JAVA) {
-        cbm_run_java_lsp(a, result, source, source_len, root);
-    }
-    if (language == CBM_LANG_KOTLIN) {
-        cbm_run_kotlin_lsp(a, result, source, source_len, root);
-    }
-    if (language == CBM_LANG_RUST) {
-        cbm_run_rust_lsp(a, result, source, source_len, root);
+        if (language == CBM_LANG_JAVA) {
+            cbm_run_java_lsp(a, result, source, source_len, root);
+        }
+        if (language == CBM_LANG_KOTLIN) {
+            cbm_run_kotlin_lsp(a, result, source, source_len, root);
+        }
+        if (language == CBM_LANG_RUST) {
+            cbm_run_rust_lsp(a, result, source, source_len, root);
+        }
     }
     atomic_fetch_add(&total_lsp_ns, now_ns() - lsp_start);
 
@@ -1757,6 +2356,14 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
     // Defs keep original-source line numbers; only CALLS are extracted from expanded source.
     if (language == CBM_LANG_C || language == CBM_LANG_CPP || language == CBM_LANG_CUDA) {
         uint64_t pp_start = now_ns();
+        /* #1989: collect build-system export-macro candidates from the raw
+         * source. They are predefined empty in the expanded buffer (see
+         * preprocessor.cpp) so `class MOD_API Foo` parses with its real name,
+         * and the rescue loop below can adopt corrected type defs. Bounded:
+         * at most CBM_EXPORT_MACRO_MAX names per file. */
+        char export_cands[CBM_EXPORT_MACRO_MAX][CBM_EXPORT_MACRO_NAME_MAX];
+        int export_cand_count =
+            cbm_export_macro_candidates(source, source_len, export_cands, CBM_EXPORT_MACRO_MAX);
         CBMPreprocessedSource *preprocessed = cbm_preprocess_with_map(
             source, source_len, rel_path, extra_defines, include_paths, language != CBM_LANG_C);
         if (preprocessed && preprocessed->source) {
@@ -1837,17 +2444,52 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
                      * recover defs from it — adopting ONLY those that
                      * intersect a raw ERROR region, whose name is visible on
                      * the raw source line, and whose QN the raw pass did not
-                     * already extract. */
-                    if (ts_node_has_error(root)) {
+                     * already extract.
+                     *
+                     * #1989: build-system export macros (<MOD>_API,
+                     * <lib>_EXPORT, ...) are empty on the real compile line but
+                     * opaque to tree-sitter, so `class MOD_API Foo` misparses
+                     * with the macro as the type name — often with NO raw ERROR
+                     * region at all (the class_specifier "succeeds" with the
+                     * wrong name; enums and free functions do error out). When
+                     * export-macro candidates were collected for this file, also
+                     * adopt expanded defs that replace a raw def literally named
+                     * as a candidate, or that correct a raw misparse label (the
+                     * raw pass extracted the same name as Function/Method from
+                     * the broken function_definition shape; the expanded tree
+                     * yields a proper type def). Superseded raw defs are
+                     * dropped so the corrected definition is not shadowed by
+                     * the qualified-name dedup. With no candidates the block
+                     * reduces to the original #961 behavior. */
+                    if (ts_node_has_error(root) || export_cand_count > 0) {
                         cbm_error_regions_t raw_regs = {{0}, {0}, 0, 0};
                         cbm_collect_error_regions(root, &raw_regs, source, source_len);
-                        if (raw_regs.count > 0) {
+                        if (raw_regs.count > 0 || export_cand_count > 0) {
                             int defs_before = result->defs.count;
                             cbm_extract_definitions(&pp_ctx);
                             int w = defs_before;
+                            char *superseded = NULL;
+                            if (export_cand_count > 0 && defs_before > 0) {
+                                superseded =
+                                    (char *)cbm_calloc(CBM_MEM_CLASS_EXTRACT, (size_t)defs_before);
+                            }
+                            /* #1989: spans of defs already adopted from the
+                             * expanded tree. A def nested inside one of these
+                             * (an inline method of a rescued class) was dropped
+                             * by the raw pass — the misparsed
+                             * `class MOD_API Foo {...}` parsed as a
+                             * function_definition, and nested defs in its body
+                             * are never walked. Bounded: one span per adopted
+                             * def, capped at 64. */
+                            struct {
+                                uint32_t start;
+                                uint32_t end;
+                            } rescued_spans[64];
+                            int rescued_count = 0;
                             for (int i = defs_before; i < result->defs.count; i++) {
                                 CBMDefinition *d = &result->defs.items[i];
                                 bool adopt = false;
+                                int supersede_j = -1;
                                 if (cbm_remap_preprocessed_def(d, preprocessed)) {
                                     for (int rj = 0; rj < raw_regs.count && !adopt; rj++) {
                                         if (d->start_line <= raw_regs.ends[rj] &&
@@ -1855,26 +2497,159 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
                                             adopt = true;
                                         }
                                     }
+                                    if (!adopt && export_cand_count > 0 && d->name) {
+                                        for (int ci = 0; ci < export_cand_count && !adopt; ci++) {
+                                            for (int j = 0; j < defs_before && !adopt; j++) {
+                                                CBMDefinition *r = &result->defs.items[j];
+                                                if (!r->name ||
+                                                    strcmp(r->name, export_cands[ci]) != 0) {
+                                                    continue;
+                                                }
+                                                if (r->start_line <= d->end_line &&
+                                                    d->start_line <= r->end_line &&
+                                                    cbm_span_contains_type_def(
+                                                        source, source_len, d->start_line,
+                                                        d->end_line, d->name)) {
+                                                    adopt = true;
+                                                    supersede_j = j;
+                                                }
+                                            }
+                                        }
+                                        if (!adopt && d->label && cbm_def_label_is_type(d->label)) {
+                                            for (int j = 0; j < defs_before && !adopt; j++) {
+                                                CBMDefinition *r = &result->defs.items[j];
+                                                /* Widened past callables (#1989): the
+                                                 * misparse also mints value-label raw
+                                                 * defs for types (`class X_API FEmpty {}`
+                                                 * -> Variable FEmpty). Same name,
+                                                 * overlapping span, raw label is NOT a
+                                                 * type => raw is the misparse artifact. */
+                                                if (!r->name || !r->label || !d->name ||
+                                                    strcmp(r->name, d->name) != 0 ||
+                                                    cbm_def_label_is_type(r->label)) {
+                                                    continue;
+                                                }
+                                                if (r->start_line <= d->end_line &&
+                                                    d->start_line <= r->end_line) {
+                                                    adopt = true;
+                                                    supersede_j = j;
+                                                }
+                                            }
+                                        }
+                                        /* Nested rescue (#1989): a def nested inside
+                                         * an already-adopted def's span — the inline
+                                         * method of a rescued class, dropped by the
+                                         * raw pass because the class parsed as a
+                                         * function body. The same validation gates
+                                         * (name-on-line, shape, QN dedup) still run
+                                         * below before it lands. */
+                                        if (!adopt && rescued_count > 0) {
+                                            for (int k = 0; k < rescued_count && !adopt; k++) {
+                                                if (d->start_line >= rescued_spans[k].start &&
+                                                    d->end_line <= rescued_spans[k].end) {
+                                                    adopt = true;
+                                                }
+                                            }
+                                        }
+                                    }
                                 }
-                                if (adopt && (!d->name ||
-                                              !cbm_line_contains(source, source_len, d->start_line,
-                                                                 d->name) ||
-                                              !cbm_span_contains_callable_def(
-                                                  source, source_len, d->start_line, d->end_line,
-                                                  d->name))) {
+                                if (adopt &&
+                                    (!d->name ||
+                                     !cbm_line_contains(source, source_len, d->start_line,
+                                                        d->name) ||
+                                     (!cbm_span_contains_callable_def(source, source_len,
+                                                                      d->start_line, d->end_line,
+                                                                      d->name) &&
+                                      !cbm_span_contains_type_def(source, source_len, d->start_line,
+                                                                  d->end_line, d->name)))) {
                                     adopt = false;
                                 }
                                 for (int j = 0; j < defs_before && adopt; j++) {
+                                    if (j == supersede_j || (superseded && superseded[j])) {
+                                        continue; // being replaced by this very def
+                                    }
                                     const char *q = result->defs.items[j].qualified_name;
                                     if (q && d->qualified_name &&
                                         strcmp(q, d->qualified_name) == 0) {
+                                        /* #1989: a raw def holding the same QN is
+                                         * usually a reject — unless it is the
+                                         * misparse artifact this very def came to
+                                         * replace (raw "Function FCalc" from the
+                                         * broken `class MOD_API FCalc` shape vs the
+                                         * rescued "Class FCalc"). Same name, same
+                                         * span, raw label is not a type: supersede
+                                         * instead of dropping the correction. */
+                                        CBMDefinition *r = &result->defs.items[j];
+                                        if (d->label && cbm_def_label_is_type(d->label) &&
+                                            r->label && r->name && d->name &&
+                                            strcmp(r->name, d->name) == 0 &&
+                                            !cbm_def_label_is_type(r->label) &&
+                                            r->start_line == d->start_line &&
+                                            r->end_line == d->end_line && superseded) {
+                                            superseded[j] = 1;
+                                            continue;
+                                        }
                                         adopt = false;
                                     }
                                 }
                                 if (adopt) {
+                                    if (supersede_j >= 0 && supersede_j < defs_before &&
+                                        superseded) {
+                                        superseded[supersede_j] = 1;
+                                    }
+                                    /* Phantom-artifact suppression (#1989): on the
+                                     * raw tree `class MOD_API Foo : public Base
+                                     * {...}` parses as a function_definition whose
+                                     * declarator is the BASE-CLASS name, so the raw
+                                     * pass mints a bogus Function def named after
+                                     * the base spanning the whole class. Fingerprint:
+                                     * a raw callable def with an IDENTICAL span to
+                                     * the adopted type def whose name is one of the
+                                     * adopted def's base classes. A real method is
+                                     * a strict subset of the class span and never
+                                     * carries a base-class name. */
+                                    if (d->label && cbm_def_label_is_type(d->label) && superseded &&
+                                        d->base_classes) {
+                                        for (int j = 0; j < defs_before; j++) {
+                                            CBMDefinition *r = &result->defs.items[j];
+                                            if (!r->label || !r->name ||
+                                                !cbm_def_label_is_callable(r->label) ||
+                                                r->start_line != d->start_line ||
+                                                r->end_line != d->end_line) {
+                                                continue;
+                                            }
+                                            for (const char **b = d->base_classes; *b; b++) {
+                                                if (strcmp(*b, r->name) == 0) {
+                                                    superseded[j] = 1;
+                                                    break;
+                                                }
+                                            }
+                                        }
+                                    }
+                                    if (rescued_count < 64) {
+                                        rescued_spans[rescued_count].start = d->start_line;
+                                        rescued_spans[rescued_count].end = d->end_line;
+                                        rescued_count++;
+                                    }
                                     result->defs.items[w++] = *d;
                                 }
                             }
+                            if (superseded) {
+                                int rw = 0;
+                                for (int j = 0; j < defs_before; j++) {
+                                    if (!superseded[j]) {
+                                        result->defs.items[rw++] = result->defs.items[j];
+                                    }
+                                }
+                                int shift = defs_before - rw;
+                                if (shift > 0 && w > defs_before) {
+                                    memmove(&result->defs.items[rw],
+                                            &result->defs.items[defs_before],
+                                            (size_t)(w - defs_before) * sizeof(CBMDefinition));
+                                }
+                                w -= shift;
+                                cbm_free(CBM_MEM_CLASS_EXTRACT, superseded);
+                            }
                             result->defs.count = w;
                         }
                     }
@@ -2060,7 +2835,7 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
          * splitting a brace inside a recovered function looks unrecovered:
          * the refinement keeps only the discarded branch, the function starts
          * above it, and the evidence falls outside the range. */
-        cbm_subtract_recovered_regions(&regs, &result->defs);
+        cbm_subtract_recovered_regions(&regs, &result->defs, source, source_len);
         /* Phase 2: cut what is left down to the lines the preprocessed parse
          * could not explain. */
         if (pp_line_map) {
@@ -2108,26 +2883,141 @@ static CBMFileResult *extract_file_ex_body(const char *source, int source_len, C
     return result;
 }
 
+/* ── Per-worker working arena (see cbm.h) ───────────────────────────── */
+static CBM_TLS CBMArena tl_work_arena;
+static CBM_TLS bool tl_work_arena_live = false;
+
+/* The traversal scratch arena is kept per worker the same way. A thread keeps
+ * one only after it has given a working arena back (so only pipeline workers,
+ * which call cbm_work_arena_release when they end), and only while it holds no
+ * more than CBM_EXTRACT_SCRATCH_KEEP_BYTES (an outsized file's arena is not
+ * worth holding). Before this every file created and destroyed a
+ * 512 KB block -- 28,145 of them on the Go corpus, 14 GB allocated, 99.9 %
+ * never written and 7,136 never touched (waste sanitizer, 2026-09-17). */
+/* The parked arena lives on the HEAP, reached through a thread-local pointer,
+ * not inline in thread-local storage: a CBMArena is ~4 KB (256 block pointers
+ * and 256 sizes), and static TLS is charged to every thread AND taken out of
+ * each thread's stack allocation — enough of it and a small-stack thread stops
+ * being creatable at all (PR #2233). The holder is allocated once per thread
+ * and reused, so parking still costs no allocation per file. */
+static CBM_TLS CBMArena *tl_scratch_slot;
+static CBM_TLS bool tl_scratch_live = false;
+static CBM_TLS bool tl_scratch_keep = false;
+
+void cbm_work_arena_take(CBMArena *into) {
+    if (tl_work_arena_live) {
+        *into = tl_work_arena;
+        tl_work_arena_live = false;
+        cbm_arena_rewind(into);
+        return;
+    }
+    cbm_arena_init(into);
+}
+
+void cbm_work_arena_release(void) {
+    if (tl_work_arena_live) {
+        cbm_arena_destroy(&tl_work_arena);
+        tl_work_arena_live = false;
+    }
+    if (tl_scratch_live && tl_scratch_slot) {
+        cbm_arena_destroy(tl_scratch_slot);
+        tl_scratch_live = false;
+    }
+    cbm_free(CBM_MEM_CLASS_OTHER, tl_scratch_slot);
+    tl_scratch_slot = NULL;
+    cbm_result_compact_release_thread();
+    tl_scratch_keep = false;
+}
+
+bool cbm_work_arena_keeping(void) {
+    return tl_scratch_keep;
+}
+
+void cbm_work_arena_keep_begin(void) {
+    tl_scratch_keep = true;
+}
+
+void cbm_work_arena_give(CBMArena *from) {
+    if (!from || from->nblocks == 0) {
+        return;
+    }
+    tl_scratch_keep = true; /* a pipeline worker: its release call will come */
+    if (tl_work_arena_live || cbm_arena_capacity(from) > (size_t)CBM_WORK_ARENA_KEEP_BYTES) {
+        cbm_arena_destroy(from);
+        return;
+    }
+    tl_work_arena = *from;
+    tl_work_arena_live = true;
+    memset(from, 0, sizeof(*from));
+}
+
 /* Public entry. Owns the traversal scratch arena for the whole of one file's
  * extraction: created here, handed to the body as ctx->scratch, destroyed on
  * the way out. The body has seven early returns, so bracketing it in a wrapper
- * is what keeps that to one create and one destroy. If the arena cannot be
- * created, the body is handed NULL and the traversal stacks fall back to the
- * result arena, which is what shipped before #1997. */
+ * is what keeps that to one create and one destroy. The arena is LAZY: it takes
+ * its first block when a traversal stack first needs one, so a file that builds
+ * no stack (most non-code files) costs nothing -- opened eagerly, 3.3 GB of
+ * 512 KB blocks were never read or written on the Go corpus (waste sanitizer,
+ * 2026-09-17). If the block cannot be allocated, the stack's allocation fails
+ * and it stops growing, exactly as on any later out-of-memory. */
 CBMFileResult *cbm_extract_file_ex(const char *source, int source_len, CBMLanguage language,
                                    const char *project, const char *rel_path,
                                    int64_t timeout_micros, const char **extra_defines,
                                    const char **include_paths, const CBMMacroTable *macro_table,
                                    const CBMReturnTypeTable *return_type_table) {
     CBMArena scratch;
-    cbm_arena_init_sized(&scratch, CBM_EXTRACT_SCRATCH_BLOCK);
-    CBMFileResult *result = extract_file_ex_body(
-        source, source_len, language, project, rel_path, timeout_micros, extra_defines,
-        include_paths, macro_table, return_type_table, scratch.nblocks > 0 ? &scratch : NULL);
-    cbm_arena_destroy(&scratch);
+    if (tl_scratch_live && tl_scratch_slot) {
+        scratch = *tl_scratch_slot;
+        tl_scratch_live = false;
+        cbm_arena_rewind(&scratch);
+    } else {
+        cbm_arena_init_lazy(&scratch, CBM_EXTRACT_SCRATCH_BLOCK);
+    }
+    CBMFileResult *result = extract_file_ex_body(source, source_len, language, project, rel_path,
+                                                 timeout_micros, extra_defines, include_paths,
+                                                 macro_table, return_type_table, &scratch);
+    /* !tl_scratch_live: a nested extraction (an embedded language inside this
+     * file) may already have parked its own; never overwrite it. */
+    /* Kept up to CBM_EXTRACT_SCRATCH_KEEP_BYTES, grown blocks included: the
+     * definitions walk draws its frames from this arena too, so a file with
+     * many definitions grows it past the first block, and dropping every grown
+     * arena turned those files into fresh 512 KB blocks for the next file. */
+    if (tl_scratch_keep && !tl_scratch_live && scratch.nblocks > 0 &&
+        cbm_arena_capacity(&scratch) <= (size_t)CBM_EXTRACT_SCRATCH_KEEP_BYTES) {
+        if (!tl_scratch_slot) {
+            tl_scratch_slot = cbm_alloc(CBM_MEM_CLASS_OTHER, sizeof(CBMArena));
+        }
+        if (tl_scratch_slot) {
+            *tl_scratch_slot = scratch;
+            tl_scratch_live = true;
+        } else {
+            cbm_arena_destroy(&scratch); /* no holder: keep nothing, stay correct */
+        }
+    } else {
+        cbm_arena_destroy(&scratch);
+    }
     return result;
 }
 
+CBMFileResult *cbm_result_alloc(void) {
+    /* The one raw allocation of a result: cbm_free_result releases it with
+     * the matching free. Extraction and the spill loader both come here. */
+    enum { SINGLE = 1 };
+    return (CBMFileResult *)calloc(SINGLE, sizeof(CBMFileResult));
+}
+
+void cbm_result_release_owned(CBMFileResult *result) {
+    if (!result) {
+        return;
+    }
+    for (int i = 0; i < result->owned_result_count; i++) {
+        cbm_free_result(result->owned_results[i]);
+    }
+    free(result->owned_results);
+    result->owned_results = NULL;
+    result->owned_result_count = 0;
+}
+
 void cbm_free_result(CBMFileResult *result) {
     if (!result) {
         return;
@@ -2136,12 +3026,7 @@ void cbm_free_result(CBMFileResult *result) {
         ts_tree_delete(result->cached_tree);
         result->cached_tree = NULL;
     }
-    for (int i = 0; i < result->owned_result_count; i++) {
-        cbm_free_result(result->owned_results[i]);
-    }
-    free(result->owned_results);
-    result->owned_results = NULL;
-    result->owned_result_count = 0;
+    cbm_result_release_owned(result);
     cbm_arena_destroy(&result->arena);
     free(result);
 }
diff --git a/internal/cbm/cbm.h b/internal/cbm/cbm.h
index a5bdba999..a00192a18 100644
--- a/internal/cbm/cbm.h
+++ b/internal/cbm/cbm.h
@@ -6,6 +6,17 @@
 #include "arena.h"
 #include "tree_sitter/api.h"
 
+/* Field lookups by NAME resolve the name with a linear strncmp scan over the
+ * grammar's field table on every call -- 951 M strncmp calls on the Go corpus
+ * (waste sanitizer, 2026-09-17) across ~1,200 call sites. Tree-sitter's own
+ * implementation is exactly "field id for name, then child by field id"; this
+ * caches the first half per thread (language, name) and keeps the second.
+ * Every extractor includes this header, so every call site gets it. */
+TSNode cbm_ts_child_by_field_name(TSNode node, const char *name, uint32_t name_length);
+/* Variadic: call sites spell the name and its length as ONE macro argument
+ * (TS_FIELD("body") expands to "body", 4), which must expand before the call. */
+#define ts_node_child_by_field_name(...) cbm_ts_child_by_field_name(__VA_ARGS__)
+
 // Language enum mirrors lang.Language in Go.
 // Order must match lang_specs.c tables.
 typedef enum {
@@ -248,31 +259,41 @@ typedef enum {
 } CBMSourceOrigin;
 
 typedef struct {
-    const char *callee_name;            // raw callee text ("pkg.Func", "foo")
-    const char *enclosing_func_qn;      // QN of enclosing function (or module QN)
-    const char *first_string_arg;       // first string literal argument (URL, topic, key) or NULL
-    const char *second_arg_name;        // second argument identifier (handler ref) or NULL
-    CBMCallArg args[CBM_MAX_CALL_ARGS]; // first N arguments with expressions
-    int arg_count;                      // number of captured arguments
-    int loop_depth;                     // enclosing loop nesting at the call site
-    int branch_depth;                   // enclosing branch nesting at the call site
-    int start_line;                     // 1-based source line of the call (for def range-match)
-    uint32_t site_start_byte;           // exact AST occurrence span; end > start when present
-    uint32_t site_end_byte;             // exclusive byte offset in the source file
-    CBMSourceOrigin source_origin;      // raw source or C-family preprocessed buffer
-    bool is_method;                     // method/member call with an UNRESOLVED receiver. Perl:
-                                        // arrow/method call ($obj->m). TS/JS/TSX: member call
-                                        // x.foo() whose receiver is not this/super. Python:
-                                        // x.foo() where x is not self/cls/super() and is not
-                                        // rooted in an imported name. Read by the weak-member
-                                        // guard and by the pxc synthetic-carrier dedup key in
-                                        // pass_lsp_cross.c. Default false.
-    bool requires_lsp_resolution;       // synthetic semantic candidate (for example an implicit
-                                        // C++ operator). Never fall back to textual resolution.
-    bool callee_is_locally_bound;       // bare call foo() whose callee identifier is bound as a
-                                        // parameter of an enclosing function, so it cannot be the
-                                        // module-level foo. Python only today. Read by the
-                                        // weak-local-binding guard. Default false.
+    const char *callee_name;       // raw callee text ("pkg.Func", "foo")
+    const char *enclosing_func_qn; // QN of enclosing function (or module QN)
+    const char *first_string_arg;  // first string literal argument (URL, topic, key) or NULL
+    const char *second_arg_name;   // second argument identifier (handler ref) or NULL
+    /* First arg_count captured arguments, arena-allocated on first capture;
+     * NULL when arg_count == 0. Was an inline args[CBM_MAX_CALL_ARGS] (256 of
+     * the record's 320 bytes) -- the Go corpus census (2026-09-13) put 825k
+     * calls at 251 MB with most of that empty slots. Readers index it exactly
+     * as before; only `sizeof` changed. */
+    CBMCallArg *args;
+    int arg_count;                   // number of captured arguments (<= CBM_MAX_CALL_ARGS)
+    int loop_depth;                  // enclosing loop nesting at the call site
+    int branch_depth;                // enclosing branch nesting at the call site
+    int start_line;                  // 1-based source line of the call (for def range-match)
+    uint32_t site_start_byte;        // exact AST occurrence span; end > start when present
+    uint32_t site_end_byte;          // exclusive byte offset in the source file
+    CBMSourceOrigin source_origin;   // raw source or C-family preprocessed buffer
+    bool is_method;                  // method/member call with an UNRESOLVED receiver. Perl:
+                                     // arrow/method call ($obj->m). TS/JS/TSX: member call
+                                     // x.foo() whose receiver is not this/super. Python:
+                                     // x.foo() where x is not self/cls/super() and is not
+                                     // rooted in an imported name. Read by the weak-member
+                                     // guard and by the pxc synthetic-carrier dedup key in
+                                     // pass_lsp_cross.c. Default false.
+    bool requires_lsp_resolution;    // synthetic semantic candidate (for example an implicit
+                                     // C++ operator). Never fall back to textual resolution.
+    bool callee_is_locally_bound;    // bare call foo() whose callee identifier is bound as a
+                                     // parameter of an enclosing function, so it cannot be the
+                                     // module-level foo. Python only today. Read by the
+                                     // weak-local-binding guard. Default false.
+    bool receiver_is_self_attribute; // Python member call whose receiver is an attribute
+                                     // chain rooted at self/cls but not self/cls itself
+                                     // (self.compiler.apply_converters()). An object the
+                                     // class owns, not a parameter: read by the weak-member
+                                     // guard's unique-name exemption. Default false.
 } CBMCall;
 
 typedef struct {
@@ -286,16 +307,18 @@ typedef enum {
 } CBMUsageKind;
 
 typedef struct {
-    const char *ref_name;            // referenced identifier
-    const char *enclosing_func_qn;   // QN of enclosing function (or module QN)
+    const char *ref_name;          // referenced identifier
+    const char *enclosing_func_qn; // QN of enclosing function (or module QN)
+    /* Fixed-width fields grouped so the record packs to 40 bytes (was 48; the
+     * Go corpus holds 4.68M of these). Field meanings unchanged. */
+    uint32_t lexical_scope_id;       // extraction-local scope instance; never graph identity
+    uint32_t site_start_byte;        // exact reference-token span; end > start when present
+    uint32_t site_end_byte;          // exclusive byte offset in the source file
     CBMUsageKind kind;               // ordinary USAGE or explicit callable reference
+    CBMSourceOrigin source_origin;   // raw source or C-family preprocessed buffer
     bool may_be_call_reference;      // syntactic candidate; exact LSP proof may upgrade its edge
     bool semantic_reference_blocked; // lexical evidence blocks only unproven textual fallback
     bool semantic_reference_local_shadow; // blocker belongs to a non-module lexical scope
-    uint32_t lexical_scope_id;            // extraction-local scope instance; never graph identity
-    uint32_t site_start_byte;             // exact reference-token span; end > start when present
-    uint32_t site_end_byte;               // exclusive byte offset in the source file
-    CBMSourceOrigin source_origin;        // raw source or C-family preprocessed buffer
     bool is_member_access;                // token is the member half of a selector/attribute
                                           // (Go x.f — field_identifier). The extractor strips
                                           // the receiver, so this is the only surviving record
@@ -541,7 +564,22 @@ typedef struct CBMFileResult {
     int error_region_count;
     bool is_test_file;
     int imports_count;
-    TSTree *cached_tree;     // retained parse tree (caller frees via cbm_free_tree)
+    TSTree *cached_tree; // retained parse tree (caller frees via cbm_free_tree)
+    /* The parse alone used more than its share of the per-file budget: the
+     * per-file LSP walk and the cross-file resolve skip this file (its
+     * unified-extractor defs stay). Set by cbm_extract_file_ex, honoured by
+     * cbm_pxc_dispatch_file -- one site for every language. */
+    bool lsp_skipped;
+    /* The unified walk stopped at its CPU budget: defs/calls/usages found up
+     * to that point are kept, the rest of the file is not walked. Implies
+     * lsp_skipped. */
+    bool walk_truncated;
+    /* Size of this file's parse tree, and how much of it the unified walk got
+     * through. Reported for a truncated or LSP-skipped file so the coverage
+     * report says how much of it is missing, instead of leaving the gap
+     * silent. */
+    uint32_t tree_nodes;
+    uint32_t walk_nodes_visited;
     CBMLanguage cached_lang; // language of cached tree (for parser selection)
 
     // Retained source bytes — copied into `arena` by the parallel
@@ -632,6 +670,19 @@ typedef struct {
      * class-body variable def records which class declares it (parent_class)
      * without changing its module-level qualified name. NULL elsewhere. */
     const char *var_parent_class;
+    /* Per-file walk budget in VISITED NODES (0 = unbounded). The unified cursor
+     * walk stops once it is spent, so no single file can hold a worker for
+     * minutes: a 23 MB single-expression C# test file cost 346 s in usage
+     * stamping alone (tree-sitter's ts_node_parent descends from the root,
+     * quadratic on a deep tree; 2026-09-14). What was extracted before the stop
+     * is kept, and the file is named in the coverage report. Counted in nodes
+     * rather than CPU time so that the same file always stops at the same node
+     * — see CBM_WALK_MAX_NODES_DEFAULT for what a clock did here. */
+    uint32_t walk_budget_nodes;
+    bool walk_budget_exhausted;
+    /* How many nodes the unified walk actually visited (whether or not it ran
+     * out of budget) — the measurement the budget has to be expressed in. */
+    uint32_t walk_nodes_visited;
 } CBMExtractCtx;
 
 // --- Public API ---
@@ -645,6 +696,12 @@ typedef struct {
 // also calls it so non-main entry points (pipeline passes) still get the binds.
 // In the test build (no CBM_BIND_TS_ALLOCATOR) this is a no-op.
 void cbm_alloc_init(void);
+/* SQLite allocates from a dedicated mimalloc heap per thread while on; the
+ * index worker turns it on (its default heap holds the graph). Off elsewhere:
+ * a thread-per-connection daemon would pin connection-lifetime blocks to
+ * dead threads. The switch exists in every build; it changes nothing where
+ * the allocator binds are compiled out. */
+void cbm_sqlite_dedicated_heap(bool on);
 
 // Initialize the library. Call once at startup. Returns 0 on success.
 int cbm_init(void);
@@ -675,6 +732,41 @@ void cbm_index_mark_done(const char *rel_path);
 // Extract all data from one file. Caller must call cbm_free_result().
 // source must remain valid for the duration of the call.
 // timeout_micros: per-file parse timeout in microseconds (0 = no timeout).
+/* Compact a finished result: copy everything reachable from it -- every
+ * record array at exact count, every string once (interned by content within
+ * the file), the retained source -- into one exact-size arena, and destroy the
+ * working arena the extractors wrote into. Measured on the Go corpus
+ * (2026-09-13): 14.8 GB written per index, 3.4 GB reachable; the rest was
+ * node-text copies and abandoned array generations no one could free because
+ * the result owned the arena. Call once, after the last per-file write and
+ * before the result is cached for later passes. Later appends into the arena
+ * still work (growth restarts at the default block). A composite's owned
+ * per-unit results are released: after the deep copy nothing points at them.
+ * On allocation failure the result is left exactly as it was. */
+void cbm_result_compact(CBMFileResult *result);
+
+/* The working arena the extractors write into, per worker thread. Extraction
+ * takes it (rewound, pages still mapped) instead of allocating a fresh arena
+ * per file; compaction returns it instead of destroying it. Reusing the same
+ * addresses directly is what stops the purge/re-commit churn that kept a
+ * kernel worker at 15 GB resident with 4-5 GB charged. An arena that grew past
+ * CBM_WORK_ARENA_KEEP_BYTES (one giant file) is destroyed, not kept. */
+enum { CBM_WORK_ARENA_KEEP_BYTES = 16 * 1024 * 1024 };
+void cbm_work_arena_take(CBMArena *into);
+void cbm_work_arena_give(CBMArena *from);
+/* Drop this thread's kept working arena (end of an extraction pass). */
+void cbm_work_arena_release(void);
+/* True on a thread that has given a working arena back, i.e. a pipeline
+ * worker whose cbm_work_arena_release is guaranteed to run: only such a thread
+ * may keep per-thread scratch between files. */
+bool cbm_work_arena_keeping(void);
+/* Let this thread keep its per-file extraction scratch between the files of a
+ * sequential loop; the caller must call cbm_work_arena_release on the same
+ * thread when the loop ends (every return path). */
+void cbm_work_arena_keep_begin(void);
+/* Free the compaction scratch this thread kept (cbm_work_arena_release calls it). */
+void cbm_result_compact_release_thread(void);
+
 CBMFileResult *cbm_extract_file(const char *source, int source_len, CBMLanguage language,
                                 const char *project, const char *rel_path, int64_t timeout_micros,
                                 const char **extra_defines, // NULL-terminated, or NULL
@@ -696,6 +788,12 @@ CBMFileResult *cbm_extract_file_ex(
 // Free all memory associated with a result.
 void cbm_free_result(CBMFileResult *result);
 
+/* Allocate an empty result; cbm_free_result releases it. */
+CBMFileResult *cbm_result_alloc(void);
+
+/* Release a composite result's per-unit results (the owner of that array). */
+void cbm_result_release_owned(CBMFileResult *result);
+
 // Free only the cached tree from a result (caller retained it for reuse).
 void cbm_free_tree(CBMFileResult *result);
 
@@ -710,6 +808,25 @@ void cbm_reset_thread_parser(void);
 // Destroy the thread-local parser. Call on worker thread exit.
 void cbm_destroy_thread_parser(void);
 
+// This thread's reusable tree cursor, reset to `node`. Child walks run once per
+// visited node; a cursor per walk was a malloc + free of its stack each time
+// (49.8 M on the Go corpus, waste sanitizer 2026-09-17). Valid until the next
+// call on this thread; released with the thread parser.
+TSTreeCursor *cbm_thread_cursor(TSNode node);
+
+// Reusable cursors for RECURSIVE walks: one per recursion depth on this thread,
+// so a walk that recurses from inside its child loop never shares a cursor with
+// its own callers. A slot already in use (another walker nested on this thread)
+// hands out a private cursor instead; release deletes it. Released with the
+// thread parser.
+typedef struct {
+    TSTreeCursor *cursor;
+    TSTreeCursor private_cursor;
+    int slot; /* -1: private */
+} cbm_cursor_lease_t;
+TSTreeCursor *cbm_cursor_acquire(cbm_cursor_lease_t *lease, int depth, TSNode node);
+void cbm_cursor_release(cbm_cursor_lease_t *lease);
+
 // Shutdown the library. Call once at exit.
 void cbm_shutdown(void);
 
diff --git a/internal/cbm/extract_calls.c b/internal/cbm/extract_calls.c
index c22a11e01..e1de896b8 100644
--- a/internal/cbm/extract_calls.c
+++ b/internal/cbm/extract_calls.c
@@ -258,9 +258,18 @@ static char *extract_constructor_callee(CBMArena *a, TSNode node, const char *so
 }
 
 // Try common field-based callee resolution (function, name, method fields).
+static TSNode unwrap_await_callee(TSNode node) {
+    if (ts_node_is_null(node) || strcmp(ts_node_type(node), "await_expression") != 0 ||
+        ts_node_named_child_count(node) == 0) {
+        return node;
+    }
+    return ts_node_named_child(node, 0);
+}
+
 static char *extract_callee_from_fields(CBMArena *a, TSNode node, const char *source) {
     // Try "function" field
     TSNode func_node = ts_node_child_by_field_name(node, TS_FIELD("function"));
+    func_node = unwrap_await_callee(func_node);
     if (!ts_node_is_null(func_node)) {
         const char *fk = ts_node_type(func_node);
         if (strcmp(fk, "selector_expression") == 0) {
@@ -2059,6 +2068,20 @@ static void extract_call_args(CBMExtractCtx *ctx, TSNode args, CBMCall *call) {
     for (uint32_t ai = 0; ai < argc && call->arg_count < CBM_MAX_CALL_ARGS; ai++) {
         TSNode arg_node = ts_node_named_child(args, ai);
         const char *ak = ts_node_type(arg_node);
+        /* tree-sitter lists a comment inside the argument list as a named
+         * child (Java block_comment/line_comment, C-family comment). It is
+         * not an argument: taken as one, a leading block comment became
+         * args[0] and the Route pass read its text as a URL. */
+        if (strcmp(ak, "comment") == 0 || strcmp(ak, "line_comment") == 0 ||
+            strcmp(ak, "block_comment") == 0) {
+            continue;
+        }
+        if (!call->args) {
+            call->args = cbm_arena_calloc(ctx->arena, CBM_MAX_CALL_ARGS * sizeof(CBMCallArg));
+            if (!call->args) {
+                return;
+            }
+        }
         CBMCallArg *ca = &call->args[call->arg_count];
         memset(ca, 0, sizeof(*ca));
 
@@ -2257,6 +2280,61 @@ static const char *extract_binary_concat_suffix(CBMExtractCtx *ctx, TSNode node)
 }
 
 // Try to extract URL/topic from a positional argument (string or constant).
+/* Swift names its call arguments, so each one is a value_argument that may lead
+ * with a value_argument_label — the `from:` in `data(from: url)`. Return the
+ * value itself, and leave any other node exactly as it came in. */
+static TSNode swift_argument_value(TSNode arg) {
+    if (strcmp(ts_node_type(arg), "value_argument") != 0 || ts_node_named_child_count(arg) == 0) {
+        return arg;
+    }
+    TSNode val = ts_node_named_child(arg, 0);
+    if (strcmp(ts_node_type(val), "value_argument_label") == 0 &&
+        ts_node_named_child_count(arg) > 1) {
+        val = ts_node_named_child(arg, 1);
+    }
+    return val;
+}
+
+/* Swift has no URL literal, so almost no real code passes a bare string to a
+ * request. It writes `URL(string: "https://…")!` instead, and the literal then
+ * sits two levels down: past the trailing `!`, which the grammar models as a
+ * postfix_expression, and inside the constructor's own argument list.
+ *
+ * Unwrap both so that literal is as reachable as a bare one. Only the three
+ * Foundation types that take a URL string are unwrapped — any other call keeps
+ * its own meaning, and a non-literal argument such as `URL(string: base + path)`
+ * falls through to the ordinary handling unchanged. */
+static TSNode swift_unwrap_url_constructor(CBMExtractCtx *ctx, TSNode arg) {
+    /* Step past a trailing "!" or "?". */
+    if (strcmp(ts_node_type(arg), "postfix_expression") == 0) {
+        TSNode target = ts_node_child_by_field_name(arg, TS_FIELD("target"));
+        if (!ts_node_is_null(target)) {
+            arg = target;
+        }
+    }
+    if (strcmp(ts_node_type(arg), "call_expression") != 0) {
+        return arg;
+    }
+    TSNode callee = ts_node_named_child(arg, 0);
+    if (ts_node_is_null(callee) || strcmp(ts_node_type(callee), "simple_identifier") != 0) {
+        return arg;
+    }
+    const char *name = cbm_node_text(ctx->arena, callee, ctx->source);
+    if (!name || (strcmp(name, "URL") != 0 && strcmp(name, "URLComponents") != 0 &&
+                  strcmp(name, "URLRequest") != 0)) {
+        return arg;
+    }
+    TSNode suffix = cbm_find_child_by_kind(arg, "call_suffix");
+    if (ts_node_is_null(suffix)) {
+        return arg;
+    }
+    TSNode inner = cbm_find_child_by_kind(suffix, "value_arguments");
+    if (ts_node_is_null(inner) || ts_node_named_child_count(inner) == 0) {
+        return arg;
+    }
+    return swift_argument_value(ts_node_named_child(inner, 0));
+}
+
 static const char *extract_positional_url(CBMExtractCtx *ctx, TSNode arg, const char *ak) {
     /* JS/TS template literals: `/things/${id}` normalizes to "/things/{}" so the
      * client URL joins the server route's canonical placeholder (issue #1006). */
@@ -2300,15 +2378,12 @@ static const char *extract_url_or_topic_arg(CBMExtractCtx *ctx, TSNode args) {
         }
         /* Swift wraps each argument in a value_argument that may lead with its
          * label, so `data(from: url)` would otherwise yield the label `from`
-         * rather than the value. Step past a leading value_argument_label. */
-        if (strcmp(ts_node_type(arg), "value_argument") == 0 &&
-            ts_node_named_child_count(arg) > 0) {
-            TSNode val = ts_node_named_child(arg, 0);
-            if (strcmp(ts_node_type(val), "value_argument_label") == 0 &&
-                ts_node_named_child_count(arg) > 1) {
-                val = ts_node_named_child(arg, 1);
-            }
-            arg = val;
+         * rather than the value. */
+        arg = swift_argument_value(arg);
+        /* A Swift URL is usually built rather than written bare, and the
+         * literal then sits inside that constructor. */
+        if (ctx->language == CBM_LANG_SWIFT) {
+            arg = swift_unwrap_url_constructor(ctx, arg);
         }
         const char *ak = ts_node_type(arg);
 
@@ -2950,6 +3025,28 @@ static char *resolve_objectscript_instance_call(CBMArena *a, TSNode node, const
  * statically-known type here, so the call must not bind by short name alone.
  * Note `self.client.send()` is NOT exempt: the receiver is `self.client`, an
  * attribute of unknown type, not `self` itself. */
+/* True when a Python attribute-call receiver is an attribute chain ROOTED at
+ * self/cls but is not self/cls itself: `self.compiler.apply_converters()` has
+ * receiver `self.compiler`, an object the class owns. The weak-member guard's
+ * unique-name exemption keys on this shape (see cbm_weak_member_unique_name_
+ * exempt): a bare parameter (`accelerator.backward()`) carries no ownership
+ * evidence and stays suppressed. Direct `self.m()` is already exempt via
+ * python_receiver_is_exempt and is deliberately NOT flagged here. */
+static bool python_receiver_rooted_at_self(CBMExtractCtx *ctx, TSNode receiver) {
+    if (ts_node_is_null(receiver) || strcmp(ts_node_type(receiver), "attribute") != 0) {
+        return false;
+    }
+    TSNode root = receiver;
+    while (!ts_node_is_null(root) && strcmp(ts_node_type(root), "attribute") == 0) {
+        root = ts_node_child_by_field_name(root, TS_FIELD("object"));
+    }
+    if (ts_node_is_null(root) || strcmp(ts_node_type(root), "identifier") != 0) {
+        return false;
+    }
+    char *name = cbm_node_text(ctx->arena, root, ctx->source);
+    return name && (strcmp(name, "self") == 0 || strcmp(name, "cls") == 0);
+}
+
 static bool python_receiver_is_exempt(CBMExtractCtx *ctx, TSNode receiver) {
     if (ts_node_is_null(receiver)) {
         return false;
@@ -3515,6 +3612,7 @@ static CBMPrimaryCalleeSelection select_primary_callee(CBMExtractCtx *ctx, TSNod
     }
 
     selection.expr = language_specific_callee_expr(ctx->language, node);
+    selection.expr = unwrap_await_callee(selection.expr);
     if (is_dynamic_callee_expr(ctx, selection.expr)) {
         selection.expr = (TSNode){0};
         return selection;
@@ -3679,6 +3777,7 @@ CBMInvocationDescriptor handle_calls(CBMExtractCtx *ctx, TSNode node, const CBML
                 if (!ts_node_is_null(fn) && strcmp(ts_node_type(fn), "attribute") == 0) {
                     TSNode obj = ts_node_child_by_field_name(fn, TS_FIELD("object"));
                     call.is_method = !python_receiver_is_exempt(ctx, obj);
+                    call.receiver_is_self_attribute = python_receiver_rooted_at_self(ctx, obj);
                 } else if (!ts_node_is_null(fn) && strcmp(ts_node_type(fn), "identifier") == 0) {
                     call.callee_is_locally_bound = python_callee_is_bound_parameter(ctx, state, fn);
                 }
@@ -3768,6 +3867,13 @@ CBMInvocationDescriptor handle_calls(CBMExtractCtx *ctx, TSNode node, const CBML
                         if (strcmp(ack, "method_arg") != 0) {
                             continue;
                         }
+                        if (!call.args) {
+                            call.args = cbm_arena_calloc(ctx->arena,
+                                                         CBM_MAX_CALL_ARGS * sizeof(CBMCallArg));
+                            if (!call.args) {
+                                break;
+                            }
+                        }
                         CBMCallArg *ca = &call.args[call.arg_count];
                         memset(ca, 0, sizeof(*ca));
                         ca->index = call.arg_count;
diff --git a/internal/cbm/extract_defs.c b/internal/cbm/extract_defs.c
index b49147dc6..916f1136f 100644
--- a/internal/cbm/extract_defs.c
+++ b/internal/cbm/extract_defs.c
@@ -3477,6 +3477,159 @@ static TSNode find_function_params(TSNode func_node, CBMLanguage lang) {
     return params;
 }
 
+/* ── C-family declared return type ──────────────────────────────────
+ * The C-family grammars split a declared return type three ways: the `type`
+ * field (`char`), sibling type_qualifier nodes (`const`), and the
+ * pointer/reference declarators wrapping the function declarator (`*`). Taking
+ * only the `type` field published `const char *get_name(void)` as "char".
+ *
+ * Canonical spelling: leading cv-qualifiers in source order, the base type text
+ * verbatim, then one space and the declarator markers outermost-first with no
+ * space between them — `const char *`, `char **`, `Text &`, `Text *&`. A
+ * qualifier on a pointer level follows its `*` and is separated from the next
+ * marker by a space: `char *const *`. A qualifier written after the base type
+ * (`char const *`) is normalized to the leading position. */
+
+/* Output sink: measures when buf is NULL, writes otherwise. Rendering twice
+ * sizes the arena allocation exactly without a second copy of the logic. */
+typedef struct {
+    char *buf;
+    size_t len;
+} c_rt_out_t;
+
+static void c_rt_put(c_rt_out_t *out, const char *text, size_t n) {
+    if (out->buf) {
+        memcpy(out->buf + out->len, text, n);
+    }
+    out->len += n;
+}
+
+static void c_rt_put_str(c_rt_out_t *out, const char *text) {
+    c_rt_put(out, text, strlen(text));
+}
+
+static void c_rt_put_node(c_rt_out_t *out, TSNode node, const char *source) {
+    uint32_t start = ts_node_start_byte(node);
+    uint32_t end = ts_node_end_byte(node);
+    if (end > start) {
+        c_rt_put(out, source + start, (size_t)(end - start));
+    }
+}
+
+/* type_qualifier also covers keywords that are not part of the type
+ * (`constexpr`, `_Noreturn`, `mutable`, `__extension__`, …). Keep only the ones
+ * that are, so `constexpr int f()` still returns "int". */
+static bool is_c_return_cv_qualifier(TSNode node, const char *source) {
+    static const char *const kept[] = {"const",        "volatile", "restrict", "__restrict",
+                                       "__restrict__", "_Atomic",  NULL};
+    if (strcmp(ts_node_type(node), "type_qualifier") != 0) {
+        return false;
+    }
+    uint32_t start = ts_node_start_byte(node);
+    uint32_t end = ts_node_end_byte(node);
+    size_t len = end > start ? (size_t)(end - start) : 0;
+    for (const char *const *k = kept; *k; k++) {
+        if (strlen(*k) == len && memcmp(source + start, *k, len) == 0) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static bool is_c_declarator_lang(CBMLanguage lang) {
+    return lang == CBM_LANG_C || lang == CBM_LANG_CPP || lang == CBM_LANG_CUDA ||
+           lang == CBM_LANG_GLSL || lang == CBM_LANG_HLSL || lang == CBM_LANG_ISPC ||
+           lang == CBM_LANG_SLANG || lang == CBM_LANG_OBJC;
+}
+
+/* Render the canonical return type into `out`; returns how many qualifiers and
+ * markers were added around the base type (0 = the base text alone is already
+ * the whole type). The declarator walk is one strict child chain, so it is
+ * O(depth) with no recursion and needs no depth cap. It stops at the first node
+ * that is neither a pointer nor a reference declarator: for a function returning
+ * a function pointer (`int (*f(void))(int)`) that is the outer
+ * function_declarator, which leaves the base type as it was. */
+static size_t c_rt_render(c_rt_out_t *out, TSNode func_node, TSNode type_node, TSNode declarator,
+                          const char *source) {
+    size_t added = 0;
+    uint32_t decl_start = ts_node_start_byte(declarator);
+    uint32_t nc = ts_node_named_child_count(func_node);
+    for (uint32_t i = 0; i < nc; i++) {
+        TSNode ch = ts_node_named_child(func_node, i);
+        if (ts_node_start_byte(ch) >= decl_start) {
+            break;
+        }
+        if (is_c_return_cv_qualifier(ch, source)) {
+            c_rt_put_node(out, ch, source);
+            c_rt_put_str(out, " ");
+            added++;
+        }
+    }
+    c_rt_put_node(out, type_node, source);
+
+    bool need_space = true;
+    TSNode decl = declarator;
+    while (!ts_node_is_null(decl)) {
+        const char *dk = ts_node_type(decl);
+        bool is_ref = strcmp(dk, "reference_declarator") == 0;
+        if (!is_ref && strcmp(dk, "pointer_declarator") != 0) {
+            break;
+        }
+        if (need_space) {
+            c_rt_put_str(out, " ");
+            need_space = false;
+        }
+        /* A reference_declarator opens with its `&` / `&&` token. */
+        TSNode marker = ts_node_child(decl, 0);
+        if (is_ref && !ts_node_is_null(marker) && !ts_node_is_named(marker)) {
+            c_rt_put_node(out, marker, source);
+        } else {
+            c_rt_put_str(out, is_ref ? "&" : "*");
+        }
+        added++;
+        uint32_t dn = ts_node_named_child_count(decl);
+        for (uint32_t i = 0; i < dn; i++) {
+            TSNode q = ts_node_named_child(decl, i);
+            if (is_c_return_cv_qualifier(q, source)) {
+                c_rt_put_node(out, q, source);
+                need_space = true;
+                added++;
+            }
+        }
+        /* tree-sitter-cpp/-cuda give a reference_declarator's inner declarator no
+         * `declarator` field (see find_c_params); it is the one named child. */
+        TSNode inner = ts_node_child_by_field_name(decl, TS_FIELD("declarator"));
+        if (ts_node_is_null(inner) && is_ref && dn > 0) {
+            inner = ts_node_named_child(decl, 0);
+        }
+        decl = inner;
+    }
+    return added;
+}
+
+/* Declared return type of a C-family function/method node whose `type` field is
+ * `type_node`. Any other language, and any type with nothing around its base
+ * type, gets the base type text exactly as before. */
+static char *c_declared_return_type(CBMExtractCtx *ctx, TSNode func_node, TSNode type_node) {
+    CBMArena *a = ctx->arena;
+    TSNode declarator = ts_node_child_by_field_name(func_node, TS_FIELD("declarator"));
+    if (!is_c_declarator_lang(ctx->language) || ts_node_is_null(declarator)) {
+        return cbm_node_text(a, type_node, ctx->source);
+    }
+    c_rt_out_t out = {NULL, 0};
+    if (c_rt_render(&out, func_node, type_node, declarator, ctx->source) == 0) {
+        return cbm_node_text(a, type_node, ctx->source);
+    }
+    out.buf = (char *)cbm_arena_alloc(a, out.len + NULL_TERM);
+    if (!out.buf) {
+        return cbm_node_text(a, type_node, ctx->source);
+    }
+    out.len = 0;
+    (void)c_rt_render(&out, func_node, type_node, declarator, ctx->source);
+    out.buf[out.len] = '\0';
+    return out.buf;
+}
+
 // C++: resolve trailing return type (auto f() -> Type) on a declarator node.
 // Updates def->return_type and def->return_types if trailing type found.
 static void resolve_cpp_trailing_return(CBMArena *a, TSNode func_node, const char *source,
@@ -3712,7 +3865,7 @@ static void extract_func_def(CBMExtractCtx *ctx, TSNode node, const CBMLangSpec
     for (const char **f = rt_fields; *f; f++) {
         TSNode rt = ts_node_child_by_field_name(func_node, *f, (uint32_t)strlen(*f));
         if (!ts_node_is_null(rt)) {
-            def.return_type = cbm_node_text(a, rt, ctx->source);
+            def.return_type = c_declared_return_type(ctx, func_node, rt);
             def.return_types = extract_return_types(a, rt, ctx->source, ctx->language);
             break;
         }
@@ -4964,7 +5117,7 @@ static void push_method_def(CBMExtractCtx *ctx, TSNode child, TSNode class_node,
         for (const char **f = rt_fields; *f; f++) {
             TSNode rt = ts_node_child_by_field_name(child, *f, (uint32_t)strlen(*f));
             if (!ts_node_is_null(rt)) {
-                def.return_type = cbm_node_text(a, rt, ctx->source);
+                def.return_type = c_declared_return_type(ctx, child, rt);
                 break;
             }
         }
@@ -7053,6 +7206,13 @@ typedef struct {
     int cap;
     const char *path; // for the WARN when the ceiling is hit (may be NULL)
     bool warned;
+    /* The per-file traversal scratch (ctx->scratch) when there is one: frames
+     * then come from memory the thread reuses file after file, where a malloc
+     * of 256 frames per file was 28 k allocations and 255 MB never written on
+     * the Go corpus (waste sanitizer, 2026-09-17). Growth copies into a
+     * doubled buffer and abandons the old one to the arena, like TSNodeStack.
+     * NULL: the heap, freed by the walk. */
+    CBMArena *arena;
 } wd_stack_t;
 
 // Generous safety ceiling (frames), env-overridable via CBM_WALK_DEFS_MAX.
@@ -7082,7 +7242,16 @@ static void wd_push(wd_stack_t *s, TSNode node, const char *enclosing_qn) {
             }
             return; // bounded: stop growing (warned, not silent)
         }
-        walk_defs_frame_t *nd = safe_realloc(s->data, (size_t)ncap * sizeof(walk_defs_frame_t));
+        walk_defs_frame_t *nd = NULL;
+        if (s->arena) {
+            nd = (walk_defs_frame_t *)cbm_arena_alloc(s->arena,
+                                                      (size_t)ncap * sizeof(walk_defs_frame_t));
+            if (nd && s->top > 0) {
+                memcpy(nd, s->data, (size_t)s->top * sizeof(walk_defs_frame_t));
+            }
+        } else {
+            nd = safe_realloc(s->data, (size_t)ncap * sizeof(walk_defs_frame_t));
+        }
         if (!nd) {
             /* OOM — safe_realloc already freed the old buffer. Bail cleanly: drop
              * pending frames so the walk_defs loop drains and exits without a NULL
@@ -7747,6 +7916,7 @@ static void walk_defs(CBMExtractCtx *ctx, TSNode root, const CBMLangSpec *spec,
     (void)depth_unused;
     wd_stack_t s = {0};
     s.path = ctx->rel_path;
+    s.arena = ctx->scratch;
     wd_push(&s, root, ctx->enclosing_class_qn);
 
     while (s.top > 0) {
@@ -7899,7 +8069,9 @@ static void walk_defs(CBMExtractCtx *ctx, TSNode root, const CBMLangSpec *spec,
          * collection is mandatory (see wd_push_children_reverse). */
         wd_push_children_reverse(&s, node, frame.enclosing_class_qn);
     }
-    free(s.data);
+    if (!s.arena) {
+        free(s.data);
+    }
 }
 
 void cbm_extract_definitions_without_module(CBMExtractCtx *ctx) {
diff --git a/internal/cbm/extract_imports.c b/internal/cbm/extract_imports.c
index 544020db3..fcdfc8e09 100644
--- a/internal/cbm/extract_imports.c
+++ b/internal/cbm/extract_imports.c
@@ -133,6 +133,19 @@ static void parse_go_import_spec(CBMExtractCtx *ctx, TSNode spec) {
         return;
     }
 
+    /* cgo: `import "C"` names the cgo PSEUDO-package, not a real one — "C" is
+     * reserved by go/build and no package with that import path can exist.
+     * Emitting it as an ordinary import makes the import resolver fall through
+     * to its symbol-name fallback (cbm_pipeline_resolve_import_node Strategy 3,
+     * pass_pkgmap.c), which matches the literal name "C" against every project
+     * node called C and picks the lexicographically smallest: on a real Go repo
+     * all 27 cgo files pointed their IMPORTS edge at the same unrelated `C`
+     * member of a test helper. Drop it — the C side is not a graph package, and
+     * the file's remaining imports are unaffected. */
+    if (strcmp(path, "C") == 0) {
+        return;
+    }
+
     TSNode name_node = ts_node_child_by_field_name(spec, TS_FIELD("name"));
     const char *local_name =
         !ts_node_is_null(name_node) ? cbm_node_text(a, name_node, ctx->source) : path_last(a, path);
diff --git a/internal/cbm/extract_node_stack.h b/internal/cbm/extract_node_stack.h
index 0013d53b1..30a27968b 100644
--- a/internal/cbm/extract_node_stack.h
+++ b/internal/cbm/extract_node_stack.h
@@ -12,9 +12,9 @@
  *
  * Growth abandons the old buffer in that scratch arena, which is free because
  * the arena dies with the file. The initial capacities below are unchanged, but
- * they are no longer what a small file costs: cbm_extract_file_ex creates the
- * scratch arena's first block for every call, including calls that build no
- * stack at all, and reclaims it on the way out.
+ * they are no longer what a small file costs: cbm_extract_file_ex hands every
+ * call a lazy scratch arena, whose first block is taken by the first stack
+ * built, so a call that builds no stack allocates nothing.
  */
 #ifndef CBM_EXTRACT_NODE_STACK_H
 #define CBM_EXTRACT_NODE_STACK_H
@@ -84,13 +84,14 @@ static inline TSNode ts_nstack_pop(TSNodeStack *s) {
  */
 static inline void ts_nstack_push_children(TSNodeStack *s, TSNode node) {
     int base = s->count;
-    TSTreeCursor cursor = ts_tree_cursor_new(node);
-    if (ts_tree_cursor_goto_first_child(&cursor)) {
+    /* The thread's reusable cursor (cbm_thread_cursor): the walk completes
+     * before anything else on this thread can ask for it. */
+    TSTreeCursor *cursor = cbm_thread_cursor(node);
+    if (ts_tree_cursor_goto_first_child(cursor)) {
         do {
-            ts_nstack_push(s, ts_tree_cursor_current_node(&cursor));
-        } while (ts_tree_cursor_goto_next_sibling(&cursor));
+            ts_nstack_push(s, ts_tree_cursor_current_node(cursor));
+        } while (ts_tree_cursor_goto_next_sibling(cursor));
     }
-    ts_tree_cursor_delete(&cursor);
     /* Reverse [base, count) so the first child pops first (forward order). */
     int lo = base, hi = s->count - 1;
     while (lo < hi) {
diff --git a/internal/cbm/extract_unified.c b/internal/cbm/extract_unified.c
index 5c2905f9c..086f501a0 100644
--- a/internal/cbm/extract_unified.c
+++ b/internal/cbm/extract_unified.c
@@ -5,6 +5,8 @@
 #include "lang_specs.h"      // CBMLangSpec, cbm_lang_spec, CBM_LANG_*
 #include "tree_sitter/api.h" // TSNode, TSTreeCursor, ts_tree_cursor_*, ts_node_*
 #include "foundation/constants.h"
+#include "foundation/compat.h" // cbm_thread_cpu_time_ns
+#include <stdlib.h>
 
 enum { MAX_INFRA_BINDINGS = 8 };
 
@@ -2596,9 +2598,33 @@ void cbm_extract_unified(CBMExtractCtx *ctx) {
     state.branch_depth = 0;
 
     uint32_t depth = 0;
+    uint32_t visited = 0;
+#ifdef CBM_ENABLE_TEST_SEAMS
+    /* CBM_TEST_WALK_BUDGET_NODES=<n>: spend the budget after n nodes. Production
+     * now counts nodes too, so this seam only shortens the budget; it no longer
+     * has to stand in for a mechanism of its own. */
+    uint32_t budget_nodes = ctx->walk_budget_nodes;
+    {
+        const char *seam = getenv("CBM_TEST_WALK_BUDGET_NODES");
+        if (seam && seam[0]) {
+            budget_nodes = (uint32_t)strtoul(seam, NULL, 10);
+        }
+    }
+#else
+    const uint32_t budget_nodes = ctx->walk_budget_nodes;
+#endif
 
     for (;;) {
         TSNode node = ts_tree_cursor_current_node(&cursor);
+        visited++;
+        /* The budget is spent in nodes, so the walk of a given file always ends
+         * on the same node — on any machine, under any load. A CPU deadline
+         * here made the graph differ between two runs on one machine; see
+         * CBM_WALK_MAX_NODES_DEFAULT (cbm.c). */
+        if (budget_nodes != 0 && visited > budget_nodes) {
+            ctx->walk_budget_exhausted = true;
+            break;
+        }
         bool trivia = is_unified_trivia_node(node);
         if (!trivia) {
             /* Trivia consumes no semantic state. Scope expiry may be deferred
@@ -2652,6 +2678,7 @@ void cbm_extract_unified(CBMExtractCtx *ctx) {
     }
 
     cbm_finalize_lexical_usages(ctx, &state);
+    ctx->walk_nodes_visited = visited;
     ts_tree_cursor_delete(&occurrence_cursor);
     ts_tree_cursor_delete(&cursor);
 }
diff --git a/internal/cbm/extract_usages.c b/internal/cbm/extract_usages.c
index fd83864ac..f6b391315 100644
--- a/internal/cbm/extract_usages.c
+++ b/internal/cbm/extract_usages.c
@@ -1355,20 +1355,20 @@ static bool is_direct_argument_value(TSNode node) {
     return !ts_node_is_null(grandparent) && is_argument_container_kind(ts_node_type(grandparent));
 }
 
-/* Cursor-backed counterpart for the unified walker. `cursor` must currently
- * point at `node`; it is consumed while walking toward the argument owner. */
-static bool is_direct_argument_value_cursor(TSNode node, TSTreeCursor *cursor) {
-    TSNode current = node;
-    while (!ts_node_is_null(current)) {
-        TSNode parent;
-        const char *field;
-        if (!occurrence_parent(cursor, current, &parent, &field))
-            return false;
+/* The body of the walk above, entered one level in: for a caller that has
+ * ALREADY stepped the cursor onto `parent` and knows which `field` of it the
+ * node below occupies. A caller that climbed to find its site has that pair in
+ * hand, and re-deriving it would mean either stepping the cursor twice or
+ * paying ts_node_parent for what the cursor just told us. */
+static bool is_direct_argument_value_from(TSNode parent, const char *field, TSTreeCursor *cursor) {
+    for (;;) {
         const char *parent_kind = ts_node_type(parent);
         if (is_labeled_argument_kind(parent_kind)) {
             if (!field || strcmp(field, "value") != 0)
                 return false;
-            current = parent;
+            /* The labeled argument now has to be the argument value itself. */
+            if (!occurrence_parent(cursor, parent, &parent, &field))
+                return false;
             continue;
         }
         if (field && strcmp(field, "arguments") == 0)
@@ -1389,7 +1389,16 @@ static bool is_direct_argument_value_cursor(TSNode node, TSTreeCursor *cursor) {
         return occurrence_parent(cursor, parent, &grandparent, &argument_field) &&
                is_argument_container_kind(ts_node_type(grandparent));
     }
-    return false;
+}
+
+/* Cursor-backed counterpart for the unified walker. `cursor` must currently
+ * point at `node`; it is consumed while walking toward the argument owner. */
+static bool is_direct_argument_value_cursor(TSNode node, TSTreeCursor *cursor) {
+    TSNode parent;
+    const char *field;
+    if (!occurrence_parent(cursor, node, &parent, &field))
+        return false;
+    return is_direct_argument_value_from(parent, field, cursor);
 }
 
 static bool is_direct_argument_value_walk(TSNode node, WalkState *state) {
@@ -1443,15 +1452,36 @@ static bool language_may_stamp_exact_callable_value_candidate(CBMLanguage langua
  * arguments are narrow syntactic candidates only. A language LSP must still
  * prove one target at this exact occurrence before the graph upgrades USAGE to
  * CALL_REFERENCE; unresolved, reassigned, and composite expressions stay USAGE. */
-static TSNode csharp_callable_value_site(TSNode node) {
-    usage_slow_parent_fallback_test_note();
+/* One step up from `site`, on the walk cursor when the caller has one. Every
+ * other language branch in call_reference_candidate_site climbs this way; C#
+ * used ts_node_parent, which tree-sitter answers by descending from the ROOT,
+ * so each step costs O(depth) with a child scan at every level. On the
+ * generated .NET JIT tests — single expressions megabytes deep — that was
+ * 18-48 us per visited node and ~85% of the whole unified walk (sampled
+ * 2026-09-19: stamp_usage_site -> ts_node_parent ->
+ * ts_node_child_with_descendant). Those files are also the ones the old CPU
+ * deadline used to cut off mid-walk, so the slow path and the nondeterminism
+ * it forced were the same defect seen from two ends. */
+static bool csharp_site_parent(TSTreeCursor *cursor, TSNode site, TSNode *parent,
+                               const char **field) {
+    if (!cursor) {
+        usage_slow_parent_fallback_test_note();
+    }
+    return occurrence_parent(cursor, site, parent, field);
+}
+
+static TSNode csharp_callable_value_site(TSNode node, TSNode parent, const char *parent_field,
+                                         TSTreeCursor *cursor) {
     const char *kind = ts_node_type(node);
     if (strcmp(kind, "identifier") != 0 && strcmp(kind, "simple_identifier") != 0) {
         return (TSNode){0};
     }
 
+    /* The caller has already resolved node's parent (and the field it occupies)
+     * with the cursor, so the climb starts from that pair instead of asking for
+     * it again. Invariant below: `parent`/`field` always describe `site`. */
     TSNode site = node;
-    TSNode parent = ts_node_parent(site);
+    const char *field = parent_field;
     if (!ts_node_is_null(parent) && strcmp(ts_node_type(parent), "generic_name") == 0) {
         TSNode name = ts_node_child_by_field_name(parent, TS_FIELD("name"));
         if (ts_node_is_null(name) && ts_node_named_child_count(parent) > 0) {
@@ -1461,7 +1491,9 @@ static TSNode csharp_callable_value_site(TSNode node) {
             return (TSNode){0};
         }
         site = parent;
-        parent = ts_node_parent(site);
+        if (!csharp_site_parent(cursor, site, &parent, &field)) {
+            return (TSNode){0};
+        }
     }
 
     if (!ts_node_is_null(parent) && strcmp(ts_node_type(parent), "member_access_expression") == 0) {
@@ -1470,7 +1502,9 @@ static TSNode csharp_callable_value_site(TSNode node) {
             return (TSNode){0};
         }
         site = parent;
-        parent = ts_node_parent(site);
+        if (!csharp_site_parent(cursor, site, &parent, &field)) {
+            return (TSNode){0};
+        }
     }
 
     while (!ts_node_is_null(parent) &&
@@ -1483,12 +1517,17 @@ static TSNode csharp_callable_value_site(TSNode node) {
             return (TSNode){0};
         }
         site = parent;
-        parent = ts_node_parent(site);
+        if (!csharp_site_parent(cursor, site, &parent, &field)) {
+            return (TSNode){0};
+        }
     }
 
     /* The wrapper chain proves admission, but the semantic row is keyed to the
      * terminal method-name identifier. Keep the raw carrier on that leaf. */
-    return is_direct_argument_value(site) ? node : (TSNode){0};
+    if (ts_node_is_null(parent)) {
+        return (TSNode){0};
+    }
+    return is_direct_argument_value_from(parent, field, cursor) ? node : (TSNode){0};
 }
 
 /* Climb out of the parentheses wrapping a direct argument and return the
@@ -1545,10 +1584,12 @@ static TSNode call_reference_candidate_site(CBMExtractCtx *ctx, TSNode node, con
     const char *parent_field = NULL;
     if (!cursor) {
         usage_slow_parent_fallback_test_note();
-        parent = ts_node_parent(node);
-    } else {
-        (void)occurrence_parent(cursor, node, &parent, &parent_field);
     }
+    /* Resolve the parent AND the field node occupies in it, on both paths. The
+     * C# site walk below carries that field into the argument test, and
+     * ts_node_parent on its own would leave it NULL there — silently losing the
+     * "this node IS the arguments" case whenever no cursor is available. */
+    (void)occurrence_parent(cursor, node, &parent, &parent_field);
     bool ts_family = ctx->language == CBM_LANG_JAVASCRIPT || ctx->language == CBM_LANG_TYPESCRIPT ||
                      ctx->language == CBM_LANG_TSX || ctx->language == CBM_LANG_ARKTS;
     if (ts_family && strcmp(kind, "property_identifier") == 0 && !ts_node_is_null(parent) &&
@@ -1588,7 +1629,7 @@ static TSNode call_reference_candidate_site(CBMExtractCtx *ctx, TSNode node, con
         return is_direct_argument_value_walk(node, state) ? node : (TSNode){0};
     }
     if (ctx->language == CBM_LANG_CSHARP) {
-        return csharp_callable_value_site(node);
+        return csharp_callable_value_site(node, parent, parent_field, cursor);
     }
     if (strcmp(kind, "identifier") != 0 && strcmp(kind, "simple_identifier") != 0) {
         return (TSNode){0};
diff --git a/internal/cbm/lsp/c_lsp.c b/internal/cbm/lsp/c_lsp.c
index c5991561e..374f6f404 100644
--- a/internal/cbm/lsp/c_lsp.c
+++ b/internal/cbm/lsp/c_lsp.c
@@ -63,6 +63,7 @@ void c_lsp_init(CLSPContext *ctx, CBMArena *arena, const char *source, int sourc
     ctx->source = source;
     ctx->source_len = source_len;
     ctx->registry = registry;
+    ctx->registry_head = (CBMTypeRegistry *)registry;
     ctx->module_qn = module_qn;
     ctx->module_qn_len = module_qn ? strlen(module_qn) : 0;
     ctx->enclosing_func_qn = module_qn;
@@ -2819,10 +2820,10 @@ static const CBMRegisteredFunc *c_lookup_member_depth(CLSPContext *ctx, const ch
         size_t slen = strlen(shortn);
         const char *best_qn = NULL;
         CBMTypeShortIter it;
-        cbm_registry_types_by_short_name(ctx->registry, shortn, &it);
+        cbm_registry_types_by_short_name_chain(ctx->registry, shortn, &it);
         int i;
         while ((i = cbm_type_short_iter_next(&it)) >= 0) {
-            const char *q = ctx->registry->types[i].qualified_name;
+            const char *q = it.reg->types[i].qualified_name;
             if (!q) {
                 continue;
             }
@@ -3670,12 +3671,12 @@ static const CBMRegisteredFunc *c_lookup_free_operator(CLSPContext *ctx, const c
     const char *right_ns = extract_namespace_from_qn(ctx->arena, right_qn);
     const CBMRegisteredFunc *match = NULL;
     CBMFreeFuncIter it;
-    cbm_registry_free_funcs_by_short_name(ctx->registry, operator_name, &it);
+    cbm_registry_free_funcs_by_short_name_chain(ctx->registry, operator_name, &it);
     for (int index = cbm_free_func_iter_next(&it); index >= 0;
          index = cbm_free_func_iter_next(&it)) {
-        if (index >= ctx->registry->func_count)
+        if (index >= it.reg->func_count)
             continue;
-        const CBMRegisteredFunc *candidate = &ctx->registry->funcs[index];
+        const CBMRegisteredFunc *candidate = &it.reg->funcs[index];
         if (candidate->receiver_type || !candidate->short_name ||
             strcmp(candidate->short_name, operator_name) != 0 || !candidate->qualified_name) {
             continue;
@@ -3730,13 +3731,13 @@ static const CBMRegisteredFunc *c_lookup_free_unary_operator(CLSPContext *ctx,
     const CBMRegisteredFunc *match = NULL;
     const CBMType *actuals[1] = {operand_type};
     CBMFreeFuncIter it;
-    cbm_registry_free_funcs_by_short_name(ctx->registry, operator_name, &it);
+    cbm_registry_free_funcs_by_short_name_chain(ctx->registry, operator_name, &it);
     for (int index = cbm_free_func_iter_next(&it); index >= 0;
          index = cbm_free_func_iter_next(&it)) {
-        if (index >= ctx->registry->func_count) {
+        if (index >= it.reg->func_count) {
             continue;
         }
-        const CBMRegisteredFunc *candidate = &ctx->registry->funcs[index];
+        const CBMRegisteredFunc *candidate = &it.reg->funcs[index];
         if (candidate->receiver_type || !candidate->short_name ||
             strcmp(candidate->short_name, operator_name) != 0 || !candidate->qualified_name) {
             continue;
@@ -4882,18 +4883,16 @@ static void c_process_function(CLSPContext *ctx, TSNode func_node) {
     // indexing bitcoin). Cross-phase template deduction then relies on the
     // positional fallback, which is graceful degradation.
     if (ctx->in_template && ctx->template_param_count > 0 && !ctx->registry_shared) {
-        // Find the registered function and set type_param_names
-        for (int ri = 0; ri < ((CBMTypeRegistry *)ctx->registry)->func_count; ri++) {
-            CBMRegisteredFunc *rf = &((CBMTypeRegistry *)ctx->registry)->funcs[ri];
-            if (strcmp(rf->qualified_name, func_qn) == 0 && !rf->type_param_names) {
-                const char **tpn = (const char **)cbm_arena_alloc(
-                    ctx->arena, (ctx->template_param_count + 1) * sizeof(const char *));
-                for (int ti = 0; ti < ctx->template_param_count; ti++)
-                    tpn[ti] = ctx->template_param_names[ti];
-                tpn[ctx->template_param_count] = NULL;
-                rf->type_param_names = tpn;
-                break;
-            }
+        // Set type_param_names on the registered function -- on the head's
+        // own copy of it (copy-on-write), never on a shared base entry.
+        CBMRegisteredFunc *rf = cbm_registry_func_for_update(ctx->registry_head, func_qn);
+        if (rf && !rf->type_param_names) {
+            const char **tpn = (const char **)cbm_arena_alloc(
+                ctx->arena, (ctx->template_param_count + 1) * sizeof(const char *));
+            for (int ti = 0; ti < ctx->template_param_count; ti++)
+                tpn[ti] = ctx->template_param_names[ti];
+            tpn[ctx->template_param_count] = NULL;
+            rf->type_param_names = tpn;
         }
     }
 
@@ -4929,12 +4928,9 @@ static void c_process_function(CLSPContext *ctx, TSNode func_node) {
     }
     // Set min_params on the registered function (for default-arg overload matching)
     if (total_params > 0 && defaulted_params > 0) {
-        for (int ri = 0; ri < ((CBMTypeRegistry *)ctx->registry)->func_count; ri++) {
-            CBMRegisteredFunc *rf = &((CBMTypeRegistry *)ctx->registry)->funcs[ri];
-            if (strcmp(rf->qualified_name, func_qn) == 0 && rf->min_params < 0) {
-                rf->min_params = total_params - defaulted_params;
-                break;
-            }
+        CBMRegisteredFunc *rf = cbm_registry_func_for_update(ctx->registry_head, func_qn);
+        if (rf && rf->min_params < 0) {
+            rf->min_params = total_params - defaulted_params;
         }
     }
 
@@ -5059,7 +5055,7 @@ static void c_process_body_child(CLSPContext *ctx, TSNode child) {
                                         tpn[ctx->template_param_count] = NULL;
                                         rf.type_param_names = tpn;
                                     }
-                                    cbm_registry_add_func((CBMTypeRegistry *)ctx->registry, rf);
+                                    cbm_registry_add_func(ctx->registry_head, rf);
                                 }
                             }
                         }
@@ -5161,14 +5157,7 @@ static void c_process_class(CLSPContext *ctx, TSNode class_node) {
 
             // Store template param names on the registered type (for substitution)
             if (ctx->in_template && ctx->template_param_names && ctx->template_param_count > 0) {
-                CBMRegisteredType *rt = NULL;
-                for (int ri = 0; ri < ((CBMTypeRegistry *)ctx->registry)->type_count; ri++) {
-                    if (strcmp(((CBMTypeRegistry *)ctx->registry)->types[ri].qualified_name,
-                               class_qn) == 0) {
-                        rt = &((CBMTypeRegistry *)ctx->registry)->types[ri];
-                        break;
-                    }
-                }
+                CBMRegisteredType *rt = cbm_registry_type_for_update(ctx->registry_head, class_qn);
                 if (rt && !rt->type_param_names) {
                     const char **tpn = (const char **)cbm_arena_alloc(
                         ctx->arena, (ctx->template_param_count + 1) * sizeof(const char *));
@@ -5341,14 +5330,25 @@ static void c_process_class(CLSPContext *ctx, TSNode class_node) {
                                         should_upgrade = true;
                                 }
                                 if (should_upgrade) {
-                                    // Update existing entry's signature return type
-                                    const CBMType **new_rets = (const CBMType **)cbm_arena_alloc(
-                                        ctx->arena, 2 * sizeof(const CBMType *));
-                                    new_rets[0] = actual_ret;
-                                    new_rets[1] = NULL;
-                                    CBMRegisteredFunc *mut = (CBMRegisteredFunc *)existing;
-                                    mut->signature = cbm_type_func_replace_returns(
-                                        ctx->arena, existing->signature, new_rets);
+                                    /* Refine the return type on the HEAD copy only
+                                     * (copy-on-write). `existing` may live in the
+                                     * sealed shared base; writing a scratch-arena
+                                     * signature into it was read by other workers
+                                     * after this file's arena died (ASan heap-use-
+                                     * after-free in c_adl_resolve on dotnet/runtime,
+                                     * 2026-09-14). NULL = the head is sealed too:
+                                     * skip the refinement. */
+                                    CBMRegisteredFunc *mut = cbm_registry_func_for_update(
+                                        ctx->registry_head, existing->qualified_name);
+                                    if (mut) {
+                                        const CBMType **new_rets =
+                                            (const CBMType **)cbm_arena_alloc(
+                                                ctx->arena, 2 * sizeof(const CBMType *));
+                                        new_rets[0] = actual_ret;
+                                        new_rets[1] = NULL;
+                                        mut->signature = cbm_type_func_replace_returns(
+                                            ctx->arena, mut->signature, new_rets);
+                                    }
                                 }
                                 break;
                             }
@@ -5364,7 +5364,7 @@ static void c_process_class(CLSPContext *ctx, TSNode class_node) {
                             rf.receiver_type = ctx->enclosing_class_qn;
                             rf.signature = cbm_type_func(ctx->arena, NULL, NULL, rets);
                             rf.min_params = -1;
-                            cbm_registry_add_func((CBMTypeRegistry *)ctx->registry, rf);
+                            cbm_registry_add_func(ctx->registry_head, rf);
                             break;
                         } else if (strcmp(dk, "reference_declarator") == 0) {
                             actual_ret = cbm_type_reference(ctx->arena, actual_ret);
diff --git a/internal/cbm/lsp/c_lsp.h b/internal/cbm/lsp/c_lsp.h
index 9aa936960..af81d5bbd 100644
--- a/internal/cbm/lsp/c_lsp.h
+++ b/internal/cbm/lsp/c_lsp.h
@@ -13,6 +13,11 @@ typedef struct {
     const char *source;
     int source_len;
     const CBMTypeRegistry *registry;
+    /* The writable head of the registry chain: the per-file overlay the
+     * dispatcher hands in, or the per-file registry on the non-cross path.
+     * Every refinement (lazy add, min_params, template params) goes here
+     * via cbm_registry_*_for_update; nothing behind ->fallback is written. */
+    CBMTypeRegistry *registry_head;
     CBMScope *current_scope;
 
     // Include map: header_path -> namespace QN prefix
@@ -94,9 +99,9 @@ typedef struct {
                           // READ-ONLY across resolve workers — never mutate it
                           // (and never store per-worker arena pointers into it)
     bool debug;
-    int eval_depth; // recursion depth for c_eval_expr_type (crash guard)
-    int eval_steps; // total expression eval calls for current file (hang guard)
-    int walk_depth; // c_resolve_calls_in_node self-recursion (AST nesting)
+    int eval_depth;         // recursion depth for c_eval_expr_type (crash guard)
+    int eval_steps;         // total expression eval calls for current file (hang guard)
+    int walk_depth;         // c_resolve_calls_in_node self-recursion (AST nesting)
     int control_flow_depth; // if/loop/switch/catch nesting; assignments merge fail-closed
 } CLSPContext;
 
diff --git a/internal/cbm/lsp/cs_lsp.c b/internal/cbm/lsp/cs_lsp.c
index 0beed0a56..fc3b548ef 100644
--- a/internal/cbm/lsp/cs_lsp.c
+++ b/internal/cbm/lsp/cs_lsp.c
@@ -492,10 +492,10 @@ const char *cs_resolve_type_name(CSLSPContext *ctx, const char *raw) {
             CBMTypeShortIter ts_it;
             int i;
             if (ctx->registry) {
-                cbm_registry_types_by_short_name(ctx->registry, the_short, &ts_it);
+                cbm_registry_types_by_short_name_chain(ctx->registry, the_short, &ts_it);
             }
             while (ctx->registry && (i = cbm_type_short_iter_next(&ts_it)) >= 0) {
-                const CBMRegisteredType *cand = &ctx->registry->types[i];
+                const CBMRegisteredType *cand = &ts_it.reg->types[i];
                 if (!cand->short_name || strcmp(cand->short_name, the_short) != 0)
                     continue;
                 int score = 0;
@@ -643,12 +643,12 @@ static const CBMRegisteredFunc *cs_lookup_extension(CSLSPContext *ctx, const cha
      * registration-order tie-break exactly (bucket chains are not in funcs[]
      * order). */
     CBMFreeFuncIter ext_it;
-    cbm_registry_free_funcs_by_short_name(ctx->registry, method_name, &ext_it);
+    cbm_registry_free_funcs_by_short_name_chain(ctx->registry, method_name, &ext_it);
     const CBMRegisteredFunc *best = NULL;
     int best_idx = -1;
     int i;
     while ((i = cbm_free_func_iter_next(&ext_it)) >= 0) {
-        const CBMRegisteredFunc *cand = &ctx->registry->funcs[i];
+        const CBMRegisteredFunc *cand = &ext_it.reg->funcs[i];
         if (!cand->short_name || strcmp(cand->short_name, method_name) != 0)
             continue;
         if (cand->receiver_type)
@@ -1522,8 +1522,12 @@ static const char *cs_resolve_callable_name(CSLSPContext *ctx, const char *name)
      * generated fixtures can register receiverless callables. Only accept a
      * unique short-name match; ambiguity is intentionally not guessed. */
     const CBMRegisteredFunc *only = NULL;
-    for (int i = 0; ctx->registry && i < ctx->registry->func_count; i++) {
-        const CBMRegisteredFunc *candidate = &ctx->registry->funcs[i];
+    CBMFreeFuncIter all_funcs;
+    if (ctx->registry) {
+        cbm_registry_all_funcs_chain(ctx->registry, &all_funcs);
+    }
+    for (int i = -1; ctx->registry && (i = cbm_free_func_iter_next(&all_funcs)) >= 0;) {
+        const CBMRegisteredFunc *candidate = &all_funcs.reg->funcs[i];
         if (candidate->receiver_type || !candidate->short_name ||
             strcmp(candidate->short_name, name) != 0) {
             continue;
@@ -2142,8 +2146,12 @@ static void cs_resolve_invocation(CSLSPContext *ctx, TSNode call) {
         /* Last resort: any free function with this short name in registry. */
         const CBMRegisteredFunc *best = NULL;
         int best_score = -1;
-        for (int i = 0; ctx->registry && i < ctx->registry->func_count; i++) {
-            const CBMRegisteredFunc *cand = &ctx->registry->funcs[i];
+        CBMFreeFuncIter all_funcs;
+        if (ctx->registry) {
+            cbm_registry_all_funcs_chain(ctx->registry, &all_funcs);
+        }
+        for (int i = -1; ctx->registry && (i = cbm_free_func_iter_next(&all_funcs)) >= 0;) {
+            const CBMRegisteredFunc *cand = &all_funcs.reg->funcs[i];
             if (cand->receiver_type)
                 continue;
             if (!cand->short_name || strcmp(cand->short_name, bare) != 0)
diff --git a/internal/cbm/lsp/go_lsp.c b/internal/cbm/lsp/go_lsp.c
index 7efa273e1..ba7df163b 100644
--- a/internal/cbm/lsp/go_lsp.c
+++ b/internal/cbm/lsp/go_lsp.c
@@ -1,12 +1,14 @@
 #include "go_lsp.h"
 #include "lsp_node_iter.h"
+#include "../../../src/foundation/hash_table.h"
 #include "../helpers.h"
 #include <string.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdatomic.h>
 
 // Forward declarations
-static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node);
+static void resolve_calls_in_node_inner(GoLSPContext *ctx, TSNode node);
 
 /* Depth-guarded entry for the AST call-resolution walk. The walk recurses once
  * per nesting level; a deeply-nested or cyclic file can overflow the native
@@ -15,7 +17,7 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node);
  * crash. The cap is CBM_LSP_MAX_WALK_DEPTH, env-overridable via the same name.
  * The walk_depth-- runs after the inner returns, so early returns in the body
  * never leak the counter. */
-static void resolve_calls_in_node(GoLSPContext* ctx, TSNode node) {
+static void resolve_calls_in_node(GoLSPContext *ctx, TSNode node) {
     if (ctx->walk_depth >= cbm_lsp_max_walk_depth())
         return;
     ctx->walk_depth++;
@@ -25,14 +27,16 @@ static void resolve_calls_in_node(GoLSPContext* ctx, TSNode node) {
 static void emit_resolved_call(GoLSPContext *ctx, const char *callee_qn, const char *strategy,
                                float confidence, TSNode site);
 static const char *go_exact_callable_target(GoLSPContext *ctx, TSNode node);
-static const CBMType* go_lookup_field(GoLSPContext* ctx, const char* type_qn, const char* field_name, int depth);
-static void extract_type_params_from_ast(CBMArena* arena, CBMTypeRegistry* reg,
-    TSNode root, const char* source, const char* module_qn);
+static const CBMType *go_lookup_field(GoLSPContext *ctx, const char *type_qn,
+                                      const char *field_name, int depth);
+static void extract_type_params_from_ast(CBMArena *arena, CBMTypeRegistry *reg, TSNode root,
+                                         const char *source, const char *module_qn);
 
 // --- Initialization ---
 
-void go_lsp_init(GoLSPContext* ctx, CBMArena* arena, const char* source, int source_len,
-    const CBMTypeRegistry* registry, const char* package_qn, CBMResolvedCallArray* out) {
+void go_lsp_init(GoLSPContext *ctx, CBMArena *arena, const char *source, int source_len,
+                 const CBMTypeRegistry *registry, const char *package_qn,
+                 CBMResolvedCallArray *out) {
     memset(ctx, 0, sizeof(GoLSPContext));
     ctx->arena = arena;
     ctx->source = source;
@@ -43,21 +47,24 @@ void go_lsp_init(GoLSPContext* ctx, CBMArena* arena, const char* source, int sou
     ctx->current_scope = cbm_scope_push(arena, NULL); // root scope
 
     {
-        const char* debug_env = getenv("CBM_LSP_DEBUG");
+        const char *debug_env = getenv("CBM_LSP_DEBUG");
         ctx->debug = (debug_env && debug_env[0]);
     }
 }
 
-void go_lsp_add_import(GoLSPContext* ctx, const char* local_name, const char* pkg_qn) {
+void go_lsp_add_import(GoLSPContext *ctx, const char *local_name, const char *pkg_qn) {
     // Store in parallel arrays (arena-allocated, grow by doubling)
     if (ctx->import_count % 32 == 0) {
         int new_cap = ctx->import_count + 32;
-        const char** new_names = (const char**)cbm_arena_alloc(ctx->arena, (new_cap + 1) * sizeof(const char*));
-        const char** new_qns = (const char**)cbm_arena_alloc(ctx->arena, (new_cap + 1) * sizeof(const char*));
-        if (!new_names || !new_qns) return;
+        const char **new_names =
+            (const char **)cbm_arena_alloc(ctx->arena, (new_cap + 1) * sizeof(const char *));
+        const char **new_qns =
+            (const char **)cbm_arena_alloc(ctx->arena, (new_cap + 1) * sizeof(const char *));
+        if (!new_names || !new_qns)
+            return;
         if (ctx->import_local_names && ctx->import_count > 0) {
-            memcpy(new_names, ctx->import_local_names, ctx->import_count * sizeof(const char*));
-            memcpy(new_qns, ctx->import_package_qns, ctx->import_count * sizeof(const char*));
+            memcpy(new_names, ctx->import_local_names, ctx->import_count * sizeof(const char *));
+            memcpy(new_qns, ctx->import_package_qns, ctx->import_count * sizeof(const char *));
         }
         ctx->import_local_names = new_names;
         ctx->import_package_qns = new_qns;
@@ -69,13 +76,13 @@ void go_lsp_add_import(GoLSPContext* ctx, const char* local_name, const char* pk
 
 // --- Helper: get node text ---
 
-static char* lsp_node_text(GoLSPContext* ctx, TSNode node) {
+static char *lsp_node_text(GoLSPContext *ctx, TSNode node) {
     return cbm_node_text(ctx->arena, node, ctx->source);
 }
 
 // --- Helper: resolve import alias to package QN ---
 
-static const char* resolve_import(GoLSPContext* ctx, const char* local_name) {
+static const char *resolve_import(GoLSPContext *ctx, const char *local_name) {
     for (int i = 0; i < ctx->import_count; i++) {
         if (strcmp(ctx->import_local_names[i], local_name) == 0) {
             return ctx->import_package_qns[i];
@@ -86,31 +93,26 @@ static const char* resolve_import(GoLSPContext* ctx, const char* local_name) {
 
 // --- Helper: check if name is a Go builtin ---
 
-static bool is_go_builtin_func(const char* name) {
-    static const char* builtins[] = {
-        "make", "new", "append", "len", "cap", "delete",
-        "close", "copy", "panic", "recover", "print", "println",
-        "complex", "real", "imag", "min", "max", "clear",
-        NULL
-    };
-    for (const char** b = builtins; *b; b++) {
-        if (strcmp(name, *b) == 0) return true;
+static bool is_go_builtin_func(const char *name) {
+    static const char *builtins[] = {"make",   "new",     "append",  "len",   "cap",
+                                     "delete", "close",   "copy",    "panic", "recover",
+                                     "print",  "println", "complex", "real",  "imag",
+                                     "min",    "max",     "clear",   NULL};
+    for (const char **b = builtins; *b; b++) {
+        if (strcmp(name, *b) == 0)
+            return true;
     }
     return false;
 }
 
 // --- Helper: check if name is a Go builtin type ---
 
-static const CBMType* resolve_builtin_type(GoLSPContext* ctx, const char* name) {
-    static const char* builtin_types[] = {
-        "int", "int8", "int16", "int32", "int64",
-        "uint", "uint8", "uint16", "uint32", "uint64",
-        "float32", "float64", "complex64", "complex128",
-        "string", "bool", "byte", "rune", "error",
-        "uintptr", "any",
-        NULL
-    };
-    for (const char** b = builtin_types; *b; b++) {
+static const CBMType *resolve_builtin_type(GoLSPContext *ctx, const char *name) {
+    static const char *builtin_types[] = {
+        "int",    "int8",   "int16",   "int32",   "int64",     "uint",       "uint8",  "uint16",
+        "uint32", "uint64", "float32", "float64", "complex64", "complex128", "string", "bool",
+        "byte",   "rune",   "error",   "uintptr", "any",       NULL};
+    for (const char **b = builtin_types; *b; b++) {
         if (strcmp(name, *b) == 0) {
             return cbm_type_builtin(ctx->arena, name);
         }
@@ -120,20 +122,23 @@ static const CBMType* resolve_builtin_type(GoLSPContext* ctx, const char* name)
 
 // --- go_parse_type_node: AST type node -> CBMType ---
 
-const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
-    if (ts_node_is_null(node)) return cbm_type_unknown();
+const CBMType *go_parse_type_node(GoLSPContext *ctx, TSNode node) {
+    if (ts_node_is_null(node))
+        return cbm_type_unknown();
 
-    const char* kind = ts_node_type(node);
+    const char *kind = ts_node_type(node);
 
     // type_identifier: simple named type
     if (strcmp(kind, "type_identifier") == 0) {
-        char* name = lsp_node_text(ctx, node);
-        if (!name) return cbm_type_unknown();
-        const CBMType* builtin = resolve_builtin_type(ctx, name);
-        if (builtin) return builtin;
+        char *name = lsp_node_text(ctx, node);
+        if (!name)
+            return cbm_type_unknown();
+        const CBMType *builtin = resolve_builtin_type(ctx, name);
+        if (builtin)
+            return builtin;
         // Resolve as local type: package_qn.TypeName
         return cbm_type_named(ctx->arena,
-            cbm_arena_sprintf(ctx->arena, "%s.%s", ctx->package_qn, name));
+                              cbm_arena_sprintf(ctx->arena, "%s.%s", ctx->package_qn, name));
     }
 
     // qualified_type: pkg.Type
@@ -141,12 +146,12 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
         TSNode pkg_node = ts_node_child_by_field_name(node, "package", 7);
         TSNode name_node = ts_node_child_by_field_name(node, "name", 4);
         if (!ts_node_is_null(pkg_node) && !ts_node_is_null(name_node)) {
-            char* pkg = lsp_node_text(ctx, pkg_node);
-            char* name = lsp_node_text(ctx, name_node);
-            const char* pkg_qn = resolve_import(ctx, pkg);
+            char *pkg = lsp_node_text(ctx, pkg_node);
+            char *name = lsp_node_text(ctx, name_node);
+            const char *pkg_qn = resolve_import(ctx, pkg);
             if (pkg_qn) {
                 return cbm_type_named(ctx->arena,
-                    cbm_arena_sprintf(ctx->arena, "%s.%s", pkg_qn, name));
+                                      cbm_arena_sprintf(ctx->arena, "%s.%s", pkg_qn, name));
             }
         }
         return cbm_type_unknown();
@@ -157,7 +162,7 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
         uint32_t nc = ts_node_named_child_count(node);
         if (nc > 0) {
             return cbm_type_pointer(ctx->arena,
-                go_parse_type_node(ctx, ts_node_named_child(node, nc - 1)));
+                                    go_parse_type_node(ctx, ts_node_named_child(node, nc - 1)));
         }
         return cbm_type_unknown();
     }
@@ -184,9 +189,8 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
     if (strcmp(kind, "map_type") == 0) {
         TSNode key = ts_node_child_by_field_name(node, "key", 3);
         TSNode value = ts_node_child_by_field_name(node, "value", 5);
-        return cbm_type_map(ctx->arena,
-            go_parse_type_node(ctx, key),
-            go_parse_type_node(ctx, value));
+        return cbm_type_map(ctx->arena, go_parse_type_node(ctx, key),
+                            go_parse_type_node(ctx, value));
     }
 
     // channel_type: chan T
@@ -196,11 +200,13 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
             value = ts_node_named_child(node, ts_node_named_child_count(node) - 1);
         }
         // Determine direction from text
-        char* text = lsp_node_text(ctx, node);
+        char *text = lsp_node_text(ctx, node);
         int dir = 0;
         if (text) {
-            if (strncmp(text, "chan<-", 6) == 0 || strncmp(text, "chan <-", 7) == 0) dir = 1;
-            else if (strncmp(text, "<-chan", 6) == 0 || strncmp(text, "<- chan", 7) == 0) dir = 2;
+            if (strncmp(text, "chan<-", 6) == 0 || strncmp(text, "chan <-", 7) == 0)
+                dir = 1;
+            else if (strncmp(text, "<-chan", 6) == 0 || strncmp(text, "<- chan", 7) == 0)
+                dir = 2;
         }
         return cbm_type_channel(ctx->arena, go_parse_type_node(ctx, value), dir);
     }
@@ -212,7 +218,7 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
 
     // interface_type
     if (strcmp(kind, "interface_type") == 0) {
-        CBMType* t = (CBMType*)cbm_arena_alloc(ctx->arena, sizeof(CBMType));
+        CBMType *t = (CBMType *)cbm_arena_alloc(ctx->arena, sizeof(CBMType));
         memset(t, 0, sizeof(CBMType));
         t->kind = CBM_TYPE_INTERFACE;
         return t;
@@ -220,7 +226,7 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
 
     // struct_type
     if (strcmp(kind, "struct_type") == 0) {
-        CBMType* t = (CBMType*)cbm_arena_alloc(ctx->arena, sizeof(CBMType));
+        CBMType *t = (CBMType *)cbm_arena_alloc(ctx->arena, sizeof(CBMType));
         memset(t, 0, sizeof(CBMType));
         t->kind = CBM_TYPE_STRUCT;
         return t;
@@ -247,12 +253,13 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
     // parameter_list used as result type (multi-return)
     if (strcmp(kind, "parameter_list") == 0) {
         int count = 0;
-        const CBMType* elems[16];
+        const CBMType *elems[16];
         uint32_t nc = ts_node_child_count(node);
         for (uint32_t i = 0; i < nc && count < 16; i++) {
             TSNode child = ts_node_child(node, i);
-            if (ts_node_is_null(child) || !ts_node_is_named(child)) continue;
-            const char* ck = ts_node_type(child);
+            if (ts_node_is_null(child) || !ts_node_is_named(child))
+                continue;
+            const char *ck = ts_node_type(child);
             if (strcmp(ck, "parameter_declaration") == 0) {
                 TSNode tn = ts_node_child_by_field_name(child, "type", 4);
                 if (!ts_node_is_null(tn)) {
@@ -262,8 +269,10 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
                 elems[count++] = go_parse_type_node(ctx, child);
             }
         }
-        if (count == 1) return elems[0];
-        if (count > 1) return cbm_type_tuple(ctx->arena, elems, count);
+        if (count == 1)
+            return elems[0];
+        if (count > 1)
+            return cbm_type_tuple(ctx->arena, elems, count);
     }
 
     return cbm_type_unknown();
@@ -273,14 +282,17 @@ const CBMType* go_parse_type_node(GoLSPContext* ctx, TSNode node) {
 
 // Unify a parameter type pattern (containing TYPE_PARAM) against a concrete argument type.
 // Fills inferred[i] with the concrete type bound to type_param_names[i].
-static void go_unify_type(const CBMType* param_type, const CBMType* arg_type,
-    const char** type_param_names, const CBMType** inferred, int param_count) {
-    if (!param_type || !arg_type || cbm_type_is_unknown(arg_type)) return;
+static void go_unify_type(const CBMType *param_type, const CBMType *arg_type,
+                          const char **type_param_names, const CBMType **inferred,
+                          int param_count) {
+    if (!param_type || !arg_type || cbm_type_is_unknown(arg_type))
+        return;
 
     if (param_type->kind == CBM_TYPE_TYPE_PARAM) {
         for (int i = 0; i < param_count; i++) {
             if (strcmp(param_type->data.type_param.name, type_param_names[i]) == 0) {
-                if (!inferred[i]) inferred[i] = arg_type;
+                if (!inferred[i])
+                    inferred[i] = arg_type;
                 break;
             }
         }
@@ -289,36 +301,41 @@ static void go_unify_type(const CBMType* param_type, const CBMType* arg_type,
 
     // Structural matching — recurse into composite types
     if (param_type->kind == CBM_TYPE_SLICE && arg_type->kind == CBM_TYPE_SLICE) {
-        go_unify_type(param_type->data.slice.elem, arg_type->data.slice.elem,
-            type_param_names, inferred, param_count);
+        go_unify_type(param_type->data.slice.elem, arg_type->data.slice.elem, type_param_names,
+                      inferred, param_count);
     }
     if (param_type->kind == CBM_TYPE_POINTER && arg_type->kind == CBM_TYPE_POINTER) {
-        go_unify_type(param_type->data.pointer.elem, arg_type->data.pointer.elem,
-            type_param_names, inferred, param_count);
+        go_unify_type(param_type->data.pointer.elem, arg_type->data.pointer.elem, type_param_names,
+                      inferred, param_count);
     }
     if (param_type->kind == CBM_TYPE_MAP && arg_type->kind == CBM_TYPE_MAP) {
-        go_unify_type(param_type->data.map.key, arg_type->data.map.key,
-            type_param_names, inferred, param_count);
-        go_unify_type(param_type->data.map.value, arg_type->data.map.value,
-            type_param_names, inferred, param_count);
+        go_unify_type(param_type->data.map.key, arg_type->data.map.key, type_param_names, inferred,
+                      param_count);
+        go_unify_type(param_type->data.map.value, arg_type->data.map.value, type_param_names,
+                      inferred, param_count);
     }
     if (param_type->kind == CBM_TYPE_CHANNEL && arg_type->kind == CBM_TYPE_CHANNEL) {
-        go_unify_type(param_type->data.channel.elem, arg_type->data.channel.elem,
-            type_param_names, inferred, param_count);
+        go_unify_type(param_type->data.channel.elem, arg_type->data.channel.elem, type_param_names,
+                      inferred, param_count);
     }
     if (param_type->kind == CBM_TYPE_FUNC && arg_type->kind == CBM_TYPE_FUNC) {
         // Match param types
         if (param_type->data.func.param_types && arg_type->data.func.param_types) {
-            for (int i = 0; param_type->data.func.param_types[i] && arg_type->data.func.param_types[i]; i++) {
-                go_unify_type(param_type->data.func.param_types[i], arg_type->data.func.param_types[i],
-                    type_param_names, inferred, param_count);
+            for (int i = 0;
+                 param_type->data.func.param_types[i] && arg_type->data.func.param_types[i]; i++) {
+                go_unify_type(param_type->data.func.param_types[i],
+                              arg_type->data.func.param_types[i], type_param_names, inferred,
+                              param_count);
             }
         }
         // Match return types
         if (param_type->data.func.return_types && arg_type->data.func.return_types) {
-            for (int i = 0; param_type->data.func.return_types[i] && arg_type->data.func.return_types[i]; i++) {
-                go_unify_type(param_type->data.func.return_types[i], arg_type->data.func.return_types[i],
-                    type_param_names, inferred, param_count);
+            for (int i = 0;
+                 param_type->data.func.return_types[i] && arg_type->data.func.return_types[i];
+                 i++) {
+                go_unify_type(param_type->data.func.return_types[i],
+                              arg_type->data.func.return_types[i], type_param_names, inferred,
+                              param_count);
             }
         }
     }
@@ -326,33 +343,39 @@ static void go_unify_type(const CBMType* param_type, const CBMType* arg_type,
 
 // --- go_eval_expr_type: recursive expression type evaluator ---
 
-const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
-    if (ts_node_is_null(node)) return cbm_type_unknown();
+const CBMType *go_eval_expr_type(GoLSPContext *ctx, TSNode node) {
+    if (ts_node_is_null(node))
+        return cbm_type_unknown();
 
-    const char* kind = ts_node_type(node);
+    const char *kind = ts_node_type(node);
 
     // --- Identifier: scope lookup ---
     if (strcmp(kind, "identifier") == 0) {
-        char* name = lsp_node_text(ctx, node);
-        if (!name) return cbm_type_unknown();
+        char *name = lsp_node_text(ctx, node);
+        if (!name)
+            return cbm_type_unknown();
 
         // Check scope first
-        const CBMType* t = cbm_scope_lookup(ctx->current_scope, name);
+        const CBMType *t = cbm_scope_lookup(ctx->current_scope, name);
         if (cbm_scope_contains(ctx->current_scope, name))
             return t ? t : cbm_type_unknown();
 
         // Check if it's a package-level function
-        const CBMRegisteredFunc* f = cbm_registry_lookup_symbol(ctx->registry, ctx->package_qn, name);
-        if (f && f->signature) return f->signature;
+        const CBMRegisteredFunc *f =
+            cbm_registry_lookup_symbol(ctx->registry, ctx->package_qn, name);
+        if (f && f->signature)
+            return f->signature;
 
         // Check if it's a builtin type (for type conversions like string(x), int(x))
-        const CBMType* bt = resolve_builtin_type(ctx, name);
-        if (bt) return cbm_type_named(ctx->arena, name);
+        const CBMType *bt = resolve_builtin_type(ctx, name);
+        if (bt)
+            return cbm_type_named(ctx->arena, name);
 
         // Check if it's a registered type (for type conversions like MyType(x))
-        const char* type_qn = cbm_arena_sprintf(ctx->arena, "%s.%s", ctx->package_qn, name);
-        const CBMRegisteredType* rt = cbm_registry_lookup_type(ctx->registry, type_qn);
-        if (rt) return cbm_type_named(ctx->arena, type_qn);
+        const char *type_qn = cbm_arena_sprintf(ctx->arena, "%s.%s", ctx->package_qn, name);
+        const CBMRegisteredType *rt = cbm_registry_lookup_type(ctx->registry, type_qn);
+        if (rt)
+            return cbm_type_named(ctx->arena, type_qn);
 
         return cbm_type_unknown();
     }
@@ -361,49 +384,57 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
     if (strcmp(kind, "selector_expression") == 0) {
         TSNode operand = ts_node_child_by_field_name(node, "operand", 7);
         TSNode field = ts_node_child_by_field_name(node, "field", 5);
-        if (ts_node_is_null(operand) || ts_node_is_null(field)) return cbm_type_unknown();
+        if (ts_node_is_null(operand) || ts_node_is_null(field))
+            return cbm_type_unknown();
 
-        char* field_name = lsp_node_text(ctx, field);
-        if (!field_name) return cbm_type_unknown();
+        char *field_name = lsp_node_text(ctx, field);
+        if (!field_name)
+            return cbm_type_unknown();
 
         // Check if operand is an import alias (pkg.Symbol)
         if (strcmp(ts_node_type(operand), "identifier") == 0) {
-            char* pkg_name = lsp_node_text(ctx, operand);
+            char *pkg_name = lsp_node_text(ctx, operand);
             if (pkg_name) {
-                const char* pkg_qn = resolve_import(ctx, pkg_name);
+                const char *pkg_qn = resolve_import(ctx, pkg_name);
                 if (pkg_qn) {
                     // Look up pkg.Symbol as a function or type
-                    const CBMRegisteredFunc* f = cbm_registry_lookup_symbol(ctx->registry, pkg_qn, field_name);
-                    if (f && f->signature) return f->signature;
+                    const CBMRegisteredFunc *f =
+                        cbm_registry_lookup_symbol(ctx->registry, pkg_qn, field_name);
+                    if (f && f->signature)
+                        return f->signature;
                     // Check if it's a type
-                    char* type_qn = cbm_arena_sprintf(ctx->arena, "%s.%s", pkg_qn, field_name);
-                    const CBMRegisteredType* rt = cbm_registry_lookup_type(ctx->registry, type_qn);
-                    if (rt) return cbm_type_named(ctx->arena, type_qn);
+                    char *type_qn = cbm_arena_sprintf(ctx->arena, "%s.%s", pkg_qn, field_name);
+                    const CBMRegisteredType *rt = cbm_registry_lookup_type(ctx->registry, type_qn);
+                    if (rt)
+                        return cbm_type_named(ctx->arena, type_qn);
                     return cbm_type_unknown();
                 }
             }
         }
 
         // Evaluate operand type
-        const CBMType* recv_type = go_eval_expr_type(ctx, operand);
-        if (cbm_type_is_unknown(recv_type)) return cbm_type_unknown();
+        const CBMType *recv_type = go_eval_expr_type(ctx, operand);
+        if (cbm_type_is_unknown(recv_type))
+            return cbm_type_unknown();
 
         // Auto-deref pointers for method calls
-        const CBMType* base_type = recv_type;
+        const CBMType *base_type = recv_type;
         if (base_type->kind == CBM_TYPE_POINTER) {
             base_type = cbm_type_deref(base_type);
         }
 
         if (base_type->kind == CBM_TYPE_NAMED) {
-            const char* type_qn = base_type->data.named.qualified_name;
+            const char *type_qn = base_type->data.named.qualified_name;
 
             // Look up method/field (methods recurse through embeddings)
-            const CBMRegisteredFunc* method = go_lookup_field_or_method(ctx, type_qn, field_name);
-            if (method && method->signature) return method->signature;
+            const CBMRegisteredFunc *method = go_lookup_field_or_method(ctx, type_qn, field_name);
+            if (method && method->signature)
+                return method->signature;
 
             // Check struct fields (with embedded field promotion)
-            const CBMType* field_type = go_lookup_field(ctx, type_qn, field_name, 0);
-            if (field_type && !cbm_type_is_unknown(field_type)) return field_type;
+            const CBMType *field_type = go_lookup_field(ctx, type_qn, field_name, 0);
+            if (field_type && !cbm_type_is_unknown(field_type))
+                return field_type;
         }
 
         return cbm_type_unknown();
@@ -413,43 +444,45 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
     if (strcmp(kind, "call_expression") == 0) {
         TSNode func_node = ts_node_child_by_field_name(node, "function", 8);
         TSNode args_node = ts_node_child_by_field_name(node, "arguments", 9);
-        if (ts_node_is_null(func_node)) return cbm_type_unknown();
+        if (ts_node_is_null(func_node))
+            return cbm_type_unknown();
 
         // Check for builtin calls
         if (strcmp(ts_node_type(func_node), "identifier") == 0) {
-            char* name = lsp_node_text(ctx, func_node);
+            char *name = lsp_node_text(ctx, func_node);
             if (name && is_go_builtin_func(name)) {
                 return go_eval_builtin_call(ctx, name, args_node);
             }
         }
 
         // Evaluate function type
-        const CBMType* func_type = go_eval_expr_type(ctx, func_node);
+        const CBMType *func_type = go_eval_expr_type(ctx, func_node);
 
         // If it's a FUNC type, return its return type
-        if (func_type && func_type->kind == CBM_TYPE_FUNC &&
-            func_type->data.func.return_types && func_type->data.func.return_types[0]) {
+        if (func_type && func_type->kind == CBM_TYPE_FUNC && func_type->data.func.return_types &&
+            func_type->data.func.return_types[0]) {
 
             // Check for explicit type arguments: call_expression has type_arguments field
-            // Go tree-sitter: Func[T1, T2](args) → call_expression { function, type_arguments, arguments }
+            // Go tree-sitter: Func[T1, T2](args) → call_expression { function, type_arguments,
+            // arguments }
             TSNode targs_node = ts_node_child_by_field_name(node, "type_arguments", 14);
             if (!ts_node_is_null(targs_node)) {
                 // Look up the registered function to get type_param_names
-                const CBMRegisteredFunc* rfunc = NULL;
-                char* func_name = lsp_node_text(ctx, func_node);
+                const CBMRegisteredFunc *rfunc = NULL;
+                char *func_name = lsp_node_text(ctx, func_node);
                 if (func_name) {
-                    const char* func_qn = cbm_arena_sprintf(ctx->arena, "%s.%s",
-                        ctx->package_qn, func_name);
+                    const char *func_qn =
+                        cbm_arena_sprintf(ctx->arena, "%s.%s", ctx->package_qn, func_name);
                     rfunc = cbm_registry_lookup_func(ctx->registry, func_qn);
                     // If not found as local, try via import (selector_expression: pkg.Func)
                     if (!rfunc && strcmp(ts_node_type(func_node), "selector_expression") == 0) {
                         TSNode operand = ts_node_child_by_field_name(func_node, "operand", 7);
                         TSNode field = ts_node_child_by_field_name(func_node, "field", 5);
                         if (!ts_node_is_null(operand) && !ts_node_is_null(field)) {
-                            char* pkg = lsp_node_text(ctx, operand);
-                            char* fn = lsp_node_text(ctx, field);
+                            char *pkg = lsp_node_text(ctx, operand);
+                            char *fn = lsp_node_text(ctx, field);
                             if (pkg && fn) {
-                                const char* pkg_qn = resolve_import(ctx, pkg);
+                                const char *pkg_qn = resolve_import(ctx, pkg);
                                 if (pkg_qn) {
                                     rfunc = cbm_registry_lookup_symbol(ctx->registry, pkg_qn, fn);
                                 }
@@ -460,40 +493,44 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
 
                 if (rfunc && rfunc->type_param_names) {
                     // Parse type arguments from AST
-                    const CBMType* type_args[16];
+                    const CBMType *type_args[16];
                     int targ_count = 0;
                     uint32_t ta_nc = ts_node_child_count(targs_node);
                     for (uint32_t ti = 0; ti < ta_nc && targ_count < 15; ti++) {
                         TSNode targ = ts_node_child(targs_node, ti);
-                        if (ts_node_is_null(targ) || !ts_node_is_named(targ)) continue;
+                        if (ts_node_is_null(targ) || !ts_node_is_named(targ))
+                            continue;
                         type_args[targ_count++] = go_parse_type_node(ctx, targ);
                     }
 
                     // Count type params
                     int param_count = 0;
-                    while (rfunc->type_param_names[param_count]) param_count++;
+                    while (rfunc->type_param_names[param_count])
+                        param_count++;
 
                     if (targ_count > 0 && targ_count == param_count) {
-                        const CBMType** targ_arr = (const CBMType**)cbm_arena_alloc(
-                            ctx->arena, (targ_count + 1) * sizeof(const CBMType*));
-                        for (int ti = 0; ti < targ_count; ti++) targ_arr[ti] = type_args[ti];
+                        const CBMType **targ_arr = (const CBMType **)cbm_arena_alloc(
+                            ctx->arena, (targ_count + 1) * sizeof(const CBMType *));
+                        for (int ti = 0; ti < targ_count; ti++)
+                            targ_arr[ti] = type_args[ti];
                         targ_arr[targ_count] = NULL;
 
                         // Substitute type params in return type(s)
                         int ret_count = 0;
-                        while (func_type->data.func.return_types[ret_count]) ret_count++;
+                        while (func_type->data.func.return_types[ret_count])
+                            ret_count++;
 
                         if (ret_count == 1) {
                             return cbm_type_substitute(ctx->arena,
-                                func_type->data.func.return_types[0],
-                                rfunc->type_param_names, targ_arr);
+                                                       func_type->data.func.return_types[0],
+                                                       rfunc->type_param_names, targ_arr);
                         }
                         // Multi-return: substitute all
-                        const CBMType** new_rets = (const CBMType**)cbm_arena_alloc(
-                            ctx->arena, (ret_count + 1) * sizeof(const CBMType*));
+                        const CBMType **new_rets = (const CBMType **)cbm_arena_alloc(
+                            ctx->arena, (ret_count + 1) * sizeof(const CBMType *));
                         for (int ri = 0; ri < ret_count; ri++) {
-                            new_rets[ri] = cbm_type_substitute(ctx->arena,
-                                func_type->data.func.return_types[ri],
+                            new_rets[ri] = cbm_type_substitute(
+                                ctx->arena, func_type->data.func.return_types[ri],
                                 rfunc->type_param_names, targ_arr);
                         }
                         new_rets[ret_count] = NULL;
@@ -505,20 +542,20 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
             // Implicit generics: infer type args from argument types
             if (ts_node_is_null(targs_node)) {
                 // Look up registered function to check for type_param_names
-                const CBMRegisteredFunc* rfunc = NULL;
-                char* func_name = lsp_node_text(ctx, func_node);
+                const CBMRegisteredFunc *rfunc = NULL;
+                char *func_name = lsp_node_text(ctx, func_node);
                 if (func_name) {
-                    const char* func_qn = cbm_arena_sprintf(ctx->arena, "%s.%s",
-                        ctx->package_qn, func_name);
+                    const char *func_qn =
+                        cbm_arena_sprintf(ctx->arena, "%s.%s", ctx->package_qn, func_name);
                     rfunc = cbm_registry_lookup_func(ctx->registry, func_qn);
                     if (!rfunc && strcmp(ts_node_type(func_node), "selector_expression") == 0) {
                         TSNode operand = ts_node_child_by_field_name(func_node, "operand", 7);
                         TSNode field = ts_node_child_by_field_name(func_node, "field", 5);
                         if (!ts_node_is_null(operand) && !ts_node_is_null(field)) {
-                            char* pkg = lsp_node_text(ctx, operand);
-                            char* fn = lsp_node_text(ctx, field);
+                            char *pkg = lsp_node_text(ctx, operand);
+                            char *fn = lsp_node_text(ctx, field);
                             if (pkg && fn) {
-                                const char* pkg_qn = resolve_import(ctx, pkg);
+                                const char *pkg_qn = resolve_import(ctx, pkg);
                                 if (pkg_qn)
                                     rfunc = cbm_registry_lookup_symbol(ctx->registry, pkg_qn, fn);
                             }
@@ -528,39 +565,49 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
 
                 if (rfunc && rfunc->type_param_names && func_type->data.func.param_types) {
                     int tpc = 0;
-                    while (rfunc->type_param_names[tpc]) tpc++;
+                    while (rfunc->type_param_names[tpc])
+                        tpc++;
 
                     // Check if any return type uses a type param
                     bool has_type_param = false;
                     int ret_count = 0;
-                    while (func_type->data.func.return_types[ret_count]) ret_count++;
+                    while (func_type->data.func.return_types[ret_count])
+                        ret_count++;
                     for (int ri = 0; ri < ret_count && !has_type_param; ri++) {
                         // Quick check: walk return type tree for TYPE_PARAM nodes
-                        const CBMType* rt = func_type->data.func.return_types[ri];
-                        if (rt->kind == CBM_TYPE_TYPE_PARAM) has_type_param = true;
+                        const CBMType *rt = func_type->data.func.return_types[ri];
+                        if (rt->kind == CBM_TYPE_TYPE_PARAM)
+                            has_type_param = true;
                         else if (rt->kind == CBM_TYPE_SLICE && rt->data.slice.elem &&
-                                 rt->data.slice.elem->kind == CBM_TYPE_TYPE_PARAM) has_type_param = true;
+                                 rt->data.slice.elem->kind == CBM_TYPE_TYPE_PARAM)
+                            has_type_param = true;
                         else if (rt->kind == CBM_TYPE_POINTER && rt->data.pointer.elem &&
-                                 rt->data.pointer.elem->kind == CBM_TYPE_TYPE_PARAM) has_type_param = true;
+                                 rt->data.pointer.elem->kind == CBM_TYPE_TYPE_PARAM)
+                            has_type_param = true;
                         else if (rt->kind == CBM_TYPE_MAP) {
-                            if (rt->data.map.key && rt->data.map.key->kind == CBM_TYPE_TYPE_PARAM) has_type_param = true;
-                            if (rt->data.map.value && rt->data.map.value->kind == CBM_TYPE_TYPE_PARAM) has_type_param = true;
+                            if (rt->data.map.key && rt->data.map.key->kind == CBM_TYPE_TYPE_PARAM)
+                                has_type_param = true;
+                            if (rt->data.map.value &&
+                                rt->data.map.value->kind == CBM_TYPE_TYPE_PARAM)
+                                has_type_param = true;
                         }
                     }
 
                     if (has_type_param && tpc > 0 && tpc <= 16) {
                         // Evaluate argument types and unify
-                        const CBMType* inferred[16] = {0};
+                        const CBMType *inferred[16] = {0};
 
                         if (!ts_node_is_null(args_node)) {
                             uint32_t argc = ts_node_named_child_count(args_node);
                             int pi = 0;
-                            for (uint32_t ai = 0; ai < argc && func_type->data.func.param_types[pi]; ai++) {
+                            for (uint32_t ai = 0; ai < argc && func_type->data.func.param_types[pi];
+                                 ai++) {
                                 TSNode arg = ts_node_named_child(args_node, ai);
-                                if (ts_node_is_null(arg)) continue;
-                                const CBMType* arg_type = go_eval_expr_type(ctx, arg);
-                                go_unify_type(func_type->data.func.param_types[pi],
-                                    arg_type, rfunc->type_param_names, inferred, tpc);
+                                if (ts_node_is_null(arg))
+                                    continue;
+                                const CBMType *arg_type = go_eval_expr_type(ctx, arg);
+                                go_unify_type(func_type->data.func.param_types[pi], arg_type,
+                                              rfunc->type_param_names, inferred, tpc);
                                 pi++;
                             }
                         }
@@ -568,25 +615,29 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
                         // Check if all type params were inferred
                         bool all_inferred = true;
                         for (int i = 0; i < tpc; i++) {
-                            if (!inferred[i]) { all_inferred = false; break; }
+                            if (!inferred[i]) {
+                                all_inferred = false;
+                                break;
+                            }
                         }
 
                         if (all_inferred) {
-                            const CBMType** targ_arr = (const CBMType**)cbm_arena_alloc(
-                                ctx->arena, (tpc + 1) * sizeof(const CBMType*));
-                            for (int i = 0; i < tpc; i++) targ_arr[i] = inferred[i];
+                            const CBMType **targ_arr = (const CBMType **)cbm_arena_alloc(
+                                ctx->arena, (tpc + 1) * sizeof(const CBMType *));
+                            for (int i = 0; i < tpc; i++)
+                                targ_arr[i] = inferred[i];
                             targ_arr[tpc] = NULL;
 
                             if (ret_count == 1) {
                                 return cbm_type_substitute(ctx->arena,
-                                    func_type->data.func.return_types[0],
-                                    rfunc->type_param_names, targ_arr);
+                                                           func_type->data.func.return_types[0],
+                                                           rfunc->type_param_names, targ_arr);
                             }
-                            const CBMType** new_rets = (const CBMType**)cbm_arena_alloc(
-                                ctx->arena, (ret_count + 1) * sizeof(const CBMType*));
+                            const CBMType **new_rets = (const CBMType **)cbm_arena_alloc(
+                                ctx->arena, (ret_count + 1) * sizeof(const CBMType *));
                             for (int ri = 0; ri < ret_count; ri++) {
-                                new_rets[ri] = cbm_type_substitute(ctx->arena,
-                                    func_type->data.func.return_types[ri],
+                                new_rets[ri] = cbm_type_substitute(
+                                    ctx->arena, func_type->data.func.return_types[ri],
                                     rfunc->type_param_names, targ_arr);
                             }
                             new_rets[ret_count] = NULL;
@@ -601,7 +652,8 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
                 return func_type->data.func.return_types[0];
             }
             int count = 0;
-            while (func_type->data.func.return_types[count]) count++;
+            while (func_type->data.func.return_types[count])
+                count++;
             if (count > 1) {
                 return cbm_type_tuple(ctx->arena, func_type->data.func.return_types, count);
             }
@@ -615,7 +667,7 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
         // Type conversion with composite type syntax: []byte(s), map[K]V(x), etc.
         // The function node is a type node (slice_type, map_type, etc.)
         {
-            const char* fk = ts_node_type(func_node);
+            const char *fk = ts_node_type(func_node);
             if (strcmp(fk, "slice_type") == 0 || strcmp(fk, "array_type") == 0 ||
                 strcmp(fk, "map_type") == 0 || strcmp(fk, "pointer_type") == 0 ||
                 strcmp(fk, "channel_type") == 0) {
@@ -638,14 +690,16 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
     // --- Unary expression: &x, *x, <-ch, !x ---
     if (strcmp(kind, "unary_expression") == 0) {
         TSNode operand = ts_node_child_by_field_name(node, "operand", 7);
-        if (ts_node_is_null(operand)) return cbm_type_unknown();
+        if (ts_node_is_null(operand))
+            return cbm_type_unknown();
 
         // Get operator
         for (uint32_t i = 0; i < ts_node_child_count(node); i++) {
             TSNode child = ts_node_child(node, i);
             if (!ts_node_is_named(child)) {
-                char* op = lsp_node_text(ctx, child);
-                if (!op) continue;
+                char *op = lsp_node_text(ctx, child);
+                if (!op)
+                    continue;
                 if (strcmp(op, "&") == 0) {
                     return cbm_type_pointer(ctx->arena, go_eval_expr_type(ctx, operand));
                 }
@@ -653,7 +707,7 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
                     return cbm_type_deref(go_eval_expr_type(ctx, operand));
                 }
                 if (strcmp(op, "<-") == 0) {
-                    const CBMType* ch_type = go_eval_expr_type(ctx, operand);
+                    const CBMType *ch_type = go_eval_expr_type(ctx, operand);
                     if (ch_type && ch_type->kind == CBM_TYPE_CHANNEL) {
                         return ch_type->data.channel.elem;
                     }
@@ -671,11 +725,15 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
     // --- Index expression: a[i] ---
     if (strcmp(kind, "index_expression") == 0) {
         TSNode operand = ts_node_child_by_field_name(node, "operand", 7);
-        if (ts_node_is_null(operand)) return cbm_type_unknown();
-        const CBMType* op_type = go_eval_expr_type(ctx, operand);
-        if (!op_type) return cbm_type_unknown();
-        if (op_type->kind == CBM_TYPE_MAP) return op_type->data.map.value;
-        if (op_type->kind == CBM_TYPE_SLICE) return op_type->data.slice.elem;
+        if (ts_node_is_null(operand))
+            return cbm_type_unknown();
+        const CBMType *op_type = go_eval_expr_type(ctx, operand);
+        if (!op_type)
+            return cbm_type_unknown();
+        if (op_type->kind == CBM_TYPE_MAP)
+            return op_type->data.map.value;
+        if (op_type->kind == CBM_TYPE_SLICE)
+            return op_type->data.slice.elem;
         return cbm_type_unknown();
     }
 
@@ -701,24 +759,25 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
         for (uint32_t i = 0; i < ts_node_child_count(node); i++) {
             TSNode child = ts_node_child(node, i);
             if (!ts_node_is_named(child)) {
-                char* op = lsp_node_text(ctx, child);
-                if (op && (strcmp(op, "==") == 0 || strcmp(op, "!=") == 0 ||
-                           strcmp(op, "<") == 0 || strcmp(op, ">") == 0 ||
-                           strcmp(op, "<=") == 0 || strcmp(op, ">=") == 0 ||
+                char *op = lsp_node_text(ctx, child);
+                if (op && (strcmp(op, "==") == 0 || strcmp(op, "!=") == 0 || strcmp(op, "<") == 0 ||
+                           strcmp(op, ">") == 0 || strcmp(op, "<=") == 0 || strcmp(op, ">=") == 0 ||
                            strcmp(op, "&&") == 0 || strcmp(op, "||") == 0)) {
                     return cbm_type_builtin(ctx->arena, "bool");
                 }
                 break;
             }
         }
-        if (!ts_node_is_null(left)) return go_eval_expr_type(ctx, left);
+        if (!ts_node_is_null(left))
+            return go_eval_expr_type(ctx, left);
         return cbm_type_unknown();
     }
 
     // --- Slice expression: a[low:high] ---
     if (strcmp(kind, "slice_expression") == 0) {
         TSNode operand = ts_node_child_by_field_name(node, "operand", 7);
-        if (!ts_node_is_null(operand)) return go_eval_expr_type(ctx, operand);
+        if (!ts_node_is_null(operand))
+            return go_eval_expr_type(ctx, operand);
         return cbm_type_unknown();
     }
 
@@ -746,7 +805,7 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
         TSNode body = ts_node_child_by_field_name(node, "body", 4);
         if (!ts_node_is_null(body)) {
             // Push child scope (inherits all outer bindings via parent chain)
-            CBMScope* saved = ctx->current_scope;
+            CBMScope *saved = ctx->current_scope;
             ctx->current_scope = cbm_scope_push(ctx->arena, ctx->current_scope);
 
             // Bind closure parameters
@@ -755,16 +814,18 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
                 uint32_t nc = ts_node_child_count(params);
                 for (uint32_t i = 0; i < nc; i++) {
                     TSNode param = ts_node_child(params, i);
-                    if (ts_node_is_null(param) || !ts_node_is_named(param)) continue;
-                    if (strcmp(ts_node_type(param), "parameter_declaration") != 0) continue;
+                    if (ts_node_is_null(param) || !ts_node_is_named(param))
+                        continue;
+                    if (strcmp(ts_node_type(param), "parameter_declaration") != 0)
+                        continue;
                     TSNode type_node = ts_node_child_by_field_name(param, "type", 4);
-                    const CBMType* pt = go_parse_type_node(ctx, type_node);
+                    const CBMType *pt = go_parse_type_node(ctx, type_node);
                     uint32_t pnc = ts_node_child_count(param);
                     for (uint32_t j = 0; j < pnc; j++) {
                         TSNode ch = ts_node_child(param, j);
                         if (!ts_node_is_null(ch) && ts_node_is_named(ch) &&
                             strcmp(ts_node_type(ch), "identifier") == 0) {
-                            char* pname = lsp_node_text(ctx, ch);
+                            char *pname = lsp_node_text(ctx, ch);
                             if (pname && strcmp(pname, "_") != 0)
                                 cbm_scope_bind(ctx->current_scope, pname, pt);
                         }
@@ -779,15 +840,17 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
         }
 
         // Build full FUNC type with param/return types from AST
-        const CBMType* pt_arr[16];
+        const CBMType *pt_arr[16];
         int pt_count = 0;
         TSNode params2 = ts_node_child_by_field_name(node, "parameters", 10);
         if (!ts_node_is_null(params2)) {
             uint32_t nc2 = ts_node_child_count(params2);
             for (uint32_t i = 0; i < nc2 && pt_count < 15; i++) {
                 TSNode p = ts_node_child(params2, i);
-                if (ts_node_is_null(p) || !ts_node_is_named(p)) continue;
-                if (strcmp(ts_node_type(p), "parameter_declaration") != 0) continue;
+                if (ts_node_is_null(p) || !ts_node_is_named(p))
+                    continue;
+                if (strcmp(ts_node_type(p), "parameter_declaration") != 0)
+                    continue;
                 TSNode pt = ts_node_child_by_field_name(p, "type", 4);
                 if (!ts_node_is_null(pt))
                     pt_arr[pt_count++] = go_parse_type_node(ctx, pt);
@@ -795,7 +858,7 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
         }
         pt_arr[pt_count] = NULL;
 
-        const CBMType* rt_arr[16];
+        const CBMType *rt_arr[16];
         int rt_count = 0;
         TSNode result = ts_node_child_by_field_name(node, "result", 6);
         if (!ts_node_is_null(result)) {
@@ -803,9 +866,11 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
                 uint32_t rnc = ts_node_child_count(result);
                 for (uint32_t i = 0; i < rnc && rt_count < 15; i++) {
                     TSNode rc = ts_node_child(result, i);
-                    if (ts_node_is_null(rc) || !ts_node_is_named(rc)) continue;
+                    if (ts_node_is_null(rc) || !ts_node_is_named(rc))
+                        continue;
                     TSNode rt = ts_node_child_by_field_name(rc, "type", 4);
-                    if (ts_node_is_null(rt)) rt = rc;
+                    if (ts_node_is_null(rt))
+                        rt = rc;
                     rt_arr[rt_count++] = go_parse_type_node(ctx, rt);
                 }
             } else {
@@ -814,9 +879,8 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
         }
         rt_arr[rt_count] = NULL;
 
-        return cbm_type_func(ctx->arena, NULL,
-            pt_count > 0 ? (const CBMType**)pt_arr : NULL,
-            rt_count > 0 ? (const CBMType**)rt_arr : NULL);
+        return cbm_type_func(ctx->arena, NULL, pt_count > 0 ? (const CBMType **)pt_arr : NULL,
+                             rt_count > 0 ? (const CBMType **)rt_arr : NULL);
     }
 
     return cbm_type_unknown();
@@ -824,7 +888,7 @@ const CBMType* go_eval_expr_type(GoLSPContext* ctx, TSNode node) {
 
 // --- go_eval_builtin_call ---
 
-const CBMType* go_eval_builtin_call(GoLSPContext* ctx, const char* name, TSNode args) {
+const CBMType *go_eval_builtin_call(GoLSPContext *ctx, const char *name, TSNode args) {
     // make(Type, ...) -> Type
     if (strcmp(name, "make") == 0 && !ts_node_is_null(args)) {
         uint32_t nc = ts_node_named_child_count(args);
@@ -877,17 +941,20 @@ const CBMType* go_eval_builtin_call(GoLSPContext* ctx, const char* name, TSNode
 // the file's imports; returns NULL when no alias segment is involved.
 
 static const char *go_requalify_via_imports(GoLSPContext *ctx, const char *type_qn) {
-    if (!ctx || !type_qn || !type_qn[0] || ctx->import_count <= 0) return NULL;
+    if (!ctx || !type_qn || !type_qn[0] || ctx->import_count <= 0)
+        return NULL;
     for (int j = 0; j < ctx->import_count; j++) {
         const char *alias = ctx->import_local_names[j];
         const char *alias_qn = ctx->import_package_qns[j];
-        if (!alias || !alias[0] || !alias_qn || strchr(alias, '.')) continue;
+        if (!alias || !alias[0] || !alias_qn || strchr(alias, '.'))
+            continue;
         size_t alias_len = strlen(alias);
         /* Last occurrence of a "<dot>alias<dot>" segment in type_qn. */
         const char *hit = NULL;
         for (const char *p = type_qn;;) {
             p = strstr(p, ".");
-            if (!p) break;
+            if (!p)
+                break;
             p++;
             if (strncmp(p, alias, alias_len) == 0 && p[alias_len] == '.') {
                 hit = p;
@@ -902,26 +969,31 @@ static const char *go_requalify_via_imports(GoLSPContext *ctx, const char *type_
     return NULL;
 }
 
-static const CBMType* go_lookup_field(GoLSPContext* ctx,
-    const char* type_qn, const char* field_name, int depth) {
-    if (!type_qn || !field_name || depth > 5) return NULL;
+static const CBMType *go_lookup_field(GoLSPContext *ctx, const char *type_qn,
+                                      const char *field_name, int depth) {
+    if (!type_qn || !field_name || depth > 5)
+        return NULL;
 
-    const CBMRegisteredType* rt = cbm_registry_lookup_type(ctx->registry, type_qn);
+    const CBMRegisteredType *rt = cbm_registry_lookup_type(ctx->registry, type_qn);
     if (!rt && depth == 0) {
         /* Import-alias re-qualification: field texts from cross-package defs
          * may embed an alias segment only this file's import map resolves. */
-        const char* alt_qn = go_requalify_via_imports(ctx, type_qn);
-        if (alt_qn) rt = cbm_registry_lookup_type(ctx->registry, alt_qn);
+        const char *alt_qn = go_requalify_via_imports(ctx, type_qn);
+        if (alt_qn)
+            rt = cbm_registry_lookup_type(ctx->registry, alt_qn);
     }
-    if (!rt) return NULL;
+    if (!rt)
+        return NULL;
 
     // Follow alias chain
-    if (rt->alias_of) return go_lookup_field(ctx, rt->alias_of, field_name, depth + 1);
+    if (rt->alias_of)
+        return go_lookup_field(ctx, rt->alias_of, field_name, depth + 1);
 
     // Direct field lookup
     if (rt->field_names) {
         for (int i = 0; rt->field_names[i]; i++) {
-            if (strcmp(rt->field_names[i], field_name) == 0 && rt->field_types && rt->field_types[i]) {
+            if (strcmp(rt->field_names[i], field_name) == 0 && rt->field_types &&
+                rt->field_types[i]) {
                 return rt->field_types[i];
             }
         }
@@ -930,8 +1002,9 @@ static const CBMType* go_lookup_field(GoLSPContext* ctx,
     // Promoted fields from embedded types
     if (rt->embedded_types) {
         for (int i = 0; rt->embedded_types[i]; i++) {
-            const CBMType* f = go_lookup_field(ctx, rt->embedded_types[i], field_name, depth + 1);
-            if (f) return f;
+            const CBMType *f = go_lookup_field(ctx, rt->embedded_types[i], field_name, depth + 1);
+            if (f)
+                return f;
         }
     }
 
@@ -940,40 +1013,49 @@ static const CBMType* go_lookup_field(GoLSPContext* ctx,
 
 // --- go_lookup_field_or_method: method sets + embedding ---
 
-static const CBMRegisteredFunc* go_lookup_field_or_method_depth(GoLSPContext* ctx,
-    const char* type_qn, const char* member_name, int depth) {
-    if (!type_qn || !member_name) return NULL;
-    if (depth > CBM_LSP_MAX_LOOKUP_DEPTH) return NULL;
+static const CBMRegisteredFunc *go_lookup_field_or_method_depth(GoLSPContext *ctx,
+                                                                const char *type_qn,
+                                                                const char *member_name,
+                                                                int depth) {
+    if (!type_qn || !member_name)
+        return NULL;
+    if (depth > CBM_LSP_MAX_LOOKUP_DEPTH)
+        return NULL;
 
     // Direct method lookup
-    const CBMRegisteredFunc* f = cbm_registry_lookup_method(ctx->registry, type_qn, member_name);
-    if (f) return f;
+    const CBMRegisteredFunc *f = cbm_registry_lookup_method(ctx->registry, type_qn, member_name);
+    if (f)
+        return f;
 
     /* Import-alias re-qualification fallback: NAMED receivers built from
      * cross-package field type texts can carry a "<module>.svc.Svc" QN;
      * retry the method set on the import-resolved QN (see
      * go_requalify_via_imports). */
     if (depth == 0) {
-        const char* alt_qn = go_requalify_via_imports(ctx, type_qn);
+        const char *alt_qn = go_requalify_via_imports(ctx, type_qn);
         if (alt_qn) {
             f = go_lookup_field_or_method_depth(ctx, alt_qn, member_name, depth + 1);
-            if (f) return f;
+            if (f)
+                return f;
         }
     }
 
-    const CBMRegisteredType* rt = cbm_registry_lookup_type(ctx->registry, type_qn);
+    const CBMRegisteredType *rt = cbm_registry_lookup_type(ctx->registry, type_qn);
     if (rt) {
         // Follow type alias chain
         if (rt->alias_of) {
             f = go_lookup_field_or_method_depth(ctx, rt->alias_of, member_name, depth + 1);
-            if (f) return f;
+            if (f)
+                return f;
         }
 
         // Check embedded types (promoted methods)
         if (rt->embedded_types) {
             for (int i = 0; rt->embedded_types[i]; i++) {
-                f = go_lookup_field_or_method_depth(ctx, rt->embedded_types[i], member_name, depth + 1);
-                if (f) return f;
+                f = go_lookup_field_or_method_depth(ctx, rt->embedded_types[i], member_name,
+                                                    depth + 1);
+                if (f)
+                    return f;
             }
         }
     }
@@ -981,8 +1063,8 @@ static const CBMRegisteredFunc* go_lookup_field_or_method_depth(GoLSPContext* ct
     return NULL;
 }
 
-const CBMRegisteredFunc* go_lookup_field_or_method(GoLSPContext* ctx,
-    const char* type_qn, const char* member_name) {
+const CBMRegisteredFunc *go_lookup_field_or_method(GoLSPContext *ctx, const char *type_qn,
+                                                   const char *member_name) {
     return go_lookup_field_or_method_depth(ctx, type_qn, member_name, 0);
 }
 
@@ -1058,17 +1140,19 @@ static void go_scope_bind_value(GoLSPContext *ctx, const char *name, const CBMTy
 
 // --- go_process_statement: bind variables from statements ---
 
-void go_process_statement(GoLSPContext* ctx, TSNode node) {
-    if (ts_node_is_null(node)) return;
-    const char* kind = ts_node_type(node);
+void go_process_statement(GoLSPContext *ctx, TSNode node) {
+    if (ts_node_is_null(node))
+        return;
+    const char *kind = ts_node_type(node);
 
     // short_var_declaration: a, b := expr
     if (strcmp(kind, "short_var_declaration") == 0) {
         TSNode left = ts_node_child_by_field_name(node, "left", 4);
         TSNode right = ts_node_child_by_field_name(node, "right", 5);
-        if (ts_node_is_null(left) || ts_node_is_null(right)) return;
+        if (ts_node_is_null(left) || ts_node_is_null(right))
+            return;
 
-        const CBMType* rhs_type = NULL;
+        const CBMType *rhs_type = NULL;
         TSNode single_rhs = {0};
 
         // Check if RHS is an expression_list (multiple values)
@@ -1091,11 +1175,13 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
             uint32_t lhs_count = ts_node_named_child_count(left);
             for (uint32_t i = 0; i < lhs_count; i++) {
                 TSNode lhs_var = ts_node_named_child(left, i);
-                if (strcmp(ts_node_type(lhs_var), "identifier") != 0) continue;
-                char* var_name = lsp_node_text(ctx, lhs_var);
-                if (!var_name || strcmp(var_name, "_") == 0) continue;
+                if (strcmp(ts_node_type(lhs_var), "identifier") != 0)
+                    continue;
+                char *var_name = lsp_node_text(ctx, lhs_var);
+                if (!var_name || strcmp(var_name, "_") == 0)
+                    continue;
 
-                const CBMType* var_type = cbm_type_unknown();
+                const CBMType *var_type = cbm_type_unknown();
                 if (rhs_type) {
                     if (rhs_type->kind == CBM_TYPE_TUPLE && (int)i < rhs_type->data.tuple.count) {
                         var_type = rhs_type->data.tuple.elems[i];
@@ -1106,7 +1192,7 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
                 go_scope_bind_value(ctx, var_name, var_type, i == 0 ? rhs_callable : NULL);
             }
         } else if (strcmp(ts_node_type(left), "identifier") == 0) {
-            char* var_name = lsp_node_text(ctx, left);
+            char *var_name = lsp_node_text(ctx, left);
             if (var_name && strcmp(var_name, "_") != 0 && rhs_type) {
                 go_scope_bind_value(ctx, var_name, rhs_type, rhs_callable);
             }
@@ -1156,7 +1242,7 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
         TSNode type_node = ts_node_child_by_field_name(node, "type", 4);
         TSNode value_node = ts_node_child_by_field_name(node, "value", 5);
 
-        const CBMType* var_type = cbm_type_unknown();
+        const CBMType *var_type = cbm_type_unknown();
         TSNode callable_value = value_node;
         if (!ts_node_is_null(value_node) &&
             strcmp(ts_node_type(value_node), "expression_list") == 0) {
@@ -1181,9 +1267,10 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
         uint32_t vnc = ts_node_child_count(node);
         for (uint32_t vi = 0; vi < vnc; vi++) {
             TSNode ch = ts_node_child(node, vi);
-            if (ts_node_is_null(ch) || !ts_node_is_named(ch)) continue;
+            if (ts_node_is_null(ch) || !ts_node_is_named(ch))
+                continue;
             if (strcmp(ts_node_type(ch), "identifier") == 0) {
-                char* var_name = lsp_node_text(ctx, ch);
+                char *var_name = lsp_node_text(ctx, ch);
                 if (var_name && strcmp(var_name, "_") != 0) {
                     go_scope_bind_value(ctx, var_name, var_type, callable_qn);
                 }
@@ -1197,9 +1284,10 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
         TSNode name_node = ts_node_child_by_field_name(node, "name", 4);
         TSNode type_node = ts_node_child_by_field_name(node, "type", 4);
         TSNode value_node = ts_node_child_by_field_name(node, "value", 5);
-        if (ts_node_is_null(name_node)) return;
+        if (ts_node_is_null(name_node))
+            return;
 
-        const CBMType* const_type = cbm_type_unknown();
+        const CBMType *const_type = cbm_type_unknown();
         TSNode callable_value = value_node;
         if (!ts_node_is_null(value_node) &&
             strcmp(ts_node_type(value_node), "expression_list") == 0) {
@@ -1222,7 +1310,7 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
             ts_node_is_null(callable_value) ? NULL : go_exact_callable_target(ctx, callable_value);
 
         if (strcmp(ts_node_type(name_node), "identifier") == 0) {
-            char* name = lsp_node_text(ctx, name_node);
+            char *name = lsp_node_text(ctx, name_node);
             if (name && strcmp(name, "_") != 0)
                 go_scope_bind_value(ctx, name, const_type, callable_qn);
         }
@@ -1233,13 +1321,14 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
     if (strcmp(kind, "range_clause") == 0) {
         TSNode left = ts_node_child_by_field_name(node, "left", 4);
         TSNode right = ts_node_child_by_field_name(node, "right", 5);
-        if (ts_node_is_null(right)) return;
+        if (ts_node_is_null(right))
+            return;
 
-        const CBMType* container_type = go_eval_expr_type(ctx, right);
+        const CBMType *container_type = go_eval_expr_type(ctx, right);
 
         // Determine key and value types based on container type
-        const CBMType* key_type = cbm_type_unknown();
-        const CBMType* val_type = cbm_type_unknown();
+        const CBMType *key_type = cbm_type_unknown();
+        const CBMType *val_type = cbm_type_unknown();
 
         if (container_type) {
             switch (container_type->kind) {
@@ -1268,9 +1357,11 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
             uint32_t lhs_count = ts_node_named_child_count(left);
             for (uint32_t i = 0; i < lhs_count; i++) {
                 TSNode var_node = ts_node_named_child(left, i);
-                if (strcmp(ts_node_type(var_node), "identifier") != 0) continue;
-                char* var_name = lsp_node_text(ctx, var_node);
-                if (!var_name || strcmp(var_name, "_") == 0) continue;
+                if (strcmp(ts_node_type(var_node), "identifier") != 0)
+                    continue;
+                char *var_name = lsp_node_text(ctx, var_node);
+                if (!var_name || strcmp(var_name, "_") == 0)
+                    continue;
                 cbm_scope_bind(ctx->current_scope, var_name, i == 0 ? key_type : val_type);
             }
         }
@@ -1286,7 +1377,8 @@ void go_process_statement(GoLSPContext* ctx, TSNode node) {
 static void go_emit_resolved_kind(GoLSPContext *ctx, const char *callee_qn, const char *strategy,
                                   float confidence, const char *source_name, CBMResolvedKind kind,
                                   TSNode site) {
-    if (!ctx->resolved_calls || !callee_qn || !ctx->enclosing_func_qn) return;
+    if (!ctx->resolved_calls || !callee_qn || !ctx->enclosing_func_qn)
+        return;
 
     CBMResolvedCall rc = {0};
     rc.caller_qn = ctx->enclosing_func_qn;
@@ -1345,7 +1437,8 @@ static void emit_unresolved_reference(GoLSPContext *ctx, const char *source_name
 // Emit a diagnostic for an unresolved call (confidence 0.0).
 static void emit_unresolved_call(GoLSPContext *ctx, const char *expr_text, const char *reason,
                                  TSNode site) {
-    if (!ctx->resolved_calls || !ctx->enclosing_func_qn) return;
+    if (!ctx->resolved_calls || !ctx->enclosing_func_qn)
+        return;
 
     CBMResolvedCall rc = {0};
     rc.caller_qn = ctx->enclosing_func_qn;
@@ -1428,9 +1521,10 @@ static void go_invalidate_control_flow_aliases(GoLSPContext *ctx, TSNode node, i
 
 // --- Walk call expressions and resolve them ---
 
-static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
-    if (ts_node_is_null(node)) return;
-    const char* kind = ts_node_type(node);
+static void resolve_calls_in_node_inner(GoLSPContext *ctx, TSNode node) {
+    if (ts_node_is_null(node))
+        return;
+    const char *kind = ts_node_type(node);
 
     // Process statements to build scope
     go_process_statement(ctx, node);
@@ -1446,22 +1540,23 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
         go_resolve_value_references_at(ctx, node);
         TSNode func_node = ts_node_child_by_field_name(node, "function", 8);
         if (!ts_node_is_null(func_node)) {
-            const char* fk = ts_node_type(func_node);
+            const char *fk = ts_node_type(func_node);
 
             // selector_expression: obj.Method() or pkg.Func()
             if (strcmp(fk, "selector_expression") == 0) {
                 TSNode operand = ts_node_child_by_field_name(func_node, "operand", 7);
                 TSNode field = ts_node_child_by_field_name(func_node, "field", 5);
                 if (!ts_node_is_null(operand) && !ts_node_is_null(field)) {
-                    char* field_name = lsp_node_text(ctx, field);
+                    char *field_name = lsp_node_text(ctx, field);
 
                     // Check if operand is a package import
                     if (strcmp(ts_node_type(operand), "identifier") == 0) {
-                        char* pkg_name = lsp_node_text(ctx, operand);
+                        char *pkg_name = lsp_node_text(ctx, operand);
                         if (pkg_name) {
-                            const char* pkg_qn = resolve_import(ctx, pkg_name);
+                            const char *pkg_qn = resolve_import(ctx, pkg_name);
                             if (pkg_qn && field_name) {
-                                const CBMRegisteredFunc* f = cbm_registry_lookup_symbol(ctx->registry, pkg_qn, field_name);
+                                const CBMRegisteredFunc *f =
+                                    cbm_registry_lookup_symbol(ctx->registry, pkg_qn, field_name);
                                 if (f) {
                                     emit_resolved_call(ctx, f->qualified_name, "lsp_direct", 0.95f,
                                                        node);
@@ -1479,14 +1574,15 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
 
                     // Type-based method dispatch
                     if (field_name) {
-                        const CBMType* recv_type = go_eval_expr_type(ctx, operand);
-                        const CBMType* base = recv_type;
-                        if (base && base->kind == CBM_TYPE_POINTER) base = cbm_type_deref(base);
+                        const CBMType *recv_type = go_eval_expr_type(ctx, operand);
+                        const CBMType *base = recv_type;
+                        if (base && base->kind == CBM_TYPE_POINTER)
+                            base = cbm_type_deref(base);
 
                         if (base && base->kind == CBM_TYPE_NAMED) {
                             const char *recv_qn = base->data.named.qualified_name;
-                            const CBMRegisteredType *receiver_type = cbm_registry_lookup_type(
-                                ctx->registry, recv_qn);
+                            const CBMRegisteredType *receiver_type =
+                                cbm_registry_lookup_type(ctx->registry, recv_qn);
                             const char *alt_qn = NULL;
                             /* Re-qualify NAMED receivers that embed an import
                              * alias segment (cross-package field type texts) —
@@ -1495,7 +1591,8 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
                                 alt_qn = go_requalify_via_imports(ctx, recv_qn);
                                 if (alt_qn) {
                                     receiver_type = cbm_registry_lookup_type(ctx->registry, alt_qn);
-                                    if (receiver_type) recv_qn = alt_qn;
+                                    if (receiver_type)
+                                        recv_qn = alt_qn;
                                 }
                             }
                             /* Registered interface receivers must reach the
@@ -1503,13 +1600,12 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
                              * method registrations are signatures, not concrete
                              * dispatch targets. */
                             if (!receiver_type || !receiver_type->is_interface) {
-                                const CBMRegisteredFunc *method = go_lookup_field_or_method(
-                                    ctx, recv_qn, field_name);
+                                const CBMRegisteredFunc *method =
+                                    go_lookup_field_or_method(ctx, recv_qn, field_name);
                                 if (method) {
                                     const char *strategy = "lsp_type_dispatch";
                                     if (method->receiver_type &&
-                                        strcmp(method->receiver_type,
-                                               recv_qn) != 0) {
+                                        strcmp(method->receiver_type, recv_qn) != 0) {
                                         strategy = "lsp_embed_dispatch";
                                     }
                                     emit_resolved_call(ctx, method->qualified_name, strategy, 0.95f,
@@ -1519,15 +1615,16 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
                             }
                         }
 
-                        // Interface dispatch: NAMED type that is an interface, or bare INTERFACE type
+                        // Interface dispatch: NAMED type that is an interface, or bare INTERFACE
+                        // type
                         if (base && field_name) {
                             bool is_iface = (base->kind == CBM_TYPE_INTERFACE);
-                            const char* iface_qn = NULL;
+                            const char *iface_qn = NULL;
                             if (!is_iface && base->kind == CBM_TYPE_NAMED) {
-                                const CBMRegisteredType* rt = cbm_registry_lookup_type(ctx->registry,
-                                    base->data.named.qualified_name);
+                                const CBMRegisteredType *rt = cbm_registry_lookup_type(
+                                    ctx->registry, base->data.named.qualified_name);
                                 if (!rt) {
-                                    const char* alt_qn = go_requalify_via_imports(
+                                    const char *alt_qn = go_requalify_via_imports(
                                         ctx, base->data.named.qualified_name);
                                     if (alt_qn)
                                         rt = cbm_registry_lookup_type(ctx->registry, alt_qn);
@@ -1538,32 +1635,47 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
                                 }
                             }
                             if (is_iface) {
-                                // Try interface satisfaction: find concrete types implementing this interface
-                                const CBMRegisteredType* iface_rt = iface_qn ?
-                                    cbm_registry_lookup_type(ctx->registry, iface_qn) : NULL;
-                                if (iface_rt && iface_rt->method_names && iface_rt->method_names[0]) {
+                                // Try interface satisfaction: find concrete types implementing this
+                                // interface
+                                const CBMRegisteredType *iface_rt =
+                                    iface_qn ? cbm_registry_lookup_type(ctx->registry, iface_qn)
+                                             : NULL;
+                                if (iface_rt && iface_rt->method_names &&
+                                    iface_rt->method_names[0]) {
                                     // Count interface methods
                                     int iface_mcount = 0;
-                                    while (iface_rt->method_names[iface_mcount]) iface_mcount++;
+                                    while (iface_rt->method_names[iface_mcount])
+                                        iface_mcount++;
 
                                     // Scan all registered types for satisfaction
-                                    const char* sole_impl_qn = NULL;
+                                    const char *sole_impl_qn = NULL;
                                     int impl_count = 0;
                                     // Skip stdlib types when interface is from a project package
-                                    bool iface_is_project = iface_qn && strchr(iface_qn, '/') != NULL;
-                                    for (int ti = 0; ti < ctx->registry->type_count && impl_count < 2; ti++) {
-                                        const CBMRegisteredType* cand = &ctx->registry->types[ti];
-                                        if (cand->is_interface) continue;
-                                        if (!cand->qualified_name) continue;
-                                        if (cand->alias_of) continue;
-                                        // For project interfaces, skip stdlib candidates (no '/' in QN)
-                                        if (iface_is_project && !strchr(cand->qualified_name, '/')) continue;
+                                    bool iface_is_project =
+                                        iface_qn && strchr(iface_qn, '/') != NULL;
+                                    CBMTypeShortIter all_types;
+                                    cbm_registry_all_types_chain(ctx->registry, &all_types);
+                                    for (int ti = -1;
+                                         impl_count < 2 &&
+                                         (ti = cbm_type_short_iter_next(&all_types)) >= 0;) {
+                                        const CBMRegisteredType *cand = &all_types.reg->types[ti];
+                                        if (cand->is_interface)
+                                            continue;
+                                        if (!cand->qualified_name)
+                                            continue;
+                                        if (cand->alias_of)
+                                            continue;
+                                        // For project interfaces, skip stdlib candidates (no '/' in
+                                        // QN)
+                                        if (iface_is_project && !strchr(cand->qualified_name, '/'))
+                                            continue;
 
                                         // Check if candidate has all interface methods
                                         bool satisfies = true;
                                         for (int mi = 0; mi < iface_mcount; mi++) {
-                                            if (!cbm_registry_lookup_method(ctx->registry,
-                                                    cand->qualified_name, iface_rt->method_names[mi])) {
+                                            if (!cbm_registry_lookup_method(
+                                                    ctx->registry, cand->qualified_name,
+                                                    iface_rt->method_names[mi])) {
                                                 satisfies = false;
                                                 break;
                                             }
@@ -1576,14 +1688,15 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
 
                                     if (impl_count == 1 && sole_impl_qn) {
                                         // Single implementer: resolve to concrete method
-                                        const CBMRegisteredFunc* concrete_method =
-                                            cbm_registry_lookup_method(ctx->registry, sole_impl_qn, field_name);
+                                        const CBMRegisteredFunc *concrete_method =
+                                            cbm_registry_lookup_method(ctx->registry, sole_impl_qn,
+                                                                       field_name);
                                         if (concrete_method) {
                                             // Sole-implementer interface dispatch is an unambiguous
-                                            // resolution (exactly one concrete method); rank it at least
-                                            // as high as a direct type dispatch (0.95) so the concrete
-                                            // `Type.method` wins over the interface-method type_dispatch
-                                            // for the same call site.
+                                            // resolution (exactly one concrete method); rank it at
+                                            // least as high as a direct type dispatch (0.95) so the
+                                            // concrete `Type.method` wins over the interface-method
+                                            // type_dispatch for the same call site.
                                             emit_resolved_call(ctx, concrete_method->qualified_name,
                                                                "lsp_interface_resolve", 0.95f,
                                                                node);
@@ -1611,7 +1724,7 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
                                                                    field_name),
                                                  "method_not_found", node);
                         } else if (cbm_type_is_unknown(recv_type)) {
-                            char* operand_text = lsp_node_text(ctx, operand);
+                            char *operand_text = lsp_node_text(ctx, operand);
                             emit_unresolved_call(
                                 ctx,
                                 cbm_arena_sprintf(ctx->arena, "%s.%s",
@@ -1624,7 +1737,7 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
 
             // Direct function call: FuncName()
             if (strcmp(fk, "identifier") == 0) {
-                char* name = lsp_node_text(ctx, func_node);
+                char *name = lsp_node_text(ctx, func_node);
                 if (name && !is_go_builtin_func(name)) {
                     if (cbm_scope_contains(ctx->current_scope, name)) {
                         const char *alias_target =
@@ -1638,7 +1751,8 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
                         goto recurse;
                     }
                     // Package-local function
-                    const CBMRegisteredFunc* f = cbm_registry_lookup_symbol(ctx->registry, ctx->package_qn, name);
+                    const CBMRegisteredFunc *f =
+                        cbm_registry_lookup_symbol(ctx->registry, ctx->package_qn, name);
                     if (f) {
                         emit_resolved_call(ctx, f->qualified_name, "lsp_direct", 0.95f, node);
                     } else {
@@ -1651,18 +1765,16 @@ static void resolve_calls_in_node_inner(GoLSPContext* ctx, TSNode node) {
 
 recurse:;
     // Push scope for blocks and statements that introduce variables
-    bool push_scope = (strcmp(kind, "block") == 0 ||
-                       strcmp(kind, "if_statement") == 0 ||
-                       strcmp(kind, "for_statement") == 0 ||
-                       strcmp(kind, "expression_switch_statement") == 0);
+    bool push_scope =
+        (strcmp(kind, "block") == 0 || strcmp(kind, "if_statement") == 0 ||
+         strcmp(kind, "for_statement") == 0 || strcmp(kind, "expression_switch_statement") == 0);
     if (push_scope) {
         ctx->current_scope = cbm_scope_push(ctx->arena, ctx->current_scope);
     }
 
     // Process initializer field for if/for/switch statements.
     // Go patterns: if err := f(); ..., for i := 0; ..., switch v := x; v { ... }
-    if (strcmp(kind, "if_statement") == 0 ||
-        strcmp(kind, "for_statement") == 0 ||
+    if (strcmp(kind, "if_statement") == 0 || strcmp(kind, "for_statement") == 0 ||
         strcmp(kind, "expression_switch_statement") == 0) {
         TSNode init = ts_node_child_by_field_name(node, "initializer", 11);
         if (!ts_node_is_null(init)) {
@@ -1688,14 +1800,15 @@ recurse:;
     //   identifier (operand "animal")
     //   type_case (case clause, may repeat)
     if (strcmp(kind, "type_switch_statement") == 0) {
-        const char* switch_var = NULL;
+        const char *switch_var = NULL;
         // Pass 1: find switch variable and operand type
         uint32_t nc2 = ts_node_child_count(node);
         bool found_assign = false;
         for (uint32_t i = 0; i < nc2; i++) {
             TSNode child = ts_node_child(node, i);
-            if (ts_node_is_null(child)) continue;
-            const char* ck = ts_node_type(child);
+            if (ts_node_is_null(child))
+                continue;
+            const char *ck = ts_node_type(child);
 
             // expression_list before := is the LHS (variable name)
             if (!found_assign && strcmp(ck, "expression_list") == 0) {
@@ -1705,8 +1818,9 @@ recurse:;
             }
             // := operator marks the assignment
             if (!ts_node_is_named(child)) {
-                char* tok = lsp_node_text(ctx, child);
-                if (tok && strcmp(tok, ":=") == 0) found_assign = true;
+                char *tok = lsp_node_text(ctx, child);
+                if (tok && strcmp(tok, ":=") == 0)
+                    found_assign = true;
             }
             // identifier after := is the operand being type-switched
             if (found_assign && strcmp(ck, "identifier") == 0) {
@@ -1717,25 +1831,27 @@ recurse:;
         // Pass 2: process each type_case with narrowed scope
         for (uint32_t i = 0; i < nc2; i++) {
             TSNode child = ts_node_child(node, i);
-            if (ts_node_is_null(child) || !ts_node_is_named(child)) continue;
-            if (strcmp(ts_node_type(child), "type_case") != 0) continue;
+            if (ts_node_is_null(child) || !ts_node_is_named(child))
+                continue;
+            if (strcmp(ts_node_type(child), "type_case") != 0)
+                continue;
 
-            CBMScope* saved = ctx->current_scope;
+            CBMScope *saved = ctx->current_scope;
             ctx->current_scope = cbm_scope_push(ctx->arena, ctx->current_scope);
 
             // Find case type and bind switch variable
             uint32_t cc_count = ts_node_child_count(child);
             for (uint32_t j = 0; j < cc_count; j++) {
                 TSNode cc_child = ts_node_child(child, j);
-                if (ts_node_is_null(cc_child) || !ts_node_is_named(cc_child)) continue;
-                const char* cc_kind = ts_node_type(cc_child);
+                if (ts_node_is_null(cc_child) || !ts_node_is_named(cc_child))
+                    continue;
+                const char *cc_kind = ts_node_type(cc_child);
                 if (strcmp(cc_kind, "type_identifier") == 0 ||
                     strcmp(cc_kind, "qualified_type") == 0 ||
-                    strcmp(cc_kind, "pointer_type") == 0 ||
-                    strcmp(cc_kind, "slice_type") == 0) {
+                    strcmp(cc_kind, "pointer_type") == 0 || strcmp(cc_kind, "slice_type") == 0) {
                     if (switch_var) {
                         cbm_scope_bind(ctx->current_scope, switch_var,
-                            go_parse_type_node(ctx, cc_child));
+                                       go_parse_type_node(ctx, cc_child));
                     }
                     break;
                 }
@@ -1744,20 +1860,22 @@ recurse:;
             // Recurse into case body statements
             for (uint32_t j = 0; j < cc_count; j++) {
                 TSNode cc_child = ts_node_child(child, j);
-                if (ts_node_is_null(cc_child) || !ts_node_is_named(cc_child)) continue;
-                const char* cc_kind = ts_node_type(cc_child);
+                if (ts_node_is_null(cc_child) || !ts_node_is_named(cc_child))
+                    continue;
+                const char *cc_kind = ts_node_type(cc_child);
                 // Skip type nodes, process everything else (expression_statement, etc.)
                 if (strcmp(cc_kind, "type_identifier") == 0 ||
                     strcmp(cc_kind, "qualified_type") == 0 ||
-                    strcmp(cc_kind, "pointer_type") == 0 ||
-                    strcmp(cc_kind, "slice_type") == 0) continue;
+                    strcmp(cc_kind, "pointer_type") == 0 || strcmp(cc_kind, "slice_type") == 0)
+                    continue;
                 resolve_calls_in_node(ctx, cc_child);
             }
 
             ctx->current_scope = saved;
         }
 
-        if (push_scope) ctx->current_scope = cbm_scope_pop(ctx->current_scope);
+        if (push_scope)
+            ctx->current_scope = cbm_scope_pop(ctx->current_scope);
         return;
     }
 
@@ -1767,19 +1885,21 @@ recurse:;
         uint32_t nc3 = ts_node_child_count(node);
         for (uint32_t i = 0; i < nc3; i++) {
             TSNode child = ts_node_child(node, i);
-            if (ts_node_is_null(child) || !ts_node_is_named(child)) continue;
-            const char* ck3 = ts_node_type(child);
+            if (ts_node_is_null(child) || !ts_node_is_named(child))
+                continue;
+            const char *ck3 = ts_node_type(child);
 
             if (strcmp(ck3, "communication_case") == 0 || strcmp(ck3, "default_case") == 0) {
-                CBMScope* saved = ctx->current_scope;
+                CBMScope *saved = ctx->current_scope;
                 ctx->current_scope = cbm_scope_push(ctx->arena, ctx->current_scope);
 
                 // Process children: receive_statement binds vars, then recurse body
                 uint32_t cc_count = ts_node_child_count(child);
                 for (uint32_t j = 0; j < cc_count; j++) {
                     TSNode cc_child = ts_node_child(child, j);
-                    if (ts_node_is_null(cc_child) || !ts_node_is_named(cc_child)) continue;
-                    const char* cc_kind = ts_node_type(cc_child);
+                    if (ts_node_is_null(cc_child) || !ts_node_is_named(cc_child))
+                        continue;
+                    const char *cc_kind = ts_node_type(cc_child);
 
                     if (strcmp(cc_kind, "receive_statement") == 0) {
                         // receive_statement: left := <-right
@@ -1788,10 +1908,10 @@ recurse:;
                         TSNode left = ts_node_child_by_field_name(cc_child, "left", 4);
                         TSNode right = ts_node_child_by_field_name(cc_child, "right", 5);
                         if (!ts_node_is_null(right)) {
-                            const CBMType* right_type = go_eval_expr_type(ctx, right);
+                            const CBMType *right_type = go_eval_expr_type(ctx, right);
                             // right_type might be a channel (if right is the channel)
                             // or already the elem type (if right is a <-ch unary expr)
-                            const CBMType* recv_type = right_type;
+                            const CBMType *recv_type = right_type;
                             if (right_type && right_type->kind == CBM_TYPE_CHANNEL) {
                                 recv_type = right_type->data.channel.elem;
                             }
@@ -1800,19 +1920,21 @@ recurse:;
                                     uint32_t lhs_count = ts_node_named_child_count(left);
                                     for (uint32_t k = 0; k < lhs_count; k++) {
                                         TSNode var_node = ts_node_named_child(left, k);
-                                        if (strcmp(ts_node_type(var_node), "identifier") != 0) continue;
-                                        char* var_name = lsp_node_text(ctx, var_node);
-                                        if (!var_name || strcmp(var_name, "_") == 0) continue;
+                                        if (strcmp(ts_node_type(var_node), "identifier") != 0)
+                                            continue;
+                                        char *var_name = lsp_node_text(ctx, var_node);
+                                        if (!var_name || strcmp(var_name, "_") == 0)
+                                            continue;
                                         if (k == 0) {
                                             cbm_scope_bind(ctx->current_scope, var_name, recv_type);
                                         } else {
                                             // second var is the ok bool
                                             cbm_scope_bind(ctx->current_scope, var_name,
-                                                cbm_type_builtin(ctx->arena, "bool"));
+                                                           cbm_type_builtin(ctx->arena, "bool"));
                                         }
                                     }
                                 } else if (strcmp(ts_node_type(left), "identifier") == 0) {
-                                    char* var_name = lsp_node_text(ctx, left);
+                                    char *var_name = lsp_node_text(ctx, left);
                                     if (var_name && strcmp(var_name, "_") != 0) {
                                         cbm_scope_bind(ctx->current_scope, var_name, recv_type);
                                     }
@@ -1828,20 +1950,24 @@ recurse:;
                 ctx->current_scope = saved;
             }
         }
-        if (push_scope) ctx->current_scope = cbm_scope_pop(ctx->current_scope);
+        if (push_scope)
+            ctx->current_scope = cbm_scope_pop(ctx->current_scope);
         return;
     }
 
     // Recurse into children via a cursor (O(n)); ts_node_child(node,i) is O(i)
     // → O(n²) on a wide node.
+    // The cursor is this depth's pooled one (cbm_cursor_acquire): the recursion
+    // below runs one level deeper and never touches it.
     {
-        TSTreeCursor cursor = ts_tree_cursor_new(node);
-        if (ts_tree_cursor_goto_first_child(&cursor)) {
+        cbm_cursor_lease_t lease;
+        TSTreeCursor *cursor = cbm_cursor_acquire(&lease, ctx->walk_depth, node);
+        if (ts_tree_cursor_goto_first_child(cursor)) {
             do {
-                resolve_calls_in_node(ctx, ts_tree_cursor_current_node(&cursor));
-            } while (ts_tree_cursor_goto_next_sibling(&cursor));
+                resolve_calls_in_node(ctx, ts_tree_cursor_current_node(cursor));
+            } while (ts_tree_cursor_goto_next_sibling(cursor));
         }
-        ts_tree_cursor_delete(&cursor);
+        cbm_cursor_release(&lease);
     }
 
     if (push_scope) {
@@ -1851,13 +1977,15 @@ recurse:;
 
 // --- Process a single function body ---
 
-static void process_function(GoLSPContext* ctx, TSNode func_node) {
+static void process_function(GoLSPContext *ctx, TSNode func_node) {
     // Set enclosing function QN
     TSNode name_node = ts_node_child_by_field_name(func_node, "name", 4);
-    if (ts_node_is_null(name_node)) return;
+    if (ts_node_is_null(name_node))
+        return;
 
-    char* func_name = lsp_node_text(ctx, name_node);
-    if (!func_name || !func_name[0]) return;
+    char *func_name = lsp_node_text(ctx, name_node);
+    if (!func_name || !func_name[0])
+        return;
 
     // Enclosing-function QN must be the BARE package.Func form (no receiver
     // type segment). The textual call events (extract_unified.c) source calls
@@ -1870,7 +1998,7 @@ static void process_function(GoLSPContext* ctx, TSNode func_node) {
     ctx->enclosing_func_qn = cbm_arena_sprintf(ctx->arena, "%s.%s", ctx->package_qn, func_name);
 
     // Push function scope
-    CBMScope* saved_scope = ctx->current_scope;
+    CBMScope *saved_scope = ctx->current_scope;
     ctx->current_scope = cbm_scope_push(ctx->arena, ctx->current_scope);
 
     // Bind parameters into scope (including variadic)
@@ -1879,15 +2007,17 @@ static void process_function(GoLSPContext* ctx, TSNode func_node) {
         uint32_t nc = ts_node_child_count(params);
         for (uint32_t i = 0; i < nc; i++) {
             TSNode param = ts_node_child(params, i);
-            if (ts_node_is_null(param) || !ts_node_is_named(param)) continue;
-            const char* pk = ts_node_type(param);
+            if (ts_node_is_null(param) || !ts_node_is_named(param))
+                continue;
+            const char *pk = ts_node_type(param);
 
             bool is_variadic = (strcmp(pk, "variadic_parameter_declaration") == 0);
-            if (!is_variadic && strcmp(pk, "parameter_declaration") != 0) continue;
+            if (!is_variadic && strcmp(pk, "parameter_declaration") != 0)
+                continue;
 
             // Get type
             TSNode type_node = ts_node_child_by_field_name(param, "type", 4);
-            const CBMType* param_type = go_parse_type_node(ctx, type_node);
+            const CBMType *param_type = go_parse_type_node(ctx, type_node);
 
             // Variadic: ...T is []T in the function body
             if (is_variadic && param_type) {
@@ -1898,9 +2028,10 @@ static void process_function(GoLSPContext* ctx, TSNode func_node) {
             uint32_t pnc = ts_node_child_count(param);
             for (uint32_t j = 0; j < pnc; j++) {
                 TSNode child = ts_node_child(param, j);
-                if (ts_node_is_null(child) || !ts_node_is_named(child)) continue;
+                if (ts_node_is_null(child) || !ts_node_is_named(child))
+                    continue;
                 if (strcmp(ts_node_type(child), "identifier") == 0) {
-                    char* pname = lsp_node_text(ctx, child);
+                    char *pname = lsp_node_text(ctx, child);
                     if (pname && strcmp(pname, "_") != 0) {
                         cbm_scope_bind(ctx->current_scope, pname, param_type);
                     }
@@ -1913,23 +2044,26 @@ static void process_function(GoLSPContext* ctx, TSNode func_node) {
     TSNode result_node = ts_node_child_by_field_name(func_node, "result", 6);
     if (!ts_node_is_null(result_node)) {
         // result can be a parameter_list (named returns) or a simple type
-        const char* rk = ts_node_type(result_node);
+        const char *rk = ts_node_type(result_node);
         if (strcmp(rk, "parameter_list") == 0) {
             uint32_t rnc = ts_node_child_count(result_node);
             for (uint32_t i = 0; i < rnc; i++) {
                 TSNode rparam = ts_node_child(result_node, i);
-                if (ts_node_is_null(rparam) || !ts_node_is_named(rparam)) continue;
-                if (strcmp(ts_node_type(rparam), "parameter_declaration") != 0) continue;
+                if (ts_node_is_null(rparam) || !ts_node_is_named(rparam))
+                    continue;
+                if (strcmp(ts_node_type(rparam), "parameter_declaration") != 0)
+                    continue;
 
                 TSNode rtype = ts_node_child_by_field_name(rparam, "type", 4);
-                const CBMType* ret_type = go_parse_type_node(ctx, rtype);
+                const CBMType *ret_type = go_parse_type_node(ctx, rtype);
 
                 uint32_t rpnc = ts_node_child_count(rparam);
                 for (uint32_t j = 0; j < rpnc; j++) {
                     TSNode child = ts_node_child(rparam, j);
-                    if (ts_node_is_null(child) || !ts_node_is_named(child)) continue;
+                    if (ts_node_is_null(child) || !ts_node_is_named(child))
+                        continue;
                     if (strcmp(ts_node_type(child), "identifier") == 0) {
-                        char* rname = lsp_node_text(ctx, child);
+                        char *rname = lsp_node_text(ctx, child);
                         if (rname && strcmp(rname, "_") != 0) {
                             cbm_scope_bind(ctx->current_scope, rname, ret_type);
                         }
@@ -1946,11 +2080,13 @@ static void process_function(GoLSPContext* ctx, TSNode func_node) {
         uint32_t rnc = ts_node_child_count(recv);
         for (uint32_t i = 0; i < rnc; i++) {
             TSNode rp = ts_node_child(recv, i);
-            if (ts_node_is_null(rp) || !ts_node_is_named(rp)) continue;
-            if (strcmp(ts_node_type(rp), "parameter_declaration") != 0) continue;
+            if (ts_node_is_null(rp) || !ts_node_is_named(rp))
+                continue;
+            if (strcmp(ts_node_type(rp), "parameter_declaration") != 0)
+                continue;
 
             TSNode rtype = ts_node_child_by_field_name(rp, "type", 4);
-            const CBMType* recv_type = go_parse_type_node(ctx, rtype);
+            const CBMType *recv_type = go_parse_type_node(ctx, rtype);
 
             // Find receiver name
             uint32_t rpnc = ts_node_child_count(rp);
@@ -1958,7 +2094,7 @@ static void process_function(GoLSPContext* ctx, TSNode func_node) {
                 TSNode rc = ts_node_child(rp, j);
                 if (!ts_node_is_null(rc) && ts_node_is_named(rc) &&
                     strcmp(ts_node_type(rc), "identifier") == 0) {
-                    char* rname = lsp_node_text(ctx, rc);
+                    char *rname = lsp_node_text(ctx, rc);
                     if (rname && strcmp(rname, "_") != 0) {
                         cbm_scope_bind(ctx->current_scope, rname, recv_type);
                     }
@@ -1980,24 +2116,26 @@ static void process_function(GoLSPContext* ctx, TSNode func_node) {
 
 // --- Process entire file ---
 
-void go_lsp_process_file(GoLSPContext* ctx, TSNode root) {
-    if (ts_node_is_null(root)) return;
+void go_lsp_process_file(GoLSPContext *ctx, TSNode root) {
+    if (ts_node_is_null(root))
+        return;
 
     // Collect top-level children once (O(n)); ts_node_child(root,i) is O(i) → O(n²).
     uint32_t kn = 0;
-    TSNode* kids = cbm_lsp_collect_children(ctx->arena, root, &kn);
+    TSNode *kids = cbm_lsp_collect_children(ctx->arena, root, &kn);
 
     // Pass 1: Bind package-level var/const declarations into root scope.
     // Must happen before processing functions so all globals are visible.
     for (uint32_t i = 0; i < kn; i++) {
         TSNode child = kids[i];
-        const char* kind = ts_node_type(child);
+        const char *kind = ts_node_type(child);
 
         if (strcmp(kind, "var_declaration") == 0 || strcmp(kind, "const_declaration") == 0) {
             uint32_t vnc = ts_node_child_count(child);
             for (uint32_t j = 0; j < vnc; j++) {
                 TSNode spec = ts_node_child(child, j);
-                if (ts_node_is_null(spec) || !ts_node_is_named(spec)) continue;
+                if (ts_node_is_null(spec) || !ts_node_is_named(spec))
+                    continue;
                 go_process_statement(ctx, spec);
             }
         }
@@ -2006,10 +2144,9 @@ void go_lsp_process_file(GoLSPContext* ctx, TSNode root) {
     // Pass 2: Process function/method bodies
     for (uint32_t i = 0; i < kn; i++) {
         TSNode child = kids[i];
-        const char* kind = ts_node_type(child);
+        const char *kind = ts_node_type(child);
 
-        if (strcmp(kind, "function_declaration") == 0 ||
-            strcmp(kind, "method_declaration") == 0) {
+        if (strcmp(kind, "function_declaration") == 0 || strcmp(kind, "method_declaration") == 0) {
             process_function(ctx, child);
         }
     }
@@ -2017,8 +2154,9 @@ void go_lsp_process_file(GoLSPContext* ctx, TSNode root) {
 
 // --- Helper: parse Go return type text into CBMType ---
 
-const CBMType* cbm_parse_return_type_text(CBMArena* a, const char* text, const char* module_qn) {
-    if (!text || !text[0]) return cbm_type_unknown();
+const CBMType *cbm_parse_return_type_text(CBMArena *a, const char *text, const char *module_qn) {
+    if (!text || !text[0])
+        return cbm_type_unknown();
 
     // Pointer: *Foo
     if (text[0] == '*') {
@@ -2031,15 +2169,13 @@ const CBMType* cbm_parse_return_type_text(CBMArena* a, const char* text, const c
     }
 
     // Builtin types
-    static const char* builtins[] = {
-        "int","int8","int16","int32","int64",
-        "uint","uint8","uint16","uint32","uint64",
-        "float32","float64","string","bool","byte","rune","error",
-        "any","uintptr",
-        NULL
-    };
-    for (const char** b = builtins; *b; b++) {
-        if (strcmp(text, *b) == 0) return cbm_type_builtin(a, text);
+    static const char *builtins[] = {"int",     "int8",    "int16",  "int32",   "int64",
+                                     "uint",    "uint8",   "uint16", "uint32",  "uint64",
+                                     "float32", "float64", "string", "bool",    "byte",
+                                     "rune",    "error",   "any",    "uintptr", NULL};
+    for (const char **b = builtins; *b; b++) {
+        if (strcmp(text, *b) == 0)
+            return cbm_type_builtin(a, text);
     }
 
     // Named type: assume local to module
@@ -2057,23 +2193,80 @@ static const CBMType *cbm_go_lsp_parse_signature_param_text(CBMArena *arena, con
     return cbm_parse_return_type_text(arena, text, module_qn);
 }
 
+// --- Shared Go stdlib registry ---
+
+/* The Go stdlib (2,328 functions, 321 types) registered ONCE per process into
+ * a finalized, sealed registry that every per-file registry chains to as its
+ * fallback -- the overlay contract of type_registry.h: lookups and the chain
+ * iterators reach it, refinements copy into the head, nothing writes it.
+ * Registered into each file's registry instead, it was 13.4 k re-registrations
+ * on the Go corpus, 2.5 GB of copies, and every lookup of the unfinalized
+ * per-file registry scanned the stdlib linearly (waste sanitizer, 2026-09-17).
+ * Threads racing the first build each build a copy and the first to publish
+ * wins; the others free theirs -- no thread waits. NULL on allocation
+ * failure: the caller registers the stdlib into its own registry as before. */
+typedef struct {
+    CBMArena arena;
+    CBMTypeRegistry reg;
+} go_stdlib_holder_t;
+
+static _Atomic(go_stdlib_holder_t *) g_go_stdlib_shared;
+
+static const CBMTypeRegistry *go_stdlib_shared(void) {
+    go_stdlib_holder_t *ready = atomic_load_explicit(&g_go_stdlib_shared, memory_order_acquire);
+    if (ready)
+        return &ready->reg;
+    go_stdlib_holder_t *built = cbm_calloc(CBM_MEM_CLASS_OTHER, sizeof(*built));
+    if (!built)
+        return NULL;
+    cbm_arena_init(&built->arena);
+    if (built->arena.nblocks == 0) {
+        cbm_free(CBM_MEM_CLASS_OTHER, built);
+        return NULL;
+    }
+    cbm_registry_init(&built->reg, &built->arena);
+    cbm_go_stdlib_register(&built->reg, &built->arena);
+    cbm_registry_finalize(&built->reg);
+    built->reg.read_only = true;
+    go_stdlib_holder_t *expected = NULL;
+    if (atomic_compare_exchange_strong_explicit(&g_go_stdlib_shared, &expected, built,
+                                                memory_order_acq_rel, memory_order_acquire)) {
+        return &built->reg;
+    }
+    cbm_arena_destroy(&built->arena);
+    cbm_free(CBM_MEM_CLASS_OTHER, built);
+    return &expected->reg;
+}
+
+/* A per-file registry sees the stdlib: chained to the shared copy, or
+ * registered into it when the shared copy cannot be built. */
+static void go_registry_with_stdlib(CBMTypeRegistry *reg, CBMArena *arena) {
+    const CBMTypeRegistry *shared = go_stdlib_shared();
+    if (shared) {
+        reg->fallback = shared;
+    } else {
+        cbm_go_stdlib_register(reg, arena);
+    }
+}
+
 // --- Entry point: build registry from file defs + run LSP ---
 
-void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
-    const char* source, int source_len, TSNode root) {
+void cbm_run_go_lsp(CBMArena *arena, CBMFileResult *result, const char *source, int source_len,
+                    TSNode root) {
 
     CBMTypeRegistry reg;
     cbm_registry_init(&reg, arena);
 
-    // Register Go stdlib types/functions
-    cbm_go_stdlib_register(&reg, arena);
+    // Go stdlib types/functions: the shared sealed registry, chained
+    go_registry_with_stdlib(&reg, arena);
 
-    const char* module_qn = result->module_qn;
+    const char *module_qn = result->module_qn;
 
     // Phase 1: Register all types and functions from the file's own definitions
     for (int i = 0; i < result->defs.count; i++) {
-        CBMDefinition* d = &result->defs.items[i];
-        if (!d->qualified_name || !d->name) continue;
+        CBMDefinition *d = &result->defs.items[i];
+        if (!d->qualified_name || !d->name)
+            continue;
 
         // Register every type-like container (Class/Struct/Type/Interface/Enum/
         // Trait). Struct included so a Go `type T struct {...}` (now labelled
@@ -2088,13 +2281,16 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
             // Populate embedded_types from base_classes (Go struct embedding)
             if (d->base_classes) {
                 int bc_count = 0;
-                while (d->base_classes[bc_count]) bc_count++;
+                while (d->base_classes[bc_count])
+                    bc_count++;
                 if (bc_count > 0) {
-                    const char** embedded = (const char**)cbm_arena_alloc(arena, (bc_count + 1) * sizeof(const char*));
+                    const char **embedded = (const char **)cbm_arena_alloc(
+                        arena, (bc_count + 1) * sizeof(const char *));
                     for (int j = 0; j < bc_count; j++) {
-                        const char* bc = d->base_classes[j];
+                        const char *bc = d->base_classes[j];
                         // Strip pointer prefix for embedded *Type
-                        while (bc[0] == '*') bc++;
+                        while (bc[0] == '*')
+                            bc++;
                         // Qualify the embedded type name
                         embedded[j] = cbm_arena_sprintf(arena, "%s.%s", module_qn, bc);
                     }
@@ -2114,20 +2310,23 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
             rf.short_name = d->name;
 
             // Build FUNC type from return_types
-            const CBMType** ret_types = NULL;
+            const CBMType **ret_types = NULL;
             if (d->return_types) {
                 int count = 0;
-                while (d->return_types[count]) count++;
+                while (d->return_types[count])
+                    count++;
                 if (count > 0) {
-                    ret_types = (const CBMType**)cbm_arena_alloc(arena, (count + 1) * sizeof(const CBMType*));
+                    ret_types = (const CBMType **)cbm_arena_alloc(
+                        arena, (count + 1) * sizeof(const CBMType *));
                     for (int j = 0; j < count; j++) {
-                        ret_types[j] = cbm_parse_return_type_text(arena, d->return_types[j], module_qn);
+                        ret_types[j] =
+                            cbm_parse_return_type_text(arena, d->return_types[j], module_qn);
                     }
                     ret_types[count] = NULL;
                 }
             } else if (d->return_type && d->return_type[0]) {
                 // Fallback: single return_type string
-                ret_types = (const CBMType**)cbm_arena_alloc(arena, 2 * sizeof(const CBMType*));
+                ret_types = (const CBMType **)cbm_arena_alloc(arena, 2 * sizeof(const CBMType *));
                 ret_types[0] = cbm_parse_return_type_text(arena, d->return_type, module_qn);
                 ret_types[1] = NULL;
             }
@@ -2136,7 +2335,7 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
              * is present, including a non-NULL carrier with an explicit zero
              * count. Its slots deliberately have no names because legacy name
              * extraction is not guaranteed to have the same multiplicity. */
-            const CBMType** param_types_arr = NULL;
+            const CBMType **param_types_arr = NULL;
             const char **param_names_arr = NULL;
             bool has_ordered_params =
                 d->signature_param_types != NULL || d->signature_param_count > 0;
@@ -2148,11 +2347,14 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
             } else if (d->param_types) {
                 param_names_arr = d->param_names;
                 int count = 0;
-                while (d->param_types[count]) count++;
+                while (d->param_types[count])
+                    count++;
                 if (count > 0) {
-                    param_types_arr = (const CBMType**)cbm_arena_alloc(arena, (count + 1) * sizeof(const CBMType*));
+                    param_types_arr = (const CBMType **)cbm_arena_alloc(
+                        arena, (count + 1) * sizeof(const CBMType *));
                     for (int j = 0; j < count; j++) {
-                        param_types_arr[j] = cbm_parse_return_type_text(arena, d->param_types[j], module_qn);
+                        param_types_arr[j] =
+                            cbm_parse_return_type_text(arena, d->param_types[j], module_qn);
                     }
                     param_types_arr[count] = NULL;
                 }
@@ -2204,28 +2406,32 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
     {
         // Collect top-level children once (O(n)); ts_node_child(root,i) is O(i) → O(n²).
         uint32_t rkn = 0;
-        TSNode* rkids = cbm_lsp_collect_children(arena, root, &rkn);
+        TSNode *rkids = cbm_lsp_collect_children(arena, root, &rkn);
         for (uint32_t i = 0; i < rkn; i++) {
             TSNode top = rkids[i];
-            const char* tk = ts_node_type(top);
+            const char *tk = ts_node_type(top);
             // type_declaration contains type_spec children
-            if (strcmp(tk, "type_declaration") != 0) continue;
+            if (strcmp(tk, "type_declaration") != 0)
+                continue;
             uint32_t td_nc = ts_node_child_count(top);
             for (uint32_t j = 0; j < td_nc; j++) {
                 TSNode spec = ts_node_child(top, j);
-                if (ts_node_is_null(spec) || !ts_node_is_named(spec)) continue;
-                const char* spec_kind = ts_node_type(spec);
+                if (ts_node_is_null(spec) || !ts_node_is_named(spec))
+                    continue;
+                const char *spec_kind = ts_node_type(spec);
 
                 // type_alias: type Foo = Bar
                 if (strcmp(spec_kind, "type_alias") == 0) {
                     TSNode alias_name = ts_node_child_by_field_name(spec, "name", 4);
                     TSNode alias_type = ts_node_child_by_field_name(spec, "type", 4);
                     if (!ts_node_is_null(alias_name) && !ts_node_is_null(alias_type)) {
-                        char* aname = cbm_node_text(arena, alias_name, source);
-                        char* atarget = cbm_node_text(arena, alias_type, source);
+                        char *aname = cbm_node_text(arena, alias_name, source);
+                        char *atarget = cbm_node_text(arena, alias_type, source);
                         if (aname && aname[0] && atarget && atarget[0]) {
-                            const char* alias_type_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, aname);
-                            const char* alias_target_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, atarget);
+                            const char *alias_type_qn =
+                                cbm_arena_sprintf(arena, "%s.%s", module_qn, aname);
+                            const char *alias_target_qn =
+                                cbm_arena_sprintf(arena, "%s.%s", module_qn, atarget);
                             bool found_a = false;
                             for (int ti = 0; ti < reg.type_count; ti++) {
                                 if (reg.types[ti].qualified_name &&
@@ -2248,30 +2454,34 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
                     continue;
                 }
 
-                if (strcmp(spec_kind, "type_spec") != 0) continue;
+                if (strcmp(spec_kind, "type_spec") != 0)
+                    continue;
 
                 TSNode name_node = ts_node_child_by_field_name(spec, "name", 4);
                 TSNode type_node = ts_node_child_by_field_name(spec, "type", 4);
-                if (ts_node_is_null(name_node) || ts_node_is_null(type_node)) continue;
+                if (ts_node_is_null(name_node) || ts_node_is_null(type_node))
+                    continue;
 
-                char* type_name = cbm_node_text(arena,name_node, source);
-                if (!type_name || !type_name[0]) continue;
-                const char* type_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, type_name);
+                char *type_name = cbm_node_text(arena, name_node, source);
+                if (!type_name || !type_name[0])
+                    continue;
+                const char *type_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, type_name);
 
                 // Interface type: extract method names for satisfaction checking
                 if (strcmp(ts_node_type(type_node), "interface_type") == 0) {
-                    const char* iface_methods[64];
+                    const char *iface_methods[64];
                     int iface_method_count = 0;
                     uint32_t inl_nc = ts_node_named_child_count(type_node);
                     for (uint32_t k = 0; k < inl_nc && iface_method_count < 63; k++) {
                         TSNode child = ts_node_named_child(type_node, k);
-                        if (ts_node_is_null(child)) continue;
-                        const char* ck = ts_node_type(child);
+                        if (ts_node_is_null(child))
+                            continue;
+                        const char *ck = ts_node_type(child);
                         // method_spec: MethodName(params) returns
                         if (strcmp(ck, "method_spec") == 0 || strcmp(ck, "method_elem") == 0) {
                             TSNode mname = ts_node_child_by_field_name(child, "name", 4);
                             if (!ts_node_is_null(mname)) {
-                                char* mn = cbm_node_text(arena, mname, source);
+                                char *mn = cbm_node_text(arena, mname, source);
                                 if (mn && mn[0]) {
                                     iface_methods[iface_method_count++] = mn;
                                 }
@@ -2281,9 +2491,10 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
                     if (iface_method_count > 0) {
                         for (int ti = 0; ti < reg.type_count; ti++) {
                             if (!reg.types[ti].qualified_name ||
-                                strcmp(reg.types[ti].qualified_name, type_qn) != 0) continue;
-                            const char** names = (const char**)cbm_arena_alloc(arena,
-                                (iface_method_count + 1) * sizeof(const char*));
+                                strcmp(reg.types[ti].qualified_name, type_qn) != 0)
+                                continue;
+                            const char **names = (const char **)cbm_arena_alloc(
+                                arena, (iface_method_count + 1) * sizeof(const char *));
                             for (int mi = 0; mi < iface_method_count; mi++) {
                                 names[mi] = iface_methods[mi];
                             }
@@ -2295,7 +2506,8 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
                     continue;
                 }
 
-                if (strcmp(ts_node_type(type_node), "struct_type") != 0) continue;
+                if (strcmp(ts_node_type(type_node), "struct_type") != 0)
+                    continue;
 
                 // Find field_declaration_list inside struct_type
                 TSNode field_list = ts_node_child_by_field_name(type_node, "body", 4);
@@ -2304,13 +2516,14 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
                     if (ts_node_named_child_count(type_node) > 0)
                         field_list = ts_node_named_child(type_node, 0);
                 }
-                if (ts_node_is_null(field_list)) continue;
+                if (ts_node_is_null(field_list))
+                    continue;
 
                 // Scan field_declarations for embeds and named fields
-                const char* embeds[16];
+                const char *embeds[16];
                 int embed_count = 0;
-                const char* fld_names[64];
-                const CBMType* fld_types[64];
+                const char *fld_names[64];
+                const CBMType *fld_types[64];
                 int fld_count = 0;
 
                 // Create a temporary LSP context for parsing field types
@@ -2325,8 +2538,10 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
                 uint32_t fl_nc = ts_node_child_count(field_list);
                 for (uint32_t k = 0; k < fl_nc; k++) {
                     TSNode field = ts_node_child(field_list, k);
-                    if (ts_node_is_null(field) || !ts_node_is_named(field)) continue;
-                    if (strcmp(ts_node_type(field), "field_declaration") != 0) continue;
+                    if (ts_node_is_null(field) || !ts_node_is_named(field))
+                        continue;
+                    if (strcmp(ts_node_type(field), "field_declaration") != 0)
+                        continue;
 
                     TSNode fname = ts_node_child_by_field_name(field, "name", 4);
                     TSNode ftype = ts_node_child_by_field_name(field, "type", 4);
@@ -2334,16 +2549,19 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
                     if (ts_node_is_null(fname) && !ts_node_is_null(ftype)) {
                         // Embedded field: has type but no name
                         if (embed_count < 15) {
-                            char* embed_text = cbm_node_text(arena, ftype, source);
+                            char *embed_text = cbm_node_text(arena, ftype, source);
                             if (embed_text && embed_text[0]) {
-                                const char* et = embed_text;
-                                while (*et == '*') et++;
-                                embeds[embed_count++] = cbm_arena_sprintf(arena, "%s.%s", module_qn, et);
+                                const char *et = embed_text;
+                                while (*et == '*')
+                                    et++;
+                                embeds[embed_count++] =
+                                    cbm_arena_sprintf(arena, "%s.%s", module_qn, et);
                             }
                         }
-                    } else if (!ts_node_is_null(fname) && !ts_node_is_null(ftype) && fld_count < 63) {
+                    } else if (!ts_node_is_null(fname) && !ts_node_is_null(ftype) &&
+                               fld_count < 63) {
                         // Named field: name + type
-                        char* fn = cbm_node_text(arena, fname, source);
+                        char *fn = cbm_node_text(arena, fname, source);
                         if (fn && fn[0]) {
                             fld_names[fld_count] = fn;
                             fld_types[fld_count] = go_parse_type_node(&tmp_ctx, ftype);
@@ -2355,20 +2573,22 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
                 // Find the registered type and update it
                 for (int ti = 0; ti < reg.type_count; ti++) {
                     if (!reg.types[ti].qualified_name ||
-                        strcmp(reg.types[ti].qualified_name, type_qn) != 0) continue;
+                        strcmp(reg.types[ti].qualified_name, type_qn) != 0)
+                        continue;
 
                     if (embed_count > 0) {
-                        const char** arr = (const char**)cbm_arena_alloc(arena,
-                            (embed_count + 1) * sizeof(const char*));
-                        for (int ei = 0; ei < embed_count; ei++) arr[ei] = embeds[ei];
+                        const char **arr = (const char **)cbm_arena_alloc(
+                            arena, (embed_count + 1) * sizeof(const char *));
+                        for (int ei = 0; ei < embed_count; ei++)
+                            arr[ei] = embeds[ei];
                         arr[embed_count] = NULL;
                         reg.types[ti].embedded_types = arr;
                     }
                     if (fld_count > 0) {
-                        const char** names = (const char**)cbm_arena_alloc(arena,
-                            (fld_count + 1) * sizeof(const char*));
-                        const CBMType** types = (const CBMType**)cbm_arena_alloc(arena,
-                            (fld_count + 1) * sizeof(const CBMType*));
+                        const char **names = (const char **)cbm_arena_alloc(
+                            arena, (fld_count + 1) * sizeof(const char *));
+                        const CBMType **types = (const CBMType **)cbm_arena_alloc(
+                            arena, (fld_count + 1) * sizeof(const CBMType *));
                         for (int fi = 0; fi < fld_count; fi++) {
                             names[fi] = fld_names[fi];
                             types[fi] = fld_types[fi];
@@ -2393,7 +2613,7 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
 
     // Add imports
     for (int i = 0; i < result->imports.count; i++) {
-        CBMImport* imp = &result->imports.items[i];
+        CBMImport *imp = &result->imports.items[i];
         if (imp->local_name && imp->module_path) {
             go_lsp_add_import(&lsp_ctx, imp->local_name, imp->module_path);
         }
@@ -2406,30 +2626,35 @@ void cbm_run_go_lsp(CBMArena* arena, CBMFileResult* result,
 // --- Cross-file LSP: parse source, build registry from defs, run LSP ---
 
 // Helper: split "|"-separated string into array of CBMType*.
-static const CBMType** split_pipe_types(CBMArena* a, const char* text, const char* module_qn) {
-    if (!text || !text[0]) return NULL;
+static const CBMType **split_pipe_types(CBMArena *a, const char *text, const char *module_qn) {
+    if (!text || !text[0])
+        return NULL;
 
     // Count separators
     int count = 1;
-    for (const char* p = text; *p; p++) {
-        if (*p == '|') count++;
+    for (const char *p = text; *p; p++) {
+        if (*p == '|')
+            count++;
     }
 
-    const CBMType** arr = (const CBMType**)cbm_arena_alloc(a, (count + 1) * sizeof(const CBMType*));
-    if (!arr) return NULL;
+    const CBMType **arr =
+        (const CBMType **)cbm_arena_alloc(a, (count + 1) * sizeof(const CBMType *));
+    if (!arr)
+        return NULL;
 
     // Split and parse each type
-    char* buf = cbm_arena_strdup(a, text);
+    char *buf = cbm_arena_strdup(a, text);
     int idx = 0;
-    char* start = buf;
-    for (char* p = buf; ; p++) {
+    char *start = buf;
+    for (char *p = buf;; p++) {
         if (*p == '|' || *p == '\0') {
             char save = *p;
             *p = '\0';
             if (start[0]) {
                 arr[idx++] = cbm_parse_return_type_text(a, start, module_qn);
             }
-            if (save == '\0') break;
+            if (save == '\0')
+                break;
             start = p + 1;
         }
     }
@@ -2438,28 +2663,32 @@ static const CBMType** split_pipe_types(CBMArena* a, const char* text, const cha
 }
 
 // Helper: split "|"-separated string into array of const char*.
-static const char** split_pipe_strings(CBMArena* a, const char* text) {
-    if (!text || !text[0]) return NULL;
+static const char **split_pipe_strings(CBMArena *a, const char *text) {
+    if (!text || !text[0])
+        return NULL;
 
     int count = 1;
-    for (const char* p = text; *p; p++) {
-        if (*p == '|') count++;
+    for (const char *p = text; *p; p++) {
+        if (*p == '|')
+            count++;
     }
 
-    const char** arr = (const char**)cbm_arena_alloc(a, (count + 1) * sizeof(const char*));
-    if (!arr) return NULL;
+    const char **arr = (const char **)cbm_arena_alloc(a, (count + 1) * sizeof(const char *));
+    if (!arr)
+        return NULL;
 
-    char* buf = cbm_arena_strdup(a, text);
+    char *buf = cbm_arena_strdup(a, text);
     int idx = 0;
-    char* start = buf;
-    for (char* p = buf; ; p++) {
+    char *start = buf;
+    for (char *p = buf;; p++) {
         if (*p == '|' || *p == '\0') {
             char save = *p;
             *p = '\0';
             if (start[0]) {
                 arr[idx++] = cbm_arena_strdup(a, start);
             }
-            if (save == '\0') break;
+            if (save == '\0')
+                break;
             start = p + 1;
         }
     }
@@ -2470,32 +2699,40 @@ static const char** split_pipe_strings(CBMArena* a, const char* text) {
 // Helper: parse "|"-separated "name:type" field definitions and populate a registered type.
 // Format: "Binder:Binder|Name:string|Count:int"
 // type_text is resolved relative to def_module_qn.
-static void parse_field_defs_into_type(CBMArena* arena, CBMTypeRegistry* reg,
-    const char* type_qn, const char* field_defs, const char* def_module_qn) {
-    if (!field_defs || !field_defs[0] || !type_qn) return;
+/* Parse "name:type|name:type" into NULL-terminated name/type arrays. False when
+ * nothing parsed (or on allocation failure): the type keeps no field info. */
+static bool parse_field_defs(CBMArena *arena, const char *field_defs, const char *def_module_qn,
+                             const char ***names_out, const CBMType ***types_out) {
 
     // Count fields
     int count = 1;
-    for (const char* p = field_defs; *p; p++) {
-        if (*p == '|') count++;
+    for (const char *p = field_defs; *p; p++) {
+        if (*p == '|')
+            count++;
     }
-    if (count > 63) count = 63;
+    if (count > 63)
+        count = 63;
 
-    const char** names = (const char**)cbm_arena_alloc(arena, (count + 1) * sizeof(const char*));
-    const CBMType** types = (const CBMType**)cbm_arena_alloc(arena, (count + 1) * sizeof(const CBMType*));
-    if (!names || !types) return;
+    const char **names = (const char **)cbm_arena_alloc(arena, (count + 1) * sizeof(const char *));
+    const CBMType **types =
+        (const CBMType **)cbm_arena_alloc(arena, (count + 1) * sizeof(const CBMType *));
+    if (!names || !types)
+        return false;
 
-    char* buf = cbm_arena_strdup(arena, field_defs);
+    char *buf = cbm_arena_strdup(arena, field_defs);
     int idx = 0;
-    char* start = buf;
-    for (char* p = buf; ; p++) {
+    char *start = buf;
+    for (char *p = buf;; p++) {
         if (*p == '|' || *p == '\0') {
             char save = *p;
             *p = '\0';
             // Parse "name:type"
-            char* colon = NULL;
-            for (char* q = start; *q; q++) {
-                if (*q == ':') { colon = q; break; }
+            char *colon = NULL;
+            for (char *q = start; *q; q++) {
+                if (*q == ':') {
+                    colon = q;
+                    break;
+                }
             }
             if (colon && idx < count) {
                 *colon = '\0';
@@ -2503,14 +2740,25 @@ static void parse_field_defs_into_type(CBMArena* arena, CBMTypeRegistry* reg,
                 types[idx] = cbm_parse_return_type_text(arena, colon + 1, def_module_qn);
                 idx++;
             }
-            if (save == '\0') break;
+            if (save == '\0')
+                break;
             start = p + 1;
         }
     }
     names[idx] = NULL;
     types[idx] = NULL;
+    *names_out = names;
+    *types_out = types;
+    return idx > 0;
+}
 
-    if (idx > 0) {
+static void parse_field_defs_into_type(CBMArena *arena, CBMTypeRegistry *reg, const char *type_qn,
+                                       const char *field_defs, const char *def_module_qn) {
+    if (!field_defs || !field_defs[0] || !type_qn)
+        return;
+    const char **names = NULL;
+    const CBMType **types = NULL;
+    if (parse_field_defs(arena, field_defs, def_module_qn, &names, &types)) {
         // Find the registered type and update field info
         for (int ti = 0; ti < reg->type_count; ti++) {
             if (reg->types[ti].qualified_name &&
@@ -2528,16 +2776,19 @@ static void parse_field_defs_into_type(CBMArena* arena, CBMTypeRegistry* reg,
 // Helper: parse a tree-sitter type AST node with type param awareness.
 // Like go_parse_type_node but checks type_identifier against type_param_names first,
 // and works without a full GoLSPContext (uses raw arena/source/module_qn).
-static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
-    const char* source, const char* module_qn, const char** type_param_names) {
-    if (ts_node_is_null(node)) return cbm_type_unknown();
+static const CBMType *parse_type_node_with_params(CBMArena *arena, TSNode node, const char *source,
+                                                  const char *module_qn,
+                                                  const char **type_param_names) {
+    if (ts_node_is_null(node))
+        return cbm_type_unknown();
 
-    const char* kind = ts_node_type(node);
+    const char *kind = ts_node_type(node);
 
     // type_identifier: check type params first, then resolve as named type
     if (strcmp(kind, "type_identifier") == 0) {
-        char* name = cbm_node_text(arena, node, source);
-        if (!name) return cbm_type_unknown();
+        char *name = cbm_node_text(arena, node, source);
+        if (!name)
+            return cbm_type_unknown();
         // Check type param names
         if (type_param_names) {
             for (int i = 0; type_param_names[i]; i++) {
@@ -2547,13 +2798,11 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
             }
         }
         // Builtin types
-        if (strcmp(name, "int") == 0 || strcmp(name, "string") == 0 ||
-            strcmp(name, "bool") == 0 || strcmp(name, "float64") == 0 ||
-            strcmp(name, "float32") == 0 || strcmp(name, "byte") == 0 ||
-            strcmp(name, "rune") == 0 || strcmp(name, "error") == 0 ||
-            strcmp(name, "any") == 0 || strcmp(name, "int8") == 0 ||
-            strcmp(name, "int16") == 0 || strcmp(name, "int32") == 0 ||
-            strcmp(name, "int64") == 0 || strcmp(name, "uint") == 0 ||
+        if (strcmp(name, "int") == 0 || strcmp(name, "string") == 0 || strcmp(name, "bool") == 0 ||
+            strcmp(name, "float64") == 0 || strcmp(name, "float32") == 0 ||
+            strcmp(name, "byte") == 0 || strcmp(name, "rune") == 0 || strcmp(name, "error") == 0 ||
+            strcmp(name, "any") == 0 || strcmp(name, "int8") == 0 || strcmp(name, "int16") == 0 ||
+            strcmp(name, "int32") == 0 || strcmp(name, "int64") == 0 || strcmp(name, "uint") == 0 ||
             strcmp(name, "uint8") == 0 || strcmp(name, "uint16") == 0 ||
             strcmp(name, "uint32") == 0 || strcmp(name, "uint64") == 0 ||
             strcmp(name, "uintptr") == 0) {
@@ -2564,8 +2813,8 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
 
     // type_elem: wrapper in type_arguments
     if (strcmp(kind, "type_elem") == 0 && ts_node_named_child_count(node) > 0) {
-        return parse_type_node_with_params(arena, ts_node_named_child(node, 0),
-            source, module_qn, type_param_names);
+        return parse_type_node_with_params(arena, ts_node_named_child(node, 0), source, module_qn,
+                                           type_param_names);
     }
 
     // qualified_type: pkg.Type
@@ -2573,8 +2822,8 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
         TSNode pkg_node = ts_node_child_by_field_name(node, "package", 7);
         TSNode name_node = ts_node_child_by_field_name(node, "name", 4);
         if (!ts_node_is_null(pkg_node) && !ts_node_is_null(name_node)) {
-            char* pkg = cbm_node_text(arena, pkg_node, source);
-            char* name = cbm_node_text(arena, name_node, source);
+            char *pkg = cbm_node_text(arena, pkg_node, source);
+            char *name = cbm_node_text(arena, name_node, source);
             if (pkg && name) {
                 return cbm_type_named(arena, cbm_arena_sprintf(arena, "%s.%s", pkg, name));
             }
@@ -2586,8 +2835,9 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
     if (strcmp(kind, "pointer_type") == 0) {
         uint32_t nc = ts_node_named_child_count(node);
         if (nc > 0)
-            return cbm_type_pointer(arena, parse_type_node_with_params(arena,
-                ts_node_named_child(node, nc - 1), source, module_qn, type_param_names));
+            return cbm_type_pointer(
+                arena, parse_type_node_with_params(arena, ts_node_named_child(node, nc - 1), source,
+                                                   module_qn, type_param_names));
         return cbm_type_unknown();
     }
 
@@ -2596,8 +2846,8 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
         TSNode elem = ts_node_child_by_field_name(node, "element", 7);
         if (ts_node_is_null(elem) && ts_node_named_child_count(node) > 0)
             elem = ts_node_named_child(node, ts_node_named_child_count(node) - 1);
-        return cbm_type_slice(arena, parse_type_node_with_params(arena,
-            elem, source, module_qn, type_param_names));
+        return cbm_type_slice(
+            arena, parse_type_node_with_params(arena, elem, source, module_qn, type_param_names));
     }
 
     // array_type: [N]T
@@ -2605,16 +2855,16 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
         TSNode elem = ts_node_child_by_field_name(node, "element", 7);
         if (ts_node_is_null(elem) && ts_node_named_child_count(node) > 0)
             elem = ts_node_named_child(node, ts_node_named_child_count(node) - 1);
-        return cbm_type_slice(arena, parse_type_node_with_params(arena,
-            elem, source, module_qn, type_param_names));
+        return cbm_type_slice(
+            arena, parse_type_node_with_params(arena, elem, source, module_qn, type_param_names));
     }
 
     // map_type: map[K]V
     if (strcmp(kind, "map_type") == 0) {
         TSNode key = ts_node_child_by_field_name(node, "key", 3);
         TSNode value = ts_node_child_by_field_name(node, "value", 5);
-        return cbm_type_map(arena,
-            parse_type_node_with_params(arena, key, source, module_qn, type_param_names),
+        return cbm_type_map(
+            arena, parse_type_node_with_params(arena, key, source, module_qn, type_param_names),
             parse_type_node_with_params(arena, value, source, module_qn, type_param_names));
     }
 
@@ -2623,14 +2873,17 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
         TSNode value = ts_node_child_by_field_name(node, "value", 5);
         if (ts_node_is_null(value) && ts_node_named_child_count(node) > 0)
             value = ts_node_named_child(node, ts_node_named_child_count(node) - 1);
-        char* text = cbm_node_text(arena, node, source);
+        char *text = cbm_node_text(arena, node, source);
         int dir = 0;
         if (text) {
-            if (strncmp(text, "chan<-", 6) == 0 || strncmp(text, "chan <-", 7) == 0) dir = 1;
-            else if (strncmp(text, "<-chan", 6) == 0 || strncmp(text, "<- chan", 7) == 0) dir = 2;
+            if (strncmp(text, "chan<-", 6) == 0 || strncmp(text, "chan <-", 7) == 0)
+                dir = 1;
+            else if (strncmp(text, "<-chan", 6) == 0 || strncmp(text, "<- chan", 7) == 0)
+                dir = 2;
         }
-        return cbm_type_channel(arena, parse_type_node_with_params(arena,
-            value, source, module_qn, type_param_names), dir);
+        return cbm_type_channel(
+            arena, parse_type_node_with_params(arena, value, source, module_qn, type_param_names),
+            dir);
     }
 
     // function_type: func(T) R — full parsing with type param awareness
@@ -2638,51 +2891,54 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
         TSNode params_node = ts_node_child_by_field_name(node, "parameters", 10);
         TSNode result_node = ts_node_child_by_field_name(node, "result", 6);
 
-        const CBMType* param_types_arr[16];
+        const CBMType *param_types_arr[16];
         int pc = 0;
         if (!ts_node_is_null(params_node)) {
             uint32_t pnc = ts_node_child_count(params_node);
             for (uint32_t i = 0; i < pnc && pc < 15; i++) {
                 TSNode child = ts_node_child(params_node, i);
-                if (ts_node_is_null(child) || !ts_node_is_named(child)) continue;
+                if (ts_node_is_null(child) || !ts_node_is_named(child))
+                    continue;
                 if (strcmp(ts_node_type(child), "parameter_declaration") == 0) {
                     TSNode pt = ts_node_child_by_field_name(child, "type", 4);
                     if (!ts_node_is_null(pt))
-                        param_types_arr[pc++] = parse_type_node_with_params(arena,
-                            pt, source, module_qn, type_param_names);
+                        param_types_arr[pc++] = parse_type_node_with_params(
+                            arena, pt, source, module_qn, type_param_names);
                 }
             }
         }
         param_types_arr[pc] = NULL;
 
-        const CBMType* ret_types_arr[16];
+        const CBMType *ret_types_arr[16];
         int rc = 0;
         if (!ts_node_is_null(result_node)) {
             if (strcmp(ts_node_type(result_node), "parameter_list") == 0) {
                 uint32_t rnc = ts_node_child_count(result_node);
                 for (uint32_t i = 0; i < rnc && rc < 15; i++) {
                     TSNode child = ts_node_child(result_node, i);
-                    if (ts_node_is_null(child) || !ts_node_is_named(child)) continue;
+                    if (ts_node_is_null(child) || !ts_node_is_named(child))
+                        continue;
                     TSNode rt = ts_node_child_by_field_name(child, "type", 4);
-                    if (ts_node_is_null(rt)) rt = child;
-                    ret_types_arr[rc++] = parse_type_node_with_params(arena,
-                        rt, source, module_qn, type_param_names);
+                    if (ts_node_is_null(rt))
+                        rt = child;
+                    ret_types_arr[rc++] =
+                        parse_type_node_with_params(arena, rt, source, module_qn, type_param_names);
                 }
             } else {
-                ret_types_arr[rc++] = parse_type_node_with_params(arena,
-                    result_node, source, module_qn, type_param_names);
+                ret_types_arr[rc++] = parse_type_node_with_params(arena, result_node, source,
+                                                                  module_qn, type_param_names);
             }
         }
         ret_types_arr[rc] = NULL;
 
-        const CBMType** pt = pc > 0 ? (const CBMType**)param_types_arr : NULL;
-        const CBMType** rt = rc > 0 ? (const CBMType**)ret_types_arr : NULL;
+        const CBMType **pt = pc > 0 ? (const CBMType **)param_types_arr : NULL;
+        const CBMType **rt = rc > 0 ? (const CBMType **)ret_types_arr : NULL;
         return cbm_type_func(arena, NULL, pt, rt);
     }
 
     // interface_type
     if (strcmp(kind, "interface_type") == 0) {
-        CBMType* t = (CBMType*)cbm_arena_alloc(arena, sizeof(CBMType));
+        CBMType *t = (CBMType *)cbm_arena_alloc(arena, sizeof(CBMType));
         memset(t, 0, sizeof(CBMType));
         t->kind = CBM_TYPE_INTERFACE;
         return t;
@@ -2690,15 +2946,16 @@ static const CBMType* parse_type_node_with_params(CBMArena* arena, TSNode node,
 
     // parenthesized_type: (T)
     if (strcmp(kind, "parenthesized_type") == 0 && ts_node_named_child_count(node) > 0) {
-        return parse_type_node_with_params(arena, ts_node_named_child(node, 0),
-            source, module_qn, type_param_names);
+        return parse_type_node_with_params(arena, ts_node_named_child(node, 0), source, module_qn,
+                                           type_param_names);
     }
 
     // generic_type: Type[T1, T2]
     if (strcmp(kind, "generic_type") == 0) {
         TSNode type_node = ts_node_child_by_field_name(node, "type", 4);
         if (!ts_node_is_null(type_node))
-            return parse_type_node_with_params(arena, type_node, source, module_qn, type_param_names);
+            return parse_type_node_with_params(arena, type_node, source, module_qn,
+                                               type_param_names);
     }
 
     return cbm_type_unknown();
@@ -2742,34 +2999,40 @@ static const CBMType *cbm_go_lsp_keep_known_refinement(const CBMType *candidate,
 
 // Scan AST for generic function declarations and set type_param_names + re-parse
 // return types on matching registered functions.
-static void extract_type_params_from_ast(CBMArena* arena, CBMTypeRegistry* reg,
-    TSNode root, const char* source, const char* module_qn) {
+static void extract_type_params_from_ast(CBMArena *arena, CBMTypeRegistry *reg, TSNode root,
+                                         const char *source, const char *module_qn) {
 
     // Collect top-level children once (O(n)); ts_node_child(root,i) is O(i) → O(n²).
     uint32_t rkn = 0;
-    TSNode* rkids = cbm_lsp_collect_children(arena, root, &rkn);
+    TSNode *rkids = cbm_lsp_collect_children(arena, root, &rkn);
     for (uint32_t i = 0; i < rkn; i++) {
         TSNode top = rkids[i];
-        if (strcmp(ts_node_type(top), "function_declaration") != 0) continue;
+        if (strcmp(ts_node_type(top), "function_declaration") != 0)
+            continue;
 
         // Check for type_parameter_list (field name: "type_parameters", 15 chars)
         TSNode tp_list = ts_node_child_by_field_name(top, "type_parameters", 15);
-        if (ts_node_is_null(tp_list)) continue;
+        if (ts_node_is_null(tp_list))
+            continue;
 
         // Get function name
         TSNode name_node = ts_node_child_by_field_name(top, "name", 4);
-        if (ts_node_is_null(name_node)) continue;
-        char* func_name = cbm_node_text(arena, name_node, source);
-        if (!func_name || !func_name[0]) continue;
+        if (ts_node_is_null(name_node))
+            continue;
+        char *func_name = cbm_node_text(arena, name_node, source);
+        if (!func_name || !func_name[0])
+            continue;
 
         // Extract type param names from type_parameter_declaration children
-        const char* params[16];
+        const char *params[16];
         int param_count = 0;
         uint32_t tp_nc = ts_node_child_count(tp_list);
         for (uint32_t j = 0; j < tp_nc && param_count < 15; j++) {
             TSNode child = ts_node_child(tp_list, j);
-            if (ts_node_is_null(child) || !ts_node_is_named(child)) continue;
-            if (strcmp(ts_node_type(child), "type_parameter_declaration") != 0) continue;
+            if (ts_node_is_null(child) || !ts_node_is_named(child))
+                continue;
+            if (strcmp(ts_node_type(child), "type_parameter_declaration") != 0)
+                continue;
             TSNode pname = ts_node_child_by_field_name(child, "name", 4);
             if (ts_node_is_null(pname)) {
                 // Fallback: first type_identifier child
@@ -2784,21 +3047,24 @@ static void extract_type_params_from_ast(CBMArena* arena, CBMTypeRegistry* reg,
                 }
             }
             if (!ts_node_is_null(pname)) {
-                char* pn = cbm_node_text(arena, pname, source);
+                char *pn = cbm_node_text(arena, pname, source);
                 if (pn && pn[0]) {
                     params[param_count++] = cbm_arena_strdup(arena, pn);
                 }
             }
         }
-        if (param_count == 0) continue;
+        if (param_count == 0)
+            continue;
         params[param_count] = NULL;
 
         // Build arena-allocated type_param_names array
-        const char** tp_names = (const char**)cbm_arena_alloc(arena, (param_count + 1) * sizeof(const char*));
-        for (int j = 0; j <= param_count; j++) tp_names[j] = params[j];
+        const char **tp_names =
+            (const char **)cbm_arena_alloc(arena, (param_count + 1) * sizeof(const char *));
+        for (int j = 0; j <= param_count; j++)
+            tp_names[j] = params[j];
 
         // Find the matching registered function and set type_param_names
-        const char* func_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, func_name);
+        const char *func_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, func_name);
         for (int fi = 0; fi < reg->func_count; fi++) {
             if (reg->funcs[fi].qualified_name &&
                 strcmp(reg->funcs[fi].qualified_name, func_qn) == 0) {
@@ -2807,23 +3073,24 @@ static void extract_type_params_from_ast(CBMArena* arena, CBMTypeRegistry* reg,
                 // Re-parse return types with type param awareness
                 if (reg->funcs[fi].signature && reg->funcs[fi].signature->kind == CBM_TYPE_FUNC &&
                     reg->funcs[fi].signature->data.func.return_types) {
-                    const CBMType** old_rets = reg->funcs[fi].signature->data.func.return_types;
+                    const CBMType **old_rets = reg->funcs[fi].signature->data.func.return_types;
                     int ret_count = 0;
-                    while (old_rets[ret_count]) ret_count++;
+                    while (old_rets[ret_count])
+                        ret_count++;
 
                     // Check if any return type is a NAMED that matches a type param
                     bool needs_reparse = false;
                     for (int ri = 0; ri < ret_count && !needs_reparse; ri++) {
-                        const CBMType* check = old_rets[ri];
+                        const CBMType *check = old_rets[ri];
                         // Unwrap slice/pointer to get inner named type
                         if (check->kind == CBM_TYPE_SLICE && check->data.slice.elem)
                             check = check->data.slice.elem;
                         else if (check->kind == CBM_TYPE_POINTER && check->data.pointer.elem)
                             check = check->data.pointer.elem;
                         if (check->kind == CBM_TYPE_NAMED) {
-                            const char* qn = check->data.named.qualified_name;
-                            const char* dot = strrchr(qn, '.');
-                            const char* short_name = dot ? dot + 1 : qn;
+                            const char *qn = check->data.named.qualified_name;
+                            const char *dot = strrchr(qn, '.');
+                            const char *short_name = dot ? dot + 1 : qn;
                             for (int pi = 0; pi < param_count; pi++) {
                                 if (strcmp(short_name, tp_names[pi]) == 0) {
                                     needs_reparse = true;
@@ -2836,17 +3103,19 @@ static void extract_type_params_from_ast(CBMArena* arena, CBMTypeRegistry* reg,
                     if (needs_reparse) {
                         TSNode result_node = ts_node_child_by_field_name(top, "result", 6);
                         if (!ts_node_is_null(result_node)) {
-                            const CBMType** new_rets = (const CBMType**)cbm_arena_alloc(arena,
-                                (ret_count + 1) * sizeof(const CBMType*));
+                            const CBMType **new_rets = (const CBMType **)cbm_arena_alloc(
+                                arena, (ret_count + 1) * sizeof(const CBMType *));
 
                             if (strcmp(ts_node_type(result_node), "parameter_list") == 0) {
                                 int idx = 0;
                                 uint32_t rnc = ts_node_child_count(result_node);
                                 for (uint32_t ri = 0; ri < rnc && idx < ret_count; ri++) {
                                     TSNode rchild = ts_node_child(result_node, ri);
-                                    if (ts_node_is_null(rchild) || !ts_node_is_named(rchild)) continue;
+                                    if (ts_node_is_null(rchild) || !ts_node_is_named(rchild))
+                                        continue;
                                     TSNode rtype = ts_node_child_by_field_name(rchild, "type", 4);
-                                    if (ts_node_is_null(rtype)) rtype = rchild;
+                                    if (ts_node_is_null(rtype))
+                                        rtype = rchild;
                                     const CBMType *parsed = parse_type_node_with_params(
                                         arena, rtype, source, module_qn, tp_names);
                                     new_rets[idx] =
@@ -2880,20 +3149,22 @@ static void extract_type_params_from_ast(CBMArena* arena, CBMTypeRegistry* reg,
                 // Also re-parse param types with TYPE_PARAM awareness (for implicit generics)
                 if (reg->funcs[fi].signature && reg->funcs[fi].signature->kind == CBM_TYPE_FUNC &&
                     reg->funcs[fi].signature->data.func.param_types) {
-                    const CBMType** old_params = reg->funcs[fi].signature->data.func.param_types;
+                    const CBMType **old_params = reg->funcs[fi].signature->data.func.param_types;
                     int pc = 0;
-                    while (old_params[pc]) pc++;
+                    while (old_params[pc])
+                        pc++;
                     // Re-parse from AST parameter list
                     TSNode params_node = ts_node_child_by_field_name(top, "parameters", 10);
                     if (!ts_node_is_null(params_node)) {
-                        const CBMType** new_params = (const CBMType**)cbm_arena_alloc(arena,
-                            (pc + 1) * sizeof(const CBMType*));
+                        const CBMType **new_params = (const CBMType **)cbm_arena_alloc(
+                            arena, (pc + 1) * sizeof(const CBMType *));
                         int idx = 0;
                         bool overflow = false;
                         uint32_t pnc = ts_node_child_count(params_node);
                         for (uint32_t pi = 0; pi < pnc && !overflow; pi++) {
                             TSNode pchild = ts_node_child(params_node, pi);
-                            if (ts_node_is_null(pchild) || !ts_node_is_named(pchild)) continue;
+                            if (ts_node_is_null(pchild) || !ts_node_is_named(pchild))
+                                continue;
                             const char *param_kind = ts_node_type(pchild);
                             if (strcmp(param_kind, "parameter_declaration") != 0 &&
                                 strcmp(param_kind, "variadic_parameter_declaration") != 0) {
@@ -2935,37 +3206,37 @@ static void extract_type_params_from_ast(CBMArena* arena, CBMTypeRegistry* reg,
 }
 
 // Forward: tree-sitter Go language (from lang_specs.c)
-extern const TSLanguage* tree_sitter_go(void);
+extern const TSLanguage *tree_sitter_go(void);
 
-void cbm_run_go_lsp_cross(
-    CBMArena* arena,
-    const char* source, int source_len,
-    const char* module_qn,
-    CBMLSPDef* defs, int def_count,
-    const char** import_names, const char** import_qns, int import_count,
-    TSTree* cached_tree,
-    CBMResolvedCallArray* out)
-{
-    if (!source || source_len <= 0) return;
+void cbm_run_go_lsp_cross(CBMArena *arena, const char *source, int source_len,
+                          const char *module_qn, CBMLSPDef *defs, int def_count,
+                          const char **import_names, const char **import_qns, int import_count,
+                          TSTree *cached_tree, CBMResolvedCallArray *out) {
+    if (!source || source_len <= 0)
+        return;
 
     // 1. Use cached tree if available, otherwise parse fresh
-    TSParser* parser = NULL;
-    TSTree* tree = cached_tree;
+    TSParser *parser = NULL;
+    TSTree *tree = cached_tree;
     bool owns_tree = false;
     if (!tree) {
         parser = ts_parser_new();
-        if (!parser) return;
+        if (!parser)
+            return;
         ts_parser_set_language(parser, tree_sitter_go());
         tree = ts_parser_parse_string(parser, NULL, source, source_len);
         owns_tree = true;
-        if (!tree) { ts_parser_delete(parser); return; }
+        if (!tree) {
+            ts_parser_delete(parser);
+            return;
+        }
     }
     TSNode root = ts_tree_root_node(tree);
 
-    // 2. Build registry
+    // 2. Build registry (the stdlib is the shared sealed registry, chained)
     CBMTypeRegistry reg;
     cbm_registry_init(&reg, arena);
-    cbm_go_stdlib_register(&reg, arena);
+    go_registry_with_stdlib(&reg, arena);
 
     // Register all defs (file-local + cross-file).
     // Perf: borrow strings from defs[] directly — they live in the
@@ -2973,18 +3244,19 @@ void cbm_run_go_lsp_cross(
     // wasted work. On kubernetes (~110k defs × 11k files × 5 strdups
     // ~= 6B mallocs) this alone saves ~90s of resolve wall time.
     for (int i = 0; i < def_count; i++) {
-        CBMLSPDef* d = &defs[i];
-        if (!d->qualified_name || !d->short_name || !d->label) continue;
+        CBMLSPDef *d = &defs[i];
+        if (!d->qualified_name || !d->short_name || !d->label)
+            continue;
 
-        const char* def_mod = d->def_module_qn ? d->def_module_qn : module_qn;
+        const char *def_mod = d->def_module_qn ? d->def_module_qn : module_qn;
 
         // Every type-like container (Type/Class/Struct/Interface/Enum/Trait).
         // Struct included so Go structs (now labelled "Struct") register as types.
         if (cbm_label_is_type_like(d->label)) {
             CBMRegisteredType rt;
             memset(&rt, 0, sizeof(rt));
-            rt.qualified_name = d->qualified_name;  // borrowed
-            rt.short_name = d->short_name;          // borrowed
+            rt.qualified_name = d->qualified_name; // borrowed
+            rt.short_name = d->short_name;         // borrowed
             rt.is_interface = d->is_interface || strcmp(d->label, "Interface") == 0;
             rt.embedded_types = split_pipe_strings(arena, d->embedded_types);
 
@@ -3005,11 +3277,11 @@ void cbm_run_go_lsp_cross(
         if (strcmp(d->label, "Function") == 0 || strcmp(d->label, "Method") == 0) {
             CBMRegisteredFunc rf;
             memset(&rf, 0, sizeof(rf));
-            rf.qualified_name = d->qualified_name;  // borrowed
-            rf.short_name = d->short_name;          // borrowed
+            rf.qualified_name = d->qualified_name; // borrowed
+            rf.short_name = d->short_name;         // borrowed
 
             // Build FUNC type from return_types text
-            const CBMType** ret_types = split_pipe_types(arena, d->return_types, def_mod);
+            const CBMType **ret_types = split_pipe_types(arena, d->return_types, def_mod);
             CBMGoLSPSignatureParserContext param_parser_ctx = {def_mod};
             const CBMType **param_types = cbm_type_materialize_signature_params(
                 arena, d->signature_param_types, d->signature_param_count,
@@ -3018,14 +3290,14 @@ void cbm_run_go_lsp_cross(
 
             // Method receiver
             if (strcmp(d->label, "Method") == 0 && d->receiver_type && d->receiver_type[0]) {
-                rf.receiver_type = d->receiver_type;  // borrowed
+                rf.receiver_type = d->receiver_type; // borrowed
                 // Auto-create type entry if not exists
                 if (!cbm_registry_lookup_type(&reg, rf.receiver_type)) {
                     CBMRegisteredType auto_type;
                     memset(&auto_type, 0, sizeof(auto_type));
                     auto_type.qualified_name = rf.receiver_type;
-                    const char* dot = strrchr(d->receiver_type, '.');
-                    auto_type.short_name = dot ? dot + 1 : rf.receiver_type;  // borrowed substring
+                    const char *dot = strrchr(d->receiver_type, '.');
+                    auto_type.short_name = dot ? dot + 1 : rf.receiver_type; // borrowed substring
                     cbm_registry_add_type(&reg, auto_type);
                 }
             }
@@ -3038,26 +3310,30 @@ void cbm_run_go_lsp_cross(
     {
         // Collect top-level children once (O(n)); ts_node_child(root,i) is O(i) → O(n²).
         uint32_t rkn = 0;
-        TSNode* rkids = cbm_lsp_collect_children(arena, root, &rkn);
+        TSNode *rkids = cbm_lsp_collect_children(arena, root, &rkn);
         for (uint32_t i = 0; i < rkn; i++) {
             TSNode top = rkids[i];
-            if (strcmp(ts_node_type(top), "type_declaration") != 0) continue;
+            if (strcmp(ts_node_type(top), "type_declaration") != 0)
+                continue;
             uint32_t td_nc = ts_node_child_count(top);
             for (uint32_t j = 0; j < td_nc; j++) {
                 TSNode spec = ts_node_child(top, j);
-                if (ts_node_is_null(spec) || !ts_node_is_named(spec)) continue;
-                const char* spec_kind2 = ts_node_type(spec);
+                if (ts_node_is_null(spec) || !ts_node_is_named(spec))
+                    continue;
+                const char *spec_kind2 = ts_node_type(spec);
 
                 // type_alias: type Foo = Bar
                 if (strcmp(spec_kind2, "type_alias") == 0) {
                     TSNode alias_name = ts_node_child_by_field_name(spec, "name", 4);
                     TSNode alias_type = ts_node_child_by_field_name(spec, "type", 4);
                     if (!ts_node_is_null(alias_name) && !ts_node_is_null(alias_type)) {
-                        char* aname = cbm_node_text(arena, alias_name, source);
-                        char* atarget = cbm_node_text(arena, alias_type, source);
+                        char *aname = cbm_node_text(arena, alias_name, source);
+                        char *atarget = cbm_node_text(arena, alias_type, source);
                         if (aname && aname[0] && atarget && atarget[0]) {
-                            const char* alias_type_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, aname);
-                            const char* alias_target_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, atarget);
+                            const char *alias_type_qn =
+                                cbm_arena_sprintf(arena, "%s.%s", module_qn, aname);
+                            const char *alias_target_qn =
+                                cbm_arena_sprintf(arena, "%s.%s", module_qn, atarget);
                             bool found_a = false;
                             for (int ti = 0; ti < reg.type_count; ti++) {
                                 if (reg.types[ti].qualified_name &&
@@ -3080,28 +3356,33 @@ void cbm_run_go_lsp_cross(
                     continue;
                 }
 
-                if (strcmp(spec_kind2, "type_spec") != 0) continue;
+                if (strcmp(spec_kind2, "type_spec") != 0)
+                    continue;
 
                 TSNode name_node = ts_node_child_by_field_name(spec, "name", 4);
                 TSNode type_node = ts_node_child_by_field_name(spec, "type", 4);
-                if (ts_node_is_null(name_node) || ts_node_is_null(type_node)) continue;
-                if (strcmp(ts_node_type(type_node), "struct_type") != 0) continue;
+                if (ts_node_is_null(name_node) || ts_node_is_null(type_node))
+                    continue;
+                if (strcmp(ts_node_type(type_node), "struct_type") != 0)
+                    continue;
 
-                char* type_name = cbm_node_text(arena, name_node, source);
-                if (!type_name || !type_name[0]) continue;
-                const char* type_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, type_name);
+                char *type_name = cbm_node_text(arena, name_node, source);
+                if (!type_name || !type_name[0])
+                    continue;
+                const char *type_qn = cbm_arena_sprintf(arena, "%s.%s", module_qn, type_name);
 
                 TSNode field_list = ts_node_child_by_field_name(type_node, "body", 4);
                 if (ts_node_is_null(field_list)) {
                     if (ts_node_named_child_count(type_node) > 0)
                         field_list = ts_node_named_child(type_node, 0);
                 }
-                if (ts_node_is_null(field_list)) continue;
+                if (ts_node_is_null(field_list))
+                    continue;
 
-                const char* embeds[16];
+                const char *embeds[16];
                 int embed_count = 0;
-                const char* fld_names[64];
-                const CBMType* fld_types[64];
+                const char *fld_names[64];
+                const CBMType *fld_types[64];
                 int fld_count = 0;
 
                 GoLSPContext tmp_ctx;
@@ -3118,21 +3399,26 @@ void cbm_run_go_lsp_cross(
                 uint32_t fl_nc = ts_node_child_count(field_list);
                 for (uint32_t k = 0; k < fl_nc; k++) {
                     TSNode field = ts_node_child(field_list, k);
-                    if (ts_node_is_null(field) || !ts_node_is_named(field)) continue;
-                    if (strcmp(ts_node_type(field), "field_declaration") != 0) continue;
+                    if (ts_node_is_null(field) || !ts_node_is_named(field))
+                        continue;
+                    if (strcmp(ts_node_type(field), "field_declaration") != 0)
+                        continue;
                     TSNode fname = ts_node_child_by_field_name(field, "name", 4);
                     TSNode ftype = ts_node_child_by_field_name(field, "type", 4);
                     if (ts_node_is_null(fname) && !ts_node_is_null(ftype)) {
                         if (embed_count < 15) {
-                            char* embed_text = cbm_node_text(arena, ftype, source);
+                            char *embed_text = cbm_node_text(arena, ftype, source);
                             if (embed_text && embed_text[0]) {
-                                const char* et = embed_text;
-                                while (*et == '*') et++;
-                                embeds[embed_count++] = cbm_arena_sprintf(arena, "%s.%s", module_qn, et);
+                                const char *et = embed_text;
+                                while (*et == '*')
+                                    et++;
+                                embeds[embed_count++] =
+                                    cbm_arena_sprintf(arena, "%s.%s", module_qn, et);
                             }
                         }
-                    } else if (!ts_node_is_null(fname) && !ts_node_is_null(ftype) && fld_count < 63) {
-                        char* fn = cbm_node_text(arena, fname, source);
+                    } else if (!ts_node_is_null(fname) && !ts_node_is_null(ftype) &&
+                               fld_count < 63) {
+                        char *fn = cbm_node_text(arena, fname, source);
                         if (fn && fn[0]) {
                             fld_names[fld_count] = fn;
                             fld_types[fld_count] = go_parse_type_node(&tmp_ctx, ftype);
@@ -3143,20 +3429,22 @@ void cbm_run_go_lsp_cross(
 
                 for (int ti = 0; ti < reg.type_count; ti++) {
                     if (!reg.types[ti].qualified_name ||
-                        strcmp(reg.types[ti].qualified_name, type_qn) != 0) continue;
+                        strcmp(reg.types[ti].qualified_name, type_qn) != 0)
+                        continue;
 
                     if (embed_count > 0) {
-                        const char** arr = (const char**)cbm_arena_alloc(arena,
-                            (embed_count + 1) * sizeof(const char*));
-                        for (int ei = 0; ei < embed_count; ei++) arr[ei] = embeds[ei];
+                        const char **arr = (const char **)cbm_arena_alloc(
+                            arena, (embed_count + 1) * sizeof(const char *));
+                        for (int ei = 0; ei < embed_count; ei++)
+                            arr[ei] = embeds[ei];
                         arr[embed_count] = NULL;
                         reg.types[ti].embedded_types = arr;
                     }
                     if (fld_count > 0) {
-                        const char** names = (const char**)cbm_arena_alloc(arena,
-                            (fld_count + 1) * sizeof(const char*));
-                        const CBMType** types = (const CBMType**)cbm_arena_alloc(arena,
-                            (fld_count + 1) * sizeof(const CBMType*));
+                        const char **names = (const char **)cbm_arena_alloc(
+                            arena, (fld_count + 1) * sizeof(const char *));
+                        const CBMType **types = (const CBMType **)cbm_arena_alloc(
+                            arena, (fld_count + 1) * sizeof(const CBMType *));
                         for (int fi = 0; fi < fld_count; fi++) {
                             names[fi] = fld_names[fi];
                             types[fi] = fld_types[fi];
@@ -3198,7 +3486,8 @@ void cbm_run_go_lsp_cross(
     // 5. Cleanup — only free if we allocated
     if (owns_tree) {
         ts_tree_delete(tree);
-        if (parser) ts_parser_delete(parser);
+        if (parser)
+            ts_parser_delete(parser);
     }
 }
 
@@ -3217,23 +3506,47 @@ void cbm_run_go_lsp_cross(
  * 1b (and not already in defs[] embedded_types/field_defs strings) are
  * missed. In practice the per-file LSP during extract already captures
  * those via the def strings. */
-CBMTypeRegistry* cbm_go_build_cross_registry(
-    CBMArena* arena, CBMLSPDef* defs, int def_count) {
-    if (!arena) return NULL;
-    CBMTypeRegistry* reg = (CBMTypeRegistry*)cbm_arena_alloc(arena, sizeof(*reg));
-    if (!reg) return NULL;
+CBMTypeRegistry *cbm_go_build_cross_registry(CBMArena *arena, CBMLSPDef *defs, int def_count) {
+    if (!arena)
+        return NULL;
+    CBMTypeRegistry *reg = (CBMTypeRegistry *)cbm_arena_alloc(arena, sizeof(*reg));
+    if (!reg)
+        return NULL;
     cbm_registry_init(reg, arena);
     cbm_go_stdlib_register(reg, arena);
 
+    /* Qualified name -> FIRST type index while the registry is built: it is
+     * not finalized until the end, so its own lookup scans every type, and the
+     * receiver check below plus the field-definition lookup made the build
+     * O(types x (methods + structs)) -- 4.4 s single-threaded on the Go corpus,
+     * the scaling lane's parse_field_defs_into_type x2.9 (waste sanitizer,
+     * 2026-09-17). First-match semantics are kept exactly: a receiver's
+     * placeholder type added before its struct still receives the fields.
+     * NULL on allocation failure: the linear paths below run as before. */
+    CBMHashTable *first_type = cbm_ht_create((uint32_t)(def_count / 4 + 1024));
+    int noted_types = 0;
+#define GO_NOTE_NEW_TYPES()                                                        \
+    do {                                                                           \
+        for (; first_type && noted_types < reg->type_count; noted_types++) {       \
+            const char *tqn = reg->types[noted_types].qualified_name;              \
+            if (tqn && !cbm_ht_has(first_type, tqn)) {                             \
+                cbm_ht_set(first_type, tqn, (void *)(uintptr_t)(noted_types + 1)); \
+            }                                                                      \
+        }                                                                          \
+    } while (0)
+    GO_NOTE_NEW_TYPES();
+
     for (int i = 0; i < def_count; i++) {
-        CBMLSPDef* d = &defs[i];
-        if (!d->qualified_name || !d->short_name || !d->label) continue;
+        CBMLSPDef *d = &defs[i];
+        if (!d->qualified_name || !d->short_name || !d->label)
+            continue;
         /* Filter to Go defs only — the all_defs[] array is mixed-language. */
-        if (d->lang != CBM_LANG_GO) continue;
+        if (d->lang != CBM_LANG_GO)
+            continue;
         /* In the pre-built path every def carries its own def_module_qn
          * (set by cbm_pxc_collect_all_defs). There is no caller module to
          * fall back to — this registry is project-wide, not per-file. */
-        const char* def_mod = d->def_module_qn ? d->def_module_qn : "";
+        const char *def_mod = d->def_module_qn ? d->def_module_qn : "";
 
         // Every type-like container (Type/Class/Struct/Interface/Enum/Trait).
         // Struct included so Go structs (now labelled "Struct") register as types.
@@ -3248,9 +3561,20 @@ CBMTypeRegistry* cbm_go_build_cross_registry(
                 rt.method_names = split_pipe_strings(arena, d->method_names_str);
             }
             cbm_registry_add_type(reg, rt);
+            GO_NOTE_NEW_TYPES();
             if (d->field_defs && d->field_defs[0]) {
-                parse_field_defs_into_type(arena, reg, rt.qualified_name,
-                                           d->field_defs, def_mod);
+                if (first_type) {
+                    const char **names = NULL;
+                    const CBMType **types = NULL;
+                    uintptr_t at = (uintptr_t)cbm_ht_get(first_type, rt.qualified_name);
+                    if (parse_field_defs(arena, d->field_defs, def_mod, &names, &types) && at) {
+                        reg->types[at - 1].field_names = names;
+                        reg->types[at - 1].field_types = types;
+                    }
+                } else {
+                    parse_field_defs_into_type(arena, reg, rt.qualified_name, d->field_defs,
+                                               def_mod);
+                }
             }
         }
 
@@ -3259,7 +3583,7 @@ CBMTypeRegistry* cbm_go_build_cross_registry(
             memset(&rf, 0, sizeof(rf));
             rf.qualified_name = d->qualified_name; /* borrowed */
             rf.short_name = d->short_name;
-            const CBMType** ret_types = split_pipe_types(arena, d->return_types, def_mod);
+            const CBMType **ret_types = split_pipe_types(arena, d->return_types, def_mod);
             CBMGoLSPSignatureParserContext param_parser_ctx = {def_mod};
             const CBMType **param_types = cbm_type_materialize_signature_params(
                 arena, d->signature_param_types, d->signature_param_count,
@@ -3267,44 +3591,51 @@ CBMTypeRegistry* cbm_go_build_cross_registry(
             rf.signature = cbm_type_func(arena, NULL, param_types, ret_types);
             if (strcmp(d->label, "Method") == 0 && d->receiver_type && d->receiver_type[0]) {
                 rf.receiver_type = d->receiver_type;
-                if (!cbm_registry_lookup_type(reg, rf.receiver_type)) {
+                bool known = first_type ? cbm_ht_has(first_type, rf.receiver_type)
+                                        : cbm_registry_lookup_type(reg, rf.receiver_type) != NULL;
+                if (!known) {
                     CBMRegisteredType auto_type;
                     memset(&auto_type, 0, sizeof(auto_type));
                     auto_type.qualified_name = rf.receiver_type;
-                    const char* dot = strrchr(d->receiver_type, '.');
+                    const char *dot = strrchr(d->receiver_type, '.');
                     auto_type.short_name = dot ? dot + 1 : rf.receiver_type;
                     cbm_registry_add_type(reg, auto_type);
+                    GO_NOTE_NEW_TYPES();
                 }
             }
             cbm_registry_add_func(reg, rf);
         }
     }
+#undef GO_NOTE_NEW_TYPES
+    cbm_ht_free(first_type);
 
     cbm_registry_finalize(reg);
     reg->read_only = true; /* seal: shared Tier-2 registry is read-only during resolve */
     return reg;
 }
 
-void cbm_run_go_lsp_cross_with_registry(
-    CBMArena* arena,
-    const char* source, int source_len,
-    const char* module_qn,
-    CBMTypeRegistry* reg,
-    const char** import_names, const char** import_qns, int import_count,
-    TSTree* cached_tree,
-    CBMResolvedCallArray* out) {
-    if (!source || source_len <= 0 || !reg) return;
+void cbm_run_go_lsp_cross_with_registry(CBMArena *arena, const char *source, int source_len,
+                                        const char *module_qn, CBMTypeRegistry *reg,
+                                        const char **import_names, const char **import_qns,
+                                        int import_count, TSTree *cached_tree,
+                                        CBMResolvedCallArray *out) {
+    if (!source || source_len <= 0 || !reg)
+        return;
 
-    TSParser* parser = NULL;
-    TSTree* tree = cached_tree;
+    TSParser *parser = NULL;
+    TSTree *tree = cached_tree;
     bool owns_tree = false;
     if (!tree) {
         parser = ts_parser_new();
-        if (!parser) return;
+        if (!parser)
+            return;
         ts_parser_set_language(parser, tree_sitter_go());
         tree = ts_parser_parse_string(parser, NULL, source, source_len);
         owns_tree = true;
-        if (!tree) { ts_parser_delete(parser); return; }
+        if (!tree) {
+            ts_parser_delete(parser);
+            return;
+        }
     }
     TSNode root = ts_tree_root_node(tree);
 
@@ -3322,7 +3653,8 @@ void cbm_run_go_lsp_cross_with_registry(
 
     if (owns_tree) {
         ts_tree_delete(tree);
-        if (parser) ts_parser_delete(parser);
+        if (parser)
+            ts_parser_delete(parser);
     }
 }
 
@@ -3353,46 +3685,47 @@ void cbm_run_go_lsp_cross_with_registry(
  * This is what the user meant: walk the AST ONCE (during extract),
  * capture everything cross-LSP needs as metadata, and let cross-LSP
  * be a pure lookup pass. */
-int cbm_go_fast_resolve_qualified_calls(
-    CBMFileResult* result,
-    CBMTypeRegistry* reg,
-    const char** import_names, const char** import_qns, int import_count) {
-    if (!result || !reg) return 0;
+int cbm_go_fast_resolve_qualified_calls(CBMFileResult *result, CBMTypeRegistry *reg,
+                                        const char **import_names, const char **import_qns,
+                                        int import_count) {
+    if (!result || !reg)
+        return 0;
     /* Snapshot the count: we append to resolved_calls inside the loop,
      * but only want to scan the original unresolved entries. */
     int initial_count = result->resolved_calls.count;
     int newly_resolved = 0;
 
     for (int i = 0; i < initial_count; i++) {
-        const CBMResolvedCall* uc = &result->resolved_calls.items[i];
-        if (!uc->strategy || !uc->callee_qn || !uc->caller_qn) continue;
-        if (strcmp(uc->strategy, "lsp_unresolved") != 0) continue;
+        const CBMResolvedCall *uc = &result->resolved_calls.items[i];
+        if (!uc->strategy || !uc->callee_qn || !uc->caller_qn)
+            continue;
+        if (strcmp(uc->strategy, "lsp_unresolved") != 0)
+            continue;
 
         /* Case 1: callee_qn is already a fully-qualified type/pkg
          * symbol that per-file LSP couldn't find in its local registry
          * but the global registry has. (method_not_found with NAMED
          * receiver, or any other case where callee_qn looks like a
          * full QN). Direct lookup. */
-        const CBMRegisteredFunc* f = cbm_registry_lookup_func(reg, uc->callee_qn);
+        const CBMRegisteredFunc *f = cbm_registry_lookup_func(reg, uc->callee_qn);
 
         /* Case 2: callee_qn is "local_pkg_alias.suffix" — the alias
          * needs translating through the file's import map to get the
          * real module QN. */
         if (!f) {
-            const char* dot = strchr(uc->callee_qn, '.');
+            const char *dot = strchr(uc->callee_qn, '.');
             if (dot) {
                 size_t prefix_len = (size_t)(dot - uc->callee_qn);
                 if (prefix_len > 0 && prefix_len < 256) {
                     char prefix[256];
                     memcpy(prefix, uc->callee_qn, prefix_len);
                     prefix[prefix_len] = '\0';
-                    const char* suffix = dot + 1;
+                    const char *suffix = dot + 1;
                     for (int j = 0; j < import_count; j++) {
                         if (import_names[j] && import_qns[j] &&
                             strcmp(prefix, import_names[j]) == 0) {
                             char fq[1024];
-                            int n = snprintf(fq, sizeof(fq), "%s.%s",
-                                             import_qns[j], suffix);
+                            int n = snprintf(fq, sizeof(fq), "%s.%s", import_qns[j], suffix);
                             if (n > 0 && n < (int)sizeof(fq)) {
                                 f = cbm_registry_lookup_func(reg, fq);
                             }
@@ -3411,7 +3744,8 @@ int cbm_go_fast_resolve_qualified_calls(
             f = cbm_registry_lookup_symbol(reg, result->module_qn, uc->callee_qn);
         }
 
-        if (!f) continue;
+        if (!f)
+            continue;
 
         /* Emit a resolved entry. cbm_pipeline_find_lsp_resolution
          * picks the highest-confidence match, so the unresolved entry
@@ -3438,18 +3772,17 @@ int cbm_go_fast_resolve_qualified_calls(
 
 // --- Batch cross-file LSP ---
 
-void cbm_batch_go_lsp_cross(
-    CBMArena* arena,
-    CBMBatchGoLSPFile* files, int file_count,
-    CBMResolvedCallArray* out)
-{
-    if (!files || file_count <= 0 || !out) return;
+void cbm_batch_go_lsp_cross(CBMArena *arena, CBMBatchGoLSPFile *files, int file_count,
+                            CBMResolvedCallArray *out) {
+    if (!files || file_count <= 0 || !out)
+        return;
 
     for (int f = 0; f < file_count; f++) {
-        CBMBatchGoLSPFile* file = &files[f];
+        CBMBatchGoLSPFile *file = &files[f];
         memset(&out[f], 0, sizeof(CBMResolvedCallArray));
 
-        if (!file->source || file->source_len <= 0 || file->def_count <= 0) continue;
+        if (!file->source || file->source_len <= 0 || file->def_count <= 0)
+            continue;
 
         // Per-file arena: registry + temp data freed after each file
         CBMArena file_arena;
@@ -3459,29 +3792,24 @@ void cbm_batch_go_lsp_cross(
         memset(&file_out, 0, sizeof(file_out));
 
         // Delegate to existing per-file function
-        cbm_run_go_lsp_cross(
-            &file_arena,
-            file->source, file->source_len,
-            file->module_qn,
-            file->defs, file->def_count,
-            file->import_names, file->import_qns, file->import_count,
-            file->cached_tree,
-            &file_out);
+        cbm_run_go_lsp_cross(&file_arena, file->source, file->source_len, file->module_qn,
+                             file->defs, file->def_count, file->import_names, file->import_qns,
+                             file->import_count, file->cached_tree, &file_out);
 
         // Copy results to output arena (must outlive per-file arena)
         if (file_out.count > 0) {
             out[f].count = file_out.count;
-            out[f].items = (CBMResolvedCall*)cbm_arena_alloc(arena,
-                file_out.count * sizeof(CBMResolvedCall));
+            out[f].items =
+                (CBMResolvedCall *)cbm_arena_alloc(arena, file_out.count * sizeof(CBMResolvedCall));
             for (int j = 0; j < file_out.count; j++) {
-                CBMResolvedCall* src = &file_out.items[j];
-                CBMResolvedCall* dst = &out[f].items[j];
+                CBMResolvedCall *src = &file_out.items[j];
+                CBMResolvedCall *dst = &out[f].items[j];
                 memset(dst, 0, sizeof(*dst));
                 dst->caller_qn = src->caller_qn ? cbm_arena_strdup(arena, src->caller_qn) : NULL;
                 dst->callee_qn = src->callee_qn ? cbm_arena_strdup(arena, src->callee_qn) : NULL;
-                dst->strategy  = src->strategy  ? cbm_arena_strdup(arena, src->strategy)  : NULL;
+                dst->strategy = src->strategy ? cbm_arena_strdup(arena, src->strategy) : NULL;
                 dst->confidence = src->confidence;
-                dst->reason    = src->reason    ? cbm_arena_strdup(arena, src->reason)    : NULL;
+                dst->reason = src->reason ? cbm_arena_strdup(arena, src->reason) : NULL;
                 dst->kind = src->kind;
                 dst->site_start_byte = src->site_start_byte;
                 dst->site_end_byte = src->site_end_byte;
diff --git a/internal/cbm/lsp/py_lsp.c b/internal/cbm/lsp/py_lsp.c
index 6dbc126e1..8a0396115 100644
--- a/internal/cbm/lsp/py_lsp.c
+++ b/internal/cbm/lsp/py_lsp.c
@@ -238,6 +238,7 @@ void py_lsp_init(PyLSPContext *ctx, CBMArena *arena, const char *source, int sou
     ctx->source = source;
     ctx->source_len = source_len;
     ctx->registry = registry;
+    ctx->registry_head = (CBMTypeRegistry *)registry;
     ctx->module_qn = module_qn;
     ctx->resolved_calls = out;
     ctx->current_scope = py_scope_push_checked(ctx);
@@ -394,7 +395,7 @@ static void py_import_syntax_match_add(PyImportSyntaxMatch *match, PyDirectImpor
  * registry then retains responsibility for proving that the exact target is
  * an undecorated, unambiguous callable. */
 static const char *py_canonical_from_import_qn(PyLSPContext *ctx, TSNode statement,
-                                                TSNode imported_name, const char *incoming_qn) {
+                                               TSNode imported_name, const char *incoming_qn) {
     if (!ctx || !incoming_qn || ts_node_is_null(statement) || ts_node_is_null(imported_name))
         return NULL;
     TSNode module = py_from_import_module_node(statement);
@@ -407,10 +408,9 @@ static const char *py_canonical_from_import_qn(PyLSPContext *ctx, TSNode stateme
     while (module_suffix && *module_suffix == '.')
         module_suffix++;
 
-    const char *full_suffix =
-        module_suffix && module_suffix[0]
-            ? cbm_arena_sprintf(ctx->arena, "%s.%s", module_suffix, member)
-            : member;
+    const char *full_suffix = module_suffix && module_suffix[0]
+                                  ? cbm_arena_sprintf(ctx->arena, "%s.%s", module_suffix, member)
+                                  : member;
     if (!full_suffix)
         return NULL;
     if (py_qn_has_boundary_suffix(incoming_qn, full_suffix))
@@ -445,17 +445,16 @@ static void py_import_match_statement(PyLSPContext *ctx, TSNode stmt, const char
                 TSNode alias = ts_node_child_by_field_name(item, "alias", 5);
                 if (py_import_node_text_equals(ctx, alias, local)) {
                     const char *canonical = py_canonical_from_import_qn(ctx, stmt, name, qn);
-                    py_import_syntax_match_add(
-                        match, canonical ? PY_FROM_IMPORT : PY_IMPORT_UNCLASSIFIED,
-                        canonical ? canonical : qn);
+                    py_import_syntax_match_add(match,
+                                               canonical ? PY_FROM_IMPORT : PY_IMPORT_UNCLASSIFIED,
+                                               canonical ? canonical : qn);
                 }
-            } else if ((strcmp(kind, "identifier") == 0 ||
-                        strcmp(kind, "dotted_name") == 0) &&
+            } else if ((strcmp(kind, "identifier") == 0 || strcmp(kind, "dotted_name") == 0) &&
                        py_import_node_text_equals(ctx, item, local)) {
                 const char *canonical = py_canonical_from_import_qn(ctx, stmt, item, qn);
-                py_import_syntax_match_add(
-                    match, canonical ? PY_FROM_IMPORT : PY_IMPORT_UNCLASSIFIED,
-                    canonical ? canonical : qn);
+                py_import_syntax_match_add(match,
+                                           canonical ? PY_FROM_IMPORT : PY_IMPORT_UNCLASSIFIED,
+                                           canonical ? canonical : qn);
             }
         }
         return;
@@ -489,8 +488,7 @@ static void py_import_match_statement(PyLSPContext *ctx, TSNode stmt, const char
     }
 }
 
-static PyDirectImportKind py_import_match_result(PyImportSyntaxMatch *match,
-                                                 const char **qn_io) {
+static PyDirectImportKind py_import_match_result(PyImportSyntaxMatch *match, const char **qn_io) {
     if (!match || !qn_io)
         return PY_DIRECT_IMPORT_UNKNOWN;
     if (match->count == 0)
@@ -503,8 +501,7 @@ static PyDirectImportKind py_import_match_result(PyImportSyntaxMatch *match,
 }
 
 static PyDirectImportKind py_import_kind_from_statement(PyLSPContext *ctx, TSNode stmt,
-                                                        const char *local,
-                                                        const char **qn_io) {
+                                                        const char *local, const char **qn_io) {
     const char *qn = qn_io ? *qn_io : NULL;
     if (!ctx || !local || !qn || !qn_io || ts_node_is_null(stmt))
         return PY_DIRECT_IMPORT_UNKNOWN;
@@ -513,8 +510,8 @@ static PyDirectImportKind py_import_kind_from_statement(PyLSPContext *ctx, TSNod
     return py_import_match_result(&match, qn_io);
 }
 
-static PyDirectImportKind py_import_kind_from_ast(PyLSPContext *ctx, TSNode root,
-                                                  const char *local, const char **qn_io) {
+static PyDirectImportKind py_import_kind_from_ast(PyLSPContext *ctx, TSNode root, const char *local,
+                                                  const char **qn_io) {
     const char *qn = qn_io ? *qn_io : NULL;
     if (!ctx || !local || !qn || !qn_io || ts_node_is_null(root))
         return PY_DIRECT_IMPORT_UNKNOWN;
@@ -589,36 +586,34 @@ static void py_bind_import_index(PyLSPContext *ctx, int index, bool synthetic_fa
     if (!local || !qn || strcmp(local, "*") == 0)
         return;
 
-    PyDirectImportKind direct_kind = ctx->import_kinds
-                                         ? (PyDirectImportKind)ctx->import_kinds[index]
-                                         : PY_DIRECT_IMPORT_UNKNOWN;
+    PyDirectImportKind direct_kind =
+        ctx->import_kinds ? (PyDirectImportKind)ctx->import_kinds[index] : PY_DIRECT_IMPORT_UNKNOWN;
     bool from_style = direct_kind == PY_FROM_IMPORT ||
-                      (direct_kind == PY_DIRECT_IMPORT_UNKNOWN &&
-                       import_is_from_style(local, qn));
+                      (direct_kind == PY_DIRECT_IMPORT_UNKNOWN && import_is_from_style(local, qn));
     const CBMType *t;
     if (direct_kind == PY_DIRECT_IMPORT_UNALIASED) {
-            // Python binds only the root of an unaliased dotted import.
+        // Python binds only the root of an unaliased dotted import.
         t = cbm_type_module(ctx->arena, local);
     } else if (direct_kind == PY_DIRECT_IMPORT_ALIASED) {
         t = cbm_type_module(ctx->arena, qn);
     } else if (from_style) {
-            // `from X import Y` — bind Y to NAMED(X.Y). Phase 6 attribute
-            // resolution checks the registry to upgrade to MODULE / class
-            // / function as appropriate.
+        // `from X import Y` — bind Y to NAMED(X.Y). Phase 6 attribute
+        // resolution checks the registry to upgrade to MODULE / class
+        // / function as appropriate.
         t = cbm_type_named(ctx->arena, qn);
     } else if (strchr(qn, '.') != NULL) {
-            // Dotted path whose tail does NOT match the local name: an
-            // ALIASED binding — `from X import Y as Z` (Z names function/
-            // class X.Y) or `import a.b as z` (z names module a.b). The
-            // CBMImport shape cannot distinguish the two, but NAMED(qn)
-            // covers both: phase 6 upgrades it to the registered function/
-            // class for the from-import and to MODULE for the module alias.
-            // Binding MODULE here made `g()` calls on `from m import f as g`
-            // resolve as calls on a module — lsp=MISS, and the whole CALLS
-            // edge was lost (#988).
+        // Dotted path whose tail does NOT match the local name: an
+        // ALIASED binding — `from X import Y as Z` (Z names function/
+        // class X.Y) or `import a.b as z` (z names module a.b). The
+        // CBMImport shape cannot distinguish the two, but NAMED(qn)
+        // covers both: phase 6 upgrades it to the registered function/
+        // class for the from-import and to MODULE for the module alias.
+        // Binding MODULE here made `g()` calls on `from m import f as g`
+        // resolve as calls on a module — lsp=MISS, and the whole CALLS
+        // edge was lost (#988).
         t = cbm_type_named(ctx->arena, qn);
     } else {
-            // `import X` / `import X as Y` (single segment) — MODULE(X).
+        // `import X` / `import X as Y` (single segment) — MODULE(X).
         t = cbm_type_module(ctx->arena, qn);
     }
     const CBMRegisteredFunc *imported =
@@ -841,8 +836,7 @@ static void py_emit_resolved_call(PyLSPContext *ctx, const char *callee_qn, cons
 }
 
 static void py_emit_resolved_reference(PyLSPContext *ctx, const char *callee_qn,
-                                       const char *source_name, TSNode site,
-                                       const char *strategy) {
+                                       const char *source_name, TSNode site, const char *strategy) {
     if (!ctx || !ctx->resolved_calls || !callee_qn || !ctx->enclosing_func_qn ||
         ts_node_is_null(site)) {
         return;
@@ -1027,8 +1021,7 @@ static void py_resolve_value_references_at(PyLSPContext *ctx, TSNode call) {
         if (candidate && cbm_scope_contains(ctx->current_scope, source_name)) {
             const CBMType *binding =
                 cbm_type_resolve_alias(cbm_scope_lookup(ctx->current_scope, source_name));
-            if (binding && binding->kind == CBM_TYPE_NAMED &&
-                binding->data.named.qualified_name &&
+            if (binding && binding->kind == CBM_TYPE_NAMED && binding->data.named.qualified_name &&
                 strcmp(binding->data.named.qualified_name, candidate) == 0) {
                 py_emit_unresolved_reference(ctx, candidate, arg);
             }
@@ -1195,16 +1188,10 @@ static void py_register_instance_field(PyLSPContext *ctx, const char *class_qn,
         return;
     }
 
-    // Find the type entry. cbm_registry_lookup_type returns a const pointer;
-    // we need a mutable pointer into the registry's array.
-    CBMRegisteredType *rt = NULL;
-    for (int i = 0; i < ctx->registry->type_count; i++) {
-        const char *qn = ctx->registry->types[i].qualified_name;
-        if (qn && strcmp(qn, class_qn) == 0) {
-            rt = &ctx->registry->types[i];
-            break;
-        }
-    }
+    // The writable entry for the class: the head's own, or a copy of the
+    // base entry made in the head (copy-on-write). The shared base is never
+    // written -- it used to be, from every parallel resolve worker.
+    CBMRegisteredType *rt = cbm_registry_type_for_update(ctx->registry_head, class_qn);
     if (!rt)
         return;
 
@@ -1570,11 +1557,12 @@ static const CBMType *py_eval_expr_type_uncached(PyLSPContext *ctx, TSNode node)
             const char *prefix = cbm_arena_sprintf(ctx->arena, "%s.", qn);
             size_t prefix_len = strlen(prefix);
             bool is_submodule = false;
-            for (int i = 0; i < ctx->registry->func_count; i++) {
-                const char *fqn = ctx->registry->funcs[i].qualified_name;
+            CBMFreeFuncIter all_funcs;
+            cbm_registry_all_funcs_chain(ctx->registry, &all_funcs);
+            for (int i = -1; !is_submodule && (i = cbm_free_func_iter_next(&all_funcs)) >= 0;) {
+                const char *fqn = all_funcs.reg->funcs[i].qualified_name;
                 if (fqn && strncmp(fqn, prefix, prefix_len) == 0) {
                     is_submodule = true;
-                    break;
                 }
             }
             if (is_submodule)
@@ -2600,8 +2588,7 @@ static void py_emit_call_for(PyLSPContext *ctx, TSNode call_node) {
                         const char *local = ctx->import_local_names[i];
                         const char *import_qn = ctx->import_module_qns[i];
                         if (local && import_qn && strcmp(local, fname) == 0 &&
-                            strcmp(import_qn, qn) == 0 &&
-                            py_import_index_is_from_binding(ctx, i)) {
+                            strcmp(import_qn, qn) == 0 && py_import_index_is_from_binding(ctx, i)) {
                             imported_alias = true;
                             break;
                         }
@@ -2758,8 +2745,8 @@ static void py_emit_call_for(PyLSPContext *ctx, TSNode call_node) {
                     // Skip if mod is already rooted under the project to avoid
                     // "<root>.<root>.mod".
                     if (!(strncmp(mod, ctx->module_qn, root_len) == 0 && mod[root_len] == '.')) {
-                        char *qual_mod = (char *)cbm_arena_alloc(ctx->arena, root_len + 1 +
-                                                                                strlen(mod) + 1);
+                        char *qual_mod =
+                            (char *)cbm_arena_alloc(ctx->arena, root_len + 1 + strlen(mod) + 1);
                         if (qual_mod) {
                             memcpy(qual_mod, ctx->module_qn, root_len);
                             qual_mod[root_len] = '.';
@@ -4047,10 +4034,8 @@ static void py_process_function(PyLSPContext *ctx, TSNode func_node, const char
     // For methods, bind `self`/`cls` AFTER param walk so the receiver type
     // wins over the unannotated `self` / `cls` parameter declaration.
     if (ctx->enclosing_class_qn) {
-        py_scope_bind(ctx, "self",
-                       cbm_type_named(ctx->arena, ctx->enclosing_class_qn));
-        py_scope_bind(ctx, "cls",
-                       cbm_type_named(ctx->arena, ctx->enclosing_class_qn));
+        py_scope_bind(ctx, "self", cbm_type_named(ctx->arena, ctx->enclosing_class_qn));
+        py_scope_bind(ctx, "cls", cbm_type_named(ctx->arena, ctx->enclosing_class_qn));
     }
 
     TSNode body = ts_node_child_by_field_name(func_node, "body", 4);
@@ -4197,12 +4182,14 @@ static void py_bind_external_module_classes(PyLSPContext *ctx, TSNode root) {
     if (!ctx || !ctx->registry || !ctx->module_qn)
         return;
     size_t prefix_len = strlen(ctx->module_qn);
-    for (int i = 0; i < ctx->registry->type_count; i++) {
-        const CBMRegisteredType *type = &ctx->registry->types[i];
+    CBMTypeShortIter all_types;
+    cbm_registry_all_types_chain(ctx->registry, &all_types);
+    for (int i = -1; (i = cbm_type_short_iter_next(&all_types)) >= 0;) {
+        const CBMRegisteredType *type = &all_types.reg->types[i];
         const char *qn = type->qualified_name;
         const char *name = type->short_name;
-        if (!qn || !name || strncmp(qn, ctx->module_qn, prefix_len) != 0 ||
-            qn[prefix_len] != '.' || py_root_defines_class_named(ctx, root, name)) {
+        if (!qn || !name || strncmp(qn, ctx->module_qn, prefix_len) != 0 || qn[prefix_len] != '.' ||
+            py_root_defines_class_named(ctx, root, name)) {
             continue;
         }
         py_scope_bind(ctx, name, cbm_type_named(ctx->arena, qn));
@@ -4502,8 +4489,7 @@ static void py_invalidate_possible_bindings(PyLSPContext *ctx, TSNode node, int
             py_invalidate_possible_bindings(ctx, definition, depth + 1);
         return;
     }
-    if (strcmp(kind, "import_statement") == 0 ||
-        strcmp(kind, "import_from_statement") == 0) {
+    if (strcmp(kind, "import_statement") == 0 || strcmp(kind, "import_from_statement") == 0) {
         py_invalidate_import_bindings(ctx, node);
         return;
     }
@@ -4511,8 +4497,7 @@ static void py_invalidate_possible_bindings(PyLSPContext *ctx, TSNode node, int
         TSNode right = ts_node_child_by_field_name(node, "right", 5);
         if (ts_node_is_null(right))
             return;
-        py_invalidate_binding_target(ctx, ts_node_child_by_field_name(node, "left", 4),
-                                     depth + 1);
+        py_invalidate_binding_target(ctx, ts_node_child_by_field_name(node, "left", 4), depth + 1);
         py_invalidate_possible_bindings(ctx, right, depth + 1);
         return;
     }
@@ -4523,8 +4508,7 @@ static void py_invalidate_possible_bindings(PyLSPContext *ctx, TSNode node, int
         py_invalidate_possible_bindings(ctx, right, depth + 1);
         return;
     }
-    if (strcmp(kind, "named_expression") == 0 ||
-        strcmp(kind, "assignment_expression") == 0) {
+    if (strcmp(kind, "named_expression") == 0 || strcmp(kind, "assignment_expression") == 0) {
         TSNode name = ts_node_child_by_field_name(node, "name", 4);
         if (ts_node_is_null(name))
             name = ts_node_child_by_field_name(node, "left", 4);
@@ -4619,8 +4603,7 @@ static void py_replay_import_local(PyLSPContext *ctx, TSNode stmt, const char *l
             continue;
         }
         const char *candidate_qn = ctx->import_module_qns[i];
-        PyDirectImportKind kind =
-            py_import_kind_from_statement(ctx, stmt, local, &candidate_qn);
+        PyDirectImportKind kind = py_import_kind_from_statement(ctx, stmt, local, &candidate_qn);
         if (!py_replayable_import_kind(kind))
             continue;
         if (!chosen_qn) {
@@ -4642,8 +4625,7 @@ static void py_replay_import_local(PyLSPContext *ctx, TSNode stmt, const char *l
     py_bind_import_index(ctx, chosen, false);
 }
 
-static void py_replay_import_statement(PyLSPContext *ctx, TSNode stmt,
-                                       unsigned char *consumed) {
+static void py_replay_import_statement(PyLSPContext *ctx, TSNode stmt, unsigned char *consumed) {
     if (py_import_statement_is_wildcard(stmt)) {
         py_invalidate_module_bindings_for_wildcard(ctx);
         return;
@@ -4686,8 +4668,7 @@ void py_lsp_process_file(PyLSPContext *ctx, TSNode root) {
     py_bind_external_module_classes(ctx, root);
     unsigned char *consumed_imports = NULL;
     if (ctx->import_count > 0) {
-        consumed_imports =
-            (unsigned char *)cbm_arena_alloc(ctx->arena, (size_t)ctx->import_count);
+        consumed_imports = (unsigned char *)cbm_arena_alloc(ctx->arena, (size_t)ctx->import_count);
         if (consumed_imports)
             memset(consumed_imports, 0, (size_t)ctx->import_count);
     }
@@ -4700,8 +4681,7 @@ void py_lsp_process_file(PyLSPContext *ctx, TSNode root) {
     for (uint32_t i = 0; i < nc; i++) {
         TSNode c = ts_node_named_child(root, i);
         const char *ck = ts_node_type(c);
-        if (strcmp(ck, "import_statement") == 0 ||
-            strcmp(ck, "import_from_statement") == 0) {
+        if (strcmp(ck, "import_statement") == 0 || strcmp(ck, "import_from_statement") == 0) {
             py_replay_import_statement(ctx, c, consumed_imports);
         } else if (strcmp(ck, "function_definition") == 0) {
             py_bind_module_function(ctx, c);
diff --git a/internal/cbm/lsp/py_lsp.h b/internal/cbm/lsp/py_lsp.h
index 96a85dc5d..939025100 100644
--- a/internal/cbm/lsp/py_lsp.h
+++ b/internal/cbm/lsp/py_lsp.h
@@ -44,6 +44,10 @@ typedef struct {
     const char *source;
     int source_len;
     const CBMTypeRegistry *registry;
+    /* Writable head of the registry chain (the per-file overlay, or the
+     * per-file registry on the non-cross path); refinements go here via
+     * cbm_registry_*_for_update, never into anything behind ->fallback. */
+    CBMTypeRegistry *registry_head;
     CBMScope *current_scope;
 
     // Import map: local_name -> module_qn (arena-allocated, NULL-terminated).
diff --git a/internal/cbm/lsp/ts_lsp.c b/internal/cbm/lsp/ts_lsp.c
index fc8b8911f..0072aa999 100644
--- a/internal/cbm/lsp/ts_lsp.c
+++ b/internal/cbm/lsp/ts_lsp.c
@@ -2800,8 +2800,17 @@ static void resolve_value_references_at(TSLSPContext *ctx, TSNode call_node) {
     }
 }
 
+static TSNode unwrap_await_callee(TSNode node) {
+    if (ts_node_is_null(node) || strcmp(ts_node_type(node), "await_expression") != 0 ||
+        ts_node_named_child_count(node) == 0) {
+        return node;
+    }
+    return ts_node_named_child(node, 0);
+}
+
 static void resolve_call_at(TSLSPContext *ctx, TSNode call_node) {
     TSNode fn = ts_node_child_by_field_name(call_node, "function", TS_LSP_FIELD_LEN("function"));
+    fn = unwrap_await_callee(fn);
     if (ts_node_is_null(fn))
         return;
 
diff --git a/internal/cbm/lsp/type_registry.c b/internal/cbm/lsp/type_registry.c
index 30c551899..4e2f02012 100644
--- a/internal/cbm/lsp/type_registry.c
+++ b/internal/cbm/lsp/type_registry.c
@@ -301,6 +301,9 @@ static void build_ffunc_short_index(CBMTypeRegistry *reg, CBMArena *idx_arena) {
 void cbm_registry_types_by_short_name(const CBMTypeRegistry *reg, const char *short_name,
                                       CBMTypeShortIter *out) {
     out->reg = reg;
+    out->chain = false;
+    out->key = short_name;
+    out->shadow = NULL;
     out->hash = fnv1a(short_name);
     if (reg->type_qn_buckets && reg->type_qn_bucket_count > 0) {
         if (reg->type_short_buckets && reg->type_short_bucket_count > 0) {
@@ -319,7 +322,7 @@ void cbm_registry_types_by_short_name(const CBMTypeRegistry *reg, const char *sh
     }
 }
 
-int cbm_type_short_iter_next(CBMTypeShortIter *it) {
+static int type_short_next_local(CBMTypeShortIter *it) {
     const CBMTypeRegistry *reg = it->reg;
     while (it->chain_idx >= 0) {
         const CBMRegistryHashEntry *e = &reg->type_short_entries[it->chain_idx];
@@ -335,9 +338,79 @@ int cbm_type_short_iter_next(CBMTypeShortIter *it) {
     return -1;
 }
 
+static const CBMRegisteredType *lookup_type_self(const CBMTypeRegistry *reg,
+                                                 const char *qualified_name);
+static const CBMRegisteredFunc *lookup_func_self(const CBMTypeRegistry *reg,
+                                                 const char *qualified_name);
+
+/* A base entry is shadowed when the head holds an entry with the same QN. */
+static bool type_shadowed(const CBMTypeRegistry *shadow, const CBMTypeRegistry *reg, int i) {
+    if (!shadow || shadow == reg || !reg->types[i].qualified_name) {
+        return false;
+    }
+    return lookup_type_self(shadow, reg->types[i].qualified_name) != NULL;
+}
+static bool func_shadowed(const CBMTypeRegistry *shadow, const CBMTypeRegistry *reg, int i) {
+    if (!shadow || shadow == reg || !reg->funcs[i].qualified_name) {
+        return false;
+    }
+    return lookup_func_self(shadow, reg->funcs[i].qualified_name) != NULL;
+}
+
+static void type_short_open_linear(const CBMTypeRegistry *reg, CBMTypeShortIter *out) {
+    out->reg = reg;
+    out->hash = 0;
+    out->chain_idx = -1;
+    out->tail_i = 0;
+    out->tail_end = reg->type_count;
+}
+
+int cbm_type_short_iter_next(CBMTypeShortIter *it) {
+    for (;;) {
+        int p = type_short_next_local(it);
+        if (p >= 0) {
+            if (it->chain && type_shadowed(it->shadow, it->reg, p)) {
+                continue;
+            }
+            return p;
+        }
+        if (!it->chain || !it->reg->fallback) {
+            return -1;
+        }
+        const CBMTypeRegistry *next = it->reg->fallback;
+        const char *key = it->key;
+        const CBMTypeRegistry *shadow = it->shadow;
+        if (key) {
+            cbm_registry_types_by_short_name(next, key, it);
+        } else {
+            type_short_open_linear(next, it);
+        }
+        it->chain = true;
+        it->key = key;
+        it->shadow = shadow;
+    }
+}
+
+void cbm_registry_types_by_short_name_chain(const CBMTypeRegistry *head, const char *short_name,
+                                            CBMTypeShortIter *out) {
+    cbm_registry_types_by_short_name(head, short_name, out);
+    out->chain = true;
+    out->shadow = head;
+}
+
+void cbm_registry_all_types_chain(const CBMTypeRegistry *head, CBMTypeShortIter *out) {
+    type_short_open_linear(head, out);
+    out->chain = true;
+    out->key = NULL;
+    out->shadow = head;
+}
+
 void cbm_registry_types_by_embedded_bare(const CBMTypeRegistry *reg, const char *bare,
                                          CBMTypeEmbedIter *out) {
     out->reg = reg;
+    out->chain = false;
+    out->key = bare;
+    out->shadow = NULL;
     out->hash = fnv1a(bare);
     out->prev_type = -1;
     if (reg->type_qn_buckets && reg->type_qn_bucket_count > 0) {
@@ -358,7 +431,7 @@ void cbm_registry_types_by_embedded_bare(const CBMTypeRegistry *reg, const char
     }
 }
 
-int cbm_type_embed_iter_next(CBMTypeEmbedIter *it) {
+static int type_embed_next_local(CBMTypeEmbedIter *it) {
     const CBMTypeRegistry *reg = it->reg;
     while (it->chain_idx >= 0) {
         const CBMRegistryHashEntry *e = &reg->type_embed_entries[it->chain_idx];
@@ -377,9 +450,40 @@ int cbm_type_embed_iter_next(CBMTypeEmbedIter *it) {
     return -1;
 }
 
+int cbm_type_embed_iter_next(CBMTypeEmbedIter *it) {
+    for (;;) {
+        int p = type_embed_next_local(it);
+        if (p >= 0) {
+            if (it->chain && type_shadowed(it->shadow, it->reg, p)) {
+                continue;
+            }
+            return p;
+        }
+        if (!it->chain || !it->reg->fallback) {
+            return -1;
+        }
+        const CBMTypeRegistry *next = it->reg->fallback;
+        const char *key = it->key;
+        const CBMTypeRegistry *shadow = it->shadow;
+        cbm_registry_types_by_embedded_bare(next, key, it);
+        it->chain = true;
+        it->shadow = shadow;
+    }
+}
+
+void cbm_registry_types_by_embedded_bare_chain(const CBMTypeRegistry *head, const char *bare,
+                                               CBMTypeEmbedIter *out) {
+    cbm_registry_types_by_embedded_bare(head, bare, out);
+    out->chain = true;
+    out->shadow = head;
+}
+
 void cbm_registry_free_funcs_by_short_name(const CBMTypeRegistry *reg, const char *short_name,
                                            CBMFreeFuncIter *out) {
     out->reg = reg;
+    out->chain = false;
+    out->key = short_name;
+    out->shadow = NULL;
     out->hash = fnv1a(short_name);
     if (reg->func_qn_buckets && reg->func_qn_bucket_count > 0) {
         if (reg->ffunc_short_buckets && reg->ffunc_short_bucket_count > 0) {
@@ -397,7 +501,7 @@ void cbm_registry_free_funcs_by_short_name(const CBMTypeRegistry *reg, const cha
     }
 }
 
-int cbm_free_func_iter_next(CBMFreeFuncIter *it) {
+static int free_func_next_local(CBMFreeFuncIter *it) {
     const CBMTypeRegistry *reg = it->reg;
     while (it->chain_idx >= 0) {
         const CBMRegistryHashEntry *e = &reg->ffunc_short_entries[it->chain_idx];
@@ -413,9 +517,57 @@ int cbm_free_func_iter_next(CBMFreeFuncIter *it) {
     return -1;
 }
 
+static void free_func_open_linear(const CBMTypeRegistry *reg, CBMFreeFuncIter *out) {
+    out->reg = reg;
+    out->hash = 0;
+    out->chain_idx = -1;
+    out->tail_i = 0;
+    out->tail_end = reg->func_count;
+}
+
+int cbm_free_func_iter_next(CBMFreeFuncIter *it) {
+    for (;;) {
+        int p = free_func_next_local(it);
+        if (p >= 0) {
+            if (it->chain && func_shadowed(it->shadow, it->reg, p)) {
+                continue;
+            }
+            return p;
+        }
+        if (!it->chain || !it->reg->fallback) {
+            return -1;
+        }
+        const CBMTypeRegistry *next = it->reg->fallback;
+        const char *key = it->key;
+        const CBMTypeRegistry *shadow = it->shadow;
+        if (key) {
+            cbm_registry_free_funcs_by_short_name(next, key, it);
+        } else {
+            free_func_open_linear(next, it);
+        }
+        it->chain = true;
+        it->key = key;
+        it->shadow = shadow;
+    }
+}
+
+void cbm_registry_free_funcs_by_short_name_chain(const CBMTypeRegistry *head,
+                                                 const char *short_name, CBMFreeFuncIter *out) {
+    cbm_registry_free_funcs_by_short_name(head, short_name, out);
+    out->chain = true;
+    out->shadow = head;
+}
+
+void cbm_registry_all_funcs_chain(const CBMTypeRegistry *head, CBMFreeFuncIter *out) {
+    free_func_open_linear(head, out);
+    out->chain = true;
+    out->key = NULL;
+    out->shadow = head;
+}
+
 void cbm_registry_methods(const CBMTypeRegistry *reg, const char *receiver_qn,
                           const char *method_name, CBMMethodIter *out) {
-    memset(out, 0, sizeof(*out));
+    memset(out, 0, sizeof(*out)); /* chain=false, shadow=NULL */
     out->reg = reg;
     out->receiver_qn = receiver_qn;
     out->method_name = method_name;
@@ -435,10 +587,7 @@ void cbm_registry_methods(const CBMTypeRegistry *reg, const char *receiver_qn,
     }
 }
 
-int cbm_method_iter_next(CBMMethodIter *it) {
-    if (!it || !it->reg || !it->receiver_qn || !it->method_name) {
-        return -1;
-    }
+static int method_next_local(CBMMethodIter *it) {
     const CBMTypeRegistry *reg = it->reg;
     while (it->chain_idx >= 0) {
         const CBMRegistryHashEntry *e = &reg->method_entries[it->chain_idx];
@@ -465,6 +614,80 @@ int cbm_method_iter_next(CBMMethodIter *it) {
     return -1;
 }
 
+int cbm_method_iter_next(CBMMethodIter *it) {
+    if (!it || !it->reg || !it->receiver_qn || !it->method_name) {
+        return -1;
+    }
+    for (;;) {
+        int p = method_next_local(it);
+        if (p >= 0) {
+            if (it->chain && func_shadowed(it->shadow, it->reg, p)) {
+                continue;
+            }
+            return p;
+        }
+        if (!it->chain || !it->reg->fallback) {
+            return -1;
+        }
+        const CBMTypeRegistry *next = it->reg->fallback;
+        const CBMTypeRegistry *shadow = it->shadow;
+        cbm_registry_methods(next, it->receiver_qn, it->method_name, it);
+        it->chain = true;
+        it->shadow = shadow;
+    }
+}
+
+void cbm_registry_methods_chain(const CBMTypeRegistry *head, const char *receiver_qn,
+                                const char *method_name, CBMMethodIter *out) {
+    cbm_registry_methods(head, receiver_qn, method_name, out);
+    out->chain = true;
+    out->shadow = head;
+}
+
+CBMRegisteredFunc *cbm_registry_func_for_update(CBMTypeRegistry *head, const char *qualified_name) {
+    if (!head || !qualified_name || head->read_only) {
+        return NULL;
+    }
+    const CBMRegisteredFunc *own = lookup_func_self(head, qualified_name);
+    if (own) {
+        return (CBMRegisteredFunc *)own;
+    }
+    for (const CBMTypeRegistry *r = head->fallback; r; r = r->fallback) {
+        const CBMRegisteredFunc *base = lookup_func_self(r, qualified_name);
+        if (base) {
+            int before = head->func_count;
+            cbm_registry_add_func(head, *base);
+            if (head->func_count == before + 1) {
+                return &head->funcs[before];
+            }
+            return NULL;
+        }
+    }
+    return NULL;
+}
+
+CBMRegisteredType *cbm_registry_type_for_update(CBMTypeRegistry *head, const char *qualified_name) {
+    if (!head || !qualified_name || head->read_only) {
+        return NULL;
+    }
+    const CBMRegisteredType *own = lookup_type_self(head, qualified_name);
+    if (own) {
+        return (CBMRegisteredType *)own;
+    }
+    for (const CBMTypeRegistry *r = head->fallback; r; r = r->fallback) {
+        const CBMRegisteredType *base = lookup_type_self(r, qualified_name);
+        if (base) {
+            int before = head->type_count;
+            cbm_registry_add_type(head, *base);
+            if (head->type_count == before + 1) {
+                return &head->types[before];
+            }
+            return NULL;
+        }
+    }
+    return NULL;
+}
+
 void cbm_registry_finalize_into(CBMTypeRegistry *reg, CBMArena *idx_arena) {
     if (!reg || !idx_arena)
         return;
diff --git a/internal/cbm/lsp/type_registry.h b/internal/cbm/lsp/type_registry.h
index 7f7737448..c752350b1 100644
--- a/internal/cbm/lsp/type_registry.h
+++ b/internal/cbm/lsp/type_registry.h
@@ -242,6 +242,16 @@ typedef struct {
     int chain_idx;
     int tail_i;
     int tail_end;
+    /* Chain mode (see cbm_registry_*_chain): when this registry is exhausted
+     * the iterator re-opens on reg->fallback; `reg` then names the registry
+     * the yielded index belongs to, so callers deref it->reg->types[i], never
+     * the registry they started from. `key` re-opens the same query on the
+     * next link; NULL = linear scan. `shadow` is the head: fallback entries
+     * whose qualified_name the head also holds are skipped (an overlay copy
+     * hides its base original). */
+    bool chain;
+    const char *key;
+    const CBMTypeRegistry *shadow;
 } CBMTypeShortIter;
 void cbm_registry_types_by_short_name(const CBMTypeRegistry *reg, const char *short_name,
                                       CBMTypeShortIter *out);
@@ -263,6 +273,9 @@ typedef struct {
     int tail_i;    // next tail/linear type index
     int tail_end;  // reg->type_count snapshot
     int prev_type; // last yielded type index (adjacent-dedup); -1 = none
+    bool chain;
+    const char *key;
+    const CBMTypeRegistry *shadow;
 } CBMTypeEmbedIter;
 void cbm_registry_types_by_embedded_bare(const CBMTypeRegistry *reg, const char *bare,
                                          CBMTypeEmbedIter *out);
@@ -277,6 +290,9 @@ typedef struct {
     int chain_idx;
     int tail_i;
     int tail_end;
+    bool chain;
+    const char *key;
+    const CBMTypeRegistry *shadow;
 } CBMFreeFuncIter;
 
 void cbm_registry_free_funcs_by_short_name(const CBMTypeRegistry *reg, const char *short_name,
@@ -296,11 +312,41 @@ typedef struct {
     int chain_idx;
     int tail_i;
     int tail_end;
+    bool chain;
+    const CBMTypeRegistry *shadow;
 } CBMMethodIter;
 void cbm_registry_methods(const CBMTypeRegistry *reg, const char *receiver_qn,
                           const char *method_name, CBMMethodIter *out);
 int cbm_method_iter_next(CBMMethodIter *it);
 
+/* ── Chain-aware iteration and copy-on-write (per-file overlay contract) ──
+ *
+ * A resolve walk is handed a per-file OVERLAY registry chained (`fallback`) to
+ * the immutable shared base. Lookups already chain; these make the index
+ * iterators and the whole-registry scans chain too, and give a walk one way
+ * to refine an entry: copy it into the head first. Nothing behind `fallback`
+ * is ever written. Every yielded index belongs to it->reg at that moment. */
+void cbm_registry_types_by_short_name_chain(const CBMTypeRegistry *head, const char *short_name,
+                                            CBMTypeShortIter *out);
+void cbm_registry_types_by_embedded_bare_chain(const CBMTypeRegistry *head, const char *bare,
+                                               CBMTypeEmbedIter *out);
+void cbm_registry_free_funcs_by_short_name_chain(const CBMTypeRegistry *head,
+                                                 const char *short_name, CBMFreeFuncIter *out);
+void cbm_registry_methods_chain(const CBMTypeRegistry *head, const char *receiver_qn,
+                                const char *method_name, CBMMethodIter *out);
+/* Linear scans over every func / type in the chain (head first, shadowed
+ * base entries skipped). Same iterator types, same it->reg contract. */
+void cbm_registry_all_funcs_chain(const CBMTypeRegistry *head, CBMFreeFuncIter *out);
+void cbm_registry_all_types_chain(const CBMTypeRegistry *head, CBMTypeShortIter *out);
+
+/* The writable entry for qualified_name: the head's own entry if it has one,
+ * else a copy of the first fallback entry added to the head (copy-on-write),
+ * else NULL. NULL also when the head is sealed (read_only) -- a walk must never
+ * mutate a shared registry, so the caller skips the refinement, exactly as the
+ * sealed-registry no-op in cbm_registry_add_func does today. */
+CBMRegisteredFunc *cbm_registry_func_for_update(CBMTypeRegistry *head, const char *qualified_name);
+CBMRegisteredType *cbm_registry_type_for_update(CBMTypeRegistry *head, const char *qualified_name);
+
 // --- TS-specific helpers (return NULL for types without these signatures) ---
 
 // If the type has a call signature (e.g., `interface F { (x:number): string }`), return
diff --git a/internal/cbm/preprocessor.cpp b/internal/cbm/preprocessor.cpp
index 54cb073fe..9be6298f3 100644
--- a/internal/cbm/preprocessor.cpp
+++ b/internal/cbm/preprocessor.cpp
@@ -42,6 +42,283 @@ static bool has_preprocessor_work(const char *source, int source_len) {
     return false;
 }
 
+// ── Export-macro candidates (#1989) ─────────────────────────────────────────
+// Build systems define symbol-export macros empty on the compiler command line
+// (UE's UBT: `/D "MODULE_API="`; CMake generate_export_header: `<lib>_EXPORT`),
+// so they never appear as #define lines in the source. tree-sitter has no
+// preprocessor state either, and `class MODULE_API Foo` misparses with the
+// macro token as the type name (worse: enums and free functions are lost to
+// ERROR regions entirely). To mirror the real compile line, the preprocessed
+// second pass predefines the conventional export-macro-shaped identifiers found
+// in the file as empty. The shape is deliberately narrow — ALL_CAPS identifier
+// ending in a known export suffix, with a non-trivial prefix — and the list is
+// capped, so ordinary all-caps identifiers cannot be swept in wholesale.
+static const char *kExportMacroSuffixes[] = {"_API",       "_EXPORT",     "_IMPORT",
+                                             "_DLLEXPORT", "_DEPRECATED", NULL};
+
+static bool is_export_macro_shape(const char *id, size_t len) {
+    if (id[0] < 'A' || id[0] > 'Z') {
+        return false;
+    }
+    for (size_t i = 0; i < len; i++) {
+        char c = id[i];
+        bool upper = c >= 'A' && c <= 'Z';
+        bool digit = c >= '0' && c <= '9';
+        if (!upper && !digit && c != '_') {
+            return false;
+        }
+    }
+    for (int s = 0; kExportMacroSuffixes[s]; s++) {
+        size_t slen = strlen(kExportMacroSuffixes[s]);
+        // Require at least two prefix characters before the suffix so a bare
+        // "X_API"-style token (single-letter, easily a genuine symbol) stays out.
+        if (len >= slen + 2 && strncmp(id + len - slen, kExportMacroSuffixes[s], slen) == 0) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static bool is_identifier_start(char c) {
+    return (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || c == '_';
+}
+
+static bool is_identifier_char(char c) {
+    return is_identifier_start(c) || (c >= '0' && c <= '9');
+}
+
+// C++ raw string literals (R"delim(...)delim"). Returns the index one past
+// the closing quote, or -1 when the form cannot be confidently recognized
+// (unterminated, malformed delimiter) — the caller then STOPS collecting so
+// the mis-modeled literal cannot poison the scan state of the rest of the
+// file (#1989 review).
+static int skip_raw_string(const char *source, int source_len, int quote) {
+    int j = quote + 1;
+    int delim_start = j;
+    while (j < source_len) {
+        char c = source[j];
+        if (c == '(') {
+            break;
+        }
+        // Delimiter chars: the standard d-char set excludes space, parens,
+        // backslash, and the line breaks — a double quote IS a legal d-char
+        // (R"""(...)""" compiles), so it must not end the delimiter (#1989
+        // review round 3).
+        if (c == ' ' || c == '\t' || c == '\n' || c == '\r' || c == ')' || c == '\\' ||
+            j - delim_start >= 16) {
+            return -1;
+        }
+        j++;
+    }
+    if (j >= source_len || source[j] != '(') {
+        return -1;
+    }
+    int delim_len = j - delim_start;
+    j++; // past the opening "("
+    while (j < source_len) {
+        if (source[j] == ')') {
+            int k = j + 1;
+            int m = 0;
+            while (m < delim_len && k + m < source_len &&
+                   source[k + m] == source[delim_start + m]) {
+                m++;
+            }
+            if (m == delim_len && k + m < source_len && source[k + m] == '"') {
+                return k + m + 1;
+            }
+        }
+        j++;
+    }
+    return -1; // unterminated raw string: uncertain
+}
+
+// If the identifier just scanned is a raw-string prefix (R, LR, uR, UR, u8R)
+// immediately followed by a quote, return skip_raw_string(...). Returns 0 for
+// an ordinary identifier (including an identifier merely ENDING in R — only a
+// standalone prefix token starts a raw string) and -1 on an unrecognizable
+// raw form.
+static int raw_string_after_prefix(const char *source, int source_len, int start, int end) {
+    static const char *prefixes[] = {"R", "LR", "uR", "UR", "u8R", NULL};
+    size_t idlen = (size_t)(end - start);
+    bool is_prefix = false;
+    for (int p = 0; prefixes[p]; p++) {
+        if (idlen == strlen(prefixes[p]) && strncmp(source + start, prefixes[p], idlen) == 0) {
+            is_prefix = true;
+            break;
+        }
+    }
+    if (!is_prefix || end >= source_len || source[end] != '"') {
+        return 0;
+    }
+    return skip_raw_string(source, source_len, end);
+}
+
+// Advance past comments and string/char literals so only real code tokens
+// consume the candidate budget (#1989 review). Handles line-spliced //
+// comments (a backslash before the newline continues the comment — line
+// splicing happens before comment recognition) and, via the identifier-scan
+// hook in the callers, C++ raw string literals. A digit separator (1'000'000)
+// can still over-skip — that fails safe, toward NOT collecting a candidate.
+static int skip_non_code(const char *source, int source_len, int i) {
+    while (i < source_len) {
+        char c = source[i];
+        if (c == '/' && i + 1 < source_len && source[i + 1] == '/') {
+            i += 2;
+            for (;;) {
+                while (i < source_len && source[i] != '\n') {
+                    i++;
+                }
+                if (i >= source_len) {
+                    break;
+                }
+                // Line splice: a backslash right before the newline (allowing
+                // \r\n) means the comment continues on the next line.
+                int back = i - 1;
+                if (back >= 0 && source[back] == '\r') {
+                    back--;
+                }
+                if (back >= 0 && source[back] == '\\') {
+                    i++; // spliced: keep consuming inside the comment
+                    continue;
+                }
+                i++; // real end-of-comment newline
+                break;
+            }
+        } else if (c == '/' && i + 1 < source_len && source[i + 1] == '*') {
+            i += 2;
+            while (i + 1 < source_len && !(source[i] == '*' && source[i + 1] == '/')) {
+                i++;
+            }
+            if (i + 1 < source_len) {
+                i += 2; // past the closing "*/"
+            } else {
+                i = source_len; // unterminated comment runs to EOF
+            }
+        } else if (c == '"' || c == '\'') {
+            char quote = c;
+            i++;
+            while (i < source_len) {
+                if (source[i] == '\\') {
+                    i += 2;
+                    continue;
+                }
+                if (source[i] == quote) {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+        } else {
+            return i;
+        }
+    }
+    return i;
+}
+
+// Count-only scan used by the early gate (no storage).
+static bool has_export_macro_candidates(const char *source, int source_len) {
+    if (!source || source_len <= 0) {
+        return false;
+    }
+    int i = 0;
+    while (i < source_len) {
+        i = skip_non_code(source, source_len, i);
+        if (i >= source_len) {
+            break;
+        }
+        if (!is_identifier_start(source[i])) {
+            i++;
+            continue;
+        }
+        int start = i;
+        while (i < source_len && is_identifier_char(source[i])) {
+            i++;
+        }
+        // A raw-string prefix consumes everything up to its closing quote;
+        // an unrecognizable raw form poisons the scan state, so fail toward
+        // NOT running the second pass (raw behavior preserved).
+        int raw = raw_string_after_prefix(source, source_len, start, i);
+        if (raw < 0) {
+            return false;
+        }
+        if (raw > 0) {
+            i = raw;
+            continue;
+        }
+        if (is_export_macro_shape(source + start, (size_t)(i - start))) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static int collect_export_macro_candidates(const char *source, int source_len,
+                                           char (*out)[CBM_EXPORT_MACRO_NAME_MAX], int max_out) {
+    if (!source || source_len <= 0 || !out || max_out <= 0) {
+        return 0;
+    }
+    int stored = 0;
+    int i = 0;
+    while (i < source_len) {
+        i = skip_non_code(source, source_len, i);
+        if (i >= source_len) {
+            break;
+        }
+        if (!is_identifier_start(source[i])) {
+            i++;
+            continue;
+        }
+        int start = i;
+        while (i < source_len && is_identifier_char(source[i])) {
+            i++;
+        }
+        // Raw string (see has_export_macro_candidates): skip its body, or stop
+        // collecting entirely when the form cannot be confidently recognized —
+        // continuing would mis-tokenize the rest of the file and could both
+        // mint phantom candidates and mask real ones (#1989 review).
+        int raw = raw_string_after_prefix(source, source_len, start, i);
+        if (raw < 0) {
+            break;
+        }
+        if (raw > 0) {
+            i = raw;
+            continue;
+        }
+        size_t len = (size_t)(i - start);
+        /* Length gate FIRST: the dedup below reads out[k][0..len] against rows
+         * of CBM_EXPORT_MACRO_NAME_MAX bytes — an over-long candidate must be
+         * rejected before any compare touches them. */
+        if (len >= CBM_EXPORT_MACRO_NAME_MAX) {
+            continue;
+        }
+        if (!is_export_macro_shape(source + start, len)) {
+            continue;
+        }
+        bool dup = false;
+        for (int k = 0; k < stored; k++) {
+            if (strncmp(out[k], source + start, len) == 0 && out[k][len] == '\0') {
+                dup = true;
+                break;
+            }
+        }
+        if (dup) {
+            continue;
+        }
+        if (stored >= max_out) {
+            break; // bounded: stop collecting once the cap is reached
+        }
+        memcpy(out[stored], source + start, len);
+        out[stored][len] = '\0';
+        stored++;
+    }
+    return stored;
+}
+
+int cbm_export_macro_candidates(const char *source, int source_len,
+                                char (*out)[CBM_EXPORT_MACRO_NAME_MAX], int max_out) {
+    return collect_export_macro_candidates(source, source_len, out, max_out);
+}
+
 static int count_expanded_lines(const std::string &text) {
     int count = 1;
     for (char c : text) {
@@ -146,7 +423,11 @@ static bool build_line_map(const std::string &expanded, const std::string &main_
 CBMPreprocessedSource *cbm_preprocess_with_map(const char *source, int source_len,
                                                const char *filename, const char **extra_defines,
                                                const char **include_paths, int cpp_mode) {
-    if (!has_preprocessor_work(source, source_len)) {
+    // Run the second pass when there are directives to evaluate OR when the file
+    // carries export-macro-shaped identifiers to predefine empty (#1989) — a UE
+    // plugin header with only `#pragma once` + `#include` lines still needs it.
+    if (!has_preprocessor_work(source, source_len) &&
+        !has_export_macro_candidates(source, source_len)) {
         return NULL; // NULL = no expansion needed, use original
     }
 
@@ -156,6 +437,28 @@ CBMPreprocessedSource *cbm_preprocess_with_map(const char *source, int source_le
             for (int i = 0; extra_defines[i]; i++)
                 dui.defines.push_back(extra_defines[i]);
         }
+        // Predefine collected export-macro candidates as empty, mirroring the
+        // real compile command line (`/D "MODULE_API="`). Names already provided
+        // by the caller win — never override an explicit define.
+        char export_cands[CBM_EXPORT_MACRO_MAX][CBM_EXPORT_MACRO_NAME_MAX];
+        int export_cand_count =
+            collect_export_macro_candidates(source, source_len, export_cands, CBM_EXPORT_MACRO_MAX);
+        for (int i = 0; i < export_cand_count; i++) {
+            bool provided = false;
+            for (std::list<std::string>::const_iterator it = dui.defines.begin();
+                 it != dui.defines.end(); ++it) {
+                const std::string &def = *it;
+                size_t eq = def.find('=');
+                std::string name = (eq == std::string::npos) ? def : def.substr(0, eq);
+                if (name == export_cands[i]) {
+                    provided = true;
+                    break;
+                }
+            }
+            if (!provided) {
+                dui.defines.push_back(std::string(export_cands[i]) + "=");
+            }
+        }
         if (include_paths) {
             for (int i = 0; include_paths[i]; i++)
                 dui.includePaths.push_back(include_paths[i]);
diff --git a/internal/cbm/preprocessor.h b/internal/cbm/preprocessor.h
index 72828c012..1b108b335 100644
--- a/internal/cbm/preprocessor.h
+++ b/internal/cbm/preprocessor.h
@@ -4,6 +4,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+/* #1989: build-system export macros (UE "<MOD>_API", CMake generate_export_header
+ * "<lib>_EXPORT", ...) are defined empty on the real compile command line but are
+ * invisible to tree-sitter, so `class MOD_API Foo` misparses with the macro token
+ * as the type name. The preprocessed second pass predefines the conventional
+ * export-macro-shaped identifiers found in a source file as empty, mirroring the
+ * real build line. The candidate list is bounded. */
+#define CBM_EXPORT_MACRO_MAX 32
+#define CBM_EXPORT_MACRO_NAME_MAX 96
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -15,6 +24,12 @@ typedef struct {
     int expanded_line_count;
 } CBMPreprocessedSource;
 
+// Collect conventional export-macro-shaped identifiers (ALL_CAPS ending in
+// _API/_EXPORT/_IMPORT/_DLLEXPORT/_DEPRECATED) from the source, up to max_out
+// unique names. Returns the number of names stored in out.
+int cbm_export_macro_candidates(const char *source, int source_len,
+                                char (*out)[CBM_EXPORT_MACRO_NAME_MAX], int max_out);
+
 // Preprocess C/C++ source: expand macros, evaluate #ifdef, resolve #include.
 // Returns malloc-allocated expanded source, or NULL if no expansion needed/on failure.
 // extra_defines: NULL-terminated array of "NAME=VALUE" strings (can be NULL).
diff --git a/internal/cbm/result_compact.c b/internal/cbm/result_compact.c
new file mode 100644
index 000000000..d237b2a17
--- /dev/null
+++ b/internal/cbm/result_compact.c
@@ -0,0 +1,534 @@
+/*
+ * result_compact.c — copy a finished CBMFileResult into one exact-size arena.
+ *
+ * Why this exists (Go corpus census, 2026-09-13): extraction writes every
+ * temporary into the result arena — cbm_node_text copies at 496 call sites,
+ * per-node QN sprintf, enclosing-QN strings — and GROW_ARRAY leaves each
+ * previous generation of every record array dead behind it. 14.8 GB written,
+ * 3.4 GB reachable, and all of it retained until after resolve because the
+ * result owned the arena. Compaction walks what is reachable, measures it,
+ * copies it into a single block of exactly that size (strings interned by
+ * content within the file), and destroys the working arena.
+ *
+ * Three passes over one traversal:
+ *   COUNT   — number of string references, to size the intern table
+ *   MEASURE — bytes every allocation will take (aligned like the arena does)
+ *   COPY    — the same allocations, for real, into the fresh arena
+ * MEASURE and COPY issue identical allocation sequences, so the block fits
+ * exactly; any failure leaves the result untouched.
+ */
+
+#include "cbm.h"
+#include "foundation/arena.h"
+#include "foundation/compat.h" /* CBM_TLS */
+#include "foundation/constants.h"
+#include "foundation/mem_core.h"
+#include "result_spill.h" /* cbm_result_relocate */
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <string.h>
+
+enum { CR_ALIGN = 7, CR_MIN_TABLE = 64, CR_TABLE_LOAD = 2 };
+
+typedef enum { CR_COUNT = 0, CR_MEASURE, CR_COPY, CR_RELOCATE } cr_phase_t;
+
+typedef struct {
+    const char *src; /* NULL = empty slot */
+    char *dst;       /* copy in the new arena; NULL until COPY reaches it */
+    uint64_t hash;
+    size_t len; /* strlen(src) */
+} cr_slot_t;
+
+typedef struct {
+    cr_phase_t phase;
+    size_t refs;   /* COUNT: string references seen */
+    size_t bytes;  /* MEASURE: total arena bytes */
+    CBMArena *dst; /* COPY: the fresh arena */
+    bool failed;
+    cr_slot_t *slots;
+    size_t cap; /* power of two */
+    /* MEASURE records which slot each string reference landed in; COPY, which
+     * presents the very same references in the same order, replays them
+     * instead of measuring, hashing and comparing every string a second time
+     * (20 M repeated strlen + 31 M memcmp on the Go corpus, waste sanitizer
+     * 2026-09-17). */
+    uint32_t *seq;
+    size_t seq_len;
+    size_t seq_pos;
+    /* RELOCATE: pointers in [old_base, old_base + old_len) move by delta. */
+    const char *old_base;
+    size_t old_len;
+    ptrdiff_t delta;
+} cr_ctx_t;
+
+static bool cr_in_old_block(const cr_ctx_t *c, const void *p) {
+    const char *cp = (const char *)p;
+    return cp >= c->old_base && cp < c->old_base + c->old_len;
+}
+
+static size_t cr_aligned(size_t n) {
+    return (n + CR_ALIGN) & ~(size_t)CR_ALIGN;
+}
+
+static uint64_t cr_hash(const char *s, size_t len) {
+    uint64_t h = 1469598103934665603ULL;
+    for (size_t i = 0; i < len; i++) {
+        h ^= (unsigned char)s[i];
+        h *= 1099511628211ULL;
+    }
+    return h;
+}
+
+/* Find or insert the slot for s. Never fails: the table is sized from COUNT
+ * at half load, and the same references are presented again in COPY. */
+static cr_slot_t *cr_slot(cr_ctx_t *c, const char *s) {
+    size_t len = strlen(s);
+    uint64_t h = cr_hash(s, len);
+    size_t mask = c->cap - SKIP_ONE;
+    size_t i = (size_t)h & mask;
+    for (;;) {
+        cr_slot_t *slot = &c->slots[i];
+        if (!slot->src) {
+            slot->src = s;
+            slot->hash = h;
+            slot->len = len;
+            slot->dst = NULL;
+            return slot;
+        }
+        if (slot->hash == h && slot->len == len &&
+            (slot->src == s || memcmp(slot->src, s, len) == 0)) {
+            return slot;
+        }
+        i = (i + SKIP_ONE) & mask;
+    }
+}
+
+/* A raw allocation of `bytes` in the new arena: MEASURE books it, COPY makes
+ * it. Zero bytes is no allocation (the arena returns NULL for it too). */
+static void *cr_alloc(cr_ctx_t *c, size_t bytes) {
+    if (bytes == 0) {
+        return NULL;
+    }
+    if (c->phase == CR_MEASURE) {
+        c->bytes += cr_aligned(bytes);
+        return NULL;
+    }
+    if (c->phase == CR_COPY) {
+        void *p = cbm_arena_alloc(c->dst, bytes);
+        if (!p) {
+            c->failed = true;
+        }
+        return p;
+    }
+    return NULL;
+}
+
+/* A string field: interned by content. COPY rewrites the field. */
+static void cr_str(cr_ctx_t *c, const char **field) {
+    const char *s = *field;
+    if (!s) {
+        return;
+    }
+    if (c->phase == CR_RELOCATE) {
+        if (cr_in_old_block(c, s)) {
+            *field = s + c->delta;
+        }
+        return;
+    }
+    if (c->phase == CR_COUNT) {
+        c->refs++;
+        return;
+    }
+    cr_slot_t *slot;
+    if (c->phase == CR_COPY && c->seq && c->seq_pos < c->seq_len) {
+        slot = &c->slots[c->seq[c->seq_pos++]];
+    } else {
+        slot = cr_slot(c, s);
+    }
+    if (c->phase == CR_MEASURE) {
+        if (c->seq && c->seq_len < c->refs) {
+            c->seq[c->seq_len++] = (uint32_t)(slot - c->slots);
+        }
+        if (!slot->dst) {
+            slot->dst = (char *)s; /* mark as booked; reset before COPY */
+            c->bytes += cr_aligned(slot->len + SKIP_ONE);
+        }
+        return;
+    }
+    if (!slot->dst) {
+        char *copy = (char *)cr_alloc(c, slot->len + SKIP_ONE);
+        if (!copy) {
+            return;
+        }
+        memcpy(copy, slot->src, slot->len + SKIP_ONE);
+        slot->dst = copy;
+    }
+    *field = slot->dst;
+}
+
+/* A blob (fingerprint, retained source): copied verbatim. */
+static void cr_blob(cr_ctx_t *c, const void **field, size_t bytes) {
+    if (!*field || bytes == 0) {
+        return;
+    }
+    if (c->phase == CR_RELOCATE) {
+        if (cr_in_old_block(c, *field)) {
+            *field = (const char *)*field + c->delta;
+        }
+        return;
+    }
+    if (c->phase == CR_COPY) {
+        void *copy = cr_alloc(c, bytes);
+        if (!copy) {
+            return;
+        }
+        memcpy(copy, *field, bytes);
+        *field = copy;
+    } else {
+        (void)cr_alloc(c, bytes);
+    }
+}
+
+/* A record array: copied at exact count, then the caller walks its fields. */
+static void cr_array(cr_ctx_t *c, void **items, int count, size_t elem) {
+    if (!*items || count <= 0) {
+        if (c->phase == CR_COPY) {
+            *items = NULL;
+        }
+        return;
+    }
+    if (c->phase == CR_RELOCATE) {
+        if (cr_in_old_block(c, *items)) {
+            *items = (char *)*items + c->delta;
+        }
+        return;
+    }
+    cr_blob(c, (const void **)items, (size_t)count * elem);
+}
+
+/* A NULL-terminated list of strings: the pointer array plus each string. */
+static void cr_list(cr_ctx_t *c, const char ***field) {
+    const char **list = *field;
+    if (!list) {
+        return;
+    }
+    int n = 0;
+    if (c->phase == CR_RELOCATE) {
+        /* The array may live in a block we can no longer read at its old
+         * address: relocate the pointer first, then count and walk it. */
+        cr_blob(c, (const void **)field, sizeof(char *));
+        list = *field;
+        while (list[n]) {
+            n++;
+        }
+        for (int i = 0; i < n; i++) {
+            cr_str(c, &list[i]);
+        }
+        return;
+    }
+    while (list[n]) {
+        n++;
+    }
+    cr_blob(c, (const void **)field, (size_t)(n + SKIP_ONE) * sizeof(char *));
+    const char **walk = *field; /* the copy in COPY, the original otherwise */
+    for (int i = 0; i < n && walk; i++) {
+        cr_str(c, &walk[i]);
+    }
+}
+
+/* A counted list of strings (signature_param_types). */
+static void cr_counted_list(cr_ctx_t *c, const char ***field, int count) {
+    if (!*field || count <= 0) {
+        return;
+    }
+    cr_blob(c, (const void **)field, (size_t)count * sizeof(char *));
+    /* (RELOCATE: the pointer moved; the walk below now reads the new array.) */
+    const char **walk = *field;
+    for (int i = 0; i < count && walk; i++) {
+        cr_str(c, &walk[i]);
+    }
+}
+
+static void cr_walk_def(cr_ctx_t *c, CBMDefinition *d) {
+    cr_str(c, &d->name);
+    cr_str(c, &d->qualified_name);
+    cr_str(c, &d->label);
+    cr_str(c, &d->file_path);
+    cr_str(c, &d->signature);
+    cr_str(c, &d->return_type);
+    cr_str(c, &d->receiver);
+    cr_str(c, &d->docstring);
+    cr_str(c, &d->parent_class);
+    cr_list(c, &d->decorators);
+    cr_list(c, &d->base_classes);
+    cr_list(c, &d->param_names);
+    cr_list(c, &d->param_types);
+    cr_counted_list(c, &d->signature_param_types, d->signature_param_count);
+    cr_list(c, &d->return_types);
+    cr_str(c, &d->route_path);
+    cr_str(c, &d->route_method);
+    cr_blob(c, (const void **)&d->fingerprint,
+            d->fingerprint_k > 0 ? (size_t)d->fingerprint_k * sizeof(uint32_t) : 0);
+    cr_str(c, &d->structural_profile);
+    cr_str(c, &d->body_tokens);
+    cr_str(c, &d->impl_trait);
+}
+
+static void cr_walk_call(cr_ctx_t *c, CBMCall *call) {
+    cr_str(c, &call->callee_name);
+    cr_str(c, &call->enclosing_func_qn);
+    cr_str(c, &call->first_string_arg);
+    cr_str(c, &call->second_arg_name);
+    int argc = call->arg_count;
+    if (argc > CBM_MAX_CALL_ARGS) {
+        argc = CBM_MAX_CALL_ARGS;
+    }
+    if (call->args && argc > 0) {
+        cr_array(c, (void **)&call->args, argc, sizeof(CBMCallArg));
+        for (int i = 0; i < argc && call->args; i++) {
+            cr_str(c, &call->args[i].expr);
+            cr_str(c, &call->args[i].value);
+            cr_str(c, &call->args[i].keyword);
+        }
+    } else if (c->phase == CR_COPY) {
+        call->args = NULL;
+        call->arg_count = 0;
+    }
+}
+
+static void cr_walk(cr_ctx_t *c, CBMFileResult *r) {
+    cr_array(c, (void **)&r->defs.items, r->defs.count, sizeof(CBMDefinition));
+    for (int i = 0; i < r->defs.count && r->defs.items; i++) {
+        cr_walk_def(c, &r->defs.items[i]);
+    }
+    cr_array(c, (void **)&r->calls.items, r->calls.count, sizeof(CBMCall));
+    for (int i = 0; i < r->calls.count && r->calls.items; i++) {
+        cr_walk_call(c, &r->calls.items[i]);
+    }
+    cr_array(c, (void **)&r->imports.items, r->imports.count, sizeof(CBMImport));
+    for (int i = 0; i < r->imports.count && r->imports.items; i++) {
+        cr_str(c, &r->imports.items[i].local_name);
+        cr_str(c, &r->imports.items[i].module_path);
+    }
+    cr_array(c, (void **)&r->usages.items, r->usages.count, sizeof(CBMUsage));
+    for (int i = 0; i < r->usages.count && r->usages.items; i++) {
+        cr_str(c, &r->usages.items[i].ref_name);
+        cr_str(c, &r->usages.items[i].enclosing_func_qn);
+    }
+    cr_array(c, (void **)&r->throws.items, r->throws.count, sizeof(CBMThrow));
+    for (int i = 0; i < r->throws.count && r->throws.items; i++) {
+        cr_str(c, &r->throws.items[i].exception_name);
+        cr_str(c, &r->throws.items[i].enclosing_func_qn);
+    }
+    cr_array(c, (void **)&r->rw.items, r->rw.count, sizeof(CBMReadWrite));
+    for (int i = 0; i < r->rw.count && r->rw.items; i++) {
+        cr_str(c, &r->rw.items[i].var_name);
+        cr_str(c, &r->rw.items[i].enclosing_func_qn);
+    }
+    cr_array(c, (void **)&r->type_refs.items, r->type_refs.count, sizeof(CBMTypeRef));
+    for (int i = 0; i < r->type_refs.count && r->type_refs.items; i++) {
+        cr_str(c, &r->type_refs.items[i].type_name);
+        cr_str(c, &r->type_refs.items[i].enclosing_func_qn);
+    }
+    cr_array(c, (void **)&r->env_accesses.items, r->env_accesses.count, sizeof(CBMEnvAccess));
+    for (int i = 0; i < r->env_accesses.count && r->env_accesses.items; i++) {
+        cr_str(c, &r->env_accesses.items[i].env_key);
+        cr_str(c, &r->env_accesses.items[i].enclosing_func_qn);
+    }
+    cr_array(c, (void **)&r->type_assigns.items, r->type_assigns.count, sizeof(CBMTypeAssign));
+    for (int i = 0; i < r->type_assigns.count && r->type_assigns.items; i++) {
+        cr_str(c, &r->type_assigns.items[i].var_name);
+        cr_str(c, &r->type_assigns.items[i].type_name);
+        cr_str(c, &r->type_assigns.items[i].enclosing_func_qn);
+    }
+    cr_array(c, (void **)&r->impl_traits.items, r->impl_traits.count, sizeof(CBMImplTrait));
+    for (int i = 0; i < r->impl_traits.count && r->impl_traits.items; i++) {
+        cr_str(c, &r->impl_traits.items[i].trait_name);
+        cr_str(c, &r->impl_traits.items[i].struct_name);
+        cr_str(c, &r->impl_traits.items[i].struct_qn);
+    }
+    cr_array(c, (void **)&r->resolved_calls.items, r->resolved_calls.count,
+             sizeof(CBMResolvedCall));
+    for (int i = 0; i < r->resolved_calls.count && r->resolved_calls.items; i++) {
+        cr_str(c, &r->resolved_calls.items[i].caller_qn);
+        cr_str(c, &r->resolved_calls.items[i].callee_qn);
+        cr_str(c, &r->resolved_calls.items[i].strategy);
+        cr_str(c, &r->resolved_calls.items[i].reason);
+    }
+    cr_array(c, (void **)&r->string_refs.items, r->string_refs.count, sizeof(CBMStringRef));
+    for (int i = 0; i < r->string_refs.count && r->string_refs.items; i++) {
+        cr_str(c, &r->string_refs.items[i].value);
+        cr_str(c, &r->string_refs.items[i].enclosing_func_qn);
+        cr_str(c, &r->string_refs.items[i].key_path);
+    }
+    cr_array(c, (void **)&r->infra_bindings.items, r->infra_bindings.count,
+             sizeof(CBMInfraBinding));
+    for (int i = 0; i < r->infra_bindings.count && r->infra_bindings.items; i++) {
+        cr_str(c, &r->infra_bindings.items[i].source_name);
+        cr_str(c, &r->infra_bindings.items[i].target_url);
+        cr_str(c, &r->infra_bindings.items[i].broker);
+    }
+    cr_array(c, (void **)&r->channels.items, r->channels.count, sizeof(CBMChannel));
+    for (int i = 0; i < r->channels.count && r->channels.items; i++) {
+        cr_str(c, &r->channels.items[i].channel_name);
+        cr_str(c, &r->channels.items[i].transport);
+        cr_str(c, &r->channels.items[i].enclosing_func_qn);
+    }
+    cr_str(c, &r->module_qn);
+    cr_str(c, &r->namespace_name);
+    cr_list(c, &r->exports);
+    cr_list(c, &r->constants);
+    cr_list(c, &r->global_vars);
+    cr_list(c, &r->macros);
+    cr_str(c, &r->error_msg);
+    cr_str(c, &r->error_ranges);
+    cr_blob(c, (const void **)&r->source, r->source ? (size_t)r->source_len + SKIP_ONE : 0);
+}
+
+void cbm_result_relocate(CBMFileResult *result, const char *old_base, size_t len, char *new_base) {
+    if (!result || !old_base || !new_base || len == 0 || old_base == new_base) {
+        return;
+    }
+    cr_ctx_t c;
+    memset(&c, 0, sizeof(c));
+    c.phase = CR_RELOCATE;
+    c.old_base = old_base;
+    c.old_len = len;
+    c.delta = new_base - old_base;
+    cr_walk(&c, result);
+}
+
+static size_t cr_pow2_at_least(size_t n) {
+    size_t cap = CR_MIN_TABLE;
+    while (cap < n) {
+        cap *= PAIR_LEN;
+    }
+    return cap;
+}
+
+/* The intern table and the replay sequence, kept per pipeline worker: a fresh
+ * zeroed table per file was 21,875 allocations and 2.0 GB of pure churn on the
+ * Go corpus (waste sanitizer, 2026-09-17). Kept only on threads whose
+ * cbm_work_arena_release is guaranteed to run (cbm_work_arena_keeping), and
+ * only up to CR_KEEP_BYTES; anything else allocates per call as before. */
+enum { CR_KEEP_BYTES = 8 * 1024 * 1024 };
+static CBM_TLS void *tl_cr_buf;
+static CBM_TLS size_t tl_cr_bytes;
+
+void cbm_result_compact_release_thread(void) {
+    cbm_free(CBM_MEM_CLASS_EXTRACT, tl_cr_buf);
+    tl_cr_buf = NULL;
+    tl_cr_bytes = 0;
+}
+
+/* One zeroed block holding the slot table followed by the sequence. Returns
+ * whether the block is the kept one (then the caller must not free it). */
+static bool cr_scratch_get(cr_ctx_t *c) {
+    size_t slot_bytes = c->cap * sizeof(cr_slot_t);
+    size_t bytes = slot_bytes + (c->refs * sizeof(uint32_t));
+    bool keep = bytes <= (size_t)CR_KEEP_BYTES && cbm_work_arena_keeping();
+    void *buf = NULL;
+    if (keep && tl_cr_buf && tl_cr_bytes >= bytes) {
+        buf = tl_cr_buf;
+    } else if (keep) {
+        size_t grown = CR_MIN_TABLE; /* powers of two: a growing file mix reallocates rarely */
+        while (grown < bytes) {
+            grown *= PAIR_LEN;
+        }
+        if (grown > (size_t)CR_KEEP_BYTES) {
+            grown = bytes;
+        }
+        cbm_result_compact_release_thread();
+        tl_cr_buf = cbm_alloc(CBM_MEM_CLASS_EXTRACT, grown);
+        tl_cr_bytes = tl_cr_buf ? grown : 0;
+        buf = tl_cr_buf;
+    } else {
+        buf = cbm_alloc(CBM_MEM_CLASS_EXTRACT, bytes);
+    }
+    if (!buf) {
+        return false;
+    }
+    memset(
+        buf, 0,
+        slot_bytes); /* MEASURE needs an empty table; the sequence is written before it is read */
+    c->slots = (cr_slot_t *)buf;
+    c->seq = c->refs ? (uint32_t *)((char *)buf + slot_bytes) : NULL;
+    return true;
+}
+
+static void cr_scratch_put(cr_ctx_t *c) {
+    if ((void *)c->slots != tl_cr_buf) {
+        cbm_free(CBM_MEM_CLASS_EXTRACT, c->slots);
+    }
+    c->slots = NULL;
+    c->seq = NULL;
+}
+
+void cbm_result_compact(CBMFileResult *result) {
+    if (!result || result->arena.nblocks == 0) {
+        return;
+    }
+    cr_ctx_t c;
+    memset(&c, 0, sizeof(c));
+
+    /* Work on a copy of the header: every pointer rewrite lands here and the
+     * caller's result is replaced only once everything succeeded. */
+    CBMFileResult tmp = *result;
+
+    c.phase = CR_COUNT;
+    cr_walk(&c, &tmp);
+
+    c.cap = cr_pow2_at_least(c.refs * CR_TABLE_LOAD + CR_MIN_TABLE);
+    if (!cr_scratch_get(&c)) {
+        return;
+    }
+
+    c.phase = CR_MEASURE;
+    cr_walk(&c, &tmp);
+    for (size_t i = 0; i < c.cap; i++) {
+        c.slots[i].dst = NULL; /* MEASURE used dst as a booked marker */
+    }
+
+    CBMArena fresh;
+    cbm_arena_init_exact(&fresh, c.bytes);
+    if (fresh.nblocks == 0) {
+        cr_scratch_put(&c);
+        return;
+    }
+
+    c.phase = CR_COPY;
+    c.dst = &fresh;
+    cr_walk(&c, &tmp);
+    cr_scratch_put(&c);
+    if (c.failed) {
+        cbm_arena_destroy(&fresh);
+        return;
+    }
+
+    /* Exact-count arrays: nothing may append into the dead headroom. */
+    tmp.defs.cap = tmp.defs.count;
+    tmp.calls.cap = tmp.calls.count;
+    tmp.imports.cap = tmp.imports.count;
+    tmp.usages.cap = tmp.usages.count;
+    tmp.throws.cap = tmp.throws.count;
+    tmp.rw.cap = tmp.rw.count;
+    tmp.type_refs.cap = tmp.type_refs.count;
+    tmp.env_accesses.cap = tmp.env_accesses.count;
+    tmp.type_assigns.cap = tmp.type_assigns.count;
+    tmp.impl_traits.cap = tmp.impl_traits.count;
+    tmp.resolved_calls.cap = tmp.resolved_calls.count;
+    tmp.string_refs.cap = tmp.string_refs.count;
+    tmp.infra_bindings.cap = tmp.infra_bindings.count;
+    tmp.channels.cap = tmp.channels.count;
+
+    /* A composite kept its per-unit results only so shallow-copied strings
+     * stayed valid; every string is now a copy of its own. */
+    cbm_result_release_owned(result);
+    tmp.owned_results = NULL;
+    tmp.owned_result_count = 0;
+
+    cbm_work_arena_give(&result->arena); /* kept for this thread's next file */
+    tmp.arena = fresh;
+    *result = tmp;
+}
diff --git a/internal/cbm/result_spill.c b/internal/cbm/result_spill.c
new file mode 100644
index 000000000..852421632
--- /dev/null
+++ b/internal/cbm/result_spill.c
@@ -0,0 +1,410 @@
+/*
+ * result_spill.c — see result_spill.h.
+ *
+ * Layout on disk, per parked result:
+ *   spill_rec_hdr_t  (magic, block length, block base address at park time,
+ *                     the CBMFileResult header as it was in memory)
+ *   block bytes      (the single compacted arena block)
+ *
+ * The header's pointers are meaningless on disk; the loader rebuilds the
+ * arena at a new address and shifts every pointer by the delta
+ * (cbm_result_relocate, implemented on the compaction traversal so it sees
+ * exactly the fields compaction copied).
+ */
+
+#include "result_spill.h"
+
+#include "foundation/arena.h"
+#include "foundation/compat_fs.h"
+#include "foundation/compat_thread.h"
+#include "foundation/constants.h"
+#include "foundation/log.h"
+#include "foundation/mem_core.h"
+#include "foundation/platform.h" /* cbm_fs_free_bytes: the disk ceiling below */
+
+/* The park writes a result as an opaque image: the record header (a struct
+ * copy) and the compacted arena block. Both carry padding bytes no code ever
+ * wrote -- inside structs, between objects -- and MemorySanitizer tracks
+ * that mark through the compaction's memcpy, so it refuses the fwrite of an
+ * image that is read back whole and never interpreted byte by byte (CI MSan
+ * lane on #2202: offset 4087, then 6714, of a 6,952-byte block). Under MSan
+ * the image is declared defined right before the write; every other build
+ * compiles this to nothing. */
+#include "foundation/sanitized.h" /* __has_feature exists everywhere, cppcheck included */
+#if __has_feature(memory_sanitizer)
+#include <sanitizer/msan_interface.h>
+#define SPILL_IMAGE_DEFINED(p, n) __msan_unpoison((p), (n))
+#else
+#define SPILL_IMAGE_DEFINED(p, n) ((void)0)
+#endif
+
+#include <stdatomic.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#ifdef _WIN32
+#include <process.h>
+#define SPILL_PID() ((long)_getpid())
+#define SPILL_SEEK(fp, off) _fseeki64((fp), (long long)(off), SEEK_SET)
+#else
+#include <unistd.h>
+#define SPILL_PID() ((long)getpid())
+#define SPILL_SEEK(fp, off) fseeko((fp), (off_t)(off), SEEK_SET)
+#endif
+
+static const uint64_t SPILL_MAGIC = 0x5350494C4C524553ULL; /* "SPILLRES" */
+
+typedef struct {
+    uint64_t magic;
+    uint64_t block_len;
+    uint64_t old_base; /* (uintptr_t) of the block when parked */
+    CBMFileResult header;
+} spill_rec_hdr_t;
+
+typedef struct {
+    FILE *fp;
+    cbm_mutex_t mu; /* reads seek; writes append -- one lock per file */
+    char path[CBM_SZ_1K];
+    uint64_t end;  /* bytes written so far (append offset) */
+    bool unlinked; /* already removed while open (POSIX); close must not retry */
+} spill_file_t;
+
+typedef struct {
+    int writer;       /* -1 = empty */
+    uint64_t offset;  /* record start in that writer's file */
+    uint64_t rec_len; /* header + block */
+    /* The file's namespace/package, kept in MEMORY while the result itself is
+     * on disk. The namespace map that import resolution is built on is
+     * assembled from every file at once, before any of them is reloaded: a
+     * parked file used to contribute nothing to it, so spilling silently
+     * changed how imports resolved (see cbm_result_spill_namespace). One short
+     * string per parked file is a rounding error against the result it
+     * replaces. */
+    char *namespace_name;
+} spill_slot_t;
+
+struct cbm_result_spill {
+    spill_file_t *files;
+    int writers;
+    spill_slot_t *slots;
+    int slot_count;
+    _Atomic int64_t parked;
+    _Atomic int64_t bytes;
+    _Atomic int64_t loads;
+    int64_t byte_cap;         /* 0 = uncapped (the platform could not say) */
+    _Atomic int cap_reported; /* reaching the cap is logged once, not per park */
+};
+
+/* Spilling trades a memory problem for a disk problem, so the disk gets a say.
+ *
+ * FLOOR: below this much free space, do not start spilling at all — filling the
+ * user's disk is a worse failure than the memory pressure being relieved, since
+ * it breaks everything else on the machine and not just this index.
+ * SHARE: of what IS free, never take more than this fraction, so a runaway
+ * index cannot consume the rest either.
+ * Free space is read once, at open: it is this run's budget, not a moving
+ * target to race against, and a failed write stays handled underneath. */
+enum { SPILL_FREE_FLOOR_GB = 10, SPILL_FREE_SHARE_DIV = 2 };
+
+/* Remove spill files left by runs that are no longer here. Only files this
+ * module names (spill-<pid>-<writer>.bin) are touched, and on Windows an open
+ * file refuses deletion, which is exactly the liveness check we want: a running
+ * index keeps its own spill. POSIX runs unlink at open, so this only ever finds
+ * files from before that behaviour, or from another platform's cache. */
+static void spill_sweep_orphans(const char *spill_dir) {
+    cbm_dir_t *dir = cbm_opendir(spill_dir);
+    if (!dir) {
+        return;
+    }
+    int removed = 0;
+    cbm_dirent_t *entry;
+    while ((entry = cbm_readdir(dir)) != NULL) {
+        if (strncmp(entry->name, "spill-", 6) != 0) {
+            continue;
+        }
+        size_t len = strlen(entry->name);
+        if (len < 5 || strcmp(entry->name + len - 4, ".bin") != 0) {
+            continue;
+        }
+        char path[CBM_SZ_1K];
+        if (snprintf(path, sizeof(path), "%s/%s", spill_dir, entry->name) >= (int)sizeof(path)) {
+            continue;
+        }
+        if (cbm_unlink(path) == 0) {
+            removed++;
+        }
+    }
+    cbm_closedir(dir);
+    if (removed > 0) {
+        char removed_text[CBM_SZ_16];
+        snprintf(removed_text, sizeof(removed_text), "%d", removed);
+        cbm_log_info("mem.spill.orphans_removed", "count", removed_text, "dir", spill_dir);
+    }
+}
+
+cbm_result_spill_t *cbm_result_spill_open(const char *dir, int writers, int slots) {
+    if (!dir || !dir[0] || writers <= 0 || slots <= 0) {
+        return NULL;
+    }
+    char spill_dir[CBM_SZ_1K];
+    if (snprintf(spill_dir, sizeof(spill_dir), "%s/spill", dir) >= (int)sizeof(spill_dir)) {
+        return NULL;
+    }
+    if (!cbm_mkdir_p(spill_dir, 0700)) {
+        cbm_log_warn("mem.spill.open_failed", "dir", spill_dir, "reason", "mkdir");
+        return NULL;
+    }
+    /* Reclaim what earlier runs could not. A run killed outright (OOM killer,
+     * SIGKILL, power loss) runs no cleanup, and on Windows its spill files
+     * survive; POSIX runs unlink-at-open below and leaves nothing. Deleting is
+     * the liveness test: an open file cannot be removed on Windows, so a
+     * concurrent run's spill refuses and is left alone. */
+    spill_sweep_orphans(spill_dir);
+    /* Ask the disk BEFORE trading memory for it. Refusing here leaves the
+     * caller in the memory path it was already in (back-pressure, then its own
+     * budget decision) — the same outcome as a disk that fills mid-run, minus
+     * the filled disk. */
+    size_t free_bytes = cbm_fs_free_bytes(spill_dir);
+    int64_t byte_cap = 0;
+    if (free_bytes > 0) {
+        size_t floor_bytes = (size_t)SPILL_FREE_FLOOR_GB * 1024 * 1024 * 1024;
+        if (free_bytes < floor_bytes) {
+            char free_mb[CBM_SZ_32];
+            snprintf(free_mb, sizeof(free_mb), "%zu", free_bytes / (1024 * 1024));
+            cbm_log_warn("mem.spill.refused", "reason", "low_disk", "free_mb", free_mb, "detail",
+                         "not spilling onto a nearly full disk; memory relief continues through "
+                         "back-pressure instead");
+            return NULL;
+        }
+        byte_cap = (int64_t)(free_bytes / SPILL_FREE_SHARE_DIV);
+    }
+    cbm_result_spill_t *sp = cbm_calloc(CBM_MEM_CLASS_OTHER, sizeof(*sp));
+    if (!sp) {
+        return NULL;
+    }
+    sp->files = cbm_calloc(CBM_MEM_CLASS_OTHER, (size_t)writers * sizeof(spill_file_t));
+    sp->slots = cbm_calloc(CBM_MEM_CLASS_OTHER, (size_t)slots * sizeof(spill_slot_t));
+    if (!sp->files || !sp->slots) {
+        cbm_result_spill_close(sp);
+        return NULL;
+    }
+    sp->writers = writers;
+    sp->slot_count = slots;
+    sp->byte_cap = byte_cap;
+    for (int i = 0; i < slots; i++) {
+        sp->slots[i].writer = -1;
+    }
+    for (int w = 0; w < writers; w++) {
+        spill_file_t *f = &sp->files[w];
+        snprintf(f->path, sizeof(f->path), "%s/spill-%ld-%d.bin", spill_dir, SPILL_PID(), w);
+        f->fp = cbm_fopen(f->path, "w+b");
+        if (!f->fp) {
+            cbm_log_warn("mem.spill.open_failed", "path", f->path, "reason", "fopen");
+            cbm_result_spill_close(sp);
+            return NULL;
+        }
+        cbm_mutex_init(&f->mu);
+#ifndef _WIN32
+        /* Unlink while we hold it open: the data stays reachable through this
+         * handle, and the space comes back the moment the process ends — a
+         * clean exit, an abort, or a SIGKILL from the OOM killer alike. A
+         * killed run cannot leave gigabytes of spill behind because there is no
+         * name left to leave it under. Windows refuses to unlink an open file,
+         * so it keeps the close-path unlink and the sweep below. */
+        if (cbm_unlink(f->path) == 0) {
+            f->unlinked = true;
+        }
+#endif
+    }
+    cbm_log_info("mem.spill.open", "dir", spill_dir, "writers", writers > 0 ? "yes" : "no");
+    return sp;
+}
+
+bool cbm_result_spill_has(const cbm_result_spill_t *sp, int slot) {
+    return sp && slot >= 0 && slot < sp->slot_count && sp->slots[slot].writer >= 0;
+}
+
+bool cbm_result_spill_park(cbm_result_spill_t *sp, int writer, int slot, CBMFileResult *result) {
+    if (!sp || !result || writer < 0 || writer >= sp->writers || slot < 0 ||
+        slot >= sp->slot_count || sp->slots[slot].writer >= 0) {
+        return false;
+    }
+    /* Only a compacted result is one block with every pointer inside it; a
+     * result that owns sub-results (embedded languages) has more arenas than
+     * that and stays in memory. A retained parse tree is a re-parse cache,
+     * not data: it is dropped with the in-memory result below. */
+    if (result->arena.nblocks != 1 || result->owned_result_count != 0) {
+        return false;
+    }
+    /* The disk ceiling. Refusing a park leaves the result in memory, which is
+     * exactly where it would be without spill at all — the caller's
+     * back-pressure and budget keep deciding from there. What this prevents is
+     * an index quietly consuming the rest of the user's free space. */
+    if (sp->byte_cap > 0) {
+        int64_t want = (int64_t)(sizeof(spill_rec_hdr_t) + result->arena.used);
+        if (atomic_load_explicit(&sp->bytes, memory_order_relaxed) + want > sp->byte_cap) {
+            if (atomic_exchange_explicit(&sp->cap_reported, 1, memory_order_relaxed) == 0) {
+                char cap_mb[CBM_SZ_32];
+                snprintf(cap_mb, sizeof(cap_mb), "%lld", (long long)(sp->byte_cap / (1024 * 1024)));
+                cbm_log_warn("mem.spill.cap_reached", "cap_mb", cap_mb, "detail",
+                             "spill is at its share of free disk; results stay in memory and "
+                             "back-pressure takes over");
+            }
+            return false;
+        }
+    }
+    spill_file_t *f = &sp->files[writer];
+    spill_rec_hdr_t hdr;
+    memset(&hdr, 0, sizeof(hdr));
+    hdr.magic = SPILL_MAGIC;
+    hdr.block_len = result->arena.used; /* bytes actually written into the block */
+    hdr.old_base = (uint64_t)(uintptr_t)result->arena.blocks[0];
+    hdr.header = *result;
+    hdr.header.cached_tree = NULL; /* never on disk: the loader gets no tree */
+    SPILL_IMAGE_DEFINED(&hdr, sizeof(hdr));
+    SPILL_IMAGE_DEFINED(result->arena.blocks[0], hdr.block_len);
+    cbm_mutex_lock(&f->mu);
+    uint64_t offset = f->end;
+    bool ok = SPILL_SEEK(f->fp, offset) == 0 && fwrite(&hdr, sizeof(hdr), 1, f->fp) == 1 &&
+              (hdr.block_len == 0 || fwrite(result->arena.blocks[0], hdr.block_len, 1, f->fp) == 1);
+    if (ok) {
+        f->end = offset + sizeof(hdr) + hdr.block_len;
+    }
+    cbm_mutex_unlock(&f->mu);
+    if (!ok) {
+        cbm_log_warn("mem.spill.write_failed", "path", f->path);
+        return false;
+    }
+    sp->slots[slot].writer = writer;
+    sp->slots[slot].offset = offset;
+    sp->slots[slot].rec_len = sizeof(hdr) + hdr.block_len;
+    /* Copied BEFORE the result is freed below: the namespace map is built from
+     * all files at once, long before this slot is loaded back. */
+    if (result->namespace_name && result->namespace_name[0]) {
+        sp->slots[slot].namespace_name =
+            cbm_mem_strdup(CBM_MEM_CLASS_OTHER, result->namespace_name);
+    }
+    atomic_fetch_add_explicit(&sp->parked, 1, memory_order_relaxed);
+    atomic_fetch_add_explicit(&sp->bytes, (int64_t)(sizeof(hdr) + hdr.block_len),
+                              memory_order_relaxed);
+    cbm_free_result(result);
+    return true;
+}
+
+CBMFileResult *cbm_result_spill_load(const cbm_result_spill_t *sp, int slot) {
+    if (!cbm_result_spill_has(sp, slot)) {
+        return NULL;
+    }
+    const spill_slot_t *s = &sp->slots[slot];
+    spill_file_t *f = &sp->files[s->writer];
+    spill_rec_hdr_t hdr;
+    cbm_mutex_lock(&f->mu);
+    bool ok = SPILL_SEEK(f->fp, s->offset) == 0 && fread(&hdr, sizeof(hdr), 1, f->fp) == 1 &&
+              hdr.magic == SPILL_MAGIC;
+    CBMFileResult *r = NULL;
+    if (ok) {
+        r = cbm_result_alloc();
+        if (r) {
+            *r = hdr.header;
+            r->cached_tree = NULL;
+            memset(&r->arena, 0, sizeof(r->arena));
+            cbm_arena_init_exact(&r->arena, hdr.block_len ? (size_t)hdr.block_len : 1);
+            if (r->arena.nblocks == 1 &&
+                (hdr.block_len == 0 ||
+                 fread(r->arena.blocks[0], (size_t)hdr.block_len, 1, f->fp) == 1)) {
+                r->arena.used = (size_t)hdr.block_len;
+                r->arena.total_alloc = (size_t)hdr.block_len;
+            } else {
+                ok = false;
+            }
+        } else {
+            ok = false;
+        }
+    }
+    cbm_mutex_unlock(&f->mu);
+    if (!ok) {
+        cbm_log_warn("mem.spill.read_failed", "path", f->path);
+        if (r) {
+            cbm_free_result(r);
+        }
+        return NULL;
+    }
+    cbm_result_relocate(r, (const char *)(uintptr_t)hdr.old_base, (size_t)hdr.block_len,
+                        r->arena.blocks[0]);
+    atomic_fetch_add_explicit((_Atomic int64_t *)&sp->loads, 1, memory_order_relaxed);
+    return r;
+}
+
+bool cbm_result_spill_peek_header(const cbm_result_spill_t *sp, int slot, CBMFileResult *out) {
+    if (!out || !cbm_result_spill_has(sp, slot)) {
+        return false;
+    }
+    const spill_slot_t *s = &sp->slots[slot];
+    spill_file_t *f = &sp->files[s->writer];
+    spill_rec_hdr_t hdr;
+    cbm_mutex_lock(&f->mu);
+    bool ok = SPILL_SEEK(f->fp, s->offset) == 0 && fread(&hdr, sizeof(hdr), 1, f->fp) == 1 &&
+              hdr.magic == SPILL_MAGIC;
+    cbm_mutex_unlock(&f->mu);
+    if (ok) {
+        *out = hdr.header;
+    }
+    return ok;
+}
+
+void cbm_result_spill_peek_counts(const cbm_result_spill_t *sp, int slot, int *defs, int *impls) {
+    CBMFileResult hdr;
+    bool ok = cbm_result_spill_peek_header(sp, slot, &hdr);
+    if (defs) {
+        *defs = ok ? hdr.defs.count : 0;
+    }
+    if (impls) {
+        *impls = ok ? hdr.impl_traits.count : 0;
+    }
+}
+
+void cbm_result_spill_stats(const cbm_result_spill_t *sp, int64_t *parked, int64_t *bytes,
+                            int64_t *loads) {
+    if (parked) {
+        *parked = sp ? atomic_load_explicit(&sp->parked, memory_order_relaxed) : 0;
+    }
+    if (bytes) {
+        *bytes = sp ? atomic_load_explicit(&sp->bytes, memory_order_relaxed) : 0;
+    }
+    if (loads) {
+        *loads = sp ? atomic_load_explicit(&sp->loads, memory_order_relaxed) : 0;
+    }
+}
+
+const char *cbm_result_spill_namespace(const cbm_result_spill_t *sp, int slot) {
+    if (!sp || !sp->slots || slot < 0 || slot >= sp->slot_count) {
+        return NULL;
+    }
+    return sp->slots[slot].namespace_name;
+}
+
+void cbm_result_spill_close(cbm_result_spill_t *sp) {
+    if (!sp) {
+        return;
+    }
+    if (sp->files) {
+        for (int w = 0; w < sp->writers; w++) {
+            spill_file_t *f = &sp->files[w];
+            if (f->fp) {
+                (void)fclose(f->fp);
+                if (!f->unlinked) { /* POSIX already removed it at open */
+                    (void)cbm_unlink(f->path);
+                }
+                cbm_mutex_destroy(&f->mu);
+            }
+        }
+        cbm_free(CBM_MEM_CLASS_OTHER, sp->files);
+    }
+    if (sp->slots) {
+        for (int i = 0; i < sp->slot_count; i++) {
+            cbm_free(CBM_MEM_CLASS_OTHER, sp->slots[i].namespace_name);
+        }
+    }
+    cbm_free(CBM_MEM_CLASS_OTHER, sp->slots);
+    cbm_free(CBM_MEM_CLASS_OTHER, sp);
+}
diff --git a/internal/cbm/result_spill.h b/internal/cbm/result_spill.h
new file mode 100644
index 000000000..75b7a3231
--- /dev/null
+++ b/internal/cbm/result_spill.h
@@ -0,0 +1,73 @@
+/*
+ * result_spill.h — per-file extraction results parked on disk when the
+ * memory budget is hit.
+ *
+ * A compacted CBMFileResult is one exact-size arena block plus a header whose
+ * pointers all point into that block (cbm_result_compact guarantees it). That
+ * makes a result a relocatable blob: written as header + block, read back at
+ * any address by shifting every pointer by the base delta. The store is one
+ * append-only file per writer thread under the cache directory; loads use
+ * pread and are safe from any thread. Nothing here decides WHEN to spill --
+ * the pipeline does, on the budget signal (see cbm_pipeline_ctx_t.spill).
+ */
+#ifndef CBM_RESULT_SPILL_H
+#define CBM_RESULT_SPILL_H
+
+#include "cbm.h"
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+typedef struct cbm_result_spill cbm_result_spill_t;
+
+/* One store for one pipeline run: `writers` append-only files under
+ * <dir>/spill-<pid>-<w>.bin, `slots` result slots (one per input file).
+ * NULL on failure (no directory, no space): the caller keeps results in
+ * memory as before. */
+cbm_result_spill_t *cbm_result_spill_open(const char *dir, int writers, int slots);
+
+/* Park a compacted result in slot `slot` via writer `writer`, then free the
+ * in-memory result (a retained parse tree goes with it; a loaded result has
+ * none). Returns false (and leaves the result untouched) when the result is
+ * not a single-block compaction, owns sub-results, or the write fails. */
+bool cbm_result_spill_park(cbm_result_spill_t *sp, int writer, int slot, CBMFileResult *result);
+
+/* True when slot `slot` holds a parked result. */
+bool cbm_result_spill_has(const cbm_result_spill_t *sp, int slot);
+
+/* Load slot `slot` back into memory: a fresh CBMFileResult the caller owns
+ * (cbm_free_result). NULL when the slot is empty or the read fails. Safe from
+ * several threads for different slots. */
+CBMFileResult *cbm_result_spill_load(const cbm_result_spill_t *sp, int slot);
+
+/* Read only the parked header of slot `slot` into *out: every count in it
+ * is valid, every pointer meaningless. False when the slot is empty or the
+ * read fails. Lets a consumer skip the load when there is nothing to read. */
+bool cbm_result_spill_peek_header(const cbm_result_spill_t *sp, int slot, CBMFileResult *out);
+
+/* Read only the parked header of slot `slot`: how many defs and impl
+ * relations it holds (the collector sizes its array before loading). */
+void cbm_result_spill_peek_counts(const cbm_result_spill_t *sp, int slot, int *defs, int *impls);
+
+/* The namespace/package a parked file declares, or NULL. Kept in MEMORY while
+ * the result itself is on disk, because import resolution builds its namespace
+ * map from EVERY file before any parked one is read back. Without it a spilled
+ * file contributed nothing to that map, so imports resolved differently
+ * depending on memory pressure -- php measured 57,182 edges in memory against
+ * 59,379 while spilling, the same binary, 2026-09-18. */
+const char *cbm_result_spill_namespace(const cbm_result_spill_t *sp, int slot);
+
+/* Counters for the log: results parked, bytes on disk, loads served. */
+void cbm_result_spill_stats(const cbm_result_spill_t *sp, int64_t *parked, int64_t *bytes,
+                            int64_t *loads);
+
+/* Close and delete the files. */
+void cbm_result_spill_close(cbm_result_spill_t *sp);
+
+/* Relocation primitive used by the loader: every pointer inside `result`
+ * that points into [old_base, old_base + len) is shifted to the block now at
+ * `new_base`. Exposed for tests. */
+void cbm_result_relocate(CBMFileResult *result, const char *old_base, size_t len, char *new_base);
+
+#endif /* CBM_RESULT_SPILL_H */
diff --git a/internal/cbm/service_patterns.c b/internal/cbm/service_patterns.c
index e3740f5aa..c2425e09e 100644
--- a/internal/cbm/service_patterns.c
+++ b/internal/cbm/service_patterns.c
@@ -140,6 +140,20 @@ static const lib_pattern_t http_libraries[] = {
     {"socket.http", CBM_SVC_HTTP, NULL},
     {"resty.http", CBM_SVC_HTTP, NULL},
 
+    /* Glued-name libraries. match_qn needs an identifier boundary around an
+     * id, so a library whose own name glues a lowercase prefix/suffix onto
+     * another id ("grequests", "curlpp") is listed explicitly: no boundary
+     * rule can tell "grequests" from "myrequests". */
+    {"grequests", CBM_SVC_HTTP, NULL},  /* Python: gevent + requests */
+    {"txrequests", CBM_SVC_HTTP, NULL}, /* Python: Twisted + requests */
+    {"redaxios", CBM_SVC_HTTP, NULL},   /* JS: axios-compatible fetch client */
+    {"gaxios", CBM_SVC_HTTP, NULL},     /* JS: Google's axios-style client */
+    {"libcurl", CBM_SVC_HTTP, NULL},    /* C, node-libcurl */
+    {"curlpp", CBM_SVC_HTTP, NULL},     /* C++ libcurl wrapper */
+    {"curlcpp", CBM_SVC_HTTP, NULL},    /* C++ libcurl wrapper */
+    {"hyperlocal", CBM_SVC_HTTP, NULL}, /* Rust: hyper over unix sockets */
+    {"guzzlehttp", CBM_SVC_HTTP, NULL}, /* PHP: Guzzle's composer vendor */
+
     {NULL, CBM_SVC_NONE, NULL},
 };
 
@@ -263,6 +277,33 @@ static const lib_pattern_t async_libraries[] = {
     {"dapr.clients.grpc", CBM_SVC_ASYNC, "dapr"},
     {"DaprClient", CBM_SVC_ASYNC, "dapr"},
 
+    /* Glued-name libraries (see the note in http_libraries). */
+    {"aiokafka", CBM_SVC_ASYNC, "kafka"},
+    {"pykafka", CBM_SVC_ASYNC, "kafka"},
+    {"librdkafka", CBM_SVC_ASYNC, "kafka"},
+    {"rdkafkacpp", CBM_SVC_ASYNC, "kafka"},
+    {"rskafka", CBM_SVC_ASYNC, "kafka"},
+    {"aioamqp", CBM_SVC_ASYNC, "rabbitmq"},
+    {"amqpstorm", CBM_SVC_ASYNC, "rabbitmq"},
+    {"pamqp", CBM_SVC_ASYNC, "rabbitmq"},
+    {"pyamqp", CBM_SVC_ASYNC, "rabbitmq"},
+    {"amqprs", CBM_SVC_ASYNC, "rabbitmq"},
+    {"amqpcpp", CBM_SVC_ASYNC, "rabbitmq"},
+    {"pynats", CBM_SVC_ASYNC, "nats"},
+    {"jnats", CBM_SVC_ASYNC, "nats"},
+    {"aiomqtt", CBM_SVC_ASYNC, "mqtt"},
+    {"amqtt", CBM_SVC_ASYNC, "mqtt"},
+    {"hbmqtt", CBM_SVC_ASYNC, "mqtt"},
+    {"umqtt", CBM_SVC_ASYNC, "mqtt"},
+    {"mqttools", CBM_SVC_ASYNC, "mqtt"},
+    {"emqtt", CBM_SVC_ASYNC, "mqtt"},
+    {"rumqtt", CBM_SVC_ASYNC, "mqtt"},
+    {"gomqtt", CBM_SVC_ASYNC, "mqtt"},
+    {"libmosquitto", CBM_SVC_ASYNC, "mqtt"},
+    {"mosquittopp", CBM_SVC_ASYNC, "mqtt"},
+    {"pubsublite", CBM_SVC_ASYNC, "pubsub"},
+    {"gocelery", CBM_SVC_ASYNC, "celery"},
+
     {NULL, CBM_SVC_NONE, NULL},
 };
 
@@ -308,6 +349,13 @@ static const lib_pattern_t config_libraries[] = {
     {"Application.get_env", CBM_SVC_CONFIG, NULL},
     {"Application.fetch_env", CBM_SVC_CONFIG, NULL},
 
+    /* Glued-name accessors (see the note in http_libraries). */
+    {"wgetenv", CBM_SVC_CONFIG, NULL},   /* Windows CRT: _wgetenv, _wgetenv_s */
+    {"getenvb", CBM_SVC_CONFIG, NULL},   /* Python: os.getenvb */
+    {"qgetenv", CBM_SVC_CONFIG, NULL},   /* Qt */
+    {"dotenvx", CBM_SVC_CONFIG, NULL},   /* JS: @dotenvx/dotenvx */
+    {"phpdotenv", CBM_SVC_CONFIG, NULL}, /* PHP: vlucas/phpdotenv */
+
     {NULL, CBM_SVC_NONE, NULL},
 };
 
@@ -377,6 +425,11 @@ static const lib_pattern_t route_reg_libraries[] = {
     {"akka.http.scaladsl.server", CBM_SVC_ROUTE_REG, NULL},
     {"play.api.routing", CBM_SVC_ROUTE_REG, NULL},
 
+    /* Glued-name frameworks (see the note in http_libraries). */
+    {"apiflask", CBM_SVC_ROUTE_REG, NULL},       /* Python: Flask-based */
+    {"honox", CBM_SVC_ROUTE_REG, NULL},          /* JS: Hono meta-framework */
+    {"fasthttprouter", CBM_SVC_ROUTE_REG, NULL}, /* Go: httprouter for fasthttp */
+
     {NULL, CBM_SVC_NONE, NULL},
 };
 
@@ -448,6 +501,11 @@ static const lib_pattern_t graphql_libraries[] = {
     {"async-graphql", CBM_SVC_GRAPHQL, NULL},
     {"juniper", CBM_SVC_GRAPHQL, NULL},
 
+    /* Glued-name libraries (see the note in http_libraries). */
+    {"gqlparser", CBM_SVC_GRAPHQL, NULL}, /* Go: vektah/gqlparser */
+    {"gqlgenc", CBM_SVC_GRAPHQL, NULL},   /* Go: gqlgen client generator */
+    {"aiogqlc", CBM_SVC_GRAPHQL, NULL},   /* Python: asyncio GraphQL client */
+
     {NULL, CBM_SVC_NONE, NULL},
 };
 
@@ -534,17 +592,67 @@ static const method_suffix_t method_suffixes[] = {
 
 /* ── Matching implementation ───────────────────────────────────── */
 
-/* Check if any library identifier appears as a substring in the QN.
- * Case-sensitive: "requests" matches "project.venv.requests.api.get"
- * but not "Requests". Library names are specific enough to avoid
- * false positives even with substring matching. */
+static bool qn_is_lower(char ch) {
+    return ch >= 'a' && ch <= 'z';
+}
+
+static bool is_digit_char(char ch) {
+    return ch >= '0' && ch <= '9';
+}
+
+static bool qn_is_alnum(char ch) {
+    return qn_is_lower(ch) || is_digit_char(ch) || (ch >= 'A' && ch <= 'Z');
+}
+
+/* True when the occurrence of `id` at `hit` sits on identifier boundaries.
+ *
+ * A raw substring match let short ids fire inside unrelated words: "gin."
+ * in "plugin.", "dio" in "studio", "surf" in "surface", "express" in
+ * "expression". Every character that is not an ASCII letter or digit is a
+ * separator ('.', '/', '\\', ':', '_', '-', '$', '@', ...).
+ *
+ *   BEFORE: start of string, a separator, an id that itself starts with a
+ *           separator ("@trpc/server"), or an id that starts with an
+ *           uppercase letter — a capital opens a new CamelCase word whatever
+ *           precedes it ("AsyncHttpClient", "IHttpClientFactory",
+ *           "NSURLSession"). Rejected: a lowercase/digit-initial id glued to
+ *           a letter or digit ("plugin." / "studio" / "myrequests").
+ *   AFTER:  end of string, a separator, an id that itself ends in a
+ *           separator ("gin."), an uppercase letter (CamelCase glue:
+ *           "GuzzleHttp", "FeignClient", "KafkaProducer", "kafkaProducer")
+ *           or a digit (version suffix: "urllib2", "amqp091-go").
+ *           Rejected: a lowercase letter continuing the word ("surface",
+ *           "curly", "expression"). */
+static bool qn_hit_on_boundary(const char *qn, const char *hit, const char *id, size_t id_len) {
+    char first = id[0];
+    char last = id[id_len - 1];
+    if (hit > qn && qn_is_alnum(hit[-1]) && (qn_is_lower(first) || is_digit_char(first))) {
+        return false;
+    }
+    if (qn_is_alnum(last) && qn_is_lower(hit[id_len])) {
+        return false;
+    }
+    return true;
+}
+
+/* Check if any library identifier appears in the QN on identifier
+ * boundaries (see qn_hit_on_boundary). Case-sensitive: "requests" matches
+ * "project.venv.requests.api.get" and "svc.requests_get" but neither
+ * "Requests" nor "myrequests". */
 static const lib_pattern_t *match_qn(const char *qn, const lib_pattern_t *patterns) {
     if (!qn || !qn[0]) {
         return NULL;
     }
     for (int i = 0; patterns[i].library_id != NULL; i++) {
-        if (strstr(qn, patterns[i].library_id) != NULL) {
-            return &patterns[i];
+        const char *id = patterns[i].library_id;
+        size_t id_len = strlen(id);
+        if (id_len == 0) {
+            continue;
+        }
+        for (const char *hit = strstr(qn, id); hit != NULL; hit = strstr(hit + 1, id)) {
+            if (qn_hit_on_boundary(qn, hit, id, id_len)) {
+                return &patterns[i];
+            }
         }
     }
     return NULL;
@@ -574,10 +682,6 @@ static bool contains_segment(const char *path, const char *segment) {
     return false;
 }
 
-static bool is_digit_char(char ch) {
-    return ch >= '0' && ch <= '9';
-}
-
 static bool has_http_route_marker(const char *path) {
     if (starts_with_segment(path, "api") || starts_with_segment(path, "apis") ||
         starts_with_segment(path, "graphql") || starts_with_segment(path, "health") ||
@@ -714,6 +818,25 @@ static const char *strip_string_delimiters(const char *literal, char *buf, size_
     return buf;
 }
 
+/* A comment opens with the slash a route opens with, and an argument list
+ * that starts with one handed three Java block comments to the Route pass as
+ * URLs (elasticsearch, 2026-09-16). The wildcard route (slash-star alone) is a
+ * path, so the block-comment shape needs its closing star-slash; a route
+ * literal never holds a line break. */
+bool cbm_service_pattern_is_comment_text(const char *text) {
+    if (!text || text[0] != '/') {
+        return false;
+    }
+    if (strchr(text, '\n') != NULL || strchr(text, '\r') != NULL) {
+        return true;
+    }
+    size_t n = strlen(text);
+    if (text[1] == '*' && n >= 4 && text[n - 2] == '*' && text[n - 1] == '/') {
+        return true;
+    }
+    return text[1] == '/' && (text[2] == ' ' || text[2] == '\t');
+}
+
 bool cbm_service_pattern_is_http_route_literal(const char *literal, const char *callee_name) {
     char path_buf[1024];
     const char *path = strip_string_delimiters(literal, path_buf, sizeof(path_buf));
@@ -729,6 +852,9 @@ bool cbm_service_pattern_is_http_route_literal(const char *literal, const char *
     if (path[0] != '/') {
         return false;
     }
+    if (cbm_service_pattern_is_comment_text(path)) {
+        return false;
+    }
     if (callee_is_delimiter_or_filesystem_builder(callee_name)) {
         return false;
     }
diff --git a/internal/cbm/service_patterns.h b/internal/cbm/service_patterns.h
index 4642a08de..d9a93c251 100644
--- a/internal/cbm/service_patterns.h
+++ b/internal/cbm/service_patterns.h
@@ -48,6 +48,12 @@ bool cbm_service_pattern_is_global_fetch(const char *callee_name);
  * Rejects filesystem paths and non-HTTP string consumers. */
 bool cbm_service_pattern_is_http_route_literal(const char *literal, const char *callee_name);
 
+/* True when text that reached a path slot is a source comment rather than a
+ * path: a block comment (slash-star … star-slash), a line comment (slash-slash
+ * followed by a space), or any text with a line break. The wildcard route
+ * (slash-star alone) is a path. */
+bool cbm_service_pattern_is_comment_text(const char *text);
+
 /* Per-worker TLS cache for cbm_service_pattern_match results. The
  * pattern matcher runs once per resolved CALL edge in emit_service_
  * edge — that's 6 pattern lists × ~30 patterns × strstr per call ≈
diff --git a/internal/cbm/sqlite_writer.c b/internal/cbm/sqlite_writer.c
index 7391803f4..da8aba06c 100644
--- a/internal/cbm/sqlite_writer.c
+++ b/internal/cbm/sqlite_writer.c
@@ -15,6 +15,8 @@
 //   - Varints: 1-9 bytes, big-endian, MSB continuation
 
 #include "sqlite_writer.h"
+#include "foundation/arena.h"  /* index-cell arena */
+#include "foundation/compat.h" /* CBM_TLS */
 #include "foundation/constants.h"
 #include "foundation/compat_fs.h"
 #include "foundation/compat_thread.h"
@@ -26,6 +28,7 @@
 #include <string.h>
 #include <stdint.h>
 #include <stdbool.h>
+#include <errno.h>
 
 #ifdef _WIN32
 #include <io.h>
@@ -301,29 +304,37 @@ typedef struct {
     uint8_t *data;
     int len;
     int cap;
+    bool heap; /* data is malloc-owned; otherwise it is the caller's inline space */
 } DynBuf;
 
-static void dynbuf_init(DynBuf *b) {
-    b->data = NULL;
+/* Start on caller-provided space (a record builder's stack array). Growth past
+ * it moves to the heap once; a buffer that never outgrows it never allocates. */
+static void dynbuf_init_inline(DynBuf *b, uint8_t *space, int cap) {
+    b->data = space;
     b->len = 0;
-    b->cap = 0;
+    b->cap = cap;
+    b->heap = false;
 }
 
 static bool dynbuf_ensure(DynBuf *b, int needed) {
     if (b->len + needed <= b->cap) {
         return true;
     }
-    int newcap = b->cap == 0 ? INITIAL_PAGE_CAP : b->cap;
+    int newcap = b->cap < INITIAL_PAGE_CAP ? INITIAL_PAGE_CAP : b->cap;
     while (newcap < b->len + needed) {
         newcap *= GROWTH_FACTOR;
     }
-    uint8_t *p = (uint8_t *)realloc(b->data, newcap);
+    uint8_t *p = b->heap ? (uint8_t *)realloc(b->data, newcap) : (uint8_t *)malloc(newcap);
     if (!p) {
         (void)fprintf(stderr, "cbm_write_db: dynbuf realloc failed size=%d\n", newcap);
         return false;
     }
+    if (!b->heap && b->len > 0) {
+        memcpy(p, b->data, (size_t)b->len);
+    }
     b->data = p;
     b->cap = newcap;
+    b->heap = true;
     return true;
 }
 
@@ -343,22 +354,35 @@ static bool dynbuf_append(DynBuf *b, const void *data, int len) {
 }
 
 static void dynbuf_free(DynBuf *b) {
-    free(b->data);
+    if (b->heap) {
+        free(b->data);
+    }
     b->data = NULL;
     b->len = b->cap = 0;
+    b->heap = false;
 }
 
 // --- Record builder ---
 // Builds a SQLite record: header (header_len varint + serial types) + body (values)
 
+/* Inline space for one record. Every node, edge and index row used to allocate
+ * a 4 KB header buffer and a 4 KB body buffer and free both after copying a few
+ * dozen bytes out: the waste sanitizer measured 32 M allocations and ~126 GB of
+ * churn on the Go corpus, ~99 % of it never written (2026-09-17). A header is
+ * one serial type per column; a body is the row's text. Rows that do not fit
+ * (long property JSON) still grow onto the heap. */
+enum { REC_HEADER_INLINE = 64, REC_BODY_INLINE = 1536 };
+
 typedef struct {
     DynBuf header; // serial type varints
     DynBuf body;   // column values
+    uint8_t header_space[REC_HEADER_INLINE];
+    uint8_t body_space[REC_BODY_INLINE];
 } RecordBuilder;
 
 static void rec_init(RecordBuilder *r) {
-    dynbuf_init(&r->header);
-    dynbuf_init(&r->body);
+    dynbuf_init_inline(&r->header, r->header_space, REC_HEADER_INLINE);
+    dynbuf_init_inline(&r->body, r->body_space, REC_BODY_INLINE);
 }
 
 static void rec_free(RecordBuilder *r) {
@@ -408,8 +432,7 @@ static void rec_add_blob(RecordBuilder *r, const uint8_t *data, int len) {
 
 // Finalize: returns the complete record bytes (header_len + header + body).
 // Caller must free the returned buffer.
-static uint8_t *rec_finalize(RecordBuilder *r, int *out_len) {
-    *out_len = 0;
+static int rec_total_header(const RecordBuilder *r) {
     int header_content_len = r->header.len;
     int header_len_varint_len = varint_len(header_content_len + varint_len(header_content_len));
     // The header size varint includes itself, so we may need to iterate
@@ -420,20 +443,73 @@ static uint8_t *rec_finalize(RecordBuilder *r, int *out_len) {
         header_len_varint_len = recalc;
         total_header = header_len_varint_len + header_content_len;
     }
+    return total_header;
+}
 
-    int total = total_header + r->body.len;
+// Bytes rec_write produces: the record exactly as rec_finalize returns it.
+static int rec_payload_len(const RecordBuilder *r) {
+    return rec_total_header(r) + r->body.len;
+}
+
+// Write the record (header_len + header + body) at dst; returns its length.
+static int rec_write(const RecordBuilder *r, uint8_t *dst) {
+    int pos = put_varint(dst, rec_total_header(r));
+    memcpy(dst + pos, r->header.data, r->header.len);
+    pos += r->header.len;
+    memcpy(dst + pos, r->body.data, r->body.len);
+    return pos + r->body.len;
+}
+
+static uint8_t *rec_finalize(RecordBuilder *r, int *out_len) {
+    *out_len = 0;
+    int total = rec_payload_len(r);
     uint8_t *buf = (uint8_t *)malloc(total);
     if (!buf) {
         return NULL;
     }
-    int pos = put_varint(buf, total_header);
-    memcpy(buf + pos, r->header.data, header_content_len);
-    pos += header_content_len;
-    memcpy(buf + pos, r->body.data, r->body.len);
-    *out_len = total;
+    *out_len = rec_write(r, buf);
     return buf;
 }
 
+/* One index build's cells live in an arena: they are all released together
+ * once the B-tree is written, where a malloc + free per row was 12.1 M
+ * allocations on the Go corpus (waste sanitizer, 2026-09-17). The writer
+ * builds one index at a time on one thread; NULL = the malloc path, which the
+ * unit tests and any other caller keep. */
+enum { CELLS_ARENA_BLOCK = 1024 * 1024 };
+static CBM_TLS CBMArena *tl_cells_arena;
+
+static uint8_t *cells_alloc(size_t bytes) {
+    if (tl_cells_arena) {
+        return (uint8_t *)cbm_arena_alloc(tl_cells_arena, bytes);
+    }
+    return (uint8_t *)malloc(bytes);
+}
+
+static void cells_free(uint8_t *cell) {
+    if (!tl_cells_arena) {
+        free(cell);
+    }
+}
+
+// An index leaf cell, varint(payload_len) + record, written in place: building
+// the record first and copying it into the cell was a second allocation and a
+// copy for every index entry (16 M record buffers of pure churn on the Go
+// corpus, waste sanitizer 2026-09-17). Same bytes.
+static uint8_t *rec_finalize_index_cell(const RecordBuilder *r, int *out_len) {
+    *out_len = 0;
+    int payload_len = rec_payload_len(r);
+    int total = varint_len(payload_len) + payload_len;
+    uint8_t *cell = cells_alloc((size_t)total);
+    if (!cell) {
+        return NULL;
+    }
+    int pos = put_varint(cell, payload_len);
+    pos += rec_write(r, cell + pos);
+    *out_len = pos;
+    return cell;
+}
+
 // --- Page builder ---
 // Accumulates cells (records) into B-tree leaf pages.
 
@@ -460,6 +536,11 @@ typedef struct {
     PageRef *leaves;
     int leaf_count;
     int leaf_cap;
+
+    // One reusable buffer every table cell is assembled in before it is copied
+    // into the page (grows to the largest cell, freed by pb_free).
+    uint8_t *cell_buf;
+    int cell_cap;
 } PageBuilder;
 
 static void pb_init(PageBuilder *pb, FILE *fp, uint32_t start_page, bool is_index) {
@@ -475,6 +556,8 @@ static void pb_init(PageBuilder *pb, FILE *fp, uint32_t start_page, bool is_inde
     pb->leaves = NULL;
     pb->leaf_count = 0;
     pb->leaf_cap = 0;
+    pb->cell_buf = NULL;
+    pb->cell_cap = 0;
 }
 
 static void pb_free(PageBuilder *pb) {
@@ -484,6 +567,21 @@ static void pb_free(PageBuilder *pb) {
         }
         free(pb->leaves);
     }
+    free(pb->cell_buf);
+    pb->cell_buf = NULL;
+    pb->cell_cap = 0;
+}
+
+static uint8_t *pb_cell_scratch(PageBuilder *pb, int len) {
+    if (pb->cell_cap < len) {
+        uint8_t *grown = (uint8_t *)realloc(pb->cell_buf, (size_t)len);
+        if (!grown) {
+            return NULL;
+        }
+        pb->cell_buf = grown;
+        pb->cell_cap = len;
+    }
+    return pb->cell_buf;
 }
 
 // Flush current leaf page to file
@@ -736,74 +834,46 @@ static uint32_t pb_build_interior(PageBuilder *pb, bool is_index) {
 
 // Build a nodes table record: (id, project, label, name, qualified_name, file_path, start_line,
 // end_line, properties)
-static uint8_t *build_node_record(const CBMDumpNode *n, int *out_len) {
-    RecordBuilder r;
-    rec_init(&r);
-
-    rec_add_int(&r, n->id);
-    rec_add_text(&r, n->project);
-    rec_add_text(&r, n->label);
-    rec_add_text(&r, n->name);
-    rec_add_text(&r, n->qualified_name);
-    rec_add_text(&r, n->file_path ? n->file_path : "");
-    rec_add_int(&r, n->start_line);
-    rec_add_int(&r, n->end_line);
-    rec_add_text(&r, n->properties ? n->properties : "{}");
-
-    uint8_t *data = rec_finalize(&r, out_len);
-    rec_free(&r);
-    return data;
+static void fill_node_record(RecordBuilder *r, const CBMDumpNode *n) {
+    rec_add_int(r, n->id);
+    rec_add_text(r, n->project);
+    rec_add_text(r, n->label);
+    rec_add_text(r, n->name);
+    rec_add_text(r, n->qualified_name);
+    rec_add_text(r, n->file_path ? n->file_path : "");
+    rec_add_int(r, n->start_line);
+    rec_add_int(r, n->end_line);
+    rec_add_text(r, n->properties ? n->properties : "{}");
 }
 
 // Build an edges table record: (id, project, source_id, target_id, type, properties)
 // url_path_gen and local_name_gen are VIRTUAL generated columns — NOT stored in the record.
-static uint8_t *build_edge_record(const CBMDumpEdge *e, int *out_len) {
-    RecordBuilder r;
-    rec_init(&r);
-
-    rec_add_int(&r, e->id);
-    rec_add_text(&r, e->project);
-    rec_add_int(&r, e->source_id);
-    rec_add_int(&r, e->target_id);
-    rec_add_text(&r, e->type);
-    rec_add_text(&r, e->properties ? e->properties : "{}");
-
-    uint8_t *data = rec_finalize(&r, out_len);
-    rec_free(&r);
-    return data;
+static void fill_edge_record(RecordBuilder *r, const CBMDumpEdge *e) {
+    rec_add_int(r, e->id);
+    rec_add_text(r, e->project);
+    rec_add_int(r, e->source_id);
+    rec_add_int(r, e->target_id);
+    rec_add_text(r, e->type);
+    rec_add_text(r, e->properties ? e->properties : "{}");
 }
 
 // Build a node_vectors table record: (node_id, project, vector)
-// Includes node_id in the record body (same pattern as build_node_record).
-static uint8_t *build_vector_record(const CBMDumpVector *v, int *out_len) {
-    RecordBuilder r;
-    rec_init(&r);
-
-    rec_add_int(&r, v->node_id);
-    rec_add_text(&r, v->project);
-    rec_add_blob(&r, v->vector, v->vector_len);
-
-    uint8_t *data = rec_finalize(&r, out_len);
-    rec_free(&r);
-    return data;
+// Includes node_id in the record body (same pattern as the node record).
+static void fill_vector_record(RecordBuilder *r, const CBMDumpVector *v) {
+    rec_add_int(r, v->node_id);
+    rec_add_text(r, v->project);
+    rec_add_blob(r, v->vector, v->vector_len);
 }
 
 // Build a token_vectors table record: (id, project, token, vector, idf)
-static uint8_t *build_token_vec_record(const CBMDumpTokenVec *tv, int *out_len) {
-    RecordBuilder r;
-    rec_init(&r);
-
-    rec_add_int(&r, tv->id);
-    rec_add_text(&r, tv->project);
-    rec_add_text(&r, tv->token);
-    rec_add_blob(&r, tv->vector, tv->vector_len);
+static void fill_token_vec_record(RecordBuilder *r, const CBMDumpTokenVec *tv) {
+    rec_add_int(r, tv->id);
+    rec_add_text(r, tv->project);
+    rec_add_text(r, tv->token);
+    rec_add_blob(r, tv->vector, tv->vector_len);
     /* Store IDF as integer × 1000 for fixed-point (avoid float in record) */
     enum { IDF_FIXED_POINT_SCALE = 1000 };
-    rec_add_int(&r, (int64_t)(tv->idf * IDF_FIXED_POINT_SCALE));
-
-    uint8_t *data = rec_finalize(&r, out_len);
-    rec_free(&r);
-    return data;
+    rec_add_int(r, (int64_t)(tv->idf * IDF_FIXED_POINT_SCALE));
 }
 
 // Build a projects table record: (name, indexed_at, root_path)
@@ -924,27 +994,8 @@ static uint8_t *build_index_entry_2text_rowid(const char *col1, const char *col2
     rec_add_text(&r, col1);
     rec_add_text(&r, col2);
     rec_add_int(&r, rowid);
-    int payload_len = 0;
-    uint8_t *payload = rec_finalize(&r, &payload_len);
+    uint8_t *cell = rec_finalize_index_cell(&r, out_len);
     rec_free(&r);
-    if (!payload) {
-        *out_len = 0;
-        return NULL;
-    }
-
-    // Index cell: varint(payload_len) + payload
-    int vl = varint_len(payload_len);
-    int total = vl + payload_len;
-    uint8_t *cell = (uint8_t *)malloc(total);
-    if (!cell) {
-        free(payload);
-        *out_len = 0;
-        return NULL;
-    }
-    int pos = put_varint(cell, payload_len);
-    memcpy(cell + pos, payload, payload_len);
-    free(payload);
-    *out_len = total;
     return cell;
 }
 
@@ -956,26 +1007,8 @@ static uint8_t *build_index_entry_int_text_rowid(int64_t val, const char *text,
     rec_add_int(&r, val);
     rec_add_text(&r, text);
     rec_add_int(&r, rowid);
-    int payload_len = 0;
-    uint8_t *payload = rec_finalize(&r, &payload_len);
+    uint8_t *cell = rec_finalize_index_cell(&r, out_len);
     rec_free(&r);
-    if (!payload) {
-        *out_len = 0;
-        return NULL;
-    }
-
-    int vl = varint_len(payload_len);
-    int total = vl + payload_len;
-    uint8_t *cell = (uint8_t *)malloc(total);
-    if (!cell) {
-        free(payload);
-        *out_len = 0;
-        return NULL;
-    }
-    int pos = put_varint(cell, payload_len);
-    memcpy(cell + pos, payload, payload_len);
-    free(payload);
-    *out_len = total;
     return cell;
 }
 
@@ -988,26 +1021,8 @@ static uint8_t *build_index_entry_text_int_text_rowid(const char *t1, int64_t va
     rec_add_int(&r, val);
     rec_add_text(&r, t2);
     rec_add_int(&r, rowid);
-    int payload_len = 0;
-    uint8_t *payload = rec_finalize(&r, &payload_len);
+    uint8_t *cell = rec_finalize_index_cell(&r, out_len);
     rec_free(&r);
-    if (!payload) {
-        *out_len = 0;
-        return NULL;
-    }
-
-    int vl = varint_len(payload_len);
-    int total = vl + payload_len;
-    uint8_t *cell = (uint8_t *)malloc(total);
-    if (!cell) {
-        free(payload);
-        *out_len = 0;
-        return NULL;
-    }
-    int pos = put_varint(cell, payload_len);
-    memcpy(cell + pos, payload, payload_len);
-    free(payload);
-    *out_len = total;
     return cell;
 }
 
@@ -1023,26 +1038,8 @@ static uint8_t *build_index_entry_unique_2int_2text_rowid(int64_t v1, int64_t v2
     rec_add_text(&r, text);
     rec_add_text(&r, text2);
     rec_add_int(&r, rowid);
-    int payload_len = 0;
-    uint8_t *payload = rec_finalize(&r, &payload_len);
+    uint8_t *cell = rec_finalize_index_cell(&r, out_len);
     rec_free(&r);
-    if (!payload) {
-        *out_len = 0;
-        return NULL;
-    }
-
-    int vlen = varint_len(payload_len);
-    int total = vlen + payload_len;
-    uint8_t *cell = (uint8_t *)malloc(total);
-    if (!cell) {
-        free(payload);
-        *out_len = 0;
-        return NULL;
-    }
-    int pos = put_varint(cell, payload_len);
-    memcpy(cell + pos, payload, payload_len);
-    free(payload);
-    *out_len = total;
     return cell;
 }
 
@@ -1115,18 +1112,34 @@ static uint8_t *overflowize_index_cell(FILE *fp, uint32_t *next_page, uint8_t *c
     uint32_t first_ovfl =
         write_overflow_pages(fp, next_page, cell + vlen + local, (int)plen - local);
     int nlen = vlen + local + BTREE_PTR_SIZE;
-    uint8_t *data = (uint8_t *)malloc((size_t)nlen);
+    uint8_t *data = cells_alloc((size_t)nlen);
     if (!data) {
         return cell; /* fall back to the (broken) inline form on OOM */
     }
     memcpy(data, cell, (size_t)(vlen + local));
     put_u32(data + vlen + local, first_ovfl);
-    free(cell);
+    cells_free(cell);
     *cell_len = nlen;
     return data;
 }
 #define TABLE_OVERFLOW_MIN_LOCAL 8199
 
+// Put a finished table cell on the current leaf, flushing a full leaf first.
+static bool pb_place_table_cell(PageBuilder *pb, const uint8_t *cell, int cell_len,
+                                int64_t prev_rowid) {
+    if (!pb_cell_fits(pb, cell_len) && pb->cell_count > 0) {
+        if (!pb_ensure_leaf_cap(pb)) {
+            return false;
+        }
+        pb->leaves[pb->leaf_count].max_key = prev_rowid;
+        pb->leaves[pb->leaf_count].sep_cell = NULL;
+        pb->leaves[pb->leaf_count].sep_cell_len = 0;
+        pb_flush_leaf(pb);
+    }
+    pb_add_cell(pb, cell, cell_len);
+    return true;
+}
+
 // Add a table cell to the PageBuilder, flushing leaf pages as needed.
 // If the payload exceeds max_local, overflow pages are written and only the
 // local portion plus a 4-byte overflow page pointer is stored in the leaf cell.
@@ -1160,22 +1173,39 @@ static void pb_add_table_cell_with_flush(PageBuilder *pb, int64_t rowid, const u
     if (!cell) {
         return;
     }
-
-    if (!pb_cell_fits(pb, cell_len) && pb->cell_count > 0) {
-        if (!pb_ensure_leaf_cap(pb)) {
-            free(cell);
-            return;
-        }
-        pb->leaves[pb->leaf_count].max_key = prev_rowid;
-        pb->leaves[pb->leaf_count].sep_cell = NULL;
-        pb->leaves[pb->leaf_count].sep_cell_len = 0;
-        pb_flush_leaf(pb);
-    }
-
-    pb_add_cell(pb, cell, cell_len);
+    (void)pb_place_table_cell(pb, cell, cell_len, prev_rowid);
     free(cell);
 }
 
+// A table record written straight into the page builder's cell buffer: the
+// record builder's bytes go to the cell once, where rec_finalize +
+// build_table_cell allocated the record, allocated the cell, copied, and freed
+// both for every row. Same bytes; a record too large for the page takes the
+// overflow path unchanged. False only on allocation failure.
+static bool pb_add_table_record_with_flush(PageBuilder *pb, int64_t rowid, const RecordBuilder *r,
+                                           int64_t prev_rowid) {
+    int payload_len = rec_payload_len(r);
+    if (payload_len > TABLE_OVERFLOW_MAX_LOCAL) {
+        int rec_len = 0;
+        uint8_t *rec = rec_finalize((RecordBuilder *)r, &rec_len);
+        if (!rec) {
+            return false;
+        }
+        pb_add_table_cell_with_flush(pb, rowid, rec, rec_len, prev_rowid);
+        free(rec);
+        return true;
+    }
+    int total = varint_len(payload_len) + varint_len(rowid) + payload_len;
+    uint8_t *cell = pb_cell_scratch(pb, total);
+    if (!cell) {
+        return false;
+    }
+    int pos = put_varint(cell, payload_len);
+    pos += put_varint(cell + pos, rowid);
+    pos += rec_write(r, cell + pos);
+    return pb_place_table_cell(pb, cell, pos, prev_rowid);
+}
+
 // Finalize a table PageBuilder: flush last leaf and build interior pages.
 static uint32_t pb_finalize_table(PageBuilder *pb, uint32_t *next_page, int64_t last_rowid) {
     if (pb->cell_count > 0) {
@@ -1607,21 +1637,8 @@ static uint8_t *ecell_url_path(const CBMDumpEdge *e, int *out_len) {
         rec_add_null(&r);
     }
     rec_add_int(&r, e->id);
-    int payload_len = 0;
-    uint8_t *payload = rec_finalize(&r, &payload_len);
+    uint8_t *cell = rec_finalize_index_cell(&r, out_len);
     rec_free(&r);
-    int vlen = varint_len(payload_len);
-    int total = vlen + payload_len;
-    uint8_t *cell = (uint8_t *)malloc(total);
-    if (!cell) {
-        free(payload);
-        *out_len = 0;
-        return NULL;
-    }
-    int pos = put_varint(cell, payload_len);
-    memcpy(cell + pos, payload, payload_len);
-    free(payload);
-    *out_len = total;
     return cell;
 }
 
@@ -1636,19 +1653,21 @@ static uint32_t build_edge_index_sorted(FILE *fp, uint32_t *next_page, CBMDumpEd
     }
     uint8_t **idx_cells = (uint8_t **)malloc(edge_count * sizeof(uint8_t *));
     int *idx_lens = (int *)malloc(edge_count * sizeof(int));
+    CBMArena cells;
+    cbm_arena_init_lazy(&cells, CELLS_ARENA_BLOCK);
     if (!idx_cells || !idx_lens) {
         free(perm);
         free(idx_cells);
         free(idx_lens);
         return 0;
     }
+    tl_cells_arena = &cells;
     for (int i = 0; i < edge_count; i++) {
         int si = perm[i];
         idx_cells[i] = cell_fn(&edges[si], &idx_lens[i]);
         if (!idx_cells[i]) {
-            for (int j = 0; j < i; j++) {
-                free(idx_cells[j]);
-            }
+            tl_cells_arena = NULL;
+            cbm_arena_destroy(&cells);
             free(idx_cells);
             free(idx_lens);
             free(perm);
@@ -1657,9 +1676,8 @@ static uint32_t build_edge_index_sorted(FILE *fp, uint32_t *next_page, CBMDumpEd
     }
     free(perm);
     uint32_t root = write_index_btree(fp, next_page, idx_cells, idx_lens, edge_count);
-    for (int i = 0; i < edge_count; i++) {
-        free(idx_cells[i]);
-    }
+    tl_cells_arena = NULL;
+    cbm_arena_destroy(&cells);
     free(idx_cells);
     free(idx_lens);
     return root;
@@ -1691,20 +1709,22 @@ static uint32_t build_node_index_sorted(FILE *fp, uint32_t *next_page, CBMDumpNo
     }
     uint8_t **idx_cells = (uint8_t **)malloc(node_count * sizeof(uint8_t *));
     int *idx_lens = (int *)malloc(node_count * sizeof(int));
+    CBMArena cells;
+    cbm_arena_init_lazy(&cells, CELLS_ARENA_BLOCK);
     if (!idx_cells || !idx_lens) {
         free(perm);
         free(idx_cells);
         free(idx_lens);
         return 0;
     }
+    tl_cells_arena = &cells;
     for (int i = 0; i < node_count; i++) {
         int si = perm[i];
         idx_cells[i] = build_index_entry_2text_rowid(nodes[si].project, col_fn(&nodes[si]),
                                                      nodes[si].id, &idx_lens[i]);
         if (!idx_cells[i]) {
-            for (int j = 0; j < i; j++) {
-                free(idx_cells[j]);
-            }
+            tl_cells_arena = NULL;
+            cbm_arena_destroy(&cells);
             free(idx_cells);
             free(idx_lens);
             free(perm);
@@ -1713,9 +1733,8 @@ static uint32_t build_node_index_sorted(FILE *fp, uint32_t *next_page, CBMDumpNo
     }
     free(perm);
     uint32_t root = write_index_btree(fp, next_page, idx_cells, idx_lens, node_count);
-    for (int i = 0; i < node_count; i++) {
-        free(idx_cells[i]);
-    }
+    tl_cells_arena = NULL;
+    cbm_arena_destroy(&cells);
     free(idx_cells);
     free(idx_lens);
     return root;
@@ -1759,6 +1778,10 @@ static int sync_writer_output(FILE *fp) {
 }
 
 static int discard_writer_output(write_db_ctx_t *w, int rc) {
+    /* Cleanup runs after the failure that brought us here, and a library
+     * call may set errno even when it succeeds. Carry the reason across it
+     * so the caller can report WHY the publish failed. */
+    int failure_errno = errno;
     if (w->fp) {
         (void)fclose(w->fp);
         w->fp = NULL;
@@ -1766,6 +1789,7 @@ static int discard_writer_output(write_db_ctx_t *w, int rc) {
     if (w->temp_path[0]) {
         (void)cbm_unlink(w->temp_path);
     }
+    errno = failure_errno;
     return rc;
 }
 
@@ -1774,10 +1798,12 @@ static int publish_writer_output(write_db_ctx_t *w) {
         return discard_writer_output(w, ERR_WRITE_FAILED);
     }
     if (fclose(w->fp) != 0) {
+        int failure_errno = errno;
         w->fp = NULL;
         if (w->temp_path[0]) {
             (void)cbm_unlink(w->temp_path);
         }
+        errno = failure_errno;
         return ERR_WRITE_FAILED;
     }
     w->fp = NULL;
@@ -1785,7 +1811,12 @@ static int publish_writer_output(write_db_ctx_t *w) {
         return 0;
     }
     if (cbm_rename_replace(w->temp_path, w->final_path) != 0) {
+        /* cbm_rename_replace translated the platform error into errno so the
+         * caller can say what denied the publish (#1620). Preserve it across
+         * the cleanup unlink. */
+        int rename_errno = errno;
         (void)cbm_unlink(w->temp_path);
+        errno = rename_errno;
         return ERR_WRITE_FAILED;
     }
     /* Sidecars are removed only after the replacement succeeds. On POSIX,
@@ -1796,13 +1827,13 @@ static int publish_writer_output(write_db_ctx_t *w) {
     return 0;
 }
 
-/* Callback type for building a record from an item at index i. */
-typedef uint8_t *(*build_record_fn)(const void *items, int i, int *out_len);
+/* Callback type for filling a record from an item at index i. */
+typedef void (*fill_record_fn)(RecordBuilder *r, const void *items, int i);
 typedef int64_t (*get_rowid_fn)(const void *items, int i);
 
 /* Write a streaming B-tree table from count items, or an empty table if count == 0. */
 static int write_one_table(write_db_ctx_t *w, uint32_t *root, const void *items, int count,
-                           build_record_fn build_rec, get_rowid_fn get_id) {
+                           fill_record_fn fill_rec, get_rowid_fn get_id) {
     if (count <= 0 || !items) {
         *root = write_table_btree(w->fp, &w->next_page, NULL, NULL, NULL, 0, false);
         return 0;
@@ -1810,15 +1841,17 @@ static int write_one_table(write_db_ctx_t *w, uint32_t *root, const void *items,
     PageBuilder pb;
     pb_init(&pb, w->fp, w->next_page, false);
     for (int i = 0; i < count; i++) {
-        int rec_len;
-        uint8_t *rec = build_rec(items, i, &rec_len);
-        if (!rec) {
-            return ERR_WRITE_FAILED;
-        }
+        RecordBuilder r;
+        rec_init(&r);
+        fill_rec(&r, items, i);
         int64_t rowid = get_id(items, i);
         int64_t prev_id = i > 0 ? get_id(items, i - SKIP_ONE) : 0;
-        pb_add_table_cell_with_flush(&pb, rowid, rec, rec_len, prev_id);
-        free(rec);
+        bool placed = pb_add_table_record_with_flush(&pb, rowid, &r, prev_id);
+        rec_free(&r);
+        if (!placed) {
+            pb_free(&pb);
+            return ERR_WRITE_FAILED;
+        }
     }
     *root = pb_finalize_table(&pb, &w->next_page, get_id(items, count - SKIP_ONE));
     return 0;
@@ -1826,20 +1859,20 @@ static int write_one_table(write_db_ctx_t *w, uint32_t *root, const void *items,
 
 /* Adapter functions for write_one_table (nodes are written via the streaming
  * PageBuilder in cbm_writer_append_nodes, so no node adapter is needed here). */
-static uint8_t *adapt_build_edge(const void *items, int i, int *out_len) {
-    return build_edge_record(&((const CBMDumpEdge *)items)[i], out_len);
+static void adapt_fill_edge(RecordBuilder *r, const void *items, int i) {
+    fill_edge_record(r, &((const CBMDumpEdge *)items)[i]);
 }
 static int64_t adapt_edge_id(const void *items, int i) {
     return ((const CBMDumpEdge *)items)[i].id;
 }
-static uint8_t *adapt_build_vector(const void *items, int i, int *out_len) {
-    return build_vector_record(&((const CBMDumpVector *)items)[i], out_len);
+static void adapt_fill_vector(RecordBuilder *r, const void *items, int i) {
+    fill_vector_record(r, &((const CBMDumpVector *)items)[i]);
 }
 static int64_t adapt_vector_id(const void *items, int i) {
     return ((const CBMDumpVector *)items)[i].node_id;
 }
-static uint8_t *adapt_build_token_vec(const void *items, int i, int *out_len) {
-    return build_token_vec_record(&((const CBMDumpTokenVec *)items)[i], out_len);
+static void adapt_fill_token_vec(RecordBuilder *r, const void *items, int i) {
+    fill_token_vec_record(r, &((const CBMDumpTokenVec *)items)[i]);
 }
 static int64_t adapt_token_vec_id(const void *items, int i) {
     return ((const CBMDumpTokenVec *)items)[i].id;
@@ -2066,17 +2099,17 @@ static int write_db_after_nodes(write_db_ctx_t *w, uint32_t nodes_root) {
     uint32_t vectors_root;
     uint32_t token_vecs_root;
     int rc =
-        write_one_table(w, &edges_root, w->edges, w->edge_count, adapt_build_edge, adapt_edge_id);
+        write_one_table(w, &edges_root, w->edges, w->edge_count, adapt_fill_edge, adapt_edge_id);
     if (rc != 0) {
         return discard_writer_output(w, rc);
     }
-    rc = write_one_table(w, &vectors_root, w->vectors, w->vector_count, adapt_build_vector,
+    rc = write_one_table(w, &vectors_root, w->vectors, w->vector_count, adapt_fill_vector,
                          adapt_vector_id);
     if (rc != 0) {
         return discard_writer_output(w, rc);
     }
     rc = write_one_table(w, &token_vecs_root, w->token_vecs, w->token_vec_count,
-                         adapt_build_token_vec, adapt_token_vec_id);
+                         adapt_fill_token_vec, adapt_token_vec_id);
     if (rc != 0) {
         return discard_writer_output(w, rc);
     }
@@ -2283,13 +2316,22 @@ cbm_db_writer_t *cbm_writer_open(const char *path) {
     int n = snprintf(w->wc.final_path, sizeof(w->wc.final_path), "%s", path);
     if (n < 0 || (size_t)n >= sizeof(w->wc.final_path) ||
         make_writer_temp_path(path, w, w->wc.temp_path, sizeof(w->wc.temp_path)) != 0) {
+        /* Both conditions are truncation and neither sets errno; name the
+         * reason rather than let the caller report a stale one. */
         free(w);
+        errno = ENAMETOOLONG;
         return NULL;
     }
     FILE *fp = cbm_fopen(w->wc.temp_path, "wb");
     if (!fp) {
+        /* The cleanup below unlinks a file that was never created, so it
+         * fails and leaves ENOENT behind — which reads as a missing path
+         * when the real answer is that the directory refused the create.
+         * That is the #1620 case, so carry the open's reason across it. */
+        int open_errno = errno;
         (void)cbm_unlink(w->wc.temp_path);
         free(w);
+        errno = open_errno;
         return NULL;
     }
     w->wc.fp = fp;
@@ -2307,16 +2349,18 @@ int cbm_writer_append_nodes(cbm_db_writer_t *w, const CBMDumpNode *nodes, int co
         return w->err;
     }
     for (int i = 0; i < count; i++) {
-        int rec_len;
-        uint8_t *rec = build_node_record(&nodes[i], &rec_len);
-        if (!rec) {
+        RecordBuilder r;
+        rec_init(&r);
+        fill_node_record(&r, &nodes[i]);
+        /* prev_rowid is the previous node's id (0 for the very first), matching
+         * the one-shot write_one_table loop — so output is byte-identical. */
+        bool placed =
+            pb_add_table_record_with_flush(&w->nodes_pb, nodes[i].id, &r, w->last_node_rowid);
+        rec_free(&r);
+        if (!placed) {
             w->err = ERR_WRITE_FAILED;
             return w->err;
         }
-        /* prev_rowid is the previous node's id (0 for the very first), matching
-         * the one-shot write_one_table loop — so output is byte-identical. */
-        pb_add_table_cell_with_flush(&w->nodes_pb, nodes[i].id, rec, rec_len, w->last_node_rowid);
-        free(rec);
         w->last_node_rowid = nodes[i].id;
         w->node_rows_written++;
     }
@@ -2355,6 +2399,10 @@ int cbm_writer_finalize(cbm_db_writer_t *w, const char *project, const char *roo
     write_db_ctx_t wc = w->wc; /* value copy survives free(w) */
     free(w);
     if (err != 0) {
+        /* A sticky append failure: errno belongs to whatever call failed
+         * many calls ago, not to the publish. Clear it so the caller does
+         * not attach a reason this path does not have. */
+        errno = 0;
         return discard_writer_output(&wc, err);
     }
     return write_db_after_nodes(&wc, nodes_root);
diff --git a/internal/cbm/vendored/grammars/MANIFEST.md b/internal/cbm/vendored/grammars/MANIFEST.md
index 4025b5f50..74322763e 100644
--- a/internal/cbm/vendored/grammars/MANIFEST.md
+++ b/internal/cbm/vendored/grammars/MANIFEST.md
@@ -87,6 +87,7 @@ row instead.
 | rescript   | `rescript/scanner.c`, deserialize | guard `memcpy(state, buffer, n_bytes)` with `if (n_bytes > 0)` | UBSan: zero-length `memcpy` with a NULL `buffer` / `n_bytes == 0` on empty-state deserialize (formal UB, harmless). The sibling serialize copies a fixed `sizeof(ScannerState)` (always > 0, non-NULL src) and needs no guard. |
 | purescript | `purescript/scanner.c`, serialize | guard `memcpy(buffer, indents->data, to_copy)` with `if (to_copy > 0)` | UBSan: zero-length `memcpy` with a NULL/0-size source when the indent vector is empty (formal UB, harmless) |
 | plsql      | `plsql/parser.c`, include         | `#include <tree_sitter/parser.h>` → `#include "tree_sitter/parser.h"` | The older ABI-14 generator emits angle brackets; every other vendored grammar uses the quoted form, which resolves the per-grammar `tree_sitter/` header from the including file's directory |
+| properties | `properties/scanner.c`, whole file | move the `reached_eof` flag out of a file-scope `static bool` and into a per-parser payload allocated by `..._external_scanner_create()` | **Data race, and the only one of its kind in 103 vendored scanners.** That flag is how the scanner refuses to emit a second end-of-input `FAKE_EOL`, and upstream keeps it in ONE process-wide object. With several worker threads indexing `.properties` files at once, whichever reached EOF first set the flag, so another thread's `!reached_eof` was false and its parse never received the `FAKE_EOL` it needed to finish — it sat at end-of-input asking for a token that would never arrive. Measured 2026-09-19: ~106 M parse operations on a 253-byte file before the per-file budget stopped it, after which the file was dropped from the graph and java/kotlin indexes differed run to run. Interleaved A/B under identical load, 40 runs each: unpatched 6 stalls, patched 0. The serialize/deserialize wire format is unchanged (the state is still the returned length). Upstream `6310671b24d4` still carries the static, so a re-vendor must re-apply this |
 | swift      | `swift/scanner.c`, `OP_SYMBOL_SUPPRESSOR` + `eat_operators` | `1UL <<` / `1 <<` → `1ULL <<` | UBSan: `1 << suppressor` shifts an `int` by up to `TOKEN_COUNT` bits, undefined once the index reaches 31, while the mask it feeds is `uint64_t`. `1UL << FAKE_TRY_BANG` is the same defect on Windows, where `unsigned long` is 32 bits and `FAKE_TRY_BANG` is 32; the CLANGARM64 leg runs UBSan in trap mode, so there it is an illegal instruction rather than a log line. Upstream already carries both changes: `fb63a7004f07` (2026-04-06, upstream #558) for `eat_operators`, `6ab8d1d74ebd` (2026-08-10) for the `OP_SYMBOL_SUPPRESSOR` entry. Our pin `8abb3e8b3325` (2026-03-20) predates both, so this is a backport rather than a local invention — a re-vendor past 2026-08-10 should delete this row, not re-apply it |
 
 ## Vendored from verified upstream
diff --git a/internal/cbm/vendored/grammars/properties/scanner.c b/internal/cbm/vendored/grammars/properties/scanner.c
index 583456268..5ef7b71b0 100644
--- a/internal/cbm/vendored/grammars/properties/scanner.c
+++ b/internal/cbm/vendored/grammars/properties/scanner.c
@@ -1,5 +1,7 @@
 #include "tree_sitter/parser.h"
 
+#include <stdlib.h>
+
 #ifdef _MSC_VER
 #pragma warning(disable : 4100)
 #elif defined(__GNUC__) || defined(__clang__)
@@ -8,21 +10,43 @@
 
 enum TokenType { FAKE_EOL };
 
-static bool reached_eof = false;
+/* The scanner's one bit of state -- whether THIS parse has already emitted the
+ * end-of-input FAKE_EOL -- lives in the payload, one per parser, which is what
+ * tree-sitter's create/destroy contract is for.
+ *
+ * It used to be a file-scope `static bool`: one object for the entire process,
+ * shared by every thread. The grammar needs exactly one FAKE_EOL to close a
+ * file, and `!reached_eof` is how the scanner refuses to emit a second one. So
+ * when two threads indexed .properties files at the same time, whichever
+ * reached EOF first set the flag, and the other thread's `!reached_eof` was
+ * false -- it never received the FAKE_EOL its parse was waiting for and sat at
+ * end-of-input asking for a token that would never arrive. Measured on
+ * 2026-09-19: ~106 million parse operations on a 253-byte file before the
+ * per-file budget stopped it, after which the file was dropped from the graph
+ * and the index differed from run to run. */
+typedef struct {
+    bool reached_eof;
+} Scanner;
 
-bool tree_sitter_properties_external_scanner_scan(void *payload, TSLexer *lexer, const bool *valid_symbols) {
+bool tree_sitter_properties_external_scanner_scan(void *payload, TSLexer *lexer,
+                                                  const bool *valid_symbols) {
+  Scanner *scanner = (Scanner *)payload;
   lexer->result_symbol = FAKE_EOL;
-  return reached_eof = !reached_eof && valid_symbols[FAKE_EOL] && lexer->eof(lexer);
+  return scanner->reached_eof =
+             !scanner->reached_eof && valid_symbols[FAKE_EOL] && lexer->eof(lexer);
 }
 
+/* Wire format unchanged: the state IS the returned length (1 = already emitted,
+ * 0 = not), and no bytes are written to the buffer. */
 unsigned tree_sitter_properties_external_scanner_serialize(void *payload, char *buffer) {
-  return reached_eof;
+  return ((Scanner *)payload)->reached_eof;
 }
 
-void tree_sitter_properties_external_scanner_deserialize(void *payload, const char *buffer, unsigned length) {
-  reached_eof = length;
+void tree_sitter_properties_external_scanner_deserialize(void *payload, const char *buffer,
+                                                         unsigned length) {
+  ((Scanner *)payload)->reached_eof = length;
 }
 
-void *tree_sitter_properties_external_scanner_create() { return NULL; }
+void *tree_sitter_properties_external_scanner_create() { return calloc(1, sizeof(Scanner)); }
 
-void tree_sitter_properties_external_scanner_destroy(void *payload) { }
\ No newline at end of file
+void tree_sitter_properties_external_scanner_destroy(void *payload) { free(payload); }
diff --git a/pkg/chocolatey/codebase-memory-mcp.nuspec b/pkg/chocolatey/codebase-memory-mcp.nuspec
index 5ce1deacc..7b6f6cabe 100644
--- a/pkg/chocolatey/codebase-memory-mcp.nuspec
+++ b/pkg/chocolatey/codebase-memory-mcp.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>codebase-memory-mcp</id>
-    <version>0.10.8</version>
+    <version>0.11.0</version>
     <title>codebase-memory-mcp</title>
     <authors>DeusData</authors>
     <projectUrl>https://github.com/DeusData/codebase-memory-mcp</projectUrl>
@@ -28,7 +28,7 @@ After installation, run:
 
 to configure your coding agents automatically.
     </description>
-    <releaseNotes>https://github.com/DeusData/codebase-memory-mcp/releases/tag/v0.10.8</releaseNotes>
+    <releaseNotes>https://github.com/DeusData/codebase-memory-mcp/releases/tag/v0.11.0</releaseNotes>
   </metadata>
   <files>
     <file src="tools\**" target="tools" />
diff --git a/pkg/chocolatey/tools/chocolateyInstall.ps1 b/pkg/chocolatey/tools/chocolateyInstall.ps1
index 132b86d90..031ac9e86 100644
--- a/pkg/chocolatey/tools/chocolateyInstall.ps1
+++ b/pkg/chocolatey/tools/chocolateyInstall.ps1
@@ -1,9 +1,9 @@
 $ErrorActionPreference = 'Stop'
 
 $packageName = 'codebase-memory-mcp'
-$version     = '0.10.8'
+$version     = '0.11.0'
 $url64       = "https://github.com/DeusData/codebase-memory-mcp/releases/download/v${version}/codebase-memory-mcp-windows-amd64.zip"
-$checksum64  = 'b43ad982994c4d829670749e08d3b622a74bb20041fc0a7d02bef6113f81c34d'
+$checksum64  = '6eb6beaf261b19e419766e78baf93cbc3cf1c6338cff8fb7c0234859f96d1685'
 $installDir  = Join-Path $env:ChocolateyBinRoot $packageName
 
 Install-ChocolateyZipPackage `
diff --git a/pkg/go/cmd/codebase-memory-mcp/main.go b/pkg/go/cmd/codebase-memory-mcp/main.go
index 91f1adc33..65f6e131a 100644
--- a/pkg/go/cmd/codebase-memory-mcp/main.go
+++ b/pkg/go/cmd/codebase-memory-mcp/main.go
@@ -36,7 +36,7 @@ import (
 
 const (
 	repo              = "DeusData/codebase-memory-mcp"
-	version           = "0.10.8"
+	version           = "0.11.0"
 	windowsBinaryName = "codebase-memory-mcp.exe"
 
 	maxRedirects            = 5
diff --git a/pkg/npm/README.md b/pkg/npm/README.md
index 614b81b1c..e1e5abe3e 100644
--- a/pkg/npm/README.md
+++ b/pkg/npm/README.md
@@ -7,7 +7,7 @@
 
 **The fastest and most efficient code intelligence engine for AI coding agents.** Full-indexes an average repository in milliseconds, the Linux kernel (28M LOC, 75K files) in 3 minutes. Answers structural queries in under 1ms. This npm wrapper downloads, verifies, and caches the selected native runtime set: the executable, its authenticated integration asset, and—when requested—the content-addressed UI pack.
 
-High-quality parsing through [tree-sitter](https://tree-sitter.github.io/tree-sitter/) AST analysis across 162 languages — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 15 MCP tools. No hosted service or API key; this package requires Node.js to manage and launch the cached native runtime set. Plug and play across 45 automatic/conditional client surfaces.
+High-quality parsing through [tree-sitter](https://tree-sitter.github.io/tree-sitter/) AST analysis across 162 languages — producing a persistent knowledge graph of functions, classes, call chains, HTTP routes, and cross-service links. 17 MCP tools. No hosted service or API key; this package requires Node.js to manage and launch the cached native runtime set. Plug and play across 45 automatic/conditional client surfaces.
 
 ## Installation
 
@@ -38,7 +38,7 @@ Restart your agent. Say **"Index this project"** — done.
 - **Lifecycle hooks stay conservative** — Kimi uses `UserPromptSubmit`; on macOS/Linux, GitLab Duo gets a fail-open user `SessionStart`, while Devin gets `UserPromptSubmit`, `PostCompaction`, and a deduplicated `SessionStart` when Claude does not already provide it. Qoder, GitLab Duo, Devin, and Factory hooks are withheld on Windows without a documented shell/executor contract. Cline's auto-activating file hooks are withheld because their context output is not reliably consumed, CodeBuddy beta hooks are not auto-installed, and Cursor context hooks remain withheld.
 - **Subagent access is explicit** — Claude, Gemini, Kiro, Qwen, CodeBuddy, KiloCode, Mistral Vibe, Grok Build, Qoder, Junie, and Factory get documented graph profiles with the narrowest tool/server filters their schemas support. KiloCode and Vibe enumerate read-only query tools rather than using server wildcards. Cursor, Rovo, Pochi, and Cline use explicit parent handoff where child MCP is unavailable or unsafe; IBM Bob receives no invented hook or agent.
 - **Manual, UI, cloud, or repository-managed (not counted)** — Qodo, Warp MCP, JetBrains AI/ACP, GitHub Copilot coding agent, Jules, CodeRabbit, Replit, BLACKBOX AI, Plandex, and SWE-agent. Warp is counted above for its detected skill installation; its MCP connection remains manual.
-- **15 MCP tools** — search, trace, architecture, impact analysis, Cypher queries, dead code detection, cross-service HTTP linking, ADR management, and more.
+- **17 MCP tools** — search, trace, architecture, impact analysis, Cypher queries, dead code detection, cross-service HTTP linking, ADR management, and more.
 
 ## Supported Platforms
 
diff --git a/pkg/npm/package.json b/pkg/npm/package.json
index f2b122d84..d19488f7f 100644
--- a/pkg/npm/package.json
+++ b/pkg/npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codebase-memory-mcp",
-  "version": "0.10.8",
+  "version": "0.11.0",
   "description": "Fast code intelligence for AI coding agents — installs a verified native runtime set",
   "mcpName": "io.github.DeusData/codebase-memory-mcp",
   "license": "MIT",
diff --git a/pkg/pypi/pyproject.toml b/pkg/pypi/pyproject.toml
index 5821d2a4b..f848e7cd8 100644
--- a/pkg/pypi/pyproject.toml
+++ b/pkg/pypi/pyproject.toml
@@ -8,7 +8,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "codebase-memory-mcp"
-version = "0.10.8"
+version = "0.11.0"
 description = "Fast code intelligence for AI coding agents — installs a verified native runtime set"
 readme = "README.md"
 license = { text = "MIT" }
diff --git a/pkg/pypi/src/codebase_memory_mcp/_cli.py b/pkg/pypi/src/codebase_memory_mcp/_cli.py
index 8a4aa112c..458b8c350 100644
--- a/pkg/pypi/src/codebase_memory_mcp/_cli.py
+++ b/pkg/pypi/src/codebase_memory_mcp/_cli.py
@@ -338,7 +338,7 @@ def _version() -> str:
         from importlib.metadata import version
         return version("codebase-memory-mcp")
     except Exception:
-        return "0.10.8"
+        return "0.11.0"
 
 
 def _os_name() -> str:
diff --git a/scripts/fuzz.sh b/scripts/fuzz.sh
new file mode 100755
index 000000000..43e44d8f9
--- /dev/null
+++ b/scripts/fuzz.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# fuzz.sh — run the libFuzzer targets of build/fuzz/cbm-fuzz.
+#
+# Usage:
+#   scripts/fuzz.sh <extract|cypher|config|all> [--runs N] [--max-total-time S]
+#                   [--jobs N] [--seed N] [--no-build]
+#
+# Two shapes, one driver:
+#   --runs N --seed S    a fixed number of executions from a fixed seed: the same
+#                        inputs every time, so a smoke in CI is a function of the
+#                        code (O9). This is the default (--runs 20000 --seed 1).
+#   --max-total-time S   exploration for dry-run and nightly: new inputs are the
+#                        point, and a crash is saved with its reproducer.
+#
+# The checked-in seeds (tests/fuzz/corpus/<target>/) are copied into a working
+# corpus under build/fuzz/, so a run never rewrites the repository. A crash,
+# leak or timeout leaves its input in build/fuzz/artifacts-<target>/ and the
+# script exits non-zero; reproduce with
+#   CBM_FUZZ_TARGET=<target> build/fuzz/cbm-fuzz <artifact>
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# --help before the positional target: the venue-parity interface probe calls
+# every canonical entry as `<entry> --help` with no other argument.
+case "${1:-}" in
+-h | --help) sed -n '2,21p' "$0"; exit 0 ;;
+esac
+TARGET="${1:-}"
+[ $# -gt 0 ] && shift
+RUNS=20000
+SEED=1
+MAX_TIME=""
+JOBS=1
+BUILD=1
+while [ $# -gt 0 ]; do
+    case "$1" in
+    --runs) RUNS="$2"; shift 2 ;;
+    --seed) SEED="$2"; shift 2 ;;
+    --max-total-time) MAX_TIME="$2"; RUNS=""; shift 2 ;;
+    --jobs) JOBS="$2"; shift 2 ;;
+    --no-build) BUILD=0; shift ;;
+    -h | --help) sed -n '2,21p' "$0"; exit 0 ;;
+    *) echo "fuzz.sh: unknown argument $1. Please consult --help." >&2; exit 2 ;;
+    esac
+done
+
+case "$TARGET" in
+extract | cypher | config) TARGETS=("$TARGET") ;;
+all) TARGETS=(extract cypher config) ;;
+*) echo "fuzz.sh: target must be extract, cypher, config or all. Please consult --help." >&2
+    exit 2 ;;
+esac
+
+BIN="$ROOT/build/fuzz/cbm-fuzz"
+if [ "$BUILD" -eq 1 ]; then
+    make -C "$ROOT" -f Makefile.cbm -j"$(getconf _NPROCESSORS_ONLN)" fuzz >/dev/null
+fi
+if [ ! -x "$BIN" ]; then
+    echo "fuzz.sh: $BIN is missing (build failed, or --no-build without a build)" >&2
+    exit 2
+fi
+
+status=0
+for t in "${TARGETS[@]}"; do
+    corpus="$ROOT/build/fuzz/corpus-$t"
+    artifacts="$ROOT/build/fuzz/artifacts-$t/"
+    mkdir -p "$corpus" "$artifacts"
+    cp -R "$ROOT/tests/fuzz/corpus/$t/." "$corpus/"
+    args=(-artifact_prefix="$artifacts" -seed="$SEED" -rss_limit_mb=4096 -timeout=30 -print_final_stats=1)
+    if [ -n "$RUNS" ]; then
+        args+=(-runs="$RUNS")
+    else
+        args+=(-max_total_time="$MAX_TIME")
+    fi
+    if [ "$JOBS" -gt 1 ]; then
+        args+=(-jobs="$JOBS" -workers="$JOBS")
+    fi
+    echo "=== fuzz $t: ${RUNS:+$RUNS runs}${MAX_TIME:+$MAX_TIME s} (seed $SEED) ==="
+    if ! CBM_FUZZ_TARGET="$t" "$BIN" "${args[@]}" "$corpus"; then
+        echo "fuzz.sh: target $t FAILED -- reproducer in $artifacts" >&2
+        status=1
+    fi
+done
+exit "$status"
diff --git a/scripts/hooks/pre-commit b/scripts/hooks/pre-commit
index fa42d92ae..7b5e1a4ff 100755
--- a/scripts/hooks/pre-commit
+++ b/scripts/hooks/pre-commit
@@ -17,4 +17,13 @@ echo "pre-commit: security audit (source-level)..."
 scripts/security-audit.sh
 
 echo "pre-commit: building and running tests..."
-make -j$(sysctl -n hw.ncpu 2>/dev/null || nproc) -f Makefile.cbm test
+(
+    # Git exports repository-local variables to hooks. The test suite creates
+    # independent repositories and linked worktrees, so keep the commit's
+    # index and object paths out of those fixtures.
+    while IFS= read -r variable; do
+        unset "$variable"
+    done < <(git rev-parse --local-env-vars)
+
+    make -j"$(sysctl -n hw.ncpu 2>/dev/null || nproc)" -f Makefile.cbm test
+)
diff --git a/scripts/lint-memory-core.py b/scripts/lint-memory-core.py
new file mode 100644
index 000000000..18c329383
--- /dev/null
+++ b/scripts/lint-memory-core.py
@@ -0,0 +1,228 @@
+#!/usr/bin/env python3
+"""
+lint-memory-core.py — the memory-core linter.
+
+Memory in this project is allocated through ONE core (src/foundation/mem_core.h),
+not through scattered raw malloc/calloc/realloc/free/strdup. This linter is the
+gate that keeps that true.
+
+WHY A RATCHET, NOT A BAN. An audit on 2026-09-13 found ~800 raw allocation
+sites in src/ and none of them can be migrated in one change. So the gate works
+like every other honest debt gate: a checked-in baseline records how many raw
+sites each file has TODAY, and the build goes red the moment any file has MORE
+than its baseline, or a file not in the baseline grows one. Files can only ever
+go down. When a file is migrated, its baseline line is lowered (or removed) in
+the same change -- and --strict turns "below baseline" into a failure too, so
+the baseline cannot silently rot behind the code.
+
+WHAT COUNTS AS RAW. A call to malloc/calloc/realloc/free/strdup/strndup that is
+not part of a longer identifier. cbm_alloc, cbm_free, cbm_calloc, mi_malloc,
+cbm_arena_alloc and heap_strdup are all NOT matches: the character before the
+name is an identifier character. Comments and string literals are stripped
+first, so prose that mentions malloc( does not trip the gate -- the security
+audit already bit us once on exactly that with fork(.
+
+EXEMPT. The core itself and the allocator plumbing it sits on:
+    src/foundation/mem_core.c        the route
+    (arena.c allocates its blocks THROUGH the core -- class arena -- and is scanned)
+    src/foundation/slab_alloc.c      same
+    src/foundation/mem.c             policy/measurement, probes with malloc
+    src/foundation/mem_override_*.c  the --wrap / override shims
+    src/foundation/compat*.c         libc replacement surface
+    internal/**/vendored/**          not ours
+    vendored/**                      not ours
+
+SCOPE. Everything under src/ and internal/ -- cli, mcp, daemon, store,
+pipeline, the extraction engine -- so the count is for the whole project, not
+one subsystem, and a leak shows up wherever it is.
+
+Usage:
+    lint-memory-core.py                  check against the baseline (CI)
+    lint-memory-core.py --strict         also fail when a file is BELOW baseline
+    lint-memory-core.py --write-baseline regenerate scripts/memory-core-baseline.txt
+    lint-memory-core.py --list           print every raw site (file:line: call)
+
+Exit 0 = clean. Exit 1 = a file grew. Exit 2 = usage/IO error.
+"""
+from __future__ import annotations
+
+import argparse
+import pathlib
+import re
+import sys
+
+ROOT = pathlib.Path(__file__).resolve().parent.parent
+BASELINE = ROOT / "scripts" / "memory-core-baseline.txt"
+SCAN_ROOTS = ("src", "internal")
+RAW = re.compile(r"(?<![A-Za-z0-9_])(malloc|calloc|realloc|free|strdup|strndup)\s*\(")
+
+EXEMPT_EXACT = {
+    "src/foundation/mem_core.c",
+            "src/foundation/mem.c",
+}
+EXEMPT_PREFIX = (
+    "src/foundation/mem_override_",
+    "src/foundation/compat",
+    "vendored/",
+)
+
+
+def is_vendored(rel: str) -> bool:
+    """Any vendored/ segment anywhere under internal/ is not ours."""
+    return "/vendored/" in rel or rel.startswith("vendored/")
+
+
+def is_exempt(rel: str) -> bool:
+    return rel in EXEMPT_EXACT or rel.startswith(EXEMPT_PREFIX) or is_vendored(rel)
+
+
+def strip_comments_and_strings(text: str) -> str:
+    """Blank out comments and string literals, preserving line structure so
+    reported line numbers stay right. Character-class aware enough for C:
+    handles escapes inside strings and does not treat // inside a string as a
+    comment."""
+    out = []
+    i, n = 0, len(text)
+    while i < n:
+        c = text[i]
+        nxt = text[i + 1] if i + 1 < n else ""
+        if c == "/" and nxt == "*":
+            j = text.find("*/", i + 2)
+            j = n if j < 0 else j + 2
+            out.append("".join(ch if ch == "\n" else " " for ch in text[i:j]))
+            i = j
+        elif c == "/" and nxt == "/":
+            j = text.find("\n", i)
+            j = n if j < 0 else j
+            out.append(" " * (j - i))
+            i = j
+        elif c == '"' or c == "'":
+            q = c
+            j = i + 1
+            while j < n and text[j] != q:
+                if text[j] == "\\":
+                    j += 1
+                if j < n and text[j] == "\n":
+                    break
+                j += 1
+            j = min(j + 1, n)
+            out.append(q + " " * max(0, j - i - 2) + (q if j - i >= 2 else ""))
+            i = j
+        else:
+            out.append(c)
+            i += 1
+    return "".join(out)
+
+
+def scan() -> dict[str, list[tuple[int, str]]]:
+    hits: dict[str, list[tuple[int, str]]] = {}
+    for root in SCAN_ROOTS:
+        base = ROOT / root
+        if not base.exists():
+            continue
+        for path in sorted(base.rglob("*")):
+            if path.suffix not in (".c", ".h") or not path.is_file():
+                continue
+            rel = path.relative_to(ROOT).as_posix()
+            if is_exempt(rel):
+                continue
+            text = strip_comments_and_strings(path.read_text(encoding="utf-8", errors="replace"))
+            for lineno, line in enumerate(text.splitlines(), 1):
+                for m in RAW.finditer(line):
+                    hits.setdefault(rel, []).append((lineno, m.group(1)))
+    return hits
+
+
+def read_baseline() -> dict[str, int]:
+    if not BASELINE.exists():
+        return {}
+    out: dict[str, int] = {}
+    for raw in BASELINE.read_text(encoding="utf-8").splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#"):
+            continue
+        rel, _, count = line.rpartition("\t")
+        if not rel:
+            continue
+        try:
+            out[rel] = int(count)
+        except ValueError:
+            continue
+    return out
+
+
+def write_baseline(hits: dict[str, list]) -> None:
+    lines = [
+        "# memory-core-baseline.txt -- raw allocator call sites per file.",
+        "# Generated by scripts/lint-memory-core.py --write-baseline.",
+        "# A file may only ever go DOWN. Lower a line in the same change that",
+        "# migrates the file to src/foundation/mem_core.h; never raise one.",
+        "",
+    ]
+    for rel in sorted(hits):
+        lines.append(f"{rel}\t{len(hits[rel])}")
+    BASELINE.write_text("\n".join(lines) + "\n", encoding="utf-8")
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--write-baseline", action="store_true")
+    ap.add_argument("--strict", action="store_true", help="fail when a file is BELOW its baseline")
+    ap.add_argument("--list", action="store_true", help="print every raw site")
+    args = ap.parse_args()
+
+    hits = scan()
+    total = sum(len(v) for v in hits.values())
+
+    if args.write_baseline:
+        write_baseline(hits)
+        print(f"memory-core baseline written: {len(hits)} files, {total} raw sites")
+        return 0
+
+    if args.list:
+        for rel in sorted(hits):
+            for lineno, call in hits[rel]:
+                print(f"{rel}:{lineno}: {call}(")
+        print(f"-- {total} raw sites in {len(hits)} files")
+        return 0
+
+    baseline = read_baseline()
+    if not baseline:
+        print(f"ERROR: no baseline at {BASELINE.relative_to(ROOT)}; run --write-baseline", file=sys.stderr)
+        return 2
+
+    grew: list[str] = []
+    shrank: list[str] = []
+    for rel, sites in sorted(hits.items()):
+        now = len(sites)
+        allowed = baseline.get(rel, 0)
+        if now > allowed:
+            # Show the LAST sites: new code is usually appended, so these are the
+            # likeliest culprits. The linter cannot know which sites are new
+            # without a diff; --list prints them all.
+            delta = now - allowed
+            tail = ", ".join(f"{ln}:{c}" for ln, c in sites[-max(delta, 1):][-6:])
+            grew.append(f"  {rel}: grew by {delta} ({allowed} -> {now}); latest sites: {tail}"
+                        f"  [run --list for all]")
+        elif now < allowed:
+            shrank.append(f"  {rel}: {now} (baseline {allowed}) -- lower the baseline")
+    for rel, allowed in sorted(baseline.items()):
+        if rel not in hits and allowed > 0:
+            shrank.append(f"  {rel}: 0 (baseline {allowed}) -- remove the line")
+
+    if grew:
+        print("memory-core linter FAILED: raw allocator use grew. Allocate through")
+        print("src/foundation/mem_core.h (cbm_alloc/cbm_calloc/cbm_realloc/cbm_free/")
+        print("cbm_mem_strdup) instead of malloc/calloc/realloc/free/strdup.")
+        print("\n".join(grew))
+    if shrank:
+        print("memory-core ratchet: these files improved; tighten scripts/memory-core-baseline.txt:")
+        print("\n".join(shrank))
+    if grew or (args.strict and shrank):
+        return 1
+    print(f"memory-core linter passed: {total} raw sites across {len(hits)} files, none grew")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/memlab-drive.py b/scripts/memlab-drive.py
index cef508810..bac474126 100644
--- a/scripts/memlab-drive.py
+++ b/scripts/memlab-drive.py
@@ -32,6 +32,16 @@ def rpc(proc, payload, timeout_note):
             return message
 
 
+def tool_failed(reply):
+    """A JSON-RPC error, or a tool result the server marked isError: MCP reports
+    a failed tool call as a normal result, so checking only "error" counts every
+    failure as served (a lab measuring nothing looked healthy)."""
+    if "error" in reply:
+        return True
+    result = reply.get("result")
+    return isinstance(result, dict) and bool(result.get("isError"))
+
+
 def main():
     parser = argparse.ArgumentParser()
     parser.add_argument("binary")
@@ -63,14 +73,16 @@ def main():
                    "params": {"protocolVersion": "2024-11-05", "capabilities": {},
                               "clientInfo": {"name": "memlab", "version": "1"}}},
             "initialize")
+        project = None
         if not args.skip_index:
             indexed = rpc(proc, {"jsonrpc": "2.0", "id": 1, "method": "tools/call",
                                  "params": {"name": "index_repository",
-                                            "arguments": {"path": args.corpus}}},
+                                            "arguments": {"repo_path": args.corpus}}},
                           "index_repository")
-            if "error" in indexed:
-                print(f"index failed: {indexed['error']}", file=sys.stderr)
+            if tool_failed(indexed):
+                print(f"index failed: {indexed.get('error') or indexed.get('result')}", file=sys.stderr)
                 return 3
+            project = (indexed.get("result", {}).get("structuredContent") or {}).get("project")
 
         halfway = 2 + args.requests // 2
         for i in range(2, args.requests + 2):
@@ -84,11 +96,15 @@ def main():
                          "list_projects": {},
                          "get_graph_schema": {},
                          "search_code": {"pattern": "Widget"}}.get(args.tool, {})
+            if project and args.tool != "list_projects":
+                arguments = dict(arguments, project=project)
             reply = rpc(proc, {"jsonrpc": "2.0", "id": i, "method": "tools/call",
                                "params": {"name": args.tool, "arguments": arguments}},
                         f"request {i}")
             served += 1
-            if "error" in reply:
+            if tool_failed(reply):
+                if failures == 0:
+                    print(f"first failure (request {i}): {json.dumps(reply)[:600]}", file=sys.stderr, flush=True)
                 failures += 1
     finally:
         try:
diff --git a/scripts/memlab-report.py b/scripts/memlab-report.py
index cf538fa7d..eae4bccf8 100644
--- a/scripts/memlab-report.py
+++ b/scripts/memlab-report.py
@@ -1,19 +1,20 @@
 #!/usr/bin/env python3
 """Analyse #581 memory-lab output: attribute growth to allocation sites.
 
-Reads the JSONL the profiler appends (CBM_MEM_PROFILE_OUT) and the mem.census
-lines from a daemon log, and prints:
+Reads the waste layer's dumps (CBM_MEMWASTE_OUT, one at every request-stage phase
+mark; see scripts/memlab.sh) and the mem.census lines from a daemon log, and
+prints:
 
   * retention per request, as a linear fit rather than first-vs-last, so noise
     does not masquerade as a trend
   * the call sites whose live bytes grow across the run, ranked by growth
-  * an explicit unattributed remainder: process growth the profiler could not
-    account for. That number is the honesty check — a report that attributed
-    everything while tracking only >=32 KiB allocations would be lying.
+  * an explicit unattributed remainder: process growth the layer could not
+    account for (allocator metadata, fragmentation, memory outside malloc).
+    That number is the honesty check.
 
 Usage:
-  memlab-report.py <profile.jsonl> [--census <daemon.log>] [--top N]
-  memlab-report.py <a.jsonl> --diff <b.jsonl>     # platform comparison
+  memlab-report.py <dump.jsonl> [--census <daemon.log>] [--binary BIN] [--top N]
+  memlab-report.py <a.jsonl> --diff <b.jsonl> [--binary BIN]     # platform comparison
 """
 import argparse
 import json
@@ -23,9 +24,11 @@ from collections import defaultdict
 
 
 def load_profile(path):
-    """Return (summaries, site_series). Records are appended over time, so the
-    Nth occurrence of a site is its Nth sample."""
-    summaries, series = [], defaultdict(list)
+    """Return (summaries, site_series) for the process with the most dumps.
+    Every dump lists every site, so the Nth occurrence of a site is its Nth
+    sample; a site first seen late is padded with zeros so series align."""
+    procs = defaultdict(lambda: {"summaries": [], "series": defaultdict(list)})
+    cur = None
     with open(path, "r", errors="replace") as handle:
         for line in handle:
             line = line.strip()
@@ -35,11 +38,31 @@ def load_profile(path):
                 record = json.loads(line)
             except json.JSONDecodeError:
                 continue
-            if "site" in record:
-                series[record["site"]].append(record)
-            else:
-                summaries.append(record)
-    return summaries, series
+            if "memwaste" in record:
+                cur = procs[record.get("pid", 0)]
+                cur["summaries"].append(record)
+            elif cur is not None and "site" in record and "work" not in record:
+                samples = cur["series"][record["site"]]
+                while len(samples) < len(cur["summaries"]) - 1:
+                    samples.append({"live_bytes": 0})
+                samples.append(record)
+    if not procs:
+        return [], {}
+    best = max(procs.values(), key=lambda p: len(p["summaries"]))
+    return best["summaries"], best["series"]
+
+
+def load_symbols(binary, summaries, sites):
+    """Symbolise site addresses with the waste report's own symboliser."""
+    if not binary or not summaries:
+        return {}
+    import importlib.util
+    import os
+    spec = importlib.util.spec_from_file_location(
+        "memwaste_report", os.path.join(os.path.dirname(os.path.abspath(__file__)), "memwaste-report.py"))
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod.symbolise(binary, summaries[-1].get("image_base", "0x0"), list(sites))
 
 
 def linear_slope(values):
@@ -57,7 +80,7 @@ def linear_slope(values):
 
 def parse_census(path):
     """Pull the pool totals out of mem.census log lines."""
-    fields = ("priv_kb", "rss_kb", "crt_kb", "biggest_kb", "prof_live_kb")
+    fields = ("priv_kb", "rss_kb", "crt_kb", "biggest_kb")
     rows = []
     pattern = re.compile(r"(\w+)=(\S+)")
     with open(path, "r", errors="replace") as handle:
@@ -71,16 +94,16 @@ def parse_census(path):
     return rows
 
 
-def report(path, census_path, top):
+def report(path, census_path, top, binary=None):
     summaries, series = load_profile(path)
     if not summaries and not series:
-        print(f"{path}: no profiler records — was CBM_MEM_PROFILE=1 set?")
+        print(f"{path}: no waste-layer records -- was the memwaste flavour run with CBM_MEMWASTE=1?")
         return
+    names = load_symbols(binary, summaries, series.keys())
     last = summaries[-1] if summaries else {}
     print(f"=== {path} ===")
     if last:
-        print(f"threshold      : {last.get('threshold', 0)} bytes "
-              f"(allocations below this are invisible by design)")
+        print(f"samples        : {len(summaries)} dumps (every allocation size is tracked)")
         print(f"sites seen     : {last.get('sites', 0)}")
         print(f"attributed live: {last.get('live_bytes', 0)/1048576:.1f} MB "
               f"in {last.get('live_blocks', 0)} blocks")
@@ -94,23 +117,23 @@ def report(path, census_path, top):
         slope = linear_slope(live)
         if slope <= 0 and live[-1] <= live[0]:
             continue
-        growth.append((slope, live[-1] - live[0], live[-1], samples[-1]))
+        growth.append((slope, live[-1] - live[0], live[-1], names.get(site, site)))
     growth.sort(key=lambda row: row[0], reverse=True)
 
     print(f"\n--- sites whose retained bytes GROW (top {top}) ---")
     if not growth:
         print("none — no tracked site retains more over time.")
-    for slope, delta, live, sample in growth[:top]:
-        frames = " <- ".join(sample.get("frames", [])[:4])
+    for slope, delta, live, name in growth[:top]:
         print(f"  +{slope/1024:8.1f} KB/sample  total +{delta/1048576:6.2f} MB  "
               f"live {live/1048576:6.2f} MB")
-        print(f"      {frames}")
+        print(f"      {name}")
 
     if census_path:
         rows = parse_census(census_path)
         if rows:
             priv = [r["priv_kb"] for r in rows if "priv_kb" in r]
-            prof = [r["prof_live_kb"] for r in rows if "prof_live_kb" in r]
+            # attributed = what the waste layer holds live, sampled at its own dumps
+            prof = [int(h.get("live_bytes", 0)) // 1024 for h in summaries]
             print(f"\n--- pools vs attribution ({len(rows)} samples) ---")
             if priv:
                 print(f"  private committed : {priv[0]/1024:.1f} -> {priv[-1]/1024:.1f} MB "
@@ -119,24 +142,27 @@ def report(path, census_path, top):
                 unattributed = (priv[-1] - priv[0]) - (prof[-1] - prof[0])
                 print(f"  attributed growth : {(prof[-1]-prof[0])/1024:+.1f} MB")
                 print(f"  UNATTRIBUTED      : {unattributed/1024:+.1f} MB "
-                      "<- below-threshold allocations, allocator metadata, or fragmentation")
+                      "<- allocator metadata, fragmentation, or memory outside malloc (mmap, stacks)")
 
 
-def diff(path_a, path_b, top):
-    """Same sites, two platforms: what does one retain that the other does not?"""
-    _, series_a = load_profile(path_a)
+def diff(path_a, path_b, top, binary=None):
+    """Same sites, two platforms: what does one retain that the other does not?
+    Raw addresses differ between binaries, so sites are matched by symbol name
+    when --binary is given (the same binary for both runs) and by address otherwise."""
+    summaries_a, series_a = load_profile(path_a)
     _, series_b = load_profile(path_b)
+    names = load_symbols(binary, summaries_a, set(series_a) | set(series_b))
     rows = []
     for site, samples in series_a.items():
         a_live = samples[-1]["live_bytes"]
         b_live = series_b[site][-1]["live_bytes"] if site in series_b else 0
         if a_live - b_live > 0:
-            rows.append((a_live - b_live, a_live, b_live, samples[-1]))
+            rows.append((a_live - b_live, a_live, b_live, site))
     rows.sort(key=lambda row: row[0], reverse=True)
     print(f"=== {path_a} minus {path_b} (top {top}) ===")
-    for delta, a_live, b_live, sample in rows[:top]:
+    for delta, a_live, b_live, site in rows[:top]:
         print(f"  +{delta/1048576:7.2f} MB   A={a_live/1048576:.2f} MB  B={b_live/1048576:.2f} MB")
-        print(f"      {' <- '.join(sample.get('frames', [])[:4])}")
+        print(f"      {names.get(site, site)}")
 
 
 def main():
@@ -145,11 +171,12 @@ def main():
     parser.add_argument("--census")
     parser.add_argument("--diff")
     parser.add_argument("--top", type=int, default=12)
+    parser.add_argument("--binary", help="the memwaste binary, for symbol names")
     args = parser.parse_args()
     if args.diff:
-        diff(args.profile, args.diff, args.top)
+        diff(args.profile, args.diff, args.top, args.binary)
     else:
-        report(args.profile, args.census, args.top)
+        report(args.profile, args.census, args.top, args.binary)
     return 0
 
 
diff --git a/scripts/memlab.sh b/scripts/memlab.sh
index 373742556..d3136b43c 100644
--- a/scripts/memlab.sh
+++ b/scripts/memlab.sh
@@ -10,9 +10,14 @@
 #
 # Usage: scripts/memlab.sh <binary> [requests] [label]
 #
-# Output: memlab-<label>.jsonl  (profiler records, one block per sample)
+# <binary> must be the waste-sanitizer flavour (make -f Makefile.cbm cbm
+# MEMWASTE=1 BUILD_DIR=build/memwaste): the attribution comes from its event
+# layer, which observes every allocation on Linux, macOS and Windows alike.
+#
+# Output: memlab-<label>.jsonl  (a waste-layer dump at every request-stage phase mark)
 #         memlab-<label>.log    (daemon log with mem.census lines)
-# Analyse with: scripts/memlab-report.py memlab-<label>.jsonl --census memlab-<label>.log
+# Analyse with: scripts/memlab-report.py memlab-<label>.jsonl --census memlab-<label>.log \
+#                   --binary <binary>
 set -u
 
 BINARY="${1:?usage: memlab.sh <binary> [requests] [label]}"
@@ -24,6 +29,16 @@ if [ ! -x "$BINARY" ]; then
     exit 2
 fi
 
+# The profiled process must reach a daemon rendezvous and cache this run owns:
+# only CBM_RUNTIME_DIR moves the rendezvous, so a private CBM_CACHE_DIR alone
+# joined the operator's account daemon (#1691, #1696). The helper also stops
+# that daemon before its cache is removed and leaves the root for diagnosis
+# when it will not stop.
+# shellcheck source=test-runtime.sh
+source "$(dirname "$0")/test-runtime.sh"
+cbm_test_runtime_init || exit 1
+trap 'cbm_test_runtime_cleanup "$BINARY"' EXIT
+
 WORK=$(mktemp -d 2>/dev/null || mktemp -d -t memlab)
 
 # Native Windows: the server walks the full ancestor chain of both the binary
@@ -75,7 +90,12 @@ PROFILE_OUT="$PWD/memlab-${LABEL}.jsonl"
 RUN_LOG="$PWD/memlab-${LABEL}.log"
 rm -f "$PROFILE_OUT" "$RUN_LOG"
 
-cleanup() { rm -rf "$WORK" 2>/dev/null || true; rm -rf "${WIN_ROOT:-}" 2>/dev/null || true; }
+cleanup() {
+    # The helper probes with $BINARY, whose native-Windows copy lives in $WORK.
+    cbm_test_runtime_cleanup "$BINARY"
+    rm -rf "$WORK" 2>/dev/null || true
+    rm -rf "${WIN_ROOT:-}" 2>/dev/null || true
+}
 trap cleanup EXIT
 
 # A fixed corpus: same file count and content on every platform, so a
@@ -108,15 +128,23 @@ done
 echo "=== memlab: binary=$BINARY requests=$REQUESTS label=$LABEL ==="
 echo "corpus: $(find "$CORPUS" -name '*.py' | wc -l | tr -d ' ') files"
 
-# The Windows binary needs a native path here; an msys /c/... path is not one.
-if command -v cygpath >/dev/null 2>&1 && ! command -v winepath >/dev/null 2>&1; then
+# The native Windows binary needs a native path here, under its stamped root;
+# an msys /c/... path is not one. Everywhere else the helper's owner-only cache
+# (already exported as CBM_CACHE_DIR) is the cache.
+if [ -n "${WIN_ROOT:-}" ]; then
     mkdir -p "$WORK/cache"
     export CBM_CACHE_DIR="$(cygpath -w "$WORK/cache")"
+    CACHE_HOST="$WORK/cache"
 else
-    export CBM_CACHE_DIR="$WORK/cache"
+    CACHE_HOST="$CBM_TEST_CACHE_DIR_HOST"
 fi
-export CBM_MEM_PROFILE=1
-export CBM_MEM_PROFILE_OUT="$PROFILE_OUT"
+export CBM_MEMWASTE=1
+export CBM_MEMWASTE_OUT="$PROFILE_OUT"
+# The server marks a memory phase at every request stage, and the layer dumps
+# at each mark: live bytes per site become a series over identical requests. The
+# series needs neither the fill scan nor the duplicate hash, which only cost time.
+export CBM_MEMWASTE_FILL=0
+export CBM_MEMWASTE_DUPES=0
 export CBM_MEM_CENSUS=1
 export CBM_LOG_LEVEL=info
 export CBM_LOG_FORMAT=text
@@ -139,7 +167,7 @@ python3 "$(dirname "$0")/memlab-drive.py" "$DRIVE_BINARY" "$DRIVE_CORPUS" "$REQU
 RC=$?
 # With CBM_CACHE_DIR set the process logs to its own file rather than stderr,
 # so fold that in or the census series is invisible.
-cat "$WORK"/cache/logs/*.log >> "$RUN_LOG" 2>/dev/null || true
+cat "$CACHE_HOST"/logs/*.log >> "$RUN_LOG" 2>/dev/null || true
 cat "$WORK/server-stderr.log" >> "$RUN_LOG" 2>/dev/null || true
 RESPONSES=$(sed -n "s/.*served=\\([0-9]*\\).*/\\1/p" "$WORK/drive.out" | head -1); RESPONSES=${RESPONSES:-0}
 CENSUS=$(grep -c "mem.census" "$RUN_LOG" 2>/dev/null | head -1); CENSUS=${CENSUS:-0}
@@ -155,9 +183,8 @@ if [ "$CENSUS" -eq 0 ]; then
     echo "WARN: no census samples — check CBM_MEM_CENSUS wiring" >&2
 fi
 if [ "$SITES" -eq 0 ]; then
-    # Not fatal, but never silent: on macOS there is no --wrap, so the
-    # profiler legitimately has no observation point.
-    echo "WARN: no profiler records — expected on macOS (no --wrap); a gap anywhere else" >&2
+    # Never silent: an empty dump means the binary is not the memwaste flavour.
+    echo "WARN: no waste-layer records -- is $BINARY built with MEMWASTE=1?" >&2
 fi
 echo "profile: $PROFILE_OUT"
 echo "log:     $RUN_LOG"
diff --git a/scripts/memory-core-baseline.txt b/scripts/memory-core-baseline.txt
new file mode 100644
index 000000000..ee54b498b
--- /dev/null
+++ b/scripts/memory-core-baseline.txt
@@ -0,0 +1,90 @@
+# memory-core-baseline.txt -- raw allocator call sites per file.
+# Generated by scripts/lint-memory-core.py --write-baseline.
+# A file may only ever go DOWN. Lower a line in the same change that
+# migrates the file to src/foundation/mem_core.h; never raise one.
+
+internal/cbm/ac.c	20
+internal/cbm/arena.c	3
+internal/cbm/cbm.c	13
+internal/cbm/extract_defs.c	5
+internal/cbm/helpers.c	3
+internal/cbm/lsp/c_lsp.c	4
+internal/cbm/lsp/perl_lsp.c	21
+internal/cbm/lsp/py_lsp.c	2
+internal/cbm/macro_table.c	1
+internal/cbm/service_patterns.c	2
+internal/cbm/sqlite_writer.c	74
+src/cli/activation_transaction.c	80
+src/cli/agent_clients.c	73
+src/cli/agent_profiles.c	7
+src/cli/cli.c	173
+src/cli/client_adapter.c	3
+src/cli/config_edit_path.c	2
+src/cli/config_json_like.c	142
+src/cli/config_text_edit.c	72
+src/cli/config_toml_edit.c	85
+src/cli/config_yaml_edit.c	117
+src/cli/hook_augment.c	31
+src/cypher/cypher.c	132
+src/daemon/application.c	107
+src/daemon/bootstrap.c	13
+src/daemon/daemon.c	31
+src/daemon/frontend.c	12
+src/daemon/ipc.c	146
+src/daemon/project_lock.c	6
+src/daemon/runtime.c	45
+src/daemon/service.c	6
+src/daemon/version_cohort.c	9
+src/discover/discover.c	31
+src/discover/gitignore.c	12
+src/discover/userconfig.c	15
+src/foundation/diagnostics.c	7
+src/foundation/lock_registry.c	18
+src/foundation/platform.c	11
+src/foundation/platform.h	5
+src/foundation/private_file_lock.c	56
+src/foundation/str_intern.c	7
+src/foundation/subprocess.c	24
+src/foundation/win_utf8.h	17
+src/foundation/workspace.c	3
+src/foundation/yaml.c	10
+src/git/git_context.c	18
+src/main.c	32
+src/mcp/compact_out.c	39
+src/mcp/index_supervisor.c	8
+src/mcp/mcp.c	784
+src/pipeline/artifact.c	38
+src/pipeline/fqn.c	23
+src/pipeline/lsp_resolve.h	4
+src/pipeline/lsp_surface.c	5
+src/pipeline/pass_calls.c	23
+src/pipeline/pass_compile_commands.c	17
+src/pipeline/pass_complexity.c	15
+src/pipeline/pass_configlink.c	3
+src/pipeline/pass_cross_repo.c	8
+src/pipeline/pass_definitions.c	14
+src/pipeline/pass_enrichment.c	15
+src/pipeline/pass_ensemble_routing.c	10
+src/pipeline/pass_envscan.c	2
+src/pipeline/pass_githistory.c	27
+src/pipeline/pass_importance.c	4
+src/pipeline/pass_infrascan.c	2
+src/pipeline/pass_k8s.c	6
+src/pipeline/pass_lsp_cross.c	50
+src/pipeline/pass_parallel.c	31
+src/pipeline/pass_pkgmap.c	82
+src/pipeline/pass_semantic.c	3
+src/pipeline/pass_tests.c	3
+src/pipeline/pass_usages.c	4
+src/pipeline/path_alias.c	42
+src/pipeline/pipeline.c	134
+src/pipeline/pipeline_delta.c	19
+src/pipeline/pipeline_incremental.c	144
+src/pipeline/registry.c	17
+src/pipeline/worker_pool.c	2
+src/store/store.c	358
+src/ui/config.c	12
+src/ui/http_server.c	31
+src/ui/httpd.c	21
+src/ui/layout3d.c	66
+src/watcher/watcher.c	33
diff --git a/scripts/memwaste-padding.py b/scripts/memwaste-padding.py
new file mode 100644
index 000000000..0921ef462
--- /dev/null
+++ b/scripts/memwaste-padding.py
@@ -0,0 +1,174 @@
+#!/usr/bin/env python3
+"""
+memwaste-padding.py — the layout lane of the waste sanitizer: bytes every
+instance of a struct carries for alignment alone.
+
+Padding is waste multiplied by the instance count: 4 bytes in a record the graph
+buffer holds 15 million of is 57 MB. The compiler knows every hole; this lane
+asks it, for EVERY translation unit of the production build -- vendored code
+included (grammars, the tree-sitter runtime, SQLite, mimalloc, tre, lz4, zstd,
+the C++ preprocessor) -- by replaying the build's own compile commands with
+`-fsyntax-only -Wno-everything -Wpadded`.
+
+Per struct it reports the interior holes (removable by ordering fields from the
+largest alignment down), the tail padding (removable only when the interior
+reordering frees enough bytes), and how many allocation sites name the type in a
+sizeof, as a first hint of instance counts. The event lane's per-site requested
+sizes are the runtime evidence to pair it with.
+
+Usage:
+    scripts/memwaste-padding.py                  # every TU, top 40 by interior padding
+    scripts/memwaste-padding.py --project-only   # skip vendored TUs
+    scripts/memwaste-padding.py --json
+"""
+from __future__ import annotations
+
+import argparse
+import concurrent.futures as cf
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+from collections import defaultdict
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+SRC_EXT = (".c", ".cc", ".cpp")
+KEEP_WITH_ARG = {"-include", "-isystem", "-iquote", "-arch", "-target"}
+WARN_RE = re.compile(
+    r"^(?P<file>[^:]+):(?P<line>\d+):\d+: warning: padding (?:struct|class|size of) "
+    r"'(?P<type>[^']+)' with (?P<bytes>\d+) bytes? to (?P<what>align '(?P<field>[^']*)'|alignment boundary)")
+
+
+def build_commands(cc: str, cxx: str) -> list[tuple[str, list[str], str]]:
+    dry = subprocess.run(["make", "-f", "Makefile.cbm", "-n", "cbm", "BUILD_DIR=build/memwaste-padding-dry",
+                          f"CC={cc}", f"CXX={cxx}", "MEMWASTE=1"],
+                         cwd=ROOT, capture_output=True, text=True, check=False)
+    text = dry.stdout.replace("\\\n", " ")
+    jobs = []
+    seen = set()
+    for line in text.splitlines():
+        try:
+            argv = shlex.split(line)
+        except ValueError:
+            continue
+        if not argv or os.path.basename(argv[0]) not in (cc, cxx, os.path.basename(cc), os.path.basename(cxx)):
+            continue
+        flags = []
+        sources = []
+        i = 1
+        while i < len(argv):
+            a = argv[i]
+            if a in KEEP_WITH_ARG and i + 1 < len(argv):
+                flags += [a, argv[i + 1]]
+                i += 2
+                continue
+            if a == "-o":
+                i += 2
+                continue
+            if a.startswith(("-I", "-D", "-U", "-std=")):
+                flags.append(a)
+            elif a.endswith(SRC_EXT) and os.path.isfile(os.path.join(ROOT, a)):
+                sources.append(a)
+            i += 1
+        for s in sources:
+            key = (s, tuple(flags))
+            if key not in seen:
+                seen.add(key)
+                jobs.append((argv[0], flags, s))
+    return jobs
+
+
+def run_one(job: tuple[str, list[str], str]) -> tuple[str, str]:
+    compiler, flags, source = job
+    res = subprocess.run([compiler, "-fsyntax-only", "-Wno-everything", "-Wpadded"] + flags + [source],
+                         cwd=ROOT, capture_output=True, text=True, check=False)
+    return source, res.stderr
+
+
+def is_vendored(path: str) -> bool:
+    return "/vendored/" in f"/{path}" or path.startswith("vendored/")
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--cc", default="clang")
+    ap.add_argument("--cxx", default="clang++")
+    ap.add_argument("--top", type=int, default=40)
+    ap.add_argument("--project-only", action="store_true")
+    ap.add_argument("--jobs", type=int, default=os.cpu_count() or 4)
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args()
+
+    jobs = build_commands(args.cc, args.cxx)
+    if args.project_only:
+        jobs = [j for j in jobs if not is_vendored(j[2])]
+    if not jobs:
+        sys.exit("memwaste-padding: no compile commands found (make -n printed none for the compiler)")
+
+    holes: dict[str, dict] = {}
+    with cf.ThreadPoolExecutor(max_workers=args.jobs) as pool:
+        for source, stderr in pool.map(run_one, jobs):
+            for line in stderr.splitlines():
+                m = WARN_RE.match(line)
+                if not m:
+                    continue
+                file = os.path.relpath(os.path.join(ROOT, m.group("file")), ROOT) \
+                    if not os.path.isabs(m.group("file")) else os.path.relpath(m.group("file"), ROOT)
+                t = holes.setdefault(m.group("type"), {"type": m.group("type"), "interior": {}, "tail": 0,
+                                                       "where": f"{file}:{m.group('line')}",
+                                                       "vendored": is_vendored(file)})
+                n = int(m.group("bytes"))
+                if m.group("field") is not None:
+                    t["interior"][m.group("field")] = n  # a header seen by many TUs reports the same hole
+                else:
+                    t["tail"] = n
+                    t["where"] = f"{file}:{m.group('line')}"
+
+    # Allocation hint: how many allocation expressions size by this type.
+    sizeof_sites: dict[str, int] = defaultdict(int)
+    names = {t.split(" ", 1)[-1] for t in holes}
+    alloc_re = re.compile(r"(?:alloc|calloc|realloc|arena_alloc|CBM_DA_PUSH|cbm_da_push)\w*\s*\([^;]*sizeof\s*\(\s*"
+                          r"(?:struct\s+)?(\w+)\s*\)")
+    for base in ("src", "internal/cbm"):
+        for dirpath, _, filenames in os.walk(os.path.join(ROOT, base)):
+            if "/vendored" in dirpath:
+                continue
+            for fn in filenames:
+                if not fn.endswith((".c", ".h")):
+                    continue
+                try:
+                    text = open(os.path.join(dirpath, fn), encoding="utf-8", errors="replace").read()
+                except OSError:
+                    continue
+                for m in alloc_re.finditer(text):
+                    if m.group(1) in names:
+                        sizeof_sites[m.group(1)] += 1
+
+    rows = []
+    for t in holes.values():
+        interior = sum(t["interior"].values())
+        short = t["type"].split(" ", 1)[-1]
+        rows.append({"type": t["type"], "interior_bytes": interior, "tail_bytes": t["tail"],
+                     "holes": len(t["interior"]), "alloc_sites": sizeof_sites.get(short, 0),
+                     "where": t["where"], "vendored": t["vendored"]})
+    rows.sort(key=lambda r: (-(r["alloc_sites"] > 0), -r["interior_bytes"], r["type"]))
+
+    if args.json:
+        json.dump({"translation_units": len(jobs), "structs": rows}, sys.stdout, indent=1)
+        print()
+        return 0
+    print(f"translation units checked: {len(jobs)}  structs with padding: {len(rows)}  "
+          f"(vendored: {sum(1 for r in rows if r['vendored'])})")
+    print()
+    print(f"  {'interior B':>10} {'tail B':>6} {'holes':>5} {'alloc sites':>11}  struct  (declared at)")
+    for r in rows[: args.top]:
+        tag = " [vendored]" if r["vendored"] else ""
+        print(f"  {r['interior_bytes']:>10} {r['tail_bytes']:>6} {r['holes']:>5} {r['alloc_sites']:>11}  "
+              f"{r['type']}{tag}  ({r['where']})")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/memwaste-ratchet.py b/scripts/memwaste-ratchet.py
new file mode 100644
index 000000000..2c886ee54
--- /dev/null
+++ b/scripts/memwaste-ratchet.py
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+"""
+memwaste-ratchet.py — hold the waste numbers where they are, lower them as they fall.
+
+Same shape as the memory-core linter's ratchet: a checked-in baseline per venue
+(scripts/memwaste-baseline.json), every waste class normalised PER THOUSAND GRAPH
+NODES so a corpus that grows does not look like a regression. A class that grows
+past its baseline by more than --tolerance fails under --enforce; without it the
+comparison is printed and the exit is 0 (report-only rollout). A class that
+FALLS is reported so the baseline can be lowered with --record.
+
+The inputs are what scripts/memwaste.sh leaves in its --out directory:
+memwaste.json (the report's --json) and index.json (the index result, for the
+node count).
+
+Usage:
+    memwaste-ratchet.py --out DIR --venue pr-linux              # compare, report-only
+    memwaste-ratchet.py --out DIR --venue pr-linux --enforce    # compare, gate
+    memwaste-ratchet.py --out DIR --venue pr-linux --record     # write the baseline
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+BASELINE = os.path.join(ROOT, "scripts", "memwaste-baseline.json")
+
+# Classes the ratchet holds. Left out on purpose: allocator-internal byte work
+# (it moves with allocator settings), the access-lane classes (one lane only),
+# and contended mutex acquisitions and pool imbalance -- those depend on thread
+# scheduling, and a gate on them would be a lottery (O9). They stay in the report.
+CLASSES = [
+    "slack_bytes", "never_written_bytes", "over_requested_bytes", "realloc_copy_bytes",
+    "short_lived", "dup_bytes_max", "retained_bytes_max", "raw_bytes",
+    "container_idle_peak_bytes", "byte_work_bytes", "byte_work_repeats", "io_tiny_calls",
+    "path_repeats", "ht_repeat_lookups", "ht_growths",
+]
+
+
+def current(out_dir: str) -> dict:
+    report = json.load(open(os.path.join(out_dir, "memwaste.json")))
+    index = json.load(open(os.path.join(out_dir, "index.json")))
+    nodes = int(index.get("nodes") or 0)
+    if nodes <= 0:
+        sys.exit("memwaste-ratchet: index.json has no node count")
+    # The index worker is the process that allocated the most.
+    worker = max(report["processes"].values(), key=lambda p: p["header"].get("usable_bytes", 0))
+    summary = worker["summary"]
+    return {
+        "nodes": nodes,
+        "per_1k_nodes": {c: round(summary.get(c, 0) * 1000.0 / nodes, 3) for c in CLASSES},
+    }
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--out", required=True, help="memwaste.sh --out directory")
+    ap.add_argument("--venue", required=True, help="baseline key, e.g. pr-linux, dryrun-macos")
+    ap.add_argument("--tolerance", type=float, default=0.05, help="allowed growth before a class fails")
+    ap.add_argument("--enforce", action="store_true")
+    ap.add_argument("--record", action="store_true")
+    args = ap.parse_args()
+
+    cur = current(args.out)
+    base_all = json.load(open(BASELINE)) if os.path.exists(BASELINE) else {}
+    if args.record:
+        base_all[args.venue] = cur
+        with open(BASELINE, "w") as fh:
+            json.dump(base_all, fh, indent=1, sort_keys=True)
+            fh.write("\n")
+        print(f"baseline recorded for {args.venue} ({cur['nodes']:,} nodes)")
+        return 0
+    base = base_all.get(args.venue)
+    if not base:
+        print(f"no baseline for {args.venue}: nothing to hold yet (record one with --record)")
+        return 0
+
+    worse, better = [], []
+    print(f"{'class':<28} {'baseline/1k':>14} {'now/1k':>14} {'delta':>8}")
+    for c in CLASSES:
+        b = base["per_1k_nodes"].get(c, 0.0)
+        n = cur["per_1k_nodes"].get(c, 0.0)
+        delta = (n - b) / b if b else (0.0 if n == 0 else float("inf"))
+        mark = ""
+        if delta > args.tolerance:
+            worse.append(c)
+            mark = "  WORSE"
+        elif delta < -args.tolerance:
+            better.append(c)
+            mark = "  better"
+        shown = "new" if delta == float("inf") else f"{delta * 100:+.1f}%"
+        print(f"{c:<28} {b:>14,.3f} {n:>14,.3f} {shown:>8}{mark}")
+    if better:
+        print(f"\n{len(better)} class(es) improved beyond tolerance: lower the baseline with --record")
+    if worse:
+        print(f"\n{len(worse)} class(es) grew beyond {args.tolerance * 100:.0f}%: {', '.join(worse)}")
+        return 1 if args.enforce else 0
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/memwaste-report.py b/scripts/memwaste-report.py
new file mode 100644
index 000000000..1764a4e46
--- /dev/null
+++ b/scripts/memwaste-report.py
@@ -0,0 +1,392 @@
+#!/usr/bin/env python3
+"""
+memwaste-report.py — turn waste-sanitizer dumps into ranked, symbolised evidence.
+
+The sanitizer (src/foundation/mem_events.h) appends JSON lines at every phase
+mark: a header per dump, then one object per allocation site and one per CPU
+work row, all with RAW return addresses. Symbolisation is offline so the hot
+path never loads a symbol handler. This tool reads every dump, keeps the LAST
+dump of each process for the cumulative counters, the MAXIMUM over its dumps for
+the phase snapshots (retained, duplicates), resolves the addresses against the
+binary that produced them, and prints:
+
+  1. a waste summary per process — one line per waste class, in bytes/calls;
+  2. the memory table — allocation sites ranked by a chosen waste metric;
+  3. containers — arenas, dynamic arrays, hash tables: capacity against use;
+  4. CPU work — byte work, I/O, contention, pool imbalance, repeated work.
+
+Usage:
+    memwaste-report.py DUMP.jsonl --binary build/memwaste/codebase-memory-mcp
+    memwaste-report.py DUMP.jsonl --binary ... --sort never_written --top 30
+    memwaste-report.py DUMP.jsonl --binary ... --json   (for the ratchet)
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import platform
+import re
+import shutil
+import subprocess
+import sys
+from collections import defaultdict
+
+MB = 1024.0 * 1024.0
+
+SNAPSHOT_FIELDS = ("retained_bytes", "dup_bytes", "dup_blocks")
+
+WASTE_CLASSES = [
+    # (key, label, unit)
+    ("slack_bytes", "allocator slack (usable - requested)", "bytes"),
+    ("never_written_bytes", "never-written bytes (fill pattern intact at free)", "bytes"),
+    ("over_requested_bytes", "requested beyond the last written byte", "bytes"),
+    ("zero_untouched_bytes", "calloc tail still zero at free (upper bound)", "bytes"),
+    ("realloc_copy_bytes", "bytes copied by realloc growth", "bytes"),
+    ("short_lived", "short-lived allocations (churn)", "calls"),
+    ("dup_bytes_max", "duplicate small blocks (peak over phases)", "bytes"),
+    ("retained_bytes_max", "live across a phase boundary (peak)", "bytes"),
+    ("raw_bytes", "bytes that never went through the memory core", "bytes"),
+    ("acc_untouched_bytes", "blocks never read or written (access lane)", "bytes"),
+    ("acc_dead_bytes", "blocks written, never read by instrumented code (access lane)", "bytes"),
+    ("acc_opaque_blocks", "blocks used only by code the access lane cannot see (no verdict)", "blocks"),
+    ("acc_idle_bytes", "blocks idle for at least one phase before free (access lane)", "bytes"),
+    ("acc_uninit_reads", "reads before any write, not calloc (access lane)", "blocks"),
+    ("container_idle_peak_bytes", "container capacity left unused (largest instance, per site)", "bytes"),
+    ("byte_work_bytes", "bytes moved/compared by mem*/str* calls in program code", "bytes"),
+    ("allocator_byte_work_bytes", "bytes moved/compared inside the allocator (mimalloc)", "bytes"),
+    ("byte_work_repeats", "strlen of a string just measured", "calls"),
+    ("io_tiny_calls", "I/O calls under 512 bytes", "calls"),
+    ("path_repeats", "open/stat of a path already opened/statted", "calls"),
+    ("mutex_contended", "contended mutex acquisitions", "calls"),
+    ("pool_imbalance_items", "work items an even pool would have spread", "items"),
+    ("pool_ops_imbalance", "worker events an even pool would have spread (work done)", "events"),
+    ("ht_repeat_lookups", "hash lookups of the key object just looked up", "calls"),
+    ("ht_growths", "hash-table growths", "calls"),
+]
+
+BYTE_KINDS = {"memcpy", "memmove", "memset", "memcmp", "strlen", "strcmp", "strncmp"}
+IO_KINDS = {"read", "write", "pread", "pwrite", "fread", "fwrite"}
+PATH_KINDS = {"open", "stat", "fopen", "opendir"}
+CONTAINER_KINDS = {"ct_arena", "ct_dyn_array", "ct_hash_table"}
+# Symbols of the vendored allocator. Its byte work is real CPU, but the fix is in
+# how the allocator is built or configured, not at a program call site.
+ALLOCATOR_SYMBOL = re.compile(r"^_?mi_")
+
+
+def load(path: str):
+    """{pid: {"header": last header, "headers": [...], "sites": {addr: row}, "snap_max": {addr: {...}},
+    "work": {(kind, addr): row}}} — sites/work from the LAST dump of the process."""
+    procs: dict[int, dict] = {}
+    cur = None
+    with open(path, encoding="utf-8", errors="replace") as fh:
+        for line in fh:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                obj = json.loads(line)
+            except json.JSONDecodeError:
+                continue  # a torn line from a process that died mid-write
+            if "memwaste" in obj:
+                pid = int(obj.get("pid", 0))
+                p = procs.setdefault(pid, {"headers": [], "snap_max": defaultdict(dict)})
+                p["headers"].append(obj)
+                p["header"] = obj
+                p["sites"] = {}
+                p["work"] = {}
+                cur = p
+            elif cur is None:
+                continue
+            elif "work" in obj:
+                cur["work"][(obj["work"], obj["site"])] = obj
+            elif "site" in obj:
+                cur["sites"][obj["site"]] = obj
+                snap = cur["snap_max"][obj["site"]]
+                for f in SNAPSHOT_FIELDS:
+                    v = obj.get(f, 0)
+                    if v > snap.get(f, 0):
+                        snap[f] = v
+                        snap[f + "_phase"] = cur["header"].get("phase_label", "?")
+    return procs
+
+
+def pe_image_base(binary: str) -> int | None:
+    """The preferred ImageBase of a PE file, or None for anything else. A PE
+    symboliser wants VA = ImageBase + RVA, and the dump gives RVA + runtime base."""
+    try:
+        with open(binary, "rb") as fh:
+            head = fh.read(4096)
+    except OSError:
+        return None
+    if head[:2] != b"MZ" or len(head) < 0x40:
+        return None
+    pe = int.from_bytes(head[0x3C:0x40], "little")
+    if head[pe:pe + 4] != b"PE\0\0":
+        return None
+    opt = pe + 24
+    magic = int.from_bytes(head[opt:opt + 2], "little")
+    if magic == 0x20B:  # PE32+
+        return int.from_bytes(head[opt + 24:opt + 32], "little")
+    if magic == 0x10B:  # PE32
+        return int.from_bytes(head[opt + 28:opt + 32], "little")
+    return None
+
+
+def symbolise(binary: str | None, base: str, addrs: list[str]) -> dict[str, str]:
+    if not binary or not addrs:
+        return {}
+    if not os.path.exists(binary) and os.path.exists(binary + ".exe"):
+        binary = binary + ".exe"
+    out: dict[str, str] = {}
+    uniq = sorted(set(addrs))
+    if platform.system() == "Darwin" and shutil.which("atos"):
+        for i in range(0, len(uniq), 2000):
+            chunk = uniq[i:i + 2000]
+            res = subprocess.run(["atos", "-o", binary, "-l", base] + chunk,
+                                 capture_output=True, text=True, check=False)
+            for addr, name in zip(chunk, res.stdout.splitlines()):
+                out[addr] = name.strip()
+    elif shutil.which("addr2line") or shutil.which("llvm-addr2line"):
+        tool = shutil.which("llvm-addr2line") or shutil.which("addr2line")
+        b = int(base, 16)
+        preferred = pe_image_base(binary) or 0
+        for i in range(0, len(uniq), 2000):
+            chunk = uniq[i:i + 2000]
+            rel = [hex(int(a, 16) - b + preferred) if b else a for a in chunk]
+            res = subprocess.run([tool, "-f", "-C", "-p", "-e", binary] + rel,
+                                 capture_output=True, text=True, check=False)
+            for addr, name in zip(chunk, res.stdout.splitlines()):
+                out[addr] = name.strip()
+    return out
+
+
+def pct(part: float, whole: float) -> float:
+    return 100.0 * part / whole if whole else 0.0
+
+
+def summarise(p: dict, names: dict[str, str]) -> dict:
+    s = defaultdict(int)
+    for addr, r in p["sites"].items():
+        s["slack_bytes"] += max(r["usable_bytes"] - r["requested_bytes"], 0)
+        for k in ("never_written_bytes", "over_requested_bytes", "zero_untouched_bytes",
+                  "realloc_copy_bytes", "short_lived", "raw_bytes", "acc_untouched_bytes",
+                  "acc_dead_bytes", "acc_idle_bytes", "acc_uninit_reads", "acc_opaque_blocks"):
+            s[k] += r.get(k, 0)
+        snap = p["snap_max"].get(addr, {})
+        s["dup_bytes_max"] += snap.get("dup_bytes", 0)
+        s["retained_bytes_max"] += snap.get("retained_bytes", 0)
+    for (kind, addr), w in p["work"].items():
+        if kind in CONTAINER_KINDS:
+            s["container_idle_peak_bytes"] += w.get("peak", max(w["bytes"] - w["aux1"], 0))
+            if kind == "ct_hash_table":
+                s["ht_growths"] += w["aux2"]
+        elif kind in BYTE_KINDS:
+            if ALLOCATOR_SYMBOL.match(names.get(addr, "")):
+                s["allocator_byte_work_bytes"] += w["bytes"]
+            else:
+                s["byte_work_bytes"] += w["bytes"]
+            s["byte_work_repeats"] += w["repeats"]
+        elif kind in IO_KINDS:
+            s["io_tiny_calls"] += w["aux1"]
+        elif kind in PATH_KINDS:
+            s["path_repeats"] += w["repeats"]
+        elif kind == "mutex":
+            s["mutex_contended"] += w["aux1"]
+        elif kind == "parallel_for":
+            s["pool_imbalance_items"] += w["aux1"]
+        elif kind == "pool_ops":
+            s["pool_ops_imbalance"] += w["aux1"]
+        elif kind == "ht_get":
+            s["ht_repeat_lookups"] += w["repeats"]
+    return dict(s)
+
+
+def fmt(v: float, unit: str) -> str:
+    if unit == "bytes":
+        return f"{v / MB:,.1f} MB"
+    return f"{v:,.0f} {unit}"
+
+
+SITE_SORTS = {
+    "bytes": lambda r, s: r["usable_bytes"],
+    "slack": lambda r, s: r["usable_bytes"] - r["requested_bytes"],
+    "never_written": lambda r, s: r.get("never_written_bytes", 0),
+    "over_requested": lambda r, s: r.get("over_requested_bytes", 0),
+    "churn": lambda r, s: r["short_lived"],
+    "copy": lambda r, s: r["realloc_copy_bytes"],
+    "live": lambda r, s: r["live_bytes"],
+    "allocs": lambda r, s: r["allocs"],
+    "dups": lambda r, s: s.get("dup_bytes", 0),
+    "retained": lambda r, s: s.get("retained_bytes", 0),
+    "dead": lambda r, s: r.get("acc_dead_bytes", 0),
+    "untouched": lambda r, s: r.get("acc_untouched_bytes", 0),
+    "idle": lambda r, s: r.get("acc_idle_bytes", 0),
+    "uninit": lambda r, s: r.get("acc_uninit_reads", 0),
+}
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("dump")
+    ap.add_argument("--binary", help="the binary that produced the dump, for symbolisation")
+    ap.add_argument("--top", type=int, default=20)
+    ap.add_argument("--sort", choices=sorted(SITE_SORTS), default="bytes")
+    ap.add_argument("--json", action="store_true", help="emit the merged tables as JSON")
+    args = ap.parse_args()
+
+    procs = load(args.dump)
+    if not procs:
+        print("no waste-sanitizer dump found in", args.dump, file=sys.stderr)
+        return 2
+
+    names_by_pid = {}
+    for pid, p in procs.items():
+        addrs = list(p["sites"].keys()) + [a for (_, a) in p["work"].keys()]
+        names_by_pid[pid] = symbolise(args.binary, p["header"].get("image_base", "0x0"), addrs)
+
+    if args.json:
+        out = {"processes": {}}
+        for pid, p in procs.items():
+            names = names_by_pid[pid]
+            out["processes"][str(pid)] = {
+                "header": p["header"],
+                "phases": [h.get("phase_label") for h in p["headers"]],
+                "summary": summarise(p, names),
+                "sites": [dict(r, name=names.get(a, a),
+                               **{(k if k.endswith("_phase") else k + "_max"): v
+                                  for k, v in p["snap_max"].get(a, {}).items()})
+                          for a, r in p["sites"].items()],
+                "work": [dict(w, name=names.get(a, a)) for (_, a), w in p["work"].items()],
+            }
+        json.dump(out, sys.stdout, indent=1)
+        print()
+        return 0
+
+    # Work-heavy processes first: the index worker is the one that matters.
+    order = sorted(procs.items(), key=lambda kv: -kv[1]["header"].get("usable_bytes", 0))
+    for pid, p in order:
+        h = p["header"]
+        names = names_by_pid[pid]
+        s = summarise(p, names)
+        print("=" * 110)
+        print(f"process {pid}  last dump={h.get('why')}  phases={len(p['headers'])}  allocs={h['allocs']:,}  "
+              f"cum={h['usable_bytes'] / MB:,.0f} MB  live={h['live_bytes'] / MB:,.0f} MB  "
+              f"rss={h.get('rss_bytes', 0) / MB:,.0f} MB  sites={h['sites']:,}  fill={h.get('fill')}  access={h.get('access')}  "
+              f"layer={h.get('layer_vm_bytes', 0) / MB:,.0f} MB/{h.get('layer_threads', 0)} threads")
+        blind = {k: h.get(k, 0) for k in ("site_table_full", "pointer_table_full", "work_table_full", "untracked_frees")}
+        if any(blind.values()):
+            print("  blind spots: " + "  ".join(f"{k}={v:,}" for k, v in blind.items()))
+        if h.get("foreign_frees", 0):
+            print(f"  outside the shim: {h['foreign_frees']:,} frees of blocks another allocator made "
+                  "(C runtime / system DLL; their allocations are invisible to the layer)")
+        print()
+        print("  WASTE SUMMARY")
+        for key, label, unit in WASTE_CLASSES:
+            v = s.get(key, 0)
+            if v:
+                print(f"    {fmt(v, unit):>18}  {label}")
+        if len(p["sites"]) == 0 and len(p["work"]) == 0:
+            continue
+
+        print()
+        print(f"  MEMORY — top {args.top} sites by {args.sort}")
+        print(f"    {'cum MB':>9} {'allocs':>12} {'slack%':>6} {'churn%':>6} {'copy MB':>8} {'unwrit MB':>9} "
+              f"{'overreq MB':>10} {'dup MB':>7} {'retain MB':>9} {'raw%':>5} {'live MB':>8}  site")
+        key = SITE_SORTS[args.sort]
+        rows = sorted(p["sites"].items(), key=lambda kv: (-key(kv[1], p["snap_max"].get(kv[0], {})), kv[0]))
+        for addr, r in rows[:args.top]:
+            snap = p["snap_max"].get(addr, {})
+            print(f"    {r['usable_bytes'] / MB:>9,.1f} {r['allocs']:>12,} "
+                  f"{pct(r['usable_bytes'] - r['requested_bytes'], r['usable_bytes']):>6.1f} "
+                  f"{pct(r['short_lived'], r['allocs']):>6.1f} {r['realloc_copy_bytes'] / MB:>8,.1f} "
+                  f"{r.get('never_written_bytes', 0) / MB:>9,.1f} {r.get('over_requested_bytes', 0) / MB:>10,.1f} "
+                  f"{snap.get('dup_bytes', 0) / MB:>7,.1f} {snap.get('retained_bytes', 0) / MB:>9,.1f} "
+                  f"{pct(r['raw_bytes'], r['usable_bytes']):>5.0f} {r['live_bytes'] / MB:>8,.1f}  "
+                  f"{names.get(addr, addr)[:90]}")
+
+        if h.get("access"):
+            # The access lane's verdicts per allocation site. Library-owned blocks (a FILE
+            # buffer) are not tracked; bytes a library wrote without a store callback are
+            # recognised through the fill pattern.
+            acc_cols = [("untouched", "acc_untouched_bytes", "never read or written"),
+                        ("dead", "acc_dead_bytes", "written, never read"),
+                        ("idle", "acc_idle_bytes", "idle for a phase before free")]
+            for sort_key, field, label in acc_cols:
+                rows = [(a, r) for a, r in p["sites"].items() if r.get(field, 0) > 0]
+                if not rows:
+                    continue
+                print()
+                print(f"  ACCESS — top {args.top} sites by bytes {label}")
+                print(f"    {'MB':>9} {'blocks':>11} {'allocs':>12} {'uninit rd':>10}  site")
+                blocks_field = field.replace("_bytes", "_blocks")
+                for a, r in sorted(rows, key=lambda t: (-t[1][field], t[0]))[:args.top]:
+                    print(f"    {r[field] / MB:>9,.1f} {r.get(blocks_field, 0):>11,} {r['allocs']:>12,} "
+                          f"{r.get('acc_uninit_reads', 0):>10,}  {names.get(a, a)[:90]}")
+            rows = [(a, r) for a, r in p["sites"].items() if r.get("acc_uninit_reads", 0) > 0]
+            if rows:
+                print()
+                print(f"  ACCESS — top {args.top} sites by blocks read before any write (not calloc)")
+                print(f"    {'blocks':>11} {'allocs':>12}  site")
+                for a, r in sorted(rows, key=lambda t: (-t[1]["acc_uninit_reads"], t[0]))[:args.top]:
+                    print(f"    {r['acc_uninit_reads']:>11,} {r['allocs']:>12,}  {names.get(a, a)[:90]}")
+
+        ct = [(k, a, w) for (k, a), w in p["work"].items() if k in CONTAINER_KINDS]
+        if ct:
+            print()
+            # A container reports at every reset: calls are USES, cap/used sum over uses.
+            # "peak idle" is the largest capacity a single instance left unused.
+            print(f"  CONTAINERS — top {args.top} by largest unused capacity of one instance")
+            print(f"    {'kind':<10} {'uses':>9} {'avg cap MB':>10} {'avg used MB':>11} {'unused%':>7} "
+                  f"{'peak idle MB':>12} {'growths':>9}  created at")
+            for k, a, w in sorted(ct, key=lambda t: (-t[2].get("peak", 0), t[1]))[:args.top]:
+                uses = max(w["calls"], 1)
+                print(f"    {k[3:]:<10} {w['calls']:>9,} {w['bytes'] / uses / MB:>10,.2f} {w['aux1'] / uses / MB:>11,.2f} "
+                      f"{pct(w['bytes'] - w['aux1'], w['bytes']):>7.1f} {w.get('peak', 0) / MB:>12,.1f} "
+                      f"{w['aux2']:>9,}  {names.get(a, a)[:90]}")
+
+        def section(title, kinds, sort_key, cols):
+            rows = [(k, a, w) for (k, a), w in p["work"].items() if k in kinds]
+            if not rows:
+                return
+            print()
+            print(f"  CPU — {title}")
+            print("    " + "  ".join(f"{c[0]:>{c[1]}}" for c in cols) + "  site")
+            for k, a, w in sorted(rows, key=lambda t: (-sort_key(t[2]), t[1]))[:args.top]:
+                cells = []
+                for c in cols:
+                    v = c[2](k, w)
+                    cells.append(f"{v:>{c[1]}}" if isinstance(v, str) else f"{v:>{c[1]},.0f}")
+                print("    " + "  ".join(cells) + f"  {names.get(a, a)[:90]}")
+
+        section("byte work (mem*/str*) by bytes", BYTE_KINDS, lambda w: w["bytes"],
+                [("kind", 8, lambda k, w: k), ("calls", 12, lambda k, w: w["calls"]),
+                 ("MB", 10, lambda k, w: w["bytes"] / MB), ("repeats", 10, lambda k, w: w["repeats"]),
+                 ("max call", 10, lambda k, w: w.get("peak", 0))])
+        section("I/O by calls", IO_KINDS, lambda w: w["calls"],
+                [("kind", 8, lambda k, w: k), ("calls", 12, lambda k, w: w["calls"]),
+                 ("MB", 10, lambda k, w: w["bytes"] / MB), ("tiny", 10, lambda k, w: w["aux1"])])
+        section("paths opened/statted again", PATH_KINDS, lambda w: w["repeats"],
+                [("kind", 8, lambda k, w: k), ("calls", 12, lambda k, w: w["calls"]),
+                 ("repeats", 10, lambda k, w: w["repeats"]), ("failed", 10, lambda k, w: w["aux1"])])
+        section("mutex contention", {"mutex"}, lambda w: w["aux1"],
+                [("calls", 12, lambda k, w: w["calls"]), ("contended", 10, lambda k, w: w["aux1"])])
+        section("parallel_for imbalance", {"parallel_for"}, lambda w: w["aux1"],
+                [("calls", 8, lambda k, w: w["calls"]), ("items", 10, lambda k, w: w["bytes"]),
+                 ("imbalance", 10, lambda k, w: w["aux1"])])
+        # imbalance / (work + imbalance): the share of the pool's capacity that sat idle
+        # while the busiest worker finished (0% = perfectly even).
+        section("pool balance by work done (per-worker events)", {"pool_ops"}, lambda w: w["aux1"],
+                [("calls", 8, lambda k, w: w["calls"]), ("events", 14, lambda k, w: w["bytes"]),
+                 ("idle%", 6, lambda k, w: f"{pct(w['aux1'], w['bytes'] + w['aux1']):.1f}"),
+                 ("workers", 8, lambda k, w: w["aux2"] / max(w["calls"], 1))])
+        section("hash-table lookups", {"ht_get"}, lambda w: w["repeats"],
+                [("gets", 12, lambda k, w: w["calls"]), ("misses", 12, lambda k, w: w["aux1"]),
+                 ("repeats", 12, lambda k, w: w["repeats"])])
+        section("dead writes (access lane)", {"dead_write"}, lambda w: w["bytes"],
+                [("blocks", 10, lambda k, w: w["aux1"]), ("MB", 10, lambda k, w: w["bytes"] / MB)])
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/memwaste-scaling.py b/scripts/memwaste-scaling.py
new file mode 100644
index 000000000..ea8f1b060
--- /dev/null
+++ b/scripts/memwaste-scaling.py
@@ -0,0 +1,262 @@
+#!/usr/bin/env python3
+"""
+memwaste-scaling.py — the CPU scaling lane of the waste sanitizer.
+
+Work that grows faster than the input is the costliest CPU waste there is, and a
+single run cannot see it: a function that burns 5 % of the time on the Go corpus
+may burn 60 % on a corpus four times larger. This lane indexes the SAME real
+source tree replicated K times and 2K times, with clang's execution counters in
+every object (vendored ones included), and compares, function by function, how
+much work each leg did. Linear work doubles; a function whose counters grow by
+more than --threshold (default 2.3, i.e. 15 % above linear) while doing at least
+--min-excess extra counter increments is reported as super-linear.
+
+The counters are COUNTS, not time: the verdict is a function of the code and the
+input, so it can gate (O9). Wall time is printed as information only.
+
+Replicas are hard links (copies when the file system refuses) under
+<out>/leg-<n>/r<i>/, so every replica is a separate directory -- a separate Go
+package, a separate module -- and the registry, namespace and resolution paths
+see N times the same names: exactly the coupling behind the #1669 class of bugs.
+
+Usage:
+    scripts/memwaste-scaling.py --corpus ~/perf-bench/go/src/net --replicas 2
+    scripts/memwaste-scaling.py --corpus DIR --replicas 3 --no-build --json
+
+Build: MEMWASTE_PROFILE=1 into build/memwaste-profile with clang (the driver does
+it unless --no-build). llvm-profdata is taken from the directory of the clang
+that built the binary, so the profile format always matches.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+BUILD_DIR = "build/memwaste-profile"
+
+
+def find_profdata(cc: str) -> str:
+    cc_path = shutil.which(cc)
+    if cc_path:
+        cand = os.path.join(os.path.dirname(os.path.realpath(cc_path)), "llvm-profdata")
+        if os.access(cand, os.X_OK):
+            return cand
+    for name in ("llvm-profdata",) + tuple(f"llvm-profdata-{v}" for v in range(30, 13, -1)):
+        p = shutil.which(name)
+        if p:
+            return p
+    if shutil.which("xcrun"):
+        res = subprocess.run(["xcrun", "--find", "llvm-profdata"], capture_output=True, text=True, check=False)
+        if res.returncode == 0 and res.stdout.strip():
+            return res.stdout.strip()
+    sys.exit("memwaste-scaling: llvm-profdata not found next to the compiler or on PATH")
+
+
+def replicate(src: str, dst: str, copies: int) -> int:
+    """Hard-link `copies` replicas of src under dst/r<i>; returns the file count."""
+    files = 0
+    for i in range(copies):
+        base = os.path.join(dst, f"r{i}")
+        for dirpath, dirnames, filenames in os.walk(src):
+            dirnames[:] = [d for d in dirnames if d not in (".git", ".hg", ".svn")]
+            rel = os.path.relpath(dirpath, src)
+            out_dir = os.path.join(base, rel)
+            os.makedirs(out_dir, exist_ok=True)
+            for name in filenames:
+                s = os.path.join(dirpath, name)
+                if os.path.islink(s) or not os.path.isfile(s):
+                    continue
+                d = os.path.join(out_dir, name)
+                try:
+                    os.link(s, d)
+                except OSError:
+                    shutil.copy2(s, d)
+                files += 1
+    return files
+
+
+def run_leg(binary: str, profdata: str, corpus: str, work: str, copies: int) -> tuple[dict, dict]:
+    leg = os.path.join(work, f"leg-{copies}")
+    tree = os.path.join(leg, "corpus")
+    os.makedirs(tree, exist_ok=True)
+    nfiles = replicate(corpus, tree, copies)
+    raw_dir = os.path.join(leg, "profraw")
+    os.makedirs(raw_dir, exist_ok=True)
+    runtime = tempfile.mkdtemp(prefix="cbm-sc.", dir="/tmp")
+    os.chmod(runtime, 0o700)
+    env = dict(os.environ)
+    env.update({
+        "LLVM_PROFILE_FILE": os.path.join(raw_dir, "cbm-%p.profraw"),
+        "CBM_PROFILE_DIR": raw_dir,  # the index worker names its own: worker-<pid>.profraw
+        "CBM_CACHE_DIR": os.path.join(leg, "cache"),
+        "CBM_RUNTIME_DIR": runtime,
+        "CBM_LOG_LEVEL": "error",
+    })
+    env.pop("CBM_MEMWASTE", None)  # production code paths: the event layer stays dormant
+    t0 = time.monotonic()
+    try:
+        res = subprocess.run([binary, "cli", "index_repository", "--repo-path", tree, "--mode", "full"],
+                             env=env, capture_output=True, text=True, check=False)
+    finally:
+        shutil.rmtree(runtime, ignore_errors=True)
+    wall = time.monotonic() - t0
+    if res.returncode != 0:
+        sys.exit(f"memwaste-scaling: index of leg {copies} failed (rc={res.returncode}):\n{res.stderr[-2000:]}")
+    raws = sorted(os.path.join(raw_dir, f) for f in os.listdir(raw_dir) if f.endswith(".profraw"))
+    workers = [r for r in raws if os.path.basename(r).startswith("worker-")]
+    if not workers:
+        sys.exit("memwaste-scaling: the index worker wrote no profile -- is the binary built with "
+                 "MEMWASTE_PROFILE=1, and does it call cbm_memev_process_exit before _Exit?")
+    # The comparison is the WORKER's work: the daemon and CLI processes differ in
+    # number between legs (and hash the binary at start-up), which is not scaling.
+    info = {"copies": copies, "files": nfiles, "wall_s": round(wall, 1), "profiles": len(raws)}
+    return merge_counts(profdata, workers, os.path.join(leg, "worker.profdata")), \
+        dict(info, other=merge_counts(profdata, [r for r in raws if r not in workers],
+                                      os.path.join(leg, "other.profdata")))
+
+
+def merge_counts(profdata: str, raws: list[str], merged: str) -> dict[str, int]:
+    if not raws:
+        return {}
+    subprocess.run([profdata, "merge", "-o", merged] + raws, check=True)
+    shown = subprocess.run([profdata, "show", "--all-functions", "--counts", merged],
+                           capture_output=True, text=True, check=True).stdout
+    return parse_counts(shown)
+
+
+FUNC_RE = re.compile(r"^  (\S.*):$")
+
+
+def parse_counts(text: str) -> dict[str, int]:
+    """Total counter increments per function from `llvm-profdata show --counts`."""
+    out: dict[str, int] = {}
+    name = None
+    for line in text.splitlines():
+        m = FUNC_RE.match(line)
+        if m:
+            name = m.group(1)
+            continue
+        if name is None:
+            continue
+        s = line.strip()
+        if s.startswith("Function count:"):
+            out[name] = out.get(name, 0) + int(s.split(":", 1)[1])
+        elif s.startswith("Block counts:"):
+            vals = s.split(":", 1)[1].strip().strip("[]")
+            if vals:
+                out[name] = out.get(name, 0) + sum(int(v) for v in vals.split(",") if v.strip())
+    return out
+
+
+def display_name(raw: str) -> str:
+    # static functions are "file.c;name" (or "file.c:name" in older formats)
+    for sep in (";", ":"):
+        if sep in raw:
+            file_part, fn = raw.rsplit(sep, 1)
+            return f"{fn}  ({os.path.basename(file_part)})"
+    return raw
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--corpus", required=True, help="a real source tree to replicate")
+    ap.add_argument("--replicas", type=int, default=2, help="K: legs index K and 2K replicas")
+    ap.add_argument("--threshold", type=float, default=2.3, help="2K/K counter ratio that is super-linear")
+    ap.add_argument("--min-excess", type=int, default=10_000_000,
+                    help="ignore functions whose work beyond linear is below this many counter increments")
+    ap.add_argument("--top", type=int, default=30)
+    ap.add_argument("--out", help="work directory (default: a new temp dir)")
+    ap.add_argument("--no-build", action="store_true")
+    ap.add_argument("--cc", default="clang")
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args()
+
+    corpus = os.path.abspath(os.path.expanduser(args.corpus))
+    if not os.path.isdir(corpus):
+        sys.exit(f"memwaste-scaling: {corpus} is not a directory")
+    binary = os.path.join(ROOT, BUILD_DIR, "codebase-memory-mcp")
+    if not args.no_build:
+        cxx = "clang++" if args.cc == "clang" else args.cc.replace("clang", "clang++")
+        subprocess.run([os.path.join(ROOT, "scripts", "build.sh"), f"BUILD_DIR={BUILD_DIR}",
+                        "MEMWASTE_PROFILE=1", f"CC={args.cc}", f"CXX={cxx}"],
+                       check=True, stdout=subprocess.DEVNULL)
+    if not os.access(binary, os.X_OK):
+        sys.exit(f"memwaste-scaling: {binary} is missing (build it, or drop --no-build)")
+    profdata = find_profdata(args.cc)
+    work = os.path.abspath(args.out) if args.out else tempfile.mkdtemp(prefix="cbm-scaling.")
+    os.makedirs(work, exist_ok=True)
+    for sub in os.listdir(work):
+        if sub.startswith("leg-"):
+            shutil.rmtree(os.path.join(work, sub), ignore_errors=True)
+
+    k = args.replicas
+    small, info_k = run_leg(binary, profdata, corpus, work, k)
+    large, info_2k = run_leg(binary, profdata, corpus, work, 2 * k)
+
+    total_k = sum(small.values())
+    total_2k = sum(large.values())
+    rows = []
+    for name, c2 in large.items():
+        c1 = small.get(name, 0)
+        excess = c2 - 2 * c1
+        ratio = (c2 / c1) if c1 else float("inf")
+        rows.append({"function": name, "k": c1, "2k": c2, "ratio": ratio, "excess": excess})
+    flagged = [r for r in rows if r["ratio"] > args.threshold and r["excess"] >= args.min_excess]
+    flagged.sort(key=lambda r: -r["excess"])
+    heaviest = sorted(rows, key=lambda r: -r["2k"])[: args.top]
+
+    for info in (info_k, info_2k):
+        other = info.pop("other", {}) or {}
+        info["other_total"] = sum(other.values())
+        info["other_top"] = sorted(other.items(), key=lambda kv: -kv[1])[:10]
+    report = {
+        "corpus": corpus, "legs": [info_k, info_2k], "threshold": args.threshold,
+        "min_excess": args.min_excess, "total_counts": {"k": total_k, "2k": total_2k},
+        "total_ratio": (total_2k / total_k) if total_k else None,
+        "superlinear": flagged,
+        "work_dir": work,
+    }
+    if args.json:
+        json.dump(report, sys.stdout, indent=1, default=lambda o: None if o == float("inf") else o)
+        print()
+        return 1 if flagged else 0
+
+    print(f"corpus {corpus}")
+    for info in (info_k, info_2k):
+        print(f"  leg {info['copies']:>2} replicas: {info['files']:,} files, {info['profiles']} process profile(s), "
+              f"{info['wall_s']} s wall (information only)")
+    print(f"  worker counter increments: k={total_k:,}  2k={total_2k:,}  ratio={report['total_ratio']:.3f}")
+    for info in (info_k, info_2k):
+        other = info.get("other") or {}
+        top = sorted(other.items(), key=lambda kv: -kv[1])[:3]
+        print(f"  other processes at {info['copies']} replicas: {sum(other.values()):,} increments; heaviest: "
+              + ", ".join(f"{display_name(n)} {c:,}" for n, c in top))
+    print()
+    print(f"  SUPER-LINEAR — ratio > {args.threshold} and >= {args.min_excess:,} increments beyond linear")
+    if not flagged:
+        print("    none")
+    else:
+        print(f"    {'ratio':>7} {'excess':>16} {'k':>16} {'2k':>16}  function")
+        for r in flagged[: args.top]:
+            ratio = "new" if r["ratio"] == float("inf") else f"{r['ratio']:.2f}"
+            print(f"    {ratio:>7} {r['excess']:>16,} {r['k']:>16,} {r['2k']:>16,}  {display_name(r['function'])[:100]}")
+    print()
+    print(f"  HEAVIEST at 2k — top {args.top} by counter increments (share of all work, scaling ratio)")
+    for r in heaviest:
+        ratio = "new" if r["ratio"] == float("inf") else f"{r['ratio']:.2f}"
+        print(f"    {100.0 * r['2k'] / total_2k:>6.2f}%  x{ratio:>5}  {display_name(r['function'])[:100]}")
+    print()
+    print(f"work dir: {work}")
+    return 1 if flagged else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/memwaste.sh b/scripts/memwaste.sh
new file mode 100755
index 000000000..8d1935d7e
--- /dev/null
+++ b/scripts/memwaste.sh
@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+# memwaste.sh — run the waste sanitizer on a repository and print the ranked report.
+#
+# The sanitizer (src/foundation/mem_events.h) measures memory that is CORRECT but
+# unnecessary: allocator slack, churn, realloc copying, memory that never reaches
+# the memory core. This driver is the one entry point for every venue: a local
+# run on a bench corpus, the PR-CI fixture run, the dry-run and release runs.
+#
+# Usage:
+#   scripts/memwaste.sh <repo-path> [--lane event|access] [--top N] [--sort METRIC]
+#                                   [--out DIR] [--no-build] [--json] [--binary PATH]
+#
+# --binary runs a kept copy of a flavour binary (a baseline, a replay) instead of
+# the one in the build directory; it implies --no-build.
+#
+# What it does
+#   1. builds the `memwaste` flavour (production flags + the event layer) into
+#      build/memwaste, unless --no-build;
+#   2. indexes <repo-path> with CBM_MEMWASTE=1 into a private cache and a private,
+#      SHORT runtime directory (the coordination socket has a 104-byte path limit);
+#   3. prints the symbolised report and writes the raw dump + JSON next to it;
+#   4. FAILS when the measurement itself is unsound: a table overflowed, or more
+#      than 0.1 % of frees were of blocks the layer never saw. A sanitizer that
+#      silently loses records produces false confidence.
+#
+# Nothing here reads a clock to decide anything: wall time is printed as
+# information only. Gates are counts.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+REPO=""
+TOP=25
+SORT=bytes
+OUT=""
+BUILD=1
+JSON=0
+LANE=event
+BINARY_OVERRIDE=""
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+    --binary) BINARY_OVERRIDE="$2"; BUILD=0; shift 2 ;;
+    --top) TOP="$2"; shift 2 ;;
+    --sort) SORT="$2"; shift 2 ;;
+    --out) OUT="$2"; shift 2 ;;
+    --no-build) BUILD=0; shift ;;
+    --json) JSON=1; shift ;;
+    --lane) LANE="$2"; shift 2 ;;
+    -h | --help) sed -n '2,24p' "$0"; exit 0 ;;
+    # A typo'd flag must never be read as the repository path — it would index
+    # nothing and report an empty lane as a clean one.
+    -*) echo "memwaste.sh: unknown argument $1. Please consult --help." >&2; exit 2 ;;
+    *) REPO="$1"; shift ;;
+    esac
+done
+
+if [ -z "$REPO" ] || [ ! -d "$REPO" ]; then
+    echo "memwaste.sh: a repository directory is required. Please consult --help." >&2
+    exit 2
+fi
+
+case "$LANE" in
+event) BUILD_ARGS=(BUILD_DIR=build/memwaste MEMWASTE=1 ${CC:+CC=$CC} ${CXX:+CXX=$CXX})
+    BIN="$ROOT/build/memwaste/codebase-memory-mcp" ;;
+access) BUILD_ARGS=(BUILD_DIR=build/memwaste-access MEMWASTE_ACCESS=1 CC=clang CXX=clang++)
+    BIN="$ROOT/build/memwaste-access/codebase-memory-mcp" ;;
+*) echo "memwaste.sh: --lane must be event or access" >&2; exit 2 ;;
+esac
+if [ "$BUILD" -eq 1 ]; then
+    "$ROOT/scripts/build.sh" "${BUILD_ARGS[@]}" >/dev/null
+fi
+if [ -n "$BINARY_OVERRIDE" ]; then
+    BIN="$BINARY_OVERRIDE"
+fi
+if [ ! -x "$BIN" ]; then
+    echo "memwaste.sh: $BIN is missing (build failed, or --no-build without a build)" >&2
+    exit 2
+fi
+
+if [ -z "$OUT" ]; then
+    OUT="$(mktemp -d "${TMPDIR:-/tmp}/cbm-memwaste.XXXXXX")"
+fi
+mkdir -p "$OUT"
+DUMP="$OUT/memwaste.jsonl"
+rm -f "$DUMP"
+
+RUN_BIN="$BIN"
+if command -v cygpath >/dev/null 2>&1 && ! command -v winepath >/dev/null 2>&1; then
+    # Native Windows: the server walks the ancestor chain of its binary, cache and
+    # runtime directories and refuses any that grant mutation to untrusted SIDs.
+    # The checkout and msys /tmp both do, so the run happens from a root under
+    # USERPROFILE stamped to the current user, SYSTEM and Administrators -- by
+    # SID, the way scripts/memlab.sh does it (#1532).
+    PROFILE_DIR="$(cygpath -u "$USERPROFILE")"
+    WORK="$(mktemp -d "$PROFILE_DIR/cbm-mw.XXXXXX")"
+    WORK_W="$(cygpath -w "$WORK")"
+    SID_QUERY='[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value'
+    ME="$(powershell.exe -NoProfile -NonInteractive -Command "$SID_QUERY" 2>/dev/null | tr -d '\r\n')"
+    case "$ME" in
+    S-1-*) ME="*$ME" ;;
+    *) echo "memwaste.sh: could not resolve the current user's SID" >&2; exit 2 ;;
+    esac
+    if ! MSYS2_ARG_CONV_EXCL='*' icacls "$WORK_W" /inheritance:r \
+        /grant:r "${ME}:(OI)(CI)F" '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' /Q >/dev/null 2>&1; then
+        echo "memwaste.sh: could not stamp $WORK" >&2
+        exit 2
+    fi
+    mkdir -p "$WORK/cache" "$WORK/rt"
+    cp "$BIN.exe" "$WORK/codebase-memory-mcp.exe" 2>/dev/null || cp "$BIN" "$WORK/codebase-memory-mcp.exe"
+    RUN_BIN="$WORK/codebase-memory-mcp.exe"
+    CACHE_DIR="$WORK_W\\cache"
+    RUNTIME="$WORK_W\\rt"
+    DUMP_ENV="$(cygpath -w "$DUMP")"
+else
+    WORK="$(mktemp -d /tmp/cbm-mw.XXXXXX)"
+    chmod 700 "$WORK"
+    # A fresh cache every run: an existing index turns --mode full into an
+    # incremental pass that measures hashing instead of indexing.
+    rm -rf "$OUT/cache"
+    mkdir -p "$OUT/cache"
+    CACHE_DIR="$OUT/cache"
+    RUNTIME="$WORK"
+    DUMP_ENV="$DUMP"
+fi
+
+# CBM_MEMWASTE_KEEP=1 keeps the private root (binary copy, cache, logs) for inspection.
+cleanup() {
+    if [ "${CBM_MEMWASTE_KEEP:-0}" != 1 ]; then
+        rm -rf "$WORK"
+    fi
+}
+trap cleanup EXIT
+
+INDEX_RC=0
+CBM_MEMWASTE=1 CBM_MEMWASTE_OUT="$DUMP_ENV" CBM_CACHE_DIR="$CACHE_DIR" CBM_RUNTIME_DIR="$RUNTIME" \
+    CBM_LOG_LEVEL=error "$RUN_BIN" cli index_repository --repo-path "$REPO" --mode full \
+    >"$OUT/index.json" || INDEX_RC=$?
+if [ "$INDEX_RC" -ne 0 ]; then
+    # A failed index is a finding about the flavour, never a silent partial report.
+    echo "memwaste.sh: the index failed (rc=$INDEX_RC); its logs follow" >&2
+    for log in "$WORK"/cache/logs/* "$WORK"/cache/logs/.worker-log-* "$OUT"/cache/logs/* "$OUT"/cache/logs/.worker-log-*; do
+        if [ -f "$log" ]; then
+            echo "--- $log" >&2
+            tail -n 60 "$log" >&2
+        fi
+    done
+    exit 1
+fi
+
+if [ ! -s "$DUMP" ]; then
+    echo "memwaste.sh: the sanitizer wrote no dump -- is the flavour built with MEMWASTE=1?" >&2
+    exit 1
+fi
+
+python3 "$ROOT/scripts/memwaste-report.py" "$DUMP" --binary "$BIN" --json >"$OUT/memwaste.json"
+if [ "$JSON" -eq 1 ]; then
+    cat "$OUT/memwaste.json"
+else
+    python3 "$ROOT/scripts/memwaste-report.py" "$DUMP" --binary "$BIN" --top "$TOP" --sort "$SORT"
+    echo
+    echo "raw dump: $DUMP"
+    echo "json:     $OUT/memwaste.json"
+fi
+
+# Soundness of the measurement itself.
+python3 - "$OUT/memwaste.json" <<'PY'
+import json, sys
+procs = json.load(open(sys.argv[1]))["processes"]
+bad = []
+for pid, proc in procs.items():
+    h = proc["header"]
+    if h.get("site_table_full", 0) or h.get("pointer_table_full", 0):
+        bad.append(f"process {pid}: a table overflowed (sites={h.get('site_table_full')}, pointers={h.get('pointer_table_full')})")
+    frees = h.get("frees", 0) + h.get("untracked_frees", 0)
+    if frees and h.get("untracked_frees", 0) * 1000 > frees:
+        bad.append(f"process {pid}: {h['untracked_frees']:,} of {frees:,} frees were of blocks the layer never saw (> 0.1 %)")
+if bad:
+    print("memwaste.sh: UNSOUND MEASUREMENT", file=sys.stderr)
+    for b in bad:
+        print("  " + b, file=sys.stderr)
+    sys.exit(1)
+PY
diff --git a/scripts/run-test-wave.py b/scripts/run-test-wave.py
index d24f80815..ce7e3d344 100755
--- a/scripts/run-test-wave.py
+++ b/scripts/run-test-wave.py
@@ -26,7 +26,19 @@ SUITE_NAME = re.compile(r"^[a-z0-9_]+$")
 SUMMARY = re.compile(r"^  (?P<passed>[0-9]+) passed")
 FAILED = re.compile(r"(?:^|, )(?P<failed>[0-9]+) failed")
 SKIPPED = re.compile(r"(?:^|, )(?P<skipped>[0-9]+) skipped")
-SLOW_SUITES = frozenset(("incremental", "store_arch", "daemon_runtime"))
+# Suites whose honest runtime does not fit the default per-suite budget, and so
+# get --slow-timeout instead. This is a statement about SIZE, never about
+# flakiness: every suite here is deterministic and simply long, and a racy suite
+# must be made deterministic rather than given more clock.
+#
+# `cli` joined the list because the classification had gone stale, not because
+# anything regressed. It spends 497s of the 900s default on macos-14 -- the
+# FASTEST macOS runner -- while the macos-15-intel runner in the same matrix is
+# 2.4-3.6x slower on comparable suites (daemon_runtime 842s vs 349s,
+# stack_overflow_b 277s vs 76s). 497s at that ratio cannot fit, so the suite was
+# killed at 900s and reported as hung. daemon_runtime, at 842s on that same
+# runner, survives only because it was already listed here.
+SLOW_SUITES = frozenset(("incremental", "store_arch", "daemon_runtime", "cli"))
 POLL_SECONDS = 0.05
 
 # WHY: the Windows descendant probe below is a cold `powershell.exe` + CIM
diff --git a/scripts/sanitizer-coverage-map.py b/scripts/sanitizer-coverage-map.py
new file mode 100644
index 000000000..d961ec976
--- /dev/null
+++ b/scripts/sanitizer-coverage-map.py
@@ -0,0 +1,306 @@
+#!/usr/bin/env python3
+"""
+sanitizer-coverage-map.py — what our sanitizer lanes instrument, what they
+actually execute, and every hole, vendored code included.
+
+A sanitizer only checks code that runs under it. A function no suite reaches is
+unchecked in every lane, and until now nobody could name those functions. This
+tool answers three questions and keeps the answers from regressing:
+
+  static    Which translation units does each lane COMPILE with its sanitizer,
+            per the build's own compile commands (make -n)? Lists every TU no
+            dynamic lane instruments and every TU the static lanes filter out.
+  run       Build one lane with clang source coverage on top of its sanitizer
+            flags, run its test runner (suites optional), and export per-function
+            execution counts (lcov) -- vendored objects included, because the
+            flags ride on the lane's own sanitizer variable, which the vendored
+            rules already use.
+  union     Merge the per-lane exports: the functions that ran under NO lane,
+            grouped by file, vendored code flagged.
+  ratchet   Compare a union against the checked-in baseline: a function that
+            joins the never-executed list fails; one that leaves it is reported
+            so the baseline can be lowered.
+  map       Validate and print scripts/sanitizer-map.json: every defect class x
+            platform cell must be covered, partial, or a named limit with a reason.
+
+`run` executes test suites, so it belongs to the lane's own venue (local CI, the
+CI job); `static`, `union`, `ratchet` and `map` run anywhere in seconds.
+
+Usage:
+    scripts/sanitizer-coverage-map.py static
+    scripts/sanitizer-coverage-map.py run --lane asan --out build/covmap [SUITE...]
+    scripts/sanitizer-coverage-map.py union --out build/covmap
+    scripts/sanitizer-coverage-map.py ratchet --out build/covmap
+    scripts/sanitizer-coverage-map.py map
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+from collections import defaultdict
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+BASELINE = os.path.join(ROOT, "scripts", "sanitizer-coverage-baseline.txt")
+MAP_FILE = os.path.join(ROOT, "scripts", "sanitizer-map.json")
+COVERAGE_FLAGS = "-fprofile-instr-generate -fcoverage-mapping"
+SRC_EXT = (".c", ".cc", ".cpp")
+
+# lane -> how the lane builds and runs. `var` is the make variable carrying the
+# lane's sanitizer flags; the coverage flags are appended to it.
+LANES = {
+    "asan": {"target": "test-runner", "var": "SANITIZE",
+             "value": "-fsanitize=address,undefined -fno-omit-frame-pointer", "env": {}},
+    "tsan": {"target": "test-runner-tsan", "var": "TSAN_SANITIZE",
+             "value": "-fsanitize=thread -fno-omit-frame-pointer",
+             "env": {"TSAN_OPTIONS": "halt_on_error=1:report_thread_leaks=0"}},
+    "lsan": {"target": "test-runner", "var": "SANITIZE",
+             "value": "-fsanitize=address,undefined -fno-omit-frame-pointer",
+             "env": {"ASAN_OPTIONS": "detect_leaks=1:halt_on_error=1"}},
+}
+DYNAMIC_FLAGS = ("-fsanitize=address", "-fsanitize=thread", "-fsanitize=memory", "-fsanitize=undefined",
+                 "-fsanitize=address,undefined")
+
+
+def is_vendored(path: str) -> bool:
+    # grammar_<lang>.c and the runtime/unity wrappers only #include vendored sources
+    base = os.path.basename(path)
+    return "vendored/" in path or base.startswith(("grammar_", "ts_runtime")) or base in (
+        "sqlite3.c", "mimalloc.c", "unixcoder_blob.c")
+
+
+def dry_commands(target: str, extra: list[str]) -> list[list[str]]:
+    res = subprocess.run(["make", "-f", "Makefile.cbm", "-n", "-B", target] + extra,
+                         cwd=ROOT, capture_output=True, text=True, check=False)
+    cmds = []
+    for line in res.stdout.replace("\\\n", " ").splitlines():
+        try:
+            argv = shlex.split(line)
+        except ValueError:
+            continue
+        if argv and any(a.endswith(SRC_EXT) for a in argv) and ("-c" in argv or "-o" in argv):
+            cmds.append(argv)
+    return cmds
+
+
+def make_var(name: str) -> list[str]:
+    """The fully expanded value of a Makefile.cbm variable (works with make 3.81: no --eval)."""
+    with tempfile.NamedTemporaryFile("w", suffix=".mk", delete=False) as mk:
+        mk.write("print-cbm-var-%:\n\t@echo $($*)\n")
+        helper = mk.name
+    try:
+        res = subprocess.run(["make", "-s", "-f", "Makefile.cbm", "-f", helper, f"print-cbm-var-{name}"],
+                             cwd=ROOT, capture_output=True, text=True, check=False)
+    finally:
+        os.unlink(helper)
+    return res.stdout.split() if res.returncode == 0 else []
+
+
+def cmd_static(args) -> int:
+    instrumented: dict[str, set[str]] = defaultdict(set)
+    compiled: set[str] = set()
+    for lane, spec in {"asan": LANES["asan"], "tsan": LANES["tsan"]}.items():
+        bdir = f"build/covmap-static-{lane}"
+        for argv in dry_commands(f"{bdir}/{spec['target']}", [f"BUILD_DIR={bdir}"]):
+            flags = " ".join(argv)
+            for a in argv:
+                if a.endswith(SRC_EXT) and os.path.isfile(os.path.join(ROOT, a)):
+                    compiled.add(a)
+                    if any(f in flags for f in ("-fsanitize=address", "-fsanitize=thread")):
+                        instrumented[a].add(lane)
+    uninstrumented = sorted(s for s in compiled if not instrumented.get(s))
+    lint_srcs = set(make_var("LINT_SRCS"))
+    static_skipped = sorted(s for s in compiled if s not in lint_srcs)
+    out = {
+        "translation_units": len(compiled),
+        "not_instrumented_by_any_dynamic_lane": uninstrumented,
+        "not_in_static_lanes": static_skipped,
+        "per_tu": {s: sorted(instrumented.get(s, ())) for s in sorted(compiled)},
+    }
+    if args.json:
+        json.dump(out, sys.stdout, indent=1)
+        print()
+        return 0
+    print(f"translation units in the test builds: {len(compiled)}")
+    print(f"  instrumented by ASan+UBSan: {sum(1 for v in instrumented.values() if 'asan' in v)}"
+          f"   by TSan: {sum(1 for v in instrumented.values() if 'tsan' in v)}")
+    print()
+    print(f"  NOT instrumented by any dynamic lane ({len(uninstrumented)}):")
+    for s in uninstrumented:
+        print(f"    {s}{'  [vendored]' if is_vendored(s) else ''}")
+    print()
+    print(f"  outside the static lanes' source list (cppcheck, clang-analyzer) ({len(static_skipped)}):")
+    vend = [s for s in static_skipped if is_vendored(s)]
+    own = [s for s in static_skipped if not is_vendored(s) and not s.startswith("tests/")]
+    print(f"    vendored: {len(vend)}   project: {len(own)}")
+    for s in own:
+        print(f"    {s}")
+    return 0
+
+
+def find_llvm_tool(name: str, cc: str) -> str:
+    cc_path = shutil.which(cc)
+    if cc_path:
+        cand = os.path.join(os.path.dirname(os.path.realpath(cc_path)), name)
+        if os.access(cand, os.X_OK):
+            return cand
+    p = shutil.which(name)
+    if p:
+        return p
+    if shutil.which("xcrun"):
+        res = subprocess.run(["xcrun", "--find", name], capture_output=True, text=True, check=False)
+        if res.returncode == 0:
+            return res.stdout.strip()
+    sys.exit(f"sanitizer-coverage-map: {name} not found next to {cc} or on PATH")
+
+
+def cmd_run(args) -> int:
+    spec = LANES[args.lane]
+    out = os.path.abspath(args.out)
+    os.makedirs(out, exist_ok=True)
+    bdir = f"build/covmap-{args.lane}"
+    cxx = "clang++" if args.cc == "clang" else args.cc.replace("clang", "clang++")
+    flags = f"{spec['value']} {COVERAGE_FLAGS}"
+    subprocess.run(["make", "-f", "Makefile.cbm", f"-j{os.cpu_count() or 4}", f"{bdir}/{spec['target']}",
+                    f"BUILD_DIR={bdir}", f"CC={args.cc}", f"CXX={cxx}", f"{spec['var']}={flags}"],
+                   cwd=ROOT, check=True)
+    raw_dir = os.path.join(out, f"{args.lane}-profraw")
+    shutil.rmtree(raw_dir, ignore_errors=True)
+    os.makedirs(raw_dir)
+    env = dict(os.environ)
+    env.update(spec["env"])
+    env["LLVM_PROFILE_FILE"] = os.path.join(raw_dir, "%p-%m.profraw")
+    runner = os.path.join(ROOT, bdir, spec["target"])
+    rc = subprocess.run([runner] + args.suites, cwd=ROOT, env=env, check=False).returncode
+    raws = [os.path.join(raw_dir, f) for f in os.listdir(raw_dir) if f.endswith(".profraw")]
+    if not raws:
+        sys.exit("sanitizer-coverage-map: the runner wrote no profile")
+    profdata = find_llvm_tool("llvm-profdata", args.cc)
+    cov = find_llvm_tool("llvm-cov", args.cc)
+    merged = os.path.join(out, f"{args.lane}.profdata")
+    subprocess.run([profdata, "merge", "-sparse", "-o", merged] + raws, check=True)
+    with open(os.path.join(out, f"{args.lane}.lcov"), "w") as fh:
+        subprocess.run([cov, "export", "-format=lcov", "-skip-expansions", f"-instr-profile={merged}", runner],
+                       cwd=ROOT, stdout=fh, check=True)
+    print(f"{args.lane}: runner rc={rc}, {len(raws)} profile(s) -> {out}/{args.lane}.lcov")
+    return 0 if rc == 0 else rc
+
+
+def read_lcov(path: str) -> dict[tuple[str, str], int]:
+    counts: dict[tuple[str, str], int] = {}
+    src = None
+    for line in open(path, encoding="utf-8", errors="replace"):
+        if line.startswith("SF:"):
+            src = os.path.relpath(line[3:].strip(), ROOT)
+        elif line.startswith("FNDA:") and src:
+            count, name = line[5:].strip().split(",", 1)
+            key = (src, name)
+            counts[key] = max(counts.get(key, 0), int(count))
+    return counts
+
+
+def cmd_union(args) -> int:
+    out = os.path.abspath(args.out)
+    lanes = [f[:-5] for f in sorted(os.listdir(out)) if f.endswith(".lcov")]
+    if not lanes:
+        sys.exit(f"sanitizer-coverage-map: no <lane>.lcov under {out} (run `run` first)")
+    total: dict[tuple[str, str], int] = {}
+    for lane in lanes:
+        for key, c in read_lcov(os.path.join(out, f"{lane}.lcov")).items():
+            total[key] = max(total.get(key, 0), c)
+    never = sorted(k for k, c in total.items() if c == 0 and not k[0].startswith(("tests/", "..")))
+    with open(os.path.join(out, "never-executed.txt"), "w") as fh:
+        for src, fn in never:
+            fh.write(f"{src}\t{fn}\n")
+    by_file = defaultdict(int)
+    for src, _ in never:
+        by_file[src] += 1
+    functions = sum(1 for k in total if not k[0].startswith(("tests/", "..")))
+    print(f"lanes merged: {', '.join(lanes)}")
+    print(f"functions: {functions:,}   never executed under any lane: {len(never):,} "
+          f"(vendored: {sum(1 for s, _ in never if is_vendored(s)):,})")
+    for src, n in sorted(by_file.items(), key=lambda kv: (-kv[1], kv[0]))[: args.top]:
+        print(f"  {n:>6}  {src}{'  [vendored]' if is_vendored(src) else ''}")
+    print(f"list: {out}/never-executed.txt")
+    return 0
+
+
+def cmd_ratchet(args) -> int:
+    current_path = os.path.join(os.path.abspath(args.out), "never-executed.txt")
+    current = set(open(current_path).read().splitlines())
+    if not os.path.exists(BASELINE):
+        print(f"no baseline yet: copy {current_path} to {BASELINE} to arm the ratchet")
+        return 0
+    base = set(l for l in open(BASELINE).read().splitlines() if l and not l.startswith("#"))
+    new = sorted(current - base)
+    gone = sorted(base - current)
+    for line in new:
+        print(f"NEW never-executed: {line}")
+    if gone:
+        print(f"{len(gone)} function(s) now executed: lower the baseline (remove them from {BASELINE})")
+    return 1 if new else 0
+
+
+def cmd_map(args) -> int:
+    data = json.load(open(MAP_FILE))
+    platforms = data["platforms"]
+    bad = []
+    for cls in data["classes"]:
+        cells = cls["cells"]
+        for plat in platforms:
+            cell = cells.get(plat)
+            if not cell:
+                bad.append(f"{cls['name']} / {plat}: missing")
+            elif cell.get("status") not in ("covered", "partial", "limit"):
+                bad.append(f"{cls['name']} / {plat}: status must be covered, partial or limit")
+            elif cell["status"] != "covered" and not cell.get("why"):
+                bad.append(f"{cls['name']} / {plat}: {cell['status']} needs a why")
+    if not args.quiet:
+        width = max(len(c["name"]) for c in data["classes"])
+        print(f"{'defect class':<{width}}  " + "  ".join(f"{p:<14}" for p in platforms))
+        for cls in data["classes"]:
+            row = []
+            for plat in platforms:
+                cell = cls["cells"].get(plat, {})
+                row.append(f"{cell.get('status', '?') + ':' + cell.get('lane', ''):<14}"[:14])
+            print(f"{cls['name']:<{width}}  " + "  ".join(row))
+        print()
+        for cls in data["classes"]:
+            for plat in platforms:
+                cell = cls["cells"].get(plat, {})
+                if cell.get("status") in ("partial", "limit"):
+                    print(f"  {cell['status']:<7} {cls['name']} / {plat}: {cell.get('why', '')}")
+    for b in bad:
+        print(f"MAP DEFECT: {b}", file=sys.stderr)
+    return 1 if bad else 0
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    s = sub.add_parser("static")
+    s.add_argument("--json", action="store_true")
+    r = sub.add_parser("run")
+    r.add_argument("--lane", choices=sorted(LANES), required=True)
+    r.add_argument("--out", default="build/covmap")
+    r.add_argument("--cc", default="clang")
+    r.add_argument("suites", nargs="*")
+    u = sub.add_parser("union")
+    u.add_argument("--out", default="build/covmap")
+    u.add_argument("--top", type=int, default=40)
+    t = sub.add_parser("ratchet")
+    t.add_argument("--out", default="build/covmap")
+    m = sub.add_parser("map")
+    m.add_argument("--quiet", action="store_true")
+    args = ap.parse_args()
+    return {"static": cmd_static, "run": cmd_run, "union": cmd_union,
+            "ratchet": cmd_ratchet, "map": cmd_map}[args.cmd](args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/sanitizer-map.json b/scripts/sanitizer-map.json
new file mode 100644
index 000000000..d2ee15fb6
--- /dev/null
+++ b/scripts/sanitizer-map.json
@@ -0,0 +1,126 @@
+{
+  "about": "Defect class x platform coverage of the sanitizer lanes. Every cell is covered, partial (with why), or a named limit (with why). Validated by scripts/sanitizer-coverage-map.py map. Which functions each lane actually EXECUTES is the run/union/ratchet part of the same tool.",
+  "platforms": ["linux-x64", "linux-arm64", "macos-arm64", "windows-x64", "windows-arm64"],
+  "classes": [
+    {
+      "name": "heap/stack memory errors",
+      "cells": {
+        "linux-x64": {"status": "covered", "lane": "asan", "venue": "PR CI"},
+        "linux-arm64": {"status": "covered", "lane": "asan", "venue": "local container"},
+        "macos-arm64": {"status": "partial", "lane": "asan+diag", "why": "use-after-return and use-after-scope only on the Homebrew-LLVM diag lane, which is local-only"},
+        "windows-x64": {"status": "covered", "lane": "asan", "venue": "PR CI"},
+        "windows-arm64": {"status": "limit", "lane": "none", "why": "no ASan runtime for Windows ARM64; the class is covered for Windows by the x64 leg"}
+      }
+    },
+    {
+      "name": "allocator-path memory errors",
+      "cells": {
+        "linux-x64": {"status": "partial", "lane": "asan", "why": "test builds use the C runtime allocator: mimalloc bindings, the --wrap shims and the slab never run sanitized; mimalloc itself is built without ASan"},
+        "linux-arm64": {"status": "partial", "lane": "asan", "why": "same as linux-x64"},
+        "macos-arm64": {"status": "partial", "lane": "asan", "why": "same as linux-x64; the zone-observer path runs only in the memwaste flavours"},
+        "windows-x64": {"status": "partial", "lane": "asan", "why": "same as linux-x64"},
+        "windows-arm64": {"status": "limit", "lane": "none", "why": "no ASan runtime for Windows ARM64"}
+      }
+    },
+    {
+      "name": "undefined behaviour",
+      "cells": {
+        "linux-x64": {"status": "partial", "lane": "ubsan", "why": "tre (regex) is built with -fno-sanitize=alignment"},
+        "linux-arm64": {"status": "partial", "lane": "ubsan", "why": "tre (regex) is built with -fno-sanitize=alignment"},
+        "macos-arm64": {"status": "partial", "lane": "ubsan", "why": "tre (regex) is built with -fno-sanitize=alignment"},
+        "windows-x64": {"status": "partial", "lane": "ubsan", "why": "tre (regex) is built with -fno-sanitize=alignment"},
+        "windows-arm64": {"status": "partial", "lane": "ubsan-trap", "why": "trap mode: a violation stops the run without a message"}
+      }
+    },
+    {
+      "name": "leaks",
+      "cells": {
+        "linux-x64": {"status": "covered", "lane": "lsan", "venue": "PR CI (on by default under ASan)"},
+        "linux-arm64": {"status": "covered", "lane": "lsan", "venue": "local container"},
+        "macos-arm64": {"status": "covered", "lane": "test-lsan", "venue": "local (Homebrew LLVM; Apple clang refuses detect_leaks)"},
+        "windows-x64": {"status": "partial", "lane": "memwaste-event", "why": "no leak sanitizer on Windows; the waste lane's live-per-site report at the last phase and the soak slope stand in"},
+        "windows-arm64": {"status": "partial", "lane": "memwaste-event", "why": "no leak sanitizer on Windows; the waste lane's live-per-site report at the last phase and the soak slope stand in"}
+      }
+    },
+    {
+      "name": "uninitialised reads",
+      "cells": {
+        "linux-x64": {"status": "partial", "lane": "msan", "why": "CI only; deep-recursion suites need larger thread stacks under MSan"},
+        "linux-arm64": {"status": "partial", "lane": "msan", "why": "locally red: three deep-recursion suites overflow their thread stacks"},
+        "macos-arm64": {"status": "partial", "lane": "memwaste-access", "why": "no MSan on macOS; the access lane's read-before-write verdict on a real corpus is the second net, per block, not per byte"},
+        "windows-x64": {"status": "partial", "lane": "memwaste-access", "why": "no MSan on Windows; the access lane (clang) is the second net"},
+        "windows-arm64": {"status": "partial", "lane": "memwaste-access", "why": "no MSan on Windows; the access lane (clang) is the second net"}
+      }
+    },
+    {
+      "name": "data races",
+      "cells": {
+        "linux-x64": {"status": "partial", "lane": "tsan", "why": "a subset of suites runs under TSan"},
+        "linux-arm64": {"status": "partial", "lane": "tsan", "why": "a subset of suites runs under TSan"},
+        "macos-arm64": {"status": "partial", "lane": "tsan", "why": "a subset of suites runs under TSan"},
+        "windows-x64": {"status": "limit", "lane": "none", "why": "no TSan on Windows"},
+        "windows-arm64": {"status": "limit", "lane": "none", "why": "no TSan on Windows"}
+      }
+    },
+    {
+      "name": "static analysis",
+      "cells": {
+        "linux-x64": {"status": "partial", "lane": "cppcheck+lint-mem+codeql", "why": "vendored trees are filtered out of cppcheck and the analyzer gate"},
+        "linux-arm64": {"status": "partial", "lane": "cppcheck+lint-mem", "why": "vendored trees are filtered out"},
+        "macos-arm64": {"status": "partial", "lane": "lint-mem", "why": "vendored trees are filtered out"},
+        "windows-x64": {"status": "limit", "lane": "none", "why": "static lanes are platform-independent source passes; Windows-only code is analysed by CodeQL only"},
+        "windows-arm64": {"status": "limit", "lane": "none", "why": "static lanes are platform-independent source passes"}
+      }
+    },
+    {
+      "name": "hostile input",
+      "cells": {
+        "linux-x64": {"status": "partial", "lane": "security-fuzz+libfuzzer", "why": "fixed MCP payloads in CI; libFuzzer targets for extractors, Cypher and config editors run in dry-run/nightly"},
+        "linux-arm64": {"status": "partial", "lane": "libfuzzer", "why": "local only"},
+        "macos-arm64": {"status": "partial", "lane": "libfuzzer", "why": "local only (Homebrew LLVM ships libFuzzer; Apple clang does not)"},
+        "windows-x64": {"status": "limit", "lane": "none", "why": "libFuzzer is not built for the MinGW toolchain"},
+        "windows-arm64": {"status": "limit", "lane": "none", "why": "libFuzzer is not built for the MinGW toolchain"}
+      }
+    },
+    {
+      "name": "algorithmic blow-up",
+      "cells": {
+        "linux-x64": {"status": "covered", "lane": "complexity+memwaste-scaling"},
+        "linux-arm64": {"status": "covered", "lane": "complexity+memwaste-scaling"},
+        "macos-arm64": {"status": "covered", "lane": "complexity+memwaste-scaling"},
+        "windows-x64": {"status": "partial", "lane": "complexity", "why": "the per-function scaling lane needs clang's profile runtime; whole-pipeline counters only"},
+        "windows-arm64": {"status": "partial", "lane": "complexity", "why": "the per-function scaling lane needs clang's profile runtime; whole-pipeline counters only"}
+      }
+    },
+    {
+      "name": "memory waste",
+      "cells": {
+        "linux-x64": {"status": "covered", "lane": "memwaste-event+access"},
+        "linux-arm64": {"status": "covered", "lane": "memwaste-event+access"},
+        "macos-arm64": {"status": "covered", "lane": "memwaste-event+access"},
+        "windows-x64": {"status": "partial", "lane": "memwaste-event", "why": "libc wrappers cover mem*/str* and FILE I/O only; the access lane needs a clang build"},
+        "windows-arm64": {"status": "partial", "lane": "memwaste-event", "why": "libc wrappers cover mem*/str* and FILE I/O only"}
+      }
+    },
+    {
+      "name": "CPU waste",
+      "cells": {
+        "linux-x64": {"status": "covered", "lane": "memwaste-cpu+scaling"},
+        "linux-arm64": {"status": "covered", "lane": "memwaste-cpu+scaling"},
+        "macos-arm64": {"status": "covered", "lane": "memwaste-cpu+scaling"},
+        "windows-x64": {"status": "partial", "lane": "memwaste-cpu", "why": "no system-call or pthread lock wrappers on Windows: Win32 file and lock APIs are imports --wrap cannot redirect"},
+        "windows-arm64": {"status": "partial", "lane": "memwaste-cpu", "why": "no system-call or pthread lock wrappers on Windows: Win32 file and lock APIs are imports --wrap cannot redirect"}
+      }
+    },
+    {
+      "name": "executed-code coverage of the lanes",
+      "cells": {
+        "linux-x64": {"status": "partial", "lane": "sanitizer-coverage-map", "why": "needs a clang job; the gcc legs are not measured"},
+        "linux-arm64": {"status": "covered", "lane": "sanitizer-coverage-map"},
+        "macos-arm64": {"status": "covered", "lane": "sanitizer-coverage-map"},
+        "windows-x64": {"status": "limit", "lane": "none", "why": "no sanitizer lane on Windows executes under clang source coverage yet"},
+        "windows-arm64": {"status": "limit", "lane": "none", "why": "no sanitizer lane on Windows executes under clang source coverage yet"}
+      }
+    }
+  ]
+}
diff --git a/scripts/smoke-invariants.sh b/scripts/smoke-invariants.sh
index 3a4f9ce09..175a59903 100755
--- a/scripts/smoke-invariants.sh
+++ b/scripts/smoke-invariants.sh
@@ -520,10 +520,10 @@ inv_mcp_initialize() {
     return 0
 }
 
-# ── Invariant 4: tools/list returns all expected tools ─────────────────────
-# Cross-check against the canonical 14-tool list (TOOLS[] in src/mcp/mcp.c).
-EXPECTED_TOOLS="index_repository search_graph query_graph trace_path get_code_snippet get_graph_schema get_architecture search_code list_projects delete_project index_status detect_changes manage_adr ingest_traces"
-EXPECTED_TOOL_COUNT=14
+# ── Invariant 4: tools/list returns exactly the expected tools ─────────────
+# Cross-check against the canonical registry (TOOLS[] in src/mcp/mcp.c).
+EXPECTED_TOOLS="index_repository search_graph query_graph trace_path get_code_snippet get_file_outline get_graph_schema compare_graphs get_architecture search_code list_projects delete_project index_status check_index_coverage detect_changes manage_adr ingest_traces"
+EXPECTED_TOOL_COUNT="$(printf '%s\n' $EXPECTED_TOOLS | grep -c .)"
 inv_tools_list() {
     if ! mcp_alive; then
         fail "tools-list" "server not alive"
@@ -573,7 +573,7 @@ print(r.get("nextCursor") or "")' 2>/dev/null)"
         fail "tools-list" "got $got_count tools across $page page(s), expected $EXPECTED_TOOL_COUNT; names=[$got_names]"
         return
     fi
-    local missing=""
+    local missing="" extra="" duplicates=""
     local t
     for t in $EXPECTED_TOOLS; do
         case " $got_names " in
@@ -581,10 +581,21 @@ print(r.get("nextCursor") or "")' 2>/dev/null)"
             *) missing="$missing $t" ;;
         esac
     done
+    for t in $got_names; do
+        case " $EXPECTED_TOOLS " in
+            *" $t "*) ;;
+            *) extra="$extra $t" ;;
+        esac
+    done
+    duplicates="$(printf '%s\n' $got_names | sort | uniq -d | tr '\n' ' ')"
     if [ -n "$missing" ]; then
         fail "tools-list" "missing tools:$missing"
+    elif [ -n "$extra" ]; then
+        fail "tools-list" "unexpected tools:$extra"
+    elif [ -n "$duplicates" ]; then
+        fail "tools-list" "duplicate tools: $duplicates"
     else
-        pass "tools-list (all $EXPECTED_TOOL_COUNT tools present)"
+        pass "tools-list (exactly $EXPECTED_TOOL_COUNT unique tools present)"
     fi
 }
 
@@ -626,7 +637,7 @@ inv_every_tool() {
         return
     fi
 
-    # name|minimal-args (JSON object) for the remaining 13 tools.
+    # name|minimal-args (JSON object) for the remaining 16 tools.
     # Args chosen to be minimally valid per TOOLS[] required fields.
     local p="$PROJ_NAME"
     local -a CALLS
@@ -635,11 +646,14 @@ inv_every_tool() {
         "query_graph|{\"project\":\"$p\",\"query\":\"MATCH (n) RETURN n.name LIMIT 5\"}"
         "trace_path|{\"project\":\"$p\",\"function_name\":\"compute\",\"direction\":\"both\"}"
         "get_code_snippet|{\"project\":\"$p\",\"qualified_name\":\"compute\"}"
+        "get_file_outline|{\"project\":\"$p\",\"file_path\":\"src/main.py\"}"
         "get_graph_schema|{\"project\":\"$p\"}"
+        "compare_graphs|{\"base_project\":\"$p\",\"target_project\":\"$p\"}"
         "get_architecture|{\"project\":\"$p\"}"
         "search_code|{\"project\":\"$p\",\"pattern\":\"def \"}"
         "list_projects|{}"
         "index_status|{\"project\":\"$p\"}"
+        "check_index_coverage|{\"project\":\"$p\",\"paths\":[\"src/main.py\"]}"
         "detect_changes|{\"project\":\"$p\"}"
         "manage_adr|{\"project\":\"$p\",\"mode\":\"get\"}"
         "ingest_traces|{\"project\":\"$p\",\"traces\":[]}"
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index ca27edcc6..d1c64c6b7 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -22,6 +22,8 @@ they stage the release fixture, start the fixture server, and sandbox
 HOME/TEMP/agent-config destinations. Called bare, the download/checksum/
 install-script phases (12-13) SKIP for lack of a fixture server, and the run
 mutates the REAL profile — the venue-parity contract forbids that in any venue.
+The daemon runtime and cache are private to the run either way: every product
+process is started under a CBM_RUNTIME_DIR/CBM_CACHE_DIR this harness owns.
 
 Arguments:
   <binary-path>         product binary to smoke
@@ -41,6 +43,20 @@ if [ -n "$SMOKE_MODE" ] && [ "$SMOKE_MODE" != "--agent-config-only" ]; then
 fi
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/.." && pwd)"
 
+# Every product process below — the phases, the install/update E2E and the
+# daemon retirements — must reach a daemon rendezvous this run owns. Only
+# CBM_RUNTIME_DIR moves that rendezvous; the wrappers' HOME/TMPDIR/CBM_CACHE_DIR
+# sandbox does not, so without this the retirements land on the operator's live
+# account daemon (#1691, #1696).
+# shellcheck source=test-runtime.sh
+source "$REPO_ROOT/scripts/test-runtime.sh"
+cbm_test_runtime_init
+# Armed here rather than only with the fixture trap below: the fixture mktemp
+# and its cygpath conversion sit between the two, and under `set -e` a failure
+# there would otherwise leave the private root behind. The fixture trap
+# replaces this one and keeps the same cleanup as its first step.
+trap 'cbm_test_runtime_cleanup "$BINARY"' EXIT
+
 smoke_mktemp_file() {
   if [ -n "${SMOKE_TEMP_ROOT:-}" ]; then
     mktemp "$SMOKE_TEMP_ROOT/cbm-smoke.XXXXXX"
@@ -100,8 +116,8 @@ copy_smoke_binary() {
   cp "$BINARY" "$destination"
 }
 
-# Retire the shared account daemon (if one is running) and wait until it
-# reports not-running. Install/uninstall flows leave an ephemeral daemon
+# Retire this run's private account daemon (if one is running) and wait until
+# it reports not-running. Install/uninstall flows leave an ephemeral daemon
 # draining asynchronously whose mapped generation backing and open logs
 # block rm on Windows (POSIX rm doesn't care) — so every cleanup of a
 # fixture HOME that received an install, and the final cache removal, must
@@ -149,7 +165,11 @@ CODEX_LIFECYCLE_HOME=""
 if command -v cygpath &>/dev/null; then
     TMPDIR=$(cygpath -m "$TMPDIR")
 fi
-trap 'smoke_rmtree "$TMPDIR" "${DRYRUN_HOME:-}" "${CODEX_LIFECYCLE_HOME:-}"' EXIT
+# Runtime cleanup first, so no earlier cleanup step stands between the exit
+# and the private daemon's retirement; on Windows that retirement is also what
+# unblocks the fixture rm (mapped binary, open logs). smoke_rmtree never fails,
+# so the fixture removal still runs after it.
+trap 'cbm_test_runtime_cleanup "$BINARY"; smoke_rmtree "$TMPDIR" "${DRYRUN_HOME:-}" "${CODEX_LIFECYCLE_HOME:-}"' EXIT
 
 CLI_STDERR=$(smoke_mktemp_file)
 # 10 of the cli call sites assign directly (VAR=$(cli ...)). Under
@@ -174,6 +194,29 @@ cli() {
   return "$rc"
 }
 
+# A worker failure says "inspect log: <path>" — and in CI that path dies with the
+# job's sandbox, so the one artifact naming the cause is the one nobody can open.
+# A worker killed by a signal writes no summary of its own either, which is
+# exactly the case that most needs the log (PR #2233: "index worker ended with
+# killed (exit=-1, signal=9)" on ubuntu-latest, unreproducible on every local
+# venue). Print it while it still exists.
+smoke_dump_worker_log() {
+  local log
+  log=$(sed -n 's/.*inspect log: \([^ ]*\).*/\1/p' "$CLI_STDERR" 2>/dev/null | tail -1)
+  if [ -z "$log" ] || [ ! -f "$log" ]; then
+    # The path is only printed for some failures; fall back to the newest log
+    # the run produced.
+    log=$(ls -t "${CBM_CACHE_DIR:-$HOME/.cache/codebase-memory-mcp}"/logs/.worker-log-* 2>/dev/null | head -1)
+  fi
+  if [ -n "$log" ] && [ -f "$log" ]; then
+    echo "--- worker log: $log ---"
+    tail -80 "$log"
+    echo "--- end worker log ---"
+  else
+    echo "--- no worker log found (cache ${CBM_CACHE_DIR:-unset}) ---"
+  fi
+}
+
 echo "=== Phase 1: version ==="
 VERSION_STATUS=0
 OUTPUT=$("$BINARY" --version 2>&1) || VERSION_STATUS=$?
@@ -334,6 +377,7 @@ GENEOF
 if ! RESULT=$(cli index_repository --repo-path "$TMPDIR"); then
   echo "FAIL: index_repository (flag form) exited non-zero"
   cat "$CLI_STDERR"
+  smoke_dump_worker_log
   exit 1
 fi
 echo "$RESULT"
diff --git a/scripts/soak-test.sh b/scripts/soak-test.sh
index a12029a30..31a16259f 100755
--- a/scripts/soak-test.sh
+++ b/scripts/soak-test.sh
@@ -66,9 +66,17 @@ CBM_SOAK_MODE="${CBM_SOAK_MODE:-default}"
 RESULTS_DIR="${RESULTS_DIR:-soak-results}"
 mkdir -p "$RESULTS_DIR"
 
-# Isolate daemon coordination from interactive CBM sessions and give this run
-# a deterministic host-side daemon log. Wine needs a Windows-form cache path
-# in the child environment while this Bash harness retains the host path.
+# Every product process below must reach a daemon rendezvous this run owns.
+# Only CBM_RUNTIME_DIR moves that rendezvous — a private CBM_CACHE_DIR alone
+# still shares the operator's account daemon (#1691, #1696).
+# shellcheck source=test-runtime.sh
+source "$(dirname "${BASH_SOURCE[0]}")/test-runtime.sh"
+cbm_test_runtime_init
+trap 'cbm_test_runtime_cleanup "$BINARY"' EXIT
+
+# Give this run a deterministic host-side daemon log. Wine needs a Windows-form
+# cache path in the child environment while this Bash harness retains the host
+# path.
 #
 # On native Windows the cache CANNOT live under msys /tmp: the server's
 # cache-private executable-identity check walks the cache path's ancestors
@@ -146,7 +154,7 @@ if [[ "$BINARY" == *.exe ]] && command -v cygpath >/dev/null 2>&1 &&
         exit 1
     fi
 else
-    SOAK_CACHE_DIR_HOST=$(mktemp -d "${TMPDIR:-/tmp}/cbm-soak-cache.XXXXXX")
+    SOAK_CACHE_DIR_HOST="$CBM_TEST_CACHE_DIR_HOST"
 fi
 SOAK_CACHE_DIR_VALUE="$SOAK_CACHE_DIR_HOST"
 if [[ "$BINARY" == *.exe ]] && command -v winepath >/dev/null 2>&1; then
@@ -206,7 +214,12 @@ soak_cleanup() {
     if [ -f "$DAEMON_LOG" ]; then
         cp "$DAEMON_LOG" "$RESULTS_DIR/cbm-daemon.log" 2>/dev/null || true
     fi
-    rm -rf -- "$SOAK_PROJECT" "$SOAK_CACHE_DIR_HOST"
+    rm -rf -- "$SOAK_PROJECT"
+    # The helper stops this run's private daemon before removing its root and
+    # leaves the root behind for diagnosis when the daemon will not stop. The
+    # native-Windows cache sits under SOAK_WIN_ROOT, which goes only after the
+    # daemon check because the binary it probes with is the copy inside it.
+    cbm_test_runtime_cleanup "$BINARY"
     [ -z "${SOAK_WIN_ROOT:-}" ] || rm -rf -- "$SOAK_WIN_ROOT"
 }
 
@@ -807,7 +820,7 @@ if [ "$SKIP_CRASH" != "--skip-crash-test" ] && [ "$CBM_SOAK_MODE" != "query-leak
     SERVER_PID=""
     exec 3>&- 4<&-
     if ! wait_for_daemon_stop "$DAEMON_STOP_COUNT"; then
-        echo "FAIL: last-session crash did not stop the shared daemon"
+        echo "FAIL: last-session crash did not stop the private daemon"
         exit 1
     fi
 
@@ -848,7 +861,7 @@ kill "$SERVER_PID" 2>/dev/null || true
 wait "$SERVER_PID" 2>/dev/null || true
 SERVER_PID=""
 if ! wait_for_daemon_stop "$FINAL_DAEMON_STOP_COUNT"; then
-    echo "FAIL: final frontend shutdown did not stop the shared daemon"
+    echo "FAIL: final frontend shutdown did not stop the private daemon"
     PASS=false
 fi
 
diff --git a/scripts/test-runtime.sh b/scripts/test-runtime.sh
index cb69cadfb..5d2c0c3ae 100644
--- a/scripts/test-runtime.sh
+++ b/scripts/test-runtime.sh
@@ -105,6 +105,16 @@ _cbm_test_runtime_daemon() {
         CBM_CACHE_DIR="$_CBM_TEST_RUNTIME_PRODUCT_CACHE" "$1" daemon "$2"
 }
 
+# The supervisor resolves one resource policy per index and hands it to the
+# worker in argv; a worker that finds no complete policy refuses to start rather
+# than index unbounded. A shell test that spawns `cli --index-worker` itself
+# stands in for the supervisor and owes the worker the same object. Mirrors
+# cbm_mcp_index_policy_add_to_args: every key in cbm_index_policy_key_at, and
+# nothing else.
+cbm_test_index_worker_policy_json() {
+    printf '%s' '"_cbm_index_policy":{"index_max_files":"off","index_max_source_mb":"off"}'
+}
+
 cbm_test_runtime_cleanup() {
     local binary="${1:-}" root="$_CBM_TEST_RUNTIME_CREATED_ROOT"
     local name="${_CBM_TEST_RUNTIME_CREATED_ROOT##*/}" runtime_entry="" active=0
diff --git a/scripts/test.sh b/scripts/test.sh
index 0aafe6c20..0845a2e77 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -212,15 +212,27 @@ bash "$ROOT/tests/test_ui_dev_proxy_security.sh"
 echo "=== Step 0d: daemon soak recovery contract ==="
 bash "$ROOT/tests/test_soak_daemon_recovery_contract.sh"
 
+echo "=== Step 0d2: soak harness runtime isolation contract (#1696) ==="
+bash "$ROOT/tests/test_soak_runtime_isolation_contract.sh"
+
 echo "=== Step 0e: Windows launcher bundle contract ==="
 bash "$ROOT/tests/test_windows_bundle_contract.sh"
 
+echo "=== Step 0e2: activation refusal diagnostic contract ==="
+bash "$ROOT/tests/test_activation_diagnostic_contract.sh"
+
+echo "=== Step 0e3: security gate fail-closed contract ==="
+bash "$ROOT/tests/test_security_gate_fail_closed.sh"
+
 echo "=== Step 0f: tree-sitter runtime Makefile dependencies ==="
 bash "$ROOT/tests/test_makefile_ts_runtime_dependencies.sh"
 
 echo "=== Step 0g: security fuzz harness self-test ==="
 bash "$ROOT/tests/test_security_fuzz_harness.sh"
 
+echo "=== Step 0g2: memlab harness runtime isolation contract (#1696) ==="
+bash "$ROOT/tests/test_memlab_runtime_isolation_contract.sh"
+
 echo "=== Step 0h: smoke release-fixture contract ==="
 bash "$ROOT/tests/test_smoke_fixture_contract.sh"
 
@@ -260,6 +272,9 @@ bash "$ROOT/tests/test_release_gate_chain_contract.sh"
 echo "=== Step 0t: test runtime isolation contract (#1691) ==="
 bash "$ROOT/tests/test_runtime_isolation_contract.sh"
 
+echo "=== Step 0t2: smoke harness runtime isolation contract (#1696) ==="
+bash "$ROOT/tests/test_smoke_runtime_isolation_contract.sh"
+
 echo "=== Step 0u: shell line-ending contract ==="
 bash "$ROOT/tests/test_shell_line_endings.sh"
 
@@ -272,6 +287,14 @@ bash "$ROOT/tests/test_language_count_contract.sh"
 echo "=== Step 0x: packaging version-metadata contract ==="
 bash "$ROOT/tests/test_version_metadata_contract.sh"
 
+# Step 0y: the Windows leg must not decide its verdict from an exit status that
+# the ssh/msys2_shell chain can mangle — a channel that turns 0 into 1 can turn
+# 1 into 0, and that direction reports a RED Windows leg as green. Runs
+# everywhere (it drives synthetic logs, no VM needed) because the guard it pins
+# is what every Windows verdict rests on.
+echo "=== Step 0y: VM leg verdict contract ==="
+bash "$ROOT/tests/test_vm_verdict_contract.sh"
+
 # Verify compiler supports target arch
 verify_compiler "$CC"
 
@@ -312,6 +335,15 @@ make -j"$NPROC" -f Makefile.cbm cbm TEST_SEAMS=1 ${MAKE_ARGS[@]+"${MAKE_ARGS[@]}
 WATCHDOG_BINARY="$ROOT/$BUILD_DIR/codebase-memory-mcp"
 CBM_TEST_BINARY="$WATCHDOG_BINARY" bash "$ROOT/tests/test_parent_watchdog.sh"
 
+# Step 5a: that watchdog is also the SMALLEST-stack thread in the image, which
+# makes it the first casualty when static TLS grows — glibc takes the TLS block
+# out of each thread's own stack allocation. Checked here, against the binary
+# Step 5 just built, because the failure it prevents surfaces nowhere near its
+# cause (PR #2233: a thread-local cache in an extraction file stopped the index
+# worker from starting, on x86-64 only).
+echo "=== Step 5a: static-TLS budget against the smallest thread stack ==="
+bash "$ROOT/tests/test_thread_stack_tls_contract.sh" "$WATCHDOG_BINARY"
+
 # Step 5b: worker-mode parent-death watchdog (#845). A supervised index worker
 # (`cli --index-worker …`) whose supervisor dies must self-exit instead of
 # indexing on as an orphan. Reuses the prod binary built in Step 5.
@@ -346,6 +378,12 @@ CBM_TEST_BINARY="$WATCHDOG_BINARY" bash "$ROOT/tests/test_worker_error_response.
 echo "=== Step 5e: watcher_enabled kill-switch regression (#335) ==="
 CBM_TEST_BINARY="$WATCHDOG_BINARY" bash "$ROOT/tests/test_watcher_disabled.sh"
 
+# Step 5f: a supervised worker is scoped to the request the daemon admitted,
+# never to the CBM_ALLOWED_ROOT it inherited from the daemon starter's
+# environment. Reuses the prod binary built in Step 5.
+echo "=== Step 5f: worker request-scope regression ==="
+CBM_TEST_BINARY="$WATCHDOG_BINARY" bash "$ROOT/tests/test_worker_session_scope.sh"
+
 # Step 6: security-strings URL allow-list regression. The MSYS2 CLANG64 toolchain
 # bakes its package-tracker URL into the static Windows .exe; the binary string
 # audit must allow-list it (Windows-only — Linux smoke never saw it).
diff --git a/scripts/vendored-checksums.txt b/scripts/vendored-checksums.txt
index c4b809dc6..176f96d1e 100644
--- a/scripts/vendored-checksums.txt
+++ b/scripts/vendored-checksums.txt
@@ -5,7 +5,7 @@ c5cfb43042b6b72045f4ba997834d0a7786d2793d91680868b5815b39f14fc78  internal/cbm/v
 b29c1c9fb7cc82f58c84b376df1297d6e2737a1d655fd356db0859e3c29c2fea  internal/cbm/vendored/common/tree_sitter/alloc.h
 31e60a1bff6f715afacce03b5b70efe42b58371b4f9595dd4af52a577ff9608c  internal/cbm/vendored/common/tree_sitter/array.h
 180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2  internal/cbm/vendored/common/tree_sitter/parser.h
-00a84162eb34fb58bcdd38c08922d4fea4c87b7c2219dd64b773dd15ba18de71  internal/cbm/vendored/grammars/MANIFEST.md
+a66a04ed735fdb3d4a90ee4353b8f0490dc0360da5965b0d13ec5d6766f146fa  internal/cbm/vendored/grammars/MANIFEST.md
 ad8425038de519f8c4e3e9339feebf99dfad8a6002dcf79227d91402780a32cc  internal/cbm/vendored/grammars/ada/LICENSE
 02805ec13939b749c891567be36bf024b09034e04c80683a1ae667272458d549  internal/cbm/vendored/grammars/ada/parser.c
 115a75d000bef9c70c4de7dfbb7f2a80b90cbb14ba265056dc7abb1ef3b9b6db  internal/cbm/vendored/grammars/ada/tree_sitter/alloc.h
@@ -610,7 +610,7 @@ fbce36bb615a015ea545373da62c178fe9e7e3a7b7de656455738e6f671aa652  internal/cbm/v
 c4b9482069f61a2a26a590181baa34f08eb6dcc57a138def578e6f9720c35ea5  internal/cbm/vendored/grammars/prisma/tree_sitter/parser.h
 3297073719030b7261afd78b7267931ccc03a27f7a65ca6fc644316180f71bf6  internal/cbm/vendored/grammars/properties/LICENSE
 98e06c3a7b3043d7641ec0b2c28c9f66e54341e343e1f553f994ae5a6f0c0452  internal/cbm/vendored/grammars/properties/parser.c
-3c00e7a8ec38662b05cb00858d2959b123b2b5c783eb3dc25c80b7577b4c27ac  internal/cbm/vendored/grammars/properties/scanner.c
+a313549615512cf06b2ee55b080bfee1559860aaa1dfcab56e9af6010323aad8  internal/cbm/vendored/grammars/properties/scanner.c
 115a75d000bef9c70c4de7dfbb7f2a80b90cbb14ba265056dc7abb1ef3b9b6db  internal/cbm/vendored/grammars/properties/tree_sitter/alloc.h
 02d139d44303b0b0b85a899839dbc1346c478e7318d1f2971fad2b38fd57cb73  internal/cbm/vendored/grammars/properties/tree_sitter/array.h
 c4b9482069f61a2a26a590181baa34f08eb6dcc57a138def578e6f9720c35ea5  internal/cbm/vendored/grammars/properties/tree_sitter/parser.h
diff --git a/server.json b/server.json
index 3ab583af4..9d0bd68b7 100644
--- a/server.json
+++ b/server.json
@@ -8,12 +8,12 @@
     "source": "github"
   },
   "websiteUrl": "https://deusdata.github.io/codebase-memory-mcp/",
-  "version": "0.10.8",
+  "version": "0.11.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "codebase-memory-mcp",
-      "version": "0.10.8",
+      "version": "0.11.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -22,7 +22,7 @@
     {
       "registryType": "pypi",
       "identifier": "codebase-memory-mcp",
-      "version": "0.10.8",
+      "version": "0.11.0",
       "runtimeHint": "uvx",
       "transport": {
         "type": "stdio"
diff --git a/src/cli/activation_transaction.c b/src/cli/activation_transaction.c
index 9bb669eef..a56052775 100644
--- a/src/cli/activation_transaction.c
+++ b/src/cli/activation_transaction.c
@@ -18,6 +18,7 @@
 #define WIN32_LEAN_AND_MEAN
 #endif
 #include <aclapi.h>
+#include <ntsecapi.h>
 #include <sddl.h>
 #include <windows.h>
 #else
@@ -424,6 +425,102 @@ static void activation_windows_security_destroy(activation_windows_security_t *s
     memset(security, 0, sizeof(*security));
 }
 
+/* #1705: THIS machine's built-in Administrator ACCOUNT (RID 500 under the local
+ * machine account-domain SID, S-1-5-21-<machine>-500) is a trusted owner/grantee,
+ * mirroring the daemon's win_sid_trusted (src/daemon/ipc.c). It is resolved via
+ * LSA (the local machine account-domain SID) plus CreateWellKnownSid and compared
+ * with EqualSid. It is deliberately NOT IsWellKnownSid(WinAccountAdministratorSid)
+ * and NOT a trailing-RID-500 test: both accept a FOREIGN S-1-5-21-*-500 (a domain
+ * admin, or another machine's built-in Administrator), opening a cross-machine
+ * bypass. Resolved once and cached for the process; any LSA or synthesis failure
+ * caches "none" and grants NO tolerance (fail closed). advapi32 is already loaded
+ * (this file calls GetSecurityInfo etc.), so the functions are resolved from its
+ * module handle with no new import. CLI activation is single-threaded by
+ * contract, so the cache needs no lock. */
+typedef NTSTATUS(NTAPI *activation_lsa_open_policy_fn)(PLSA_UNICODE_STRING, PLSA_OBJECT_ATTRIBUTES,
+                                                       ACCESS_MASK, PLSA_HANDLE);
+typedef NTSTATUS(NTAPI *activation_lsa_query_information_policy_fn)(LSA_HANDLE,
+                                                                    POLICY_INFORMATION_CLASS,
+                                                                    PVOID *);
+typedef NTSTATUS(NTAPI *activation_lsa_free_memory_fn)(PVOID);
+typedef NTSTATUS(NTAPI *activation_lsa_close_fn)(LSA_HANDLE);
+typedef BOOL(WINAPI *activation_create_well_known_sid_fn)(WELL_KNOWN_SID_TYPE, PSID, PSID, DWORD *);
+
+static PSID activation_windows_local_admin_sid(void) {
+    static bool resolved = false;
+    static PSID cached = NULL;
+    if (resolved) {
+        return cached;
+    }
+    resolved = true;
+    HMODULE advapi = GetModuleHandleW(L"advapi32.dll");
+    if (!advapi) {
+        return NULL;
+    }
+    activation_lsa_open_policy_fn lsa_open =
+        (activation_lsa_open_policy_fn)(void (*)(void))GetProcAddress(advapi, "LsaOpenPolicy");
+    activation_lsa_query_information_policy_fn lsa_query =
+        (activation_lsa_query_information_policy_fn)(void (*)(void))GetProcAddress(
+            advapi, "LsaQueryInformationPolicy");
+    activation_lsa_free_memory_fn lsa_free =
+        (activation_lsa_free_memory_fn)(void (*)(void))GetProcAddress(advapi, "LsaFreeMemory");
+    activation_lsa_close_fn lsa_close =
+        (activation_lsa_close_fn)(void (*)(void))GetProcAddress(advapi, "LsaClose");
+    activation_create_well_known_sid_fn create_sid =
+        (activation_create_well_known_sid_fn)(void (*)(void))GetProcAddress(advapi,
+                                                                            "CreateWellKnownSid");
+    if (!lsa_open || !lsa_query || !lsa_free || !lsa_close || !create_sid) {
+        return NULL;
+    }
+    LSA_OBJECT_ATTRIBUTES attributes;
+    memset(&attributes, 0, sizeof(attributes));
+    LSA_HANDLE policy = NULL;
+    /* STATUS_SUCCESS is 0; any other status is treated as failure (fail closed). */
+    if (lsa_open(NULL, &attributes, POLICY_VIEW_LOCAL_INFORMATION, &policy) != 0 || !policy) {
+        return NULL;
+    }
+    POLICY_ACCOUNT_DOMAIN_INFO *domain = NULL;
+    if (lsa_query(policy, PolicyAccountDomainInformation, (PVOID *)&domain) == 0 && domain &&
+        domain->DomainSid && IsValidSid(domain->DomainSid)) {
+        DWORD needed = 0;
+        (void)create_sid(WinAccountAdministratorSid, domain->DomainSid, NULL, &needed);
+        if (needed > 0U) {
+            PSID admin = malloc(needed);
+            if (admin &&
+                create_sid(WinAccountAdministratorSid, domain->DomainSid, admin, &needed) &&
+                IsValidSid(admin)) {
+                cached = admin;
+            } else {
+                free(admin);
+            }
+        }
+    }
+    if (domain) {
+        (void)lsa_free(domain);
+    }
+    (void)lsa_close(policy);
+    return cached;
+}
+
+/* #2023/#1686: an owner refusal must name WHICH owner, not just "status -3, os 0".
+ * The path is already carried by g_activation_refusal_object; this appends the
+ * offending owner's SID string, mirroring the daemon's ACL/owner diagnostics, so
+ * the operator sees the exact identity to remove or the directory to move. */
+static void activation_windows_note_untrusted_owner(const char *predicate, PSID owner,
+                                                    DWORD os_error) {
+    char label[192];
+    LPSTR owner_text = NULL;
+    (void)snprintf(
+        label, sizeof(label), "%s; owner=%s", predicate,
+        (owner && IsValidSid(owner) && ConvertSidToStringSidA(owner, &owner_text) && owner_text)
+            ? owner_text
+            : "unresolved-sid");
+    if (owner_text) {
+        (void)LocalFree(owner_text);
+    }
+    activation_note_refusal(label, os_error);
+}
+
 /* Trusted-owner acceptance for SOURCE-side objects: a downloaded release
  * bundle is owned by whatever the machine's default-owner policy dictates
  * (Administrators on GitHub-runner-class images). Its integrity is enforced
@@ -440,11 +537,13 @@ static bool activation_windows_owner_is_trusted(HANDLE handle) {
     PSECURITY_DESCRIPTOR descriptor = NULL;
     DWORD result = GetSecurityInfo(handle, SE_FILE_OBJECT, OWNER_SECURITY_INFORMATION, &owner, NULL,
                                    NULL, NULL, &descriptor);
+    PSID local_admin = activation_windows_local_admin_sid();
     bool trusted = result == ERROR_SUCCESS && owner && IsValidSid(owner) &&
                    (EqualSid(owner, user_sid) || IsWellKnownSid(owner, WinLocalSystemSid) ||
-                    IsWellKnownSid(owner, WinBuiltinAdministratorsSid));
+                    IsWellKnownSid(owner, WinBuiltinAdministratorsSid) ||
+                    (local_admin && EqualSid(owner, local_admin)));
     if (!trusted) {
-        activation_note_refusal("owner-not-trusted", result);
+        activation_windows_note_untrusted_owner("owner-not-trusted", owner, result);
     }
     if (descriptor) {
         (void)LocalFree(descriptor);
@@ -522,7 +621,7 @@ static bool activation_windows_owner_is_current(HANDLE handle) {
         }
     }
     if (!same) {
-        activation_note_refusal("owner-not-current-user", result);
+        activation_windows_note_untrusted_owner("owner-not-current-user", owner, result);
     }
     if (descriptor) {
         (void)LocalFree(descriptor);
@@ -596,10 +695,15 @@ static bool activation_windows_acl_check(HANDLE handle, DWORD tolerated_untruste
         PSID sid = (PSID)&ace->SidStart;
         size_t sid_capacity = (size_t)header->AceSize - sid_offset;
         DWORD sid_length = GetSidLengthRequired(((SID *)sid)->SubAuthorityCount);
+        PSID local_admin = activation_windows_local_admin_sid();
         bool trusted = sid_length <= sid_capacity && IsValidSid(sid) &&
                        GetLengthSid(sid) == sid_length &&
                        (EqualSid(sid, user_sid) || IsWellKnownSid(sid, WinLocalSystemSid) ||
                         IsWellKnownSid(sid, WinBuiltinAdministratorsSid) ||
+                        /* #1705: THIS machine's built-in Administrator (RID-500),
+                         * resolved via LSA — never a foreign S-1-5-21-*-500; same
+                         * tolerance as the daemon's win_sid_trusted. */
+                        (local_admin && EqualSid(sid, local_admin)) ||
                         /* OWNER RIGHTS modulates whoever owns the object; the
                          * owner is separately validated in every chain that
                          * reaches here (same tolerance as the daemon IPC and
@@ -608,9 +712,17 @@ static bool activation_windows_acl_check(HANDLE handle, DWORD tolerated_untruste
         if (!trusted) {
             char label[128];
             LPSTR sid_text = NULL;
-            (void)snprintf(label, sizeof(label), "acl-grants-cross-account-mutation to %s",
+            /* #1856: say whether the grant is INHERITED. The remedy differs and
+             * the wrong one silently does nothing: `icacls <dir> /remove:g <sid>`
+             * cannot remove an inherited ACE -- that needs `/inheritance:r` --
+             * and the stock `C:\` ACE for Authenticated Users reaches every new
+             * child directory exactly this way. A reporter following the
+             * generic advice sees the command succeed and the refusal persist. */
+            bool inherited = (header->AceFlags & INHERITED_ACE) != 0;
+            (void)snprintf(label, sizeof(label), "acl-grants-cross-account-mutation to %s%s",
                            ConvertSidToStringSidA(sid, &sid_text) && sid_text ? sid_text
-                                                                              : "unparsable-sid");
+                                                                              : "unparsable-sid",
+                           inherited ? " (inherited from a parent directory)" : "");
             if (sid_text) {
                 (void)LocalFree(sid_text);
             }
@@ -778,8 +890,16 @@ static bool activation_posix_acl_empty(int descriptor) {
 }
 
 static char *activation_posix_walk_path(const char *directory) {
-#ifdef __APPLE__
+#if defined(__APPLE__) || defined(__linux__)
+    /* macOS and immutable Linux layouts can expose writable trees through
+     * root-owned aliases (for example /tmp and /home on Atomic systems).
+     * Resolve only these trusted system aliases; arbitrary user symlinks must
+     * still fail the O_NOFOLLOW walk below. */
+#ifdef __linux__
+    static const char *const aliases[] = {"/tmp", "/var", "/home"};
+#else
     static const char *const aliases[] = {"/tmp", "/var"};
+#endif
     for (size_t index = 0; index < sizeof(aliases) / sizeof(aliases[0]); index++) {
         const char *alias = aliases[index];
         size_t alias_length = strlen(alias);
@@ -789,8 +909,13 @@ static char *activation_posix_walk_path(const char *directory) {
         }
         struct stat alias_status;
         char resolved[4096];
-        if (lstat(alias, &alias_status) != 0 || !S_ISLNK(alias_status.st_mode) ||
-            alias_status.st_uid != 0 || !realpath(alias, resolved)) {
+        if (lstat(alias, &alias_status) != 0) {
+            continue;
+        }
+        if (!S_ISLNK(alias_status.st_mode)) {
+            continue;
+        }
+        if (alias_status.st_uid != 0 || !realpath(alias, resolved)) {
             return NULL;
         }
         struct stat resolved_status;
diff --git a/src/cli/cli.c b/src/cli/cli.c
index f47c3031c..b868fdca2 100644
--- a/src/cli/cli.c
+++ b/src/cli/cli.c
@@ -8,6 +8,7 @@
 #include "cli/agent_profiles.h"
 #include "cli/cli.h"
 #include "cli/activation_transaction.h"
+#include "cli/config_edit_path.h"
 #include "cli/config_json_like.h"
 #include "cli/config_text_edit.h"
 #include "cli/config_toml_edit.h"
@@ -214,6 +215,12 @@ typedef struct {
     bool cleanup_ok;
     bool original_cache_environment_present;
     bool cache_environment_overridden;
+    /* Scope: what THIS activation replaces decides whether any session must
+     * be quiesced at all, and the target cache namespace decides WHICH
+     * cohort. A skipped coordination holds no lock and drains nobody. */
+    bool quiesce_required;
+    bool coordination_skipped;
+    char scope_detail[CBM_SZ_1K];
 } cli_activation_production_context_t;
 
 static cbm_cli_activation_ops_t g_cli_activation_test_ops;
@@ -239,7 +246,9 @@ static void cli_activation_diagnostic(const cbm_cli_activation_ops_t *ops, const
                        "error: activation was refused by a filesystem safety check before any "
                        "change was made: %s\n"
                        "error: this is not a session problem. If the flagged directory is one you "
-                       "trust, remove the flagged permission grant (icacls <dir> /remove:g <sid>) "
+                       "trust, remove the flagged permission grant (icacls <dir> /remove:g <sid>; "
+                       "an INHERITED grant needs icacls <dir> /inheritance:r /grant:r "
+                       "\"%%USERNAME%%\":(OI)(CI)F instead, because /remove:g cannot delete one) "
                        "or use an owner-private directory for --dir/CBM_CACHE_DIR, then retry.",
                        note);
         diagnostic = attributed;
@@ -528,6 +537,91 @@ static void cli_activation_release_cleanup_lease(cli_activation_production_conte
     }
 }
 
+typedef enum {
+    CLI_ACTIVATION_SCOPE_ACTIVE = 0,
+    CLI_ACTIVATION_SCOPE_NOTHING_TO_REPLACE,
+    CLI_ACTIVATION_SCOPE_FOREIGN_COHORT,
+    CLI_ACTIVATION_SCOPE_ERROR,
+} cli_activation_scope_t;
+
+static void cli_activation_log_guard_decision(const cli_activation_production_context_t *context,
+                                              const char *decision, const char *active_cache) {
+    char clients[32];
+    (void)snprintf(clients, sizeof(clients), "%llu",
+                   (unsigned long long)context->daemon_result.active_clients);
+    const char *scope = cbm_daemon_ipc_endpoint_runtime_dir(context->endpoint);
+    cbm_log_info("activation.guard", "scope", scope ? scope : "", "cache",
+                 context->cache_fingerprint, "clients", clients, "decision", decision,
+                 "active_cache", active_cache ? active_cache : "");
+}
+
+/* Whose sessions does this activation have to stop? The rendezvous directory
+ * is per OS account (service.h), so the host daemon of another HOME /
+ * CBM_CACHE_DIR meets this activation at the very same endpoint; only the
+ * cache fingerprint in the cohort identity separates the namespaces. An
+ * `install` into a sandbox HOME used to drain the host daemon and every MCP
+ * client behind it although nothing it touched belonged to the host.
+ *
+ * Two questions, answered from the activation's own target: does it replace
+ * anything at all (a --skip-binary install without an index reset publishes
+ * nothing), and whose cohort is active. Admission with an immediate deadline
+ * is the cheapest authoritative read of the active lifetime record: OK means
+ * the cohort is ours or empty, CONFLICT names the active identity (its cache
+ * fingerprint is filled for every conflict kind), BUSY means another
+ * activation holds maintenance and the barrier waits for it as before. */
+static cli_activation_scope_t cli_activation_resolve_scope(
+    cli_activation_production_context_t *context) {
+    const char *runtime_dir = cbm_daemon_ipc_endpoint_runtime_dir(context->endpoint);
+    const char *scope = runtime_dir ? runtime_dir : "";
+    const char *action = cli_activation_action_text(context->action);
+    if (!context->quiesce_required) {
+        (void)snprintf(context->scope_detail, sizeof(context->scope_detail),
+                       "nothing to quiesce: published binary and indexes unchanged; scope=%s",
+                       scope);
+        cli_activation_log_guard_decision(context, "nothing_to_replace", NULL);
+        printf("No CBM session needs to stop for %s: the published binary and indexes are "
+               "unchanged.\n",
+               action);
+        (void)fflush(stdout);
+        return CLI_ACTIVATION_SCOPE_NOTHING_TO_REPLACE;
+    }
+    cbm_version_cohort_lease_t *lease = NULL;
+    cbm_daemon_conflict_t conflict;
+    memset(&conflict, 0, sizeof(conflict));
+    cbm_version_cohort_status_t status = cbm_version_cohort_acquire(
+        context->cohort_manager, &context->identity, cbm_now_ms(), &lease, &conflict);
+    cli_activation_release_cleanup_lease(context, &lease);
+    if (lease) {
+        return CLI_ACTIVATION_SCOPE_ERROR;
+    }
+    switch (status) {
+    case CBM_VERSION_COHORT_OK:
+    case CBM_VERSION_COHORT_BUSY:
+        return CLI_ACTIVATION_SCOPE_ACTIVE;
+    case CBM_VERSION_COHORT_CONFLICT:
+        break;
+    default:
+        return CLI_ACTIVATION_SCOPE_ERROR;
+    }
+    if (!conflict.active_cache_fingerprint[0] ||
+        strcmp(conflict.active_cache_fingerprint, context->cache_fingerprint) == 0) {
+        /* Same cache namespace, another build or version: that IS the daemon
+         * this activation replaces. An unreadable active cache stays in scope
+         * rather than silently exempting a same-namespace daemon. */
+        return CLI_ACTIVATION_SCOPE_ACTIVE;
+    }
+    (void)snprintf(context->scope_detail, sizeof(context->scope_detail),
+                   "active cohort serves another cache namespace (%.12s), this %s targets "
+                   "%.12s; scope=%s; nothing stopped",
+                   conflict.active_cache_fingerprint, action, context->cache_fingerprint, scope);
+    cli_activation_log_guard_decision(context, "foreign_cohort", conflict.active_cache_fingerprint);
+    printf("Leaving active CBM sessions untouched: they serve another cache namespace than "
+           "this %s targets.\n",
+           action);
+    (void)fflush(stdout);
+    return CLI_ACTIVATION_SCOPE_FOREIGN_COHORT;
+}
+
 static int cli_activation_production_reserve(void *opaque, cbm_cli_activation_lock_t *lease_out) {
     cli_activation_production_context_t *context = opaque;
     if (lease_out) {
@@ -536,6 +630,26 @@ static int cli_activation_production_reserve(void *opaque, cbm_cli_activation_lo
     if (!context || !context->cohort_manager || !lease_out) {
         return CLI_ERR;
     }
+    cli_activation_scope_t scope = cli_activation_resolve_scope(context);
+    if (scope == CLI_ACTIVATION_SCOPE_ERROR) {
+        return CLI_ERR;
+    }
+    if (scope != CLI_ACTIVATION_SCOPE_ACTIVE) {
+        /* Nothing in the target namespace is being replaced, or the only
+         * active cohort serves another namespace: hold no maintenance,
+         * admission, lifetime or startup lock (each wakes or blocks the other
+         * namespace's sessions) and send no drain request. */
+        if (!cli_activation_log_event(context, "quiesce_skipped", context->scope_detail)) {
+            return CLI_ERR;
+        }
+        context->coordination_skipped = true;
+        context->mutation_authorized = true;
+        *lease_out = context;
+        return 1;
+    }
+    printf("Stopping active CBM sessions and operations for %s...\n",
+           cli_activation_action_text(context->action));
+    (void)fflush(stdout);
     cbm_version_cohort_quiesce_result_t quiesce = CBM_VERSION_COHORT_QUIESCE_NOT_NEEDED;
     cbm_version_cohort_lease_t *lease = NULL;
     context->control_deadline_ms = cli_activation_deadline_after(CLI_ACTIVATION_CONTROL_TIMEOUT_MS);
@@ -582,6 +696,8 @@ static int cli_activation_production_reserve(void *opaque, cbm_cli_activation_lo
     }
 
     context->cohort_lease = lease;
+    cli_activation_log_guard_decision(
+        context, context->shutdown_requested ? "cohort_drained" : "no_active_cohort", NULL);
     if (!cli_activation_log_event(context, "daemon_stopped",
                                   context->shutdown_requested ? "cohort drained"
                                                               : "no active cohort")) {
@@ -600,6 +716,13 @@ static void cli_activation_production_release(void *opaque, cbm_cli_activation_l
     if (!context) {
         return;
     }
+    if (context->coordination_skipped) {
+        /* Nothing was held: the token is the context itself. */
+        if (lease != (cbm_cli_activation_lock_t)context) {
+            context->cleanup_ok = false;
+        }
+        return;
+    }
     /* Global release order is the inverse of acquisition: startup first,
      * then lifetime/admission/maintenance through the cohort lease. */
     if (context->startup_lock) {
@@ -626,9 +749,11 @@ static void cli_activation_production_diagnostic(void *opaque, const char *messa
 static bool cli_activation_production_context_init(cli_activation_production_context_t *context,
                                                    cbm_daemon_runtime_activation_action_t action,
                                                    const char *target_version,
-                                                   const char *target_build) {
+                                                   const char *target_build,
+                                                   bool quiesce_required) {
     memset(context, 0, sizeof(*context));
     context->action = action;
+    context->quiesce_required = quiesce_required;
     context->target_version = target_version;
     context->target_build = target_build;
     context->cleanup_ok = true;
@@ -735,23 +860,34 @@ static void cli_activation_production_context_close(cli_activation_production_co
     context->original_cache_environment = NULL;
 }
 
-static int cli_activation_guard(cbm_daemon_runtime_activation_action_t action,
-                                const char *target_version, const char *target_build,
-                                cbm_cli_activation_mutation_fn mutation, void *mutation_context) {
+/* quiesce_required: false when the activation publishes no binary and resets
+ * no index (a config-only install) — nothing running is then replaced, and
+ * no session is stopped for it. */
+static int cli_activation_guard_scoped(cbm_daemon_runtime_activation_action_t action,
+                                       const char *target_version, const char *target_build,
+                                       bool quiesce_required,
+                                       cbm_cli_activation_mutation_fn mutation,
+                                       void *mutation_context) {
     if (g_cli_activation_test_ops_set) {
         return cbm_cli_activation_guard_with_ops(&g_cli_activation_test_ops, mutation,
                                                  mutation_context);
     }
 
     cli_activation_production_context_t context;
-    if (!cli_activation_production_context_init(&context, action, target_version, target_build)) {
+    if (!cli_activation_production_context_init(&context, action, target_version, target_build,
+                                                quiesce_required)) {
         cli_activation_production_context_close(&context);
-        cli_activation_production_diagnostic(NULL, CLI_ACTIVATION_REFUSED_MESSAGE);
+        /* #1856: this refusal used to print the generic text BARE. Every other
+         * emitter routes through cli_activation_diagnostic, which appends the
+         * transaction refusal note or cbm_daemon_ipc_validation_detail() and so
+         * names the check that actually refused. Here the reader got "Check the
+         * errors above" with nothing above -- exactly the dead end #1537/#1416
+         * fixed on the other paths and missed on this one. Context init is
+         * where the cache, rendezvous and log directories are validated, so it
+         * is the emitter MOST likely to hold a detail worth showing. */
+        cli_activation_diagnostic(NULL, CLI_ACTIVATION_REFUSED_MESSAGE);
         return CLI_TRUE;
     }
-    printf("Stopping active CBM sessions and operations for %s...\n",
-           cli_activation_action_text(action));
-    (void)fflush(stdout);
     if (!cli_activation_log_event(&context, "requested", NULL)) {
         cli_activation_production_context_close(&context);
         (void)fprintf(stderr, "error: activation request could not be recorded safely; "
@@ -793,6 +929,13 @@ static int cli_activation_guard(cbm_daemon_runtime_activation_action_t action,
     return rc;
 }
 
+static int cli_activation_guard(cbm_daemon_runtime_activation_action_t action,
+                                const char *target_version, const char *target_build,
+                                cbm_cli_activation_mutation_fn mutation, void *mutation_context) {
+    return cli_activation_guard_scoped(action, target_version, target_build, true, mutation,
+                                       mutation_context);
+}
+
 /* Tar header field offsets */
 #define TAR_NAME_LEN 101    /* filename field: bytes 0-99 + NUL */
 #define TAR_SIZE_OFFSET 124 /* octal size field offset */
@@ -1370,8 +1513,8 @@ static const char skill_content[] =
     "\n"
     "## Edge Types\n"
     "CALLS, HTTP_CALLS, ASYNC_CALLS, DATA_FLOWS, IMPORTS, DEFINES, DEFINES_METHOD,\n"
-    "HANDLES, IMPLEMENTS, OVERRIDE, USAGE, CALL_REFERENCE, CONFIGURES, FILE_CHANGES_WITH,\n"
-    "SIMILAR_TO, SEMANTICALLY_RELATED, CONTAINS_FILE, CONTAINS_FOLDER,\n"
+    "HANDLES, IMPLEMENTS, OVERRIDE, USAGE, CALL_REFERENCE, CONFIGURES, REFERENCES_FILE,\n"
+    "FILE_CHANGES_WITH, SIMILAR_TO, SEMANTICALLY_RELATED, CONTAINS_FILE, CONTAINS_FOLDER,\n"
     "CONTAINS_PACKAGE\n"
     "\n"
     "## Cypher Examples (for query_graph)\n"
@@ -2286,6 +2429,140 @@ static int cbm_remove_openclaw_compaction(const char *config_path) {
                : CLI_ERR;
 }
 
+/* ── OpenHands settings.json mcp_config (#1826) ───────────────
+ * The mcpServers-style config installed above (cbm_install_editor_mcp into
+ * ~/.openhands/mcp.json) is not enough: OpenHands only loads a global MCP
+ * server it finds registered under settings.json -> mcp_config, in its own
+ * shape ({transport, command, enabled} — no args array). Agent profiles then
+ * opt in individually via mcp_server_refs (below). */
+
+static size_t cbm_openhands_ownership_fields(cbm_json_like_object_field_t fields[3]) {
+    fields[0] = (cbm_json_like_object_field_t){
+        .key = "transport",
+        .shape = CBM_JSON_LIKE_VALUE_STRING,
+        .expected_string = "stdio",
+        .flags = CBM_JSON_LIKE_FIELD_REQUIRED,
+    };
+    fields[1] = (cbm_json_like_object_field_t){
+        .key = "command",
+        .shape = CBM_JSON_LIKE_VALUE_STRING,
+        .expected_string = NULL,
+        .flags = CBM_JSON_LIKE_FIELD_REQUIRED | CBM_JSON_LIKE_FIELD_CAPTURE_STRING,
+    };
+    fields[2] = (cbm_json_like_object_field_t){
+        .key = "enabled",
+        .shape = CBM_JSON_LIKE_VALUE_LITERAL,
+        .expected_string = "true",
+        .flags = CBM_JSON_LIKE_FIELD_REQUIRED,
+    };
+    return 3U;
+}
+
+static char *cbm_build_openhands_mcp_entry(const char *binary_path) {
+    yyjson_mut_doc *doc = yyjson_mut_doc_new(NULL);
+    if (!doc) {
+        return NULL;
+    }
+    yyjson_mut_val *root = yyjson_mut_obj(doc);
+    bool ok = root && yyjson_mut_obj_add_strcpy(doc, root, "transport", "stdio") &&
+              yyjson_mut_obj_add_strcpy(doc, root, "command", binary_path) &&
+              yyjson_mut_obj_add_bool(doc, root, "enabled", true);
+    char *json = NULL;
+    if (ok) {
+        yyjson_mut_doc_set_root(doc, root);
+        json = yyjson_mut_write(doc, YYJSON_WRITE_NOFLAG, NULL);
+    }
+    yyjson_mut_doc_free(doc);
+    return json;
+}
+
+/* Insert or leave alone: an already-owned entry (exact match, or annotated
+ * with extra keys the client added) needs no write. A same-named entry that
+ * does not match our shape is left untouched and reported as an error rather
+ * than overwritten, matching cbm_upsert_json_named_mcp's fail-closed rule for
+ * every other editor client. */
+static int cbm_upsert_openhands_settings_mcp(const char *binary_path, const char *settings_path) {
+    if (!binary_path || !settings_path) {
+        return CLI_ERR;
+    }
+    static const char *const path[] = {"mcp_config"};
+    char *document = NULL;
+    size_t document_length = 0U;
+    int read_result = cbm_json_like_read_document(settings_path, &document, &document_length);
+    if (read_result < 0) {
+        return CLI_ERR;
+    }
+    if (read_result == 0) {
+        cbm_json_like_object_field_t fields[3];
+        size_t field_count = cbm_openhands_ownership_fields(fields);
+        char *command = NULL;
+        int ownership = cbm_json_like_match_object_entry(document, document_length, path, 1U,
+                                                         CBM_DEFAULT_MCP_SERVER_NAME, fields,
+                                                         field_count, &command);
+        free(command);
+        if (ownership == CBM_JSON_LIKE_OBJECT_MATCH ||
+            ownership == CBM_JSON_LIKE_OBJECT_MATCH_WITH_EXTRAS) {
+            free(document);
+            return CLI_OK;
+        }
+        if (ownership != CBM_JSON_LIKE_OBJECT_MISSING) {
+            free(document);
+            return CLI_ERR;
+        }
+    }
+    char *entry = cbm_build_openhands_mcp_entry(binary_path);
+    if (!entry) {
+        free(document);
+        return CLI_ERR;
+    }
+    int edit_result = cbm_json_like_upsert_entry_if_unchanged(
+        settings_path, path, 1U, CBM_DEFAULT_MCP_SERVER_NAME, entry,
+        read_result == 1 ? NULL : document, document_length);
+    free(entry);
+    free(document);
+    return edit_result == 0 ? CLI_OK : CLI_ERR;
+}
+
+/* Remove only an entry that is still recognisably ours (an annotated entry is
+ * left in place and reported, same rule as insertion above); a missing file,
+ * path, or entry is a successful no-op. */
+static int cbm_remove_openhands_settings_mcp(const char *settings_path) {
+    if (!settings_path) {
+        return CLI_ERR;
+    }
+    static const char *const path[] = {"mcp_config"};
+    char *document = NULL;
+    size_t document_length = 0U;
+    int read_result = cbm_json_like_read_document(settings_path, &document, &document_length);
+    if (read_result == 1) {
+        free(document);
+        return CLI_OK;
+    }
+    if (read_result < 0) {
+        free(document);
+        return CLI_ERR;
+    }
+    cbm_json_like_object_field_t fields[3];
+    size_t field_count = cbm_openhands_ownership_fields(fields);
+    char *command = NULL;
+    int ownership = cbm_json_like_match_object_entry(document, document_length, path, 1U,
+                                                     CBM_DEFAULT_MCP_SERVER_NAME, fields,
+                                                     field_count, &command);
+    free(command);
+    if (ownership == CBM_JSON_LIKE_OBJECT_MISSING || ownership == CBM_JSON_LIKE_OBJECT_MISMATCH) {
+        free(document);
+        return CLI_OK;
+    }
+    if (ownership != CBM_JSON_LIKE_OBJECT_MATCH) {
+        free(document);
+        return CLI_ERR;
+    }
+    int edit_result = cbm_json_like_remove_entry_if_unchanged(
+        settings_path, path, 1U, CBM_DEFAULT_MCP_SERVER_NAME, document, document_length);
+    free(document);
+    return edit_result == 0 ? CLI_OK : CLI_ERR;
+}
+
 /* ── VS Code MCP (servers key with type:stdio) ────────────────── */
 
 int cbm_install_vscode_mcp(const char *binary_path, const char *config_path) {
@@ -6965,6 +7242,12 @@ int cbm_remove_indexes(const char *home_dir) {
             if (cbm_unlink(path) == 0) {
                 count++;
             }
+            /* Remove the SQLite sidecars (-wal/-shm/-journal) for both the
+             * live and staged DBs. Idempotent and ENOENT-tolerant, so it runs
+             * even when the .db unlink failed -- an orphan -wal can outlive
+             * its .db. Sidecars are not indexes, so count is unchanged. */
+            cbm_remove_db_sidecars(path);
+            cbm_remove_db_sidecars(tmp_path);
         }
     }
     cbm_closedir(d);
@@ -7121,6 +7404,25 @@ bool cbm_config_watcher_enabled(cbm_config_t *cfg) {
     return cbm_config_get_bool(cfg, CBM_CONFIG_WATCHER_ENABLED, true);
 }
 
+bool cbm_config_load_index_policy(cbm_config_t *cfg, cbm_index_resource_policy_t *policy,
+                                  char *error, size_t error_size) {
+    if (!cfg || !policy) {
+        if (error && error_size > 0) {
+            (void)snprintf(error, error_size, "index resource configuration is unavailable");
+        }
+        return false;
+    }
+    cbm_index_policy_init(policy);
+    for (size_t index = 0; index < cbm_index_policy_key_count(); index++) {
+        const char *key = cbm_index_policy_key_at(index);
+        const char *value = cbm_config_get(cfg, key, cbm_index_policy_default_value(key));
+        if (!cbm_index_policy_set(policy, key, value, error, error_size)) {
+            return false;
+        }
+    }
+    return true;
+}
+
 /* ── Config CLI subcommand ────────────────────────────────────── */
 
 /* THE config-key table. list, get, help, and key validation all read this one
@@ -7145,6 +7447,8 @@ static const config_key_def_t CONFIG_KEYS[] = {
     {CBM_CONFIG_UI_LANG, "auto", "Pin graph UI language: en, zh, or auto"},
     {CBM_CONFIG_UI_ENABLED, "false", "Serve the graph UI on a loopback HTTP port"},
     {CBM_CONFIG_UI_PORT, "9749", "Port for the graph UI listener when enabled"},
+    {CBM_INDEX_CONFIG_MAX_FILES, "off", "Max accepted source files per index, or off"},
+    {CBM_INDEX_CONFIG_MAX_SOURCE_MB, "off", "Max accepted source MiB per index, or off"},
 };
 
 /* #1558: ui_enabled and ui_port were reachable ONLY by hand-editing
@@ -7170,6 +7474,31 @@ static bool config_key_is_ui(const char *key) {
     return key && (strcmp(key, CBM_CONFIG_UI_ENABLED) == 0 || strcmp(key, CBM_CONFIG_UI_PORT) == 0);
 }
 
+static bool config_key_is_index_policy(const char *key) {
+    return key && (strcmp(key, CBM_INDEX_CONFIG_MAX_FILES) == 0 ||
+                   strcmp(key, CBM_INDEX_CONFIG_MAX_SOURCE_MB) == 0);
+}
+
+static int config_index_policy_write(cbm_config_t *config, const char *key, const char *value) {
+    cbm_index_resource_policy_t candidate;
+    cbm_index_policy_init(&candidate);
+    char error[CLI_BUF_256];
+    if (!cbm_index_policy_set(&candidate, key, value, error, sizeof(error))) {
+        (void)fprintf(stderr, "error: %s\n", error);
+        return CLI_ERR;
+    }
+    int rc = cbm_config_set(config, key, value);
+    if (rc != 0) {
+        /* The caller suppresses its own message for policy keys because this
+         * helper names the precise reason. That is only true if the helper
+         * speaks on every failure it can return: a validated value whose write
+         * then fails -- a locked or read-only _config.db -- used to exit
+         * non-zero having printed nothing at all. */
+        (void)fprintf(stderr, "error: failed to set %s\n", key);
+    }
+    return rc;
+}
+
 static void config_ui_read(const char *key, char *out, size_t out_sz) {
     cbm_ui_config_t ui;
     cbm_ui_config_load(&ui);
@@ -7307,10 +7636,16 @@ int cbm_cmd_config(int argc, char **argv) {
                 rc = CLI_TRUE;
             }
         } else {
-            if (cbm_config_set(cfg, argv[CLI_SKIP_ONE], argv[CLI_PAIR_LEN]) == 0) {
+            int set_rc =
+                config_key_is_index_policy(argv[CLI_SKIP_ONE])
+                    ? config_index_policy_write(cfg, argv[CLI_SKIP_ONE], argv[CLI_PAIR_LEN])
+                    : cbm_config_set(cfg, argv[CLI_SKIP_ONE], argv[CLI_PAIR_LEN]);
+            if (set_rc == 0) {
                 printf("%s = %s\n", argv[CLI_SKIP_ONE], argv[CLI_PAIR_LEN]);
             } else {
-                (void)fprintf(stderr, "error: failed to set %s\n", argv[CLI_SKIP_ONE]);
+                if (!config_key_is_index_policy(argv[CLI_SKIP_ONE])) {
+                    (void)fprintf(stderr, "error: failed to set %s\n", argv[CLI_SKIP_ONE]);
+                }
                 rc = CLI_TRUE;
             }
         }
@@ -7843,6 +8178,90 @@ static cbm_install_plan_t *g_install_plan = NULL;
 static int g_agent_install_errors = 0;
 static int g_agent_uninstall_errors = 0;
 
+/* Every agent configuration uninstall could not clean, kept for the closing
+ * summary. A cleanup failure no longer stops executable and index removal
+ * (#1954: one symlinked ~/.cursor/mcp.json left a 300 MB binary plus the whole
+ * cache behind), so the user needs ONE list of what is still theirs to fix,
+ * with the observed reason next to each file. */
+typedef struct {
+    char agent[64];
+    char operation[48];
+    char path[CLI_BUF_1K];
+    char reason[160];
+    char detail[160];
+} cbm_agent_config_failure_t;
+
+static cbm_agent_config_failure_t *g_agent_uninstall_failures = NULL;
+static int g_agent_uninstall_failure_count = 0;
+static int g_agent_uninstall_failure_cap = 0;
+
+static void agent_uninstall_failures_reset(void) {
+    free(g_agent_uninstall_failures);
+    g_agent_uninstall_failures = NULL;
+    g_agent_uninstall_failure_count = 0;
+    g_agent_uninstall_failure_cap = 0;
+}
+
+static void agent_uninstall_failure_record(const char *agent, const char *operation,
+                                           const char *path, const char *reason,
+                                           const char *detail) {
+    if (g_agent_uninstall_failure_count >= g_agent_uninstall_failure_cap) {
+        int ncap = g_agent_uninstall_failure_cap ? g_agent_uninstall_failure_cap * 2 : CLI_BUF_16;
+        cbm_agent_config_failure_t *grown =
+            realloc(g_agent_uninstall_failures, (size_t)ncap * sizeof(*grown));
+        if (!grown) {
+            return;
+        }
+        g_agent_uninstall_failures = grown;
+        g_agent_uninstall_failure_cap = ncap;
+    }
+    cbm_agent_config_failure_t *entry =
+        &g_agent_uninstall_failures[g_agent_uninstall_failure_count++];
+    (void)snprintf(entry->agent, sizeof(entry->agent), "%s", agent ? agent : "unknown");
+    (void)snprintf(entry->operation, sizeof(entry->operation), "%s",
+                   operation ? operation : "unknown");
+    (void)snprintf(entry->path, sizeof(entry->path), "%s", path ? path : "unknown");
+    (void)snprintf(entry->reason, sizeof(entry->reason), "%s", reason ? reason : "");
+    (void)snprintf(entry->detail, sizeof(entry->detail), "%s", detail ? detail : "");
+}
+
+/* The agent-configuration writers opt in to following user-owned symlinked
+ * config files under the user's configuration roots (#1954, decision C);
+ * every other caller of the config editors keeps refusing links. Cleared by
+ * the same command when its configuration work is done. */
+static void cli_config_follow_begin(const char *home) {
+    cbm_config_edit_path_follow_clear();
+    if (home && home[0]) {
+        (void)cbm_config_edit_path_follow_add_root(home);
+    }
+    const char *xdg_config = getenv("XDG_CONFIG_HOME");
+    if (xdg_config && xdg_config[0]) {
+        (void)cbm_config_edit_path_follow_add_root(xdg_config);
+    }
+}
+
+/* The closing list of what uninstall could not clean. Printed AFTER the
+ * executable and the indexes are gone, so nothing in it is a reason to keep
+ * the installation around — each line is one file the user removes an entry
+ * from by hand. */
+static void agent_uninstall_failures_report(bool dry_run) {
+    if (g_agent_uninstall_failure_count == 0) {
+        return;
+    }
+    (void)fprintf(stderr, "\nerror: uninstall %s with %d agent configuration(s) left uncleaned:\n",
+                  dry_run ? "dry-run finished" : "finished", g_agent_uninstall_failure_count);
+    for (int i = 0; i < g_agent_uninstall_failure_count; i++) {
+        const cbm_agent_config_failure_t *entry = &g_agent_uninstall_failures[i];
+        (void)fprintf(stderr, "  %s (%s): %s", entry->agent, entry->operation, entry->path);
+        if (entry->reason[0]) {
+            (void)fprintf(stderr, " reason=%s", entry->reason);
+        }
+        (void)fputs(entry->detail, stderr);
+        (void)fputc('\n', stderr);
+    }
+    (void)fputs("Remove the codebase-memory-mcp entries from these files by hand.\n", stderr);
+}
+
 static void plan_record(const char *agent, const char *kind, const char *path) {
     if (!g_install_plan || !path || !path[0]) {
         return;
@@ -7898,6 +8317,14 @@ static void describe_agent_config_target(const char *path, char *out, size_t out
                        : info.is_directory ? "directory"
                        : info.is_regular   ? "regular file"
                                            : "special file";
+    /* A refused symlink names the rule that refused it (#1954): the user
+     * then knows whether to fix ownership, the target, or the parent. */
+    char refusal[160];
+    if (info.is_symlink && cbm_config_edit_path_refusal(path, refusal, sizeof(refusal))) {
+        (void)snprintf(out, out_size, " (target: symlink, %lld bytes; not followed: %s)",
+                       (long long)info.size, refusal);
+        return;
+    }
     (void)snprintf(out, out_size, " (target: %s, %lld bytes)", kind, (long long)info.size);
 }
 
@@ -7915,6 +8342,9 @@ static void record_agent_config_error_with_reason(bool uninstalling, const char
     }
     (void)fputs(detail, stderr);
     (void)fputc('\n', stderr);
+    if (uninstalling) {
+        agent_uninstall_failure_record(agent, operation, path, reason, detail);
+    }
 }
 
 static void record_agent_config_error(bool uninstalling, const char *agent, const char *operation,
@@ -9355,6 +9785,47 @@ static void uninstall_vscode_profile_configs(const char *code_user, const char *
     cbm_closedir(directory);
 }
 
+static bool cbm_filename_has_suffix(const char *name, const char *suffix) {
+    size_t name_len = strlen(name);
+    size_t suffix_len = strlen(suffix);
+    return name_len >= suffix_len && strcmp(name + (name_len - suffix_len), suffix) == 0;
+}
+
+/* Register or unregister our server against every existing OpenHands agent
+ * profile's mcp_server_refs array (#1826). A missing agent-profiles/
+ * directory is a silent no-op in both directions — install must never invent
+ * it, and uninstall has nothing to undo there. Only *.json entries are
+ * touched; a profile directory may hold arbitrary notes alongside profiles. */
+static void openhands_update_profile_refs(const char *profiles_dir, bool installing, bool dry_run) {
+    cbm_dir_t *d = cbm_opendir(profiles_dir);
+    if (!d) {
+        return;
+    }
+    cbm_dirent_t *ent;
+    while ((ent = cbm_readdir(d)) != NULL) {
+        if (strcmp(ent->name, ".") == 0 || strcmp(ent->name, "..") == 0 ||
+            !cbm_filename_has_suffix(ent->name, ".json")) {
+            continue;
+        }
+        char profile_path[CLI_BUF_1K];
+        snprintf(profile_path, sizeof(profile_path), "%s/%s", profiles_dir, ent->name);
+        struct stat state;
+        if (stat(profile_path, &state) != 0 || !S_ISREG(state.st_mode) || dry_run) {
+            continue;
+        }
+        int result = installing ? cbm_json_like_add_unique_string(profile_path, "mcp_server_refs",
+                                                                  CBM_DEFAULT_MCP_SERVER_NAME)
+                                : cbm_json_like_remove_string(profile_path, "mcp_server_refs",
+                                                              CBM_DEFAULT_MCP_SERVER_NAME);
+        if (result != CLI_OK) {
+            record_agent_config_error(
+                !installing, "OpenHands",
+                installing ? "profile_refs_install" : "profile_refs_uninstall", profile_path);
+        }
+    }
+    cbm_closedir(d);
+}
+
 /* Install MCP configs for editor-based agents (Zed, KiloCode, VS Code, OpenClaw). */
 static void install_editor_agent_configs(const cbm_detected_agents_t *agents, const char *home,
                                          const char *binary_path, bool force, bool dry_run) {
@@ -9617,11 +10088,32 @@ static void install_additional_agent_configs(const cbm_detected_agents_t *agents
     if (agents->openhands) {
         char cp[CLI_BUF_1K];
         char skills_dir[CLI_BUF_1K];
+        char settings_path[CLI_BUF_1K];
+        char profiles_dir[CLI_BUF_1K];
         snprintf(cp, sizeof(cp), "%s/.openhands/mcp.json", home);
         snprintf(skills_dir, sizeof(skills_dir), "%s/.agents/skills", home);
+        snprintf(settings_path, sizeof(settings_path), "%s/.openhands/settings.json", home);
+        snprintf(profiles_dir, sizeof(profiles_dir), "%s/.openhands/agent-profiles", home);
         install_generic_agent_config("OpenHands", binary_path, cp, NULL, dry_run,
                                      cbm_install_editor_mcp);
         install_agent_skill("OpenHands", skills_dir, force, dry_run);
+        /* #1826: the mcpServers-shaped mcp.json above is not enough — OpenHands
+         * only loads a server registered under settings.json -> mcp_config, and
+         * only for agent profiles that reference it. agent-profiles/ is never
+         * invented; a missing directory means nothing to register into yet. */
+        if (g_install_plan) {
+            plan_record("OpenHands", "mcp_config", settings_path);
+        } else {
+            if (!dry_run) {
+                if (!prepare_config_parent(settings_path) ||
+                    cbm_upsert_openhands_settings_mcp(binary_path, settings_path) != CLI_OK) {
+                    record_agent_config_error(false, "OpenHands", "settings_mcp_install",
+                                              settings_path);
+                }
+            }
+            printf("  settings mcp_config: %s\n", settings_path);
+            openhands_update_profile_refs(profiles_dir, true, dry_run);
+        }
     }
     if (agents->augment) {
         char cp[CLI_BUF_1K];
@@ -9887,12 +10379,24 @@ static void install_additional_agent_configs(const cbm_detected_agents_t *agents
     }
 }
 
+static int cbm_install_agent_configs_in_scope(const char *home, const char *binary_path, bool force,
+                                              bool dry_run, cbm_detected_agents_t *agents_in);
+
 int cbm_install_agent_configs(const char *home, const char *binary_path, bool force, bool dry_run) {
     g_agent_install_errors = 0;
     cbm_detected_agents_t agents = cbm_detect_agents(home);
     if (g_client_selection && !cli_clients_apply_selection(g_client_selection, &agents)) {
         return CLI_ERR;
     }
+    cli_config_follow_begin(home);
+    int result = cbm_install_agent_configs_in_scope(home, binary_path, force, dry_run, &agents);
+    cbm_config_edit_path_follow_clear();
+    return result;
+}
+
+static int cbm_install_agent_configs_in_scope(const char *home, const char *binary_path, bool force,
+                                              bool dry_run, cbm_detected_agents_t *agents_in) {
+    cbm_detected_agents_t agents = *agents_in;
     if (!g_install_plan) {
         print_detected_agents(&agents, home);
     }
@@ -10883,11 +11387,16 @@ int cbm_cmd_install(int argc, char **argv) {
         .force = force,
         .dry_run = dry_run,
     };
-    int activation_rc =
-        dry_run ? cli_install_activate(&activation)
-                : cli_activation_guard(CBM_DAEMON_RUNTIME_ACTIVATION_INSTALL, CBM_VERSION,
-                                       has_binary_validator ? binary_validator.fingerprint : NULL,
-                                       cli_install_activate, &activation);
+    /* What this install replaces decides whether any session must stop: with
+     * the published binary untouched (--skip-binary, or an externally managed
+     * binary) and no index reset, agent configs are refreshed while every
+     * session stays up. */
+    bool quiesce_required = has_binary_validator || delete_indexes;
+    int activation_rc = dry_run ? cli_install_activate(&activation)
+                                : cli_activation_guard_scoped(
+                                      CBM_DAEMON_RUNTIME_ACTIVATION_INSTALL, CBM_VERSION,
+                                      has_binary_validator ? binary_validator.fingerprint : NULL,
+                                      quiesce_required, cli_install_activate, &activation);
     if (activation.binary_transaction) {
         (void)cli_activation_transaction_abort(&activation.binary_transaction);
     }
@@ -11877,11 +12386,21 @@ static void uninstall_additional_agents(const cbm_detected_agents_t *agents, con
     if (agents->openhands) {
         char cp[CLI_BUF_1K];
         char skills_dir[CLI_BUF_1K];
+        char settings_path[CLI_BUF_1K];
+        char profiles_dir[CLI_BUF_1K];
         snprintf(cp, sizeof(cp), "%s/.openhands/mcp.json", home);
         snprintf(skills_dir, sizeof(skills_dir), "%s/.agents/skills", home);
+        snprintf(settings_path, sizeof(settings_path), "%s/.openhands/settings.json", home);
+        snprintf(profiles_dir, sizeof(profiles_dir), "%s/.openhands/agent-profiles", home);
         uninstall_agent_mcp_instr((mcp_uninstall_args_t){"OpenHands", cp, NULL}, dry_run,
                                   cbm_remove_editor_mcp_owned);
         printf("  removed %d skill(s)\n", cbm_remove_skills(skills_dir, dry_run));
+        /* #1826 counterpart: undo the settings.json registration and every
+         * agent profile's mcp_server_refs entry the install above added. */
+        if (!dry_run && cbm_remove_openhands_settings_mcp(settings_path) != CLI_OK) {
+            record_agent_config_error(true, "OpenHands", "settings_mcp_uninstall", settings_path);
+        }
+        openhands_update_profile_refs(profiles_dir, false, dry_run);
     }
     if (agents->augment) {
         char cp[CLI_BUF_1K];
@@ -12192,6 +12711,7 @@ static int cli_uninstall_activate(void *opaque) {
         return CLI_TRUE;
     }
 
+    cli_config_follow_begin(activation->home);
     if (activation->agents.claude_code) {
         uninstall_claude_code(activation->home, activation->bin_path, activation->dry_run);
     }
@@ -12199,14 +12719,14 @@ static int cli_uninstall_activate(void *opaque) {
     uninstall_editor_agents(&activation->agents, activation->home, activation->dry_run);
     uninstall_additional_agents(&activation->agents, activation->home, activation->dry_run);
     uninstall_agent_client_registry(activation->home, activation->dry_run);
+    cbm_config_edit_path_follow_clear();
 
-    if (g_agent_uninstall_errors != 0) {
-        cli_activation_transaction_abort_or_fail_stop(&activation->binary_transaction,
-                                                      "uninstall_transaction_config_cleanup_abort");
-        (void)fprintf(stderr, "error: one or more agent cleanup operations failed; executable "
-                              "and index removal were not started\n");
-        return CLI_ACTIVATION_PARTIAL;
-    }
+    /* Agent-config failures are collected, never a gate: an entry the editors
+     * refuse to touch (a symlinked config, a foreign file, a malformed
+     * document) is the user's to fix by hand, and leaving a 300 MB executable
+     * plus every index behind because of it is the data-loss shape of #1954.
+     * The indexes and the executable go now; the failures are listed at the
+     * end and decide the exit code. */
 
 #ifdef _WIN32
     /* #2117: install registers the install directory in the persistent
@@ -12344,6 +12864,7 @@ int cbm_cmd_uninstall(int argc, char **argv) {
     printf("codebase-memory-mcp uninstall\n\n");
 
     g_agent_uninstall_errors = 0;
+    agent_uninstall_failures_reset();
     cbm_detected_agents_t agents = cbm_detect_agents(home);
 
     /* Confirm index removal outside the startup lock, but defer the mutation
@@ -12413,6 +12934,19 @@ int cbm_cmd_uninstall(int argc, char **argv) {
         (void)cli_activation_transaction_abort(&activation.binary_transaction);
     }
     if (activation_rc != CLI_OK) {
+        agent_uninstall_failures_reset();
+        return CLI_TRUE;
+    }
+
+    if (g_agent_uninstall_errors != 0) {
+        agent_uninstall_failures_report(dry_run);
+        agent_uninstall_failures_reset();
+        printf("\nUninstall finished with errors; the files listed above still hold "
+               "codebase-memory-mcp entries. Please restart your coding-agent sessions "
+               "to properly take this into account.\n");
+        if (dry_run) {
+            printf("(dry-run — no files were modified)\n");
+        }
         return CLI_TRUE;
     }
 
@@ -12421,7 +12955,7 @@ int cbm_cmd_uninstall(int argc, char **argv) {
     if (dry_run) {
         printf("(dry-run — no files were modified)\n");
     }
-    return g_agent_uninstall_errors == 0 ? 0 : CLI_TRUE;
+    return 0;
 }
 
 /* ── Subcommand: update ───────────────────────────────────────── */
@@ -13218,6 +13752,32 @@ static void cli_add_typed(yyjson_mut_doc *out, yyjson_mut_val *obj, const char *
             arr = yyjson_mut_arr(out);
             yyjson_mut_obj_add(obj, yyjson_mut_strcpy(out, key), arr);
         }
+        /* The help prints `--paths <array>`, and a caller who writes the
+         * array literally — `--paths '["lib","t"]'` — used to get ONE element
+         * holding that literal text (2026-09-16 probe: check_index_coverage
+         * reported the fake path `["lib","t"]`). A value that parses as a JSON
+         * array contributes its elements; anything else is one element. */
+        if (have_value && value && value[0] == '[') {
+            yyjson_doc *lit = yyjson_read(value, strlen(value), 0);
+            yyjson_val *lit_root = lit ? yyjson_doc_get_root(lit) : NULL;
+            if (lit_root && yyjson_is_arr(lit_root)) {
+                size_t idx;
+                size_t max;
+                yyjson_val *elem;
+                yyjson_arr_foreach(lit_root, idx, max, elem) {
+                    if (yyjson_is_str(elem)) {
+                        yyjson_mut_arr_add_strcpy(out, arr, yyjson_get_str(elem));
+                    } else {
+                        yyjson_mut_arr_add_val(arr, yyjson_val_mut_copy(out, elem));
+                    }
+                }
+                yyjson_doc_free(lit);
+                return;
+            }
+            if (lit) {
+                yyjson_doc_free(lit);
+            }
+        }
         yyjson_mut_arr_add_strcpy(out, arr, have_value ? value : "");
         return;
     }
diff --git a/src/cli/cli.h b/src/cli/cli.h
index 139221f0a..5522edef0 100644
--- a/src/cli/cli.h
+++ b/src/cli/cli.h
@@ -13,6 +13,8 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "foundation/index_policy.h"
+
 typedef struct cbm_mcp_server cbm_mcp_server_t;
 
 /* ── Version ──────────────────────────────────────────────────── */
@@ -25,6 +27,18 @@ const char *cbm_cli_get_version(void);
 
 /* ── CLI tool arguments (flags / --args-file / --help) ────────── */
 
+/* Top-level `cli --help` text printed by run_cli() in src/main.c.
+ * Documents tool-level --format without adding a session-wide flag (#2102). */
+#define CBM_CLI_USAGE                                                                         \
+    "Usage: codebase-memory-mcp cli [--quiet] [--progress] [--verbose] [--json] <tool_name> " \
+    "[json_args]\n"                                                                           \
+    "  --quiet     Show errors only; cannot combine with --progress or outer --verbose\n"     \
+    "  --progress  Show lifecycle progress even when stderr is redirected\n"                  \
+    "  --verbose   Include informational logs (preserves CBM_LOG_LEVEL=debug)\n"              \
+    "  --json      Print the raw MCP result envelope\n"                                       \
+    "  Tools that accept format support --format tree|json (default: tree).\n"                \
+    "  --format json prints payload JSON; outer --json prints the full MCP envelope.\n"
+
 /* Convert `--flag value` / `--flag=value` / bare-boolean `--flag` arguments for
  * a tool into a JSON arguments object string, using the tool's input_schema to
  * type values (string/integer/boolean) and to collect repeated flags into
@@ -420,6 +434,11 @@ int cbm_config_set(cbm_config_t *cfg, const char *key, const char *value);
 /* Delete a config key. Returns 0 on success. */
 int cbm_config_delete(cbm_config_t *cfg, const char *key);
 
+/* Load and validate the operator-controlled discovery policy. Invalid stored
+ * values fail closed instead of silently disabling a guard. */
+bool cbm_config_load_index_policy(cbm_config_t *cfg, cbm_index_resource_policy_t *policy,
+                                  char *error, size_t error_size);
+
 /* Well-known config keys */
 #define CBM_CONFIG_AUTO_INDEX "auto_index"
 #define CBM_CONFIG_AUTO_INDEX_LIMIT "auto_index_limit"
diff --git a/src/cli/client_adapter.c b/src/cli/client_adapter.c
index dbd913426..38e73cfe0 100644
--- a/src/cli/client_adapter.c
+++ b/src/cli/client_adapter.c
@@ -7,6 +7,7 @@
 
 #include "foundation/constants.h"
 #include "mcp/mcp.h"
+#include "yyjson/yyjson.h"
 
 #include <stdbool.h>
 #include <stdio.h>
@@ -138,6 +139,167 @@ static void emit_header(adapter_sb_t *sb, const char *client) {
               "// are overwritten; edit outside it, or remove the markers to take ownership.\n");
 }
 
+static void append_typebox_type(adapter_sb_t *sb, yyjson_val *val, const char *description,
+                                bool include_description) {
+    yyjson_val *type_val = yyjson_obj_get(val, "type");
+    yyjson_val *enum_val = yyjson_obj_get(val, "enum");
+    yyjson_val *items_val = yyjson_obj_get(val, "items");
+    const char *type_str = yyjson_get_str(type_val);
+
+    if (type_str && strcmp(type_str, "string") == 0 && enum_val && yyjson_is_arr(enum_val) &&
+        yyjson_arr_size(enum_val) > 0) {
+        sb_append(sb, "Type.Union([");
+        size_t enum_idx = 0;
+        size_t enum_max = yyjson_arr_size(enum_val);
+        bool first_enum = true;
+        for (enum_idx = 0; enum_idx < enum_max; enum_idx++) {
+            yyjson_val *enum_item = yyjson_arr_get(enum_val, enum_idx);
+            const char *enum_str = yyjson_get_str(enum_item);
+            if (!enum_str) {
+                continue;
+            }
+            if (!first_enum) {
+                sb_append(sb, ", ");
+            }
+            first_enum = false;
+            sb_append(sb, "Type.Literal(");
+            sb_append_js_string(sb, enum_str);
+            sb_append(sb, ")");
+        }
+        if (first_enum) {
+            sb_append(sb, "Type.String()");
+        } else {
+            sb_append(sb, "]");
+            if (include_description && description) {
+                sb_append(sb, ", { description: ");
+                sb_append_js_string(sb, description);
+                sb_append(sb, " }");
+            }
+            sb_append(sb, ")");
+            return;
+        }
+        sb_append(sb, ")");
+        return;
+    }
+
+    const char *typebox_name = "Any";
+    if (type_str && strcmp(type_str, "string") == 0) {
+        typebox_name = "String";
+    } else if (type_str && strcmp(type_str, "integer") == 0) {
+        typebox_name = "Integer";
+    } else if (type_str && strcmp(type_str, "number") == 0) {
+        typebox_name = "Number";
+    } else if (type_str && strcmp(type_str, "boolean") == 0) {
+        typebox_name = "Boolean";
+    }
+
+    if (type_str && strcmp(type_str, "array") == 0) {
+        sb_append(sb, "Type.Array(");
+        if (items_val) {
+            append_typebox_type(sb, items_val, NULL, false);
+        } else {
+            sb_append(sb, "Type.Any()");
+        }
+        if (include_description && description) {
+            sb_append(sb, ", { description: ");
+            sb_append_js_string(sb, description);
+            sb_append(sb, " }");
+        }
+        sb_append(sb, ")");
+        return;
+    }
+
+    sb_append(sb, "Type.");
+    sb_append(sb, typebox_name);
+    sb_append(sb, "(");
+    if (include_description && description) {
+        sb_append(sb, "{ description: ");
+        sb_append_js_string(sb, description);
+        sb_append(sb, " }");
+    }
+    sb_append(sb, ")");
+}
+
+static bool typebox_property_is_required(yyjson_val *required, const char *prop_name) {
+    if (!required || !yyjson_is_arr(required)) {
+        return false;
+    }
+    size_t idx = 0;
+    size_t max = yyjson_arr_size(required);
+    for (idx = 0; idx < max; idx++) {
+        const char *required_name = yyjson_get_str(yyjson_arr_get(required, idx));
+        if (required_name && strcmp(required_name, prop_name) == 0) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static void convert_json_schema_to_typebox(adapter_sb_t *sb, const char *schema_str) {
+    if (!schema_str) {
+        sb_append(sb, "Type.Object({})");
+        return;
+    }
+
+    /* Parse the JSON schema to extract properties and convert to TypeBox */
+    yyjson_doc *doc = yyjson_read(schema_str, strlen(schema_str), 0);
+    if (!doc) {
+        sb_append(sb, "Type.Object({})");
+        return;
+    }
+
+    yyjson_val *root = yyjson_doc_get_root(doc);
+    if (!root) {
+        sb_append(sb, "Type.Object({})");
+        yyjson_doc_free(doc);
+        return;
+    }
+
+    yyjson_val *properties = yyjson_obj_get(root, "properties");
+    yyjson_val *required = yyjson_obj_get(root, "required");
+    if (!properties) {
+        sb_append(sb, "Type.Object({})");
+        yyjson_doc_free(doc);
+        return;
+    }
+
+    sb_append(sb, "Type.Object({\n");
+
+    bool first_prop = true;
+    size_t idx = 0, max = 0;
+    yyjson_val *key = NULL, *val = NULL;
+
+    yyjson_obj_foreach(properties, idx, max, key, val) {
+        const char *prop_name = yyjson_get_str(key);
+        if (!prop_name) {
+            continue;
+        }
+
+        if (!first_prop) {
+            sb_append(sb, ",\n");
+        }
+        first_prop = false;
+
+        sb_append(sb, "      ");
+        sb_append(sb, prop_name);
+        sb_append(sb, ": ");
+
+        yyjson_val *description_val = yyjson_obj_get(val, "description");
+        const char *description = yyjson_get_str(description_val);
+        bool is_required = typebox_property_is_required(required, prop_name);
+        if (!is_required) {
+            sb_append(sb, "Type.Optional(");
+        }
+        append_typebox_type(sb, val, description, true);
+        if (!is_required) {
+            sb_append(sb, ")");
+        }
+    }
+
+    sb_append(sb, "\n    })");
+    yyjson_doc_free(doc);
+}
+
 char *cbm_client_adapter_pi(const char *binary_path) {
     if (!binary_path || !binary_path[0]) {
         return NULL;
@@ -157,7 +319,8 @@ char *cbm_client_adapter_pi(const char *binary_path) {
      * (pods CLI) or an old AgentTool arity cannot be mistaken for this file. */
     sb_append(&sb, "// Target: @earendil-works/pi-coding-agent >= 0.74.0 (verified 0.84.2)\n"
                    "// ToolDefinition.execute(toolCallId, params, signal, onUpdate, ctx)\n");
-    sb_append(&sb, "import { spawn } from 'node:child_process';\n\n");
+    sb_append(&sb, "import { spawn } from 'node:child_process';\n");
+    sb_append(&sb, "import { Type } from 'typebox';\n\n");
     sb_append(&sb, "const BIN = '");
     sb_append(&sb, bin);
     sb_append(&sb, "';\n\n");
@@ -224,10 +387,8 @@ char *cbm_client_adapter_pi(const char *binary_path) {
         sb_append(&sb, ",\n    description: ");
         sb_append_js_string(&sb, description ? description : "");
         sb_append(&sb, ",\n    parameters: ");
-        /* input_schema is compact JSON, which is a valid JavaScript object
-         * literal; embedding it directly keeps the generated module free of a
-         * JSON.parse indirection and of any escaping drift. */
-        sb_append(&sb, schema ? schema : "{}");
+        /* Convert JSON schema to TypeBox format */
+        convert_json_schema_to_typebox(&sb, schema);
         /* 0.84.2 calls execute(toolCallId, params, signal, onUpdate, ctx).
          * The previous (args, ctx) shape bound the call id as the MCP args. */
         sb_append(&sb, ",\n    execute: async (toolCallId, params, signal, _onUpdate, ctx) => {\n");
diff --git a/src/cli/config_edit_path.c b/src/cli/config_edit_path.c
new file mode 100644
index 000000000..2217f3855
--- /dev/null
+++ b/src/cli/config_edit_path.c
@@ -0,0 +1,457 @@
+/*
+ * config_edit_path.c — follow a config symlink only when the agent-config
+ * writer opted in, the invoking user owns both the link and its regular-file
+ * target, and the target's parent directory can be pinned. See the header
+ * for the decision, the sequence and its boundaries (#1954).
+ */
+#include "cli/config_edit_path.h"
+
+#include "foundation/compat.h"
+#include "foundation/compat_fs.h"
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#ifndef _WIN32
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#endif
+
+enum { EDIT_PATH_MAX_ROOTS = 4 };
+
+static int edit_path_copy(const char *source, char *out, size_t out_size) {
+    int written = snprintf(out, out_size, "%s", source);
+    return written >= 0 && (size_t)written < out_size ? 0 : -1;
+}
+
+static void edit_path_target_reset(cbm_config_edit_target_t *target) {
+    target->status = CBM_CONFIG_EDIT_PATH_DIRECT;
+    target->dirfd = -1;
+    target->fd = -1;
+    target->base[0] = '\0';
+    target->path[0] = '\0';
+}
+
+#ifndef _WIN32
+/* Only the POSIX symlink-follow resolver records a refusal reason; the Windows
+ * build never follows, so guard this with the same condition as its callers to
+ * avoid -Werror,-Wunused-function (#2110 CI). */
+static void edit_path_note(char *reason, size_t reason_size, const char *text) {
+    if (reason && reason_size > 0U) {
+        (void)snprintf(reason, reason_size, "%s", text);
+    }
+}
+#endif /* !_WIN32 */
+
+void cbm_config_edit_target_close(cbm_config_edit_target_t *target) {
+    if (!target) {
+        return;
+    }
+    int saved_errno = errno;
+#ifndef _WIN32
+    if (target->fd >= 0) {
+        (void)close(target->fd);
+    }
+    if (target->dirfd >= 0) {
+        (void)close(target->dirfd);
+    }
+#endif
+    target->fd = -1;
+    target->dirfd = -1;
+    errno = saved_errno;
+}
+
+#ifndef _WIN32
+
+/* The opted-in follow-roots are per-thread (test isolation), but the storage
+ * is a heap buffer behind a thread-local POINTER, not a thread-local array.
+ * A `_Thread_local char[4][4096]` sits in the binary's static TLS block, and
+ * glibc carves that block out of every thread's stack allocation — including
+ * the parent-death watchdog's deliberately tiny 64 KiB stack (main.c). The
+ * 16 KiB array pushed the watchdog's pthread_create over the static-TLS +
+ * guard budget, so it failed with EINVAL on glibc/x86-64 (green on macOS,
+ * whose TLS is not stack-carved): #2110 CI. The pointer keeps the static TLS
+ * block at 8 bytes; the buffer is allocated on first add and freed by clear. */
+static CBM_TLS char (*edit_path_roots)[CBM_CONFIG_EDIT_PATH_MAX] = NULL;
+static CBM_TLS size_t edit_path_root_count = 0U;
+
+#ifdef CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API
+static CBM_TLS int edit_path_uid_override_set = 0;
+static CBM_TLS uid_t edit_path_uid_override = 0;
+static CBM_TLS int edit_path_identity_skew = 0;
+
+void cbm_config_edit_path_set_invoking_uid_for_test(unsigned uid, int set) {
+    edit_path_uid_override_set = set != 0;
+    edit_path_uid_override = (uid_t)uid;
+}
+
+void cbm_config_edit_path_set_identity_skew_for_test(int set) {
+    edit_path_identity_skew = set != 0;
+}
+#endif
+
+static uid_t edit_path_invoking_uid(void) {
+#ifdef CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API
+    if (edit_path_uid_override_set) {
+        return edit_path_uid_override;
+    }
+#endif
+    return geteuid();
+}
+
+int cbm_config_edit_path_follow_add_root(const char *root) {
+    if (!root || !root[0] || edit_path_root_count >= EDIT_PATH_MAX_ROOTS) {
+        return -1;
+    }
+    char canonical[CBM_CONFIG_EDIT_PATH_MAX];
+    if (!cbm_canonical_path(root, canonical, sizeof(canonical))) {
+        return -1;
+    }
+    if (!edit_path_roots) {
+        edit_path_roots = calloc(EDIT_PATH_MAX_ROOTS, sizeof(*edit_path_roots));
+        if (!edit_path_roots) {
+            return -1;
+        }
+    }
+    if (edit_path_copy(canonical, edit_path_roots[edit_path_root_count],
+                       sizeof(edit_path_roots[0])) != 0) {
+        return -1;
+    }
+    edit_path_root_count++;
+    return 0;
+}
+
+void cbm_config_edit_path_follow_clear(void) {
+    edit_path_root_count = 0U;
+    free(edit_path_roots);
+    edit_path_roots = NULL;
+}
+
+static int edit_path_under_root(const char *canonical) {
+    for (size_t i = 0U; i < edit_path_root_count; i++) {
+        const char *root = edit_path_roots[i];
+        size_t root_length = strlen(root);
+        if (strcmp(canonical, root) == 0) {
+            return 1;
+        }
+        if (strncmp(canonical, root, root_length) == 0 &&
+            (canonical[root_length] == '/' || root[root_length - 1U] == '/')) {
+            return 1;
+        }
+    }
+    return 0;
+}
+
+/* Splits a canonical absolute path into its parent and its final name. */
+static int edit_path_split(const char *canonical, char *parent, size_t parent_size, char *base,
+                           size_t base_size) {
+    const char *slash = strrchr(canonical, '/');
+    if (!slash || slash[1] == '\0') {
+        return -1;
+    }
+    size_t parent_length = slash == canonical ? 1U : (size_t)(slash - canonical);
+    if (parent_length >= parent_size || edit_path_copy(slash + 1, base, base_size) != 0) {
+        return -1;
+    }
+    memcpy(parent, canonical, parent_length);
+    parent[parent_length] = '\0';
+    return 0;
+}
+
+/* The link's OWN directory must sit under a registered root: that is what
+ * makes the follow an opt-in of the agent-configuration writers rather than
+ * a property of every editor caller. */
+static int edit_path_link_dir_under_root(const char *path) {
+    if (edit_path_root_count == 0U) {
+        return 0;
+    }
+    char parent[CBM_CONFIG_EDIT_PATH_MAX];
+    if (edit_path_copy(path, parent, sizeof(parent)) != 0) {
+        return 0;
+    }
+    char *slash = strrchr(parent, '/');
+    if (!slash) {
+        parent[0] = '.';
+        parent[1] = '\0';
+    } else if (slash == parent) {
+        parent[1] = '\0';
+    } else {
+        *slash = '\0';
+    }
+    char canonical[CBM_CONFIG_EDIT_PATH_MAX];
+    if (!cbm_canonical_path(parent, canonical, sizeof(canonical))) {
+        return 0;
+    }
+    return edit_path_under_root(canonical);
+}
+
+static void edit_path_note_owner(char *reason, size_t reason_size, const char *what,
+                                 unsigned long owner, unsigned long self) {
+    if (reason && reason_size > 0U) {
+        (void)snprintf(reason, reason_size, "%s owned by uid %lu, not the invoking user (uid %lu)",
+                       what, owner, self);
+    }
+}
+
+/* One classification serves both the resolver and the diagnostic, so the
+ * reason a user reads is exactly the rule that refused the link. On REFUSED
+ * every descriptor opened along the way is closed again. */
+static int edit_path_classify(const char *path, cbm_config_edit_target_t *target, char *reason,
+                              size_t reason_size) {
+    edit_path_target_reset(target);
+    if (reason && reason_size > 0U) {
+        reason[0] = '\0';
+    }
+    if (!path || !path[0]) {
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    struct stat link_state;
+    if (lstat(path, &link_state) != 0 || !S_ISLNK(link_state.st_mode)) {
+        return edit_path_copy(path, target->path, sizeof(target->path)) == 0
+                   ? CBM_CONFIG_EDIT_PATH_DIRECT
+                   : CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    if (!edit_path_link_dir_under_root(path)) {
+        edit_path_note(reason, reason_size,
+                       edit_path_root_count == 0U
+                           ? "symlinks are not followed by this command"
+                           : "symlink outside the opted-in configuration roots");
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    uid_t self = edit_path_invoking_uid();
+    if (self == 0 && link_state.st_uid != 0) {
+        if (reason && reason_size > 0U) {
+            (void)snprintf(reason, reason_size,
+                           "symlink owned by uid %lu is not followed by a root process",
+                           (unsigned long)link_state.st_uid);
+        }
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    if (link_state.st_uid != self) {
+        edit_path_note_owner(reason, reason_size, "symlink", (unsigned long)link_state.st_uid,
+                             (unsigned long)self);
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    char resolved[CBM_CONFIG_EDIT_PATH_MAX];
+    struct stat target_state;
+    if (!cbm_canonical_path(path, resolved, sizeof(resolved)) ||
+        stat(resolved, &target_state) != 0) {
+        edit_path_note(reason, reason_size, "dangling symlink");
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    if (!S_ISREG(target_state.st_mode)) {
+        edit_path_note(reason, reason_size,
+                       S_ISDIR(target_state.st_mode) ? "symlink to a directory"
+                                                     : "symlink to a special file");
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    if (target_state.st_uid != self) {
+        edit_path_note_owner(reason, reason_size, "symlink target",
+                             (unsigned long)target_state.st_uid, (unsigned long)self);
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+#if CBM_CONFIG_EDIT_TARGET_UNDER_ROOT
+    if (!edit_path_under_root(resolved)) {
+        edit_path_note(reason, reason_size, "symlink target outside the configuration roots");
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+#endif
+    char parent[CBM_CONFIG_EDIT_PATH_MAX];
+    if (edit_path_split(resolved, parent, sizeof(parent), target->base, sizeof(target->base)) !=
+            0 ||
+        edit_path_copy(resolved, target->path, sizeof(target->path)) != 0) {
+        edit_path_note(reason, reason_size, "symlink target path is too long");
+        edit_path_target_reset(target);
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+
+    int dir_flags = O_RDONLY | O_NOFOLLOW;
+#ifdef O_DIRECTORY
+    dir_flags |= O_DIRECTORY;
+#endif
+#ifdef O_CLOEXEC
+    dir_flags |= O_CLOEXEC;
+#endif
+    target->dirfd = open(parent, dir_flags);
+    struct stat dir_state;
+    if (target->dirfd < 0 || fstat(target->dirfd, &dir_state) != 0 || !S_ISDIR(dir_state.st_mode)) {
+        edit_path_note(reason, reason_size,
+                       "parent directory of the symlink target cannot be opened");
+        cbm_config_edit_target_close(target);
+        edit_path_target_reset(target);
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    if (dir_state.st_uid != self && dir_state.st_uid != 0) {
+        if (reason && reason_size > 0U) {
+            (void)snprintf(reason, reason_size,
+                           "parent directory of the symlink target is owned by uid %lu",
+                           (unsigned long)dir_state.st_uid);
+        }
+        cbm_config_edit_target_close(target);
+        edit_path_target_reset(target);
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    if ((dir_state.st_mode & S_IWOTH) != 0 && (dir_state.st_mode & S_ISVTX) == 0) {
+        edit_path_note(reason, reason_size,
+                       "parent directory of the symlink target is writable by others");
+        cbm_config_edit_target_close(target);
+        edit_path_target_reset(target);
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+
+    int file_flags = O_RDONLY | O_NOFOLLOW | O_NONBLOCK;
+#ifdef O_CLOEXEC
+    file_flags |= O_CLOEXEC;
+#endif
+    target->fd = openat(target->dirfd, target->base, file_flags);
+    struct stat opened_state;
+    if (target->fd < 0 || fstat(target->fd, &opened_state) != 0) {
+        edit_path_note(reason, reason_size, "symlink target cannot be opened beside its parent");
+        cbm_config_edit_target_close(target);
+        edit_path_target_reset(target);
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    const char *mismatch = NULL;
+    if (!S_ISREG(opened_state.st_mode)) {
+        mismatch = "symlink target is not a regular file";
+    } else if (opened_state.st_uid != self) {
+        mismatch = "symlink target changed owner while it was being checked";
+    } else if (opened_state.st_nlink != 1U) {
+        mismatch = "symlink target is hard-linked";
+    } else if (opened_state.st_dev != target_state.st_dev ||
+               opened_state.st_ino != target_state.st_ino) {
+        mismatch = "symlink target changed while it was being checked";
+    }
+#ifdef CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API
+    if (!mismatch && edit_path_identity_skew) {
+        mismatch = "symlink target changed while it was being checked";
+    }
+#endif
+    if (mismatch) {
+        edit_path_note(reason, reason_size, mismatch);
+        cbm_config_edit_target_close(target);
+        edit_path_target_reset(target);
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    target->status = CBM_CONFIG_EDIT_PATH_FOLLOWED;
+    return CBM_CONFIG_EDIT_PATH_FOLLOWED;
+}
+
+int cbm_config_edit_target_create_temp(const cbm_config_edit_target_t *target, const char *name,
+                                       unsigned mode) {
+    if (!target || target->status != CBM_CONFIG_EDIT_PATH_FOLLOWED || target->dirfd < 0 || !name ||
+        !name[0] || strchr(name, '/')) {
+        errno = EINVAL;
+        return -1;
+    }
+    int flags = O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW;
+#ifdef O_CLOEXEC
+    flags |= O_CLOEXEC;
+#endif
+    return openat(target->dirfd, name, flags, (mode_t)mode);
+}
+
+int cbm_config_edit_target_commit(const cbm_config_edit_target_t *target, const char *name) {
+    if (!target || target->status != CBM_CONFIG_EDIT_PATH_FOLLOWED || target->dirfd < 0 || !name ||
+        !name[0] || strchr(name, '/')) {
+        errno = EINVAL;
+        return -1;
+    }
+    if (renameat(target->dirfd, name, target->dirfd, target->base) != 0) {
+        return -1;
+    }
+    return fsync(target->dirfd) == 0 ? 0 : -1;
+}
+
+int cbm_config_edit_target_unlink(const cbm_config_edit_target_t *target, const char *name) {
+    if (!target || target->status != CBM_CONFIG_EDIT_PATH_FOLLOWED || target->dirfd < 0 || !name ||
+        !name[0] || strchr(name, '/')) {
+        errno = EINVAL;
+        return -1;
+    }
+    return unlinkat(target->dirfd, name, 0);
+}
+
+#else /* _WIN32 */
+
+#ifdef CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API
+void cbm_config_edit_path_set_invoking_uid_for_test(unsigned uid, int set) {
+    (void)uid;
+    (void)set;
+}
+
+void cbm_config_edit_path_set_identity_skew_for_test(int set) {
+    (void)set;
+}
+#endif
+
+int cbm_config_edit_path_follow_add_root(const char *root) {
+    (void)root;
+    return 0;
+}
+
+void cbm_config_edit_path_follow_clear(void) {}
+
+/* Reparse points are never followed by the editors on Windows; the path is
+ * handed back unchanged and FILE_FLAG_OPEN_REPARSE_POINT keeps refusing. */
+static int edit_path_classify(const char *path, cbm_config_edit_target_t *target, char *reason,
+                              size_t reason_size) {
+    edit_path_target_reset(target);
+    if (reason && reason_size > 0U) {
+        reason[0] = '\0';
+    }
+    if (!path || !path[0]) {
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    return edit_path_copy(path, target->path, sizeof(target->path)) == 0
+               ? CBM_CONFIG_EDIT_PATH_DIRECT
+               : CBM_CONFIG_EDIT_PATH_REFUSED;
+}
+
+int cbm_config_edit_target_create_temp(const cbm_config_edit_target_t *target, const char *name,
+                                       unsigned mode) {
+    (void)target;
+    (void)name;
+    (void)mode;
+    errno = EINVAL;
+    return -1;
+}
+
+int cbm_config_edit_target_commit(const cbm_config_edit_target_t *target, const char *name) {
+    (void)target;
+    (void)name;
+    errno = EINVAL;
+    return -1;
+}
+
+int cbm_config_edit_target_unlink(const cbm_config_edit_target_t *target, const char *name) {
+    (void)target;
+    (void)name;
+    errno = EINVAL;
+    return -1;
+}
+
+#endif /* _WIN32 */
+
+int cbm_config_edit_target_open(const char *path, cbm_config_edit_target_t *target) {
+    if (!target) {
+        return CBM_CONFIG_EDIT_PATH_REFUSED;
+    }
+    int status = edit_path_classify(path, target, NULL, 0U);
+    target->status = status;
+    return status;
+}
+
+int cbm_config_edit_path_refusal(const char *path, char *out, size_t out_size) {
+    if (!out || out_size == 0U) {
+        return 0;
+    }
+    cbm_config_edit_target_t target;
+    (void)edit_path_classify(path, &target, out, out_size);
+    cbm_config_edit_target_close(&target);
+    return out[0] != '\0' ? 1 : 0;
+}
diff --git a/src/cli/config_edit_path.h b/src/cli/config_edit_path.h
new file mode 100644
index 000000000..abe3d0e4c
--- /dev/null
+++ b/src/cli/config_edit_path.h
@@ -0,0 +1,109 @@
+/*
+ * config_edit_path.h — the path a configuration editor may operate on when
+ * the path it was given is a symlink.
+ *
+ * Every config editor (JSON-like, TOML, YAML, text) opens its file with
+ * O_NOFOLLOW and refuses symlinks: a link planted at ~/.cursor/mcp.json could
+ * otherwise point a privileged writer at any file its planter can name. Users,
+ * however, keep exactly those files as symlinks into a dotfiles checkout, and
+ * a blanket refusal turned `uninstall` into data loss (#1954).
+ *
+ * Decision C (2026-09-07): a symlink the INVOKING user owns, resolving to a
+ * regular file the same user owns, is followed — but only as an explicit
+ * OPT-IN of the agent-configuration writers, scoped to configuration roots
+ * (HOME / XDG dirs) they register with cbm_config_edit_path_follow_add_root().
+ * With no root registered the editors behave exactly as before; a path whose
+ * link lives outside every registered root is never followed, so repository
+ * paths stay refused whatever the caller.
+ *
+ * Race-safe sequence for a followed link (POSIX):
+ *   lstat(link) → link owner == invoking uid (a root process follows only
+ *   root-owned links) → realpath → open the target's PARENT DIRECTORY as a
+ *   dirfd (O_DIRECTORY|O_NOFOLLOW; owned by the invoking user or root, not
+ *   writable by others unless sticky) → openat(dirfd, base, O_NOFOLLOW) →
+ *   fstat: regular file, owned by the invoking user, link count 1, and the
+ *   same (st_dev, st_ino) as stat(realpath).
+ * Everything else is refused with an observable reason
+ * (cbm_config_edit_path_refusal): another owner, a root process over a
+ * non-root link, a dangling link, a link to a directory or special file, a
+ * hard-linked or swapped target, a foreign or world-writable parent. The
+ * editor then reads through the validated descriptor, stages its temp file
+ * with openat(dirfd, …, O_CREAT|O_EXCL) and commits with renameat on the same
+ * dirfd, so the link itself is never replaced. Windows never follows reparse
+ * points here: the editors keep FILE_FLAG_OPEN_REPARSE_POINT and the helper
+ * hands the path back unchanged.
+ *
+ * The check runs at every open and before every commit, never cached: a link
+ * swapped mid-edit resolves to a different identity, which also fails the
+ * editors' own pre-publish snapshot comparison on the resolved path.
+ */
+#ifndef CBM_CONFIG_EDIT_PATH_H
+#define CBM_CONFIG_EDIT_PATH_H
+
+#include <stddef.h>
+
+enum {
+    /* Callers pass a buffer of at least this size (cbm_canonical_path's floor). */
+    CBM_CONFIG_EDIT_PATH_MAX = 4096,
+    CBM_CONFIG_EDIT_NAME_MAX = 256,
+};
+
+/* Pending user decision (#1954): must the resolved TARGET also stay under a
+ * registered root (1), or may it live anywhere the invoking user owns, such
+ * as a dotfiles checkout on an external volume (0, the default)? One switch. */
+#ifndef CBM_CONFIG_EDIT_TARGET_UNDER_ROOT
+#define CBM_CONFIG_EDIT_TARGET_UNDER_ROOT 0
+#endif
+
+typedef enum {
+    CBM_CONFIG_EDIT_PATH_REFUSED = -1, /* a link that must not be followed */
+    CBM_CONFIG_EDIT_PATH_DIRECT = 0,   /* not a link (or absent): path is used as given */
+    CBM_CONFIG_EDIT_PATH_FOLLOWED = 1, /* user-owned link inside a root: the target is used */
+} cbm_config_edit_path_status_t;
+
+typedef struct {
+    int status; /* cbm_config_edit_path_status_t */
+    int dirfd;  /* FOLLOWED: the target's parent directory, pinned; else -1 */
+    int fd;     /* FOLLOWED: the validated target, O_RDONLY|O_NOFOLLOW; else -1 */
+    char base[CBM_CONFIG_EDIT_NAME_MAX]; /* FOLLOWED: the target's name inside dirfd */
+    char path[CBM_CONFIG_EDIT_PATH_MAX]; /* the path the editor operates on */
+} cbm_config_edit_target_t;
+
+/* Opt-in scope (per thread): links under these canonical roots may be
+ * followed. Up to four roots; returns 0 when registered. Clear when the
+ * agent-configuration work is done. */
+int cbm_config_edit_path_follow_add_root(const char *root);
+void cbm_config_edit_path_follow_clear(void);
+
+/* Classifies path and, for a followed link, pins its parent directory and
+ * validates the target. Returns the status; on REFUSED the target holds no
+ * descriptors and an empty path, and the editor fails closed as before.
+ * Always pair with cbm_config_edit_target_close(). */
+int cbm_config_edit_target_open(const char *path, cbm_config_edit_target_t *target);
+void cbm_config_edit_target_close(cbm_config_edit_target_t *target);
+
+/* FOLLOWED targets only (return -1 with errno = EINVAL otherwise):
+ * create a temp file `name` beside the target (openat O_CREAT|O_EXCL|
+ * O_NOFOLLOW; EEXIST when the name is taken), publish it over the target with
+ * renameat on the pinned directory (which is then fsync'ed), or discard it. */
+int cbm_config_edit_target_create_temp(const cbm_config_edit_target_t *target, const char *name,
+                                       unsigned mode);
+int cbm_config_edit_target_commit(const cbm_config_edit_target_t *target, const char *name);
+int cbm_config_edit_target_unlink(const cbm_config_edit_target_t *target, const char *name);
+
+/* Observed-fact reason a symlink at path is refused, for diagnostics
+ * ("symlink owned by uid 0, not the invoking user (uid 501)", "dangling
+ * symlink", …). Writes "" and returns 0 when path is not a refused link, 1
+ * when a reason was written. Never reports errno — it may be stale (#1537). */
+int cbm_config_edit_path_refusal(const char *path, char *out, size_t out_size);
+
+#ifdef CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API
+/* Test seams (POSIX; no-ops on Windows). A test cannot create a link owned by
+ * another user without root, so the foreign-owner and root-run refusals move
+ * the observer instead of the file; the identity skew makes the validated
+ * descriptor disagree with stat(realpath), the swapped-target refusal. */
+void cbm_config_edit_path_set_invoking_uid_for_test(unsigned uid, int set);
+void cbm_config_edit_path_set_identity_skew_for_test(int set);
+#endif
+
+#endif /* CBM_CONFIG_EDIT_PATH_H */
diff --git a/src/cli/config_json_like.c b/src/cli/config_json_like.c
index 21ed11309..afd786161 100644
--- a/src/cli/config_json_like.c
+++ b/src/cli/config_json_like.c
@@ -8,6 +8,7 @@
  */
 #include "cli/config_json_like.h"
 
+#include "cli/config_edit_path.h"
 #include "foundation/compat.h"
 #include "foundation/compat_fs.h"
 
@@ -1223,8 +1224,19 @@ static int jl_make_insertion(const char *text, size_t length, size_t object_star
         return 0;
     }
 
-    if (object->close_pos == gap_start ||
-        !jl_is_space((unsigned char)text[object->close_pos - 1U])) {
+    /* Zero-width insertion right at close_pos: whatever byte already sits at
+     * close_pos - 1 is untouched and stays in the output. When the original
+     * had a real gap there (close_pos != gap_start, e.g. "[ \"a\" ]"), that
+     * preserved byte already supplies a separator on the leading side, so
+     * mirroring it on the trailing side (space before the bracket) matches
+     * the array's own loose style. The fully tight case ("[\"a\"]", nothing
+     * at all between the last value and the bracket) has no such byte to
+     * lean on: manufacture ONE space so `,new` reads `, new` — the
+     * comma-spacing convention every other insertion path uses — and add
+     * nothing after, so `new]` stays `new]` rather than gaining a trailing
+     * space the original never had (#1826 byte-for-byte round-trip). */
+    bool tight = object->close_pos == gap_start;
+    if (tight || !jl_is_space((unsigned char)text[object->close_pos - 1U])) {
         if (jl_buffer_char(insertion, ' ') != 0) {
             return -1;
         }
@@ -1235,7 +1247,7 @@ static int jl_make_insertion(const char *text, size_t length, size_t object_star
     if (object->trailing_comma && jl_buffer_char(insertion, ',') != 0) {
         return -1;
     }
-    return jl_buffer_char(insertion, ' ');
+    return tight ? 0 : jl_buffer_char(insertion, ' ');
 }
 
 static int jl_apply_edits(const char *source, size_t source_length, jl_edit_t *edits,
@@ -1429,11 +1441,24 @@ static int jl_read_file(const char *path, char **content_out, size_t *length_out
 #ifdef O_CLOEXEC
     flags |= O_CLOEXEC;
 #endif
-    int descriptor = open(path, flags);
+    /* A symlink the invoking user owns, inside an opted-in configuration
+     * root, is read through the descriptor the helper validated on the
+     * target's pinned parent directory (#1954); everything else is opened by
+     * name with O_NOFOLLOW exactly as before. */
+    cbm_config_edit_target_t target;
+    if (cbm_config_edit_target_open(path, &target) < 0) {
+        return -1;
+    }
+    int descriptor = target.fd;
+    target.fd = -1;
+    if (target.status != CBM_CONFIG_EDIT_PATH_FOLLOWED) {
+        descriptor = open(target.path, flags);
+    }
+    cbm_config_edit_target_close(&target);
     if (descriptor < 0) {
         if (errno == ENOENT) {
             struct stat path_state;
-            if (lstat(path, &path_state) == 0 || errno != ENOENT) {
+            if (lstat(target.path, &path_state) == 0 || errno != ENOENT) {
                 return -1;
             }
             *missing_out = true;
@@ -1598,10 +1623,31 @@ static int jl_replace_atomic(const char *temp_path, const char *path, bool desti
 #endif
 }
 
-static int jl_write_atomic(const char *path, const char *content, size_t length,
-                           const char *expected_content, size_t expected_length,
-                           const jl_file_snapshot_t *expected_snapshot) {
-    if (jl_ensure_parent(path) != 0) {
+static const char *jl_temp_name(const char *temp_path) {
+    const char *slash = strrchr(temp_path, '/');
+    return slash ? slash + 1 : temp_path;
+}
+
+/* Drop a staged temp file: through the pinned parent for a followed link,
+ * by name otherwise. */
+static void jl_discard_temp(const cbm_config_edit_target_t *target, const char *temp_path) {
+    if (target->status == CBM_CONFIG_EDIT_PATH_FOLLOWED) {
+        (void)cbm_config_edit_target_unlink(target, jl_temp_name(temp_path));
+    } else {
+        (void)cbm_unlink(temp_path);
+    }
+}
+
+/* For a followed link (#1954) the temp file is created with openat() beside
+ * the target and published with renameat() on the pinned parent, so the link
+ * itself is never replaced; every pre-publish comparison runs against the
+ * resolved path. A direct path keeps the by-name sequence unchanged. */
+static int jl_write_atomic_at(const cbm_config_edit_target_t *target, const char *content,
+                              size_t length, const char *expected_content, size_t expected_length,
+                              const jl_file_snapshot_t *expected_snapshot) {
+    const char *path = target->path;
+    bool followed = target->status == CBM_CONFIG_EDIT_PATH_FOLLOWED;
+    if (!followed && jl_ensure_parent(path) != 0) {
         return -1;
     }
     size_t path_length = strlen(path);
@@ -1636,13 +1682,15 @@ static int jl_write_atomic(const char *path, const char *content, size_t length,
 #ifdef O_CLOEXEC
         flags |= O_CLOEXEC;
 #endif
-        int descriptor = open(temp_path, flags, 0600);
+        int descriptor =
+            followed ? cbm_config_edit_target_create_temp(target, jl_temp_name(temp_path), 0600U)
+                     : open(temp_path, flags, 0600);
         if (descriptor >= 0) {
             file = fdopen(descriptor, "wb");
             if (!file) {
                 int saved_error = errno;
                 close(descriptor);
-                (void)cbm_unlink(temp_path);
+                jl_discard_temp(target, temp_path);
                 errno = saved_error;
             }
         }
@@ -1685,7 +1733,7 @@ static int jl_write_atomic(const char *path, const char *content, size_t length,
         failed = true;
     }
     if (failed) {
-        cbm_unlink(temp_path);
+        jl_discard_temp(target, temp_path);
         free(temp_path);
         return -1;
     }
@@ -1697,7 +1745,7 @@ static int jl_write_atomic(const char *path, const char *content, size_t length,
         temp_missing || temp_length != length ||
         (length != 0U && memcmp(temp_content, content, length) != 0)) {
         free(temp_content);
-        cbm_unlink(temp_path);
+        jl_discard_temp(target, temp_path);
         free(temp_path);
         return -1;
     }
@@ -1708,7 +1756,7 @@ static int jl_write_atomic(const char *path, const char *content, size_t length,
     }
 #endif
     if (jl_snapshot_matches_path(path, expected_content, expected_length, expected_snapshot) != 0) {
-        cbm_unlink(temp_path);
+        jl_discard_temp(target, temp_path);
         free(temp_path);
         return -1;
     }
@@ -1719,8 +1767,9 @@ static int jl_write_atomic(const char *path, const char *content, size_t length,
 #endif
     if (jl_snapshot_matches_path(path, expected_content, expected_length, expected_snapshot) != 0 ||
         jl_snapshot_matches_path(temp_path, content, length, &temp_snapshot) != 0 ||
-        jl_replace_atomic(temp_path, path, expected_snapshot->exists) != 0) {
-        cbm_unlink(temp_path);
+        (followed ? cbm_config_edit_target_commit(target, jl_temp_name(temp_path))
+                  : jl_replace_atomic(temp_path, path, expected_snapshot->exists)) != 0) {
+        jl_discard_temp(target, temp_path);
         free(temp_path);
         return -1;
     }
@@ -1728,6 +1777,19 @@ static int jl_write_atomic(const char *path, const char *content, size_t length,
     return 0;
 }
 
+static int jl_write_atomic(const char *requested_path, const char *content, size_t length,
+                           const char *expected_content, size_t expected_length,
+                           const jl_file_snapshot_t *expected_snapshot) {
+    cbm_config_edit_target_t target;
+    if (cbm_config_edit_target_open(requested_path, &target) < 0) {
+        return -1;
+    }
+    int result = jl_write_atomic_at(&target, content, length, expected_content, expected_length,
+                                    expected_snapshot);
+    cbm_config_edit_target_close(&target);
+    return result;
+}
+
 static int jl_decode_utf8(const unsigned char *text, size_t remaining, uint32_t *codepoint,
                           size_t *byte_count) {
     if (remaining == 0U) {
@@ -2411,6 +2473,13 @@ int cbm_json_like_remove_entry_if_unchanged(const char *file_path, const char *c
                            expected_length);
 }
 
+/* True when [start, end) is the bare 4-byte literal token null (never a
+ * quoted "null" string, which is 6 bytes with the quotes) — the documented
+ * OpenHands "no list yet" shape for mcp_server_refs (#1826). */
+static bool jl_is_null_literal(const char *text, size_t start, size_t end) {
+    return end - start == 4U && memcmp(text + start, "null", 4U) == 0;
+}
+
 int cbm_json_like_add_unique_string_at_path(const char *file_path, const char *const *object_path,
                                             size_t path_len, const char *array_key,
                                             const char *string_value) {
@@ -2502,6 +2571,24 @@ int cbm_json_like_add_unique_string_at_path(const char *file_path, const char *c
         result = jl_insert_member(source, source_length, object_start, &object, object_path,
                                   path_len, SIZE_MAX, array_key, array_json.data, array_json.length,
                                   &updated, &updated_length);
+    } else if (jl_is_null_literal(source, object.match.value_start, object.match.value_end)) {
+        /* OpenHands profiles ship `"mcp_server_refs": null` as the documented
+         * "no list yet" shape (#1826). Splice the built one-element array over
+         * the bare null token in place, preserving every other byte (trailing
+         * comments included) the way the object-member and array-element
+         * edits below already do for their own value spans. */
+        size_t head = object.match.value_start;
+        size_t tail = object.match.value_end;
+        updated_length = head + array_json.length + (source_length - tail);
+        updated = (char *)malloc(updated_length + 1U);
+        if (!updated) {
+            result = -1;
+        } else {
+            memcpy(updated, source, head);
+            memcpy(updated + head, array_json.data, array_json.length);
+            memcpy(updated + head + array_json.length, source + tail, source_length - tail);
+            updated[updated_length] = '\0';
+        }
     } else if (source[object.match.value_start] != '[') {
         result = -1;
     } else {
@@ -2764,6 +2851,24 @@ static int jl_decode_field_string(const char *text, size_t start, size_t end,
         }
         return jl_decode_string_value(text, start, end, value_out) == 0 ? 0 : 1;
     }
+    if (shape == CBM_JSON_LIKE_VALUE_LITERAL) {
+        /* The value's token boundaries already exclude surrounding trivia
+         * (jl_parse_value advances pos past exactly the token). Copy the raw
+         * bytes verbatim so a quoted "true" never equals the bare literal
+         * true, and the caller's expected_string comparison decides match. */
+        if (start >= end) {
+            return 1;
+        }
+        size_t length = end - start;
+        char *copy = (char *)malloc(length + 1U);
+        if (!copy) {
+            return 1;
+        }
+        memcpy(copy, text + start, length);
+        copy[length] = '\0';
+        *value_out = copy;
+        return 0;
+    }
     if (shape != CBM_JSON_LIKE_VALUE_SINGLE_STRING_ARRAY || start >= end || text[start] != '[') {
         return 1;
     }
@@ -2832,11 +2937,13 @@ int cbm_json_like_match_object_entry(const char *document, size_t document_lengt
     size_t capture_count = 0U;
     for (size_t i = 0U; i < field_count; ++i) {
         if (!fields[i].key || fields[i].key[0] == '\0' ||
-            fields[i].shape > CBM_JSON_LIKE_VALUE_SINGLE_STRING_ARRAY ||
+            fields[i].shape > CBM_JSON_LIKE_VALUE_LITERAL ||
             (fields[i].flags &
              ~(CBM_JSON_LIKE_FIELD_REQUIRED | CBM_JSON_LIKE_FIELD_CAPTURE_STRING)) != 0U ||
             ((fields[i].flags & CBM_JSON_LIKE_FIELD_CAPTURE_STRING) != 0U &&
-             fields[i].shape == CBM_JSON_LIKE_VALUE_EMPTY_ARRAY)) {
+             (fields[i].shape == CBM_JSON_LIKE_VALUE_EMPTY_ARRAY ||
+              fields[i].shape == CBM_JSON_LIKE_VALUE_LITERAL)) ||
+            (fields[i].shape == CBM_JSON_LIKE_VALUE_LITERAL && !fields[i].expected_string)) {
             return -1;
         }
         capture_count += (fields[i].flags & CBM_JSON_LIKE_FIELD_CAPTURE_STRING) != 0U ? 1U : 0U;
diff --git a/src/cli/config_json_like.h b/src/cli/config_json_like.h
index 23a8687e5..57cbfbfbf 100644
--- a/src/cli/config_json_like.h
+++ b/src/cli/config_json_like.h
@@ -47,6 +47,11 @@ typedef enum {
     CBM_JSON_LIKE_VALUE_STRING,
     CBM_JSON_LIKE_VALUE_EMPTY_ARRAY,
     CBM_JSON_LIKE_VALUE_SINGLE_STRING_ARRAY,
+    /* An exact bare token (true/false/null/a number) matched byte-for-byte
+     * against expected_string. Requires expected_string and may not be
+     * combined with CBM_JSON_LIKE_FIELD_CAPTURE_STRING — a fixed token has
+     * nothing meaningful to capture for the caller. */
+    CBM_JSON_LIKE_VALUE_LITERAL,
 } cbm_json_like_value_shape_t;
 
 enum {
diff --git a/src/cli/config_text_edit.c b/src/cli/config_text_edit.c
index cee66bdfe..ad728f506 100644
--- a/src/cli/config_text_edit.c
+++ b/src/cli/config_text_edit.c
@@ -3,6 +3,7 @@
  */
 #include "cli/config_text_edit.h"
 
+#include "cli/config_edit_path.h"
 #include "foundation/compat.h"
 #include "foundation/compat_fs.h"
 
@@ -442,13 +443,26 @@ static int text_read_file(const char *path, char **data_out, size_t *len_out,
 #ifdef O_CLOEXEC
     flags |= O_CLOEXEC;
 #endif
-    int descriptor = open(path, flags);
+    /* A symlink the invoking user owns, inside an opted-in configuration
+     * root, is read through the descriptor the helper validated on the
+     * target's pinned parent directory (#1954); everything else is opened by
+     * name with O_NOFOLLOW exactly as before. */
+    cbm_config_edit_target_t target;
+    if (cbm_config_edit_target_open(path, &target) < 0) {
+        return TEXT_ERROR;
+    }
+    int descriptor = target.fd;
+    target.fd = -1;
+    if (target.status != CBM_CONFIG_EDIT_PATH_FOLLOWED) {
+        descriptor = open(target.path, flags);
+    }
+    cbm_config_edit_target_close(&target);
     if (descriptor < 0) {
         if (errno != ENOENT) {
             return TEXT_ERROR;
         }
         struct stat path_state;
-        if (lstat(path, &path_state) == 0 || errno != ENOENT) {
+        if (lstat(target.path, &path_state) == 0 || errno != ENOENT) {
             return TEXT_ERROR;
         }
         char *empty = (char *)calloc(1U, 1U);
@@ -589,14 +603,35 @@ static int text_replace_file(const char *temp_path, const char *path, int destin
 #endif
 }
 
-static int text_write_atomic_mode(const char *path, const char *new_data, size_t new_len,
-                                  const char *old_data, size_t old_len,
-                                  const text_file_snapshot_t *snapshot, int override_mode,
-                                  unsigned int requested_mode) {
+static const char *text_temp_name(const char *temp_path) {
+    const char *slash = strrchr(temp_path, '/');
+    return slash ? slash + 1 : temp_path;
+}
+
+/* Drop a staged temp file: through the pinned parent for a followed link,
+ * by name otherwise. */
+static void text_discard_temp(const cbm_config_edit_target_t *target, const char *temp_path) {
+    if (target->status == CBM_CONFIG_EDIT_PATH_FOLLOWED) {
+        (void)cbm_config_edit_target_unlink(target, text_temp_name(temp_path));
+    } else {
+        (void)cbm_unlink(temp_path);
+    }
+}
+
+/* For a followed link (#1954) the temp file is created with openat() beside
+ * the target and published with renameat() on the pinned parent, so the link
+ * itself is never replaced; every pre-publish comparison runs against the
+ * resolved path. A direct path keeps the by-name sequence unchanged. */
+static int text_write_atomic_mode_at(const cbm_config_edit_target_t *target, const char *new_data,
+                                     size_t new_len, const char *old_data, size_t old_len,
+                                     const text_file_snapshot_t *snapshot, int override_mode,
+                                     unsigned int requested_mode) {
     if (new_len > TEXT_MAX_BYTES || old_len > TEXT_MAX_BYTES ||
         !text_requested_mode_valid(override_mode, requested_mode)) {
         return TEXT_ERROR;
     }
+    const char *path = target->path;
+    bool followed = target->status == CBM_CONFIG_EDIT_PATH_FOLLOWED;
     int content_same =
         new_len == old_len && (new_len == 0U || memcmp(new_data, old_data, new_len) == 0);
 #ifndef _WIN32
@@ -643,13 +678,15 @@ static int text_write_atomic_mode(const char *path, const char *new_data, size_t
 #ifdef O_CLOEXEC
         flags |= O_CLOEXEC;
 #endif
-        int descriptor = open(temp_path, flags, 0600);
+        int descriptor =
+            followed ? cbm_config_edit_target_create_temp(target, text_temp_name(temp_path), 0600U)
+                     : open(temp_path, flags, 0600);
         if (descriptor >= 0) {
             file = text_fdopen(descriptor, "wb");
             if (!file) {
                 int saved_error = errno;
                 text_close(descriptor);
-                (void)cbm_unlink(temp_path);
+                text_discard_temp(target, temp_path);
                 errno = saved_error;
             }
         }
@@ -702,7 +739,7 @@ static int text_write_atomic_mode(const char *path, const char *new_data, size_t
         failed = 1;
     }
     if (failed) {
-        (void)cbm_unlink(temp_path);
+        text_discard_temp(target, temp_path);
         free(temp_path);
         return TEXT_ERROR;
     }
@@ -718,7 +755,7 @@ static int text_write_atomic_mode(const char *path, const char *new_data, size_t
         !text_snapshot_publication_equal(&trusted_temp_snapshot, &temp_snapshot) ||
         temp_len != new_len || (new_len != 0U && memcmp(temp_data, new_data, new_len) != 0)) {
         free(temp_data);
-        (void)cbm_unlink(temp_path);
+        text_discard_temp(target, temp_path);
         free(temp_path);
         return TEXT_ERROR;
     }
@@ -730,7 +767,7 @@ static int text_write_atomic_mode(const char *path, const char *new_data, size_t
     }
 #endif
     if (text_snapshot_matches_path(path, old_data, old_len, snapshot) != TEXT_OK) {
-        (void)cbm_unlink(temp_path);
+        text_discard_temp(target, temp_path);
         free(temp_path);
         return TEXT_ERROR;
     }
@@ -741,8 +778,9 @@ static int text_write_atomic_mode(const char *path, const char *new_data, size_t
 #endif
     if (text_snapshot_matches_path(path, old_data, old_len, snapshot) != TEXT_OK ||
         text_snapshot_matches_path(temp_path, new_data, new_len, &temp_snapshot) != TEXT_OK ||
-        text_replace_file(temp_path, path, snapshot->exists) != TEXT_OK) {
-        (void)cbm_unlink(temp_path);
+        (followed ? cbm_config_edit_target_commit(target, text_temp_name(temp_path))
+                  : text_replace_file(temp_path, path, snapshot->exists)) != TEXT_OK) {
+        text_discard_temp(target, temp_path);
         free(temp_path);
         return TEXT_ERROR;
     }
@@ -750,6 +788,20 @@ static int text_write_atomic_mode(const char *path, const char *new_data, size_t
     return TEXT_OK;
 }
 
+static int text_write_atomic_mode(const char *requested_path, const char *new_data, size_t new_len,
+                                  const char *old_data, size_t old_len,
+                                  const text_file_snapshot_t *snapshot, int override_mode,
+                                  unsigned int requested_mode) {
+    cbm_config_edit_target_t target;
+    if (cbm_config_edit_target_open(requested_path, &target) < 0) {
+        return TEXT_ERROR;
+    }
+    int result = text_write_atomic_mode_at(&target, new_data, new_len, old_data, old_len, snapshot,
+                                           override_mode, requested_mode);
+    cbm_config_edit_target_close(&target);
+    return result;
+}
+
 static int text_write_atomic(const char *path, const char *new_data, size_t new_len,
                              const char *old_data, size_t old_len,
                              const text_file_snapshot_t *snapshot) {
diff --git a/src/cli/config_toml_edit.c b/src/cli/config_toml_edit.c
index ef73c66fc..745bdda0d 100644
--- a/src/cli/config_toml_edit.c
+++ b/src/cli/config_toml_edit.c
@@ -3,6 +3,7 @@
  */
 #include "cli/config_toml_edit.h"
 
+#include "cli/config_edit_path.h"
 #include "foundation/compat.h"
 #include "foundation/compat_fs.h"
 
@@ -465,13 +466,26 @@ static int toml_read_file(const char *path, char **out_data, size_t *out_len,
 #ifdef O_CLOEXEC
     flags |= O_CLOEXEC;
 #endif
-    int fd = open(path, flags);
+    /* A symlink the invoking user owns, inside an opted-in configuration
+     * root, is read through the descriptor the helper validated on the
+     * target's pinned parent directory (#1954); everything else is opened by
+     * name with O_NOFOLLOW exactly as before. */
+    cbm_config_edit_target_t target;
+    if (cbm_config_edit_target_open(path, &target) < 0) {
+        return TOML_EDIT_ERR;
+    }
+    int fd = target.fd;
+    target.fd = -1;
+    if (target.status != CBM_CONFIG_EDIT_PATH_FOLLOWED) {
+        fd = open(target.path, flags);
+    }
+    cbm_config_edit_target_close(&target);
     if (fd < 0) {
         if (errno != ENOENT) {
             return TOML_EDIT_ERR;
         }
         struct stat path_state;
-        if (lstat(path, &path_state) == 0 || errno != ENOENT) {
+        if (lstat(target.path, &path_state) == 0 || errno != ENOENT) {
             return TOML_EDIT_ERR;
         }
         char *empty = (char *)malloc(1U);
@@ -612,28 +626,65 @@ static int toml_replace_atomic(const char *temp_path, const char *path, int exis
 #endif
 }
 
-static int toml_write_atomic(const char *path, const char *old_data, size_t old_len,
-                             const char *new_data, size_t new_len,
-                             const toml_file_snapshot_t *snapshot) {
+static const char *toml_temp_name(const char *temp_path) {
+    const char *slash = strrchr(temp_path, '/');
+    return slash ? slash + 1 : temp_path;
+}
+
+/* Drop a staged temp file: through the pinned parent for a followed link,
+ * by name otherwise. */
+static void toml_discard_temp(const cbm_config_edit_target_t *target, const char *temp_path) {
+    if (target->status == CBM_CONFIG_EDIT_PATH_FOLLOWED) {
+        (void)cbm_config_edit_target_unlink(target, toml_temp_name(temp_path));
+    } else {
+        (void)cbm_unlink(temp_path);
+    }
+}
+
+/* For a followed link (#1954) the temp file is created with openat() beside
+ * the target and published with renameat() on the pinned parent, so the link
+ * itself is never replaced; every pre-publish comparison runs against the
+ * resolved path. A direct path keeps the mkstemp + rename sequence unchanged. */
+static int toml_write_atomic_at(const cbm_config_edit_target_t *target, const char *old_data,
+                                size_t old_len, const char *new_data, size_t new_len,
+                                const toml_file_snapshot_t *snapshot) {
     if (old_len > TOML_EDIT_MAX_BYTES || new_len > TOML_EDIT_MAX_BYTES) {
         return TOML_EDIT_ERR;
     }
+    const char *path = target->path;
+    bool followed = target->status == CBM_CONFIG_EDIT_PATH_FOLLOWED;
     if (old_len == new_len && (old_len == 0 || memcmp(old_data, new_data, old_len) == 0)) {
         return TOML_EDIT_OK;
     }
     size_t path_len = strlen(path);
     static const char suffix[] = ".XXXXXX";
-    if (path_len > SIZE_MAX - sizeof(suffix)) {
+    enum { TOML_TEMP_SUFFIX_SPACE = 48, TOML_TEMP_ATTEMPTS = 64 };
+    if (path_len > SIZE_MAX - TOML_TEMP_SUFFIX_SPACE) {
         return TOML_EDIT_ERR;
     }
-    char *temp_path = (char *)malloc(path_len + sizeof(suffix));
+    size_t temp_capacity = path_len + TOML_TEMP_SUFFIX_SPACE;
+    char *temp_path = (char *)malloc(temp_capacity);
     if (!temp_path) {
         return TOML_EDIT_ERR;
     }
-    memcpy(temp_path, path, path_len);
-    memcpy(temp_path + path_len, suffix, sizeof(suffix));
 
-    int fd = cbm_mkstemp(temp_path);
+    int fd = -1;
+    if (followed) {
+        for (unsigned attempt = 0U; attempt < TOML_TEMP_ATTEMPTS && fd < 0; attempt++) {
+            int written = snprintf(temp_path, temp_capacity, "%s.cbm-toml-%u.tmp", path, attempt);
+            if (written < 0 || (size_t)written >= temp_capacity) {
+                break;
+            }
+            fd = cbm_config_edit_target_create_temp(target, toml_temp_name(temp_path), 0600U);
+            if (fd < 0 && errno != EEXIST) {
+                break;
+            }
+        }
+    } else {
+        memcpy(temp_path, path, path_len);
+        memcpy(temp_path + path_len, suffix, sizeof(suffix));
+        fd = cbm_mkstemp(temp_path);
+    }
     if (fd < 0) {
         free(temp_path);
         return TOML_EDIT_ERR;
@@ -641,7 +692,7 @@ static int toml_write_atomic(const char *path, const char *old_data, size_t old_
     FILE *file = toml_fdopen(fd, "wb");
     if (!file) {
         (void)toml_close(fd);
-        (void)cbm_unlink(temp_path);
+        toml_discard_temp(target, temp_path);
         free(temp_path);
         return TOML_EDIT_ERR;
     }
@@ -667,7 +718,7 @@ static int toml_write_atomic(const char *path, const char *old_data, size_t old_
         failed = 1;
     }
     if (failed) {
-        (void)cbm_unlink(temp_path);
+        toml_discard_temp(target, temp_path);
         free(temp_path);
         return TOML_EDIT_ERR;
     }
@@ -678,7 +729,7 @@ static int toml_write_atomic(const char *path, const char *old_data, size_t old_
         !temp_snapshot.exists || temp_len != new_len ||
         (new_len != 0U && memcmp(temp_data, new_data, new_len) != 0)) {
         free(temp_data);
-        (void)cbm_unlink(temp_path);
+        toml_discard_temp(target, temp_path);
         free(temp_path);
         return TOML_EDIT_ERR;
     }
@@ -689,7 +740,7 @@ static int toml_write_atomic(const char *path, const char *old_data, size_t old_
     }
 #endif
     if (toml_snapshot_matches_path(path, old_data, old_len, snapshot) != TOML_EDIT_OK) {
-        (void)cbm_unlink(temp_path);
+        toml_discard_temp(target, temp_path);
         free(temp_path);
         return TOML_EDIT_ERR;
     }
@@ -700,8 +751,9 @@ static int toml_write_atomic(const char *path, const char *old_data, size_t old_
 #endif
     if (toml_snapshot_matches_path(path, old_data, old_len, snapshot) != TOML_EDIT_OK ||
         toml_snapshot_matches_path(temp_path, new_data, new_len, &temp_snapshot) != TOML_EDIT_OK ||
-        toml_replace_atomic(temp_path, path, snapshot->exists) != TOML_EDIT_OK) {
-        (void)cbm_unlink(temp_path);
+        (followed ? cbm_config_edit_target_commit(target, toml_temp_name(temp_path))
+                  : toml_replace_atomic(temp_path, path, snapshot->exists)) != TOML_EDIT_OK) {
+        toml_discard_temp(target, temp_path);
         free(temp_path);
         return TOML_EDIT_ERR;
     }
@@ -709,6 +761,18 @@ static int toml_write_atomic(const char *path, const char *old_data, size_t old_
     return TOML_EDIT_OK;
 }
 
+static int toml_write_atomic(const char *requested_path, const char *old_data, size_t old_len,
+                             const char *new_data, size_t new_len,
+                             const toml_file_snapshot_t *snapshot) {
+    cbm_config_edit_target_t target;
+    if (cbm_config_edit_target_open(requested_path, &target) < 0) {
+        return TOML_EDIT_ERR;
+    }
+    int result = toml_write_atomic_at(&target, old_data, old_len, new_data, new_len, snapshot);
+    cbm_config_edit_target_close(&target);
+    return result;
+}
+
 #ifdef CBM_TOML_EDIT_ENABLE_TEST_API
 void cbm_toml_set_precommit_hook_for_testing(cbm_toml_precommit_test_hook_t hook, void *context) {
     toml_precommit_test_hook = hook;
diff --git a/src/cli/config_yaml_edit.c b/src/cli/config_yaml_edit.c
index 788752d3a..38b3b4e33 100644
--- a/src/cli/config_yaml_edit.c
+++ b/src/cli/config_yaml_edit.c
@@ -7,6 +7,7 @@
  */
 #include "cli/config_yaml_edit.h"
 
+#include "cli/config_edit_path.h"
 #include "foundation/compat.h"
 #include "foundation/compat_fs.h"
 
@@ -694,13 +695,26 @@ static int yaml_read_file(const char *path, char **out_data, size_t *out_len,
 #ifdef O_CLOEXEC
     flags |= O_CLOEXEC;
 #endif
-    int descriptor = open(path, flags);
+    /* A symlink the invoking user owns, inside an opted-in configuration
+     * root, is read through the descriptor the helper validated on the
+     * target's pinned parent directory (#1954); everything else is opened by
+     * name with O_NOFOLLOW exactly as before. */
+    cbm_config_edit_target_t target;
+    if (cbm_config_edit_target_open(path, &target) < 0) {
+        return YAML_ERROR;
+    }
+    int descriptor = target.fd;
+    target.fd = -1;
+    if (target.status != CBM_CONFIG_EDIT_PATH_FOLLOWED) {
+        descriptor = open(target.path, flags);
+    }
+    cbm_config_edit_target_close(&target);
     if (descriptor < 0) {
         if (errno != ENOENT) {
             return YAML_ERROR;
         }
         struct stat path_state;
-        if (lstat(path, &path_state) == 0 || errno != ENOENT) {
+        if (lstat(target.path, &path_state) == 0 || errno != ENOENT) {
             return YAML_ERROR;
         }
         char *empty = (char *)calloc(YAML_UNIT, YAML_UNIT);
@@ -869,9 +883,30 @@ static int yaml_replace_file(const char *temp_path, const char *path, bool desti
 #endif
 }
 
-static int yaml_write_atomic(const char *path, const char *data, size_t len,
-                             const char *expected_data, size_t expected_len,
-                             const yaml_file_snapshot_t *expected_snapshot) {
+static const char *yaml_temp_name(const char *temp_path) {
+    const char *slash = strrchr(temp_path, '/');
+    return slash ? slash + 1 : temp_path;
+}
+
+/* Drop a staged temp file: through the pinned parent for a followed link,
+ * by name otherwise. */
+static void yaml_discard_temp(const cbm_config_edit_target_t *target, const char *temp_path) {
+    if (target->status == CBM_CONFIG_EDIT_PATH_FOLLOWED) {
+        (void)cbm_config_edit_target_unlink(target, yaml_temp_name(temp_path));
+    } else {
+        (void)cbm_unlink(temp_path);
+    }
+}
+
+/* For a followed link (#1954) the temp file is created with openat() beside
+ * the target and published with renameat() on the pinned parent, so the link
+ * itself is never replaced; every pre-publish comparison runs against the
+ * resolved path. A direct path keeps the by-name sequence unchanged. */
+static int yaml_write_atomic_at(const cbm_config_edit_target_t *target, const char *data,
+                                size_t len, const char *expected_data, size_t expected_len,
+                                const yaml_file_snapshot_t *expected_snapshot) {
+    const char *path = target->path;
+    bool followed = target->status == CBM_CONFIG_EDIT_PATH_FOLLOWED;
     size_t path_len = 0U;
     if (yaml_bounded_strlen(path, YAML_OUTPUT_MAX, &path_len) != 0 ||
         path_len > SIZE_MAX - YAML_TMP_SUFFIX_MAX - YAML_UNIT) {
@@ -901,12 +936,14 @@ static int yaml_write_atomic(const char *path, const char *data, size_t len,
 #ifdef O_CLOEXEC
         flags |= O_CLOEXEC;
 #endif
-        int descriptor = open(temp_path, flags, YAML_NEW_FILE_MODE);
+        int descriptor = followed ? cbm_config_edit_target_create_temp(
+                                        target, yaml_temp_name(temp_path), YAML_NEW_FILE_MODE)
+                                  : open(temp_path, flags, YAML_NEW_FILE_MODE);
         if (descriptor >= 0) {
             file = fdopen(descriptor, "wb");
             if (!file) {
                 (void)close(descriptor);
-                (void)cbm_unlink(temp_path);
+                yaml_discard_temp(target, temp_path);
                 free(temp_path);
                 return YAML_ERROR;
             }
@@ -947,7 +984,7 @@ static int yaml_write_atomic(const char *path, const char *data, size_t len,
         failed = true;
     }
     if (failed) {
-        (void)cbm_unlink(temp_path);
+        yaml_discard_temp(target, temp_path);
         free(temp_path);
         return YAML_ERROR;
     }
@@ -958,7 +995,7 @@ static int yaml_write_atomic(const char *path, const char *data, size_t len,
         !temp_snapshot.exists || temp_len != len ||
         (len != 0U && memcmp(temp_data, data, len) != 0)) {
         free(temp_data);
-        (void)cbm_unlink(temp_path);
+        yaml_discard_temp(target, temp_path);
         free(temp_path);
         return YAML_ERROR;
     }
@@ -970,7 +1007,7 @@ static int yaml_write_atomic(const char *path, const char *data, size_t len,
     }
 #endif
     if (yaml_snapshot_matches_path(path, expected_data, expected_len, expected_snapshot) != 0) {
-        (void)cbm_unlink(temp_path);
+        yaml_discard_temp(target, temp_path);
         free(temp_path);
         return YAML_ERROR;
     }
@@ -981,8 +1018,9 @@ static int yaml_write_atomic(const char *path, const char *data, size_t len,
 #endif
     if (yaml_snapshot_matches_path(path, expected_data, expected_len, expected_snapshot) != 0 ||
         yaml_snapshot_matches_path(temp_path, data, len, &temp_snapshot) != 0 ||
-        yaml_replace_file(temp_path, path, expected_snapshot->exists) != 0) {
-        (void)cbm_unlink(temp_path);
+        (followed ? cbm_config_edit_target_commit(target, yaml_temp_name(temp_path))
+                  : yaml_replace_file(temp_path, path, expected_snapshot->exists)) != 0) {
+        yaml_discard_temp(target, temp_path);
         free(temp_path);
         return YAML_ERROR;
     }
@@ -990,6 +1028,19 @@ static int yaml_write_atomic(const char *path, const char *data, size_t len,
     return 0;
 }
 
+static int yaml_write_atomic(const char *requested_path, const char *data, size_t len,
+                             const char *expected_data, size_t expected_len,
+                             const yaml_file_snapshot_t *expected_snapshot) {
+    cbm_config_edit_target_t target;
+    if (cbm_config_edit_target_open(requested_path, &target) < 0) {
+        return YAML_ERROR;
+    }
+    int result =
+        yaml_write_atomic_at(&target, data, len, expected_data, expected_len, expected_snapshot);
+    cbm_config_edit_target_close(&target);
+    return result;
+}
+
 #ifdef CBM_YAML_ENABLE_TEST_API
 void cbm_yaml_set_precommit_hook_for_testing(cbm_yaml_precommit_test_hook_t hook, void *context) {
     yaml_precommit_test_hook = hook;
diff --git a/src/cypher/cypher.c b/src/cypher/cypher.c
index 9dfe97c76..234f49087 100644
--- a/src/cypher/cypher.c
+++ b/src/cypher/cypher.c
@@ -1830,20 +1830,27 @@ tail:
         }
     }
 
-    /* Optional SKIP */
+    /* Optional SKIP. A non-numeric operand is a loud parse error: expect() has
+     * already filled p->error, and dropping the clause instead would leave
+     * r->skip at its "none" default while the query still reports success. */
     if (match(p, TOK_SKIP)) {
         const cbm_token_t *num = expect(p, TOK_NUMBER);
-        if (num) {
-            r->skip = (int)strtol(num->text, NULL, CBM_DECIMAL_BASE);
+        if (!num) {
+            free_return_clause(r);
+            return CBM_NOT_FOUND;
         }
+        r->skip = (int)strtol(num->text, NULL, CBM_DECIMAL_BASE);
     }
 
-    /* Optional LIMIT */
+    /* Optional LIMIT. Same rule: a dropped LIMIT is the failure mode #1334
+     * banned - the caller would silently receive the whole result set. */
     if (match(p, TOK_LIMIT)) {
         const cbm_token_t *num = expect(p, TOK_NUMBER);
-        if (num) {
-            r->limit = (int)strtol(num->text, NULL, CBM_DECIMAL_BASE);
+        if (!num) {
+            free_return_clause(r);
+            return CBM_NOT_FOUND;
         }
+        r->limit = (int)strtol(num->text, NULL, CBM_DECIMAL_BASE);
     }
 
     *out = r;
@@ -4450,11 +4457,33 @@ static void ret_agg_init_group(ret_agg_entry_t *entry, const char *key, int item
 }
 
 /* Accumulate a binding into RETURN aggregation */
+static bool binding_has_value(binding_t *b, const char *var, const char *prop) {
+    if (!var || strcmp(var, "*") == 0) {
+        return true;
+    }
+    char full[CBM_SZ_256];
+    if (prop) {
+        snprintf(full, sizeof(full), "%s.%s", var, prop);
+    } else {
+        snprintf(full, sizeof(full), "%s", var);
+    }
+    for (int i = 0; i < b->var_count; i++) {
+        if (strcmp(b->var_names[i], full) == 0) {
+            return true;
+        }
+    }
+    return binding_get_edge(b, var) != NULL || binding_get(b, var) != NULL;
+}
+
 static void ret_agg_accumulate(ret_agg_entry_t *entry, cbm_return_clause_t *ret, binding_t *b) {
     for (int ci = 0; ci < ret->count; ci++) {
         if (!is_aggregate_func(ret->items[ci].func)) {
             continue;
         }
+        if (strcmp(ret->items[ci].func, "COUNT") == 0 &&
+            !binding_has_value(b, ret->items[ci].variable, ret->items[ci].property)) {
+            continue;
+        }
         entry->counts[ci]++;
         const char *raw = binding_get_virtual(b, ret->items[ci].variable, ret->items[ci].property);
         double dv = strtod(raw, NULL);
@@ -4985,8 +5014,107 @@ static void execute_return_clause(cbm_query_t *q, cbm_return_clause_t *ret, bind
                         limit_is_engine_budget);
 }
 
+/* ── Planner: seed a single-hop pattern from its selective end ──────────────
+ *
+ * The executor scans pattern node 0 and expands from there. Written as
+ * `MATCH (a)-[:CALLS]->(b) WHERE b.name = '_printk'`, that scans every node
+ * in the store before the filter on `b` can discard any — on an 8.5 M node
+ * kernel graph the query hit the execution-time limit while the anchored
+ * spelling `MATCH (b:Function {name:'_printk'})<-[:CALLS]-(a)` answered in
+ * seconds (2026-09-16 probe). A reader should not have to know which end to
+ * write first: when the far node carries an equality on name/qualified_name,
+ * an inline property, or a label and the near node carries less, the pattern
+ * is walked from the far end with the relationship direction inverted. The
+ * result set is identical; only the enumeration order changes. Restricted to
+ * one single-relationship pattern with an explicit RETURN, and never to an
+ * OPTIONAL MATCH, whose anchor is part of its meaning. */
+static int cypher_cond_selectivity(const cbm_condition_t *c, const char *var) {
+    if (!c || !c->variable || !var || strcmp(c->variable, var) != 0 || c->negated) {
+        return 0;
+    }
+    if (!c->op || strcmp(c->op, "=") != 0 || !c->property) {
+        return 0;
+    }
+    return (strcmp(c->property, "name") == 0 || strcmp(c->property, "qualified_name") == 0) ? 3 : 2;
+}
+
+static int cypher_expr_selectivity(const cbm_expr_t *e, const char *var) {
+    if (!e) {
+        return 0;
+    }
+    if (e->type == EXPR_CONDITION) {
+        return cypher_cond_selectivity(&e->cond, var);
+    }
+    if (e->type == EXPR_AND) {
+        int l = cypher_expr_selectivity(e->left, var);
+        int r = cypher_expr_selectivity(e->right, var);
+        return l > r ? l : r;
+    }
+    return 0; /* OR / NOT / XOR: no single equality to seed from */
+}
+
+static int cypher_node_selectivity(const cbm_node_pattern_t *n, const cbm_where_clause_t *w) {
+    int s = 0;
+    for (int i = 0; i < n->prop_count; i++) {
+        const char *k = n->props[i].key;
+        int v = (k && (strcmp(k, "name") == 0 || strcmp(k, "qualified_name") == 0)) ? 3 : 2;
+        if (v > s) {
+            s = v;
+        }
+    }
+    if (w && n->variable) {
+        int v = 0;
+        if (w->root) {
+            v = cypher_expr_selectivity(w->root, n->variable);
+        } else if (!w->op || strcmp(w->op, "AND") == 0) {
+            for (int i = 0; i < w->count; i++) {
+                int c = cypher_cond_selectivity(&w->conditions[i], n->variable);
+                if (c > v) {
+                    v = c;
+                }
+            }
+        }
+        if (v > s) {
+            s = v;
+        }
+    }
+    if (s == 0 && n->label) {
+        s = 1;
+    }
+    return s;
+}
+
+static void cypher_plan_seed_from_selective_end(cbm_query_t *q) {
+    if (!q || q->pattern_count != 1 || !q->ret || (q->pattern_optional && q->pattern_optional[0])) {
+        return;
+    }
+    cbm_pattern_t *p = &q->patterns[0];
+    if (p->rel_count != 1 || p->node_count != 2) {
+        return;
+    }
+    if (cypher_node_selectivity(&p->nodes[1], q->where) <=
+        cypher_node_selectivity(&p->nodes[0], q->where)) {
+        return;
+    }
+    cbm_node_pattern_t tmp = p->nodes[0];
+    p->nodes[0] = p->nodes[1];
+    p->nodes[1] = tmp;
+    cbm_rel_pattern_t *r = &p->rels[0];
+    const char *inverted = NULL;
+    if (r->direction && strcmp(r->direction, "outbound") == 0) {
+        inverted = "inbound";
+    } else if (r->direction && strcmp(r->direction, "inbound") == 0) {
+        inverted = "outbound";
+    }
+    if (inverted) {
+        safe_str_free(&r->direction);
+        r->direction = heap_strdup(inverted);
+    }
+}
+
 static int execute_single(cbm_store_t *store, cbm_query_t *q, const char *project, int max_rows,
                           result_builder_t *rb) {
+    cypher_plan_seed_from_selective_end(q);
     cbm_pattern_t *pat0 = &q->patterns[0];
 
     /* Step 1: Scan initial nodes */
diff --git a/src/daemon/application.c b/src/daemon/application.c
index ca600b465..748b8bb75 100644
--- a/src/daemon/application.c
+++ b/src/daemon/application.c
@@ -208,7 +208,8 @@ static bool application_unique_recovery_file(char out[APPLICATION_PATH_CAP], con
 static bool application_update_reap(cbm_daemon_application_t *application, bool wait,
                                     uint32_t timeout_ms);
 static void *application_job_thread(void *opaque);
-static char *application_auto_index_args(const char *root_path);
+static char *application_auto_index_args(cbm_daemon_application_t *application,
+                                         const char *root_path);
 static cbm_daemon_application_job_t *application_job_subscribe_locked(
     cbm_daemon_application_t *application, const char *project_key, const char *root_path,
     const char *args_json, application_job_subscribe_status_t *status_out);
@@ -1455,7 +1456,7 @@ static void application_auto_index_retry_pending_locked(cbm_daemon_application_t
             application_refresh_watch_locked(session);
             continue;
         }
-        char *args = application_auto_index_args(root_path);
+        char *args = application_auto_index_args(application, root_path);
         if (!args) {
             continue;
         }
@@ -2005,7 +2006,27 @@ static bool application_update_reap(cbm_daemon_application_t *application, bool
     }
 }
 
-static char *application_auto_index_args(const char *root_path) {
+static bool application_index_args_add_policy(cbm_daemon_application_t *application,
+                                              yyjson_mut_doc *document, yyjson_mut_val *root) {
+    cbm_config_t *owned_config = NULL;
+    cbm_config_t *config = application ? application->config : NULL;
+    if (!config) {
+        owned_config = cbm_config_open(cbm_resolve_cache_dir());
+        config = owned_config;
+    }
+    cbm_index_resource_policy_t policy;
+    char error[CBM_SZ_256] = {0};
+    bool loaded = cbm_config_load_index_policy(config, &policy, error, sizeof(error));
+    cbm_config_close(owned_config);
+    if (!loaded) {
+        cbm_log_error("daemon.index.policy", "error", error);
+        return false;
+    }
+    return cbm_mcp_index_policy_add_to_args(document, root, &policy);
+}
+
+static char *application_auto_index_args(cbm_daemon_application_t *application,
+                                         const char *root_path) {
     yyjson_mut_doc *document = yyjson_mut_doc_new(NULL);
     yyjson_mut_val *root = document ? yyjson_mut_obj(document) : NULL;
     if (!document || !root) {
@@ -2013,7 +2034,8 @@ static char *application_auto_index_args(const char *root_path) {
         return NULL;
     }
     yyjson_mut_doc_set_root(document, root);
-    char *args = yyjson_mut_obj_add_strcpy(document, root, "repo_path", root_path)
+    char *args = yyjson_mut_obj_add_strcpy(document, root, "repo_path", root_path) &&
+                         application_index_args_add_policy(application, document, root)
                      ? yyjson_mut_write(document, 0, NULL)
                      : NULL;
     yyjson_mut_doc_free(document);
@@ -2060,7 +2082,7 @@ static void application_background_initialize_impl(cbm_daemon_application_sessio
                      files);
     }
     bool args_required = auto_index_candidate && within_auto_index_limit;
-    char *args = args_required ? application_auto_index_args(root_path) : NULL;
+    char *args = args_required ? application_auto_index_args(application, root_path) : NULL;
     application_jobs_reap_completed(application);
     cbm_mutex_lock(&application->mutex);
     if (application->stopping || application_request_cancelled_locked(session)) {
@@ -3458,7 +3480,8 @@ static int application_background_index(cbm_daemon_application_t *application,
         return -1;
     }
     yyjson_mut_doc_set_root(document, root);
-    bool encoded = yyjson_mut_obj_add_strcpy(document, root, "repo_path", canonical_root);
+    bool encoded = yyjson_mut_obj_add_strcpy(document, root, "repo_path", canonical_root) &&
+                   application_index_args_add_policy(application, document, root);
     char *default_project = cbm_project_name_from_path(canonical_root);
     bool custom_project =
         project_name[0] && (!default_project || strcmp(default_project, project_name) != 0);
diff --git a/src/daemon/bootstrap.c b/src/daemon/bootstrap.c
index 50f189036..0e4cbed61 100644
--- a/src/daemon/bootstrap.c
+++ b/src/daemon/bootstrap.c
@@ -6,13 +6,17 @@
 #include "daemon/ipc.h"
 #include "daemon/service.h"
 #include "foundation/compat.h"
+#include "foundation/compat_fs.h"
+#include "foundation/log.h"
 #include "foundation/platform.h"
 
+#include <errno.h>
 #include <limits.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <time.h>
 
 #ifdef _WIN32
 #ifndef WIN32_LEAN_AND_MEAN
@@ -38,6 +42,14 @@ extern char **environ;
 
 enum {
     BOOTSTRAP_RETRY_NS = 1000000,
+    /* #1828: how often a waiting client re-reads the start-failure log
+     * (the wait loop itself ticks every millisecond). */
+    BOOTSTRAP_START_FAILURE_CHECK_MS = 50,
+    /* A record this many seconds OLDER than the client's own spawn instant is
+     * still accepted: a sibling client's attempt that just failed is the same
+     * evidence, and second-granularity clocks need the slack anyway. */
+    BOOTSTRAP_START_FAILURE_SKEW_S = 2,
+    BOOTSTRAP_START_FAILURE_LOG_CAP = 65536,
     BOOTSTRAP_COORDINATION_CLEANUP_MS = 500,
     BOOTSTRAP_PATH_CAP = 4096,
 };
@@ -292,6 +304,270 @@ static _Noreturn void bootstrap_cleanup_fail_stop(const char *component) {
 #endif
 }
 
+static const char BOOTSTRAP_START_FAILURE_LOG_NAME[] = "cbm-daemon.start-failures.log";
+
+bool cbm_daemon_bootstrap_log_directory(char *out, size_t capacity) {
+    if (!out || capacity == 0) {
+        return false;
+    }
+    out[0] = '\0';
+    const char *cache = cbm_resolve_cache_dir();
+    if (!cache || !cache[0]) {
+        return false;
+    }
+    int written = snprintf(out, capacity, "%s/logs", cache);
+    if (written <= 0 || (size_t)written >= capacity) {
+        out[0] = '\0';
+        return false;
+    }
+    return true;
+}
+
+/* One record field: the line format is tab-separated, so a tab or newline in
+ * a value (a path, in theory) becomes '?' rather than a parser ambiguity. */
+static void bootstrap_record_field(char *out, size_t capacity, const char *value) {
+    size_t used = 0;
+    for (const char *cursor = value ? value : ""; *cursor && used + 1 < capacity; cursor++) {
+        unsigned char ch = (unsigned char)*cursor;
+        out[used++] = ch == '\t' || ch == '\n' || ch == '\r' ? '?' : (char)ch;
+    }
+    out[used] = '\0';
+}
+
+static uint64_t bootstrap_current_pid(void) {
+#ifdef _WIN32
+    return (uint64_t)GetCurrentProcessId();
+#else
+    return (uint64_t)getpid();
+#endif
+}
+
+bool cbm_daemon_bootstrap_start_failure_record(const char *log_directory,
+                                               const cbm_daemon_ipc_endpoint_t *endpoint,
+                                               const char *component) {
+    if (!log_directory || !log_directory[0] || !endpoint || !component || !component[0]) {
+        return false;
+    }
+    const char *runtime_dir = cbm_daemon_ipc_endpoint_runtime_dir(endpoint);
+    if (!runtime_dir || !runtime_dir[0]) {
+        return false;
+    }
+    cbm_daemon_ipc_listen_failure_t detail;
+    if (!cbm_daemon_ipc_listen_failure_detail(&detail)) {
+        memset(&detail, 0, sizeof(detail));
+    }
+    char safe_runtime_dir[BOOTSTRAP_PATH_CAP];
+    char safe_component[CBM_DAEMON_BOOTSTRAP_COMPONENT_CAP];
+    char safe_stage[CBM_DAEMON_IPC_LISTEN_FAILURE_STAGE_CAP];
+    char safe_path[CBM_DAEMON_IPC_LISTEN_FAILURE_PATH_CAP];
+    bootstrap_record_field(safe_runtime_dir, sizeof(safe_runtime_dir), runtime_dir);
+    bootstrap_record_field(safe_component, sizeof(safe_component), component);
+    bootstrap_record_field(safe_stage, sizeof(safe_stage), detail.stage);
+    bootstrap_record_field(safe_path, sizeof(safe_path), detail.path);
+    FILE *stream = cbm_daemon_ipc_private_log_open(log_directory, BOOTSTRAP_START_FAILURE_LOG_NAME,
+                                                   BOOTSTRAP_START_FAILURE_LOG_CAP);
+    if (!stream) {
+        return false;
+    }
+    int written =
+        fprintf(stream, "v1\t%llu\t%llu\t%s\t%s\t%s\t%d\t%s\n", (unsigned long long)time(NULL),
+                (unsigned long long)bootstrap_current_pid(), safe_runtime_dir, safe_component,
+                safe_stage, detail.errno_value, safe_path);
+    bool ok = written > 0 && fflush(stream) == 0;
+    if (fclose(stream) != 0) {
+        ok = false;
+    }
+    return ok;
+}
+
+/* Parse one "v1\tts\tpid\truntime_dir\tcomponent\tstage\terrno\tpath" line
+ * (line is NUL-terminated, newline already stripped, and is modified). */
+static bool bootstrap_start_failure_parse(char *line, char **runtime_dir_out,
+                                          cbm_daemon_bootstrap_start_failure_t *out) {
+    char *fields[8];
+    size_t count = 0;
+    char *cursor = line;
+    while (count < 8) {
+        fields[count++] = cursor;
+        char *tab = strchr(cursor, '\t');
+        if (!tab) {
+            break;
+        }
+        *tab = '\0';
+        cursor = tab + 1;
+    }
+    if (count != 8 || strcmp(fields[0], "v1") != 0) {
+        return false;
+    }
+    memset(out, 0, sizeof(*out));
+    out->recorded_at_s = strtoull(fields[1], NULL, 10);
+    out->pid = strtoull(fields[2], NULL, 10);
+    *runtime_dir_out = fields[3];
+    (void)snprintf(out->component, sizeof(out->component), "%s", fields[4]);
+    (void)snprintf(out->stage, sizeof(out->stage), "%s", fields[5]);
+    out->errno_value = (int)strtol(fields[6], NULL, 10);
+    (void)snprintf(out->path, sizeof(out->path), "%s", fields[7]);
+    return true;
+}
+
+static FILE *bootstrap_start_failure_open(const char *log_directory, int *status_out) {
+    char path[BOOTSTRAP_PATH_CAP];
+    int written =
+        snprintf(path, sizeof(path), "%s/%s", log_directory, BOOTSTRAP_START_FAILURE_LOG_NAME);
+    if (written <= 0 || written >= (int)sizeof(path)) {
+        *status_out = -1;
+        return NULL;
+    }
+#ifndef _WIN32
+    struct stat status;
+    if (lstat(path, &status) != 0) {
+        *status_out = errno == ENOENT ? 0 : -1;
+        return NULL;
+    }
+    if (!S_ISREG(status.st_mode) || status.st_uid != geteuid() || status.st_nlink != 1) {
+        *status_out = -1;
+        return NULL;
+    }
+#endif
+    /* The directory is the trust boundary (owner-only, no symlinked
+     * ancestry); the same validation guards cbm-daemon.log itself. */
+    if (!cbm_daemon_ipc_private_directory_secure(log_directory)) {
+        *status_out = -1;
+        return NULL;
+    }
+    FILE *file = cbm_fopen(path, "rb");
+    if (!file) {
+        *status_out = errno == ENOENT ? 0 : -1;
+        return NULL;
+    }
+    *status_out = 1;
+    return file;
+}
+
+int cbm_daemon_bootstrap_start_failure_read(const char *log_directory,
+                                            const cbm_daemon_ipc_endpoint_t *endpoint,
+                                            uint64_t not_before_s,
+                                            cbm_daemon_bootstrap_start_failure_t *out_failure) {
+    if (!out_failure) {
+        return -1;
+    }
+    memset(out_failure, 0, sizeof(*out_failure));
+    if (!log_directory || !log_directory[0] || !endpoint) {
+        return -1;
+    }
+    const char *runtime_dir = cbm_daemon_ipc_endpoint_runtime_dir(endpoint);
+    if (!runtime_dir || !runtime_dir[0]) {
+        return -1;
+    }
+    int status = 0;
+    FILE *file = bootstrap_start_failure_open(log_directory, &status);
+    if (!file) {
+        return status;
+    }
+    char *buffer = malloc(BOOTSTRAP_START_FAILURE_LOG_CAP + 1U);
+    if (!buffer) {
+        (void)fclose(file);
+        return -1;
+    }
+    size_t used = fread(buffer, 1, BOOTSTRAP_START_FAILURE_LOG_CAP, file);
+    bool read_ok = !ferror(file);
+    (void)fclose(file);
+    buffer[used] = '\0';
+    int found = 0;
+    if (read_ok) {
+        char *line = buffer;
+        while (line && *line) {
+            char *end = strchr(line, '\n');
+            if (!end) {
+                break; /* a partial trailing line is a record still being written */
+            }
+            *end = '\0';
+            char *record_runtime_dir = NULL;
+            cbm_daemon_bootstrap_start_failure_t candidate;
+            if (bootstrap_start_failure_parse(line, &record_runtime_dir, &candidate) &&
+                strcmp(record_runtime_dir, runtime_dir) == 0 &&
+                candidate.recorded_at_s >= not_before_s) {
+                *out_failure = candidate; /* later lines are newer */
+                found = 1;
+            }
+            line = end + 1;
+        }
+    } else {
+        found = -1;
+    }
+    free(buffer);
+    return found;
+}
+
+void cbm_daemon_bootstrap_start_failure_format(const cbm_daemon_bootstrap_start_failure_t *failure,
+                                               const char *log_directory, char *out,
+                                               size_t capacity) {
+    if (!out || capacity == 0) {
+        return;
+    }
+    if (!failure) {
+        out[0] = '\0';
+        return;
+    }
+    const char *what = failure->stage[0]       ? failure->stage
+                       : failure->component[0] ? failure->component
+                                               : "startup";
+    char where[BOOTSTRAP_PATH_CAP];
+    if (log_directory && log_directory[0]) {
+        (void)snprintf(where, sizeof(where), "see %s/cbm-daemon.log", log_directory);
+    } else {
+        (void)snprintf(where, sizeof(where), "see the daemon log");
+    }
+    if (failure->errno_value != 0 && failure->path[0]) {
+        (void)snprintf(out, capacity,
+                       "CBM daemon failed to start: %s failed with %s (%s) at %s; %s", what,
+                       cbm_errno_name(failure->errno_value), strerror(failure->errno_value),
+                       failure->path, where);
+    } else if (failure->errno_value != 0) {
+        (void)snprintf(out, capacity, "CBM daemon failed to start: %s failed with %s (%s); %s",
+                       what, cbm_errno_name(failure->errno_value), strerror(failure->errno_value),
+                       where);
+    } else if (failure->path[0]) {
+        (void)snprintf(out, capacity, "CBM daemon failed to start: %s failed at %s; %s", what,
+                       failure->path, where);
+    } else {
+        (void)snprintf(out, capacity, "CBM daemon failed to start: %s failed; %s", what, where);
+    }
+}
+
+/* After this attempt spawned a daemon: did that daemon (or a sibling attempt
+ * moments earlier) record a start failure? A found record ends the wait with
+ * its cause -- respawning a deterministically failing daemon until the
+ * deadline only produced "active or starting" (#1828). */
+static bool bootstrap_start_failure_detected(const cbm_daemon_bootstrap_config_t *config,
+                                             const cbm_daemon_bootstrap_ops_t *ops,
+                                             uint64_t spawn_wall_s, bool force,
+                                             uint64_t *next_check_ms,
+                                             cbm_daemon_bootstrap_result_t *result_out) {
+    if (spawn_wall_s == 0 || !ops->start_failure_probe) {
+        return false;
+    }
+    uint64_t now_ms = cbm_now_ms();
+    if (!force && now_ms < *next_check_ms) {
+        return false;
+    }
+    *next_check_ms = now_ms + BOOTSTRAP_START_FAILURE_CHECK_MS;
+    uint64_t not_before_s = spawn_wall_s > BOOTSTRAP_START_FAILURE_SKEW_S
+                                ? spawn_wall_s - BOOTSTRAP_START_FAILURE_SKEW_S
+                                : 0;
+    cbm_daemon_bootstrap_start_failure_t failure;
+    if (ops->start_failure_probe(ops->context, config->endpoint, not_before_s, &failure) != 1) {
+        return false;
+    }
+    char logs[BOOTSTRAP_PATH_CAP];
+    if (!cbm_daemon_bootstrap_log_directory(logs, sizeof(logs))) {
+        logs[0] = '\0';
+    }
+    cbm_daemon_bootstrap_start_failure_format(&failure, logs, result_out->message,
+                                              sizeof(result_out->message));
+    return true;
+}
+
 static void bootstrap_pause(uint64_t deadline) {
     uint64_t now = cbm_now_ms();
     if (now >= deadline) {
@@ -458,7 +734,15 @@ cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute_with_ops(
     bool lock_acquired = false;
     bool generation_observed = probe == CBM_DAEMON_BOOTSTRAP_PROBE_RESERVED ||
                                probe == CBM_DAEMON_BOOTSTRAP_PROBE_TERMINAL;
+    uint64_t spawn_wall_s = 0;
+    uint64_t next_failure_check_ms = 0;
+    bool start_failed = false;
     while (cbm_now_ms() < deadline) {
+        if (bootstrap_start_failure_detected(config, ops, spawn_wall_s, false,
+                                             &next_failure_check_ms, result_out)) {
+            start_failed = true;
+            break;
+        }
         if (!bootstrap_probe_is_waitable(probe)) {
             break;
         }
@@ -508,11 +792,20 @@ cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute_with_ops(
             break;
         }
 
+        /* Never relaunch a daemon whose predecessor already recorded why it
+         * could not start; the record is written before that daemon lets go
+         * of its lifetime reservation, so this unconditional read sees it. */
+        if (bootstrap_start_failure_detected(config, ops, spawn_wall_s, true,
+                                             &next_failure_check_ms, result_out)) {
+            start_failed = true;
+            break;
+        }
         cbm_daemon_bootstrap_launch_spec_t spec;
         bool spec_ready =
             config->spawn_permanent
                 ? cbm_daemon_bootstrap_launch_spec_init_permanent(config->executable_path, &spec)
                 : cbm_daemon_bootstrap_launch_spec_init(config->executable_path, &spec);
+        spawn_wall_s = (uint64_t)time(NULL);
         if (!spec_ready || !ops->startup_lock_prepare_handoff(ops->context, startup_lock) ||
             !ops->spawn_daemon(ops->context, &spec)) {
             probe = CBM_DAEMON_BOOTSTRAP_PROBE_ERROR;
@@ -537,7 +830,15 @@ cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute_with_ops(
             if (!bootstrap_probe_is_waitable(probe)) {
                 break;
             }
+            if (bootstrap_start_failure_detected(config, ops, spawn_wall_s, false,
+                                                 &next_failure_check_ms, result_out)) {
+                start_failed = true;
+                break;
+            }
         } while (cbm_now_ms() < deadline);
+        if (start_failed) {
+            break;
+        }
         if (!lock_acquired) {
             continue;
         }
@@ -555,7 +856,9 @@ cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute_with_ops(
     }
 
     result_out->status = CBM_DAEMON_BOOTSTRAP_FAILED;
-    if (muted_holder_pid != 0) {
+    if (start_failed) {
+        /* result_out->message already names the recorded cause. */
+    } else if (muted_holder_pid != 0) {
         /* The one diagnostic the 2026-08-29 zombie recovery had to assemble by
          * hand from process, pipe, and log correlation: name the pid that
          * holds the endpoint without answering, and say what to do with it. */
@@ -773,6 +1076,17 @@ static bool bootstrap_production_unlock(void *context, cbm_daemon_bootstrap_lock
     return released;
 }
 
+static int bootstrap_production_start_failure_probe(
+    void *context, const cbm_daemon_ipc_endpoint_t *endpoint, uint64_t not_before_s,
+    cbm_daemon_bootstrap_start_failure_t *out_failure) {
+    (void)context;
+    char logs[BOOTSTRAP_PATH_CAP];
+    if (!cbm_daemon_bootstrap_log_directory(logs, sizeof(logs))) {
+        return -1;
+    }
+    return cbm_daemon_bootstrap_start_failure_read(logs, endpoint, not_before_s, out_failure);
+}
+
 static bool bootstrap_production_handoff(void *context, cbm_daemon_bootstrap_lock_t lock) {
     (void)context;
     return cbm_daemon_ipc_startup_lock_prepare_handoff((cbm_daemon_ipc_startup_lock_t *)lock);
@@ -1041,10 +1355,26 @@ static void bootstrap_production_diagnostic(void *context, const char *message)
     (void)fflush(stderr);
 }
 
+#ifdef CBM_ENABLE_TEST_SEAMS
+static cbm_daemon_bootstrap_spawn_fn g_bootstrap_spawn_override_for_test;
+static void *g_bootstrap_spawn_override_context_for_test;
+
+void cbm_daemon_bootstrap_spawn_override_set_for_test(cbm_daemon_bootstrap_spawn_fn spawn,
+                                                      void *context) {
+    g_bootstrap_spawn_override_context_for_test = context;
+    g_bootstrap_spawn_override_for_test = spawn;
+}
+
+static bool bootstrap_seam_spawn(void *context, const cbm_daemon_bootstrap_launch_spec_t *spec) {
+    (void)context;
+    return g_bootstrap_spawn_override_for_test(g_bootstrap_spawn_override_context_for_test, spec);
+}
+#endif
+
 cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute(
     const cbm_daemon_bootstrap_config_t *config, cbm_daemon_bootstrap_result_t *result_out) {
     bootstrap_production_context_t context = {0};
-    const cbm_daemon_bootstrap_ops_t ops = {
+    cbm_daemon_bootstrap_ops_t ops = {
         .context = &context,
         .cohort_acquire = bootstrap_production_cohort_acquire,
         .cohort_release = bootstrap_production_cohort_release,
@@ -1054,6 +1384,12 @@ cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute(
         .startup_lock_release = bootstrap_production_unlock,
         .spawn_daemon = bootstrap_production_spawn,
         .visible_diagnostic = bootstrap_production_diagnostic,
+        .start_failure_probe = bootstrap_production_start_failure_probe,
     };
+#ifdef CBM_ENABLE_TEST_SEAMS
+    if (g_bootstrap_spawn_override_for_test) {
+        ops.spawn_daemon = bootstrap_seam_spawn;
+    }
+#endif
     return cbm_daemon_bootstrap_execute_with_ops(config, &ops, result_out);
 }
diff --git a/src/daemon/bootstrap.h b/src/daemon/bootstrap.h
index acb6c657b..8b1e797dd 100644
--- a/src/daemon/bootstrap.h
+++ b/src/daemon/bootstrap.h
@@ -119,6 +119,47 @@ cbm_daemon_bootstrap_probe_status_t cbm_daemon_bootstrap_classify_failed_connect
 typedef void *cbm_daemon_bootstrap_lock_t;
 typedef void *cbm_daemon_bootstrap_cohort_t;
 
+/* Durable daemon start-failure record (#1828). A detached daemon has no
+ * stderr and no channel back to the client that launched it; when its
+ * listener publication fails (a full /tmp, for instance) the client used to
+ * respawn it for the whole startup deadline and then report "active or
+ * starting". The host now appends one record per failed start to
+ * <cache>/logs/cbm-daemon.start-failures.log -- the same owner-only log
+ * directory as cbm-daemon.log, deliberately NOT the runtime directory: that
+ * one is exactly what a full /tmp cannot write, and a new artifact there
+ * would entangle stale-generation cleanup. A waiting client reads the newest
+ * record for its endpoint that is not older than its own spawn and fails
+ * immediately with the cause. Diagnostic only: policy never reads it. */
+enum { CBM_DAEMON_BOOTSTRAP_COMPONENT_CAP = 32 };
+typedef struct {
+    uint64_t recorded_at_s; /* wall clock, seconds */
+    uint64_t pid;
+    char component[CBM_DAEMON_BOOTSTRAP_COMPONENT_CAP];  /* host component that refused */
+    char stage[CBM_DAEMON_IPC_LISTEN_FAILURE_STAGE_CAP]; /* IPC stage, "" when none */
+    int errno_value;                                     /* 0 when unknown */
+    char path[CBM_DAEMON_IPC_LISTEN_FAILURE_PATH_CAP];   /* "" when none */
+} cbm_daemon_bootstrap_start_failure_t;
+
+/* <cache>/logs, the owner-only directory that holds every daemon log. */
+bool cbm_daemon_bootstrap_log_directory(char *out, size_t capacity);
+/* Append one record for this process's most recent listener failure detail
+ * (cbm_daemon_ipc_listen_failure_detail) under `component`. */
+bool cbm_daemon_bootstrap_start_failure_record(const char *log_directory,
+                                               const cbm_daemon_ipc_endpoint_t *endpoint,
+                                               const char *component);
+/* Newest record for `endpoint` recorded at or after not_before_s. Returns 1
+ * and fills out_failure, 0 when none matches, -1 when the log directory or
+ * file cannot be validated. */
+int cbm_daemon_bootstrap_start_failure_read(const char *log_directory,
+                                            const cbm_daemon_ipc_endpoint_t *endpoint,
+                                            uint64_t not_before_s,
+                                            cbm_daemon_bootstrap_start_failure_t *out_failure);
+/* The client-facing sentence: "CBM daemon failed to start: <stage> failed
+ * with ENOSPC (No space left on device) at <path>; see <log>". */
+void cbm_daemon_bootstrap_start_failure_format(const cbm_daemon_bootstrap_start_failure_t *failure,
+                                               const char *log_directory, char *out,
+                                               size_t capacity);
+
 /* Injectable OS/runtime boundary used by the deterministic unit contract.
  * Production callers use cbm_daemon_bootstrap_execute(), whose built-in
  * operations delegate to daemon IPC/runtime and write visible diagnostics to
@@ -149,6 +190,12 @@ typedef struct {
     bool (*startup_lock_release)(void *context, cbm_daemon_bootstrap_lock_t *lock_io);
     bool (*spawn_daemon)(void *context, const cbm_daemon_bootstrap_launch_spec_t *spec);
     void (*visible_diagnostic)(void *context, const char *message);
+    /* Optional. After this attempt spawned a daemon, report a start-failure
+     * record for the endpoint not older than not_before_s (1 found, 0 none,
+     * -1 unreadable). A found record ends the wait immediately (#1828). */
+    int (*start_failure_probe)(void *context, const cbm_daemon_ipc_endpoint_t *endpoint,
+                               uint64_t not_before_s,
+                               cbm_daemon_bootstrap_start_failure_t *out_failure);
 } cbm_daemon_bootstrap_ops_t;
 
 cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute(
@@ -156,6 +203,17 @@ cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute(
 
 /* Test seam for the same state machine. All callbacks are synchronous and
  * borrowed for the duration of the call. */
+#ifdef CBM_ENABLE_TEST_SEAMS
+/* Replace ONLY the production spawn while every other production operation
+ * (cohort, probe, startup lock, handoff) stays real. A test forks a real
+ * daemon host in place of exec'ing the product binary, so the complete
+ * client/daemon rendezvous runs in one deterministic process tree (#1828). */
+typedef bool (*cbm_daemon_bootstrap_spawn_fn)(void *context,
+                                              const cbm_daemon_bootstrap_launch_spec_t *spec);
+void cbm_daemon_bootstrap_spawn_override_set_for_test(cbm_daemon_bootstrap_spawn_fn spawn,
+                                                      void *context);
+#endif
+
 cbm_daemon_bootstrap_status_t cbm_daemon_bootstrap_execute_with_ops(
     const cbm_daemon_bootstrap_config_t *config, const cbm_daemon_bootstrap_ops_t *ops,
     cbm_daemon_bootstrap_result_t *result_out);
diff --git a/src/daemon/daemon.c b/src/daemon/daemon.c
index ae26ba36b..f6f4315b7 100644
--- a/src/daemon/daemon.c
+++ b/src/daemon/daemon.c
@@ -47,6 +47,11 @@ struct cbm_daemon_coordinator {
     size_t client_count;
     /* See cbm_daemon_coordinator_set_permanent. */
     bool permanent;
+    /* See cbm_daemon_coordinator_set_linger. Distinct from `permanent`: a
+     * transient, runtime-driven hold that keeps an ephemeral coordinator
+     * admitting while cohort participants are still mid-bootstrap (cold-storm
+     * race, 2026-09). Clearing it while idle retires the coordinator at once. */
+    bool linger;
     size_t job_count;
     size_t watch_count;
     size_t callback_count;
@@ -291,7 +296,7 @@ static void release_client_locked(cbm_daemon_coordinator_t *coordinator,
     release_client_resources_locked(coordinator, client->id, batch);
     free(client);
     coordinator->client_count--;
-    if (coordinator->client_count == 0 && !coordinator->permanent) {
+    if (coordinator->client_count == 0 && !coordinator->permanent && !coordinator->linger) {
         coordinator->state = CBM_DAEMON_COORDINATOR_STOPPING;
     }
 }
@@ -329,6 +334,23 @@ void cbm_daemon_coordinator_set_permanent(cbm_daemon_coordinator_t *coordinator,
     cbm_mutex_unlock(&coordinator->mutex);
 }
 
+void cbm_daemon_coordinator_set_linger(cbm_daemon_coordinator_t *coordinator, bool linger) {
+    if (!coordinator) {
+        return;
+    }
+    cbm_mutex_lock(&coordinator->mutex);
+    coordinator->linger = linger;
+    /* Clearing the hold while the coordinator is already idle is the retirement
+     * signal: an ephemeral generation whose cohort participants have all
+     * connected and left (or whose linger window elapsed) transitions to
+     * STOPPING now, exactly as the last-client disconnect would have. */
+    if (!linger && !coordinator->permanent && coordinator->client_count == 0 &&
+        coordinator->state == CBM_DAEMON_COORDINATOR_RUNNING) {
+        coordinator->state = CBM_DAEMON_COORDINATOR_STOPPING;
+    }
+    cbm_mutex_unlock(&coordinator->mutex);
+}
+
 cbm_daemon_coordinator_t *cbm_daemon_coordinator_new(uint64_t lease_timeout_ms) {
     cbm_daemon_coordinator_t *coordinator = calloc(1, sizeof(*coordinator));
     if (!coordinator) {
diff --git a/src/daemon/daemon.h b/src/daemon/daemon.h
index 6357cb151..09e6abd5b 100644
--- a/src/daemon/daemon.h
+++ b/src/daemon/daemon.h
@@ -74,6 +74,14 @@ cbm_daemon_coordinator_t *cbm_daemon_coordinator_new(uint64_t lease_timeout_ms);
  * self-transitions to STOPPING when its client count reaches zero; only the
  * explicit stop/drain paths end it. */
 void cbm_daemon_coordinator_set_permanent(cbm_daemon_coordinator_t *coordinator, bool permanent);
+/* Transient, runtime-driven hold (distinct from `permanent`) that keeps an
+ * ephemeral coordinator RUNNING — still admitting new clients — after its last
+ * client disconnects, while cohort participants are still mid-bootstrap racing
+ * connect() (cold-storm race, 2026-09). Setting it before the last disconnect
+ * suppresses the self-transition to STOPPING; clearing it while the coordinator
+ * is already idle transitions to STOPPING at once, so retirement stays prompt
+ * and bounded. Has no effect on a permanent coordinator. */
+void cbm_daemon_coordinator_set_linger(cbm_daemon_coordinator_t *coordinator, bool linger);
 /* The caller must first quiesce coordinator calls and hook invocations. */
 void cbm_daemon_coordinator_free(cbm_daemon_coordinator_t *coordinator);
 
diff --git a/src/daemon/host.c b/src/daemon/host.c
index f475658b8..3e509e207 100644
--- a/src/daemon/host.c
+++ b/src/daemon/host.c
@@ -5,6 +5,7 @@
 #include "daemon/host_internal.h"
 
 #include "daemon/application.h"
+#include "daemon/bootstrap.h"
 #include "daemon/runtime.h"
 #include "daemon/project_lock.h"
 #include "daemon/version_cohort.h"
@@ -146,6 +147,18 @@ static bool host_log_open(char conflict_log_out[HOST_PATH_CAP]) {
     return true;
 }
 
+/* #1828: a detached daemon has no stderr; its start failure must reach the
+ * client that is waiting for it, or that client burns its whole deadline and
+ * reports the opposite of the truth. */
+static void host_start_failure_record(const cbm_daemon_ipc_endpoint_t *endpoint,
+                                      const char *component) {
+    char logs[HOST_PATH_CAP];
+    if (!cbm_daemon_bootstrap_log_directory(logs, sizeof(logs)) ||
+        !cbm_daemon_bootstrap_start_failure_record(logs, endpoint, component)) {
+        cbm_log_error("daemon.start_failure_record_failed", "component", component);
+    }
+}
+
 static void host_log_close(void) {
     cbm_log_set_sink(NULL);
     if (g_host_log_mutex_initialized) {
@@ -891,6 +904,10 @@ static bool host_wait_for_lifetime(cbm_daemon_runtime_service_t *service,
             return cbm_daemon_runtime_service_stop(service, HOST_RUNTIME_SHUTDOWN_MS);
         }
         host_http_reconcile_at(host, cbm_now_ms(), false);
+        /* Retire an ephemeral generation that lingered for cold-storm cohort
+         * participants once they drain, or once its bounded linger elapses.
+         * A no-op unless a cohort-participant hook armed a linger. */
+        cbm_daemon_runtime_service_reconcile_lifetime(service);
         (void)cbm_daemon_runtime_service_wait_exited(service, HOST_WAIT_TICK_MS);
     }
 }
@@ -1051,10 +1068,16 @@ int cbm_daemon_host_run(const cbm_daemon_host_config_t *config) {
     };
     cbm_daemon_runtime_service_t *service =
         cbm_daemon_runtime_service_start_reserved(&runtime_config, &lifetime_reservation);
+    if (!service) {
+        cbm_log_error("daemon.start_failed", "component", "runtime");
+        /* Recorded while the lifetime reservation is still held: a client
+         * that watches this generation vanish finds the cause already there
+         * and never launches a doomed replacement. */
+        host_start_failure_record(config->endpoint, "runtime");
+    }
     cbm_daemon_ipc_lifetime_reservation_release(lifetime_reservation);
     lifetime_reservation = NULL;
     if (!service) {
-        cbm_log_error("daemon.start_failed", "component", "runtime");
         host_state_free(&host);
         host_log_close();
         host_participant_guard_close(&participant_guard);
diff --git a/src/daemon/ipc.c b/src/daemon/ipc.c
index 2467d311d..3917a7a05 100644
--- a/src/daemon/ipc.c
+++ b/src/daemon/ipc.c
@@ -9,6 +9,7 @@
 #include "foundation/compat_thread.h"
 #include "foundation/log.h"
 #include "foundation/macos_acl.h"
+#include "foundation/platform.h"
 #include "foundation/private_file_lock_internal.h"
 #include "foundation/sha256.h"
 #include "foundation/secure_random.h"
@@ -53,6 +54,60 @@ const char *cbm_daemon_ipc_validation_detail(void) {
     return ipc_validation_detail_buffer;
 }
 
+static cbm_daemon_ipc_listen_failure_t ipc_listen_failure;
+
+/* The failure recorder and its reset are only reached from the POSIX socket
+ * listener (all callers live in the `#ifndef _WIN32` block below); the Windows
+ * named-pipe listener does its own reporting. Guarding them keeps the always-
+ * compiled struct + accessor cross-platform while avoiding -Werror,
+ * -Wunused-function on the Windows build (#1828 CI). */
+#ifndef _WIN32
+static void ipc_listen_failure_reset(void) {
+    memset(&ipc_listen_failure, 0, sizeof(ipc_listen_failure));
+}
+
+/* Record and log one listener failure. `name` is an artifact inside the
+ * endpoint's runtime directory, "" for the directory itself, or NULL when
+ * the stage has no path. The log line names the errno symbolically and the
+ * full path, so `daemon.ipc.listen_failed stage=pending_publication` alone
+ * (the whole trace #1828's reporter had) can no longer happen. */
+static void ipc_listen_failed(const char *runtime_dir, const char *stage, int errno_value,
+                              const char *name) {
+    ipc_listen_failure_reset();
+    (void)snprintf(ipc_listen_failure.stage, sizeof(ipc_listen_failure.stage), "%s",
+                   stage ? stage : "");
+    ipc_listen_failure.errno_value = errno_value;
+    if (runtime_dir && name) {
+        int written = name[0] ? snprintf(ipc_listen_failure.path, sizeof(ipc_listen_failure.path),
+                                         "%s/%s", runtime_dir, name)
+                              : snprintf(ipc_listen_failure.path, sizeof(ipc_listen_failure.path),
+                                         "%s", runtime_dir);
+        if (written <= 0 || written >= (int)sizeof(ipc_listen_failure.path)) {
+            ipc_listen_failure.path[0] = '\0';
+        }
+    }
+    const char *errno_name = errno_value != 0 ? cbm_errno_name(errno_value) : NULL;
+    if (errno_name && ipc_listen_failure.path[0]) {
+        cbm_log_error("daemon.ipc.listen_failed", "stage", stage, "errno", errno_name, "path",
+                      ipc_listen_failure.path);
+    } else if (errno_name) {
+        cbm_log_error("daemon.ipc.listen_failed", "stage", stage, "errno", errno_name);
+    } else if (ipc_listen_failure.path[0]) {
+        cbm_log_error("daemon.ipc.listen_failed", "stage", stage, "path", ipc_listen_failure.path);
+    } else {
+        cbm_log_error("daemon.ipc.listen_failed", "stage", stage);
+    }
+}
+#endif /* !_WIN32 */
+
+bool cbm_daemon_ipc_listen_failure_detail(cbm_daemon_ipc_listen_failure_t *out) {
+    if (!out) {
+        return false;
+    }
+    *out = ipc_listen_failure;
+    return ipc_listen_failure.stage[0] != '\0';
+}
+
 static bool instance_key_valid(const char *key) {
     if (!key) {
         return false;
@@ -122,6 +177,19 @@ void cbm_daemon_ipc_windows_legacy_guard_release_failures_set_for_test(unsigned
                           memory_order_release);
 }
 
+#ifndef _WIN32
+static atomic_int g_posix_record_write_failure_errno_for_test;
+#endif
+
+void cbm_daemon_ipc_posix_record_write_failure_set_for_test(int errno_value) {
+#ifndef _WIN32
+    atomic_store_explicit(&g_posix_record_write_failure_errno_for_test, errno_value,
+                          memory_order_release);
+#else
+    (void)errno_value;
+#endif
+}
+
 #ifdef _WIN32
 static cbm_daemon_ipc_startup_gate_fn g_startup_gate_for_test;
 static void *g_startup_gate_context_for_test;
@@ -146,6 +214,31 @@ static void ipc_startup_gate_run(void) {
 }
 #endif
 
+#ifdef _WIN32
+static cbm_daemon_ipc_win_directory_create_hook_fn g_win_directory_create_hook_for_test;
+static void *g_win_directory_create_hook_context_for_test;
+#endif
+
+void cbm_daemon_ipc_win_directory_create_hook_set_for_test(
+    cbm_daemon_ipc_win_directory_create_hook_fn hook, void *context) {
+#ifdef _WIN32
+    g_win_directory_create_hook_context_for_test = context;
+    g_win_directory_create_hook_for_test = hook;
+#else
+    (void)hook;
+    (void)context;
+#endif
+}
+
+#ifdef _WIN32
+static void ipc_win_directory_create_hook_run(const wchar_t *path) {
+    cbm_daemon_ipc_win_directory_create_hook_fn hook = g_win_directory_create_hook_for_test;
+    if (hook) {
+        hook(path, g_win_directory_create_hook_context_for_test);
+    }
+}
+#endif
+
 bool cbm_daemon_ipc_windows_legacy_names(const char *canonical_runtime_parent,
                                          const char *instance_key,
                                          char pipe_out[CBM_DAEMON_IPC_WINDOWS_NAME_CAP],
@@ -1395,9 +1488,21 @@ static char *private_log_directory_path_copy(const char *directory_path) {
  *
  * The overflow owner is tolerated for ANCESTORS ONLY, and ONLY when
  * /proc/self/uid_map is a single-uid map whose sole inside id is our euid. In
- * that shape no in-namespace principal can be the overflow owner, so an
- * overflow-owned ancestor is exactly as safe as a root-owned one on the host:
- * nobody reachable can have created it or can mutate it. A multi-uid map
+ * that shape no IN-NAMESPACE principal can be the overflow owner.
+ *
+ * Be precise about what that does and does not buy, because an earlier version
+ * of this comment overstated it. The overflow uid is what EVERY unmapped host
+ * uid maps to, not only host root (user_namespaces(7)), so "overflow-owned"
+ * does NOT prove "created by root". On a shared host, a directory owned by
+ * another local user is indistinguishable from root-owned /tmp once you are
+ * inside the namespace -- and there is no in-namespace discriminator that could
+ * tell them apart, which is precisely why the tolerance is scoped the way it
+ * is rather than made smarter. The real guarantee is narrower and still
+ * sufficient: no principal REACHABLE FROM INSIDE the namespace can create or
+ * mutate such an ancestor, and the private directory itself is never tolerated
+ * as overflow (see below), so a hostile host-side owner of an ancestor is
+ * bounded to denial of service and socket-path control. It cannot reach the
+ * leaf, which stays 0700 and euid-rechecked. A multi-uid map
  * (rootless podman with subuids) still shows host root as overflow and is
  * refused — conservative scope, not the safety argument. There is deliberately
  * no environment escape hatch.
@@ -1477,7 +1582,20 @@ static bool posix_read_small_proc_file(const char *path, char *buffer, size_t ca
     return true;
 }
 
+#ifdef CBM_ENABLE_TEST_SEAMS
+/* Counts real derivations. A cache here was a security hazard once (see the
+ * note above posix_ancestor_overflow_uid); the contract test asserts this
+ * climbs on EVERY call so re-introducing one fails loudly. */
+static unsigned g_posix_overflow_compute_count;
+unsigned cbm_daemon_ipc_posix_overflow_compute_count_for_test(void) {
+    return g_posix_overflow_compute_count;
+}
+#endif
+
 static uid_t posix_compute_ancestor_overflow_uid(void) {
+#ifdef CBM_ENABLE_TEST_SEAMS
+    g_posix_overflow_compute_count++;
+#endif
     char map[256];
     if (!posix_read_small_proc_file("/proc/self/uid_map", map, sizeof(map)) ||
         !posix_uid_map_is_single_uid(map, geteuid())) {
@@ -1496,15 +1614,27 @@ static uid_t posix_compute_ancestor_overflow_uid(void) {
     return (uid_t)overflow;
 }
 
-static uid_t g_posix_overflow_cached = POSIX_NO_OVERFLOW_UID;
-static pthread_once_t g_posix_overflow_once = PTHREAD_ONCE_INIT;
-static void posix_overflow_init_once(void) {
-    g_posix_overflow_cached = posix_compute_ancestor_overflow_uid();
-}
 #endif /* __linux__ */
 
-/* The overflow uid tolerated for ancestors in this process, or
- * POSIX_NO_OVERFLOW_UID when none. Derived once from immutable /proc state. */
+/* The overflow uid tolerated for ancestors, or POSIX_NO_OVERFLOW_UID when none.
+ *
+ * DERIVED FRESH ON EVERY CALL, deliberately. This used to memoise via
+ * pthread_once behind a comment claiming "immutable /proc state". That claim
+ * was false in both halves: unshare(CLONE_NEWUSER) rewrites
+ * /proc/self/uid_map, and pthread_once state survives a forked child already
+ * marked done -- so a process that forked and then changed namespace kept the
+ * parent answer and refused a directory it should have accepted.
+ * (Spelled without the call syntax on purpose: scripts/security-audit.sh
+ * blocks that literal in src/, and an allow-list entry to let a COMMENT pass
+ * would weaken a real check on a real file.) It happened to be
+ * harmless because every caller today runs in a freshly exec'd process, but
+ * that made a security decision depend on an invariant nothing enforced, and
+ * the next fork-without-exec caller would have silently inherited a stale
+ * verdict.
+ *
+ * The cost of not caching is two small /proc reads per ancestor check, against
+ * an openat + fstat + fchmod + ACL check per path component in the same walk.
+ * Do not re-introduce a cache here; the contract test counts derivations. */
 static uid_t posix_ancestor_overflow_uid(void) {
 #ifdef CBM_ENABLE_TEST_SEAMS
     if (g_posix_overflow_override_active) {
@@ -1512,8 +1642,7 @@ static uid_t posix_ancestor_overflow_uid(void) {
     }
 #endif
 #if defined(__linux__)
-    (void)pthread_once(&g_posix_overflow_once, posix_overflow_init_once);
-    return g_posix_overflow_cached;
+    return posix_compute_ancestor_overflow_uid();
 #else
     return POSIX_NO_OVERFLOW_UID;
 #endif
@@ -1999,6 +2128,29 @@ static bool posix_fd_write_all(int fd, const uint8_t *buffer, size_t length) {
     return true;
 }
 
+/* The failing step of the most recent record publication in this process:
+ * its errno (0 when a validation predicate, not a syscall, refused) and the
+ * artifact name it was operating on. Read by the listener right after a
+ * publish returns false. */
+static int posix_publish_failure_errno;
+static char posix_publish_failure_name[NAME_MAX + 1];
+
+static void posix_publish_failure_note(int errno_value, const char *name) {
+    posix_publish_failure_errno = errno_value;
+    (void)snprintf(posix_publish_failure_name, sizeof(posix_publish_failure_name), "%s",
+                   name ? name : "");
+}
+
+static bool posix_record_fd_write(int fd, const uint8_t *buffer, size_t length) {
+    int injected =
+        atomic_load_explicit(&g_posix_record_write_failure_errno_for_test, memory_order_acquire);
+    if (injected != 0) {
+        errno = injected;
+        return false;
+    }
+    return posix_fd_write_all(fd, buffer, length);
+}
+
 static bool posix_fd_pread_all(int fd, uint8_t *buffer, size_t length) {
     size_t offset = 0;
     while (offset < length) {
@@ -2353,50 +2505,75 @@ static bool posix_socket_record_publish(const cbm_daemon_ipc_endpoint_t *endpoin
         return false;
     }
     struct stat existing;
+    errno = 0;
     if (fstatat(endpoint->dir_fd, record_name, &existing, AT_SYMLINK_NOFOLLOW) == 0 ||
         errno != ENOENT) {
+        posix_publish_failure_note(errno == 0 ? EEXIST : errno, record_name);
         return false;
     }
     uint8_t record[POSIX_SOCKET_RECORD_SIZE];
     if (!posix_socket_record_encode(magic, source, record)) {
+        posix_publish_failure_note(0, record_name);
         return false;
     }
 
     char temp_name[NAME_MAX + 1];
     if (!posix_socket_record_temp_name(record_name, temp_name)) {
+        posix_publish_failure_note(ENAMETOOLONG, record_name);
         return false;
     }
     int fd = openat(endpoint->dir_fd, temp_name,
                     O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC | O_NOFOLLOW | O_NONBLOCK, 0600);
     if (fd < 0) {
+        posix_publish_failure_note(errno, temp_name);
         return false;
     }
 
     struct stat created = {0};
     bool temp_exists = true;
     bool stable_linked = false;
+    errno = 0;
     bool ok = fd_set_cloexec(fd) && fchmod(fd, 0600) == 0 &&
               private_regular_file_snapshot(endpoint->dir_fd, temp_name, fd, 1, &created) &&
-              posix_fd_write_all(fd, record, sizeof(record)) && fsync(fd) == 0 &&
+              posix_record_fd_write(fd, record, sizeof(record)) && fsync(fd) == 0 &&
               private_regular_file_snapshot(endpoint->dir_fd, temp_name, fd, 1, &created) &&
               created.st_size == (off_t)POSIX_SOCKET_RECORD_SIZE &&
               endpoint_runtime_still_valid(endpoint);
+    if (!ok) {
+        posix_publish_failure_note(errno, temp_name);
+    }
     if (ok) {
         posix_record_publication_stage_reached(magic, false);
+        errno = 0;
         ok =
             posix_linkat_no_follow(endpoint->dir_fd, temp_name, endpoint->dir_fd, record_name) == 0;
         stable_linked = ok;
+        if (!ok) {
+            posix_publish_failure_note(errno, record_name);
+        }
     }
     if (ok) {
         posix_record_publication_stage_reached(magic, true);
+        errno = 0;
         ok = posix_path_unlink_regular_if_matches(endpoint->dir_fd, temp_name, created.st_dev,
                                                   created.st_ino, 2);
         temp_exists = !ok;
+        if (!ok) {
+            posix_publish_failure_note(errno, temp_name);
+        }
     }
     if (ok) {
+        errno = 0;
         ok = posix_directory_sync(endpoint->dir_fd);
+        if (!ok) {
+            posix_publish_failure_note(errno, "");
+        }
     }
+    errno = 0;
     if (close(fd) != 0) {
+        if (ok) {
+            posix_publish_failure_note(errno, temp_name);
+        }
         ok = false;
     }
 
@@ -2408,6 +2585,9 @@ static bool posix_socket_record_publish(const cbm_daemon_ipc_endpoint_t *endpoin
              posix_socket_identity_equal(&published_record.identity, &source->identity) &&
              strcmp(published_record.anchor_name, source->anchor_name) == 0 &&
              published_status.st_dev == created.st_dev && published_status.st_ino == created.st_ino;
+        if (!ok) {
+            posix_publish_failure_note(0, record_name);
+        }
     }
     if (!ok) {
         if (stable_linked) {
@@ -2723,8 +2903,11 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
     cbm_daemon_ipc_lifetime_reservation_t **reservation_io) {
     cbm_daemon_ipc_lifetime_reservation_t *lifetime_reservation =
         reservation_io ? *reservation_io : NULL;
+    ipc_listen_failure_reset();
+    posix_publish_failure_note(0, NULL);
+    const char *runtime_dir = endpoint ? endpoint->runtime_dir : NULL;
     if (!lifetime_reservation_matches_endpoint(endpoint, lifetime_reservation)) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "reservation_validation");
+        ipc_listen_failed(runtime_dir, "reservation_validation", 0, NULL);
         return NULL;
     }
     /* Stale removal happens only under the startup lock, before a daemon host
@@ -2734,7 +2917,7 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
     char pending_temp_name[NAME_MAX + 1];
     if (!posix_socket_record_temp_name(endpoint->socket_identity_name, identity_temp_name) ||
         !posix_socket_record_temp_name(endpoint->socket_pending_name, pending_temp_name)) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "temp_names");
+        ipc_listen_failed(runtime_dir, "temp_names", ENAMETOOLONG, endpoint->socket_pending_name);
         return NULL;
     }
     struct stat existing;
@@ -2743,27 +2926,32 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
         endpoint->socket_pending_name, identity_temp_name,           pending_temp_name,
     };
     bool namespace_absent = true;
+    const char *occupied_name = "";
+    int occupied_errno = 0;
     for (size_t index = 0; index < sizeof(required_absent) / sizeof(required_absent[0]); index++) {
+        errno = 0;
         if (fstatat(endpoint->dir_fd, required_absent[index], &existing, AT_SYMLINK_NOFOLLOW) ==
                 0 ||
             errno != ENOENT) {
             namespace_absent = false;
+            occupied_name = required_absent[index];
+            occupied_errno = errno == 0 ? EEXIST : errno;
             break;
         }
     }
     if (!endpoint_runtime_still_valid(endpoint) || !namespace_absent) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "namespace_validation");
+        ipc_listen_failed(runtime_dir, "namespace_validation", occupied_errno, occupied_name);
         return NULL;
     }
 
     int fd = local_socket_new();
     if (fd < 0) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "socket_creation");
+        ipc_listen_failed(runtime_dir, "socket_creation", errno, NULL);
         return NULL;
     }
     cbm_daemon_ipc_listener_t *listener = calloc(1, sizeof(*listener));
     if (!listener) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "listener_allocation");
+        ipc_listen_failed(runtime_dir, "listener_allocation", ENOMEM, NULL);
         (void)close(fd);
         return NULL;
     }
@@ -2781,7 +2969,8 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
     if (listener->dir_fd < 0 || !fd_set_cloexec(listener->dir_fd) || !listener->runtime_dir ||
         !listener->address || !listener->socket_name || !listener->socket_anchor_name ||
         !listener->socket_identity_name || !listener->socket_pending_name) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "listener_initialization");
+        ipc_listen_failed(runtime_dir, "listener_initialization",
+                          listener->dir_fd < 0 ? errno : ENOMEM, NULL);
         if (listener->dir_fd >= 0) {
             (void)close(listener->dir_fd);
         }
@@ -2799,20 +2988,19 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
     struct sockaddr_un address;
     socklen_t address_length;
     if (!unix_address_set(&address, endpoint->socket_anchor_address, &address_length)) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "socket_address");
+        ipc_listen_failed(runtime_dir, "socket_address", ENAMETOOLONG,
+                          endpoint->socket_anchor_name);
         cbm_daemon_ipc_listener_close(listener);
         return NULL;
     }
     if (bind(fd, (const struct sockaddr *)&address, address_length) != 0) {
-        int bind_error = errno;
-        char error_text[32];
-        (void)snprintf(error_text, sizeof(error_text), "%d", bind_error);
-        cbm_log_error("daemon.ipc.listen_failed", "bind_errno", error_text);
+        ipc_listen_failed(runtime_dir, "socket_bind", errno, endpoint->socket_anchor_name);
         cbm_daemon_ipc_listener_close(listener);
         return NULL;
     }
 
     struct stat bound_status;
+    errno = 0;
     bool bound_path_ok = fstatat(endpoint->dir_fd, endpoint->socket_anchor_name, &bound_status,
                                  AT_SYMLINK_NOFOLLOW) == 0 &&
                          S_ISSOCK(bound_status.st_mode) && bound_status.st_uid == geteuid();
@@ -2832,11 +3020,13 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
         anchor_status.st_ino != bound_status.st_ino ||
         !posix_socket_identity_from_stat(&anchor_status, &anchor_identity) ||
         !posix_directory_sync(endpoint->dir_fd)) {
+        int security_errno = errno;
         if (bound_path_ok) {
             posix_bound_socket_unlink_if_matches(endpoint->dir_fd, endpoint->socket_anchor_name,
                                                  bound_status.st_dev, bound_status.st_ino);
         }
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "socket_security");
+        ipc_listen_failed(runtime_dir, "socket_security", security_errno,
+                          endpoint->socket_anchor_name);
         cbm_daemon_ipc_listener_close(listener);
         return NULL;
     }
@@ -2853,16 +3043,19 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
         endpoint, endpoint->socket_pending_name, POSIX_SOCKET_PENDING_MAGIC, &pending,
         &pending_status.st_dev, &pending_status.st_ino);
     if (!pending_published) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "pending_publication");
+        ipc_listen_failed(runtime_dir, "pending_publication", posix_publish_failure_errno,
+                          posix_publish_failure_name);
         posix_publication_abort(endpoint, &anchor_identity, false, NULL, false, NULL);
         cbm_daemon_ipc_listener_close(listener);
         return NULL;
     }
     posix_publication_stage_reached(CBM_DAEMON_IPC_POSIX_PUBLICATION_PENDING_DURABLE);
 
+    errno = 0;
     bool stable_linked = posix_linkat_no_follow(endpoint->dir_fd, endpoint->socket_anchor_name,
                                                 endpoint->dir_fd, endpoint->socket_name) == 0 &&
                          posix_directory_sync(endpoint->dir_fd);
+    int stable_errno = stable_linked ? 0 : errno;
     posix_socket_identity_t stable_identity = {0};
     posix_socket_identity_t committed_identity = {0};
     struct stat stable_status = {0};
@@ -2877,7 +3070,7 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
         posix_socket_identity_equal(&stable_identity, &committed_identity) &&
         posix_socket_inode_equal(&anchor_identity, &committed_identity);
     if (!stable_valid) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "stable_publication");
+        ipc_listen_failed(runtime_dir, "stable_publication", stable_errno, endpoint->socket_name);
         posix_publication_abort(endpoint, &anchor_identity, pending_published, &pending_status,
                                 false, NULL);
         cbm_daemon_ipc_listener_close(listener);
@@ -2896,7 +3089,8 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
         endpoint, endpoint->socket_identity_name, POSIX_SOCKET_MARKER_MAGIC, &marker,
         &marker_status.st_dev, &marker_status.st_ino);
     if (!marker_published) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "marker_publication");
+        ipc_listen_failed(runtime_dir, "marker_publication", posix_publish_failure_errno,
+                          posix_publish_failure_name);
         posix_publication_abort(endpoint, &committed_identity, pending_published, &pending_status,
                                 false, NULL);
         cbm_daemon_ipc_listener_close(listener);
@@ -2906,10 +3100,11 @@ cbm_daemon_ipc_listener_t *cbm_daemon_ipc_listen_reserved(
     listener->identity_inode = marker_status.st_ino;
     posix_publication_stage_reached(CBM_DAEMON_IPC_POSIX_PUBLICATION_MARKER_DURABLE);
 
+    errno = 0;
     if (!posix_path_unlink_regular_if_matches(endpoint->dir_fd, endpoint->socket_pending_name,
                                               pending_status.st_dev, pending_status.st_ino, 1) ||
         !posix_directory_sync(endpoint->dir_fd)) {
-        cbm_log_error("daemon.ipc.listen_failed", "stage", "pending_removal");
+        ipc_listen_failed(runtime_dir, "pending_removal", errno, endpoint->socket_pending_name);
         posix_publication_abort(endpoint, &committed_identity, true, &pending_status,
                                 marker_published, &marker_status);
         cbm_daemon_ipc_listener_close(listener);
@@ -3561,6 +3756,7 @@ bool cbm_daemon_ipc_local_transition_release(cbm_daemon_ipc_local_transition_t *
 #include <windows.h>
 #include <aclapi.h>
 #include <sddl.h>
+#include <ntsecapi.h>
 #include <fcntl.h>
 #include <io.h>
 #include <shlobj.h>
@@ -3823,6 +4019,16 @@ static char *wide_to_utf8(const wchar_t *value) {
     return utf8;
 }
 
+/* Record "<path>: <message>" as the validation detail, with the wide path
+ * rendered as UTF-8. One place owns the conversion buffer, so every refusal on
+ * the directory walk can name its component without each call site carrying
+ * its own allocation. */
+static void ipc_validation_detail_set_for_path(const wchar_t *path, const char *message) {
+    char *path_utf8 = wide_to_utf8(path);
+    ipc_validation_detail_set("%s: %s", path_utf8 ? path_utf8 : "<path>", message);
+    free(path_utf8);
+}
+
 static wchar_t *wide_copy(const wchar_t *value) {
     if (!value) {
         return NULL;
@@ -4218,17 +4424,120 @@ static bool win_sid_is_trusted_installer(const uint8_t *sid, size_t sid_length)
     return true;
 }
 
+/* #1705: the built-in Administrator ACCOUNT of THIS machine — RID 500 under the
+ * local machine's own account-domain SID (S-1-5-21-<machine>-500) — is a
+ * legitimate owner/grantee of directories an elevated install created, even when
+ * that account has been renamed or is disabled. It is resolved by asking LSA for
+ * the local machine account-domain SID and synthesizing its RID-500 SID with
+ * CreateWellKnownSid, then compared with EqualSid.
+ *
+ * It is deliberately NOT tested with IsWellKnownSid(sid, WinAccountAdministratorSid)
+ * and NOT by matching a trailing RID of 500: BOTH of those accept ANY domain's
+ * -500 — a domain administrator, or another machine's built-in Administrator —
+ * which is exactly the cross-machine trust escalation this must never open. Only
+ * THIS machine's -500 is trusted.
+ *
+ * Resolved once per process and cached; any LSA or synthesis failure leaves the
+ * cache NULL and therefore grants NO tolerance at all (fail closed). advapi32 is
+ * reached through the already-loaded module handle in win_security_t and the
+ * function pointers are resolved dynamically, matching this file's SID-API style
+ * and adding no static import. */
+typedef NTSTATUS(NTAPI *lsa_open_policy_fn)(PLSA_UNICODE_STRING, PLSA_OBJECT_ATTRIBUTES,
+                                            ACCESS_MASK, PLSA_HANDLE);
+typedef NTSTATUS(NTAPI *lsa_query_information_policy_fn)(LSA_HANDLE, POLICY_INFORMATION_CLASS,
+                                                         PVOID *);
+typedef NTSTATUS(NTAPI *lsa_free_memory_fn)(PVOID);
+typedef NTSTATUS(NTAPI *lsa_close_fn)(LSA_HANDLE);
+typedef BOOL(WINAPI *create_well_known_sid_fn)(WELL_KNOWN_SID_TYPE, PSID, PSID, DWORD *);
+
+static INIT_ONCE g_local_admin_sid_once = INIT_ONCE_STATIC_INIT;
+static PSID g_local_admin_sid = NULL; /* process-lifetime cache; NULL => no tolerance */
+
+static BOOL CALLBACK win_resolve_local_admin_sid(PINIT_ONCE once, PVOID parameter, PVOID *context) {
+    (void)once;
+    (void)context;
+    win_security_t *security = (win_security_t *)parameter;
+    if (!security || !security->advapi) {
+        return TRUE; /* ran once; cache stays NULL (fail closed) */
+    }
+    HMODULE advapi = security->advapi;
+    lsa_open_policy_fn lsa_open =
+        (lsa_open_policy_fn)(void (*)(void))GetProcAddress(advapi, "LsaOpenPolicy");
+    lsa_query_information_policy_fn lsa_query = (lsa_query_information_policy_fn)(void (*)(
+        void))GetProcAddress(advapi, "LsaQueryInformationPolicy");
+    lsa_free_memory_fn lsa_free =
+        (lsa_free_memory_fn)(void (*)(void))GetProcAddress(advapi, "LsaFreeMemory");
+    lsa_close_fn lsa_close = (lsa_close_fn)(void (*)(void))GetProcAddress(advapi, "LsaClose");
+    create_well_known_sid_fn create_sid =
+        (create_well_known_sid_fn)(void (*)(void))GetProcAddress(advapi, "CreateWellKnownSid");
+    if (!lsa_open || !lsa_query || !lsa_free || !lsa_close || !create_sid) {
+        return TRUE;
+    }
+    LSA_OBJECT_ATTRIBUTES attributes;
+    memset(&attributes, 0, sizeof(attributes));
+    LSA_HANDLE policy = NULL;
+    /* STATUS_SUCCESS is 0; any other status (including informational positives) is
+     * treated as failure, keeping the outcome fail-closed. */
+    if (lsa_open(NULL, &attributes, POLICY_VIEW_LOCAL_INFORMATION, &policy) != 0 || !policy) {
+        return TRUE;
+    }
+    POLICY_ACCOUNT_DOMAIN_INFO *domain = NULL;
+    if (lsa_query(policy, PolicyAccountDomainInformation, (PVOID *)&domain) == 0 && domain &&
+        domain->DomainSid && security->is_valid_sid(domain->DomainSid)) {
+        DWORD needed = 0;
+        (void)create_sid(WinAccountAdministratorSid, domain->DomainSid, NULL, &needed);
+        if (needed > 0U) {
+            PSID resolved = malloc(needed);
+            if (resolved &&
+                create_sid(WinAccountAdministratorSid, domain->DomainSid, resolved, &needed) &&
+                security->is_valid_sid(resolved)) {
+                g_local_admin_sid = resolved;
+            } else {
+                free(resolved);
+            }
+        }
+    }
+    if (domain) {
+        (void)lsa_free(domain);
+    }
+    (void)lsa_close(policy);
+    return TRUE;
+}
+
+static PSID win_local_admin_sid(win_security_t *security) {
+    if (!security || !security->advapi) {
+        return NULL;
+    }
+    (void)InitOnceExecuteOnce(&g_local_admin_sid_once, win_resolve_local_admin_sid, (PVOID)security,
+                              NULL);
+    return g_local_admin_sid;
+}
+
 static bool win_sid_trusted(win_security_t *security, PSID sid) {
     if (!security || !sid || !security->is_valid_sid(sid)) {
         return false;
     }
     DWORD sid_length = security->get_length_sid(sid);
+    PSID local_admin = win_local_admin_sid(security);
     return (sid_length > 0U && security->equal_sid(sid, security->user_sid)) ||
            security->is_well_known_sid(sid, WinLocalSystemSid) ||
            security->is_well_known_sid(sid, WinBuiltinAdministratorsSid) ||
+           (local_admin && security->equal_sid(sid, local_admin)) ||
            win_sid_is_trusted_installer((const uint8_t *)sid, (size_t)sid_length);
 }
 
+#ifdef CBM_ENABLE_TEST_SEAMS
+bool cbm_daemon_ipc_win_sid_trusted_for_testing(void *sid) {
+    win_security_t security;
+    if (!win_security_init(&security)) {
+        return false;
+    }
+    bool trusted = win_sid_trusted(&security, (PSID)sid);
+    win_security_destroy(&security);
+    return trusted;
+}
+#endif
+
 /* AppContainer identities: package SIDs (S-1-15-2-*) and capability SIDs
  * (S-1-15-3-*), under the APP_PACKAGE identifier authority (15).
  *
@@ -4587,13 +4896,28 @@ static bool win_runtime_directory_secure(const wchar_t *runtime_dir) {
         return false;
     }
     bool created = CreateDirectoryW(runtime_dir, &security.directory_attributes) != 0;
-    if (!created && GetLastError() != ERROR_ALREADY_EXISTS) {
+    DWORD create_error = created ? ERROR_SUCCESS : GetLastError();
+    if (!created && create_error != ERROR_ALREADY_EXISTS) {
+        char message[96];
+        (void)snprintf(message, sizeof(message),
+                       "could not create the directory (Windows error %lu)",
+                       (unsigned long)create_error);
+        ipc_validation_detail_set_for_path(runtime_dir, message);
         win_security_destroy(&security);
         return false;
     }
     DWORD attributes = GetFileAttributesW(runtime_dir);
     if (attributes == INVALID_FILE_ATTRIBUTES || (attributes & FILE_ATTRIBUTE_DIRECTORY) == 0 ||
         (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
+        /* What already exists at this path is adopted only if it is a plain
+         * directory. Say which rule refused it: the walk in front of this
+         * function tolerates losing a creation race, so this check is what
+         * stands between that tolerance and a planted file or junction. */
+        const char *rule = attributes == INVALID_FILE_ATTRIBUTES ? "cannot be inspected"
+                           : (attributes & FILE_ATTRIBUTE_DIRECTORY) == 0
+                               ? "exists but is not a directory"
+                               : "is a reparse point (junction or symlink)";
+        ipc_validation_detail_set_for_path(runtime_dir, rule);
         win_security_destroy(&security);
         return false;
     }
@@ -4747,8 +5071,35 @@ static bool win_private_directory_tree_secure(const wchar_t *directory_path) {
             DWORD attributes = GetFileAttributesW(path);
             if (attributes == INVALID_FILE_ATTRIBUTES) {
                 DWORD error = GetLastError();
-                ok = (error == ERROR_FILE_NOT_FOUND || error == ERROR_PATH_NOT_FOUND) &&
-                     CreateDirectoryW(path, &security.directory_attributes) != 0;
+                bool absent = error == ERROR_FILE_NOT_FOUND || error == ERROR_PATH_NOT_FOUND;
+                if (absent) {
+                    ipc_win_directory_create_hook_run(path);
+                    /* Several processes first-starting together all observe
+                     * this component absent; one CreateDirectoryW wins and
+                     * the rest get ERROR_ALREADY_EXISTS. Losing that race is
+                     * not a failure -- the directory this process wanted now
+                     * exists, exactly as if it had been there all along. It
+                     * is NOT trusted for that: an ancestor still goes through
+                     * win_directory_component_secure() below, and the final
+                     * component through win_runtime_directory_secure(), which
+                     * refuses a non-directory or reparse point and enforces
+                     * owner and DACL. The POSIX walk tolerates EEXIST at the
+                     * same point for the same reason. */
+                    if (CreateDirectoryW(path, &security.directory_attributes) == 0) {
+                        error = GetLastError();
+                        absent = error == ERROR_ALREADY_EXISTS;
+                    }
+                }
+                ok = absent;
+                if (!ok) {
+                    /* Never a bare "(endpoint)": name the component and the
+                     * Windows error that refused it. */
+                    char message[96];
+                    (void)snprintf(message, sizeof(message),
+                                   "could not create or inspect the directory (Windows error %lu)",
+                                   (unsigned long)error);
+                    ipc_validation_detail_set_for_path(path, message);
+                }
             }
             /* Ancestors are observe-only and must already be secure.  The
              * final current-user directory is intentionally handled below by
@@ -4760,10 +5111,7 @@ static bool win_private_directory_tree_secure(const wchar_t *directory_path) {
                      * at this walk position; the helper set the inner rule. */
                     char inner[384];
                     (void)snprintf(inner, sizeof(inner), "%s", ipc_validation_detail_buffer);
-                    char *component_utf8 = wide_to_utf8(path);
-                    ipc_validation_detail_set(
-                        "%s: %s", component_utf8 ? component_utf8 : "<component>", inner);
-                    free(component_utf8);
+                    ipc_validation_detail_set_for_path(path, inner);
                 }
             }
         }
diff --git a/src/daemon/ipc.h b/src/daemon/ipc.h
index 2c10d458b..545ecb357 100644
--- a/src/daemon/ipc.h
+++ b/src/daemon/ipc.h
@@ -91,9 +91,35 @@ bool cbm_daemon_ipc_private_directory_secure(const char *directory_path);
  * validation refusal (empty string when none). Diagnostic only — callers
  * append it to their error messages; policy decisions never read it. */
 const char *cbm_daemon_ipc_validation_detail(void);
+
+/* This process's most recent listener-publication failure: the stage that
+ * refused, the errno the failing step reported (0 when the step reported
+ * none), and the artifact path it was operating on ("" when no path applies).
+ * Every `daemon.ipc.listen_failed` log line carries the same three fields.
+ * Reset at the start of each listen attempt. Returns false while no failure
+ * has been recorded. Diagnostic only: the daemon host copies it into its
+ * durable start-failure record so a waiting client can name the cause instead
+ * of burning its full startup deadline (#1828). */
+enum {
+    CBM_DAEMON_IPC_LISTEN_FAILURE_STAGE_CAP = 32,
+    CBM_DAEMON_IPC_LISTEN_FAILURE_PATH_CAP = 4096
+};
+typedef struct {
+    char stage[CBM_DAEMON_IPC_LISTEN_FAILURE_STAGE_CAP];
+    int errno_value;
+    char path[CBM_DAEMON_IPC_LISTEN_FAILURE_PATH_CAP];
+} cbm_daemon_ipc_listen_failure_t;
+bool cbm_daemon_ipc_listen_failure_detail(cbm_daemon_ipc_listen_failure_t *out);
 #ifdef CBM_ENABLE_TEST_SEAMS
 /* #1537: seed the detail so a test can prove the CLI refusal surfaces it. */
 void cbm_daemon_ipc_set_validation_detail_for_testing(const char *detail);
+#ifdef _WIN32
+/* #1705: run the daemon's directory-owner/ACE trust predicate against an
+ * arbitrary SID, so a test can assert THIS machine's built-in Administrator
+ * (RID-500) is trusted while a foreign S-1-5-21-*-500 is not. Returns false on
+ * any setup failure. Windows only. */
+bool cbm_daemon_ipc_win_sid_trusted_for_testing(void *sid);
+#endif
 #ifndef _WIN32
 /* #1830 seams (POSIX). Override the single-uid user-namespace overflow uid that
  * ancestors may be owned by (active=false restores the real /proc-derived
@@ -105,6 +131,12 @@ bool cbm_daemon_ipc_posix_uid_map_is_single_uid_for_test(const char *uid_map, un
 bool cbm_daemon_ipc_posix_ancestor_stat_ok_for_test(unsigned long owner, unsigned int mode,
                                                     unsigned long euid, bool overflow_active,
                                                     unsigned long overflow_uid);
+#if defined(__linux__)
+/* Number of REAL overflow-uid derivations so far. The value is meaningless on
+ * its own; the point is that it must rise on every ancestor check, proving no
+ * cache has crept back in. */
+unsigned cbm_daemon_ipc_posix_overflow_compute_count_for_test(void);
+#endif
 #endif
 #endif
 
diff --git a/src/daemon/ipc_internal.h b/src/daemon/ipc_internal.h
index b791a6b02..f481b7378 100644
--- a/src/daemon/ipc_internal.h
+++ b/src/daemon/ipc_internal.h
@@ -95,6 +95,11 @@ typedef void (*cbm_daemon_ipc_posix_publication_hook_fn)(
 void cbm_daemon_ipc_posix_publication_hook_set_for_test(
     cbm_daemon_ipc_posix_publication_hook_fn hook, void *context);
 void cbm_daemon_ipc_windows_legacy_guard_release_failures_set_for_test(unsigned int count);
+/* #1828: while non-zero, every POSIX socket-record publication write fails
+ * with this errno. This is the deterministic stand-in for a full runtime
+ * filesystem (tmpfs ENOSPC): the socket binds, the record file is created,
+ * and only its data write is refused -- exactly the reporter's failure shape. */
+void cbm_daemon_ipc_posix_record_write_failure_set_for_test(int errno_value);
 
 /* Deterministic-interleaving seam: fires on the Windows startup path once the
  * startup lock is held, before the rendezvous handoff. A test parks here to
@@ -105,4 +110,15 @@ void cbm_daemon_ipc_windows_legacy_guard_release_failures_set_for_test(unsigned
 typedef void (*cbm_daemon_ipc_startup_gate_fn)(void *context);
 void cbm_daemon_ipc_startup_gate_set_for_test(cbm_daemon_ipc_startup_gate_fn gate, void *context);
 
+/* Deterministic-interleaving seam for the Windows private-directory walk:
+ * fires after a path component was observed ABSENT and before this process
+ * tries to create it. A test plays the concurrent process that wins that
+ * creation, which pins the cold-start race (N processes first-starting
+ * against a runtime directory that does not exist yet) by construction
+ * instead of by thread timing. `path` is the NUL-terminated component path at
+ * the walk position. No-op off Windows. */
+typedef void (*cbm_daemon_ipc_win_directory_create_hook_fn)(const wchar_t *path, void *context);
+void cbm_daemon_ipc_win_directory_create_hook_set_for_test(
+    cbm_daemon_ipc_win_directory_create_hook_fn hook, void *context);
+
 #endif /* CBM_DAEMON_IPC_INTERNAL_H */
diff --git a/src/daemon/runtime.c b/src/daemon/runtime.c
index 7db0f0225..efa41a020 100644
--- a/src/daemon/runtime.c
+++ b/src/daemon/runtime.c
@@ -49,6 +49,16 @@ void cbm_daemon_runtime_set_containment_hook_for_testing(
     cbm_daemon_runtime_containment_hook_t hook) {
     atomic_store(&runtime_containment_hook_seam, hook);
 }
+
+/* Cold-storm ephemeral-linger seam (2026-09). Overrides the bounded linger
+ * window that ephemeral last-committed-client retirement grants while cohort
+ * participants are still mid-bootstrap, so a test can drive both the linger and
+ * its expiry backstop in test time. UINT32_MAX leaves the production constant;
+ * any other value (0 = expire immediately) overrides. */
+static _Atomic uint32_t runtime_ephemeral_linger_timeout_seam = UINT32_MAX;
+void cbm_daemon_runtime_service_set_ephemeral_linger_timeout_for_testing(uint32_t timeout_ms) {
+    atomic_store(&runtime_ephemeral_linger_timeout_seam, timeout_ms);
+}
 #endif
 
 #ifdef _WIN32
@@ -95,6 +105,14 @@ enum {
      * wedged behind it, and the dead generation held the endpoint pipes and
      * the UI port for nine hours with nothing logged. */
     RUNTIME_ABANDONED_REQUEST_JOIN_TIMEOUT_MS = 30000,
+    /* Cold-storm race (2026-09): when the final committed client of an
+     * ephemeral generation disconnects while cohort participants are still
+     * admitted but mid-bootstrap (racing connect()), the generation lingers
+     * this long for them to connect instead of retiring out from under them.
+     * Mirrors the host initial-client window; the linger is always bounded so
+     * a participant that never connects cannot wedge the generation (the
+     * 900s host_serving hang). */
+    RUNTIME_EPHEMERAL_LINGER_MS = 10000,
     RUNTIME_PATH_CAP = 4096,
 
     RENDEZVOUS_REQUEST_ABI_OFFSET = 0,
@@ -231,6 +249,12 @@ struct cbm_daemon_runtime_service {
     /* Owned only by the convenience start() path. start_reserved() callers
      * retain their externally managed participant guard. */
     cbm_daemon_ipc_participant_guard_t *owned_participant_guard;
+    /* Cold-storm ephemeral-retirement gate (2026-09). When the final committed
+     * client disconnects while cohort participants are still admitted but not
+     * yet committed, the generation lingers until this bounded deadline instead
+     * of retiring; reconcile_lifetime retires it once that window elapses with
+     * no new client committing. Zero means no linger is armed. */
+    uint64_t ephemeral_linger_deadline_ms;
 };
 
 struct cbm_daemon_runtime_worker {
@@ -289,6 +313,16 @@ static uint64_t runtime_deadline_after(uint32_t timeout_ms) {
     return now_ms + (uint64_t)timeout_ms;
 }
 
+static uint32_t runtime_ephemeral_linger_timeout_ms(void) {
+#ifdef CBM_ENABLE_TEST_SEAMS
+    uint32_t seam = atomic_load(&runtime_ephemeral_linger_timeout_seam);
+    if (seam != UINT32_MAX) {
+        return seam;
+    }
+#endif
+    return RUNTIME_EPHEMERAL_LINGER_MS;
+}
+
 static void runtime_wait_tick(uint64_t deadline_ms) {
     uint64_t now_ms = cbm_now_ms();
     if (now_ms >= deadline_ms) {
@@ -1174,10 +1208,32 @@ static void runtime_service_interrupt_connections(cbm_daemon_runtime_service_t *
     runtime_service_interrupt_connections_except(service, NULL, false);
 }
 
+/* A cold-storm racer is a connection that has been ACCEPTED but has not yet
+ * passed HELLO admission (in_use with a live connection, not yet admitted, not
+ * tearing down) -- a one-shot client still mid-bootstrap. This deliberately
+ * does NOT count an already-admitted provisional session (HELLO done, app
+ * session opening): a provisional coordinator client must not keep a retiring
+ * generation alive (see runtime_worker_disconnect below and the
+ * daemon_runtime_final_disconnect_rejects_blocked_provisional_session guard).
+ * Caller holds service->mutex. `except` excludes the departing worker. */
+static bool runtime_has_pending_hello_peer_locked(const cbm_daemon_runtime_service_t *service,
+                                                  const cbm_daemon_runtime_worker_t *except) {
+    for (size_t i = 0; i < service->worker_capacity; i++) {
+        const cbm_daemon_runtime_worker_t *worker = &service->workers[i];
+        if (worker != except && worker->in_use && worker->connection && !worker->admitted &&
+            !atomic_load_explicit(&worker->disconnecting, memory_order_acquire)) {
+            return true;
+        }
+    }
+    return false;
+}
+
 static void runtime_worker_disconnect(cbm_daemon_runtime_worker_t *worker) {
     cbm_daemon_runtime_service_t *service = worker->service;
     cbm_daemon_client_id_t client_id = CBM_DAEMON_CLIENT_ID_INVALID;
     uint64_t shutdown_deadline = runtime_deadline_after(service->shutdown_timeout_ms);
+    bool last_committed_left = false;
+    bool linger_armed = false;
     atomic_store_explicit(&worker->disconnecting, true, memory_order_release);
     cbm_mutex_lock(&service->mutex);
     if (worker->admitted) {
@@ -1195,14 +1251,47 @@ static void runtime_worker_disconnect(cbm_daemon_runtime_worker_t *worker) {
              * alive after the final fully committed frontend disconnects.
              * A permanent generation (`daemon start`) deliberately survives
              * this: only the stop/drain ops or a process kill end it. */
-            runtime_service_begin_stopping_locked(service, shutdown_deadline, false,
-                                                  "last_committed_client_disconnected");
+            last_committed_left = true;
+            /* Cold-storm race (2026-09): if another connection is already
+             * accepted and still mid-HELLO (not yet admitted) when the last
+             * committed client leaves, it is a one-shot peer racing to commit —
+             * retiring now strands it on a STOPPING daemon and forces a full
+             * cold respawn ("cold-storm client failed (racing daemon spawn)").
+             * Linger a bounded window for it; the accept loop retires the
+             * generation once that racer drains without committing or the window
+             * elapses, and a racer that does commit clears the linger
+             * (runtime_worker_commit_admission). This deliberately lingers ONLY
+             * for a pre-HELLO racer, never for an already-admitted provisional
+             * session (HELLO done, app session opening): the contract that a
+             * provisional coordinator client cannot keep a retiring generation
+             * alive is preserved (the reject-blocked-provisional-session guard).
+             * With no such racer — the common single-client case — retire
+             * immediately, unchanged. (A cross-process cohort peer count is
+             * unavailable: advisory locks expose presence, not a holder count,
+             * and Windows LockFileEx has no non-owning probe.) */
+            if (runtime_has_pending_hello_peer_locked(service, worker)) {
+                service->ephemeral_linger_deadline_ms =
+                    runtime_deadline_after(runtime_ephemeral_linger_timeout_ms());
+                linger_armed = true;
+            } else {
+                service->ephemeral_linger_deadline_ms = 0;
+                runtime_service_begin_stopping_locked(service, shutdown_deadline, false,
+                                                      "last_committed_client_disconnected");
+            }
         }
     }
     cbm_mutex_unlock(&service->mutex);
     if (client_id == CBM_DAEMON_CLIENT_ID_INVALID) {
         return;
     }
+    /* Set the coordinator hold BEFORE releasing this client so its last-client
+     * self-transition to STOPPING is suppressed while a racing peer is still
+     * mid-HELLO; when no peer is present the hold stays clear so the release
+     * retires the coordinator normally. last_committed_left implies a committed (hence
+     * admitted) client, so client_id is always valid here. */
+    if (last_committed_left) {
+        cbm_daemon_coordinator_set_linger(service->coordinator, linger_armed);
+    }
     (void)cbm_daemon_client_disconnected(service->coordinator, client_id, cbm_now_ms());
     if (worker->application_session_opened && !worker->application_cancelled) {
         worker->application_cancelled = true;
@@ -1250,8 +1339,18 @@ static bool runtime_worker_commit_admission(cbm_daemon_runtime_worker_t *worker)
     if (committed) {
         worker->admission_committed = true;
         service->committed_clients++;
+        /* A freshly committed client ends any last-client linger window; the
+         * next drop to zero re-arms it against the participants outstanding
+         * then. */
+        service->ephemeral_linger_deadline_ms = 0;
     }
     cbm_mutex_unlock(&service->mutex);
+    if (committed) {
+        /* Mirror the cleared linger onto the coordinator. client_count is
+         * already nonzero (admission incremented it), so this only resets the
+         * hold for the next idle window — it never retires a live coordinator. */
+        cbm_daemon_coordinator_set_linger(service->coordinator, false);
+    }
     return committed;
 }
 
@@ -2183,6 +2282,11 @@ static void *runtime_accept_loop(void *opaque) {
             continue;
         }
 
+        /* Self-retire a generation lingering for a cold-storm peer once the peer
+         * drains or the bounded window elapses, without an external driver. A
+         * no-op unless a last-committed-client linger is armed. */
+        cbm_daemon_runtime_service_reconcile_lifetime(service);
+
         cbm_daemon_ipc_connection_t *connection = NULL;
         int accepted =
             cbm_daemon_ipc_accept(service->listener, RUNTIME_ACCEPT_POLL_MS, &connection);
@@ -2474,6 +2578,36 @@ size_t cbm_daemon_runtime_service_active_connections(cbm_daemon_runtime_service_
     return count;
 }
 
+void cbm_daemon_runtime_service_reconcile_lifetime(cbm_daemon_runtime_service_t *service) {
+    if (!service) {
+        return;
+    }
+    bool retired = false;
+    cbm_mutex_lock(&service->mutex);
+    if (service->state == CBM_DAEMON_RUNTIME_SERVICE_RUNNING && !service->permanent &&
+        service->committed_clients == 0 && service->ephemeral_linger_deadline_ms != 0) {
+        bool peers_drained = !runtime_has_pending_hello_peer_locked(service, NULL);
+        bool window_elapsed = cbm_now_ms() >= service->ephemeral_linger_deadline_ms;
+        if (peers_drained || window_elapsed) {
+            /* The racing peer drained without committing (retire now), or never
+             * committed within the bounded window (the backstop that rules out
+             * an unbounded idle hang — the host_serving 900s mode). */
+            service->ephemeral_linger_deadline_ms = 0;
+            runtime_service_begin_stopping_locked(
+                service, runtime_deadline_after(service->shutdown_timeout_ms), false,
+                peers_drained ? "ephemeral_peer_drained" : "ephemeral_linger_expired");
+            retired = true;
+        }
+    }
+    cbm_mutex_unlock(&service->mutex);
+    if (retired) {
+        /* Release the coordinator hold now that the linger has resolved. With
+         * no client left this transitions the coordinator to STOPPING, so the
+         * service drains and exits cleanly rather than only on the deadline. */
+        cbm_daemon_coordinator_set_linger(service->coordinator, false);
+    }
+}
+
 size_t cbm_daemon_runtime_service_job_subscribers(cbm_daemon_runtime_service_t *service,
                                                   const char *project_key) {
     return service ? cbm_daemon_job_subscribers(service->coordinator, project_key) : 0;
diff --git a/src/daemon/runtime.h b/src/daemon/runtime.h
index 4d53da9a4..7a31dab61 100644
--- a/src/daemon/runtime.h
+++ b/src/daemon/runtime.h
@@ -329,6 +329,13 @@ uint64_t cbm_daemon_runtime_service_clients_admitted_total(cbm_daemon_runtime_se
 /* Includes accepted connections still waiting for HELLO. Never exceeds the
  * configured max_clients; over-cap peers receive REJECTED before close. */
 size_t cbm_daemon_runtime_service_active_connections(cbm_daemon_runtime_service_t *service);
+
+/* Re-evaluate an ephemeral generation that is lingering after its last committed
+ * client disconnected (the bounded cold-storm debounce). Retires it once the
+ * linger window elapses with no new client committing; the bound also rules out
+ * an unbounded idle hang. The host lifetime loop calls this every tick; it is a
+ * no-op unless a last-committed-client linger is armed. */
+void cbm_daemon_runtime_service_reconcile_lifetime(cbm_daemon_runtime_service_t *service);
 size_t cbm_daemon_runtime_service_job_subscribers(cbm_daemon_runtime_service_t *service,
                                                   const char *project_key);
 uint64_t cbm_daemon_runtime_service_client_process_id(cbm_daemon_runtime_service_t *service,
@@ -441,6 +448,12 @@ typedef void (*cbm_daemon_runtime_containment_hook_t)(const char *component);
 void cbm_daemon_runtime_set_abandoned_request_join_timeout_for_testing(uint32_t timeout_ms);
 void cbm_daemon_runtime_set_containment_hook_for_testing(
     cbm_daemon_runtime_containment_hook_t hook);
+/* Cold-storm ephemeral-linger seam (2026-09). Overrides the bounded linger
+ * window the last-committed-client retirement grants while cohort participants
+ * are mid-bootstrap, so a test drives both the linger and its expiry backstop
+ * in test time. UINT32_MAX restores the production constant; any other value
+ * (0 = expire immediately) overrides. Process-global; reset it after use. */
+void cbm_daemon_runtime_service_set_ephemeral_linger_timeout_for_testing(uint32_t timeout_ms);
 #endif
 
 #endif /* CBM_DAEMON_RUNTIME_H */
diff --git a/src/discover/discover.c b/src/discover/discover.c
index c10d345f1..383d1438a 100644
--- a/src/discover/discover.c
+++ b/src/discover/discover.c
@@ -13,6 +13,7 @@
 
 #include "foundation/constants.h"
 #include "foundation/compat_fs.h"
+#include "foundation/limits.h"
 #include "foundation/workspace.h"
 #include "foundation/platform.h"
 #ifdef _WIN32
@@ -414,6 +415,10 @@ typedef struct {
     int capacity;
     int max_files;
     uint64_t deadline_ms;
+    const cbm_index_resource_policy_t *resource_policy;
+    cbm_index_resource_violation_t *resource_violation;
+    uint64_t source_files;
+    uint64_t source_bytes;
     bool count_only;
     bool collect_excluded;
     bool limit_exceeded;
@@ -435,6 +440,21 @@ typedef struct {
     int ignored_total;
 } file_list_t;
 
+static void file_list_resource_violation(file_list_t *fl, cbm_index_resource_t resource,
+                                         uint64_t observed, uint64_t limit) {
+    if (!fl || fl->limit_exceeded || fl->failed) {
+        return;
+    }
+    fl->limit_exceeded = true;
+    if (fl->resource_violation) {
+        *fl->resource_violation = (cbm_index_resource_violation_t){
+            .resource = resource,
+            .observed = observed,
+            .limit = limit,
+        };
+    }
+}
+
 static bool file_list_should_stop(file_list_t *fl) {
     if (!fl) {
         return true;
@@ -504,6 +524,28 @@ static void fl_add(file_list_t *fl, const char *abs_path, const char *rel_path,
         fl->limit_exceeded = true;
         return;
     }
+    uint64_t source_size = size > 0 ? (uint64_t)size : 0;
+    bool resource_accepted = fl->resource_policy && source_size <= (uint64_t)cbm_max_file_bytes();
+    if (resource_accepted) {
+        if (fl->resource_policy->max_files.enabled &&
+            fl->source_files >= fl->resource_policy->max_files.value) {
+            file_list_resource_violation(fl, CBM_INDEX_RESOURCE_FILES, fl->source_files + 1U,
+                                         fl->resource_policy->max_files.value);
+            return;
+        }
+        if (fl->resource_policy->max_source_bytes.enabled) {
+            uint64_t limit = fl->resource_policy->max_source_bytes.value;
+            if (source_size > limit || fl->source_bytes > limit - source_size) {
+                uint64_t observed = source_size > UINT64_MAX - fl->source_bytes
+                                        ? UINT64_MAX
+                                        : fl->source_bytes + source_size;
+                file_list_resource_violation(fl, CBM_INDEX_RESOURCE_SOURCE_BYTES, observed, limit);
+                return;
+            }
+            fl->source_bytes += source_size;
+        }
+        fl->source_files++;
+    }
     if (fl->count_only) {
         fl->count++;
         return;
@@ -1364,6 +1406,9 @@ static cbm_discover_status_t discover_impl(const char *repo_path, const cbm_disc
     if (ignored_total_out) {
         *ignored_total_out = 0;
     }
+    if (opts && opts->resource_violation) {
+        *opts->resource_violation = (cbm_index_resource_violation_t){0};
+    }
     if (!repo_path || !out || !count || (count_only && max_files < 0)) {
         return CBM_DISCOVER_ERROR;
     }
@@ -1472,6 +1517,8 @@ static cbm_discover_status_t discover_impl(const char *repo_path, const cbm_disc
     file_list_t fl = {
         .max_files = count_only ? max_files : -1,
         .deadline_ms = count_only ? deadline_ms : 0,
+        .resource_policy = opts ? opts->resource_policy : NULL,
+        .resource_violation = opts ? opts->resource_violation : NULL,
         .count_only = count_only,
         .collect_excluded = !count_only && excluded_out != NULL,
         .collect_ignored = !count_only && ignored_out != NULL,
@@ -1495,11 +1542,11 @@ static cbm_discover_status_t discover_impl(const char *repo_path, const cbm_disc
         }
         return fl.limit_exceeded ? CBM_DISCOVER_LIMIT_EXCEEDED : CBM_DISCOVER_OK;
     }
-    if (fl.failed) {
+    if (fl.failed || fl.limit_exceeded) {
         cbm_discover_free(fl.files, fl.count);
         cbm_discover_free_excluded(fl.excluded, fl.excluded_count);
         cbm_discover_free_ignored(fl.ignored, fl.ignored_count);
-        return CBM_DISCOVER_ERROR;
+        return fl.limit_exceeded ? CBM_DISCOVER_LIMIT_EXCEEDED : CBM_DISCOVER_ERROR;
     }
 
     *out = fl.files;
diff --git a/src/discover/discover.h b/src/discover/discover.h
index b15844340..fb8d7b5e6 100644
--- a/src/discover/discover.h
+++ b/src/discover/discover.h
@@ -17,6 +17,7 @@
 
 /* Use the existing CBMLanguage enum from extraction layer */
 #include "cbm.h"
+#include "foundation/index_policy.h"
 
 /* ── Language detection ──────────────────────────────────────────── */
 
@@ -143,9 +144,11 @@ typedef struct {
 } cbm_file_info_t;
 
 typedef struct {
-    cbm_index_mode_t mode;   /* CBM_MODE_FULL or CBM_MODE_FAST */
-    const char *ignore_file; /* path to .cbmignore file, or NULL */
-    int64_t max_file_size;   /* 0 = no limit */
+    cbm_index_mode_t mode;                              /* discovery filtering mode */
+    const char *ignore_file;                            /* .cbmignore path, or NULL */
+    int64_t max_file_size;                              /* 0 = no per-file limit */
+    const cbm_index_resource_policy_t *resource_policy; /* NULL = no resource limits */
+    cbm_index_resource_violation_t *resource_violation; /* optional exact diagnostic */
 } cbm_discover_opts_t;
 
 typedef enum {
diff --git a/src/discover/language.c b/src/discover/language.c
index e61a07c43..c9d92719a 100644
--- a/src/discover/language.c
+++ b/src/discover/language.c
@@ -321,6 +321,28 @@ static const ext_entry_t EXT_TABLE[] = {
     {".xsd", CBM_LANG_XML},
     {".xsl", CBM_LANG_XML},
     {".svg", CBM_LANG_XML},
+    /* MSBuild project system. Plain XML documents, and the files that carry a
+     * .NET repository's package references, target frameworks, build hooks and
+     * project layout — none of which were reachable while these were unmapped. */
+    {".csproj", CBM_LANG_XML},
+    {".vbproj", CBM_LANG_XML},
+    {".fsproj", CBM_LANG_XML},
+    {".props", CBM_LANG_XML},
+    {".targets", CBM_LANG_XML},
+    {".nuspec", CBM_LANG_XML},
+    {".slnx", CBM_LANG_XML},
+    {".runsettings", CBM_LANG_XML},
+    /* .NET resource files: the localized strings a UI reads back by key. */
+    {".resx", CBM_LANG_XML},
+    /* XAML views: WPF, WinUI, MAUI (.xaml) and Avalonia (.axaml). */
+    {".xaml", CBM_LANG_XML},
+    {".axaml", CBM_LANG_XML},
+    /* Application manifests: Apple property lists and privacy manifests, Win32
+     * side-by-side manifests and MSIX packages. */
+    {".plist", CBM_LANG_XML},
+    {".xcprivacy", CBM_LANG_XML},
+    {".manifest", CBM_LANG_XML},
+    {".appxmanifest", CBM_LANG_XML},
 
     /* YAML */
     {".yaml", CBM_LANG_YAML},
diff --git a/src/foundation/arena.c b/src/foundation/arena.c
index 3ae0b9a83..7d16f1043 100644
--- a/src/foundation/arena.c
+++ b/src/foundation/arena.c
@@ -11,44 +11,129 @@
  */
 #include "arena.h"
 #include "foundation/constants.h"
+#include "foundation/mem_core.h"
+#include "foundation/mem_events.h"
 
 enum { ARENA_ALIGN = 7, ARENA_GROW_OK = 1 };
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
+#if defined(__APPLE__)
+#include <pthread.h>
+#include <xlocale.h>
+#endif
 #include <stdio.h>
 
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+/* Capacity against use for the life of an arena, reported when it resets or
+ * dies: bytes left at the end of every block it moved past, the unused rest of
+ * the block it stopped in, and blocks it owned but never reached. */
+static void arena_waste_report(const CBMArena *a) {
+    if (!a || a->nblocks == 0 || !cbm_memev_enabled()) {
+        return;
+    }
+    uint64_t capacity = 0;
+    uint64_t unreached = 0;
+    for (int i = 0; i < a->nblocks; i++) {
+        capacity += a->block_sizes[i];
+        if (i > a->cur) {
+            unreached += a->block_sizes[i];
+        }
+    }
+    uint64_t current_rest = a->block_size > a->used ? a->block_size - a->used : 0;
+    uint64_t wasted = a->waste_tail + current_rest + unreached;
+    uint64_t used = capacity > wasted ? capacity - wasted : 0;
+    cbm_memev_container(CBM_WORK_CT_ARENA, a->waste_site, capacity, used, (uint64_t)a->waste_grows);
+}
+#define ARENA_SITE() __builtin_return_address(0)
+#else
+#define arena_waste_report(a) ((void)0)
+#define ARENA_SITE() NULL
+#endif
+
+static void arena_init_at(CBMArena *a, size_t block_size, void *site);
+
 void cbm_arena_init(CBMArena *a) {
-    cbm_arena_init_sized(a, CBM_ARENA_DEFAULT_BLOCK_SIZE);
+    arena_init_at(a, CBM_ARENA_DEFAULT_BLOCK_SIZE, ARENA_SITE());
 }
 
 void cbm_arena_init_sized(CBMArena *a, size_t block_size) {
+    arena_init_at(a, block_size, ARENA_SITE());
+}
+
+static void arena_init_at(CBMArena *a, size_t block_size, void *site) {
     memset(a, 0, sizeof(*a));
+    a->waste_site = site;
     if (block_size < CBM_SZ_64) {
         block_size = CBM_SZ_64; /* minimum sanity */
     }
     a->block_size = block_size;
-    a->blocks[0] = (char *)malloc(block_size);
+    a->grow_size = block_size * PAIR_LEN;
+    a->blocks[0] = (char *)cbm_alloc(CBM_MEM_CLASS_ARENA, block_size);
     if (a->blocks[0]) {
         a->block_sizes[0] = block_size;
         a->nblocks = SKIP_ONE;
     }
 }
 
+void cbm_arena_init_lazy(CBMArena *a, size_t block_size) {
+    memset(a, 0, sizeof(*a));
+    a->waste_site = ARENA_SITE();
+    if (block_size < CBM_SZ_64) {
+        block_size = CBM_SZ_64; /* minimum sanity */
+    }
+    a->grow_size = block_size; /* the opening block; arena_grow doubles from there */
+}
+
+void cbm_arena_init_exact(CBMArena *a, size_t bytes) {
+    size_t block = (bytes + ARENA_ALIGN) & ~(size_t)ARENA_ALIGN;
+    arena_init_at(a, block, ARENA_SITE());
+    a->grow_size = CBM_ARENA_APPEND_BLOCK;
+    /* An exact block is a compacted result's image and may be written to
+     * disk whole (result_spill): the alignment gaps between objects and the
+     * padding inside structs are never written by the copy, and MemorySanitizer
+     * refuses an fwrite of uninitialized bytes (CI MSan lane on #2202, offset
+     * 4087 of a 6,952-byte block). Zeroed once here, every byte of the image
+     * is defined; the cost is one pass over memory the copy is about to touch. */
+    if (a->blocks[0]) {
+        memset(a->blocks[0], 0, a->block_sizes[0]);
+    }
+}
+
 static int arena_grow(CBMArena *a, size_t min_size) {
+    /* A rewound arena still owns blocks past the cursor: use the next one if
+     * it fits, otherwise drop it and everything after it and grow fresh. */
+    a->waste_tail += a->block_size > a->used ? a->block_size - a->used : 0;
+    if (a->cur + SKIP_ONE < a->nblocks && a->blocks[a->cur + SKIP_ONE]) {
+        if (a->block_sizes[a->cur + SKIP_ONE] >= min_size) {
+            a->cur++;
+            a->block_size = a->block_sizes[a->cur];
+            a->used = 0;
+            return ARENA_GROW_OK;
+        }
+        for (int i = a->cur + SKIP_ONE; i < a->nblocks; i++) {
+            cbm_free(CBM_MEM_CLASS_ARENA, a->blocks[i]);
+            a->blocks[i] = NULL;
+            a->block_sizes[i] = 0;
+        }
+        a->nblocks = a->cur + SKIP_ONE;
+    }
     if (a->nblocks >= CBM_ARENA_MAX_BLOCKS) {
         return 0;
     }
-    size_t new_size = a->block_size * PAIR_LEN;
+    size_t new_size = a->grow_size;
     if (new_size < min_size) {
         new_size = min_size;
     }
-    char *block = (char *)malloc(new_size);
+    a->grow_size = new_size * PAIR_LEN;
+    char *block = (char *)cbm_alloc(CBM_MEM_CLASS_ARENA, new_size);
     if (!block) {
         return 0;
     }
     a->blocks[a->nblocks] = block;
     a->block_sizes[a->nblocks] = new_size;
+    a->waste_grows++;
+    a->cur = a->nblocks;
     a->nblocks++;
     a->block_size = new_size;
     a->used = 0;
@@ -62,14 +147,19 @@ void *cbm_arena_alloc(CBMArena *a, size_t n) {
     /* 8-byte alignment */
     n = (n + ARENA_ALIGN) & ~(size_t)ARENA_ALIGN;
     if (a->nblocks == 0) {
-        return NULL;
+        /* A lazy arena opens here. A zeroed or destroyed one has no grow size
+         * and stays closed. */
+        if (a->grow_size == 0 || !arena_grow(a, n)) {
+            return NULL;
+        }
+        a->waste_grows = 0; /* the opening block is the arena's first, not a growth */
     }
     if (a->used + n > a->block_size) {
         if (!arena_grow(a, n)) {
             return NULL;
         }
     }
-    char *ptr = a->blocks[a->nblocks - SKIP_ONE] + a->used;
+    char *ptr = a->blocks[a->cur] + a->used;
     a->used += n;
     a->total_alloc += n;
     return ptr;
@@ -107,10 +197,53 @@ char *cbm_arena_strndup(CBMArena *a, const char *s, size_t len) {
     return dst;
 }
 
+/* On macOS every vsnprintf consults the process locale under an unfair lock
+ * (localeconv_l inside __vfprintf). Eighteen workers formatting type names
+ * collapsed into that lock on the C# corpus -- the 10 MB JIT test files took
+ * 68 s each instead of under a second (sampled 2026-09-14) -- and the old
+ * two-pass form paid it twice per string. Each thread formats with a C locale
+ * object of its own, so no thread ever waits for another, and the common
+ * short string is formatted once into a stack buffer. */
+#if defined(__APPLE__)
+/* One locale object per thread, freed when the thread exits: the object is
+ * heap memory that the thread-local pointer alone kept, so every worker
+ * thread that ever formatted a name leaked 1,472 bytes at exit (the macOS
+ * LSan lane on PR #2202, 16-101 objects per test process). A pthread key
+ * destructor is the one hook that runs at thread exit for a TLS-held
+ * resource; the main thread keeps its locale until process exit. */
+static _Thread_local locale_t tl_c_locale;
+static pthread_key_t tl_c_locale_key;
+static pthread_once_t tl_c_locale_once = PTHREAD_ONCE_INIT;
+static void arena_c_locale_free(void *loc) {
+    if (loc) {
+        freelocale((locale_t)loc);
+    }
+}
+static void arena_c_locale_key_init(void) {
+    (void)pthread_key_create(&tl_c_locale_key, arena_c_locale_free);
+}
+static locale_t arena_c_locale(void) {
+    if (!tl_c_locale) {
+        tl_c_locale = newlocale(LC_ALL_MASK, "C", NULL);
+        if (tl_c_locale) {
+            pthread_once(&tl_c_locale_once, arena_c_locale_key_init);
+            (void)pthread_setspecific(tl_c_locale_key, tl_c_locale);
+        }
+    }
+    return tl_c_locale; /* NULL = the global locale, the pre-fix behaviour */
+}
+#define ARENA_VSNPRINTF(buf, n, fmt, ap) vsnprintf_l((buf), (n), arena_c_locale(), (fmt), (ap))
+#else
+#define ARENA_VSNPRINTF(buf, n, fmt, ap) vsnprintf((buf), (n), (fmt), (ap))
+#endif
+
+enum { ARENA_SPRINTF_LOCAL = 512 };
+
 char *cbm_arena_sprintf(CBMArena *a, const char *fmt, ...) {
+    char local[ARENA_SPRINTF_LOCAL];
     va_list args;
     va_start(args, fmt);
-    int needed = vsnprintf(NULL, 0, fmt, args);
+    int needed = ARENA_VSNPRINTF(local, sizeof(local), fmt, args);
     va_end(args);
     if (needed < 0) {
         return NULL;
@@ -120,35 +253,66 @@ char *cbm_arena_sprintf(CBMArena *a, const char *fmt, ...) {
     if (!dst) {
         return NULL;
     }
+    if ((size_t)needed < sizeof(local)) {
+        memcpy(dst, local, (size_t)needed + SKIP_ONE);
+        return dst;
+    }
 
     va_start(args, fmt);
-    vsnprintf(dst, (size_t)needed + SKIP_ONE, fmt, args);
+    ARENA_VSNPRINTF(dst, (size_t)needed + SKIP_ONE, fmt, args);
     va_end(args);
     return dst;
 }
 
+void cbm_arena_rewind(CBMArena *a) {
+    if (!a || a->nblocks == 0) {
+        return;
+    }
+    arena_waste_report(a);
+    a->waste_tail = 0;
+    a->waste_grows = 0;
+    a->cur = 0;
+    a->block_size = a->block_sizes[0];
+    a->used = 0;
+    a->total_alloc = 0;
+}
+
+size_t cbm_arena_capacity(const CBMArena *a) {
+    size_t total = 0;
+    for (int i = 0; a && i < a->nblocks; i++) {
+        total += a->block_sizes[i];
+    }
+    return total;
+}
+
 void cbm_arena_reset(CBMArena *a) {
+    arena_waste_report(a);
+    a->waste_tail = 0;
+    a->waste_grows = 0;
     /* Keep first block, free the rest */
     for (int i = SKIP_ONE; i < a->nblocks; i++) {
-        free(a->blocks[i]);
+        cbm_free(CBM_MEM_CLASS_ARENA, a->blocks[i]);
         a->blocks[i] = NULL;
         a->block_sizes[i] = 0;
     }
     if (a->nblocks > SKIP_ONE) {
         a->nblocks = SKIP_ONE;
     }
+    a->cur = 0;
     a->used = 0;
     a->total_alloc = 0;
     /* Reset block_size to match surviving block — prevents overflow if
      * block_size grew during previous allocations (e.g., CBM_SZ_128 → CBM_SZ_256). */
     if (a->nblocks == SKIP_ONE) {
         a->block_size = a->block_sizes[0];
+        a->grow_size = a->block_size * PAIR_LEN;
     }
 }
 
 void cbm_arena_destroy(CBMArena *a) {
+    arena_waste_report(a);
     for (int i = 0; i < a->nblocks; i++) {
-        free(a->blocks[i]);
+        cbm_free(CBM_MEM_CLASS_ARENA, a->blocks[i]);
     }
     memset(a, 0, sizeof(*a));
 }
diff --git a/src/foundation/arena.h b/src/foundation/arena.h
index 663f07459..7f6b5dac6 100644
--- a/src/foundation/arena.h
+++ b/src/foundation/arena.h
@@ -24,6 +24,14 @@ typedef struct {
     size_t block_size;  /* current block capacity */
     size_t used;        /* bytes used in current block */
     size_t total_alloc; /* cumulative bytes allocated (for stats) */
+    size_t grow_size;   /* size of the NEXT block added; doubles per growth */
+    int cur;            /* index of the block allocations come from (rewind sets 0) */
+    /* Waste sanitizer (mem_events.h): where the arena was created and how many
+     * bytes were left behind at the end of blocks it moved past. Present in
+     * every build so the struct is the same in every translation unit. */
+    void *waste_site;
+    size_t waste_tail;
+    size_t waste_grows; /* fresh blocks allocated since the last report */
 } CBMArena;
 
 /* Initialize arena with default block size. */
@@ -32,6 +40,30 @@ void cbm_arena_init(CBMArena *a);
 /* Initialize arena with a custom initial block size. */
 void cbm_arena_init_sized(CBMArena *a, size_t block_size);
 
+/* Initialize an arena that holds no memory until its first allocation, which
+ * opens a first block of `block_size` (later blocks double as usual). For an
+ * arena many callers create and most never use: the per-file extraction
+ * scratch opened a 512 KB block for every file, and 3.3 GB of those blocks were
+ * never read or written on the Go corpus (waste sanitizer access lane,
+ * 2026-09-17). A zeroed or destroyed arena stays closed: allocating from it
+ * still returns NULL. */
+void cbm_arena_init_lazy(CBMArena *a, size_t block_size);
+
+/* The block an exact arena takes when something appends to it after the fact:
+ * the cross-file LSP pass adds a few resolved calls to a compacted result, so
+ * a 64 KB default block was ~60 KB of untouched memory per appended-to result
+ * and 0.5 GB of the worker's peak on the Go corpus (waste sanitizer,
+ * 2026-09-17). It doubles from here like any other arena. */
+#define CBM_ARENA_APPEND_BLOCK ((size_t)8 * 1024)
+
+/* Initialize an arena as ONE block of exactly `bytes` (rounded to alignment),
+ * with later growth restarting at CBM_ARENA_APPEND_BLOCK rather than doubling
+ * the exact block. This is the compaction target: a result whose reachable
+ * data measures N bytes lands in one N-byte block with no tail, and a later
+ * append (the cross-file LSP pass adds resolved calls) costs one small block,
+ * not 2N. */
+void cbm_arena_init_exact(CBMArena *a, size_t bytes);
+
 /* Allocate n bytes (8-byte aligned). Returns NULL on OOM. */
 void *cbm_arena_alloc(CBMArena *a, size_t n);
 
@@ -50,6 +82,14 @@ char *cbm_arena_sprintf(CBMArena *a, const char *fmt, ...) __attribute__((format
 /* Reset arena for reuse: keeps first block, frees the rest. */
 void cbm_arena_reset(CBMArena *a);
 
+/* Rewind: keep EVERY block, start allocating from the first one again. The
+ * pages stay mapped and are overwritten by the next use -- no free, no
+ * purge, no re-commit. This is what a per-worker working arena wants between
+ * files: the same addresses reused directly. cbm_arena_capacity() says how
+ * much such an arena holds, so a caller can drop an outsized one. */
+void cbm_arena_rewind(CBMArena *a);
+size_t cbm_arena_capacity(const CBMArena *a);
+
 /* Free all blocks. Arena is zeroed after this. */
 void cbm_arena_destroy(CBMArena *a);
 
diff --git a/src/foundation/compat.c b/src/foundation/compat.c
index 74c25bd8e..94e7020bd 100644
--- a/src/foundation/compat.c
+++ b/src/foundation/compat.c
@@ -316,6 +316,30 @@ int cbm_clock_gettime(int clk_id, struct timespec *tp) {
 }
 #endif
 
+/* ── Per-thread CPU time ──────────────────────────────────────── */
+
+uint64_t cbm_thread_cpu_time_ns(void) {
+#ifdef _WIN32
+    FILETIME creation, exit_time, kernel, user;
+    if (!GetThreadTimes(GetCurrentThread(), &creation, &exit_time, &kernel, &user)) {
+        return 0;
+    }
+    /* kernel/user each carry a 64-bit count of 100-ns ticks split across a
+     * FILETIME's two DWORDs; recombine, sum, and scale to nanoseconds. The
+     * shift-combine avoids casting to ULARGE_INTEGER (alignment-unsafe per
+     * MSDN, and its union members trip cppcheck's unreadVariable). */
+    uint64_t kernel_ticks = ((uint64_t)kernel.dwHighDateTime << 32) | kernel.dwLowDateTime;
+    uint64_t user_ticks = ((uint64_t)user.dwHighDateTime << 32) | user.dwLowDateTime;
+    return (kernel_ticks + user_ticks) * 100ULL;
+#else
+    struct timespec ts;
+    if (clock_gettime(CLOCK_THREAD_CPUTIME_ID, &ts) != 0) {
+        return 0;
+    }
+    return (uint64_t)ts.tv_sec * 1000000000ULL + (uint64_t)ts.tv_nsec;
+#endif
+}
+
 /* ── getline (Windows lacks it) ───────────────────────────────── */
 
 #ifdef _WIN32
diff --git a/src/foundation/compat.h b/src/foundation/compat.h
index 175d775e4..821d901f0 100644
--- a/src/foundation/compat.h
+++ b/src/foundation/compat.h
@@ -11,6 +11,7 @@
 #include <errno.h>
 #include <stdbool.h>
 #include <stddef.h>
+#include <stdint.h>
 #include <stdio.h>
 /* stdlib.h declares getenv (cbm_tmpdir) and, on Windows, _putenv_s (cbm_setenv/
  * cbm_unsetenv). The x86-64 mingw toolchain pulled it in transitively, but the
@@ -99,6 +100,16 @@ static inline int cbm_nanosleep(const struct timespec *req, struct timespec *rem
 /* Sleeps for the full requested duration even when POSIX signals interrupt it. */
 int cbm_nanosleep_full(const struct timespec *req);
 
+/* Per-CALLING-THREAD CPU time in nanoseconds. Unlike cbm_clock_gettime — which
+ * measures WALL time on every platform (QueryPerformanceCounter on Windows) —
+ * this advances only while the calling thread is actually scheduled on a CPU, so
+ * a descheduled/starved thread accrues (almost) none. Use it to budget work
+ * against real CPU consumed rather than wall-clock, which a contended host
+ * inflates without the thread doing any work. POSIX (incl. macOS 10.12+):
+ * CLOCK_THREAD_CPUTIME_ID. Windows: GetThreadTimes kernel+user. Returns 0 if the
+ * platform clock is unavailable. Implemented in compat.c. */
+uint64_t cbm_thread_cpu_time_ns(void);
+
 /* ── gmtime_r (Windows lacks it) ─────────────────────────────── */
 #ifdef _WIN32
 static inline struct tm *cbm_gmtime_r(const time_t *timep, struct tm *result) {
diff --git a/src/foundation/compat_fs.c b/src/foundation/compat_fs.c
index ed02c9674..71ab16b11 100644
--- a/src/foundation/compat_fs.c
+++ b/src/foundation/compat_fs.c
@@ -23,11 +23,13 @@
 #include <windows.h>
 
 #include <aclapi.h>
-#include <direct.h> /* _wmkdir */
-#include <errno.h>  /* errno for spawn-failure logging */
-#include <fcntl.h>  /* _O_RDONLY */
-#include <io.h>     /* _wunlink, _open_osfhandle, _close */
-#include <stdint.h> /* intptr_t */
+#include <direct.h>   /* _wmkdir */
+#include <errno.h>    /* errno for spawn-failure logging */
+#include <fcntl.h>    /* _O_RDONLY */
+#include <io.h>       /* _wunlink, _open_osfhandle, _close */
+#include <share.h>    /* _SH_DENYRW */
+#include <sys/stat.h> /* _S_IREAD */
+#include <stdint.h>   /* intptr_t */
 #include "foundation/log.h"
 #include "foundation/win_utf8.h"
 
@@ -588,6 +590,26 @@ int cbm_rmdir(const char *path) {
     return ret;
 }
 
+int cbm_lockfile_open(const char *path, bool create) {
+    wchar_t *wpath = cbm_path_to_wide(path);
+    if (!wpath) {
+        errno = EINVAL;
+        return -1;
+    }
+    int flags = _O_RDWR | _O_BINARY | _O_NOINHERIT | (create ? _O_CREAT : 0);
+    /* _SH_DENYRW: every other open of this file, from any process, fails
+     * with EACCES until this descriptor closes -- including at death. */
+    int fd = _wsopen(wpath, flags, _SH_DENYRW, _S_IREAD | _S_IWRITE);
+    free(wpath);
+    return fd;
+}
+
+void cbm_lockfile_close(int fd) {
+    if (fd >= 0) {
+        (void)_close(fd);
+    }
+}
+
 /* Build a properly-quoted Windows command line from an argv array.
  * Returns a heap-allocated wide string, or NULL on allocation failure.
  * Quoting follows the MSVC CRT convention: arguments containing spaces,
@@ -737,6 +759,7 @@ int cbm_exec_no_shell(const char *const *argv) {
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <sys/file.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
 #include <unistd.h>
@@ -1043,6 +1066,34 @@ int cbm_rmdir(const char *path) {
     return rmdir(path);
 }
 
+int cbm_lockfile_open(const char *path, bool create) {
+    int flags = O_RDWR | O_CLOEXEC | O_NOFOLLOW | (create ? O_CREAT : 0);
+    int fd;
+    do {
+        fd = open(path, flags, S_IRUSR | S_IWUSR);
+    } while (fd < 0 && errno == EINTR);
+    if (fd < 0) {
+        return -1;
+    }
+    int rc;
+    do {
+        rc = flock(fd, LOCK_EX | LOCK_NB);
+    } while (rc != 0 && errno == EINTR);
+    if (rc != 0) {
+        int saved = errno;
+        (void)close(fd);
+        errno = saved;
+        return -1;
+    }
+    return fd;
+}
+
+void cbm_lockfile_close(int fd) {
+    if (fd >= 0) {
+        (void)close(fd);
+    }
+}
+
 int cbm_exec_no_shell(const char *const *argv) {
     if (!argv || !argv[0]) {
         return CBM_NOT_FOUND;
diff --git a/src/foundation/compat_fs.h b/src/foundation/compat_fs.h
index 01bc025d2..a27bf66a2 100644
--- a/src/foundation/compat_fs.h
+++ b/src/foundation/compat_fs.h
@@ -113,6 +113,18 @@ int cbm_canonical_path(const char *path, char *out, size_t out_sz);
 /* Delete an empty directory. Returns 0 on success. */
 int cbm_rmdir(const char *path);
 
+/* Exclusive lock file. Opens `path` and takes an exclusive lock the KERNEL
+ * releases on any process death -- POSIX open(O_CLOEXEC|O_NOFOLLOW) +
+ * flock(LOCK_EX|LOCK_NB); Windows _wsopen with _SH_DENYRW (deny every other
+ * open) and _O_NOINHERIT -- so ownership never outlives its holder and is
+ * never inherited by a spawned child. `create` false never creates the file.
+ * Returns the descriptor, or -1 with errno: EWOULDBLOCK/EAGAIN (POSIX) or
+ * EACCES (Windows sharing violation) when another holder is live, ENOENT
+ * when absent, otherwise the open error. Never use this on a SQLite file:
+ * on macOS an flock conflicts with SQLite's own fcntl byte locks. */
+int cbm_lockfile_open(const char *path, bool create);
+void cbm_lockfile_close(int fd);
+
 /* Open a file by UTF-8 path.
  * On Windows, converts to wide-char and calls _wfopen so paths with
  * non-ASCII characters (accents, CJK, etc.) are handled correctly.
diff --git a/src/foundation/compat_thread.c b/src/foundation/compat_thread.c
index e018cdc41..b86a7f3fb 100644
--- a/src/foundation/compat_thread.c
+++ b/src/foundation/compat_thread.c
@@ -2,8 +2,9 @@
  * compat_thread.c — Portable thread, mutex, and aligned allocation.
  *
  * POSIX: thin wrappers around pthreads and posix_memalign.
- * Windows: CreateThread, CRITICAL_SECTION, _aligned_malloc.
+ * Windows: CreateThread, CRITICAL_SECTION, aligned allocation.
  */
+#include "foundation/mem_events.h"
 #include "foundation/constants.h"
 #include "foundation/compat_thread.h"
 
@@ -12,6 +13,7 @@
 
 #include <mimalloc.h> /* mi_thread_done at thread exit */
 
+#include <errno.h> /* EINVAL — a refused stack-size hint, see cbm_thread_create */
 #include <pthread.h>
 #include <stdlib.h>
 
@@ -93,6 +95,9 @@ static bool thread_release_heap_enabled(void) {
 static void NTAPI cbm_thread_detach_callback(PVOID handle, DWORD reason, PVOID reserved) {
     (void)handle;
     (void)reserved;
+    if (reason == DLL_THREAD_DETACH) {
+        cbm_memev_thread_end(); /* waste-sanitizer thread state; no-op outside that build */
+    }
     if (reason == DLL_THREAD_DETACH && thread_release_heap_enabled()) {
         mi_thread_done();
     }
@@ -174,6 +179,24 @@ int cbm_thread_create(cbm_thread_t *t, size_t stack_size, void *(*fn)(void *), v
     pthread_attr_setstacksize(&attr, stack_size);
     int rc = pthread_create(&t->handle, &attr, fn, arg);
     pthread_attr_destroy(&attr);
+    if (rc == EINVAL) {
+        /* glibc carves the static TLS block out of the thread's own stack
+         * allocation, so a small REQUESTED stack stops being legal the moment
+         * the image's TLS grows — no warning where the growth happens, only
+         * EINVAL here, from then on. That is exactly how the 64 KB
+         * parent-death watchdog stopped starting once this image's TLS passed
+         * it (PR #2233): the worker then refused to index without containment
+         * and SIGKILLed its own group, so every venue reported nothing but
+         * "killed (signal 9)".
+         * A stack size is a hint about how much this thread needs; the platform
+         * refusing the hint is not a reason to fail to create the thread. Fall
+         * back to the default stack, which always has room for the TLS block. */
+        pthread_attr_t fallback;
+        pthread_attr_init(&fallback);
+        pthread_attr_setstacksize(&fallback, cbm_thread_default_stack_size());
+        rc = pthread_create(&t->handle, &fallback, fn, arg);
+        pthread_attr_destroy(&fallback);
+    }
     return rc;
 }
 
@@ -204,6 +227,16 @@ void cbm_mutex_init(cbm_mutex_t *m) {
 }
 
 void cbm_mutex_lock(cbm_mutex_t *m) {
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+    if (cbm_memev_enabled()) {
+        bool contended = !TryEnterCriticalSection(&m->cs);
+        if (contended) {
+            EnterCriticalSection(&m->cs);
+        }
+        cbm_work_note(CBM_WORK_MUTEX, __builtin_return_address(0), 0, contended ? 1 : 0, 0);
+        return;
+    }
+#endif
     EnterCriticalSection(&m->cs);
 }
 
@@ -222,7 +255,13 @@ void cbm_mutex_init(cbm_mutex_t *m) {
 }
 
 void cbm_mutex_lock(cbm_mutex_t *m) {
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+    /* pthread_mutex_lock itself counts in this flavour; going through the same
+     * lock with our caller as the site keeps the attribution and counts once. */
+    (void)cbm_memev_mutex_lock(&m->mtx, __builtin_return_address(0));
+#else
     pthread_mutex_lock(&m->mtx);
+#endif
 }
 
 void cbm_mutex_unlock(cbm_mutex_t *m) {
@@ -240,12 +279,20 @@ void cbm_mutex_destroy(cbm_mutex_t *m) {
 #ifdef _WIN32
 
 int cbm_aligned_alloc(void **ptr, size_t alignment, size_t size) {
+#if defined(CBM_MEM_GLOBAL_OVERRIDE) && CBM_MEM_GLOBAL_OVERRIDE
+    *ptr = mi_malloc_aligned(size, alignment);
+#else
     *ptr = _aligned_malloc(size, alignment);
+#endif
     return *ptr ? 0 : -1;
 }
 
 void cbm_aligned_free(void *ptr) {
+#if defined(CBM_MEM_GLOBAL_OVERRIDE) && CBM_MEM_GLOBAL_OVERRIDE
+    mi_free(ptr);
+#else
     _aligned_free(ptr);
+#endif
 }
 
 #else /* POSIX */
diff --git a/src/foundation/diagnostics.c b/src/foundation/diagnostics.c
index 5b2ee2cb8..77f16c5bc 100644
--- a/src/foundation/diagnostics.c
+++ b/src/foundation/diagnostics.c
@@ -23,6 +23,7 @@
 #include <mimalloc.h>
 #include <stdatomic.h>
 #include <stdio.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
@@ -538,6 +539,20 @@ static void write_diagnostics(void) {
      * macOS/Windows, and peak is reconciled to never undercut current. */
     current_rss = cbm_mem_rss();
     peak_rss = cbm_mem_peak_rss();
+    /* The committed pair has the same failure: the counter is signed and
+     * merged per thread at thread exit, so a thread-per-connection daemon
+     * reads it negative once short-lived threads have freed what a long-lived
+     * one committed (query-leak soak, Linux 2026-09-14: heap_committed_bytes
+     * printed 2^64 - 121 MB from the second sample on). cbm_mem_allocator_
+     * committed reports 0 for a negative reading; the peak never undercuts
+     * the current value and never carries a wrapped one. */
+    current_commit = cbm_mem_allocator_committed();
+    if (peak_commit > (SIZE_MAX >> 1)) {
+        peak_commit = 0;
+    }
+    if (peak_commit < current_commit) {
+        peak_commit = current_commit;
+    }
 
     int fds = count_open_fds();
     time_t now = time(NULL);
diff --git a/src/foundation/dyn_array.h b/src/foundation/dyn_array.h
index 002b285c5..19acb578f 100644
--- a/src/foundation/dyn_array.h
+++ b/src/foundation/dyn_array.h
@@ -20,6 +20,15 @@
 
 #include <stdlib.h>
 #include <string.h>
+#include "mem_core.h" /* same directory: units without -Isrc include this header relatively */
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+#include "mem_events.h"
+#define CBM_DA_WASTE_NOTE(da)                                   \
+    cbm_memev_da_note((size_t)(da)->cap * sizeof(*(da)->items), \
+                      (size_t)(da)->count * sizeof(*(da)->items), (size_t)(da)->cap)
+#else
+#define CBM_DA_WASTE_NOTE(da) ((void)0)
+#endif
 
 /* Declare a dynamic array type for a given element type. */
 #define CBM_DYN_ARRAY(T) \
@@ -30,25 +39,45 @@
     }
 
 /* Push an element. Grows by 2x when full. */
-#define cbm_da_push(da, item)                                                           \
-    do {                                                                                \
-        if ((da)->count >= (da)->cap) {                                                 \
-            int _new_cap = (da)->cap ? (da)->cap * 2 : 8;                               \
-            void *_new = realloc((da)->items, (size_t)_new_cap * sizeof(*(da)->items)); \
-            if (!_new)                                                                  \
-                break;                                                                  \
-            (da)->items = _new;                                                         \
-            (da)->cap = _new_cap;                                                       \
-        }                                                                               \
-        (da)->items[(da)->count++] = (item);                                            \
+#define cbm_da_push(da, item)                                                  \
+    do {                                                                       \
+        if ((da)->count >= (da)->cap) {                                        \
+            int _new_cap = (da)->cap ? (da)->cap * 2 : 8;                      \
+            void *_new = cbm_realloc(CBM_MEM_CLASS_DYN_ARRAY, (da)->items,     \
+                                     (size_t)_new_cap * sizeof(*(da)->items)); \
+            if (!_new)                                                         \
+                break;                                                         \
+            (da)->items = _new;                                                \
+            (da)->cap = _new_cap;                                              \
+        }                                                                      \
+        (da)->items[(da)->count++] = (item);                                   \
+    } while (0)
+
+/* Push with a caller-chosen first capacity. cbm_da_push starts at 8 slots,
+ * which is 64 bytes of headroom on every array; an index that keeps one
+ * small array per key (millions of keys, most holding one or two entries)
+ * pays that on every key. Growth stays 2x. */
+#define cbm_da_push_min(da, item, min_cap)                                     \
+    do {                                                                       \
+        if ((da)->count >= (da)->cap) {                                        \
+            int _new_cap = (da)->cap ? (da)->cap * 2 : (min_cap);              \
+            void *_new = cbm_realloc(CBM_MEM_CLASS_DYN_ARRAY, (da)->items,     \
+                                     (size_t)_new_cap * sizeof(*(da)->items)); \
+            if (!_new)                                                         \
+                break;                                                         \
+            (da)->items = _new;                                                \
+            (da)->cap = _new_cap;                                              \
+        }                                                                      \
+        (da)->items[(da)->count++] = (item);                                   \
     } while (0)
 
 /* Push an element with a pointer return (for in-place init). */
-#define cbm_da_push_ptr(da)                                                                        \
-    (((da)->count >= (da)->cap                                                                     \
-          ? ((void)((da)->cap = (da)->cap ? (da)->cap * 2 : 8),                                    \
-             (void)((da)->items = realloc((da)->items, (size_t)(da)->cap * sizeof(*(da)->items)))) \
-          : (void)0),                                                                              \
+#define cbm_da_push_ptr(da)                                                               \
+    (((da)->count >= (da)->cap                                                            \
+          ? ((void)((da)->cap = (da)->cap ? (da)->cap * 2 : 8),                           \
+             (void)((da)->items = cbm_realloc(CBM_MEM_CLASS_DYN_ARRAY, (da)->items,       \
+                                              (size_t)(da)->cap * sizeof(*(da)->items)))) \
+          : (void)0),                                                                     \
      &(da)->items[(da)->count++])
 
 /* Pop last element. Returns the element. Undefined if empty. */
@@ -61,24 +90,26 @@
 #define cbm_da_clear(da) ((da)->count = 0)
 
 /* Free all memory. */
-#define cbm_da_free(da)     \
-    do {                    \
-        free((da)->items);  \
-        (da)->items = NULL; \
-        (da)->count = 0;    \
-        (da)->cap = 0;      \
+#define cbm_da_free(da)                                 \
+    do {                                                \
+        CBM_DA_WASTE_NOTE(da);                          \
+        cbm_free(CBM_MEM_CLASS_DYN_ARRAY, (da)->items); \
+        (da)->items = NULL;                             \
+        (da)->count = 0;                                \
+        (da)->cap = 0;                                  \
     } while (0)
 
 /* Reserve capacity (grow if needed, never shrink). */
-#define cbm_da_reserve(da, n)                                                      \
-    do {                                                                           \
-        if ((n) > (da)->cap) {                                                     \
-            void *_new = realloc((da)->items, (size_t)(n) * sizeof(*(da)->items)); \
-            if (_new) {                                                            \
-                (da)->items = _new;                                                \
-                (da)->cap = (n);                                                   \
-            }                                                                      \
-        }                                                                          \
+#define cbm_da_reserve(da, n)                                              \
+    do {                                                                   \
+        if ((n) > (da)->cap) {                                             \
+            void *_new = cbm_realloc(CBM_MEM_CLASS_DYN_ARRAY, (da)->items, \
+                                     (size_t)(n) * sizeof(*(da)->items));  \
+            if (_new) {                                                    \
+                (da)->items = _new;                                        \
+                (da)->cap = (n);                                           \
+            }                                                              \
+        }                                                                  \
     } while (0)
 
 /* Insert at index, shifting elements right. */
diff --git a/src/foundation/hash_table.c b/src/foundation/hash_table.c
index 1ee33e32e..6d45c0f2b 100644
--- a/src/foundation/hash_table.c
+++ b/src/foundation/hash_table.c
@@ -20,6 +20,7 @@
  */
 #include "foundation/constants.h"
 #include "hash_table.h"
+#include "mem_events.h"
 #include <stdlib.h>
 #include <string.h>
 
@@ -27,11 +28,26 @@
  * include below generates static inline functions named cbm_vt_init,
  * cbm_vt_cleanup, cbm_vt_get, cbm_vt_insert, etc., plus the cbm_vt
  * struct itself. */
+/* Verstable allocates its bucket/entry blocks through the memory core; the
+ * table's ctx is the class those blocks are charged to (Verstable hands the
+ * ctx and the block size to both hooks). Without this the graph buffer's
+ * 8.5M node keys and 15.8M edge keys on the kernel were memory no class
+ * could see. */
+static void *ht_alloc_in(size_t size, cbm_mem_class_t *cls) {
+    return cbm_alloc(*cls, size);
+}
+static void ht_free_in(void *ptr, size_t size, cbm_mem_class_t *cls) {
+    (void)size;
+    cbm_free(*cls, ptr);
+}
 #define NAME cbm_vt
 #define KEY_TY const char *
 #define VAL_TY void *
 #define HASH_FN vt_hash_string
 #define CMPR_FN vt_cmpr_string
+#define CTX_TY cbm_mem_class_t
+#define MALLOC_FN ht_alloc_in
+#define FREE_FN ht_free_in
 #include "../../internal/cbm/vendored/verstable/verstable.h"
 
 /* The opaque CBMHashTable struct holds the Verstable instance + a
@@ -39,19 +55,53 @@
  * our own atomic-free counter). */
 struct CBMHashTable {
     cbm_vt vt;
+    /* Waste sanitizer: where the table was created, how often it grew, and a
+     * write counter (a lookup only repeats when nothing was written between). */
+    void *waste_site;
+    uint32_t waste_growths;
+    uint64_t waste_generation;
 };
 
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+#define HT_SITE() __builtin_return_address(0)
+enum { HT_SLOT_BYTES = sizeof(cbm_vt_bucket) + sizeof(uint16_t) };
+#define HT_WROTE(ht) ((ht)->waste_generation++)
+#define HT_LOOKED_UP(ht, key, found)                                                 \
+    do {                                                                             \
+        if (cbm_memev_enabled()) {                                                   \
+            /* site = the table's creation site: lookups are charged to the table */ \
+            cbm_work_note_ht(CBM_WORK_HT_GET, (ht)->waste_site, (ht), (key),         \
+                             (ht)->waste_generation, (found));                       \
+        }                                                                            \
+    } while (0)
+#else
+#define HT_SITE() NULL
+#define HT_WROTE(ht) ((void)0)
+#define HT_LOOKED_UP(ht, key, found) ((void)0)
+#endif
+
+static CBMHashTable *ht_create_at(cbm_mem_class_t cls, uint32_t initial_capacity, void *site);
+
 CBMHashTable *cbm_ht_create(uint32_t initial_capacity) {
-    CBMHashTable *ht = (CBMHashTable *)calloc(CBM_ALLOC_ONE, sizeof(*ht));
+    return ht_create_at(CBM_MEM_CLASS_HASH_TABLE, initial_capacity, HT_SITE());
+}
+
+CBMHashTable *cbm_ht_create_in(cbm_mem_class_t cls, uint32_t initial_capacity) {
+    return ht_create_at(cls, initial_capacity, HT_SITE());
+}
+
+static CBMHashTable *ht_create_at(cbm_mem_class_t cls, uint32_t initial_capacity, void *site) {
+    CBMHashTable *ht = (CBMHashTable *)cbm_calloc(cls, sizeof(*ht));
     if (!ht)
         return NULL;
-    cbm_vt_init(&ht->vt);
+    ht->waste_site = site;
+    cbm_vt_init(&ht->vt, cls);
     if (initial_capacity > 0) {
         /* Reserve enough buckets for the requested entries. Verstable
          * computes the minimum bucket count internally. */
         if (!cbm_vt_reserve(&ht->vt, (size_t)initial_capacity)) {
             cbm_vt_cleanup(&ht->vt);
-            free(ht);
+            cbm_free(cls, ht);
             return NULL;
         }
     }
@@ -61,23 +111,48 @@ CBMHashTable *cbm_ht_create(uint32_t initial_capacity) {
 void cbm_ht_free(CBMHashTable *ht) {
     if (!ht)
         return;
+    cbm_mem_class_t cls = ht->vt.ctx;
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+    if (cbm_memev_enabled()) {
+        cbm_memev_container(CBM_WORK_CT_HASH_TABLE, ht->waste_site,
+                            (uint64_t)cbm_vt_bucket_count(&ht->vt) * HT_SLOT_BYTES,
+                            (uint64_t)cbm_vt_size(&ht->vt) * HT_SLOT_BYTES, ht->waste_growths);
+    }
+#endif
     cbm_vt_cleanup(&ht->vt);
-    free(ht);
+    cbm_free(cls, ht);
 }
 
 void *cbm_ht_set(CBMHashTable *ht, const char *key, void *value) {
     if (!ht || !key)
         return NULL;
-    /* Capture previous value (if any) before overwriting.
-     * Verstable's _insert overwrites silently and returns an iterator
-     * to the (now updated) entry — we have to peek first to surface
-     * the prior value to the caller (back-compat with our API). */
+    /* ONE probe: get_or_insert either inserts (key, value) or hands back the
+     * existing entry, whose previous value is returned and whose key AND value
+     * are replaced -- exactly what _insert did. The old get-then-insert hashed
+     * every key twice: 83 M repeated strlen calls inside vt_hash_string on the
+     * Go corpus (waste sanitizer, 2026-09-17). Verstable reports an insertion
+     * as a size change. */
     void *prev = NULL;
-    cbm_vt_itr itr = cbm_vt_get(&ht->vt, key);
-    if (!cbm_vt_is_end(itr)) {
+    HT_WROTE(ht);
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+    size_t buckets_before = cbm_vt_bucket_count(&ht->vt);
+#endif
+    size_t size_before = cbm_vt_size(&ht->vt);
+    cbm_vt_itr itr = cbm_vt_get_or_insert(&ht->vt, key, value);
+    if (!cbm_vt_is_end(itr) && cbm_vt_size(&ht->vt) == size_before) {
         prev = itr.data->val;
+        itr.data->key = key;
+        itr.data->val = value;
     }
-    (void)cbm_vt_insert(&ht->vt, key, value);
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+    bool grew = cbm_vt_bucket_count(&ht->vt) != buckets_before;
+    if (grew) {
+        ht->waste_growths++;
+    }
+    if (cbm_memev_enabled()) {
+        cbm_work_note(CBM_WORK_HT_SET, ht->waste_site, 0, grew ? 1 : 0, 0);
+    }
+#endif
     return prev;
 }
 
@@ -85,6 +160,7 @@ void *cbm_ht_get(const CBMHashTable *ht, const char *key) {
     if (!ht || !key)
         return NULL;
     cbm_vt_itr itr = cbm_vt_get(&ht->vt, key);
+    HT_LOOKED_UP(ht, key, !cbm_vt_is_end(itr));
     if (cbm_vt_is_end(itr))
         return NULL;
     return itr.data->val;
@@ -94,6 +170,7 @@ bool cbm_ht_has(const CBMHashTable *ht, const char *key) {
     if (!ht || !key)
         return false;
     cbm_vt_itr itr = cbm_vt_get(&ht->vt, key);
+    HT_LOOKED_UP(ht, key, !cbm_vt_is_end(itr));
     return !cbm_vt_is_end(itr);
 }
 
@@ -101,6 +178,7 @@ const char *cbm_ht_get_key(const CBMHashTable *ht, const char *key) {
     if (!ht || !key)
         return NULL;
     cbm_vt_itr itr = cbm_vt_get(&ht->vt, key);
+    HT_LOOKED_UP(ht, key, !cbm_vt_is_end(itr));
     if (cbm_vt_is_end(itr))
         return NULL;
     return itr.data->key;
@@ -113,6 +191,7 @@ void *cbm_ht_delete(CBMHashTable *ht, const char *key) {
     if (cbm_vt_is_end(itr))
         return NULL;
     void *prev = itr.data->val;
+    HT_WROTE(ht);
     (void)cbm_vt_erase(&ht->vt, key);
     return prev;
 }
@@ -134,5 +213,6 @@ void cbm_ht_foreach(const CBMHashTable *ht, cbm_ht_iter_fn fn, void *userdata) {
 void cbm_ht_clear(CBMHashTable *ht) {
     if (!ht)
         return;
+    HT_WROTE(ht);
     cbm_vt_clear(&ht->vt);
 }
diff --git a/src/foundation/hash_table.h b/src/foundation/hash_table.h
index a4a0646c4..17e270924 100644
--- a/src/foundation/hash_table.h
+++ b/src/foundation/hash_table.h
@@ -15,6 +15,7 @@
 
 #include <stddef.h>
 #include <stdint.h>
+#include "mem_core.h" /* cbm_mem_class_t; same directory: the lsp_all unit has no -Isrc */
 #include <stdbool.h>
 
 /* Opaque — full definition lives in hash_table.c. */
@@ -24,6 +25,11 @@ typedef struct CBMHashTable CBMHashTable;
  * buckets and avoid early growth; 0 = library default). */
 CBMHashTable *cbm_ht_create(uint32_t initial_capacity);
 
+/* Same, with the memory class the table's buckets and entries are charged
+ * to. cbm_ht_create charges CBM_MEM_CLASS_HASH_TABLE; an owner that wants
+ * its indexes attributed (the graph buffer: gbuf_index) names its class. */
+CBMHashTable *cbm_ht_create_in(cbm_mem_class_t cls, uint32_t initial_capacity);
+
 /* Free the hash table (does NOT free keys or values). */
 void cbm_ht_free(CBMHashTable *ht);
 
diff --git a/src/foundation/index_policy.c b/src/foundation/index_policy.c
new file mode 100644
index 000000000..0d2b986bf
--- /dev/null
+++ b/src/foundation/index_policy.c
@@ -0,0 +1,153 @@
+#include "foundation/index_policy.h"
+
+#include <stdio.h>
+#include <string.h>
+
+static const char *const INDEX_POLICY_KEYS[] = {
+    CBM_INDEX_CONFIG_MAX_FILES,
+    CBM_INDEX_CONFIG_MAX_SOURCE_MB,
+};
+
+static void set_error(char *error, size_t error_size, const char *key, uint64_t maximum) {
+    if (error && error_size > 0) {
+        (void)snprintf(error, error_size, "%s must be off or an integer from 1 to %llu", key,
+                       (unsigned long long)maximum);
+    }
+}
+
+static bool parse_bounded_uint64(const char *value, uint64_t maximum, uint64_t *parsed) {
+    if (!value || !value[0] || !parsed) {
+        return false;
+    }
+    uint64_t result = 0;
+    for (const unsigned char *cursor = (const unsigned char *)value; *cursor; cursor++) {
+        if (*cursor < '0' || *cursor > '9') {
+            return false;
+        }
+        uint64_t digit = (uint64_t)(*cursor - '0');
+        if (result > (maximum - digit) / 10U) {
+            return false;
+        }
+        result = result * 10U + digit;
+    }
+    if (result == 0) {
+        return false;
+    }
+    *parsed = result;
+    return true;
+}
+
+void cbm_index_policy_init(cbm_index_resource_policy_t *policy) {
+    if (policy) {
+        *policy = (cbm_index_resource_policy_t){0};
+    }
+}
+
+bool cbm_index_policy_enabled(const cbm_index_resource_policy_t *policy) {
+    return policy && (policy->max_files.enabled || policy->max_source_bytes.enabled);
+}
+
+size_t cbm_index_policy_key_count(void) {
+    return sizeof(INDEX_POLICY_KEYS) / sizeof(INDEX_POLICY_KEYS[0]);
+}
+
+const char *cbm_index_policy_key_at(size_t index) {
+    return index < cbm_index_policy_key_count() ? INDEX_POLICY_KEYS[index] : NULL;
+}
+
+const char *cbm_index_policy_default_value(const char *key) {
+    for (size_t index = 0; index < cbm_index_policy_key_count(); index++) {
+        if (key && strcmp(key, INDEX_POLICY_KEYS[index]) == 0) {
+            return "off";
+        }
+    }
+    return NULL;
+}
+
+bool cbm_index_policy_set(cbm_index_resource_policy_t *policy, const char *key, const char *value,
+                          char *error, size_t error_size) {
+    if (error && error_size > 0) {
+        error[0] = '\0';
+    }
+    if (!policy || !key || !value) {
+        set_error(error, error_size, key ? key : "index resource limit", 0);
+        return false;
+    }
+
+    cbm_index_limit_u64_t *target = NULL;
+    uint64_t maximum = 0;
+    uint64_t multiplier = 1;
+    if (strcmp(key, CBM_INDEX_CONFIG_MAX_FILES) == 0) {
+        target = &policy->max_files;
+        maximum = CBM_INDEX_MAX_FILES_VALUE;
+    } else if (strcmp(key, CBM_INDEX_CONFIG_MAX_SOURCE_MB) == 0) {
+        target = &policy->max_source_bytes;
+        maximum = CBM_INDEX_MAX_SOURCE_MB_VALUE;
+        multiplier = CBM_INDEX_MIB_BYTES;
+    } else {
+        set_error(error, error_size, key, 0);
+        return false;
+    }
+
+    cbm_index_limit_u64_t candidate = {0};
+    if (strcmp(value, "off") != 0) {
+        uint64_t parsed = 0;
+        if (!parse_bounded_uint64(value, maximum, &parsed)) {
+            set_error(error, error_size, key, maximum);
+            return false;
+        }
+        candidate.enabled = true;
+        candidate.value = parsed * multiplier;
+    }
+    *target = candidate;
+    return true;
+}
+
+bool cbm_index_policy_format(const cbm_index_resource_policy_t *policy, const char *key, char *out,
+                             size_t out_size) {
+    if (!policy || !key || !out || out_size == 0) {
+        return false;
+    }
+    const cbm_index_limit_u64_t *limit = NULL;
+    uint64_t divisor = 1;
+    if (strcmp(key, CBM_INDEX_CONFIG_MAX_FILES) == 0) {
+        limit = &policy->max_files;
+    } else if (strcmp(key, CBM_INDEX_CONFIG_MAX_SOURCE_MB) == 0) {
+        limit = &policy->max_source_bytes;
+        divisor = CBM_INDEX_MIB_BYTES;
+    } else {
+        return false;
+    }
+    int length = limit->enabled
+                     ? snprintf(out, out_size, "%llu", (unsigned long long)(limit->value / divisor))
+                     : snprintf(out, out_size, "off");
+    return length >= 0 && (size_t)length < out_size;
+}
+
+const char *cbm_index_resource_name(cbm_index_resource_t resource) {
+    switch (resource) {
+    case CBM_INDEX_RESOURCE_FILES:
+        return "files";
+    case CBM_INDEX_RESOURCE_SOURCE_BYTES:
+        return "source_bytes";
+    case CBM_INDEX_RESOURCE_NONE:
+    default:
+        return "unknown";
+    }
+}
+
+const char *cbm_index_resource_unit(cbm_index_resource_t resource) {
+    return resource == CBM_INDEX_RESOURCE_FILES ? "files" : "bytes";
+}
+
+const char *cbm_index_resource_config_key(cbm_index_resource_t resource) {
+    switch (resource) {
+    case CBM_INDEX_RESOURCE_FILES:
+        return CBM_INDEX_CONFIG_MAX_FILES;
+    case CBM_INDEX_RESOURCE_SOURCE_BYTES:
+        return CBM_INDEX_CONFIG_MAX_SOURCE_MB;
+    case CBM_INDEX_RESOURCE_NONE:
+    default:
+        return "index_resource_limit";
+    }
+}
diff --git a/src/foundation/index_policy.h b/src/foundation/index_policy.h
new file mode 100644
index 000000000..6a6c499fc
--- /dev/null
+++ b/src/foundation/index_policy.h
@@ -0,0 +1,53 @@
+#ifndef CBM_INDEX_POLICY_H
+#define CBM_INDEX_POLICY_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define CBM_INDEX_CONFIG_MAX_FILES "index_max_files"
+#define CBM_INDEX_CONFIG_MAX_SOURCE_MB "index_max_source_mb"
+
+#define CBM_INDEX_MAX_FILES_VALUE UINT64_C(10000000)
+#define CBM_INDEX_MAX_SOURCE_MB_VALUE UINT64_C(1048576)
+#define CBM_INDEX_MIB_BYTES UINT64_C(1048576)
+
+typedef struct {
+    bool enabled;
+    uint64_t value;
+} cbm_index_limit_u64_t;
+
+typedef struct {
+    cbm_index_limit_u64_t max_files;
+    cbm_index_limit_u64_t max_source_bytes;
+} cbm_index_resource_policy_t;
+
+typedef enum {
+    CBM_INDEX_RESOURCE_NONE = 0,
+    CBM_INDEX_RESOURCE_FILES,
+    CBM_INDEX_RESOURCE_SOURCE_BYTES,
+} cbm_index_resource_t;
+
+typedef struct {
+    cbm_index_resource_t resource;
+    uint64_t observed;
+    uint64_t limit;
+} cbm_index_resource_violation_t;
+
+void cbm_index_policy_init(cbm_index_resource_policy_t *policy);
+bool cbm_index_policy_enabled(const cbm_index_resource_policy_t *policy);
+
+size_t cbm_index_policy_key_count(void);
+const char *cbm_index_policy_key_at(size_t index);
+const char *cbm_index_policy_default_value(const char *key);
+
+bool cbm_index_policy_set(cbm_index_resource_policy_t *policy, const char *key, const char *value,
+                          char *error, size_t error_size);
+bool cbm_index_policy_format(const cbm_index_resource_policy_t *policy, const char *key, char *out,
+                             size_t out_size);
+
+const char *cbm_index_resource_name(cbm_index_resource_t resource);
+const char *cbm_index_resource_unit(cbm_index_resource_t resource);
+const char *cbm_index_resource_config_key(cbm_index_resource_t resource);
+
+#endif
diff --git a/src/foundation/mem.c b/src/foundation/mem.c
index 61d13fe91..4c5b60ae7 100644
--- a/src/foundation/mem.c
+++ b/src/foundation/mem.c
@@ -6,7 +6,9 @@
  * RSS queries (task_info on macOS, /proc/self/statm on Linux,
  * GetProcessMemoryInfo on Windows).
  */
+#include "foundation/mem_events.h"
 #include "mem.h"
+#include "mem_core.h" /* cbm_mem_tracked_live_bytes */
 #include "platform.h"
 #include "log.h"
 #include "compat_fs.h"
@@ -32,6 +34,7 @@
 #include <psapi.h>
 #elif defined(__APPLE__)
 #include <mach/mach.h>
+#include <malloc/malloc.h> /* malloc_zone_pressure_relief */
 #else
 #include <unistd.h>
 #endif
@@ -185,6 +188,11 @@ static void mem_option_set_verified(mi_option_t option, long value, const char *
 #define RAM_FRACTION_32GB 0.35
 #define RAM_BYTES_PER_GB (1024ULL * 1024 * 1024)
 
+/* Bounds for the free-memory clamp (cbm_mem_clamp_to_available). */
+#define CBM_MEM_AVAIL_HEADROOM_MIN ((size_t)RAM_BYTES_PER_GB)
+#define CBM_MEM_AVAIL_HEADROOM_MAX ((size_t)(8ULL * RAM_BYTES_PER_GB))
+#define CBM_MEM_BUDGET_FLOOR ((size_t)(RAM_BYTES_PER_GB / 2)) /* 512 MB */
+
 double cbm_mem_ram_fraction_for_total(size_t total_ram_bytes) {
     if (total_ram_bytes <= 16ULL * RAM_BYTES_PER_GB) {
         return RAM_FRACTION_16GB;
@@ -245,6 +253,36 @@ cbm_mem_budget_t cbm_mem_resolve_budget(size_t total_ram, double ram_fraction,
     return result;
 }
 
+/* A budget derived from TOTAL ram plans to use memory that may already belong
+ * to something else. Measured 2026-09-18 on a 48 GB host: the default budget
+ * (50% = 24 GB) was sized while a 12 GiB VM and a second VM were running, the
+ * kernel index took its full 24.5 GB RSS, and the machine ran out — the same
+ * run completed at the same budget once the VM was stopped. Total RAM is the
+ * CEILING; what is free right now is the CONSTRAINT.
+ *
+ * Headroom is a quarter of what is free, held between 1 and 8 GB: enough that
+ * the OS, its file cache and the user's editor are not squeezed out, without
+ * making a large-memory machine behave like a small one. A budget is never
+ * clamped below CBM_MEM_BUDGET_FLOOR — below that nothing indexes at all, and
+ * refusing to start is worse than trying and spilling. available == 0 means
+ * the platform could not answer, and a guess is not better than the ceiling. */
+size_t cbm_mem_clamp_to_available(size_t budget, size_t available) {
+    if (available == 0) {
+        return budget;
+    }
+    size_t headroom = available / 4;
+    if (headroom < CBM_MEM_AVAIL_HEADROOM_MIN) {
+        headroom = CBM_MEM_AVAIL_HEADROOM_MIN;
+    } else if (headroom > CBM_MEM_AVAIL_HEADROOM_MAX) {
+        headroom = CBM_MEM_AVAIL_HEADROOM_MAX;
+    }
+    size_t cap = available > headroom ? available - headroom : 0;
+    if (cap < CBM_MEM_BUDGET_FLOOR) {
+        cap = CBM_MEM_BUDGET_FLOOR;
+    }
+    return budget < cap ? budget : cap;
+}
+
 cbm_mem_budget_t cbm_mem_resolve_budget_capped(size_t total_ram, double ram_fraction,
                                                const char *budget_mb, size_t hard_cap_bytes) {
     cbm_mem_budget_t result = cbm_mem_resolve_budget(total_ram, ram_fraction, budget_mb);
@@ -415,6 +453,38 @@ void cbm_mem_init_with_cap(double ram_fraction, size_t hard_cap_bytes) {
     const char *env = cbm_safe_getenv("CBM_MEM_BUDGET_MB", env_buf, sizeof(env_buf), NULL);
     cbm_mem_budget_t resolved =
         cbm_mem_resolve_budget_capped(info.total_ram, ram_fraction, env, hard_cap_bytes);
+
+    /* A budget derived from total RAM is a plan made in ignorance of what the
+     * machine is already doing. Clamp the DERIVED budget to what is actually
+     * free; an explicit CBM_MEM_BUDGET_MB is the user's deliberate choice and
+     * still wins, but it is warned about when it exceeds what is free, because
+     * the failure it buys (the OS killing the worker) reads like a product bug
+     * rather than a setting. */
+    size_t available = cbm_system_available_ram();
+    bool explicit_budget =
+        resolved.source != NULL && strcmp(resolved.source, "CBM_MEM_BUDGET_MB") == 0;
+    if (!explicit_budget) {
+        size_t clamped = cbm_mem_clamp_to_available(resolved.budget, available);
+        if (clamped < resolved.budget) {
+            char want_mb[CBM_SZ_32];
+            char avail_mb[CBM_SZ_32];
+            snprintf(want_mb, sizeof(want_mb), "%zu", resolved.budget / MB_DIVISOR);
+            snprintf(avail_mb, sizeof(avail_mb), "%zu", available / MB_DIVISOR);
+            cbm_log_info("mem.budget.available_clamp", "from_mb", want_mb, "available_mb", avail_mb,
+                         "detail", "budget reduced to fit memory that is actually free");
+            resolved.budget = clamped;
+            resolved.source = "available_ram";
+        }
+    } else if (available > 0 && resolved.budget > available) {
+        char want_mb[CBM_SZ_32];
+        char avail_mb[CBM_SZ_32];
+        snprintf(want_mb, sizeof(want_mb), "%zu", resolved.budget / MB_DIVISOR);
+        snprintf(avail_mb, sizeof(avail_mb), "%zu", available / MB_DIVISOR);
+        cbm_log_warn("mem.budget.over_available", "budget_mb", want_mb, "available_mb", avail_mb,
+                     "detail",
+                     "explicit budget exceeds free memory: the OS may kill this process before "
+                     "the budget is ever reached");
+    }
     g_budget = resolved.budget;
 
     /* The resolver is the single source of truth for the parse + clamp; this
@@ -508,10 +578,101 @@ void cbm_mem_set_budget_for_tests(size_t bytes) {
     g_budget = bytes;
 }
 
+size_t cbm_mem_allocator_committed(void) {
+    size_t commit = 0;
+    mi_process_info(NULL, NULL, NULL, NULL, NULL, &commit, NULL, NULL);
+    /* The statistic behind this is a signed counter merged per thread at
+     * thread exit; a process whose long-lived thread commits what its
+     * short-lived threads free reads it NEGATIVE, cast to size_t here. The
+     * daemon's query-leak soak reported 2^64 - 121 MB from the second sample
+     * on (Linux, 2026-09-14). A negative reading is no reading: report 0 so
+     * the charge falls back to the OS number instead of a 16 EB budget breach. */
+    if (commit > (SIZE_MAX >> 1)) {
+        return 0;
+    }
+    return commit;
+}
+
+static _Atomic size_t g_peak_charged;
+size_t cbm_mem_charged(void) {
+    /* The OS number (phys_footprint on macOS, RSS elsewhere) is the charge for
+     * everything the process maps, and the memory core's own live bytes are its
+     * floor: macOS was measured under-reporting the OS number after
+     * MADV_FREE_REUSABLE cycles (kernel extraction: 4.1 GB charged, 13.4 GB
+     * tracked live), so the larger of the two is the honest reading.
+     *
+     * NOT the allocator's committed bytes. mimalloc only decrements that
+     * counter when a decommit will need a matching recommit, and in a RELEASE
+     * build it never will (prim/unix/prim.c: `#if !MI_DEBUG && MI_SECURE<=2`
+     * sets needs_recommit=false), so a purge hands the pages back to the OS and
+     * leaves the counter where it was. Measured on the kernel, 2026-09-17: 77 GB
+     * purged, the counter flat at 14.8 GB, macOS phys_footprint 5.2 GB. Reading
+     * it as the charge pinned the budget at its limit -- the spill sweep freed
+     * 10 GB and the number did not move, so the semantic pass ran with zero
+     * headroom and the run reported a 32 % budget overshoot that never happened.
+     * It stays in the logs (commit_mb) as a diagnostic. */
+#if defined(__APPLE__)
+    size_t os_charge = cbm_mem_footprint();
+    if (os_charge == 0) {
+        os_charge = cbm_mem_rss(); /* footprint unavailable: fall back */
+    }
+#else
+    size_t os_charge = cbm_mem_rss();
+#endif
+    size_t tracked = cbm_mem_tracked_live_bytes();
+    size_t charged = tracked > os_charge ? tracked : os_charge;
+    /* High-water mark of the charge itself, at the granularity of the gate
+     * that reads it (every file pull, every phase mark). RSS high-water
+     * counts pages already purged to the OS but not yet reclaimed
+     * (MADV_FREE); this is the number the budget is measured against. */
+    size_t seen = atomic_load_explicit(&g_peak_charged, memory_order_relaxed);
+    while (charged > seen &&
+           !atomic_compare_exchange_weak_explicit(&g_peak_charged, &seen, charged,
+                                                  memory_order_relaxed, memory_order_relaxed)) {}
+    return charged;
+}
+size_t cbm_mem_peak_charged(void) {
+    return atomic_load_explicit(&g_peak_charged, memory_order_relaxed);
+}
+
 bool cbm_mem_over_budget(void) {
-    size_t rss = cbm_mem_rss();
-    check_pressure(rss);
-    return rss > g_budget;
+    size_t charged = cbm_mem_charged();
+    check_pressure(charged);
+    return charged > g_budget;
+}
+
+/* "Give memory back now" — true when our own budget is exceeded OR the MACHINE
+ * is short, whichever comes first.
+ *
+ * Deliberately separate from cbm_mem_over_budget(): the budget decides whether
+ * the run may CONTINUE (and, as a last resort, aborts it), while this decides
+ * whether to spill and reclaim. System pressure must never abort a run — it is
+ * someone else's allocation spike as often as ours, and the honest response is
+ * to hand memory back, not to fail. Keeping the two apart is what lets the
+ * relief path be aggressive without making the failure path trigger-happy.
+ *
+ * Why it is needed at all: the budget is charged against OUR accounting, which
+ * on 2026-09-18 read 22 GB against a 24 GB budget while the host had nothing
+ * left and killed the worker. Our own number can be comfortably under budget
+ * while the machine is dying. */
+bool cbm_mem_should_relieve(void) {
+    return cbm_mem_over_budget() || cbm_mem_system_under_pressure();
+}
+
+/* Reclaimable memory below this share of total RAM is where paging starts to
+ * hurt, so it is the point at which pressing on stops being reasonable. */
+enum { MEM_PRESSURE_AVAIL_DIVISOR = 8 }; /* 12.5% of total RAM */
+
+bool cbm_mem_system_under_pressure(void) {
+    size_t available = cbm_system_available_ram();
+    if (available == 0) {
+        return false; /* platform cannot answer - do not abort on a guess */
+    }
+    cbm_system_info_t info = cbm_system_info();
+    if (info.total_ram == 0) {
+        return false;
+    }
+    return available < info.total_ram / MEM_PRESSURE_AVAIL_DIVISOR;
 }
 
 size_t cbm_mem_worker_budget(int num_workers) {
@@ -525,6 +686,32 @@ void cbm_mem_collect(void) {
     mi_collect(true);
 }
 
+size_t cbm_mem_footprint(void) {
+#if defined(__APPLE__)
+    task_vm_info_data_t vm = {0};
+    mach_msg_type_number_t count = TASK_VM_INFO_COUNT;
+    if (task_info(mach_task_self(), TASK_VM_INFO, (task_info_t)&vm, &count) == KERN_SUCCESS) {
+        return (size_t)vm.phys_footprint;
+    }
+    return 0;
+#else
+    return os_rss();
+#endif
+}
+
+void cbm_mem_release_to_os(void) {
+    /* mi_collect is the release: on Linux and Windows mimalloc owns malloc, so
+     * there is no libc heap to trim. glibc's malloc_trim was called here once
+     * and cost the static Linux release its link: the reference pulls
+     * libc.a(malloc.o) in beside mimalloc's malloc/free (multiple definition,
+     * release run 34948714902, 2026-09-15). macOS keeps the system heap for
+     * everything outside the core, hence the pressure-relief call there. */
+    mi_collect(true);
+#if defined(__APPLE__)
+    (void)malloc_zone_pressure_relief(NULL, 0);
+#endif
+}
+
 /* ── Memory map (see mem.h for how to read the triple) ─────────────── */
 
 static const size_t MEM_MAP_BUCKET_LIMITS[CBM_MEM_MAP_BUCKETS] = {
@@ -728,7 +915,44 @@ static bool mem_phase_enabled(void) {
     return on;
 }
 
+bool cbm_mem_phases_enabled(void) {
+    return mem_phase_enabled();
+}
+
+/* One line of mimalloc's stats table, logged as it comes. */
+static void mem_allocator_stats_line(const char *msg, void *arg) {
+    if (!msg || !msg[0]) {
+        return;
+    }
+    char line[512];
+    size_t n = 0;
+    for (const char *p = msg; *p && n + 1 < sizeof(line); p++) {
+        line[n++] = (*p == '\n' || *p == '\r' || *p == '\t') ? ' ' : *p;
+    }
+    line[n] = '\0';
+    /* trailing blanks make the log unreadable; trim */
+    while (n > 0 && line[n - 1] == ' ') {
+        line[--n] = '\0';
+    }
+    if (line[0] == '\0') {
+        return;
+    }
+    cbm_log_info("mem.allocator.stats", "tag", (const char *)arg, "line", line);
+}
+
+void cbm_mem_allocator_stats_log(const char *tag) {
+    char enabled[CBM_SZ_16];
+    if (cbm_safe_getenv("CBM_MEM_ALLOCATOR_STATS", enabled, sizeof(enabled), NULL) == NULL) {
+        return;
+    }
+    if (enabled[0] == '0' && enabled[1] == '\0') {
+        return;
+    }
+    mi_stats_print_out(mem_allocator_stats_line, (void *)(tag ? tag : "-"));
+}
+
 void cbm_mem_phase_mark(const char *label) {
+    cbm_memev_phase(label); /* waste sanitizer: dormant unless CBM_MEMWASTE=1 */
     if (!mem_phase_enabled()) {
         return;
     }
diff --git a/src/foundation/mem.h b/src/foundation/mem.h
index bbd9d769f..22cf0b47a 100644
--- a/src/foundation/mem.h
+++ b/src/foundation/mem.h
@@ -50,12 +50,36 @@ cbm_mem_budget_t cbm_mem_resolve_budget(size_t total_ram, double ram_fraction,
 cbm_mem_budget_t cbm_mem_resolve_budget_capped(size_t total_ram, double ram_fraction,
                                                const char *budget_mb, size_t hard_cap_bytes);
 
+/* Reduce a budget derived from TOTAL ram to something the machine can actually
+ * spare right now, keeping a headroom reserve for the OS and other processes.
+ * `available` of 0 means the platform could not answer and the budget stands.
+ * Pure, so the policy is testable without a machine in a particular state. */
+size_t cbm_mem_clamp_to_available(size_t budget, size_t available);
+
 /* Current RSS in bytes via mi_process_info().
  * Falls back to OS-specific queries when MI_OVERRIDE=0 (ASan builds). */
 size_t cbm_mem_rss(void);
 
 /* Peak RSS in bytes. */
 size_t cbm_mem_peak_rss(void);
+/* High-water mark of cbm_mem_charged() as seen by its callers (the extract
+ * gate reads it per file pull, the phase marks per pass): the peak of the
+ * budget metric itself, next to the RSS peak that counts reclaimable pages. */
+size_t cbm_mem_peak_charged(void);
+
+/* The number the budget is enforced against: what the OS charges this
+ * process. On macOS that is phys_footprint -- resident_size keeps every page
+ * mimalloc has purged until the kernel reclaims it, and the kernel proof
+ * (2026-09-13) had the worker at 17.4 GB RSS with 5.5 GB charged after
+ * extraction. Elsewhere the two are the same number. Falls back to RSS when
+ * the footprint is unavailable. */
+size_t cbm_mem_charged(void);
+
+/* Bytes mimalloc currently has committed (its own counter). With the core
+ * backed by mimalloc this is the allocator-level truth: tracked live bytes
+ * plus fragmentation and metadata, minus nothing the OS may or may not have
+ * reclaimed yet. 0 when unavailable. */
+size_t cbm_mem_allocator_committed(void);
 
 /* Total budget in bytes. */
 size_t cbm_mem_budget(void);
@@ -72,12 +96,48 @@ void cbm_mem_set_budget_for_tests(size_t bytes);
 /* Returns true if current RSS exceeds the budget. */
 bool cbm_mem_over_budget(void);
 
+/* True when memory should be handed back NOW: our budget is exceeded, or the
+ * machine itself is short. Use this for spill/reclaim decisions; use
+ * cbm_mem_over_budget() for the decision to stop a run. System pressure must
+ * relieve, never abort — the spike may not even be ours. */
+bool cbm_mem_should_relieve(void);
+
 /* Per-worker budget hint: budget / num_workers. */
 size_t cbm_mem_worker_budget(int num_workers);
 
+/* True only when the SYSTEM is genuinely short of memory, not merely when this
+ * process is over its advisory budget.
+ *
+ * The budget is a static fraction of TOTAL ram, so on a large host it refuses
+ * work the machine can plainly do: measured 2026-09-13, the linux kernel needs
+ * 31.75 GB of a 48 GB host against a 24 GB budget, and the previous release
+ * completed the very same index by overshooting to 33.56 GB. Aborting on the
+ * budget alone therefore turned a working index into a refusal.
+ *
+ * So the budget keeps its job as the BACKPRESSURE trigger (workers park, peers
+ * return transients) and this answers the different question of whether giving
+ * up is warranted. Returns false when availability is unknown: never abort on
+ * a guess. */
+bool cbm_mem_system_under_pressure(void);
+
 /* Return unused pages to the OS. Call between files to bound per-file peak. */
 void cbm_mem_collect(void);
 
+/* What the OS charges this process for memory-pressure purposes. On macOS
+ * that is phys_footprint, which EXCLUDES pages the allocator has already
+ * marked reusable (MADV_FREE_REUSABLE) -- resident_size still counts them, so
+ * after a large free the two can differ by gigabytes. Elsewhere equals RSS.
+ * 0 when unavailable. */
+size_t cbm_mem_footprint(void);
+
+/* Hand freed memory back to the OS on every allocator this process uses:
+ * mimalloc (mi_collect) and, on macOS, the system zones
+ * (malloc_zone_pressure_relief). Never glibc's malloc_trim: on Linux mimalloc
+ * owns malloc, and the reference alone breaks the static release link. Costs
+ * a few ms; call at phase boundaries after a bulk release, never per
+ * allocation. */
+void cbm_mem_release_to_os(void);
+
 /* ── Memory map: where does the process's memory actually live? ──────
  *
  * A growth diagnostic that is honest about what it cannot see. Walking the
@@ -208,6 +268,16 @@ void cbm_mem_phase_mark(const char *label);
 /* Drop all accumulated phase totals (call once at the start of a measurement). */
 void cbm_mem_phase_reset(void);
 
+/* True when CBM_MEM_PHASES=1 turned phase attribution on for this process.
+ * Instruments that walk large structures (the result census) gate on it. */
+bool cbm_mem_phases_enabled(void);
+
+/* CBM_MEM_ALLOCATOR_STATS=1: write the allocator's own reserved / committed /
+ * purged table into the log at `tag`. The worker leaves through _Exit, so
+ * mimalloc's at-exit statistics never appear; this is the way to see them.
+ * Inert unless the variable is set. */
+void cbm_mem_allocator_stats_log(const char *tag);
+
 /* Write the phase table as a JSON array of {label, bytes, hits}, biggest total
  * first. Returns bytes written (0 when disabled or empty). */
 int cbm_mem_phase_report_json(char *out, size_t size);
diff --git a/src/foundation/mem_core.c b/src/foundation/mem_core.c
new file mode 100644
index 000000000..121d2696d
--- /dev/null
+++ b/src/foundation/mem_core.c
@@ -0,0 +1,446 @@
+/*
+ * mem_core.c — the allocation route. See mem_core.h for why it exists.
+ */
+#include "foundation/mem_core.h"
+#include "foundation/mem.h"
+#include "foundation/mem_events.h"
+
+/* Ownership check for blocks handed back to the core (defined with cbm_free). */
+static void check_owned(const void *block, const char *op);
+
+#include "foundation/constants.h"
+#include "foundation/log.h"
+
+#include <stdatomic.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* Usable-size query, per platform.
+ *
+ * Deliberately NOT mi_usable_size: the mimalloc global override is off on
+ * macOS (permanently — the two-level namespace aborts on cross-boundary
+ * frees), so a pointer from plain malloc there is not a mimalloc block and
+ * mi_usable_size would be undefined behaviour on it. Each platform's own query
+ * is correct under whichever allocator is actually installed, including when
+ * that allocator IS mimalloc via the Linux/MinGW override. */
+#if defined(CBM_BIND_TS_ALLOCATOR) && CBM_BIND_TS_ALLOCATOR
+#include <mimalloc.h>
+#define CBM_BACKING_MALLOC(n) mi_malloc(n)
+#define CBM_BACKING_CALLOC(n) mi_calloc(CBM_ALLOC_ONE, n)
+#define CBM_BACKING_REALLOC(p, n) mi_realloc(p, n)
+#define CBM_BACKING_FREE(p) mi_free(p)
+#define CBM_USABLE_SIZE(p) mi_usable_size((void *)(p))
+#elif defined(__APPLE__)
+#include <malloc/malloc.h> /* malloc_size */
+#define CBM_USABLE_SIZE(p) malloc_size(p)
+#elif defined(_WIN32)
+#include <malloc.h> /* _msize */
+#define CBM_USABLE_SIZE(p) _msize((void *)(p))
+#elif defined(__GLIBC__) || defined(__linux__)
+#include <malloc.h> /* malloc_usable_size */
+#define CBM_USABLE_SIZE(p) malloc_usable_size((void *)(p))
+#else
+/* BSD and anything unknown: no portable query. Accounting then tracks the
+ * REQUESTED size, which understates by the rounding. Understating is the safe
+ * direction for a diagnostic (it never invents memory), and the alternative --
+ * a per-block header -- costs 1.6 GB at kernel scale. */
+#define CBM_USABLE_SIZE_UNAVAILABLE 1
+#endif
+
+#ifndef CBM_BACKING_MALLOC
+#define CBM_BACKING_MALLOC(n) malloc(n)
+#define CBM_BACKING_CALLOC(n) calloc(CBM_ALLOC_ONE, n)
+#define CBM_BACKING_REALLOC(p, n) realloc(p, n)
+#define CBM_BACKING_FREE(p) free(p)
+#endif
+
+enum { MEM_CORE_REPORT_MIN = 64 };
+
+typedef struct {
+    atomic_size_t live_bytes;
+    atomic_size_t live_blocks;
+    atomic_size_t peak_bytes;
+} mem_class_stats_t;
+
+static mem_class_stats_t g_classes[CBM_MEM_CLASS_COUNT];
+
+static const char *const g_class_names[CBM_MEM_CLASS_COUNT] = {
+    "other",   "gbuf_node", "gbuf_edge", "gbuf_string", "gbuf_index", "extract",   "arena",
+    "ts_tree", "semantic",  "dump",      "store",       "hash_table", "dyn_array",
+};
+
+const char *cbm_mem_class_name(cbm_mem_class_t cls) {
+    if ((int)cls < 0 || (int)cls >= CBM_MEM_CLASS_COUNT) {
+        return "invalid";
+    }
+    return g_class_names[cls];
+}
+
+/* Out-of-range classes are folded into OTHER rather than rejected: a
+ * mis-tagged allocation must still be freed correctly. Accounting accuracy is
+ * worth less than not corrupting the heap. */
+static mem_class_stats_t *class_slot(cbm_mem_class_t cls) {
+    if ((int)cls < 0 || (int)cls >= CBM_MEM_CLASS_COUNT) {
+        return &g_classes[CBM_MEM_CLASS_OTHER];
+    }
+    return &g_classes[cls];
+}
+
+/* ── Accounting: thread-local deltas, shared atomics on flush ──────────
+ * The hot path (every allocation and free on every worker) touches only
+ * thread-local memory. The shared per-class counters see one flush per
+ * MEM_FLUSH_BYTES / MEM_FLUSH_BLOCKS of change per thread, or an explicit
+ * cbm_mem_class_flush_thread() -- which every parallel-for worker calls when
+ * its work item ends and every reader calls for its own thread first. With
+ * one atomic per allocation, 18 workers on 18 cores bounced the same three
+ * cache lines on every block: Kotlin CPU 38 -> 121 s for a smaller graph,
+ * Go 177 -> 312 s (bench vs v0.10.8, 2026-09-14). A class's live figure can
+ * lag a running worker by at most MEM_FLUSH_BYTES; the phase marks read
+ * after the workers joined, so they are exact. Peaks are recorded at flush
+ * and are low by at most threads x MEM_FLUSH_BYTES -- a diagnostic. */
+enum { MEM_FLUSH_BYTES = 256 * 1024, MEM_FLUSH_BLOCKS = 512 };
+
+typedef struct {
+    long bytes; /* signed: allocations add, frees subtract */
+    long blocks;
+} mem_delta_t;
+
+static _Thread_local mem_delta_t tl_delta[CBM_MEM_CLASS_COUNT];
+
+/* live += delta, never wrapping below zero: a mismatched class on free (the
+ * one way a caller can get this wrong) must not turn a small drift into a
+ * colossal bogus number that looks like a leak. Returns the new value. */
+static size_t apply_signed(atomic_size_t *counter, long delta) {
+    if (delta >= 0) {
+        return atomic_fetch_add_explicit(counter, (size_t)delta, memory_order_relaxed) +
+               (size_t)delta;
+    }
+    size_t sub = (size_t)(-delta);
+    size_t seen = atomic_load_explicit(counter, memory_order_relaxed);
+    while (true) {
+        size_t want = sub > seen ? 0 : seen - sub;
+        if (atomic_compare_exchange_weak_explicit(counter, &seen, want, memory_order_relaxed,
+                                                  memory_order_relaxed)) {
+            return want;
+        }
+    }
+}
+
+static void class_flush_one(cbm_mem_class_t cls) {
+    mem_delta_t *d = &tl_delta[cls];
+    if (d->bytes == 0 && d->blocks == 0) {
+        return;
+    }
+    long bytes = d->bytes;
+    long blocks = d->blocks;
+    d->bytes = 0;
+    d->blocks = 0;
+    mem_class_stats_t *st = &g_classes[cls];
+    size_t now = apply_signed(&st->live_bytes, bytes);
+    (void)apply_signed(&st->live_blocks, blocks);
+    if (bytes > 0) {
+        /* Peak is best-effort under concurrency: racing writers can leave it
+         * one flush low; that never changes a decision. */
+        size_t seen = atomic_load_explicit(&st->peak_bytes, memory_order_relaxed);
+        while (now > seen) {
+            if (atomic_compare_exchange_weak_explicit(&st->peak_bytes, &seen, now,
+                                                      memory_order_relaxed, memory_order_relaxed)) {
+                break;
+            }
+        }
+    }
+}
+
+void cbm_mem_class_flush_thread(void) {
+    cbm_memev_flush_thread(); /* same seam: work-item end, thread end, every reader */
+    for (int i = 0; i < CBM_MEM_CLASS_COUNT; i++) {
+        class_flush_one((cbm_mem_class_t)i);
+    }
+}
+
+static cbm_mem_class_t class_index(cbm_mem_class_t cls) {
+    return ((int)cls < 0 || (int)cls >= CBM_MEM_CLASS_COUNT) ? CBM_MEM_CLASS_OTHER : cls;
+}
+
+static void class_add(cbm_mem_class_t cls, size_t bytes, size_t blocks) {
+    cls = class_index(cls);
+    mem_delta_t *d = &tl_delta[cls];
+    d->bytes += (long)bytes;
+    d->blocks += (long)blocks;
+    if (d->bytes >= MEM_FLUSH_BYTES || d->blocks >= MEM_FLUSH_BLOCKS) {
+        class_flush_one(cls);
+    }
+}
+
+static void class_sub(cbm_mem_class_t cls, size_t bytes, size_t blocks) {
+    cls = class_index(cls);
+    mem_delta_t *d = &tl_delta[cls];
+    d->bytes -= (long)bytes;
+    d->blocks -= (long)blocks;
+    if (d->bytes <= -MEM_FLUSH_BYTES || d->blocks <= -MEM_FLUSH_BLOCKS) {
+        class_flush_one(cls);
+    }
+}
+
+#ifdef CBM_USABLE_SIZE_UNAVAILABLE
+static size_t charge_size(const void *block, size_t requested) {
+    (void)block;
+    return requested;
+}
+
+size_t cbm_mem_usable_size(const void *block) {
+    (void)block;
+    return 0;
+}
+#else
+static size_t charge_size(const void *block, size_t requested) {
+    size_t usable = CBM_USABLE_SIZE(block);
+    return usable ? usable : requested;
+}
+
+size_t cbm_mem_usable_size(const void *block) {
+    if (!block) {
+        return 0;
+    }
+    return CBM_USABLE_SIZE(block);
+}
+#endif
+
+/* -- Waste-sanitizer hooks (mem_events.h) ---------------------------------
+ * Compiled to nothing outside the `memwaste` flavour. The core names the
+ * caller's site and the class; who REPORTS the event depends on whether an
+ * observer sees the backing allocator:
+ *   - backing is mimalloc called directly (CBM_BIND_TS_ALLOCATOR): no observer
+ *     ever sees it, the core reports everything itself;
+ *   - backing is plain malloc and an observer is installed: the observer
+ *     reports, the hint hands it the site and the class;
+ *   - backing is plain malloc, no observer: the core reports.
+ * Frees are reported BEFORE the block goes back (see mem_events.h). */
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+static bool core_reports_frees(void) {
+#if defined(CBM_BIND_TS_ALLOCATOR) && CBM_BIND_TS_ALLOCATOR
+    return true;
+#else
+    return !cbm_memev_observer_installed();
+#endif
+}
+#define MEMEV_HINT(cls)                                              \
+    do {                                                             \
+        if (cbm_memev_enabled() && !cbm_memev_hint_pending()) {      \
+            cbm_memev_hint(__builtin_return_address(0), (int)(cls)); \
+        }                                                            \
+    } while (0)
+#define MEMEV_ALLOCATED(block, bytes, flags)                                                  \
+    do {                                                                                      \
+        if (cbm_memev_hint_pending()) {                                                       \
+            cbm_memev_alloc_ex((block), (bytes), (block) ? charge_size((block), (bytes)) : 0, \
+                               NULL, (flags));                                                \
+        }                                                                                     \
+    } while (0)
+#define MEMEV_REALLOCATED(old_block, grown, bytes)                                \
+    do {                                                                          \
+        if (cbm_memev_hint_pending()) {                                           \
+            cbm_memev_realloc((old_block), (grown), (bytes),                      \
+                              (grown) ? charge_size((grown), (bytes)) : 0, NULL); \
+        }                                                                         \
+    } while (0)
+#define MEMEV_FREEING(block)                               \
+    do {                                                   \
+        if (cbm_memev_enabled() && core_reports_frees()) { \
+            cbm_memev_free(block);                         \
+        }                                                  \
+    } while (0)
+#else
+#define MEMEV_HINT(cls) ((void)0)
+#define MEMEV_ALLOCATED(block, bytes, flags) ((void)0)
+#define MEMEV_REALLOCATED(old_block, grown, bytes) ((void)0)
+#define MEMEV_FREEING(block) ((void)0)
+#endif
+
+void *cbm_alloc(cbm_mem_class_t cls, size_t bytes) {
+    MEMEV_HINT(cls);
+    void *block = CBM_BACKING_MALLOC(bytes ? bytes : CBM_ALLOC_ONE);
+    MEMEV_ALLOCATED(block, bytes, 0);
+    if (!block) {
+        return NULL;
+    }
+    class_add(cls, charge_size(block, bytes), CBM_ALLOC_ONE);
+    return block;
+}
+
+void *cbm_calloc(cbm_mem_class_t cls, size_t bytes) {
+    MEMEV_HINT(cls);
+    void *block = CBM_BACKING_CALLOC(bytes ? bytes : CBM_ALLOC_ONE);
+    MEMEV_ALLOCATED(block, bytes, CBM_MEMEV_ZEROED);
+    if (!block) {
+        return NULL;
+    }
+    class_add(cls, charge_size(block, bytes), CBM_ALLOC_ONE);
+    return block;
+}
+
+void *cbm_realloc(cbm_mem_class_t cls, void *block, size_t bytes) {
+    if (!block) {
+        return cbm_alloc(cls, bytes);
+    }
+    check_owned(block, "realloc");
+    /* Measure BEFORE: after realloc the old block is gone and its size is
+     * unknowable, so the decrement has to be computed first. */
+    size_t old = charge_size(block, 0);
+    MEMEV_HINT(cls);
+    CBM_MEMEV_BACKING(1);
+    void *next = CBM_BACKING_REALLOC(block, bytes ? bytes : CBM_ALLOC_ONE);
+    CBM_MEMEV_BACKING(-1);
+    MEMEV_REALLOCATED(block, next, bytes);
+    if (!next) {
+        return NULL; /* original intact and still charged - correct */
+    }
+    class_sub(cls, old, 0);
+    class_add(cls, charge_size(next, bytes), 0);
+    return next;
+}
+
+char *cbm_mem_strdup(cbm_mem_class_t cls, const char *s) {
+    if (!s) {
+        return NULL;
+    }
+    size_t len = strlen(s) + CBM_ALLOC_ONE;
+    MEMEV_HINT(cls); /* the site is OUR caller, not cbm_alloc's */
+    char *copy = (char *)cbm_alloc(cls, len);
+    if (!copy) {
+        return NULL;
+    }
+    memcpy(copy, s, len);
+    return copy;
+}
+
+/* A block that did not come from the backing allocator reached the core:
+ * a cross-allocator free (a libc strdup handed to cbm_free, which is mi_free
+ * in the production build) that no libc-backed test build can see. Checked
+ * where the backing is mimalloc and only under CBM_MEM_PHASES=1 -- the proof
+ * runs -- and fatal there: silent heap corruption is the alternative. */
+#if defined(CBM_BIND_TS_ALLOCATOR) && CBM_BIND_TS_ALLOCATOR
+static void check_owned(const void *block, const char *op) {
+    if (!cbm_mem_phases_enabled() || mi_is_in_heap_region(block)) {
+        return;
+    }
+    cbm_log_error("mem.core.foreign_block", "op", op);
+    abort();
+}
+#else
+static void check_owned(const void *block, const char *op) {
+    (void)block;
+    (void)op;
+}
+#endif
+
+void cbm_free(cbm_mem_class_t cls, void *block) {
+    if (!block) {
+        return;
+    }
+    check_owned(block, "free");
+    class_sub(cls, charge_size(block, 0), CBM_ALLOC_ONE);
+    MEMEV_FREEING(block);
+    CBM_BACKING_FREE(block);
+}
+
+void cbm_mem_class_add_external(cbm_mem_class_t cls, size_t bytes) {
+    class_add(cls, bytes, 0);
+}
+
+void cbm_mem_class_remove_external(cbm_mem_class_t cls, size_t bytes) {
+    class_sub(cls, bytes, 0);
+}
+
+size_t cbm_mem_class_live_bytes(cbm_mem_class_t cls) {
+    cbm_mem_class_flush_thread();
+    return atomic_load_explicit(&class_slot(cls)->live_bytes, memory_order_relaxed);
+}
+
+size_t cbm_mem_class_live_blocks(cbm_mem_class_t cls) {
+    cbm_mem_class_flush_thread();
+    return atomic_load_explicit(&class_slot(cls)->live_blocks, memory_order_relaxed);
+}
+
+size_t cbm_mem_class_peak_bytes(cbm_mem_class_t cls) {
+    cbm_mem_class_flush_thread();
+    return atomic_load_explicit(&class_slot(cls)->peak_bytes, memory_order_relaxed);
+}
+
+size_t cbm_mem_tracked_live_bytes(void) {
+    cbm_mem_class_flush_thread();
+    size_t total = 0;
+    for (int i = 0; i < CBM_MEM_CLASS_COUNT; i++) {
+        total += atomic_load_explicit(&g_classes[i].live_bytes, memory_order_relaxed);
+    }
+    return total;
+}
+
+void cbm_mem_class_reset_peaks(void) {
+    cbm_mem_class_flush_thread();
+    for (int i = 0; i < CBM_MEM_CLASS_COUNT; i++) {
+        size_t live = atomic_load_explicit(&g_classes[i].live_bytes, memory_order_relaxed);
+        atomic_store_explicit(&g_classes[i].peak_bytes, live, memory_order_relaxed);
+    }
+}
+
+int cbm_mem_class_report_json(char *out, size_t size) {
+    cbm_mem_class_flush_thread();
+    if (!out || size < MEM_CORE_REPORT_MIN) {
+        return 0;
+    }
+    int order[CBM_MEM_CLASS_COUNT];
+    int n = 0;
+    for (int i = 0; i < CBM_MEM_CLASS_COUNT; i++) {
+        if (atomic_load_explicit(&g_classes[i].peak_bytes, memory_order_relaxed) > 0) {
+            order[n++] = i;
+        }
+    }
+    if (n == 0) {
+        return 0;
+    }
+    /* Insertion sort: n is at most CBM_MEM_CLASS_COUNT. */
+    for (int i = 1; i < n; i++) {
+        int key = order[i];
+        size_t kv = atomic_load_explicit(&g_classes[key].live_bytes, memory_order_relaxed);
+        int j = i - 1;
+        while (j >= 0 &&
+               atomic_load_explicit(&g_classes[order[j]].live_bytes, memory_order_relaxed) < kv) {
+            order[j + 1] = order[j];
+            j--;
+        }
+        order[j + 1] = key;
+    }
+
+    int written = snprintf(out, size, "[");
+    for (int i = 0; i < n && written > 0 && (size_t)written < size; i++) {
+        int idx = order[i];
+        int add = snprintf(out + written, size - (size_t)written,
+                           "%s{\"class\":\"%s\",\"live_bytes\":%zu,\"live_blocks\":%zu,"
+                           "\"peak_bytes\":%zu}",
+                           i ? "," : "", g_class_names[idx],
+                           atomic_load_explicit(&g_classes[idx].live_bytes, memory_order_relaxed),
+                           atomic_load_explicit(&g_classes[idx].live_blocks, memory_order_relaxed),
+                           atomic_load_explicit(&g_classes[idx].peak_bytes, memory_order_relaxed));
+        if (add < 0 || (size_t)(written + add) >= size) {
+            return 0; /* truncated: a partial JSON array is worse than none */
+        }
+        written += add;
+    }
+    if ((size_t)written + CBM_ALLOC_ONE >= size) {
+        return 0;
+    }
+    out[written++] = ']';
+    out[written] = '\0';
+    return written;
+}
+
+void cbm_mem_class_log(const char *tag) {
+    cbm_mem_class_flush_thread();
+    char report[CBM_SZ_1K];
+    if (cbm_mem_class_report_json(report, sizeof(report)) <= 0) {
+        return;
+    }
+    cbm_log_info("mem.classes", "tag", tag ? tag : "-", "classes", report);
+}
diff --git a/src/foundation/mem_core.h b/src/foundation/mem_core.h
new file mode 100644
index 000000000..1514c3c68
--- /dev/null
+++ b/src/foundation/mem_core.h
@@ -0,0 +1,149 @@
+/*
+ * mem_core.h — THE allocation route.
+ *
+ * Memory in this project is allocated through one core, not through ~800
+ * scattered malloc/calloc/strdup sites. This header is that core;
+ * foundation/mem.h remains policy and measurement (budget, RSS, pressure,
+ * phase marks) and deliberately owns no allocation.
+ *
+ * WHY THIS EXISTS (audited 2026-09-13)
+ *
+ * The budget could only ever be OBSERVED, never enforced. cbm_mem_over_budget()
+ * reads process RSS *after* the allocation that crossed the line already
+ * succeeded, and the only available response was to nap. A thermostat wired to
+ * a thermometer with no cooler attached.
+ *
+ * Worse, we could not even say WHERE the memory was. Two independent reasons:
+ *
+ *   1. cbm_mem_map_collect()'s live_bytes walks mi_theap_get_default() — THIS
+ *      thread's mimalloc heap only. Walking the process-wide mi_heap_main() is
+ *      a data race that TSan caught on macOS, so it is deliberately not done.
+ *      An 18-worker index therefore attributes almost nothing; the rest lands
+ *      in `residual`.
+ *   2. The mimalloc global override is ON for Linux/MinGW and permanently OFF
+ *      for macOS (the two-level namespace turns this binary's free into mi_free
+ *      while system libraries keep allocating from the system zone, and a
+ *      pointer crossing that boundary aborts). On macOS ordinary malloc is
+ *      served by the SYSTEM allocator: the startup audit reports
+ *      owned_classes=0/6. Any accounting that assumes mimalloc owns the pointer
+ *      is blind on an entire platform.
+ *
+ * So the core keeps its OWN counters. Atomic, per class, incremented at
+ * allocation and decremented at free. Thread-safe by construction, identical on
+ * every platform, and independent of which allocator actually serves malloc.
+ *
+ * NO PER-ALLOCATION HEADER. The obvious design — a {class,size} prefix — costs
+ * 16 bytes on every block, and the graph buffer makes ~100M of them at kernel
+ * scale: ~1.6 GB of pure overhead to measure a memory problem. Sizes come from
+ * the platform's usable-size query instead, which is exact-to-the-bucket, free,
+ * and correct under either allocator.
+ */
+#ifndef CBM_MEM_CORE_H
+#define CBM_MEM_CORE_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+/* Allocation classes.
+ *
+ * A class is a BUDGETING bucket, not a type taxonomy: split only where the
+ * split would change a decision. These follow the measured phase profile of a
+ * kernel index (2026-09-13), where the peak was 35.20 GB and the two consumers
+ * behaved differently — extraction transients scale with worker count, the
+ * semantic plateau does not. Attribution that cannot separate those two cannot
+ * choose between "park workers" and "stream the vectors". */
+typedef enum {
+    CBM_MEM_CLASS_OTHER = 0,   /* unclassified; the residual to drive down */
+    CBM_MEM_CLASS_GBUF_NODE,   /* node records (~64 B each) */
+    CBM_MEM_CLASS_GBUF_EDGE,   /* edge records (~48 B each) */
+    CBM_MEM_CLASS_GBUF_STRING, /* name / qualified_name / properties_json */
+    CBM_MEM_CLASS_GBUF_INDEX,  /* the 8 lookup indexes (383 MB peak on the Go corpus) */
+    CBM_MEM_CLASS_EXTRACT,     /* per-file working set: source text, extraction scratch */
+    CBM_MEM_CLASS_ARENA,       /* CBMArena blocks -- every arena, whoever owns it */
+    CBM_MEM_CLASS_TS_TREE,     /* tree-sitter: parse trees + parser state (bound allocator) */
+    CBM_MEM_CLASS_SEMANTIC,    /* semantic pass: vectors, token pools, LSH (87 MB on Go) */
+    CBM_MEM_CLASS_DUMP,        /* dump-time transients */
+    CBM_MEM_CLASS_STORE,       /* SQLite (bound mem methods) + store batches and row buffers */
+    CBM_MEM_CLASS_HASH_TABLE,  /* CBMHashTable buckets/entries not claimed by an owner class */
+    CBM_MEM_CLASS_DYN_ARRAY,   /* CBM_DYN_ARRAY item storage (every cbm_da_* user) */
+    CBM_MEM_CLASS_COUNT
+} cbm_mem_class_t;
+
+/* Stable lowercase name, for logs and JSON. Never NULL, even out of range. */
+const char *cbm_mem_class_name(cbm_mem_class_t cls);
+
+/* ── The allocation route ──────────────────────────────────────────────
+ *
+ * Semantics match the C library exactly, so adoption is a mechanical rename and
+ * never a behaviour change:
+ *   - cbm_alloc(cls, 0) returns a non-NULL pointer that is valid to free
+ *   - cbm_free(cls, NULL) is a no-op
+ *   - cbm_realloc(cls, NULL, n) behaves as cbm_alloc
+ *   - a failed realloc leaves the original block intact and returns NULL
+ *
+ * The class passed to free/realloc MUST be the class the block was allocated
+ * with, or the counters drift. Pass the class through alongside the pointer,
+ * the same way a custom deleter would. */
+void *cbm_alloc(cbm_mem_class_t cls, size_t bytes);
+void *cbm_calloc(cbm_mem_class_t cls, size_t bytes);
+void *cbm_realloc(cbm_mem_class_t cls, void *block, size_t bytes);
+char *cbm_mem_strdup(cbm_mem_class_t cls, const char *s);
+void cbm_free(cbm_mem_class_t cls, void *block);
+
+/* ── Accounting ────────────────────────────────────────────────────────
+ *
+ * live_bytes is what the ALLOCATOR handed us (usable size), so it exceeds the
+ * bytes requested by the per-block rounding and is the honest number for a
+ * memory budget: rounding is memory the process cannot use for anything else.
+ *
+ * These counters see only memory that went through this core. Everything still
+ * on raw malloc is invisible here — which is the point of
+ * cbm_mem_tracked_live_bytes() versus the process RSS in mem.h: the gap between
+ * them IS the unmigrated surface, and it should shrink as adoption spreads. An
+ * unmeasured allocation must never read as an absent one. */
+/* Push this thread's pending accounting deltas to the shared counters. Every
+ * reader does it for its own thread; a parallel-for worker does it when its
+ * work item ends, so the phase marks (read after the join) are exact. */
+void cbm_mem_class_flush_thread(void);
+
+size_t cbm_mem_class_live_bytes(cbm_mem_class_t cls);
+size_t cbm_mem_class_live_blocks(cbm_mem_class_t cls);
+size_t cbm_mem_tracked_live_bytes(void);
+
+/* Peak live bytes for a class since process start (or the last reset). The
+ * budget question is always about the PEAK, never the value at the moment
+ * someone happened to look. */
+size_t cbm_mem_class_peak_bytes(cbm_mem_class_t cls);
+
+/* Drop all peaks to the current live values. For a measurement run that wants
+ * one phase, not the whole process history. Never resets live counters --
+ * those track real outstanding blocks. */
+void cbm_mem_class_reset_peaks(void);
+
+/* JSON array of {class, live_bytes, live_blocks, peak_bytes}, biggest live
+ * first, classes with no activity omitted. Returns bytes written, 0 if none. */
+int cbm_mem_class_report_json(char *out, size_t size);
+
+/* Log the class table at info level under `tag`. For phase boundaries in the
+ * index pipeline, where the interesting question is which class grew. */
+void cbm_mem_class_log(const char *tag);
+
+/* Usable size of a block obtained from this core, or 0 when the platform
+ * cannot answer. Exposed because the same query is what makes header-free
+ * accounting possible, and callers doing their own bulk accounting (arenas)
+ * need the identical definition to stay consistent with these counters. */
+size_t cbm_mem_usable_size(const void *block);
+
+/* ── Bulk accounting, for allocators that are not this one ─────────────
+ *
+ * The extraction engine already allocates through arenas (1301 call sites) and
+ * must NOT be rewritten to per-object cbm_alloc — that would undo the very
+ * batching that keeps its allocation count low. Instead an arena reports its
+ * block acquisitions here, so arena-backed memory appears in the same table as
+ * heap memory and the totals stay comparable.
+ *
+ * Symmetric: every add must be matched by a remove of the same size. */
+void cbm_mem_class_add_external(cbm_mem_class_t cls, size_t bytes);
+void cbm_mem_class_remove_external(cbm_mem_class_t cls, size_t bytes);
+
+#endif /* CBM_MEM_CORE_H */
diff --git a/src/foundation/mem_events.c b/src/foundation/mem_events.c
new file mode 100644
index 000000000..0ccb84c69
--- /dev/null
+++ b/src/foundation/mem_events.c
@@ -0,0 +1,2162 @@
+/*
+ * mem_events.c — see mem_events.h.
+ *
+ * Layout:
+ *   sites[]      global, open-addressed, keyed by return address. Keys are
+ *                claimed with one CAS; counters are touched only under the
+ *                merge lock, from per-thread deltas.
+ *   shards[]     the pointer table, 256 independently locked open-addressed
+ *                maps. A block is routinely freed by a thread that did not
+ *                allocate it, so the pointer table cannot be per-thread.
+ *   work[]       CPU work counters keyed by (return address, kind), merged
+ *                the same way as the sites.
+ *   tl_state     per-thread deltas for every site and work row the thread
+ *                touched, dirty lists so a flush walks only those, the core
+ *                handshake, the re-entrancy guard and the repeat caches.
+ *   access lane  (CBM_MEMWASTE_ACCESS) a shadow map from every 16-byte slot of
+ *                a tracked block to a per-block record the compiler's load and
+ *                store callbacks update.
+ *
+ * Everything the layer owns comes from raw virtual memory: it runs INSIDE the
+ * allocator it observes and must never call it.
+ */
+#include "foundation/mem_events.h"
+
+#if (defined(CBM_MEMWASTE) && CBM_MEMWASTE) || \
+    (defined(CBM_ENABLE_TEST_SEAMS) && CBM_ENABLE_TEST_SEAMS)
+
+#include "foundation/mem.h"
+
+#include <stdatomic.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#ifdef _WIN32
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <fcntl.h> /* _O_WRONLY, _O_CREAT, _O_APPEND, _O_BINARY */
+#include <io.h>
+#include <windows.h>
+#else
+#include <fcntl.h>
+#include <pthread.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#if defined(__linux__)
+#include <link.h> /* dl_iterate_phdr: the load bias of the main program */
+#endif
+#endif
+
+/* The layer's own code is never instrumented by the access lane: its tables
+ * are not program data, and a hook that reached instrumented code would pay
+ * for itself on every table probe. */
+#if defined(__clang__)
+#pragma clang attribute push(__attribute__((no_sanitize("coverage"))), apply_to = function)
+#endif
+
+enum {
+    MEMEV_SITE_BITS = 16,
+    MEMEV_SITE_CAP = 1 << MEMEV_SITE_BITS,
+    MEMEV_WORK_BITS = 17,
+    MEMEV_WORK_CAP = 1 << MEMEV_WORK_BITS,
+    MEMEV_SHARD_BITS = 8,
+    MEMEV_SHARDS = 1 << MEMEV_SHARD_BITS,
+    MEMEV_SHARD_INIT_BITS = 10,
+    MEMEV_SHARD_MAX_BITS = 26,
+    MEMEV_LOAD_NUM = 7, /* grow at 70 % occupancy (live + tombstones) */
+    MEMEV_LOAD_DEN = 10,
+    MEMEV_SEQ_BITS = 24,
+    MEMEV_SEQ_MASK = (1 << MEMEV_SEQ_BITS) - 1,
+    MEMEV_PHASE_CAP = 63, /* stored in 6 bits */
+    MEMEV_PHASE_LABEL = 48,
+    MEMEV_LINE = 2048,   /* a site line with every field at 20 digits is ~1,150 bytes */
+    MEMEV_PTR_SHIFT = 4, /* allocators align to 16: the low bits carry no entropy */
+    MEMEV_REPEAT_SLOTS = 256,
+    MEMEV_PATH_BITS = 20,
+    MEMEV_PATH_CAP = 1 << MEMEV_PATH_BITS,
+    MEMEV_RUN_MIN = 8, /* a run of the fill byte this long was never written */
+    MEMEV_FILL_BYTE = 0xA5,
+};
+
+#define MEMEV_NO_INDEX UINT32_MAX
+#define MEMEV_TOMBSTONE ((uintptr_t)1)
+#define MEMEV_FILL_CAP ((size_t)256 * 1024 * 1024) /* never fill (or scan) beyond this */
+#define MEMEV_SITE_MASK ((uintptr_t)0x00FFFFFFFFFFFFFFULL)
+
+/* ── raw virtual memory ───────────────────────────────────────────────*/
+/* The layer's own footprint, reported in every dump header: a sanitizer that
+ * cannot say what it costs cannot be trusted to measure anybody else's waste.
+ * On Windows every byte here is committed; on POSIX it is lazily backed. */
+static _Atomic uint64_t g_layer_vm_bytes;
+static _Atomic int64_t g_layer_threads;
+
+static void *vm_get(size_t bytes) {
+#ifdef _WIN32
+    void *p = VirtualAlloc(NULL, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+#else
+    void *p = mmap(NULL, bytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+    if (p == MAP_FAILED) {
+        p = NULL;
+    }
+#endif
+    if (p) {
+        atomic_fetch_add_explicit(&g_layer_vm_bytes, bytes, memory_order_relaxed);
+    }
+    return p;
+}
+
+static void vm_put(void *p, size_t bytes) {
+    if (!p) {
+        return;
+    }
+    atomic_fetch_sub_explicit(&g_layer_vm_bytes, bytes, memory_order_relaxed);
+#ifdef _WIN32
+    (void)bytes;
+    VirtualFree(p, 0, MEM_RELEASE);
+#else
+    munmap(p, bytes);
+#endif
+}
+
+/* ── spin lock ────────────────────────────────────────────────────────
+ * Held for a handful of instructions around one table probe. A mutex would
+ * have to be initialised, and initialisation may allocate. */
+typedef atomic_flag memev_lock_t;
+
+static void lock_take(memev_lock_t *l) {
+    while (atomic_flag_test_and_set_explicit(l, memory_order_acquire)) {}
+}
+
+static void lock_drop(memev_lock_t *l) {
+    atomic_flag_clear_explicit(l, memory_order_release);
+}
+
+/* ── tables ───────────────────────────────────────────────────────────*/
+typedef struct {
+    uint64_t allocs;
+    uint64_t frees;
+    uint64_t reallocs;
+    uint64_t requested_bytes;
+    uint64_t usable_bytes;
+    uint64_t realloc_copy_bytes;
+    uint64_t short_lived;
+    uint64_t raw_bytes;
+    uint64_t scanned_blocks;
+    uint64_t never_written_bytes;
+    uint64_t over_requested_bytes;
+    uint64_t zero_untouched_bytes;
+    uint64_t acc_untouched_blocks;
+    uint64_t acc_untouched_bytes;
+    uint64_t acc_dead_blocks;
+    uint64_t acc_dead_bytes;
+    uint64_t acc_uninit_reads;
+    uint64_t acc_idle_bytes;
+    uint64_t acc_opaque_blocks;
+    int64_t live_bytes;
+    int64_t live_blocks;
+} site_counters_t;
+
+typedef struct {
+    uint64_t calls;
+    uint64_t bytes;
+    uint64_t aux1;
+    uint64_t aux2;
+    uint64_t repeats;
+    uint64_t peak;
+} work_counters_t;
+
+enum {
+    META_PHASE_MASK = 0x3F,
+    META_FILLED = 0x40,
+    META_ZEROED = 0x80,
+};
+
+typedef struct {
+    uintptr_t block; /* 0 empty, MEMEV_TOMBSTONE deleted */
+    uint64_t usable;
+    uint64_t requested;
+    uint32_t seq; /* thread slot << MEMEV_SEQ_BITS | that thread's alloc counter */
+    uint16_t site;
+    int8_t mem_class;
+    uint8_t meta; /* phase (6 bits) | FILLED | ZEROED */
+} ptr_entry_t;
+
+typedef struct {
+    memev_lock_t lock;
+    ptr_entry_t *entries;
+    uint32_t bits;
+    uint32_t used; /* live + tombstones */
+    uint32_t live;
+} shard_t;
+
+typedef struct {
+    const void *table;
+    uint64_t key_hash;
+    uint64_t generation;
+} ht_pair_t;
+
+typedef struct {
+    const char *ptr;
+    size_t len;
+    uint64_t content_hash;
+} strlen_pair_t;
+
+typedef struct {
+    site_counters_t *delta; /* MEMEV_SITE_CAP entries */
+    uint32_t *dirty;        /* site ids touched since the last flush */
+    uint8_t *is_dirty;
+    uint32_t dirty_count;
+    work_counters_t *work_delta; /* MEMEV_WORK_CAP entries */
+    uint32_t *work_dirty;
+    uint8_t *work_is_dirty;
+    uint32_t work_dirty_count;
+    uint32_t slot;      /* thread slot, 8 bits */
+    uint32_t alloc_seq; /* this thread's allocation counter */
+    uint64_t untracked_frees;
+    uint64_t pointer_table_full;
+    uint64_t site_table_full;
+    uint64_t work_table_full;
+    strlen_pair_t strlen_cache[MEMEV_REPEAT_SLOTS];
+    ht_pair_t ht_cache[MEMEV_REPEAT_SLOTS];
+    /* The handshake and the re-entrancy guard live HERE, not in _Thread_local
+     * variables. On macOS the first touch of a _Thread_local in a thread
+     * allocates its storage THROUGH MALLOC: inside an allocation hook that
+     * re-enters the hook, which touches the variable again, until the stack is
+     * gone (SIGSEGV at start-up, 2026-09-17; MinGW's emulated TLS allocates the
+     * same way). A pthread key / FLS slot never allocates, and the state it
+     * points at comes from raw virtual memory. */
+    void *hint_site;
+    int hint_class;
+    bool hint_set;
+    bool busy;        /* the layer is invisible to itself */
+    uint32_t backing; /* depth of backing allocator calls (access lane) */
+    uint64_t ops;     /* allocations + work notes by this thread */
+    uint32_t library_depth;
+    void *library_site;
+#if defined(CBM_MEMWASTE_ACCESS) && CBM_MEMWASTE_ACCESS
+    uint32_t acc_ids[512];
+    uint32_t acc_id_count;
+#endif
+} tl_state_t;
+
+static _Atomic uintptr_t g_site_keys[MEMEV_SITE_CAP];
+static site_counters_t g_site_counters[MEMEV_SITE_CAP];
+static uint64_t g_snap_retained[MEMEV_SITE_CAP];
+static uint64_t g_snap_dup_bytes[MEMEV_SITE_CAP];
+static uint64_t g_snap_dup_blocks[MEMEV_SITE_CAP];
+static _Atomic uintptr_t g_work_keys[MEMEV_WORK_CAP];
+static work_counters_t g_work_counters[MEMEV_WORK_CAP];
+static _Atomic uint64_t g_path_hashes[MEMEV_PATH_CAP];
+static memev_lock_t g_merge_lock = ATOMIC_FLAG_INIT;
+static shard_t g_shards[MEMEV_SHARDS];
+static _Atomic uint64_t g_untracked_frees;
+static _Atomic uint64_t g_foreign_frees;
+static _Atomic uint64_t g_pointer_table_full;
+static _Atomic uint64_t g_site_table_full;
+static _Atomic uint64_t g_work_table_full;
+static _Atomic uint32_t g_next_slot;
+static _Atomic uint32_t g_phase;
+static char g_phase_label[MEMEV_PHASE_LABEL] = "start";
+static _Atomic int g_enabled = -1;
+static _Atomic int g_fill = -1;
+static _Atomic int g_dupes = -1;
+static _Atomic bool g_observer_installed;
+static _Atomic uintptr_t g_image_base;
+
+static const char *const g_work_names[CBM_WORK_KIND_COUNT] = {
+    "memcpy", "memmove", "memset",     "memcmp",   "strlen",       "strcmp",        "strncmp",
+    "read",   "write",   "pread",      "pwrite",   "open",         "stat",          "fopen",
+    "fread",  "fwrite",  "opendir",    "readdir",  "mutex",        "parallel_for",  "pool_ops",
+    "ht_get", "ht_set",  "dead_write", "ct_arena", "ct_dyn_array", "ct_hash_table",
+};
+
+const char *cbm_work_kind_name(cbm_work_kind_t kind) {
+    if ((int)kind < 0 || kind >= CBM_WORK_KIND_COUNT) {
+        return "invalid";
+    }
+    return g_work_names[kind];
+}
+
+static int env_flag(const char *name, int dflt) {
+    const char *v = getenv(name);
+    if (!v || !v[0]) {
+        return dflt;
+    }
+    return (v[0] == '1' && v[1] == '\0') ? 1 : 0;
+}
+
+#if defined(__linux__)
+extern char **environ;
+#endif
+
+bool cbm_memev_enabled(void) {
+    int state = atomic_load_explicit(&g_enabled, memory_order_acquire);
+    if (state >= 0) {
+        return state == 1;
+    }
+#if defined(__linux__)
+    /* Code can run before libc has set up the environment: the loader's
+     * pre-init hooks (the UBSan runtime that -fsanitize-coverage links, which
+     * allocates through dlsym) reach this through the malloc and mutex wrappers.
+     * getenv answers NULL there, and caching that answer switched the layer
+     * off for the whole process (Linux access lane, no dump, 2026-09-17).
+     * Decide only once the environment exists. */
+    if (!environ) {
+        return false;
+    }
+#endif
+    int on = env_flag("CBM_MEMWASTE", 0);
+    atomic_store_explicit(&g_enabled, on, memory_order_release);
+    return on == 1;
+}
+
+static bool fill_enabled(void) {
+    int state = atomic_load_explicit(&g_fill, memory_order_relaxed);
+    if (state < 0) {
+        state = env_flag("CBM_MEMWASTE_FILL", 1);
+        atomic_store_explicit(&g_fill, state, memory_order_relaxed);
+    }
+    return state == 1;
+}
+
+static bool dupes_enabled(void) {
+    int state = atomic_load_explicit(&g_dupes, memory_order_relaxed);
+    if (state < 0) {
+        state = env_flag("CBM_MEMWASTE_DUPES", 1);
+        atomic_store_explicit(&g_dupes, state, memory_order_relaxed);
+    }
+    return state == 1;
+}
+
+void cbm_memev_scan_for_tests(bool fill, bool dupes) {
+    atomic_store_explicit(&g_fill, fill ? 1 : 0, memory_order_relaxed);
+    atomic_store_explicit(&g_dupes, dupes ? 1 : 0, memory_order_relaxed);
+}
+
+void cbm_memev_force_for_tests(bool on) {
+    atomic_store_explicit(&g_enabled, on ? 1 : 0, memory_order_release);
+}
+
+void cbm_memev_set_image_base(uintptr_t base) {
+    atomic_store_explicit(&g_image_base, base, memory_order_release);
+}
+
+void cbm_memev_set_observer_installed(bool installed) {
+    atomic_store_explicit(&g_observer_installed, installed, memory_order_release);
+}
+
+bool cbm_memev_observer_installed(void) {
+    return atomic_load_explicit(&g_observer_installed, memory_order_acquire);
+}
+
+/* ── per-thread slot: a key, never _Thread_local (see tl_state_t) ───────*/
+static _Atomic int g_key_state; /* 0 none, 1 being created, 2 ready */
+#ifdef _WIN32
+static DWORD g_key;
+#else
+static pthread_key_t g_key;
+#endif
+
+static size_t tl_bytes(void);
+static void tl_release(void *raw);
+#ifdef _WIN32
+#endif
+
+static bool key_ready(void) {
+    int state = atomic_load_explicit(&g_key_state, memory_order_acquire);
+    while (state != 2) {
+        int expect = 0;
+        if (state == 0 &&
+            atomic_compare_exchange_strong_explicit(&g_key_state, &expect, 1, memory_order_acq_rel,
+                                                    memory_order_acquire)) {
+#ifdef _WIN32
+            /* A plain TLS slot, released from the loader's thread-detach
+             * callback (cbm_memev_thread_end, compat_thread.c). An FLS
+             * destructor never ran in the static MinGW link, and by the time
+             * the detach callback runs the FLS value is already gone -- the
+             * state leaked 22 MB per thread (71 threads by the similarity pass,
+             * then commit exhaustion, 2026-09-17). A TLS slot is still readable
+             * there. */
+            g_key = TlsAlloc();
+            bool ok = g_key != TLS_OUT_OF_INDEXES;
+#else
+            bool ok = pthread_key_create(&g_key, tl_release) == 0;
+#endif
+            atomic_store_explicit(&g_key_state, ok ? 2 : 0, memory_order_release);
+            if (!ok) {
+                return false;
+            }
+        }
+        state = atomic_load_explicit(&g_key_state, memory_order_acquire);
+    }
+    return true;
+}
+
+/* A thread whose state was already released keeps this marker in its slot. Its
+ * teardown still frees (and on Windows allocates): without the marker every such
+ * call would create a fresh 22 MB state that no destructor ever releases --
+ * Windows runs an FLS callback once per thread, it does not re-run it the way
+ * POSIX re-runs key destructors. Observed as commit exhaustion in the Windows
+ * index worker, 2026-09-17. */
+static char g_tl_exited_marker;
+#define TL_EXITED ((void *)&g_tl_exited_marker)
+
+static void *tl_slot_value(void) {
+#ifdef _WIN32
+    return TlsGetValue(g_key);
+#else
+    return pthread_getspecific(g_key);
+#endif
+}
+
+static tl_state_t *tl_peek(void) {
+    if (!key_ready()) {
+        return NULL;
+    }
+    void *v = tl_slot_value();
+    return v == TL_EXITED ? NULL : (tl_state_t *)v;
+}
+
+static size_t tl_bytes(void) {
+    return sizeof(tl_state_t) + ((size_t)MEMEV_SITE_CAP * sizeof(site_counters_t)) +
+           ((size_t)MEMEV_SITE_CAP * sizeof(uint32_t)) + (size_t)MEMEV_SITE_CAP +
+           ((size_t)MEMEV_WORK_CAP * sizeof(work_counters_t)) +
+           ((size_t)MEMEV_WORK_CAP * sizeof(uint32_t)) + (size_t)MEMEV_WORK_CAP;
+}
+
+static tl_state_t *tl_get(void) {
+    if (!key_ready()) {
+        return NULL;
+    }
+    void *v = tl_slot_value();
+    if (v == TL_EXITED) {
+        return NULL; /* this thread is ending: observe nothing more */
+    }
+    if (v) {
+        return (tl_state_t *)v;
+    }
+    char *raw = (char *)vm_get(tl_bytes());
+    if (!raw) {
+        return NULL;
+    }
+    tl_state_t *st = (tl_state_t *)raw;
+    raw += sizeof(tl_state_t);
+    st->delta = (site_counters_t *)raw;
+    raw += (size_t)MEMEV_SITE_CAP * sizeof(site_counters_t);
+    st->dirty = (uint32_t *)raw;
+    raw += (size_t)MEMEV_SITE_CAP * sizeof(uint32_t);
+    st->is_dirty = (uint8_t *)raw;
+    raw += (size_t)MEMEV_SITE_CAP;
+    st->work_delta = (work_counters_t *)raw;
+    raw += (size_t)MEMEV_WORK_CAP * sizeof(work_counters_t);
+    st->work_dirty = (uint32_t *)raw;
+    raw += (size_t)MEMEV_WORK_CAP * sizeof(uint32_t);
+    st->work_is_dirty = (uint8_t *)raw;
+    atomic_fetch_add_explicit(&g_layer_threads, 1, memory_order_relaxed);
+    st->slot = atomic_fetch_add_explicit(&g_next_slot, 1, memory_order_relaxed) &
+               ((1U << MEMEV_SHARD_BITS) - 1U);
+#ifdef _WIN32
+    if (!TlsSetValue(g_key, st)) {
+        vm_put(st, tl_bytes());
+        return NULL;
+    }
+#else
+    if (pthread_setspecific(g_key, st) != 0) {
+        vm_put(st, tl_bytes());
+        return NULL;
+    }
+#endif
+    return st;
+}
+
+static site_counters_t *tl_site(tl_state_t *st, uint32_t site) {
+    if (!st->is_dirty[site]) {
+        st->is_dirty[site] = 1;
+        st->dirty[st->dirty_count++] = site;
+    }
+    return &st->delta[site];
+}
+
+static work_counters_t *tl_work(tl_state_t *st, uint32_t idx) {
+    if (!st->work_is_dirty[idx]) {
+        st->work_is_dirty[idx] = 1;
+        st->work_dirty[st->work_dirty_count++] = idx;
+    }
+    return &st->work_delta[idx];
+}
+
+/* ── keyed tables ─────────────────────────────────────────────────────*/
+static uint64_t mix(uint64_t x) {
+    x ^= x >> 33;
+    x *= 0xff51afd7ed558ccdULL;
+    x ^= x >> 33;
+    x *= 0xc4ceb9fe1a85ec53ULL;
+    x ^= x >> 33;
+    return x;
+}
+
+/* Index of `key` in a CAS-claimed open-addressed key table, claiming a slot on
+ * first sight. MEMEV_NO_INDEX when the table is full — counted by the caller,
+ * never silently dropped. */
+static uint32_t key_index(_Atomic uintptr_t *keys, uint32_t cap, uintptr_t key) {
+    uint32_t idx = (uint32_t)(mix((uint64_t)key) & (cap - 1));
+    for (uint32_t probe = 0; probe < cap; probe++) {
+        uintptr_t seen = atomic_load_explicit(&keys[idx], memory_order_acquire);
+        if (seen == key) {
+            return idx;
+        }
+        if (seen == 0) {
+            uintptr_t expect = 0;
+            if (atomic_compare_exchange_strong_explicit(
+                    &keys[idx], &expect, key, memory_order_acq_rel, memory_order_acquire) ||
+                expect == key) {
+                return idx;
+            }
+        }
+        idx = (idx + 1) & (cap - 1);
+    }
+    return MEMEV_NO_INDEX;
+}
+
+static uint32_t site_index(uintptr_t site) {
+    site &= MEMEV_SITE_MASK;
+    if (site == 0) {
+        site = (uintptr_t)1; /* "unknown caller" is a site like any other */
+    }
+    return key_index(g_site_keys, MEMEV_SITE_CAP, site);
+}
+
+static uint32_t work_index(cbm_work_kind_t kind, uintptr_t site) {
+    uintptr_t key = (site & MEMEV_SITE_MASK) | ((uintptr_t)((unsigned)kind + 1U) << 56);
+    return key_index(g_work_keys, MEMEV_WORK_CAP, key);
+}
+
+/* ── pointer shards ───────────────────────────────────────────────────*/
+static shard_t *shard_of(uintptr_t block) {
+    return &g_shards[mix((uint64_t)(block >> MEMEV_PTR_SHIFT)) >> (64 - MEMEV_SHARD_BITS)];
+}
+
+static uint32_t slot_of(uintptr_t block, uint32_t bits) {
+    return (uint32_t)(mix((uint64_t)(block >> MEMEV_PTR_SHIFT)) & ((1U << bits) - 1U));
+}
+
+static bool shard_resize(shard_t *sh, uint32_t bits) {
+    if (bits > MEMEV_SHARD_MAX_BITS) {
+        return false;
+    }
+    size_t bytes = ((size_t)1 << bits) * sizeof(ptr_entry_t);
+    ptr_entry_t *next = (ptr_entry_t *)vm_get(bytes);
+    if (!next) {
+        return false;
+    }
+    uint32_t live = 0;
+    if (sh->entries) {
+        uint32_t old_cap = 1U << sh->bits;
+        for (uint32_t i = 0; i < old_cap; i++) {
+            ptr_entry_t *e = &sh->entries[i];
+            if (e->block == 0 || e->block == MEMEV_TOMBSTONE) {
+                continue;
+            }
+            uint32_t s = slot_of(e->block, bits);
+            while (next[s].block != 0) {
+                s = (s + 1) & ((1U << bits) - 1U);
+            }
+            next[s] = *e;
+            live++;
+        }
+        vm_put(sh->entries, ((size_t)1 << sh->bits) * sizeof(ptr_entry_t));
+    }
+    sh->entries = next;
+    sh->bits = bits;
+    sh->used = live;
+    sh->live = live;
+    return true;
+}
+
+/* Caller holds the shard lock. */
+static ptr_entry_t *shard_insert(shard_t *sh, uintptr_t block) {
+    if (!sh->entries && !shard_resize(sh, MEMEV_SHARD_INIT_BITS)) {
+        return NULL;
+    }
+    uint32_t cap = 1U << sh->bits;
+    if ((uint64_t)(sh->used + 1) * MEMEV_LOAD_DEN > (uint64_t)cap * MEMEV_LOAD_NUM) {
+        /* Mostly tombstones: rehash in place at the same size; otherwise double. */
+        uint32_t want = ((uint64_t)sh->live * 2 * MEMEV_LOAD_DEN > (uint64_t)cap * MEMEV_LOAD_NUM)
+                            ? sh->bits + 1
+                            : sh->bits;
+        if (!shard_resize(sh, want)) {
+            return NULL;
+        }
+        cap = 1U << sh->bits;
+    }
+    uint32_t s = slot_of(block, sh->bits);
+    ptr_entry_t *grave = NULL;
+    for (uint32_t probe = 0; probe < cap; probe++) {
+        ptr_entry_t *e = &sh->entries[s];
+        if (e->block == block) {
+            return e; /* address reuse without a free we saw: overwrite */
+        }
+        if (e->block == MEMEV_TOMBSTONE && !grave) {
+            grave = e;
+        } else if (e->block == 0) {
+            ptr_entry_t *dst = grave ? grave : e;
+            if (!grave) {
+                sh->used++;
+            }
+            sh->live++;
+            dst->block = block;
+            return dst;
+        }
+        s = (s + 1) & (cap - 1);
+    }
+    return NULL;
+}
+
+/* Caller holds the shard lock. */
+static ptr_entry_t *shard_find(shard_t *sh, uintptr_t block) {
+    if (!sh->entries) {
+        return NULL;
+    }
+    uint32_t cap = 1U << sh->bits;
+    uint32_t s = slot_of(block, sh->bits);
+    for (uint32_t probe = 0; probe < cap; probe++) {
+        ptr_entry_t *e = &sh->entries[s];
+        if (e->block == block) {
+            return e;
+        }
+        if (e->block == 0) {
+            return NULL;
+        }
+        s = (s + 1) & (cap - 1);
+    }
+    return NULL;
+}
+
+/* ── fill pattern and scan ────────────────────────────────────────────
+ * A new block is filled with MEMEV_FILL_BYTE. At free, a run of at least
+ * MEMEV_RUN_MIN fill bytes is memory nobody ever wrote, and the last byte that
+ * is NOT the fill byte is the high-water mark of what was written. Runs are
+ * counted at word granularity (aligned 8-byte words), which is within 7 bytes
+ * per run edge and fast enough for hundreds of gigabytes. A calloc block is
+ * scanned the same way for zero bytes, which is an upper bound: a written zero
+ * is indistinguishable from an untouched one. */
+typedef struct {
+    uint64_t run_bytes;
+    uint64_t high_water;
+} scan_t;
+
+static scan_t scan_block(const uint8_t *p, size_t n, uint8_t pat) {
+    scan_t out = {0, 0};
+    uint64_t patw = 0x0101010101010101ULL * pat;
+    size_t hw = n;
+    while (hw > 0 && (hw & 7U) != 0 && p[hw - 1] == pat) {
+        hw--;
+    }
+    while (hw >= 8) {
+        uint64_t w;
+        memcpy(&w, p + hw - 8, 8);
+        if (w != patw) {
+            break;
+        }
+        hw -= 8;
+    }
+    while (hw > 0 && p[hw - 1] == pat) {
+        hw--;
+    }
+    size_t tail = n - hw;
+    if (tail < MEMEV_RUN_MIN) {
+        hw = n; /* a short tail of the fill byte is as likely written as not */
+        tail = 0;
+    }
+    uint64_t runs = tail;
+    size_t i = 0;
+    while (i + 8 <= hw) {
+        uint64_t w;
+        memcpy(&w, p + i, 8);
+        if (w == patw) {
+            runs += 8;
+        }
+        i += 8;
+    }
+    out.run_bytes = runs;
+    out.high_water = hw;
+    return out;
+}
+
+/* ── access lane ──────────────────────────────────────────────────────*/
+#if defined(CBM_MEMWASTE_ACCESS) && CBM_MEMWASTE_ACCESS
+enum {
+    /* 48-bit user address space: arm64 Linux maps the program and its heap
+     * above 2^47 (0xaaaa... and 0xffff...), which a 47-bit map silently ignored. */
+    ACC_L1_BITS = 16,
+    ACC_L1_CAP = 1 << ACC_L1_BITS,
+    ACC_SLOT_SHIFT = 4,
+    ACC_REGION_SLOTS = 1 << 28, /* one 4 GB region in 16-byte slots */
+    ACC_RECS_BITS = 27,
+    ACC_WRITTEN = 1,
+    ACC_READ = 2,
+    ACC_READ_BEFORE_WRITE = 4,
+    ACC_ID_BATCH = 256,
+};
+
+typedef struct {
+    _Atomic uint8_t flags;
+    uint8_t last_phase;
+    uint8_t zeroed;
+    uint8_t filled; /* holds the fill pattern: a byte that differs was written by someone */
+    uint32_t site;
+    uint64_t usable;
+    _Atomic uintptr_t writer;
+} acc_rec_t;
+
+static _Atomic(uint32_t *) g_acc_l2[ACC_L1_CAP];
+static acc_rec_t *g_acc_recs;
+static uint32_t *g_acc_free;
+static uint32_t g_acc_free_count;
+static uint32_t g_acc_next = 1;
+static memev_lock_t g_acc_lock = ATOMIC_FLAG_INIT;
+static _Atomic int g_acc_ready;
+
+static bool acc_init(void) {
+    if (atomic_load_explicit(&g_acc_ready, memory_order_acquire) == 2) {
+        return true;
+    }
+    lock_take(&g_acc_lock);
+    if (atomic_load_explicit(&g_acc_ready, memory_order_relaxed) != 2) {
+        g_acc_recs = (acc_rec_t *)vm_get(((size_t)1 << ACC_RECS_BITS) * sizeof(acc_rec_t));
+        g_acc_free = (uint32_t *)vm_get(((size_t)1 << ACC_RECS_BITS) * sizeof(uint32_t));
+        atomic_store_explicit(&g_acc_ready, (g_acc_recs && g_acc_free) ? 2 : 1,
+                              memory_order_release);
+    }
+    lock_drop(&g_acc_lock);
+    return atomic_load_explicit(&g_acc_ready, memory_order_acquire) == 2;
+}
+
+static uint32_t *acc_region(uint32_t l1, bool create) {
+    uint32_t *l2 = atomic_load_explicit(&g_acc_l2[l1], memory_order_acquire);
+    if (l2 || !create) {
+        return l2;
+    }
+    uint32_t *fresh = (uint32_t *)vm_get((size_t)ACC_REGION_SLOTS * sizeof(uint32_t));
+    if (!fresh) {
+        return NULL;
+    }
+    uint32_t *expect = NULL;
+    if (!atomic_compare_exchange_strong_explicit(&g_acc_l2[l1], &expect, fresh,
+                                                 memory_order_acq_rel, memory_order_acquire)) {
+        vm_put(fresh, (size_t)ACC_REGION_SLOTS * sizeof(uint32_t));
+        return expect;
+    }
+    return fresh;
+}
+
+/* Write `id` into every slot of [a, a + n). */
+static void acc_map(uintptr_t a, uint64_t n, uint32_t id) {
+    uintptr_t end = a + (uintptr_t)(n ? n : 1);
+    while (a < end) {
+        uint32_t l1 = (uint32_t)(a >> 32);
+        if (l1 >= ACC_L1_CAP) {
+            return;
+        }
+        uint32_t *l2 = acc_region(l1, id != 0);
+        uintptr_t region_end = ((uintptr_t)l1 + 1) << 32;
+        uintptr_t stop = end < region_end ? end : region_end;
+        if (l2) {
+            uint64_t first = ((uint32_t)a) >> ACC_SLOT_SHIFT;
+            uint64_t last = (stop == region_end) ? (uint64_t)ACC_REGION_SLOTS
+                                                 : ((((uint32_t)(stop - 1)) >> ACC_SLOT_SHIFT) + 1);
+            for (uint64_t s = first; s < last; s++) {
+                l2[s] = id;
+            }
+        }
+        a = stop;
+    }
+}
+
+static uint32_t acc_lookup(uintptr_t a) {
+    uint32_t l1 = (uint32_t)(a >> 32);
+    if (l1 >= ACC_L1_CAP) {
+        return 0;
+    }
+    uint32_t *l2 = atomic_load_explicit(&g_acc_l2[l1], memory_order_relaxed);
+    return l2 ? l2[((uint32_t)a) >> ACC_SLOT_SHIFT] : 0;
+}
+
+static uint32_t acc_take_id(tl_state_t *st) {
+    if (st->acc_id_count == 0) {
+        lock_take(&g_acc_lock);
+        while (st->acc_id_count < ACC_ID_BATCH) {
+            uint32_t id;
+            if (g_acc_free_count > 0) {
+                id = g_acc_free[--g_acc_free_count];
+            } else if (g_acc_next < (1U << ACC_RECS_BITS)) {
+                id = g_acc_next++;
+            } else {
+                break;
+            }
+            st->acc_ids[st->acc_id_count++] = id;
+        }
+        lock_drop(&g_acc_lock);
+    }
+    return st->acc_id_count ? st->acc_ids[--st->acc_id_count] : 0;
+}
+
+static void acc_give_id(tl_state_t *st, uint32_t id) {
+    if (st->acc_id_count < (uint32_t)(sizeof(st->acc_ids) / sizeof(st->acc_ids[0]))) {
+        st->acc_ids[st->acc_id_count++] = id;
+        return;
+    }
+    lock_take(&g_acc_lock);
+    g_acc_free[g_acc_free_count++] = id;
+    while (st->acc_id_count > ACC_ID_BATCH) {
+        g_acc_free[g_acc_free_count++] = st->acc_ids[--st->acc_id_count];
+    }
+    lock_drop(&g_acc_lock);
+}
+
+static void acc_track(tl_state_t *st, uintptr_t block, uint64_t usable, uint32_t site, bool zeroed,
+                      bool filled, bool written) {
+    if (!acc_init()) {
+        return;
+    }
+    uint32_t id = acc_take_id(st);
+    if (!id) {
+        return;
+    }
+    acc_rec_t *r = &g_acc_recs[id];
+    /* A block that already holds content when the layer hears of it (the
+     * Linux/Windows strdup wrappers report AFTER the copy) was written by the
+     * allocation itself: without this every such block read a first time was a
+     * read-before-write -- 16.5 M false verdicts on Linux, 12.6 M of them the
+     * reach-cache key copies (2026-09-17). */
+    atomic_store_explicit(&r->flags, written ? ACC_WRITTEN : 0, memory_order_relaxed);
+    atomic_store_explicit(&r->writer, 0, memory_order_relaxed);
+    r->last_phase = (uint8_t)atomic_load_explicit(&g_phase, memory_order_relaxed);
+    r->zeroed = zeroed ? 1 : 0;
+    r->filled = filled ? 1 : 0;
+    r->site = site;
+    r->usable = usable;
+    acc_map(block, usable, id);
+}
+
+static void work_add(tl_state_t *st, cbm_work_kind_t kind, uintptr_t site, uint64_t bytes,
+                     uint64_t aux1, uint64_t aux2, uint64_t repeats);
+
+/* The verdict on a block that is going away: what its life was spent on.
+ * `scan_written` is the fill scan's word on it (1 written, 0 not, -1 no scan):
+ * a library call the compiler did not instrument (snprintf, strcpy, qsort)
+ * writes without a store callback, and the pattern still shows it. */
+static void acc_untrack(tl_state_t *st, uintptr_t block, uint64_t usable, int scan_written) {
+    if (atomic_load_explicit(&g_acc_ready, memory_order_relaxed) != 2) {
+        return;
+    }
+    uint32_t id = acc_lookup(block);
+    if (!id) {
+        return;
+    }
+    acc_rec_t *r = &g_acc_recs[id];
+    uint8_t f = atomic_load_explicit(&r->flags, memory_order_relaxed);
+    site_counters_t *c = tl_site(st, r->site);
+    /* OPAQUE: the fill pattern shows writes, yet no callback ever fired. The
+     * block was used only by code the lane cannot see -- an uninstrumented
+     * library, or an aggregate copy (`*dst = *src` of a struct) that the
+     * compiler expands inline after instrumentation, emitting no load or store
+     * callback. Its reads are invisible too, so neither "untouched" nor
+     * "written, never read" nor "idle" can be claimed about it. */
+    bool opaque = scan_written == 1 && !(f & (ACC_WRITTEN | ACC_READ));
+    if (opaque) {
+        c->acc_opaque_blocks++;
+    } else if (!(f & (ACC_WRITTEN | ACC_READ))) {
+        c->acc_untouched_blocks++;
+        c->acc_untouched_bytes += r->usable;
+    } else if ((f & ACC_WRITTEN) && !(f & ACC_READ)) {
+        /* Seen written, never seen read. A read through an inline struct copy is
+         * invisible, so this is "no instrumented read", named as such in reports. */
+        c->acc_dead_blocks++;
+        c->acc_dead_bytes += r->usable;
+        uintptr_t writer = atomic_load_explicit(&r->writer, memory_order_relaxed);
+        if (writer) { /* 0: only a library wrote it -- counted at the site, no writer to name */
+            work_add(st, CBM_WORK_DEAD_WRITE, writer, r->usable, 1, 0, 0);
+        }
+    }
+    if ((f & ACC_READ_BEFORE_WRITE) && !r->zeroed) {
+        c->acc_uninit_reads++;
+    }
+    if (!opaque && r->last_phase < (uint8_t)atomic_load_explicit(&g_phase, memory_order_relaxed)) {
+        c->acc_idle_bytes += r->usable;
+    }
+    acc_map(block, usable, 0);
+    acc_give_id(st, id);
+}
+
+static uint32_t acc_move(uintptr_t old_block, uint64_t old_usable, uintptr_t grown,
+                         uint64_t usable) {
+    if (atomic_load_explicit(&g_acc_ready, memory_order_relaxed) != 2) {
+        return 0;
+    }
+    uint32_t id = acc_lookup(old_block);
+    if (!id) {
+        return 0;
+    }
+    acc_map(old_block, old_usable, 0);
+    g_acc_recs[id].usable = usable;
+    acc_map(grown, usable, id);
+    return id;
+}
+
+static inline void acc_touch(uintptr_t a, bool store, uintptr_t pc) {
+    uint32_t id = acc_lookup(a);
+    if (!id) {
+        return;
+    }
+    acc_rec_t *r = &g_acc_recs[id];
+    uint8_t f = atomic_load_explicit(&r->flags, memory_order_relaxed);
+    if (store) {
+        if (!(f & ACC_WRITTEN)) {
+            atomic_fetch_or_explicit(&r->flags, ACC_WRITTEN, memory_order_relaxed);
+            atomic_store_explicit(&r->writer, pc, memory_order_relaxed);
+        }
+    } else if (!(f & ACC_READ)) {
+        uint8_t mark = ACC_READ;
+        if (!(f & ACC_WRITTEN)) {
+            /* The program is about to read this byte, so looking at it is safe. */
+            bool library_wrote = r->filled && *(const uint8_t *)a != MEMEV_FILL_BYTE;
+            mark |= library_wrote ? ACC_WRITTEN : ACC_READ_BEFORE_WRITE;
+        }
+        atomic_fetch_or_explicit(&r->flags, mark, memory_order_relaxed);
+    }
+    uint8_t ph = (uint8_t)atomic_load_explicit(&g_phase, memory_order_relaxed);
+    if (r->last_phase != ph) {
+        r->last_phase = ph;
+    }
+}
+
+#define ACC_PC() ((uintptr_t)__builtin_return_address(0))
+void __sanitizer_cov_load1(uint8_t *a) {
+    acc_touch((uintptr_t)a, false, 0);
+}
+void __sanitizer_cov_load2(uint16_t *a) {
+    acc_touch((uintptr_t)a, false, 0);
+}
+void __sanitizer_cov_load4(uint32_t *a) {
+    acc_touch((uintptr_t)a, false, 0);
+}
+void __sanitizer_cov_load8(uint64_t *a) {
+    acc_touch((uintptr_t)a, false, 0);
+}
+void __sanitizer_cov_load16(__int128 *a) {
+    acc_touch((uintptr_t)a, false, 0);
+}
+void __sanitizer_cov_store1(uint8_t *a) {
+    acc_touch((uintptr_t)a, true, ACC_PC());
+}
+void __sanitizer_cov_store2(uint16_t *a) {
+    acc_touch((uintptr_t)a, true, ACC_PC());
+}
+void __sanitizer_cov_store4(uint32_t *a) {
+    acc_touch((uintptr_t)a, true, ACC_PC());
+}
+void __sanitizer_cov_store8(uint64_t *a) {
+    acc_touch((uintptr_t)a, true, ACC_PC());
+}
+void __sanitizer_cov_store16(__int128 *a) {
+    acc_touch((uintptr_t)a, true, ACC_PC());
+}
+void __sanitizer_cov_bool_flag_init(uint8_t *start, uint8_t *stop) {
+    (void)start;
+    (void)stop;
+}
+
+/* Verdicts are per block, so touching both ends of the range marks every block
+ * it can belong to (a range never spans two allocations in a correct program). */
+void cbm_memev_access(const void *p, size_t n, bool store, void *pc) {
+    if (!p || n == 0 || atomic_load_explicit(&g_acc_ready, memory_order_relaxed) != 2) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy || st->backing) {
+        return;
+    }
+    uintptr_t a = (uintptr_t)p;
+    acc_touch(a, store, (uintptr_t)pc);
+    if (n > 1) {
+        acc_touch(a + (uintptr_t)(n - 1), store, (uintptr_t)pc);
+    }
+}
+
+void cbm_memev_backing(int delta) {
+    tl_state_t *st = tl_get();
+    if (st) {
+        st->backing = (uint32_t)((int)st->backing + delta);
+    }
+}
+#else
+static void work_add(tl_state_t *st, cbm_work_kind_t kind, uintptr_t site, uint64_t bytes,
+                     uint64_t aux1, uint64_t aux2, uint64_t repeats);
+#endif /* CBM_MEMWASTE_ACCESS */
+
+/* ── the handshake ────────────────────────────────────────────────────*/
+void cbm_memev_hint(void *site, int mem_class) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (st) {
+        st->hint_site = site;
+        st->hint_class = mem_class;
+        st->hint_set = true;
+    }
+}
+
+bool cbm_memev_hint_pending(void) {
+    if (!cbm_memev_enabled()) {
+        return false;
+    }
+    const tl_state_t *st = tl_peek();
+    return st && st->hint_set;
+}
+
+/* ── events ───────────────────────────────────────────────────────────*/
+static void record_alloc(tl_state_t *st, uintptr_t block, size_t requested, size_t usable,
+                         uintptr_t site, int mem_class, unsigned flags) {
+    st->ops++;
+    uint32_t sid = site_index(site);
+    if (sid == MEMEV_NO_INDEX) {
+        st->site_table_full++;
+        return;
+    }
+    uint64_t charged = usable ? usable : requested;
+    st->alloc_seq = (st->alloc_seq + 1) & (uint32_t)MEMEV_SEQ_MASK;
+
+    bool zeroed = (flags & CBM_MEMEV_ZEROED) != 0;
+    bool filled = false;
+    if (!zeroed && !(flags & (CBM_MEMEV_FOREIGN | CBM_MEMEV_WRITTEN)) &&
+        charged <= MEMEV_FILL_CAP && fill_enabled()) {
+        memset((void *)block, MEMEV_FILL_BYTE, (size_t)charged);
+        filled = true;
+    }
+
+    shard_t *sh = shard_of(block);
+    lock_take(&sh->lock);
+    ptr_entry_t *e = shard_insert(sh, block);
+    if (e) {
+        e->usable = charged;
+        e->requested = requested;
+        e->seq = (st->slot << MEMEV_SEQ_BITS) | st->alloc_seq;
+        e->site = (uint16_t)sid;
+        e->mem_class = (int8_t)mem_class;
+        e->meta =
+            (uint8_t)((atomic_load_explicit(&g_phase, memory_order_relaxed) & META_PHASE_MASK) |
+                      (filled ? META_FILLED : 0) | (zeroed ? META_ZEROED : 0));
+    }
+    lock_drop(&sh->lock);
+    if (!e) {
+        st->pointer_table_full++;
+    }
+
+    site_counters_t *c = tl_site(st, sid);
+    c->allocs++;
+    c->requested_bytes += requested;
+    c->usable_bytes += charged;
+    if (mem_class == CBM_MEMEV_CLASS_RAW) {
+        c->raw_bytes += charged;
+    }
+    if (e) {
+        c->live_bytes += (int64_t)charged;
+        c->live_blocks++;
+#if defined(CBM_MEMWASTE_ACCESS) && CBM_MEMWASTE_ACCESS
+        if (!(flags & (CBM_MEMEV_FOREIGN | CBM_MEMEV_LIBRARY))) {
+            acc_track(st, block, charged, sid, zeroed, filled, (flags & CBM_MEMEV_WRITTEN) != 0);
+        }
+#endif
+    }
+}
+
+void cbm_memev_alloc_ex(void *block, size_t requested, size_t usable, void *site, unsigned flags) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy) {
+        return;
+    }
+    bool hinted = st->hint_set;
+    st->hint_set = false; /* consumed even when the allocation failed */
+    if (!block) {
+        return;
+    }
+    st->busy = true;
+    record_alloc(st, (uintptr_t)block, requested, usable,
+                 (uintptr_t)(hinted ? st->hint_site : site),
+                 hinted ? st->hint_class : CBM_MEMEV_CLASS_RAW,
+                 hinted ? (flags & ~(unsigned)CBM_MEMEV_FOREIGN) : flags);
+    st->busy = false;
+}
+
+void cbm_memev_alloc(void *block, size_t requested, size_t usable, void *site) {
+    cbm_memev_alloc_ex(block, requested, usable, site, 0);
+}
+
+/* Removes the record of `block`. Returns false when the layer never saw it. */
+static bool take_entry(uintptr_t block, ptr_entry_t *out) {
+    shard_t *sh = shard_of(block);
+    lock_take(&sh->lock);
+    ptr_entry_t *e = shard_find(sh, block);
+    bool found = e != NULL;
+    if (found) {
+        *out = *e;
+        e->block = MEMEV_TOMBSTONE;
+        sh->live--;
+    }
+    lock_drop(&sh->lock);
+    return found;
+}
+
+void cbm_memev_free(void *block) {
+    if (!block || !cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy) {
+        return;
+    }
+    st->busy = true;
+    ptr_entry_t e;
+    if (take_entry((uintptr_t)block, &e)) {
+        site_counters_t *c = tl_site(st, e.site);
+        c->frees++;
+        c->live_bytes -= (int64_t)e.usable;
+        c->live_blocks--;
+        uint32_t slot = e.seq >> MEMEV_SEQ_BITS;
+        uint32_t age =
+            (st->alloc_seq - (e.seq & (uint32_t)MEMEV_SEQ_MASK)) & (uint32_t)MEMEV_SEQ_MASK;
+        if (slot == st->slot && age <= CBM_MEMEV_CHURN_WINDOW) {
+            c->short_lived++;
+        }
+        int scan_written = -1;
+        if ((e.meta & (META_FILLED | META_ZEROED)) && e.usable <= MEMEV_FILL_CAP) {
+            bool zeroed = (e.meta & META_ZEROED) != 0;
+            scan_t sc =
+                scan_block((const uint8_t *)block, (size_t)e.usable, zeroed ? 0 : MEMEV_FILL_BYTE);
+            scan_written = sc.high_water > 0 ? 1 : 0;
+            c->scanned_blocks++;
+            if (zeroed) {
+                c->zero_untouched_bytes += e.usable - sc.high_water;
+            } else {
+                c->never_written_bytes += sc.run_bytes;
+                if (e.requested > sc.high_water) {
+                    c->over_requested_bytes += e.requested - sc.high_water;
+                }
+            }
+        }
+#if defined(CBM_MEMWASTE_ACCESS) && CBM_MEMWASTE_ACCESS
+        acc_untrack(st, (uintptr_t)block, e.usable, scan_written);
+#else
+        (void)scan_written;
+#endif
+    } else {
+        st->untracked_frees++;
+    }
+    st->busy = false;
+}
+
+void cbm_memev_free_foreign(void *block) {
+    if (!block || !cbm_memev_enabled()) {
+        return;
+    }
+    atomic_fetch_add_explicit(&g_foreign_frees, 1, memory_order_relaxed);
+}
+
+void cbm_memev_realloc(void *old_block, void *grown, size_t requested, size_t usable, void *site) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy) {
+        return;
+    }
+    bool hinted = st->hint_set;
+    void *hint_site = st->hint_site;
+    int hint_class = st->hint_class;
+    st->hint_set = false;
+    if (!grown) {
+        return;
+    }
+    st->busy = true;
+    ptr_entry_t e;
+    bool had = old_block && take_entry((uintptr_t)old_block, &e);
+    if (had) {
+        /* The record keeps its ORIGINAL site: a realloc chain is one object
+         * growing, and its copies are that object's cost. */
+        site_counters_t *c = tl_site(st, e.site);
+        c->reallocs++;
+        c->live_bytes -= (int64_t)e.usable;
+        c->live_blocks--;
+        if (grown != old_block) {
+            c->realloc_copy_bytes += e.usable < requested ? e.usable : requested;
+        }
+        uint64_t charged = usable ? usable : requested;
+        uint8_t meta = e.meta;
+        if ((meta & META_FILLED) && charged > e.usable && charged <= MEMEV_FILL_CAP) {
+            /* the new tail is uninitialised: it gets the pattern too */
+            memset((char *)grown + e.usable, MEMEV_FILL_BYTE, (size_t)(charged - e.usable));
+        } else if (charged > e.usable) {
+            meta &= (uint8_t)~(META_FILLED | META_ZEROED); /* mixed content: stop scanning */
+        }
+        shard_t *sh = shard_of((uintptr_t)grown);
+        lock_take(&sh->lock);
+        ptr_entry_t *n = shard_insert(sh, (uintptr_t)grown);
+        if (n) {
+            n->usable = charged;
+            n->requested = requested;
+            n->seq = e.seq;
+            n->site = e.site;
+            n->mem_class = e.mem_class;
+            n->meta = meta;
+        }
+        lock_drop(&sh->lock);
+        c->requested_bytes += requested;
+        c->usable_bytes += charged;
+        if (e.mem_class == CBM_MEMEV_CLASS_RAW) {
+            c->raw_bytes += charged;
+        }
+        if (n) {
+            c->live_bytes += (int64_t)charged;
+            c->live_blocks++;
+#if defined(CBM_MEMWASTE_ACCESS) && CBM_MEMWASTE_ACCESS
+            (void)acc_move((uintptr_t)old_block, e.usable, (uintptr_t)grown, charged);
+#endif
+        } else {
+            st->pointer_table_full++;
+        }
+    } else {
+        /* The old block was never seen (allocated before the observer, or by a
+         * path it does not cover): the grown block already holds the program's
+         * data, so it is recorded without the fill. realloc(NULL, n) is a fresh
+         * allocation and gets the fill like any malloc. */
+        record_alloc(st, (uintptr_t)grown, requested, usable,
+                     (uintptr_t)(hinted ? hint_site : site),
+                     hinted ? hint_class : CBM_MEMEV_CLASS_RAW,
+                     old_block ? CBM_MEMEV_WRITTEN : 0); /* realloc(NULL, n) is a malloc */
+    }
+    st->busy = false;
+}
+
+/* ── CPU work ─────────────────────────────────────────────────────────*/
+static void work_add(tl_state_t *st, cbm_work_kind_t kind, uintptr_t site, uint64_t bytes,
+                     uint64_t aux1, uint64_t aux2, uint64_t repeats) {
+    st->ops++;
+    uint32_t idx = work_index(kind, site);
+    if (idx == MEMEV_NO_INDEX) {
+        st->work_table_full++;
+        return;
+    }
+    work_counters_t *w = tl_work(st, idx);
+    w->calls++;
+    w->bytes += bytes;
+    w->aux1 += aux1;
+    w->aux2 += aux2;
+    w->repeats += repeats;
+    bool container = kind == CBM_WORK_CT_ARENA || kind == CBM_WORK_CT_DYN_ARRAY ||
+                     kind == CBM_WORK_CT_HASH_TABLE;
+    uint64_t single = container ? (bytes > aux1 ? bytes - aux1 : 0) : bytes;
+    if (single > w->peak) {
+        w->peak = single;
+    }
+}
+
+void cbm_memev_library_enter(void *site) {
+    tl_state_t *st = cbm_memev_enabled() ? tl_get() : NULL;
+    if (st && st->library_depth++ == 0) {
+        st->library_site = site;
+    }
+}
+
+void cbm_memev_library_leave(void) {
+    tl_state_t *st = cbm_memev_enabled() ? tl_get() : NULL;
+    if (st && st->library_depth > 0 && --st->library_depth == 0) {
+        st->library_site = NULL;
+    }
+}
+
+void *cbm_memev_library_site(void) {
+    tl_state_t *st = cbm_memev_enabled() ? tl_get() : NULL;
+    return st ? st->library_site : NULL;
+}
+
+#if defined(CBM_MEMWASTE_PROFILE) && CBM_MEMWASTE_PROFILE
+void __llvm_profile_set_filename(const char *pattern);
+int __llvm_profile_write_file(void);
+#endif
+
+void cbm_memev_process_role(const char *role) {
+#if defined(CBM_MEMWASTE_PROFILE) && CBM_MEMWASTE_PROFILE
+    const char *dir = getenv("CBM_PROFILE_DIR");
+    if (!dir || !dir[0] || !role) {
+        return;
+    }
+    /* The runtime keeps the pointer, not a copy: the pattern must outlive us. */
+    static char pattern[1024];
+    int n = snprintf(pattern, sizeof(pattern), "%s/%s-%%p.profraw", dir, role);
+    if (n > 0 && (size_t)n < sizeof(pattern)) {
+        __llvm_profile_set_filename(pattern);
+    }
+#else
+    (void)role;
+#endif
+}
+
+void cbm_memev_process_exit(void) {
+    if (cbm_memev_enabled()) {
+        const char *out = getenv("CBM_MEMWASTE_OUT");
+        if (out && out[0]) {
+            (void)cbm_memev_dump(out, "exit");
+        }
+    }
+#if defined(CBM_MEMWASTE_PROFILE) && CBM_MEMWASTE_PROFILE
+    (void)__llvm_profile_write_file();
+#endif
+}
+
+uint64_t cbm_memev_thread_ops(void) {
+    if (!cbm_memev_enabled()) {
+        return 0;
+    }
+    tl_state_t *st = tl_get();
+    return st ? st->ops : 0;
+}
+
+void cbm_work_note(cbm_work_kind_t kind, void *site, uint64_t bytes, uint64_t aux1, uint64_t aux2) {
+    if ((int)kind < 0 || kind >= CBM_WORK_KIND_COUNT || !cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy) {
+        return;
+    }
+    st->busy = true;
+    work_add(st, kind, (uintptr_t)site, bytes, aux1, aux2, 0);
+    st->busy = false;
+}
+
+__attribute__((noinline)) void cbm_memev_da_note(size_t cap_bytes, size_t used_bytes,
+                                                 size_t cap_slots) {
+    if (!cbm_memev_enabled() || cap_bytes == 0) {
+        return;
+    }
+    uint64_t growths = 0;
+    for (size_t c = 8; c < cap_slots; c <<= 1) {
+        growths++;
+    }
+    cbm_work_note(CBM_WORK_CT_DYN_ARRAY, __builtin_return_address(0), cap_bytes, used_bytes,
+                  growths);
+}
+
+/* FNV-1a over the first bytes of a string of known length; the length is
+ * mixed in, so two strings that share a long prefix still differ. */
+enum { MEMEV_CONTENT_HASH_MAX = 4096 };
+static uint64_t bytes_hash(const char *s, size_t len) {
+    uint64_t h = 0xcbf29ce484222325ULL ^ (uint64_t)len;
+    size_t n = len < MEMEV_CONTENT_HASH_MAX ? len : MEMEV_CONTENT_HASH_MAX;
+    for (size_t i = 0; s && i < n; i++) {
+        h ^= (uint8_t)s[i];
+        h *= 0x100000001b3ULL;
+    }
+    return h;
+}
+
+void cbm_work_note_strlen(void *site, const char *s, size_t len) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy) {
+        return;
+    }
+    st->busy = true;
+    strlen_pair_t *slot = &st->strlen_cache[mix((uint64_t)(uintptr_t)s) & (MEMEV_REPEAT_SLOTS - 1)];
+    uint64_t content = bytes_hash(s, len);
+    uint64_t repeat = (slot->ptr == s && slot->len == len && slot->content_hash == content) ? 1 : 0;
+    slot->ptr = s;
+    slot->len = len;
+    slot->content_hash = content;
+    work_add(st, CBM_WORK_STRLEN, (uintptr_t)site, len, 0, 0, repeat);
+    st->busy = false;
+}
+
+/* FNV-1a over a NUL-terminated path, without calling the strlen we wrap. */
+static uint64_t path_hash(const char *p) {
+    uint64_t h = 0xcbf29ce484222325ULL;
+    for (; p && *p; p++) {
+        h ^= (uint8_t)*p;
+        h *= 0x100000001b3ULL;
+    }
+    return h;
+}
+
+void cbm_work_note_path(cbm_work_kind_t kind, void *site, const char *path, bool failed) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy) {
+        return;
+    }
+    st->busy = true;
+    uint64_t h = mix(path_hash(path) ^ ((uint64_t)kind << 58)) | 1U;
+    uint64_t repeat = 0;
+    uint32_t idx = (uint32_t)(h & (MEMEV_PATH_CAP - 1));
+    for (uint32_t probe = 0; probe < MEMEV_PATH_CAP; probe++) {
+        uint64_t seen = atomic_load_explicit(&g_path_hashes[idx], memory_order_relaxed);
+        if (seen == h) {
+            repeat = 1;
+            break;
+        }
+        if (seen == 0) {
+            uint64_t expect = 0;
+            if (atomic_compare_exchange_strong_explicit(
+                    &g_path_hashes[idx], &expect, h, memory_order_relaxed, memory_order_relaxed)) {
+                break;
+            }
+            if (expect == h) {
+                repeat = 1;
+                break;
+            }
+        }
+        idx = (idx + 1) & (MEMEV_PATH_CAP - 1);
+    }
+    work_add(st, kind, (uintptr_t)site, 0, failed ? 1 : 0, 0, repeat);
+    st->busy = false;
+}
+
+void cbm_work_note_ht(cbm_work_kind_t kind, void *site, const void *table, const char *key,
+                      uint64_t generation, bool hit) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy) {
+        return;
+    }
+    st->busy = true;
+    uint64_t repeat = 0;
+    if (kind == CBM_WORK_HT_GET) {
+        uint64_t key_hash = path_hash(key);
+        ht_pair_t *slot =
+            &st->ht_cache[mix((uint64_t)(uintptr_t)table ^ (key_hash * 0x9e3779b97f4a7c15ULL)) &
+                          (MEMEV_REPEAT_SLOTS - 1)];
+        repeat =
+            (slot->table == table && slot->key_hash == key_hash && slot->generation == generation)
+                ? 1
+                : 0;
+        slot->table = table;
+        slot->key_hash = key_hash;
+        slot->generation = generation;
+    }
+    work_add(st, kind, (uintptr_t)site, 0, (kind == CBM_WORK_HT_GET && !hit) ? 1 : 0, 0, repeat);
+    st->busy = false;
+}
+
+/* ── merge ────────────────────────────────────────────────────────────*/
+static void flush_state(tl_state_t *st) {
+    lock_take(&g_merge_lock);
+    for (uint32_t i = 0; i < st->dirty_count; i++) {
+        uint32_t sid = st->dirty[i];
+        site_counters_t *d = &st->delta[sid];
+        site_counters_t *g = &g_site_counters[sid];
+        g->allocs += d->allocs;
+        g->frees += d->frees;
+        g->reallocs += d->reallocs;
+        g->requested_bytes += d->requested_bytes;
+        g->usable_bytes += d->usable_bytes;
+        g->realloc_copy_bytes += d->realloc_copy_bytes;
+        g->short_lived += d->short_lived;
+        g->raw_bytes += d->raw_bytes;
+        g->scanned_blocks += d->scanned_blocks;
+        g->never_written_bytes += d->never_written_bytes;
+        g->over_requested_bytes += d->over_requested_bytes;
+        g->zero_untouched_bytes += d->zero_untouched_bytes;
+        g->acc_untouched_blocks += d->acc_untouched_blocks;
+        g->acc_untouched_bytes += d->acc_untouched_bytes;
+        g->acc_dead_blocks += d->acc_dead_blocks;
+        g->acc_dead_bytes += d->acc_dead_bytes;
+        g->acc_uninit_reads += d->acc_uninit_reads;
+        g->acc_idle_bytes += d->acc_idle_bytes;
+        g->acc_opaque_blocks += d->acc_opaque_blocks;
+        g->live_bytes += d->live_bytes;
+        g->live_blocks += d->live_blocks;
+        memset(d, 0, sizeof(*d));
+        st->is_dirty[sid] = 0;
+    }
+    st->dirty_count = 0;
+    for (uint32_t i = 0; i < st->work_dirty_count; i++) {
+        uint32_t idx = st->work_dirty[i];
+        work_counters_t *d = &st->work_delta[idx];
+        work_counters_t *g = &g_work_counters[idx];
+        g->calls += d->calls;
+        g->bytes += d->bytes;
+        g->aux1 += d->aux1;
+        g->aux2 += d->aux2;
+        g->repeats += d->repeats;
+        if (d->peak > g->peak) {
+            g->peak = d->peak;
+        }
+        memset(d, 0, sizeof(*d));
+        st->work_is_dirty[idx] = 0;
+    }
+    st->work_dirty_count = 0;
+    lock_drop(&g_merge_lock);
+    atomic_fetch_add_explicit(&g_untracked_frees, st->untracked_frees, memory_order_relaxed);
+    atomic_fetch_add_explicit(&g_pointer_table_full, st->pointer_table_full, memory_order_relaxed);
+    atomic_fetch_add_explicit(&g_site_table_full, st->site_table_full, memory_order_relaxed);
+    atomic_fetch_add_explicit(&g_work_table_full, st->work_table_full, memory_order_relaxed);
+    st->untracked_frees = 0;
+    st->pointer_table_full = 0;
+    st->site_table_full = 0;
+    st->work_table_full = 0;
+}
+
+void cbm_memev_flush_thread(void) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_peek();
+    if (!st || st->busy) {
+        return;
+    }
+    st->busy = true;
+    flush_state(st);
+    st->busy = false;
+}
+
+/* Thread exit (pthread key / FLS destructor): hand over what is pending, then
+ * give the raw memory back. */
+static void tl_release(void *raw);
+
+void cbm_memev_thread_end(void) {
+    if (atomic_load_explicit(&g_key_state, memory_order_acquire) != 2) {
+        return; /* no thread ever had state: nothing to release */
+    }
+    void *v = tl_slot_value();
+    if (v && v != TL_EXITED) {
+        tl_release(v);
+    }
+}
+
+static void tl_release(void *raw) {
+    tl_state_t *st = (tl_state_t *)raw;
+    if (!st || raw == TL_EXITED) {
+        return;
+    }
+    st->busy = true;
+    flush_state(st);
+    /* Mark the slot before the memory goes: whatever the rest of the thread's
+     * teardown allocates or frees must find the marker, neither a freed pointer
+     * nor an empty slot that would build a new state. */
+#ifdef _WIN32
+    (void)TlsSetValue(g_key, TL_EXITED);
+#else
+    (void)pthread_setspecific(g_key, TL_EXITED);
+#endif
+    atomic_fetch_sub_explicit(&g_layer_threads, 1, memory_order_relaxed);
+    vm_put(st, tl_bytes());
+}
+
+/* ── phase snapshot ───────────────────────────────────────────────────
+ * Live blocks allocated in an earlier phase are RETAINED: the question is
+ * whether the phase that is running still needs them. Small live blocks with
+ * identical content are DUPLICATES: one interned copy would do. Both are
+ * snapshots of the live set taken after the workers joined. */
+static uint64_t content_hash(const uint8_t *p, size_t n) {
+    uint64_t h = 0xcbf29ce484222325ULL ^ ((uint64_t)n * 0x9e3779b97f4a7c15ULL);
+    for (size_t i = 0; i < n; i++) {
+        h ^= p[i];
+        h *= 0x100000001b3ULL;
+    }
+    return h | 1U;
+}
+
+static void snapshot_phase(uint32_t phase_now) {
+    memset(g_snap_retained, 0, sizeof(g_snap_retained));
+    memset(g_snap_dup_bytes, 0, sizeof(g_snap_dup_bytes));
+    memset(g_snap_dup_blocks, 0, sizeof(g_snap_dup_blocks));
+    bool dupes = dupes_enabled();
+    uint64_t live_total = 0;
+    for (uint32_t i = 0; i < MEMEV_SHARDS; i++) {
+        live_total += g_shards[i].live;
+    }
+    size_t set_cap = 1024;
+    while (set_cap < live_total * 2 && set_cap < ((size_t)1 << 30)) {
+        set_cap <<= 1;
+    }
+    uint64_t *set = dupes ? (uint64_t *)vm_get(set_cap * sizeof(uint64_t)) : NULL;
+    for (uint32_t i = 0; i < MEMEV_SHARDS; i++) {
+        shard_t *sh = &g_shards[i];
+        lock_take(&sh->lock);
+        uint32_t cap = sh->entries ? (1U << sh->bits) : 0;
+        for (uint32_t j = 0; j < cap; j++) {
+            const ptr_entry_t *e = &sh->entries[j];
+            if (e->block == 0 || e->block == MEMEV_TOMBSTONE) {
+                continue;
+            }
+            if ((uint32_t)(e->meta & META_PHASE_MASK) < phase_now) {
+                g_snap_retained[e->site] += e->usable;
+            }
+            if (!set || e->usable > CBM_MEMEV_DUP_MAX || !(e->meta & (META_FILLED | META_ZEROED))) {
+                continue;
+            }
+            const uint8_t *p = (const uint8_t *)e->block;
+            scan_t sc =
+                scan_block(p, (size_t)e->usable, (e->meta & META_ZEROED) ? 0 : MEMEV_FILL_BYTE);
+            if (sc.high_water == 0) {
+                continue; /* nothing written: that is never-written waste, not a duplicate */
+            }
+            uint64_t h = content_hash(p, (size_t)sc.high_water);
+            size_t s = (size_t)(h & (set_cap - 1));
+            for (;;) {
+                if (set[s] == 0) {
+                    set[s] = h;
+                    break;
+                }
+                if (set[s] == h) {
+                    g_snap_dup_bytes[e->site] += e->usable;
+                    g_snap_dup_blocks[e->site]++;
+                    break;
+                }
+                s = (s + 1) & (set_cap - 1);
+            }
+        }
+        lock_drop(&sh->lock);
+    }
+    vm_put(set, set_cap * sizeof(uint64_t));
+}
+
+void cbm_memev_phase(const char *label) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    tl_state_t *st = tl_get();
+    if (!st || st->busy) {
+        return;
+    }
+    st->busy = true;
+    flush_state(st);
+    uint32_t next = atomic_load_explicit(&g_phase, memory_order_relaxed) + 1;
+    if (next <= MEMEV_PHASE_CAP) {
+        atomic_store_explicit(&g_phase, next, memory_order_relaxed);
+    }
+    lock_take(&g_merge_lock);
+    snprintf(g_phase_label, sizeof(g_phase_label), "%s", label ? label : "-");
+    lock_drop(&g_merge_lock);
+    snapshot_phase(atomic_load_explicit(&g_phase, memory_order_relaxed));
+    st->busy = false;
+    const char *out = getenv("CBM_MEMWASTE_OUT");
+    if (out && out[0]) {
+        char why[MEMEV_PHASE_LABEL + 8];
+        snprintf(why, sizeof(why), "phase:%s", label ? label : "-");
+        (void)cbm_memev_dump(out, why);
+    }
+}
+
+/* ── report ───────────────────────────────────────────────────────────*/
+void cbm_memev_totals(cbm_memev_totals_t *out) {
+    if (!out) {
+        return;
+    }
+    memset(out, 0, sizeof(*out));
+    cbm_memev_flush_thread();
+    lock_take(&g_merge_lock);
+    for (uint32_t i = 0; i < MEMEV_SITE_CAP; i++) {
+        if (atomic_load_explicit(&g_site_keys[i], memory_order_relaxed) == 0) {
+            continue;
+        }
+        const site_counters_t *g = &g_site_counters[i];
+        out->sites++;
+        out->allocs += g->allocs;
+        out->frees += g->frees;
+        out->reallocs += g->reallocs;
+        out->requested_bytes += g->requested_bytes;
+        out->usable_bytes += g->usable_bytes;
+        out->realloc_copy_bytes += g->realloc_copy_bytes;
+        out->raw_bytes += g->raw_bytes;
+        if (g->live_bytes > 0) {
+            out->live_bytes += (uint64_t)g->live_bytes;
+        }
+        if (g->live_blocks > 0) {
+            out->live_blocks += (uint64_t)g->live_blocks;
+        }
+    }
+    lock_drop(&g_merge_lock);
+    out->untracked_frees = atomic_load_explicit(&g_untracked_frees, memory_order_relaxed);
+    out->foreign_frees = atomic_load_explicit(&g_foreign_frees, memory_order_relaxed);
+    out->pointer_table_full = atomic_load_explicit(&g_pointer_table_full, memory_order_relaxed);
+    out->site_table_full = atomic_load_explicit(&g_site_table_full, memory_order_relaxed);
+    out->work_table_full = atomic_load_explicit(&g_work_table_full, memory_order_relaxed);
+}
+
+static void site_row_of(uint32_t i, uintptr_t key, cbm_memev_site_t *row) {
+    const site_counters_t *g = &g_site_counters[i];
+    *row = (cbm_memev_site_t){
+        .site = key,
+        .allocs = g->allocs,
+        .frees = g->frees,
+        .reallocs = g->reallocs,
+        .requested_bytes = g->requested_bytes,
+        .usable_bytes = g->usable_bytes,
+        .realloc_copy_bytes = g->realloc_copy_bytes,
+        .live_bytes = g->live_bytes > 0 ? (uint64_t)g->live_bytes : 0,
+        .live_blocks = g->live_blocks > 0 ? (uint64_t)g->live_blocks : 0,
+        .short_lived = g->short_lived,
+        .raw_bytes = g->raw_bytes,
+        .scanned_blocks = g->scanned_blocks,
+        .never_written_bytes = g->never_written_bytes,
+        .over_requested_bytes = g->over_requested_bytes,
+        .zero_untouched_bytes = g->zero_untouched_bytes,
+        .retained_bytes = g_snap_retained[i],
+        .dup_bytes = g_snap_dup_bytes[i],
+        .dup_blocks = g_snap_dup_blocks[i],
+        .acc_untouched_blocks = g->acc_untouched_blocks,
+        .acc_untouched_bytes = g->acc_untouched_bytes,
+        .acc_dead_blocks = g->acc_dead_blocks,
+        .acc_dead_bytes = g->acc_dead_bytes,
+        .acc_uninit_reads = g->acc_uninit_reads,
+        .acc_idle_bytes = g->acc_idle_bytes,
+        .acc_opaque_blocks = g->acc_opaque_blocks,
+    };
+}
+
+static int by_usable_desc(const void *a, const void *b) {
+    const cbm_memev_site_t *x = (const cbm_memev_site_t *)a;
+    const cbm_memev_site_t *y = (const cbm_memev_site_t *)b;
+    if (x->usable_bytes != y->usable_bytes) {
+        return x->usable_bytes < y->usable_bytes ? 1 : -1;
+    }
+    /* Equal bytes: order by address, so the report is a function of the data. */
+    return x->site < y->site ? -1 : (x->site > y->site ? 1 : 0);
+}
+
+/* Top `max` sites by cumulative usable bytes, selected without allocating. */
+size_t cbm_memev_sites(cbm_memev_site_t *out, size_t max) {
+    if (!out || max == 0) {
+        return 0;
+    }
+    cbm_memev_flush_thread();
+    size_t n = 0;
+    lock_take(&g_merge_lock);
+    for (uint32_t i = 0; i < MEMEV_SITE_CAP; i++) {
+        uintptr_t key = atomic_load_explicit(&g_site_keys[i], memory_order_relaxed);
+        if (key == 0) {
+            continue;
+        }
+        cbm_memev_site_t row;
+        site_row_of(i, key, &row);
+        if (n < max) {
+            out[n++] = row;
+            continue;
+        }
+        size_t smallest = 0;
+        for (size_t k = 1; k < n; k++) {
+            if (by_usable_desc(&out[k], &out[smallest]) > 0) {
+                smallest = k;
+            }
+        }
+        if (by_usable_desc(&row, &out[smallest]) < 0) {
+            out[smallest] = row;
+        }
+    }
+    lock_drop(&g_merge_lock);
+    tl_state_t *st = tl_get();
+    bool was_busy = st && st->busy;
+    if (st) {
+        st->busy = true; /* qsort is libc; keep anything it does out of the tables */
+    }
+    qsort(out, n, sizeof(out[0]), by_usable_desc);
+    if (st) {
+        st->busy = was_busy;
+    }
+    return n;
+}
+
+size_t cbm_work_rows(cbm_work_row_t *out, size_t max) {
+    if (!out || max == 0) {
+        return 0;
+    }
+    cbm_memev_flush_thread();
+    size_t n = 0;
+    lock_take(&g_merge_lock);
+    for (uint32_t i = 0; i < MEMEV_WORK_CAP && n < max; i++) {
+        uintptr_t key = atomic_load_explicit(&g_work_keys[i], memory_order_relaxed);
+        if (key == 0) {
+            continue;
+        }
+        const work_counters_t *g = &g_work_counters[i];
+        out[n++] = (cbm_work_row_t){
+            .site = key & MEMEV_SITE_MASK,
+            .kind = (cbm_work_kind_t)((key >> 56) - 1),
+            .calls = g->calls,
+            .bytes = g->bytes,
+            .aux1 = g->aux1,
+            .aux2 = g->aux2,
+            .repeats = g->repeats,
+            .peak = g->peak,
+        };
+    }
+    lock_drop(&g_merge_lock);
+    return n;
+}
+
+static bool write_all(int fd, const char *buf, size_t len) {
+    while (len > 0) {
+#ifdef _WIN32
+        int put = _write(fd, buf, (unsigned)len);
+#else
+        ssize_t put = write(fd, buf, len);
+#endif
+        if (put <= 0) {
+            return false;
+        }
+        buf += put;
+        len -= (size_t)put;
+    }
+    return true;
+}
+
+#if defined(__linux__)
+static int first_object_bias(struct dl_phdr_info *info, size_t size, void *out) {
+    (void)size;
+    *(uintptr_t *)out = (uintptr_t)info->dlpi_addr;
+    return 1; /* the first object is the main program */
+}
+#endif
+
+/* Sites are raw return addresses; the report subtracts the image base to get
+ * the address the symboliser expects. macOS records it when the zone observer
+ * installs; Linux (the load bias: 0 for a non-PIE binary) and Windows (the
+ * runtime module base) record it here, once, before the first dump. */
+static void ensure_image_base(void) {
+    if (atomic_load_explicit(&g_image_base, memory_order_relaxed) != 0) {
+        return;
+    }
+#if defined(__linux__)
+    uintptr_t bias = 0;
+    dl_iterate_phdr(first_object_bias, &bias);
+    atomic_store_explicit(&g_image_base, bias, memory_order_relaxed);
+#elif defined(_WIN32)
+    atomic_store_explicit(&g_image_base, (uintptr_t)GetModuleHandleW(NULL), memory_order_relaxed);
+#endif
+}
+
+static bool dump_locked(const char *path, const char *why) {
+    ensure_image_base();
+    cbm_memev_totals_t t;
+    cbm_memev_totals(&t);
+#ifdef _WIN32
+    int fd = _open(path, _O_WRONLY | _O_CREAT | _O_APPEND | _O_BINARY, 0600);
+    int pid = (int)GetCurrentProcessId();
+#else
+    int fd = open(path, O_WRONLY | O_CREAT | O_APPEND, 0600);
+    int pid = (int)getpid();
+#endif
+    if (fd < 0) {
+        return false;
+    }
+    char label[MEMEV_PHASE_LABEL];
+    lock_take(&g_merge_lock);
+    snprintf(label, sizeof(label), "%s", g_phase_label);
+    lock_drop(&g_merge_lock);
+    char line[MEMEV_LINE];
+    int len = snprintf(
+        line, sizeof(line),
+        "{\"memwaste\":2,\"why\":\"%s\",\"pid\":%d,\"image_base\":\"0x%llx\",\"phase\":%u,"
+        "\"phase_label\":\"%s\",\"rss_bytes\":%llu,\"allocs\":%llu,\"frees\":%llu,"
+        "\"untracked_frees\":%llu,\"foreign_frees\":%llu,\"reallocs\":%llu,\"requested_bytes\":%"
+        "llu,\"usable_bytes\":%llu,"
+        "\"realloc_copy_bytes\":%llu,\"live_bytes\":%llu,\"live_blocks\":%llu,\"raw_bytes\":%llu,"
+        "\"sites\":%llu,\"site_table_full\":%llu,\"pointer_table_full\":%llu,"
+        "\"work_table_full\":%llu,\"layer_vm_bytes\":%llu,\"layer_threads\":%lld,"
+        "\"fill\":%d,\"access\":%d}\n",
+        why ? why : "-", pid,
+        (unsigned long long)atomic_load_explicit(&g_image_base, memory_order_relaxed),
+        atomic_load_explicit(&g_phase, memory_order_relaxed), label,
+        (unsigned long long)cbm_mem_rss(), (unsigned long long)t.allocs,
+        (unsigned long long)t.frees, (unsigned long long)t.untracked_frees,
+        (unsigned long long)t.foreign_frees, (unsigned long long)t.reallocs,
+        (unsigned long long)t.requested_bytes, (unsigned long long)t.usable_bytes,
+        (unsigned long long)t.realloc_copy_bytes, (unsigned long long)t.live_bytes,
+        (unsigned long long)t.live_blocks, (unsigned long long)t.raw_bytes,
+        (unsigned long long)t.sites, (unsigned long long)t.site_table_full,
+        (unsigned long long)t.pointer_table_full, (unsigned long long)t.work_table_full,
+        (unsigned long long)atomic_load_explicit(&g_layer_vm_bytes, memory_order_relaxed),
+        (long long)atomic_load_explicit(&g_layer_threads, memory_order_relaxed),
+        fill_enabled() ? 1 : 0,
+#if defined(CBM_MEMWASTE_ACCESS) && CBM_MEMWASTE_ACCESS
+        1
+#else
+        0
+#endif
+    );
+    bool ok = len > 0 && (size_t)len < sizeof(line) && write_all(fd, line, (size_t)len);
+
+    lock_take(&g_merge_lock);
+    for (uint32_t i = 0; ok && i < MEMEV_SITE_CAP; i++) {
+        uintptr_t key = atomic_load_explicit(&g_site_keys[i], memory_order_relaxed);
+        if (key == 0) {
+            continue;
+        }
+        cbm_memev_site_t r;
+        site_row_of(i, key, &r);
+        len = snprintf(
+            line, sizeof(line),
+            "{\"site\":\"0x%llx\",\"allocs\":%llu,\"frees\":%llu,\"reallocs\":%llu,"
+            "\"requested_bytes\":%llu,\"usable_bytes\":%llu,\"realloc_copy_bytes\":%llu,"
+            "\"live_bytes\":%llu,\"live_blocks\":%llu,\"short_lived\":%llu,\"raw_bytes\":%llu,"
+            "\"scanned_blocks\":%llu,\"never_written_bytes\":%llu,\"over_requested_bytes\":%llu,"
+            "\"zero_untouched_bytes\":%llu,\"retained_bytes\":%llu,\"dup_bytes\":%llu,"
+            "\"dup_blocks\":%llu,\"acc_untouched_blocks\":%llu,\"acc_untouched_bytes\":%llu,"
+            "\"acc_dead_blocks\":%llu,\"acc_dead_bytes\":%llu,\"acc_uninit_reads\":%llu,"
+            "\"acc_idle_bytes\":%llu,\"acc_opaque_blocks\":%llu}\n",
+            (unsigned long long)r.site, (unsigned long long)r.allocs, (unsigned long long)r.frees,
+            (unsigned long long)r.reallocs, (unsigned long long)r.requested_bytes,
+            (unsigned long long)r.usable_bytes, (unsigned long long)r.realloc_copy_bytes,
+            (unsigned long long)r.live_bytes, (unsigned long long)r.live_blocks,
+            (unsigned long long)r.short_lived, (unsigned long long)r.raw_bytes,
+            (unsigned long long)r.scanned_blocks, (unsigned long long)r.never_written_bytes,
+            (unsigned long long)r.over_requested_bytes, (unsigned long long)r.zero_untouched_bytes,
+            (unsigned long long)r.retained_bytes, (unsigned long long)r.dup_bytes,
+            (unsigned long long)r.dup_blocks, (unsigned long long)r.acc_untouched_blocks,
+            (unsigned long long)r.acc_untouched_bytes, (unsigned long long)r.acc_dead_blocks,
+            (unsigned long long)r.acc_dead_bytes, (unsigned long long)r.acc_uninit_reads,
+            (unsigned long long)r.acc_idle_bytes, (unsigned long long)r.acc_opaque_blocks);
+        ok = len > 0 && (size_t)len < sizeof(line) && write_all(fd, line, (size_t)len);
+    }
+    for (uint32_t i = 0; ok && i < MEMEV_WORK_CAP; i++) {
+        uintptr_t key = atomic_load_explicit(&g_work_keys[i], memory_order_relaxed);
+        if (key == 0) {
+            continue;
+        }
+        const work_counters_t *g = &g_work_counters[i];
+        if (g->calls == 0) {
+            continue;
+        }
+        len = snprintf(line, sizeof(line),
+                       "{\"work\":\"%s\",\"site\":\"0x%llx\",\"calls\":%llu,\"bytes\":%llu,"
+                       "\"aux1\":%llu,\"aux2\":%llu,\"repeats\":%llu,\"peak\":%llu}\n",
+                       cbm_work_kind_name((cbm_work_kind_t)((key >> 56) - 1)),
+                       (unsigned long long)(key & MEMEV_SITE_MASK), (unsigned long long)g->calls,
+                       (unsigned long long)g->bytes, (unsigned long long)g->aux1,
+                       (unsigned long long)g->aux2, (unsigned long long)g->repeats,
+                       (unsigned long long)g->peak);
+        ok = len > 0 && (size_t)len < sizeof(line) && write_all(fd, line, (size_t)len);
+    }
+    lock_drop(&g_merge_lock);
+#ifdef _WIN32
+    _close(fd);
+#else
+    close(fd);
+#endif
+    return ok;
+}
+
+bool cbm_memev_dump(const char *path, const char *why) {
+    if (!path || !path[0]) {
+        return false;
+    }
+    static memev_lock_t dump_lock = ATOMIC_FLAG_INIT;
+    tl_state_t *st = tl_get();
+    bool was_busy = st && st->busy;
+    if (st && !was_busy) {
+        flush_state(st); /* this thread's pending events belong in the dump */
+    }
+    if (st) {
+        st->busy = true; /* the dump's own writes and allocations are not the program's work */
+    }
+    lock_take(&dump_lock);
+    bool ok = dump_locked(path, why);
+    lock_drop(&dump_lock);
+    if (st) {
+        st->busy = was_busy;
+    }
+    return ok;
+}
+
+void cbm_memev_reset_for_tests(void) {
+    cbm_memev_flush_thread();
+    lock_take(&g_merge_lock);
+    for (uint32_t i = 0; i < MEMEV_SITE_CAP; i++) {
+        atomic_store_explicit(&g_site_keys[i], 0, memory_order_relaxed);
+    }
+    for (uint32_t i = 0; i < MEMEV_WORK_CAP; i++) {
+        atomic_store_explicit(&g_work_keys[i], 0, memory_order_relaxed);
+    }
+    for (uint32_t i = 0; i < MEMEV_PATH_CAP; i++) {
+        atomic_store_explicit(&g_path_hashes[i], 0, memory_order_relaxed);
+    }
+    memset(g_site_counters, 0, sizeof(g_site_counters));
+    memset(g_work_counters, 0, sizeof(g_work_counters));
+    memset(g_snap_retained, 0, sizeof(g_snap_retained));
+    memset(g_snap_dup_bytes, 0, sizeof(g_snap_dup_bytes));
+    memset(g_snap_dup_blocks, 0, sizeof(g_snap_dup_blocks));
+    lock_drop(&g_merge_lock);
+    for (uint32_t i = 0; i < MEMEV_SHARDS; i++) {
+        shard_t *sh = &g_shards[i];
+        lock_take(&sh->lock);
+        vm_put(sh->entries, sh->entries ? ((size_t)1 << sh->bits) * sizeof(ptr_entry_t) : 0);
+        sh->entries = NULL;
+        sh->bits = 0;
+        sh->used = 0;
+        sh->live = 0;
+        lock_drop(&sh->lock);
+    }
+    atomic_store_explicit(&g_untracked_frees, 0, memory_order_relaxed);
+    atomic_store_explicit(&g_foreign_frees, 0, memory_order_relaxed);
+    atomic_store_explicit(&g_pointer_table_full, 0, memory_order_relaxed);
+    atomic_store_explicit(&g_site_table_full, 0, memory_order_relaxed);
+    atomic_store_explicit(&g_work_table_full, 0, memory_order_relaxed);
+    atomic_store_explicit(&g_phase, 0, memory_order_relaxed);
+    atomic_store_explicit(&g_fill, 0, memory_order_relaxed); /* tests use synthetic addresses */
+    tl_state_t *st = tl_peek();
+    if (st) {
+        st->hint_set = false;
+        memset(st->strlen_cache, 0, sizeof(st->strlen_cache));
+        memset(st->ht_cache, 0, sizeof(st->ht_cache));
+    }
+}
+
+#if defined(__clang__)
+#pragma clang attribute pop
+#endif
+
+#else /* layer compiled out: every entry point is an empty stub */
+
+bool cbm_memev_enabled(void) {
+    return false;
+}
+void cbm_memev_alloc(void *block, size_t requested, size_t usable, void *site) {
+    (void)block;
+    (void)requested;
+    (void)usable;
+    (void)site;
+}
+void cbm_memev_alloc_ex(void *block, size_t requested, size_t usable, void *site, unsigned flags) {
+    (void)block;
+    (void)requested;
+    (void)usable;
+    (void)site;
+    (void)flags;
+}
+void cbm_memev_free(void *block) {
+    (void)block;
+}
+void cbm_memev_free_foreign(void *block) {
+    (void)block;
+}
+void cbm_memev_realloc(void *old_block, void *grown, size_t requested, size_t usable, void *site) {
+    (void)old_block;
+    (void)grown;
+    (void)requested;
+    (void)usable;
+    (void)site;
+}
+void cbm_memev_hint(void *site, int mem_class) {
+    (void)site;
+    (void)mem_class;
+}
+bool cbm_memev_hint_pending(void) {
+    return false;
+}
+void cbm_memev_set_image_base(uintptr_t base) {
+    (void)base;
+}
+void cbm_memev_set_observer_installed(bool installed) {
+    (void)installed;
+}
+bool cbm_memev_observer_installed(void) {
+    return false;
+}
+void cbm_memev_flush_thread(void) {}
+void cbm_memev_phase(const char *label) {
+    (void)label;
+}
+const char *cbm_work_kind_name(cbm_work_kind_t kind) {
+    (void)kind;
+    return "off";
+}
+uint64_t cbm_memev_thread_ops(void) {
+    return 0;
+}
+void cbm_memev_process_role(const char *role) {
+    (void)role;
+}
+void cbm_memev_thread_end(void) {}
+void cbm_memev_process_exit(void) {}
+void cbm_memev_library_enter(void *site) {
+    (void)site;
+}
+void cbm_memev_library_leave(void) {}
+void *cbm_memev_library_site(void) {
+    return NULL;
+}
+void cbm_work_note(cbm_work_kind_t kind, void *site, uint64_t bytes, uint64_t aux1, uint64_t aux2) {
+    (void)kind;
+    (void)site;
+    (void)bytes;
+    (void)aux1;
+    (void)aux2;
+}
+void cbm_memev_da_note(size_t cap_bytes, size_t used_bytes, size_t cap_slots) {
+    (void)cap_bytes;
+    (void)used_bytes;
+    (void)cap_slots;
+}
+void cbm_work_note_strlen(void *site, const char *s, size_t len) {
+    (void)site;
+    (void)s;
+    (void)len;
+}
+void cbm_work_note_path(cbm_work_kind_t kind, void *site, const char *path, bool failed) {
+    (void)kind;
+    (void)site;
+    (void)path;
+    (void)failed;
+}
+void cbm_work_note_ht(cbm_work_kind_t kind, void *site, const void *table, const char *key,
+                      uint64_t generation, bool hit) {
+    (void)kind;
+    (void)site;
+    (void)table;
+    (void)key;
+    (void)generation;
+    (void)hit;
+}
+void cbm_memev_totals(cbm_memev_totals_t *out) {
+    if (out) {
+        *out = (cbm_memev_totals_t){0};
+    }
+}
+size_t cbm_memev_sites(cbm_memev_site_t *out, size_t max) {
+    (void)out;
+    (void)max;
+    return 0;
+}
+size_t cbm_work_rows(cbm_work_row_t *out, size_t max) {
+    (void)out;
+    (void)max;
+    return 0;
+}
+bool cbm_memev_dump(const char *path, const char *why) {
+    (void)path;
+    (void)why;
+    return false;
+}
+void cbm_memev_reset_for_tests(void) {}
+void cbm_memev_scan_for_tests(bool fill, bool dupes) {
+    (void)fill;
+    (void)dupes;
+}
+void cbm_memev_force_for_tests(bool on) {
+    (void)on;
+}
+
+#endif
diff --git a/src/foundation/mem_events.h b/src/foundation/mem_events.h
new file mode 100644
index 000000000..e244c4666
--- /dev/null
+++ b/src/foundation/mem_events.h
@@ -0,0 +1,358 @@
+/*
+ * mem_events.h — the waste sanitizer: memory and CPU work that is correct but
+ * unnecessary, attributed to the code that caused it.
+ *
+ * ASan, MSan, TSan and LSan find memory that is WRONG. Nothing in the tree
+ * measured memory or work that is merely WASTED — allocator slack, blocks
+ * bigger than what is written into them, churn an arena would have served,
+ * realloc chains copying the same bytes again, duplicate strings, memory held
+ * across phases that never touch it, the same string measured twice, the same
+ * file opened twice. The memory-core rounds found such waste BY HAND; this
+ * layer turns it into a ranked report.
+ *
+ * On 2026-09-17 a forwarding malloc-zone observer showed the Go indexing worker
+ * making 92.3 million raw allocations OUTSIDE the memory core on macOS — 128 GB
+ * requested cumulatively in a 41 s run — that no instrument in the tree saw.
+ *
+ * WHERE IT LISTENS
+ *   - the memory core (mem_core.c) announces its own calls with a site + class;
+ *   - platform observers see the malloc family underneath: the Linux and
+ *     Windows --wrap shims, the macOS malloc-zone observer;
+ *   - bound allocators that bypass both (SQLite, tree-sitter -> mimalloc) report
+ *     directly;
+ *   - containers (arena, dynamic array, hash table) report capacity vs use;
+ *   - libc wrappers (mem_override_libc.c) report byte and system-call work;
+ *   - the ACCESS lane (-fsanitize-coverage=trace-loads,trace-stores) reports
+ *     reads and writes of every tracked block.
+ *
+ * COSTS NOTHING UNLESS ASKED FOR. Compiled in only under -DCBM_MEMWASTE=1 (the
+ * `memwaste` build flavour, `make MEMWASTE=1`) and dormant unless CBM_MEMWASTE=1
+ * is set. The access lane additionally needs -DCBM_MEMWASTE_ACCESS=1
+ * (`make MEMWASTE_ACCESS=1`). Release binaries contain none of it.
+ *
+ * NO PER-BLOCK HEADER (see mem_core.h: 16 bytes x ~100 M kernel blocks is
+ * 1.6 GB). Block state lives in side tables backed by raw virtual memory, so
+ * the layer never calls the allocator it is observing.
+ *
+ * DETERMINISM (O9). Every quantity a gate may read is a SUM over events —
+ * per-site totals — or a snapshot taken at a phase mark after the workers
+ * joined. Nothing here reads a clock.
+ *
+ * ENVIRONMENT
+ *   CBM_MEMWASTE=1          wake the layer
+ *   CBM_MEMWASTE_OUT=path   append JSON-lines dumps at every phase mark
+ *   CBM_MEMWASTE_FILL=0     do not fill new blocks with the never-written pattern
+ *   CBM_MEMWASTE_DUPES=0    skip the duplicate-content scan at phase marks
+ */
+#ifndef CBM_MEM_EVENTS_H
+#define CBM_MEM_EVENTS_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+/* Class value for blocks that never passed through the memory core. */
+#define CBM_MEMEV_CLASS_RAW (-1)
+
+/* Allocation flags. */
+enum {
+    CBM_MEMEV_ZEROED = 1u,  /* calloc: the allocator zeroed it, never fill it */
+    CBM_MEMEV_FOREIGN = 2u, /* a system library allocating for itself: observe, never fill */
+    CBM_MEMEV_LIBRARY = 4u, /* allocated inside a wrapped library call, charged to its caller */
+    /* The block already holds its content when it is reported (a strdup copy, a
+     * realloc whose old block the layer never saw): observe, NEVER fill -- the
+     * fill pattern would overwrite live data. */
+    CBM_MEMEV_WRITTEN = 8u,
+};
+
+/* Blocks at or below this size take part in the duplicate-content scan. */
+enum { CBM_MEMEV_DUP_MAX = 256 };
+
+/* Freed by the allocating thread within this many of its own allocations:
+ * churn an arena or a stack buffer would have served. */
+enum { CBM_MEMEV_CHURN_WINDOW = 64 };
+
+/* True when the layer is compiled in AND CBM_MEMWASTE=1. Cached after the
+ * first call; safe from inside an allocator hook (it never allocates). */
+bool cbm_memev_enabled(void);
+
+/* ── Allocation events ────────────────────────────────────────────────
+ * `site` is a return address inside the code that asked for the memory.
+ * `usable` is what the allocator actually handed out (0 when unknown: the
+ * layer then charges `requested`). All return immediately when dormant. */
+void cbm_memev_alloc(void *block, size_t requested, size_t usable, void *site);
+void cbm_memev_alloc_ex(void *block, size_t requested, size_t usable, void *site, unsigned flags);
+void cbm_memev_free(void *block);
+/* A free of a block another allocator made (Windows: the C runtime or a system
+ * DLL allocating where --wrap cannot reach). Counted apart from untracked
+ * frees: its allocation was never observable, so it says what the layer cannot
+ * see, not that the layer missed something it should have seen. */
+void cbm_memev_free_foreign(void *block);
+/* One event for a realloc: the old block's record moves to `grown`, the copy
+ * the allocator had to make is charged to the ORIGINAL allocation site. */
+void cbm_memev_realloc(void *old_block, void *grown, size_t requested, size_t usable, void *site);
+
+/* ── Core <-> observer handshake ──────────────────────────────────────
+ * The memory core and a platform observer can both see one allocation. The
+ * core announces itself first; the observer consumes the hint and the event
+ * carries the CORE's caller as site and the class attached. When nothing
+ * consumed the hint, the core reports the event itself:
+ *
+ *   cbm_memev_hint(site, cls);
+ *   block = backing_malloc(n);
+ *   if (cbm_memev_hint_pending()) {
+ *       cbm_memev_alloc(block, n, usable, NULL);
+ *   }
+ *
+ * FREES HAVE NO HANDSHAKE, on purpose: a free event must be recorded BEFORE
+ * the block goes back to the allocator, or another thread can be handed the
+ * same address, record its allocation, and have it erased by the late free.
+ * Where an observer sees the backing allocator it reports frees; everywhere
+ * else the core reports them itself, first. */
+void cbm_memev_hint(void *site, int mem_class);
+bool cbm_memev_hint_pending(void);
+void cbm_memev_set_observer_installed(bool installed);
+bool cbm_memev_observer_installed(void);
+
+/* Load address of the main image, written into every report header: sites are
+ * raw addresses in a randomised process, and offline symbolisation needs the
+ * base they are relative to. 0 = unknown. */
+void cbm_memev_set_image_base(uintptr_t base);
+
+/* ── Merge points ─────────────────────────────────────────────────────
+ * Per-thread counters are pushed to the shared tables here: work-item end,
+ * thread end, before any reader. */
+void cbm_memev_flush_thread(void);
+
+/* This thread is ending: merge its counters and release its state now. POSIX
+ * does this from a pthread key destructor. A static MinGW link runs no FLS or
+ * key destructors at thread exit (the same reason compat_thread.c releases the
+ * mimalloc thread heap from a loader TLS callback, #581), so Windows threads
+ * left their 22 MB state behind -- 71 of them by the similarity pass on the
+ * Go corpus, then commit exhaustion (2026-09-17). Safe to call twice. */
+void cbm_memev_thread_end(void);
+
+/* A pipeline phase boundary. Blocks allocated from now on carry the new phase;
+ * the live set is snapshotted (retained-across-phases, duplicate content) and
+ * a dump is appended to CBM_MEMWASTE_OUT. Called after the workers joined. */
+void cbm_memev_phase(const char *label);
+
+/* ── Process role and exit ────────────────────────────────────────────
+ * The index worker leaves with _Exit (no exit handlers: multi-GB teardown is
+ * skipped), which also skips every at-exit writer -- the waste dump and clang's
+ * profile runtime. cbm_memev_process_exit writes both first; it is a no-op when
+ * neither lane is compiled in or active.
+ * cbm_memev_process_role names this process's execution-count profile
+ * <CBM_PROFILE_DIR>/<role>-<pid>.profraw, so the scaling lane can compare the
+ * worker's work without the daemon and CLI processes mixed in. */
+void cbm_memev_process_role(const char *role);
+void cbm_memev_process_exit(void);
+
+/* ── Access lane: what the compiler cannot see ─────────────────────────
+ * The access lane learns about reads and writes from compiler callbacks, and a
+ * library call is not compiled with them: a block filled by memcpy or read(2)
+ * would look never written. The library wrappers report those ranges here.
+ * While the allocator itself runs (a realloc copying the old block), its reads
+ * and writes are not the program's: the shims bracket every backing call that
+ * can copy. Both vanish outside the access lane. */
+#if defined(CBM_MEMWASTE_ACCESS) && CBM_MEMWASTE_ACCESS
+void cbm_memev_access(const void *p, size_t n, bool store, void *pc);
+void cbm_memev_backing(int delta);
+#define CBM_MEMEV_ACCESS(p, n, store, pc) cbm_memev_access((p), (n), (store), (pc))
+#define CBM_MEMEV_BACKING(delta) cbm_memev_backing(delta)
+#else
+#define CBM_MEMEV_ACCESS(p, n, store, pc) ((void)0)
+#define CBM_MEMEV_BACKING(delta) ((void)0)
+#endif
+
+/* A wrapped library call (fopen, fread, opendir...) is running on this thread.
+ * Memory the library allocates for itself meanwhile -- a FILE buffer, a DIR
+ * stream -- is charged to `site` (the wrapper's caller) with CBM_MEMEV_LIBRARY:
+ * it is counted like any memory, but the access lane leaves it alone, because
+ * only the uninstrumented library ever reads it. Nestable; the outermost site
+ * wins. */
+void cbm_memev_library_enter(void *site);
+void cbm_memev_library_leave(void);
+void *cbm_memev_library_site(void);
+
+/* ── CPU work ─────────────────────────────────────────────────────────
+ * Work is COUNTED, never timed: a count is a function of the code and the
+ * input, so it can gate. Semantics of the counters per kind:
+ *
+ *   kind              bytes             aux1                aux2
+ *   memcpy..strncmp   bytes processed   -                   -
+ *   read, write,
+ *   pread, pwrite,
+ *   fread, fwrite     bytes transferred tiny calls (<512 B) -
+ *   open, stat,
+ *   fopen, opendir    -                 failures            -
+ *   readdir           -                 -                   -
+ *   mutex             -                 contended           -
+ *   parallel_for      items             imbalance items     workers
+ *   pool_ops          events by workers imbalance events    workers
+ *   ht_get            -                 misses              -
+ *   ht_set            -                 table growths       -
+ *   dead_write        bytes never read  blocks              -
+ *   ct_arena,
+ *   ct_dyn_array,
+ *   ct_hash_table     capacity bytes    used bytes          growths
+ *
+ * `repeats` counts the same work done again, where the answer cannot have
+ * changed: strlen of the same pointer holding the same bytes (recent, same
+ * thread), open/stat of the same path (process-wide), a hash-table lookup of
+ * the same key TEXT in the same table with no write to that table in between
+ * (recent, same thread). A reused buffer holding a different string is not a
+ * repeat.
+ *
+ * `peak` is the largest single note: the biggest call for byte work and I/O,
+ * and for containers the largest capacity one instance left unused. Containers
+ * report at every reset, so `bytes` and `aux1` sum over USES (a per-thread arena
+ * rewound for 28,000 files reports 28,000 times); `peak` is the memory figure. */
+typedef enum {
+    CBM_WORK_MEMCPY = 0,
+    CBM_WORK_MEMMOVE,
+    CBM_WORK_MEMSET,
+    CBM_WORK_MEMCMP,
+    CBM_WORK_STRLEN,
+    CBM_WORK_STRCMP,
+    CBM_WORK_STRNCMP,
+    CBM_WORK_READ,
+    CBM_WORK_WRITE,
+    CBM_WORK_PREAD,
+    CBM_WORK_PWRITE,
+    CBM_WORK_OPEN,
+    CBM_WORK_STAT,
+    CBM_WORK_FOPEN,
+    CBM_WORK_FREAD,
+    CBM_WORK_FWRITE,
+    CBM_WORK_OPENDIR,
+    CBM_WORK_READDIR,
+    CBM_WORK_MUTEX,
+    CBM_WORK_PARALLEL_FOR,
+    CBM_WORK_POOL_OPS,
+    CBM_WORK_HT_GET,
+    CBM_WORK_HT_SET,
+    CBM_WORK_DEAD_WRITE,
+    CBM_WORK_CT_ARENA,
+    CBM_WORK_CT_DYN_ARRAY,
+    CBM_WORK_CT_HASH_TABLE,
+    CBM_WORK_KIND_COUNT
+} cbm_work_kind_t;
+
+enum { CBM_WORK_TINY_IO = 512 };
+
+const char *cbm_work_kind_name(cbm_work_kind_t kind);
+void cbm_work_note(cbm_work_kind_t kind, void *site, uint64_t bytes, uint64_t aux1, uint64_t aux2);
+void cbm_work_note_strlen(void *site, const char *s, size_t len);
+
+/* Events (allocations and work notes) this thread has produced so far. A pool
+ * compares its workers by this: a pool over N work SLOTS whose workers each pull
+ * their own items shows its real imbalance only in the work done. */
+uint64_t cbm_memev_thread_ops(void);
+
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE && !defined(_WIN32)
+/* The one counting lock behind every pthread_mutex_lock in the flavour
+ * (mem_override_libc.c): try first, count a contended acquisition at `site`,
+ * then block. cbm_mutex_lock passes its own caller as the site. */
+int cbm_memev_mutex_lock(void *pthread_mutex, void *site);
+#endif
+void cbm_work_note_path(cbm_work_kind_t kind, void *site, const char *path, bool failed);
+/* `generation` is the table's write counter: a lookup repeats only when the
+ * table has not been written since the same key was last looked up. */
+void cbm_work_note_ht(cbm_work_kind_t kind, void *site, const void *table, const char *key,
+                      uint64_t generation, bool hit);
+
+/* Containers report capacity against use when they are freed or reset.
+ * `site` is where the container was created. */
+static inline void cbm_memev_container(cbm_work_kind_t kind, void *site, uint64_t capacity,
+                                       uint64_t used, uint64_t growths) {
+    cbm_work_note(kind, site, capacity, used, growths);
+}
+
+/* A dynamic array being freed: capacity against count, in bytes. The site is
+ * the function that freed it (the helper is never inlined, so its return
+ * address lands there). Growths are the doublings from 8 slots to `cap`. */
+void cbm_memev_da_note(size_t cap_bytes, size_t used_bytes, size_t cap_slots);
+
+/* ── Report ───────────────────────────────────────────────────────────*/
+typedef struct {
+    uint64_t allocs;          /* alloc events seen */
+    uint64_t frees;           /* free events matched to a tracked block */
+    uint64_t untracked_frees; /* frees of blocks the layer never saw */
+    uint64_t foreign_frees;   /* frees of blocks another allocator made */
+    uint64_t reallocs;
+    uint64_t requested_bytes;    /* cumulative */
+    uint64_t usable_bytes;       /* cumulative */
+    uint64_t realloc_copy_bytes; /* bytes the allocator had to move */
+    uint64_t live_bytes;         /* usable bytes outstanding now */
+    uint64_t live_blocks;
+    uint64_t raw_bytes; /* cumulative usable bytes never tagged by the core */
+    uint64_t sites;     /* distinct allocation sites */
+    /* Records the fixed tables could not hold. A profiler that silently loses
+     * records produces false confidence; these make the blind spot a number. */
+    uint64_t site_table_full;
+    uint64_t pointer_table_full;
+    uint64_t work_table_full;
+} cbm_memev_totals_t;
+
+void cbm_memev_totals(cbm_memev_totals_t *out);
+
+typedef struct {
+    uintptr_t site;
+    uint64_t allocs;
+    uint64_t frees;
+    uint64_t reallocs;
+    uint64_t requested_bytes;
+    uint64_t usable_bytes;
+    uint64_t realloc_copy_bytes;
+    uint64_t live_bytes;
+    uint64_t live_blocks;
+    uint64_t short_lived;
+    uint64_t raw_bytes;
+    /* fill-pattern scan at free */
+    uint64_t scanned_blocks;
+    uint64_t never_written_bytes;  /* bytes still holding the fill pattern */
+    uint64_t over_requested_bytes; /* requested beyond the last written byte */
+    uint64_t zero_untouched_bytes; /* calloc: trailing zero bytes (upper bound) */
+    /* phase snapshot (the most recent phase mark) */
+    uint64_t retained_bytes; /* live, allocated in an EARLIER phase */
+    uint64_t dup_bytes;      /* live small blocks identical to another */
+    uint64_t dup_blocks;
+    /* access lane */
+    uint64_t acc_untouched_blocks;
+    uint64_t acc_untouched_bytes;
+    uint64_t acc_dead_blocks; /* written, never read */
+    uint64_t acc_dead_bytes;
+    uint64_t acc_uninit_reads;  /* read before any write, not calloc */
+    uint64_t acc_idle_bytes;    /* last accessed in an earlier phase than freed */
+    uint64_t acc_opaque_blocks; /* written (fill scan) with no callback: no verdict possible */
+} cbm_memev_site_t;
+
+size_t cbm_memev_sites(cbm_memev_site_t *out, size_t max);
+
+typedef struct {
+    uintptr_t site;
+    cbm_work_kind_t kind;
+    uint64_t calls;
+    uint64_t bytes;
+    uint64_t aux1;
+    uint64_t aux2;
+    uint64_t repeats;
+    uint64_t peak;
+} cbm_work_row_t;
+
+size_t cbm_work_rows(cbm_work_row_t *out, size_t max);
+
+/* Append the report as JSON lines to `path`: one header object, one object per
+ * allocation site, one per work row. Raw addresses; symbolisation is offline
+ * (scripts/memwaste-report.py). `why` labels the dump. */
+bool cbm_memev_dump(const char *path, const char *why);
+
+/* Test seams. Never called in production. */
+void cbm_memev_reset_for_tests(void);
+void cbm_memev_force_for_tests(bool on);
+/* Tests that hand the layer REAL memory turn the fill pattern and the duplicate
+ * scan on (reset turns fill off: most tests use synthetic addresses). */
+void cbm_memev_scan_for_tests(bool fill, bool dupes);
+
+#endif /* CBM_MEM_EVENTS_H */
diff --git a/src/foundation/mem_override_darwin.c b/src/foundation/mem_override_darwin.c
new file mode 100644
index 000000000..80997b768
--- /dev/null
+++ b/src/foundation/mem_override_darwin.c
@@ -0,0 +1,266 @@
+/*
+ * mem_override_darwin.c — the macOS allocation observer of the waste sanitizer.
+ *
+ * WHY THIS FILE EXISTS
+ *
+ * Linux and Windows observe the malloc family through the linker's --wrap
+ * (mem_override_posix.c, mem_override_win.c). macOS ld has no --wrap, and the
+ * mimalloc global override is off there permanently: the two-level namespace
+ * splits this binary's free from the system libraries' malloc, and a pointer
+ * crossing that boundary aborts. So on macOS nothing saw raw malloc at all —
+ * the platform the project is developed on was the one platform that could not
+ * be measured.
+ *
+ * HOW IT WORKS
+ *
+ * A malloc ZONE that forwards every entry to the original default zone and
+ * reports the event. Forwarding is the whole safety argument: a block never
+ * changes allocator, so there is no boundary for it to cross. The zone claims
+ * ownership through size(), which is what routes free() back through it.
+ *
+ * Proven on 2026-09-17 inside the real indexer (Go corpus): no abort, a block
+ * allocated BEFORE installation frees cleanly after it, wall time 41.2 s ->
+ * 41.3 s, and 92.3 million raw allocations that nothing had ever counted.
+ *
+ * THREE TRAPS, each one hit during that proof:
+ *   1. malloc_default_zone() returns a VIRTUAL wrapper that dispatches to
+ *      whatever is default at call time. Forwarding to it recurses forever once
+ *      this zone is the default. The real slot 0 comes from
+ *      malloc_get_all_zones().
+ *   2. Registration appends. The default is slot 0, and the only way in is the
+ *      rotation jemalloc uses: unregister slot 0 (the last zone moves into it),
+ *      re-register it (appended), until this zone is first.
+ *   3. free() arrives through free_definite_size, not through free.
+ *
+ * Compiled only into the `memwaste` flavour; dormant unless CBM_MEMWASTE=1.
+ */
+#if defined(__APPLE__) && defined(CBM_MEMWASTE) && CBM_MEMWASTE
+
+#include "foundation/mem_events.h"
+
+#include <mach-o/dyld.h>
+#include <mach-o/getsect.h>
+#include <mach/mach.h>
+#include <malloc/malloc.h>
+#include <pthread.h>
+#include <stdint.h>
+#include <string.h>
+
+enum { OBS_ZONE_VERSION = 9, OBS_MAX_ROTATIONS = 16, OBS_MAX_FRAMES = 24 };
+
+static malloc_zone_t *g_orig;
+static malloc_zone_t g_obs;
+static uintptr_t g_text_lo;
+static uintptr_t g_text_hi;
+
+/* The site of a raw allocation is the first return address inside OUR image:
+ * above the zone entry sit libmalloc's own frames, and often libc's (strdup,
+ * getpwuid), before the code of ours that caused the call. Frames are walked
+ * through the frame-pointer chain, bounded by this thread's stack, so a
+ * foreign or corrupt frame ends the walk instead of faulting. */
+static void *caller_site(void *frame, unsigned *flags) {
+    *flags = 0;
+    if (cbm_memev_hint_pending()) {
+        return NULL; /* the memory core already named the site */
+    }
+    void *library_caller = cbm_memev_library_site();
+    if (library_caller) {
+        *flags = CBM_MEMEV_LIBRARY; /* a FILE buffer, a DIR stream: the library's own */
+        return library_caller;
+    }
+    pthread_t self = pthread_self();
+    uintptr_t hi = (uintptr_t)pthread_get_stackaddr_np(self);
+    uintptr_t lo = hi - pthread_get_stacksize_np(self);
+    uintptr_t *fp = (uintptr_t *)frame;
+    void *first = NULL;
+    for (int depth = 0; depth < OBS_MAX_FRAMES; depth++) {
+        if ((uintptr_t)fp < lo || (uintptr_t)fp + (2 * sizeof(uintptr_t)) > hi ||
+            ((uintptr_t)fp & (sizeof(uintptr_t) - 1)) != 0) {
+            break;
+        }
+        uintptr_t ret = fp[1];
+        uintptr_t *next = (uintptr_t *)fp[0];
+        if (ret == 0) {
+            break;
+        }
+        if (!first) {
+            first = (void *)ret;
+        }
+        if (ret >= g_text_lo && ret < g_text_hi) {
+            return (void *)ret;
+        }
+        if (next <= fp) {
+            break; /* the chain must climb */
+        }
+        fp = next;
+    }
+    *flags = CBM_MEMEV_FOREIGN;
+    return first; /* a system library allocating for itself: observe, never fill */
+}
+
+static size_t obs_size(malloc_zone_t *z, const void *p) {
+    (void)z;
+    return g_orig->size(g_orig, p);
+}
+
+static void *obs_malloc(malloc_zone_t *z, size_t n) {
+    (void)z;
+    void *p = g_orig->malloc(g_orig, n);
+    if (p && cbm_memev_enabled()) {
+        unsigned flags;
+        void *site = caller_site(__builtin_frame_address(0), &flags);
+        cbm_memev_alloc_ex(p, n, g_orig->size(g_orig, p), site, flags);
+    }
+    return p;
+}
+
+static void *obs_calloc(malloc_zone_t *z, size_t count, size_t n) {
+    (void)z;
+    void *p = g_orig->calloc(g_orig, count, n);
+    if (p && cbm_memev_enabled()) {
+        unsigned flags;
+        void *site = caller_site(__builtin_frame_address(0), &flags);
+        cbm_memev_alloc_ex(p, count * n, g_orig->size(g_orig, p), site, flags | CBM_MEMEV_ZEROED);
+    }
+    return p;
+}
+
+static void *obs_valloc(malloc_zone_t *z, size_t n) {
+    (void)z;
+    void *p = g_orig->valloc(g_orig, n);
+    if (p && cbm_memev_enabled()) {
+        unsigned flags;
+        void *site = caller_site(__builtin_frame_address(0), &flags);
+        cbm_memev_alloc_ex(p, n, g_orig->size(g_orig, p), site, flags);
+    }
+    return p;
+}
+
+static void *obs_memalign(malloc_zone_t *z, size_t align, size_t n) {
+    (void)z;
+    void *p = g_orig->memalign(g_orig, align, n);
+    if (p && cbm_memev_enabled()) {
+        unsigned flags;
+        void *site = caller_site(__builtin_frame_address(0), &flags);
+        cbm_memev_alloc_ex(p, n, g_orig->size(g_orig, p), site, flags);
+    }
+    return p;
+}
+
+static void *obs_realloc(malloc_zone_t *z, void *p, size_t n) {
+    (void)z;
+    unsigned flags = 0;
+    void *site = cbm_memev_enabled() ? caller_site(__builtin_frame_address(0), &flags) : NULL;
+    CBM_MEMEV_BACKING(1);
+    void *q = g_orig->realloc(g_orig, p, n);
+    CBM_MEMEV_BACKING(-1);
+    if (q && cbm_memev_enabled()) {
+        cbm_memev_realloc(p, q, n, g_orig->size(g_orig, q), site);
+    }
+    return q;
+}
+
+static void obs_free(malloc_zone_t *z, void *p) {
+    (void)z;
+    cbm_memev_free(p);
+    g_orig->free(g_orig, p);
+}
+
+static void obs_free_definite_size(malloc_zone_t *z, void *p, size_t n) {
+    (void)z;
+    cbm_memev_free(p);
+    if (g_orig->free_definite_size) {
+        g_orig->free_definite_size(g_orig, p, n);
+    } else {
+        g_orig->free(g_orig, p);
+    }
+}
+
+static unsigned obs_batch_malloc(malloc_zone_t *z, size_t size, void **results, unsigned count) {
+    (void)z;
+    unsigned got = g_orig->batch_malloc ? g_orig->batch_malloc(g_orig, size, results, count) : 0;
+    if (cbm_memev_enabled()) {
+        unsigned flags;
+        void *site = caller_site(__builtin_frame_address(0), &flags);
+        for (unsigned i = 0; i < got; i++) {
+            cbm_memev_alloc_ex(results[i], size, g_orig->size(g_orig, results[i]), site, flags);
+        }
+    }
+    return got;
+}
+
+static void obs_batch_free(malloc_zone_t *z, void **blocks, unsigned count) {
+    (void)z;
+    for (unsigned i = 0; i < count; i++) {
+        cbm_memev_free(blocks[i]);
+    }
+    if (g_orig->batch_free) {
+        g_orig->batch_free(g_orig, blocks, count);
+    }
+}
+
+static void obs_destroy(malloc_zone_t *z) {
+    (void)z;
+}
+
+static size_t obs_pressure_relief(malloc_zone_t *z, size_t goal) {
+    (void)z;
+    return g_orig->pressure_relief ? g_orig->pressure_relief(g_orig, goal) : 0;
+}
+
+static malloc_zone_t *slot_zero(void) {
+    vm_address_t *zones = NULL;
+    unsigned count = 0;
+    if (malloc_get_all_zones(mach_task_self(), NULL, &zones, &count) != KERN_SUCCESS ||
+        count == 0) {
+        return NULL;
+    }
+    return (malloc_zone_t *)zones[0];
+}
+
+__attribute__((constructor)) static void cbm_mem_observe_install(void) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    const struct mach_header_64 *hdr = (const struct mach_header_64 *)_dyld_get_image_header(0);
+    unsigned long text_size = 0;
+    uint8_t *text = hdr ? getsegmentdata(hdr, "__TEXT", &text_size) : NULL;
+    g_text_lo = (uintptr_t)text;
+    g_text_hi = g_text_lo + text_size;
+    cbm_memev_set_image_base((uintptr_t)hdr);
+
+    g_orig = slot_zero();
+    if (!g_orig) {
+        return;
+    }
+    memset(&g_obs, 0, sizeof(g_obs));
+    g_obs.size = obs_size;
+    g_obs.malloc = obs_malloc;
+    g_obs.calloc = obs_calloc;
+    g_obs.valloc = obs_valloc;
+    g_obs.free = obs_free;
+    g_obs.realloc = obs_realloc;
+    g_obs.destroy = obs_destroy;
+    g_obs.zone_name = "cbm_memwaste_observer";
+    g_obs.batch_malloc = obs_batch_malloc;
+    g_obs.batch_free = obs_batch_free;
+    g_obs.introspect = g_orig->introspect; /* leaks/heap keep working */
+    g_obs.version = OBS_ZONE_VERSION;
+    g_obs.memalign = obs_memalign;
+    g_obs.free_definite_size = obs_free_definite_size;
+    g_obs.pressure_relief = obs_pressure_relief;
+    malloc_zone_register(&g_obs);
+    for (int spin = 0; spin < OBS_MAX_ROTATIONS; spin++) {
+        malloc_zone_t *first = slot_zero();
+        if (!first || first == &g_obs) {
+            break;
+        }
+        malloc_zone_unregister(first);
+        malloc_zone_register(first);
+    }
+    cbm_memev_set_observer_installed(slot_zero() == &g_obs);
+}
+
+#else
+typedef int cbm_mem_override_darwin_unused_t;
+#endif
diff --git a/src/foundation/mem_override_libc.c b/src/foundation/mem_override_libc.c
new file mode 100644
index 000000000..4e320f23c
--- /dev/null
+++ b/src/foundation/mem_override_libc.c
@@ -0,0 +1,745 @@
+/*
+ * mem_override_libc.c — the CPU lane of the waste sanitizer: byte work and
+ * system calls, counted per call site.
+ *
+ * WHAT IT COUNTS. memcpy, memmove, memset, memcmp, strlen, strcmp, strncmp
+ * (calls and bytes), read/write/pread/pwrite/fread/fwrite (bytes and tiny
+ * calls), open/stat/fopen/opendir (failures and the same path again), readdir,
+ * and pthread_mutex_lock (contended acquisitions; POSIX only -- Windows locks
+ * are counted where cbm_mutex_lock takes them).
+ * Calls the compiler inlines (small constant-size copies) are not calls and are
+ * not counted: what is counted is exactly the work that reaches the library.
+ *
+ * HOW IT LISTENS, per platform
+ *   Linux, Windows  the linker's --wrap redirects every reference in OUR
+ *                   objects to __wrap_<name>; __real_<name> is the original.
+ *                   The flavour adds the flags (Makefile.cbm, MEMWASTE=1).
+ *   macOS           ld has no --wrap and dyld ignores __interpose tuples in the
+ *                   main executable (proven 2026-09-17). Instead this file
+ *                   DEFINES the symbols: references in our objects bind to the
+ *                   definitions in our own image, and each definition reaches
+ *                   libSystem's through dlsym(RTLD_NEXT). Calls made inside
+ *                   libSystem keep libSystem's own functions. Fortified builds
+ *                   call __memcpy_chk and friends, so those are defined too.
+ *
+ * The CALLER's return address is the site: this file is the observation point.
+ * Compiled only into the `memwaste` flavour; dormant unless CBM_MEMWASTE=1.
+ * Everything here forwards unconditionally: counting can only ever be skipped,
+ * never the work.
+ */
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+
+#include "foundation/mem_events.h"
+
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#if !defined(_WIN32)
+#include <pthread.h>
+#endif
+
+#if defined(__clang__)
+#pragma clang attribute push(__attribute__((no_sanitize("coverage"))), apply_to = function)
+#endif
+
+#define SITE() __builtin_return_address(0)
+
+static inline void note_io(cbm_work_kind_t kind, void *site, long long got, size_t asked) {
+    if (!cbm_memev_enabled()) {
+        return;
+    }
+    uint64_t bytes = got > 0 ? (uint64_t)got : 0;
+    cbm_work_note(kind, site, bytes, (asked > 0 && asked < CBM_WORK_TINY_IO) ? 1 : 0, 0);
+}
+
+/* Access lane: a library call's reads and writes, charged to its caller. */
+#define ACC_LOAD(p, n) CBM_MEMEV_ACCESS((p), (n), false, SITE())
+#define ACC_STORE(p, n) CBM_MEMEV_ACCESS((p), (n), true, SITE())
+
+static inline void note_bytes(cbm_work_kind_t kind, void *site, size_t n) {
+    if (cbm_memev_enabled()) {
+        cbm_work_note(kind, site, n, 0, 0);
+    }
+}
+
+/* ══════════════════════════════════════════════════════════════════════ */
+#if defined(__APPLE__)
+
+#include <dirent.h>
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#undef memcpy
+#undef memmove
+#undef memset
+#undef strlen
+#undef strcmp
+#undef strncmp
+#undef memcmp
+
+/* Resolved in a constructor. Until then the byte functions run a plain loop
+ * (dlsym and the dynamic loader call them before any constructor), marked
+ * no_builtin so the optimiser cannot turn the loop back into a call to itself. */
+static void *(*r_memcpy)(void *, const void *, size_t);
+static void *(*r_memmove)(void *, const void *, size_t);
+static void *(*r_memset)(void *, int, size_t);
+static int (*r_memcmp)(const void *, const void *, size_t);
+static size_t (*r_strlen)(const char *);
+static int (*r_strcmp)(const char *, const char *);
+static int (*r_strncmp)(const char *, const char *, size_t);
+static void *(*r_memcpy_chk)(void *, const void *, size_t, size_t);
+static void *(*r_memmove_chk)(void *, const void *, size_t, size_t);
+static void *(*r_memset_chk)(void *, int, size_t, size_t);
+static ssize_t (*r_read)(int, void *, size_t);
+static ssize_t (*r_write)(int, const void *, size_t);
+static ssize_t (*r_pread)(int, void *, size_t, off_t);
+static ssize_t (*r_pwrite)(int, const void *, size_t, off_t);
+static int (*r_open)(const char *, int, ...);
+static int (*r_stat)(const char *, struct stat *);
+static int (*r_lstat)(const char *, struct stat *);
+static FILE *(*r_fopen)(const char *, const char *);
+static size_t (*r_fread)(void *, size_t, size_t, FILE *);
+static size_t (*r_fwrite)(const void *, size_t, size_t, FILE *);
+static DIR *(*r_opendir)(const char *);
+static struct dirent *(*r_readdir)(DIR *);
+static int (*r_mutex_lock)(pthread_mutex_t *);
+static int (*r_mutex_trylock)(pthread_mutex_t *);
+
+__attribute__((constructor(101))) static void libc_resolve(void) {
+    r_memcpy = dlsym(RTLD_NEXT, "memcpy");
+    r_memmove = dlsym(RTLD_NEXT, "memmove");
+    r_memset = dlsym(RTLD_NEXT, "memset");
+    r_memcmp = dlsym(RTLD_NEXT, "memcmp");
+    r_strlen = dlsym(RTLD_NEXT, "strlen");
+    r_strcmp = dlsym(RTLD_NEXT, "strcmp");
+    r_strncmp = dlsym(RTLD_NEXT, "strncmp");
+    r_memcpy_chk = dlsym(RTLD_NEXT, "__memcpy_chk");
+    r_memmove_chk = dlsym(RTLD_NEXT, "__memmove_chk");
+    r_memset_chk = dlsym(RTLD_NEXT, "__memset_chk");
+    r_read = dlsym(RTLD_NEXT, "read");
+    r_write = dlsym(RTLD_NEXT, "write");
+    r_pread = dlsym(RTLD_NEXT, "pread");
+    r_pwrite = dlsym(RTLD_NEXT, "pwrite");
+    r_open = dlsym(RTLD_NEXT, "open");
+    r_stat = dlsym(RTLD_NEXT, "stat");
+    r_lstat = dlsym(RTLD_NEXT, "lstat");
+    r_fopen = dlsym(RTLD_NEXT, "fopen");
+    r_fread = dlsym(RTLD_NEXT, "fread");
+    r_fwrite = dlsym(RTLD_NEXT, "fwrite");
+    r_opendir = dlsym(RTLD_NEXT, "opendir");
+    r_readdir = dlsym(RTLD_NEXT, "readdir");
+    r_mutex_lock = dlsym(RTLD_NEXT, "pthread_mutex_lock");
+    r_mutex_trylock = dlsym(RTLD_NEXT, "pthread_mutex_trylock");
+}
+
+/* System calls are only reachable after libc_resolve; a call from an earlier
+ * constructor resolves its own target once. */
+#define RESOLVED(ptr, name) ((ptr) ? (ptr) : ((ptr) = dlsym(RTLD_NEXT, name)))
+
+/* Spelled through a macro only because the three builtin names plus this
+ * signature come to 117 columns, and a wrapped attribute is the one thing
+ * clang-format 20 and 22 lay out differently -- CI runs 20, the local lane runs
+ * Homebrew's 22, so the wrapped form passed here and failed there. Fitting the
+ * line under the 100-column limit leaves no wrapping decision to disagree on.
+ * The siblings below fit as they are and stay inline. */
+#define NO_BUILTIN_MEM __attribute__((no_builtin("memcpy", "memmove", "memset")))
+
+NO_BUILTIN_MEM static void *slow_move(void *d, const void *s, size_t n) {
+    unsigned char *dd = (unsigned char *)d;
+    const unsigned char *ss = (const unsigned char *)s;
+    if (dd < ss) {
+        for (size_t i = 0; i < n; i++) {
+            dd[i] = ss[i];
+        }
+    } else {
+        for (size_t i = n; i > 0; i--) {
+            dd[i - 1] = ss[i - 1];
+        }
+    }
+    return d;
+}
+
+__attribute__((no_builtin("memset"))) static void *slow_set(void *d, int c, size_t n) {
+    unsigned char *dd = (unsigned char *)d;
+    for (size_t i = 0; i < n; i++) {
+        dd[i] = (unsigned char)c;
+    }
+    return d;
+}
+
+__attribute__((no_builtin("strlen"))) static size_t slow_strlen(const char *s) {
+    size_t i = 0;
+    while (s[i]) {
+        i++;
+    }
+    return i;
+}
+
+__attribute__((no_builtin("memcmp", "strcmp", "strncmp"))) static int slow_ncmp(const char *a,
+                                                                                const char *b,
+                                                                                size_t n,
+                                                                                bool stop_at_nul) {
+    for (size_t i = 0; i < n; i++) {
+        unsigned char x = (unsigned char)a[i];
+        unsigned char y = (unsigned char)b[i];
+        if (x != y) {
+            return x < y ? -1 : 1;
+        }
+        if (stop_at_nul && x == 0) {
+            return 0;
+        }
+    }
+    return 0;
+}
+
+void *(memcpy)(void *restrict d, const void *restrict s, size_t n) {
+    note_bytes(CBM_WORK_MEMCPY, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return r_memcpy ? r_memcpy(d, s, n) : slow_move(d, s, n);
+}
+
+void *(memmove)(void *d, const void *s, size_t n) {
+    note_bytes(CBM_WORK_MEMMOVE, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return r_memmove ? r_memmove(d, s, n) : slow_move(d, s, n);
+}
+
+void *(memset)(void *d, int c, size_t n) {
+    note_bytes(CBM_WORK_MEMSET, SITE(), n);
+    ACC_STORE(d, n);
+    return r_memset ? r_memset(d, c, n) : slow_set(d, c, n);
+}
+
+int(memcmp)(const void *a, const void *b, size_t n) {
+    note_bytes(CBM_WORK_MEMCMP, SITE(), n);
+    ACC_LOAD(a, n);
+    ACC_LOAD(b, n);
+    return r_memcmp ? r_memcmp(a, b, n) : slow_ncmp((const char *)a, (const char *)b, n, false);
+}
+
+size_t(strlen)(const char *s) {
+    size_t n = r_strlen ? r_strlen(s) : slow_strlen(s);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_strlen(SITE(), s, n);
+        ACC_LOAD(s, n + 1);
+    }
+    return n;
+}
+
+int(strcmp)(const char *a, const char *b) {
+    note_bytes(CBM_WORK_STRCMP, SITE(), 0);
+    ACC_LOAD(a, 1);
+    ACC_LOAD(b, 1);
+    return r_strcmp ? r_strcmp(a, b) : slow_ncmp(a, b, (size_t)-1, true);
+}
+
+int(strncmp)(const char *a, const char *b, size_t n) {
+    note_bytes(CBM_WORK_STRNCMP, SITE(), n);
+    ACC_LOAD(a, 1);
+    ACC_LOAD(b, 1);
+    return r_strncmp ? r_strncmp(a, b, n) : slow_ncmp(a, b, n, true);
+}
+
+void *__memcpy_chk(void *d, const void *s, size_t n, size_t dn) {
+    note_bytes(CBM_WORK_MEMCPY, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return RESOLVED(r_memcpy_chk, "__memcpy_chk")(d, s, n, dn);
+}
+
+void *__memmove_chk(void *d, const void *s, size_t n, size_t dn) {
+    note_bytes(CBM_WORK_MEMMOVE, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return RESOLVED(r_memmove_chk, "__memmove_chk")(d, s, n, dn);
+}
+
+void *__memset_chk(void *d, int c, size_t n, size_t dn) {
+    note_bytes(CBM_WORK_MEMSET, SITE(), n);
+    ACC_STORE(d, n);
+    return RESOLVED(r_memset_chk, "__memset_chk")(d, c, n, dn);
+}
+
+ssize_t read(int fd, void *buf, size_t n) {
+    ssize_t got = RESOLVED(r_read, "read")(fd, buf, n);
+    note_io(CBM_WORK_READ, SITE(), (long long)got, n);
+    ACC_STORE(buf, got > 0 ? (size_t)got : 0);
+    return got;
+}
+
+ssize_t write(int fd, const void *buf, size_t n) {
+    ssize_t put = RESOLVED(r_write, "write")(fd, buf, n);
+    note_io(CBM_WORK_WRITE, SITE(), (long long)put, n);
+    ACC_LOAD(buf, put > 0 ? (size_t)put : 0);
+    return put;
+}
+
+ssize_t pread(int fd, void *buf, size_t n, off_t off) {
+    ssize_t got = RESOLVED(r_pread, "pread")(fd, buf, n, off);
+    note_io(CBM_WORK_PREAD, SITE(), (long long)got, n);
+    ACC_STORE(buf, got > 0 ? (size_t)got : 0);
+    return got;
+}
+
+ssize_t pwrite(int fd, const void *buf, size_t n, off_t off) {
+    ssize_t put = RESOLVED(r_pwrite, "pwrite")(fd, buf, n, off);
+    note_io(CBM_WORK_PWRITE, SITE(), (long long)put, n);
+    ACC_LOAD(buf, put > 0 ? (size_t)put : 0);
+    return put;
+}
+
+int open(const char *path, int flags, ...) {
+    int mode = 0;
+    if (flags & O_CREAT) {
+        va_list ap;
+        va_start(ap, flags);
+        mode = va_arg(ap, int);
+        va_end(ap);
+    }
+    int fd = RESOLVED(r_open, "open")(path, flags, mode);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_OPEN, SITE(), path, fd < 0);
+    }
+    return fd;
+}
+
+int stat(const char *path, struct stat *st) {
+    int rc = RESOLVED(r_stat, "stat")(path, st);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_STAT, SITE(), path, rc != 0);
+    }
+    return rc;
+}
+
+int lstat(const char *path, struct stat *st) {
+    int rc = RESOLVED(r_lstat, "lstat")(path, st);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_STAT, SITE(), path, rc != 0);
+    }
+    return rc;
+}
+
+FILE *fopen(const char *restrict path, const char *restrict mode) {
+    cbm_memev_library_enter(SITE());
+    FILE *f = RESOLVED(r_fopen, "fopen")(path, mode);
+    cbm_memev_library_leave();
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_FOPEN, SITE(), path, f == NULL);
+    }
+    return f;
+}
+
+size_t fread(void *restrict buf, size_t size, size_t count, FILE *restrict f) {
+    cbm_memev_library_enter(SITE());
+    size_t got = RESOLVED(r_fread, "fread")(buf, size, count, f);
+    cbm_memev_library_leave();
+    note_io(CBM_WORK_FREAD, SITE(), (long long)(got * size), size * count);
+    ACC_STORE(buf, got * size);
+    return got;
+}
+
+size_t fwrite(const void *restrict buf, size_t size, size_t count, FILE *restrict f) {
+    cbm_memev_library_enter(SITE());
+    size_t put = RESOLVED(r_fwrite, "fwrite")(buf, size, count, f);
+    cbm_memev_library_leave();
+    note_io(CBM_WORK_FWRITE, SITE(), (long long)(put * size), size * count);
+    ACC_LOAD(buf, put * size);
+    return put;
+}
+
+DIR *opendir(const char *path) {
+    cbm_memev_library_enter(SITE());
+    DIR *d = RESOLVED(r_opendir, "opendir")(path);
+    cbm_memev_library_leave();
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_OPENDIR, SITE(), path, d == NULL);
+    }
+    return d;
+}
+
+struct dirent *readdir(DIR *d) {
+    note_bytes(CBM_WORK_READDIR, SITE(), 0);
+    cbm_memev_library_enter(SITE());
+    struct dirent *ent = RESOLVED(r_readdir, "readdir")(d);
+    cbm_memev_library_leave();
+    return ent;
+}
+
+int cbm_memev_mutex_lock(void *pthread_mutex, void *site) {
+    pthread_mutex_t *m = (pthread_mutex_t *)pthread_mutex;
+    int (*lock)(pthread_mutex_t *) = RESOLVED(r_mutex_lock, "pthread_mutex_lock");
+    if (!cbm_memev_enabled()) {
+        return lock(m);
+    }
+    int rc = RESOLVED(r_mutex_trylock, "pthread_mutex_trylock")(m);
+    bool contended = rc == EBUSY;
+    if (contended) {
+        rc = lock(m);
+    }
+    cbm_work_note(CBM_WORK_MUTEX, site, 0, contended ? 1 : 0, 0);
+    return rc;
+}
+
+int pthread_mutex_lock(pthread_mutex_t *m) {
+    return cbm_memev_mutex_lock(m, SITE());
+}
+
+/* ══════════════════════════════════════════════════════════════════════ */
+#elif defined(__linux__)
+
+#include <dirent.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+void *__real_memcpy(void *, const void *, size_t);
+void *__real_memmove(void *, const void *, size_t);
+void *__real_memset(void *, int, size_t);
+int __real_memcmp(const void *, const void *, size_t);
+size_t __real_strlen(const char *);
+int __real_strcmp(const char *, const char *);
+int __real_strncmp(const char *, const char *, size_t);
+void *__real___memcpy_chk(void *, const void *, size_t, size_t);
+void *__real___memmove_chk(void *, const void *, size_t, size_t);
+void *__real___memset_chk(void *, int, size_t, size_t);
+ssize_t __real_read(int, void *, size_t);
+ssize_t __real___read_chk(int, void *, size_t, size_t);
+ssize_t __real_write(int, const void *, size_t);
+ssize_t __real_pread(int, void *, size_t, off_t);
+ssize_t __real_pwrite(int, const void *, size_t, off_t);
+ssize_t __real_pread64(int, void *, size_t, off_t);
+ssize_t __real_pwrite64(int, const void *, size_t, off_t);
+int __real_open(const char *, int, ...);
+int __real_open64(const char *, int, ...);
+int __real___open_2(const char *, int);
+int __real___open64_2(const char *, int);
+int __real_stat(const char *, struct stat *);
+int __real_lstat(const char *, struct stat *);
+FILE *__real_fopen(const char *, const char *);
+FILE *__real_fopen64(const char *, const char *);
+size_t __real_fread(void *, size_t, size_t, FILE *);
+size_t __real___fread_chk(void *, size_t, size_t, size_t, FILE *);
+size_t __real_fwrite(const void *, size_t, size_t, FILE *);
+DIR *__real_opendir(const char *);
+struct dirent *__real_readdir(DIR *);
+int __real_pthread_mutex_lock(pthread_mutex_t *);
+
+void *__wrap_memcpy(void *d, const void *s, size_t n) {
+    note_bytes(CBM_WORK_MEMCPY, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return __real_memcpy(d, s, n);
+}
+void *__wrap_memmove(void *d, const void *s, size_t n) {
+    note_bytes(CBM_WORK_MEMMOVE, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return __real_memmove(d, s, n);
+}
+void *__wrap_memset(void *d, int c, size_t n) {
+    note_bytes(CBM_WORK_MEMSET, SITE(), n);
+    ACC_STORE(d, n);
+    return __real_memset(d, c, n);
+}
+int __wrap_memcmp(const void *a, const void *b, size_t n) {
+    note_bytes(CBM_WORK_MEMCMP, SITE(), n);
+    ACC_LOAD(a, n);
+    ACC_LOAD(b, n);
+    return __real_memcmp(a, b, n);
+}
+size_t __wrap_strlen(const char *s) {
+    size_t n = __real_strlen(s);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_strlen(SITE(), s, n);
+        ACC_LOAD(s, n + 1);
+    }
+    return n;
+}
+int __wrap_strcmp(const char *a, const char *b) {
+    note_bytes(CBM_WORK_STRCMP, SITE(), 0);
+    ACC_LOAD(a, 1);
+    ACC_LOAD(b, 1);
+    return __real_strcmp(a, b);
+}
+int __wrap_strncmp(const char *a, const char *b, size_t n) {
+    note_bytes(CBM_WORK_STRNCMP, SITE(), n);
+    ACC_LOAD(a, 1);
+    ACC_LOAD(b, 1);
+    return __real_strncmp(a, b, n);
+}
+void *__wrap___memcpy_chk(void *d, const void *s, size_t n, size_t dn) {
+    note_bytes(CBM_WORK_MEMCPY, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return __real___memcpy_chk(d, s, n, dn);
+}
+void *__wrap___memmove_chk(void *d, const void *s, size_t n, size_t dn) {
+    note_bytes(CBM_WORK_MEMMOVE, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return __real___memmove_chk(d, s, n, dn);
+}
+void *__wrap___memset_chk(void *d, int c, size_t n, size_t dn) {
+    note_bytes(CBM_WORK_MEMSET, SITE(), n);
+    ACC_STORE(d, n);
+    return __real___memset_chk(d, c, n, dn);
+}
+ssize_t __wrap_read(int fd, void *buf, size_t n) {
+    ssize_t got = __real_read(fd, buf, n);
+    note_io(CBM_WORK_READ, SITE(), (long long)got, n);
+    ACC_STORE(buf, got > 0 ? (size_t)got : 0);
+    return got;
+}
+ssize_t __wrap___read_chk(int fd, void *buf, size_t n, size_t bn) {
+    ssize_t got = __real___read_chk(fd, buf, n, bn);
+    note_io(CBM_WORK_READ, SITE(), (long long)got, n);
+    ACC_STORE(buf, got > 0 ? (size_t)got : 0);
+    return got;
+}
+ssize_t __wrap_write(int fd, const void *buf, size_t n) {
+    ssize_t put = __real_write(fd, buf, n);
+    note_io(CBM_WORK_WRITE, SITE(), (long long)put, n);
+    ACC_LOAD(buf, put > 0 ? (size_t)put : 0);
+    return put;
+}
+ssize_t __wrap_pread(int fd, void *buf, size_t n, off_t off) {
+    ssize_t got = __real_pread(fd, buf, n, off);
+    note_io(CBM_WORK_PREAD, SITE(), (long long)got, n);
+    ACC_STORE(buf, got > 0 ? (size_t)got : 0);
+    return got;
+}
+ssize_t __wrap_pwrite(int fd, const void *buf, size_t n, off_t off) {
+    ssize_t put = __real_pwrite(fd, buf, n, off);
+    note_io(CBM_WORK_PWRITE, SITE(), (long long)put, n);
+    ACC_LOAD(buf, put > 0 ? (size_t)put : 0);
+    return put;
+}
+ssize_t __wrap_pread64(int fd, void *buf, size_t n, off_t off) {
+    ssize_t got = __real_pread64(fd, buf, n, off);
+    note_io(CBM_WORK_PREAD, SITE(), (long long)got, n);
+    ACC_STORE(buf, got > 0 ? (size_t)got : 0);
+    return got;
+}
+ssize_t __wrap_pwrite64(int fd, const void *buf, size_t n, off_t off) {
+    ssize_t put = __real_pwrite64(fd, buf, n, off);
+    note_io(CBM_WORK_PWRITE, SITE(), (long long)put, n);
+    ACC_LOAD(buf, put > 0 ? (size_t)put : 0);
+    return put;
+}
+static int open_mode(int flags, va_list ap) {
+    return (flags & O_CREAT) ? va_arg(ap, int) : 0;
+}
+int __wrap_open(const char *path, int flags, ...) {
+    va_list ap;
+    va_start(ap, flags);
+    int mode = open_mode(flags, ap);
+    va_end(ap);
+    int fd = __real_open(path, flags, mode);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_OPEN, SITE(), path, fd < 0);
+    }
+    return fd;
+}
+int __wrap_open64(const char *path, int flags, ...) {
+    va_list ap;
+    va_start(ap, flags);
+    int mode = open_mode(flags, ap);
+    va_end(ap);
+    int fd = __real_open64(path, flags, mode);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_OPEN, SITE(), path, fd < 0);
+    }
+    return fd;
+}
+int __wrap___open_2(const char *path, int flags) {
+    int fd = __real___open_2(path, flags);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_OPEN, SITE(), path, fd < 0);
+    }
+    return fd;
+}
+int __wrap___open64_2(const char *path, int flags) {
+    int fd = __real___open64_2(path, flags);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_OPEN, SITE(), path, fd < 0);
+    }
+    return fd;
+}
+int __wrap_stat(const char *path, struct stat *st) {
+    int rc = __real_stat(path, st);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_STAT, SITE(), path, rc != 0);
+    }
+    return rc;
+}
+int __wrap_lstat(const char *path, struct stat *st) {
+    int rc = __real_lstat(path, st);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_STAT, SITE(), path, rc != 0);
+    }
+    return rc;
+}
+FILE *__wrap_fopen(const char *path, const char *mode) {
+    FILE *f = __real_fopen(path, mode);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_FOPEN, SITE(), path, f == NULL);
+    }
+    return f;
+}
+FILE *__wrap_fopen64(const char *path, const char *mode) {
+    FILE *f = __real_fopen64(path, mode);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_FOPEN, SITE(), path, f == NULL);
+    }
+    return f;
+}
+size_t __wrap_fread(void *buf, size_t size, size_t count, FILE *f) {
+    size_t got = __real_fread(buf, size, count, f);
+    note_io(CBM_WORK_FREAD, SITE(), (long long)(got * size), size * count);
+    ACC_STORE(buf, got * size);
+    return got;
+}
+size_t __wrap___fread_chk(void *buf, size_t bn, size_t size, size_t count, FILE *f) {
+    size_t got = __real___fread_chk(buf, bn, size, count, f);
+    note_io(CBM_WORK_FREAD, SITE(), (long long)(got * size), size * count);
+    ACC_STORE(buf, got * size);
+    return got;
+}
+size_t __wrap_fwrite(const void *buf, size_t size, size_t count, FILE *f) {
+    size_t put = __real_fwrite(buf, size, count, f);
+    note_io(CBM_WORK_FWRITE, SITE(), (long long)(put * size), size * count);
+    ACC_LOAD(buf, put * size);
+    return put;
+}
+DIR *__wrap_opendir(const char *path) {
+    DIR *d = __real_opendir(path);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_path(CBM_WORK_OPENDIR, SITE(), path, d == NULL);
+    }
+    return d;
+}
+struct dirent *__wrap_readdir(DIR *d) {
+    note_bytes(CBM_WORK_READDIR, SITE(), 0);
+    return __real_readdir(d);
+}
+
+int cbm_memev_mutex_lock(void *pthread_mutex, void *site) {
+    pthread_mutex_t *m = (pthread_mutex_t *)pthread_mutex;
+    if (!cbm_memev_enabled()) {
+        return __real_pthread_mutex_lock(m);
+    }
+    int rc = pthread_mutex_trylock(m);
+    bool contended = rc == EBUSY;
+    if (contended) {
+        rc = __real_pthread_mutex_lock(m);
+    }
+    cbm_work_note(CBM_WORK_MUTEX, site, 0, contended ? 1 : 0, 0);
+    return rc;
+}
+
+int __wrap_pthread_mutex_lock(pthread_mutex_t *m) {
+    return cbm_memev_mutex_lock(m, SITE());
+}
+
+/* ══════════════════════════════════════════════════════════════════════ */
+#elif defined(_WIN32)
+
+#include <wchar.h>
+
+void *__real_memcpy(void *, const void *, size_t);
+void *__real_memmove(void *, const void *, size_t);
+void *__real_memset(void *, int, size_t);
+int __real_memcmp(const void *, const void *, size_t);
+size_t __real_strlen(const char *);
+int __real_strcmp(const char *, const char *);
+int __real_strncmp(const char *, const char *, size_t);
+FILE *__real__wfopen(const wchar_t *, const wchar_t *);
+size_t __real_fread(void *, size_t, size_t, FILE *);
+size_t __real_fwrite(const void *, size_t, size_t, FILE *);
+
+void *__wrap_memcpy(void *d, const void *s, size_t n) {
+    note_bytes(CBM_WORK_MEMCPY, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return __real_memcpy(d, s, n);
+}
+void *__wrap_memmove(void *d, const void *s, size_t n) {
+    note_bytes(CBM_WORK_MEMMOVE, SITE(), n);
+    ACC_LOAD(s, n);
+    ACC_STORE(d, n);
+    return __real_memmove(d, s, n);
+}
+void *__wrap_memset(void *d, int c, size_t n) {
+    note_bytes(CBM_WORK_MEMSET, SITE(), n);
+    ACC_STORE(d, n);
+    return __real_memset(d, c, n);
+}
+int __wrap_memcmp(const void *a, const void *b, size_t n) {
+    note_bytes(CBM_WORK_MEMCMP, SITE(), n);
+    ACC_LOAD(a, n);
+    ACC_LOAD(b, n);
+    return __real_memcmp(a, b, n);
+}
+size_t __wrap_strlen(const char *s) {
+    size_t n = __real_strlen(s);
+    if (cbm_memev_enabled()) {
+        cbm_work_note_strlen(SITE(), s, n);
+        ACC_LOAD(s, n + 1);
+    }
+    return n;
+}
+int __wrap_strcmp(const char *a, const char *b) {
+    note_bytes(CBM_WORK_STRCMP, SITE(), 0);
+    ACC_LOAD(a, 1);
+    ACC_LOAD(b, 1);
+    return __real_strcmp(a, b);
+}
+int __wrap_strncmp(const char *a, const char *b, size_t n) {
+    note_bytes(CBM_WORK_STRNCMP, SITE(), n);
+    ACC_LOAD(a, 1);
+    ACC_LOAD(b, 1);
+    return __real_strncmp(a, b, n);
+}
+/* A wide path's hash is taken over its UTF-16 units squeezed to bytes: equal
+ * paths hash equal, which is all the repeat detector needs. */
+FILE *__wrap__wfopen(const wchar_t *path, const wchar_t *mode) {
+    FILE *f = __real__wfopen(path, mode);
+    if (cbm_memev_enabled()) {
+        char narrow[1024];
+        size_t i = 0;
+        for (; path && path[i] && i + 1 < sizeof(narrow); i++) {
+            narrow[i] = (char)(path[i] & 0x7F ? path[i] : '?');
+        }
+        narrow[i] = '\0';
+        cbm_work_note_path(CBM_WORK_FOPEN, SITE(), narrow, f == NULL);
+    }
+    return f;
+}
+size_t __wrap_fread(void *buf, size_t size, size_t count, FILE *f) {
+    size_t got = __real_fread(buf, size, count, f);
+    note_io(CBM_WORK_FREAD, SITE(), (long long)(got * size), size * count);
+    ACC_STORE(buf, got * size);
+    return got;
+}
+size_t __wrap_fwrite(const void *buf, size_t size, size_t count, FILE *f) {
+    size_t put = __real_fwrite(buf, size, count, f);
+    note_io(CBM_WORK_FWRITE, SITE(), (long long)(put * size), size * count);
+    ACC_LOAD(buf, put * size);
+    return put;
+}
+
+#endif /* platform */
+
+#if defined(__clang__)
+#pragma clang attribute pop
+#endif
+
+#else
+typedef int cbm_mem_override_libc_unused_t;
+#endif /* CBM_MEMWASTE */
diff --git a/src/foundation/mem_override_posix.c b/src/foundation/mem_override_posix.c
index 008d8010d..ee3e13e0d 100644
--- a/src/foundation/mem_override_posix.c
+++ b/src/foundation/mem_override_posix.c
@@ -32,36 +32,61 @@
  * and a difference in the output is a difference in behaviour rather than an
  * artifact of two different instrumentation schemes.
  *
- * Linux only: --wrap is a GNU ld/lld feature. macOS ld has no equivalent, so
- * macOS runs census-only and the profiler reports nothing there. That gap is
- * stated in the harness spec rather than hidden behind zeros that look like
- * "no allocations".
+ * Linux only: --wrap is a GNU ld/lld feature. macOS ld has no equivalent; there
+ * the waste layer observes through a forwarding malloc zone instead
+ * (mem_override_darwin.c), so all three platforms report the same site tables.
  */
-#include "foundation/mem_profile.h"
-
 #include <mimalloc.h>
 #include <stddef.h>
+#include <string.h>
 
 #if defined(__linux__)
 
+/* Waste sanitizer (mem_events.h). The wrapper IS the observation point, so the
+ * caller's return address is the allocation site. Compiled to nothing outside
+ * the `memwaste` flavour. Frees are reported BEFORE the block goes back. */
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+#include "foundation/mem_events.h"
+#define OBS_ALLOC_F(block, requested, flags)                                    \
+    do {                                                                        \
+        if ((block) && cbm_memev_enabled()) {                                   \
+            cbm_memev_alloc_ex((block), (requested), mi_usable_size(block),     \
+                               __builtin_return_address(0), (unsigned)(flags)); \
+        }                                                                       \
+    } while (0)
+#define OBS_ALLOC(block, requested) OBS_ALLOC_F((block), (requested), 0)
+#define OBS_REALLOC(old_block, grown, requested)                                        \
+    do {                                                                                \
+        if ((grown) && cbm_memev_enabled()) {                                           \
+            cbm_memev_realloc((old_block), (grown), (requested), mi_usable_size(grown), \
+                              __builtin_return_address(0));                             \
+        }                                                                               \
+    } while (0)
+#define OBS_FREE(block) cbm_memev_free(block)
+#else
+#define OBS_ALLOC(block, requested) ((void)0)
+#define OBS_ALLOC_F(block, requested, flags) ((void)0)
+#define OBS_REALLOC(old_block, grown, requested) ((void)0)
+#define OBS_FREE(block) ((void)0)
+#endif
+
 void *__wrap_malloc(size_t size) {
     void *block = mi_malloc(size);
-    cbm_mem_profile_alloc(block, size);
+    OBS_ALLOC(block, size);
     return block;
 }
 
 void *__wrap_calloc(size_t count, size_t size) {
     void *block = mi_calloc(count, size);
-    cbm_mem_profile_alloc(block, count * size);
+    OBS_ALLOC_F(block, count * size, CBM_MEMEV_ZEROED);
     return block;
 }
 
 void *__wrap_realloc(void *block, size_t size) {
-    if (block) {
-        cbm_mem_profile_free(block);
-    }
+    CBM_MEMEV_BACKING(1);
     void *grown = mi_realloc(block, size);
-    cbm_mem_profile_alloc(grown, size);
+    CBM_MEMEV_BACKING(-1);
+    OBS_REALLOC(block, grown, size);
     return grown;
 }
 
@@ -71,16 +96,43 @@ void __wrap_free(void *block) {
     }
     /* Unlike Windows there is no foreign-allocator hazard to route around:
      * every malloc in this image is already mimalloc's. */
-    cbm_mem_profile_free(block);
+    OBS_FREE(block);
     mi_free(block);
 }
 
 char *__wrap_strdup(const char *text) {
     char *copy = mi_strdup(text);
-    if (copy) {
-        cbm_mem_profile_alloc(copy, mi_usable_size(copy));
-    }
+    OBS_ALLOC_F(copy, copy ? strlen(copy) + 1 : 0, CBM_MEMEV_WRITTEN);
     return copy;
 }
 
+/* The aligned family and strndup reach mimalloc too; without these a block
+ * from posix_memalign (the slab allocator's pages) is invisible, and its
+ * free reads as untracked. */
+char *__wrap_strndup(const char *text, size_t length) {
+    char *copy = mi_strndup(text, length);
+    OBS_ALLOC_F(copy, copy ? strlen(copy) + 1 : 0, CBM_MEMEV_WRITTEN);
+    return copy;
+}
+
+int __wrap_posix_memalign(void **out, size_t alignment, size_t size) {
+    int rc = mi_posix_memalign(out, alignment, size);
+    if (rc == 0 && out) {
+        OBS_ALLOC(*out, size);
+    }
+    return rc;
+}
+
+void *__wrap_aligned_alloc(size_t alignment, size_t size) {
+    void *block = mi_aligned_alloc(alignment, size);
+    OBS_ALLOC(block, size);
+    return block;
+}
+
+void *__wrap_memalign(size_t alignment, size_t size) {
+    void *block = mi_memalign(alignment, size);
+    OBS_ALLOC(block, size);
+    return block;
+}
+
 #endif /* __linux__ */
diff --git a/src/foundation/mem_override_win.c b/src/foundation/mem_override_win.c
index 8b51cb690..e18b09d11 100644
--- a/src/foundation/mem_override_win.c
+++ b/src/foundation/mem_override_win.c
@@ -42,6 +42,7 @@
  * mimalloc is always safe.
  */
 #include "foundation/mem.h"
+#include "foundation/mem_events.h" /* CBM_MEMEV_BACKING: empty outside the access lane */
 
 #include <mimalloc.h>
 #include <stddef.h>
@@ -68,32 +69,73 @@ static inline bool mem_override_is_ours(const void *block) {
     return mi_is_in_heap_region(block);
 }
 
+/* Waste sanitizer (mem_events.h). The wrapper IS the observation point, so the
+ * caller's return address is the allocation site. Compiled to nothing outside
+ * the `memwaste` flavour. Frees are reported BEFORE the block goes back. */
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+#define OBS_ALLOC_F(block, requested, flags)                                    \
+    do {                                                                        \
+        if ((block) && cbm_memev_enabled()) {                                   \
+            cbm_memev_alloc_ex((block), (requested), mi_usable_size(block),     \
+                               __builtin_return_address(0), (unsigned)(flags)); \
+        }                                                                       \
+    } while (0)
+#define OBS_ALLOC(block, requested) OBS_ALLOC_F((block), (requested), 0)
+#define OBS_REALLOC(old_block, grown, requested)                                        \
+    do {                                                                                \
+        if ((grown) && cbm_memev_enabled()) {                                           \
+            cbm_memev_realloc((old_block), (grown), (requested), mi_usable_size(grown), \
+                              __builtin_return_address(0));                             \
+        }                                                                               \
+    } while (0)
+/* A block mimalloc did not make came from the CRT or a system DLL: the layer
+ * could never have seen its allocation, so it is not an untracked free. */
+#define OBS_FREE(block) \
+    (mem_override_is_ours(block) ? cbm_memev_free(block) : cbm_memev_free_foreign(block))
+#else
+#define OBS_ALLOC(block, requested) ((void)0)
+#define OBS_ALLOC_F(block, requested, flags) ((void)0)
+#define OBS_REALLOC(old_block, grown, requested) ((void)0)
+#define OBS_FREE(block) ((void)0)
+#endif
+
 void *__wrap_malloc(size_t size) {
-    return mi_malloc(size);
+    void *block = mi_malloc(size);
+    OBS_ALLOC(block, size);
+    return block;
 }
 
 void *__wrap_calloc(size_t count, size_t size) {
-    return mi_calloc(count, size);
+    void *block = mi_calloc(count, size);
+    OBS_ALLOC_F(block, count * size, CBM_MEMEV_ZEROED);
+    return block;
 }
 
 char *__wrap_strdup(const char *text) {
-    return mi_strdup(text);
+    char *copy = mi_strdup(text);
+    OBS_ALLOC_F(copy, copy ? strlen(copy) + 1 : 0, CBM_MEMEV_WRITTEN);
+    return copy;
 }
 
 char *__wrap_strndup(const char *text, size_t length) {
-    return mi_strndup(text, length);
+    char *copy = mi_strndup(text, length);
+    OBS_ALLOC_F(copy, copy ? strlen(copy) + 1 : 0, CBM_MEMEV_WRITTEN);
+    return copy;
 }
 
 void *__wrap__aligned_malloc(size_t size, size_t alignment) {
     /* Windows spells aligned allocation _aligned_malloc(size, alignment) —
      * note the argument order is the reverse of mi_malloc_aligned's. */
-    return mi_malloc_aligned(size, alignment);
+    void *block = mi_malloc_aligned(size, alignment);
+    OBS_ALLOC(block, size);
+    return block;
 }
 
 void __wrap_free(void *block) {
     if (!block) {
         return;
     }
+    OBS_FREE(block);
     if (mem_override_is_ours(block)) {
         mi_free(block);
         return;
@@ -108,6 +150,7 @@ void __wrap__aligned_free(void *block) {
     if (!block) {
         return;
     }
+    OBS_FREE(block);
     if (mem_override_is_ours(block)) {
         mi_free(block);
         return;
@@ -117,10 +160,15 @@ void __wrap__aligned_free(void *block) {
 
 void *__wrap_realloc(void *block, size_t size) {
     if (!block) {
-        return mi_malloc(size);
+        void *fresh = mi_malloc(size);
+        OBS_ALLOC(fresh, size);
+        return fresh;
     }
     if (mem_override_is_ours(block)) {
+        CBM_MEMEV_BACKING(1);
         void *grown = mi_realloc(block, size);
+        CBM_MEMEV_BACKING(-1);
+        OBS_REALLOC(block, grown, size);
         return grown;
     }
     /* A CRT block cannot be handed to mi_realloc, and the CRT's realloc must
@@ -134,6 +182,7 @@ void *__wrap_realloc(void *block, size_t size) {
         return NULL; /* original stays valid, as realloc requires */
     }
     memcpy(moved, block, old_size < size ? old_size : size);
+    OBS_REALLOC(block, moved, size);
     __real_free(block);
     return moved;
 }
diff --git a/src/foundation/mem_profile.c b/src/foundation/mem_profile.c
deleted file mode 100644
index f0c43b745..000000000
--- a/src/foundation/mem_profile.c
+++ /dev/null
@@ -1,325 +0,0 @@
-/*
- * mem_profile.c — see mem_profile.h.
- *
- * Two fixed tables, both open-addressed with linear probing:
- *   sites[]    stack hash -> {frames, live bytes, live blocks, totals}
- *   pointers[] block address -> {site index, size}
- *
- * A single mutex guards both. That is heavy for a hot path and entirely
- * acceptable here: profiling is opt-in, and a diagnostic that is fast but
- * racy would produce numbers nobody can trust — which is the failure mode
- * this whole harness exists to correct.
- */
-#include "mem_profile.h"
-
-#include "compat_fs.h"
-#include "compat_thread.h"
-#include "foundation/constants.h"
-#include "platform.h"
-
-#include <stdatomic.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#ifdef _WIN32
-#ifndef WIN32_LEAN_AND_MEAN
-#define WIN32_LEAN_AND_MEAN
-#endif
-#include <windows.h>
-#else
-#include <execinfo.h>
-#endif
-
-enum {
-    PROFILE_FRAMES = 8,        /* stack depth per site */
-    PROFILE_SKIP_FRAMES = 2,   /* this file's own frames */
-    PROFILE_SITES = 4096,      /* distinct call sites */
-    PROFILE_POINTERS = 262144, /* tracked live blocks */
-    PROFILE_DEFAULT_MIN = 32768,
-};
-
-typedef struct {
-    uint64_t hash; /* 0 = empty slot */
-    void *frames[PROFILE_FRAMES];
-    int frame_count;
-    size_t live_bytes;
-    size_t live_blocks;
-    size_t total_bytes;
-    size_t total_blocks;
-    size_t peak_live_bytes;
-} profile_site_t;
-
-typedef struct {
-    void *block; /* NULL = empty slot */
-    size_t size;
-    size_t site;
-} profile_pointer_t;
-
-/* The profiler runs INSIDE the allocator: every hook here is reached from
- * malloc/free. Anything it calls that itself allocates — reading an env var,
- * the logger, even a probe — re-enters the hook, which recurses until the stack
- * dies (silently: the process produces no stdout, no stderr and no log) and
- * would deadlock the non-recursive mutex on the way. This guard makes the
- * profiler invisible to itself. */
-static _Thread_local bool g_profile_reentrant;
-
-static cbm_mutex_t g_profile_mutex;
-static profile_site_t g_sites[PROFILE_SITES];
-static profile_pointer_t g_pointers[PROFILE_POINTERS];
-static cbm_mem_profile_totals_t g_totals;
-static atomic_int g_profile_enabled = -1;
-static size_t g_profile_min = PROFILE_DEFAULT_MIN;
-
-size_t cbm_mem_profile_threshold(void) {
-    (void)cbm_mem_profile_enabled();
-    return g_profile_min;
-}
-
-bool cbm_mem_profile_enabled(void) {
-    int state = atomic_load_explicit(&g_profile_enabled, memory_order_acquire);
-    if (state >= 0) {
-        return state == 1;
-    }
-    char buf[CBM_SZ_32];
-    bool on = cbm_safe_getenv("CBM_MEM_PROFILE", buf, sizeof(buf), NULL) != NULL && buf[0] == '1';
-    if (on) {
-        char min_buf[CBM_SZ_32];
-        if (cbm_safe_getenv("CBM_MEM_PROFILE_MIN", min_buf, sizeof(min_buf), NULL) != NULL) {
-            long parsed = strtol(min_buf, NULL, 10);
-            if (parsed > 0) {
-                g_profile_min = (size_t)parsed;
-            }
-        }
-        cbm_mutex_init(&g_profile_mutex);
-    }
-    atomic_store_explicit(&g_profile_enabled, on ? 1 : 0, memory_order_release);
-    return on;
-}
-
-/* FNV-1a over the return addresses: cheap, and collisions merely merge two
- * sites rather than corrupting counts. */
-static uint64_t profile_hash(void *const *frames, int count) {
-    uint64_t hash = 1469598103934665603ULL;
-    for (int i = 0; i < count; i++) {
-        uintptr_t value = (uintptr_t)frames[i];
-        for (size_t byte = 0; byte < sizeof(value); byte++) {
-            hash ^= (value >> (byte * 8)) & 0xFFU;
-            hash *= 1099511628211ULL;
-        }
-    }
-    return hash == 0 ? 1 : hash; /* 0 marks an empty slot */
-}
-
-static int profile_capture(void **frames, void *caller) {
-#ifdef _WIN32
-    int captured = (int)CaptureStackBackTrace(PROFILE_SKIP_FRAMES, PROFILE_FRAMES, frames, NULL);
-    if (captured > 0) {
-        return captured;
-    }
-    /* Fall back to the caller the hook supplied. Using a return address from
-     * THIS frame would name the profiler, not the allocating code. */
-    if (caller) {
-        frames[0] = caller;
-        return 1;
-    }
-    frames[0] = __builtin_return_address(0);
-    return frames[0] != NULL ? 1 : 0;
-#else
-    (void)caller;
-    void *raw[PROFILE_FRAMES + PROFILE_SKIP_FRAMES];
-    int got = backtrace(raw, PROFILE_FRAMES + PROFILE_SKIP_FRAMES);
-    int count = got - PROFILE_SKIP_FRAMES;
-    if (count <= 0) {
-        return 0;
-    }
-    if (count > PROFILE_FRAMES) {
-        count = PROFILE_FRAMES;
-    }
-    memcpy(frames, raw + PROFILE_SKIP_FRAMES, (size_t)count * sizeof(*frames));
-    return count;
-#endif
-}
-
-/* Returns SIZE_MAX when the table is full, so the caller can count the loss. */
-static size_t profile_intern_site_locked(void **frames, int count) {
-    uint64_t hash = profile_hash(frames, count);
-    size_t index = (size_t)(hash % PROFILE_SITES);
-    for (size_t probe = 0; probe < PROFILE_SITES; probe++) {
-        profile_site_t *site = &g_sites[index];
-        if (site->hash == hash) {
-            return index;
-        }
-        if (site->hash == 0) {
-            site->hash = hash;
-            site->frame_count = count;
-            memcpy(site->frames, frames, (size_t)count * sizeof(*frames));
-            g_totals.sites++;
-            return index;
-        }
-        index = (index + 1) % PROFILE_SITES;
-    }
-    return SIZE_MAX;
-}
-
-static size_t profile_pointer_slot(const void *block) {
-    uintptr_t value = (uintptr_t)block;
-    /* Block addresses are page-aligned at these sizes, so mix the high bits
-     * down before masking or every entry lands in the same few buckets. */
-    value ^= value >> 20;
-    value *= 2654435761U;
-    return (size_t)(value % PROFILE_POINTERS);
-}
-
-void cbm_mem_profile_alloc(void *block, size_t size) {
-    cbm_mem_profile_alloc_at(block, size, NULL);
-}
-
-void cbm_mem_profile_alloc_at(void *block, size_t size, void *caller) {
-    if (!block || g_profile_reentrant) {
-        return;
-    }
-    g_profile_reentrant = true;
-    if (!cbm_mem_profile_enabled() || size < g_profile_min) {
-        g_profile_reentrant = false;
-        return;
-    }
-    void *frames[PROFILE_FRAMES];
-    int count = profile_capture(frames, caller);
-    if (count <= 0) {
-        cbm_mutex_lock(&g_profile_mutex);
-        g_totals.capture_failed++;
-        cbm_mutex_unlock(&g_profile_mutex);
-        g_profile_reentrant = false;
-        return;
-    }
-    cbm_mutex_lock(&g_profile_mutex);
-    size_t site_index = profile_intern_site_locked(frames, count);
-    if (site_index == SIZE_MAX) {
-        g_totals.site_table_full++;
-        cbm_mutex_unlock(&g_profile_mutex);
-        g_profile_reentrant = false;
-        return;
-    }
-    size_t slot = profile_pointer_slot(block);
-    bool stored = false;
-    for (size_t probe = 0; probe < PROFILE_POINTERS; probe++) {
-        if (g_pointers[slot].block == NULL) {
-            g_pointers[slot].block = block;
-            g_pointers[slot].size = size;
-            g_pointers[slot].site = site_index;
-            stored = true;
-            break;
-        }
-        slot = (slot + 1) % PROFILE_POINTERS;
-    }
-    if (!stored) {
-        g_totals.pointer_table_full++;
-        cbm_mutex_unlock(&g_profile_mutex);
-        g_profile_reentrant = false;
-        return;
-    }
-    profile_site_t *site = &g_sites[site_index];
-    site->live_bytes += size;
-    site->live_blocks++;
-    site->total_bytes += size;
-    site->total_blocks++;
-    if (site->live_bytes > site->peak_live_bytes) {
-        site->peak_live_bytes = site->live_bytes;
-    }
-    g_totals.live_bytes += size;
-    g_totals.live_blocks++;
-    g_totals.total_bytes += size;
-    cbm_mutex_unlock(&g_profile_mutex);
-    g_profile_reentrant = false;
-}
-
-void cbm_mem_profile_free(void *block) {
-    if (!block || g_profile_reentrant) {
-        return;
-    }
-    g_profile_reentrant = true;
-    if (!cbm_mem_profile_enabled()) {
-        g_profile_reentrant = false;
-        return;
-    }
-    cbm_mutex_lock(&g_profile_mutex);
-    size_t slot = profile_pointer_slot(block);
-    for (size_t probe = 0; probe < PROFILE_POINTERS; probe++) {
-        profile_pointer_t *entry = &g_pointers[slot];
-        if (entry->block == block) {
-            profile_site_t *site = &g_sites[entry->site];
-            site->live_bytes -= entry->size;
-            site->live_blocks--;
-            g_totals.live_bytes -= entry->size;
-            g_totals.live_blocks--;
-            entry->block = NULL;
-            entry->size = 0;
-            entry->site = 0;
-            cbm_mutex_unlock(&g_profile_mutex);
-            g_profile_reentrant = false;
-            return;
-        }
-        if (entry->block == NULL) {
-            break; /* linear probe ended: never tracked (below threshold) */
-        }
-        slot = (slot + 1) % PROFILE_POINTERS;
-    }
-    /* Expected for every sub-threshold allocation, so this is a scale check,
-     * not an error: it should track the small-allocation rate, not grow with
-     * retained bytes. */
-    g_totals.untracked_frees++;
-    cbm_mutex_unlock(&g_profile_mutex);
-    g_profile_reentrant = false;
-}
-
-void cbm_mem_profile_totals(cbm_mem_profile_totals_t *out) {
-    if (!out) {
-        return;
-    }
-    memset(out, 0, sizeof(*out));
-    if (!cbm_mem_profile_enabled()) {
-        return;
-    }
-    cbm_mutex_lock(&g_profile_mutex);
-    *out = g_totals;
-    cbm_mutex_unlock(&g_profile_mutex);
-}
-
-bool cbm_mem_profile_dump(const char *path, const char *label) {
-    if (!path || !cbm_mem_profile_enabled()) {
-        return false;
-    }
-    FILE *out = cbm_fopen(path, "ab");
-    if (!out) {
-        return false;
-    }
-    cbm_mutex_lock(&g_profile_mutex);
-    (void)fprintf(out,
-                  "{\"label\":\"%s\",\"threshold\":%zu,\"sites\":%zu,\"live_bytes\":%zu,"
-                  "\"live_blocks\":%zu,\"total_bytes\":%zu,\"untracked_frees\":%zu,"
-                  "\"site_table_full\":%zu,\"pointer_table_full\":%zu}\n",
-                  label ? label : "", g_profile_min, g_totals.sites, g_totals.live_bytes,
-                  g_totals.live_blocks, g_totals.total_bytes, g_totals.untracked_frees,
-                  g_totals.site_table_full, g_totals.pointer_table_full);
-    for (size_t i = 0; i < PROFILE_SITES; i++) {
-        profile_site_t *site = &g_sites[i];
-        if (site->hash == 0 || site->total_blocks == 0) {
-            continue;
-        }
-        (void)fprintf(out,
-                      "{\"label\":\"%s\",\"site\":%llu,\"live_bytes\":%zu,\"live_blocks\":%zu,"
-                      "\"total_bytes\":%zu,\"total_blocks\":%zu,\"peak_live\":%zu,\"frames\":[",
-                      label ? label : "", (unsigned long long)site->hash, site->live_bytes,
-                      site->live_blocks, site->total_bytes, site->total_blocks,
-                      site->peak_live_bytes);
-        for (int f = 0; f < site->frame_count; f++) {
-            (void)fprintf(out, "%s\"%p\"", f == 0 ? "" : ",", site->frames[f]);
-        }
-        (void)fprintf(out, "]}\n");
-    }
-    cbm_mutex_unlock(&g_profile_mutex);
-    (void)fclose(out);
-    return true;
-}
diff --git a/src/foundation/mem_profile.h b/src/foundation/mem_profile.h
deleted file mode 100644
index 44613a45b..000000000
--- a/src/foundation/mem_profile.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * mem_profile.h — Which allocation sites retain memory?
- *
- * The census answers "which POOL holds the memory"; it cannot answer "which
- * allocation put it there". Without that, every hypothesis about #581 needed a
- * code change plus a soak to test, so the investigation could only ask one
- * yes/no question per eight minutes — and two mechanisms that looked confirmed
- * were later falsified. This records the missing half.
- *
- * Only allocations at or above a size threshold are tracked (default 32 KiB).
- * That is deliberate: arena fragmentation is driven by large transient runs,
- * and tracking every small allocation would cost more than the signal is worth.
- * The threshold is reported alongside the data so the blind spot is explicit.
- *
- * Off unless CBM_MEM_PROFILE=1. All tables are fixed-capacity and allocated
- * once; when a table fills, the overflow is COUNTED and reported rather than
- * silently dropped, because a profiler that quietly loses records produces
- * exactly the false confidence this is meant to end.
- */
-#ifndef CBM_MEM_PROFILE_H
-#define CBM_MEM_PROFILE_H
-
-#include <stdbool.h>
-#include <stddef.h>
-
-/* Gate: CBM_MEM_PROFILE=1. Read once, cached. */
-bool cbm_mem_profile_enabled(void);
-
-/* Minimum allocation size recorded, from CBM_MEM_PROFILE_MIN (bytes). */
-size_t cbm_mem_profile_threshold(void);
-
-/* Record an allocation / release. Safe to call unconditionally: both return
- * immediately when profiling is off or the size is below the threshold. */
-void cbm_mem_profile_alloc(void *block, size_t size);
-
-/* Same, but with the caller's return address supplied by the hook itself.
- * Required on Windows ARM64, where CaptureStackBackTrace returns nothing: a
- * return address captured inside the capture helper names the helper, so every
- * allocation collapses onto a handful of hook addresses and the attribution
- * column becomes useless. Each hook must evaluate __builtin_return_address(0)
- * in its OWN frame and pass it here. */
-void cbm_mem_profile_alloc_at(void *block, size_t size, void *caller);
-void cbm_mem_profile_free(void *block);
-
-typedef struct {
-    size_t sites;      /* distinct call sites seen */
-    size_t live_bytes; /* currently retained, attributed */
-    size_t live_blocks;
-    size_t total_bytes;        /* cumulative allocated at/above threshold */
-    size_t untracked_frees;    /* frees whose pointer was not in the table */
-    size_t site_table_full;    /* records lost: site table exhausted */
-    size_t pointer_table_full; /* records lost: pointer table exhausted */
-    /* Stack capture returned nothing. On Windows ARM64 CaptureStackBackTrace
-     * can legitimately fail, and dropping those samples silently makes a
-     * working profiler look like an empty one. */
-    size_t capture_failed;
-} cbm_mem_profile_totals_t;
-
-void cbm_mem_profile_totals(cbm_mem_profile_totals_t *out);
-
-/* Append one JSON object per site to `path`, biggest live first, with the raw
- * return addresses of each site's stack. Symbolisation is deliberately left to
- * the offline analyser so the hot path never loads a symbol handler. */
-bool cbm_mem_profile_dump(const char *path, const char *label);
-
-#endif /* CBM_MEM_PROFILE_H */
diff --git a/src/foundation/platform.c b/src/foundation/platform.c
index 14e36c0d8..cf9a0f469 100644
--- a/src/foundation/platform.c
+++ b/src/foundation/platform.c
@@ -543,6 +543,60 @@ const char *cbm_app_local_dir(void) {
 
 /* ── Cache directory ────────────────────────── */
 
+const char *cbm_errno_name(int error) {
+    static const struct {
+        int value;
+        const char *name;
+    } names[] = {
+        {EACCES, "EACCES"},
+        {EAGAIN, "EAGAIN"},
+        {EBUSY, "EBUSY"},
+        {EEXIST, "EEXIST"},
+        {EFBIG, "EFBIG"},
+        {EINTR, "EINTR"},
+        {EINVAL, "EINVAL"},
+        {EIO, "EIO"},
+        {EISDIR, "EISDIR"},
+        {ELOOP, "ELOOP"},
+        {EMFILE, "EMFILE"},
+        {EMLINK, "EMLINK"},
+        {ENAMETOOLONG, "ENAMETOOLONG"},
+        {ENFILE, "ENFILE"},
+        {ENOENT, "ENOENT"},
+        {ENOMEM, "ENOMEM"},
+        {ENOSPC, "ENOSPC"},
+        {ENOTDIR, "ENOTDIR"},
+        {ENOTEMPTY, "ENOTEMPTY"},
+        {ENXIO, "ENXIO"},
+        {EPERM, "EPERM"},
+        {EROFS, "EROFS"},
+        {ETXTBSY, "ETXTBSY"},
+        {EXDEV, "EXDEV"},
+        {ETIMEDOUT, "ETIMEDOUT"},
+        {ECONNREFUSED, "ECONNREFUSED"},
+        {EADDRINUSE, "EADDRINUSE"},
+        {ENOTSOCK, "ENOTSOCK"},
+        {EPIPE, "EPIPE"},
+#ifdef EDQUOT
+        {EDQUOT, "EDQUOT"},
+#endif
+#ifdef EOVERFLOW
+        {EOVERFLOW, "EOVERFLOW"},
+#endif
+#ifdef ENOTSUP
+        {ENOTSUP, "ENOTSUP"},
+#endif
+    };
+    for (size_t i = 0; i < sizeof(names) / sizeof(names[0]); i++) {
+        if (names[i].value == error) {
+            return names[i].name;
+        }
+    }
+    static CBM_TLS char fallback[16];
+    (void)snprintf(fallback, sizeof(fallback), "%d", error);
+    return fallback;
+}
+
 const char *cbm_resolve_cache_dir(void) {
     static CBM_TLS char buf[CBM_SZ_4K];
     static const char missing[] = "\x1f"
diff --git a/src/foundation/platform.h b/src/foundation/platform.h
index 938cf5905..43738f621 100644
--- a/src/foundation/platform.h
+++ b/src/foundation/platform.h
@@ -94,6 +94,13 @@ uint64_t cbm_now_ns(void);
 /* Monotonic millisecond timestamp. */
 uint64_t cbm_now_ms(void);
 
+/* Symbolic name for an errno value ("ENOSPC"), or the decimal number when the
+ * value is not in the portable table. The fallback lives in thread-local
+ * storage; copy it before the next call on the same thread. Diagnostics only:
+ * a log line that says `errno=ENOSPC path=...` is a one-line diagnosis where
+ * `stage=pending_publication` alone cost a reporter hours (#1828). */
+const char *cbm_errno_name(int error);
+
 /* ── System info ───────────────────────────────────────────────── */
 
 /* Number of available CPU cores. */
@@ -109,6 +116,16 @@ typedef struct {
 /* Query system information. Results are cached after first call. */
 cbm_system_info_t cbm_system_info(void);
 
+/* Physical memory the system could hand out right now, or 0 when the platform
+ * cannot answer. NOT cached - it changes during a run, which is the point. */
+size_t cbm_system_available_ram(void);
+
+/* Free bytes on the filesystem holding `path`, or 0 when the platform cannot
+ * answer. Spilling trades a memory problem for a disk problem, so the disk has
+ * to be ASKED before that trade, not discovered through a failed write halfway
+ * through. Not cached: free space changes while we spill into it. */
+size_t cbm_fs_free_bytes(const char *path);
+
 /* Recommended worker count for parallel indexing.
  * initial=true:  all cores (user is waiting for initial index)
  * initial=false: max(1, perf_cores-1) (leave headroom for user apps) */
diff --git a/src/foundation/sha256.c b/src/foundation/sha256.c
index 937e363e6..84d37453e 100644
--- a/src/foundation/sha256.c
+++ b/src/foundation/sha256.c
@@ -25,7 +25,11 @@ static const uint32_t K[64] = {
 #define SIG1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ ((x) >> 10))
 
 static void sha256_transform(cbm_sha256_ctx *c, const uint8_t *data) {
-    uint32_t m[64];
+    /* Scratch comes from the context, not this frame: a 256-byte local here
+     * is fake-stacked by ASan's use-after-return mode on every 64-byte block
+     * (see the note on cbm_sha256_ctx::sched). Identical values, allocated
+     * once per hash instead of once per block. */
+    uint32_t *m = c->sched;
     for (int i = 0, j = 0; i < 16; i++, j += 4) {
         m[i] = ((uint32_t)data[j] << 24) | ((uint32_t)data[j + 1] << 16) |
                ((uint32_t)data[j + 2] << 8) | (uint32_t)data[j + 3];
diff --git a/src/foundation/sha256.h b/src/foundation/sha256.h
index a34a741d3..f3c7f9c55 100644
--- a/src/foundation/sha256.h
+++ b/src/foundation/sha256.h
@@ -17,6 +17,14 @@ typedef struct {
     uint64_t bitlen;
     uint8_t buf[64];
     size_t buflen;
+    /* Message-schedule scratch for one compression round. It lives in the
+     * context rather than in sha256_transform's own frame because a 256-byte
+     * local there is large enough for ASan's use-after-return fake stack,
+     * which then heap-allocates it on EVERY 64-byte block — millions of
+     * __asan_stack_malloc calls to fingerprint one large file, turning
+     * sanitized binary fingerprinting into minutes. Here it is allocated once
+     * per hash instead of once per block. */
+    uint32_t sched[64];
 } cbm_sha256_ctx;
 
 void cbm_sha256_init(cbm_sha256_ctx *c);
diff --git a/src/foundation/slab_alloc.c b/src/foundation/slab_alloc.c
index 95d23587e..684aa1838 100644
--- a/src/foundation/slab_alloc.c
+++ b/src/foundation/slab_alloc.c
@@ -39,6 +39,7 @@
 #include "foundation/slab_alloc.h"
 #include "foundation/compat.h"
 #include "foundation/compat_thread.h"
+#include "foundation/mem_core.h"
 
 #include <stdbool.h>
 #include <stddef.h>
@@ -177,7 +178,7 @@ static bool slab_map_set(uintptr_t base, slab_page_t *val) {
             slab_map_unlock();
             return true; /* nothing to unregister */
         }
-        l2 = (slab_map_l2_t *)calloc(1, sizeof(*l2));
+        l2 = (slab_map_l2_t *)cbm_calloc(CBM_MEM_CLASS_TS_TREE, sizeof(*l2));
         if (!l2) {
             slab_map_unlock();
             return false;
@@ -190,7 +191,7 @@ static bool slab_map_set(uintptr_t base, slab_page_t *val) {
             slab_map_unlock();
             return true;
         }
-        l3 = (slab_map_l3_t *)calloc(1, sizeof(*l3));
+        l3 = (slab_map_l3_t *)cbm_calloc(CBM_MEM_CLASS_TS_TREE, sizeof(*l3));
         if (!l3) {
             slab_map_unlock();
             return false;
@@ -217,6 +218,7 @@ static bool slab_grow(slab_state_t *s) {
     if (cbm_aligned_alloc(&mem, SLAB_PAGE_SIZE, SLAB_PAGE_SIZE) != 0 || !mem) {
         return false;
     }
+    cbm_mem_class_add_external(CBM_MEM_CLASS_TS_TREE, SLAB_PAGE_SIZE);
     slab_page_t *page = (slab_page_t *)mem;
     page->next = s->pages;
     atomic_init(&page->owner, s);
@@ -224,6 +226,7 @@ static bool slab_grow(slab_state_t *s) {
     atomic_init(&page->refcount, 1u); /* owner guard */
 
     if (!slab_map_register_page(page)) {
+        cbm_mem_class_remove_external(CBM_MEM_CLASS_TS_TREE, SLAB_PAGE_SIZE);
         cbm_aligned_free(page);
         return false;
     }
@@ -269,6 +272,7 @@ static void slab_reclaim_pages(slab_state_t *s, bool clear_installed) {
         unsigned prev = atomic_fetch_sub_explicit(&p->refcount, 1u, memory_order_acq_rel);
         if (prev == 1u) {
             slab_map_unregister_page(p);
+            cbm_mem_class_remove_external(CBM_MEM_CLASS_TS_TREE, SLAB_PAGE_SIZE);
             cbm_aligned_free(p);
         }
         p = next;
@@ -292,7 +296,7 @@ static void *slab_malloc(size_t size) {
         if (!s->freelist) {
             slab_refill(s);
             if (!s->freelist) {
-                return malloc(size); /* grow failed → heap fallback */
+                return cbm_alloc(CBM_MEM_CLASS_TS_TREE, size); /* grow failed → heap fallback */
             }
         }
         slab_free_node_t *node = s->freelist;
@@ -302,8 +306,8 @@ static void *slab_malloc(size_t size) {
         return node;
     }
 
-    /* >64B: straight to malloc (= mimalloc in production) */
-    return malloc(size);
+    /* >64B: straight to the core (= mimalloc in production) */
+    return cbm_alloc(CBM_MEM_CLASS_TS_TREE, size);
 }
 
 static void *slab_calloc(size_t count, size_t size) {
@@ -338,7 +342,7 @@ static void *slab_realloc(void *ptr, size_t new_size) {
             return ptr;
         }
         /* Promote slab → heap */
-        void *new_ptr = malloc(new_size);
+        void *new_ptr = cbm_alloc(CBM_MEM_CLASS_TS_TREE, new_size);
         if (!new_ptr) {
             return NULL;
         }
@@ -347,8 +351,8 @@ static void *slab_realloc(void *ptr, size_t new_size) {
         return new_ptr;
     }
 
-    /* Case 2: heap pointer (from malloc) */
-    return realloc(ptr, new_size);
+    /* Case 2: heap pointer (from the core) */
+    return cbm_realloc(CBM_MEM_CLASS_TS_TREE, ptr, new_size);
 }
 
 static void slab_free(void *ptr) {
@@ -359,7 +363,7 @@ static void slab_free(void *ptr) {
     slab_page_t *page = slab_map_lookup(base);
     if (!page) {
         /* Not a slab chunk → plain heap pointer (>64B or grow-fallback). */
-        free(ptr);
+        cbm_free(CBM_MEM_CLASS_TS_TREE, ptr);
         return;
     }
 
@@ -386,6 +390,7 @@ static void slab_free(void *ptr) {
     if (prev == 1u) {
         /* We returned the final chunk of a retired page → release it. */
         slab_map_unregister_page(page);
+        cbm_mem_class_remove_external(CBM_MEM_CLASS_TS_TREE, SLAB_PAGE_SIZE);
         cbm_aligned_free(page);
     }
 }
diff --git a/src/foundation/str_util.c b/src/foundation/str_util.c
index c8aec01af..9f65c079a 100644
--- a/src/foundation/str_util.c
+++ b/src/foundation/str_util.c
@@ -310,6 +310,33 @@ bool cbm_validate_project_name(const char *name) {
     return true;
 }
 
+int cbm_utf8_trim_partial(char *buf) {
+    if (!buf) {
+        return 0;
+    }
+    int pos = (int)strlen(buf);
+    if (pos == 0) {
+        return 0;
+    }
+    /* Walk back over continuation bytes to the lead byte; drop the sequence
+     * when fewer continuation bytes follow it than its lead byte announces. */
+    int back = pos - 1;
+    int cont = 0;
+    while (back >= 0 && ((unsigned char)buf[back] & 0xC0) == 0x80) {
+        back--;
+        cont++;
+    }
+    if (back >= 0) {
+        unsigned char lead = (unsigned char)buf[back];
+        int need = lead >= 0xF0 ? 3 : lead >= 0xE0 ? 2 : lead >= 0xC0 ? 1 : 0;
+        if (need > cont) {
+            pos = back;
+            buf[pos] = '\0';
+        }
+    }
+    return pos;
+}
+
 int cbm_json_escape(char *buf, int bufsize, const char *src) {
     if (!buf || bufsize <= 0) {
         return 0;
@@ -319,7 +346,8 @@ int cbm_json_escape(char *buf, int bufsize, const char *src) {
         return 0;
     }
     int pos = 0;
-    for (int i = 0; src[i] && pos < bufsize - JSON_NUL_RESERVE; i++) {
+    int i = 0;
+    for (; src[i] && pos < bufsize - JSON_NUL_RESERVE; i++) {
         unsigned char c = (unsigned char)src[i];
         if (c == '"' || c == '\\') {
             if (pos + JSON_ESC_LEN > bufsize - JSON_NUL_RESERVE) {
@@ -356,5 +384,11 @@ int cbm_json_escape(char *buf, int bufsize, const char *src) {
         }
     }
     buf[pos] = '\0';
+    /* A truncated output must never end inside a multibyte UTF-8 sequence: a
+     * callee cut mid-character persisted bytes SQLite cannot decode as text
+     * (2026-09-16 probe: nine CALLS rows across rust, java and typescript). */
+    if (src[i] != '\0') {
+        pos = cbm_utf8_trim_partial(buf);
+    }
     return pos;
 }
diff --git a/src/foundation/str_util.h b/src/foundation/str_util.h
index e0ff46057..afaeb6ba0 100644
--- a/src/foundation/str_util.h
+++ b/src/foundation/str_util.h
@@ -91,9 +91,16 @@ bool cbm_validate_project_name(const char *name);
         }                                                                            \
     } while (0)
 
+/* Drop a trailing INCOMPLETE UTF-8 sequence from a NUL-terminated buffer in
+ * place (a lead byte whose continuation bytes were cut off). Returns the new
+ * length. Complete sequences and ASCII are left untouched. Use after any
+ * byte-count truncation of text that will be stored or serialised. */
+int cbm_utf8_trim_partial(char *buf);
+
 /* Escape a string for safe embedding in JSON: escapes " \ and control chars.
  * Writes into buf (including NUL). Returns number of chars written (excl NUL).
- * If buf is too small, output is truncated but always NUL-terminated. */
+ * If buf is too small, output is truncated but always NUL-terminated, and it
+ * never ends inside a multibyte UTF-8 sequence. */
 int cbm_json_escape(char *buf, int bufsize, const char *src);
 
 #endif /* CBM_STR_UTIL_H */
diff --git a/src/foundation/subprocess.c b/src/foundation/subprocess.c
index 196165cea..83f788937 100644
--- a/src/foundation/subprocess.c
+++ b/src/foundation/subprocess.c
@@ -411,6 +411,7 @@ struct cbm_subprocess {
     void *log_ud;
     int quiet_timeout_ms;
     int cancel_grace_ms;
+    size_t memory_limit_bytes;
     bool delete_log_on_exit;
 
     long tail_pos;
@@ -444,6 +445,9 @@ static void cbm_subprocess_result_init(cbm_proc_result_t *result) {
     result->forced = false;
     result->tree_quiesced = false;
     result->supervision_failed = false;
+    result->job_memory_limit_bytes = 0;
+    result->peak_job_memory_bytes = 0;
+    result->job_memory_available = false;
 }
 
 static void cbm_subprocess_free_config(cbm_subprocess_t *process) {
@@ -525,6 +529,7 @@ static cbm_subprocess_t *cbm_subprocess_copy_opts(const cbm_proc_opts_t *opts) {
     if (process->cancel_grace_ms > CBM_SUBPROCESS_MAX_CANCEL_GRACE_MS) {
         process->cancel_grace_ms = CBM_SUBPROCESS_MAX_CANCEL_GRACE_MS;
     }
+    process->memory_limit_bytes = opts->memory_limit_bytes;
     process->delete_log_on_exit = opts->delete_log_on_exit;
     atomic_init(&process->lifecycle, CBM_SUBPROCESS_ACTIVE);
     cbm_subprocess_result_init(&process->result);
@@ -658,6 +663,10 @@ static int cbm_subprocess_spawn_win(cbm_subprocess_t *process) {
     JOBOBJECT_EXTENDED_LIMIT_INFORMATION limits;
     ZeroMemory(&limits, sizeof(limits));
     limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+    if (process->memory_limit_bytes > 0) {
+        limits.BasicLimitInformation.LimitFlags |= JOB_OBJECT_LIMIT_JOB_MEMORY;
+        limits.JobMemoryLimit = (SIZE_T)process->memory_limit_bytes;
+    }
     HANDLE job = CreateJobObjectW(NULL, NULL);
     if (!job ||
         !SetInformationJobObject(job, JobObjectExtendedLimitInformation, &limits, sizeof(limits))) {
@@ -785,6 +794,17 @@ static bool cbm_win_job_active(cbm_subprocess_t *process, bool *known) {
     return accounting.ActiveProcesses != 0;
 }
 
+static void cbm_win_capture_job_memory(cbm_subprocess_t *process) {
+    process->result.job_memory_limit_bytes = process->memory_limit_bytes;
+    JOBOBJECT_EXTENDED_LIMIT_INFORMATION limits;
+    ZeroMemory(&limits, sizeof(limits));
+    if (QueryInformationJobObject(process->job, JobObjectExtendedLimitInformation, &limits,
+                                  sizeof(limits), NULL)) {
+        process->result.peak_job_memory_bytes = (size_t)limits.PeakJobMemoryUsed;
+        process->result.job_memory_available = true;
+    }
+}
+
 static void cbm_win_begin_termination(cbm_subprocess_t *process, uint64_t now) {
     if (process->termination_started) {
         return;
@@ -873,9 +893,11 @@ static cbm_proc_poll_t cbm_subprocess_poll_win(cbm_subprocess_t *process, cbm_pr
     if (process->force_started_ms != 0 &&
         now - process->force_started_ms >= CBM_SUBPROCESS_FORCE_SETTLE_MS &&
         (!job_known || job_active || !process->root_reaped)) {
+        cbm_win_capture_job_memory(process);
         return cbm_subprocess_finish_failed(process, out);
     }
     if (process->root_reaped && !job_active) {
+        cbm_win_capture_job_memory(process);
         return cbm_subprocess_finish(process, out);
     }
     return CBM_PROC_POLL_RUNNING;
diff --git a/src/foundation/subprocess.h b/src/foundation/subprocess.h
index 62592c592..54940de11 100644
--- a/src/foundation/subprocess.h
+++ b/src/foundation/subprocess.h
@@ -42,6 +42,9 @@ typedef struct {
     bool forced; /* force was needed after grace expiry or to reap descendants after root exit */
     bool tree_quiesced;      /* the owned process tree has no surviving processes */
     bool supervision_failed; /* the bounded containment deadline expired; tree_quiesced is false */
+    size_t job_memory_limit_bytes; /* Windows Job Object commit cap; zero on POSIX or uncapped */
+    size_t peak_job_memory_bytes;  /* Windows peak commit, not RSS or proof of a limit hit */
+    bool job_memory_available;     /* terminal Job Object memory query succeeded */
 } cbm_proc_result_t;
 
 /* Called synchronously for each newly-completed log chunk while the child runs.
@@ -68,6 +71,8 @@ typedef struct {
                                       * ms with no new completed log line */
     int cancel_grace_ms;             /* graceful tree-termination window; <= 0 uses the finite
                                       * CBM_SUBPROCESS_DEFAULT_CANCEL_GRACE_MS */
+    size_t memory_limit_bytes;       /* Windows-only hard commit limit for the entire Job Object;
+                                      * 0 => no OS-enforced memory limit */
     bool delete_log_on_exit;         /* unlink log_file after reaping */
 } cbm_proc_opts_t;
 
diff --git a/src/foundation/system_info.c b/src/foundation/system_info.c
index 8ba237f6c..84a91cdf1 100644
--- a/src/foundation/system_info.c
+++ b/src/foundation/system_info.c
@@ -14,18 +14,25 @@
 
 enum { DEFAULT_CORES = 1, MIN_WORKERS = 1, CBM_WORKERS_MAX = 256 };
 #include "foundation/log.h"
+#include "foundation/mem_core.h" /* cbm_alloc: one accounted allocation path */
 #include "foundation/platform.h"
 #include "foundation/system_info_internal.h"
-#include <stdint.h> // uint64_t
-#include <stdlib.h> // strtol
+#include <stdatomic.h> // the system-info cache is published across worker threads
+#include <stdint.h>    // uint64_t
+#include <stdlib.h>    // strtol
 #include <string.h>
 
+#ifndef _WIN32
+#include <sys/statvfs.h> /* cbm_fs_free_bytes: free space before we spill into it */
+#endif
+
 #ifdef _WIN32
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN
 #endif
 #include <windows.h>
 #elif defined(__APPLE__)
+#include <mach/mach.h> /* host_statistics64 - reclaimable page accounting */
 #include <sys/sysctl.h>
 #elif defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__)
 #include <unistd.h>
@@ -261,23 +268,51 @@ static cbm_system_info_t detect_system_windows(void) {
 
 /* ── Public API ──────────────────────────────────────────────────── */
 
-static int info_cached = 0;
+/* The cache is published once, by whichever thread gets there first.
+ *
+ * This used to be a plain `if (!info_cached) { cached_info = detect(); }`, which
+ * was fine while only the main thread asked. It stopped being fine when the
+ * memory-relief path started calling cbm_mem_system_under_pressure() from the
+ * extract workers: several threads then raced on the flag AND on the struct,
+ * and a struct assignment is not atomic, so a reader could see half of one.
+ * TSan caught it on all three platforms (system_info.c:284 against :274, from
+ * extract_worker).
+ *
+ * Three states rather than a flag, so the winner of the compare-exchange is the
+ * only writer of cached_info: a loser returns the copy it detected itself,
+ * which is the same answer, and a later reader sees the published struct
+ * through the acquire/release pair. No mutex, so nothing has to be initialised
+ * before first use, and no reader can observe a half-written struct. */
+enum { INFO_EMPTY = 0, INFO_CLAIMED = 1, INFO_READY = 2 };
+static _Atomic int info_state = INFO_EMPTY;
 static cbm_system_info_t cached_info;
 
-cbm_system_info_t cbm_system_info(void) {
-    if (!info_cached) {
+static cbm_system_info_t detect_system_now(void) {
 #ifdef _WIN32
-        cached_info = detect_system_windows();
+    return detect_system_windows();
 #elif defined(__APPLE__)
-        cached_info = detect_system_macos();
+    return detect_system_macos();
 #elif defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__)
-        cached_info = detect_system_bsd();
+    return detect_system_bsd();
 #else
-        cached_info = detect_system_linux();
+    return detect_system_linux();
 #endif
-        info_cached = SKIP_ONE;
+}
+
+cbm_system_info_t cbm_system_info(void) {
+    if (atomic_load_explicit(&info_state, memory_order_acquire) == INFO_READY) {
+        return cached_info;
     }
-    return cached_info;
+    /* Detection only reads the OS (sysconf/sysctl/GetSystemInfo), so racing
+     * threads doing it twice during startup costs a little and changes nothing. */
+    cbm_system_info_t local = detect_system_now();
+    int expected = INFO_EMPTY;
+    if (atomic_compare_exchange_strong_explicit(&info_state, &expected, INFO_CLAIMED,
+                                                memory_order_acq_rel, memory_order_relaxed)) {
+        cached_info = local;
+        atomic_store_explicit(&info_state, INFO_READY, memory_order_release);
+    }
+    return local;
 }
 
 int cbm_default_worker_count(bool initial) {
@@ -304,3 +339,102 @@ int cbm_default_worker_count(bool initial) {
     int workers = info.perf_cores - SKIP_ONE;
     return workers > 0 ? workers : MIN_WORKERS;
 }
+
+/* -- Available RAM --------------------------------------------------
+ *
+ * Bytes the system could hand out right now, or 0 when the platform cannot
+ * answer. Deliberately NOT cached: core counts and total RAM are immutable
+ * hardware facts, but this changes continuously and the entire point is to
+ * observe it DURING an index.
+ *
+ * Why this exists: the indexer decided "out of memory" by comparing its own
+ * RSS against a static fraction of TOTAL ram. That refuses work a machine can
+ * plainly do -- measured 2026-09-13, the linux kernel needs 31.75 GB on a
+ * 48 GB host (66 percent) against a 0.5 default budget, and the same index
+ * completed on the previous release by overshooting to 33.56 GB. Whether
+ * memory is actually scarce is a property of the SYSTEM, not of a constant. */
+size_t cbm_system_available_ram(void) {
+#ifdef _WIN32
+    MEMORYSTATUSEX status;
+    status.dwLength = sizeof(status);
+    if (GlobalMemoryStatusEx(&status)) {
+        return (size_t)status.ullAvailPhys;
+    }
+    return 0;
+#elif defined(__APPLE__)
+    /* free + inactive + purgeable. Counting only free_count would report
+     * pressure on any machine that is merely warm, because inactive and
+     * purgeable pages are reclaimed on demand. */
+    mach_port_t host = mach_host_self();
+    vm_size_t page_size = 0;
+    if (host_page_size(host, &page_size) != KERN_SUCCESS || page_size == 0) {
+        return 0;
+    }
+    vm_statistics64_data_t vm_stat = {0};
+    mach_msg_type_number_t count = HOST_VM_INFO64_COUNT;
+    if (host_statistics64(host, HOST_VM_INFO64, (host_info64_t)&vm_stat, &count) != KERN_SUCCESS) {
+        return 0;
+    }
+    uint64_t pages = (uint64_t)vm_stat.free_count + (uint64_t)vm_stat.inactive_count +
+                     (uint64_t)vm_stat.purgeable_count;
+    return (size_t)(pages * (uint64_t)page_size);
+#elif !defined(__NetBSD__) && !defined(__FreeBSD__) && !defined(__OpenBSD__)
+    /* Linux: MemAvailable is the kernel estimate and accounts for reclaimable
+     * slab and page cache, which MemFree does not. */
+    FILE *meminfo = fopen("/proc/meminfo", "re");
+    if (!meminfo) {
+        return 0;
+    }
+    char line[CBM_SZ_256];
+    size_t available = 0;
+    while (fgets(line, sizeof(line), meminfo) != NULL) {
+        unsigned long long kb = 0;
+        if (sscanf(line, "MemAvailable: %llu kB", &kb) == 1) {
+            available = (size_t)(kb * (unsigned long long)CBM_SZ_1K);
+            break;
+        }
+    }
+    (void)fclose(meminfo);
+    return available;
+#else
+    return 0; /* BSD: unknown rather than guessed */
+#endif
+}
+
+size_t cbm_fs_free_bytes(const char *path) {
+    if (!path || !path[0]) {
+        return 0;
+    }
+#ifdef _WIN32
+    /* The QUOTA figure, not the volume's: on a disk with per-user quotas the
+     * volume's free space is not what this process may actually write. */
+    ULARGE_INTEGER avail = {0};
+    /* Widened through the memory core rather than cbm_utf8_to_wide(), which
+     * allocates with raw malloc: every allocation in this binary goes through
+     * one accounted path (src/foundation/mem_core.h). */
+    int wide_len = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, path, -1, NULL, 0);
+    if (wide_len <= 0) {
+        return 0;
+    }
+    wchar_t *wide = cbm_alloc(CBM_MEM_CLASS_OTHER, (size_t)wide_len * sizeof(wchar_t));
+    if (!wide) {
+        return 0;
+    }
+    size_t free_bytes = 0;
+    if (MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, path, -1, wide, wide_len) == wide_len &&
+        GetDiskFreeSpaceExW(wide, &avail, NULL, NULL)) {
+        free_bytes = (size_t)avail.QuadPart;
+    }
+    cbm_free(CBM_MEM_CLASS_OTHER, wide);
+    return free_bytes;
+#else
+    struct statvfs st;
+    if (statvfs(path, &st) != 0) {
+        return 0;
+    }
+    /* f_bavail, not f_bfree: blocks free for an UNPRIVILEGED writer, which is
+     * what this process is. f_frsize is the fragment size the counts are in. */
+    uint64_t unit = st.f_frsize ? (uint64_t)st.f_frsize : (uint64_t)st.f_bsize;
+    return (size_t)((uint64_t)st.f_bavail * unit);
+#endif
+}
diff --git a/src/graph_buffer/graph_buffer.c b/src/graph_buffer/graph_buffer.c
index 939cc8cdb..e55eb28f0 100644
--- a/src/graph_buffer/graph_buffer.c
+++ b/src/graph_buffer/graph_buffer.c
@@ -36,8 +36,10 @@ enum {
 #include "foundation/dyn_array.h"
 #include "foundation/profile.h"
 #include "foundation/mem.h"
+#include "foundation/mem_core.h"
 #include <sqlite3.h>
 
+#include <errno.h>
 #include <stdatomic.h>
 #include <stdint.h> // int64_t
 #include <stdio.h>
@@ -60,6 +62,18 @@ static inline void *intptr_to_ptr(intptr_t v) {
 #define EDGE_KEY_BUF CBM_SZ_256
 
 /* Per-type or per-key edge list stored in hash tables as values */
+typedef struct {
+    uint64_t h0;
+    uint64_t h1;
+    cbm_gbuf_edge_t *edge; /* NULL = empty slot */
+} edge_key_slot_t;
+
+typedef struct {
+    edge_key_slot_t *slots;
+    size_t cap; /* power of two, 0 = not allocated */
+    size_t count;
+} edge_key_map_t;
+
 typedef CBM_DYN_ARRAY(const cbm_gbuf_edge_t *) edge_ptr_array_t;
 
 /* Per-label or per-name node list */
@@ -85,6 +99,10 @@ struct cbm_gbuf {
      * strings at kernel scale, plus a snprintf+strdup+hash on every one of
      * the ~18 hot find_by_id call sites. */
     cbm_gbuf_node_t **by_id;
+    /* Worker buffers (cbm_gbuf_new_worker) keep no by_id array: their ids
+     * come from the shared counter, so a dense array would span the whole
+     * global id space in every worker and double in lockstep. */
+    bool by_id_off;
     int64_t by_id_cap;
 
     /* Secondary node indexes */
@@ -95,7 +113,7 @@ struct cbm_gbuf {
     CBM_DYN_ARRAY(cbm_gbuf_edge_t *) edges;
 
     /* Edge dedup index: "srcID:tgtID:type" → cbm_gbuf_edge_t* */
-    CBMHashTable *edge_by_key;
+    edge_key_map_t edge_by_key; /* dedup: 128-bit key hash -> edge */
 
     /* Edge secondary indexes: composite keys → edge_ptr_array_t */
     CBMHashTable *edges_by_source_type; /* "srcID:type" → edge_ptr_array_t* */
@@ -124,7 +142,7 @@ struct cbm_gbuf {
 /* ── Helpers ─────────────────────────────────────────────────────── */
 
 static char *heap_strdup(const char *s) {
-    return s ? strdup(s) : strdup("{}");
+    return cbm_mem_strdup(CBM_MEM_CLASS_GBUF_STRING, s ? s : "{}");
 }
 
 /* Intern a repetitive string into the buffer's pool: identical content collapses
@@ -137,7 +155,7 @@ static const char *gb_intern(cbm_gbuf_t *gb, const char *s) {
     if (found) {
         return found;
     }
-    char *copy = strdup(key);
+    char *copy = cbm_mem_strdup(CBM_MEM_CLASS_GBUF_STRING, key);
     if (copy) {
         cbm_ht_set(gb->intern_pool, copy, copy); /* key == value == owned copy */
     }
@@ -201,22 +219,142 @@ static void make_src_type_key(char *buf, size_t bufsz, int64_t src, const char *
     snprintf(buf, bufsz, "%lld:%s", (long long)src, type);
 }
 
+/* ── Edge dedup index: 128-bit key hash -> edge, open addressing ──────
+ *
+ * The dedup key is "src:tgt:type:props" (make_edge_key). Keeping it as a
+ * string per edge cost the kernel 15.8M heap strings (~1.2 GB live, and the
+ * same again transiently in worker buffers during merge). Two independent
+ * 64-bit FNV-1a hashes of the composed key take 16 bytes; a false match needs
+ * both to collide, ~n^2 / 2^129 for n edges -- below any other failure mode of
+ * the index. Linear probing, backward-shift deletion (no tombstones), load
+ * kept under 1/2. Values are the edge pointers (stable heap records). */
+
+static void edge_key_hash(const char *key, uint64_t *h0, uint64_t *h1) {
+    uint64_t a = 1469598103934665603ULL;
+    uint64_t b = 0x9E3779B97F4A7C15ULL;
+    for (const unsigned char *p = (const unsigned char *)key; *p; p++) {
+        a ^= *p;
+        a *= 1099511628211ULL;
+        b = (b ^ *p) * 0xFF51AFD7ED558CCDULL;
+        b ^= b >> 29;
+    }
+    *h0 = a;
+    *h1 = b ^ (a >> 17);
+}
+
+static void edge_key_map_free(edge_key_map_t *m) {
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, m->slots);
+    m->slots = NULL;
+    m->cap = 0;
+    m->count = 0;
+}
+
+static edge_key_slot_t *edge_key_map_find(const edge_key_map_t *m, uint64_t h0, uint64_t h1) {
+    if (!m->slots) {
+        return NULL;
+    }
+    size_t mask = m->cap - SKIP_ONE;
+    for (size_t i = (size_t)h0 & mask;; i = (i + SKIP_ONE) & mask) {
+        edge_key_slot_t *s = &m->slots[i];
+        if (!s->edge) {
+            return NULL;
+        }
+        if (s->h0 == h0 && s->h1 == h1) {
+            return s;
+        }
+    }
+}
+
+static bool edge_key_map_grow(edge_key_map_t *m) {
+    size_t new_cap = m->cap ? m->cap * PAIR_LEN : CBM_SZ_1K;
+    edge_key_slot_t *slots = cbm_calloc(CBM_MEM_CLASS_GBUF_INDEX, new_cap * sizeof(*slots));
+    if (!slots) {
+        return false;
+    }
+    size_t mask = new_cap - SKIP_ONE;
+    for (size_t i = 0; i < m->cap; i++) {
+        edge_key_slot_t *s = &m->slots[i];
+        if (!s->edge) {
+            continue;
+        }
+        size_t j = (size_t)s->h0 & mask;
+        while (slots[j].edge) {
+            j = (j + SKIP_ONE) & mask;
+        }
+        slots[j] = *s;
+    }
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, m->slots);
+    m->slots = slots;
+    m->cap = new_cap;
+    return true;
+}
+
+static bool edge_key_map_set(edge_key_map_t *m, uint64_t h0, uint64_t h1, cbm_gbuf_edge_t *edge) {
+    if ((m->count + SKIP_ONE) * PAIR_LEN > m->cap && !edge_key_map_grow(m)) {
+        return false;
+    }
+    size_t mask = m->cap - SKIP_ONE;
+    size_t i = (size_t)h0 & mask;
+    while (m->slots[i].edge) {
+        if (m->slots[i].h0 == h0 && m->slots[i].h1 == h1) {
+            m->slots[i].edge = edge;
+            return true;
+        }
+        i = (i + SKIP_ONE) & mask;
+    }
+    m->slots[i].h0 = h0;
+    m->slots[i].h1 = h1;
+    m->slots[i].edge = edge;
+    m->count++;
+    return true;
+}
+
+static void edge_key_map_delete(edge_key_map_t *m, uint64_t h0, uint64_t h1) {
+    edge_key_slot_t *s = edge_key_map_find(m, h0, h1);
+    if (!s) {
+        return;
+    }
+    size_t mask = m->cap - SKIP_ONE;
+    size_t i = (size_t)(s - m->slots);
+    m->slots[i].edge = NULL;
+    m->count--;
+    /* Backward shift: pull later entries of the same probe run into the hole. */
+    for (size_t j = (i + SKIP_ONE) & mask; m->slots[j].edge; j = (j + SKIP_ONE) & mask) {
+        size_t home = (size_t)m->slots[j].h0 & mask;
+        /* entry at j may move to i if its home is not in (i, j] cyclically */
+        bool movable = (i <= j) ? (home <= i || home > j) : (home <= i && home > j);
+        if (movable) {
+            m->slots[i] = m->slots[j];
+            m->slots[j].edge = NULL;
+            i = j;
+        }
+    }
+}
+
 /* Get or create a node_ptr_array_t in a hash table */
+static void node_array_push(node_ptr_array_t *arr, const cbm_gbuf_node_t *node);
+
 static node_ptr_array_t *get_or_create_node_array(CBMHashTable *ht, const char *key) {
+    if (!ht) {
+        return NULL; /* worker buffer: no secondary indexes (cbm_gbuf_new_worker) */
+    }
     node_ptr_array_t *arr = cbm_ht_get(ht, key);
     if (!arr) {
-        arr = calloc(CBM_ALLOC_ONE, sizeof(node_ptr_array_t));
-        cbm_ht_set(ht, strdup(key), arr);
+        arr = cbm_calloc(CBM_MEM_CLASS_GBUF_INDEX, sizeof(node_ptr_array_t));
+        cbm_ht_set(ht, cbm_mem_strdup(CBM_MEM_CLASS_GBUF_INDEX, key), arr);
     }
     return arr;
 }
 
 /* Get or create an edge_ptr_array_t in a hash table */
 static edge_ptr_array_t *get_or_create_edge_array(CBMHashTable *ht, const char *key) {
+    if (!ht) {
+        return NULL;
+    }
     edge_ptr_array_t *arr = cbm_ht_get(ht, key);
     if (!arr) {
-        arr = calloc(CBM_ALLOC_ONE, sizeof(edge_ptr_array_t));
-        cbm_ht_set(ht, strdup(key), arr);
+        arr = cbm_calloc(CBM_MEM_CLASS_GBUF_INDEX, sizeof(edge_ptr_array_t));
+        cbm_ht_set(ht, cbm_mem_strdup(CBM_MEM_CLASS_GBUF_INDEX, key), arr);
     }
     return arr;
 }
@@ -227,9 +365,9 @@ static void free_node_array(const char *key, void *value, void *ud) {
     node_ptr_array_t *arr = value;
     if (arr) {
         cbm_da_free(arr);
-        free(arr);
+        cbm_free(CBM_MEM_CLASS_GBUF_INDEX, arr);
     }
-    free((void *)key);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, (void *)key);
 }
 
 /* Free an edge_ptr_array_t (callback) */
@@ -238,30 +376,40 @@ static void free_edge_array(const char *key, void *value, void *ud) {
     edge_ptr_array_t *arr = value;
     if (arr) {
         cbm_da_free(arr);
-        free(arr);
+        cbm_free(CBM_MEM_CLASS_GBUF_INDEX, arr);
     }
-    free((void *)key);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, (void *)key);
 }
 
-/* Free keys only (for edge_by_key, deleted_set) */
-static void free_key_only(const char *key, void *value, void *ud) {
+/* Free index keys only (deleted_set id keys). */
+static void free_index_key(const char *key, void *value, void *ud) {
     (void)value;
     (void)ud;
-    free((void *)key);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, (void *)key);
+}
+
+/* Free one intern-pool entry: key == value == the single owned string copy
+ * that nodes/edges borrowed for label/file_path/type. */
+static void free_intern_entry(const char *key, void *value, void *ud) {
+    (void)value;
+    (void)ud;
+    cbm_free(CBM_MEM_CLASS_GBUF_STRING, (void *)key);
 }
 
 /* Free a single node's owned strings. label and file_path are interned
  * (pool-owned) — NOT freed here; the pool frees them once in cbm_gbuf_free. */
 static void free_node_strings(cbm_gbuf_node_t *n) {
-    free(n->name);
-    free(n->qualified_name);
-    free(n->properties_json);
+    cbm_free(CBM_MEM_CLASS_GBUF_STRING, n->name);
+    cbm_free(CBM_MEM_CLASS_GBUF_STRING, n->qualified_name);
+    cbm_free(CBM_MEM_CLASS_GBUF_STRING, n->properties_json);
 }
 
-/* Free a single edge's owned strings. type is interned (pool-owned) — NOT
- * freed here; the pool frees it once in cbm_gbuf_free. */
+/* An edge owns no strings: type AND properties_json are interned (pool-owned;
+ * the pool frees each once in cbm_gbuf_free). Edge properties repeat massively
+ * -- on the Go corpus 1.8M edges carry 343k distinct property strings and 854k
+ * are exactly "{}" -- and an edge's properties are never mutated in place. */
 static void free_edge_strings(cbm_gbuf_edge_t *e) {
-    free(e->properties_json);
+    (void)e;
 }
 
 /* Allocate the next buffer-local or shared-atomic ID. */
@@ -303,9 +451,10 @@ static void unindex_edge(cbm_gbuf_t *gb, const cbm_gbuf_edge_t *e) {
     char key[EDGE_KEY_BUF];
 
     make_edge_key(key, sizeof(key), e->source_id, e->target_id, e->type, e->properties_json);
-    const char *ekey = cbm_ht_get_key(gb->edge_by_key, key);
-    cbm_ht_delete(gb->edge_by_key, key);
-    free((void *)ekey);
+    uint64_t h0;
+    uint64_t h1;
+    edge_key_hash(key, &h0, &h1);
+    edge_key_map_delete(&gb->edge_by_key, h0, h1);
 
     make_src_type_key(key, sizeof(key), e->source_id, e->type);
     remove_edge_from_ptr_array(cbm_ht_get(gb->edges_by_source_type, key), e->id);
@@ -329,7 +478,7 @@ static void cascade_delete_edges(cbm_gbuf_t *gb, CBMHashTable *deleted_set) {
         if (cbm_ht_get(deleted_set, src_id) || cbm_ht_get(deleted_set, tgt_id)) {
             unindex_edge(gb, e);
             free_edge_strings(e);
-            free(e);
+            cbm_free(CBM_MEM_CLASS_GBUF_EDGE, e);
         } else {
             gb->edges.items[write_idx++] = gb->edges.items[i];
         }
@@ -341,34 +490,50 @@ static void cascade_delete_edges(cbm_gbuf_t *gb, CBMHashTable *deleted_set) {
 static void register_node_in_indexes(cbm_gbuf_t *gb, cbm_gbuf_node_t *node) {
     cbm_ht_set(gb->node_by_qn, node->qualified_name, node);
 
-    if (node->id >= gb->by_id_cap) {
-        int64_t nc = gb->by_id_cap > 0 ? gb->by_id_cap : CBM_SZ_1K;
-        while (nc <= node->id) {
-            nc *= 2;
+    if (!gb->by_id_off) {
+        if (node->id >= gb->by_id_cap) {
+            int64_t nc = gb->by_id_cap > 0 ? gb->by_id_cap : CBM_SZ_1K;
+            while (nc <= node->id) {
+                nc *= 2;
+            }
+            cbm_gbuf_node_t **grown =
+                cbm_realloc(CBM_MEM_CLASS_GBUF_INDEX, gb->by_id, (size_t)nc * sizeof(*grown));
+            if (grown) {
+                memset(grown + gb->by_id_cap, 0, (size_t)(nc - gb->by_id_cap) * sizeof(*grown));
+                gb->by_id = grown;
+                gb->by_id_cap = nc;
+            }
         }
-        cbm_gbuf_node_t **grown = realloc(gb->by_id, (size_t)nc * sizeof(*grown));
-        if (grown) {
-            memset(grown + gb->by_id_cap, 0, (size_t)(nc - gb->by_id_cap) * sizeof(*grown));
-            gb->by_id = grown;
-            gb->by_id_cap = nc;
+        if (node->id >= 0 && node->id < gb->by_id_cap) {
+            gb->by_id[node->id] = node;
         }
     }
-    if (node->id >= 0 && node->id < gb->by_id_cap) {
-        gb->by_id[node->id] = node;
-    }
 
     node_ptr_array_t *by_label =
         get_or_create_node_array(gb->nodes_by_label, node->label ? node->label : "");
-    cbm_da_push(by_label, (const cbm_gbuf_node_t *)node);
+    node_array_push(by_label, node);
 
     node_ptr_array_t *by_name =
         get_or_create_node_array(gb->nodes_by_name, node->name ? node->name : "");
-    cbm_da_push(by_name, (const cbm_gbuf_node_t *)node);
+    node_array_push(by_name, node);
 }
 
-/* Push an edge pointer into a dynamic array (wraps macro to reduce CC contribution). */
+/* Per-key index arrays start at two slots: on the kernel the secondary
+ * indexes hold ~18M of these arrays and most keys have one or two entries,
+ * so the default 8-slot start was 1 GB of empty headroom. NULL = the buffer
+ * has no secondary indexes (worker buffers). */
+enum { GB_INDEX_ARRAY_FIRST_CAP = 2 };
 static void edge_array_push(edge_ptr_array_t *arr, const cbm_gbuf_edge_t *edge) {
-    cbm_da_push(arr, edge);
+    if (!arr) {
+        return;
+    }
+    cbm_da_push_min(arr, edge, GB_INDEX_ARRAY_FIRST_CAP);
+}
+static void node_array_push(node_ptr_array_t *arr, const cbm_gbuf_node_t *node) {
+    if (!arr) {
+        return;
+    }
+    cbm_da_push_min(arr, node, GB_INDEX_ARRAY_FIRST_CAP);
 }
 
 /* Index an edge by one key into a hash table bucket. */
@@ -392,6 +557,9 @@ static void register_edge_in_indexes(cbm_gbuf_t *gb, cbm_gbuf_edge_t *edge) {
 
 /* Rebuild edge secondary indexes from scratch (after bulk deletion). */
 static void rebuild_edge_secondary_indexes(cbm_gbuf_t *gb) {
+    if (!gb->edges_by_type) {
+        return; /* worker buffer: nothing to rebuild */
+    }
     cbm_ht_foreach(gb->edges_by_source_type, free_edge_array, NULL);
     cbm_ht_free(gb->edges_by_source_type);
     cbm_ht_foreach(gb->edges_by_target_type, free_edge_array, NULL);
@@ -399,9 +567,9 @@ static void rebuild_edge_secondary_indexes(cbm_gbuf_t *gb) {
     cbm_ht_foreach(gb->edges_by_type, free_edge_array, NULL);
     cbm_ht_free(gb->edges_by_type);
 
-    gb->edges_by_source_type = cbm_ht_create(CBM_SZ_256);
-    gb->edges_by_target_type = cbm_ht_create(CBM_SZ_256);
-    gb->edges_by_type = cbm_ht_create(CBM_SZ_32);
+    gb->edges_by_source_type = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_256);
+    gb->edges_by_target_type = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_256);
+    gb->edges_by_type = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_32);
 
     for (int i = 0; i < gb->edges.count; i++) {
         register_edge_in_indexes(gb, gb->edges.items[i]);
@@ -412,7 +580,7 @@ static void rebuild_edge_secondary_indexes(cbm_gbuf_t *gb) {
 static void release_gbuf_indexes(cbm_gbuf_t *gb) {
     cbm_ht_free(gb->node_by_qn);
     gb->node_by_qn = NULL;
-    free(gb->by_id);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, gb->by_id);
     gb->by_id = NULL;
     gb->by_id_cap = 0;
     cbm_ht_foreach(gb->nodes_by_label, free_node_array, NULL);
@@ -421,9 +589,7 @@ static void release_gbuf_indexes(cbm_gbuf_t *gb) {
     cbm_ht_foreach(gb->nodes_by_name, free_node_array, NULL);
     cbm_ht_free(gb->nodes_by_name);
     gb->nodes_by_name = NULL;
-    cbm_ht_foreach(gb->edge_by_key, free_key_only, NULL);
-    cbm_ht_free(gb->edge_by_key);
-    gb->edge_by_key = NULL;
+    edge_key_map_free(&gb->edge_by_key);
     cbm_ht_foreach(gb->edges_by_source_type, free_edge_array, NULL);
     cbm_ht_free(gb->edges_by_source_type);
     gb->edges_by_source_type = NULL;
@@ -438,28 +604,27 @@ static void release_gbuf_indexes(cbm_gbuf_t *gb) {
 /* ── Lifecycle ──────────────────────────────────────────────────── */
 
 cbm_gbuf_t *cbm_gbuf_new(const char *project, const char *root_path) {
-    cbm_gbuf_t *gb = calloc(CBM_ALLOC_ONE, sizeof(cbm_gbuf_t));
+    cbm_gbuf_t *gb = cbm_calloc(CBM_MEM_CLASS_OTHER, sizeof(cbm_gbuf_t));
     if (!gb) {
         return NULL;
     }
 
-    gb->project = strdup(project ? project : "");
-    gb->root_path = strdup(root_path ? root_path : "");
+    gb->project = cbm_mem_strdup(CBM_MEM_CLASS_GBUF_STRING, project ? project : "");
+    gb->root_path = cbm_mem_strdup(CBM_MEM_CLASS_GBUF_STRING, root_path ? root_path : "");
     gb->next_id = SKIP_ONE;
     gb->shared_ids = NULL;
 
-    gb->node_by_qn = cbm_ht_create(CBM_SZ_256);
+    gb->node_by_qn = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_256);
     gb->by_id = NULL;
     gb->by_id_cap = 0;
-    gb->nodes_by_label = cbm_ht_create(CBM_SZ_32);
-    gb->nodes_by_name = cbm_ht_create(CBM_SZ_256);
+    gb->nodes_by_label = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_32);
+    gb->nodes_by_name = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_256);
 
-    gb->edge_by_key = cbm_ht_create(CBM_SZ_512);
-    gb->edges_by_source_type = cbm_ht_create(CBM_SZ_256);
-    gb->edges_by_target_type = cbm_ht_create(CBM_SZ_256);
-    gb->edges_by_type = cbm_ht_create(CBM_SZ_32);
+    gb->edges_by_source_type = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_256);
+    gb->edges_by_target_type = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_256);
+    gb->edges_by_type = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_INDEX, CBM_SZ_32);
 
-    gb->intern_pool = cbm_ht_create(CBM_SZ_1K);
+    gb->intern_pool = cbm_ht_create_in(CBM_MEM_CLASS_GBUF_STRING, CBM_SZ_1K);
 
     return gb;
 }
@@ -473,6 +638,40 @@ cbm_gbuf_t *cbm_gbuf_new_shared_ids(const char *project, const char *root_path,
     return gb;
 }
 
+cbm_gbuf_t *cbm_gbuf_new_worker(const char *project, const char *root_path,
+                                _Atomic int64_t *id_source) {
+    cbm_gbuf_t *gb = cbm_gbuf_new_shared_ids(project, root_path, id_source);
+    if (!gb) {
+        return NULL;
+    }
+    /* A worker buffer is appended to and merged; it is never asked by label,
+     * name or edge type. Its secondary indexes were pure cost: on the kernel
+     * the index class peaked at 7.1 GB during resolve against 2.5 GB live in
+     * the main buffer, the difference being 18 workers' throwaway indexes.
+     * node_by_qn and edge_by_key stay: upsert and dedup need them. */
+    cbm_ht_free(gb->nodes_by_label);
+    cbm_ht_free(gb->nodes_by_name);
+    cbm_ht_free(gb->edges_by_source_type);
+    cbm_ht_free(gb->edges_by_target_type);
+    cbm_ht_free(gb->edges_by_type);
+    gb->nodes_by_label = NULL;
+    gb->nodes_by_name = NULL;
+    gb->edges_by_source_type = NULL;
+    gb->edges_by_target_type = NULL;
+    gb->edges_by_type = NULL;
+    /* Nor by id: with ids from the shared counter, a dense id -> node array
+     * in every worker spans the whole global id space (8.5M ids x 8 B x 18
+     * workers on the kernel) and all of them double in the same instant --
+     * a 1 GB step between two reads of the memory gate, which is where the
+     * 15 GB budget was missed (2026-09-14). Nothing asks a worker buffer by
+     * id before the merge; the main buffer answers after it. */
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, gb->by_id);
+    gb->by_id = NULL;
+    gb->by_id_cap = 0;
+    gb->by_id_off = true;
+    return gb;
+}
+
 void cbm_gbuf_free(cbm_gbuf_t *gb) {
     if (!gb) {
         return;
@@ -482,7 +681,7 @@ void cbm_gbuf_free(cbm_gbuf_t *gb) {
     for (int i = 0; i < gb->nodes.count; i++) {
         cbm_gbuf_node_t *n = gb->nodes.items[i];
         free_node_strings(n);
-        free(n);
+        cbm_free(CBM_MEM_CLASS_GBUF_NODE, n);
     }
     cbm_da_free(&gb->nodes);
 
@@ -490,7 +689,7 @@ void cbm_gbuf_free(cbm_gbuf_t *gb) {
     for (int i = 0; i < gb->edges.count; i++) {
         cbm_gbuf_edge_t *e = gb->edges.items[i];
         free_edge_strings(e);
-        free(e);
+        cbm_free(CBM_MEM_CLASS_GBUF_EDGE, e);
     }
     cbm_da_free(&gb->edges);
 
@@ -498,7 +697,7 @@ void cbm_gbuf_free(cbm_gbuf_t *gb) {
     if (gb->node_by_qn) {
         cbm_ht_free(gb->node_by_qn);
     }
-    free(gb->by_id);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, gb->by_id);
     if (gb->nodes_by_label) {
         cbm_ht_foreach(gb->nodes_by_label, free_node_array, NULL);
         cbm_ht_free(gb->nodes_by_label);
@@ -507,10 +706,7 @@ void cbm_gbuf_free(cbm_gbuf_t *gb) {
         cbm_ht_foreach(gb->nodes_by_name, free_node_array, NULL);
         cbm_ht_free(gb->nodes_by_name);
     }
-    if (gb->edge_by_key) {
-        cbm_ht_foreach(gb->edge_by_key, free_key_only, NULL);
-        cbm_ht_free(gb->edge_by_key);
-    }
+    edge_key_map_free(&gb->edge_by_key);
     if (gb->edges_by_source_type) {
         cbm_ht_foreach(gb->edges_by_source_type, free_edge_array, NULL);
         cbm_ht_free(gb->edges_by_source_type);
@@ -526,28 +722,28 @@ void cbm_gbuf_free(cbm_gbuf_t *gb) {
 
     /* Free vector storage */
     for (int i = 0; i < gb->dump_vector_count; i++) {
-        free((void *)gb->dump_vectors[i].vector);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)gb->dump_vectors[i].vector);
     }
-    free(gb->dump_vectors);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, gb->dump_vectors);
 
     /* Free token vector storage */
     for (int i = 0; i < gb->dump_token_vec_count; i++) {
-        free((void *)gb->dump_token_vecs[i].token);
-        free((void *)gb->dump_token_vecs[i].vector);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)gb->dump_token_vecs[i].token);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)gb->dump_token_vecs[i].vector);
     }
-    free(gb->dump_token_vecs);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, gb->dump_token_vecs);
 
     /* Free interned strings (node label/file_path, edge type) — pool owns one
-     * copy each (key == value), freed exactly once via free_key_only. Done after
-     * nodes/edges since they borrowed these pointers. */
+     * copy each (key == value), freed exactly once via free_intern_entry. Done
+     * after nodes/edges since they borrowed these pointers. */
     if (gb->intern_pool) {
-        cbm_ht_foreach(gb->intern_pool, free_key_only, NULL);
+        cbm_ht_foreach(gb->intern_pool, free_intern_entry, NULL);
         cbm_ht_free(gb->intern_pool);
     }
 
-    free(gb->project);
-    free(gb->root_path);
-    free(gb);
+    cbm_free(CBM_MEM_CLASS_GBUF_STRING, gb->project);
+    cbm_free(CBM_MEM_CLASS_GBUF_STRING, gb->root_path);
+    cbm_free(CBM_MEM_CLASS_OTHER, gb);
 }
 
 /* ── Vector storage ──────────────────────────────────────────────── */
@@ -560,7 +756,8 @@ int cbm_gbuf_store_vector(cbm_gbuf_t *gb, int64_t node_id, const uint8_t *vector
     if (gb->dump_vector_count >= gb->dump_vector_cap) {
         int new_cap =
             gb->dump_vector_cap < VEC_INIT_CAP ? VEC_INIT_CAP : gb->dump_vector_cap * VEC_GROW;
-        CBMDumpVector *grown = realloc(gb->dump_vectors, (size_t)new_cap * sizeof(CBMDumpVector));
+        CBMDumpVector *grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, gb->dump_vectors,
+                                           (size_t)new_cap * sizeof(CBMDumpVector));
         if (!grown) {
             return GB_ERR;
         }
@@ -568,7 +765,7 @@ int cbm_gbuf_store_vector(cbm_gbuf_t *gb, int64_t node_id, const uint8_t *vector
         gb->dump_vector_cap = new_cap;
     }
     /* Copy vector data */
-    uint8_t *vec_copy = malloc((size_t)vector_len);
+    uint8_t *vec_copy = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)vector_len);
     if (!vec_copy) {
         return GB_ERR;
     }
@@ -592,15 +789,15 @@ int cbm_gbuf_store_token_vector(cbm_gbuf_t *gb, const char *token, const uint8_t
     if (gb->dump_token_vec_count >= gb->dump_token_vec_cap) {
         int new_cap =
             gb->dump_token_vec_cap < TV_INIT_CAP ? TV_INIT_CAP : gb->dump_token_vec_cap * TV_GROW;
-        CBMDumpTokenVec *grown =
-            realloc(gb->dump_token_vecs, (size_t)new_cap * sizeof(CBMDumpTokenVec));
+        CBMDumpTokenVec *grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, gb->dump_token_vecs,
+                                             (size_t)new_cap * sizeof(CBMDumpTokenVec));
         if (!grown) {
             return GB_ERR;
         }
         gb->dump_token_vecs = grown;
         gb->dump_token_vec_cap = new_cap;
     }
-    uint8_t *vec_copy = malloc((size_t)vector_len);
+    uint8_t *vec_copy = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)vector_len);
     if (!vec_copy) {
         return GB_ERR;
     }
@@ -610,7 +807,7 @@ int cbm_gbuf_store_token_vector(cbm_gbuf_t *gb, const char *token, const uint8_t
     gb->dump_token_vecs[idx] = (CBMDumpTokenVec){
         .id = idx + SKIP_ONE, /* 1-based sequential ID */
         .project = gb->project,
-        .token = strdup(token),
+        .token = cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, token),
         .vector = vec_copy,
         .vector_len = vector_len,
         .idf = idf,
@@ -721,30 +918,30 @@ int64_t cbm_gbuf_upsert_node(cbm_gbuf_t *gb, const char *label, const char *name
                 cbm_ht_get(gb->nodes_by_name, existing->name ? existing->name : ""), existing->id);
         }
         existing->label = (char *)new_label_interned;
-        free(existing->name);
+        cbm_free(CBM_MEM_CLASS_GBUF_STRING, existing->name);
         existing->name = new_name;
         existing->file_path = (char *)gb_intern(gb, file_path);
         existing->start_line = start_line;
         existing->end_line = end_line;
         if (new_props) {
-            free(existing->properties_json);
+            cbm_free(CBM_MEM_CLASS_GBUF_STRING, existing->properties_json);
             existing->properties_json = new_props;
         }
         if (label_changed) {
             node_ptr_array_t *by_label = get_or_create_node_array(
                 gb->nodes_by_label, existing->label ? existing->label : "");
-            cbm_da_push(by_label, (const cbm_gbuf_node_t *)existing);
+            node_array_push(by_label, existing);
         }
         if (name_changed) {
             node_ptr_array_t *by_name =
                 get_or_create_node_array(gb->nodes_by_name, existing->name ? existing->name : "");
-            cbm_da_push(by_name, (const cbm_gbuf_node_t *)existing);
+            node_array_push(by_name, existing);
         }
         return existing->id;
     }
 
     /* Heap-allocate a new node (pointer stays stable across array growth) */
-    cbm_gbuf_node_t *node = calloc(CBM_ALLOC_ONE, sizeof(cbm_gbuf_node_t));
+    cbm_gbuf_node_t *node = cbm_calloc(CBM_MEM_CLASS_GBUF_NODE, sizeof(cbm_gbuf_node_t));
     if (!node) {
         return 0;
     }
@@ -766,6 +963,19 @@ int64_t cbm_gbuf_upsert_node(cbm_gbuf_t *gb, const char *label, const char *name
     return id;
 }
 
+int cbm_gbuf_node_set_properties_json(cbm_gbuf_node_t *node, const char *json) {
+    if (!node) {
+        return GB_ERR;
+    }
+    char *copy = heap_strdup(json);
+    if (!copy) {
+        return GB_ERR;
+    }
+    cbm_free(CBM_MEM_CLASS_GBUF_STRING, node->properties_json);
+    node->properties_json = copy;
+    return 0;
+}
+
 const cbm_gbuf_node_t *cbm_gbuf_find_by_qn(const cbm_gbuf_t *gb, const char *qn) {
     if (!gb || !qn) {
         return NULL;
@@ -834,7 +1044,8 @@ int cbm_gbuf_delete_by_label(cbm_gbuf_t *gb, const char *label) {
 
         char id_buf[CBM_SZ_32];
         make_id_key(id_buf, sizeof(id_buf), n->id);
-        cbm_ht_set(deleted_set, strdup(id_buf), intptr_to_ptr(SKIP_ONE));
+        cbm_ht_set(deleted_set, cbm_mem_strdup(CBM_MEM_CLASS_GBUF_INDEX, id_buf),
+                   intptr_to_ptr(SKIP_ONE));
 
         /* Remove from primary indexes */
         cbm_ht_delete(gb->node_by_qn, n->qualified_name);
@@ -849,7 +1060,7 @@ int cbm_gbuf_delete_by_label(cbm_gbuf_t *gb, const char *label) {
     /* Cascade-delete edges referencing deleted nodes */
     cascade_delete_edges(gb, deleted_set);
 
-    cbm_ht_foreach(deleted_set, free_key_only, NULL);
+    cbm_ht_foreach(deleted_set, free_index_key, NULL);
     cbm_ht_free(deleted_set);
     return 0;
 }
@@ -876,7 +1087,8 @@ int cbm_gbuf_delete_by_file(cbm_gbuf_t *gb, const char *file_path) {
 
         char id_buf[CBM_SZ_32];
         make_id_key(id_buf, sizeof(id_buf), n->id);
-        cbm_ht_set(deleted_set, strdup(id_buf), intptr_to_ptr(SKIP_ONE));
+        cbm_ht_set(deleted_set, cbm_mem_strdup(CBM_MEM_CLASS_GBUF_INDEX, id_buf),
+                   intptr_to_ptr(SKIP_ONE));
 
         /* Remove from secondary indexes */
         remove_node_from_ptr_array(cbm_ht_get(gb->nodes_by_label, n->label), n->id);
@@ -890,7 +1102,7 @@ int cbm_gbuf_delete_by_file(cbm_gbuf_t *gb, const char *file_path) {
 
         /* NULL out QN so dump's liveness check (cbm_ht_get by QN) fails
          * even if a new node with the same QN is inserted later via merge. */
-        free(n->qualified_name);
+        cbm_free(CBM_MEM_CLASS_GBUF_STRING, n->qualified_name);
         n->qualified_name = NULL;
         deleted_count++;
     }
@@ -903,7 +1115,7 @@ int cbm_gbuf_delete_by_file(cbm_gbuf_t *gb, const char *file_path) {
     /* Cascade-delete edges referencing deleted nodes */
     cascade_delete_edges(gb, deleted_set);
 
-    cbm_ht_foreach(deleted_set, free_key_only, NULL);
+    cbm_ht_foreach(deleted_set, free_index_key, NULL);
     cbm_ht_free(deleted_set);
     {
         char s_buf[CBM_SZ_16];
@@ -945,7 +1157,8 @@ int cbm_gbuf_load_from_db(cbm_gbuf_t *gb, const char *db_path, const char *proje
     }
     sqlite3_finalize(stmt);
 
-    int64_t *old_to_new = calloc((size_t)(max_old_id + SKIP_ONE), sizeof(int64_t));
+    int64_t *old_to_new =
+        cbm_calloc(CBM_MEM_CLASS_GBUF_INDEX, (size_t)(max_old_id + SKIP_ONE) * sizeof(int64_t));
     if (!old_to_new) {
         cbm_store_close(store);
         return CBM_NOT_FOUND;
@@ -957,7 +1170,7 @@ int cbm_gbuf_load_from_db(cbm_gbuf_t *gb, const char *db_path, const char *proje
             "SELECT id, label, name, qualified_name, file_path, start_line, end_line, properties "
             "FROM nodes WHERE project = ? ORDER BY id",
             CBM_NOT_FOUND, &stmt, NULL) != SQLITE_OK) {
-        free(old_to_new);
+        cbm_free(CBM_MEM_CLASS_GBUF_INDEX, old_to_new);
         cbm_store_close(store);
         return CBM_NOT_FOUND;
     }
@@ -985,7 +1198,7 @@ int cbm_gbuf_load_from_db(cbm_gbuf_t *gb, const char *db_path, const char *proje
                            "SELECT source_id, target_id, type, properties "
                            "FROM edges WHERE project = ?",
                            CBM_NOT_FOUND, &stmt, NULL) != SQLITE_OK) {
-        free(old_to_new);
+        cbm_free(CBM_MEM_CLASS_GBUF_INDEX, old_to_new);
         cbm_store_close(store);
         return CBM_NOT_FOUND;
     }
@@ -1005,7 +1218,7 @@ int cbm_gbuf_load_from_db(cbm_gbuf_t *gb, const char *db_path, const char *proje
     }
     sqlite3_finalize(stmt);
 
-    free(old_to_new);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, old_to_new);
     cbm_store_close(store);
     return 0;
 }
@@ -1101,17 +1314,20 @@ int64_t cbm_gbuf_insert_edge(cbm_gbuf_t *gb, int64_t source_id, int64_t target_i
     char key[EDGE_KEY_BUF];
     make_edge_key(key, sizeof(key), source_id, target_id, type, properties_json);
 
-    cbm_gbuf_edge_t *existing = cbm_ht_get(gb->edge_by_key, key);
+    uint64_t h0;
+    uint64_t h1;
+    edge_key_hash(key, &h0, &h1);
+    edge_key_slot_t *hit = edge_key_map_find(&gb->edge_by_key, h0, h1);
+    cbm_gbuf_edge_t *existing = hit ? hit->edge : NULL;
     if (existing) {
         if (edge_props_should_replace(existing->properties_json, properties_json)) {
-            free(existing->properties_json);
-            existing->properties_json = heap_strdup(properties_json);
+            existing->properties_json = (char *)gb_intern(gb, properties_json);
         }
         return existing->id;
     }
 
     /* Heap-allocate a new edge (pointer stays stable) */
-    cbm_gbuf_edge_t *edge = calloc(CBM_ALLOC_ONE, sizeof(cbm_gbuf_edge_t));
+    cbm_gbuf_edge_t *edge = cbm_calloc(CBM_MEM_CLASS_GBUF_EDGE, sizeof(cbm_gbuf_edge_t));
     if (!edge) {
         return 0;
     }
@@ -1121,13 +1337,13 @@ int64_t cbm_gbuf_insert_edge(cbm_gbuf_t *gb, int64_t source_id, int64_t target_i
     edge->source_id = source_id;
     edge->target_id = target_id;
     edge->type = (char *)gb_intern(gb, type);
-    edge->properties_json = heap_strdup(properties_json);
+    edge->properties_json = (char *)gb_intern(gb, properties_json);
 
     /* Store pointer in array */
     cbm_da_push(&gb->edges, edge);
 
     /* Dedup index */
-    cbm_ht_set(gb->edge_by_key, strdup(key), edge);
+    (void)edge_key_map_set(&gb->edge_by_key, h0, h1, edge);
 
     /* Secondary indexes */
     register_edge_in_indexes(gb, edge);
@@ -1212,11 +1428,12 @@ int cbm_gbuf_delete_edges_by_type(cbm_gbuf_t *gb, const char *type) {
             char key[EDGE_KEY_BUF];
             make_edge_key(key, sizeof(key), e->source_id, e->target_id, e->type,
                           e->properties_json);
-            const char *ekey = cbm_ht_get_key(gb->edge_by_key, key);
-            cbm_ht_delete(gb->edge_by_key, key);
-            free((void *)ekey);
+            uint64_t h0;
+            uint64_t h1;
+            edge_key_hash(key, &h0, &h1);
+            edge_key_map_delete(&gb->edge_by_key, h0, h1);
             free_edge_strings(e);
-            free(e);
+            cbm_free(CBM_MEM_CLASS_GBUF_EDGE, e);
         } else {
             gb->edges.items[write_idx++] = gb->edges.items[i];
         }
@@ -1234,8 +1451,8 @@ int cbm_gbuf_delete_edges_by_type(cbm_gbuf_t *gb, const char *type) {
 /* Free remap hash table entries (key = heap string, value = heap int64_t*) */
 static void free_remap_entry(const char *key, void *val, void *ud) {
     (void)ud;
-    free((void *)key);
-    free(val);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, (void *)key);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, val);
 }
 
 /* Handle QN collision: update dst node fields (src wins), record remap if IDs differ.
@@ -1296,24 +1513,24 @@ static void merge_update_existing(cbm_gbuf_t *dst, cbm_gbuf_node_t *existing,
                     existing->id);
             }
             existing->label = (char *)new_label;
-            free(existing->name);
+            cbm_free(CBM_MEM_CLASS_GBUF_STRING, existing->name);
             existing->name = heap_strdup(sn->name);
             existing->file_path = (char *)gb_intern(dst, sn->file_path);
             existing->start_line = sn->start_line;
             existing->end_line = sn->end_line;
             if (sn->properties_json) {
-                free(existing->properties_json);
+                cbm_free(CBM_MEM_CLASS_GBUF_STRING, existing->properties_json);
                 existing->properties_json = heap_strdup(sn->properties_json);
             }
             if (label_changed) {
                 node_ptr_array_t *by_label = get_or_create_node_array(
                     dst->nodes_by_label, existing->label ? existing->label : "");
-                cbm_da_push(by_label, (const cbm_gbuf_node_t *)existing);
+                node_array_push(by_label, existing);
             }
             if (name_changed) {
                 node_ptr_array_t *by_name = get_or_create_node_array(
                     dst->nodes_by_name, existing->name ? existing->name : "");
-                cbm_da_push(by_name, (const cbm_gbuf_node_t *)existing);
+                node_array_push(by_name, existing);
             }
         }
     }
@@ -1324,15 +1541,15 @@ static void merge_update_existing(cbm_gbuf_t *dst, cbm_gbuf_node_t *existing,
         }
         char key[CBM_SZ_32];
         make_id_key(key, sizeof(key), sn->id);
-        int64_t *val = malloc(sizeof(int64_t));
+        int64_t *val = cbm_alloc(CBM_MEM_CLASS_GBUF_INDEX, sizeof(int64_t));
         *val = existing->id;
-        cbm_ht_set(*remap, strdup(key), val);
+        cbm_ht_set(*remap, cbm_mem_strdup(CBM_MEM_CLASS_GBUF_INDEX, key), val);
     }
 }
 
 /* Copy a non-colliding src node into dst with its original ID. */
 static void merge_copy_new_node(cbm_gbuf_t *dst, const cbm_gbuf_node_t *sn) {
-    cbm_gbuf_node_t *node = calloc(CBM_ALLOC_ONE, sizeof(cbm_gbuf_node_t));
+    cbm_gbuf_node_t *node = cbm_calloc(CBM_MEM_CLASS_GBUF_NODE, sizeof(cbm_gbuf_node_t));
     if (!node) {
         return;
     }
@@ -1445,7 +1662,7 @@ static char *extract_prop_string(const char *props, const char *key_quoted, cons
     yyjson_val *v = yyjson_obj_get(yyjson_doc_get_root(doc), key);
     if (v && yyjson_is_str(v)) {
         const char *sv = yyjson_get_str(v);
-        out = cbm_strndup(sv, strlen(sv));
+        out = cbm_mem_strdup(CBM_MEM_CLASS_DUMP, sv);
     }
     yyjson_doc_free(doc);
     return out;
@@ -1477,11 +1694,11 @@ static CBMDumpNode *build_dump_nodes(cbm_gbuf_t *gb, int live_count, int64_t *te
                                      int64_t max_temp_id, int *out_count,
                                      cbm_gbuf_node_t ***src_out) {
     size_t cap = (size_t)(live_count > 0 ? live_count : SKIP_ONE);
-    CBMDumpNode *dump_nodes = malloc(cap * sizeof(CBMDumpNode));
+    CBMDumpNode *dump_nodes = cbm_alloc(CBM_MEM_CLASS_DUMP, cap * sizeof(CBMDumpNode));
     /* Parallel gbuf-node pointers so a streamed partition can free its heavy
      * properties_json after the rows are persisted. NULL on OOM disables the
      * per-partition free (the dump still succeeds). */
-    cbm_gbuf_node_t **src = malloc(cap * sizeof(cbm_gbuf_node_t *));
+    cbm_gbuf_node_t **src = cbm_alloc(CBM_MEM_CLASS_DUMP, cap * sizeof(cbm_gbuf_node_t *));
     int idx = 0;
 
     for (int i = 0; i < gb->nodes.count; i++) {
@@ -1534,10 +1751,10 @@ static CBMDumpEdge *build_dump_edges(cbm_gbuf_t *gb, const int64_t *temp_to_fina
         }
     }
 
-    CBMDumpEdge *dump_edges =
-        malloc((size_t)(valid_edges > 0 ? valid_edges : SKIP_ONE) * sizeof(CBMDumpEdge));
-    char **url_paths = calloc((size_t)(valid_edges > 0 ? valid_edges : SKIP_ONE), sizeof(char *));
-    char **local_names = calloc((size_t)(valid_edges > 0 ? valid_edges : SKIP_ONE), sizeof(char *));
+    size_t edge_cap = (size_t)(valid_edges > 0 ? valid_edges : SKIP_ONE);
+    CBMDumpEdge *dump_edges = cbm_alloc(CBM_MEM_CLASS_DUMP, edge_cap * sizeof(CBMDumpEdge));
+    char **url_paths = cbm_calloc(CBM_MEM_CLASS_DUMP, edge_cap * sizeof(char *));
+    char **local_names = cbm_calloc(CBM_MEM_CLASS_DUMP, edge_cap * sizeof(char *));
     int idx = 0;
 
     for (int i = 0; i < gb->edges.count; i++) {
@@ -1625,18 +1842,44 @@ static void log_dump_summary(int node_count, int edge_count) {
     cbm_log_info("gbuf.dump", "nodes", b1, "edges", b2);
 }
 
+/* A dump that published nothing gets exactly one signature in the log.
+ * Without it the writer's return code is the only evidence, and it reaches
+ * the user as a generic pipeline failure that blames their repository
+ * (#1620, #2001).
+ *
+ * failure_errno is read by the caller at the point of failure: the value is
+ * only meaningful before the next library call. Zero means the failure did
+ * not originate at the publish boundary — an append that failed many calls
+ * earlier — and the field is omitted rather than claim a reason this record
+ * does not have. */
+static void log_dump_failed(int rc, int failure_errno, int node_count, int edge_count) {
+    char b1[CBM_SZ_16];
+    char b3[CBM_SZ_16];
+    char b4[CBM_SZ_16];
+    snprintf(b1, sizeof(b1), "%d", rc);
+    snprintf(b3, sizeof(b3), "%d", node_count);
+    snprintf(b4, sizeof(b4), "%d", edge_count);
+    if (failure_errno == 0) {
+        cbm_log_error("gbuf.dump_failed", "rc", b1, "nodes", b3, "edges", b4);
+        return;
+    }
+    char b2[CBM_SZ_16];
+    snprintf(b2, sizeof(b2), "%d", failure_errno);
+    cbm_log_error("gbuf.dump_failed", "rc", b1, "errno", b2, "nodes", b3, "edges", b4);
+}
+
 static void free_dump_resources(char **url_paths, char **local_names, int edge_count,
                                 CBMDumpEdge *dump_edges, CBMDumpNode *dump_nodes,
                                 int64_t *temp_to_final) {
     for (int i = 0; i < edge_count; i++) {
-        free(url_paths[i]);
-        free(local_names[i]);
+        cbm_free(CBM_MEM_CLASS_DUMP, url_paths[i]);
+        cbm_free(CBM_MEM_CLASS_DUMP, local_names[i]);
     }
-    free(url_paths);
-    free(local_names);
-    free(dump_edges);
-    free(dump_nodes);
-    free(temp_to_final);
+    cbm_free(CBM_MEM_CLASS_DUMP, url_paths);
+    cbm_free(CBM_MEM_CLASS_DUMP, local_names);
+    cbm_free(CBM_MEM_CLASS_DUMP, dump_edges);
+    cbm_free(CBM_MEM_CLASS_DUMP, dump_nodes);
+    cbm_free(CBM_MEM_CLASS_DUMP, temp_to_final);
 }
 
 static int count_live_nodes(cbm_gbuf_t *gb) {
@@ -1678,8 +1921,9 @@ int cbm_gbuf_dump_to_sqlite(cbm_gbuf_t *gb, const char *path) {
 
     CBM_PROF_START(t_build_nodes);
     int64_t max_temp_id = gb->next_id;
-    int64_t *temp_to_final = calloc((size_t)max_temp_id, sizeof(int64_t));
+    int64_t *temp_to_final = cbm_calloc(CBM_MEM_CLASS_DUMP, (size_t)max_temp_id * sizeof(int64_t));
     if (!temp_to_final) {
+        log_dump_failed(CBM_NOT_FOUND, errno, 0, 0);
         return CBM_NOT_FOUND;
     }
 
@@ -1710,9 +1954,10 @@ int cbm_gbuf_dump_to_sqlite(cbm_gbuf_t *gb, const char *path) {
      * uninitialized budget from ever triggering the free). */
     cbm_db_writer_t *w = cbm_writer_open(path);
     if (!w) {
-        free(src_nodes);
-        free(dump_nodes);
-        free(temp_to_final);
+        log_dump_failed(CBM_NOT_FOUND, errno, node_idx, 0);
+        cbm_free(CBM_MEM_CLASS_DUMP, src_nodes);
+        cbm_free(CBM_MEM_CLASS_DUMP, dump_nodes);
+        cbm_free(CBM_MEM_CLASS_DUMP, temp_to_final);
         return CBM_NOT_FOUND;
     }
 
@@ -1729,10 +1974,15 @@ int cbm_gbuf_dump_to_sqlite(cbm_gbuf_t *gb, const char *path) {
         if (rc != 0) {
             break;
         }
-        free_heavy = free_heavy || (cbm_mem_budget() > 0 && cbm_mem_over_budget());
+        /* cbm_mem_should_relieve, not cbm_mem_over_budget: the dump is where
+         * the run died on 2026-09-18 with our charge UNDER budget and the host
+         * out of memory, so the only signal that would have fired here is the
+         * machine's. Dropping the property strings we have already written is
+         * pure relief — the rows are in the file by now. */
+        free_heavy = free_heavy || (cbm_mem_budget() > 0 && cbm_mem_should_relieve());
         if (free_heavy && src_nodes) {
             for (int j = off; j < off + chunk; j++) {
-                free(src_nodes[j]->properties_json);
+                cbm_free(CBM_MEM_CLASS_GBUF_STRING, src_nodes[j]->properties_json);
                 src_nodes[j]->properties_json = NULL;
                 dump_nodes[j].properties = NULL;
             }
@@ -1759,14 +2009,21 @@ int cbm_gbuf_dump_to_sqlite(cbm_gbuf_t *gb, const char *path) {
     int frc = cbm_writer_finalize(w, gb->project, gb->root_path, indexed_at, dump_nodes, node_idx,
                                   dump_edges, edge_idx, gb->dump_vectors, gb->dump_vector_count,
                                   gb->dump_token_vecs, gb->dump_token_vec_count);
+    /* Read errno before anything else can touch it: the profiling macro
+     * below is already one library call away from losing the reason. */
+    int finalize_errno = errno;
     CBM_PROF_END_N("dump", "6_write_db_finalize", t_finalize, node_idx + edge_idx);
     if (rc == 0) {
         rc = frc;
     }
 
-    log_dump_summary(node_idx, edge_idx);
+    if (rc != 0) {
+        log_dump_failed(rc, finalize_errno, node_idx, edge_idx);
+    } else {
+        log_dump_summary(node_idx, edge_idx);
+    }
     free_dump_resources(url_paths, local_names, edge_idx, dump_edges, dump_nodes, temp_to_final);
-    free(src_nodes);
+    cbm_free(CBM_MEM_CLASS_DUMP, src_nodes);
     return rc;
 }
 
@@ -1791,7 +2048,7 @@ int cbm_gbuf_flush_to_store(cbm_gbuf_t *gb, cbm_store_t *store) {
      * Temp IDs start at 1 and are sequential, but can have gaps from edge inserts.
      * Use max_id as size. */
     int64_t max_temp_id = gb->next_id;
-    int64_t *temp_to_real = calloc(max_temp_id, sizeof(int64_t));
+    int64_t *temp_to_real = cbm_calloc(CBM_MEM_CLASS_DUMP, (size_t)max_temp_id * sizeof(int64_t));
 
     for (int i = 0; i < gb->nodes.count; i++) {
         cbm_gbuf_node_t *n = gb->nodes.items[i];
@@ -1840,7 +2097,7 @@ int cbm_gbuf_flush_to_store(cbm_gbuf_t *gb, cbm_store_t *store) {
     cbm_store_create_indexes(store);
     cbm_store_end_bulk(store);
 
-    free(temp_to_real);
+    cbm_free(CBM_MEM_CLASS_DUMP, temp_to_real);
     return 0;
 }
 
@@ -1854,7 +2111,7 @@ int cbm_gbuf_merge_into_store(cbm_gbuf_t *gb, cbm_store_t *store) {
 
     /* Build temp_id → real_id map */
     int64_t max_temp_id = gb->next_id;
-    int64_t *temp_to_real = calloc(max_temp_id, sizeof(int64_t));
+    int64_t *temp_to_real = cbm_calloc(CBM_MEM_CLASS_DUMP, (size_t)max_temp_id * sizeof(int64_t));
 
     for (int i = 0; i < gb->nodes.count; i++) {
         cbm_gbuf_node_t *n = gb->nodes.items[i];
@@ -1899,6 +2156,6 @@ int cbm_gbuf_merge_into_store(cbm_gbuf_t *gb, cbm_store_t *store) {
 
     cbm_store_commit(store);
 
-    free(temp_to_real);
+    cbm_free(CBM_MEM_CLASS_DUMP, temp_to_real);
     return 0;
 }
diff --git a/src/graph_buffer/graph_buffer.h b/src/graph_buffer/graph_buffer.h
index 6c8c6babe..ffbff0469 100644
--- a/src/graph_buffer/graph_buffer.h
+++ b/src/graph_buffer/graph_buffer.h
@@ -50,6 +50,12 @@ cbm_gbuf_t *cbm_gbuf_new(const char *project, const char *root_path);
  * IDs are allocated via atomic_fetch_add on *id_source.
  * Used for parallel extraction where multiple gbufs need unique IDs.
  * If id_source is NULL, behaves like cbm_gbuf_new(). */
+/* A worker buffer: shared ids, no secondary indexes (by label / name / edge
+ * type). It is filled by one worker and merged into the main buffer; the
+ * finders that need those indexes return nothing on it. */
+cbm_gbuf_t *cbm_gbuf_new_worker(const char *project, const char *root_path,
+                                _Atomic int64_t *id_source);
+
 cbm_gbuf_t *cbm_gbuf_new_shared_ids(const char *project, const char *root_path,
                                     _Atomic int64_t *id_source);
 
@@ -175,4 +181,11 @@ int cbm_gbuf_flush_to_store(cbm_gbuf_t *gb, cbm_store_t *store);
  * Returns 0 on success. */
 int cbm_gbuf_merge_into_store(cbm_gbuf_t *gb, cbm_store_t *store);
 
+/* Replace a node's properties_json with a buffer-owned copy of json (NULL
+ * maps to "{}"). The buffer allocates and frees every string it owns through
+ * the memory core; passes that rewrite properties MUST go through here rather
+ * than freeing node->properties_json themselves. Returns 0, or -1 on OOM
+ * (the old value is kept). */
+int cbm_gbuf_node_set_properties_json(cbm_gbuf_node_t *node, const char *json);
+
 #endif /* CBM_GRAPH_BUFFER_H */
diff --git a/src/main.c b/src/main.c
index 53d259b1c..65e041217 100644
--- a/src/main.c
+++ b/src/main.c
@@ -60,7 +60,15 @@ enum {
     MAIN_HOOK_NOTICE_INTERVAL_SECONDS = 900,
     MAIN_CLOSE_TIMEOUT_MS = 5000,
     MAIN_COORDINATION_CLEANUP_MS = 500,
-    PARENT_WATCHDOG_STACK_SIZE = 64 * CBM_SZ_1K, /* watchdog only polls — tiny stack suffices */
+    /* The watchdog only polls, so the STACK it needs is tiny — but on glibc the
+     * thread's static TLS block is carved out of this same allocation, and this
+     * image's TLS is ~50 KB. At the old 64 KB the request was almost entirely
+     * TLS, and when TLS grew past it the thread stopped being creatable at all:
+     * the worker then refused to index without containment and SIGKILLed its own
+     * group, reported everywhere as a bare "killed (signal 9)" (PR #2233).
+     * Sized to hold the TLS block AND a real stack; tests/
+     * test_thread_stack_tls_contract.sh keeps the two from converging again. */
+    PARENT_WATCHDOG_STACK_SIZE = 256 * CBM_SZ_1K,
 };
 #define SLEN(s) (sizeof(s) - 1)
 #include "foundation/log.h"
@@ -71,6 +79,7 @@ enum {
 #include "foundation/compat_fs.h"
 #include "foundation/compat_thread.h"
 #include "foundation/mem.h"
+#include "foundation/mem_events.h"
 #include "foundation/profile.h"
 #include "foundation/sha256.h"
 #include "foundation/secure_random.h"
@@ -451,10 +460,22 @@ static bool worker_prepare_process_group(void) {
  * identically — write() and _exit() rather than fprintf/exit, because this runs
  * after fork-sensitive setup and must not touch stdio locks or atexit handlers.
  */
-static void worker_containment_unavailable(void) {
-    static const char message[] =
-        "CBM index worker could not start: process-tree containment unavailable\n";
-    (void)write(STDERR_FILENO, message, sizeof(message) - 1);
+static void worker_containment_unavailable(const char *why) {
+    /* WHICH of the containment conditions failed, and the pids behind it. The
+     * bare sentence cost a full CI cycle and two emulated builds to attribute
+     * (PR #2233): every venue reported the same line, and the supervisor only
+     * ever sees `killed (signal 9)` because the refusal SIGKILLs its own group.
+     * snprintf into a local buffer touches no stdio lock and no atexit handler,
+     * so the fork-sensitivity contract above still holds. */
+    char message[256];
+    int n = snprintf(message, sizeof(message),
+                     "CBM index worker could not start: process-tree containment unavailable "
+                     "(%s; pid=%ld pgrp=%ld ppid=%ld)\n",
+                     why ? why : "unspecified", (long)getpid(), (long)getpgrp(), (long)getppid());
+    if (n > 0) {
+        (void)write(STDERR_FILENO, message,
+                    (size_t)n < sizeof(message) ? (size_t)n : sizeof(message) - 1);
+    }
     (void)kill(-getpid(), SIGKILL);
     _exit(EXIT_FAILURE);
 }
@@ -654,13 +675,7 @@ static bool client_start_parent_watchdog(DWORD initial_ppid) {
 
 /* ── CLI mode ───────────────────────────────────────────────────── */
 
-#define CLI_USAGE                                                                             \
-    "Usage: codebase-memory-mcp cli [--quiet] [--progress] [--verbose] [--json] <tool_name> " \
-    "[json_args]\n"                                                                           \
-    "  --quiet     Show errors only; cannot combine with --progress or outer --verbose\n"     \
-    "  --progress  Show lifecycle progress even when stderr is redirected\n"                  \
-    "  --verbose   Include informational logs (preserves CBM_LOG_LEVEL=debug)\n"              \
-    "  --json      Print the raw MCP result envelope\n"
+#define CLI_USAGE CBM_CLI_USAGE /* `cli --help`; wording lives in cli.h (#2102) */
 
 /* Extract text content from MCP tool result envelope and print it.
  * MCP results: {"content":[{"type":"text","text":"..."}],"isError":...}
@@ -789,6 +804,36 @@ static bool cli_first_nonspace_is_brace(const char *s) {
 static char *main_local_cli_daemon_execute(const char *tool_name, const char *args_json,
                                            bool quiet_requested);
 
+/* A supervised worker runs in the DAEMON's environment, not the requesting
+ * client's. The daemon admitted this request under the client's session policy
+ * and re-executed us with the canonical repo_path in the args (both daemon
+ * spawn paths rewrite it), so the request itself is the worker's workspace
+ * scope: repository == session root == allowed root. Without this, a fresh
+ * server fell back to the process-wide CBM_ALLOWED_ROOT inherited from whoever
+ * started the daemon and refused every admitted session outside it. Returns
+ * NULL once scoped, otherwise the reason to fail closed: a worker never indexes
+ * under an ambient policy.
+ *
+ * A repository that cannot be canonicalized (it does not exist) can only have
+ * been admitted by a session with no declared boundary, because containment
+ * needs a real path. The worker mirrors that with an explicit unrestricted
+ * policy - still never the environment fallback - so the pipeline reports the
+ * missing repository as the tool error it always was, instead of the
+ * supervisor misreading a refused worker as a crash. */
+static const char *main_index_worker_scope_request(cbm_mcp_server_t *srv, const char *args_json) {
+    char *repo_path = cbm_mcp_get_string_arg(args_json, "repo_path");
+    if (!repo_path || !repo_path[0]) {
+        free(repo_path);
+        return "request names no repo_path";
+    }
+    char canonical[MAIN_PATH_CAP];
+    bool exists = cbm_canonical_path(repo_path, canonical, sizeof(canonical)) != 0;
+    const char *scope = exists ? canonical : repo_path;
+    bool scoped = cbm_mcp_server_set_session_context(srv, scope, exists ? scope : NULL);
+    free(repo_path);
+    return scoped ? NULL : "session context could not be installed";
+}
+
 static int run_cli(int argc, char **argv, cbm_project_lock_manager_t *project_locks,
                    main_local_maintenance_context_t *maintenance_context) {
     cbm_cli_output_flags_t output_flags;
@@ -824,6 +869,12 @@ static int run_cli(int argc, char **argv, cbm_project_lock_manager_t *project_lo
     const char *worker_marker = cli_strip_flag_value(&argc, argv, CBM_INDEX_WORKER_MARKER_ARG);
     const char *worker_quarantine =
         cli_strip_flag_value(&argc, argv, CBM_INDEX_WORKER_QUARANTINE_ARG);
+    if (index_worker) {
+        /* The graph lives on this process's heaps: SQLite gets heaps of its
+         * own here, and only here (cbm_sqlite_dedicated_heap). */
+        cbm_sqlite_dedicated_heap(true);
+        cbm_memev_process_role("worker");
+    }
     cbm_index_set_worker_role_options(index_worker, response_out, worker_single_thread,
                                       worker_marker, worker_quarantine,
                                       cbm_index_worker_memory_budget_bytes());
@@ -930,11 +981,15 @@ static int run_cli(int argc, char **argv, cbm_project_lock_manager_t *project_lo
     };
     bool maintenance_binding_failed = false;
     bool maintenance_cancelled = false;
+    const char *worker_scope_refused = NULL;
     if (!index_worker) {
         result = main_local_cli_daemon_execute(tool_name, args_json, output_flags.quiet_requested);
     } else {
         srv = cbm_mcp_server_new(NULL);
         if (srv) {
+            worker_scope_refused = main_index_worker_scope_request(srv, args_json);
+        }
+        if (srv && !worker_scope_refused) {
             /* The in-process worker is a standalone instance: it may not
              * launch MCP-session background tasks. It receives project_locks
              * from its own process-level coordination setup and therefore
@@ -947,8 +1002,8 @@ static int run_cli(int argc, char **argv, cbm_project_lock_manager_t *project_lo
                                                               main_local_cli_mutation_try_begin);
             }
         }
-        maintenance_binding_failed = srv && !maintenance_context;
-        if (srv && maintenance_context) {
+        maintenance_binding_failed = srv && !worker_scope_refused && !maintenance_context;
+        if (srv && !worker_scope_refused && maintenance_context) {
             main_local_maintenance_server_bind(maintenance_context, srv);
             result = cbm_mcp_handle_tool(srv, tool_name, args_json);
             /* Unbind under the same mutex used by cancellation before any
@@ -960,7 +1015,10 @@ static int run_cli(int argc, char **argv, cbm_project_lock_manager_t *project_lo
         }
     }
     if (!result) {
-        if (maintenance_binding_failed) {
+        if (worker_scope_refused) {
+            (void)fprintf(stderr, "error: request workspace scope invalid: %s\n",
+                          worker_scope_refused);
+        } else if (maintenance_binding_failed) {
             (void)fprintf(stderr,
                           "error: local %s maintenance cancellation could not bind safely\n",
                           index_worker ? "worker" : "CLI");
@@ -982,6 +1040,12 @@ static int run_cli(int argc, char **argv, cbm_project_lock_manager_t *project_lo
         /* Supervised worker: hand the full result string to the parent via the
          * response file before printing (parent reads it back on a clean exit). */
         const char *ro = cbm_index_worker_response_out();
+        if (cbm_index_worker_active()) {
+            /* Waste dump + execution counts BEFORE the response: the parent may
+             * end the worker as soon as the response file is complete, and the
+             * fast exit below skips every at-exit writer anyway. */
+            cbm_memev_process_exit();
+        }
         bool worker_response_written = false;
         if (ro) {
             FILE *rf = cbm_fopen(ro, "wb");
@@ -3031,17 +3095,22 @@ int main(int argc, char **argv) {
          * unconditional in the source, so with the seam compiled out cppcheck
          * correctly reported `!probe()` as always false. Guarding the STEP, not
          * stubbing the function, means release builds simply do not have it. */
-        if (!worker_prepare_process_group() || process_initial_ppid <= 1 ||
-            getppid() != process_initial_ppid) {
-            worker_containment_unavailable();
+        if (!worker_prepare_process_group()) {
+            worker_containment_unavailable("own process group not established");
+        }
+        if (process_initial_ppid <= 1) {
+            worker_containment_unavailable("no supervising parent at startup");
+        }
+        if (getppid() != process_initial_ppid) {
+            worker_containment_unavailable("parent changed since startup");
         }
 #ifdef CBM_ENABLE_TEST_SEAMS
         if (!worker_start_watchdog_test_descendant()) {
-            worker_containment_unavailable();
+            worker_containment_unavailable("watchdog test descendant refused");
         }
 #endif
         if (!worker_start_parent_watchdog(process_initial_ppid)) {
-            worker_containment_unavailable();
+            worker_containment_unavailable("parent-death watchdog would not start");
         }
 #endif
         cbm_index_supervisor_mark_host();
diff --git a/src/mcp/index_supervisor.c b/src/mcp/index_supervisor.c
index f565a8bea..4cd69f642 100644
--- a/src/mcp/index_supervisor.c
+++ b/src/mcp/index_supervisor.c
@@ -149,6 +149,16 @@ const char *cbm_index_supervisor_build_fingerprint(void) {
     return g_build_fingerprint[0] ? g_build_fingerprint : NULL;
 }
 
+#if defined(CBM_CLI_ENABLE_TEST_API)
+void cbm_index_supervisor_set_build_fingerprint_for_test(const char *fingerprint) {
+    if (!fingerprint || !worker_fingerprint_valid(fingerprint)) {
+        return;
+    }
+    g_build_fingerprint_capture_attempted = true;
+    (void)snprintf(g_build_fingerprint, sizeof(g_build_fingerprint), "%s", fingerprint);
+}
+#endif
+
 static bool worker_fingerprint_valid(const char *fingerprint) {
     if (!fingerprint || strlen(fingerprint) != CBM_INDEX_WORKER_BUILD_FINGERPRINT_LENGTH) {
         return false;
@@ -599,6 +609,21 @@ static void worker_terminal_log(cbm_index_worker_handle_t *handle) {
     (void)snprintf(exit_text, sizeof(exit_text), "%d", handle->result.exit_code);
     cbm_log_info("index.supervisor.reap", "outcome", cbm_proc_outcome_str(handle->result.outcome),
                  "exit_code", exit_text, "signal", signal_text);
+    if (!worker_result_succeeded(&handle->result) &&
+        handle->process_result.job_memory_limit_bytes > 0) {
+        char limit_text[CBM_SZ_32];
+        char peak_text[CBM_SZ_32];
+        (void)snprintf(limit_text, sizeof(limit_text), "%zu",
+                       handle->process_result.job_memory_limit_bytes);
+        (void)snprintf(peak_text, sizeof(peak_text), "%zu",
+                       handle->process_result.peak_job_memory_bytes);
+        /* Peak accounting may include a denied allocation and exceed the cap,
+         * or remain below it. Report evidence, not an inferred OOM classification
+         * or a file to quarantine. */
+        cbm_log_warn("index.supervisor.worker_memory", "job_limit_bytes", limit_text,
+                     "peak_job_memory_bytes",
+                     handle->process_result.job_memory_available ? peak_text : "unavailable");
+    }
     if (handle->result.response_rejected) {
         cbm_log_error("index.supervisor.response_rejected", "reason", "payload_too_large", "log",
                       handle->log_path);
@@ -619,6 +644,26 @@ static void worker_terminal_log(cbm_index_worker_handle_t *handle) {
     }
 }
 
+size_t cbm_index_worker_job_memory_limit(size_t memory_budget_bytes) {
+    /* Tiny token budgets must still reach main (image/CRT/stack startup already
+     * needs memory). Keep their argv value but leave the OS cap disabled below
+     * 512 MiB. KILL_ON_JOB_CLOSE remains in force regardless of the cap.
+     *
+     * Windows charges job-wide COMMIT, not RSS. This 1.5x limit leaves room
+     * for the
+     * cooperative budget's recovery/abort gate, but an allocation can
+     * still be denied before
+     * the next cooperative check. It is a backstop for
+     * descendants too, not exact
+     * enforcement of the accounting budget. */
+    const size_t minimum_budget = (size_t)512U * 1024U * 1024U;
+    if (memory_budget_bytes < minimum_budget) {
+        return 0;
+    }
+    size_t headroom = memory_budget_bytes / 2;
+    return memory_budget_bytes > SIZE_MAX - headroom ? SIZE_MAX : memory_budget_bytes + headroom;
+}
+
 int cbm_index_worker_start_with_log(const char *args_json, size_t memory_budget_bytes,
                                     bool single_thread, const char *marker_file,
                                     const char *quarantine_file, cbm_proc_log_cb log_callback,
@@ -706,6 +751,7 @@ int cbm_index_worker_start_with_log(const char *args_json, size_t memory_budget_
     options.on_log_line = NULL;
     options.log_ud = NULL;
     options.quiet_timeout_ms = worker_quiet_timeout_ms();
+    options.memory_limit_bytes = cbm_index_worker_job_memory_limit(memory_budget_bytes);
     options.delete_log_on_exit = false;
     if (cbm_subprocess_spawn(&options, &handle->process) != 0) {
         (void)cbm_unlink(handle->response_path);
diff --git a/src/mcp/index_supervisor.h b/src/mcp/index_supervisor.h
index 31259df90..42b6bd74a 100644
--- a/src/mcp/index_supervisor.h
+++ b/src/mcp/index_supervisor.h
@@ -76,6 +76,16 @@ void cbm_index_worker_log_begin(const char *args_json, const char *repo_path);
 bool cbm_index_supervisor_capture_build_fingerprint(void);
 const char *cbm_index_supervisor_build_fingerprint(void);
 
+#if defined(CBM_CLI_ENABLE_TEST_API)
+/* Test-only: the runner captures a synthetic stub (see the capture seam) so
+ * spawned workers start instantly, but a daemon runtime service can only carry
+ * the REAL image hash. A fixture that runs a real daemon and drives the
+ * production activation guard against it aligns the captured value with that
+ * hash for its duration and restores the previous value afterwards. Invalid
+ * input is ignored. Never compiled into production. */
+void cbm_index_supervisor_set_build_fingerprint_for_test(const char *fingerprint);
+#endif
+
 typedef struct {
     const char *expected_build_fingerprint;
     const char *args_json;
@@ -151,6 +161,10 @@ typedef enum {
     CBM_INDEX_WORKER_POLL_TERMINAL = 1,
 } cbm_index_worker_poll_t;
 
+/* Pure Windows backstop policy, available on all platforms for regression tests.
+ * Small/zero budgets disable the OS cap, not the cooperative budget or containment. */
+size_t cbm_index_worker_job_memory_limit(size_t memory_budget_bytes);
+
 /* Start returns after process creation. All string arguments are copied by the
  * contained subprocess layer. Recovery values are encoded only as hidden argv
  * and applied after exec by cbm_index_set_worker_role_options(). */
diff --git a/src/mcp/mcp.c b/src/mcp/mcp.c
index c8978a79d..75ff8e396 100644
--- a/src/mcp/mcp.c
+++ b/src/mcp/mcp.c
@@ -63,6 +63,7 @@ enum {
 #include "cli/cli.h"
 #include "watcher/watcher.h"
 #include "foundation/mem.h"
+#include "foundation/mem_core.h"
 #include "foundation/diagnostics.h"
 #include "foundation/platform.h"
 #include "foundation/compat.h"
@@ -3762,6 +3763,8 @@ enum {
     BM25_BIND_OFFSET = 4,
     BM25_BIND_INNER = 5,
     BM25_BIND_FILE = 6,
+    BM25_BIND_LABEL = 7,
+    BM25_BIND_EXACT = 8,
     BM25_SQL_AUTO_LEN = -1,
     /* Inner FTS5 candidate cap.  SQLite can early-terminate a plain FTS5 query
      * (no JOIN/WHERE on outer table) of the form:
@@ -3878,7 +3881,7 @@ static void bm25_output_rows_free(bm25_output_row_t *rows, int count) {
         free(rows[i].label);
         free(rows[i].file_path);
     }
-    free(rows);
+    cbm_free(CBM_MEM_CLASS_OTHER, rows);
 }
 
 static void bm25_lines_str(char *out, size_t size, int start, int end) {
@@ -4019,8 +4022,8 @@ static char *bm25_render(const bm25_output_row_t *rows, int returned, int total,
  * Returns NULL if FTS5 is unavailable or the query produced no usable tokens,
  * in which case the caller falls back to the regex-based search path. */
 static char *bm25_search(cbm_store_t *store, const char *project, const char *query,
-                         const char *file_pattern, int limit, int offset, bool tree_format,
-                         size_t max_output_bytes) {
+                         const char *file_pattern, const char *label, int limit, int offset,
+                         bool tree_format, size_t max_output_bytes) {
     sqlite3 *db = cbm_store_get_db(store);
     if (!db) {
         return NULL;
@@ -4046,9 +4049,18 @@ static char *bm25_search(cbm_store_t *store, const char *project, const char *qu
      * because no outer predicate blocks it.  We fetch BM25_INNER_LIMIT top candidates
      * from the FTS5 index, then join/filter/boost only those rows.  bm25() returns a
      * NEGATIVE score (lower = more relevant). */
+    /* Exact-name tier (2026-09-16 probe): a definition whose NAME is the query
+     * outranks every partial hit. BM25 term frequency otherwise rewards a long
+     * test-method name that repeats the token — `table references table with
+     * same name` — over the `Table` class itself, and the label tiers below
+     * then push the class's own methods above it (Method 10 > Class 5). The
+     * definition the reader asked for by name comes first; case-insensitive
+     * exact spelling comes next; everything else keeps its BM25 order. */
     const char *sql =
         "SELECT n.id, n.label, n.name, n.qualified_name, n.file_path, n.start_line, n.end_line, "
         "       (fts.base_rank "
+        "        - CASE WHEN n.name = ?8 THEN 30.0 "
+        "               WHEN lower(n.name) = lower(?8) THEN 20.0 ELSE 0.0 END "
         "        - CASE WHEN n.label IN ('Function','Method') THEN 10.0 "
         "               WHEN n.label = 'Route' THEN 8.0 "
         "               WHEN n.label IN (" CBM_SQL_TYPE_LIKE_LABELS ") THEN 5.0 "
@@ -4070,6 +4082,10 @@ static char *bm25_search(cbm_store_t *store, const char *project, const char *qu
          * must be changed together or results desynchronise from counts. */
         "  AND n.label NOT IN ('File','Folder','Variable','Project') "
         "  AND (?6 IS NULL OR n.file_path LIKE ?6) "
+        /* The caller's label filter applies in query mode exactly as it does
+         * in the structural mode (2026-09-16 probe: `label=Class` was ignored
+         * here and five Methods came back). MIRRORED in the count query. */
+        "  AND (?7 IS NULL OR n.label = ?7) "
         /* rank ties are common (boosted floats) — the id tie-break makes
          * offset pages contractually stable across calls. */
         "ORDER BY rank, n.id "
@@ -4090,6 +4106,12 @@ static char *bm25_search(cbm_store_t *store, const char *project, const char *qu
     } else {
         sqlite3_bind_null(stmt, BM25_BIND_FILE);
     }
+    if (label && label[0]) {
+        sqlite3_bind_text(stmt, BM25_BIND_LABEL, label, BM25_SQL_AUTO_LEN, MCP_SQLITE_TRANSIENT);
+    } else {
+        sqlite3_bind_null(stmt, BM25_BIND_LABEL);
+    }
+    sqlite3_bind_text(stmt, BM25_BIND_EXACT, query, BM25_SQL_AUTO_LEN, MCP_SQLITE_TRANSIENT);
 
     /* Count hits within the same inner-limit window — capped at BM25_INNER_LIMIT.
      * Uses the identical subquery structure so the FTS5 early-exit applies here too. */
@@ -4107,6 +4129,7 @@ static char *bm25_search(cbm_store_t *store, const char *project, const char *qu
                                  * not describe the rows returned. */
                                 "      AND n.label NOT IN ('File','Folder','Variable','Project')"
                                 "      AND (?6 IS NULL OR n.file_path LIKE ?6)"
+                                "      AND (?7 IS NULL OR n.label = ?7)"
                                 ")";
         sqlite3_stmt *cs = NULL;
         if (sqlite3_prepare_v2(db, count_sql, BM25_SQL_AUTO_LEN, &cs, NULL) == SQLITE_OK) {
@@ -4121,6 +4144,12 @@ static char *bm25_search(cbm_store_t *store, const char *project, const char *qu
             } else {
                 sqlite3_bind_null(cs, BM25_BIND_FILE);
             }
+            if (label && label[0]) {
+                sqlite3_bind_text(cs, BM25_BIND_LABEL, label, BM25_SQL_AUTO_LEN,
+                                  MCP_SQLITE_TRANSIENT);
+            } else {
+                sqlite3_bind_null(cs, BM25_BIND_LABEL);
+            }
             if (sqlite3_step(cs) == SQLITE_ROW) {
                 total = sqlite3_column_int(cs, 0);
             }
@@ -4149,14 +4178,15 @@ static char *bm25_search(cbm_store_t *store, const char *project, const char *qu
     }
 
     int row_cap = limit > 0 ? limit : BM25_DEFAULT_LIMIT;
-    bm25_output_row_t *rows = calloc((size_t)row_cap, sizeof(*rows));
+    bm25_output_row_t *rows =
+        (bm25_output_row_t *)cbm_calloc(CBM_MEM_CLASS_OTHER, (size_t)row_cap * sizeof(*rows));
     int row_count = 0;
     while (rows && row_count < row_cap && sqlite3_step(stmt) == SQLITE_ROW) {
         const char *qn = (const char *)sqlite3_column_text(stmt, BM25_COL_QN);
-        const char *label = (const char *)sqlite3_column_text(stmt, BM25_COL_LABEL);
+        const char *row_label = (const char *)sqlite3_column_text(stmt, BM25_COL_LABEL);
         const char *file = (const char *)sqlite3_column_text(stmt, BM25_COL_FILE);
         rows[row_count].qualified_name = heap_strdup(qn ? qn : "");
-        rows[row_count].label = heap_strdup(label ? label : "");
+        rows[row_count].label = heap_strdup(row_label ? row_label : "");
         rows[row_count].file_path = heap_strdup(file ? file : "");
         rows[row_count].start_line = sqlite3_column_int(stmt, BM25_COL_START);
         rows[row_count].end_line = sqlite3_column_int(stmt, BM25_COL_END);
@@ -5089,9 +5119,11 @@ static char *handle_search_graph(cbm_mcp_server_t *srv, const char *args) {
     }
     if (query && query[0]) {
         char *q_file_pattern = cbm_mcp_get_string_arg(args, "file_pattern");
-        char *bm25_json = bm25_search(store, project, query, q_file_pattern, limit, offset,
+        char *q_label = cbm_mcp_get_string_arg(args, "label");
+        char *bm25_json = bm25_search(store, project, query, q_file_pattern, q_label, limit, offset,
                                       !json_format, max_output_bytes);
         free(q_file_pattern);
+        free(q_label);
         if (bm25_json) {
             free(query);
             free(project);
@@ -6265,17 +6297,6 @@ static coverage_path_result_t coverage_normalize_rel(const char *input, bool all
     return written > 0U || allow_root ? COVERAGE_PATH_OK : COVERAGE_PATH_INVALID;
 }
 
-static int64_t coverage_stat_mtime_ns(const struct stat *st) {
-#ifdef __APPLE__
-    return ((int64_t)st->st_mtimespec.tv_sec * (int64_t)CBM_NSEC_PER_SEC) +
-           (int64_t)st->st_mtimespec.tv_nsec;
-#elif defined(_WIN32)
-    return (int64_t)st->st_mtime * (int64_t)CBM_NSEC_PER_SEC;
-#else
-    return ((int64_t)st->st_mtim.tv_sec * (int64_t)CBM_NSEC_PER_SEC) + (int64_t)st->st_mtim.tv_nsec;
-#endif
-}
-
 static const char *coverage_path_freshness(cbm_store_t *store, const char *project,
                                            const char *root_path, const char *rel_path,
                                            bool *outside) {
@@ -6289,8 +6310,13 @@ static const char *coverage_path_freshness(cbm_store_t *store, const char *proje
     if (n < 0 || (size_t)n >= sizeof(abs_path)) {
         return "unavailable";
     }
-    struct stat st;
-    if (stat(abs_path, &st) != 0) {
+    /* #1714: mtime_ns must come from the SAME source the indexer recorded it
+     * with — cbm_path_info_utf8. Recomputing from struct stat truncates to
+     * seconds on Windows (st_mtime), while the file_hashes record carries
+     * FILETIME-resolution nanoseconds, so a byte-identical file never matched
+     * and every path was reported metadata_changed. */
+    cbm_path_info_t info;
+    if (cbm_path_info_utf8(abs_path, &info) != 0) {
         return "missing";
     }
     if (!cbm_path_within_root(root_path, abs_path)) {
@@ -6306,7 +6332,7 @@ static const char *coverage_path_freshness(cbm_store_t *store, const char *proje
     if (rc != CBM_STORE_OK) {
         return "unavailable";
     }
-    bool matches = hash.mtime_ns == coverage_stat_mtime_ns(&st) && hash.size == st.st_size;
+    bool matches = hash.mtime_ns == info.mtime_ns && hash.size == info.size;
     cbm_store_clear_file_hash(&hash);
     return matches ? "metadata_match" : "metadata_changed";
 }
@@ -10606,6 +10632,63 @@ cbm_mcp_supervised_result_disposition_t cbm_mcp_supervised_result_disposition(
     return CBM_MCP_SUPERVISED_RESULT_CONTAINED_FAILURE;
 }
 
+static bool index_policy_from_worker_args(const char *args, cbm_index_resource_policy_t *policy,
+                                          char *error, size_t error_size) {
+    yyjson_doc *doc = args ? yyjson_read(args, strlen(args), 0) : NULL;
+    yyjson_val *root = doc ? yyjson_doc_get_root(doc) : NULL;
+    yyjson_val *encoded =
+        root && yyjson_is_obj(root) ? yyjson_obj_get(root, "_cbm_index_policy") : NULL;
+    if (!encoded || !yyjson_is_obj(encoded) ||
+        yyjson_obj_size(encoded) != cbm_index_policy_key_count()) {
+        yyjson_doc_free(doc);
+        (void)snprintf(error, error_size, "missing or incomplete trusted worker policy");
+        return false;
+    }
+
+    cbm_index_policy_init(policy);
+    bool valid = true;
+    for (size_t index = 0; valid && index < cbm_index_policy_key_count(); index++) {
+        const char *key = cbm_index_policy_key_at(index);
+        yyjson_val *value = yyjson_obj_get(encoded, key);
+        valid = value && yyjson_is_str(value) &&
+                cbm_index_policy_set(policy, key, yyjson_get_str(value), error, error_size);
+    }
+    yyjson_doc_free(doc);
+    if (!valid && error && error_size > 0 && error[0] == '\0') {
+        (void)snprintf(error, error_size, "invalid trusted worker policy");
+    }
+    return valid;
+}
+
+static bool load_index_policy(cbm_mcp_server_t *srv, const char *args,
+                              cbm_index_resource_policy_t *policy, char *error, size_t error_size) {
+    if (cbm_index_worker_active()) {
+        return index_policy_from_worker_args(args, policy, error, error_size);
+    }
+    cbm_config_t *owned_config = NULL;
+    cbm_config_t *config = srv ? srv->config : NULL;
+    if (!config) {
+        owned_config = cbm_config_open(cbm_resolve_cache_dir());
+        config = owned_config;
+    }
+    bool loaded = cbm_config_load_index_policy(config, policy, error, error_size);
+    cbm_config_close(owned_config);
+    return loaded;
+}
+
+bool cbm_mcp_index_policy_add_to_args(yyjson_mut_doc *doc, yyjson_mut_val *root,
+                                      const cbm_index_resource_policy_t *policy) {
+    yyjson_mut_val *encoded = yyjson_mut_obj(doc);
+    bool valid = encoded != NULL;
+    for (size_t index = 0; valid && index < cbm_index_policy_key_count(); index++) {
+        const char *key = cbm_index_policy_key_at(index);
+        char value[CBM_SZ_64];
+        valid = cbm_index_policy_format(policy, key, value, sizeof(value)) &&
+                yyjson_mut_obj_add_strcpy(doc, encoded, key, value);
+    }
+    return valid && yyjson_mut_obj_add_val(doc, root, "_cbm_index_policy", encoded);
+}
+
 /* Run index_repository in a supervised worker subprocess with skip-and-continue
  * (Stage 3c). Returns the response string (caller frees):
  *   - the worker's own response on a clean first run (the common path);
@@ -10871,10 +10954,20 @@ static char *index_run_supervised_path(cbm_mcp_server_t *srv, const char *root_p
     if (!root_path || !root_path[0]) {
         return NULL;
     }
+    cbm_index_resource_policy_t policy;
+    char policy_error[CBM_SZ_256] = {0};
+    if (!load_index_policy(srv, NULL, &policy, policy_error, sizeof(policy_error))) {
+        cbm_log_error("index.policy", "error", policy_error);
+        return NULL;
+    }
     yyjson_mut_doc *doc = yyjson_mut_doc_new(NULL);
     yyjson_mut_val *root = yyjson_mut_obj(doc);
     yyjson_mut_doc_set_root(doc, root);
-    yyjson_mut_obj_add_strcpy(doc, root, "repo_path", root_path);
+    if (!yyjson_mut_obj_add_strcpy(doc, root, "repo_path", root_path) ||
+        !cbm_mcp_index_policy_add_to_args(doc, root, &policy)) {
+        yyjson_mut_doc_free(doc);
+        return NULL;
+    }
     char *args = yy_doc_to_str(doc);
     yyjson_mut_doc_free(doc);
     if (!args) {
@@ -10923,8 +11016,9 @@ static bool resolve_session_repo_path(cbm_mcp_server_t *srv, char **repo_path) {
 
 /* Preserve every index option while replacing all caller-supplied repo_path
  * keys with the one canonical path that was actually authorized. */
-static char *index_args_with_repo_path(const char *args, const char *canonical_repo_path) {
-    if (!args || !canonical_repo_path) {
+static char *index_args_with_repo_path(const char *args, const char *canonical_repo_path,
+                                       const cbm_index_resource_policy_t *policy) {
+    if (!args || !canonical_repo_path || !policy) {
         return NULL;
     }
     yyjson_doc *source = yyjson_read(args, strlen(args), 0);
@@ -10941,8 +11035,14 @@ static char *index_args_with_repo_path(const char *args, const char *canonical_r
         yyjson_mut_doc_free(copy);
         return NULL;
     }
-    (void)yyjson_mut_obj_remove_key(copy_root, "repo_path");
-    if (!yyjson_mut_obj_add_strcpy(copy, copy_root, "repo_path", canonical_repo_path)) {
+    while (yyjson_mut_obj_get(copy_root, "repo_path")) {
+        (void)yyjson_mut_obj_remove_key(copy_root, "repo_path");
+    }
+    while (yyjson_mut_obj_get(copy_root, "_cbm_index_policy")) {
+        (void)yyjson_mut_obj_remove_key(copy_root, "_cbm_index_policy");
+    }
+    if (!yyjson_mut_obj_add_strcpy(copy, copy_root, "repo_path", canonical_repo_path) ||
+        !cbm_mcp_index_policy_add_to_args(copy, copy_root, policy)) {
         yyjson_mut_doc_free(copy);
         return NULL;
     }
@@ -10981,6 +11081,29 @@ static char *resolved_repo_path_from_project_arg(const char *args) {
     return root_path;
 }
 
+static bool project_db_is_servable(const char *project, const char *db_path) {
+    cbm_store_t *store = db_path && db_path[0] ? cbm_store_open_path_query(db_path) : NULL;
+    if (!store) {
+        return false;
+    }
+    cbm_project_t stored_project = {0};
+    bool servable = cbm_store_get_project(store, project, &stored_project) == CBM_STORE_OK &&
+                    stored_project.root_path && stored_project.root_path[0];
+    cbm_project_free_fields(&stored_project);
+    cbm_store_close(store);
+    return servable;
+}
+
+/* The three heap strings handle_index_repository owns from
+ * cbm_mcp_get_string_arg / resolved_repo_path_from_project_arg. One release
+ * point keeps the dozen early-return paths in step; free(NULL) is a no-op, so
+ * a path may pass NULL for an argument it never obtained. */
+static void index_args_free(char *repo_path, char *mode_str, char *name_override) {
+    free(repo_path);
+    free(mode_str);
+    free(name_override);
+}
+
 static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
     char *repo_path = cbm_mcp_get_string_arg(args, "repo_path");
     char *mode_str = cbm_mcp_get_string_arg(args, "mode");
@@ -10993,15 +11116,12 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
     }
 
     if (!repo_path) {
-        free(mode_str);
-        free(name_override);
+        index_args_free(NULL, mode_str, name_override);
         return cbm_mcp_text_result("repo_path is required", true);
     }
 
     if (!resolve_session_repo_path(srv, &repo_path)) {
-        free(mode_str);
-        free(name_override);
-        free(repo_path);
+        index_args_free(repo_path, mode_str, name_override);
         return cbm_mcp_text_result("failed to resolve repo_path", true);
     }
 
@@ -11021,31 +11141,32 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
     if (repo_path && repo_path[0] &&
         !cbm_workspace_root_allowed(repo_path, cbm_workspace_home_dir(), cbm_workspace_cache_dir(),
                                     allowed_root, boundary_err, sizeof(boundary_err))) {
-        free(mode_str);
-        free(name_override);
-        free(repo_path);
+        index_args_free(repo_path, mode_str, name_override);
         return cbm_mcp_text_result(boundary_err, true);
     }
 
     if (mode_str && strcmp(mode_str, "cross-repo-intelligence") == 0) {
-        free(mode_str);
         char *result = handle_cross_repo_mode(srv, repo_path, name_override, args);
-        free(name_override);
-        free(repo_path);
+        index_args_free(repo_path, mode_str, name_override);
         return result;
     }
 
+    cbm_index_resource_policy_t resource_policy;
+    char policy_error[CBM_SZ_256] = {0};
+    if (!load_index_policy(srv, args, &resource_policy, policy_error, sizeof(policy_error))) {
+        index_args_free(repo_path, mode_str, name_override);
+        return cbm_mcp_text_result(policy_error, true);
+    }
+
     /* A daemon session delegates the one physical write to its shared job
      * registry only after path canonicalization and workspace authorization. */
     if (srv->index_executor) {
-        char *worker_args = index_args_with_repo_path(args, repo_path);
+        char *worker_args = index_args_with_repo_path(args, repo_path, &resource_policy);
         char *coordinated =
             worker_args ? srv->index_executor(srv->index_executor_context, repo_path, worker_args)
                         : NULL;
         free(worker_args);
-        free(repo_path);
-        free(mode_str);
-        free(name_override);
+        index_args_free(repo_path, mode_str, name_override);
         return coordinated ? coordinated
                            : cbm_mcp_text_result(
                                  "daemon index coordinator could not start the operation", true);
@@ -11058,9 +11179,7 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
     char *mutation_project =
         cbm_project_name_from_path(name_override && name_override[0] ? name_override : repo_path);
     if (!mutation_project) {
-        free(repo_path);
-        free(mode_str);
-        free(name_override);
+        index_args_free(repo_path, mode_str, name_override);
         return cbm_mcp_text_result("could not resolve index project name", true);
     }
 
@@ -11070,27 +11189,21 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
      * installs the same guard before running the in-process pipeline. A marked
      * host fails closed if preparation or worker startup cannot complete. */
     if (cbm_index_supervisor_should_wrap()) {
-        char *worker_args = index_args_with_repo_path(args, repo_path);
+        char *worker_args = index_args_with_repo_path(args, repo_path, &resource_policy);
         if (!worker_args) {
             free(mutation_project);
-            free(repo_path);
-            free(mode_str);
-            free(name_override);
+            index_args_free(repo_path, mode_str, name_override);
             return cbm_mcp_text_result("failed to prepare supervised index request", true);
         }
         char *supervised = index_run_supervised(srv, worker_args);
         free(worker_args);
         if (supervised) {
             free(mutation_project);
-            free(repo_path);
-            free(mode_str);
-            free(name_override);
+            index_args_free(repo_path, mode_str, name_override);
             return supervised;
         }
         free(mutation_project);
-        free(repo_path);
-        free(mode_str);
-        free(name_override);
+        index_args_free(repo_path, mode_str, name_override);
         return cbm_mcp_text_result(
             "index supervision failed before a contained worker could start; no "
             "in-process fallback was attempted",
@@ -11099,18 +11212,14 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
 
     if (!mcp_project_mutation_begin(srv, mutation_project)) {
         free(mutation_project);
-        free(repo_path);
-        free(mode_str);
-        free(name_override);
+        index_args_free(repo_path, mode_str, name_override);
         return cbm_mcp_text_result("index operation blocked by another mutation for this project",
                                    true);
     }
     if (mcp_request_cancelled(srv)) {
         mcp_project_mutation_end(srv, mutation_project);
         free(mutation_project);
-        free(repo_path);
-        free(mode_str);
-        free(name_override);
+        index_args_free(repo_path, mode_str, name_override);
         return cbm_mcp_text_result("index operation cancelled for this request", true);
     }
 
@@ -11142,11 +11251,15 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
     }
     free(name_override);
     cbm_pipeline_set_persistence(p, persistence);
+    cbm_pipeline_set_resource_policy(p, &resource_policy);
 
     char *project_name = heap_strdup(cbm_pipeline_project_name(p));
 
     /* Bootstrap from artifact if no local DB exists */
     try_artifact_bootstrap(project_name, repo_path);
+    char serving_db_path[CBM_SZ_1K];
+    project_db_path(project_name, serving_db_path, sizeof(serving_db_path));
+    bool serving_index_was_servable = project_db_is_servable(project_name, serving_db_path);
 
     /* Close cached store — pipeline will delete + recreate the .db file */
     if (srv->owns_store && srv->store) {
@@ -11178,6 +11291,8 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
     cbm_file_error_t *file_errors = NULL;
     int file_error_count = 0;
     cbm_pipeline_get_file_errors(p, &file_errors, &file_error_count);
+    cbm_index_resource_violation_t resource_violation = {0};
+    cbm_pipeline_get_resource_violation(p, &resource_violation);
 
     cbm_mem_collect(); /* return mimalloc pages to OS after large indexing */
 
@@ -11228,11 +11343,34 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
         yyjson_mut_obj_add_str(doc, root, "previous_index", "preserved");
         yyjson_mut_obj_add_int(doc, root, "budget_mb", budget_mb);
         yyjson_mut_obj_add_int(doc, root, "peak_rss_mb", peak_rss_mb);
-        yyjson_mut_obj_add_str(doc, root, "hint",
-                               "Indexing stopped: resident memory stayed above the budget after "
-                               "backpressure; no partial graph was published and the previous "
-                               "index still serves. Raise CBM_MEM_BUDGET_MB, lower CBM_WORKERS, "
-                               "or exclude large subtrees.");
+        /* A CONCRETE retry value, because "raise CBM_MEM_BUDGET_MB" alone makes
+         * the caller guess — and the obvious guess is wrong. peak_rss_mb is
+         * where the run was STOPPED (it is pinned just above the budget by
+         * construction), not what the repo needs, so retrying at peak+10% fails
+         * again. Measured 2026-09-13 on the linux kernel: aborted at 25622 MB
+         * against a 24576 MB budget, but completing it actually took 31.75 GB —
+         * 1.32x the budget, 1.24x the reported peak. Suggest 1.5x the budget so
+         * the first retry has a real chance, and say plainly that the peak is a
+         * floor rather than a requirement. */
+        /* (3*b+1)/2 rather than b + b/2: integer division makes the latter
+         * degenerate to b for b == 1, so the "suggestion" would repeat the
+         * budget that just failed. Rounding up keeps it strictly larger for
+         * every positive budget. */
+        int suggested_budget_mb = budget_mb > 0 ? (budget_mb * 3 + 1) / 2 : 0;
+        char hint_text[CBM_SZ_512];
+        (void)snprintf(hint_text, sizeof(hint_text),
+                       "Indexing stopped: resident memory stayed above the budget after "
+                       "backpressure; no partial graph was published and the previous index "
+                       "still serves. peak_rss_mb is where indexing was STOPPED, not what this "
+                       "repo needs — the real requirement is higher, so retrying just above the "
+                       "peak will fail again. Retry with CBM_MEM_BUDGET_MB=%d (1.5x the current "
+                       "budget) if the machine has the RAM, or lower CBM_WORKERS, or exclude "
+                       "large subtrees.",
+                       suggested_budget_mb);
+        if (suggested_budget_mb > 0) {
+            yyjson_mut_obj_add_int(doc, root, "suggested_budget_mb", suggested_budget_mb);
+        }
+        yyjson_mut_obj_add_strcpy(doc, root, "hint", hint_text);
     } else if (rc == CBM_PIPELINE_ABORT_PRESERVE_DB) {
         /* The truthful abort message (#2020): the old generic "check repo_path"
          * hint sent people debugging a path that was fine, when the run
@@ -11252,6 +11390,25 @@ static char *handle_index_repository(cbm_mcp_server_t *srv, const char *args) {
                                "The validated staging database could not be published. Check "
                                "free disk space and permissions on the cache directory; the "
                                "previous index may have been rolled back.");
+    } else if (rc == CBM_PIPELINE_RESOURCE_LIMIT &&
+               resource_violation.resource != CBM_INDEX_RESOURCE_NONE) {
+        const char *config_key = cbm_index_resource_config_key(resource_violation.resource);
+        char message[CBM_SZ_256];
+        (void)snprintf(message, sizeof(message), "Index discovery exceeded %s", config_key);
+        yyjson_mut_obj_add_str(doc, root, "status", "error");
+        yyjson_mut_obj_add_str(doc, root, "code", "resource_limit_exceeded");
+        yyjson_mut_obj_add_str(doc, root, "stage", "discovery");
+        yyjson_mut_obj_add_str(doc, root, "resource",
+                               cbm_index_resource_name(resource_violation.resource));
+        yyjson_mut_obj_add_uint(doc, root, "observed", resource_violation.observed);
+        yyjson_mut_obj_add_uint(doc, root, "limit", resource_violation.limit);
+        yyjson_mut_obj_add_str(doc, root, "unit",
+                               cbm_index_resource_unit(resource_violation.resource));
+        yyjson_mut_obj_add_bool(doc, root, "retryable", true);
+        yyjson_mut_obj_add_bool(doc, root, "serving_index_preserved",
+                                serving_index_was_servable &&
+                                    project_db_is_servable(project_name, serving_db_path));
+        yyjson_mut_obj_add_strcpy(doc, root, "message", message);
     } else {
         yyjson_mut_obj_add_str(doc, root, "status", "error");
         yyjson_mut_obj_add_str(doc, root, "hint",
@@ -17427,6 +17584,16 @@ static void register_watcher_if_enabled(cbm_mcp_server_t *srv) {
 }
 
 /* Background auto-index thread function */
+/* Extraction builds a THREAD-LOCAL node-type bitset cache (cbm_kind_in_set).
+ * Every worker thread that runs extraction must free that cache before it exits,
+ * or the calloc'd bitsets are orphaned when the thread's TLS is torn down and
+ * LeakSanitizer reports them at process exit. Parallel workers do this in
+ * pass_parallel.c; the in-process (sequential) auto-index runs extraction on
+ * THIS short-lived thread, so it must free its own cache too. Declared extern
+ * (not via internal/cbm/helpers.h) to avoid pulling the extraction layer's
+ * header into the MCP TU — the same pattern test_main.c uses for teardown. */
+extern void cbm_kind_in_set_free_cache(void);
+
 static void *autoindex_thread(void *arg) {
     cbm_mcp_server_t *srv = (cbm_mcp_server_t *)arg;
 
@@ -17466,7 +17633,8 @@ static void *autoindex_thread(void *arg) {
     cbm_pipeline_unlock();
 
     cbm_pipeline_free(p);
-    cbm_mem_collect(); /* return mimalloc pages to OS after indexing (in-process only) */
+    cbm_kind_in_set_free_cache(); /* free THIS thread's extraction bitset cache (see above) */
+    cbm_mem_collect();            /* return mimalloc pages to OS after indexing (in-process only) */
 
     if (rc == 0) {
         cbm_log_info("autoindex.done", "project", srv->session_project);
@@ -17565,9 +17733,13 @@ static void maybe_auto_index(cbm_mcp_server_t *srv) {
         char limit[32];
         (void)snprintf(files, sizeof(files), "%d", file_count);
         (void)snprintf(limit, sizeof(limit), "%d", file_limit);
+        char root_disp[CBM_SZ_1K];
+        (void)snprintf(root_disp, sizeof(root_disp), "%s", srv->session_root);
+        cbm_normalize_path_sep(
+            root_disp); /* forward-slash paths in diagnostics (Windows \\ -> /) */
         cbm_log_warn("autoindex.skip", "reason",
                      file_count >= 0 ? "too_many_files" : "unsafe_or_unavailable_path", "files",
-                     files, "limit", limit);
+                     files, "limit", limit, "root", root_disp);
         return;
     }
 
diff --git a/src/mcp/mcp_internal.h b/src/mcp/mcp_internal.h
index 5e5c771a3..de170067a 100644
--- a/src/mcp/mcp_internal.h
+++ b/src/mcp/mcp_internal.h
@@ -1,10 +1,13 @@
 #ifndef CBM_MCP_INTERNAL_H
 #define CBM_MCP_INTERNAL_H
 
+#include "foundation/index_policy.h"
 #include "mcp/mcp.h"
 #include "pipeline/pipeline.h" /* cbm_changed_hunk_t */
 #include "store/store.h"       /* cbm_node_t */
 
+#include <yyjson/yyjson.h>
+
 /* White-box fault injection for deterministic cross-platform quarantine
  * safety tests. This header is internal and is not part of the MCP API. */
 typedef bool (*cbm_mcp_quarantine_test_hook_fn)(void *context, const char *step);
@@ -36,6 +39,11 @@ bool cbm_mcp_server_release_pristine_memory_store(cbm_mcp_server_t *srv);
  * On success replaces and frees *response_io; on failure it is unchanged. */
 bool cbm_mcp_jsonrpc_response_prepend_notice(char **response_io, const char *notice);
 
+/* Encode the complete trusted policy on an internal worker request. Callers
+ * must remove any untrusted field with the same name before invoking this. */
+bool cbm_mcp_index_policy_add_to_args(yyjson_mut_doc *doc, yyjson_mut_val *root,
+                                      const cbm_index_resource_policy_t *policy);
+
 enum { CBM_MCP_DEFAULT_AUTO_INDEX_LIMIT = 50000 };
 
 /* Count indexable files with the pipeline's native full-mode discovery policy,
diff --git a/src/pipeline/lsp_surface.c b/src/pipeline/lsp_surface.c
index 369f7f7e5..5a8c89f97 100644
--- a/src/pipeline/lsp_surface.c
+++ b/src/pipeline/lsp_surface.c
@@ -17,13 +17,16 @@
  *     bytes is the early-cutoff key: a body edit reserializes identically.
  */
 #include "pipeline/lsp_surface.h"
+#include "pipeline/pipeline_internal.h"
 
+#include <stdatomic.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include "cbm.h" /* cbm_label_is_relation — reg-only surface membership */
 #include "foundation/log.h"
 #include "foundation/sha256.h"
+#include "pipeline/worker_pool.h"
 #include "yyjson/yyjson.h"
 
 enum { SURFACE_CODEC_VERSION = 1 };
@@ -69,9 +72,10 @@ static void add_str_array_or_null(yyjson_mut_doc *doc, yyjson_mut_val *obj, cons
 }
 
 /* Serialize one file's surface: its slice of all_defs plus the registry-only
- * symbols from its raw extraction defs. Returns a malloc'd JSON string. */
-static char *surface_file_to_json(const CBMFileResult *result, const CBMLSPDef *defs,
-                                  int def_count) {
+ * symbols from its raw extraction defs. Returns a malloc'd JSON string and its
+ * length. */
+static char *surface_file_to_json(const CBMFileResult *result, const CBMLSPDef *defs, int def_count,
+                                  size_t *out_len) {
     yyjson_mut_doc *doc = yyjson_mut_doc_new(NULL);
     if (!doc) {
         return NULL;
@@ -121,13 +125,66 @@ static char *surface_file_to_json(const CBMFileResult *result, const CBMLSPDef *
     }
     yyjson_mut_obj_add_val(doc, root, "reg", reg);
 
-    char *json = yyjson_mut_write(doc, 0, NULL);
+    char *json = yyjson_mut_write(doc, 0, out_len);
     yyjson_mut_doc_free(doc);
     return json;
 }
 
-int cbm_lsp_surface_build_rows(const char *project, CBMFileResult **cache,
-                               const cbm_file_info_t *files, int file_count,
+/* One file's row, written in place: files are independent (their own result,
+ * their own def slice), so the pass runs them in parallel. Sequentially it was
+ * 1.15 s of the Go corpus's cross-LSP prepare (profile, 2026-09-17). */
+typedef struct {
+    const cbm_pipeline_ctx_t *ctx;
+    const char *project;
+    CBMFileResult **cache;
+    const cbm_file_info_t *files;
+    const CBMLSPDef *all_defs;
+    const int *def_starts;
+    cbm_lsp_surface_row_t *rows;
+    _Atomic bool failed;
+} surface_job_t;
+
+static void surface_row_one(int i, void *arg) {
+    surface_job_t *job = (surface_job_t *)arg;
+    if (atomic_load_explicit(&job->failed, memory_order_relaxed)) {
+        return;
+    }
+    bool loaded = false;
+    CBMFileResult *fr = cbm_pipeline_result_acquire(job->ctx, job->cache, i, NULL, &loaded);
+    if (!fr) {
+        /* Never parsed this run (read/extract skip): no surface claim.
+         * The routing layer treats a missing row as "must full-rebuild
+         * before this file can be reasoned about", which is the correct
+         * fail-closed default for an unreadable file. */
+        return;
+    }
+    int start = job->def_starts ? job->def_starts[i] : 0;
+    int end = job->def_starts ? job->def_starts[i + 1] : 0;
+    size_t json_len = 0;
+    char *json = surface_file_to_json(fr, job->all_defs ? job->all_defs + start : NULL, end - start,
+                                      &json_len);
+    cbm_pipeline_result_release(fr, loaded);
+    if (!json) {
+        atomic_store_explicit(&job->failed, true, memory_order_relaxed);
+        return;
+    }
+    char sha[CBM_SHA256_HEX_LEN + 1];
+    cbm_sha256_hex(json, json_len, sha);
+    cbm_lsp_surface_row_t *r = &job->rows[i];
+    r->defs_json = json; /* set first: it marks the row present for the compaction */
+    r->project = strdup(job->project);
+    r->rel_path = strdup(job->files[i].rel_path);
+    r->surface_sha = strdup(sha);
+    r->ref_bloom = NULL;
+    r->ref_bloom_len = 0;
+    r->config_ctx = strdup("");
+    if (!r->project || !r->rel_path || !r->surface_sha || !r->config_ctx) {
+        atomic_store_explicit(&job->failed, true, memory_order_relaxed);
+    }
+}
+
+int cbm_lsp_surface_build_rows(const cbm_pipeline_ctx_t *ctx, const char *project,
+                               CBMFileResult **cache, const cbm_file_info_t *files, int file_count,
                                const CBMLSPDef *all_defs, const int *def_starts,
                                cbm_lsp_surface_row_t **out_rows, int *out_count) {
     *out_rows = NULL;
@@ -139,37 +196,32 @@ int cbm_lsp_surface_build_rows(const char *project, CBMFileResult **cache,
     if (!rows) {
         return -1;
     }
+    surface_job_t job = {
+        .ctx = ctx,
+        .project = project,
+        .cache = cache,
+        .files = files,
+        .all_defs = all_defs,
+        .def_starts = def_starts,
+        .rows = rows,
+    };
+    atomic_init(&job.failed, false);
+    cbm_parallel_for(file_count, surface_row_one, &job,
+                     (cbm_parallel_for_opts_t){.max_workers = 0, .force_pthreads = false});
+    if (atomic_load_explicit(&job.failed, memory_order_relaxed)) {
+        cbm_store_free_lsp_surfaces(rows, file_count); /* untouched rows are all NULL */
+        return -1;
+    }
+    /* Present rows to the front, in file order: the same rows, in the same
+     * order, as the sequential loop produced. */
     int n = 0;
     for (int i = 0; i < file_count; i++) {
-        if (!cache[i]) {
-            /* Never parsed this run (read/extract skip): no surface claim.
-             * The routing layer treats a missing row as "must full-rebuild
-             * before this file can be reasoned about", which is the correct
-             * fail-closed default for an unreadable file. */
+        if (!rows[i].defs_json) {
             continue;
         }
-        int start = def_starts ? def_starts[i] : 0;
-        int end = def_starts ? def_starts[i + 1] : 0;
-        char *json =
-            surface_file_to_json(cache[i], all_defs ? all_defs + start : NULL, end - start);
-        if (!json) {
-            cbm_store_free_lsp_surfaces(rows, n);
-            return -1;
-        }
-        char sha[CBM_SHA256_HEX_LEN + 1];
-        cbm_sha256_hex(json, strlen(json), sha);
-        cbm_lsp_surface_row_t *r = &rows[n];
-        r->project = strdup(project);
-        r->rel_path = strdup(files[i].rel_path);
-        r->surface_sha = strdup(sha);
-        r->defs_json = json;
-        r->ref_bloom = NULL;
-        r->ref_bloom_len = 0;
-        r->config_ctx = strdup("");
-        if (!r->project || !r->rel_path || !r->surface_sha || !r->config_ctx) {
-            n++;
-            cbm_store_free_lsp_surfaces(rows, n);
-            return -1;
+        if (n != i) {
+            rows[n] = rows[i];
+            memset(&rows[i], 0, sizeof(rows[i]));
         }
         n++;
     }
diff --git a/src/pipeline/lsp_surface.h b/src/pipeline/lsp_surface.h
index a1d826158..de3390d85 100644
--- a/src/pipeline/lsp_surface.h
+++ b/src/pipeline/lsp_surface.h
@@ -29,8 +29,8 @@
  * heap strings; release with cbm_store_free_lsp_surfaces. Files with an
  * empty surface still get a row (empty arrays hash too — "no defs" must be
  * distinguishable from "no data"). Returns 0, or -1 on allocation failure. */
-int cbm_lsp_surface_build_rows(const char *project, CBMFileResult **cache,
-                               const cbm_file_info_t *files, int file_count,
+int cbm_lsp_surface_build_rows(const cbm_pipeline_ctx_t *ctx, const char *project,
+                               CBMFileResult **cache, const cbm_file_info_t *files, int file_count,
                                const CBMLSPDef *all_defs, const int *def_starts,
                                cbm_lsp_surface_row_t **out_rows, int *out_count);
 
diff --git a/src/pipeline/pass_calls.c b/src/pipeline/pass_calls.c
index c9744dda2..84958954c 100644
--- a/src/pipeline/pass_calls.c
+++ b/src/pipeline/pass_calls.c
@@ -626,15 +626,29 @@ static int resolve_single_call(cbm_pipeline_ctx_t *ctx, CBMCall *call,
      * reintroduce the #592/#606 false-edge class for .ets files. */
     bool suppress_weak_member = lang == CBM_LANG_PYTHON || lang == CBM_LANG_JAVASCRIPT ||
                                 lang == CBM_LANG_TYPESCRIPT || lang == CBM_LANG_TSX ||
-                                lang == CBM_LANG_ARKTS;
+                                lang == CBM_LANG_ARKTS ||
+                                /* Files whose calls are embedded JS/TS (<script>
+                                 * bodies): the calls carry the JS receiver flag
+                                 * but the FILE language gated them out, so
+                                 * generated Dokka pages bound localStorage.getItem
+                                 * to a docs bundle (2026-09-16 probe: 4,207 junk
+                                 * edges on JetBrains/Exposed). */
+                                lang == CBM_LANG_HTML || lang == CBM_LANG_VUE ||
+                                lang == CBM_LANG_SVELTE || lang == CBM_LANG_ASTRO;
     /* Bare-call local-binding suppression. A member call has a receiver the
      * guard above can reason about; a bare `run()` has none, so that guard
      * cannot see this class at all. Python-only today because the extraction
      * flag is set only for Python — this gate MUST match pass_parallel.c's
      * exactly, for the same divergence reason noted above. */
     bool suppress_weak_local_binding = lang == CBM_LANG_PYTHON;
+    /* The member guard's one exemption (Python, self/cls-rooted receiver,
+     * unique_name, not a builtin type's method) — see
+     * cbm_weak_member_unique_name_exempt. MUST match pass_parallel.c exactly. */
     bool drop_plain_call =
-        cbm_suppress_weak_member_match(suppress_weak_member, call->is_method, res.strategy) ||
+        (cbm_suppress_weak_member_match(suppress_weak_member, call->is_method, res.strategy) &&
+         !cbm_weak_member_unique_name_exempt(lang == CBM_LANG_PYTHON,
+                                             call->receiver_is_self_attribute, call->callee_name,
+                                             res.strategy)) ||
         cbm_suppress_weak_local_binding_call(suppress_weak_local_binding,
                                              call->callee_is_locally_bound, res.strategy);
 
diff --git a/src/pipeline/pass_complexity.c b/src/pipeline/pass_complexity.c
index 420237b81..ab1574566 100644
--- a/src/pipeline/pass_complexity.c
+++ b/src/pipeline/pass_complexity.c
@@ -95,8 +95,8 @@ static void append_complexity_props(cbm_gbuf_node_t *node, int tld, bool recursi
         free(neu);
         return;
     }
-    free(node->properties_json);
-    node->properties_json = neu;
+    (void)cbm_gbuf_node_set_properties_json(node, neu);
+    free(neu);
 }
 
 /* Content-only node order: qualified_name, then file path and start line.
diff --git a/src/pipeline/pass_configlink.c b/src/pipeline/pass_configlink.c
index 34c90bdf3..1ee3ecf4b 100644
--- a/src/pipeline/pass_configlink.c
+++ b/src/pipeline/pass_configlink.c
@@ -17,9 +17,12 @@
 
 #include <stdint.h>
 #include <stdio.h>
+#include <stdatomic.h>
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
+#include "foundation/platform.h" /* cbm_default_worker_count */
+#include "pipeline/worker_pool.h"
 #include "foundation/compat_regex.h"
 
 /* ── Config link confidence scores ───────────────────────────────── */
@@ -223,6 +226,83 @@ static int collect_code_entries(cbm_gbuf_t *gb, code_entry_t *out, int max_out)
     return n;
 }
 
+/* The key x symbol comparison of strategy 1, per config key: every pair's
+ * verdict depends only on its two strings, so rows run in parallel and the
+ * edges are inserted afterwards in the original (config, code) order. One
+ * thread compared up to 4,096 x 8,192 pairs -- configlink's 0.93 s on the Go
+ * corpus (profile, 2026-09-17). A pair whose lengths rule both verdicts out
+ * skips the string calls: an exact match needs equal lengths, a substring one
+ * no longer than the code key. */
+typedef struct {
+    int co;
+    double confidence;
+} key_match_t;
+
+typedef struct {
+    key_match_t *items;
+    int count;
+    int cap;
+} key_match_list_t;
+
+typedef struct {
+    const config_entry_t *config;
+    const size_t *config_len;
+    int config_count;
+    const code_entry_t *code;
+    const size_t *code_len;
+    int code_count;
+    key_match_list_t *lists;
+    _Atomic int next;
+    _Atomic bool failed;
+} key_match_job_t;
+
+static double key_pair_confidence(const char *config_norm, size_t config_len, const char *code_norm,
+                                  size_t code_len) {
+    if (config_len > code_len) {
+        return 0.0;
+    }
+    if (config_len == code_len && memcmp(config_norm, code_norm, code_len) == 0) {
+        return CONF_KEY_EXACT; /* Exact match */
+    }
+    if (strstr(code_norm, config_norm) != NULL) {
+        return CONF_KEY_SUBSTRING; /* Substring match */
+    }
+    return 0.0;
+}
+
+static void key_match_worker(int worker_id, void *arg) {
+    (void)worker_id;
+    key_match_job_t *job = (key_match_job_t *)arg;
+    while (!atomic_load_explicit(&job->failed, memory_order_relaxed)) {
+        int ci = atomic_fetch_add_explicit(&job->next, SKIP_ONE, memory_order_relaxed);
+        if (ci >= job->config_count) {
+            break;
+        }
+        key_match_list_t *list = &job->lists[ci];
+        for (int co = 0; co < job->code_count; co++) {
+            double confidence = key_pair_confidence(job->config[ci].normalized, job->config_len[ci],
+                                                    job->code[co].normalized, job->code_len[co]);
+            if (confidence <= 0.0) {
+                continue;
+            }
+            if (list->count == list->cap) {
+                int cap = list->cap ? list->cap * PAIR_LEN : CBM_SZ_16;
+                key_match_t *grown =
+                    cbm_realloc(CBM_MEM_CLASS_OTHER, list->items, (size_t)cap * sizeof(*grown));
+                if (!grown) {
+                    atomic_store_explicit(&job->failed, true, memory_order_relaxed);
+                    return;
+                }
+                list->items = grown;
+                list->cap = cap;
+            }
+            list->items[list->count].co = co;
+            list->items[list->count].confidence = confidence;
+            list->count++;
+        }
+    }
+}
+
 static int strategy_key_symbols(cbm_gbuf_t *gb) {
     /* Get all Variable nodes */
     const cbm_gbuf_node_t **vars = NULL;
@@ -243,6 +323,62 @@ static int strategy_key_symbols(cbm_gbuf_t *gb) {
 
     int edge_count = 0;
 
+    size_t *config_len = cbm_alloc(CBM_MEM_CLASS_OTHER, (size_t)config_count * sizeof(size_t));
+    size_t *code_len =
+        cbm_alloc(CBM_MEM_CLASS_OTHER, (size_t)(code_count > 0 ? code_count : 1) * sizeof(size_t));
+    key_match_list_t *lists =
+        cbm_calloc(CBM_MEM_CLASS_OTHER, (size_t)config_count * sizeof(key_match_list_t));
+    bool parallel_ok = config_len && code_len && lists;
+    if (parallel_ok) {
+        for (int ci = 0; ci < config_count; ci++) {
+            config_len[ci] = strlen(config_entries[ci].normalized);
+        }
+        for (int co = 0; co < code_count; co++) {
+            code_len[co] = strlen(code_entries[co].normalized);
+        }
+        key_match_job_t job = {
+            .config = config_entries,
+            .config_len = config_len,
+            .config_count = config_count,
+            .code = code_entries,
+            .code_len = code_len,
+            .code_count = code_count,
+            .lists = lists,
+        };
+        atomic_init(&job.next, 0);
+        atomic_init(&job.failed, false);
+        int workers = cbm_default_worker_count(false);
+        cbm_parallel_for(
+            workers, key_match_worker, &job,
+            (cbm_parallel_for_opts_t){.max_workers = workers, .force_pthreads = false});
+        parallel_ok = !atomic_load_explicit(&job.failed, memory_order_relaxed);
+    }
+    if (parallel_ok) {
+        for (int ci = 0; ci < config_count; ci++) {
+            for (int m = 0; m < lists[ci].count; m++) {
+                const key_match_t *km = &lists[ci].items[m];
+                char props[CBM_SZ_512];
+                snprintf(props, sizeof(props),
+                         "{\"strategy\":\"key_symbol\",\"confidence\":%.2f,\"config_key\":\"%s\"}",
+                         km->confidence, config_entries[ci].name);
+
+                cbm_gbuf_insert_edge(gb, code_entries[km->co].node_id, config_entries[ci].node_id,
+                                     "CONFIGURES", props);
+                edge_count++;
+            }
+        }
+    }
+    for (int ci = 0; lists && ci < config_count; ci++) {
+        cbm_free(CBM_MEM_CLASS_OTHER, lists[ci].items);
+    }
+    cbm_free(CBM_MEM_CLASS_OTHER, lists);
+    cbm_free(CBM_MEM_CLASS_OTHER, config_len);
+    cbm_free(CBM_MEM_CLASS_OTHER, code_len);
+    if (parallel_ok) {
+        return edge_count;
+    }
+
+    /* Allocation failed: the one-thread comparison, as before. */
     for (int ci = 0; ci < config_count; ci++) {
         for (int co = 0; co < code_count; co++) {
             double confidence = 0.0;
@@ -350,25 +486,90 @@ static void lowercase_into(char *buf, size_t bufsize, const char *src) {
     buf[len < bufsize ? len : bufsize - SKIP_ONE] = '\0';
 }
 
-/* Match a dep name (lowercased) against an import target node.
- * Returns confidence > 0 on match, 0 on no match. */
-static double match_dep_to_import(const cbm_gbuf_node_t *target, const char *dep_lower) {
-    char target_lower[CBM_SZ_256];
-    lowercase_into(target_lower, sizeof(target_lower), target->name);
+/* One IMPORTS edge prepared for matching: its endpoints resolved and its
+ * target's name and qualified name lowercased ONCE (same truncation as before:
+ * 255 and 511 bytes). Resolving both nodes and lowercasing both strings inside
+ * the dep x import loop was the whole cost of configlink -- 0.9 s on the Go
+ * corpus, and cbm_gbuf_find_by_id's x3.1 super-linear scaling (waste
+ * sanitizer, 2026-09-17). */
+typedef struct {
+    int64_t source_id;
+    const char *target_lower; /* into one shared block */
+    const char *qn_lower;     /* NULL when the target has no qualified name */
+} dep_import_t;
 
-    if (strcmp(target_lower, dep_lower) == 0) {
+/* Match a dep name (lowercased) against a prepared import target.
+ * Returns confidence > 0 on match, 0 on no match. */
+static double match_dep_to_import(const dep_import_t *imp, const char *dep_lower) {
+    if (strcmp(imp->target_lower, dep_lower) == 0) {
         return CONF_DEP_EXACT;
     }
-    if (target->qualified_name) {
-        char qn_lower[CBM_SZ_512];
-        lowercase_into(qn_lower, sizeof(qn_lower), target->qualified_name);
-        if (strstr(qn_lower, dep_lower) != NULL) {
-            return CONF_DEP_QN_SUBSTR;
-        }
+    if (imp->qn_lower && strstr(imp->qn_lower, dep_lower) != NULL) {
+        return CONF_DEP_QN_SUBSTR;
     }
     return 0.0;
 }
 
+/* Resolve and lowercase every IMPORTS edge whose endpoints both exist, in edge
+ * order. Returns the count (0 with *out NULL on allocation failure). */
+static int prepare_dep_imports(cbm_gbuf_t *gb, const cbm_gbuf_edge_t *const *imports,
+                               int import_count, dep_import_t **out, char **block_out) {
+    *out = NULL;
+    *block_out = NULL;
+    enum { NAME_CAP = CBM_SZ_256, QN_CAP = CBM_SZ_512 };
+    size_t bytes = 0;
+    for (int ii = 0; ii < import_count; ii++) {
+        const cbm_gbuf_node_t *target = cbm_gbuf_find_by_id(gb, imports[ii]->target_id);
+        const cbm_gbuf_node_t *source =
+            target ? cbm_gbuf_find_by_id(gb, imports[ii]->source_id) : NULL;
+        if (!target || !source) {
+            continue;
+        }
+        size_t nlen = target->name ? strlen(target->name) : 0;
+        bytes += (nlen < NAME_CAP ? nlen : NAME_CAP - SKIP_ONE) + SKIP_ONE;
+        if (target->qualified_name) {
+            size_t qlen = strlen(target->qualified_name);
+            bytes += (qlen < QN_CAP ? qlen : QN_CAP - SKIP_ONE) + SKIP_ONE;
+        }
+    }
+    dep_import_t *items = cbm_alloc(
+        CBM_MEM_CLASS_OTHER, (size_t)(import_count > 0 ? import_count : 1) * sizeof(dep_import_t));
+    char *block = cbm_alloc(CBM_MEM_CLASS_OTHER, bytes > 0 ? bytes : 1);
+    if (!items || !block) {
+        cbm_free(CBM_MEM_CLASS_OTHER, items);
+        cbm_free(CBM_MEM_CLASS_OTHER, block);
+        return 0;
+    }
+    int n = 0;
+    char *w = block;
+    for (int ii = 0; ii < import_count; ii++) {
+        const cbm_gbuf_node_t *target = cbm_gbuf_find_by_id(gb, imports[ii]->target_id);
+        const cbm_gbuf_node_t *source =
+            target ? cbm_gbuf_find_by_id(gb, imports[ii]->source_id) : NULL;
+        if (!target || !source) {
+            continue;
+        }
+        size_t nlen = target->name ? strlen(target->name) : 0;
+        size_t ncap = (nlen < NAME_CAP ? nlen : NAME_CAP - SKIP_ONE) + SKIP_ONE;
+        lowercase_into(w, ncap, target->name);
+        items[n].target_lower = w;
+        w += ncap;
+        items[n].qn_lower = NULL;
+        if (target->qualified_name) {
+            size_t qlen = strlen(target->qualified_name);
+            size_t qcap = (qlen < QN_CAP ? qlen : QN_CAP - SKIP_ONE) + SKIP_ONE;
+            lowercase_into(w, qcap, target->qualified_name);
+            items[n].qn_lower = w;
+            w += qcap;
+        }
+        items[n].source_id = source->id;
+        n++;
+    }
+    *out = items;
+    *block_out = block;
+    return n;
+}
+
 static int strategy_dep_imports(cbm_gbuf_t *gb) {
     const cbm_gbuf_node_t **vars = NULL;
     int var_count = 0;
@@ -391,23 +592,16 @@ static int strategy_dep_imports(cbm_gbuf_t *gb) {
     }
 
     int edge_count = 0;
+    dep_import_t *prepared = NULL;
+    char *prepared_block = NULL;
+    int prepared_count = prepare_dep_imports(gb, imports, import_count, &prepared, &prepared_block);
 
-    for (int di = 0; di < dep_count; di++) {
+    for (int di = 0; di < dep_count && prepared; di++) {
         char dep_lower[CBM_SZ_256];
         lowercase_into(dep_lower, sizeof(dep_lower), deps[di].name);
 
-        for (int ii = 0; ii < import_count; ii++) {
-            const cbm_gbuf_node_t *target = cbm_gbuf_find_by_id(gb, imports[ii]->target_id);
-            if (!target) {
-                continue;
-            }
-
-            const cbm_gbuf_node_t *source = cbm_gbuf_find_by_id(gb, imports[ii]->source_id);
-            if (!source) {
-                continue;
-            }
-
-            double confidence = match_dep_to_import(target, dep_lower);
+        for (int ii = 0; ii < prepared_count; ii++) {
+            double confidence = match_dep_to_import(&prepared[ii], dep_lower);
             if (confidence > 0.0) {
                 char props[CBM_SZ_512];
                 snprintf(
@@ -415,13 +609,16 @@ static int strategy_dep_imports(cbm_gbuf_t *gb) {
                     "{\"strategy\":\"dependency_import\",\"confidence\":%.2f,\"dep_name\":\"%s\"}",
                     confidence, deps[di].name);
 
-                cbm_gbuf_insert_edge(gb, source->id, deps[di].node_id, "CONFIGURES", props);
+                cbm_gbuf_insert_edge(gb, prepared[ii].source_id, deps[di].node_id, "CONFIGURES",
+                                     props);
                 edge_count++;
             }
         }
     }
 
-    /* gbuf data is borrowed — no free */
+    /* gbuf data is borrowed; only the prepared copies are owned */
+    cbm_free(CBM_MEM_CLASS_OTHER, prepared);
+    cbm_free(CBM_MEM_CLASS_OTHER, prepared_block);
     return edge_count;
 }
 
diff --git a/src/pipeline/pass_doclinks.c b/src/pipeline/pass_doclinks.c
new file mode 100644
index 000000000..4b75357e5
--- /dev/null
+++ b/src/pipeline/pass_doclinks.c
@@ -0,0 +1,572 @@
+/*
+ * pass_doclinks.c — Documentation → file reference linking (pre-dump pass).
+ *
+ * Markdown docs reference other repo files constantly — a coding-standards
+ * doc links to the modules it governs, a README points at entry points —
+ * but none of that surfaced as graph edges, so fan-in queries were blind to
+ * documentation hubs: on a docs-heavy repo the top fan-in answer was off by
+ * an order of magnitude because the most-referenced doc had zero inbound
+ * edges.
+ *
+ * Three strategies emit REFERENCES_FILE edges between EXISTING File nodes
+ * (targets that don't resolve to an indexed file are dropped — the pass
+ * never invents nodes):
+ *   MD 1. Inline link:    [text](relative/path.ext)   (not http/mailto/#anchor)
+ *   MD 2. Backtick path:  `path/with/slash.ext` or `file.ext`
+ *   MD 3. Bare mention:   relative/path.ext            (slash + extension)
+ *
+ * Targets resolve relative to the referencing file's directory AND the repo
+ * root (docs are written both ways). Repeated references between the same
+ * file pair are collapsed to one edge carrying a "count" property; the edge
+ * keeps the highest-confidence strategy that matched.
+ *
+ * Operates on the graph buffer before dump to .db file.
+ */
+#include "pipeline/pipeline.h"
+#include "pipeline/pipeline_internal.h"
+#include "graph_buffer/graph_buffer.h"
+#include "foundation/constants.h"
+#include "foundation/hash_table.h"
+#include "foundation/log.h"
+#include "foundation/compat_fs.h"
+#include "foundation/limits.h"
+#include "foundation/mem_core.h"
+#include "foundation/dyn_array.h"
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+
+#define SLEN(s) (sizeof(s) - SKIP_ONE)
+
+/* ── Doc link confidence scores ──────────────────────────────────── */
+/* Markdown strategies */
+#define DOCLINK_MD_INLINE 0.95
+#define DOCLINK_MD_BACKTICK 0.85
+#define DOCLINK_MD_BARE 0.70
+
+/* Edge type emitted by this pass. */
+#define DOCLINK_EDGE_TYPE "REFERENCES_FILE"
+
+enum {
+    DOCLINK_MAX_SEGS = CBM_SZ_64, /* path segments during normalization */
+};
+
+/* ── Path classification ─────────────────────────────────────────── */
+
+/* Extension of the path's basename (including the dot), or NULL. */
+static const char *doclink_path_ext(const char *path) {
+    if (!path) {
+        return NULL;
+    }
+    const char *base = strrchr(path, '/');
+    base = base ? base + SKIP_ONE : path;
+    return strrchr(base, '.');
+}
+
+static bool doclink_is_markdown_path(const char *path) {
+    const char *ext = doclink_path_ext(path);
+    return ext && (strcmp(ext, ".md") == 0 || strcmp(ext, ".mdx") == 0);
+}
+
+/* ── File reading (mirrors pass_definitions.c read_file, minus TS pad) ──
+ *
+ * Reports *out_status so the caller can attribute a skip to the right
+ * reason (open failure vs. oversized vs. OOM) instead of a silent drop —
+ * hitting a limit here degrades to a REPORTED skip, per limits.h. */
+static char *doclink_read_file(const char *path, long *out_size, cbm_read_status_t *out_status) {
+    if (out_size) {
+        *out_size = 0;
+    }
+    if (out_status) {
+        *out_status = CBM_READ_OK;
+    }
+    FILE *f = cbm_fopen(path, "rb");
+    if (!f) {
+        if (out_status) {
+            *out_status = CBM_READ_OPEN_FAIL;
+        }
+        return NULL;
+    }
+    (void)fseek(f, 0, SEEK_END);
+    long size = ftell(f);
+    (void)fseek(f, 0, SEEK_SET);
+    if (out_size) {
+        *out_size = size;
+    }
+    if (size <= 0) {
+        (void)fclose(f);
+        if (out_status) {
+            *out_status = CBM_READ_EMPTY;
+        }
+        return NULL;
+    }
+    if (size > cbm_max_file_bytes()) {
+        (void)fclose(f);
+        if (out_status) {
+            *out_status = CBM_READ_OVERSIZED;
+        }
+        return NULL;
+    }
+    char *buf = cbm_alloc(CBM_MEM_CLASS_EXTRACT, (size_t)size + SKIP_ONE);
+    if (!buf) {
+        (void)fclose(f);
+        if (out_status) {
+            *out_status = CBM_READ_OOM;
+        }
+        return NULL;
+    }
+    size_t nread = fread(buf, SKIP_ONE, (size_t)size, f);
+    (void)fclose(f);
+    if (nread > (size_t)size) {
+        nread = (size_t)size;
+    }
+    buf[nread] = '\0';
+    return buf;
+}
+
+/* ── Path normalization + resolution ─────────────────────────────── */
+
+/* Normalize "a/./b/../c" into "a/c". Rejects paths that escape the repo
+ * root (leading ".."), empty results, and over-long/over-deep inputs. */
+static bool doclink_normalize(const char *in, char *out, size_t out_sz) {
+    size_t seg_starts[DOCLINK_MAX_SEGS];
+    int depth = 0;
+    size_t out_len = 0;
+    const char *p = in;
+    out[0] = '\0';
+    while (*p) {
+        const char *seg = p;
+        const char *slash = strchr(p, '/');
+        size_t seg_len = slash ? (size_t)(slash - p) : strlen(p);
+        p = slash ? slash + SKIP_ONE : p + seg_len;
+        if (seg_len == 0 || (seg_len == SKIP_ONE && seg[0] == '.')) {
+            continue;
+        }
+        if (seg_len == PAIR_LEN && seg[0] == '.' && seg[SKIP_ONE] == '.') {
+            if (depth == 0) {
+                return false; /* escapes the repo root */
+            }
+            depth--;
+            out_len = seg_starts[depth];
+            out[out_len] = '\0';
+            continue;
+        }
+        if (depth >= DOCLINK_MAX_SEGS || out_len + seg_len + PAIR_LEN >= out_sz) {
+            return false;
+        }
+        seg_starts[depth++] = out_len;
+        if (out_len > 0) {
+            out[out_len++] = '/';
+        }
+        memcpy(out + out_len, seg, seg_len);
+        out_len += seg_len;
+        out[out_len] = '\0';
+    }
+    return out_len > 0;
+}
+
+/* One raw match before dedup. Collected in a growable vector (no per-file
+ * cap) and collapsed by doclink_flush(). */
+typedef struct {
+    int64_t target_id;
+    double confidence;
+    const char *strategy; /* static string literal */
+} doclink_match_t;
+
+typedef struct {
+    cbm_gbuf_t *gb;
+    CBMHashTable *files_by_path; /* rel_path → cbm_gbuf_node_t* (borrowed) */
+    const cbm_gbuf_node_t *src;  /* referencing File node */
+    char src_dir[CBM_SZ_512];    /* its directory ("" at repo root) */
+    CBM_DYN_ARRAY(doclink_match_t) matches;
+} doclink_ctx_t;
+
+/* How a reference was written, which decides where it may resolve. Mixing
+ * these up let a rooted "/x" still match a same-named file in the
+ * referencing directory, and let an explicit "./x" fall back to an
+ * unrelated same-named file at the repo root. */
+typedef enum {
+    DOCLINK_REF_BARE = 0, /* "x": referencing dir, then repo root */
+    DOCLINK_REF_RELATIVE, /* "./x": referencing dir only */
+    DOCLINK_REF_ROOTED,   /* "/x": repo root only */
+} doclink_ref_kind_t;
+
+/* Resolve a reference against the referencing file's directory and/or the
+ * repo root, per its kind. Returns the already-indexed File node or NULL —
+ * unresolvable references are dropped. */
+static const cbm_gbuf_node_t *doclink_resolve(doclink_ctx_t *dc, const char *ref) {
+    const char *r = ref;
+    doclink_ref_kind_t kind = DOCLINK_REF_BARE;
+    if (r[0] == '.' && r[SKIP_ONE] == '/') {
+        kind = DOCLINK_REF_RELATIVE;
+        while (r[0] == '.' && r[SKIP_ONE] == '/') {
+            r += PAIR_LEN;
+        }
+    } else if (r[0] == '/') {
+        kind = DOCLINK_REF_ROOTED;
+        r++; /* "/docs/x.md" is repo-root-relative by doc convention */
+    }
+    if (r[0] == '\0') {
+        return NULL;
+    }
+
+    char norm[CBM_SZ_512];
+    if (kind != DOCLINK_REF_ROOTED && dc->src_dir[0] != '\0') {
+        char joined[CBM_SZ_512];
+        int n = snprintf(joined, sizeof(joined), "%s/%s", dc->src_dir, r);
+        if (n > 0 && (size_t)n < sizeof(joined) && doclink_normalize(joined, norm, sizeof(norm))) {
+            const cbm_gbuf_node_t *node = cbm_ht_get(dc->files_by_path, norm);
+            if (node) {
+                return node;
+            }
+        }
+    }
+    if (kind != DOCLINK_REF_RELATIVE && doclink_normalize(r, norm, sizeof(norm))) {
+        return cbm_ht_get(dc->files_by_path, norm);
+    }
+    return NULL;
+}
+
+/* Record one match. No cap, no dedup here — dc->matches is a plain append
+ * log; doclink_flush() sorts and collapses same-target matches so a
+ * generated file with hundreds of distinct targets loses nothing. */
+static void doclink_record(doclink_ctx_t *dc, const cbm_gbuf_node_t *target, double confidence,
+                           const char *strategy) {
+    if (!target || target->id == dc->src->id) {
+        return; /* never self-reference */
+    }
+    doclink_match_t m = {.target_id = target->id, .confidence = confidence, .strategy = strategy};
+    cbm_da_push(&dc->matches, m);
+}
+
+static int doclink_match_cmp(const void *a, const void *b) {
+    int64_t ta = ((const doclink_match_t *)a)->target_id;
+    int64_t tb = ((const doclink_match_t *)b)->target_id;
+    return (ta > tb) - (ta < tb);
+}
+
+/* Emit accumulated references as REFERENCES_FILE edges. Sorts by target id
+ * (O(M log M)) and collapses same-target runs: count = occurrences, the
+ * highest-confidence match in the run wins strategy + confidence. Returns
+ * edge count. */
+static int doclink_flush(doclink_ctx_t *dc) {
+    if (dc->matches.count > 1) {
+        qsort(dc->matches.items, (size_t)dc->matches.count, sizeof(dc->matches.items[0]),
+              doclink_match_cmp);
+    }
+
+    int emitted = 0;
+    int i = 0;
+    while (i < dc->matches.count) {
+        int64_t target_id = dc->matches.items[i].target_id;
+        double confidence = dc->matches.items[i].confidence;
+        const char *strategy = dc->matches.items[i].strategy;
+        int count = SKIP_ONE;
+        int j = i + SKIP_ONE;
+        while (j < dc->matches.count && dc->matches.items[j].target_id == target_id) {
+            count++;
+            if (dc->matches.items[j].confidence > confidence) {
+                confidence = dc->matches.items[j].confidence;
+                strategy = dc->matches.items[j].strategy;
+            }
+            j++;
+        }
+
+        char props[CBM_SZ_256];
+        (void)snprintf(props, sizeof(props),
+                       "{\"strategy\":\"%s\",\"confidence\":%.2f,\"count\":%d}", strategy,
+                       confidence, count);
+        if (cbm_gbuf_insert_edge(dc->gb, dc->src->id, target_id, DOCLINK_EDGE_TYPE, props) > 0) {
+            emitted++;
+        }
+        i = j;
+    }
+    cbm_da_clear(&dc->matches);
+    return emitted;
+}
+
+/* ── Markdown scanning ───────────────────────────────────────────── */
+
+/* Characters allowed in a path-shaped token (backtick / bare mention). */
+static bool doclink_token_pathlike(const char *tok) {
+    bool last_seg_has_dot = false;
+    for (const char *p = tok; *p; p++) {
+        unsigned char c = (unsigned char)*p;
+        if (c == '/') {
+            last_seg_has_dot = false;
+            continue;
+        }
+        if (c == '.') {
+            last_seg_has_dot = true;
+            continue;
+        }
+        if (!isalnum(c) && c != '_' && c != '-' && c != '+' && c != '@' && c != '~') {
+            return false;
+        }
+    }
+    /* the basename must carry an extension — bare words are not paths */
+    return last_seg_has_dot;
+}
+
+/* A markdown link target worth resolving: not a URL, mailto, or pure anchor. */
+static bool doclink_md_target_ok(const char *target) {
+    if (target[0] == '\0' || target[0] == '#') {
+        return false;
+    }
+    if (strstr(target, "://") != NULL || strncmp(target, "mailto:", SLEN("mailto:")) == 0) {
+        return false;
+    }
+    return true;
+}
+
+/* MD 1: inline links [text](target). Consumed spans are blanked so the
+ * backtick / bare-mention scans below cannot re-match the same path. */
+static void doclink_scan_md_links(doclink_ctx_t *dc, char *line) {
+    char *p = line;
+    while ((p = strstr(p, "](")) != NULL) {
+        char *close = strchr(p + PAIR_LEN, ')');
+        if (!close) {
+            return;
+        }
+        char target[CBM_SZ_512];
+        size_t tlen = (size_t)(close - (p + PAIR_LEN));
+        if (tlen < sizeof(target)) {
+            memcpy(target, p + PAIR_LEN, tlen);
+            target[tlen] = '\0';
+            char *cut = strchr(target, ' '); /* [t](path "title") */
+            if (cut) {
+                *cut = '\0';
+            }
+            cut = strchr(target, '#'); /* [t](path#anchor) */
+            if (cut) {
+                *cut = '\0';
+            }
+            if (doclink_md_target_ok(target)) {
+                doclink_record(dc, doclink_resolve(dc, target), DOCLINK_MD_INLINE,
+                               "md_inline_link");
+            }
+        }
+        /* blank the whole [text](target) span, link text included, so a
+         * path-shaped link text is not re-counted as a bare mention */
+        char *open = p;
+        while (open > line && *open != '[') {
+            open--;
+        }
+        if (*open != '[') {
+            open = p;
+        }
+        memset(open, ' ', (size_t)(close - open) + SKIP_ONE);
+        p = close + SKIP_ONE;
+    }
+}
+
+/* MD 2: backtick-quoted paths `src/foo.c` / `build.sh`. */
+static void doclink_scan_md_backticks(doclink_ctx_t *dc, char *line) {
+    char *p = line;
+    while ((p = strchr(p, '`')) != NULL) {
+        char *end = strchr(p + SKIP_ONE, '`');
+        if (!end) {
+            return;
+        }
+        char tok[CBM_SZ_512];
+        size_t tlen = (size_t)(end - (p + SKIP_ONE));
+        if (tlen > 0 && tlen < sizeof(tok)) {
+            memcpy(tok, p + SKIP_ONE, tlen);
+            tok[tlen] = '\0';
+            if (doclink_token_pathlike(tok)) {
+                doclink_record(dc, doclink_resolve(dc, tok), DOCLINK_MD_BACKTICK,
+                               "md_backtick_path");
+            }
+        }
+        memset(p, ' ', (size_t)(end - p) + SKIP_ONE);
+        p = end + SKIP_ONE;
+    }
+}
+
+static bool doclink_md_delim(char c) {
+    return isspace((unsigned char)c) || strchr("()[]{}<>\"',;:`*|", c) != NULL;
+}
+
+/* MD 3: bare relative path mentions — must contain a slash AND an extension
+ * (and, via doclink_resolve, an indexed file) to count. */
+static void doclink_scan_md_bare(doclink_ctx_t *dc, const char *line) {
+    const char *p = line;
+    while (*p) {
+        while (*p && doclink_md_delim(*p)) {
+            p++;
+        }
+        const char *start = p;
+        while (*p && !doclink_md_delim(*p)) {
+            p++;
+        }
+        size_t tlen = (size_t)(p - start);
+        char tok[CBM_SZ_512];
+        if (tlen == 0 || tlen >= sizeof(tok)) {
+            continue;
+        }
+        memcpy(tok, start, tlen);
+        tok[tlen] = '\0';
+        while (tlen > 0 && tok[tlen - SKIP_ONE] == '.') {
+            tok[--tlen] = '\0'; /* sentence-ending period */
+        }
+        if (strchr(tok, '/') != NULL && doclink_token_pathlike(tok)) {
+            doclink_record(dc, doclink_resolve(dc, tok), DOCLINK_MD_BARE, "md_bare_mention");
+        }
+    }
+}
+
+static void doclink_scan_md_line(doclink_ctx_t *dc, char *line) {
+    doclink_scan_md_links(dc, line);
+    doclink_scan_md_backticks(dc, line);
+    doclink_scan_md_bare(dc, line);
+}
+
+/* ── Per-file driver ─────────────────────────────────────────────── */
+
+/* Scan one referencing file's content line by line and emit its edges.
+ * `source` is the caller's private mutable buffer (freshly read for this
+ * file, never reused): lines are terminated in place ('\n' -> '\0') and
+ * scanned by pointer, so there is no fixed-size copy and no line-length
+ * cap to straddle a token across (a prior CBM_SZ_4K copy buffer could cut
+ * "src/foo.cpp" to "src/foo.c" at the boundary and bind to the wrong
+ * file). A trailing '\r' (CRLF) is trimmed the same way. */
+static int doclink_scan_file(doclink_ctx_t *dc, const cbm_gbuf_node_t *node, char *source) {
+    dc->src = node;
+    dc->src_dir[0] = '\0';
+    const char *slash = strrchr(node->file_path, '/');
+    if (slash) {
+        size_t dlen = (size_t)(slash - node->file_path);
+        if (dlen >= sizeof(dc->src_dir)) {
+            return 0;
+        }
+        memcpy(dc->src_dir, node->file_path, dlen);
+        dc->src_dir[dlen] = '\0';
+    }
+
+    char *p = source;
+    while (*p) {
+        char *line = p;
+        char *eol = strchr(p, '\n');
+        if (eol) {
+            *eol = '\0';
+            p = eol + SKIP_ONE;
+        } else {
+            p += strlen(p);
+        }
+        size_t line_len = strlen(line);
+        if (line_len > 0 && line[line_len - SKIP_ONE] == '\r') {
+            line[line_len - SKIP_ONE] = '\0';
+        }
+        doclink_scan_md_line(dc, line);
+    }
+    return doclink_flush(dc);
+}
+
+/* ── Pass entry point ────────────────────────────────────────────── */
+
+/* True when at least one File node is a markdown file. */
+static bool doclink_has_doc_files(const cbm_gbuf_node_t *const *files, int file_count) {
+    for (int i = 0; i < file_count; i++) {
+        if (doclink_is_markdown_path(files[i]->file_path)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/* Scan every markdown File node's on-disk content, emitting edges.
+ * md_edges receives the emitted edge count. Checks cancellation once per
+ * file — on a docs-heavy repo this is the whole pass's cancel latency —
+ * and every skip is reported via cbm_pipeline_add_file_error, never
+ * silent. */
+static void doclink_scan_repo(cbm_pipeline_ctx_t *ctx, doclink_ctx_t *dc, const char *repo_path,
+                              const cbm_gbuf_node_t *const *files, int file_count, int *md_edges) {
+    for (int i = 0; i < file_count; i++) {
+        if (cbm_pipeline_check_cancel(ctx)) {
+            return;
+        }
+        if (!files[i]->file_path || !doclink_is_markdown_path(files[i]->file_path)) {
+            continue;
+        }
+
+        char abs_path[CBM_PATH_MAX];
+        int n = snprintf(abs_path, sizeof(abs_path), "%s/%s", repo_path, files[i]->file_path);
+        if (n <= 0 || (size_t)n >= sizeof(abs_path)) {
+            continue;
+        }
+        long file_size = 0;
+        cbm_read_status_t rst = CBM_READ_OK;
+        char *source = doclink_read_file(abs_path, &file_size, &rst);
+        if (!source) {
+            if (rst == CBM_READ_OVERSIZED) {
+                long cap = cbm_max_file_bytes();
+                char reason[96];
+                (void)snprintf(reason, sizeof(reason), "oversized (%lld MB > %lld MB)",
+                               (long long)(file_size / (CBM_SZ_1K * CBM_SZ_1K)),
+                               (long long)(cap / (CBM_SZ_1K * CBM_SZ_1K)));
+                cbm_pipeline_add_file_error(ctx->pipeline, files[i]->file_path, reason,
+                                            "oversized");
+                cbm_log_warn("doclinks.file_oversized", "path", files[i]->file_path);
+            } else if (rst == CBM_READ_OPEN_FAIL || rst == CBM_READ_OOM) {
+                cbm_pipeline_add_file_error(ctx->pipeline, files[i]->file_path, "read failed",
+                                            "read");
+                cbm_log_warn("doclinks.file_unreadable", "path", files[i]->file_path);
+            }
+            /* CBM_READ_EMPTY: benign 0-byte file, nothing to index, not reported. */
+            continue;
+        }
+        int emitted = doclink_scan_file(dc, files[i], source);
+        cbm_free(CBM_MEM_CLASS_EXTRACT, source);
+        *md_edges += emitted;
+    }
+}
+
+int cbm_pipeline_pass_doclinks(cbm_pipeline_ctx_t *ctx) {
+    cbm_gbuf_t *gb = ctx->gbuf;
+
+    const cbm_gbuf_node_t **files = NULL;
+    int file_count = 0;
+    if (cbm_gbuf_find_by_label(gb, "File", &files, &file_count) != 0 || file_count == 0) {
+        return 0;
+    }
+
+    /* Early exit: no markdown files means nothing to scan. */
+    if (!doclink_has_doc_files(files, file_count)) {
+        cbm_log_info("doclinks.skip", "reason", "no_doc_files");
+        return 0;
+    }
+    if (!ctx->repo_path) {
+        cbm_log_info("doclinks.skip", "reason", "no_repo_path");
+        return 0;
+    }
+
+    doclink_ctx_t dc;
+    memset(&dc, 0, sizeof(dc));
+    dc.gb = gb;
+    dc.files_by_path = cbm_ht_create((uint32_t)file_count);
+    if (!dc.files_by_path) {
+        return 0;
+    }
+    for (int i = 0; i < file_count; i++) {
+        if (files[i]->file_path) {
+            /* key borrowed from the node (owned by gbuf, outlives the pass) */
+            cbm_ht_set(dc.files_by_path, files[i]->file_path, (void *)files[i]);
+        }
+    }
+
+    int md_edges = 0;
+    doclink_scan_repo(ctx, &dc, ctx->repo_path, files, file_count, &md_edges);
+    cbm_da_free(&dc.matches);
+    cbm_ht_free(dc.files_by_path);
+
+    char buf1[CBM_SZ_16];
+    (void)snprintf(buf1, sizeof(buf1), "%d", md_edges);
+    cbm_log_info("doclinks.strategy", "name", "markdown", "edges", buf1);
+    cbm_log_info("doclinks.done", "total", buf1);
+
+    return md_edges;
+}
diff --git a/src/pipeline/pass_importance.c b/src/pipeline/pass_importance.c
index c544d0a10..e331dce90 100644
--- a/src/pipeline/pass_importance.c
+++ b/src/pipeline/pass_importance.c
@@ -292,8 +292,8 @@ void cbm_pipeline_importance_append_prop(cbm_gbuf_node_t *node, double score) {
     if (!neu) {
         return;
     }
-    free(node->properties_json);
-    node->properties_json = neu;
+    (void)cbm_gbuf_node_set_properties_json(node, neu);
+    free(neu);
 }
 
 /* ── The scoring rule ─────────────────────────────────────────────────
diff --git a/src/pipeline/pass_k8s.c b/src/pipeline/pass_k8s.c
index 94dcd439a..3a6982ef6 100644
--- a/src/pipeline/pass_k8s.c
+++ b/src/pipeline/pass_k8s.c
@@ -22,7 +22,12 @@
 #include "foundation/compat_fs.h"
 #include "foundation/limits.h"
 #include "cbm.h"
+#include "helpers.h"               /* cbm_kind_in_set_free_cache */
+#include "foundation/slab_alloc.h" /* cbm_slab_destroy_thread */
+#include "foundation/platform.h"   /* cbm_default_worker_count */
+#include "pipeline/worker_pool.h"
 
+#include <stdatomic.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
@@ -48,7 +53,7 @@ static char *k8s_read_file(const char *path, int *out_len) {
 
     /* +pad: tree-sitter lexer lookahead reads past EOF; keep it in-bounds */
     enum { CBM_TS_LOOKAHEAD_PAD = 16 };
-    char *buf = malloc((size_t)size + CBM_TS_LOOKAHEAD_PAD);
+    char *buf = cbm_alloc(CBM_MEM_CLASS_OTHER, (size_t)size + CBM_TS_LOOKAHEAD_PAD);
     if (!buf) {
         (void)fclose(f);
         return NULL;
@@ -83,8 +88,10 @@ static const char *k8s_basename(const char *path) {
 
 /* ── Kustomize handler ───────────────────────────────────────────── */
 
-static void handle_kustomize(cbm_pipeline_ctx_t *ctx, const char *path, const char *rel_path,
-                             CBMFileResult *result) {
+/* `result` is the cached parallel-pass result or, for an uncached file, the
+ * re-extraction the preparation step made; the caller owns it. */
+static void handle_kustomize(cbm_pipeline_ctx_t *ctx, const char *rel_path,
+                             const CBMFileResult *result) {
     /* Emit Module node for this kustomize overlay file */
     char *mod_qn = cbm_infra_qn(ctx->project_name, rel_path, "kustomize", NULL);
     if (!mod_qn) {
@@ -99,23 +106,10 @@ static void handle_kustomize(cbm_pipeline_ctx_t *ctx, const char *path, const ch
         return;
     }
 
-    /* If we have a cached extraction result, emit IMPORTS edges for
+    /* With an extraction result, emit IMPORTS edges for
      * resources/bases/patches/components entries */
     int import_count = 0;
-    CBMFileResult *res = result;
-    bool allocated = false;
-
-    if (!res) {
-        /* Fall back to re-extraction */
-        int src_len = 0;
-        char *source = k8s_read_file(path, &src_len);
-        if (source) {
-            res = cbm_extract_file(source, src_len, CBM_LANG_KUSTOMIZE, ctx->project_name, rel_path,
-                                   CBM_EXTRACT_BUDGET, NULL, NULL);
-            free(source);
-            allocated = true;
-        }
-    }
+    const CBMFileResult *res = result;
 
     if (res) {
         for (int j = 0; j < res->imports.count; j++) {
@@ -140,10 +134,6 @@ static void handle_kustomize(cbm_pipeline_ctx_t *ctx, const char *path, const ch
                 import_count++;
             }
         }
-
-        if (allocated) {
-            cbm_free_result(res);
-        }
     }
 
     cbm_log_info("pass.k8s.kustomize", "file", rel_path, "imports", itoa_k8s(import_count));
@@ -372,13 +362,10 @@ static void k8s_link_selectors(cbm_pipeline_ctx_t *ctx, const k8s_record_array_t
  * must free after this call returns).  When `rec` is non-NULL it is populated
  * with the first Resource's node id, name and label/selector values for later
  * cross-manifest selector matching. */
-static void handle_k8s_manifest(cbm_pipeline_ctx_t *ctx, const char *path, const char *rel_path,
-                                const char *source, int src_len, k8s_record_t *rec) {
-    (void)path; /* retained for symmetry; source is always provided now */
+static void handle_k8s_manifest(cbm_pipeline_ctx_t *ctx, const char *rel_path, const char *source,
+                                const CBMFileResult *res, k8s_record_t *rec) {
     int resource_count = 0;
 
-    CBMFileResult *res = cbm_extract_file(source, src_len, CBM_LANG_K8S, ctx->project_name,
-                                          rel_path, CBM_EXTRACT_BUDGET, NULL, NULL);
     if (!res) {
         return;
     }
@@ -414,8 +401,6 @@ static void handle_k8s_manifest(cbm_pipeline_ctx_t *ctx, const char *path, const
         resource_count++;
     }
 
-    cbm_free_result(res);
-
     /* Record selector / pod-label values for later Service → workload linking. */
     if (rec && rec->node_id > 0) {
         k8s_scan_labels(source, rec);
@@ -622,6 +607,95 @@ static void handle_dep_manifest(cbm_pipeline_ctx_t *ctx, const char *rel_path, c
 
 /* ── Pass entry point ────────────────────────────────────────────── */
 
+/* What one file contributes, prepared off the graph: reading, classifying and
+ * extracting are per-file work, so they run in parallel; everything that
+ * touches the graph buffer then runs on this thread in file order, exactly as
+ * the sequential loop did. Sequentially the pass re-read and re-parsed every
+ * YAML manifest on one thread -- 1.1 s of the Go corpus (6,275 manifests;
+ * profile + waste sanitizer, 2026-09-17). */
+typedef enum { K8S_SKIP = 0, K8S_DEP, K8S_KUSTOMIZE, K8S_HELM, K8S_MANIFEST } k8s_kind_t;
+
+typedef struct {
+    k8s_kind_t kind;
+    char *source; /* DEP, HELM, MANIFEST */
+    int src_len;
+    CBMFileResult *res; /* MANIFEST, or KUSTOMIZE without a cached result */
+} k8s_prep_t;
+
+typedef struct {
+    cbm_pipeline_ctx_t *ctx;
+    const cbm_file_info_t *files;
+    k8s_prep_t *prep; /* indexed from `begin` */
+    int begin;
+    int end;
+    _Atomic int next;
+} k8s_prep_job_t;
+
+enum { K8S_CHUNK = 1024 };
+
+static void k8s_prep_file(const k8s_prep_job_t *job, int i, k8s_prep_t *out) {
+    cbm_pipeline_ctx_t *ctx = job->ctx;
+    const char *path = job->files[i].path;
+    const char *rel = job->files[i].rel_path;
+    CBMLanguage lang = job->files[i].language;
+    const char *base = k8s_basename(rel);
+
+    if (is_gomod_file(base) || lang == CBM_LANG_GOMOD || is_requirements_file(base)) {
+        out->source = k8s_read_file(path, &out->src_len);
+        out->kind = out->source ? K8S_DEP : K8S_SKIP;
+    } else if (cbm_is_kustomize_file(base)) {
+        out->kind = K8S_KUSTOMIZE;
+        bool cached = ctx->result_cache && ctx->result_cache[i];
+        if (!cached) {
+            /* Fall back to re-extraction */
+            int src_len = 0;
+            char *source = k8s_read_file(path, &src_len);
+            if (source) {
+                out->res = cbm_extract_file(source, src_len, CBM_LANG_KUSTOMIZE, ctx->project_name,
+                                            rel, CBM_EXTRACT_BUDGET, NULL, NULL);
+                cbm_free(CBM_MEM_CLASS_OTHER, source);
+            }
+        }
+    } else if (lang == CBM_LANG_YAML || lang == CBM_LANG_K8S) {
+        /* Read source once to classify (and reuse for uncached extraction). */
+        out->source = k8s_read_file(path, &out->src_len);
+        if (!out->source) {
+            return;
+        }
+        if (is_helm_chart_file(base)) {
+            out->kind = K8S_HELM;
+        } else if (cbm_is_k8s_manifest(base, out->source)) {
+            /* Always re-extract with CBM_LANG_K8S regardless of any cached
+             * result: cached results were produced during the parallel YAML
+             * pass and contain no "Resource" definitions. */
+            out->kind = K8S_MANIFEST;
+            out->res = cbm_extract_file(out->source, out->src_len, CBM_LANG_K8S, ctx->project_name,
+                                        rel, CBM_EXTRACT_BUDGET, NULL, NULL);
+        } else {
+            cbm_free(CBM_MEM_CLASS_OTHER, out->source);
+            out->source = NULL;
+        }
+    }
+}
+
+static void k8s_prep_worker(int worker_id, void *arg) {
+    (void)worker_id;
+    k8s_prep_job_t *job = (k8s_prep_job_t *)arg;
+    cbm_work_arena_keep_begin(); /* one scratch arena for this worker's files */
+    while (true) {
+        int i = atomic_fetch_add_explicit(&job->next, SKIP_ONE, memory_order_relaxed);
+        if (i >= job->end) {
+            break;
+        }
+        k8s_prep_file(job, i, &job->prep[i - job->begin]);
+    }
+    /* Per-thread extraction state, torn down like extract_worker's. */
+    cbm_destroy_thread_parser();
+    cbm_work_arena_release();
+    cbm_slab_destroy_thread();
+    cbm_kind_in_set_free_cache();
+}
+
 int cbm_pipeline_pass_k8s(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files, int file_count) {
     cbm_log_info("pass.start", "pass", "k8s", "files", itoa_k8s(file_count));
 
@@ -633,63 +707,84 @@ int cbm_pipeline_pass_k8s(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files,
 
     /* Collect per-manifest selector/label records for cross-manifest matching. */
     k8s_record_array_t recs = {0};
-    recs.items = calloc(K8S_MAX_RECORDS, sizeof(*recs.items));
+    recs.items = cbm_calloc(CBM_MEM_CLASS_OTHER, K8S_MAX_RECORDS * sizeof(*recs.items));
     recs.cap = recs.items ? K8S_MAX_RECORDS : 0;
 
-    for (int i = 0; i < file_count; i++) {
+    k8s_prep_t *prep = cbm_calloc(CBM_MEM_CLASS_OTHER, K8S_CHUNK * sizeof(*prep));
+    if (!prep) {
+        cbm_free(CBM_MEM_CLASS_OTHER, recs.items);
+        return CBM_NOT_FOUND;
+    }
+    int workers = cbm_default_worker_count(false);
+
+    for (int begin = 0; begin < file_count; begin += K8S_CHUNK) {
+        int end = begin + K8S_CHUNK < file_count ? begin + K8S_CHUNK : file_count;
         if (cbm_pipeline_check_cancel(ctx)) {
-            free(recs.items);
+            cbm_free(CBM_MEM_CLASS_OTHER, prep);
+            cbm_free(CBM_MEM_CLASS_OTHER, recs.items);
             return CBM_NOT_FOUND;
         }
+        memset(prep, 0, (size_t)K8S_CHUNK * sizeof(*prep));
+        k8s_prep_job_t job = {.ctx = ctx, .files = files, .prep = prep, .begin = begin, .end = end};
+        atomic_init(&job.next, begin);
+        cbm_parallel_for(
+            workers, k8s_prep_worker, &job,
+            (cbm_parallel_for_opts_t){.max_workers = workers, .force_pthreads = false});
 
-        const char *path = files[i].path;
-        const char *rel = files[i].rel_path;
-        CBMLanguage lang = files[i].language;
-        const char *base = k8s_basename(rel);
-
-        CBMFileResult *cached =
-            (ctx->result_cache && ctx->result_cache[i]) ? ctx->result_cache[i] : NULL;
-
-        if (is_gomod_file(base) || lang == CBM_LANG_GOMOD || is_requirements_file(base)) {
-            int dep_len = 0;
-            char *dep_src = k8s_read_file(path, &dep_len);
-            if (dep_src) {
-                handle_dep_manifest(ctx, rel, dep_src,
-                                    is_requirements_file(base) ? "pypi" : "gomod");
-                free(dep_src);
+        bool cancelled = false;
+        for (int i = begin; i < end; i++) {
+            k8s_prep_t *p = &prep[i - begin];
+            if (!cancelled && cbm_pipeline_check_cancel(ctx)) {
+                cancelled = true;
             }
-        } else if (cbm_is_kustomize_file(base)) {
-            handle_kustomize(ctx, path, rel, cached);
-            kustomize_count++;
-        } else if (lang == CBM_LANG_YAML || lang == CBM_LANG_K8S) {
-            /* Read source once to classify (and reuse for uncached extraction). */
-            int src_len = 0;
-            char *source = k8s_read_file(path, &src_len);
-            if (source) {
-                if (is_helm_chart_file(base)) {
-                    handle_helm_chart(ctx, rel, source);
+            if (!cancelled) {
+                const char *rel = files[i].rel_path;
+                const char *base = k8s_basename(rel);
+                CBMFileResult *cached =
+                    (ctx->result_cache && ctx->result_cache[i]) ? ctx->result_cache[i] : NULL;
+                switch (p->kind) {
+                case K8S_DEP:
+                    handle_dep_manifest(ctx, rel, p->source,
+                                        is_requirements_file(base) ? "pypi" : "gomod");
+                    break;
+                case K8S_KUSTOMIZE:
+                    handle_kustomize(ctx, rel, cached ? cached : p->res);
+                    kustomize_count++;
+                    break;
+                case K8S_HELM:
+                    handle_helm_chart(ctx, rel, p->source);
                     helm_count++;
-                } else if (cbm_is_k8s_manifest(base, source)) {
-                    /* Always re-extract with CBM_LANG_K8S regardless of any cached
-                     * result: cached results were produced during the parallel YAML
-                     * pass and contain no "Resource" definitions.  Pass the already-
-                     * read source buffer so handle_k8s_manifest does not re-read. */
-                    (void)cached; /* cached YAML result intentionally discarded */
+                    break;
+                case K8S_MANIFEST: {
                     k8s_record_t *rec = (recs.count < recs.cap) ? &recs.items[recs.count] : NULL;
-                    handle_k8s_manifest(ctx, path, rel, source, src_len, rec);
+                    handle_k8s_manifest(ctx, rel, p->source, p->res, rec);
                     if (rec && rec->node_id > 0) {
                         recs.count++;
                     }
                     manifest_count++;
+                    break;
                 }
-                free(source);
+                case K8S_SKIP:
+                default:
+                    break;
+                }
+            }
+            cbm_free(CBM_MEM_CLASS_OTHER, p->source);
+            if (p->res) {
+                cbm_free_result(p->res);
             }
         }
+        if (cancelled) {
+            cbm_free(CBM_MEM_CLASS_OTHER, prep);
+            cbm_free(CBM_MEM_CLASS_OTHER, recs.items);
+            return CBM_NOT_FOUND;
+        }
     }
+    cbm_free(CBM_MEM_CLASS_OTHER, prep);
 
     /* Connect Services to the workloads their selectors target (INFRA_MAPS). */
     k8s_link_selectors(ctx, &recs);
-    free(recs.items);
+    cbm_free(CBM_MEM_CLASS_OTHER, recs.items);
 
     cbm_log_info("pass.done", "pass", "k8s", "kustomize", itoa_k8s(kustomize_count), "manifests",
                  itoa_k8s(manifest_count));
diff --git a/src/pipeline/pass_lsp_cross.c b/src/pipeline/pass_lsp_cross.c
index 704a73d41..3b74cc1eb 100644
--- a/src/pipeline/pass_lsp_cross.c
+++ b/src/pipeline/pass_lsp_cross.c
@@ -16,6 +16,7 @@
 #include "pipeline/pass_lsp_cross.h"
 
 #include "pipeline/lsp_surface.h"
+#include "result_spill.h"
 #include "pipeline/pipeline_internal.h"
 #include "pipeline/lsp_resolve.h"
 #include "lsp/go_lsp.h"
@@ -32,6 +33,7 @@
 #include "foundation/hash_table.h"
 #include "foundation/log.h"
 #include "foundation/compat_fs.h"
+#include "foundation/compat.h" /* CBM_TLS */
 
 #include <stdio.h>
 #include <stdint.h>
@@ -104,7 +106,11 @@ static char *pxc_read_file(const char *path, int *out_len) {
  * plus Protocol/Function/Method — variables, modules, decorators, etc. are
  * skipped. Struct passes through so Rust/Go struct type-registration via the
  * cross-file LSP path is not dropped. */
-static const char *pxc_map_label(const char *label) {
+/* The label a cross def keeps is a static spelling, never the result's own
+ * pointer: in spill mode the CBMFileResult is freed (parked on disk) the
+ * moment the collector is done with it, and the defs outlive it. A kept
+ * spelling outside the table falls back to an arena copy. */
+static const char *pxc_map_label(CBMArena *arena, const char *label) {
     if (!label)
         return NULL;
     if (cbm_label_is_type_like(label) || strcmp(label, "Protocol") == 0 ||
@@ -115,7 +121,14 @@ static const char *pxc_map_label(const char *label) {
          * name-only fallback). Every registrar filters by explicit label, so
          * the other languages ignore Variable defs untouched. */
         strcmp(label, "Variable") == 0) {
-        return label;
+        static const char *const canon[] = {"Class", "Struct",   "Interface", "Enum",   "Type",
+                                            "Trait", "Protocol", "Function",  "Method", "Variable"};
+        for (size_t i = 0; i < sizeof(canon) / sizeof(canon[0]); i++) {
+            if (strcmp(label, canon[i]) == 0) {
+                return canon[i];
+            }
+        }
+        return arena ? cbm_arena_strdup(arena, label) : NULL;
     }
     return NULL;
 }
@@ -268,22 +281,28 @@ static const char *pxc_last_component(const char *qn) {
     return dot ? dot + 1 : qn;
 }
 
+/* Every return is arena-owned: the fallback spelling is a copy, never the
+ * result's pointer (the result may be parked on disk before the def is read). */
 static const char *pxc_jvm_type_qn(CBMArena *arena, const char *namespace_name,
                                    const char *type_qn_or_name) {
-    if (!arena || !namespace_name || !namespace_name[0] || !type_qn_or_name) {
-        return type_qn_or_name;
+    if (!arena || !type_qn_or_name) {
+        return NULL;
     }
-    const char *short_name = pxc_last_component(type_qn_or_name);
+    const char *short_name =
+        (namespace_name && namespace_name[0]) ? pxc_last_component(type_qn_or_name) : NULL;
     if (!short_name || !short_name[0]) {
-        return type_qn_or_name;
+        return cbm_arena_strdup(arena, type_qn_or_name);
     }
     return cbm_arena_sprintf(arena, "%s.%s", namespace_name, short_name);
 }
 
 static const char *pxc_jvm_def_qn(CBMArena *arena, const CBMDefinition *src,
                                   const char *namespace_name, const char *label) {
-    if (!arena || !src || !namespace_name || !namespace_name[0]) {
-        return src ? src->qualified_name : NULL;
+    if (!arena || !src) {
+        return NULL;
+    }
+    if (!namespace_name || !namespace_name[0]) {
+        return cbm_arena_strdup(arena, src->qualified_name); /* a copy, see above */
     }
     if (strcmp(label, "Method") == 0 || strcmp(label, "Function") == 0 ||
         strcmp(label, "Constructor") == 0) {
@@ -373,7 +392,7 @@ static int pxc_build_lsp_def(CBMArena *arena, const CBMDefinition *src, const ch
                              const char *namespace_name, CBMLanguage lang, CBMLSPDef *dst,
                              const cbm_registry_t *reg, const char **imp_keys,
                              const char **imp_vals, int imp_count) {
-    const char *label = pxc_map_label(src->label);
+    const char *label = pxc_map_label(arena, src->label);
     if (!label || !src->qualified_name || !src->name)
         return -1;
     memset(dst, 0, sizeof(*dst));
@@ -381,18 +400,20 @@ static int pxc_build_lsp_def(CBMArena *arena, const CBMDefinition *src, const ch
         dst->qualified_name = pxc_jvm_def_qn(arena, src, namespace_name, label);
         dst->receiver_type = pxc_jvm_type_qn(arena, namespace_name, src->parent_class);
     } else {
-        dst->qualified_name = src->qualified_name;
-        dst->receiver_type = src->parent_class;
+        dst->qualified_name = cbm_arena_strdup(arena, src->qualified_name);
+        dst->receiver_type = src->parent_class ? cbm_arena_strdup(arena, src->parent_class) : NULL;
     }
-    dst->short_name = src->name;
+    /* Copies, not borrows: a result may be parked on disk (spill mode) the
+     * moment the collector is done with it; the def list outlives it. */
+    dst->short_name = cbm_arena_strdup(arena, src->name);
     dst->label = label;
     dst->def_module_qn = module_qn;
-    dst->namespace_name = namespace_name;
+    dst->namespace_name = namespace_name ? cbm_arena_strdup(arena, namespace_name) : NULL;
     dst->is_interface = (strcmp(label, "Interface") == 0 || strcmp(label, "Protocol") == 0);
     /* Single return-type string. The per-language registrars split on '|'
      * for multi-return languages (Go); single-return languages just see one
      * piece, which is what's already stored. */
-    dst->return_types = src->return_type;
+    dst->return_types = src->return_type ? cbm_arena_strdup(arena, src->return_type) : NULL;
     /* Languages whose cross registrars read embedded_types as QNs get their
      * bases resolved against the project registry; everyone else keeps the
      * raw source spelling their own registrar already knows how to handle. */
@@ -400,14 +421,42 @@ static int pxc_build_lsp_def(CBMArena *arena, const CBMDefinition *src, const ch
                               ? pxc_join_base_qns(arena, src->base_classes, reg, module_qn,
                                                   imp_keys, imp_vals, imp_count)
                               : pxc_join_pipe(arena, src->base_classes);
-    dst->signature_param_types = src->signature_param_types;
-    dst->signature_param_count = src->signature_param_count;
+    dst->signature_param_types = NULL;
+    dst->signature_param_count = 0;
+    if (src->signature_param_types && src->signature_param_count > 0) {
+        const char **types = (const char **)cbm_arena_alloc(
+            arena, (size_t)src->signature_param_count * sizeof(const char *));
+        if (types) {
+            for (int i = 0; i < src->signature_param_count; i++) {
+                types[i] = src->signature_param_types[i]
+                               ? cbm_arena_strdup(arena, src->signature_param_types[i])
+                               : NULL;
+            }
+            dst->signature_param_types = types;
+            dst->signature_param_count = src->signature_param_count;
+        }
+    }
     dst->lang = lang;
-    dst->decorators = src->decorators;
+    dst->decorators = NULL;
+    if (src->decorators) {
+        int n = 0;
+        while (src->decorators[n]) {
+            n++;
+        }
+        const char **decos =
+            (const char **)cbm_arena_alloc(arena, (size_t)(n + 1) * sizeof(const char *));
+        if (decos) {
+            for (int i = 0; i < n; i++) {
+                decos[i] = cbm_arena_strdup(arena, src->decorators[i]);
+            }
+            decos[n] = NULL;
+            dst->decorators = decos;
+        }
+    }
     if (lang == CBM_LANG_RUST) {
         /* Exact impl-block provenance is captured while the Rust impl node is
          * still on hand.  Do not reconstruct it later from leaf names. */
-        dst->trait_qn = src->impl_trait;
+        dst->trait_qn = src->impl_trait ? cbm_arena_strdup(arena, src->impl_trait) : NULL;
         dst->is_abstract = src->is_abstract;
     }
     return 0;
@@ -490,14 +539,14 @@ static int pxc_build_rust_impl_relation(CBMArena *arena, const CBMImplTrait *imp
     if (!arena || !impl || !impl->trait_name || !impl->struct_name || !impl->struct_qn) {
         return -1;
     }
-    const char *receiver_qn = impl->struct_qn;
+    const char *receiver_qn = cbm_arena_strdup(arena, impl->struct_qn);
     memset(dst, 0, sizeof(*dst));
     dst->qualified_name = receiver_qn;
     dst->short_name = pxc_qn_leaf(receiver_qn);
     dst->label = "RustImpl";
     dst->receiver_type = receiver_qn;
     dst->def_module_qn = module_qn;
-    dst->trait_qn = impl->trait_name; /* raw; canonicalized by Rust registry */
+    dst->trait_qn = cbm_arena_strdup(arena, impl->trait_name); /* raw; canonicalized later */
     dst->lang = CBM_LANG_RUST;
     dst->is_rust_impl_relation = true;
     return 0;
@@ -506,17 +555,24 @@ static int pxc_build_rust_impl_relation(CBMArena *arena, const CBMImplTrait *imp
 /* Collect a project-wide CBMLSPDef[] from all cached results. Returns a
  * malloc'd array (caller frees) of length *out_count. String fields are
  * borrowed from cache[i]->arena and from def_modules[i] (also borrowed). */
-CBMLSPDef *cbm_pxc_collect_all_defs(const cbm_pipeline_ctx_t *ctx, CBMFileResult **cache,
-                                    const cbm_file_info_t *files, int file_count,
-                                    const char *project_name, char **def_modules, int *out_count,
-                                    int *out_def_starts) {
+CBMLSPDef *cbm_pxc_collect_all_defs(const cbm_pipeline_ctx_t *ctx, CBMArena *arena,
+                                    CBMFileResult **cache, const cbm_file_info_t *files,
+                                    int file_count, const char *project_name, char **def_modules,
+                                    int *out_count, int *out_def_starts) {
+    const cbm_result_spill_t *spill = ctx ? ctx->spill : NULL;
     int total = 0;
     for (int i = 0; i < file_count; i++) {
+        int defs = 0;
+        int impls = 0;
         if (cache[i]) {
-            total += cache[i]->defs.count;
-            if (files[i].language == CBM_LANG_RUST) {
-                total += cache[i]->impl_traits.count;
-            }
+            defs = cache[i]->defs.count;
+            impls = cache[i]->impl_traits.count;
+        } else if (spill && cbm_result_spill_has(spill, i)) {
+            cbm_result_spill_peek_counts(spill, i, &defs, &impls);
+        }
+        total += defs;
+        if (files[i].language == CBM_LANG_RUST) {
+            total += impls;
         }
     }
     if (total == 0) {
@@ -540,19 +596,21 @@ CBMLSPDef *cbm_pxc_collect_all_defs(const cbm_pipeline_ctx_t *ctx, CBMFileResult
             out_def_starts[fi] = idx;
         }
         const int file_start = idx;
-        if (!cache[fi])
+        CBMFileResult *fr = cache[fi];
+        bool fr_loaded = false;
+        if (!fr && spill && cbm_result_spill_has(spill, fi)) {
+            fr = cbm_result_spill_load(spill, fi);
+            fr_loaded = fr != NULL;
+        }
+        if (!fr)
             continue;
         if (!def_modules[fi]) {
             def_modules[fi] = cbm_pipeline_fqn_module_dir(project_name, files[fi].rel_path,
                                                           pxc_module_is_dir(files[fi].language));
         }
-        const char *namespace_name = cache[fi]->namespace_name;
+        const char *namespace_name = fr->namespace_name;
         if ((!namespace_name || !namespace_name[0]) && files[fi].rel_path) {
-            namespace_name =
-                pxc_infer_jvm_namespace(&cache[fi]->arena, files[fi].rel_path, files[fi].language);
-            if (namespace_name && namespace_name[0]) {
-                cache[fi]->namespace_name = namespace_name;
-            }
+            namespace_name = pxc_infer_jvm_namespace(arena, files[fi].rel_path, files[fi].language);
         }
         /* One import map per FILE (not per def, and not per base name): the
          * cross-file base-class resolution below needs the same local-name →
@@ -567,29 +625,31 @@ CBMLSPDef *cbm_pxc_collect_all_defs(const cbm_pipeline_ctx_t *ctx, CBMFileResult
         if (ctx && ctx->registry && pxc_lang_resolves_base_qns(files[fi].language)) {
             base_reg = ctx->registry;
             cbm_pxc_build_import_map(ctx->gbuf, project_name, files[fi].rel_path,
-                                     files[fi].language, cache[fi], &imp_keys, &imp_vals,
-                                     &imp_count);
+                                     files[fi].language, fr, &imp_keys, &imp_vals, &imp_count);
         }
-        for (int di = 0; di < cache[fi]->defs.count; di++) {
-            if (pxc_build_lsp_def(&cache[fi]->arena, &cache[fi]->defs.items[di], def_modules[fi],
-                                  namespace_name, files[fi].language, &defs[idx], base_reg,
-                                  imp_keys, imp_vals, imp_count) == 0) {
+        for (int di = 0; di < fr->defs.count; di++) {
+            if (pxc_build_lsp_def(arena, &fr->defs.items[di], def_modules[fi], namespace_name,
+                                  files[fi].language, &defs[idx], base_reg, imp_keys, imp_vals,
+                                  imp_count) == 0) {
                 idx++;
             }
         }
         cbm_pxc_free_import_map(imp_keys, imp_vals, imp_count); /* NULL-safe */
         if (files[fi].language == CBM_LANG_GO) {
-            pxc_fold_go_struct_fields(&cache[fi]->arena, cache[fi], defs, file_start, idx);
+            pxc_fold_go_struct_fields(arena, fr, defs, file_start, idx);
         }
         if (files[fi].language == CBM_LANG_RUST) {
-            for (int ii = 0; ii < cache[fi]->impl_traits.count; ii++) {
-                if (pxc_build_rust_impl_relation(
-                        &cache[fi]->arena, &cache[fi]->impl_traits.items[ii], project_name,
-                        files[fi].rel_path, def_modules[fi], &defs[idx]) == 0) {
+            for (int ii = 0; ii < fr->impl_traits.count; ii++) {
+                if (pxc_build_rust_impl_relation(arena, &fr->impl_traits.items[ii], project_name,
+                                                 files[fi].rel_path, def_modules[fi],
+                                                 &defs[idx]) == 0) {
                     idx++;
                 }
             }
         }
+        if (fr_loaded) {
+            cbm_free_result(fr);
+        }
     }
     if (out_def_starts) {
         out_def_starts[file_count] = idx;
@@ -897,6 +957,73 @@ bool cbm_pxc_has_cross_lsp(CBMLanguage lang) {
     }
 }
 
+/* Per-thread arenas for the per-file scratch below (the walk's overlay and the
+ * append dedup keys), kept rewound between files on a resolve worker that has
+ * promised to drop them at its end (cbm_pxc_thread_scratch_begin/_end).
+ * Opened fresh per file they were 18 k 64 KB-default arenas on the Go corpus,
+ * 1.6 GB allocated and 60 % never written (waste sanitizer, 2026-09-17). An
+ * arena one big file grew past PXC_KEEP_BYTES is dropped, not held; a nested
+ * take finds the slot empty and opens its own. Everywhere else (the sequential
+ * pass) take/give are exactly init/destroy. */
+enum { PXC_SCRATCH_DISPATCH = 0, PXC_SCRATCH_KEYS = 1, PXC_SCRATCH_COUNT = 2 };
+enum { PXC_KEEP_BYTES = 4 * 1024 * 1024 };
+static CBM_TLS bool tl_pxc_keep;
+/* The parked arenas live on the HEAP behind one thread-local pointer. Inline in
+ * thread-local storage they were ~8 KB of static TLS charged to every thread in
+ * the image, and static TLS comes out of each thread's own stack allocation, so
+ * past a certain size a small-stack thread cannot be created at all — which is
+ * precisely how this branch broke the 64 KB parent-death watchdog and, with it,
+ * indexing on x86-64 Linux (PR #2233). The holder is allocated once per
+ * keeping thread, so parking still costs no allocation per file. */
+typedef struct {
+    CBMArena arena[PXC_SCRATCH_COUNT];
+    bool live[PXC_SCRATCH_COUNT];
+} pxc_scratch_t;
+static CBM_TLS pxc_scratch_t *tl_pxc;
+
+static void pxc_scratch_take(int slot, CBMArena *into) {
+    if (tl_pxc && tl_pxc->live[slot]) {
+        *into = tl_pxc->arena[slot];
+        tl_pxc->live[slot] = false;
+        cbm_arena_rewind(into);
+        return;
+    }
+    cbm_arena_init(into);
+}
+
+static void pxc_scratch_give(int slot, CBMArena *from) {
+    if (tl_pxc_keep && from->nblocks > 0 && cbm_arena_capacity(from) <= (size_t)PXC_KEEP_BYTES) {
+        if (!tl_pxc) {
+            tl_pxc = cbm_calloc(CBM_MEM_CLASS_OTHER, sizeof(pxc_scratch_t));
+        }
+        if (tl_pxc && !tl_pxc->live[slot]) {
+            tl_pxc->arena[slot] = *from;
+            tl_pxc->live[slot] = true;
+            memset(from, 0, sizeof(*from));
+            return;
+        }
+    }
+    cbm_arena_destroy(from);
+}
+
+void cbm_pxc_thread_scratch_begin(void) {
+    tl_pxc_keep = true;
+}
+
+void cbm_pxc_thread_scratch_end(void) {
+    if (tl_pxc) {
+        for (int slot = 0; slot < PXC_SCRATCH_COUNT; slot++) {
+            if (tl_pxc->live[slot]) {
+                cbm_arena_destroy(&tl_pxc->arena[slot]);
+                tl_pxc->live[slot] = false;
+            }
+        }
+        cbm_free(CBM_MEM_CLASS_OTHER, tl_pxc);
+        tl_pxc = NULL;
+    }
+    tl_pxc_keep = false;
+}
+
 /* Append cross-file results from `src_out` (allocated in a scratch arena
  * about to be destroyed) into `dst_calls` (lives in cache_entry->arena),
  * copying every string field into dst_arena. A manifest-qualified Rust
@@ -921,7 +1048,7 @@ static void pxc_append_results(CBMArena *dst_arena, CBMResolvedCallArray *dst_ca
         return;
 
     CBMArena keys;
-    cbm_arena_init(&keys);
+    pxc_scratch_take(PXC_SCRATCH_KEYS, &keys);
     CBMHashTable *seen = cbm_ht_create((uint32_t)(dst_calls->count + src_out->count + 1));
 
     /* Per-file Rust resolution may already have confidently matched the tail
@@ -1014,7 +1141,7 @@ static void pxc_append_results(CBMArena *dst_arena, CBMResolvedCallArray *dst_ca
     }
 
     cbm_ht_free(seen);
-    cbm_arena_destroy(&keys);
+    pxc_scratch_give(PXC_SCRATCH_KEYS, &keys);
 }
 
 /* Merge exact synthetic call carriers produced by a cross-LSP resolver. The
@@ -1028,7 +1155,7 @@ static void pxc_append_synthetic_calls(CBMArena *dst_arena, CBMCallArray *dst_ca
         return;
 
     CBMArena keys;
-    cbm_arena_init(&keys);
+    pxc_scratch_take(PXC_SCRATCH_KEYS, &keys);
     CBMHashTable *seen = cbm_ht_create((uint32_t)(dst_calls->count + src_calls->count + 1));
 
     for (int i = 0; i < dst_calls->count; i++) {
@@ -1065,7 +1192,15 @@ static void pxc_append_synthetic_calls(CBMArena *dst_arena, CBMCallArray *dst_ca
             src->first_string_arg ? cbm_arena_strdup(dst_arena, src->first_string_arg) : NULL;
         dst.second_arg_name =
             src->second_arg_name ? cbm_arena_strdup(dst_arena, src->second_arg_name) : NULL;
-        for (int ai = 0; ai < CBM_MAX_CALL_ARGS; ai++) {
+        dst.args = NULL;
+        if (src->args && src->arg_count > 0) {
+            dst.args = cbm_arena_calloc(dst_arena, (size_t)src->arg_count * sizeof(CBMCallArg));
+            if (!dst.args) {
+                dst.arg_count = 0;
+            }
+        }
+        for (int ai = 0; dst.args && ai < src->arg_count; ai++) {
+            dst.args[ai].index = src->args[ai].index;
             dst.args[ai].expr =
                 src->args[ai].expr ? cbm_arena_strdup(dst_arena, src->args[ai].expr) : NULL;
             dst.args[ai].value =
@@ -1079,7 +1214,7 @@ static void pxc_append_synthetic_calls(CBMArena *dst_arena, CBMCallArray *dst_ca
     }
 
     cbm_ht_free(seen);
-    cbm_arena_destroy(&keys);
+    pxc_scratch_give(PXC_SCRATCH_KEYS, &keys);
 }
 
 /* ── Rust workspace manifest (Cargo.toml) for cross-CRATE resolution ──
@@ -1147,7 +1282,7 @@ void cbm_pxc_run_one(CBMLanguage lang, CBMFileResult *r, const char *source, int
     TSTree *tree = r->cached_tree; /* may be NULL — LSP re-parses then */
 
     CBMArena scratch;
-    cbm_arena_init(&scratch);
+    pxc_scratch_take(PXC_SCRATCH_DISPATCH, &scratch);
     CBMResolvedCallArray out;
     memset(&out, 0, sizeof(out));
     CBMCallArray synthetic_calls;
@@ -1204,7 +1339,7 @@ void cbm_pxc_run_one(CBMLanguage lang, CBMFileResult *r, const char *source, int
 
     pxc_append_results(&r->arena, &r->resolved_calls, &out);
     pxc_append_synthetic_calls(&r->arena, &r->calls, &synthetic_calls);
-    cbm_arena_destroy(&scratch);
+    pxc_scratch_give(PXC_SCRATCH_DISPATCH, &scratch);
 }
 
 /* Variant of cbm_pxc_run_one for TS/JS/JSX/TSX with explicit dialect
@@ -1214,7 +1349,7 @@ void cbm_pxc_run_one_ts(CBMFileResult *r, const char *source, int source_len, co
                         const char **imp_qns, int imp_count, bool js_mode, bool jsx_mode,
                         bool dts_mode) {
     CBMArena scratch;
-    cbm_arena_init(&scratch);
+    pxc_scratch_take(PXC_SCRATCH_DISPATCH, &scratch);
     CBMResolvedCallArray out;
     memset(&out, 0, sizeof(out));
 
@@ -1222,7 +1357,7 @@ void cbm_pxc_run_one_ts(CBMFileResult *r, const char *source, int source_len, co
                          def_count, imp_names, imp_qns, imp_count, r->cached_tree, &out);
 
     pxc_append_results(&r->arena, &r->resolved_calls, &out);
-    cbm_arena_destroy(&scratch);
+    pxc_scratch_give(PXC_SCRATCH_DISPATCH, &scratch);
 }
 
 /* Parse the project's root Cargo.toml (if present) into `out_m`, using
@@ -1272,6 +1407,10 @@ void cbm_pxc_filter_stats(uint64_t *defs_registered, uint64_t *build_files, uint
         *filter_failed = atomic_load_explicit(&g_pxc_filter_failed, memory_order_relaxed);
 }
 
+/* A file the extractor marked lsp_skipped (its parse alone used more than its
+ * share of the per-file budget) takes no cross-file resolve either: the same
+ * tree the per-file walk could not afford. One check for every language and
+ * both drivers. */
 void cbm_pxc_dispatch_file(CBMLanguage lang, CBMFileResult *result, const char *source,
                            int source_len, const char *rel, const char *def_module,
                            const CBMCrossLspRegistries *cross_registries,
@@ -1279,6 +1418,9 @@ void cbm_pxc_dispatch_file(CBMLanguage lang, CBMFileResult *result, const char *
                            int all_def_count, const char **imp_keys, const char **imp_vals,
                            int imp_count, CBMTypeRegistry *(*rust_shared_get)(void *),
                            void *rust_shared_ctx) {
+    if (result && result->lsp_skipped) {
+        return;
+    }
     if (!result) {
         return;
     }
@@ -1286,63 +1428,64 @@ void cbm_pxc_dispatch_file(CBMLanguage lang, CBMFileResult *result, const char *
     CBMTypeRegistry *prebuilt =
         cross_registries ? cbm_pxc_registry_for_lang(cross_registries, lang) : NULL;
     if (prebuilt) {
+        /* One lifecycle for every language (2026-09-13): the walk runs in a
+         * scratch arena against a per-file OVERLAY registry chained to the
+         * immutable shared base; whatever it registers or refines lands in
+         * the overlay and dies with the file; only the resolved calls it
+         * produces are copied into the result. Before this, Go/C/C#/Java/TS
+         * were handed the RESULT arena (and C/C#/TS the shared base to write
+         * into): the kernel proof measured that as 4.4 GB of resolve-time
+         * growth in retained results plus arena pointers stored into the
+         * shared registry -- a use-after-free class the moment the arena was
+         * not the result arena (ASan, lsp_resolution_probe). */
+        CBMArena scratch;
+        pxc_scratch_take(PXC_SCRATCH_DISPATCH, &scratch);
+        CBMTypeRegistry overlay;
+        cbm_registry_init(&overlay, &scratch);
+        overlay.fallback = prebuilt;
+        CBMResolvedCallArray out = {0};
+        CBMCallArray synthetic_calls = {0};
         switch (lang) {
         case CBM_LANG_GO:
             /* Tier 3 (metadata-driven): pure lookup over the Tier-1
-             * lsp_unresolved entries — no parse, no AST walk. Then the
-             * AST walk on the shared Tier-2 registry (mirroring every
-             * other language) so NAMED receivers evaluated against
-             * project-wide defs also resolve. The walk variant below is
-             * read-only — the sealed registry is safe for parallel
-             * workers. */
+             * lsp_unresolved entries -- no parse, no AST walk -- then the
+             * AST walk against the overlay (chained to the sealed base). */
             cbm_go_fast_resolve_qualified_calls(result, prebuilt, imp_keys, imp_vals, imp_count);
-            cbm_run_go_lsp_cross_with_registry(&result->arena, source, source_len, def_module,
-                                               prebuilt, imp_keys, imp_vals, imp_count,
-                                               result->cached_tree, &result->resolved_calls);
+            cbm_run_go_lsp_cross_with_registry(&scratch, source, source_len, def_module, &overlay,
+                                               imp_keys, imp_vals, imp_count, result->cached_tree,
+                                               &out);
             used_prebuilt = true;
             break;
-        case CBM_LANG_PYTHON: {
-            CBMArena scratch;
-            cbm_arena_init(&scratch);
-            CBMResolvedCallArray out = {0};
-            CBMCallArray synthetic_calls = {0};
-            cbm_run_py_lsp_cross_with_registry(&scratch, source, source_len, def_module, prebuilt,
+        case CBM_LANG_PYTHON:
+            cbm_run_py_lsp_cross_with_registry(&scratch, source, source_len, def_module, &overlay,
                                                imp_keys, imp_vals, imp_count, result->cached_tree,
                                                &out, &synthetic_calls);
-            pxc_append_results(&result->arena, &result->resolved_calls, &out);
-            pxc_append_synthetic_calls(&result->arena, &result->calls, &synthetic_calls);
-            cbm_arena_destroy(&scratch);
             used_prebuilt = true;
             break;
-        }
         case CBM_LANG_C:
         case CBM_LANG_CPP:
         case CBM_LANG_CUDA:
-            cbm_run_c_lsp_cross_with_registry(
-                &result->arena, source, source_len, def_module, (lang != CBM_LANG_C), prebuilt,
-                imp_keys, imp_vals, imp_count, result->cached_tree, &result->resolved_calls);
+            cbm_run_c_lsp_cross_with_registry(&scratch, source, source_len, def_module,
+                                              (lang != CBM_LANG_C), &overlay, imp_keys, imp_vals,
+                                              imp_count, result->cached_tree, &out);
             used_prebuilt = true;
             break;
         case CBM_LANG_CSHARP:
-            cbm_run_cs_lsp_cross_with_registry(&result->arena, source, source_len, def_module,
-                                               prebuilt, imp_vals, imp_count, result->cached_tree,
-                                               &result->resolved_calls);
+            cbm_run_cs_lsp_cross_with_registry(&scratch, source, source_len, def_module, &overlay,
+                                               imp_vals, imp_count, result->cached_tree, &out);
             used_prebuilt = true;
             break;
         case CBM_LANG_JAVA:
-            /* Own-module defs go into a per-file overlay; imports and stdlib
-             * resolve through the shared base (#1669). */
-            cbm_run_java_lsp_cross_with_registry(
-                &result->arena, result, source, source_len, def_module, prebuilt, imp_keys,
-                imp_vals, imp_count, result->cached_tree, &result->resolved_calls);
+            /* Java builds its own-module overlay on top of the one it is
+             * handed; both live in scratch now. */
+            cbm_run_java_lsp_cross_with_registry(&scratch, result, source, source_len, def_module,
+                                                 &overlay, imp_keys, imp_vals, imp_count,
+                                                 result->cached_tree, &out);
             used_prebuilt = true;
             break;
         case CBM_LANG_JAVASCRIPT:
         case CBM_LANG_TYPESCRIPT:
         case CBM_LANG_TSX: {
-            /* TS: per-file OVERLAY chained to the shared base. Filter to
-             * own+imports so the overlay builder can pick out own-module
-             * defs without scanning the whole project. */
             bool js;
             bool jsx;
             bool dts;
@@ -1361,10 +1504,9 @@ void cbm_pxc_dispatch_file(CBMLanguage lang, CBMFileResult *result, const char *
                     ts_def_count = fc;
                 }
             }
-            cbm_run_ts_lsp_cross_with_registry(&result->arena, source, source_len, def_module, js,
-                                               jsx, dts, prebuilt, ts_defs, ts_def_count, imp_keys,
-                                               imp_vals, imp_count, result->cached_tree,
-                                               &result->resolved_calls);
+            cbm_run_ts_lsp_cross_with_registry(&scratch, source, source_len, def_module, js, jsx,
+                                               dts, &overlay, ts_defs, ts_def_count, imp_keys,
+                                               imp_vals, imp_count, result->cached_tree, &out);
             free(ts_filtered);
             used_prebuilt = true;
             break;
@@ -1374,6 +1516,11 @@ void cbm_pxc_dispatch_file(CBMLanguage lang, CBMFileResult *result, const char *
         default:
             break;
         }
+        if (used_prebuilt) {
+            pxc_append_results(&result->arena, &result->resolved_calls, &out);
+            pxc_append_synthetic_calls(&result->arena, &result->calls, &synthetic_calls);
+        }
+        pxc_scratch_give(PXC_SCRATCH_DISPATCH, &scratch);
     }
 
     if (used_prebuilt) {
@@ -1414,7 +1561,7 @@ void cbm_pxc_dispatch_file(CBMLanguage lang, CBMFileResult *result, const char *
         CBMTypeRegistry *shared = rust_shared_get ? rust_shared_get(rust_shared_ctx) : NULL;
         if (shared) {
             CBMArena scratch;
-            cbm_arena_init(&scratch);
+            pxc_scratch_take(PXC_SCRATCH_DISPATCH, &scratch);
             CBMResolvedCallArray out = {0};
             CBMCallArray synthetic_calls = {0};
             cbm_run_rust_lsp_cross_with_registry(
@@ -1422,7 +1569,7 @@ void cbm_pxc_dispatch_file(CBMLanguage lang, CBMFileResult *result, const char *
                 result->cached_tree, cbm_pxc_get_rust_manifest(), &out, &synthetic_calls);
             pxc_append_results(&result->arena, &result->resolved_calls, &out);
             pxc_append_synthetic_calls(&result->arena, &result->calls, &synthetic_calls);
-            cbm_arena_destroy(&scratch);
+            pxc_scratch_give(PXC_SCRATCH_DISPATCH, &scratch);
         } else {
             cbm_pxc_run_one(lang, result, source, source_len, def_module, file_defs, file_def_count,
                             imp_keys, imp_vals, imp_count);
@@ -1498,15 +1645,22 @@ int cbm_pipeline_pass_lsp_cross(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *
 
     int def_count = 0;
     int *def_starts = (int *)calloc((size_t)file_count + 1, sizeof(int));
-    CBMLSPDef *all_defs = cbm_pxc_collect_all_defs(ctx, cache, files, file_count, ctx->project_name,
-                                                   def_modules, &def_count, def_starts);
+    /* The defs own their strings in the caller-owned seq_cross_arena, which
+     * the registries and later passes already borrow from (see below). */
+    if (!ctx->seq_cross_arena_live) {
+        cbm_arena_init(&ctx->seq_cross_arena);
+        ctx->seq_cross_arena_live = true;
+    }
+    CBMLSPDef *all_defs =
+        cbm_pxc_collect_all_defs(ctx, &ctx->seq_cross_arena, cache, files, file_count,
+                                 ctx->project_name, def_modules, &def_count, def_starts);
     /* Same seam as the parallel driver: serialize per-file surfaces while the
      * result cache is alive. Failure only degrades to a full rebuild on the
      * next incremental run. */
     if (ctx->pipeline && all_defs && def_starts) {
         cbm_lsp_surface_row_t *surface_rows = NULL;
         int surface_count = 0;
-        if (cbm_lsp_surface_build_rows(ctx->project_name, cache, files, file_count, all_defs,
+        if (cbm_lsp_surface_build_rows(ctx, ctx->project_name, cache, files, file_count, all_defs,
                                        def_starts, &surface_rows, &surface_count) == 0) {
             cbm_pipeline_set_lsp_surfaces(ctx->pipeline, surface_rows, surface_count);
         }
diff --git a/src/pipeline/pass_lsp_cross.h b/src/pipeline/pass_lsp_cross.h
index 705b804cc..5bf9ba5d5 100644
--- a/src/pipeline/pass_lsp_cross.h
+++ b/src/pipeline/pass_lsp_cross.h
@@ -63,10 +63,10 @@ bool cbm_pxc_has_cross_lsp(CBMLanguage lang);
  * inputs pass_semantic uses to draw its INHERITS edge, so the LSP's
  * inheritance view and the graph's cannot diverge. Pass NULL to keep the raw
  * source spelling (surface-probe paths that build no registry). */
-CBMLSPDef *cbm_pxc_collect_all_defs(const cbm_pipeline_ctx_t *ctx, CBMFileResult **cache,
-                                    const cbm_file_info_t *files, int file_count,
-                                    const char *project_name, char **def_modules, int *out_count,
-                                    int *out_def_starts);
+CBMLSPDef *cbm_pxc_collect_all_defs(const cbm_pipeline_ctx_t *ctx, CBMArena *arena,
+                                    CBMFileResult **cache, const cbm_file_info_t *files,
+                                    int file_count, const char *project_name, char **def_modules,
+                                    int *out_count, int *out_def_starts);
 
 /* Detect TS dialect flags from a relative path. */
 void cbm_pxc_ts_modes(CBMLanguage lang, const char *rel_path, bool *out_js, bool *out_jsx,
@@ -187,6 +187,10 @@ struct CBMCargoManifest;
 bool cbm_pxc_build_rust_manifest(const cbm_pipeline_ctx_t *ctx, CBMArena *manifest_arena,
                                  struct CBMCargoManifest *out_manifest);
 void cbm_pxc_set_rust_manifest(const struct CBMCargoManifest *manifest);
+/* A resolve worker keeps its per-file cross-LSP scratch arenas between files
+ * from _begin to _end; _end must run on the same thread before it exits. */
+void cbm_pxc_thread_scratch_begin(void);
+void cbm_pxc_thread_scratch_end(void);
 const struct CBMCargoManifest *cbm_pxc_get_rust_manifest(void);
 
 /* Run the cross-file LSP resolver for non-TS languages. Appends
diff --git a/src/pipeline/pass_parallel.c b/src/pipeline/pass_parallel.c
index 759c199f6..e85ad015f 100644
--- a/src/pipeline/pass_parallel.c
+++ b/src/pipeline/pass_parallel.c
@@ -70,6 +70,8 @@ enum { PP_CSHARP_M_PREFIX_LEN = 2 };
 #define PP_RETAIN_PER_FILE_HARD_MAX_BYTES (32ULL * 1024 * 1024) /* 32 MiB per file */
 #include "pipeline/pipeline.h"
 #include "pipeline/pipeline_internal.h"
+#include "result_spill.h"
+#include "foundation/platform.h"     /* cbm_resolve_cache_dir */
 #include "pipeline/pass_lsp_cross.h" /* cbm_pxc_* helpers for fused cross-file LSP */
 #include "pipeline/lsp_resolve.h"
 #include "lsp/rust_cargo.h"
@@ -78,6 +80,7 @@ enum { PP_CSHARP_M_PREFIX_LEN = 2 };
 #include "foundation/compat.h"
 #include "foundation/compat_fs.h"
 #include "foundation/compat_thread.h"
+#include "foundation/mem_core.h"
 #include "graph_buffer/graph_buffer.h"
 #include "service_patterns.h"
 #include "foundation/platform.h"
@@ -649,6 +652,12 @@ typedef struct {
     _Atomic int64_t *shared_ids;
     _Atomic int *cancelled;
     _Atomic int next_file_idx;
+    cbm_pipeline_ctx_t *pctx;         /* spill store + mode latch live here */
+    _Atomic uint8_t *slot_state;      /* per file: 0 in progress, 1 cached, 2 parked */
+    _Atomic int spill_sweeps_running; /* workers inside pp_spill_sweep right now */
+    int spill_env;        /* CBM_MEM_SPILL for this run: 1 force, 0 off, 2 budget decides */
+    cbm_mutex_t spill_mu; /* serializes the one store open */
+    _Atomic int spill_unavailable; /* store could not open: never retry */
 
     cbm_pkg_entries_t *pkg_entries; /* per-worker manifest arrays (separate allocation) */
 
@@ -762,13 +771,212 @@ static void pp_fail_whole_over_budget(extract_ctx_t *ec) {
     }
 }
 
+/* ── Spill / admission control ──────────────────────────────────────── */
+
+/* Spill mode is entered this fraction short of the budget: 1/16 = 6.25%,
+ * ~940 MB at 15 GB, above the 4% the kernel's in-flight files were measured
+ * to carry past the line. */
+enum { PP_SPILL_EARLY_DIV = 16 };
+
+/* CBM_MEM_SPILL=1 forces spill mode from the first file (tests, small
+ * machines); CBM_MEM_SPILL=0 keeps results in memory even over budget. Read
+ * once per extraction run, never cached per process: a test toggles it. */
+static int pp_spill_env_read(void) {
+    char buf[CBM_SZ_16];
+    if (cbm_safe_getenv("CBM_MEM_SPILL", buf, sizeof(buf), NULL)) {
+        return buf[0] == '1' ? 1 : 0;
+    }
+    return 2; /* unset: the budget decides */
+}
+static bool pp_spill_forced_by_env(const extract_ctx_t *ec) {
+    return ec->spill_env == 1;
+}
+static bool pp_spill_allowed(const extract_ctx_t *ec) {
+    return ec->spill_env != 0;
+}
+
+/* Latch spill mode (once) and open the store. The store is open BEFORE the
+ * latch is visible: a peer that reads the latch must also find the store, or
+ * it sees "nothing to park" while this worker is still opening files and runs
+ * the futility cycle instead of joining the sweep (kernel, 16 GB budget,
+ * 2026-09-13: the abort fired before the first sweep had logged). Never fails
+ * the run: without a store the results simply stay in memory and the nap /
+ * futility path applies as before. */
+static void pp_spill_enter(extract_ctx_t *ec, const char *reason) {
+    if (!ec->pctx || !ec->pctx->spill_allowed || !pp_spill_allowed(ec)) {
+        return;
+    }
+    if (atomic_load_explicit(&ec->pctx->spill_mode, memory_order_acquire) != 0 ||
+        atomic_load_explicit(&ec->spill_unavailable, memory_order_relaxed) != 0) {
+        return;
+    }
+    cbm_mutex_lock(&ec->spill_mu);
+    if (atomic_load_explicit(&ec->pctx->spill_mode, memory_order_acquire) == 0 &&
+        atomic_load_explicit(&ec->spill_unavailable, memory_order_relaxed) == 0) {
+        if (!ec->pctx->spill) {
+            ec->pctx->spill =
+                cbm_result_spill_open(cbm_resolve_cache_dir(), ec->max_workers, ec->file_count);
+        }
+        size_t mb = (size_t)1024 * 1024;
+        cbm_log_warn("mem.spill.on", "reason", reason, "charged_mb",
+                     itoa_log((int)(cbm_mem_charged() / mb)), "budget_mb",
+                     itoa_log((int)(cbm_mem_budget() / mb)), "store",
+                     ec->pctx->spill ? "open" : "unavailable");
+        if (ec->pctx->spill) {
+            atomic_store_explicit(&ec->pctx->spill_mode, 1, memory_order_release);
+        } else {
+            atomic_store_explicit(&ec->spill_unavailable, 1, memory_order_relaxed);
+        }
+    }
+    cbm_mutex_unlock(&ec->spill_mu);
+}
+
+static bool pp_spill_active(const extract_ctx_t *ec) {
+    /* The atomic gates the pointer, not the other way round. pp_spill_enter
+     * assigns ec->pctx->spill under spill_mu and only THEN release-stores
+     * spill_mode, so a reader that has acquired a non-zero spill_mode is
+     * guaranteed to see the finished pointer. Testing the pointer first read it
+     * with no synchronisation at all while another worker was publishing it —
+     * a genuine data race on an 8-byte write, which TSan caught at
+     * pass_parallel.c:817 against this line. Short-circuit order is load
+     * bearing here; do not reorder these terms. */
+    return ec->pctx && atomic_load_explicit(&ec->pctx->spill_mode, memory_order_acquire) != 0 &&
+           ec->pctx->spill;
+}
+
+CBMFileResult *cbm_pipeline_result_acquire(const cbm_pipeline_ctx_t *ctx, CBMFileResult **cache,
+                                           int i, cbm_result_want_fn want, bool *loaded) {
+    *loaded = false;
+    if (cache && cache[i]) {
+        return (!want || want(cache[i])) ? cache[i] : NULL;
+    }
+    if (!ctx || !ctx->spill || !cbm_result_spill_has(ctx->spill, i)) {
+        return NULL;
+    }
+    if (want) {
+        CBMFileResult hdr;
+        if (!cbm_result_spill_peek_header(ctx->spill, i, &hdr) || !want(&hdr)) {
+            return NULL;
+        }
+    }
+    CBMFileResult *r = cbm_result_spill_load(ctx->spill, i);
+    *loaded = r != NULL;
+    return r;
+}
+
+void cbm_pipeline_result_release(CBMFileResult *r, bool loaded) {
+    if (r && loaded) {
+        cbm_free_result(r);
+    }
+}
+
+void cbm_pipeline_spill_close(cbm_pipeline_ctx_t *ctx) {
+    if (!ctx || !ctx->spill) {
+        return;
+    }
+    int64_t parked = 0;
+    int64_t bytes = 0;
+    int64_t loads = 0;
+    cbm_result_spill_stats(ctx->spill, &parked, &bytes, &loads);
+    cbm_log_info("mem.spill.done", "parked", itoa_log((int)parked), "mb",
+                 itoa_log((int)(bytes / (1024 * 1024))), "loads", itoa_log((int)loads));
+    cbm_result_spill_close(ctx->spill);
+    ctx->spill = NULL;
+    atomic_store_explicit(&ctx->spill_mode, 0, memory_order_release);
+    cbm_work_arena_release();
+}
+
+/* Park every cached result that is complete. Slots are claimed 1 -> 2 so two
+ * workers never park the same result; a failed park hands the slot back. */
+/* True while a cached (not yet parked) result exists or a sweep is running:
+ * memory can still come down without anyone napping. */
+static bool pp_spill_work_remains(const extract_ctx_t *ec) {
+    if (!ec->slot_state) {
+        return false;
+    }
+    if (atomic_load_explicit(&ec->spill_sweeps_running, memory_order_acquire) > 0) {
+        return true;
+    }
+    for (int i = 0; i < ec->file_count; i++) {
+        if (atomic_load_explicit(&ec->slot_state[i], memory_order_relaxed) == 1) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static int pp_spill_sweep(extract_ctx_t *ec, int worker_id) {
+    if (!pp_spill_active(ec) || !ec->slot_state) {
+        return 0;
+    }
+    atomic_fetch_add_explicit(&ec->spill_sweeps_running, 1, memory_order_acq_rel);
+    int parked = 0;
+    for (int i = 0; i < ec->file_count; i++) {
+        if (atomic_load_explicit(&ec->over_budget_abort, memory_order_relaxed)) {
+            break;
+        }
+        uint8_t expected = 1;
+        if (!atomic_compare_exchange_strong_explicit(&ec->slot_state[i], &expected, (uint8_t)2,
+                                                     memory_order_acq_rel, memory_order_relaxed)) {
+            continue;
+        }
+        CBMFileResult *r = ec->result_cache[i];
+        if (r && cbm_result_spill_park(ec->pctx->spill, worker_id, i, r)) {
+            ec->result_cache[i] = NULL;
+            parked++;
+            if ((parked & 255) == 0) {
+                cbm_mem_release_to_os();
+            }
+        } else {
+            atomic_store_explicit(&ec->slot_state[i], (uint8_t)1, memory_order_release);
+        }
+    }
+    if (parked > 0) {
+        cbm_mem_release_to_os();
+        cbm_log_info("mem.spill.sweep", "parked", itoa_log(parked), "charged_mb",
+                     itoa_log((int)(cbm_mem_charged() / ((size_t)1024 * 1024))));
+    }
+    atomic_fetch_sub_explicit(&ec->spill_sweeps_running, 1, memory_order_acq_rel);
+    return parked;
+}
+
+/* Diagnostic (CBM_MEM_PHASES=1): where does the charge go between the
+ * near-budget latch and the first over-budget observation? One line per
+ * 256 MB step of the charge above its last logged value while spill mode is
+ * on, and one at the first over-budget observation, each with the
+ * footprint / commit / tracked breakdown and the class table. */
+static _Atomic size_t g_probe_last_mb = 0;
+static _Atomic int g_probe_over_logged = 0;
+static void pp_charge_probe(extract_ctx_t *ec, bool over) {
+    if (!cbm_mem_phases_enabled() || !pp_spill_active(ec)) {
+        return;
+    }
+    enum { PROBE_STEP_MB = 256, PROBE_MB = 1024 * 1024 };
+    size_t charged_mb = cbm_mem_charged() / PROBE_MB;
+    size_t last = atomic_load_explicit(&g_probe_last_mb, memory_order_relaxed);
+    bool step = charged_mb >= last + PROBE_STEP_MB &&
+                atomic_compare_exchange_strong_explicit(&g_probe_last_mb, &last, charged_mb,
+                                                        memory_order_relaxed, memory_order_relaxed);
+    bool first_over =
+        over && atomic_exchange_explicit(&g_probe_over_logged, 1, memory_order_relaxed) == 0;
+    if (!step && !first_over) {
+        return;
+    }
+    cbm_log_info("mem.charge.probe", "event", first_over ? "first_over" : "step", "charged_mb",
+                 itoa_log((int)charged_mb), "footprint_mb",
+                 itoa_log((int)(cbm_mem_footprint() / PROBE_MB)), "commit_mb",
+                 itoa_log((int)(cbm_mem_allocator_committed() / PROBE_MB)), "tracked_mb",
+                 itoa_log((int)(cbm_mem_tracked_live_bytes() / PROBE_MB)));
+    cbm_mem_class_log(first_over ? "charge.first_over" : "charge.step");
+}
+
 static void extract_worker(int worker_id, void *ctx_ptr) {
     extract_ctx_t *ec = ctx_ptr;
     extract_worker_state_t *ws = &ec->workers[worker_id];
 
     /* Lazy gbuf creation */
     if (!ws->local_gbuf) {
-        ws->local_gbuf = cbm_gbuf_new_shared_ids(ec->project_name, ec->repo_path, ec->shared_ids);
+        ws->local_gbuf = cbm_gbuf_new_worker(ec->project_name, ec->repo_path, ec->shared_ids);
     }
 
     /* Pull files from shared atomic counter */
@@ -805,6 +1013,49 @@ static void extract_worker(int worker_id, void *ctx_ptr) {
          * and the previously serving index keeps answering. */
         if (cbm_mem_budget() > 0) {
             bool over = cbm_mem_over_budget();
+            pp_charge_probe(ec, over);
+            /* Anticipation: the gate sees the crossing per file pull, and the
+             * workers' in-flight files carry the charge past the line before
+             * the first sweep lands (kernel, 15 GB budget: high-water 15.65
+             * GB, 4% over, all of it set in that window). Spill mode is
+             * entered PP_SPILL_EARLY_DIV-th short of the budget, so results
+             * stop accumulating in memory while the headroom still covers the
+             * in-flight work. The nap / futility path still keys on the
+             * budget itself. */
+            if (!over && !pp_spill_active(ec)) {
+                size_t budget = cbm_mem_budget();
+                if (cbm_mem_charged() > budget - budget / PP_SPILL_EARLY_DIV) {
+                    pp_spill_enter(ec, "near_budget");
+                }
+            }
+            /* The MACHINE can be out of memory while our own charge sits well
+             * under the budget: measured 2026-09-18 on a 48 GB host, 22 GB
+             * charged against a 24 GB budget, and the OS killed the worker
+             * anyway because a VM held the rest. Spill on real scarcity too.
+             * RELIEF ONLY — `over` is deliberately NOT set from this, so the
+             * futility/abort path below stays keyed to OUR budget. Another
+             * process's allocation spike must never fail this run.
+             * The cheap charge comparison guards the syscall, so the pressure
+             * query costs nothing until we are already in the danger zone. */
+            if (!pp_spill_active(ec) && cbm_mem_charged() > cbm_mem_budget() / 2 &&
+                cbm_mem_system_under_pressure()) {
+                pp_spill_enter(ec, "system_pressure");
+                (void)pp_spill_sweep(ec, worker_id);
+            }
+            bool settling = false;
+            if (over) {
+                /* Admission control, first response: park what can be parked.
+                 * Only what is still over budget after that -- the floor --
+                 * reaches the nap / futility / abort path below, and only
+                 * once nothing is left to park anywhere. */
+                pp_spill_enter(ec, "over_budget");
+                int parked = pp_spill_sweep(ec, worker_id);
+                over = cbm_mem_over_budget();
+                if (over && pp_spill_active(ec) && (parked > 0 || pp_spill_work_remains(ec))) {
+                    over = false; /* memory is still on its way down */
+                    settling = true;
+                }
+            }
             bool futile = atomic_load_explicit(&ec->bp_futile, memory_order_relaxed) != 0;
             if (over && !futile) {
                 /* Act only on the 0→1 transition: all workers race into the
@@ -819,7 +1070,13 @@ static void extract_worker(int worker_id, void *ctx_ptr) {
                         atomic_store_explicit(&ec->bp_futile, 0, memory_order_relaxed);
                     }
                 }
-            } else if (!over && futile) {
+            } else if (!over && !settling && futile) {
+                /* Re-arm only on a genuine under-budget reading. A reading the
+                 * spill shortcut produced ("still on its way down") is not
+                 * one: re-arming on it made the next over-budget pull pay a
+                 * full nap cycle again -- the gate re-paid per pull that
+                 * pipeline_backpressure_futile_nap_disengages guards against
+                 * (TSan lane on PR #2202: 8 cycles against a bound of 7). */
                 atomic_store_explicit(&ec->bp_futile, 0, memory_order_relaxed);
             }
         }
@@ -939,6 +1196,28 @@ static void extract_worker(int worker_id, void *ctx_ptr) {
             pp_err_add(errs, fi->rel_path, result->error_ranges ? result->error_ranges : "unknown",
                        result->parse_unusable ? "parse_unusable" : "parse_partial");
         }
+        /* A truncated walk is a coverage gap like a partial parse, and until now
+         * it was the only one we kept to ourselves: result->walk_truncated was
+         * set and never read by anything, so a file the walk abandoned halfway
+         * was reported as fully indexed. Say how far it got — "walked 812k of
+         * 3.4M nodes" is the difference between a graph with a known hole and a
+         * graph that quietly lies about its coverage. Independent of the
+         * branches above: a truncated walk is not a parse error. */
+        if (result->walk_truncated) {
+            char how_far[CBM_SZ_64];
+            snprintf(how_far, sizeof(how_far), "%u/%u nodes walked", result->walk_nodes_visited,
+                     result->tree_nodes);
+            pp_err_add(errs, fi->rel_path, how_far, "walk_truncated");
+        } else if (result->lsp_skipped) {
+            /* Indexed, but without the per-file and cross-file LSP refinement:
+             * the same kind of hole from the other direction. Nothing in
+             * production sets this any more except a truncated walk (handled
+             * above) and the test seam — it is reported anyway, so that if
+             * something sets it again the gap arrives named, not silent. */
+            char size_text[CBM_SZ_64];
+            snprintf(size_text, sizeof(size_text), "%u nodes", result->tree_nodes);
+            pp_err_add(errs, fi->rel_path, size_text, "lsp_skipped");
+        }
 
         /* Create definition nodes in local gbuf */
         for (int d = 0; d < result->defs.count; d++) {
@@ -1005,8 +1284,24 @@ static void extract_worker(int worker_id, void *ctx_ptr) {
          * and the retention copy (if any) lives in result->arena. */
         free_source(source);
 
-        /* Cache result (arena + extracted data, no tree) for Phase 3B and Phase 4 */
-        ec->result_cache[file_idx] = result;
+        /* Everything this file will ever contribute has been written; drop
+         * the working arena (node-text copies, abandoned array generations)
+         * and keep only the reachable result. See cbm_result_compact. */
+        cbm_result_compact(result);
+
+        /* Cache result (arena + extracted data, no tree) for Phase 3B and
+         * Phase 4 -- or park it straight to disk in spill mode. */
+        if (pp_spill_active(ec) &&
+            cbm_result_spill_park(ec->pctx->spill, worker_id, file_idx, result)) {
+            if (ec->slot_state) {
+                atomic_store_explicit(&ec->slot_state[file_idx], (uint8_t)2, memory_order_release);
+            }
+        } else {
+            ec->result_cache[file_idx] = result;
+            if (ec->slot_state) {
+                atomic_store_explicit(&ec->slot_state[file_idx], (uint8_t)1, memory_order_release);
+            }
+        }
 
         /* Progress logging: log every 10 files (atomic read, no contention) */
         if ((sort_pos + SKIP_ONE) % PP_LOG_INTERVAL == 0 || sort_pos + SKIP_ONE == ec->file_count) {
@@ -1032,6 +1327,7 @@ static void extract_worker(int worker_id, void *ctx_ptr) {
     }
 
     /* Final cleanup (parser already destroyed in loop, just slab state) */
+    cbm_work_arena_release(); /* the working arena kept between files */
     cbm_slab_destroy_thread();
     cbm_kind_in_set_free_cache(); /* free this worker thread's node-type bitset cache */
 }
@@ -1158,6 +1454,8 @@ int cbm_parallel_extract_ex(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *file
         .result_cache = result_cache,
         .shared_ids = shared_ids,
         .cancelled = ctx->cancelled,
+        .pctx = ctx,
+        .slot_state = NULL,
         .pkg_entries = pkg_entries,
         .err_lists = err_lists,
         .retain_sources = resolved_opts.retain_sources,
@@ -1173,12 +1471,43 @@ int cbm_parallel_extract_ex(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *file
     atomic_init(&ec.oversized_warned, 0);
     atomic_init(&ec.bp_futile, 0);
     atomic_init(&ec.over_budget_abort, 0);
+    atomic_init(&ec.spill_sweeps_running, 0);
+    atomic_init(&ec.spill_unavailable, 0);
+    cbm_mutex_init(&ec.spill_mu);
+    ec.slot_state = cbm_calloc(CBM_MEM_CLASS_OTHER, (size_t)file_count * sizeof(_Atomic uint8_t));
+    ec.spill_env = pp_spill_env_read();
+    if (pp_spill_forced_by_env(&ec)) {
+        pp_spill_enter(&ec, "env");
+    }
 
     /* Sub-phase: Dispatch workers (parse + extract per file, PARALLEL) */
     CBM_PROF_START(t_dispatch);
     cbm_parallel_for_opts_t parallel_opts = {.max_workers = worker_count, .force_pthreads = false};
     cbm_scale_begin(&ec.scale, "parallel_extract", (long)file_count);
     cbm_parallel_for(worker_count, extract_worker, &ec, parallel_opts);
+    if (pp_spill_active(&ec) &&
+        !atomic_load_explicit(&ec.over_budget_abort, memory_order_relaxed)) {
+        /* Spill mode was entered, so results belong on disk: park every
+         * result still cached before the phases that cannot park (registry
+         * build, resolve, the semantic pass) inherit them. The sweeps above
+         * run only on an over-budget observation; a run that latched early
+         * and then stayed under budget through extraction (kernel, 15 GB,
+         * 2026-09-14: 14,949 MB at this point, 44,797 results = 8 GB still
+         * cached) reached resolve with no headroom and aborted there. */
+        int parked = pp_spill_sweep(&ec, 0);
+        cbm_log_info("mem.spill.final_sweep", "parked", itoa_log(parked), "charged_mb",
+                     itoa_log((int)(cbm_mem_charged() / ((size_t)1024 * 1024))));
+    }
+    if (ctx->spill) {
+        int64_t parked = 0;
+        int64_t bytes = 0;
+        cbm_result_spill_stats(ctx->spill, &parked, &bytes, NULL);
+        cbm_log_info("mem.spill.extract_done", "parked", itoa_log((int)parked), "mb",
+                     itoa_log((int)(bytes / (1024 * 1024))));
+    }
+    cbm_mutex_destroy(&ec.spill_mu);
+    cbm_free(CBM_MEM_CLASS_OTHER, ec.slot_state);
+    ec.slot_state = NULL;
     cbm_scale_end(&ec.scale);
     CBM_PROF_END_N("parallel_extract", "3_dispatch_workers_parallel", t_dispatch, file_count);
 
@@ -1247,8 +1576,11 @@ int cbm_parallel_extract(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files,
 /* ── Phase 3B: Serial Registry Build ─────────────────────────────── */
 
 /* Register one definition and create DEFINES + DEFINES_METHOD edges. Returns edge count. */
-static int register_and_link_def(cbm_pipeline_ctx_t *ctx, const CBMDefinition *def, const char *rel,
-                                 int *reg_entries) {
+/* `file_node_id` is the defining file's node id (0 when it has none), looked up
+ * once per file by the caller: computing the file QN and finding its node for
+ * every definition was 700 k allocations and lookups on the Go corpus. */
+static int register_and_link_def(cbm_pipeline_ctx_t *ctx, const CBMDefinition *def,
+                                 int64_t file_node_id, int *reg_entries) {
     int edges = 0;
     if (!def->name || !def->qualified_name || !def->label) {
         return 0;
@@ -1259,14 +1591,11 @@ static int register_and_link_def(cbm_pipeline_ctx_t *ctx, const CBMDefinition *d
         cbm_registry_add(ctx->registry, def->name, def->qualified_name, def->label);
         (*reg_entries)++;
     }
-    char *file_qn = cbm_pipeline_fqn_compute(ctx->project_name, rel, "__file__");
-    const cbm_gbuf_node_t *file_node = cbm_gbuf_find_by_qn(ctx->gbuf, file_qn);
     const cbm_gbuf_node_t *def_node = cbm_gbuf_find_by_qn(ctx->gbuf, def->qualified_name);
-    if (file_node && def_node) {
-        cbm_gbuf_insert_edge(ctx->gbuf, file_node->id, def_node->id, "DEFINES", "{}");
+    if (file_node_id > 0 && def_node) {
+        cbm_gbuf_insert_edge(ctx->gbuf, file_node_id, def_node->id, "DEFINES", "{}");
         edges++;
     }
-    free(file_qn);
     if (def->parent_class && strcmp(def->label, "Method") == 0) {
         const cbm_gbuf_node_t *parent = cbm_gbuf_find_by_qn(ctx->gbuf, def->parent_class);
         if (parent && def_node) {
@@ -1367,8 +1696,23 @@ int cbm_build_registry_from_cache(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t
             rels[i] = files[i].rel_path;
         }
     }
-    CBMHashTable *namespace_map =
-        cbm_pipeline_namespace_map_build(ctx->project_name, result_cache, rels, file_count);
+    /* Built from every file, including the ones already parked on disk: their
+     * results are NULL in result_cache, and a file absent from this map does
+     * not fail to resolve, it resolves through the looser fallback. Spilling
+     * therefore used to CHANGE the graph rather than merely delay it -- php
+     * measured 57,182 edges in memory against 59,379 while spilling, the same
+     * binary and corpus (2026-09-18), differing in both directions. */
+    const char **namespaces = cbm_calloc(CBM_MEM_CLASS_OTHER, (size_t)file_count * sizeof(char *));
+    CBMHashTable *namespace_map = NULL;
+    if (namespaces) {
+        for (int i = 0; i < file_count; i++) {
+            namespaces[i] = result_cache[i] ? result_cache[i]->namespace_name
+                                            : cbm_result_spill_namespace(ctx->spill, i);
+        }
+        namespace_map =
+            cbm_pipeline_namespace_map_build_names(ctx->project_name, namespaces, rels, file_count);
+        cbm_free(CBM_MEM_CLASS_OTHER, namespaces);
+    }
     free(rels);
 
     for (int i = 0; i < file_count; i++) {
@@ -1378,6 +1722,11 @@ int cbm_build_registry_from_cache(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t
         }
 
         CBMFileResult *result = result_cache[i];
+        bool loaded = false;
+        if (!result && ctx->spill && cbm_result_spill_has(ctx->spill, i)) {
+            result = cbm_result_spill_load(ctx->spill, i);
+            loaded = result != NULL;
+        }
         if (!result) {
             continue;
         }
@@ -1385,13 +1734,23 @@ int cbm_build_registry_from_cache(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t
         const char *rel = files[i].rel_path;
 
         /* Register callable symbols + DEFINES/DEFINES_METHOD edges */
-        for (int d = 0; d < result->defs.count; d++) {
-            defines_edges += register_and_link_def(ctx, &result->defs.items[d], rel, &reg_entries);
+        if (result->defs.count > 0) {
+            char *file_qn = cbm_pipeline_fqn_compute(ctx->project_name, rel, "__file__");
+            const cbm_gbuf_node_t *file_node = cbm_gbuf_find_by_qn(ctx->gbuf, file_qn);
+            int64_t file_node_id = file_node ? file_node->id : 0;
+            free(file_qn);
+            for (int d = 0; d < result->defs.count; d++) {
+                defines_edges +=
+                    register_and_link_def(ctx, &result->defs.items[d], file_node_id, &reg_entries);
+            }
         }
 
         imports_edges += create_imports_edges(ctx, result, rel, namespace_map);
         create_channel_edges(ctx, result, rel);
         cbm_pipeline_create_env_configures_for_file(ctx, result, rel);
+        if (loaded) {
+            cbm_free_result(result);
+        }
     }
 
     cbm_pipeline_namespace_map_free(namespace_map);
@@ -1414,7 +1773,8 @@ typedef struct __attribute__((aligned(CBM_CACHE_LINE))) {
      * registry's textual matcher. Surfaced in the parallel.resolve.done
      * log line so divergence between pipelines becomes observable. */
     int lsp_overrides;
-    char _pad[CBM_CACHE_LINE - sizeof(cbm_gbuf_t *) - ((PP_RING + 1) * sizeof(int))];
+    CBMFileResult *loaded; /* spill-loaded result this worker is using */
+    char _pad[CBM_CACHE_LINE - 2 * sizeof(void *) - ((PP_RING + 1) * sizeof(int))];
 } resolve_worker_state_t;
 
 typedef struct {
@@ -1502,6 +1862,7 @@ typedef struct {
      * necessary (#1669: 87% of a Java index), so it is the one that must never
      * again grow superlinear without saying so. */
     cbm_scale_probe_t scale;
+    cbm_pipeline_ctx_t *pctx; /* spill store access */
 } resolve_ctx_t;
 
 /* Minimum buffer space needed per arg JSON object */
@@ -1513,6 +1874,10 @@ typedef struct {
 static void sanitize_expr(char *expr_buf, const char *expr) {
     if (expr) {
         snprintf(expr_buf, 128, "%.*s", 120, expr);
+        /* The 120-byte cut can land inside a multibyte character; a torn
+         * sequence persisted as invalid UTF-8 in edge properties (2026-09-16
+         * probe: rust, java, typescript stores). */
+        cbm_utf8_trim_partial(expr_buf);
         for (char *p = expr_buf; *p; p++) {
             if (*p == '"') {
                 *p = '\'';
@@ -1599,10 +1964,18 @@ static bool is_path_keyword(const char *keyword) {
     return false;
 }
 
+/* A route path is one line that opens with a slash. A block or line comment
+ * opens with a slash too, and an argument list that starts with one used to
+ * hand the comment text to the Route pass (three Java block comments became
+ * Route nodes on elasticsearch, 2026-09-16). */
+static bool is_route_path_shaped(const char *val) {
+    return val && val[0] == '/' && !cbm_service_pattern_is_comment_text(val);
+}
+
 static const char *find_route_path_in_args(const CBMCall *call, const char **out_handler) {
     *out_handler = NULL;
     /* 1. First string arg starting with / */
-    if (call->first_string_arg && call->first_string_arg[0] == '/') {
+    if (is_route_path_shaped(call->first_string_arg)) {
         *out_handler = call->second_arg_name;
         return call->first_string_arg;
     }
@@ -1611,7 +1984,7 @@ static const char *find_route_path_in_args(const CBMCall *call, const char **out
     for (int ai = 0; ai < call->arg_count && !found; ai++) {
         const CBMCallArg *ca = &call->args[ai];
         const char *val = ca->value ? ca->value : ca->expr;
-        if (!val || val[0] != '/') {
+        if (!is_route_path_shaped(val)) {
             continue;
         }
         if ((ca->keyword && is_path_keyword(ca->keyword)) || (!ca->keyword && ca->index == 0)) {
@@ -2120,6 +2493,36 @@ static void emit_service_edge(cbm_gbuf_t *gbuf, const cbm_gbuf_node_t *source,
 }
 
 /* Find the source node for an edge: enclosing function or file node. */
+/* This worker's last file-node answer. The graph buffer is read-only for the
+ * whole of phase 4 and a file's rel_path pointer is stable within it, so the
+ * pair identifies the answer; resolve_worker clears it at both ends so a later
+ * phase can never match a recycled address. Computing the file QN and looking
+ * it up ran for every call, usage, throw and read/write whose enclosing
+ * function is not a graph node of its own. */
+static CBM_TLS const cbm_gbuf_t *tl_file_node_gbuf;
+static CBM_TLS const char *tl_file_node_rel;
+static CBM_TLS const cbm_gbuf_node_t *tl_file_node;
+
+static void file_node_cache_clear(void) {
+    tl_file_node_gbuf = NULL;
+    tl_file_node_rel = NULL;
+    tl_file_node = NULL;
+}
+
+static const cbm_gbuf_node_t *file_node_for(const cbm_gbuf_t *gbuf, const char *project,
+                                            const char *rel) {
+    if (tl_file_node_gbuf == gbuf && tl_file_node_rel == rel) {
+        return tl_file_node;
+    }
+    char *file_qn = cbm_pipeline_fqn_compute(project, rel, "__file__");
+    const cbm_gbuf_node_t *node = cbm_gbuf_find_by_qn(gbuf, file_qn);
+    free(file_qn);
+    tl_file_node_gbuf = gbuf;
+    tl_file_node_rel = rel;
+    tl_file_node = node;
+    return node;
+}
+
 static const cbm_gbuf_node_t *find_source_node(const cbm_gbuf_t *gbuf, const char *project,
                                                const char *rel, const char *enclosing_qn) {
     const cbm_gbuf_node_t *src = NULL;
@@ -2133,9 +2536,7 @@ static const cbm_gbuf_node_t *find_source_node(const cbm_gbuf_t *gbuf, const cha
         }
     }
     if (!src) {
-        char *file_qn = cbm_pipeline_fqn_compute(project, rel, "__file__");
-        src = cbm_gbuf_find_by_qn(gbuf, file_qn);
-        free(file_qn);
+        src = file_node_for(gbuf, project, rel);
     }
     return src;
 }
@@ -2542,12 +2943,19 @@ static void resolve_file_calls(resolve_ctx_t *rc, resolve_worker_state_t *ws, CB
          * note there. ArkTS belongs to the JS/TS family (#1842). */
         bool suppress_weak_member = lang == CBM_LANG_PYTHON || lang == CBM_LANG_JAVASCRIPT ||
                                     lang == CBM_LANG_TYPESCRIPT || lang == CBM_LANG_TSX ||
-                                    lang == CBM_LANG_ARKTS;
+                                    lang == CBM_LANG_ARKTS ||
+                                    /* embedded-script hosts — see pass_calls.c */
+                                    lang == CBM_LANG_HTML || lang == CBM_LANG_VUE ||
+                                    lang == CBM_LANG_SVELTE || lang == CBM_LANG_ASTRO;
         /* Bare-call local-binding suppression — see the note in pass_calls.c.
          * This gate MUST stay identical to the one there. */
         bool suppress_weak_local_binding = lang == CBM_LANG_PYTHON;
+        /* The member guard's one exemption — MUST match pass_calls.c exactly. */
         bool drop_plain_call =
-            cbm_suppress_weak_member_match(suppress_weak_member, call->is_method, res.strategy) ||
+            (cbm_suppress_weak_member_match(suppress_weak_member, call->is_method, res.strategy) &&
+             !cbm_weak_member_unique_name_exempt(lang == CBM_LANG_PYTHON,
+                                                 call->receiver_is_self_attribute,
+                                                 call->callee_name, res.strategy)) ||
             cbm_suppress_weak_local_binding_call(suppress_weak_local_binding,
                                                  call->callee_is_locally_bound, res.strategy);
 
@@ -3048,8 +3456,7 @@ static void resolve_worker(int worker_id, void *ctx_ptr) {
     cbm_pxc_set_rust_manifest(rc->rust_manifest);
 
     if (!ws->local_edge_buf) {
-        ws->local_edge_buf =
-            cbm_gbuf_new_shared_ids(rc->project_name, rc->repo_path, rc->shared_ids);
+        ws->local_edge_buf = cbm_gbuf_new_worker(rc->project_name, rc->repo_path, rc->shared_ids);
     }
 
     /* Per-worker service-pattern result cache. The same resolved QN
@@ -3059,6 +3466,8 @@ static void resolve_worker(int worker_id, void *ctx_ptr) {
      * lookup after the first miss for each QN. Scoped to the worker's
      * lifetime in the parallel_resolve phase. */
     cbm_service_pattern_cache_begin();
+    cbm_pxc_thread_scratch_begin();
+    file_node_cache_clear();
 
     while (SKIP_ONE) {
         int file_idx =
@@ -3073,7 +3482,16 @@ static void resolve_worker(int worker_id, void *ctx_ptr) {
 
         uint64_t _loop_t0 = extract_now_ns();
 
+        if (ws->loaded) {
+            cbm_free_result(ws->loaded);
+            ws->loaded = NULL;
+        }
         CBMFileResult *result = rc->result_cache[file_idx];
+        if (!result && rc->pctx && rc->pctx->spill &&
+            cbm_result_spill_has(rc->pctx->spill, file_idx)) {
+            result = cbm_result_spill_load(rc->pctx->spill, file_idx);
+            ws->loaded = result;
+        }
         if (!result) {
             atomic_fetch_add_explicit(&rc->time_ns_total_loop, extract_now_ns() - _loop_t0,
                                       memory_order_relaxed);
@@ -3293,10 +3711,16 @@ static void resolve_worker(int worker_id, void *ctx_ptr) {
      * into dead TLS and are never retired, so a later cross-thread free can
      * never bring their refcount to zero (leak). Retiring them here releases
      * each page as its final chunk returns. */
+    if (ws->loaded) {
+        cbm_free_result(ws->loaded);
+        ws->loaded = NULL;
+    }
     cbm_pxc_set_rust_manifest(NULL);
     cbm_destroy_thread_parser();
     cbm_slab_destroy_thread();
     cbm_service_pattern_cache_end();
+    cbm_pxc_thread_scratch_end();
+    file_node_cache_clear();
 }
 
 int cbm_parallel_resolve(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files, int file_count,
@@ -3322,7 +3746,8 @@ int cbm_parallel_resolve(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files,
 
     bool have_rust = false;
     for (int i = 0; i < file_count; i++) {
-        if (result_cache[i] && files[i].language == CBM_LANG_RUST) {
+        if (files[i].language == CBM_LANG_RUST &&
+            (result_cache[i] || (ctx->spill && cbm_result_spill_has(ctx->spill, i)))) {
             have_rust = true;
             break;
         }
@@ -3340,6 +3765,7 @@ int cbm_parallel_resolve(cbm_pipeline_ctx_t *ctx, const cbm_file_info_t *files,
     }
 
     resolve_ctx_t rc = {
+        .pctx = ctx,
         .files = files,
         .file_count = file_count,
         .project_name = ctx->project_name,
diff --git a/src/pipeline/pass_pkgmap.c b/src/pipeline/pass_pkgmap.c
index 40e4c6c3f..bc534c583 100644
--- a/src/pipeline/pass_pkgmap.c
+++ b/src/pipeline/pass_pkgmap.c
@@ -1599,6 +1599,49 @@ static bool is_c_family_source(const char *source_rel) {
     return false;
 }
 
+/* Directory depth of a repo-relative path: how many directories sit above it. */
+static int include_path_depth(const char *path) {
+    int depth = 0;
+    for (const char *p = path; *p; p++) {
+        if (*p == '/' || *p == '\\') {
+            depth++;
+        }
+    }
+    return depth;
+}
+
+/* Total order among nodes whose file path ends with the include path. The
+ * by-name hits arrive in node-registration order, which under parallel
+ * extraction is the workers' merge order and differs run to run; taking the
+ * first hit made `#include <linux/device.h>` target include/linux/device.h in
+ * one index of the kernel and tools/virtio/linux/device.h in the next (5,821
+ * IMPORTS edges moved, and every CALLS edge resolved through those files'
+ * import maps moved with them). The include names a file, so a File node
+ * outranks a symbol declared in it; among files the least nested path wins
+ * (include/ over tools/virtio/), then the smaller path, then the smaller QN
+ * — a function of the candidate set alone (O9). */
+static bool include_target_outranks(const cbm_gbuf_node_t *cand, const cbm_gbuf_node_t *best) {
+    if (!best) {
+        return true;
+    }
+    bool cand_file = strcmp(cand->label, "File") == 0;
+    bool best_file = strcmp(best->label, "File") == 0;
+    if (cand_file != best_file) {
+        return cand_file;
+    }
+    int cd = include_path_depth(cand->file_path);
+    int bd = include_path_depth(best->file_path);
+    if (cd != bd) {
+        return cd < bd;
+    }
+    int by_path = strcmp(cand->file_path, best->file_path);
+    if (by_path != 0) {
+        return by_path < 0;
+    }
+    return cand->qualified_name && best->qualified_name &&
+           strcmp(cand->qualified_name, best->qualified_name) < 0;
+}
+
 static const cbm_gbuf_node_t *resolve_exact_file_node(const cbm_pipeline_ctx_t *ctx,
                                                       const char *file_path,
                                                       const char *source_file_qn) {
@@ -1651,18 +1694,12 @@ static const cbm_gbuf_node_t *resolve_exact_file_node(const cbm_pipeline_ctx_t *
                 strcmp(cand->qualified_name, source_file_qn) == 0) {
                 continue;
             }
-            if (strcmp(cand->label, "File") == 0) {
-                return cand;
-            }
-            if (!best) {
+            if (include_target_outranks(cand, best)) {
                 best = cand;
             }
         }
-        if (best) {
-            return best;
-        }
     }
-    return NULL;
+    return best;
 }
 
 static const cbm_gbuf_node_t *resolve_header_include(const cbm_pipeline_ctx_t *ctx,
@@ -2100,13 +2137,19 @@ const cbm_gbuf_node_t *cbm_pipeline_resolve_import_node(const cbm_pipeline_ctx_t
 
 /* ── Namespace map ───────────────────────────────────────────────── */
 
-CBMHashTable *cbm_pipeline_namespace_map_build(const char *project_name,
-                                               CBMFileResult *const *results,
-                                               const char *const *rels, int count) {
+/* The namespace names themselves, so a caller that has parked some results on
+ * disk can still contribute their namespaces (see
+ * cbm_result_spill_namespace). A file missing from this map does not fail to
+ * resolve -- it resolves DIFFERENTLY, through the looser fallback, which is why
+ * an incomplete map changed edge counts in both directions rather than only
+ * losing edges. */
+CBMHashTable *cbm_pipeline_namespace_map_build_names(const char *project_name,
+                                                     const char *const *namespaces,
+                                                     const char *const *rels, int count) {
     CBMHashTable *map = NULL;
     for (int i = 0; i < count; i++) {
-        const CBMFileResult *r = results[i];
-        if (!r || !r->namespace_name || !r->namespace_name[0] || !rels[i]) {
+        const char *namespace_name = namespaces[i];
+        if (!namespace_name || !namespace_name[0] || !rels[i]) {
             continue;
         }
         if (!map) {
@@ -2122,7 +2165,7 @@ CBMHashTable *cbm_pipeline_namespace_map_build(const char *project_name,
         /* Normalize the namespace key to dot-separated form so it matches the
          * dot-normalized lookups in cbm_pipeline_resolve_import_node (PHP uses
          * '\\', some grammars '::' or '/'). */
-        char *key = strdup(r->namespace_name);
+        char *key = strdup(namespace_name);
         if (!key) {
             free(file_qn);
             continue;
@@ -2162,6 +2205,25 @@ CBMHashTable *cbm_pipeline_namespace_map_build(const char *project_name,
     return map;
 }
 
+/* Convenience for callers whose results are all in memory (the sequential
+ * definitions pass). A caller that can SPILL must use the _names variant and
+ * fill the parked slots from cbm_result_spill_namespace, or its map silently
+ * loses those files. */
+CBMHashTable *cbm_pipeline_namespace_map_build(const char *project_name,
+                                               CBMFileResult *const *results,
+                                               const char *const *rels, int count) {
+    const char **names = cbm_calloc(CBM_MEM_CLASS_OTHER, (size_t)count * sizeof(char *));
+    if (!names) {
+        return NULL;
+    }
+    for (int i = 0; i < count; i++) {
+        names[i] = results[i] ? results[i]->namespace_name : NULL;
+    }
+    CBMHashTable *map = cbm_pipeline_namespace_map_build_names(project_name, names, rels, count);
+    cbm_free(CBM_MEM_CLASS_OTHER, names);
+    return map;
+}
+
 static void ns_map_free_entry(const char *key, void *value, void *ud) {
     (void)ud;
     free((void *)key); /* strdup'd in cbm_pipeline_namespace_map_build */
diff --git a/src/pipeline/pass_route_nodes.c b/src/pipeline/pass_route_nodes.c
index b1fac1670..878dd7f50 100644
--- a/src/pipeline/pass_route_nodes.c
+++ b/src/pipeline/pass_route_nodes.c
@@ -322,9 +322,34 @@ static bool is_broker_route(const char *qn) {
 
 /* Try to match a single infra Route to a handler Route and create HANDLES bridge.
  * Returns 1 if matched, 0 otherwise. */
+/* Total order over candidates, so "which handler" never depends on the order
+ * nodes happened to land in the graph buffer. Qualified names are unique per
+ * node, so this is a tie-break that always decides; a NULL name sorts last and
+ * therefore only wins when nothing else matched. */
+static bool infra_candidate_is_better(const cbm_gbuf_node_t *candidate,
+                                      const cbm_gbuf_node_t *best) {
+    if (!best) {
+        return true;
+    }
+    if (!candidate->qualified_name) {
+        return false;
+    }
+    if (!best->qualified_name) {
+        return true;
+    }
+    return strcmp(candidate->qualified_name, best->qualified_name) < 0;
+}
+
 static int match_one_infra_route(cbm_gbuf_t *gb, const cbm_gbuf_node_t *infra,
                                  const char *infra_path, const char *svc_name,
                                  const cbm_gbuf_node_t **all_routes, int route_count) {
+    /* The FIRST match in array order used to win, and that array is in graph
+     * buffer insertion order — parallel worker interleaving. Two runs of the
+     * same corpus linked the same infra route to different handlers, so the
+     * HANDLES edge set moved between runs (kubernetes, 2026-09-18: 229 vs 242
+     * HANDLES with an identical node set). Collect the best candidate under a
+     * total order instead, and match on it. */
+    const cbm_gbuf_node_t *best = NULL;
     for (int j = 0; j < route_count; j++) {
         const cbm_gbuf_node_t *handler_route = all_routes[j];
         if (is_broker_route(handler_route->qualified_name)) {
@@ -352,18 +377,22 @@ static int match_one_infra_route(cbm_gbuf_t *gb, const cbm_gbuf_node_t *infra,
                                                  strstr(handler_path, infra_path) != NULL));
         int root_svc_match = (strcmp(handler_path, "/") == 0);
         if (path_match || root_svc_match) {
-            const cbm_gbuf_edge_t **fn_handles = NULL;
-            int fn_hcount = 0;
-            cbm_gbuf_find_edges_by_target_type(gb, handler_route->id, "HANDLES", &fn_handles,
-                                               &fn_hcount);
-            for (int fh = 0; fh < fn_hcount; fh++) {
-                cbm_gbuf_insert_edge(gb, fn_handles[fh]->source_id, infra->id, "HANDLES",
-                                     "{\"source\":\"infra_match\"}");
+            if (infra_candidate_is_better(handler_route, best)) {
+                best = handler_route;
             }
-            return SKIP_ONE;
         }
     }
-    return 0;
+    if (!best) {
+        return 0;
+    }
+    const cbm_gbuf_edge_t **fn_handles = NULL;
+    int fn_hcount = 0;
+    cbm_gbuf_find_edges_by_target_type(gb, best->id, "HANDLES", &fn_handles, &fn_hcount);
+    for (int fh = 0; fh < fn_hcount; fh++) {
+        cbm_gbuf_insert_edge(gb, fn_handles[fh]->source_id, infra->id, "HANDLES",
+                             "{\"source\":\"infra_match\"}");
+    }
+    return SKIP_ONE;
 }
 
 /* Phase 2: Match infra Route URLs to handler Route nodes by URL path + service name. */
@@ -850,20 +879,41 @@ static void create_grpc_routes(cbm_gbuf_t *gb) {
         return;
     }
 
-    const cbm_gbuf_node_t *services[CBM_SZ_64];
+    /* EVERY proto service, not a fixed-size prefix of them.
+     *
+     * This array held 64 and the loop stopped at that many, so WHICH services
+     * were considered depended on the order Class nodes happened to land in the
+     * graph buffer — i.e. on parallel worker interleaving. Two indexes of the
+     * same corpus with the same binary produced different __grpc__ Routes
+     * (kubernetes, 2026-09-18: 5 Routes present in one run and absent from the
+     * other, 4 the other way, plus their HANDLES edges). It was a silent
+     * quality cut as well: every service past the 64th got no Routes at all,
+     * and a repository with more than 64 services is not unusual. */
+    int svc_total = 0;
+    for (int i = 0; i < class_count; i++) {
+        if (classes[i]->file_path && strstr(classes[i]->file_path, ".proto")) {
+            svc_total++;
+        }
+    }
+    if (svc_total == 0) {
+        return;
+    }
+    const cbm_gbuf_node_t **services =
+        cbm_alloc(CBM_MEM_CLASS_OTHER, (size_t)svc_total * sizeof(*services));
+    if (!services) {
+        return; /* the borrowed `classes` array belongs to the graph buffer */
+    }
     int svc_count = 0;
-    for (int i = 0; i < class_count && svc_count < CBM_SZ_64; i++) {
+    for (int i = 0; i < class_count && svc_count < svc_total; i++) {
         if (classes[i]->file_path && strstr(classes[i]->file_path, ".proto")) {
             services[svc_count++] = classes[i];
         }
     }
-    if (svc_count == 0) {
-        return;
-    }
 
     const cbm_gbuf_node_t **funcs = NULL;
     int func_count = 0;
     if (cbm_gbuf_find_by_label(gb, "Function", &funcs, &func_count) != 0 || func_count == 0) {
+        cbm_free(CBM_MEM_CLASS_OTHER, services);
         return;
     }
 
@@ -888,10 +938,13 @@ static void create_grpc_routes(cbm_gbuf_t *gb) {
         cbm_gbuf_insert_edge(gb, fn->id, route_id, "HANDLES", "{\"via\":\"proto_rpc\"}");
         grpc_routes++;
     }
+    cbm_free(CBM_MEM_CLASS_OTHER, services);
     if (grpc_routes > 0) {
         char buf[CBM_SZ_16];
+        char svc_buf[CBM_SZ_16];
         snprintf(buf, sizeof(buf), "%d", grpc_routes);
-        cbm_log_info("pass.route_nodes.grpc", "routes", buf);
+        snprintf(svc_buf, sizeof(svc_buf), "%d", svc_count);
+        cbm_log_info("pass.route_nodes.grpc", "routes", buf, "services", svc_buf);
     }
 }
 
diff --git a/src/pipeline/pass_semantic.c b/src/pipeline/pass_semantic.c
index 8afc53958..48dab0083 100644
--- a/src/pipeline/pass_semantic.c
+++ b/src/pipeline/pass_semantic.c
@@ -12,6 +12,7 @@
  * Depends on: pass_definitions having populated the registry and graph buffer
  */
 #include "foundation/constants.h"
+#include "foundation/mem_core.h"
 #include "foundation/str_util.h" // cbm_json_escape
 #include "pipeline/pipeline.h"
 #include <stdint.h>
@@ -49,7 +50,7 @@ static char *read_file(const char *path, int *out_len) {
     }
     /* +pad: tree-sitter lexer lookahead reads past EOF; keep it in-bounds */
     enum { CBM_TS_LOOKAHEAD_PAD = 16 };
-    char *buf = malloc((size_t)size + CBM_TS_LOOKAHEAD_PAD);
+    char *buf = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)size + CBM_TS_LOOKAHEAD_PAD);
     if (!buf) {
         (void)fclose(f);
         return NULL;
@@ -84,8 +85,12 @@ static int build_import_map(cbm_pipeline_ctx_t *ctx, const char *rel_path,
 
     /* Fast path: build from cached extraction result (no JSON parsing) */
     if (result && result->imports.count > 0) {
-        const char **keys = calloc((size_t)result->imports.count, sizeof(const char *));
-        const char **vals = calloc((size_t)result->imports.count, sizeof(const char *));
+        const char **keys =
+            cbm_calloc(CBM_MEM_CLASS_SEMANTIC,
+                       (size_t)((size_t)result->imports.count) * (sizeof(const char *)));
+        const char **vals =
+            cbm_calloc(CBM_MEM_CLASS_SEMANTIC,
+                       (size_t)((size_t)result->imports.count) * (sizeof(const char *)));
         int count = 0;
 
         for (int i = 0; i < result->imports.count; i++) {
@@ -99,7 +104,7 @@ static int build_import_map(cbm_pipeline_ctx_t *ctx, const char *rel_path,
             if (!target) {
                 continue;
             }
-            keys[count] = strdup(imp->local_name);
+            keys[count] = cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, imp->local_name);
             vals[count] = target->qualified_name;
             count++;
         }
@@ -126,8 +131,10 @@ static int build_import_map(cbm_pipeline_ctx_t *ctx, const char *rel_path,
         return 0;
     }
 
-    const char **keys = calloc(edge_count, sizeof(const char *));
-    const char **vals = calloc(edge_count, sizeof(const char *));
+    const char **keys =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)(edge_count) * (sizeof(const char *)));
+    const char **vals =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)(edge_count) * (sizeof(const char *)));
     int count = 0;
 
     for (int i = 0; i < edge_count; i++) {
@@ -158,12 +165,12 @@ static int build_import_map(cbm_pipeline_ctx_t *ctx, const char *rel_path,
 static void free_import_map(const char **keys, const char **vals, int count) {
     if (keys) {
         for (int i = 0; i < count; i++) {
-            free((void *)keys[i]);
+            cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)keys[i]);
         }
-        free((void *)keys);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)keys);
     }
     if (vals) {
-        free((void *)vals);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)vals);
     }
 }
 
@@ -300,6 +307,103 @@ static int check_go_class_implements(cbm_pipeline_ctx_t *ctx, const cbm_gbuf_nod
     return edges;
 }
 
+/* ── Method-name index over the concrete types ────────────────────
+ *
+ * Checking every interface against every struct and named type is
+ * interfaces x types work: the scaling lane measured it at 4.00x per 2x corpus
+ * (2026-09-17). A type can only satisfy an interface if it supplies EVERY
+ * method name, so it is in the candidate list of each of those names: checking
+ * just the shortest such list, in the original order, runs exactly the checks
+ * that can succeed, in exactly the order they ran before -- the edges and their
+ * insertion order are unchanged. A type supplies a name by either lookup
+ * check_go_class_implements uses: a DEFINES_METHOD edge to a node of that name,
+ * or a node whose QN is "<TypeQN>.<name>". */
+typedef struct {
+    int *items; /* ascending type indices, no duplicates once sealed */
+    int count;
+    int cap;
+} go_type_list_t;
+
+typedef struct {
+    CBMHashTable *by_name;    /* method name (borrowed) -> go_type_list_t* */
+    CBMHashTable *type_by_qn; /* type QN (borrowed) -> (void *)(index + 1) */
+} go_method_index_t;
+
+static void go_index_add(go_method_index_t *ix, const char *name, int type_index) {
+    go_type_list_t *list = cbm_ht_get(ix->by_name, name);
+    if (!list) {
+        list = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, sizeof(*list));
+        if (!list) {
+            return;
+        }
+        cbm_ht_set(ix->by_name, name, list);
+    }
+    if (list->count > 0 && list->items[list->count - 1] == type_index) {
+        return;
+    }
+    if (list->count == list->cap) {
+        int cap = list->cap ? list->cap * PAIR_LEN : CBM_SZ_4;
+        int *grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, list->items, (size_t)cap * sizeof(int));
+        if (!grown) {
+            return;
+        }
+        list->items = grown;
+        list->cap = cap;
+    }
+    list->items[list->count++] = type_index;
+}
+
+static void go_index_visit_node(const cbm_gbuf_node_t *node, void *userdata) {
+    go_method_index_t *ix = userdata;
+    const char *qn = node->qualified_name;
+    const char *dot = qn ? strrchr(qn, '.') : NULL;
+    if (!dot || dot == qn || !dot[SKIP_ONE]) {
+        return;
+    }
+    char parent[CBM_SZ_512];
+    size_t len = (size_t)(dot - qn);
+    if (len >= sizeof(parent)) {
+        return; /* longer than the lookup buffer check_go_class_implements builds */
+    }
+    memcpy(parent, qn, len);
+    parent[len] = '\0';
+    void *slot = cbm_ht_get(ix->type_by_qn, parent);
+    if (slot) {
+        go_index_add(ix, dot + SKIP_ONE, (int)((intptr_t)slot - SKIP_ONE));
+    }
+}
+
+static int cmp_int_asc(const void *a, const void *b) {
+    int x = *(const int *)a;
+    int y = *(const int *)b;
+    return (x > y) - (x < y);
+}
+
+static void go_index_seal_list(const char *key, void *val, void *userdata) {
+    (void)key;
+    (void)userdata;
+    go_type_list_t *list = val;
+    if (list->count < PAIR_LEN) {
+        return;
+    }
+    qsort(list->items, (size_t)list->count, sizeof(int), cmp_int_asc);
+    int out = SKIP_ONE;
+    for (int i = SKIP_ONE; i < list->count; i++) {
+        if (list->items[i] != list->items[out - SKIP_ONE]) {
+            list->items[out++] = list->items[i];
+        }
+    }
+    list->count = out;
+}
+
+static void go_index_free_list(const char *key, void *val, void *userdata) {
+    (void)key;
+    (void)userdata;
+    go_type_list_t *list = val;
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, list->items);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, list);
+}
+
 int cbm_pipeline_implements_go(cbm_pipeline_ctx_t *ctx) {
     int edge_count = 0;
 
@@ -323,6 +427,43 @@ int cbm_pipeline_implements_go(cbm_pipeline_ctx_t *ctx) {
         return 0;
     }
 
+    /* Candidate index (see go_method_index_t). Type index t is the position in
+     * the original iteration order: structs first, then classes. */
+    int type_count = struct_count + class_count;
+    const cbm_gbuf_node_t **types =
+        cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)type_count * sizeof(*types));
+    go_method_index_t ix = {
+        .by_name = cbm_ht_create_in(CBM_MEM_CLASS_SEMANTIC, (uint32_t)CBM_SZ_1K),
+        .type_by_qn = cbm_ht_create_in(CBM_MEM_CLASS_SEMANTIC, (uint32_t)type_count),
+    };
+    bool indexed = types && ix.by_name && ix.type_by_qn;
+    if (indexed) {
+        for (int c = 0; c < struct_count; c++) {
+            types[c] = structs[c];
+        }
+        for (int c = 0; c < class_count; c++) {
+            types[struct_count + c] = classes[c];
+        }
+        for (int t = 0; t < type_count; t++) {
+            if (types[t]->qualified_name) {
+                cbm_ht_set(ix.type_by_qn, types[t]->qualified_name,
+                           (void *)(intptr_t)(t + SKIP_ONE));
+            }
+            const cbm_gbuf_edge_t **tdm = NULL;
+            int tdm_count = 0;
+            cbm_gbuf_find_edges_by_source_type(ctx->gbuf, types[t]->id, "DEFINES_METHOD", &tdm,
+                                               &tdm_count);
+            for (int d = 0; d < tdm_count; d++) {
+                const cbm_gbuf_node_t *cm = cbm_gbuf_find_by_id(ctx->gbuf, tdm[d]->target_id);
+                if (cm && cm->name) {
+                    go_index_add(&ix, cm->name, t);
+                }
+            }
+        }
+        cbm_gbuf_foreach_node(ctx->gbuf, go_index_visit_node, &ix);
+        cbm_ht_foreach(ix.by_name, go_index_seal_list, NULL);
+    }
+
     for (int i = 0; i < iface_count; i++) {
         const cbm_gbuf_node_t *iface = ifaces[i];
         if (!iface->file_path || !fp_ends_with(iface->file_path, ".go")) {
@@ -351,15 +492,43 @@ int cbm_pipeline_implements_go(cbm_pipeline_ctx_t *ctx) {
             continue;
         }
 
-        /* Check each concrete-type node (Struct + Class) for method-set
-         * satisfaction. */
-        for (int c = 0; c < struct_count; c++) {
-            edge_count += check_go_class_implements(ctx, structs[c], iface, imethods, im_count);
+        if (!indexed) {
+            /* Index unavailable (allocation failure): the full scan. */
+            for (int c = 0; c < struct_count; c++) {
+                edge_count += check_go_class_implements(ctx, structs[c], iface, imethods, im_count);
+            }
+            for (int c = 0; c < class_count; c++) {
+                edge_count += check_go_class_implements(ctx, classes[c], iface, imethods, im_count);
+            }
+            continue;
         }
-        for (int c = 0; c < class_count; c++) {
-            edge_count += check_go_class_implements(ctx, classes[c], iface, imethods, im_count);
+        /* Only the types that supply the interface's rarest method name. */
+        const go_type_list_t *shortest = NULL;
+        bool missing = false;
+        for (int m = 0; m < im_count; m++) {
+            const go_type_list_t *list = cbm_ht_get(ix.by_name, imethods[m].name);
+            if (!list || list->count == 0) {
+                missing = true; /* no type supplies this name: none can satisfy */
+                break;
+            }
+            if (!shortest || list->count < shortest->count) {
+                shortest = list;
+            }
+        }
+        if (missing || !shortest) {
+            continue;
+        }
+        for (int k = 0; k < shortest->count; k++) {
+            edge_count += check_go_class_implements(ctx, types[shortest->items[k]], iface, imethods,
+                                                    im_count);
         }
     }
+    if (ix.by_name) {
+        cbm_ht_foreach(ix.by_name, go_index_free_list, NULL);
+        cbm_ht_free(ix.by_name);
+    }
+    cbm_ht_free(ix.type_by_qn);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, types);
     return edge_count;
 }
 
@@ -496,7 +665,7 @@ static CBMFileResult *sem_get_or_extract(cbm_pipeline_ctx_t *ctx, int file_idx,
     }
     CBMFileResult *r = cbm_extract_file(source, source_len, fi->language, ctx->project_name,
                                         fi->rel_path, CBM_EXTRACT_BUDGET, NULL, NULL);
-    free(source);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, source);
     if (r) {
         *owned = true;
     }
diff --git a/src/pipeline/pass_semantic_edges.c b/src/pipeline/pass_semantic_edges.c
index 2b69385da..05a7387a9 100644
--- a/src/pipeline/pass_semantic_edges.c
+++ b/src/pipeline/pass_semantic_edges.c
@@ -10,6 +10,8 @@
  * Runs in moderate and full modes (not fast). Controlled by pipeline mode.
  */
 #include "foundation/constants.h"
+#include "foundation/mem.h"
+#include "foundation/mem_core.h"
 #include "pipeline/pipeline.h"
 #include <stdint.h>
 #include "pipeline/pipeline_internal.h"
@@ -20,6 +22,7 @@
 #include "foundation/hash_table.h"
 #include "foundation/log.h"
 #include "foundation/compat.h"
+#include "foundation/compat_fs.h" /* cbm_fopen for the pair dump */
 #define XXH_INLINE_ALL
 #include "xxhash/xxhash.h"
 
@@ -93,7 +96,8 @@ static void deferred_buf_push(deferred_edge_buf_t *buf, int64_t src, int64_t tgt
                               bool same_file, int i, int j, int c) {
     if (buf->count >= buf->cap) {
         int nc = buf->cap < CBM_SZ_256 ? CBM_SZ_256 : buf->cap * GROW;
-        deferred_edge_t *grown = realloc(buf->edges, (size_t)nc * sizeof(deferred_edge_t));
+        deferred_edge_t *grown =
+            cbm_realloc(CBM_MEM_CLASS_SEMANTIC, buf->edges, (size_t)nc * sizeof(deferred_edge_t));
         if (!grown) {
             return;
         }
@@ -110,7 +114,7 @@ static void deferred_buf_push(deferred_edge_buf_t *buf, int64_t src, int64_t tgt
 }
 
 static void deferred_buf_free(deferred_edge_buf_t *buf) {
-    free(buf->edges);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, buf->edges);
     buf->edges = NULL;
     buf->count = buf->cap = 0;
 }
@@ -128,7 +132,7 @@ static int push_pattern_token(char **tokens, int count, int max_tokens, const ch
     if (count >= max_tokens) {
         return count;
     }
-    tokens[count] = strdup(text);
+    tokens[count] = cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, text);
     return tokens[count] ? count + SKIP_ONE : count;
 }
 
@@ -191,23 +195,33 @@ static int inject_callee_tokens(const char *name, char **tokens, int count, int
 }
 
 /* Walk the outbound CALLS edges of n and inject tokens for each target. */
+static const char **collect_sorted_call_neighbors(const cbm_gbuf_t *gbuf, int64_t node_id,
+                                                  bool outbound, int *out_n);
+
 static int inject_calls_pattern_tokens(const cbm_gbuf_node_t *n, const cbm_gbuf_t *gbuf,
                                        char **tokens, int count, int max_tokens) {
     if (!gbuf) {
         return count;
     }
-    const cbm_gbuf_edge_t **edges = NULL;
-    int ec = 0;
-    if (cbm_gbuf_find_edges_by_source_type(gbuf, n->id, "CALLS", &edges, &ec) != 0) {
+    /* SORTED, like every other consumer of CALLS neighbours in this file. The
+     * raw edge array is in graph-buffer insertion order — parallel worker merge
+     * order — and this loop both ORDERS the injected tokens and truncates at
+     * max_tokens. Co-occurrence enrichment reads a window around each token
+     * POSITION, so a different order yields different token vectors while
+     * leaving document frequencies untouched: measured on the go corpus
+     * 2026-09-19, two runs of one binary with identical idf but different token
+     * sequences and different enriched vectors, which flickered near-threshold
+     * SEMANTICALLY_RELATED edges. collect_sorted_call_neighbors() was written
+     * for exactly this class and this call site was missed. */
+    int nn = 0;
+    const char **names = collect_sorted_call_neighbors(gbuf, n->id, /*outbound=*/true, &nn);
+    if (!names) {
         return count;
     }
-    for (int e = 0; e < ec && count < max_tokens; e++) {
-        const cbm_gbuf_node_t *t = cbm_gbuf_find_by_id(gbuf, edges[e]->target_id);
-        if (!t || !t->name) {
-            continue;
-        }
-        count = inject_callee_tokens(t->name, tokens, count, max_tokens);
+    for (int e = 0; e < nn && count < max_tokens; e++) {
+        count = inject_callee_tokens(names[e], tokens, count, max_tokens);
     }
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)names);
     return count;
 }
 
@@ -357,7 +371,7 @@ static int json_str_array(const char *json, const char *key, char **out, int max
                 break;
             }
             int len = (int)(end - start);
-            out[count] = malloc((size_t)len + SKIP_ONE);
+            out[count] = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)len + SKIP_ONE);
             memcpy(out[count], start, (size_t)len);
             out[count][len] = '\0';
             count++;
@@ -398,7 +412,7 @@ static int tokenize_json_array_field(const char *json, const char *key, char **t
         if (count < max_tokens) {
             count += cbm_sem_tokenize(arr[p], tokens + count, max_tokens - count);
         }
-        free(arr[p]);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, arr[p]);
     }
     return count;
 }
@@ -428,7 +442,7 @@ static const char **collect_sorted_call_neighbors(const cbm_gbuf_t *gbuf, int64_
     if (rc != 0 || ec <= 0) {
         return NULL;
     }
-    const char **names = malloc((size_t)ec * sizeof(char *));
+    const char **names = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)ec * sizeof(char *));
     if (!names) {
         return NULL;
     }
@@ -458,7 +472,7 @@ static int tokenize_call_neighbors(const cbm_gbuf_node_t *n, const cbm_gbuf_t *g
     for (int e = 0; e < nn && e < MAX_CALLEES && count < max_tokens; e++) {
         count += cbm_sem_tokenize(names[e], tokens + count, max_tokens - count);
     }
-    free((void *)names);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)names);
     return count;
 }
 
@@ -511,7 +525,7 @@ static void build_api_vec(const cbm_gbuf_t *gbuf, int64_t node_id, cbm_sem_vec_t
         cbm_sem_random_index(names[i], &callee_ri);
         cbm_sem_vec_add_scaled(out, &callee_ri, PSE_UNIT_POS);
     }
-    free((void *)names);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)names);
     cbm_sem_normalize(out);
 }
 
@@ -533,7 +547,7 @@ static void build_type_vec(const char *props_json, cbm_sem_vec_t *out) {
         cbm_sem_vec_t ri;
         cbm_sem_random_index(ptypes[i], &ri);
         cbm_sem_vec_add_scaled(out, &ri, PSE_UNIT_POS);
-        free(ptypes[i]);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, ptypes[i]);
     }
     cbm_sem_normalize(out);
 }
@@ -549,7 +563,7 @@ static void build_deco_vec(const char *props_json, cbm_sem_vec_t *out) {
         cbm_sem_vec_t ri;
         cbm_sem_random_index(decos[i], &ri);
         cbm_sem_vec_add_scaled(out, &ri, PSE_UNIT_POS);
-        free(decos[i]);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, decos[i]);
     }
     cbm_sem_normalize(out);
 }
@@ -594,10 +608,41 @@ static void decode_minhash(const char *props_json, cbm_sem_func_t *func) {
 
 /* ── Parallel Phase 2: Tokenize nodes ────────────────────────────── */
 
+/* One growable token-pointer buffer per worker. A function's tokens are
+ * appended contiguously; where they landed is recorded per function so a
+ * single pass after the parallel phase can pack everything into one array
+ * with offsets. This replaces a fixed CBM_SEM_MAX_TOKENS-slot stride per
+ * function (4 KB each, 7.4 GB on the kernel). */
+typedef struct {
+    char **items;
+    size_t count;
+    size_t cap;
+} tok_buf_t;
+
+static bool tok_buf_append(tok_buf_t *b, char **tokens, int count) {
+    if (b->count + (size_t)count > b->cap) {
+        size_t new_cap = b->cap ? b->cap * 2 : (size_t)CBM_SZ_4K;
+        while (new_cap < b->count + (size_t)count) {
+            new_cap *= 2;
+        }
+        char **grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, b->items, new_cap * sizeof(char *));
+        if (!grown) {
+            return false;
+        }
+        b->items = grown;
+        b->cap = new_cap;
+    }
+    memcpy(b->items + b->count, tokens, (size_t)count * sizeof(char *));
+    b->count += (size_t)count;
+    return true;
+}
+
 typedef struct {
     const cbm_gbuf_node_t **node_ptrs; /* node pointer per function index */
     cbm_gbuf_t *gbuf;                  /* read-only during tokenization */
-    char **all_tokens;                 /* output: all_tokens[f * MAX + t] */
+    tok_buf_t *bufs;                   /* per worker: appended token pointers */
+    int *tok_worker;                   /* per function: which worker's buffer */
+    size_t *tok_off;                   /* per function: offset inside that buffer */
     int *token_counts;                 /* output: token count per function */
     int func_count;
     _Atomic int next_idx;
@@ -617,11 +662,10 @@ static void tokenize_worker(int worker_id, void *ctx_ptr) {
         }
 
         const cbm_gbuf_node_t *n = tc->node_ptrs[f];
-        /* Write directly into the shared buffer slice for this function — the
-         * strdup'd tokens are owned by all_tokens[] from the moment they land
-         * in this slot, which avoids a spurious analyzer "leak" diagnostic on
-         * the previous stack-local relay pattern. */
-        char **dst = &tc->all_tokens[(ptrdiff_t)f * CBM_SEM_MAX_TOKENS];
+        /* Tokenize into a per-call scratch slice, intern, then append the
+         * surviving pointers to this worker's buffer. The strings are owned by
+         * the worker's intern pool (or by the buffer until interned). */
+        char *dst[CBM_SEM_MAX_TOKENS];
         int count = tokenize_node(n, tc->gbuf, dst, CBM_SEM_MAX_TOKENS);
         count = inject_pattern_tokens(n, tc->gbuf, dst, count, CBM_SEM_MAX_TOKENS);
         if (tc->pools && tc->pools[worker_id]) {
@@ -629,13 +673,19 @@ static void tokenize_worker(int worker_id, void *ctx_ptr) {
             for (int t = 0; t < count; t++) {
                 char *canon = cbm_ht_get(pool, dst[t]);
                 if (canon) {
-                    free(dst[t]);
+                    cbm_free(CBM_MEM_CLASS_SEMANTIC, dst[t]);
                     dst[t] = canon;
                 } else {
                     cbm_ht_set(pool, dst[t], dst[t]); /* key borrows the value */
                 }
             }
         }
+        tok_buf_t *b = &tc->bufs[worker_id];
+        tc->tok_worker[f] = worker_id;
+        tc->tok_off[f] = b->count;
+        if (!tok_buf_append(b, dst, count)) {
+            count = 0; /* OOM: the function contributes no tokens, never garbage */
+        }
         tc->token_counts[f] = count;
     }
 }
@@ -645,6 +695,7 @@ static void tokenize_worker(int worker_id, void *ctx_ptr) {
 typedef struct {
     cbm_sem_func_t *funcs;
     char **all_tokens;
+    const size_t *offsets; /* function f = all_tokens[offsets[f] ..] */
     int *token_counts;
     cbm_sem_corpus_t *corpus;
     uint8_t *qvecs; /* output: pre-quantized int8 vectors [func_count * CBM_SEM_DIM] */
@@ -662,14 +713,24 @@ static void vec_build_worker(int worker_id, void *ctx_ptr) {
         }
 
         int tc = vc->token_counts[f];
-        char **tokens = &vc->all_tokens[(ptrdiff_t)f * CBM_SEM_MAX_TOKENS];
+        char **tokens = &vc->all_tokens[vc->offsets[f]];
+
+        /* Each token is resolved to its corpus index ONCE: both loops below ask
+         * about every token, and asking by name cost a hash lookup plus a
+         * strtol per question -- three per token (35 M repeated lookups of an
+         * unchanged table on the Go corpus, waste sanitizer 2026-09-17). */
+        int *token_index = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)tc * sizeof(int));
+        for (int t = 0; token_index && t < tc; t++) {
+            token_index[t] = cbm_sem_corpus_token_index(vc->corpus, tokens[t]);
+        }
 
         /* TF-IDF weights */
-        int *indices = malloc((size_t)tc * sizeof(int));
-        float *weights = malloc((size_t)tc * sizeof(float));
+        int *indices = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)tc * sizeof(int));
+        float *weights = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)tc * sizeof(float));
         int tfidf_len = 0;
         for (int t = 0; t < tc; t++) {
-            float idf = cbm_sem_corpus_idf(vc->corpus, tokens[t]);
+            float idf = token_index ? cbm_sem_corpus_idf_at(vc->corpus, token_index[t])
+                                    : cbm_sem_corpus_idf(vc->corpus, tokens[t]);
             if (idf > 0.0F) {
                 indices[tfidf_len] = t;
                 weights[tfidf_len] = idf;
@@ -686,12 +747,16 @@ static void vec_build_worker(int worker_id, void *ctx_ptr) {
         cbm_sem_vec_t ri_dense;
         memset(&ri_dense, 0, sizeof(cbm_sem_vec_t));
         for (int t = 0; t < tc; t++) {
-            const cbm_sem_vec_t *ri = cbm_sem_corpus_ri_vec(vc->corpus, tokens[t]);
+            const cbm_sem_vec_t *ri = token_index
+                                          ? cbm_sem_corpus_ri_vec_at(vc->corpus, token_index[t])
+                                          : cbm_sem_corpus_ri_vec(vc->corpus, tokens[t]);
             if (ri) {
-                float idf = cbm_sem_corpus_idf(vc->corpus, tokens[t]);
+                float idf = token_index ? cbm_sem_corpus_idf_at(vc->corpus, token_index[t])
+                                        : cbm_sem_corpus_idf(vc->corpus, tokens[t]);
                 cbm_sem_vec_add_scaled(&ri_dense, ri, idf);
             }
         }
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, token_index);
         cbm_sem_normalize(&ri_dense);
         cbm_rsq_encode(ri_dense.v, &vc->funcs[f].ri_code);
 
@@ -789,18 +854,30 @@ enum {
     SCORE_SEEN_EMPTY = -1,
 };
 
-/* Check whether `j` has already been recorded in the open-addressed `seen`
- * set for this function; insert it if not.  Returns true when the insertion
- * was fresh (caller should add to candidates). */
-static bool score_seen_insert(int *seen, int j) {
+/* The open-addressed `seen` set of one worker, reused for every function it
+ * scores: a slot belongs to the current function only when its stamp says so,
+ * so starting a function costs nothing where re-filling 8,192 slots cost a
+ * 32 KB write per function (90 k on the Go corpus, waste sanitizer
+ * 2026-09-17). Same size and probe order: the same candidates, in order. */
+typedef struct {
+    int ids[SCORE_SEEN_CAP];
+    int stamp[SCORE_SEEN_CAP];
+    int current; /* function index + 1: unique per function, never 0 */
+} score_seen_t;
+
+/* Check whether `j` has already been recorded in the `seen` set for this
+ * function; insert it if not.  Returns true when the insertion was fresh
+ * (caller should add to candidates). */
+static bool score_seen_insert(score_seen_t *seen, int j) {
     uint32_t slot = (uint32_t)j & SCORE_SEEN_MASK;
     for (int p = 0; p < SCORE_SEEN_CAP; p++) {
         uint32_t idx = (slot + (uint32_t)p) & SCORE_SEEN_MASK;
-        if (seen[idx] == SCORE_SEEN_EMPTY) {
-            seen[idx] = j;
+        if (seen->stamp[idx] != seen->current) {
+            seen->stamp[idx] = seen->current;
+            seen->ids[idx] = j;
             return true;
         }
-        if (seen[idx] == j) {
+        if (seen->ids[idx] == j) {
             return false;
         }
     }
@@ -810,7 +887,7 @@ static bool score_seen_insert(int *seen, int j) {
 /* Collect the unique candidate function indices for node `i` by iterating
  * every LSH band and merging bucket members via `seen[]`.  Returns the
  * populated candidate count. */
-static int score_collect_candidates(score_ctx_t *sc, int i, int *seen, int *candidates,
+static int score_collect_candidates(score_ctx_t *sc, int i, score_seen_t *seen, int *candidates,
                                     int cand_cap) {
     int cand_count = 0;
     for (int b = 0; b < SEM_LSH_BANDS && cand_count < cand_cap; b++) {
@@ -862,22 +939,24 @@ static void score_try_emit(score_ctx_t *sc, int i, int j, int c, deferred_edge_b
 static void score_worker(int worker_id, void *ctx_ptr) {
     score_ctx_t *sc = ctx_ptr;
     deferred_edge_buf_t *my_buf = &sc->worker_bufs[worker_id];
+    score_seen_t *seen = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, sizeof(score_seen_t));
+    if (!seen) {
+        return; /* the other workers claim the functions this one leaves */
+    }
 
     while (true) {
         int i = atomic_fetch_add_explicit(&sc->next_idx, SKIP_ONE, memory_order_relaxed);
         if (i >= sc->func_count) {
             break;
         }
-        int seen[SCORE_SEEN_CAP];
-        for (int s = 0; s < SCORE_SEEN_CAP; s++) {
-            seen[s] = SCORE_SEEN_EMPTY;
-        }
+        seen->current = i + SKIP_ONE;
         int candidates[SEM_MAX_CANDIDATES];
         int cand_count = score_collect_candidates(sc, i, seen, candidates, SEM_MAX_CANDIDATES);
         for (int c = 0; c < cand_count; c++) {
             score_try_emit(sc, i, candidates[c], c, my_buf);
         }
     }
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, seen);
 }
 
 /* ── Parallel Phase 1b: decode minhash/profile + build per-func vectors ── */
@@ -964,13 +1043,14 @@ static int phase1_scan_functions(cbm_gbuf_t *gbuf, cbm_sem_func_t **out_funcs,
         for (int i = 0; i < node_count; i++) {
             if (func_count >= func_cap) {
                 int new_cap = func_cap < MAX_FUNCS_INIT ? MAX_FUNCS_INIT : func_cap * GROW;
-                cbm_sem_func_t *grown = realloc(funcs, (size_t)new_cap * sizeof(cbm_sem_func_t));
+                cbm_sem_func_t *grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, funcs,
+                                                    (size_t)new_cap * sizeof(cbm_sem_func_t));
                 if (!grown) {
                     break;
                 }
                 funcs = grown;
-                const cbm_gbuf_node_t **np_grown =
-                    realloc(node_ptrs, (size_t)new_cap * sizeof(cbm_gbuf_node_t *));
+                const cbm_gbuf_node_t **np_grown = cbm_realloc(
+                    CBM_MEM_CLASS_SEMANTIC, node_ptrs, (size_t)new_cap * sizeof(cbm_gbuf_node_t *));
                 if (!np_grown) {
                     break;
                 }
@@ -1023,7 +1103,8 @@ static void phase5c_build_lsh_buckets(const uint64_t *signatures, int func_count
             if (bucket->count >= bucket->cap) {
                 int nc =
                     bucket->cap < SEM_BUCKET_CAP_INIT ? SEM_BUCKET_CAP_INIT : bucket->cap * GROW;
-                int *ni = realloc(bucket->items, (size_t)nc * sizeof(int));
+                int *ni =
+                    cbm_realloc(CBM_MEM_CLASS_SEMANTIC, bucket->items, (size_t)nc * sizeof(int));
                 if (!ni) {
                     continue;
                 }
@@ -1065,7 +1146,7 @@ static int phase6b_merge_edges(cbm_gbuf_t *gbuf, deferred_edge_buf_t *worker_buf
     }
     deferred_edge_t *pairs = NULL;
     if (total_pairs > 0) {
-        pairs = malloc((size_t)total_pairs * sizeof(deferred_edge_t));
+        pairs = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)total_pairs * sizeof(deferred_edge_t));
     }
     if (!pairs) {
         for (int w = 0; w < worker_count; w++) {
@@ -1082,9 +1163,27 @@ static int phase6b_merge_edges(cbm_gbuf_t *gbuf, deferred_edge_buf_t *worker_buf
     }
     qsort(pairs, (size_t)n, sizeof(deferred_edge_t), cmp_deferred_edge_canonical);
 
+    /* CBM_SEM_PAIR_DUMP=<path>: every candidate that passed the threshold, with
+     * its score, in canonical order. Written HERE because this loop is
+     * single-threaded and already sorted, so the dump needs no lock and two
+     * runs compare line by line. The (i, j) indices are stable across runs —
+     * funcs[] is sorted by qualified name — where node ids are not. Exists to
+     * chase the near-threshold SEMANTICALLY_RELATED flicker: find the pair that
+     * flips, then compare its score between runs. */
+    FILE *pair_dump = NULL;
+    {
+        char dump_path[CBM_SZ_1K];
+        if (cbm_safe_getenv("CBM_SEM_PAIR_DUMP", dump_path, sizeof(dump_path), NULL)) {
+            pair_dump = cbm_fopen(dump_path, "w");
+        }
+    }
+
     int total_edges = 0;
     for (int e = 0; e < n; e++) {
         deferred_edge_t *de = &pairs[e];
+        if (pair_dump) {
+            fprintf(pair_dump, "%d %d %.9g\n", de->i, de->j, (double)de->score);
+        }
         if (edge_counts[de->i] >= max_edges || edge_counts[de->j] >= max_edges) {
             continue;
         }
@@ -1096,7 +1195,10 @@ static int phase6b_merge_edges(cbm_gbuf_t *gbuf, deferred_edge_buf_t *worker_buf
         edge_counts[de->j]++;
         total_edges++;
     }
-    free(pairs);
+    if (pair_dump) {
+        (void)fclose(pair_dump);
+    }
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, pairs);
     return total_edges;
 }
 
@@ -1130,7 +1232,8 @@ static void phase3c_export_token_vectors(cbm_gbuf_t *gbuf, cbm_sem_corpus_t *cor
 /* Phase 5a: generate NUM_HYPERPLANES × CBM_SEM_DIM deterministic random
  * float hyperplanes seeded from XXH3 so signatures are reproducible. */
 static hyperplane_row_t *phase5a_build_hyperplanes(void) {
-    hyperplane_row_t *hyperplanes = malloc(sizeof(hyperplane_row_t) * NUM_HYPERPLANES);
+    hyperplane_row_t *hyperplanes =
+        cbm_alloc(CBM_MEM_CLASS_SEMANTIC, sizeof(hyperplane_row_t) * NUM_HYPERPLANES);
     if (!hyperplanes) {
         return NULL;
     }
@@ -1164,13 +1267,31 @@ static void phase1b_decode_and_build(cbm_sem_func_t *funcs, const cbm_gbuf_node_
 
 /* Phase 2: tokenize each function's metadata in parallel, filling
  * all_tokens[] and token_counts[].  Caller allocates the arrays. */
-static void phase2_tokenize(const cbm_gbuf_node_t **node_ptrs, cbm_gbuf_t *gbuf, char **all_tokens,
-                            int *token_counts, int func_count, int worker_count,
-                            CBMHashTable **pools) {
+static void phase2_tokenize(const cbm_gbuf_node_t **node_ptrs, cbm_gbuf_t *gbuf, char ***out_tokens,
+                            size_t **out_offsets, int *token_counts, int func_count,
+                            int worker_count, CBMHashTable **pools) {
+    *out_tokens = NULL;
+    *out_offsets = NULL;
+    tok_buf_t *bufs = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)worker_count * sizeof(tok_buf_t));
+    int *tok_worker = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)func_count * sizeof(int));
+    size_t *tok_off = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)func_count * sizeof(size_t));
+    size_t *offsets = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)func_count * sizeof(size_t));
+    if (!bufs || !tok_worker || !tok_off || !offsets) {
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, bufs);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, tok_worker);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, tok_off);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, offsets);
+        for (int f = 0; f < func_count; f++) {
+            token_counts[f] = 0;
+        }
+        return;
+    }
     tokenize_ctx_t tc = {
         .node_ptrs = node_ptrs,
         .gbuf = gbuf,
-        .all_tokens = all_tokens,
+        .bufs = bufs,
+        .tok_worker = tok_worker,
+        .tok_off = tok_off,
         .token_counts = token_counts,
         .func_count = func_count,
         .pools = pools,
@@ -1178,22 +1299,60 @@ static void phase2_tokenize(const cbm_gbuf_node_t **node_ptrs, cbm_gbuf_t *gbuf,
     atomic_init(&tc.next_idx, 0);
     cbm_parallel_for_opts_t opts = {.max_workers = worker_count, .force_pthreads = false};
     cbm_parallel_for(worker_count, tokenize_worker, &tc, opts);
+
+    /* Pack: one array, functions addressed by offset. Worker w's buffer lands
+     * at base[w]; a function's tokens sit at base[worker] + its offset. */
+    size_t total = 0;
+    for (int w = 0; w < worker_count; w++) {
+        total += bufs[w].count;
+    }
+    char **packed = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (total ? total : 1) * sizeof(char *));
+    if (packed) {
+        size_t base = 0;
+        for (int w = 0; w < worker_count; w++) {
+            if (bufs[w].count) {
+                memcpy(packed + base, bufs[w].items, bufs[w].count * sizeof(*bufs[w].items));
+            }
+            /* Copied: give the worker buffer back now, so the packing transient
+             * is the packed array plus ONE worker buffer, not plus all of them. */
+            cbm_free(CBM_MEM_CLASS_SEMANTIC, bufs[w].items);
+            bufs[w].items = NULL;
+            bufs[w].cap = base; /* reuse: base offset of this worker's tokens */
+            base += bufs[w].count;
+        }
+        for (int f = 0; f < func_count; f++) {
+            offsets[f] = bufs[tok_worker[f]].cap + tok_off[f];
+        }
+    } else {
+        for (int f = 0; f < func_count; f++) {
+            token_counts[f] = 0;
+        }
+    }
+    for (int w = 0; w < worker_count; w++) {
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, bufs[w].items);
+    }
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, bufs);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, tok_worker);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, tok_off);
+    *out_tokens = packed;
+    *out_offsets = offsets;
 }
 
 /* Phase 4a: build per-function TF-IDF + RI vectors in parallel, producing
  * int8-quantized qvecs for subsequent storage.  Phase 4b runs sequentially
  * to store them in gbuf because gbuf is not thread-safe. */
 static void phase4_build_and_store_vectors(cbm_gbuf_t *gbuf, cbm_sem_func_t *funcs,
-                                           char **all_tokens, int *token_counts,
-                                           cbm_sem_corpus_t *corpus, int func_count,
-                                           int worker_count) {
-    uint8_t *qvecs = malloc((size_t)func_count * CBM_SEM_DIM);
+                                           char **all_tokens, const size_t *offsets,
+                                           int *token_counts, cbm_sem_corpus_t *corpus,
+                                           int func_count, int worker_count) {
+    uint8_t *qvecs = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)func_count * CBM_SEM_DIM);
     if (!qvecs) {
         return;
     }
     vec_build_ctx_t vc = {
         .funcs = funcs,
         .all_tokens = all_tokens,
+        .offsets = offsets,
         .token_counts = token_counts,
         .corpus = corpus,
         .qvecs = qvecs,
@@ -1206,7 +1365,7 @@ static void phase4_build_and_store_vectors(cbm_gbuf_t *gbuf, cbm_sem_func_t *fun
         cbm_gbuf_store_vector(gbuf, funcs[f].node_id, &qvecs[(ptrdiff_t)f * CBM_SEM_DIM],
                               CBM_SEM_DIM);
     }
-    free(qvecs);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, qvecs);
 }
 
 /* Phase 5: hyperplane generation → signatures → LSH bucket population.
@@ -1215,7 +1374,8 @@ static void phase4_build_and_store_vectors(cbm_gbuf_t *gbuf, cbm_sem_func_t *fun
 static void phase5_lsh_build(cbm_sem_func_t *funcs, int func_count, int worker_count,
                              uint64_t **out_signatures, sem_bucket_t ***out_buckets) {
     hyperplane_row_t *hyperplanes = phase5a_build_hyperplanes();
-    uint64_t *signatures = calloc((size_t)func_count, sizeof(uint64_t));
+    uint64_t *signatures =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)((size_t)func_count) * (sizeof(uint64_t)));
     if (hyperplanes && signatures) {
         sig_build_ctx_t sc = {
             .funcs = funcs,
@@ -1227,12 +1387,14 @@ static void phase5_lsh_build(cbm_sem_func_t *funcs, int func_count, int worker_c
         cbm_parallel_for_opts_t opts = {.max_workers = worker_count, .force_pthreads = false};
         cbm_parallel_for(worker_count, sig_build_worker, &sc, opts);
     }
-    free(hyperplanes);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, hyperplanes);
 
-    sem_bucket_t **band_buckets = calloc(SEM_LSH_BANDS, sizeof(sem_bucket_t *));
+    sem_bucket_t **band_buckets =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)(SEM_LSH_BANDS) * (sizeof(sem_bucket_t *)));
     if (band_buckets) {
         for (int b = 0; b < SEM_LSH_BANDS; b++) {
-            band_buckets[b] = calloc(SEM_BUCKET_COUNT, sizeof(sem_bucket_t));
+            band_buckets[b] = cbm_calloc(CBM_MEM_CLASS_SEMANTIC,
+                                         (size_t)(SEM_BUCKET_COUNT) * (sizeof(sem_bucket_t)));
         }
         phase5c_build_lsh_buckets(signatures, func_count, band_buckets);
     }
@@ -1240,6 +1402,139 @@ static void phase5_lsh_build(cbm_sem_func_t *funcs, int func_count, int worker_c
     *out_buckets = band_buckets;
 }
 
+/* Checksum every input the scorer reads, so two runs can be compared at the
+ * seam right before scoring. cbm_sem_combined_score() reads exactly these
+ * fields, so identical checksums with differing scores would be impossible.
+ * Placed AFTER tf-idf is filled (phase 4), not after phase 1b where the
+ * sparse vectors are still empty. Diagnostic, off unless the env var is set. */
+static void sem_state_dump(const cbm_sem_func_t *funcs, int func_count) {
+    /* CBM_SEM_STATE_DUMP=1: one checksum over every per-function vector, so two
+     * runs can be compared at THIS seam. Scores are pure math over these
+     * vectors, so if the checksums match and the scores do not, the difference
+     * is downstream; if they differ, it is here or above. Diagnostic only. */
+    char state_path[CBM_SZ_1K];
+    if (cbm_safe_getenv("CBM_SEM_STATE_DUMP", state_path, sizeof(state_path), NULL)) {
+        uint64_t h = 1469598103934665603ULL;
+        uint64_t h_codes = 1469598103934665603ULL;
+        uint64_t h_tfidf = 1469598103934665603ULL;
+        for (int i = 0; i < func_count; i++) {
+            const unsigned char *bytes[] = {
+                (const unsigned char *)&funcs[i].ri_code,
+                (const unsigned char *)&funcs[i].api_code,
+                (const unsigned char *)&funcs[i].type_code,
+                (const unsigned char *)&funcs[i].deco_code,
+            };
+            for (size_t b = 0; b < sizeof(bytes) / sizeof(bytes[0]); b++) {
+                for (size_t k = 0; k < sizeof(cbm_rsq_code_t); k++) {
+                    h ^= bytes[b][k];
+                    h *= 1099511628211ULL;
+                    h_codes ^= bytes[b][k];
+                    h_codes *= 1099511628211ULL;
+                }
+            }
+            /* The other scoring inputs: sparse TF-IDF, the AST profile and the
+             * minhash fingerprint. Scoring reads exactly these plus the codes
+             * above, so a matching checksum means the scores must match too. */
+            const unsigned char *sp = (const unsigned char *)funcs[i].struct_profile;
+            for (size_t k = 0; k < sizeof(funcs[i].struct_profile); k++) {
+                h ^= sp[k];
+                h *= 1099511628211ULL;
+            }
+            const unsigned char *mh = (const unsigned char *)funcs[i].minhash;
+            for (size_t k = 0; k < (funcs[i].has_minhash ? sizeof(funcs[i].minhash) : 0); k++) {
+                h ^= mh[k];
+                h *= 1099511628211ULL;
+            }
+            for (int w = 0; w < funcs[i].tfidf_len; w++) {
+                h ^= (uint64_t)funcs[i].tfidf_indices[w];
+                h *= 1099511628211ULL;
+                uint32_t bits;
+                memcpy(&bits, &funcs[i].tfidf_weights[w], sizeof(bits));
+                h ^= bits;
+                h *= 1099511628211ULL;
+                h_tfidf ^= (uint64_t)funcs[i].tfidf_indices[w];
+                h_tfidf *= 1099511628211ULL;
+                h_tfidf ^= bits;
+                h_tfidf *= 1099511628211ULL;
+            }
+        }
+        /* To a FILE, not the log: the semantic pass runs in the index WORKER,
+         * whose log is removed when the run succeeds. */
+        FILE *sf = cbm_fopen(state_path, "w");
+        if (sf) {
+            fprintf(sf, "all=%016llx codes=%016llx tfidf=%016llx n=%d\n", (unsigned long long)h,
+                    (unsigned long long)h_codes, (unsigned long long)h_tfidf, func_count);
+            (void)fclose(sf);
+        }
+    }
+}
+
+/* Running hash of the token SEQUENCE handed to the corpus: the set AND the
+ * order, because co-occurrence enrichment reads a window around each position,
+ * so the same tokens in a different order produce different vectors while
+ * leaving document frequencies (and therefore idf) untouched. Diagnostic for
+ * the SEMANTICALLY_RELATED flicker; off unless CBM_SEM_STATE_DUMP is set. */
+static uint64_t g_sem_token_hash = 1469598103934665603ULL;
+
+static void sem_tokens_hash(char **tokens, const size_t *offsets, const int *counts, int n) {
+    char flag[CBM_SZ_1K];
+    if (!cbm_safe_getenv("CBM_SEM_STATE_DUMP", flag, sizeof(flag), NULL)) {
+        return;
+    }
+    for (int d = 0; d < n; d++) {
+        for (int k = 0; k < counts[d]; k++) {
+            const char *tok = tokens[offsets[d] + (size_t)k];
+            for (const unsigned char *c = (const unsigned char *)tok; c && *c; c++) {
+                g_sem_token_hash ^= *c;
+                g_sem_token_hash *= 1099511628211ULL;
+            }
+            g_sem_token_hash ^= 0xff; /* token boundary */
+            g_sem_token_hash *= 1099511628211ULL;
+        }
+        g_sem_token_hash ^= 0xfe; /* document boundary */
+        g_sem_token_hash *= 1099511628211ULL;
+    }
+}
+
+/* Checksum the corpus AFTER enrichment: the per-function vectors and tf-idf are
+ * both derived from it, so if this differs between two runs, everything
+ * downstream differs and the cause is in the corpus build rather than in
+ * scoring. Diagnostic, off unless CBM_SEM_STATE_DUMP is set. */
+static void sem_corpus_dump(const cbm_sem_corpus_t *corpus, const char *suffix) {
+    char state_path[CBM_SZ_1K];
+    if (!cbm_safe_getenv("CBM_SEM_STATE_DUMP", state_path, sizeof(state_path), NULL)) {
+        return;
+    }
+    char path[CBM_SZ_1K];
+    if (snprintf(path, sizeof(path), "%s.%s", state_path, suffix) >= (int)sizeof(path)) {
+        return;
+    }
+    int n = cbm_sem_corpus_token_count(corpus);
+    uint64_t h_vec = 1469598103934665603ULL;
+    uint64_t h_idf = 1469598103934665603ULL;
+    for (int i = 0; i < n; i++) {
+        const cbm_sem_vec_t *v = cbm_sem_corpus_ri_vec_at(corpus, i);
+        if (v) {
+            const unsigned char *b = (const unsigned char *)v;
+            for (size_t k = 0; k < sizeof(*v); k++) {
+                h_vec ^= b[k];
+                h_vec *= 1099511628211ULL;
+            }
+        }
+        uint32_t bits;
+        float idf = cbm_sem_corpus_idf_at(corpus, i);
+        memcpy(&bits, &idf, sizeof(bits));
+        h_idf ^= bits;
+        h_idf *= 1099511628211ULL;
+    }
+    FILE *sf = cbm_fopen(path, "w");
+    if (sf) {
+        fprintf(sf, "vec=%016llx idf=%016llx toks=%016llx tokens=%d\n", (unsigned long long)h_vec,
+                (unsigned long long)h_idf, (unsigned long long)g_sem_token_hash, n);
+        (void)fclose(sf);
+    }
+}
+
 /* Phase 6a: score candidate pairs in parallel and collect deferred edges. */
 static void phase6a_score_candidates(cbm_sem_func_t *funcs, uint64_t *signatures, int *edge_counts,
                                      sem_bucket_t **band_buckets, cbm_sem_config_t cfg,
@@ -1270,25 +1565,28 @@ static void free_lsh_buckets(sem_bucket_t **band_buckets) {
             continue;
         }
         for (int h = 0; h < SEM_BUCKET_COUNT; h++) {
-            free(band_buckets[b][h].items);
+            cbm_free(CBM_MEM_CLASS_SEMANTIC, band_buckets[b][h].items);
         }
-        free(band_buckets[b]);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, band_buckets[b]);
     }
-    free(band_buckets);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, band_buckets);
 }
 
 /* Phases 3a/3b/3c bundled: create corpus, batch-add docs, finalize, export
  * enriched token vectors to the graph buffer.  Returns the new corpus, which
  * the caller must cbm_sem_corpus_free() later. */
-static cbm_sem_corpus_t *run_corpus_phase(cbm_gbuf_t *gbuf, char **all_tokens, int *token_counts,
+static cbm_sem_corpus_t *run_corpus_phase(cbm_gbuf_t *gbuf, char **all_tokens,
+                                          const size_t *offsets, int *token_counts,
                                           int func_count) {
     CBM_PROF_START(t_phase3a);
     cbm_sem_corpus_t *corpus = cbm_sem_corpus_new();
-    cbm_sem_corpus_add_docs_batch(corpus, all_tokens, token_counts, func_count, CBM_SEM_MAX_TOKENS);
+    sem_tokens_hash(all_tokens, offsets, token_counts, func_count);
+    cbm_sem_corpus_add_docs_batch(corpus, all_tokens, offsets, token_counts, func_count);
     CBM_PROF_END_N("semantic_edges", "3a_corpus_batch", t_phase3a, func_count);
 
     CBM_PROF_START(t_phase3b);
     cbm_sem_corpus_finalize(corpus);
+    sem_corpus_dump(corpus, "corpus");
     CBM_PROF_END_N("semantic_edges", "3b_corpus_finalize_seq", t_phase3b,
                    cbm_sem_corpus_token_count(corpus));
 
@@ -1304,11 +1602,13 @@ static cbm_sem_corpus_t *run_corpus_phase(cbm_gbuf_t *gbuf, char **all_tokens, i
 static int run_scoring_phase(cbm_gbuf_t *gbuf, cbm_sem_func_t *funcs, uint64_t *signatures,
                              sem_bucket_t **band_buckets, cbm_sem_config_t cfg, int func_count,
                              int worker_count) {
-    int *edge_counts = calloc((size_t)func_count, sizeof(int));
-    deferred_edge_buf_t *worker_bufs = calloc((size_t)worker_count, sizeof(deferred_edge_buf_t));
+    int *edge_counts =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)((size_t)func_count) * (sizeof(int)));
+    deferred_edge_buf_t *worker_bufs = cbm_calloc(
+        CBM_MEM_CLASS_SEMANTIC, (size_t)((size_t)worker_count) * (sizeof(deferred_edge_buf_t)));
     if (!edge_counts || !worker_bufs) {
-        free(edge_counts);
-        free(worker_bufs);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, edge_counts);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, worker_bufs);
         return 0;
     }
     for (int w = 0; w < worker_count; w++) {
@@ -1316,6 +1616,7 @@ static int run_scoring_phase(cbm_gbuf_t *gbuf, cbm_sem_func_t *funcs, uint64_t *
     }
 
     CBM_PROF_START(t_phase6a);
+    sem_state_dump(funcs, func_count);
     phase6a_score_candidates(funcs, signatures, edge_counts, band_buckets, cfg, worker_bufs,
                              func_count, worker_count);
     CBM_PROF_END_N("semantic_edges", "6a_score_parallel", t_phase6a, func_count);
@@ -1324,8 +1625,8 @@ static int run_scoring_phase(cbm_gbuf_t *gbuf, cbm_sem_func_t *funcs, uint64_t *
     int total = phase6b_merge_edges(gbuf, worker_bufs, worker_count, edge_counts, cfg.max_edges);
     CBM_PROF_END_N("semantic_edges", "6b_edge_merge_seq", t_phase6b, total);
 
-    free(worker_bufs);
-    free(edge_counts);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, worker_bufs);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, edge_counts);
     return total;
 }
 
@@ -1333,20 +1634,22 @@ static int run_scoring_phase(cbm_gbuf_t *gbuf, cbm_sem_func_t *funcs, uint64_t *
 static void free_token_pool_entry(const char *key, void *value, void *ud) {
     (void)key; /* key == value: one owned string per unique token */
     (void)ud;
-    free(value);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, value);
 }
 
 /* all_tokens slots BORROW their strings from the per-worker intern pools;
  * the pools own exactly one copy per unique token per worker. */
 static void free_funcs_and_tokens(cbm_sem_func_t *funcs, int func_count, char **all_tokens,
-                                  const int *token_counts, CBMHashTable **pools, int worker_count) {
+                                  size_t *offsets, const int *token_counts, CBMHashTable **pools,
+                                  int worker_count) {
     (void)token_counts;
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, offsets);
     for (int f = 0; f < func_count; f++) {
-        free(funcs[f].tfidf_indices);
-        free(funcs[f].tfidf_weights);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, funcs[f].tfidf_indices);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, funcs[f].tfidf_weights);
     }
-    free(all_tokens);
-    free(funcs);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, all_tokens);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, funcs);
     if (pools) {
         for (int w = 0; w < worker_count; w++) {
             if (pools[w]) {
@@ -1354,10 +1657,155 @@ static void free_funcs_and_tokens(cbm_sem_func_t *funcs, int func_count, char **
                 cbm_ht_free(pools[w]);
             }
         }
-        free(pools);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, pools);
     }
 }
 
+/* ── Memory checkpoints inside the pass (CBM_MEM_PHASES=1) ─────────── */
+
+/* The pass is one phase mark to the pipeline; its transient lives between
+ * marks. These lines put the semantic class's live/peak bytes and the charged
+ * footprint at every sub-phase boundary, so the peak is attributable. */
+static void sem_mem_mark(const char *step) {
+    if (!cbm_mem_phases_enabled()) {
+        return;
+    }
+    enum { MB = 1024 * 1024 };
+    char live[CBM_SZ_16];
+    char peak[CBM_SZ_16];
+    char charged[CBM_SZ_16];
+    snprintf(live, sizeof(live), "%zu", cbm_mem_class_live_bytes(CBM_MEM_CLASS_SEMANTIC) / MB);
+    snprintf(peak, sizeof(peak), "%zu", cbm_mem_class_peak_bytes(CBM_MEM_CLASS_SEMANTIC) / MB);
+    snprintf(charged, sizeof(charged), "%zu", cbm_mem_charged() / MB);
+    cbm_log_info("mem.semantic.step", "step", step, "sem_live_mb", live, "sem_peak_mb", peak,
+                 "charged_mb", charged);
+}
+
+/* ── Headroom-sized batches ───────────────────────────────────────── */
+
+/* Phases 2-4 hold, per function, its token pointers, the corpus's per-doc
+ * token ids and the quantized vector being stored: ~3 KB per function on the
+ * kernel (783k functions -> the 4.9 GB transient the 15 GB budget run
+ * overshot with, 2026-09-13). The retained part -- the funcs array and the
+ * corpus entries -- is what scoring needs whole and stays. When the charged
+ * footprint plus that transient would cross the budget, the token phases run
+ * per batch of functions: tokenize -> count into the corpus -> free, then,
+ * after finalize, tokenize again -> vectorize -> store -> free. Tokenization
+ * is deterministic, so both passes see the same tokens and the graph does
+ * not change; the run pays with the second tokenize. */
+enum {
+    SEM_BATCH_BYTES_PER_FUNC = 4096, /* measured 3 KB, rounded up */
+    SEM_BATCH_MIN_FUNCS = 4096,
+};
+
+static int sem_batch_size(int func_count) {
+    /* CBM_SEM_BATCH=<n> forces the batch size regardless of budget (the
+     * batched-equals-unbatched test, small-machine iteration). */
+    char forced_buf[CBM_SZ_16];
+    if (cbm_safe_getenv("CBM_SEM_BATCH", forced_buf, sizeof(forced_buf), NULL)) {
+        int forced = atoi(forced_buf);
+        if (forced > 0 && forced < func_count) {
+            cbm_log_info("mem.semantic.batches", "functions", itoa_log(func_count), "batch",
+                         itoa_log(forced), "reason", "env");
+            return forced;
+        }
+    }
+    size_t budget = cbm_mem_budget();
+    if (budget == 0 || func_count <= SEM_BATCH_MIN_FUNCS) {
+        return func_count;
+    }
+    size_t charged = cbm_mem_charged();
+    size_t headroom = budget > charged ? budget - charged : 0;
+    size_t transient = (size_t)func_count * SEM_BATCH_BYTES_PER_FUNC;
+    /* Half the headroom is the transient's share; the other half is what the
+     * later phases (signatures, buckets, deferred edges) and mimalloc keep. */
+    size_t share = headroom / 2;
+    if (transient <= share) {
+        return func_count;
+    }
+    size_t batch = share / SEM_BATCH_BYTES_PER_FUNC;
+    if (batch < SEM_BATCH_MIN_FUNCS) {
+        batch = SEM_BATCH_MIN_FUNCS;
+    }
+    if (batch > (size_t)func_count) {
+        batch = (size_t)func_count;
+    }
+    enum { MB = 1024 * 1024 };
+    cbm_log_info("mem.semantic.batches", "functions", itoa_log(func_count), "batch",
+                 itoa_log((int)batch), "headroom_mb", itoa_log((int)(headroom / MB)),
+                 "transient_mb", itoa_log((int)(transient / MB)));
+    return (int)batch;
+}
+
+/* One batch of the token phases: tokenize functions [first, first+count) into
+ * a fresh packed array the caller frees with sem_batch_free_tokens(). */
+static void sem_batch_tokenize(const cbm_gbuf_node_t **node_ptrs, cbm_gbuf_t *gbuf, int first,
+                               int count, int worker_count, CBMHashTable **pools, int *token_counts,
+                               char ***out_tokens, size_t **out_offsets) {
+    phase2_tokenize(node_ptrs + first, gbuf, out_tokens, out_offsets, token_counts + first, count,
+                    worker_count, pools);
+}
+
+static void sem_batch_free_tokens(char **tokens, size_t *offsets) {
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, tokens);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, offsets);
+}
+
+/* Phases 2-4 in headroom-sized batches. The corpus is fed batch by batch
+ * (its per-doc token ids are ints, kept for co-occurrence), finalized once,
+ * then vectors are built batch by batch from a second tokenization. */
+static cbm_sem_corpus_t *run_token_phases_batched(cbm_gbuf_t *gbuf, cbm_sem_func_t *funcs,
+                                                  const cbm_gbuf_node_t **node_ptrs,
+                                                  int *token_counts, int func_count, int batch,
+                                                  int worker_count, CBMHashTable **token_pools) {
+    CBM_PROF_START(t_phase2);
+    cbm_sem_corpus_t *corpus = cbm_sem_corpus_new();
+    for (int first = 0; first < func_count; first += batch) {
+        int count = func_count - first < batch ? func_count - first : batch;
+        char **tokens = NULL;
+        size_t *offsets = NULL;
+        sem_batch_tokenize(node_ptrs, gbuf, first, count, worker_count, token_pools, token_counts,
+                           &tokens, &offsets);
+        if (tokens && offsets) {
+            sem_tokens_hash(tokens, offsets, token_counts + first, count);
+            cbm_sem_corpus_add_docs_batch(corpus, tokens, offsets, token_counts + first, count);
+        }
+        sem_batch_free_tokens(tokens, offsets);
+        cbm_mem_release_to_os(); /* the batch's pages leave the charge now, not at the mark */
+    }
+    CBM_PROF_END_N("semantic_edges", "2+3a_tokenize_count_batched", t_phase2, func_count);
+    sem_mem_mark("3a_corpus_batched");
+
+    CBM_PROF_START(t_phase3b);
+    cbm_sem_corpus_finalize(corpus);
+    sem_corpus_dump(corpus, "corpus");
+    CBM_PROF_END_N("semantic_edges", "3b_corpus_finalize_seq", t_phase3b,
+                   cbm_sem_corpus_token_count(corpus));
+    CBM_PROF_START(t_phase3c);
+    phase3c_export_token_vectors(gbuf, corpus);
+    CBM_PROF_END_N("semantic_edges", "3c_token_vec_export_seq", t_phase3c,
+                   cbm_sem_corpus_token_count(corpus));
+    sem_mem_mark("3c_export");
+
+    CBM_PROF_START(t_phase4);
+    for (int first = 0; first < func_count; first += batch) {
+        int count = func_count - first < batch ? func_count - first : batch;
+        char **tokens = NULL;
+        size_t *offsets = NULL;
+        sem_batch_tokenize(node_ptrs, gbuf, first, count, worker_count, token_pools, token_counts,
+                           &tokens, &offsets);
+        if (tokens && offsets) {
+            phase4_build_and_store_vectors(gbuf, funcs + first, tokens, offsets,
+                                           token_counts + first, corpus, count, worker_count);
+        }
+        sem_batch_free_tokens(tokens, offsets);
+        cbm_mem_release_to_os();
+    }
+    CBM_PROF_END_N("semantic_edges", "2+4_tokenize_vectorize_batched", t_phase4, func_count);
+    sem_mem_mark("4_vectors");
+    return corpus;
+}
+
 /* ── Pass entry point ────────────────────────────────────────────── */
 
 int cbm_pipeline_pass_semantic_edges(cbm_pipeline_ctx_t *ctx) {
@@ -1381,37 +1829,53 @@ int cbm_pipeline_pass_semantic_edges(cbm_pipeline_ctx_t *ctx) {
     cbm_log_info("pass.semantic.collected", "functions", itoa_log(func_count));
 
     if (func_count < PSE_MIN_FUNCS_FOR_PAIR) {
-        free(funcs);
-        free(node_ptrs);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, funcs);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, node_ptrs);
         cbm_log_info("pass.done", "pass", "semantic_edges", "edges", "0");
         return 0;
     }
 
+    sem_mem_mark("1b_decode_build");
+
     /* Phase 2: Tokenize all nodes (PARALLEL) */
     int worker_count = cbm_default_worker_count(false);
-    char **all_tokens = malloc((size_t)func_count * sizeof(char *) * CBM_SEM_MAX_TOKENS);
-    int *token_counts = calloc((size_t)func_count, sizeof(int));
+    char **all_tokens = NULL;   /* packed by phase2_tokenize */
+    size_t *tok_offsets = NULL; /* per function: index into all_tokens */
+    int *token_counts =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)((size_t)func_count) * (sizeof(int)));
 
-    CBM_PROF_START(t_phase2);
-    CBMHashTable **token_pools = calloc((size_t)worker_count, sizeof(CBMHashTable *));
+    CBMHashTable **token_pools = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)((size_t)worker_count) *
+                                                                        (sizeof(CBMHashTable *)));
     if (token_pools) {
         for (int w = 0; w < worker_count; w++) {
             token_pools[w] = cbm_ht_create(CBM_SZ_1K);
         }
     }
-    phase2_tokenize(node_ptrs, gbuf, all_tokens, token_counts, func_count, worker_count,
-                    token_pools);
-    CBM_PROF_END_N("semantic_edges", "2_tokenize_parallel", t_phase2, func_count);
-    free(node_ptrs);
+    cbm_sem_corpus_t *corpus = NULL;
+    int batch = sem_batch_size(func_count);
+    if (batch < func_count) {
+        corpus = run_token_phases_batched(gbuf, funcs, node_ptrs, token_counts, func_count, batch,
+                                          worker_count, token_pools);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, node_ptrs);
+    } else {
+        CBM_PROF_START(t_phase2);
+        phase2_tokenize(node_ptrs, gbuf, &all_tokens, &tok_offsets, token_counts, func_count,
+                        worker_count, token_pools);
+        CBM_PROF_END_N("semantic_edges", "2_tokenize_parallel", t_phase2, func_count);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, node_ptrs);
+        sem_mem_mark("2_tokenize");
 
-    /* Phase 3: Build corpus (batch add), finalize, export enriched token vectors. */
-    cbm_sem_corpus_t *corpus = run_corpus_phase(gbuf, all_tokens, token_counts, func_count);
+        /* Phase 3: Build corpus (batch add), finalize, export enriched token vectors. */
+        corpus = run_corpus_phase(gbuf, all_tokens, tok_offsets, token_counts, func_count);
+        sem_mem_mark("3_corpus");
 
-    /* Phase 4: Build per-function TF-IDF + RI vectors (PARALLEL) and store them. */
-    CBM_PROF_START(t_phase4);
-    phase4_build_and_store_vectors(gbuf, funcs, all_tokens, token_counts, corpus, func_count,
-                                   worker_count);
-    CBM_PROF_END_N("semantic_edges", "4_build_and_store_vec", t_phase4, func_count);
+        /* Phase 4: Build per-function TF-IDF + RI vectors (PARALLEL) and store them. */
+        CBM_PROF_START(t_phase4);
+        phase4_build_and_store_vectors(gbuf, funcs, all_tokens, tok_offsets, token_counts, corpus,
+                                       func_count, worker_count);
+        CBM_PROF_END_N("semantic_edges", "4_build_and_store_vec", t_phase4, func_count);
+        sem_mem_mark("4_vectors");
+    }
 
     cbm_log_info("pass.semantic.vectors_stored", "count", itoa_log(func_count));
 
@@ -1424,18 +1888,22 @@ int cbm_pipeline_pass_semantic_edges(cbm_pipeline_ctx_t *ctx) {
 
     cbm_log_info("pass.semantic.lsh_built", "functions", itoa_log(func_count), "bands",
                  itoa_log(SEM_LSH_BANDS));
+    sem_mem_mark("5_lsh");
 
     /* Phase 6: Parallel scoring + sequential edge merge. */
     int total_edges =
         run_scoring_phase(gbuf, funcs, signatures, band_buckets, cfg, func_count, worker_count);
 
+    sem_mem_mark("6_score");
+
     /* Phase 7: Cleanup */
     CBM_PROF_START(t_phase7);
     free_lsh_buckets(band_buckets);
-    free(signatures);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, signatures);
     cbm_log_info("pass.done", "pass", "semantic_edges", "edges", itoa_log(total_edges));
-    free_funcs_and_tokens(funcs, func_count, all_tokens, token_counts, token_pools, worker_count);
-    free(token_counts);
+    free_funcs_and_tokens(funcs, func_count, all_tokens, tok_offsets, token_counts, token_pools,
+                          worker_count);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, token_counts);
     cbm_sem_corpus_free(corpus);
     CBM_PROF_END("semantic_edges", "7_cleanup", t_phase7);
 
diff --git a/src/pipeline/pass_similarity.c b/src/pipeline/pass_similarity.c
index db4297202..8bef7933d 100644
--- a/src/pipeline/pass_similarity.c
+++ b/src/pipeline/pass_similarity.c
@@ -8,6 +8,7 @@
  * Runs as a post-pass after enrichment (both full and incremental).
  */
 #include "foundation/constants.h"
+#include "foundation/mem_core.h"
 #include "pipeline/pipeline.h"
 #include <stdint.h>
 #include "pipeline/pipeline_internal.h"
@@ -132,7 +133,8 @@ static int collect_fp_entries(cbm_gbuf_t *gbuf, fp_entry_t **out_entries) {
             }
             if (count >= cap) {
                 int new_cap = cap < FP_ENTRY_INIT_CAP ? FP_ENTRY_INIT_CAP : cap * FP_ENTRY_GROW;
-                fp_entry_t *grown = realloc(entries, (size_t)new_cap * sizeof(fp_entry_t));
+                fp_entry_t *grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, entries,
+                                                (size_t)new_cap * sizeof(fp_entry_t));
                 if (!grown) {
                     break;
                 }
@@ -178,7 +180,8 @@ static void sim_edge_buf_push(sim_edge_buf_t *buf, int64_t src, int64_t tgt, dou
                               bool same_file) {
     if (buf->count >= buf->cap) {
         int nc = buf->cap < SIM_EDGE_INIT_CAP ? SIM_EDGE_INIT_CAP : buf->cap * SIM_EDGE_GROW;
-        sim_deferred_edge_t *grown = realloc(buf->edges, (size_t)nc * sizeof(sim_deferred_edge_t));
+        sim_deferred_edge_t *grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, buf->edges,
+                                                 (size_t)nc * sizeof(sim_deferred_edge_t));
         if (!grown) {
             return;
         }
@@ -204,8 +207,13 @@ static void sim_query_worker(int worker_id, void *ctx_ptr) {
     sim_query_ctx_t *sc = ctx_ptr;
     sim_edge_buf_t *my_buf = &sc->worker_bufs[worker_id];
 
-    /* Thread-local candidate buffer (stack-allocated) */
+    /* Thread-local candidate buffer (stack-allocated) and one dedup set for
+     * all of this worker's queries. */
     const cbm_lsh_entry_t *cands[SIM_CAND_CAP];
+    cbm_lsh_seen_t *seen = cbm_lsh_seen_new();
+    if (!seen) {
+        return; /* the other workers claim the entries this one leaves */
+    }
 
     while (true) {
         int i = atomic_fetch_add_explicit(&sc->next_idx, SKIP_ONE, memory_order_relaxed);
@@ -219,7 +227,7 @@ static void sim_query_worker(int worker_id, void *ctx_ptr) {
         }
 
         const fp_entry_t *src = &sc->entries[i];
-        int cand_count = cbm_lsh_query_into(sc->lsh, &src->fp, cands, SIM_CAND_CAP);
+        int cand_count = cbm_lsh_query_into_seen(sc->lsh, &src->fp, cands, SIM_CAND_CAP, seen);
 
         int emitted = 0;
         for (int c = 0; c < cand_count; c++) {
@@ -257,6 +265,7 @@ static void sim_query_worker(int worker_id, void *ctx_ptr) {
             atomic_fetch_add_explicit(&sc->edge_counts[i], emitted, memory_order_relaxed);
         }
     }
+    cbm_lsh_seen_free(seen);
 }
 
 /* Merge worker edge buffers into gbuf. Returns total edge count. Frees worker buffers. */
@@ -271,9 +280,9 @@ static int merge_sim_edges(cbm_gbuf_t *gbuf, sim_edge_buf_t *worker_bufs, int wo
             cbm_gbuf_insert_edge(gbuf, de->source_id, de->target_id, "SIMILAR_TO", props);
             total++;
         }
-        free(worker_bufs[w].edges);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, worker_bufs[w].edges);
     }
-    free(worker_bufs);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, worker_bufs);
     return total;
 }
 
@@ -293,7 +302,7 @@ int cbm_pipeline_pass_similarity(cbm_pipeline_ctx_t *ctx) {
     cbm_log_info("pass.similarity.collected", "nodes_with_fp", itoa_log(entry_count));
 
     if (entry_count < MIN_FP_ENTRIES) {
-        free(entries);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, entries);
         cbm_log_info("pass.done", "pass", "similarity", "edges", "0");
         return 0;
     }
@@ -301,9 +310,10 @@ int cbm_pipeline_pass_similarity(cbm_pipeline_ctx_t *ctx) {
     /* Phase 2: Build LSH index (sequential — cbm_lsh_insert mutates shared state) */
     CBM_PROF_START(t_lsh_build);
     cbm_lsh_index_t *lsh = cbm_lsh_new();
-    cbm_lsh_entry_t *lsh_entries = malloc((size_t)entry_count * sizeof(cbm_lsh_entry_t));
+    cbm_lsh_entry_t *lsh_entries =
+        cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)entry_count * sizeof(cbm_lsh_entry_t));
     if (!lsh_entries) {
-        free(entries);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, entries);
         cbm_lsh_free(lsh);
         return CBM_NOT_FOUND;
     }
@@ -325,9 +335,11 @@ int cbm_pipeline_pass_similarity(cbm_pipeline_ctx_t *ctx) {
      * in its own deferred buffer. Shared edge_counts is atomic.
      * Final merge into gbuf is sequential (gbuf not thread-safe). */
     CBM_PROF_START(t_query_emit);
-    _Atomic int *edge_counts = calloc((size_t)entry_count, sizeof(_Atomic int));
+    _Atomic int *edge_counts =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)((size_t)entry_count) * (sizeof(_Atomic int)));
     int worker_count = cbm_default_worker_count(false);
-    sim_edge_buf_t *worker_bufs = calloc((size_t)worker_count, sizeof(sim_edge_buf_t));
+    sim_edge_buf_t *worker_bufs = cbm_calloc(
+        CBM_MEM_CLASS_SEMANTIC, (size_t)((size_t)worker_count) * (sizeof(sim_edge_buf_t)));
 
     {
         sim_query_ctx_t sc = {
@@ -349,9 +361,9 @@ int cbm_pipeline_pass_similarity(cbm_pipeline_ctx_t *ctx) {
 
     cbm_log_info("pass.done", "pass", "similarity", "edges", itoa_log(total_edges));
 
-    free(edge_counts);
-    free(lsh_entries);
-    free(entries);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, edge_counts);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, lsh_entries);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, entries);
     cbm_lsh_free(lsh);
     return 0;
 }
diff --git a/src/pipeline/pipeline.c b/src/pipeline/pipeline.c
index 5fe794fd0..fa62441a1 100644
--- a/src/pipeline/pipeline.c
+++ b/src/pipeline/pipeline.c
@@ -10,6 +10,8 @@
  *   6. Post-passes: tests, communities, HTTP links, git history
  *   7. Dump graph buffer to SQLite
  */
+#include "foundation/arena.h" // FIRST: internal/cbm/arena.h shares the CBM_ARENA_H guard and lacks cbm_arena_total
+
 #include "foundation/constants.h"
 
 enum { CBM_DIR_PERMS = 0755, PL_RING = 4, PL_RING_MASK = 3, PL_SEQ_PASSES = 6 };
@@ -37,7 +39,11 @@ enum { CBM_DIR_PERMS = 0755, PL_RING = 4, PL_RING_MASK = 3, PL_SEQ_PASSES = 6 };
 #include "foundation/compat_thread.h"
 #include "foundation/profile.h"
 #include "foundation/mem.h"
+#include "foundation/mem_core.h"
+#include "result_spill.h"
+#include "foundation/secure_random.h"
 
+#include <ctype.h>
 #include <errno.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -72,6 +78,8 @@ static atomic_bool g_persist_test_cancel_after_destination_prepare = false;
 static atomic_bool g_persist_test_fail_adr_capture = false;
 static cbm_pipeline_test_hook_fn g_persist_test_before_final_manifest = NULL;
 static void *g_persist_test_before_final_manifest_userdata = NULL;
+static cbm_pipeline_test_hook_fn g_persist_test_after_stage_created = NULL;
+static void *g_persist_test_after_stage_created_userdata = NULL;
 
 void cbm_pipeline_incremental_test_fail_after_stage_dump_once(void) {
     atomic_store(&g_persist_test_fail_after_stage_dump, true);
@@ -105,6 +113,29 @@ void cbm_pipeline_persist_test_run_before_final_manifest(void) {
     }
 }
 
+void cbm_pipeline_incremental_test_after_stage_created_once(cbm_pipeline_test_hook_fn hook,
+                                                            void *userdata) {
+    g_persist_test_after_stage_created = hook;
+    g_persist_test_after_stage_created_userdata = userdata;
+}
+
+/* Fired by create_staging_path() right after the stage's main file is created
+ * with O_EXCL -- and, in the current lock-before-visible ordering, after its
+ * sidecar lock is already held. A test hook installed here can run a
+ * concurrent sweep (another cbm_pipeline_run() against the same final_path) at
+ * this instant to prove the just-created stage survives it. Under the OLD
+ * create-then-lock ordering this was the unlocked TOCTOU window, so the same
+ * hook binds RED if that ordering ever regresses. */
+void cbm_pipeline_persist_test_run_after_stage_created(void) {
+    cbm_pipeline_test_hook_fn hook = g_persist_test_after_stage_created;
+    void *userdata = g_persist_test_after_stage_created_userdata;
+    g_persist_test_after_stage_created = NULL;
+    g_persist_test_after_stage_created_userdata = NULL;
+    if (hook) {
+        hook(userdata);
+    }
+}
+
 bool cbm_pipeline_persist_test_take_failure_after_stage_dump(void) {
     return atomic_exchange(&g_persist_test_fail_after_stage_dump, false);
 }
@@ -124,6 +155,8 @@ void cbm_pipeline_persist_test_reset_faults(void) {
     atomic_store(&g_persist_test_fail_adr_capture, false);
     g_persist_test_before_final_manifest = NULL;
     g_persist_test_before_final_manifest_userdata = NULL;
+    g_persist_test_after_stage_created = NULL;
+    g_persist_test_after_stage_created_userdata = NULL;
 }
 #endif
 
@@ -157,6 +190,8 @@ struct cbm_pipeline {
     atomic_int cancelled_storage;
     atomic_int *cancelled;
     bool persistence; /* write .codebase-memory/graph.db.zst after indexing */
+    cbm_index_resource_policy_t resource_policy;
+    cbm_index_resource_violation_t resource_violation;
 
     /* Indexing state (set during run) */
     cbm_gbuf_t *gbuf;
@@ -195,6 +230,15 @@ struct cbm_pipeline {
      * full rebuild, so the MCP response can surface the migration. */
     bool format_migration;
 
+    /* Recorded by cbm_pipeline_run for the staged run beneath it: whether
+     * the destination existed, and whether it was copied into the stage so
+     * that an incremental route has a real previous generation to work
+     * from. Without a copy the stage is the run's empty placeholder, and
+     * probing THAT for integrity is what reported every first index as
+     * "invalid_existing_db" (#1864). */
+    bool final_existed;
+    bool existing_generation;
+
     /* ADR (project_summaries) captured before a full-reindex DB delete, so it
      * can be restored after the rebuild. NULL when no ADR existed. Issue #516. */
     char *saved_adr;
@@ -255,9 +299,27 @@ static const char *itoa_buf(int val) {
 /* Log current + peak RSS at a pipeline phase boundary (memory profiling). */
 static void log_phase_mem(const char *phase) {
     enum { PL_BYTES_PER_MB = 1024 * 1024 };
-    cbm_log_info("mem.phase", "phase", phase, "rss_mb",
-                 itoa_buf((int)(cbm_mem_rss() / PL_BYTES_PER_MB)), "peak_mb",
-                 itoa_buf((int)(cbm_mem_peak_rss() / PL_BYTES_PER_MB)));
+    /* tracked_mb is what the memory core can account for; rss_mb - tracked_mb
+     * is the part of the process no class explains yet. */
+    /* itoa_buf is a 4-slot ring: two calls per line, never more. */
+    char rss_mb[CBM_SZ_32];
+    char footprint_mb[CBM_SZ_32];
+    char commit_mb[CBM_SZ_32];
+    char tracked_mb[CBM_SZ_32];
+    char peak_mb[CBM_SZ_32];
+    char peak_charged_mb[CBM_SZ_32];
+    snprintf(rss_mb, sizeof(rss_mb), "%zu", cbm_mem_rss() / PL_BYTES_PER_MB);
+    snprintf(footprint_mb, sizeof(footprint_mb), "%zu", cbm_mem_footprint() / PL_BYTES_PER_MB);
+    snprintf(commit_mb, sizeof(commit_mb), "%zu", cbm_mem_allocator_committed() / PL_BYTES_PER_MB);
+    snprintf(tracked_mb, sizeof(tracked_mb), "%zu", cbm_mem_tracked_live_bytes() / PL_BYTES_PER_MB);
+    snprintf(peak_mb, sizeof(peak_mb), "%zu", cbm_mem_peak_rss() / PL_BYTES_PER_MB);
+    (void)cbm_mem_charged(); /* fold this mark into the high-water mark */
+    snprintf(peak_charged_mb, sizeof(peak_charged_mb), "%zu",
+             cbm_mem_peak_charged() / PL_BYTES_PER_MB);
+    cbm_log_info("mem.phase", "phase", phase, "rss_mb", rss_mb, "footprint_mb", footprint_mb,
+                 "commit_mb", commit_mb, "tracked_mb", tracked_mb, "peak_mb", peak_mb,
+                 "peak_charged_mb", peak_charged_mb);
+    cbm_mem_allocator_stats_log(phase);
 }
 
 /* ── Lifecycle ──────────────────────────────────────────────────── */
@@ -313,6 +375,20 @@ void cbm_pipeline_set_persistence(cbm_pipeline_t *p, bool enabled) {
     }
 }
 
+void cbm_pipeline_set_resource_policy(cbm_pipeline_t *p,
+                                      const cbm_index_resource_policy_t *policy) {
+    if (p && policy) {
+        p->resource_policy = *policy;
+    }
+}
+
+void cbm_pipeline_get_resource_violation(const cbm_pipeline_t *p,
+                                         cbm_index_resource_violation_t *violation) {
+    if (violation) {
+        *violation = p ? p->resource_violation : (cbm_index_resource_violation_t){0};
+    }
+}
+
 bool cbm_pipeline_set_project_name(cbm_pipeline_t *p, const char *name) {
     if (!p || !name || !name[0]) {
         return false;
@@ -422,6 +498,14 @@ const char *cbm_pipeline_repo_path(const cbm_pipeline_t *p) {
     return p ? p->repo_path : NULL;
 }
 
+const cbm_index_resource_policy_t *cbm_pipeline_resource_policy(const cbm_pipeline_t *p) {
+    return p && cbm_index_policy_enabled(&p->resource_policy) ? &p->resource_policy : NULL;
+}
+
+cbm_index_resource_violation_t *cbm_pipeline_resource_violation(cbm_pipeline_t *p) {
+    return p ? &p->resource_violation : NULL;
+}
+
 atomic_int *cbm_pipeline_cancelled_ptr(cbm_pipeline_t *p) {
     return p ? p->cancelled : NULL;
 }
@@ -765,19 +849,32 @@ static int process_one_infra_binding(cbm_gbuf_t *gbuf, const CBMInfraBinding *ib
     return SKIP_ONE;
 }
 
-static void cbm_pipeline_process_infra_bindings(cbm_gbuf_t *gbuf, const cbm_file_info_t *files,
+static bool want_infra_bindings(const CBMFileResult *header) {
+    return header->infra_bindings.count > 0;
+}
+
+static bool want_string_refs(const CBMFileResult *header) {
+    return header->string_refs.count > 0;
+}
+
+static void cbm_pipeline_process_infra_bindings(const cbm_pipeline_ctx_t *ctx, cbm_gbuf_t *gbuf,
+                                                const cbm_file_info_t *files,
                                                 CBMFileResult **result_cache, int file_count) {
     int bindings = 0;
     for (int i = 0; i < file_count; i++) {
-        if (!result_cache[i]) {
+        bool loaded = false;
+        const CBMFileResult *r =
+            cbm_pipeline_result_acquire(ctx, result_cache, i, want_infra_bindings, &loaded);
+        if (!r) {
             continue;
         }
-        for (int bi = 0; bi < result_cache[i]->infra_bindings.count; bi++) {
-            const CBMInfraBinding *ib = &result_cache[i]->infra_bindings.items[bi];
+        for (int bi = 0; bi < r->infra_bindings.count; bi++) {
+            const CBMInfraBinding *ib = &r->infra_bindings.items[bi];
             if (ib->source_name && ib->target_url) {
                 bindings += process_one_infra_binding(gbuf, ib, files[i].rel_path);
             }
         }
+        cbm_pipeline_result_release((CBMFileResult *)r, loaded);
     }
     if (bindings > 0) {
         char buf[CBM_SZ_16];
@@ -890,7 +987,8 @@ static bool route_sr_denied(const CBMStringRef *sr) {
     return is_upstream_config_key(sr->key_path);
 }
 
-static void cbm_pipeline_extract_infra_routes(cbm_gbuf_t *gbuf, const cbm_file_info_t *files,
+static void cbm_pipeline_extract_infra_routes(const cbm_pipeline_ctx_t *ctx, cbm_gbuf_t *gbuf,
+                                              const cbm_file_info_t *files,
                                               CBMFileResult **result_cache, int file_count) {
     /* DENY-WINS-BY-VALUE: the same URL is often extracted as several string_refs
      * at different key_path granularities (full path, leaf key, flat). The Route
@@ -898,29 +996,45 @@ static void cbm_pipeline_extract_infra_routes(cbm_gbuf_t *gbuf, const cbm_file_i
      * per-ref guard — e.g. a denied full path `registries.terraform-registry.url`
      * is defeated by a sibling leaf `url`. So pass 1 collects every URL value
      * denied under ANY of its refs; pass 2 mints only values never denied. (#521) */
+    /* The table borrows nothing: a key is copied into `denied_keys`, because
+     * the result that holds sr->value is released after its file (spill
+     * mode loads it only for that moment) while the table spans both
+     * passes. A borrowed key hashed freed memory and the insert spun. */
+    CBMArena denied_keys;
+    cbm_arena_init(&denied_keys);
     CBMHashTable *denied = cbm_ht_create(16);
     for (int pass = 0; pass < 2; pass++) {
         for (int i = 0; i < file_count; i++) {
-            if (!result_cache[i] || !is_infra_file(files[i].rel_path) ||
-                is_ci_tooling_config(files[i].rel_path)) {
+            if (!is_infra_file(files[i].rel_path) || is_ci_tooling_config(files[i].rel_path)) {
                 continue;
             }
-            for (int si = 0; si < result_cache[i]->string_refs.count; si++) {
-                const CBMStringRef *sr = &result_cache[i]->string_refs.items[si];
+            bool loaded = false;
+            const CBMFileResult *r =
+                cbm_pipeline_result_acquire(ctx, result_cache, i, want_string_refs, &loaded);
+            if (!r) {
+                continue;
+            }
+            for (int si = 0; si < r->string_refs.count; si++) {
+                const CBMStringRef *sr = &r->string_refs.items[si];
                 if (sr->kind != CBM_STRREF_URL || !sr->value || !strstr(sr->value, "://")) {
                     continue;
                 }
                 if (pass == 0) {
                     if (denied && route_sr_denied(sr)) {
-                        cbm_ht_set(denied, sr->value, (void *)1);
+                        const char *key = cbm_arena_strdup(&denied_keys, sr->value);
+                        if (key && !cbm_ht_has(denied, key)) {
+                            cbm_ht_set(denied, key, (void *)1);
+                        }
                     }
                 } else if (!denied || !cbm_ht_has(denied, sr->value)) {
                     try_upsert_infra_route(gbuf, sr, files[i].rel_path);
                 }
             }
+            cbm_pipeline_result_release((CBMFileResult *)r, loaded);
         }
     }
     cbm_ht_free(denied);
+    cbm_arena_destroy(&denied_keys);
 }
 
 /* Run decorator_tags, configlink, and route matching passes. */
@@ -940,6 +1054,9 @@ static void predump_sem(cbm_pipeline_ctx_t *ctx) {
 static void predump_cfg(cbm_pipeline_ctx_t *ctx) {
     cbm_pipeline_pass_configlink(ctx);
 }
+static void predump_doclinks(cbm_pipeline_ctx_t *ctx) {
+    cbm_pipeline_pass_doclinks(ctx);
+}
 static void predump_complexity(cbm_pipeline_ctx_t *ctx) {
     cbm_pipeline_pass_complexity(ctx);
 }
@@ -950,6 +1067,222 @@ static void predump_importance(cbm_pipeline_ctx_t *ctx) {
     cbm_pipeline_pass_importance(ctx);
 }
 
+/* Phase boundary for memory attribution. Two instruments, both already in
+ * foundation/, both previously wired ONLY into MCP request handling and never
+ * into the index pipeline -- which is where the memory is (a kernel index
+ * peaks at 35 GB in extraction, measured 2026-09-13 with an external sampler
+ * because nothing in-process could say which phase it was in):
+ *   - cbm_mem_phase_mark attributes the committed-bytes delta since the last
+ *     mark to the phase just ended. Off unless CBM_MEM_PHASES=1.
+ *   - cbm_mem_class_log prints the mem_core class table, so the log answers
+ *     WHICH class grew in WHICH pass. Logs nothing until a class has activity,
+ *     so it is silent on a tree that has not migrated yet.
+ * Marks must bracket the whole path with no unlabelled gaps (mem.h), hence a
+ * mark at every pass.timing site plus pipeline.begin at the top. */
+static void pipeline_phase_mark(const char *pass) {
+    cbm_mem_phase_mark(pass);
+    /* A phase boundary is where memory is genuinely idle (the results after
+     * resolve, the semantic transient): hand it back before reading the
+     * numbers. Measured 2026-09-13 with the mimalloc-backed core: the Go worker
+     * floor went 15.8 -> 1.0 GB RSS. Milliseconds per phase. */
+    cbm_mem_release_to_os();
+    log_phase_mem(pass);
+    cbm_mem_class_log(pass);
+}
+
+/* Research census (2026-09-13): what the retained per-file results are made
+ * of. Records: count x sizeof per kind, plus the capacity the growable arrays
+ * reserved (each growth leaves the previous generation dead in the arena).
+ * Strings: bytes per field family, counted once per record (a pointer that
+ * is shared between records is charged every time it appears, so a family
+ * that is really shared shows up LARGER than its arena bytes -- that is the
+ * signal that interning would win). Measurement only. */
+static size_t census_len(const char *sv) {
+    return sv ? strlen(sv) + SKIP_ONE : 0;
+}
+static size_t census_list(const char **list) {
+    size_t n = 0;
+    if (!list) {
+        return 0;
+    }
+    for (int i = 0; list[i]; i++) {
+        n += census_len(list[i]) + sizeof(char *);
+    }
+    return n + sizeof(char *);
+}
+static void log_result_census(const char *tag, CBMFileResult **cache, int file_count) {
+    enum { PL_BYTES_PER_MB = 1024 * 1024 };
+    size_t rec_defs = 0, rec_calls = 0, rec_usages = 0, rec_rw = 0, rec_typerefs = 0;
+    size_t rec_imports = 0, rec_resolved = 0, rec_other = 0;
+    size_t cap_defs = 0, cap_calls = 0, cap_usages = 0, cap_rw = 0, cap_typerefs = 0;
+    size_t cap_other = 0;
+    size_t n_defs = 0, n_calls = 0, n_usages = 0, n_rw = 0, n_typerefs = 0, n_resolved = 0;
+    size_t str_def_names = 0, str_def_sig = 0, str_def_doc = 0, str_def_tokens = 0;
+    size_t str_def_profile = 0, str_def_lists = 0, str_def_fp = 0, str_def_misc = 0;
+    size_t str_call_names = 0, str_call_enclosing = 0, str_call_args = 0;
+    size_t str_usage_names = 0, str_usage_enclosing = 0, str_rw = 0, str_typeref = 0;
+    size_t str_resolved = 0, str_source = 0, str_module = 0;
+    for (int i = 0; i < file_count; i++) {
+        const CBMFileResult *r = cache ? cache[i] : NULL;
+        if (!r) {
+            continue;
+        }
+        rec_defs += (size_t)r->defs.count * sizeof(CBMDefinition);
+        cap_defs += (size_t)r->defs.cap * sizeof(CBMDefinition);
+        rec_calls += (size_t)r->calls.count * sizeof(CBMCall);
+        cap_calls += (size_t)r->calls.cap * sizeof(CBMCall);
+        rec_usages += (size_t)r->usages.count * sizeof(CBMUsage);
+        cap_usages += (size_t)r->usages.cap * sizeof(CBMUsage);
+        rec_rw += (size_t)r->rw.count * sizeof(CBMReadWrite);
+        cap_rw += (size_t)r->rw.cap * sizeof(CBMReadWrite);
+        rec_typerefs += (size_t)r->type_refs.count * sizeof(CBMTypeRef);
+        cap_typerefs += (size_t)r->type_refs.cap * sizeof(CBMTypeRef);
+        rec_imports += (size_t)r->imports.count * sizeof(CBMImport);
+        rec_resolved += (size_t)r->resolved_calls.count * sizeof(CBMResolvedCall);
+        rec_other += (size_t)r->throws.count * sizeof(CBMThrow) +
+                     (size_t)r->env_accesses.count * sizeof(CBMEnvAccess) +
+                     (size_t)r->type_assigns.count * sizeof(CBMTypeAssign) +
+                     (size_t)r->string_refs.count * sizeof(CBMStringRef) +
+                     (size_t)r->impl_traits.count * sizeof(CBMImplTrait) +
+                     (size_t)r->infra_bindings.count * sizeof(CBMInfraBinding) +
+                     (size_t)r->channels.count * sizeof(CBMChannel);
+        cap_other += (size_t)r->imports.cap * sizeof(CBMImport) +
+                     (size_t)r->resolved_calls.cap * sizeof(CBMResolvedCall) +
+                     (size_t)r->throws.cap * sizeof(CBMThrow) +
+                     (size_t)r->env_accesses.cap * sizeof(CBMEnvAccess) +
+                     (size_t)r->type_assigns.cap * sizeof(CBMTypeAssign) +
+                     (size_t)r->string_refs.cap * sizeof(CBMStringRef) +
+                     (size_t)r->impl_traits.cap * sizeof(CBMImplTrait) +
+                     (size_t)r->infra_bindings.cap * sizeof(CBMInfraBinding) +
+                     (size_t)r->channels.cap * sizeof(CBMChannel);
+        n_defs += (size_t)r->defs.count;
+        n_calls += (size_t)r->calls.count;
+        n_usages += (size_t)r->usages.count;
+        n_rw += (size_t)r->rw.count;
+        n_typerefs += (size_t)r->type_refs.count;
+        n_resolved += (size_t)r->resolved_calls.count;
+        str_source += (size_t)(r->source ? r->source_len + 1 : 0);
+        str_module += census_len(r->module_qn) + census_len(r->namespace_name) +
+                      census_list(r->exports) + census_list(r->constants) +
+                      census_list(r->global_vars) + census_list(r->macros);
+        for (int d = 0; d < r->defs.count; d++) {
+            const CBMDefinition *def = &r->defs.items[d];
+            str_def_names += census_len(def->name) + census_len(def->qualified_name) +
+                             census_len(def->label) + census_len(def->file_path) +
+                             census_len(def->parent_class);
+            str_def_sig += census_len(def->signature) + census_len(def->return_type) +
+                           census_len(def->receiver);
+            str_def_doc += census_len(def->docstring);
+            str_def_tokens += census_len(def->body_tokens);
+            str_def_profile += census_len(def->structural_profile);
+            str_def_lists += census_list(def->decorators) + census_list(def->base_classes) +
+                             census_list(def->param_names) + census_list(def->param_types) +
+                             census_list(def->return_types);
+            for (int k = 0; k < def->signature_param_count; k++) {
+                str_def_lists += census_len(def->signature_param_types[k]) + sizeof(char *);
+            }
+            str_def_fp += def->fingerprint ? (size_t)def->fingerprint_k * sizeof(uint32_t) : 0;
+            str_def_misc += census_len(def->route_path) + census_len(def->route_method) +
+                            census_len(def->impl_trait);
+        }
+        for (int c = 0; c < r->calls.count; c++) {
+            const CBMCall *call = &r->calls.items[c];
+            str_call_names += census_len(call->callee_name) + census_len(call->first_string_arg) +
+                              census_len(call->second_arg_name);
+            str_call_enclosing += census_len(call->enclosing_func_qn);
+            for (int a = 0; a < call->arg_count && a < CBM_MAX_CALL_ARGS; a++) {
+                str_call_args += census_len(call->args[a].expr) + census_len(call->args[a].value) +
+                                 census_len(call->args[a].keyword);
+            }
+        }
+        for (int u = 0; u < r->usages.count; u++) {
+            str_usage_names += census_len(r->usages.items[u].ref_name);
+            str_usage_enclosing += census_len(r->usages.items[u].enclosing_func_qn);
+        }
+        for (int w = 0; w < r->rw.count; w++) {
+            str_rw +=
+                census_len(r->rw.items[w].var_name) + census_len(r->rw.items[w].enclosing_func_qn);
+        }
+        for (int t = 0; t < r->type_refs.count; t++) {
+            str_typeref += census_len(r->type_refs.items[t].type_name) +
+                           census_len(r->type_refs.items[t].enclosing_func_qn);
+        }
+        for (int q = 0; q < r->resolved_calls.count; q++) {
+            const CBMResolvedCall *rc = &r->resolved_calls.items[q];
+            str_resolved += census_len(rc->caller_qn) + census_len(rc->callee_qn) +
+                            census_len(rc->strategy) + census_len(rc->reason);
+        }
+    }
+    /* One snprintf per line: itoa_buf is a small TLS ring and a line with a
+     * dozen values would overwrite its own earlier fields. */
+    char line[CBM_SZ_1K];
+#define MB(x) ((unsigned long)((x) / PL_BYTES_PER_MB))
+    snprintf(line, sizeof(line), "defs=%lu calls=%lu usages=%lu rw=%lu type_refs=%lu resolved=%lu",
+             (unsigned long)n_defs, (unsigned long)n_calls, (unsigned long)n_usages,
+             (unsigned long)n_rw, (unsigned long)n_typerefs, (unsigned long)n_resolved);
+    cbm_log_info("extract.census.records", "tag", tag, "v", line);
+    snprintf(
+        line, sizeof(line),
+        "defs=%lu calls=%lu usages=%lu rw=%lu type_refs=%lu imports=%lu resolved=%lu other=%lu",
+        MB(rec_defs), MB(rec_calls), MB(rec_usages), MB(rec_rw), MB(rec_typerefs), MB(rec_imports),
+        MB(rec_resolved), MB(rec_other));
+    cbm_log_info("extract.census.record_mb", "tag", tag, "v", line);
+    snprintf(line, sizeof(line), "defs=%lu calls=%lu usages=%lu rw=%lu type_refs=%lu other=%lu",
+             MB(cap_defs), MB(cap_calls), MB(cap_usages), MB(cap_rw), MB(cap_typerefs),
+             MB(cap_other));
+    cbm_log_info("extract.census.array_cap_mb", "tag", tag, "v", line);
+    snprintf(line, sizeof(line),
+             "names=%lu signature=%lu docstring=%lu body_tokens=%lu structural_profile=%lu "
+             "lists=%lu fingerprint=%lu misc=%lu",
+             MB(str_def_names), MB(str_def_sig), MB(str_def_doc), MB(str_def_tokens),
+             MB(str_def_profile), MB(str_def_lists), MB(str_def_fp), MB(str_def_misc));
+    cbm_log_info("extract.census.def_strings_mb", "tag", tag, "v", line);
+    snprintf(line, sizeof(line),
+             "call_names=%lu call_enclosing=%lu call_args=%lu usage_names=%lu "
+             "usage_enclosing=%lu rw=%lu type_refs=%lu resolved=%lu source=%lu module=%lu",
+             MB(str_call_names), MB(str_call_enclosing), MB(str_call_args), MB(str_usage_names),
+             MB(str_usage_enclosing), MB(str_rw), MB(str_typeref), MB(str_resolved), MB(str_source),
+             MB(str_module));
+    cbm_log_info("extract.census.ref_strings_mb", "tag", tag, "v", line);
+#undef MB
+}
+
+/* The per-file result arenas are the largest retained structure of an index
+ * (Go corpus, 2026-09-13: 28.8 GB of arena capacity live at the end of
+ * extraction against 15 GB resident). Capacity is what the core charges
+ * (block sizes); used is what extraction wrote; trees counts results still
+ * holding a tree-sitter tree. The three numbers together say whether the cost
+ * is the data, the block-doubling headroom, or retained trees. */
+static void log_result_arenas(const char *tag, CBMFileResult **cache, int file_count) {
+    enum { PL_BYTES_PER_MB = 1024 * 1024 };
+    if (!cbm_mem_phases_enabled()) {
+        return; /* a walk over every result: diagnostics only (CBM_MEM_PHASES=1) */
+    }
+    size_t used = 0;
+    size_t capacity = 0;
+    int results = 0;
+    int trees = 0;
+    for (int i = 0; i < file_count; i++) {
+        const CBMFileResult *r = cache ? cache[i] : NULL;
+        if (!r) {
+            continue;
+        }
+        results++;
+        used += cbm_arena_total(&r->arena);
+        for (int b = 0; b < r->arena.nblocks; b++) {
+            capacity += r->arena.block_sizes[b];
+        }
+        if (r->cached_tree) {
+            trees++;
+        }
+    }
+    cbm_log_info("extract.arenas", "tag", tag, "results", itoa_buf(results), "used_mb",
+                 itoa_buf((int)(used / PL_BYTES_PER_MB)), "capacity_mb",
+                 itoa_buf((int)(capacity / PL_BYTES_PER_MB)), "trees", itoa_buf(trees));
+    log_result_census(tag, cache, file_count);
+}
+
+/* Results are gone after resolve; so is the store. Logs what spill did. */
 static void run_predump_passes(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx) {
     static const struct {
         predump_pass_fn fn;
@@ -958,6 +1291,7 @@ static void run_predump_passes(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx) {
     } passes[] = {
         {predump_deco, "decorator_tags", false},
         {predump_cfg, "configlink", false},
+        {predump_doclinks, "doclinks", false},
         {predump_route, "route_match", false},
         {predump_ensemble, "ensemble_routing", false},
         {predump_sim, "similarity", true},
@@ -986,6 +1320,7 @@ static void run_predump_passes(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx) {
         passes[i].fn(ctx);
         cbm_log_info("pass.timing", "pass", passes[i].name, "elapsed_ms",
                      itoa_buf((int)elapsed_ms(t)));
+        pipeline_phase_mark(passes[i].name);
     }
 }
 
@@ -1107,6 +1442,7 @@ static int run_sequential_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
         }
         cbm_log_info("pass.timing", "pass", seq_passes[si].name, "elapsed_ms",
                      itoa_buf((int)elapsed_ms(*t)));
+        pipeline_phase_mark(seq_passes[si].name);
         if (check_cancel(p)) {
             rc = CBM_NOT_FOUND;
         }
@@ -1116,8 +1452,8 @@ static int run_sequential_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
      * one. process_one_infra_binding self-creates the topic Route node when no
      * code-side dispatch created it (e.g. a standalone scheduler manifest). */
     if (seq_cache && rc == 0) {
-        cbm_pipeline_extract_infra_routes(p->gbuf, files, seq_cache, file_count);
-        cbm_pipeline_process_infra_bindings(p->gbuf, files, seq_cache, file_count);
+        cbm_pipeline_extract_infra_routes(ctx, p->gbuf, files, seq_cache, file_count);
+        cbm_pipeline_process_infra_bindings(ctx, p->gbuf, files, seq_cache, file_count);
     }
     if (seq_cache) {
         for (int i = 0; i < file_count; i++) {
@@ -1181,14 +1517,20 @@ static int run_parallel_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
         return CBM_NOT_FOUND;
     }
     cbm_clock_gettime(CLOCK_MONOTONIC, t);
+    /* This driver is the spill owner: every consumer below reads the cache
+     * through cbm_pipeline_result_acquire() and the store is closed here. */
+    ctx->spill_allowed = true;
     int rc = cbm_parallel_extract(ctx, files, file_count, cache, &shared_ids, worker_count);
     cbm_log_info("pass.timing", "pass", "parallel_extract", "elapsed_ms",
                  itoa_buf((int)elapsed_ms(*t)));
+    pipeline_phase_mark("parallel_extract");
+    log_result_arenas("post_extract", cache, file_count);
     if (rc != 0 || check_cancel(p)) {
         for (int i = 0; i < file_count; i++) {
             cbm_free_result(cache[i]);
         }
         free(cache);
+        cbm_pipeline_spill_close(ctx);
         return rc != 0 ? rc : CBM_NOT_FOUND;
     }
     cbm_gbuf_set_next_id(p->gbuf, atomic_load(&shared_ids));
@@ -1204,7 +1546,7 @@ static int run_parallel_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
     rc = cbm_build_registry_from_cache(ctx, files, file_count, cache);
     cbm_log_info("pass.timing", "pass", "registry_build", "elapsed_ms",
                  itoa_buf((int)elapsed_ms(*t)));
-    log_phase_mem("registry_build");
+    pipeline_phase_mark("registry_build");
     if (rc != 0 || check_cancel(p)) {
         for (int i = 0; i < file_count; i++) {
             if (cache[i]) {
@@ -1212,6 +1554,7 @@ static int run_parallel_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
             }
         }
         free(cache);
+        cbm_pipeline_spill_close(ctx);
         return rc != 0 ? rc : CBM_NOT_FOUND;
     }
     /* Registry consumers may materialize serial nodes (Channel, EnvVar, and
@@ -1249,28 +1592,36 @@ static int run_parallel_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
     int def_count = 0;
     CBMLSPDef *all_defs = NULL;
     int *def_starts = NULL;
+    /* The collected defs own their strings in this arena (results may be on
+     * disk by now); the per-language cross registries share it. */
+    CBMArena cross_lsp_arena;
+    cbm_arena_init(&cross_lsp_arena);
+    CBM_PROF_START(t_collect_defs);
     if (run_cross_lsp) {
         def_modules = (char **)calloc((size_t)file_count, sizeof(char *));
         def_starts = (int *)calloc((size_t)file_count + 1, sizeof(int));
-        all_defs = def_modules
-                       ? cbm_pxc_collect_all_defs(ctx, cache, files, file_count, ctx->project_name,
-                                                  def_modules, &def_count, def_starts)
-                       : NULL;
+        all_defs = def_modules ? cbm_pxc_collect_all_defs(ctx, &cross_lsp_arena, cache, files,
+                                                          file_count, ctx->project_name,
+                                                          def_modules, &def_count, def_starts)
+                               : NULL;
     }
+    CBM_PROF_END_N("lsp_cross_prepare", "1_collect_all_defs", t_collect_defs, def_count);
     /* Serialize per-file LSP surfaces NOW — the result cache dies with this
      * pass, and the rows are what lets an incremental run detect body-only
      * edits and rehydrate cross registries without re-parsing the world.
      * Failure only degrades: no rows → the incremental route full-rebuilds. */
+    CBM_PROF_START(t_surfaces);
     if (ctx->pipeline && all_defs && def_starts) {
         cbm_lsp_surface_row_t *surface_rows = NULL;
         int surface_count = 0;
-        if (cbm_lsp_surface_build_rows(ctx->project_name, cache, files, file_count, all_defs,
+        if (cbm_lsp_surface_build_rows(ctx, ctx->project_name, cache, files, file_count, all_defs,
                                        def_starts, &surface_rows, &surface_count) == 0) {
             cbm_pipeline_set_lsp_surfaces(ctx->pipeline, surface_rows, surface_count);
         } else {
             cbm_log_warn("lsp_surface.serialize_failed", "files", itoa_buf(file_count));
         }
     }
+    CBM_PROF_END_N("lsp_cross_prepare", "2_surface_rows", t_surfaces, file_count);
     free(def_starts);
     /* Build inverted index: module_qn → defs. The fused resolve_worker
      * uses this to filter the global all_defs[] down to just the defs
@@ -1278,15 +1629,15 @@ static int run_parallel_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
      * gopls "package summary" pattern. Drops per-file registry build
      * cost from O(all_defs) to O(relevant_defs), typically 50-100×
      * smaller per file. */
+    CBM_PROF_START(t_module_index);
     CBMModuleDefIndex *module_def_index =
         all_defs ? cbm_pxc_build_module_def_index(all_defs, def_count) : NULL;
+    CBM_PROF_END_N("lsp_cross_prepare", "3_module_def_index", t_module_index, def_count);
     /* Tier 2 full: pre-build per-language cross-LSP registries.
      * Built ONCE here; shared READ-ONLY across all files of that language
      * during resolve. Per-file work is then: parse + AST walk + O(1) lookups
      * — no registry build, no Phase 1b mutations. Languages added so far:
      * Go, Python, C/C++, C#, TS/JS, Java. Others (Kotlin, PHP) fall back to per-file. */
-    CBMArena cross_lsp_arena;
-    cbm_arena_init(&cross_lsp_arena);
     CBMCrossLspRegistries cross_registries = {0};
     if (all_defs) {
         /* Per-builder split of lsp_cross_prepare — attributes a slow prepare to
@@ -1328,13 +1679,14 @@ static int run_parallel_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
     }
     cbm_log_info("pass.timing", "pass", "lsp_cross_prepare", "elapsed_ms",
                  itoa_buf((int)elapsed_ms(*t)));
-    log_phase_mem("lsp_cross_prepare");
+    pipeline_phase_mark("lsp_cross_prepare");
     cbm_clock_gettime(CLOCK_MONOTONIC, t);
     rc = cbm_parallel_resolve(ctx, files, file_count, cache, &shared_ids, worker_count, all_defs,
                               def_count, def_modules, module_def_index, &cross_registries);
     cbm_log_info("pass.timing", "pass", "parallel_resolve", "elapsed_ms",
                  itoa_buf((int)elapsed_ms(*t)));
-    log_phase_mem("parallel_resolve");
+    pipeline_phase_mark("parallel_resolve");
+    log_result_arenas("post_resolve", cache, file_count);
     cbm_pxc_free_module_def_index(module_def_index);
     cbm_arena_destroy(&cross_lsp_arena); /* releases all per-lang registries */
     free(all_defs);
@@ -1345,20 +1697,22 @@ static int run_parallel_pipeline(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
         free(def_modules);
     }
     cbm_gbuf_set_next_id(p->gbuf, atomic_load(&shared_ids));
-    cbm_pipeline_extract_infra_routes(p->gbuf, files, cache, file_count);
-    cbm_pipeline_process_infra_bindings(p->gbuf, files, cache, file_count);
+    cbm_pipeline_extract_infra_routes(ctx, p->gbuf, files, cache, file_count);
+    cbm_pipeline_process_infra_bindings(ctx, p->gbuf, files, cache, file_count);
     for (int i = 0; i < file_count; i++) {
         if (cache[i]) {
             cbm_free_result(cache[i]);
         }
     }
     free(cache);
+    cbm_pipeline_spill_close(ctx);
     if (rc != 0) {
         return rc;
     }
     cbm_clock_gettime(CLOCK_MONOTONIC, t);
     cbm_pipeline_pass_k8s(ctx, files, file_count);
     cbm_log_info("pass.timing", "pass", "k8s", "elapsed_ms", itoa_buf((int)elapsed_ms(*t)));
+    pipeline_phase_mark("k8s");
     return check_cancel(p) ? CBM_NOT_FOUND : 0;
 }
 
@@ -1402,6 +1756,16 @@ static int capture_existing_adr(cbm_pipeline_t *p, const char *db_path) {
 static int try_incremental_or_delete_db(cbm_pipeline_t *p, cbm_file_info_t *files, int file_count,
                                         const cbm_file_hash_t *baseline_manifest,
                                         int baseline_count, bool force_full_on_mismatch) {
+    if (!p->existing_generation) {
+        /* Nothing to be incremental against: a first index, or a
+         * destination that could not be copied (already reported as
+         * backup_failed_full_rebuild). The stage is an empty placeholder,
+         * not a database, so it is not probed -- "invalid_existing_db"
+         * stays reserved for a real copy that fails its integrity check. */
+        cbm_log_info("pipeline.route", "path", "full", "reason",
+                     p->final_existed ? "existing_db_backup_failed" : "no_existing_db");
+        return CBM_PIPELINE_FORCE_FULL_REINDEX;
+    }
     char *db_path = resolve_db_path(p);
     if (!db_path) {
         return CBM_PIPELINE_FORCE_FULL_REINDEX;
@@ -1530,12 +1894,148 @@ static bool promote_mode_to_existing_coverage(cbm_pipeline_t *p) {
 /* Defined below, next to the other publication helpers. */
 static char *create_staging_path(const char *final_path);
 
+/* ── Stage ownership (#1839) ─────────────────────────────────────
+ *
+ * A stage used to be recognisable only by its name: the mkstemp descriptor
+ * was closed at once and nothing marked who was writing it. A worker killed
+ * mid-run (the daemon cancels with SIGTERM then SIGKILL after one second of
+ * grace, which a gigabyte backup or clone never finishes inside) left its
+ * full-size stage behind forever, and no later run could tell a dead stage
+ * from a live one -- so none tried.
+ *
+ * Ownership is now an exclusive kernel lock on the sidecar "<stage>.lock",
+ * held from minting until the stage is discarded or renamed into place. The
+ * kernel releases it on any death, so "can I take this lock?" is exactly
+ * "is this stage dead?" -- no pid, no mtime, no grace period. The lock lives
+ * on a sidecar rather than the stage itself because on macOS an flock on a
+ * file conflicts with SQLite's fcntl byte locks on that same file.
+ *
+ * The stage path is passed around as a plain string through publish and
+ * finalize, so the descriptor is kept in this per-process registry keyed by
+ * path, and released by the same helpers that remove the file. */
+typedef struct stage_owner {
+    char *stage_path;
+    int lock_fd;
+    struct stage_owner *next;
+} stage_owner_t;
+
+static stage_owner_t *g_stage_owners = NULL;
+static atomic_flag g_stage_owners_spin = ATOMIC_FLAG_INIT;
+
+static void stage_owners_lock(void) {
+    while (atomic_flag_test_and_set_explicit(&g_stage_owners_spin, memory_order_acquire)) {}
+}
+
+static void stage_owners_unlock(void) {
+    atomic_flag_clear_explicit(&g_stage_owners_spin, memory_order_release);
+}
+
+static char *stage_lock_sidecar_path(const char *stage_path) {
+    static const char suffix[] = ".lock";
+    size_t len = strlen(stage_path);
+    if (len > SIZE_MAX - sizeof(suffix)) {
+        return NULL;
+    }
+    char *sidecar = (char *)malloc(len + sizeof(suffix));
+    if (!sidecar) {
+        return NULL;
+    }
+    memcpy(sidecar, stage_path, len);
+    memcpy(sidecar + len, suffix, sizeof(suffix));
+    return sidecar;
+}
+
+int cbm_pipeline_stage_lock_hold(const char *stage_path) {
+    if (!stage_path) {
+        return -1;
+    }
+    char *sidecar = stage_lock_sidecar_path(stage_path);
+    if (!sidecar) {
+        return -1;
+    }
+    int fd = cbm_lockfile_open(sidecar, true);
+    free(sidecar);
+    return fd;
+}
+
+void cbm_pipeline_stage_lock_drop(const char *stage_path, int lock_fd) {
+    if (!stage_path || lock_fd < 0) {
+        return;
+    }
+    char *sidecar = stage_lock_sidecar_path(stage_path);
+    /* Close before unlinking: Windows refuses to delete an open file. The
+     * sidecar exists unlocked for that instant, but by every drop the stage
+     * itself is already gone (discarded or renamed), so there is nothing a
+     * sweeper could take from us. */
+    cbm_lockfile_close(lock_fd);
+    if (sidecar) {
+        (void)cbm_unlink(sidecar);
+        free(sidecar);
+    }
+}
+
+/* Record an already-held stage lock in the per-process owner table, keyed by
+ * path so publish/finalize/discard can release it later. On success the table
+ * owns lock_fd; on failure the caller still does and must drop it.
+ *
+ * The lock must ALREADY be held: create_staging_path() takes it before the
+ * stage's main file is created (so the file is never visible on disk without
+ * its lock), then hands the descriptor here. Re-taking the lock in this helper
+ * would self-conflict -- both flock() and Windows _SH_DENYRW deny a second
+ * acquire of the same sidecar even from this same process. */
+static bool stage_owner_adopt(const char *stage_path, int lock_fd) {
+    stage_owner_t *owner = (stage_owner_t *)malloc(sizeof(*owner));
+    char *path_copy = strdup(stage_path);
+    if (!owner || !path_copy) {
+        free(owner);
+        free(path_copy);
+        return false;
+    }
+    owner->stage_path = path_copy;
+    owner->lock_fd = lock_fd;
+    stage_owners_lock();
+    owner->next = g_stage_owners;
+    g_stage_owners = owner;
+    stage_owners_unlock();
+    return true;
+}
+
+/* Release ownership of a stage that no longer exists under this name. A path
+ * this process never registered is a no-op. */
+static void stage_owner_release(const char *stage_path) {
+    if (!stage_path) {
+        return;
+    }
+    stage_owner_t *found = NULL;
+    stage_owners_lock();
+    for (stage_owner_t **link = &g_stage_owners; *link; link = &(*link)->next) {
+        if (strcmp((*link)->stage_path, stage_path) == 0) {
+            found = *link;
+            *link = found->next;
+            break;
+        }
+    }
+    stage_owners_unlock();
+    if (!found) {
+        return;
+    }
+    cbm_pipeline_stage_lock_drop(found->stage_path, found->lock_fd);
+    free(found->stage_path);
+    free(found);
+}
+
+/* Remove a stage's main file and SQLite sidecars, keeping ownership. */
+static void remove_stage_files(const char *stage_path) {
+    (void)cbm_unlink(stage_path);
+    (void)cbm_remove_db_sidecars(stage_path);
+}
+
 static void discard_generation_stage(const char *stage_path) {
     if (!stage_path) {
         return;
     }
-    cbm_unlink(stage_path);
-    cbm_remove_db_sidecars(stage_path);
+    remove_stage_files(stage_path);
+    stage_owner_release(stage_path);
 }
 
 typedef struct {
@@ -1929,6 +2429,7 @@ int cbm_pipeline_finalize_staged_generation(char *stage_path, const char *final_
         discard_generation_stage(stage_path);
         return CBM_PIPELINE_PERSIST_FAILED;
     }
+    stage_owner_release(stage_path);
     cbm_log_info("finalize.timing", "block", "rename", "elapsed_ms",
                  itoa_buf((int)elapsed_ms(t_fin)));
     return 0;
@@ -1964,15 +2465,17 @@ static int dump_and_persist_hashes(cbm_pipeline_t *p, const cbm_file_hash_t *bas
 #if defined(CBM_INCREMENTAL_TEST_API) && CBM_INCREMENTAL_TEST_API
     cbm_pipeline_persist_test_run_before_final_manifest();
 #endif
-    if (cbm_pipeline_build_fresh_semantic_manifest(p->project_name, p->repo_path, p->mode,
-                                                   &manifest, &manifest_count) != 0) {
+    int manifest_rc =
+        cbm_pipeline_build_fresh_semantic_manifest(p, p->project_name, &manifest, &manifest_count);
+    if (manifest_rc != 0) {
         cbm_log_error("pipeline.err", "phase", "semantic_manifest");
         /* db_path and db_dir are this function's strdups; the success tail and
          * the publish-failure return release them, and these two aborts must
          * too -- LSan caught exactly these paths leaking both strings. */
         free(db_dir);
         free(db_path);
-        return CBM_PIPELINE_ABORT_PRESERVE_DB;
+        return manifest_rc == CBM_DISCOVER_LIMIT_EXCEEDED ? CBM_PIPELINE_RESOURCE_LIMIT
+                                                          : CBM_PIPELINE_ABORT_PRESERVE_DB;
     }
     if (!cbm_pipeline_semantic_manifests_equal(baseline_manifest, baseline_count, manifest,
                                                manifest_count)) {
@@ -2053,6 +2556,7 @@ static int dump_and_persist_hashes(cbm_pipeline_t *p, const cbm_file_hash_t *bas
     }
     cbm_log_info("pass.timing", "pass", "dump_and_persist", "elapsed_ms",
                  itoa_buf((int)elapsed_ms(*t)), "files", itoa_buf(manifest_count));
+    pipeline_phase_mark("dump_and_persist");
     if (p->ignored_total > p->ignored_count) {
         cbm_log_warn("index.ignored_capped", "stored", itoa_buf(p->ignored_count), "total",
                      itoa_buf(p->ignored_total));
@@ -2117,6 +2621,7 @@ static int run_tests_and_history(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
     int rc = cbm_pipeline_pass_tests(ctx, files, file_count);
     CBM_PROF_END_N("pipeline", "pass_tests", t_tests, file_count);
     cbm_log_info("pass.timing", "pass", "tests", "elapsed_ms", itoa_buf((int)elapsed_ms(t)));
+    pipeline_phase_mark("tests");
     if (rc == 0 && !check_cancel(p)) {
         CBM_PROF_START(t_gh);
         rc = run_githistory(p, ctx);
@@ -2169,6 +2674,7 @@ static int run_extraction_phase(cbm_pipeline_t *p, cbm_pipeline_ctx_t *ctx,
     pass_structure(p, files, file_count);
     CBM_PROF_END_N("pipeline", "pass_structure", t_struct, file_count);
     cbm_log_info("pass.timing", "pass", "structure", "elapsed_ms", itoa_buf((int)elapsed_ms(t)));
+    pipeline_phase_mark("structure");
     if (check_cancel(p)) {
         return CBM_NOT_FOUND;
     }
@@ -2226,10 +2732,14 @@ static int cbm_pipeline_run_staged(cbm_pipeline_t *p) {
 
     /* Phase 1: Discover files */
     CBM_PROF_START(t_discover);
+    p->resource_violation = (cbm_index_resource_violation_t){0};
     cbm_discover_opts_t opts = {
         .mode = p->requested_mode,
         .ignore_file = NULL,
         .max_file_size = 0,
+        .resource_policy =
+            cbm_index_policy_enabled(&p->resource_policy) ? &p->resource_policy : NULL,
+        .resource_violation = &p->resource_violation,
     };
     cbm_file_info_t *files = NULL;
     int file_count = 0;
@@ -2254,7 +2764,7 @@ static int cbm_pipeline_run_staged(cbm_pipeline_t *p) {
     cbm_log_info("pipeline.discover", "files", itoa_buf(file_count), "elapsed_ms",
                  itoa_buf((int)elapsed_ms(t0)));
     if (rc != 0 || check_cancel(p)) {
-        rc = CBM_NOT_FOUND;
+        rc = rc == CBM_DISCOVER_LIMIT_EXCEEDED ? CBM_PIPELINE_RESOURCE_LIMIT : CBM_NOT_FOUND;
         goto cleanup;
     }
 
@@ -2262,14 +2772,15 @@ static int cbm_pipeline_run_staged(cbm_pipeline_t *p) {
      * bytes drive exact no-op comparison and are checked against a fresh
      * rediscovery immediately before any replacement is published. */
     rc = mode_promoted
-             ? cbm_pipeline_build_fresh_semantic_manifest(p->project_name, p->repo_path, p->mode,
-                                                          &baseline_manifest, &baseline_count)
+             ? cbm_pipeline_build_fresh_semantic_manifest(p, p->project_name, &baseline_manifest,
+                                                          &baseline_count)
              : cbm_pipeline_build_semantic_manifest(p->project_name, p->repo_path, files,
                                                     file_count, p->excluded_dirs, p->excluded_count,
                                                     &p->git_ctx, p->userconfig, &baseline_manifest,
                                                     &baseline_count);
     if (rc != 0) {
-        rc = CBM_PIPELINE_ABORT_PRESERVE_DB;
+        rc = rc == CBM_DISCOVER_LIMIT_EXCEEDED ? CBM_PIPELINE_RESOURCE_LIMIT
+                                               : CBM_PIPELINE_ABORT_PRESERVE_DB;
         goto cleanup;
     }
 
@@ -2313,7 +2824,7 @@ static int cbm_pipeline_run_staged(cbm_pipeline_t *p) {
         cbm_log_info("pipeline.rediscover", "requested_mode", pipeline_mode_name(p->requested_mode),
                      "effective_mode", pipeline_mode_name(p->mode), "files", itoa_buf(file_count));
         if (rc != 0 || check_cancel(p)) {
-            rc = CBM_NOT_FOUND;
+            rc = rc == CBM_DISCOVER_LIMIT_EXCEEDED ? CBM_PIPELINE_RESOURCE_LIMIT : CBM_NOT_FOUND;
             goto cleanup;
         }
     }
@@ -2386,8 +2897,8 @@ static void cleanup_staging_db(const char *path) {
     if (!path) {
         return;
     }
-    (void)cbm_unlink(path);
-    (void)cbm_remove_db_sidecars(path);
+    remove_stage_files(path);
+    stage_owner_release(path);
 }
 
 static bool ensure_db_parent(const char *path) {
@@ -2415,12 +2926,56 @@ static bool ensure_db_parent(const char *path) {
     return ok;
 }
 
+/* Length of the path a stage was minted for: the input itself unless its
+ * basename has exactly the minted shape "<name>.stage.<6 alphanumerics>", in
+ * which case the root is <name>. The outer run rewrites the pipeline's db_path
+ * to its stage, so the inner publication (dump and delta clone) used to mint
+ * ITS stage from that stage: <db>.stage.A.stage.B, with -wal/-shm beside it
+ * (#1839). Minting from the root keeps every generation's stage a sibling of
+ * the live database. Only the exact minted shape is recognised: a database
+ * named "x.stage.y.db" is not a stage and keeps its full name. */
+enum { CBM_STAGE_SUFFIX_RANDOM_CHARS = 6 };
+static const char cbm_stage_marker[] = ".stage.";
+
+static bool stage_suffix_at(const char *tail) {
+    if (strncmp(tail, cbm_stage_marker, sizeof(cbm_stage_marker) - 1) != 0) {
+        return false;
+    }
+    const char *random = tail + sizeof(cbm_stage_marker) - 1;
+    for (int i = 0; i < CBM_STAGE_SUFFIX_RANDOM_CHARS; i++) {
+        if (!isalnum((unsigned char)random[i])) {
+            return false;
+        }
+    }
+    return random[CBM_STAGE_SUFFIX_RANDOM_CHARS] == '\0';
+}
+
+static size_t stage_root_length(const char *path) {
+    size_t len = strlen(path);
+    const size_t suffix_len = sizeof(cbm_stage_marker) - 1 + CBM_STAGE_SUFFIX_RANDOM_CHARS;
+    if (len <= suffix_len) {
+        return len;
+    }
+    size_t root_len = len - suffix_len;
+    /* The marker must sit inside the basename, never span a separator. */
+    for (size_t i = root_len; i < len; i++) {
+        if (path[i] == '/'
+#ifdef _WIN32
+            || path[i] == '\\'
+#endif
+        ) {
+            return len;
+        }
+    }
+    return stage_suffix_at(path + root_len) ? root_len : len;
+}
+
 static char *create_staging_path(const char *final_path) {
     if (!final_path) {
         return NULL;
     }
     static const char suffix[] = ".stage.XXXXXX";
-    size_t final_len = strlen(final_path);
+    size_t final_len = stage_root_length(final_path);
     if (final_len > SIZE_MAX - sizeof(suffix)) {
         return NULL;
     }
@@ -2440,17 +2995,79 @@ static char *create_staging_path(const char *final_path) {
     }
     memcpy(path, final_path, final_len);
     memcpy(path + final_len, suffix, sizeof(suffix));
-    int fd = cbm_mkstemp(path);
-    if (fd < 0) {
-        free(path);
-        return NULL;
-    }
-#ifdef _WIN32
-    _close(fd);
-#else
-    close(fd);
+    /* The six random chars sit directly after the ".stage." marker; each
+     * attempt overwrites the "XXXXXX" template in place. Alphanumerics only,
+     * matching stage_suffix_at()/stage_entry_stage_length() so the sweep
+     * recognises the minted name and its sidecars. */
+    char *random_at = path + final_len + (sizeof(cbm_stage_marker) - 1);
+    static const char alphabet[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+
+    /* Lock BEFORE the stage becomes visible: take the sidecar lock first, then
+     * create the stage's main file with O_EXCL. The main file is therefore
+     * never present on disk without its lock already held, so a concurrent
+     * run's sweep_orphan_stages() against the same final_path can only ever
+     * find this stage lock-held -- it reaches the stage through the .lock
+     * sidecar too (stage_entry_stage_length() matches it), probes the lock,
+     * sees a live holder, and keeps it. That closes the old create->register
+     * window that let a racing sweep delete a live-but-unlocked stage (POSIX)
+     * or collide on the sidecar with EACCES (Windows) -- #2111's windows-guards
+     * red. A pre-lock-era orphan minted by an OLDER binary still carries no
+     * lock, so the sweep's ENOENT path still removes it (#1839 preserved).
+     *
+     * A minted suffix collides with an existing stage only about 1 in 62^6;
+     * retry a bounded number of times, the way mkstemp/mkdtemp do, then fail. */
+    for (int attempt = 0; attempt < 128; attempt++) {
+        unsigned char rnd[CBM_STAGE_SUFFIX_RANDOM_CHARS];
+        if (!cbm_secure_random(rnd, sizeof(rnd))) {
+            free(path);
+            errno = EIO;
+            return NULL;
+        }
+        for (size_t i = 0; i < sizeof(rnd); i++) {
+            random_at[i] = alphabet[rnd[i] % (sizeof(alphabet) - 1)];
+        }
+        errno = 0;
+        int lock_fd = cbm_pipeline_stage_lock_hold(path);
+        if (lock_fd < 0) {
+            /* A live twin already owns this exact suffix's sidecar (EAGAIN /
+             * EACCES), or the sidecar could not be created. Mint a fresh suffix
+             * and try again rather than contend for this one. */
+            continue;
+        }
+        FILE *main_file = cbm_fopen(path, "wbx");
+        if (!main_file) {
+            /* The suffix collided with a lock-less orphan's main file -- its
+             * sidecar was takeable, so it is not a live writer. Never inherit a
+             * stranger's bytes: drop the lock, remove the sidecar we just took,
+             * and mint a fresh suffix. The orphan's main file is left for a
+             * later sweep, which removes it as a pre-lock-era orphan. */
+            cbm_pipeline_stage_lock_drop(path, lock_fd);
+            continue;
+        }
+        (void)fclose(main_file);
+#if defined(CBM_INCREMENTAL_TEST_API) && CBM_INCREMENTAL_TEST_API
+        /* Main file now exists and its lock is already held. Under the OLD
+         * create-then-lock ordering this was the unlocked window; the
+         * concurrent-sweep test fires here to prove the stage now survives a
+         * racing sweep, and to bind RED if that ordering ever regresses. */
+        cbm_pipeline_persist_test_run_after_stage_created();
 #endif
-    return path;
+        if (!stage_owner_adopt(path, lock_fd)) {
+            cbm_pipeline_stage_lock_drop(path, lock_fd);
+            (void)cbm_unlink(path);
+            free(path);
+            return NULL;
+        }
+        return path;
+    }
+    /* Every attempt failed to take a lock -- keep the observability the old
+     * stage_owner_register() emitted for a lock failure. */
+    char errno_text[16];
+    (void)snprintf(errno_text, sizeof(errno_text), "%d", errno);
+    cbm_log_warn("pipeline.stage", "action", "lock_failed", "errno", errno_text, "path", path);
+    free(path);
+    errno = EEXIST;
+    return NULL;
 }
 
 /* A backup-failed destination may still have the only recoverable WAL or
@@ -2554,7 +3171,229 @@ static int export_after_publish(cbm_pipeline_t *p, const char *final_path) {
     return 0;
 }
 
+/* ── Orphan sweep (#1839) ────────────────────────────────────────
+ *
+ * Nothing on the worker-death path ever cleaned a stage up, so the sweep
+ * runs at the start of every run, before this run mints its own stage. It
+ * considers ONLY names of the exact minted shape for THIS database --
+ * "<basename>.stage.<6 alphanumerics>" plus that stage's -wal/-shm/-journal
+ * and .lock sidecars -- never the live database, a quarantined .corrupt, or
+ * another project's files. A stage is removed when its ownership lock can be
+ * taken (its writer is dead, or the stage predates ownership) and kept when
+ * a live writer holds the lock. The pre-ownership case is the one honest
+ * gap: a stage an OLDER binary is still writing against this database has
+ * no lock and is swept; that writer's final rename then fails and it
+ * discards. The live database is never named here on either path. */
+
+static const char *const cbm_stage_sidecar_tails[] = {"", "-wal", "-shm", "-journal", ".lock"};
+
+/* If `name` is "<base>.stage.<6 alphanumerics><known tail>", return the
+ * length of the stage name proper (without the tail); 0 otherwise. */
+static size_t stage_entry_stage_length(const char *name, const char *base, size_t base_len);
+
+/* The same test with the base taken from the name itself, so a sweep reclaims
+ * stages belonging to ANY project in this cache directory.
+ *
+ * Why it must not be per-project: a run killed outright (OOM killer, SIGKILL)
+ * cleans nothing up, and until 2026-09-18 its staging database was only removed
+ * when THAT project was indexed again — a kernel index killed once left 15 GB
+ * parked until someone re-indexed the kernel, and forever if nobody did. The
+ * per-stage lock probe still decides safety, so a live writer's stage is kept
+ * whichever project it belongs to. */
+static size_t stage_entry_stage_length_any_base(const char *name) {
+    const char *marker = strstr(name, cbm_stage_marker);
+    if (!marker) {
+        return 0;
+    }
+    return stage_entry_stage_length(name, name, (size_t)(marker - name));
+}
+
+static size_t stage_entry_stage_length(const char *name, const char *base, size_t base_len) {
+    if (strncmp(name, base, base_len) != 0) {
+        return 0;
+    }
+    const char *at = name + base_len;
+    if (strncmp(at, cbm_stage_marker, sizeof(cbm_stage_marker) - 1) != 0) {
+        return 0;
+    }
+    at += sizeof(cbm_stage_marker) - 1;
+    for (int i = 0; i < CBM_STAGE_SUFFIX_RANDOM_CHARS; i++) {
+        /* NUL is not alphanumeric, so a short name fails here too. */
+        if (!isalnum((unsigned char)at[i])) {
+            return 0;
+        }
+    }
+    at += CBM_STAGE_SUFFIX_RANDOM_CHARS;
+    for (size_t i = 0; i < sizeof(cbm_stage_sidecar_tails) / sizeof(cbm_stage_sidecar_tails[0]);
+         i++) {
+        if (strcmp(at, cbm_stage_sidecar_tails[i]) == 0) {
+            return (size_t)(at - name);
+        }
+    }
+    return 0;
+}
+
+typedef struct {
+    char **names;
+    int count;
+    int cap;
+} stage_name_list_t;
+
+/* Add a stage name once, however many of its files were listed. */
+static void stage_name_list_add(stage_name_list_t *list, const char *name, size_t len) {
+    for (int i = 0; i < list->count; i++) {
+        if (strlen(list->names[i]) == len && strncmp(list->names[i], name, len) == 0) {
+            return;
+        }
+    }
+    if (list->count == list->cap) {
+        int cap = list->cap ? list->cap * 2 : 8;
+        char **grown = (char **)realloc(list->names, (size_t)cap * sizeof(*grown));
+        if (!grown) {
+            return;
+        }
+        list->names = grown;
+        list->cap = cap;
+    }
+    char *copy = (char *)malloc(len + 1);
+    if (!copy) {
+        return;
+    }
+    memcpy(copy, name, len);
+    copy[len] = '\0';
+    list->names[list->count++] = copy;
+}
+
+static int64_t stage_bytes_on_disk(const char *stage_path) {
+    static const char *const files[] = {"", "-wal", "-shm", "-journal"};
+    int64_t total = 0;
+    char side[CBM_SZ_4K];
+    for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
+        int n = snprintf(side, sizeof(side), "%s%s", stage_path, files[i]);
+        if (n <= 0 || (size_t)n >= sizeof(side)) {
+            continue;
+        }
+        cbm_path_info_t info;
+        if (cbm_path_info_utf8(side, &info) == CBM_PATH_INFO_OK && info.is_regular) {
+            total += info.size;
+        }
+    }
+    return total;
+}
+
+static void sweep_one_stage(const char *stage_path) {
+    char *sidecar = stage_lock_sidecar_path(stage_path);
+    if (!sidecar) {
+        return;
+    }
+    errno = 0;
+    int lock_fd = cbm_lockfile_open(sidecar, false);
+    int probe_errno = errno;
+    free(sidecar);
+    if (lock_fd < 0 && probe_errno != ENOENT) {
+        bool live = probe_errno == EAGAIN || probe_errno == EACCES;
+#if defined(EWOULDBLOCK) && EWOULDBLOCK != EAGAIN
+        live = live || probe_errno == EWOULDBLOCK;
+#endif
+        if (live) {
+            cbm_log_info("pipeline.stage", "action", "orphan_kept", "reason", "live_writer", "path",
+                         stage_path);
+            return;
+        }
+        char errno_text[16];
+        (void)snprintf(errno_text, sizeof(errno_text), "%d", probe_errno);
+        cbm_log_warn("pipeline.stage", "action", "orphan_kept", "reason", "lock_probe_failed",
+                     "errno", errno_text, "path", stage_path);
+        return;
+    }
+    /* No owner: absent sidecar (an ENOENT probe) or a lock the kernel released
+     * with its writer. Ours now, from the lock down.
+     *
+     * The absent-sidecar (ENOENT) case is exactly a pre-lock-era orphan: a
+     * stage an OLDER binary minted with no sidecar at all (#1839 pins that
+     * these ARE swept). It is NOT an in-flight stage of a current run: since
+     * create_staging_path() now takes the sidecar lock BEFORE the stage's main
+     * file becomes visible on disk, a live stage always has its sidecar, so a
+     * concurrent sweep landing here for one would instead find the lock held
+     * above and keep it. Removing on ENOENT therefore reclaims genuine orphans
+     * without ever deleting a live stage (the create->register race behind
+     * #2111's windows-guards red is closed at the source). */
+    int64_t bytes = stage_bytes_on_disk(stage_path);
+    remove_stage_files(stage_path);
+    if (lock_fd >= 0) {
+        cbm_pipeline_stage_lock_drop(stage_path, lock_fd);
+    }
+    char bytes_text[32];
+    (void)snprintf(bytes_text, sizeof(bytes_text), "%lld", (long long)bytes);
+    cbm_log_info("pipeline.stage", "action", "orphan_removed", "bytes", bytes_text, "path",
+                 stage_path);
+}
+
+static void sweep_orphan_stages(const char *final_path) {
+    /* Directory part INCLUDING its trailing separator, so the stage paths
+     * are joined exactly as the final path was spelled. */
+    size_t prefix_len = 0;
+    for (const char *c = final_path; *c; c++) {
+        if (*c == '/'
+#ifdef _WIN32
+            || *c == '\\'
+#endif
+        ) {
+            prefix_len = (size_t)(c - final_path) + 1;
+        }
+    }
+    const char *base = final_path + prefix_len;
+    size_t base_len = strlen(base);
+    if (base_len == 0) {
+        return;
+    }
+    char *dir_path = prefix_len ? (char *)malloc(prefix_len + 1) : strdup(".");
+    if (!dir_path) {
+        return;
+    }
+    if (prefix_len) {
+        memcpy(dir_path, final_path, prefix_len);
+        dir_path[prefix_len] = '\0';
+    }
+    cbm_dir_t *dir = cbm_opendir(dir_path);
+    if (!dir) {
+        free(dir_path);
+        return;
+    }
+    stage_name_list_t list = {0};
+    cbm_dirent_t *entry;
+    while ((entry = cbm_readdir(dir)) != NULL) {
+        /* Any project's orphan, not just this one's: see
+         * stage_entry_stage_length_any_base. `base` still anchors the log line
+         * and the path rebuild below. */
+        size_t stage_len = stage_entry_stage_length_any_base(entry->name);
+        if (stage_len) {
+            stage_name_list_add(&list, entry->name, stage_len);
+        }
+    }
+    cbm_closedir(dir);
+    for (int i = 0; i < list.count; i++) {
+        size_t name_len = strlen(list.names[i]);
+        char *stage_path = (char *)malloc(prefix_len + name_len + 1);
+        if (stage_path) {
+            memcpy(stage_path, final_path, prefix_len);
+            memcpy(stage_path + prefix_len, list.names[i], name_len + 1);
+            sweep_one_stage(stage_path);
+            free(stage_path);
+        }
+        free(list.names[i]);
+    }
+    free(list.names);
+    free(dir_path);
+}
+
 int cbm_pipeline_run(cbm_pipeline_t *p) {
+    /* Per-index attribution: peaks and phase totals are about THIS index, not
+     * the process history, so they start clean here. The first mark opens
+     * the labelled path; every pass.timing site below closes a phase. */
+    cbm_mem_class_reset_peaks();
+    cbm_mem_phase_reset();
+    cbm_mem_phase_mark("pipeline.begin");
     if (!p) {
         return CBM_NOT_FOUND;
     }
@@ -2565,6 +3404,7 @@ int cbm_pipeline_run(cbm_pipeline_t *p) {
     }
     struct stat final_st;
     bool final_existed = stat(final_path, &final_st) == 0;
+    sweep_orphan_stages(final_path);
     char *staging_path = create_staging_path(final_path);
     if (!staging_path) {
         free(final_path);
@@ -2577,10 +3417,15 @@ int cbm_pipeline_run(cbm_pipeline_t *p) {
         if (!backup_succeeded) {
             cbm_log_warn("pipeline.stage", "action", "backup_failed_full_rebuild", "path",
                          final_path);
-            cleanup_staging_db(staging_path);
+            /* The copy is gone but the NAME stays ours: the rebuilt
+             * generation is renamed over it by the inner finalize and then
+             * published from it below, so its lock is held to the end. */
+            remove_stage_files(staging_path);
         }
     }
 
+    p->final_existed = final_existed;
+    p->existing_generation = final_existed && backup_succeeded;
     char *configured_db_path = p->db_path;
     p->db_path = strdup(staging_path);
     if (!p->db_path) {
@@ -2660,6 +3505,7 @@ int cbm_pipeline_run(cbm_pipeline_t *p) {
         return CBM_PIPELINE_PERSIST_FAILED;
     }
 
+    stage_owner_release(staging_path);
     rc = export_after_publish(p, final_path);
     free(staging_path);
     free(final_path);
diff --git a/src/pipeline/pipeline.h b/src/pipeline/pipeline.h
index 954686849..e5a672cb0 100644
--- a/src/pipeline/pipeline.h
+++ b/src/pipeline/pipeline.h
@@ -53,6 +53,13 @@ cbm_pipeline_t *cbm_pipeline_new(const char *repo_path, const char *db_path, cbm
  * When enabled, the pipeline writes a compressed artifact after indexing. */
 void cbm_pipeline_set_persistence(cbm_pipeline_t *p, bool enabled);
 
+/* Apply a validated discovery resource policy. The value is copied. */
+void cbm_pipeline_set_resource_policy(cbm_pipeline_t *p, const cbm_index_resource_policy_t *policy);
+
+/* Copy the exact discovery violation from the most recent run. */
+void cbm_pipeline_get_resource_violation(const cbm_pipeline_t *p,
+                                         cbm_index_resource_violation_t *violation);
+
 /* Free a pipeline and all its internal state. NULL-safe. */
 void cbm_pipeline_free(cbm_pipeline_t *p);
 
@@ -71,6 +78,8 @@ void cbm_pipeline_free(cbm_pipeline_t *p);
  * written, the previous DB is intact (#1997 #832). Distinct from the cancel
  * sentinel so callers can name the cause instead of "pipeline failed". */
 #define CBM_PIPELINE_ABORT_OVER_BUDGET (-5)
+/* Opt-in discovery/resource policy breach: fail the attempt, keep serving DB. */
+#define CBM_PIPELINE_RESOURCE_LIMIT (-6)
 int cbm_pipeline_run(cbm_pipeline_t *p);
 
 /* Request cancellation of a running pipeline (thread-safe). */
@@ -285,6 +294,20 @@ bool cbm_perl_suppress_generic_match(bool is_perl, bool is_method, const char *c
  * Pure; unit-tested in test_registry.c. */
 bool cbm_suppress_weak_member_match(bool enabled, bool is_method, const char *strategy);
 
+/* True if `name` is a method of a Python builtin type (str/bytes/list/dict/set/
+ * file) or a builtin function seen as an attribute call. A language fact, kept
+ * as a sorted table like the Perl builtins. */
+bool cbm_python_is_builtin_member(const char *name);
+
+/* The member guard's exemption: a Python member call whose receiver is an
+ * attribute chain rooted at self/cls (an object the class owns), whose callee has
+ * exactly one project definition (strategy unique_name) and is not a builtin
+ * type's own method keeps its edge. Combine at the call sites as
+ * `suppress && !exempt`; both pass_calls.c and pass_parallel.c must do the same.
+ * Pure; unit-tested in test_registry.c. */
+bool cbm_weak_member_unique_name_exempt(bool is_python, bool receiver_is_self_attribute,
+                                        const char *callee_name, const char *strategy);
+
 /* Bare-call counterpart of the guard above. True when a resolved BARE call edge
  * binds a callee that is shadowed by an enclosing parameter, and the match came
  * from a weak short-name strategy — so the edge is fabricated by construction
diff --git a/src/pipeline/pipeline_incremental.c b/src/pipeline/pipeline_incremental.c
index bf71a1f84..154518658 100644
--- a/src/pipeline/pipeline_incremental.c
+++ b/src/pipeline/pipeline_incremental.c
@@ -102,18 +102,6 @@ static const char *itoa_buf(int v) {
     return buf[idx];
 }
 
-/* ── Platform-portable mtime_ns ──────────────────────────────────── */
-
-static int64_t stat_mtime_ns(const struct stat *st) {
-#ifdef __APPLE__
-    return ((int64_t)st->st_mtimespec.tv_sec * CBM_NS_PER_SEC) + (int64_t)st->st_mtimespec.tv_nsec;
-#elif defined(_WIN32)
-    return (int64_t)st->st_mtime * CBM_NS_PER_SEC;
-#else
-    return ((int64_t)st->st_mtim.tv_sec * CBM_NS_PER_SEC) + (int64_t)st->st_mtim.tv_nsec;
-#endif
-}
-
 static const char *incr_mode_name(int mode) {
     switch (mode) {
     case CBM_MODE_FULL:
@@ -172,6 +160,10 @@ static int semantic_manifest_hash_file(const char *abs_path, char out[CBM_SHA256
         if (!f) {
             return CBM_NOT_FOUND;
         }
+        /* Reads go through buf below: a stdio buffer of its own was one unused
+         * 4 KB allocation per file (43 k on the Go corpus, waste sanitizer
+         * 2026-09-17). */
+        (void)setvbuf(f, NULL, _IONBF, 0);
         cbm_sha256_ctx sha;
         cbm_sha256_init(&sha);
         unsigned char buf[CBM_SZ_64K];
@@ -609,17 +601,20 @@ bool cbm_pipeline_semantic_manifests_equal(const cbm_file_hash_t *left, int left
     return equal;
 }
 
-int cbm_pipeline_build_fresh_semantic_manifest(const char *project, const char *repo_path, int mode,
+int cbm_pipeline_build_fresh_semantic_manifest(cbm_pipeline_t *p, const char *project,
                                                cbm_file_hash_t **out, int *out_count) {
-    if (!project || !repo_path || !out || !out_count) {
+    const char *repo_path = cbm_pipeline_repo_path(p);
+    if (!p || !project || !repo_path || !out || !out_count) {
         return CBM_NOT_FOUND;
     }
     *out = NULL;
     *out_count = 0;
     cbm_discover_opts_t opts = {
-        .mode = (cbm_index_mode_t)mode,
+        .mode = (cbm_index_mode_t)cbm_pipeline_get_mode(p),
         .ignore_file = NULL,
         .max_file_size = 0,
+        .resource_policy = cbm_pipeline_resource_policy(p),
+        .resource_violation = cbm_pipeline_resource_violation(p),
     };
     cbm_file_info_t *fresh_files = NULL;
     int fresh_file_count = 0;
@@ -683,14 +678,20 @@ static bool *classify_files(cbm_file_info_t *files, int file_count, cbm_file_has
             continue;
         }
 
-        struct stat st;
-        if (stat(files[i].path, &st) != 0) {
+        /* #1714: compare against the SAME source the hash writer used. The
+         * manifest hash is written from cbm_path_info_utf8 (see
+         * semantic_manifest_hash_file), so a stat()-based comparison is
+         * internally inconsistent: on Windows stat() truncates mtime to
+         * seconds while the recorded value carries FILETIME nanoseconds, which
+         * made every file look changed on each incremental pass. */
+        cbm_path_info_t info;
+        if (cbm_path_info_utf8(files[i].path, &info) != 0) {
             changed[i] = true;
             n_changed++;
             continue;
         }
 
-        if (stat_mtime_ns(&st) != h->mtime_ns || st.st_size != h->size) {
+        if (info.mtime_ns != h->mtime_ns || info.size != h->size) {
             changed[i] = true;
             n_changed++;
         } else {
@@ -1285,12 +1286,13 @@ static int run_extract_resolve(cbm_pipeline_ctx_t *ctx, cbm_file_info_t *changed
             int fresh_count = 0;
             CBMLSPDef *fresh_defs =
                 def_modules && def_starts
-                    ? cbm_pxc_collect_all_defs(ctx, cache, changed_files, ci, ctx->project_name,
-                                               def_modules, &fresh_count, def_starts)
+                    ? cbm_pxc_collect_all_defs(ctx, &closure->arena, cache, changed_files, ci,
+                                               ctx->project_name, def_modules, &fresh_count,
+                                               def_starts)
                     : NULL;
             if ((fresh_defs || fresh_count == 0) && def_starts &&
-                cbm_lsp_surface_build_rows(ctx->project_name, cache, changed_files, ci, fresh_defs,
-                                           def_starts, &closure->fresh_rows,
+                cbm_lsp_surface_build_rows(ctx, ctx->project_name, cache, changed_files, ci,
+                                           fresh_defs, def_starts, &closure->fresh_rows,
                                            &closure->fresh_count) != 0) {
                 closure->fresh_rows = NULL;
                 closure->fresh_count = 0;
@@ -1444,6 +1446,14 @@ static int run_postpasses(cbm_pipeline_ctx_t *ctx, cbm_file_info_t *changed_file
         return rc < 0 ? rc : CBM_NOT_FOUND;
     }
 
+    cbm_clock_gettime(CLOCK_MONOTONIC, &t);
+    rc = cbm_pipeline_pass_doclinks(ctx);
+    cbm_log_info("pass.timing", "pass", "incr_doclinks", "elapsed_ms",
+                 itoa_buf((int)elapsed_ms(t)));
+    if (rc < 0 || cbm_pipeline_check_cancel(ctx)) {
+        return rc < 0 ? rc : CBM_NOT_FOUND;
+    }
+
     /* SIMILAR_TO + SEMANTICALLY_RELATED edges only in moderate/full modes */
     if (ctx->mode <= CBM_MODE_MODERATE) {
         cbm_clock_gettime(CLOCK_MONOTONIC, &t);
@@ -1587,15 +1597,18 @@ static int closure_probe_surfaces(cbm_pipeline_t *p, const char *project,
         int *def_starts = (int *)calloc((size_t)probe_count + 1, sizeof(int));
         int def_count = 0;
         CBMLSPDef *defs = NULL;
+        CBMArena probe_arena;
+        cbm_arena_init(&probe_arena);
         if (def_modules && def_starts) {
-            defs = cbm_pxc_collect_all_defs(NULL, cache, probe_files, probe_count, project,
-                                            def_modules, &def_count, def_starts);
-            rc = cbm_lsp_surface_build_rows(project, cache, probe_files, probe_count, defs,
+            defs = cbm_pxc_collect_all_defs(NULL, &probe_arena, cache, probe_files, probe_count,
+                                            project, def_modules, &def_count, def_starts);
+            rc = cbm_lsp_surface_build_rows(NULL, project, cache, probe_files, probe_count, defs,
                                             def_starts, out_rows, out_count);
         } else {
             rc = -1;
         }
         free(defs);
+        cbm_arena_destroy(&probe_arena);
         free(def_starts);
         if (def_modules) {
             for (int i = 0; i < probe_count; i++) {
@@ -2262,13 +2275,13 @@ static int run_closure_delta(cbm_pipeline_t *p, const char *db_path, const char
 #if defined(CBM_INCREMENTAL_TEST_API) && CBM_INCREMENTAL_TEST_API
     cbm_pipeline_persist_test_run_before_final_manifest();
 #endif
-    if (cbm_pipeline_build_fresh_semantic_manifest(project, cbm_pipeline_repo_path(p),
-                                                   cbm_pipeline_get_mode(p), &manifest,
-                                                   &manifest_count) != 0 ||
-        !cbm_pipeline_semantic_manifests_equal(baseline_manifest, baseline_count, manifest,
-                                               manifest_count)) {
+    int manifest_rc =
+        cbm_pipeline_build_fresh_semantic_manifest(p, project, &manifest, &manifest_count);
+    if (manifest_rc != 0 || !cbm_pipeline_semantic_manifests_equal(
+                                baseline_manifest, baseline_count, manifest, manifest_count)) {
         cbm_log_warn("delta.abort", "reason", "semantic_inputs_changed");
-        result = CBM_PIPELINE_ABORT_PRESERVE_DB;
+        result = manifest_rc == CBM_DISCOVER_LIMIT_EXCEEDED ? CBM_PIPELINE_RESOURCE_LIMIT
+                                                            : CBM_PIPELINE_ABORT_PRESERVE_DB;
         goto out;
     }
 
@@ -2854,8 +2867,8 @@ int cbm_pipeline_run_incremental(cbm_pipeline_t *p, const char *db_path, cbm_fil
 #if defined(CBM_INCREMENTAL_TEST_API) && CBM_INCREMENTAL_TEST_API
     cbm_pipeline_persist_test_run_before_final_manifest();
 #endif
-    int manifest_rc = cbm_pipeline_build_fresh_semantic_manifest(
-        project, cbm_pipeline_repo_path(p), cbm_pipeline_get_mode(p), &manifest, &manifest_count);
+    int manifest_rc =
+        cbm_pipeline_build_fresh_semantic_manifest(p, project, &manifest, &manifest_count);
     if (manifest_rc != 0 || !cbm_pipeline_semantic_manifests_equal(
                                 baseline_manifest, baseline_count, manifest, manifest_count)) {
         cbm_log_warn("incremental.abort", "reason", "semantic_inputs_changed");
@@ -2865,7 +2878,8 @@ int cbm_pipeline_run_incremental(cbm_pipeline_t *p, const char *db_path, cbm_fil
         free_mode_skipped(mode_skipped, mode_skipped_count);
         free(saved_adr);
         cbm_gbuf_free(existing);
-        return CBM_PIPELINE_ABORT_PRESERVE_DB;
+        return manifest_rc == CBM_DISCOVER_LIMIT_EXCEEDED ? CBM_PIPELINE_RESOURCE_LIMIT
+                                                          : CBM_PIPELINE_ABORT_PRESERVE_DB;
     }
 
     /* Step 7: atomically publish the complete staged generation. */
diff --git a/src/pipeline/pipeline_internal.h b/src/pipeline/pipeline_internal.h
index 3a6cc1e58..e7782adef 100644
--- a/src/pipeline/pipeline_internal.h
+++ b/src/pipeline/pipeline_internal.h
@@ -136,8 +136,41 @@ typedef struct {
     /* ObjectScript method-return-type table built from extracted definitions
      * (NULL until pass_calls builds it). Owned by pipeline.c. */
     const CBMReturnTypeTable *return_type_table;
+
+    /* Spill / admission control (2026-09-13). spill_mode latches on the first
+     * over-budget observation in the extract gate (or on CBM_MEM_SPILL=1):
+     * from then on every compacted result is parked on disk instead of held
+     * in the cache, results already cached are swept out, and every later
+     * consumer (registry build, def collection, resolve) loads a result only
+     * for the moment it reads it. Memory then sits at the floor -- graph +
+     * registries + in-flight files -- and the run pays with disk reads.
+     * NULL/0 = results stay in memory as always. Owned by pipeline.c. */
+    struct cbm_result_spill *spill;
+    _Atomic int spill_mode;
+    /* Set by the ONE owner whose every result-cache consumer goes through
+     * cbm_pipeline_result_acquire()/release() and that closes the store
+     * (run_parallel_pipeline). An owner that leaves it false never spills:
+     * the incremental and probe routes still hand the cache array to passes
+     * that index it directly, so they keep results in memory (follow-up). */
+    bool spill_allowed;
 } cbm_pipeline_ctx_t;
 
+/* ── Result-cache access contract (spill mode) ────────────────────────
+ * After extraction a slot of the result cache is either the in-memory result
+ * or NULL with the result parked on disk (ctx->spill). Every consumer reads a
+ * slot through this pair; a pass that indexes the array itself is blind to
+ * parked results (the infra-route passes lost every __route__infra__ node
+ * that way, 2026-09-13). `want` (NULL = always) sees the parked HEADER first
+ * -- counts are valid, pointers are not -- and can veto the load, so a pass
+ * after one rare list does not read every parked result back from disk. */
+typedef bool (*cbm_result_want_fn)(const CBMFileResult *header);
+CBMFileResult *cbm_pipeline_result_acquire(const cbm_pipeline_ctx_t *ctx, CBMFileResult **cache,
+                                           int i, cbm_result_want_fn want, bool *loaded);
+void cbm_pipeline_result_release(CBMFileResult *r, bool loaded);
+
+/* Log the store counters, close and delete the store, drop the latch. */
+void cbm_pipeline_spill_close(cbm_pipeline_ctx_t *ctx);
+
 /* Transcode an ObjectScript Studio Export XML file and compose every generated
  * UDL class into one cacheable result. The returned result owns all child
  * extraction arenas and is released with the ordinary cbm_free_result(). */
@@ -205,6 +238,13 @@ const cbm_gbuf_node_t *cbm_pipeline_resolve_import_node(const cbm_pipeline_ctx_t
 CBMHashTable *cbm_pipeline_namespace_map_build(const char *project_name,
                                                CBMFileResult *const *results,
                                                const char *const *rels, int count);
+/* The same map built from the namespace names directly. The parallel pass needs
+ * this: results it has spilled are NULL in its cache, and a file missing from
+ * the map does not fail to resolve -- it resolves through the looser fallback,
+ * so an incomplete map CHANGES the graph instead of shrinking it. */
+CBMHashTable *cbm_pipeline_namespace_map_build_names(const char *project_name,
+                                                     const char *const *namespaces,
+                                                     const char *const *rels, int count);
 void cbm_pipeline_namespace_map_free(CBMHashTable *map);
 
 /* Parse a manifest file and collect pkg entries. Returns true if basename matched. */
@@ -625,6 +665,9 @@ int cbm_pipeline_pass_decorator_tags(cbm_gbuf_t *gbuf, const char *project);
 /* Pre-dump pass: config ↔ code linking. */
 int cbm_pipeline_pass_configlink(cbm_pipeline_ctx_t *ctx);
 
+/* Pre-dump pass: markdown → file REFERENCES_FILE linking. */
+int cbm_pipeline_pass_doclinks(cbm_pipeline_ctx_t *ctx);
+
 /* Pre-dump pass: SIMILAR_TO edges via MinHash fingerprinting. */
 int cbm_pipeline_pass_similarity(cbm_pipeline_ctx_t *ctx);
 
@@ -741,7 +784,7 @@ bool cbm_pipeline_semantic_manifests_equal(const cbm_file_hash_t *left, int left
                                            const cbm_file_hash_t *right, int right_count);
 /* Re-run discovery and hash its exact semantic inputs. Used at the publication
  * boundary so late additions/deletions cannot escape a frozen file list. */
-int cbm_pipeline_build_fresh_semantic_manifest(const char *project, const char *repo_path, int mode,
+int cbm_pipeline_build_fresh_semantic_manifest(cbm_pipeline_t *p, const char *project,
                                                cbm_file_hash_t **out, int *out_count);
 
 /* Compatibility contract persisted in coverage metadata. Increment when a
@@ -792,6 +835,17 @@ int cbm_pipeline_publish_staged(char *stage_path, const cbm_pipeline_generation_
  * executor; the dump path uses it internally). malloc'd, caller frees. */
 char *cbm_pipeline_create_staging_path(const char *final_path);
 
+/* Stage ownership (#1839). Every stage minted by cbm_pipeline_create_staging_path
+ * is owned through an exclusive kernel lock on the sidecar "<stage>.lock" for
+ * as long as the stage exists; the lock -- and the sidecar -- go away when the
+ * stage is discarded or renamed into place, and the kernel drops the lock
+ * when the writer dies. Hold/drop are the same primitive, exposed so a test
+ * can stand in for a live writer. hold returns a descriptor >= 0, or -1 when
+ * another holder is live or the sidecar cannot be created. drop releases the
+ * lock and unlinks the sidecar. */
+int cbm_pipeline_stage_lock_hold(const char *stage_path);
+void cbm_pipeline_stage_lock_drop(const char *stage_path, int lock_fd);
+
 /* ── Delta-repair staging primitives (pipeline_delta.c) ──────────
  * Closure-route-only subsystem: clone the live generation, patch exactly
  * the repaired node/edge set, publish through the shared finalize leg. */
@@ -823,6 +877,8 @@ void cbm_pipeline_set_lsp_surfaces(cbm_pipeline_t *p, cbm_lsp_surface_row_t *row
 
 /* Pipeline accessors for incremental use */
 const char *cbm_pipeline_repo_path(const cbm_pipeline_t *p);
+const cbm_index_resource_policy_t *cbm_pipeline_resource_policy(const cbm_pipeline_t *p);
+cbm_index_resource_violation_t *cbm_pipeline_resource_violation(cbm_pipeline_t *p);
 atomic_int *cbm_pipeline_cancelled_ptr(cbm_pipeline_t *p);
 /* Record committed graph size (#334 gate axis) from the incremental path,
  * which cannot see the opaque cbm_pipeline struct. Call before the dump. */
@@ -897,6 +953,15 @@ void cbm_pipeline_incremental_test_fail_adr_capture_once(void);
 typedef void (*cbm_pipeline_test_hook_fn)(void *userdata);
 void cbm_pipeline_incremental_test_before_final_manifest_once(cbm_pipeline_test_hook_fn hook,
                                                               void *userdata);
+/* Fires from create_staging_path(), right after the stage's main file is
+ * created with O_EXCL. In the current lock-before-visible ordering its sidecar
+ * lock is already held at this point, so a test hook installed here can run a
+ * concurrent sweep (via another cbm_pipeline_run() against the same
+ * final_path) and confirm the just-created stage survives it. Under the OLD
+ * create-then-lock ordering this was the unlocked window, so the hook also
+ * binds RED if that ordering regresses. */
+void cbm_pipeline_incremental_test_after_stage_created_once(cbm_pipeline_test_hook_fn hook,
+                                                            void *userdata);
 cbm_incremental_route_t cbm_pipeline_incremental_test_last_route(void);
 void cbm_pipeline_incremental_test_reset_faults(void);
 
@@ -906,6 +971,7 @@ bool cbm_pipeline_persist_test_take_failure_after_stage_dump(void);
 bool cbm_pipeline_persist_test_take_cancel_after_predump(void);
 bool cbm_pipeline_persist_test_take_cancel_after_destination_prepare(void);
 void cbm_pipeline_persist_test_run_before_final_manifest(void);
+void cbm_pipeline_persist_test_run_after_stage_created(void);
 void cbm_pipeline_persist_test_reset_faults(void);
 #endif
 
diff --git a/src/pipeline/registry.c b/src/pipeline/registry.c
index fa926d3c5..c99c72d8d 100644
--- a/src/pipeline/registry.c
+++ b/src/pipeline/registry.c
@@ -72,8 +72,18 @@ const char *cbm_confidence_band(double score) {
 
 /* ── Internal types ──────────────────────────────────────────────── */
 
-/* Array of QN strings for byName index */
-typedef CBM_DYN_ARRAY(char *) qn_array_t;
+/* Array of QN strings for byName index, with the test/mock verdict of each
+ * name cached beside it: the scorer asked is_test_qn for every candidate of
+ * every unresolved call, and the answer depends only on the name, which never
+ * changes once registered (waste sanitizer scaling lane, 2026-09-17). Field
+ * order and names match CBM_DYN_ARRAY(char *) so cbm_da_push works on it. */
+typedef struct {
+    char **items;
+    int count;
+    int cap;
+    uint8_t *is_test; /* is_test_qn(items[i]), one byte per entry */
+    int is_test_cap;
+} qn_array_t;
 
 struct cbm_registry {
     /* Interned label strings (<=~30 distinct labels; owned here, freed in
@@ -111,65 +121,157 @@ static const char *simple_name(const char *qn) {
 
 /* Extract everything before the last dot. Returns heap-allocated string. */
 
-/* Count common dot-separated prefix segments. */
+/* Count common dot-separated prefix segments. One pass over the shared prefix:
+ * the same answer as measuring each segment of both strings with strchr and
+ * strlen and comparing them, which walked every candidate's whole name per
+ * call (the scaling lane's x3.4, waste sanitizer 2026-09-17). */
 static int common_prefix_len(const char *a, const char *b) {
     if (!a || !b) {
         return 0;
     }
     int count = 0;
-    while (*a && *b) {
-        /* Find next segment in each */
-        const char *adot = strchr(a, '.');
-        const char *bdot = strchr(b, '.');
-        size_t alen = adot ? (size_t)(adot - a) : strlen(a);
-        size_t blen = bdot ? (size_t)(bdot - b) : strlen(b);
-        if (alen != blen || memcmp(a, b, alen) != 0) {
-            break;
+    size_t i = 0;
+    while (a[i] != '\0' && b[i] != '\0') { /* a segment starts here in both */
+        while (a[i] == b[i] && a[i] != '.' && a[i] != '\0') {
+            i++;
+        }
+        bool a_ends = a[i] == '.' || a[i] == '\0';
+        bool b_ends = b[i] == '.' || b[i] == '\0';
+        if (!a_ends || !b_ends) {
+            break; /* the segments differ in content or in length */
         }
         count++;
-        a += alen + (adot ? SKIP_ONE : 0);
-        b += blen + (bdot ? SKIP_ONE : 0);
-        if (!adot || !bdot) {
-            break;
+        if (a[i] == '\0' || b[i] == '\0') {
+            break; /* one name stops here: no further segment to compare */
         }
+        i++; /* both stand on '.': step into the next segment */
     }
     return count;
 }
 
 enum { REG_TEST_PENALTY = 1000 };
 
-/* Check if a qualified name looks like a test/mock path. */
+/* Check if a qualified name looks like a test/mock path: does it contain any of
+ * Test, test, Mock, mock, Stub, stub, Fake, fake, Fixture, spec? One pass that
+ * dispatches on the first character instead of ten strstr scans of the whole
+ * name (this ran for every candidate of every unresolved call: the scaling
+ * lane's x4.0, waste sanitizer 2026-09-17). */
 static bool is_test_qn(const char *qn) {
     if (!qn) {
         return false;
     }
-    return (strstr(qn, "Test") != NULL || strstr(qn, "test") != NULL ||
-            strstr(qn, "Mock") != NULL || strstr(qn, "mock") != NULL ||
-            strstr(qn, "Stub") != NULL || strstr(qn, "stub") != NULL ||
-            strstr(qn, "Fake") != NULL || strstr(qn, "fake") != NULL ||
-            strstr(qn, "Fixture") != NULL || strstr(qn, "spec") != NULL);
+    for (const char *p = qn; *p; p++) {
+        switch (*p) {
+        case 'T':
+            if (strncmp(p, "Test", 4) == 0) {
+                return true;
+            }
+            break;
+        case 't':
+            if (strncmp(p, "test", 4) == 0) {
+                return true;
+            }
+            break;
+        case 'M':
+            if (strncmp(p, "Mock", 4) == 0) {
+                return true;
+            }
+            break;
+        case 'm':
+            if (strncmp(p, "mock", 4) == 0) {
+                return true;
+            }
+            break;
+        case 'S':
+            if (strncmp(p, "Stub", 4) == 0) {
+                return true;
+            }
+            break;
+        case 's':
+            if (strncmp(p, "stub", 4) == 0 || strncmp(p, "spec", 4) == 0) {
+                return true;
+            }
+            break;
+        case 'F':
+            if (strncmp(p, "Fake", 4) == 0 || strncmp(p, "Fixture", 7) == 0) {
+                return true;
+            }
+            break;
+        case 'f':
+            if (strncmp(p, "fake", 4) == 0) {
+                return true;
+            }
+            break;
+        default:
+            break;
+        }
+    }
+    return false;
+}
+
+/* The cached test verdicts, only when they cover every entry: a failed growth
+ * leaves the cache short, and then the scorer asks per candidate as before. */
+static const uint8_t *qn_test_flags(const qn_array_t *arr) {
+    return arr->is_test && arr->is_test_cap >= arr->count ? arr->is_test : NULL;
 }
 
 /* Score a candidate for tiebreaking. Higher = better.
  * Layer 1: Non-test code preferred over test code (+1000)
- * Layer 2: Namespace proximity via common prefix length (+plen) */
-static int candidate_score(const char *candidate_qn, const char *module_qn) {
+ * Layer 2: Namespace proximity via common prefix length (+plen)
+ * `is_test` is the cached verdict when the caller has one (-1: ask). */
+static int candidate_score(const char *candidate_qn, const char *module_qn, int is_test) {
     int score = 0;
-    if (!is_test_qn(candidate_qn)) {
+    bool test = is_test >= 0 ? is_test != 0 : is_test_qn(candidate_qn);
+    if (!test) {
         score += REG_TEST_PENALTY;
     }
     score += common_prefix_len(candidate_qn, module_qn);
     return score;
 }
 
-/* Pick candidate with highest composite score (test-deprioritization + namespace proximity). */
-static const char *best_by_import_distance(const char **candidates, int count,
-                                           const char *module_qn) {
+/* Number of '.'-separated segments in a QN: how deeply the definition is
+ * nested (file depth + enclosing types). */
+static int qn_depth(const char *qn) {
+    int depth = 1;
+    for (const char *p = qn; *p; p++) {
+        if (*p == '.') {
+            depth++;
+        }
+    }
+    return depth;
+}
+
+/* Total order among candidates that tie on candidate_score. The registry's
+ * by-name bucket is in registration order, which follows the file list; a
+ * tie broken by bucket position made the resolved target a function of
+ * that order (kernel: 632 CALLS edges differed between two indexes of the
+ * same tree, `dev_name` flipping between twenty same-named struct fields
+ * and unresolved, `sg_set_buf` between include/linux and tools/virtio).
+ * The rule: the least nested definition wins (a top-level function over a
+ * same-named member two types deep, include/linux over tools/virtio/linux),
+ * then the lexicographically smaller QN — a pure function of the candidate
+ * set, never of the order it was built in (O9). */
+static bool candidate_outranks_on_tie(const char *candidate, const char *best) {
+    int cd = qn_depth(candidate);
+    int bd = qn_depth(best);
+    if (cd != bd) {
+        return cd < bd;
+    }
+    return strcmp(candidate, best) < 0;
+}
+
+/* Pick candidate with highest composite score (test-deprioritization + namespace
+ * proximity). `is_test_flags` is the candidates' cached test verdicts, or NULL
+ * when the caller has none (a filtered subset carries its own copy). */
+static const char *best_by_import_distance(const char **candidates, const uint8_t *is_test_flags,
+                                           int count, const char *module_qn) {
     const char *best = NULL;
     int best_score = CBM_NOT_FOUND;
     for (int i = 0; i < count; i++) {
-        int score = candidate_score(candidates[i], module_qn);
-        if (score > best_score) {
+        int score =
+            candidate_score(candidates[i], module_qn, is_test_flags ? (int)is_test_flags[i] : -1);
+        if (score > best_score ||
+            (score == best_score && best && candidate_outranks_on_tie(candidates[i], best))) {
             best_score = score;
             best = candidates[i];
         }
@@ -190,23 +292,30 @@ static const char *best_by_import_distance(const char **candidates, int count,
  * file exit. Thread-local so each worker has its own cache without
  * contention. */
 static CBM_TLS CBMHashTable *_reach_cache = NULL;
+/* The cache's key copies live in one per-file arena, released with the cache:
+ * a strdup per memoized candidate was 12.5 M malloc + free pairs on the Go
+ * corpus (waste sanitizer, 2026-09-17). Keys are still copies -- the public
+ * cbm_registry_is_import_reachable may be handed a caller's buffer. */
+static CBM_TLS CBMArena _reach_keys;
+static CBM_TLS bool _reach_keys_live = false;
+/* The arena opens on the first memoized key, with a small first block that
+ * doubles: opened eagerly at the 64 KB default, the per-file arenas were 1.4 GB
+ * of cumulative allocation on the Go corpus, almost all of it never written
+ * (waste sanitizer, 2026-09-17). */
+enum { REACH_KEYS_FIRST_BLOCK = 4096 };
 
 /* Sentinels stored as values in the cache. NULL means "not cached".
  * We need two distinct non-NULL pointers to encode true/false. */
 #define REACH_CACHE_TRUE ((void *)(uintptr_t)1)
 #define REACH_CACHE_FALSE ((void *)(uintptr_t)2)
 
-static void reach_cache_free_key(const char *key, void *val, void *ud) {
-    (void)val;
-    (void)ud;
-    free((char *)key);
-}
-
 void cbm_registry_reach_cache_begin(int estimated_capacity) {
     if (_reach_cache) {
         /* Defensive: caller forgot to call _end. Clear and reuse. */
-        cbm_ht_foreach(_reach_cache, reach_cache_free_key, NULL);
         cbm_ht_clear(_reach_cache);
+        if (_reach_keys_live) {
+            cbm_arena_reset(&_reach_keys);
+        }
         return;
     }
     if (estimated_capacity < 16)
@@ -217,9 +326,12 @@ void cbm_registry_reach_cache_begin(int estimated_capacity) {
 void cbm_registry_reach_cache_end(void) {
     if (!_reach_cache)
         return;
-    cbm_ht_foreach(_reach_cache, reach_cache_free_key, NULL);
     cbm_ht_free(_reach_cache);
     _reach_cache = NULL;
+    if (_reach_keys_live) {
+        cbm_arena_destroy(&_reach_keys);
+        _reach_keys_live = false;
+    }
 }
 
 /* ── Per-file import-map prefix → module-QN hash ──────────────────
@@ -341,7 +453,11 @@ static bool is_import_reachable(const char *candidate_qn, const char **import_va
     }
 
     if (_reach_cache) {
-        char *kdup = strdup(candidate_qn);
+        if (!_reach_keys_live) {
+            cbm_arena_init_sized(&_reach_keys, REACH_KEYS_FIRST_BLOCK);
+            _reach_keys_live = true;
+        }
+        char *kdup = cbm_arena_strdup(&_reach_keys, candidate_qn);
         if (kdup) {
             cbm_ht_set(_reach_cache, kdup, reachable ? REACH_CACHE_TRUE : REACH_CACHE_FALSE);
         }
@@ -475,6 +591,84 @@ bool cbm_suppress_weak_member_match(bool enabled, bool is_method, const char *st
     return weak_short_name_strategy(strategy);
 }
 
+/* ── Python builtin-type members ─────────────────────────────────────────
+ * Methods of Python's builtin types (str, bytes, list, dict, set, file objects)
+ * plus the builtin functions that appear as attribute calls. Like PERL_BUILTINS
+ * this is a fact about the LANGUAGE, not about corpus fashion: a member call
+ * whose name is a builtin's own method — `parts.extend(...)`, `line.strip()`,
+ * `d.items()` — is that builtin's method whenever the receiver is untyped, so a
+ * project symbol that merely shares the spelling must not bind. MUST stay
+ * sorted ASCII-ascending for bsearch. */
+static const char *const PYTHON_BUILTIN_MEMBERS[] = {
+    "add",        "append",       "capitalize",
+    "casefold",   "center",       "clear",
+    "close",      "copy",         "count",
+    "decode",     "difference",   "discard",
+    "encode",     "endswith",     "expandtabs",
+    "extend",     "fileno",       "find",
+    "flush",      "format",       "get",
+    "index",      "insert",       "intersection",
+    "isalnum",    "isalpha",      "isdecimal",
+    "isdigit",    "isidentifier", "islower",
+    "isnumeric",  "isprintable",  "isspace",
+    "istitle",    "isupper",      "issubset",
+    "issuperset", "items",        "join",
+    "keys",       "ljust",        "lower",
+    "lstrip",     "partition",    "pop",
+    "popitem",    "print",        "read",
+    "readable",   "readline",     "readlines",
+    "remove",     "replace",      "reverse",
+    "rfind",      "rindex",       "rjust",
+    "rpartition", "rsplit",       "rstrip",
+    "seek",       "setdefault",   "sort",
+    "split",      "splitlines",   "startswith",
+    "strip",      "swapcase",     "symmetric_difference",
+    "tell",       "title",        "truncate",
+    "union",      "update",       "upper",
+    "values",     "writable",     "write",
+    "writelines", "zfill",
+};
+
+static int python_builtin_member_cmp(const void *key, const void *elem) {
+    return strcmp((const char *)key, *(const char *const *)elem);
+}
+
+bool cbm_python_is_builtin_member(const char *name) {
+    if (!name || !name[0]) {
+        return false;
+    }
+    return bsearch(name, PYTHON_BUILTIN_MEMBERS,
+                   sizeof(PYTHON_BUILTIN_MEMBERS) / sizeof(PYTHON_BUILTIN_MEMBERS[0]),
+                   sizeof(PYTHON_BUILTIN_MEMBERS[0]), python_builtin_member_cmp) != NULL;
+}
+
+/* The member guard's one exemption. A Python member call whose receiver could
+ * not be typed still carries real evidence when three facts line up: the callee
+ * name has exactly ONE definition in the whole project (strategy unique_name),
+ * the receiver is an attribute chain rooted at self/cls — an object the class
+ * owns, not a parameter handed in — and the name is not a builtin type's own
+ * method. `self.compiler.apply_converters()` names the only apply_converters in
+ * django and nothing else it could mean exists. Measured on django/django
+ * (v0.10.8 → v0.11.0 A/B, 2026-09-16): the unconditional guard dropped 800 such
+ * self-rooted edges, every sampled one a real call in the source. A bare
+ * parameter receiver (`accelerator.backward()`, #1276's own case) carries no
+ * ownership evidence and stays suppressed, as does every builtin-member name
+ * (`self.parts.extend()`). Python only: the JS/TS family keeps the TS-LSP trade
+ * recorded in the resolution probe. Pure; unit-tested in test_registry.c. */
+bool cbm_weak_member_unique_name_exempt(bool is_python, bool receiver_is_self_attribute,
+                                        const char *callee_name, const char *strategy) {
+    if (!is_python || !receiver_is_self_attribute) {
+        return false;
+    }
+    if (!strategy || strcmp(strategy, "unique_name") != 0) {
+        return false;
+    }
+    if (!callee_name || !callee_name[0]) {
+        return false;
+    }
+    return !cbm_python_is_builtin_member(simple_name(callee_name));
+}
+
 /* Bare-call counterpart of the member guard above. A Python call `foo()` whose
  * callee identifier is bound as a parameter of an enclosing scope cannot be the
  * module-level `foo`: the parameter shadows it for the whole body. Binding such
@@ -527,13 +721,30 @@ static const char *path_basename(const char *path) {
     return slash ? slash + 1 : path;
 }
 
+/* Build and configuration languages have no cross-language call semantics: a
+ * Makefile's `$(eval ...)` or a CMake `function(...)` names nothing in a C
+ * file, so a bare-name bind into another language is always a collision
+ * (2026-09-16 probe: kernel Makefile targets bound to `sk_psock.eval`). */
+static bool build_config_language(CBMLanguage lang) {
+    return lang == CBM_LANG_MAKEFILE || lang == CBM_LANG_CMAKE || lang == CBM_LANG_YAML ||
+           lang == CBM_LANG_TOML || lang == CBM_LANG_JSON || lang == CBM_LANG_INI ||
+           lang == CBM_LANG_DOCKERFILE;
+}
+
 bool cbm_suppress_cross_language_suffix_match(CBMLanguage caller_lang, const char *target_file_path,
                                               const char *strategy) {
     /* Two same-named symbols in different languages: suffix_match picks one
      * winner by import-distance and attaches every bare-name call to it
      * (#725, Bash/Python main, JS/Python commit). unique_name is the
-     * candidates==1 case (#1572) and is not this guard. */
-    if (!strategy || strcmp(strategy, "suffix_match") != 0) {
+     * candidates==1 case (#1572) and is not this guard — except for a build
+     * or configuration caller, where even a unique match into another
+     * language is a collision by construction. */
+    if (!strategy) {
+        return false;
+    }
+    bool config_caller = build_config_language(caller_lang);
+    if (strcmp(strategy, "suffix_match") != 0 &&
+        !(config_caller && strcmp(strategy, "unique_name") == 0)) {
         return false;
     }
     if (caller_lang == CBM_LANG_COUNT || !target_file_path || !target_file_path[0]) {
@@ -623,6 +834,7 @@ static void free_qn_array(const char *key, void *value, void *ud) {
     qn_array_t *arr = value;
     if (arr) {
         /* items borrow the exact map's keys — freed there, not here */
+        cbm_free(CBM_MEM_CLASS_DYN_ARRAY, arr->is_test);
         cbm_da_free(arr);
         free(arr);
     }
@@ -689,7 +901,23 @@ void cbm_registry_add(cbm_registry_t *r, const char *name, const char *qualified
         arr = calloc(CBM_ALLOC_ONE, sizeof(qn_array_t));
         cbm_ht_set(r->by_name, strdup(simple), arr);
     }
+    int before = arr->count;
     cbm_da_push(arr, (char *)owned_qn);
+    if (arr->count == before) {
+        return; /* the name could not be recorded: no verdict to cache */
+    }
+    if (arr->count > arr->is_test_cap) {
+        int want = arr->cap > 0 ? arr->cap : arr->count;
+        uint8_t *grown =
+            cbm_realloc(CBM_MEM_CLASS_DYN_ARRAY, arr->is_test, (size_t)want * sizeof(uint8_t));
+        if (grown) {
+            arr->is_test = grown;
+            arr->is_test_cap = want;
+        }
+    }
+    if (arr->count <= arr->is_test_cap) {
+        arr->is_test[arr->count - SKIP_ONE] = is_test_qn(owned_qn) ? 1 : 0;
+    }
 }
 
 /* ── Lookup ──────────────────────────────────────────────────────── */
@@ -842,10 +1070,16 @@ static cbm_resolution_t resolve_same_module(const cbm_registry_t *r, const char
 static cbm_resolution_t resolve_multi_with_imports(const qn_array_t *arr, const char *module_qn,
                                                    const char **import_vals, int import_count) {
     const char *filtered[CBM_SZ_256];
+    uint8_t filtered_test[CBM_SZ_256];
+    const uint8_t *flags = qn_test_flags(arr);
     int fcount = 0;
     for (int i = 0; i < arr->count && fcount < CBM_SZ_256; i++) {
         if (is_import_reachable(arr->items[i], import_vals, import_count)) {
-            filtered[fcount++] = arr->items[i];
+            if (flags) {
+                filtered_test[fcount] = flags[i];
+            }
+            filtered[fcount] = arr->items[i];
+            fcount++;
         }
     }
     if (fcount == SKIP_ONE) {
@@ -853,14 +1087,16 @@ static cbm_resolution_t resolve_multi_with_imports(const qn_array_t *arr, const
         return (cbm_resolution_t){filtered[0], "suffix_match", conf, arr->count};
     }
     if (fcount > SKIP_ONE) {
-        const char *best = best_by_import_distance(filtered, fcount, module_qn);
+        const char *best =
+            best_by_import_distance(filtered, flags ? filtered_test : NULL, fcount, module_qn);
         if (best) {
             double conf = candidate_count_penalty(CONF_SUFFIX_MATCH, fcount);
             return (cbm_resolution_t){best, "suffix_match", conf, fcount};
         }
     }
     /* No import-reachable — use all candidates with penalty */
-    const char *best = best_by_import_distance((const char **)arr->items, arr->count, module_qn);
+    const char *best = best_by_import_distance((const char **)arr->items, qn_test_flags(arr),
+                                               arr->count, module_qn);
     if (best) {
         double conf = candidate_count_penalty(CONF_SUFFIX_MATCH * REG_HALF_PENALTY, arr->count);
         return (cbm_resolution_t){best, "suffix_match", conf, arr->count};
@@ -979,27 +1215,37 @@ static bool receiver_chain_admits(const char *callee_name, const char *candidate
         return true;
     }
 
-    /* The candidate's parent segment: the one before its final name. */
+    /* The candidate's ancestry: every segment before its final name. */
     const char *cand_last = strrchr(candidate_qn, '.');
     if (!cand_last || cand_last == candidate_qn) {
-        return true; /* top-level candidate — no parent to look for */
+        return true; /* top-level candidate — no ancestry to look for */
     }
-    const char *parent = cand_last;
-    while (parent > candidate_qn && parent[-1] != '.') {
-        parent--;
-    }
-    size_t parent_len = (size_t)(cand_last - parent);
 
     /* Walk the chain — every segment before the final callee name. A trailing
-     * "()" is dropped so JSONEncoder().encode reads as JSONEncoder. */
+     * "()" is dropped so JSONEncoder().encode reads as JSONEncoder. A chain
+     * segment admits the candidate when it names ANY segment of the candidate's
+     * ancestry, not only the immediate parent: Settings.builder().putList binds
+     * settings.Settings.Builder.putList because Settings owns Builder, and
+     * RequestOptions.DEFAULT.toBuilder().setWarningsHandler binds
+     * RequestOptions.Builder.setWarningsHandler the same way. Measured on
+     * elastic/elasticsearch: the parent-only rule refused 9,473 unique-name
+     * calls, most of them exactly these factory chains into a nested Builder.
+     * A foreign root still finds nothing in the ancestry — Base64.getEncoder
+     * does not admit DocOffsetsCodec.getEncoder, URLSession.shared.data does
+     * not admit PickedFile.data — so the #1893 refusals hold. */
     for (const char *seg = dotted; seg < last_dot;) {
         const char *end = strchr(seg, '.');
         size_t len = (size_t)(end - seg);
         if (len >= 2 && seg[len - 2] == '(' && seg[len - 1] == ')') {
             len -= 2; /* an empty "()" — JSONEncoder().encode names JSONEncoder */
         }
-        if (len == parent_len && strncmp(seg, parent, parent_len) == 0) {
-            return true;
+        for (const char *anc = candidate_qn; anc < cand_last;) {
+            const char *anc_end = strchr(anc, '.');
+            size_t anc_len = (size_t)(anc_end - anc);
+            if (anc_len == len && len > 0 && strncmp(seg, anc, len) == 0) {
+                return true;
+            }
+            anc = anc_end + SKIP_ONE;
         }
         seg = end + SKIP_ONE;
     }
@@ -1046,7 +1292,8 @@ static cbm_resolution_t resolve_name_lookup(const cbm_registry_t *r, const char
     if (import_vals && import_count > 0) {
         return resolve_multi_with_imports(arr, module_qn, import_vals, import_count);
     }
-    const char *best = best_by_import_distance((const char **)arr->items, arr->count, module_qn);
+    const char *best = best_by_import_distance((const char **)arr->items, qn_test_flags(arr),
+                                               arr->count, module_qn);
     if (best) {
         if (!receiver_chain_admits(callee_name, best)) {
             return empty_result();
@@ -1226,8 +1473,8 @@ cbm_fuzzy_result_t cbm_registry_fuzzy_resolve(const cbm_registry_t *r, const cha
 
     if (fcount == 0) {
         /* No import-reachable — use originals with penalty */
-        const char *best =
-            best_by_import_distance((const char **)arr->items, arr->count, module_qn);
+        const char *best = best_by_import_distance((const char **)arr->items, qn_test_flags(arr),
+                                                   arr->count, module_qn);
         if (!best) {
             return no_match;
         }
@@ -1241,7 +1488,8 @@ cbm_fuzzy_result_t cbm_registry_fuzzy_resolve(const cbm_registry_t *r, const cha
             {fptr[0], "fuzzy", candidate_count_penalty(CONF_FUZZY_SINGLE, arr->count), arr->count},
             true};
     }
-    const char *best = best_by_import_distance(fptr, fcount, module_qn);
+    const char *best = best_by_import_distance(
+        fptr, fptr == (const char **)arr->items ? qn_test_flags(arr) : NULL, fcount, module_qn);
     if (!best) {
         return no_match;
     }
diff --git a/src/pipeline/worker_pool.c b/src/pipeline/worker_pool.c
index 9cde541a4..2247fccd5 100644
--- a/src/pipeline/worker_pool.c
+++ b/src/pipeline/worker_pool.c
@@ -8,12 +8,14 @@
  * Each worker pulls indices from a shared atomic counter — zero
  * contention, natural load balancing across heterogeneous cores.
  */
+#include "foundation/mem_events.h"
 #include "pipeline/worker_pool.h"
 #include "foundation/constants.h"
 
 enum { WP_TRUE = 1, WP_MIN = 1, WP_STEP = 1 };
 #include "foundation/platform.h"
 #include "foundation/compat_thread.h"
+#include "foundation/mem_core.h"
 
 #include <stdatomic.h>
 #include <stdlib.h>
@@ -39,6 +41,33 @@ typedef struct {
     int count;
 } pthread_worker_arg_t;
 
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+/* Per-thread item counts, so the waste sanitizer can see an unbalanced pool:
+ * workers that sat idle while one thread did the work. */
+typedef struct {
+    pthread_worker_arg_t *wa;
+    int done;
+    uint64_t ops; /* events this worker produced: the work it actually did */
+} wp_counted_arg_t;
+
+static void *pthread_worker_counted(void *arg) {
+    wp_counted_arg_t *ca = arg;
+    pthread_worker_arg_t *wa = ca->wa;
+    uint64_t ops_before = cbm_memev_thread_ops();
+    while (WP_TRUE) {
+        int idx = atomic_fetch_add_explicit(wa->next_idx, WP_STEP, memory_order_relaxed);
+        if (idx >= wa->count) {
+            break;
+        }
+        wa->fn(idx, wa->ctx);
+        ca->done++;
+    }
+    ca->ops = cbm_memev_thread_ops() - ops_before;
+    cbm_mem_class_flush_thread();
+    return NULL;
+}
+#endif
+
 static void *pthread_worker(void *arg) {
     pthread_worker_arg_t *wa = arg;
     while (WP_TRUE) {
@@ -48,9 +77,71 @@ static void *pthread_worker(void *arg) {
         }
         wa->fn(idx, wa->ctx);
     }
+    /* This thread ends here: hand its pending memory-class deltas to the
+     * shared counters, so the phase mark that follows the join is exact. */
+    cbm_mem_class_flush_thread();
     return NULL;
 }
 
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+static void run_pthreads_counted(int count, cbm_parallel_fn fn, void *ctx, int nworkers,
+                                 void *site) {
+    _Atomic int next_idx = 0;
+    pthread_worker_arg_t wa = {.fn = fn, .ctx = ctx, .next_idx = &next_idx, .count = count};
+    cbm_thread_t *threads = cbm_alloc(CBM_MEM_CLASS_OTHER, (size_t)nworkers * sizeof(cbm_thread_t));
+    wp_counted_arg_t *args = cbm_calloc(CBM_MEM_CLASS_OTHER, (size_t)nworkers * sizeof(*args));
+    if (!threads || !args) {
+        cbm_free(CBM_MEM_CLASS_OTHER, threads);
+        cbm_free(CBM_MEM_CLASS_OTHER, args);
+        run_serial(count, fn, ctx);
+        return;
+    }
+    int started = 0;
+    for (int i = 0; i < nworkers; i++) {
+        args[i].wa = &wa;
+        if (cbm_thread_create(&threads[i], CBM_WORKER_STACK_SIZE, pthread_worker_counted,
+                              &args[i]) != 0) {
+            break;
+        }
+        started++;
+    }
+    int main_done = 0;
+    uint64_t main_ops_before = cbm_memev_thread_ops();
+    while (WP_TRUE) {
+        int idx = atomic_fetch_add_explicit(&next_idx, WP_STEP, memory_order_relaxed);
+        if (idx >= count) {
+            break;
+        }
+        fn(idx, ctx);
+        main_done++;
+    }
+    uint64_t main_ops = cbm_memev_thread_ops() - main_ops_before;
+    for (int i = 0; i < started; i++) {
+        cbm_thread_join(&threads[i]);
+    }
+    int max_done = main_done;
+    uint64_t max_ops = main_ops;
+    uint64_t sum_ops = main_ops;
+    for (int i = 0; i < started; i++) {
+        if (args[i].done > max_done) {
+            max_done = args[i].done;
+        }
+        if (args[i].ops > max_ops) {
+            max_ops = args[i].ops;
+        }
+        sum_ops += args[i].ops;
+    }
+    int participants = started + 1;
+    uint64_t balanced_max = (uint64_t)participants * (uint64_t)max_done;
+    uint64_t imbalance = balanced_max > (uint64_t)count ? balanced_max - (uint64_t)count : 0;
+    cbm_work_note(CBM_WORK_PARALLEL_FOR, site, (uint64_t)count, imbalance, (uint64_t)participants);
+    cbm_work_note(CBM_WORK_POOL_OPS, site, sum_ops, (uint64_t)participants * max_ops - sum_ops,
+                  (uint64_t)participants);
+    cbm_free(CBM_MEM_CLASS_OTHER, threads);
+    cbm_free(CBM_MEM_CLASS_OTHER, args);
+}
+#endif
+
 static void run_pthreads(int count, cbm_parallel_fn fn, void *ctx, int nworkers) {
     _Atomic int next_idx = 0;
 
@@ -113,5 +204,11 @@ void cbm_parallel_for(int count, cbm_parallel_fn fn, void *ctx, cbm_parallel_for
         return;
     }
 
+#if defined(CBM_MEMWASTE) && CBM_MEMWASTE
+    if (cbm_memev_enabled()) {
+        run_pthreads_counted(count, fn, ctx, nworkers, __builtin_return_address(0));
+        return;
+    }
+#endif
     run_pthreads(count, fn, ctx, nworkers);
 }
diff --git a/src/semantic/semantic.c b/src/semantic/semantic.c
index 8023e70cd..2aa1df5a3 100644
--- a/src/semantic/semantic.c
+++ b/src/semantic/semantic.c
@@ -6,6 +6,7 @@
  * Uses xxHash for deterministic random vectors. Pure C, zero dependencies.
  */
 #include "semantic/semantic.h"
+#include "foundation/mem_core.h"
 #include "foundation/constants.h"
 #include "foundation/hash_table.h"
 #include "foundation/log.h"
@@ -158,7 +159,7 @@ static bool is_camel_break(const char *name, int i) {
 static void flush_token(char *buf, int *blen, char **out, int *count, int max_out) {
     if (*blen > 0 && *count < max_out) {
         buf[*blen] = '\0';
-        out[(*count)++] = strdup(buf);
+        out[(*count)++] = cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, buf);
     }
     *blen = 0;
 }
@@ -358,7 +359,7 @@ int cbm_sem_tokenize(const char *name, char **out, int max_out) {
     for (int t = 0; t < orig_count && count < max_out; t++) {
         for (int a = 0; abbrevs[a].abbrev; a++) {
             if (strcmp(out[t], abbrevs[a].abbrev) == 0) {
-                out[count++] = strdup(abbrevs[a].expanded);
+                out[count++] = cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, abbrevs[a].expanded);
                 break;
             }
         }
@@ -422,7 +423,8 @@ static void ensure_pretrained_map(void) {
             const char *tok = PRETRAINED_TOKENS[i];
             if (tok && tok[0]) {
                 snprintf(idx_buf, sizeof(idx_buf), "%d", i);
-                cbm_ht_set(g_pretrained_map, strdup(tok), strdup(idx_buf));
+                cbm_ht_set(g_pretrained_map, cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, tok),
+                           cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, idx_buf));
             }
         }
         atomic_store_explicit(&g_pretrained_ready, MAP_READY, memory_order_release);
@@ -524,7 +526,8 @@ static int corpus_get_or_add(cbm_sem_corpus_t *c, const char *token) {
     }
     if (c->entry_count >= c->entry_cap) {
         int new_cap = c->entry_cap < CORPUS_INIT_CAP ? CORPUS_INIT_CAP : c->entry_cap * PAIR_LEN;
-        corpus_entry_t *grown = realloc(c->entries, (size_t)new_cap * sizeof(corpus_entry_t));
+        corpus_entry_t *grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, c->entries,
+                                            (size_t)new_cap * sizeof(corpus_entry_t));
         if (!grown) {
             return CBM_NOT_FOUND;
         }
@@ -532,16 +535,17 @@ static int corpus_get_or_add(cbm_sem_corpus_t *c, const char *token) {
         c->entry_cap = new_cap;
     }
     int idx = c->entry_count++;
-    c->entries[idx].token = strdup(token);
+    c->entries[idx].token = cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, token);
     c->entries[idx].doc_freq = 0;
     memset(&c->entries[idx].enriched_vec, 0, sizeof(cbm_sem_vec_t));
     snprintf(idx_buf, sizeof(idx_buf), "%d", idx);
-    cbm_ht_set(c->token_map, strdup(token), strdup(idx_buf));
+    cbm_ht_set(c->token_map, cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, token),
+               cbm_mem_strdup(CBM_MEM_CLASS_SEMANTIC, idx_buf));
     return idx;
 }
 
 cbm_sem_corpus_t *cbm_sem_corpus_new(void) {
-    cbm_sem_corpus_t *c = calloc(SKIP_ONE, sizeof(cbm_sem_corpus_t));
+    cbm_sem_corpus_t *c = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, sizeof(cbm_sem_corpus_t));
     if (c) {
         c->token_map = cbm_ht_create(CORPUS_INIT_CAP);
     }
@@ -556,11 +560,13 @@ void cbm_sem_corpus_add_doc(cbm_sem_corpus_t *corpus, const char **tokens, int c
     if (corpus->doc_count >= corpus->doc_cap) {
         int new_cap =
             corpus->doc_cap < DOC_TOKENS_INIT ? DOC_TOKENS_INIT : corpus->doc_cap * PAIR_LEN;
-        int **grown_ids = realloc(corpus->doc_token_ids, (size_t)new_cap * sizeof(int *));
-        int *grown_counts = realloc(corpus->doc_token_counts, (size_t)new_cap * sizeof(int));
+        int **grown_ids = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, corpus->doc_token_ids,
+                                      (size_t)new_cap * sizeof(int *));
+        int *grown_counts = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, corpus->doc_token_counts,
+                                        (size_t)new_cap * sizeof(int));
         if (!grown_ids || !grown_counts) {
-            free(grown_ids);
-            free(grown_counts);
+            cbm_free(CBM_MEM_CLASS_SEMANTIC, grown_ids);
+            cbm_free(CBM_MEM_CLASS_SEMANTIC, grown_counts);
             return;
         }
         corpus->doc_token_ids = grown_ids;
@@ -568,11 +574,13 @@ void cbm_sem_corpus_add_doc(cbm_sem_corpus_t *corpus, const char **tokens, int c
         corpus->doc_cap = new_cap;
     }
     int doc_idx = corpus->doc_count++;
-    corpus->doc_token_ids[doc_idx] = malloc((size_t)count * sizeof(int));
+    corpus->doc_token_ids[doc_idx] = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)count * sizeof(int));
     corpus->doc_token_counts[doc_idx] = count;
 
     /* Per-doc unique set for IDF */
-    int *seen = calloc((size_t)corpus->entry_cap + (size_t)count + CORPUS_INIT_CAP, sizeof(int));
+    int *seen =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC,
+                   ((size_t)corpus->entry_cap + (size_t)count + CORPUS_INIT_CAP) * sizeof(int));
     int seen_count = 0;
 
     for (int i = 0; i < count; i++) {
@@ -594,7 +602,7 @@ void cbm_sem_corpus_add_doc(cbm_sem_corpus_t *corpus, const char **tokens, int c
             corpus->entries[tid].doc_freq++;
         }
     }
-    free(seen);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, seen);
 }
 
 /* ── Parallel corpus batch build ──────────────────────────────────── */
@@ -612,8 +620,8 @@ void cbm_sem_corpus_add_doc(cbm_sem_corpus_t *corpus, const char **tokens, int c
 typedef struct {
     cbm_sem_corpus_t *corpus;
     char **all_tokens;
+    const size_t *offsets; /* document d = all_tokens[offsets[d] ..] */
     const int *token_counts;
-    int max_tokens;
     int doc_count;
     _Atomic int *doc_freq_atomic; /* per-entry atomic counter (entry_count long) */
     _Atomic int next_idx;
@@ -630,12 +638,12 @@ static void batch_resolve_one_doc(batch_resolve_ctx_t *bc, int doc_index, int *s
         bc->corpus->doc_token_counts[doc_index] = 0;
         return;
     }
-    int *ids = malloc((size_t)count * sizeof(int));
+    int *ids = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)count * sizeof(int));
     bc->corpus->doc_token_ids[doc_index] = ids;
     bc->corpus->doc_token_counts[doc_index] = count;
 
     int seen_count = 0;
-    char **tokens = &bc->all_tokens[(ptrdiff_t)doc_index * bc->max_tokens];
+    char **tokens = &bc->all_tokens[bc->offsets[doc_index]];
     for (int i = 0; i < count; i++) {
         const char *idx_str = cbm_ht_get(bc->corpus->token_map, tokens[i]);
         int tid = CBM_NOT_FOUND;
@@ -671,7 +679,7 @@ static void batch_resolve_worker(int worker_id, void *ctx_ptr) {
     batch_resolve_ctx_t *bc = ctx_ptr;
     /* Per-worker scratch for unique-per-doc tracking */
     int local_seen_cap = CBM_SEM_SEEN_INIT_CAP;
-    int *seen = malloc((size_t)local_seen_cap * sizeof(int));
+    int *seen = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)local_seen_cap * sizeof(int));
     if (!seen) {
         return;
     }
@@ -689,7 +697,7 @@ static void batch_resolve_worker(int worker_id, void *ctx_ptr) {
         for (int d = start; d < end; d++) {
             int count = bc->token_counts[d];
             if (count > local_seen_cap) {
-                int *grown = realloc(seen, (size_t)count * sizeof(int));
+                int *grown = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, seen, (size_t)count * sizeof(int));
                 if (!grown) {
                     continue;
                 }
@@ -699,12 +707,12 @@ static void batch_resolve_worker(int worker_id, void *ctx_ptr) {
             batch_resolve_one_doc(bc, d, seen);
         }
     }
-    free(seen);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, seen);
 }
 
 void cbm_sem_corpus_add_docs_batch(cbm_sem_corpus_t *corpus, char **all_tokens,
-                                   const int *token_counts, int doc_count, int max_tokens_per_doc) {
-    if (!corpus || !all_tokens || !token_counts || doc_count <= 0) {
+                                   const size_t *offsets, const int *token_counts, int doc_count) {
+    if (!corpus || !all_tokens || !offsets || !token_counts || doc_count <= 0) {
         return;
     }
 
@@ -712,11 +720,13 @@ void cbm_sem_corpus_add_docs_batch(cbm_sem_corpus_t *corpus, char **all_tokens,
      * Hash table mutation can't be parallelized; strdup+insert is the cost. */
     if (corpus->doc_cap < corpus->doc_count + doc_count) {
         int new_cap = corpus->doc_count + doc_count;
-        int **grown_ids = realloc(corpus->doc_token_ids, (size_t)new_cap * sizeof(int *));
-        int *grown_counts = realloc(corpus->doc_token_counts, (size_t)new_cap * sizeof(int));
+        int **grown_ids = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, corpus->doc_token_ids,
+                                      (size_t)new_cap * sizeof(int *));
+        int *grown_counts = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, corpus->doc_token_counts,
+                                        (size_t)new_cap * sizeof(int));
         if (!grown_ids || !grown_counts) {
-            free(grown_ids);
-            free(grown_counts);
+            cbm_free(CBM_MEM_CLASS_SEMANTIC, grown_ids);
+            cbm_free(CBM_MEM_CLASS_SEMANTIC, grown_counts);
             return;
         }
         corpus->doc_token_ids = grown_ids;
@@ -728,7 +738,7 @@ void cbm_sem_corpus_add_docs_batch(cbm_sem_corpus_t *corpus, char **all_tokens,
 
     for (int d = 0; d < doc_count; d++) {
         int count = token_counts[d];
-        char **tokens = &all_tokens[(ptrdiff_t)d * max_tokens_per_doc];
+        char **tokens = &all_tokens[offsets[d]];
         for (int i = 0; i < count; i++) {
             /* Inserts token into token_map if new; we discard return here —
              * Phase B will re-lookup in read-only mode to get the ID. */
@@ -739,14 +749,15 @@ void cbm_sem_corpus_add_docs_batch(cbm_sem_corpus_t *corpus, char **all_tokens,
     /* Phase B (PARALLEL): Resolve tokens → IDs and count doc_freq per entry.
      * token_map is now read-only; each worker owns its doc range (no writes
      * to shared state except atomic doc_freq counters). */
-    _Atomic int *doc_freq_atomic = calloc((size_t)corpus->entry_count, sizeof(_Atomic int));
+    _Atomic int *doc_freq_atomic =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)corpus->entry_count * sizeof(_Atomic int));
     if (!doc_freq_atomic) {
         /* OOM fallback: sequential path. Roll back doc_count first since
          * add_doc increments it itself. */
         corpus->doc_count = base_doc;
         for (int d = 0; d < doc_count; d++) {
             int count = token_counts[d];
-            char **tokens = &all_tokens[(ptrdiff_t)d * max_tokens_per_doc];
+            char **tokens = &all_tokens[offsets[d]];
             cbm_sem_corpus_add_doc(corpus, (const char **)tokens, count);
         }
         return;
@@ -757,7 +768,7 @@ void cbm_sem_corpus_add_docs_batch(cbm_sem_corpus_t *corpus, char **all_tokens,
         .corpus = corpus,
         .all_tokens = all_tokens,
         .token_counts = token_counts,
-        .max_tokens = max_tokens_per_doc,
+        .offsets = offsets,
         .doc_count = doc_count,
         .doc_freq_atomic = doc_freq_atomic,
     };
@@ -775,7 +786,7 @@ void cbm_sem_corpus_add_docs_batch(cbm_sem_corpus_t *corpus, char **all_tokens,
         corpus->entries[i].doc_freq +=
             atomic_load_explicit(&doc_freq_atomic[i], memory_order_relaxed);
     }
-    free(doc_freq_atomic);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, doc_freq_atomic);
 }
 
 /* ── Parallel corpus_finalize ─────────────────────────────────────── */
@@ -1205,14 +1216,15 @@ static void pass1_quantize_worker(int worker_id, void *ctx_ptr) {
 /* Build reverse index: token_id → list of (doc_id, position) pairs.
  * SEQUENTIAL (fast: just pointer arithmetic + flat array fill). */
 static reverse_index_t *build_reverse_index(cbm_sem_corpus_t *corpus) {
-    reverse_index_t *rev = calloc(SKIP_ONE, sizeof(reverse_index_t));
+    reverse_index_t *rev = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, sizeof(reverse_index_t));
     if (!rev) {
         return NULL;
     }
     /* Phase A: count occurrences per token */
-    int *counts = calloc((size_t)corpus->entry_count + SKIP_ONE, sizeof(int));
+    int *counts =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, ((size_t)corpus->entry_count + SKIP_ONE) * sizeof(int));
     if (!counts) {
-        free(rev);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, rev);
         return NULL;
     }
     long total = 0;
@@ -1228,10 +1240,11 @@ static reverse_index_t *build_reverse_index(cbm_sem_corpus_t *corpus) {
         }
     }
     /* Phase B: exclusive prefix sum → offsets[] */
-    rev->offsets = malloc(((size_t)corpus->entry_count + SKIP_ONE) * sizeof(int));
+    rev->offsets =
+        cbm_alloc(CBM_MEM_CLASS_SEMANTIC, ((size_t)corpus->entry_count + SKIP_ONE) * sizeof(int));
     if (!rev->offsets) {
-        free(counts);
-        free(rev);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, counts);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, rev);
         return NULL;
     }
     int running = 0;
@@ -1242,13 +1255,13 @@ static reverse_index_t *build_reverse_index(cbm_sem_corpus_t *corpus) {
     }
     rev->offsets[corpus->entry_count] = running;
     /* Phase C: fill flat array. Ensure allocation size > 0 even for empty
-     * corpora (avoids malloc(0) which is implementation-defined). */
+     * corpora (avoids cbm_alloc(CBM_MEM_CLASS_SEMANTIC, 0) which is implementation-defined). */
     size_t flat_bytes = (total > 0 ? (size_t)total : SKIP_ONE) * sizeof(cooccur_pos_t);
-    rev->flat = malloc(flat_bytes);
+    rev->flat = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, flat_bytes);
     if (!rev->flat) {
-        free(rev->offsets);
-        free(counts);
-        free(rev);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, rev->offsets);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, counts);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, rev);
         return NULL;
     }
     for (int d = 0; d < corpus->doc_count; d++) {
@@ -1263,7 +1276,7 @@ static reverse_index_t *build_reverse_index(cbm_sem_corpus_t *corpus) {
             }
         }
     }
-    free(counts);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, counts);
     return rev;
 }
 
@@ -1271,9 +1284,9 @@ static void free_reverse_index(reverse_index_t *rev) {
     if (!rev) {
         return;
     }
-    free(rev->offsets);
-    free(rev->flat);
-    free(rev);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, rev->offsets);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, rev->flat);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, rev);
 }
 
 /* Bundle of parameters shared by the finalize sub-phases. */
@@ -1323,7 +1336,8 @@ static void finalize_pass1(finalize_params_t *p) {
 
 /* Sub-phases 4+5: quantize pass1 to int8, run RRI pass 2, blend + normalize. */
 static void finalize_pass2(finalize_params_t *p) {
-    int8_t *pass1_q = malloc((size_t)p->corpus->entry_count * CBM_SEM_DIM * sizeof(int8_t));
+    int8_t *pass1_q = cbm_alloc(CBM_MEM_CLASS_SEMANTIC,
+                                (size_t)p->corpus->entry_count * CBM_SEM_DIM * sizeof(int8_t));
     if (pass1_q) {
         pass1_quant_ctx_t qc = {
             .entries = p->corpus->entries,
@@ -1334,7 +1348,8 @@ static void finalize_pass2(finalize_params_t *p) {
         cbm_parallel_for(p->worker_count, pass1_quantize_worker, &qc, p->opts);
     }
 
-    cbm_sem_vec_t *pass1 = malloc((size_t)p->corpus->entry_count * sizeof(cbm_sem_vec_t));
+    cbm_sem_vec_t *pass1 =
+        cbm_alloc(CBM_MEM_CLASS_SEMANTIC, (size_t)p->corpus->entry_count * sizeof(cbm_sem_vec_t));
     if (pass1) {
         for (int i = 0; i < p->corpus->entry_count; i++) {
             pass1[i] = p->corpus->entries[i].enriched_vec;
@@ -1366,15 +1381,25 @@ static void finalize_pass2(finalize_params_t *p) {
         };
         atomic_init(&bc.next_idx, 0);
         cbm_parallel_for(p->worker_count, blend_worker, &bc, p->opts);
-        free(pass1);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, pass1);
     }
-    free(pass1_q);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, pass1_q);
 
     norm_ctx_t nc = {.entries = p->corpus->entries, .entry_count = p->corpus->entry_count};
     atomic_init(&nc.next_idx, 0);
     cbm_parallel_for(p->worker_count, normalize_worker, &nc, p->opts);
 }
 
+/* The per-document token id lists exist for the co-occurrence pass only;
+ * released at the end of finalize so the vector phase runs without them
+ * (783k small blocks on the kernel). */
+static void corpus_release_docs(cbm_sem_corpus_t *corpus) {
+    for (int d = 0; d < corpus->doc_count; d++) {
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, corpus->doc_token_ids[d]);
+        corpus->doc_token_ids[d] = NULL;
+    }
+}
+
 void cbm_sem_corpus_finalize(cbm_sem_corpus_t *corpus) {
     if (!corpus || corpus->finalized) {
         return;
@@ -1401,8 +1426,8 @@ void cbm_sem_corpus_finalize(cbm_sem_corpus_t *corpus) {
         corpus->finalized = true;
         return;
     }
-    cbm_sem_src_entry_t *src_entries =
-        calloc((size_t)corpus->entry_count, sizeof(cbm_sem_src_entry_t));
+    cbm_sem_src_entry_t *src_entries = cbm_calloc(
+        CBM_MEM_CLASS_SEMANTIC, (size_t)corpus->entry_count * sizeof(cbm_sem_src_entry_t));
     if (!src_entries) {
         free_reverse_index(rev);
         corpus->finalized = true;
@@ -1423,8 +1448,9 @@ void cbm_sem_corpus_finalize(cbm_sem_corpus_t *corpus) {
     finalize_pass1(&params);
     finalize_pass2(&params);
 
-    free(src_entries);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, src_entries);
     free_reverse_index(rev);
+    corpus_release_docs(corpus);
     corpus->finalized = true;
 }
 
@@ -1465,6 +1491,33 @@ const cbm_sem_vec_t *cbm_sem_corpus_ri_vec(const cbm_sem_corpus_t *corpus, const
     return &corpus->entries[idx].enriched_vec;
 }
 
+int cbm_sem_corpus_token_index(const cbm_sem_corpus_t *corpus, const char *token) {
+    if (!corpus || !token) {
+        return CBM_NOT_FOUND;
+    }
+    int idx = parse_token_index(cbm_ht_get(corpus->token_map, token));
+    return (idx < 0 || idx >= corpus->entry_count) ? CBM_NOT_FOUND : idx;
+}
+
+/* Same arithmetic as cbm_sem_corpus_idf, by index. */
+float cbm_sem_corpus_idf_at(const cbm_sem_corpus_t *corpus, int index) {
+    if (!corpus || corpus->doc_count == 0 || index < 0 || index >= corpus->entry_count) {
+        return 0.0F;
+    }
+    int df = corpus->entries[index].doc_freq;
+    if (df <= 0) {
+        return 0.0F;
+    }
+    return logf((float)corpus->doc_count / (float)df);
+}
+
+const cbm_sem_vec_t *cbm_sem_corpus_ri_vec_at(const cbm_sem_corpus_t *corpus, int index) {
+    if (!corpus || index < 0 || index >= corpus->entry_count) {
+        return NULL;
+    }
+    return &corpus->entries[index].enriched_vec;
+}
+
 int cbm_sem_corpus_doc_count(const cbm_sem_corpus_t *corpus) {
     return corpus ? corpus->doc_count : 0;
 }
@@ -1490,8 +1543,8 @@ const char *cbm_sem_corpus_token_at(const cbm_sem_corpus_t *corpus, int index,
 
 static void free_ht_kv(const char *key, void *value, void *userdata) {
     (void)userdata;
-    free((void *)key);
-    free(value);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, (void *)key);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, value);
 }
 
 void cbm_sem_corpus_free(cbm_sem_corpus_t *corpus) {
@@ -1499,19 +1552,19 @@ void cbm_sem_corpus_free(cbm_sem_corpus_t *corpus) {
         return;
     }
     for (int i = 0; i < corpus->entry_count; i++) {
-        free(corpus->entries[i].token);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, corpus->entries[i].token);
     }
-    free(corpus->entries);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, corpus->entries);
     for (int d = 0; d < corpus->doc_count; d++) {
-        free(corpus->doc_token_ids[d]);
+        cbm_free(CBM_MEM_CLASS_SEMANTIC, corpus->doc_token_ids[d]);
     }
-    free(corpus->doc_token_ids);
-    free(corpus->doc_token_counts);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, corpus->doc_token_ids);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, corpus->doc_token_counts);
     if (corpus->token_map) {
         cbm_ht_foreach(corpus->token_map, free_ht_kv, NULL);
         cbm_ht_free(corpus->token_map);
     }
-    free(corpus);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, corpus);
 }
 
 /* ── Combined scoring ────────────────────────────────────────────── */
diff --git a/src/semantic/semantic.h b/src/semantic/semantic.h
index ddb5f5896..1f99a54c0 100644
--- a/src/semantic/semantic.h
+++ b/src/semantic/semantic.h
@@ -24,6 +24,7 @@
 #ifndef CBM_SEMANTIC_H
 #define CBM_SEMANTIC_H
 
+#include <stddef.h> /* size_t */
 #include <stdbool.h>
 #include <stdint.h>
 
@@ -166,11 +167,13 @@ cbm_sem_corpus_t *cbm_sem_corpus_new(void);
 void cbm_sem_corpus_add_doc(cbm_sem_corpus_t *corpus, const char **tokens, int count);
 
 /* Batch-build the corpus from pre-tokenized documents (PARALLEL variant).
- * `all_tokens` layout: all_tokens[f * max_tokens_per_doc + t] = token pointer.
- * `token_counts[f]` = number of tokens in document f.
+ * Document f's tokens are all_tokens[offsets[f] .. offsets[f] + token_counts[f]).
+ * Packed, not strided: a fixed CBM_SEM_MAX_TOKENS (512) slots per document
+ * was 4 KB per function up front -- 7.4 GB on the kernel for tokens that
+ * average a few dozen per function.
  * This replaces a loop of cbm_sem_corpus_add_doc() calls. */
 void cbm_sem_corpus_add_docs_batch(cbm_sem_corpus_t *corpus, char **all_tokens,
-                                   const int *token_counts, int doc_count, int max_tokens_per_doc);
+                                   const size_t *offsets, const int *token_counts, int doc_count);
 
 /* Finalize: compute IDF, build enriched token vectors via co-occurrence. */
 void cbm_sem_corpus_finalize(cbm_sem_corpus_t *corpus);
@@ -181,6 +184,14 @@ float cbm_sem_corpus_idf(const cbm_sem_corpus_t *corpus, const char *token);
 /* Get the enriched Random Indexing vector for a token (after co-occurrence). */
 const cbm_sem_vec_t *cbm_sem_corpus_ri_vec(const cbm_sem_corpus_t *corpus, const char *token);
 
+/* The same two answers by token index, for a caller that asks both about many
+ * tokens: resolve each token once (cbm_sem_corpus_token_index, -1 when unknown)
+ * and read idf and vector by index. The name-keyed pair costs one hash lookup and
+ * one strtol per question -- three per token in the vector build. */
+int cbm_sem_corpus_token_index(const cbm_sem_corpus_t *corpus, const char *token);
+float cbm_sem_corpus_idf_at(const cbm_sem_corpus_t *corpus, int index);
+const cbm_sem_vec_t *cbm_sem_corpus_ri_vec_at(const cbm_sem_corpus_t *corpus, int index);
+
 /* Get the total document count. */
 int cbm_sem_corpus_doc_count(const cbm_sem_corpus_t *corpus);
 
diff --git a/src/simhash/minhash.c b/src/simhash/minhash.c
index dc42ef4f5..d8680c8cc 100644
--- a/src/simhash/minhash.c
+++ b/src/simhash/minhash.c
@@ -9,6 +9,7 @@
  */
 #include "simhash/minhash.h"
 #include "foundation/constants.h"
+#include "foundation/mem_core.h"
 #include "foundation/log.h"
 /* Inline all xxHash functions — avoids separate compilation unit. */
 #define XXH_INLINE_ALL
@@ -176,32 +177,45 @@ static int collect_ast_tokens(TSNode root, const char **tokens, int max_tokens)
 /* Unique-trigram set: open addressing on 64-bit hashes. */
 enum { UNIQ_SET_SIZE = 4096, UNIQ_SET_MASK = 4095 };
 
+/* The set is sized per function: at least twice its trigram count (so it can
+ * never fill), at most UNIQ_SET_SIZE as before. Zeroing all 4,096 slots for
+ * every function was a 32 KB memset per fingerprint. */
 typedef struct {
     uint64_t slots[UNIQ_SET_SIZE];
+    uint32_t mask;
     int count;
 } uniq_trig_set_t;
 
-static void uniq_trig_init(uniq_trig_set_t *s) {
-    memset(s->slots, 0, sizeof(s->slots));
+enum { UNIQ_SET_MIN = 64 };
+
+static void uniq_trig_init(uniq_trig_set_t *s, int trigram_count) {
+    uint32_t size = UNIQ_SET_MIN;
+    while (size < UNIQ_SET_SIZE && (int64_t)size < (int64_t)trigram_count * PAIR_LEN) {
+        size <<= SKIP_ONE;
+    }
+    memset(s->slots, 0, (size_t)size * sizeof(s->slots[0]));
+    s->mask = size - SKIP_ONE;
     s->count = 0;
 }
 
-/* Insert a trigram hash.  Returns true if newly inserted. */
-static bool uniq_trig_insert(uniq_trig_set_t *s, uint64_t trig_hash) {
+enum { UNIQ_PRESENT = 0, UNIQ_NEW = 1, UNIQ_FULL = 2 };
+
+/* Insert a trigram hash: UNIQ_NEW, UNIQ_PRESENT, or UNIQ_FULL (not counted). */
+static int uniq_trig_insert(uniq_trig_set_t *s, uint64_t trig_hash) {
     uint64_t val = trig_hash | SKIP_ONE; /* ensure non-zero */
-    uint32_t slot = (uint32_t)(trig_hash & UNIQ_SET_MASK);
-    for (int probe = 0; probe < UNIQ_SET_SIZE; probe++) {
-        uint32_t idx = (slot + (uint32_t)probe) & UNIQ_SET_MASK;
+    uint32_t slot = (uint32_t)(trig_hash & s->mask);
+    for (uint32_t probe = 0; probe <= s->mask; probe++) {
+        uint32_t idx = (slot + probe) & s->mask;
         if (s->slots[idx] == 0) {
             s->slots[idx] = val;
             s->count++;
-            return true;
+            return UNIQ_NEW;
         }
         if (s->slots[idx] == val) {
-            return false;
+            return UNIQ_PRESENT;
         }
     }
-    return false;
+    return UNIQ_FULL;
 }
 
 /* Apply weighted MinHash for one trigram: hash w times per seed. */
@@ -224,7 +238,7 @@ static int hash_trigrams(const char **tokens, int token_count, cbm_minhash_t *ou
     }
 
     uniq_trig_set_t uniq;
-    uniq_trig_init(&uniq);
+    uniq_trig_init(&uniq, token_count > TRIGRAM_WINDOW ? token_count - TRIGRAM_WINDOW : 0);
     char trigram_buf[TRIGRAM_BUF_LEN];
 
     for (int i = 0; i + TRIGRAM_WINDOW < token_count; i++) {
@@ -240,8 +254,13 @@ static int hash_trigrams(const char **tokens, int token_count, cbm_minhash_t *ou
             continue;
         }
 
-        uniq_trig_insert(&uniq, XXH3_64bits(trigram_buf, (size_t)len));
-        weighted_minhash_update(out, trigram_buf, len, w);
+        /* A repeated trigram is the same string with the same weight: its
+         * update would lower the same minima to the same values. Only a first
+         * occurrence pays the 64 x w seeded hashes (identical fingerprints;
+         * the scaling lane had XXH3 at 15 % of all counted work). */
+        if (uniq_trig_insert(&uniq, XXH3_64bits(trigram_buf, (size_t)len)) != UNIQ_PRESENT) {
+            weighted_minhash_update(out, trigram_buf, len, w);
+        }
     }
     return uniq.count;
 }
@@ -355,7 +374,8 @@ static uint32_t band_hash(const cbm_minhash_t *fp, int band) {
 static void bucket_push(lsh_bucket_t *bucket, int entry_index) {
     if (bucket->count >= bucket->cap) {
         int new_cap = bucket->cap < BUCKET_INIT_CAP ? BUCKET_INIT_CAP : bucket->cap * GROW_FACTOR;
-        int *new_items = realloc(bucket->items, (size_t)new_cap * sizeof(int));
+        int *new_items =
+            cbm_realloc(CBM_MEM_CLASS_SEMANTIC, bucket->items, (size_t)new_cap * sizeof(int));
         if (!new_items) {
             return;
         }
@@ -366,7 +386,8 @@ static void bucket_push(lsh_bucket_t *bucket, int entry_index) {
 }
 
 cbm_lsh_index_t *cbm_lsh_new(void) {
-    cbm_lsh_index_t *idx = calloc(SKIP_ONE, sizeof(cbm_lsh_index_t));
+    cbm_lsh_index_t *idx =
+        cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)(SKIP_ONE) * (sizeof(cbm_lsh_index_t)));
     return idx;
 }
 
@@ -379,8 +400,8 @@ void cbm_lsh_insert(cbm_lsh_index_t *idx, const cbm_lsh_entry_t *entry) {
     if (idx->entry_count >= idx->entry_cap) {
         int new_cap =
             idx->entry_cap < ENTRY_INIT_CAP ? ENTRY_INIT_CAP : idx->entry_cap * GROW_FACTOR;
-        cbm_lsh_entry_t *new_entries =
-            realloc(idx->entries, (size_t)new_cap * sizeof(cbm_lsh_entry_t));
+        cbm_lsh_entry_t *new_entries = cbm_realloc(CBM_MEM_CLASS_SEMANTIC, idx->entries,
+                                                   (size_t)new_cap * sizeof(cbm_lsh_entry_t));
         if (!new_entries) {
             return;
         }
@@ -405,7 +426,7 @@ typedef struct {
 } seen_set_t;
 
 static void seen_set_init(seen_set_t *s) {
-    s->slots = calloc(SEEN_SET_SIZE, sizeof(int64_t));
+    s->slots = cbm_calloc(CBM_MEM_CLASS_SEMANTIC, (size_t)(SEEN_SET_SIZE) * (sizeof(int64_t)));
     s->cap = SEEN_SET_SIZE;
     /* 0 means empty — node_ids are always > 0 */
 }
@@ -429,7 +450,7 @@ static bool seen_set_insert(seen_set_t *s, int64_t node_id) {
 }
 
 static void seen_set_free(seen_set_t *s) {
-    free(s->slots);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, s->slots);
     s->slots = NULL;
 }
 
@@ -439,7 +460,8 @@ static bool result_push(cbm_lsh_index_t *idx, const cbm_lsh_entry_t *candidate)
         int new_cap =
             idx->result_cap < RESULT_INIT_CAP ? RESULT_INIT_CAP : idx->result_cap * GROW_FACTOR;
         const cbm_lsh_entry_t **new_buf =
-            realloc(idx->result_buf, (size_t)new_cap * sizeof(const cbm_lsh_entry_t *));
+            cbm_realloc(CBM_MEM_CLASS_SEMANTIC, idx->result_buf,
+                        (size_t)new_cap * sizeof(const cbm_lsh_entry_t *));
         if (!new_buf) {
             return false;
         }
@@ -489,15 +511,52 @@ void cbm_lsh_query(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
     *count = mut_idx->result_count;
 }
 
-int cbm_lsh_query_into(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
-                       const cbm_lsh_entry_t **out_buf, int out_cap) {
-    if (!idx || !fp || !out_buf || out_cap <= 0) {
+/* The reusable set: a slot belongs to the running query only when its stamp is
+ * the current generation. Same size, hash and probe order as seen_set_t, so the
+ * candidates found (and their order) are exactly those of a fresh table. */
+struct cbm_lsh_seen {
+    int64_t ids[SEEN_SET_SIZE];
+    uint32_t stamp[SEEN_SET_SIZE];
+    uint32_t current;
+};
+
+cbm_lsh_seen_t *cbm_lsh_seen_new(void) {
+    return cbm_calloc(CBM_MEM_CLASS_SEMANTIC, sizeof(cbm_lsh_seen_t));
+}
+
+void cbm_lsh_seen_free(cbm_lsh_seen_t *seen) {
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, seen);
+}
+
+static void lsh_seen_begin(cbm_lsh_seen_t *s) {
+    if (++s->current == 0) { /* generation wrapped: every old stamp must go */
+        memset(s->stamp, 0, sizeof(s->stamp));
+        s->current = 1;
+    }
+}
+
+static bool lsh_seen_insert(cbm_lsh_seen_t *s, int64_t node_id) {
+    uint32_t idx = (uint32_t)(node_id * KNUTH_MULT) & SEEN_SET_MASK;
+    for (int probe = 0; probe < SEEN_SET_SIZE; probe++) {
+        uint32_t slot = (idx + (uint32_t)probe) & SEEN_SET_MASK;
+        if (s->stamp[slot] != s->current) {
+            s->stamp[slot] = s->current;
+            s->ids[slot] = node_id;
+            return true; /* inserted (was not present) */
+        }
+        if (s->ids[slot] == node_id) {
+            return false; /* already present */
+        }
+    }
+    return false; /* table full */
+}
+
+int cbm_lsh_query_into_seen(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
+                            const cbm_lsh_entry_t **out_buf, int out_cap, cbm_lsh_seen_t *seen) {
+    if (!idx || !fp || !out_buf || out_cap <= 0 || !seen) {
         return 0;
     }
-
-    /* Thread-local dedup — no shared state touched. */
-    seen_set_t seen;
-    seen_set_init(&seen);
+    lsh_seen_begin(seen);
 
     int count = 0;
     for (int b = 0; b < CBM_LSH_BANDS; b++) {
@@ -508,7 +567,7 @@ int cbm_lsh_query_into(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
         }
         for (int i = 0; i < bucket->count && count < out_cap; i++) {
             const cbm_lsh_entry_t *candidate = &idx->entries[bucket->items[i]];
-            if (!seen_set_insert(&seen, candidate->node_id)) {
+            if (!lsh_seen_insert(seen, candidate->node_id)) {
                 continue;
             }
             out_buf[count++] = candidate;
@@ -517,8 +576,20 @@ int cbm_lsh_query_into(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
             break;
         }
     }
+    return count;
+}
 
-    seen_set_free(&seen);
+int cbm_lsh_query_into(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
+                       const cbm_lsh_entry_t **out_buf, int out_cap) {
+    if (!idx || !fp || !out_buf || out_cap <= 0) {
+        return 0;
+    }
+    cbm_lsh_seen_t *seen = cbm_lsh_seen_new();
+    if (!seen) {
+        return 0;
+    }
+    int count = cbm_lsh_query_into_seen(idx, fp, out_buf, out_cap, seen);
+    cbm_lsh_seen_free(seen);
     return count;
 }
 
@@ -529,10 +600,10 @@ void cbm_lsh_free(cbm_lsh_index_t *idx) {
     /* Free bucket arrays */
     for (int b = 0; b < CBM_LSH_BANDS; b++) {
         for (int h = 0; h < LSH_BUCKET_COUNT; h++) {
-            free(idx->bands[b][h].items);
+            cbm_free(CBM_MEM_CLASS_SEMANTIC, idx->bands[b][h].items);
         }
     }
-    free(idx->entries);
-    free(idx->result_buf);
-    free(idx);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, idx->entries);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, idx->result_buf);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, idx);
 }
diff --git a/src/simhash/minhash.h b/src/simhash/minhash.h
index cd7a7151a..8546debea 100644
--- a/src/simhash/minhash.h
+++ b/src/simhash/minhash.h
@@ -114,6 +114,18 @@ void cbm_lsh_query(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
 int cbm_lsh_query_into(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
                        const cbm_lsh_entry_t **out_buf, int out_cap);
 
+/* A dedup set one thread reuses across many queries. Starting a query costs a
+ * generation increment, not a fresh 131 KB zeroed table: the similarity pass
+ * allocated one per query, 5.3 GB of churn over 42 k queries on the Go corpus
+ * (waste sanitizer, 2026-09-17). Not shareable between threads. */
+typedef struct cbm_lsh_seen cbm_lsh_seen_t;
+cbm_lsh_seen_t *cbm_lsh_seen_new(void);
+void cbm_lsh_seen_free(cbm_lsh_seen_t *seen);
+
+/* cbm_lsh_query_into with a caller-owned dedup set: same candidates, same order. */
+int cbm_lsh_query_into_seen(const cbm_lsh_index_t *idx, const cbm_minhash_t *fp,
+                            const cbm_lsh_entry_t **out_buf, int out_cap, cbm_lsh_seen_t *seen);
+
 /* Free the LSH index and all internal storage. */
 void cbm_lsh_free(cbm_lsh_index_t *idx);
 
diff --git a/src/watcher/watcher.c b/src/watcher/watcher.c
index fc8eeb11f..95dfc1725 100644
--- a/src/watcher/watcher.c
+++ b/src/watcher/watcher.c
@@ -76,6 +76,14 @@ typedef struct {
     uint64_t last_dirty_sig;       /* committed dirty-state signature */
     uint64_t pending_dirty_sig;    /* observed at check time */
     char pending_head[CBM_SZ_128]; /* HEAD observed at check time */
+    /* Consecutive hard index failures (index_fn < 0). A hard error is
+     * usually persistent — a poisoned coordination endpoint, an unreadable
+     * DB — so retrying it at the plain poll interval re-forks a worker that
+     * fails identically, for as long as the daemon lives. #937 deliberately
+     * leaves the baseline uncommitted so the change is never lost; this
+     * decays the retry cadence so "never lost" does not also mean "retried
+     * forever". Reset to 0 by any successful reindex. */
+    int index_failures;
     /* Hop from root_path up to the repository root ("" when they are the same),
      * from `rev-parse --show-cdup`. Porcelain paths are repository-relative, so
      * the signature needs this to stat them. Resolved once at baseline. */
@@ -115,6 +123,16 @@ struct cbm_watcher {
 #define POLL_FILE_STEP 500 /* add 1s per this many files */
 #define POLL_MAX_MS 60000
 
+/* Hard index-failure backoff. Doubling per consecutive failure, capped, so a
+ * persistently failing project costs ~12 attempts/hour instead of ~480 while
+ * still recovering on its own within the ceiling once the cause clears. The
+ * shift cap keeps the intermediate value well inside int64 for any interval. */
+#define INDEX_FAIL_SHIFT_MAX 6
+#define INDEX_FAIL_CEILING_MS 300000 /* 5 min */
+/* Log a distinct line once the failures are clearly not transient, so the
+ * daemon log names the stuck project instead of only repeating the warning. */
+#define INDEX_FAIL_SUSTAINED 10
+
 /* Stale-root pruning (#286): a watched project whose root directory stays
  * missing is pruned — its cached DB is deleted and the watch entry removed.
  * Deletion is destructive (the DB can hold user-authored data such as the
@@ -144,6 +162,27 @@ static int64_t now_ns(void) {
 
 /* ── Adaptive interval ──────────────────────────────────────────── */
 
+int cbm_watcher_index_backoff_ms(int interval_ms, int consecutive_failures) {
+    if (interval_ms < 0) {
+        interval_ms = 0;
+    }
+    if (consecutive_failures <= 0) {
+        return interval_ms;
+    }
+    int shift =
+        consecutive_failures < INDEX_FAIL_SHIFT_MAX ? consecutive_failures : INDEX_FAIL_SHIFT_MAX;
+    int64_t delay = (int64_t)interval_ms << shift;
+    if (delay > INDEX_FAIL_CEILING_MS) {
+        delay = INDEX_FAIL_CEILING_MS;
+    }
+    /* Backing off must never schedule SOONER than the project's own cadence.
+     * Unreachable today (POLL_MAX_MS < the ceiling), but clamping here keeps
+     * the function monotonic for every input rather than only for the inputs
+     * the current constants can produce — the caller's contract is "a delay
+     * that never shrinks as failures accumulate". */
+    return (int)(delay < interval_ms ? interval_ms : delay);
+}
+
 int cbm_watcher_poll_interval_ms(int file_count) {
     int ms = POLL_BASE_MS + ((file_count / POLL_FILE_STEP) * CBM_MSEC_PER_SEC);
     if (ms > POLL_MAX_MS) {
@@ -1150,6 +1189,17 @@ void cbm_watcher_touch(cbm_watcher_t *w, const char *project_name) {
     cbm_mutex_unlock(&w->projects_lock);
 }
 
+int cbm_watcher_index_failure_count(cbm_watcher_t *w, const char *project_name) {
+    if (!w || !project_name) {
+        return -1;
+    }
+    cbm_mutex_lock(&w->projects_lock);
+    project_state_t *s = cbm_ht_get(w->projects, project_name);
+    int failures = s ? s->index_failures : -1;
+    cbm_mutex_unlock(&w->projects_lock);
+    return failures;
+}
+
 int cbm_watcher_watch_count(cbm_watcher_t *w) {
     if (!w) {
         return 0;
@@ -1449,6 +1499,7 @@ static void poll_project(const char *key, void *val, void *ud) {
         int rc = ctx->w->index_fn(s->project_name, s->root_path, ctx->w->user_data);
         if (rc == 0) {
             ctx->reindexed++;
+            s->index_failures = 0;
             /* Commit the baselines OBSERVED AT CHECK TIME — the state whose
              * reindex just succeeded. A commit/edit landing during the
              * reindex is deliberately not absorbed: the next poll sees it
@@ -1467,11 +1518,28 @@ static void poll_project(const char *key, void *val, void *ud) {
             /* Busy-skip: baseline stays uncommitted, next poll retries. */
             cbm_log_info("watcher.index.retry", "project", s->project_name);
         } else {
-            cbm_log_warn("watcher.index.err", "project", s->project_name);
+            /* itoa_buf returns one shared per-thread buffer, so two of them
+             * in one call would print the same value twice. */
+            char rc_text[CBM_SZ_32];
+            char streak_text[CBM_SZ_32];
+            if (s->index_failures < INT_MAX) {
+                s->index_failures++;
+            }
+            snprintf(rc_text, sizeof(rc_text), "%d", rc);
+            snprintf(streak_text, sizeof(streak_text), "%d", s->index_failures);
+            cbm_log_warn("watcher.index.err", "project", s->project_name, "rc", rc_text,
+                         "consecutive", streak_text);
+            if (s->index_failures == INDEX_FAIL_SUSTAINED) {
+                cbm_log_warn("watcher.index.sustained_failure", "project", s->project_name,
+                             "consecutive", streak_text);
+            }
         }
     }
 
-    s->next_poll_ns = ctx->now + ((int64_t)s->interval_ms * US_PER_MS);
+    /* Failures back off; success and busy-skip keep the adaptive cadence. */
+    s->next_poll_ns =
+        ctx->now +
+        ((int64_t)cbm_watcher_index_backoff_ms(s->interval_ms, s->index_failures) * US_PER_MS);
 }
 
 /* Callback to snapshot project state pointers into an array. */
diff --git a/src/watcher/watcher.h b/src/watcher/watcher.h
index 2a30cbb4f..013e1356a 100644
--- a/src/watcher/watcher.h
+++ b/src/watcher/watcher.h
@@ -91,9 +91,53 @@ void cbm_watcher_stop(cbm_watcher_t *w);
 /* Return the number of projects in the watch list. */
 int cbm_watcher_watch_count(cbm_watcher_t *w);
 
+/* Return a watched project's consecutive hard-index-failure count, or -1 when
+ * it is not watched. Exposed so the failure state machine (increment on a
+ * hard error, reset on success) can be asserted directly rather than inferred
+ * from the poll deadline it feeds.
+ *
+ * Memory visibility: this reads under projects_lock, but poll_project WRITES
+ * the counter outside that lock — it runs against a state snapshot taken
+ * while the lock was held, which is the same discipline the other
+ * poll-mutated fields here already follow (last_head, last_dirty_sig,
+ * interval_ms, next_poll_ns, missing_root_count). It is NOT the discipline of
+ * every field: active_git is serialized by projects_lock and registered is an
+ * atomic_bool. Reading concurrently with a live poll is therefore formally a
+ * data race and may observe a stale value; it is a diagnostic and test
+ * accessor, not a synchronisation point.
+ * Single-threaded callers (the tests, and any caller between poll cycles)
+ * always see the current value. Do not build scheduling decisions on it
+ * without first giving the counter atomic accessors. */
+int cbm_watcher_index_failure_count(cbm_watcher_t *w, const char *project_name);
+
 /* Return the adaptive poll interval (ms) for a given file count. */
 int cbm_watcher_poll_interval_ms(int file_count);
 
+/* Return the delay (ms) before the next index attempt for a project with
+ * `consecutive_failures` consecutive hard index failures. Zero failures
+ * yields `interval_ms` unchanged; each further failure doubles the delay, so
+ * a permanently failing project stops re-forking a worker at the poll cadence
+ * without ever being abandoned.
+ *
+ * Doubling stops at a fixed shift cap, so the delay plateaus at
+ * `interval_ms << INDEX_FAIL_SHIFT_MAX` — which is the ceiling only when
+ * `interval_ms` is large enough to reach it (>= 4688 ms for the current cap
+ * and ceiling). Below that the plateau sits strictly under the ceiling. Every
+ * interval this watcher generates is >= POLL_BASE_MS, so in practice the
+ * ceiling is always reached; the distinction is stated because this is an
+ * exported function and a caller may pass a smaller interval.
+ *
+ * The result is clamped at BOTH ends: never above the ceiling, and never
+ * below `interval_ms`, so backing off can only ever delay the next attempt,
+ * never bring it forward. That lower clamp matters only for an `interval_ms`
+ * already above the ceiling, which the current constants cannot produce
+ * (POLL_MAX_MS < the ceiling) — it is stated because this is an exported
+ * function and the guarantee should hold for any argument a caller passes,
+ * not only for the ones today's constants generate.
+ *
+ * Negative inputs are treated as zero. */
+int cbm_watcher_index_backoff_ms(int interval_ms, int consecutive_failures);
+
 /* Classify a stat() errno observed on a watched project root: returns true
  * only for values that mean the root itself is gone (ENOENT, ENOTDIR) and
  * may count toward stale-root pruning (#286). Any other failure (EACCES,
diff --git a/test-infrastructure/vm/vm-run-tests.sh b/test-infrastructure/vm/vm-run-tests.sh
index 2bd76da4f..ec17f771d 100644
--- a/test-infrastructure/vm/vm-run-tests.sh
+++ b/test-infrastructure/vm/vm-run-tests.sh
@@ -45,6 +45,66 @@ case "${1:-}" in
 -h | --help) usage; exit 0 ;;
 esac
 
+# The leg's verdict, as a function so the contract test can drive the REAL
+# logic with synthetic logs instead of a copy of it that can drift
+# (tests/test_vm_verdict_contract.sh). See the two-channel note at the call
+# site for why the log outranks the exit status.
+# `mode` is "full" for the whole venue leg and "iteration" for a named subset of
+# suites. Only the full leg prints the completion marker, because only the full
+# leg HAS an end to reach: scripts/test.sh --suites finishes after the suites it
+# was given and says nothing more. Requiring the marker in both modes made every
+# `win.sh test <suites>` run report failure while passing -- 23 passed, 1
+# skipped, rc=0, called red. A guard against false greens is not allowed to
+# invent false reds.
+vm_verdict() {
+    local log="$1"
+    local rc="$2"
+    local mode="${3:-full}"
+    if ! grep -Eq '[0-9]+ passed' "$log"; then
+        echo "GUARD: test runner produced no completion summary — the suites did" \
+            "not validly run; treating as failure (runner rc=$rc)" >&2
+        return 90
+    fi
+    local failed_total
+    local complete
+    failed_total=$(grep -Eo '[0-9]+ failed' "$log" | grep -Eo '^[0-9]+' |
+        awk '{s += $1} END {print s + 0}')
+    complete=$(grep -c '=== All tests passed ===' "$log")
+    if [ "${failed_total:-0}" -gt 0 ]; then
+        echo "GUARD: the log reports $failed_total failed test(s) (runner rc=$rc)" >&2
+        return 1
+    fi
+    if [ "$mode" = "full" ] && [ "$complete" -eq 0 ]; then
+        echo "GUARD: the log has a summary but no completion marker — the leg" \
+            "stopped before the end (runner rc=$rc)" >&2
+        return 1
+    fi
+    if [ "$mode" != "full" ] && [ "${rc:-1}" -ne 0 ]; then
+        # No marker to lean on here, so a non-zero status is the only evidence
+        # that the run ended badly after its last summary line. Iteration mode
+        # is a developer tool, not a gate, so it obeys rc rather than overriding
+        # it the way the full leg does.
+        echo "GUARD: suites reported no failures but the run exited $rc" >&2
+        return 1
+    fi
+    if [ "${rc:-1}" -ne 0 ]; then
+        echo "GUARD: every suite passed and the run completed, but the exit status" \
+            "came back as $rc — the ssh/msys2_shell chain lost it. Reporting the" \
+            "log's verdict; see the two-channel note in vm-run-tests.sh." >&2
+    fi
+    return 0
+}
+
+# Verdict-only mode for the contract test: decide a log WITHOUT a VM.
+if [ "${1:-}" = "--verdict" ]; then
+    if [ $# -lt 3 ] || [ $# -gt 4 ]; then
+        echo "usage: vm-run-tests.sh --verdict <log> <rc> [full|iteration]" >&2
+        exit 2
+    fi
+    vm_verdict "$2" "$3" "${4:-full}"
+    exit $?
+fi
+
 RUNNER="${CBM_VM_RUNNER:-}"
 
 # Per-run identity. The VM holds ONE checkout (/c/cbm), so two concurrent runs
@@ -172,4 +232,20 @@ if ! grep -Eq '[0-9]+ passed' "$LOG"; then
          "not validly run; treating as failure (runner rc=$rc)" >&2
     exit 90
 fi
-exit "$rc"
+
+# TWO independent channels decide this leg, because neither is trustworthy
+# alone. The exit status travels ssh -> cmd.exe -> msys2_shell.cmd, and that
+# chain loses it: on 2026-09-18 a leg that printed "7925 passed, 0 failed" and
+# "=== All tests passed ===" still exited 1, while the identical work run
+# through win.sh's other entry reported 0. A channel that can turn 0 into 1 can
+# turn 1 into 0 — and THAT direction is a false green, a red Windows leg
+# reported as passing, which is the failure this guard exists to prevent.
+#
+# So the LOG decides the test outcome (the runner writes it locally; it cannot
+# be mangled in transit) and rc decides what the log cannot see. Green requires
+# zero reported failures AND, for the full leg, the completion marker that
+# scripts/test.sh prints as its last statement — a leg that stopped early has a
+# summary but no marker. A named subset of suites prints no marker at all, so it
+# is judged on its summaries and its exit status instead.
+vm_verdict "$LOG" "$rc" "$([ "$1" = "--par" ] && echo full || echo iteration)"
+exit $?
diff --git a/tests/fuzz/cbm_fuzz.c b/tests/fuzz/cbm_fuzz.c
new file mode 100644
index 000000000..9e333d79e
--- /dev/null
+++ b/tests/fuzz/cbm_fuzz.c
@@ -0,0 +1,187 @@
+/*
+ * cbm_fuzz.c — coverage-guided fuzzing of the parsers that read untrusted bytes.
+ *
+ * One libFuzzer binary, three targets, chosen by CBM_FUZZ_TARGET:
+ *
+ *   extract   "<file name>\n<source>": the language comes from the file name
+ *             exactly as discovery would pick it, the source goes through the
+ *             full per-file extraction (tree-sitter grammar, extractors, LSP
+ *             passes) and the result is freed. Every grammar and extractor is
+ *             reachable from one corpus.
+ *   cypher    the whole input is a query string for the lexer and parser.
+ *   config    "<t|y|j><document>": the document is written to a private file
+ *             and one managed-entry upsert plus remove runs on it through the
+ *             TOML, YAML or JSON editor -- the code that rewrites a user's own
+ *             agent configuration.
+ *
+ * Built by `make -f Makefile.cbm fuzz` (clang with -fsanitize=fuzzer on top of
+ * ASan+UBSan; every vendored object is compiled with fuzzer-no-link, so the
+ * grammars feed coverage back too). Driven by scripts/fuzz.sh, which seeds each
+ * target from tests/fuzz/corpus/<target>/.
+ */
+#include "../../internal/cbm/cbm.h"
+#include "../../src/cli/config_json_like.h"
+#include "../../src/cli/config_toml_edit.h"
+#include "../../src/cli/config_yaml_edit.h"
+#include "../../src/cypher/cypher.h"
+#include "../../src/discover/discover.h"
+#include "../../src/foundation/compat_fs.h"
+
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+enum { FUZZ_EXTRACT, FUZZ_CYPHER, FUZZ_CONFIG };
+enum {
+    FUZZ_NAME_MAX = 128,
+    FUZZ_EXTRACT_BUDGET_MICROS = 2000000, /* a hang is a finding; a slow parse is not */
+    FUZZ_PATH_MAX = 512,
+    FUZZ_EXIT_SETUP = 2, /* the harness itself could not start */
+    FUZZ_NUL = 1,        /* room for a terminator; also the newline after the name */
+    FUZZ_JSON_PATH_LEN = 1,
+    FUZZ_FILE_NAME_ROOM = 32, /* "/config.toml" and a terminator */
+};
+
+static int g_target = FUZZ_EXTRACT;
+static char g_dir[FUZZ_PATH_MAX];
+
+int LLVMFuzzerInitialize(int *argc, char ***argv) {
+    (void)argc;
+    (void)argv;
+    const char *t = getenv("CBM_FUZZ_TARGET");
+    if (t && strcmp(t, "cypher") == 0) {
+        g_target = FUZZ_CYPHER;
+    } else if (t && strcmp(t, "config") == 0) {
+        g_target = FUZZ_CONFIG;
+    } else if (t && strcmp(t, "extract") != 0) {
+        (void)fprintf(stderr, "cbm_fuzz: CBM_FUZZ_TARGET must be extract, cypher or config\n");
+        exit(FUZZ_EXIT_SETUP);
+    }
+    if (g_target == FUZZ_EXTRACT && cbm_init() != 0) {
+        (void)fprintf(stderr, "cbm_fuzz: cbm_init failed\n");
+        exit(FUZZ_EXIT_SETUP);
+    }
+    if (g_target == FUZZ_CONFIG) {
+        const char *tmp = getenv("TMPDIR");
+        (void)snprintf(g_dir, sizeof(g_dir), "%s/cbm-fuzz-XXXXXX", tmp && tmp[0] ? tmp : "/tmp");
+        if (!mkdtemp(g_dir)) {
+            perror("cbm_fuzz: mkdtemp");
+            exit(FUZZ_EXIT_SETUP);
+        }
+    }
+    return 0;
+}
+
+static void fuzz_extract(const uint8_t *data, size_t size) {
+    size_t scan = size < FUZZ_NAME_MAX ? size : FUZZ_NAME_MAX;
+    const uint8_t *nl = memchr(data, '\n', scan);
+    if (!nl || nl == data) {
+        return;
+    }
+    size_t name_len = (size_t)(nl - data);
+    char name[FUZZ_NAME_MAX + FUZZ_NUL];
+    memcpy(name, data, name_len);
+    name[name_len] = '\0';
+    CBMLanguage lang = cbm_language_for_filename(name);
+    if ((int)lang < 0 || lang >= CBM_LANG_COUNT) {
+        return;
+    }
+    size_t src_len = size - name_len - FUZZ_NUL;
+    if (src_len > (size_t)INT32_MAX) {
+        return;
+    }
+    /* The pipeline hands extraction a file buffer with a terminator after
+     * source_len bytes, and parts of the LSP passes rely on it (strlen over the
+     * source). Fuzz the contract production honours, not a stricter one. */
+    char *source = malloc(src_len + FUZZ_NUL);
+    if (!source) {
+        return;
+    }
+    memcpy(source, nl + FUZZ_NUL, src_len);
+    source[src_len] = '\0';
+    CBMFileResult *r = cbm_extract_file(source, (int)src_len, lang, "fuzz", name,
+                                        FUZZ_EXTRACT_BUDGET_MICROS, NULL, NULL);
+    if (r) {
+        cbm_free_tree(r);
+        cbm_free_result(r);
+    }
+    free(source);
+}
+
+static void fuzz_cypher(const uint8_t *data, size_t size) {
+    char *query = malloc(size + FUZZ_NUL);
+    if (!query) {
+        return;
+    }
+    memcpy(query, data, size);
+    query[size] = '\0';
+    cbm_query_t *q = NULL;
+    char *error = NULL;
+    (void)cbm_cypher_parse(query, &q, &error);
+    cbm_query_free(q);
+    free(error);
+    free(query);
+}
+
+static void fuzz_config(const uint8_t *data, size_t size) {
+    if (size < FUZZ_NUL) {
+        return;
+    }
+    char path[FUZZ_PATH_MAX + FUZZ_FILE_NAME_ROOM];
+    const char *ext = data[0] == 't' ? "toml" : data[0] == 'y' ? "yaml" : "json";
+    (void)snprintf(path, sizeof(path), "%s/config.%s", g_dir, ext);
+    FILE *f = cbm_fopen(path, "wb");
+    if (!f) {
+        return;
+    }
+    size_t body = size - FUZZ_NUL;
+    if (body > 0 && fwrite(data + FUZZ_NUL, FUZZ_NUL, body, f) != body) {
+        (void)fclose(f);
+        return;
+    }
+    if (fclose(f) != 0) {
+        return;
+    }
+    switch (data[0]) {
+    case 't':
+        (void)cbm_toml_upsert_managed_block(path, "# BEGIN codebase-memory",
+                                            "# END codebase-memory", "owned = true\n");
+        (void)cbm_toml_remove_managed_block(path, "# BEGIN codebase-memory",
+                                            "# END codebase-memory");
+        break;
+    case 'y':
+        (void)cbm_yaml_upsert_mapping_entry(path, "mcp_servers", "codebase-memory",
+                                            "    command: codebase-memory-mcp\n");
+        (void)cbm_yaml_remove_mapping_entry(path, "mcp_servers", "codebase-memory");
+        break;
+    default: {
+        const char *object_path[] = {"mcpServers"};
+        (void)cbm_json_like_upsert_entry(path, object_path, FUZZ_JSON_PATH_LEN, "codebase-memory",
+                                         "{\"command\":\"codebase-memory-mcp\"}");
+        char *content = NULL;
+        size_t length = 0;
+        if (cbm_json_like_read_document(path, &content, &length) == 0) {
+            free(content);
+        }
+        break;
+    }
+    }
+    (void)unlink(path);
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    switch (g_target) {
+    case FUZZ_CYPHER:
+        fuzz_cypher(data, size);
+        break;
+    case FUZZ_CONFIG:
+        fuzz_config(data, size);
+        break;
+    default:
+        fuzz_extract(data, size);
+        break;
+    }
+    return 0;
+}
diff --git a/tests/fuzz/corpus/config/json-empty.seed b/tests/fuzz/corpus/config/json-empty.seed
new file mode 100644
index 000000000..0e4721e84
--- /dev/null
+++ b/tests/fuzz/corpus/config/json-empty.seed
@@ -0,0 +1 @@
+j{}
\ No newline at end of file
diff --git a/tests/fuzz/corpus/config/json.seed b/tests/fuzz/corpus/config/json.seed
new file mode 100644
index 000000000..3f248defa
--- /dev/null
+++ b/tests/fuzz/corpus/config/json.seed
@@ -0,0 +1,6 @@
+j{
+  "mcpServers": {
+    "other": {"command": "other"}
+  },
+  "theme": "dark"
+}
diff --git a/tests/fuzz/corpus/config/toml.seed b/tests/fuzz/corpus/config/toml.seed
new file mode 100644
index 000000000..2d8091a08
--- /dev/null
+++ b/tests/fuzz/corpus/config/toml.seed
@@ -0,0 +1,6 @@
+t[mcp_servers.other]
+command = "other"
+
+# BEGIN codebase-memory
+old = true
+# END codebase-memory
diff --git a/tests/fuzz/corpus/config/yaml.seed b/tests/fuzz/corpus/config/yaml.seed
new file mode 100644
index 000000000..105cc400c
--- /dev/null
+++ b/tests/fuzz/corpus/config/yaml.seed
@@ -0,0 +1,5 @@
+ymcp_servers:
+  other:
+    command: other
+  codebase-memory:
+    command: old
diff --git a/tests/fuzz/corpus/cypher/agg.seed b/tests/fuzz/corpus/cypher/agg.seed
new file mode 100644
index 000000000..1e0fdd6c7
--- /dev/null
+++ b/tests/fuzz/corpus/cypher/agg.seed
@@ -0,0 +1 @@
+MATCH (m:Module)<-[:DEFINES]-(f:File) WITH m, count(f) AS c WHERE c > 2 RETURN m.name, c ORDER BY c DESC LIMIT 10
\ No newline at end of file
diff --git a/tests/fuzz/corpus/cypher/hops.seed b/tests/fuzz/corpus/cypher/hops.seed
new file mode 100644
index 000000000..43388715e
--- /dev/null
+++ b/tests/fuzz/corpus/cypher/hops.seed
@@ -0,0 +1 @@
+MATCH p = (a:Class)-[:INHERITS*1..3]->(b:Class) RETURN a.name, length(p)
\ No newline at end of file
diff --git a/tests/fuzz/corpus/cypher/match.seed b/tests/fuzz/corpus/cypher/match.seed
new file mode 100644
index 000000000..e0f1e4080
--- /dev/null
+++ b/tests/fuzz/corpus/cypher/match.seed
@@ -0,0 +1 @@
+MATCH (n:Function) RETURN n.name LIMIT 5
\ No newline at end of file
diff --git a/tests/fuzz/corpus/cypher/optional.seed b/tests/fuzz/corpus/cypher/optional.seed
new file mode 100644
index 000000000..caddb1ba4
--- /dev/null
+++ b/tests/fuzz/corpus/cypher/optional.seed
@@ -0,0 +1 @@
+MATCH (f:Function) OPTIONAL MATCH (f)-[:CALLS]->(g) RETURN f.name, collect(g.name)
\ No newline at end of file
diff --git a/tests/fuzz/corpus/cypher/union.seed b/tests/fuzz/corpus/cypher/union.seed
new file mode 100644
index 000000000..00c528587
--- /dev/null
+++ b/tests/fuzz/corpus/cypher/union.seed
@@ -0,0 +1 @@
+MATCH (n:Function) RETURN n.name AS name UNION MATCH (n:Method) RETURN n.name AS name
\ No newline at end of file
diff --git a/tests/fuzz/corpus/cypher/where.seed b/tests/fuzz/corpus/cypher/where.seed
new file mode 100644
index 000000000..560d106c3
--- /dev/null
+++ b/tests/fuzz/corpus/cypher/where.seed
@@ -0,0 +1 @@
+MATCH (f:Function)-[:CALLS]->(g:Function) WHERE f.name = 'main' AND g.file_path CONTAINS 'src' RETURN g.name, g.file_path ORDER BY g.name
\ No newline at end of file
diff --git a/tests/fuzz/corpus/extract/c.seed b/tests/fuzz/corpus/extract/c.seed
new file mode 100644
index 000000000..992cc4c3f
--- /dev/null
+++ b/tests/fuzz/corpus/extract/c.seed
@@ -0,0 +1,11 @@
+store.c
+#include <stdlib.h>
+#include "store.h"
+
+struct store { int n; char *buf; };
+
+struct store *store_new(int n) {
+    struct store *s = malloc(sizeof(*s));
+    s->n = n;
+    return s;
+}
diff --git a/tests/fuzz/corpus/extract/cpp.seed b/tests/fuzz/corpus/extract/cpp.seed
new file mode 100644
index 000000000..d8cd0d401
--- /dev/null
+++ b/tests/fuzz/corpus/extract/cpp.seed
@@ -0,0 +1,10 @@
+graph.cpp
+#include <vector>
+namespace g {
+template <typename T> class Graph {
+public:
+  void add(T v) { nodes_.push_back(v); }
+private:
+  std::vector<T> nodes_;
+};
+}
diff --git a/tests/fuzz/corpus/extract/csharp.seed b/tests/fuzz/corpus/extract/csharp.seed
new file mode 100644
index 000000000..31dd6b231
--- /dev/null
+++ b/tests/fuzz/corpus/extract/csharp.seed
@@ -0,0 +1,6 @@
+Program.cs
+using System;
+namespace App {
+  public interface IRepo { string Get(int id); }
+  public class Repo : IRepo { public string Get(int id) => id.ToString(); }
+}
diff --git a/tests/fuzz/corpus/extract/go.seed b/tests/fuzz/corpus/extract/go.seed
new file mode 100644
index 000000000..51cc74b67
--- /dev/null
+++ b/tests/fuzz/corpus/extract/go.seed
@@ -0,0 +1,13 @@
+main.go
+package main
+
+import "fmt"
+
+type Server struct{ name string }
+
+func (s *Server) Run() error {
+	fmt.Println(s.name)
+	return nil
+}
+
+func main() { (&Server{name: "x"}).Run() }
diff --git a/tests/fuzz/corpus/extract/java.seed b/tests/fuzz/corpus/extract/java.seed
new file mode 100644
index 000000000..f12986812
--- /dev/null
+++ b/tests/fuzz/corpus/extract/java.seed
@@ -0,0 +1,9 @@
+Main.java
+package app;
+
+import java.util.List;
+
+public class Main {
+  interface Repo { List<String> all(); }
+  public static void main(String[] args) { System.out.println(args.length); }
+}
diff --git a/tests/fuzz/corpus/extract/javascript.seed b/tests/fuzz/corpus/extract/javascript.seed
new file mode 100644
index 000000000..c5ecbd417
--- /dev/null
+++ b/tests/fuzz/corpus/extract/javascript.seed
@@ -0,0 +1,4 @@
+index.js
+const http = require('http');
+function handler(req, res) { res.end(req.url); }
+module.exports = () => http.createServer(handler).listen(8080);
diff --git a/tests/fuzz/corpus/extract/makefile.seed b/tests/fuzz/corpus/extract/makefile.seed
new file mode 100644
index 000000000..91c16d0dc
--- /dev/null
+++ b/tests/fuzz/corpus/extract/makefile.seed
@@ -0,0 +1,5 @@
+Makefile
+CC ?= cc
+all: app
+app: main.o
+	$(CC) -o $@ $^
diff --git a/tests/fuzz/corpus/extract/php.seed b/tests/fuzz/corpus/extract/php.seed
new file mode 100644
index 000000000..ac1c6be72
--- /dev/null
+++ b/tests/fuzz/corpus/extract/php.seed
@@ -0,0 +1,7 @@
+index.php
+<?php
+namespace App;
+
+class Controller {
+    public function show(int $id): string { return (string) $id; }
+}
diff --git a/tests/fuzz/corpus/extract/python.seed b/tests/fuzz/corpus/extract/python.seed
new file mode 100644
index 000000000..8f3922ebe
--- /dev/null
+++ b/tests/fuzz/corpus/extract/python.seed
@@ -0,0 +1,13 @@
+app.py
+import os
+
+class Store:
+    def __init__(self, path):
+        self.path = path
+
+    def load(self):
+        with open(self.path) as fh:
+            return fh.read()
+
+def main():
+    print(Store(os.getcwd()).load())
diff --git a/tests/fuzz/corpus/extract/ruby.seed b/tests/fuzz/corpus/extract/ruby.seed
new file mode 100644
index 000000000..1eb3cf203
--- /dev/null
+++ b/tests/fuzz/corpus/extract/ruby.seed
@@ -0,0 +1,7 @@
+app.rb
+module App
+  class Store
+    def initialize(path) = @path = path
+    def load = File.read(@path)
+  end
+end
diff --git a/tests/fuzz/corpus/extract/rust.seed b/tests/fuzz/corpus/extract/rust.seed
new file mode 100644
index 000000000..4f754670a
--- /dev/null
+++ b/tests/fuzz/corpus/extract/rust.seed
@@ -0,0 +1,10 @@
+lib.rs
+use std::collections::HashMap;
+
+pub trait Store { fn get(&self, k: &str) -> Option<&String>; }
+
+pub struct Mem { m: HashMap<String, String> }
+
+impl Store for Mem {
+    fn get(&self, k: &str) -> Option<&String> { self.m.get(k) }
+}
diff --git a/tests/fuzz/corpus/extract/sql.seed b/tests/fuzz/corpus/extract/sql.seed
new file mode 100644
index 000000000..3b5208fcd
--- /dev/null
+++ b/tests/fuzz/corpus/extract/sql.seed
@@ -0,0 +1,3 @@
+schema.sql
+CREATE TABLE nodes (id INTEGER PRIMARY KEY, name TEXT NOT NULL);
+SELECT name FROM nodes WHERE id = 1;
diff --git a/tests/fuzz/corpus/extract/typescript.seed b/tests/fuzz/corpus/extract/typescript.seed
new file mode 100644
index 000000000..a57b5d35a
--- /dev/null
+++ b/tests/fuzz/corpus/extract/typescript.seed
@@ -0,0 +1,9 @@
+svc.ts
+import { readFile } from 'fs/promises';
+
+export interface Repo { get(id: string): Promise<string>; }
+
+export class FileRepo implements Repo {
+  constructor(private dir: string) {}
+  async get(id: string) { return readFile(`${this.dir}/${id}`, 'utf8'); }
+}
diff --git a/tests/fuzz/corpus/extract/yaml.seed b/tests/fuzz/corpus/extract/yaml.seed
new file mode 100644
index 000000000..06a2881d2
--- /dev/null
+++ b/tests/fuzz/corpus/extract/yaml.seed
@@ -0,0 +1,7 @@
+deploy.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web
+spec:
+  replicas: 2
diff --git a/tests/test_activation_diagnostic_contract.sh b/tests/test_activation_diagnostic_contract.sh
new file mode 100644
index 000000000..ebc4f0f81
--- /dev/null
+++ b/tests/test_activation_diagnostic_contract.sh
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# Activation-refusal diagnostics must never point at evidence they do not show.
+#
+# #1416 and #1537 both landed because a refusal printed generic text and told
+# the reader to "check the errors above" when nothing was above. The fix was
+# cli_activation_diagnostic(): it appends the transaction refusal note, or
+# cbm_daemon_ipc_validation_detail(), so the message names the check that
+# actually refused.
+#
+# #1856 showed the fix was incomplete in the way that matters: the property was
+# repaired on the paths that had tests and left broken on a sibling call site
+# that had none. cli_activation_production_context_init() -- the emitter that
+# validates the cache, rendezvous and log directories, i.e. the one MOST likely
+# to hold a useful detail -- printed the constant bare. A reporter with a full
+# ProcMon trace still could not tell which check refused, because the binary
+# discarded the answer before printing.
+#
+# So the guard here is the CLASS, not the one call site: every emitter of the
+# refusal constants goes through the attributing helper. A future emitter that
+# bypasses it fails this test instead of reaching a reporter.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+python3 - "$ROOT" <<'PY'
+from __future__ import annotations
+
+import pathlib
+import re
+import sys
+
+root = pathlib.Path(sys.argv[1])
+failures: list[str] = []
+
+
+def require(condition: bool, message: str) -> None:
+    if not condition:
+        failures.append(message)
+
+
+cli = (root / "src" / "cli" / "cli.c").read_text(encoding="utf-8")
+
+# 1. Every call that passes a refusal constant to a diagnostic sink must use the
+#    attributing helper. cli_activation_production_diagnostic is the raw sink --
+#    legitimate as an ops->visible_diagnostic member (it receives the ALREADY
+#    attributed string), never as a direct emitter of the constant.
+ATTRIBUTING = "cli_activation_diagnostic"
+CONSTANTS = ("CLI_ACTIVATION_REFUSED_MESSAGE", "CLI_ACTIVATION_BUSY_MESSAGE")
+
+for call in re.finditer(r"(\w*diagnostic)\s*\(([^;]*?)\)\s*;", cli, re.S):
+    callee, arguments = call.group(1), call.group(2)
+    if not any(constant in arguments for constant in CONSTANTS):
+        continue
+    if callee == ATTRIBUTING:
+        continue
+    line = cli.count("\n", 0, call.start()) + 1
+    require(
+        False,
+        f"src/cli/cli.c:{line}: {callee}() emits a refusal constant directly. "
+        f"Route it through {ATTRIBUTING}() so the message names the check that "
+        "refused instead of pointing at errors that were never printed (#1856)",
+    )
+
+# 2. The helper must still be the one that appends both attribution channels --
+#    deleting either turns the message back into a dead end.
+helper = re.search(
+    r"static void cli_activation_diagnostic\((?:.|\n)*?\n\}\n", cli
+)
+require(helper is not None, "cli_activation_diagnostic() not found in src/cli/cli.c")
+body = helper.group(0) if helper else ""
+require(
+    "cbm_activation_transaction_refusal_note()" in body,
+    "cli_activation_diagnostic() must append the transaction refusal note (#1416)",
+)
+require(
+    "cbm_daemon_ipc_validation_detail()" in body,
+    "cli_activation_diagnostic() must append the daemon validation detail (#1537)",
+)
+
+# 3. The remedy must be one that works. `icacls /remove:g` silently does nothing
+#    to an INHERITED ACE -- and the stock C:\ grant for Authenticated Users
+#    reaches every new child directory exactly that way, which is the shape
+#    #1856 was reported against. Advice that cannot fix the reported case is
+#    worse than none: the command succeeds and the refusal persists.
+require(
+    "/inheritance:r" in body,
+    "the refusal remedy must name icacls /inheritance:r for an inherited grant "
+    "-- /remove:g cannot remove one, so the advice fails on the stock C:\\ ACE "
+    "that #1856 reported",
+)
+
+# 4. And the refusal itself must say which of the two shapes it hit, or the
+#    reader cannot choose between those commands.
+transaction = (root / "src" / "cli" / "activation_transaction.c").read_text(encoding="utf-8")
+require(
+    re.search(r"AceFlags\s*&\s*INHERITED_ACE", transaction) is not None,
+    "src/cli/activation_transaction.c must report whether the refusing ACE was "
+    "inherited, so the printed remedy matches the grant (#1856)",
+)
+
+if failures:
+    print("Activation diagnostic contract FAILED:")
+    for failure in failures:
+        print(f"  - {failure}")
+    sys.exit(1)
+
+print("Activation diagnostic contract passed")
+PY
diff --git a/tests/test_agent_clients.c b/tests/test_agent_clients.c
index 59d48b320..179cdde11 100644
--- a/tests/test_agent_clients.c
+++ b/tests/test_agent_clients.c
@@ -1174,8 +1174,13 @@ TEST(client_adapter_pi_emits_parameters_and_execute) {
     ASSERT_NOT_NULL(strstr(js, "result.content"));
     ASSERT_NULL(strstr(js, "run: (args, ctx)"));
     ASSERT_NOT_NULL(strstr(js, "parameters:"));
-    /* The registry input_schema is embedded as a JSON object literal. */
-    ASSERT_NOT_NULL(strstr(js, "\"type\":\"object\""));
+    /* TypeBox parameters schema is embedded with Type.Object syntax. */
+    ASSERT_NOT_NULL(strstr(js, "Type.Object("));
+    ASSERT_NOT_NULL(strstr(js, "Type.String("));
+    /* A numeric registry property must remain numeric in the generated schema. */
+    ASSERT_NOT_NULL(strstr(js, "depth: Type.Optional(Type.Integer("));
+    /* TypeBox import should be present. */
+    ASSERT_NOT_NULL(strstr(js, "import { Type } from 'typebox';"));
     /* Raw JSON output is required so the bridge can parse the MCP result; the
      * human-readable path would leave `call` with nothing to JSON.parse. */
     ASSERT_NOT_NULL(strstr(js, "'cli', '--json'"));
diff --git a/tests/test_arena.c b/tests/test_arena.c
index 788c1eb9c..eb91fa4ce 100644
--- a/tests/test_arena.c
+++ b/tests/test_arena.c
@@ -5,6 +5,47 @@
 #include "../src/foundation/arena.h"
 #include <stdint.h>
 
+TEST(arena_init_exact_one_block_then_append_block_growth) {
+    CBMArena a;
+    cbm_arena_init_exact(&a, 100);
+    ASSERT_EQ(a.nblocks, 1);
+    ASSERT_EQ(a.block_sizes[0], 104); /* rounded to the 8-byte allocation grain */
+    ASSERT_EQ(a.grow_size, CBM_ARENA_APPEND_BLOCK);
+    void *p = cbm_arena_alloc(&a, 100);
+    ASSERT_NOT_NULL(p);
+    ASSERT_EQ(a.used, 104);
+    ASSERT_EQ(a.nblocks, 1); /* the exact block is full, nothing wasted */
+    void *q = cbm_arena_alloc(&a, 8);
+    ASSERT_NOT_NULL(q);
+    ASSERT_EQ(a.nblocks, 2);
+    /* An append takes a small block, not 2 x 104 and not the 64 KB default:
+     * the appended-to result arenas are the worker's peak. */
+    ASSERT_EQ(a.block_sizes[1], CBM_ARENA_APPEND_BLOCK);
+    ASSERT_EQ(a.grow_size, 2 * CBM_ARENA_APPEND_BLOCK);
+    cbm_arena_destroy(&a);
+    PASS();
+}
+
+TEST(arena_growth_doubles_grow_size_and_reset_restores_it) {
+    CBMArena a;
+    cbm_arena_init_sized(&a, 64);
+    ASSERT_EQ(a.grow_size, 128);
+    ASSERT_NOT_NULL(cbm_arena_alloc(&a, 64));
+    ASSERT_NOT_NULL(cbm_arena_alloc(&a, 8)); /* -> block 128 */
+    ASSERT_EQ(a.nblocks, 2);
+    ASSERT_EQ(a.block_sizes[1], 128);
+    ASSERT_EQ(a.grow_size, 256);
+    ASSERT_NOT_NULL(cbm_arena_alloc(&a, 1000)); /* larger than grow_size: exact */
+    ASSERT_EQ(a.nblocks, 3);
+    ASSERT_EQ(a.block_sizes[2], 1000);
+    ASSERT_EQ(a.grow_size, 2000);
+    cbm_arena_reset(&a);
+    ASSERT_EQ(a.nblocks, 1);
+    ASSERT_EQ(a.grow_size, 128);
+    cbm_arena_destroy(&a);
+    PASS();
+}
+
 TEST(arena_init_default) {
     CBMArena a;
     cbm_arena_init(&a);
@@ -427,7 +468,45 @@ TEST(arena_strndup_zero_len) {
     PASS();
 }
 
+/* A lazy arena holds nothing until its first allocation, which opens exactly
+ * the configured block; growth then doubles as usual, and destroying it closes
+ * it again (an allocation after destroy is refused, never a silent reopen). */
+TEST(arena_lazy_opens_on_first_alloc_only) {
+    CBMArena a;
+    cbm_arena_init_lazy(&a, 4096);
+    ASSERT_EQ(a.nblocks, 0);
+    ASSERT_EQ(cbm_arena_capacity(&a), 0);
+    cbm_arena_rewind(&a); /* safe on a lazy arena that never opened */
+
+    void *p = cbm_arena_alloc(&a, 100);
+    ASSERT_NOT_NULL(p);
+    ASSERT_EQ(a.nblocks, 1);
+    ASSERT_EQ(a.block_sizes[0], 4096);
+    ASSERT_EQ(a.used, 104);
+    ASSERT_EQ(a.waste_grows, 0); /* the opening block is not a growth */
+
+    void *q = cbm_arena_alloc(&a, 4000); /* does not fit the rest: one doubled block */
+    ASSERT_NOT_NULL(q);
+    ASSERT_EQ(a.nblocks, 2);
+    ASSERT_EQ(a.block_sizes[1], 8192);
+
+    cbm_arena_destroy(&a);
+    ASSERT_EQ(a.nblocks, 0);
+    ASSERT_NULL(cbm_arena_alloc(&a, 16));
+
+    /* An opening allocation larger than the configured block gets a block that fits. */
+    cbm_arena_init_lazy(&a, 4096);
+    void *big = cbm_arena_alloc(&a, 10000);
+    ASSERT_NOT_NULL(big);
+    ASSERT_EQ(a.nblocks, 1);
+    ASSERT_GTE(a.block_sizes[0], 10000);
+    cbm_arena_destroy(&a);
+    PASS();
+}
+
 SUITE(arena) {
+    RUN_TEST(arena_init_exact_one_block_then_append_block_growth);
+    RUN_TEST(arena_growth_doubles_grow_size_and_reset_restores_it);
     RUN_TEST(arena_init_default);
     RUN_TEST(arena_init_sized);
     RUN_TEST(arena_alloc_basic);
@@ -460,4 +539,5 @@ SUITE(arena) {
     RUN_TEST(arena_total_through_reset);
     RUN_TEST(arena_reset_block_size_invariant);
     RUN_TEST(arena_strndup_zero_len);
+    RUN_TEST(arena_lazy_opens_on_first_alloc_only);
 }
diff --git a/tests/test_c_lsp.c b/tests/test_c_lsp.c
index 0ba216ce0..4172fcc7f 100644
--- a/tests/test_c_lsp.c
+++ b/tests/test_c_lsp.c
@@ -15250,6 +15250,167 @@ TEST(clsp_tier2_shared_registry_readonly_c) {
     PASS();
 }
 
+/* The method-return refinement in the C++ class walk used to cast the chained
+ * lookup result and write a scratch-arena signature into it. With the entry in
+ * the sealed shared base, every other worker read that signature after the
+ * arena of this file had died (ASan heap-use-after-free in c_adl_resolve on
+ * dotnet/runtime, 2026-09-14). Contract: the refinement is copy-on-write into
+ * the overlay; the base signature pointer never changes. min_params = 7 is a
+ * marker only a COPY of the base entry carries (a fresh registration sets -1),
+ * so the assertion proves the upgrade path ran, not a re-registration. */
+TEST(clsp_method_return_refinement_is_copy_on_write) {
+    CBMArena arena;
+    cbm_arena_init(&arena);
+    CBMTypeRegistry base;
+    cbm_registry_init(&base, &arena);
+    const CBMType *rets[2] = {cbm_type_named(&arena, "test.mod.Item"), NULL};
+    CBMRegisteredFunc f;
+    memset(&f, 0, sizeof(f));
+    f.qualified_name = "test.mod.Box.items";
+    f.short_name = "items";
+    f.receiver_type = "test.mod.Box";
+    f.signature = cbm_type_func(&arena, NULL, NULL, rets);
+    f.min_params = 7;
+    cbm_registry_add_func(&base, f);
+    cbm_registry_finalize(&base);
+    base.read_only = true;
+    const CBMRegisteredFunc *base_entry = cbm_registry_lookup_func(&base, "test.mod.Box.items");
+    ASSERT_NOT_NULL(base_entry);
+    const CBMType *base_sig = base_entry->signature;
+    ASSERT_EQ(base_sig->data.func.return_types[0]->kind, CBM_TYPE_NAMED);
+
+    CBMArena scratch;
+    cbm_arena_init(&scratch);
+    CBMTypeRegistry overlay;
+    cbm_registry_init(&overlay, &scratch);
+    overlay.fallback = &base;
+    /* The in-class declaration refines the NAMED return to a POINTER. */
+    const char *src = "struct Item { int v; };\n"
+                      "struct Box {\n"
+                      "    Item *items();\n"
+                      "};\n";
+    CBMResolvedCallArray out = {0};
+    cbm_run_c_lsp_cross_with_registry(&scratch, src, (int)strlen(src), "test.mod",
+                                      /*cpp_mode=*/true, &overlay, NULL, NULL, 0, NULL, &out);
+
+    ASSERT(base_entry->signature == base_sig);
+    ASSERT_EQ(base_sig->data.func.return_types[0]->kind, CBM_TYPE_NAMED);
+    const CBMRegisteredFunc *refined = cbm_registry_lookup_func(&overlay, "test.mod.Box.items");
+    ASSERT_NOT_NULL(refined);
+    ASSERT(refined >= overlay.funcs && refined < overlay.funcs + overlay.func_count);
+    ASSERT_EQ(refined->min_params, 7);
+    ASSERT_EQ(refined->signature->data.func.return_types[0]->kind, CBM_TYPE_POINTER);
+    cbm_arena_destroy(&scratch);
+    cbm_arena_destroy(&arena);
+    PASS();
+}
+
+/* The per-file overlay contract (type_registry.c chain API): a walk is handed
+ * an overlay chained to a sealed base. Lookups and iterators see the base
+ * through the overlay, every yielded index belongs to it.reg, a refinement is
+ * copy-on-write into the overlay (the base never changes), and an overlay copy
+ * shadows its base original in chained iteration. */
+TEST(registry_overlay_chain_iterates_and_copies_on_write) {
+    CBMArena arena;
+    cbm_arena_init(&arena);
+    CBMTypeRegistry base;
+    cbm_registry_init(&base, &arena);
+    CBMRegisteredFunc f;
+    memset(&f, 0, sizeof(f));
+    f.qualified_name = "pkg.alpha";
+    f.short_name = "alpha";
+    f.min_params = -1;
+    cbm_registry_add_func(&base, f);
+    f.qualified_name = "pkg.beta";
+    f.short_name = "beta";
+    cbm_registry_add_func(&base, f);
+    CBMRegisteredType t;
+    memset(&t, 0, sizeof(t));
+    t.qualified_name = "pkg.T";
+    t.short_name = "T";
+    cbm_registry_add_type(&base, t);
+    cbm_registry_finalize(&base);
+    base.read_only = true;
+
+    CBMArena scratch;
+    cbm_arena_init(&scratch);
+    CBMTypeRegistry overlay;
+    cbm_registry_init(&overlay, &scratch);
+    overlay.fallback = &base;
+
+    /* Lookups chain through the empty overlay. */
+    ASSERT_NOT_NULL(cbm_registry_lookup_func(&overlay, "pkg.alpha"));
+    ASSERT_NOT_NULL(cbm_registry_lookup_type(&overlay, "pkg.T"));
+
+    /* Chained iteration reaches the base; it.reg names where the index lives. */
+    CBMFreeFuncIter it;
+    cbm_registry_free_funcs_by_short_name_chain(&overlay, "alpha", &it);
+    int i = cbm_free_func_iter_next(&it);
+    ASSERT(i >= 0);
+    ASSERT(it.reg == &base);
+    ASSERT(strcmp(it.reg->funcs[i].qualified_name, "pkg.alpha") == 0);
+    ASSERT_EQ(cbm_free_func_iter_next(&it), -1);
+    /* The plain iterator on the overlay alone sees nothing -- unchanged. */
+    cbm_registry_free_funcs_by_short_name(&overlay, "alpha", &it);
+    ASSERT_EQ(cbm_free_func_iter_next(&it), -1);
+
+    /* Copy-on-write: the refinement lands in the overlay, the base is untouched,
+     * and chained lookup now returns the refined copy. */
+    CBMRegisteredFunc *w = cbm_registry_func_for_update(&overlay, "pkg.alpha");
+    ASSERT_NOT_NULL(w);
+    ASSERT(w >= overlay.funcs && w < overlay.funcs + overlay.func_count);
+    w->min_params = 2;
+    ASSERT_EQ(base.funcs[0].min_params, -1);
+    ASSERT_EQ(cbm_registry_lookup_func(&overlay, "pkg.alpha")->min_params, 2);
+    ASSERT(cbm_registry_func_for_update(&overlay, "pkg.alpha") ==
+           w); /* own entry, no second copy */
+    ASSERT_EQ(overlay.func_count, 1);
+
+    /* The base original is shadowed: chained iteration yields exactly one alpha,
+     * from the overlay. */
+    cbm_registry_free_funcs_by_short_name_chain(&overlay, "alpha", &it);
+    int seen = 0;
+    while (cbm_free_func_iter_next(&it) >= 0) {
+        ASSERT(it.reg == &overlay);
+        seen++;
+    }
+    ASSERT_EQ(seen, 1);
+    /* Linear chain over everything: alpha (overlay copy) + beta (base). */
+    cbm_registry_all_funcs_chain(&overlay, &it);
+    seen = 0;
+    while (cbm_free_func_iter_next(&it) >= 0) {
+        seen++;
+    }
+    ASSERT_EQ(seen, 2);
+
+    /* Types: same contract. */
+    CBMTypeShortIter ti;
+    cbm_registry_types_by_short_name_chain(&overlay, "T", &ti);
+    int k = cbm_type_short_iter_next(&ti);
+    ASSERT(k >= 0);
+    ASSERT(ti.reg == &base);
+    CBMRegisteredType *wt = cbm_registry_type_for_update(&overlay, "pkg.T");
+    ASSERT_NOT_NULL(wt);
+    ASSERT_EQ(overlay.type_count, 1);
+    cbm_registry_all_types_chain(&overlay, &ti);
+    seen = 0;
+    while (cbm_type_short_iter_next(&ti) >= 0) {
+        seen++;
+    }
+    ASSERT_EQ(seen, 1);
+
+    /* A sealed head refuses refinement; an unknown QN yields nothing. */
+    overlay.read_only = true;
+    ASSERT(cbm_registry_func_for_update(&overlay, "pkg.beta") == NULL);
+    overlay.read_only = false;
+    ASSERT(cbm_registry_func_for_update(&overlay, "pkg.nope") == NULL);
+    ASSERT_EQ(base.func_count, 2);
+
+    cbm_arena_destroy(&scratch);
+    cbm_arena_destroy(&arena);
+    PASS();
+}
+
 /* Direct guard for the type-name / embedded-type / free-function registry
  * indexes and their iterators (type_registry.c). Verifies that every iterator
  * preserves ascending registry order, which is part of resolver tie-breaking. */
@@ -16216,6 +16377,8 @@ SUITE(c_lsp) {
     RUN_TEST(clsp_tier2_shared_registry_readonly_c);
     RUN_TEST(clsp_tier2_shared_registry_readonly_cpp);
     RUN_TEST(seal_py_shared_registry_readonly);
+    RUN_TEST(registry_overlay_chain_iterates_and_copies_on_write);
+    RUN_TEST(clsp_method_return_refinement_is_copy_on_write);
     RUN_TEST(seal_py_shared_registry_readonly_fields);
     RUN_TEST(seal_cs_shared_registry_readonly);
     RUN_TEST(seal_ts_shared_registry_readonly);
diff --git a/tests/test_cli.c b/tests/test_cli.c
index 44259a63c..d56ff7c99 100644
--- a/tests/test_cli.c
+++ b/tests/test_cli.c
@@ -23,7 +23,9 @@
 #include <foundation/constants.h>
 #include <foundation/log.h>
 #include <foundation/platform.h>
+#include <foundation/sha256.h>
 #include <mcp/mcp.h>
+#include <mcp/index_supervisor.h>
 #include <pipeline/pipeline.h>
 #include <foundation/yaml.h>
 #include <store/store.h>
@@ -39,6 +41,8 @@
 #include <sys/socket.h>
 #include <sys/un.h>
 #include <sys/wait.h>
+#include <poll.h>
+#include <signal.h>
 #endif
 #ifdef __APPLE__
 #include <mach-o/dyld.h>
@@ -48,6 +52,12 @@
 #include <wchar.h> /* wcscmp/wcslen/swprintf for the Windows user-PATH test (#2117) */
 #include <zlib.h>
 
+/* Same guarded fallback every product TU carries; CI injects the real value
+ * through CFLAGS_EXTRA for product objects and test objects alike. */
+#ifndef CBM_VERSION
+#define CBM_VERSION "dev"
+#endif
+
 /* Internal prompt seam used to restore process-global state after command
  * tests that exercise --yes. */
 void cbm_set_auto_answer_for_test(int value);
@@ -723,6 +733,61 @@ static void test_rmdir_r(const char *path) {
     th_rmtree(path);
 }
 
+#ifndef _WIN32
+/* Capture everything a command writes to one fd (stdout or stderr) so a test
+ * can assert on the transcript. Restores the fd on end and returns the text. */
+typedef struct {
+    FILE *file;
+    FILE *stream;
+    int target_fd;
+    int saved_fd;
+    bool redirected;
+} cli_fd_capture_t;
+
+static void cli_fd_capture_begin(cli_fd_capture_t *capture, FILE *stream, int target_fd) {
+    memset(capture, 0, sizeof(*capture));
+    capture->stream = stream;
+    capture->target_fd = target_fd;
+    capture->saved_fd = -1;
+    capture->file = tmpfile();
+    if (!capture->file) {
+        return;
+    }
+    capture->saved_fd = dup(target_fd);
+    if (capture->saved_fd < 0) {
+        return;
+    }
+    fflush(stream);
+    capture->redirected = dup2(fileno(capture->file), target_fd) >= 0;
+}
+
+/* Returns the captured text (heap, "" when nothing was written) or NULL when
+ * the capture never engaged. */
+static char *cli_fd_capture_end(cli_fd_capture_t *capture) {
+    fflush(capture->stream);
+    if (capture->saved_fd >= 0) {
+        (void)dup2(capture->saved_fd, capture->target_fd);
+        close(capture->saved_fd);
+        capture->saved_fd = -1;
+    }
+    char *text = NULL;
+    if (capture->file) {
+        if (capture->redirected) {
+            rewind(capture->file);
+            size_t capacity = 65536U;
+            text = calloc(1U, capacity);
+            if (text) {
+                size_t count = fread(text, 1U, capacity - 1U, capture->file);
+                text[count] = '\0';
+            }
+        }
+        fclose(capture->file);
+        capture->file = NULL;
+    }
+    return text;
+}
+#endif /* !_WIN32 -- POSIX-only fd-capture helpers (#2110) */
+
 /* Mandatory-daemon activation guard fixture. The production path uses the
  * stable per-account endpoint directly; these callbacks make every race
  * ordering deterministic without exposing a CLI flag or environment bypass. */
@@ -1217,6 +1282,23 @@ TEST(cli_activation_quiesce_does_not_wait_on_bootstrap_startup) {
         test_rmdir_r(tmpdir);
         FAIL("runtime parent setup failed");
     }
+    /* The participant models the daemon of THIS namespace: its cohort
+     * identity carries the fingerprint of the cache the install below
+     * targets, derived as main.c derives it. A foreign cache would (rightly)
+     * be left alone by the scoped guard. */
+    char participant_cache[512];
+    char participant_cache_canonical[1024];
+    char participant_cache_fingerprint[CBM_SHA256_HEX_LEN + 1] = {0};
+    snprintf(participant_cache, sizeof(participant_cache), "%s/cache", tmpdir);
+    if (!cbm_mkdir_p(participant_cache, 0700) ||
+        !cbm_canonical_path(participant_cache, participant_cache_canonical,
+                            sizeof(participant_cache_canonical))) {
+        test_rmdir_r(tmpdir);
+        FAIL("participant cache setup failed");
+    }
+    cbm_normalize_path_sep(participant_cache_canonical);
+    cbm_sha256_hex(participant_cache_canonical, strlen(participant_cache_canonical),
+                   participant_cache_fingerprint);
     int ready_pipe[2] = {-1, -1};
     if (pipe(ready_pipe) != 0) {
         test_rmdir_r(tmpdir);
@@ -1232,7 +1314,7 @@ TEST(cli_activation_quiesce_does_not_wait_on_bootstrap_startup) {
         cbm_daemon_build_identity_t identity = {
             .semantic_version = "cli-activation-test",
             .build_fingerprint = fingerprint,
-            .cache_fingerprint = "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+            .cache_fingerprint = participant_cache_fingerprint,
             .protocol_abi = CBM_DAEMON_RUNTIME_WIRE_ABI,
             .store_abi = 1,
             .feature_abi = 1,
@@ -1468,6 +1550,492 @@ TEST(cli_install_recovers_markerless_stale_rendezvous) {
     ASSERT_TRUE(anchor_removed);
     PASS();
 }
+/* ── Activation-guard namespace scope (2026-09-08) ──────────────────
+ * The rendezvous directory is per OS ACCOUNT, never per HOME (service.h):
+ * every daemon of one user meets at one endpoint, and the cohort identity's
+ * cache fingerprint is what separates one HOME / CBM_CACHE_DIR namespace
+ * from another. An `install` into a second HOME (a sandbox, a second
+ * profile) therefore reaches the LIVE host daemon at the shared endpoint —
+ * and used to drain it, disconnecting every MCP client, although nothing
+ * that install touched belonged to the host namespace.
+ *
+ * The fixture models the host the way host.c builds it: a forked process
+ * that admits itself to the cohort with the host cache fingerprint, runs a
+ * real runtime service at the shared endpoint, and exits (releasing the
+ * cohort lease LAST, the real teardown order) once that service has been
+ * drained. The parent keeps one committed client connected to it across the
+ * install under test and asks the daemon itself afterwards. */
+#define CLI_SCOPE_HOST_DRAINED 3
+#define CLI_SCOPE_TIMEOUT_MS 5000U
+/* Generous, BOUNDED waits so a wedged host child (a fork-time sanitizer
+ * allocator stall is the classic cause — see the posix_spawn fix history)
+ * fails the test cleanly instead of hanging the whole suite to the CI
+ * wall-clock kill. Each comfortably exceeds the child's own 45 s cohort
+ * admission deadline plus a multi-second service start/teardown, so none trips
+ * for a merely slow-but-healthy runner; they only convert an otherwise
+ * unbounded hang into a deterministic pass/fail. */
+#define CLI_SCOPE_READY_TIMEOUT_MS 90000U
+#define CLI_SCOPE_HOST_REAP_TIMEOUT_MS 60000U
+#define CLI_SCOPE_HOST_SERVING_TIMEOUT_MS 15000U
+/* Teardown budget for a child the activation ALREADY drained: its service is
+ * gone, so each free/release succeeds immediately and this is only the
+ * give-up point if one unexpectedly does not. The undrained path keeps the
+ * full 2 x CLI_SCOPE_TIMEOUT_MS, which is where a wedged teardown is real. */
+#define CLI_SCOPE_CLEANUP_DRAINED_MS 1000U
+/* Budget for probing that an ALREADY-drained host has stopped serving.
+ *
+ * The generous CLI_SCOPE_HOST_SERVING_TIMEOUT_MS exists for the POSITIVE
+ * question -- "is this daemon still up?" -- where a slow reply on a loaded
+ * runner must not be misread as drained. Asked in the negative it inverts:
+ * there is no reply coming, so the whole budget is spent proving silence, and
+ * the assertion is decided by a timeout expiring rather than by the system's
+ * own behaviour. That was 15 s of the drain test's wall clock and the largest
+ * single idle block in the cli suite.
+ *
+ * The drain is proven POSITIVELY elsewhere in that test: install returns 0
+ * only after the activation completed, and the host child exits with
+ * CLI_SCOPE_HOST_DRAINED. By the time this probe runs the daemon is already
+ * gone, so a short budget confirms the same fact a long one would -- it just
+ * stops charging the suite for the wait. */
+#define CLI_SCOPE_HOST_DRAINED_PROBE_MS 2000U
+
+typedef struct {
+    char tmpdir[256];
+    char runtime_parent[512];
+    char host_home[512];
+    char host_cache[512];
+    char host_cache_fingerprint[CBM_SHA256_HEX_LEN + 1];
+    char self_build[CBM_DAEMON_BUILD_FINGERPRINT_SIZE];
+    char previous_supervisor_build[CBM_DAEMON_BUILD_FINGERPRINT_SIZE];
+    char conflict_log[640];
+    cbm_daemon_build_identity_t identity;
+    cbm_daemon_ipc_endpoint_t *endpoint;
+    cbm_daemon_runtime_client_t *client;
+    pid_t host;
+    int release_fd;
+    char *old_home;
+    char *old_cache;
+    char *old_shell;
+} cli_scope_fixture_t;
+
+static _Noreturn void cli_scope_host_child(const cli_scope_fixture_t *fixture, int ready_fd,
+                                           int release_fd) {
+    cbm_daemon_ipc_endpoint_t *endpoint =
+        cbm_daemon_bootstrap_endpoint_new(fixture->runtime_parent);
+    cbm_version_cohort_manager_t *manager =
+        endpoint ? cbm_version_cohort_manager_new(endpoint) : NULL;
+    cbm_version_cohort_lease_t *lease = NULL;
+    cbm_daemon_conflict_t conflict;
+    cbm_daemon_runtime_service_t *service = NULL;
+    bool admitted = endpoint && manager &&
+                    cbm_version_cohort_acquire(manager, &fixture->identity, cbm_now_ms() + 45000U,
+                                               &lease, &conflict) == CBM_VERSION_COHORT_OK;
+    if (admitted) {
+        cbm_daemon_runtime_service_config_t config = {
+            .endpoint = endpoint,
+            .identity = fixture->identity,
+            .conflict_log_path = fixture->conflict_log,
+            .conflict_log_cap_bytes = 64U * 1024U,
+            .max_clients = 8,
+            .lease_timeout_ms = CLI_SCOPE_TIMEOUT_MS,
+            .request_timeout_ms = CLI_SCOPE_TIMEOUT_MS,
+            .shutdown_timeout_ms = CLI_SCOPE_TIMEOUT_MS,
+            /* Born permanent: only a drain/stop ends it, never the parent's
+             * client leaving, so "still alive" is a statement about the
+             * drain alone. */
+            .permanent = true,
+        };
+        service = cbm_daemon_runtime_service_start(&config);
+    }
+    bool ready_ok =
+        service && cbm_daemon_runtime_service_state(service) == CBM_DAEMON_RUNTIME_SERVICE_RUNNING;
+    char ready = ready_ok ? 'R' : 'E';
+    (void)write(ready_fd, &ready, 1);
+    close(ready_fd);
+    bool drained = false;
+    uint64_t deadline = cbm_now_ms() + 120000U;
+    while (ready_ok && cbm_now_ms() < deadline) {
+        if (cbm_daemon_runtime_service_wait_exited(service, 50U)) {
+            drained = true;
+            break;
+        }
+        struct pollfd release_poll = {.fd = release_fd, .events = POLLIN, .revents = 0};
+        if (poll(&release_poll, 1, 0) > 0) {
+            break;
+        }
+    }
+    /* A DRAINED child has already had its service torn down by the activation,
+     * so every teardown below succeeds on the first attempt; the long deadline
+     * exists for the wedged case, where we keep retrying before giving up. On
+     * the drained path that budget was pure wall clock -- the parent sits in
+     * cli_scope_reap_host waiting for this exit, and it was the single largest
+     * idle block in the whole cli suite. Behaviour at the deadline is
+     * unchanged (give up and _exit); it is simply reached sooner when there is
+     * nothing wedged to wait for. */
+    uint64_t cleanup_deadline =
+        cbm_now_ms() + (drained ? CLI_SCOPE_CLEANUP_DRAINED_MS : 2U * CLI_SCOPE_TIMEOUT_MS);
+    if (service) {
+        if (!drained) {
+            (void)cbm_daemon_runtime_service_stop(service, CLI_SCOPE_TIMEOUT_MS);
+        }
+        while (!cbm_daemon_runtime_service_free(service) && cbm_now_ms() < cleanup_deadline) {
+            cbm_usleep(1000);
+        }
+    }
+    while (lease && cbm_version_cohort_lease_release(&lease) != CBM_PRIVATE_FILE_LOCK_OK &&
+           cbm_now_ms() < cleanup_deadline) {
+        cbm_usleep(1000);
+    }
+    while (manager && cbm_version_cohort_manager_free(&manager) != CBM_PRIVATE_FILE_LOCK_OK &&
+           cbm_now_ms() < cleanup_deadline) {
+        cbm_usleep(1000);
+    }
+    cbm_daemon_ipc_endpoint_free(endpoint);
+    close(release_fd);
+    _exit(!ready_ok ? 1 : drained ? CLI_SCOPE_HOST_DRAINED : 0);
+}
+
+/* Bounded read of the host child's one-byte readiness signal. A child that
+ * deadlocks before it can write (a fork-time allocator stall under a sanitizer
+ * is the classic cause) must never hang the whole suite on an unbounded read:
+ * poll to a generous deadline, then let the caller's ASSERT_TRUE(ready) fail
+ * cleanly. Returns the byte, or 0 when the child died, closed the pipe, or
+ * never answered in time. */
+static char cli_scope_wait_ready(int fd, uint32_t timeout_ms) {
+    uint64_t deadline = cbm_now_ms() + timeout_ms;
+    for (;;) {
+        int64_t remaining = (int64_t)deadline - (int64_t)cbm_now_ms();
+        if (remaining <= 0) {
+            return 0;
+        }
+        struct pollfd pfd = {.fd = fd, .events = POLLIN, .revents = 0};
+        int r = poll(&pfd, 1, (int)remaining);
+        if (r < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            return 0;
+        }
+        if (r == 0) {
+            return 0; /* deadline reached with no signal */
+        }
+        char ready = 0;
+        ssize_t got = read(fd, &ready, 1);
+        if (got == 1) {
+            return ready;
+        }
+        if (got < 0 && errno == EINTR) {
+            continue;
+        }
+        return 0; /* EOF (child gone) or error */
+    }
+}
+
+/* Reap the host child within a bound: the release signal makes a healthy child
+ * break within ~50 ms and finish teardown in a few seconds, so a child still
+ * alive past the deadline is wedged — SIGKILL it and reap so the suite always
+ * makes progress. Returns the child's exit code, or -1 when it had to be
+ * killed or did not exit cleanly; a -1 fails the caller's host_exit assertion
+ * cleanly rather than hanging. */
+static int cli_scope_reap_host(pid_t host, uint32_t timeout_ms) {
+    uint64_t deadline = cbm_now_ms() + timeout_ms;
+    int status = 0;
+    for (;;) {
+        pid_t reaped = waitpid(host, &status, WNOHANG);
+        if (reaped == host) {
+            return WIFEXITED(status) ? WEXITSTATUS(status) : -1;
+        }
+        if (reaped < 0 && errno != EINTR) {
+            return -1;
+        }
+        if (cbm_now_ms() >= deadline) {
+            (void)kill(host, SIGKILL);
+            (void)waitpid(host, &status, 0);
+            return -1;
+        }
+        cbm_usleep(2000);
+    }
+}
+
+static bool cli_scope_fixture_start(cli_scope_fixture_t *fixture, const char *tag) {
+    memset(fixture, 0, sizeof(*fixture));
+    fixture->host = -1;
+    fixture->release_fd = -1;
+    snprintf(fixture->tmpdir, sizeof(fixture->tmpdir), "/tmp/cli-guard-scope-%s-XXXXXX", tag);
+    if (!cbm_mkdtemp(fixture->tmpdir)) {
+        return false;
+    }
+    snprintf(fixture->runtime_parent, sizeof(fixture->runtime_parent), "%s/runtime",
+             fixture->tmpdir);
+    snprintf(fixture->host_home, sizeof(fixture->host_home), "%s/host", fixture->tmpdir);
+    snprintf(fixture->host_cache, sizeof(fixture->host_cache), "%s/cache", fixture->host_home);
+    snprintf(fixture->conflict_log, sizeof(fixture->conflict_log), "%s/conflicts.ndjson",
+             fixture->host_home);
+    /* The host identity's cache fingerprint is derived exactly as main.c does
+     * for a real daemon: resolved dir -> canonical path -> SHA-256. */
+    char canonical_cache[1024];
+    if (test_mkdirp(fixture->runtime_parent) != 0 || !cbm_mkdir_p(fixture->host_cache, 0700) ||
+        !cbm_canonical_path(fixture->host_cache, canonical_cache, sizeof(canonical_cache))) {
+        return false;
+    }
+    cbm_normalize_path_sep(canonical_cache);
+    cbm_sha256_hex(canonical_cache, strlen(canonical_cache), fixture->host_cache_fingerprint);
+    if (!cbm_daemon_runtime_process_build_fingerprint((uint64_t)getpid(), fixture->self_build)) {
+        return false;
+    }
+    /* The guard claims the supervisor's captured build; the runner stubs that
+     * capture while a runtime service must carry the real image hash. Align
+     * the two for this fixture exactly as one production process has them. */
+    const char *previous_supervisor_build = cbm_index_supervisor_build_fingerprint();
+    snprintf(fixture->previous_supervisor_build, sizeof(fixture->previous_supervisor_build), "%s",
+             previous_supervisor_build ? previous_supervisor_build : "");
+    cbm_index_supervisor_set_build_fingerprint_for_test(fixture->self_build);
+    fixture->identity = (cbm_daemon_build_identity_t){
+        .semantic_version = CBM_VERSION,
+        .build_fingerprint = fixture->self_build,
+        .cache_fingerprint = fixture->host_cache_fingerprint,
+        .protocol_abi = CBM_DAEMON_RUNTIME_WIRE_ABI,
+        .store_abi = 1,
+        .feature_abi = 1,
+    };
+    int ready_pipe[2] = {-1, -1};
+    int release_pipe[2] = {-1, -1};
+    if (pipe(ready_pipe) != 0) {
+        return false;
+    }
+    if (pipe(release_pipe) != 0) {
+        close(ready_pipe[0]);
+        close(ready_pipe[1]);
+        return false;
+    }
+    pid_t child = fork();
+    if (child == 0) {
+        close(ready_pipe[0]);
+        close(release_pipe[1]);
+        cli_scope_host_child(fixture, ready_pipe[1], release_pipe[0]);
+    }
+    close(ready_pipe[1]);
+    close(release_pipe[0]);
+    char ready = child > 0 ? cli_scope_wait_ready(ready_pipe[0], CLI_SCOPE_READY_TIMEOUT_MS) : 0;
+    bool host_ready = ready == 'R';
+    close(ready_pipe[0]);
+    fixture->host = child;
+    fixture->release_fd = release_pipe[1];
+    cli_activation_save_env(&fixture->old_home, &fixture->old_cache);
+    const char *shell = getenv("SHELL");
+    fixture->old_shell = shell ? strdup(shell) : NULL;
+    cbm_setenv("SHELL", "/bin/zsh", 1);
+    if (!host_ready) {
+        return false;
+    }
+    fixture->endpoint = cbm_daemon_bootstrap_endpoint_new(fixture->runtime_parent);
+    cbm_daemon_runtime_connect_result_t connect_result = {0};
+    fixture->client = fixture->endpoint
+                          ? cbm_daemon_runtime_client_connect(fixture->endpoint, &fixture->identity,
+                                                              CLI_SCOPE_TIMEOUT_MS, &connect_result)
+                          : NULL;
+    return fixture->client != NULL;
+}
+
+static bool cli_scope_host_serving_within(const cli_scope_fixture_t *fixture, uint32_t timeout_ms) {
+    cbm_daemon_runtime_status_t status = {0};
+    return fixture->endpoint &&
+           cbm_daemon_runtime_request_status(fixture->endpoint, &fixture->identity, timeout_ms,
+                                             &status) &&
+           !status.stopping && status.committed_clients == 1;
+}
+
+/* Ask the host daemon itself: still running, not stopping, and the parent's
+ * committed client still admitted. */
+static bool cli_scope_host_serving(const cli_scope_fixture_t *fixture) {
+    /* A generous, bounded status deadline: a foreign-namespace install leaves
+     * this daemon serving, so a slow response on a loaded runner must not be
+     * misread as "drained" (the flaky failure this fixture showed). The call
+     * still fails cleanly — a genuinely drained daemon is unreachable or
+     * reports stopping — it just no longer decides survival on a 5 s budget. */
+    return cli_scope_host_serving_within(fixture, CLI_SCOPE_HOST_SERVING_TIMEOUT_MS);
+}
+
+static int cli_scope_install(cli_scope_fixture_t *fixture, const char *home, const char *cache,
+                             const char *bin_dir, bool skip_binary) {
+    cbm_setenv("HOME", home, 1);
+    cbm_setenv("CBM_CACHE_DIR", cache, 1);
+    cbm_cli_set_activation_runtime_parent_for_test(fixture->runtime_parent);
+    char dir_arg[704];
+    snprintf(dir_arg, sizeof(dir_arg), "--dir=%s", bin_dir);
+    char *install_argv[] = {skip_binary ? "--skip-binary" : "--force", "--skip-config", "--yes",
+                            dir_arg};
+    int rc = cli_test_cmd_install(4, install_argv);
+    cbm_cli_set_activation_runtime_parent_for_test(g_cli_suite_runtime_parent);
+    cbm_set_auto_answer_for_test(0);
+    return rc;
+}
+
+/* Returns the host child's exit status: 0 released intact,
+ * CLI_SCOPE_HOST_DRAINED when an activation drained it, -1 unknown. */
+static int cli_scope_fixture_finish(cli_scope_fixture_t *fixture) {
+    if (fixture->client) {
+        (void)cbm_daemon_runtime_client_close(fixture->client, CLI_SCOPE_TIMEOUT_MS);
+        fixture->client = NULL;
+    }
+    if (fixture->release_fd >= 0) {
+        /* Closing the write end is the signal (the child's poll sees POLLHUP);
+         * a write would raise SIGPIPE once a drained child is already gone. */
+        close(fixture->release_fd);
+        fixture->release_fd = -1;
+    }
+    int host_exit = -1;
+    if (fixture->host > 0) {
+        host_exit = cli_scope_reap_host(fixture->host, CLI_SCOPE_HOST_REAP_TIMEOUT_MS);
+        fixture->host = -1;
+    }
+    cbm_daemon_ipc_endpoint_free(fixture->endpoint);
+    fixture->endpoint = NULL;
+    if (fixture->previous_supervisor_build[0]) {
+        cbm_index_supervisor_set_build_fingerprint_for_test(fixture->previous_supervisor_build);
+    }
+    if (fixture->old_shell) {
+        cbm_setenv("SHELL", fixture->old_shell, 1);
+    } else {
+        cbm_unsetenv("SHELL");
+    }
+    free(fixture->old_shell);
+    fixture->old_shell = NULL;
+    cli_activation_restore_env(fixture->old_home, fixture->old_cache);
+    fixture->old_home = NULL;
+    fixture->old_cache = NULL;
+    test_rmdir_r(fixture->tmpdir);
+    return host_exit;
+}
+
+static void cli_scope_foreign_paths(const cli_scope_fixture_t *fixture, char home[512],
+                                    char cache[576], char bin_dir[640], char activation_log[704]) {
+    snprintf(home, 512, "%s/sandbox", fixture->tmpdir);
+    snprintf(cache, 576, "%s/cache", home);
+    snprintf(bin_dir, 640, "%s/custom/bin", home);
+    snprintf(activation_log, 704, "%s/logs/activation-events.ndjson", cache);
+}
+
+/* (a) `HOME=<sandbox> install --skip-binary` — the observed incident shape:
+ * the sandbox shares the account rendezvous, its cache namespace differs. */
+TEST(cli_install_skip_binary_into_foreign_home_never_drains_host_cohort) {
+    cli_scope_fixture_t fixture;
+    bool ready = cli_scope_fixture_start(&fixture, "skipbin");
+    char foreign_home[512];
+    char foreign_cache[576];
+    char foreign_bin[640];
+    char activation_log[704];
+    cli_scope_foreign_paths(&fixture, foreign_home, foreign_cache, foreign_bin, activation_log);
+    bool prepared = ready && cbm_mkdir_p(foreign_home, 0700);
+    int install_rc =
+        prepared ? cli_scope_install(&fixture, foreign_home, foreign_cache, foreign_bin, true) : -1;
+    bool host_serving = prepared && cli_scope_host_serving(&fixture);
+    const char *events = read_test_file(activation_log);
+    bool completed = events && strstr(events, "\"phase\":\"completed\"") != NULL;
+    bool nothing_drained = events && strstr(events, "cohort drained") == NULL;
+    int host_exit = cli_scope_fixture_finish(&fixture);
+
+    ASSERT_TRUE(ready);
+    ASSERT_EQ(install_rc, 0);
+    ASSERT_TRUE(host_serving);
+    ASSERT_EQ(host_exit, 0);
+    ASSERT_TRUE(completed);
+    ASSERT_TRUE(nothing_drained);
+    PASS();
+}
+
+/* (b) A full install (binary published into the sandbox bin dir) is scoped
+ * the same way: the host namespace is not what is being replaced. */
+TEST(cli_install_binary_into_foreign_home_never_drains_host_cohort) {
+    cli_scope_fixture_t fixture;
+    bool ready = cli_scope_fixture_start(&fixture, "binary");
+    char foreign_home[512];
+    char foreign_cache[576];
+    char foreign_bin[640];
+    char activation_log[704];
+    cli_scope_foreign_paths(&fixture, foreign_home, foreign_cache, foreign_bin, activation_log);
+    char target_path[704];
+    snprintf(target_path, sizeof(target_path), "%s/codebase-memory-mcp", foreign_bin);
+    bool prepared = ready && cbm_mkdir_p(foreign_home, 0700);
+    int install_rc =
+        prepared ? cli_scope_install(&fixture, foreign_home, foreign_cache, foreign_bin, false)
+                 : -1;
+    bool host_serving = prepared && cli_scope_host_serving(&fixture);
+    struct stat target_status;
+    bool target_exists = stat(target_path, &target_status) == 0;
+    const char *events = read_test_file(activation_log);
+    bool completed = events && strstr(events, "\"phase\":\"completed\"") != NULL;
+    bool nothing_drained = events && strstr(events, "cohort drained") == NULL;
+    int host_exit = cli_scope_fixture_finish(&fixture);
+
+    ASSERT_TRUE(ready);
+    ASSERT_EQ(install_rc, 0);
+    ASSERT_TRUE(target_exists);
+    ASSERT_TRUE(host_serving);
+    ASSERT_EQ(host_exit, 0);
+    ASSERT_TRUE(completed);
+    ASSERT_TRUE(nothing_drained);
+    PASS();
+}
+
+/* (c) Regression: an install that replaces the binary inside the host's own
+ * namespace still drains that cohort — and the audit names its client. */
+TEST(cli_install_into_host_namespace_still_drains_host_cohort) {
+    cli_scope_fixture_t fixture;
+    bool ready = cli_scope_fixture_start(&fixture, "host");
+    char host_bin[640];
+    char activation_log[704];
+    snprintf(host_bin, sizeof(host_bin), "%s/custom/bin", fixture.host_home);
+    snprintf(activation_log, sizeof(activation_log), "%s/logs/activation-events.ndjson",
+             fixture.host_cache);
+    int install_rc =
+        ready ? cli_scope_install(&fixture, fixture.host_home, fixture.host_cache, host_bin, false)
+              : -1;
+    /* Negative probe: see CLI_SCOPE_HOST_DRAINED_PROBE_MS. The drain itself is
+     * asserted positively below via host_exit == CLI_SCOPE_HOST_DRAINED. */
+    bool host_serving =
+        ready && cli_scope_host_serving_within(&fixture, CLI_SCOPE_HOST_DRAINED_PROBE_MS);
+    const char *events = read_test_file(activation_log);
+    bool drained_in_log = events && strstr(events, "cohort drained") != NULL &&
+                          strstr(events, "\"daemon_active_clients\":1") != NULL;
+    int host_exit = cli_scope_fixture_finish(&fixture);
+
+    ASSERT_TRUE(ready);
+    ASSERT_EQ(install_rc, 0);
+    ASSERT_FALSE(host_serving);
+    ASSERT_EQ(host_exit, CLI_SCOPE_HOST_DRAINED);
+    ASSERT_TRUE(drained_in_log);
+    PASS();
+}
+
+/* (d) `--skip-binary` with nothing to publish (no binary at the target, no
+ * index reset) replaces nothing, so even the host's own namespace has
+ * nothing to quiesce: agent configs are refreshed, sessions stay up. */
+TEST(cli_install_skip_binary_unchanged_in_host_namespace_quiesces_nothing) {
+    cli_scope_fixture_t fixture;
+    bool ready = cli_scope_fixture_start(&fixture, "unchanged");
+    char absent_bin[640];
+    char activation_log[704];
+    snprintf(absent_bin, sizeof(absent_bin), "%s/absent/bin", fixture.host_home);
+    snprintf(activation_log, sizeof(activation_log), "%s/logs/activation-events.ndjson",
+             fixture.host_cache);
+    int install_rc =
+        ready ? cli_scope_install(&fixture, fixture.host_home, fixture.host_cache, absent_bin, true)
+              : -1;
+    bool host_serving = ready && cli_scope_host_serving(&fixture);
+    const char *events = read_test_file(activation_log);
+    bool completed = events && strstr(events, "\"phase\":\"completed\"") != NULL;
+    bool nothing_drained = events && strstr(events, "cohort drained") == NULL;
+    int host_exit = cli_scope_fixture_finish(&fixture);
+
+    ASSERT_TRUE(ready);
+    ASSERT_EQ(install_rc, 0);
+    ASSERT_TRUE(host_serving);
+    ASSERT_EQ(host_exit, 0);
+    ASSERT_TRUE(completed);
+    ASSERT_TRUE(nothing_drained);
+    PASS();
+}
 #endif
 
 TEST(cli_install_force_quiesces_active_cohort_before_replacing_binary) {
@@ -1670,6 +2238,53 @@ TEST(cli_install_reset_deletion_waits_for_final_activation_guard) {
     PASS();
 }
 
+/* Removing an index must also delete its SQLite sidecars (-wal/-shm/-journal),
+ * not just the .db. cbm_remove_indexes is the single deletion chokepoint for
+ * both explicit deleters (install --reset-indexes, uninstall), so an orphan
+ * -wal/-shm left behind here outlives the index everywhere. Reporter ask (c)
+ * on issue #2054. */
+TEST(cli_remove_indexes_deletes_orphan_sqlite_sidecars_issue2054) {
+    char tmpdir[256];
+    snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-remove-indexes-sidecars-XXXXXX");
+    if (!cbm_mkdtemp(tmpdir)) {
+        FAIL("cbm_mkdtemp failed");
+    }
+    char *old_home = NULL;
+    char *old_cache = NULL;
+    cli_activation_save_env(&old_home, &old_cache);
+    cbm_setenv("HOME", tmpdir, 1);
+    char cache_dir[512];
+    snprintf(cache_dir, sizeof(cache_dir), "%s/cache", tmpdir);
+    cbm_setenv("CBM_CACHE_DIR", cache_dir, 1);
+    test_mkdirp(cache_dir);
+
+    char db_path[640];
+    char wal_path[640];
+    char shm_path[640];
+    snprintf(db_path, sizeof(db_path), "%s/proj.db", cache_dir);
+    snprintf(wal_path, sizeof(wal_path), "%s/proj.db-wal", cache_dir);
+    snprintf(shm_path, sizeof(shm_path), "%s/proj.db-shm", cache_dir);
+    write_test_file(db_path, "db");
+    write_test_file(wal_path, "wal");
+    write_test_file(shm_path, "shm");
+
+    int rc = cbm_remove_indexes(tmpdir);
+
+    struct stat st;
+    bool db_absent = stat(db_path, &st) != 0;
+    bool wal_absent = stat(wal_path, &st) != 0;
+    bool shm_absent = stat(shm_path, &st) != 0;
+    cli_activation_restore_env(old_home, old_cache);
+    test_rmdir_r(tmpdir);
+
+    /* One .db removed; sidecars are not indexes, so the count is unchanged. */
+    ASSERT_EQ(rc, 1);
+    ASSERT_TRUE(db_absent);
+    ASSERT_TRUE(wal_absent);
+    ASSERT_TRUE(shm_absent);
+    PASS();
+}
+
 TEST(cli_install_config_only_waits_for_cohort_drain) {
     char tmpdir[256];
     snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-daemon-install-config-race-XXXXXX");
@@ -2278,6 +2893,181 @@ TEST(cli_uninstall_preserves_binary_and_index_when_cohort_does_not_drain) {
     PASS();
 }
 
+#ifndef _WIN32
+/* #1954: an agent config that cannot be cleaned must not hold the executable
+ * and the indexes hostage. The fixture's ~/.cursor/mcp.json is a dangling
+ * symlink (a dotfiles checkout that moved) — a shape every config editor keeps
+ * refusing. Before the fix the cleanup failure aborted the activation BEFORE
+ * index and binary removal: `uninstall -y` exited 1 and left a 300 MB binary
+ * plus the whole cache behind, while the report still read "removed". */
+TEST(cli_uninstall_removes_binary_and_index_when_agent_config_cleanup_fails) {
+    char tmpdir[256];
+    snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-uninstall-hostage-XXXXXX");
+    if (!cbm_mkdtemp(tmpdir)) {
+        FAIL("cbm_mkdtemp failed");
+    }
+    char *old_home = NULL;
+    char *old_cache = NULL;
+    cli_activation_save_env(&old_home, &old_cache);
+    cbm_setenv("HOME", tmpdir, 1);
+    /* PATH moves with HOME so no real agent on the developer's PATH is detected. */
+    char *old_path = save_test_env("PATH");
+    cbm_setenv("PATH", tmpdir, 1);
+
+    char cache_dir[512];
+    char index_path[640];
+    snprintf(cache_dir, sizeof(cache_dir), "%s/cache", tmpdir);
+    cbm_setenv("CBM_CACHE_DIR", cache_dir, 1);
+    test_mkdirp(cache_dir);
+    snprintf(index_path, sizeof(index_path), "%s/project.db", cache_dir);
+    write_test_file(index_path, "index must go even when a config cannot be cleaned");
+
+    char bin_dir[512];
+    char bin_target[640];
+    snprintf(bin_dir, sizeof(bin_dir), "%s/.local/bin", tmpdir);
+    test_mkdirp(bin_dir);
+    snprintf(bin_target, sizeof(bin_target), "%s/codebase-memory-mcp", bin_dir);
+    write_test_file(bin_target, "binary must go even when a config cannot be cleaned");
+
+    char cursor_dir[512];
+    char cursor_config[640];
+    char dangling_target[640];
+    snprintf(cursor_dir, sizeof(cursor_dir), "%s/.cursor", tmpdir);
+    test_mkdirp(cursor_dir);
+    snprintf(cursor_config, sizeof(cursor_config), "%s/mcp.json", cursor_dir);
+    snprintf(dangling_target, sizeof(dangling_target), "%s/.dotfiles/cursor/mcp.json", tmpdir);
+    if (symlink(dangling_target, cursor_config) != 0) {
+        FAIL("symlink failed");
+    }
+
+    cli_activation_fake_t fake = {.mutation_reserve_result = 1};
+    cbm_cli_activation_ops_t ops = cli_activation_fake_ops(&fake);
+    cbm_cli_set_activation_ops_for_test(&ops);
+    cli_fd_capture_t out_capture;
+    cli_fd_capture_t err_capture;
+    cli_fd_capture_begin(&out_capture, stdout, STDOUT_FILENO);
+    cli_fd_capture_begin(&err_capture, stderr, STDERR_FILENO);
+    char *argv[] = {"--yes"};
+    int rc = cli_test_cmd_uninstall(1, argv);
+    char *err_text = cli_fd_capture_end(&err_capture);
+    char *out_text = cli_fd_capture_end(&out_capture);
+    cbm_cli_set_activation_ops_for_test(NULL);
+    cbm_set_auto_answer_for_test(0);
+
+    struct stat state;
+    bool binary_gone = lstat(bin_target, &state) != 0 && errno == ENOENT;
+    bool index_gone = lstat(index_path, &state) != 0 && errno == ENOENT;
+    bool link_untouched = lstat(cursor_config, &state) == 0 && S_ISLNK(state.st_mode);
+    bool failure_named = err_text && strstr(err_text, cursor_config) != NULL;
+
+    cli_activation_restore_env(old_home, old_cache);
+    restore_test_env("PATH", old_path);
+    test_rmdir_r(tmpdir);
+    free(err_text);
+    free(out_text);
+
+    ASSERT(rc != 0);
+    ASSERT_TRUE(binary_gone);
+    ASSERT_TRUE(index_gone);
+    ASSERT_TRUE(link_untouched);
+    ASSERT_TRUE(failure_named);
+    PASS();
+}
+
+/* #1954 end to end: ~/.cursor/mcp.json is a user-owned symlink into a
+ * dotfiles checkout. The uninstall command opts in to following it, removes
+ * our entry THROUGH the link, leaves the link pointing where it did, and
+ * exits 0 with the binary and the index gone. */
+TEST(cli_uninstall_cleans_user_owned_symlinked_config) {
+    char tmpdir[256];
+    snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-uninstall-symlinked-XXXXXX");
+    if (!cbm_mkdtemp(tmpdir)) {
+        FAIL("cbm_mkdtemp failed");
+    }
+    char *old_home = NULL;
+    char *old_cache = NULL;
+    cli_activation_save_env(&old_home, &old_cache);
+    cbm_setenv("HOME", tmpdir, 1);
+    char *old_path = save_test_env("PATH");
+    cbm_setenv("PATH", tmpdir, 1);
+
+    char cache_dir[512];
+    char index_path[640];
+    snprintf(cache_dir, sizeof(cache_dir), "%s/cache", tmpdir);
+    cbm_setenv("CBM_CACHE_DIR", cache_dir, 1);
+    test_mkdirp(cache_dir);
+    snprintf(index_path, sizeof(index_path), "%s/project.db", cache_dir);
+    write_test_file(index_path, "index goes with the uninstall");
+
+    char bin_dir[512];
+    char bin_target[640];
+    snprintf(bin_dir, sizeof(bin_dir), "%s/.local/bin", tmpdir);
+    test_mkdirp(bin_dir);
+    snprintf(bin_target, sizeof(bin_target), "%s/codebase-memory-mcp", bin_dir);
+    write_test_file(bin_target, "binary goes with the uninstall");
+
+    char cursor_dir[512];
+    char cursor_config[640];
+    char dotfiles_dir[512];
+    char dotfiles_config[640];
+    snprintf(cursor_dir, sizeof(cursor_dir), "%s/.cursor", tmpdir);
+    snprintf(cursor_config, sizeof(cursor_config), "%s/mcp.json", cursor_dir);
+    snprintf(dotfiles_dir, sizeof(dotfiles_dir), "%s/.dotfiles/cursor", tmpdir);
+    snprintf(dotfiles_config, sizeof(dotfiles_config), "%s/mcp.json", dotfiles_dir);
+    test_mkdirp(cursor_dir);
+    test_mkdirp(dotfiles_dir);
+    write_test_file(dotfiles_config,
+                    "{\n  \"mcpServers\": {\n    \"keep\": {\"command\": \"x\"}\n  }\n}\n");
+    int installed = cbm_install_editor_mcp(bin_target, dotfiles_config);
+    if (symlink(dotfiles_config, cursor_config) != 0) {
+        FAIL("symlink failed");
+    }
+
+    cli_activation_fake_t fake = {.mutation_reserve_result = 1};
+    cbm_cli_activation_ops_t ops = cli_activation_fake_ops(&fake);
+    cbm_cli_set_activation_ops_for_test(&ops);
+    cli_fd_capture_t out_capture;
+    cli_fd_capture_t err_capture;
+    cli_fd_capture_begin(&out_capture, stdout, STDOUT_FILENO);
+    cli_fd_capture_begin(&err_capture, stderr, STDERR_FILENO);
+    char *argv[] = {"--yes"};
+    int rc = cli_test_cmd_uninstall(1, argv);
+    char *err_text = cli_fd_capture_end(&err_capture);
+    char *out_text = cli_fd_capture_end(&out_capture);
+    cbm_cli_set_activation_ops_for_test(NULL);
+    cbm_set_auto_answer_for_test(0);
+
+    struct stat state;
+    bool binary_gone = lstat(bin_target, &state) != 0 && errno == ENOENT;
+    bool index_gone = lstat(index_path, &state) != 0 && errno == ENOENT;
+    bool link_intact = lstat(cursor_config, &state) == 0 && S_ISLNK(state.st_mode);
+    char link_value[640] = {0};
+    ssize_t link_length = readlink(cursor_config, link_value, sizeof(link_value) - 1U);
+    bool link_same = link_length > 0 && strcmp(link_value, dotfiles_config) == 0;
+    char *after = read_test_file_alloc(dotfiles_config);
+    bool entry_removed =
+        after && !strstr(after, "codebase-memory-mcp") && strstr(after, "\"keep\"");
+    bool no_error = err_text && !strstr(err_text, "error:");
+
+    cli_activation_restore_env(old_home, old_cache);
+    restore_test_env("PATH", old_path);
+    test_rmdir_r(tmpdir);
+    free(after);
+    free(err_text);
+    free(out_text);
+
+    ASSERT_EQ(installed, 0);
+    ASSERT_EQ(rc, 0);
+    ASSERT_TRUE(binary_gone);
+    ASSERT_TRUE(index_gone);
+    ASSERT_TRUE(link_intact);
+    ASSERT_TRUE(link_same);
+    ASSERT_TRUE(entry_removed);
+    ASSERT_TRUE(no_error);
+    PASS();
+}
+#endif
+
 TEST(cli_activation_guard_is_bypassed_for_dry_run_and_plan) {
     char tmpdir[256];
     snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-daemon-stateless-XXXXXX");
@@ -3815,6 +4605,251 @@ TEST(cli_openclaw_uninstall_removes_compaction_when_workspace_is_ambiguous) {
     PASS();
 }
 
+/* ═══════════════════════════════════════════════════════════════════
+ *  OpenHands settings.json + agent-profiles registration (#1826)
+ *
+ *  A bare ~/.openhands/mcp.json is not enough: OpenHands registers global MCP
+ *  servers under settings.json → mcp_config, and every agent profile under
+ *  agent-profiles/ must list the server in mcp_server_refs before that agent
+ *  may use it. Foreign content survives byte-for-byte; uninstall removes
+ *  exactly what install added.
+ * ═══════════════════════════════════════════════════════════════════ */
+
+typedef struct {
+    char home[256];
+    char binary[512]; /* the path `uninstall` expects: <home>/.local/bin/... */
+    char settings[640];
+    char mcp[640];
+    char profiles_dir[640];
+    char default_profile[768];
+    char custom_profile[768];
+    char note[768];
+    char *saved_home;
+    char *saved_path;
+    char *saved_cache;
+} openhands_fixture_t;
+
+static bool openhands_fixture_open(openhands_fixture_t *fx, bool with_profiles) {
+    snprintf(fx->home, sizeof(fx->home), "/tmp/cli-openhands-XXXXXX");
+    if (!cbm_mkdtemp(fx->home)) {
+        return false;
+    }
+    snprintf(fx->settings, sizeof(fx->settings), "%s/.openhands/settings.json", fx->home);
+#ifdef _WIN32
+    snprintf(fx->binary, sizeof(fx->binary), "%s/.local/bin/codebase-memory-mcp.exe", fx->home);
+#else
+    snprintf(fx->binary, sizeof(fx->binary), "%s/.local/bin/codebase-memory-mcp", fx->home);
+#endif
+    snprintf(fx->mcp, sizeof(fx->mcp), "%s/.openhands/mcp.json", fx->home);
+    snprintf(fx->profiles_dir, sizeof(fx->profiles_dir), "%s/.openhands/agent-profiles", fx->home);
+    snprintf(fx->default_profile, sizeof(fx->default_profile), "%s/default.json", fx->profiles_dir);
+    snprintf(fx->custom_profile, sizeof(fx->custom_profile), "%s/custom.json", fx->profiles_dir);
+    snprintf(fx->note, sizeof(fx->note), "%s/README.txt", fx->profiles_dir);
+    char openhands_dir[512];
+    snprintf(openhands_dir, sizeof(openhands_dir), "%s/.openhands", fx->home);
+    test_mkdirp(with_profiles ? fx->profiles_dir : openhands_dir);
+    fx->saved_home = save_test_env("HOME");
+    fx->saved_path = save_test_env("PATH");
+    fx->saved_cache = save_test_env("CBM_CACHE_DIR");
+    cbm_setenv("HOME", fx->home, 1);
+    cbm_setenv("PATH", fx->home, 1);
+    cbm_unsetenv("CBM_CACHE_DIR");
+    return true;
+}
+
+static void openhands_fixture_close(openhands_fixture_t *fx) {
+    restore_test_env("HOME", fx->saved_home);
+    restore_test_env("PATH", fx->saved_path);
+    restore_test_env("CBM_CACHE_DIR", fx->saved_cache);
+    test_rmdir_r(fx->home);
+}
+
+static yyjson_doc *openhands_read_doc(const char *path) {
+    char *data = read_test_file_alloc(path);
+    if (!data) {
+        return NULL;
+    }
+    yyjson_doc *doc = yyjson_read(data, strlen(data), 0);
+    free(data);
+    return doc;
+}
+
+/* settings.json → mcp_config.<name> must be {transport:"stdio", command:<binary>,
+ * enabled:true}; returns false for any deviation. */
+static bool openhands_settings_entry_ok(const char *settings_path, const char *name,
+                                        const char *binary) {
+    yyjson_doc *doc = openhands_read_doc(settings_path);
+    yyjson_val *root = doc ? yyjson_doc_get_root(doc) : NULL;
+    yyjson_val *mcp_config = root ? yyjson_obj_get(root, "mcp_config") : NULL;
+    yyjson_val *entry = mcp_config ? yyjson_obj_get(mcp_config, name) : NULL;
+    bool ok = entry && yyjson_is_obj(entry) && yyjson_obj_size(entry) == 3U;
+    yyjson_val *transport = ok ? yyjson_obj_get(entry, "transport") : NULL;
+    yyjson_val *command = ok ? yyjson_obj_get(entry, "command") : NULL;
+    yyjson_val *enabled = ok ? yyjson_obj_get(entry, "enabled") : NULL;
+    ok = ok && transport && yyjson_is_str(transport) &&
+         strcmp(yyjson_get_str(transport), "stdio") == 0;
+    ok = ok && command && yyjson_is_str(command) && strcmp(yyjson_get_str(command), binary) == 0;
+    ok = ok && enabled && yyjson_is_true(enabled);
+    yyjson_doc_free(doc);
+    return ok;
+}
+
+static bool openhands_settings_entry_absent(const char *settings_path, const char *name) {
+    yyjson_doc *doc = openhands_read_doc(settings_path);
+    yyjson_val *root = doc ? yyjson_doc_get_root(doc) : NULL;
+    yyjson_val *mcp_config = root ? yyjson_obj_get(root, "mcp_config") : NULL;
+    bool absent = root && (!mcp_config || !yyjson_obj_get(mcp_config, name));
+    yyjson_doc_free(doc);
+    return absent;
+}
+
+/* profile → mcp_server_refs must be exactly the given strings in order. */
+static bool openhands_profile_refs_equal(const char *profile_path, const char *const *expected,
+                                         size_t expected_count) {
+    yyjson_doc *doc = openhands_read_doc(profile_path);
+    yyjson_val *root = doc ? yyjson_doc_get_root(doc) : NULL;
+    yyjson_val *refs = root ? yyjson_obj_get(root, "mcp_server_refs") : NULL;
+    bool ok = refs && yyjson_is_arr(refs) && yyjson_arr_size(refs) == expected_count;
+    for (size_t i = 0; ok && i < expected_count; i++) {
+        yyjson_val *item = yyjson_arr_get(refs, i);
+        ok = item && yyjson_is_str(item) && strcmp(yyjson_get_str(item), expected[i]) == 0;
+    }
+    yyjson_doc_free(doc);
+    return ok;
+}
+
+static bool openhands_file_equals(const char *path, const char *expected) {
+    char *data = read_test_file_alloc(path);
+    bool equal = data && expected && strcmp(data, expected) == 0;
+    free(data);
+    return equal;
+}
+
+static const char openhands_settings_before[] = "{\n"
+                                                "  \"language\": \"en\",\n"
+                                                "  \"mcp_config\": {\n"
+                                                "    \"other-mcp\": {\"transport\": \"stdio\", "
+                                                "\"command\": \"/opt/other\", \"enabled\": false}\n"
+                                                "  },\n"
+                                                "  \"llm_model\": \"gpt-x\"\n"
+                                                "}\n";
+static const char openhands_default_profile_before[] = "{\n"
+                                                       "  \"name\": \"default\",\n"
+                                                       "  \"mcp_server_refs\": null,\n"
+                                                       "  \"tools\": [\"bash\"]\n"
+                                                       "}\n";
+static const char openhands_custom_profile_before[] =
+    "{\"name\": \"custom\", \"mcp_server_refs\": [\"other-mcp\"]}\n";
+static const char openhands_note_before[] = "not a profile\n";
+
+/* Foreign settings keys and a foreign mcp_config sibling survive verbatim;
+ * a null profile ref list becomes ours, an existing list is appended once;
+ * a second install is byte-idempotent; uninstall restores the foreign files
+ * byte-for-byte and removes only our ref. */
+TEST(cli_openhands_registers_settings_mcp_config_and_profile_refs_issue1826) {
+    openhands_fixture_t fx;
+    if (!openhands_fixture_open(&fx, true))
+        FAIL("cbm_mkdtemp failed");
+    write_test_file(fx.settings, openhands_settings_before);
+    write_test_file(fx.default_profile, openhands_default_profile_before);
+    write_test_file(fx.custom_profile, openhands_custom_profile_before);
+    write_test_file(fx.note, openhands_note_before);
+
+    cbm_install_agent_configs(fx.home, fx.binary, false, false);
+
+    const char *const only_ours[] = {"codebase-memory-mcp"};
+    const char *const appended[] = {"other-mcp", "codebase-memory-mcp"};
+    bool ours_ok = openhands_settings_entry_ok(fx.settings, "codebase-memory-mcp", fx.binary);
+    char *settings_after = read_test_file_alloc(fx.settings);
+    bool foreign_ok =
+        settings_after && strstr(settings_after, "\"language\": \"en\"") &&
+        strstr(settings_after, "\"llm_model\": \"gpt-x\"") &&
+        strstr(settings_after, "\"other-mcp\": {\"transport\": \"stdio\", \"command\": "
+                               "\"/opt/other\", \"enabled\": false}");
+    bool default_ok = openhands_profile_refs_equal(fx.default_profile, only_ours, 1U);
+    bool custom_ok = openhands_profile_refs_equal(fx.custom_profile, appended, 2U);
+    char *default_after = read_test_file_alloc(fx.default_profile);
+    bool default_foreign_ok = default_after && strstr(default_after, "\"name\": \"default\"") &&
+                              strstr(default_after, "\"tools\": [\"bash\"]");
+    bool note_ok = openhands_file_equals(fx.note, openhands_note_before);
+    const char *const standard_json[] = {"mcpServers", "codebase-memory-mcp", fx.binary};
+    bool mcp_json_ok = test_file_contains_all(fx.mcp, standard_json, 3);
+    char *custom_after = read_test_file_alloc(fx.custom_profile);
+
+    /* Second install: byte-idempotent on every touched file. */
+    cbm_install_agent_configs(fx.home, fx.binary, false, false);
+    bool idempotent = openhands_file_equals(fx.settings, settings_after) &&
+                      openhands_file_equals(fx.default_profile, default_after) &&
+                      openhands_file_equals(fx.custom_profile, custom_after);
+    free(settings_after);
+    free(default_after);
+    free(custom_after);
+
+    char *argv[] = {"uninstall", "--yes"};
+    int rc = cli_test_cmd_uninstall(2, argv);
+    bool settings_restored = openhands_file_equals(fx.settings, openhands_settings_before);
+    bool custom_restored =
+        openhands_file_equals(fx.custom_profile, openhands_custom_profile_before);
+    /* null → ["codebase-memory-mcp"] → [] : the ref is gone; an empty list is
+     * the minimal edit (the editor cannot know the list was null before). */
+    bool default_cleared = openhands_profile_refs_equal(fx.default_profile, only_ours, 0U);
+    bool note_restored = openhands_file_equals(fx.note, openhands_note_before);
+    openhands_fixture_close(&fx);
+
+    if (!ours_ok)
+        FAIL("settings.json must register mcp_config.codebase-memory-mcp {stdio, binary, enabled}");
+    if (!foreign_ok)
+        FAIL("settings.json foreign keys and the foreign mcp_config sibling must survive verbatim");
+    if (!default_ok)
+        FAIL("a null mcp_server_refs must become [\"codebase-memory-mcp\"]");
+    if (!custom_ok)
+        FAIL("an existing mcp_server_refs list must gain codebase-memory-mcp exactly once");
+    if (!default_foreign_ok)
+        FAIL("profile keys around mcp_server_refs must survive verbatim");
+    if (!note_ok)
+        FAIL("non-JSON files under agent-profiles must not be touched");
+    if (!mcp_json_ok)
+        FAIL("the existing ~/.openhands/mcp.json registration must be kept");
+    if (!idempotent)
+        FAIL("a second install must be byte-idempotent");
+    if (rc != 0 || !settings_restored)
+        FAIL("uninstall must restore settings.json byte-for-byte");
+    if (!custom_restored)
+        FAIL("uninstall must restore a profile with foreign refs byte-for-byte");
+    if (!default_cleared)
+        FAIL("uninstall must remove our ref from the null-origin profile");
+    if (!note_restored)
+        FAIL("uninstall must not touch non-JSON files under agent-profiles");
+    PASS();
+}
+
+/* Fresh ~/.openhands without settings.json or agent-profiles: settings.json is
+ * created with only our entry, no profile directory is invented, and uninstall
+ * removes the entry again. */
+TEST(cli_openhands_creates_settings_and_skips_missing_profiles_issue1826) {
+    openhands_fixture_t fx;
+    if (!openhands_fixture_open(&fx, false))
+        FAIL("cbm_mkdtemp failed");
+
+    cbm_install_agent_configs(fx.home, fx.binary, false, false);
+    bool ours_ok = openhands_settings_entry_ok(fx.settings, "codebase-memory-mcp", fx.binary);
+    struct stat st;
+    bool no_profiles_invented = stat(fx.profiles_dir, &st) != 0;
+
+    char *argv[] = {"uninstall", "--yes"};
+    int rc = cli_test_cmd_uninstall(2, argv);
+    bool removed = openhands_settings_entry_absent(fx.settings, "codebase-memory-mcp");
+    openhands_fixture_close(&fx);
+
+    if (!ours_ok)
+        FAIL("a missing settings.json must be created with mcp_config.codebase-memory-mcp");
+    if (!no_profiles_invented)
+        FAIL("install must never create ~/.openhands/agent-profiles");
+    if (rc != 0 || !removed)
+        FAIL("uninstall must remove mcp_config.codebase-memory-mcp from settings.json");
+    PASS();
+}
+
 /* ═══════════════════════════════════════════════════════════════════
  *  VS Code MCP config tests
  * ═══════════════════════════════════════════════════════════════════ */
@@ -4636,7 +5671,7 @@ TEST(cli_agent_uninstall_reports_safe_editor_refusal) {
 #else
     snprintf(bin_path, sizeof(bin_path), "%s/codebase-memory-mcp", bin_dir);
 #endif
-    write_test_file(bin_path, "installed binary must remain live\n");
+    write_test_file(bin_path, "installed binary goes even when a config cannot be cleaned\n");
 
     char *saved_home = save_test_env("HOME");
     char *saved_path = save_test_env("PATH");
@@ -4660,9 +5695,12 @@ TEST(cli_agent_uninstall_reports_safe_editor_refusal) {
     restore_test_env("HOME", saved_home);
     restore_test_env("PATH", saved_path);
     test_rmdir_r(tmpdir);
-    if (rc == 0 || !preserved || !binary_preserved || fake.mutation_reserve_count != 1 ||
-        fake.mutation_lease_release_count != 1 || !strstr(fake.diagnostic, "executable was kept"))
-        FAIL("agent uninstall refusal must fail before removing the live binary");
+    /* #1954: a refused config is reported and fails the exit code, but it never
+     * keeps the executable installed — that left a 300 MB binary and every index
+     * behind for one unreadable mcp.json. */
+    if (rc == 0 || !preserved || binary_preserved || fake.mutation_reserve_count != 1 ||
+        fake.mutation_lease_release_count != 1 || fake.diagnostic[0] != '\0')
+        FAIL("agent uninstall refusal must fail the exit code without keeping the binary");
     PASS();
 }
 
@@ -5169,6 +6207,7 @@ TEST(cli_new_agent_install_plans_use_documented_paths) {
         "/.hermes/skills/codebase-memory/SKILL.md",
         "\"openhands\"",
         "/.openhands/mcp.json",
+        "/.openhands/settings.json",
         "/.agents/skills/codebase-memory/SKILL.md",
         "\"cline\"",
         "/.cline/mcp.json",
@@ -8344,8 +9383,8 @@ TEST(cli_codex_respects_codex_home) {
     snprintf(expected_config, sizeof(expected_config), "%s/config.toml", codex_home);
     yyjson_doc *plan_doc = json ? yyjson_read(json, strlen(json), 0) : NULL;
     yyjson_val *plan_root = plan_doc ? yyjson_doc_get_root(plan_doc) : NULL;
-    bool plans_config = test_json_string_array_contains(plan_root, "config_files_planned",
-                                                        expected_config);
+    bool plans_config =
+        test_json_string_array_contains(plan_root, "config_files_planned", expected_config);
     bool plans_instructions = test_json_string_array_contains(
         plan_root, "instruction_files_planned", expected_instructions);
     bool plans_cleanup = json && strstr(json, "remove_managed_block_if_present") != NULL;
@@ -8401,8 +9440,8 @@ TEST(cli_codex_install_uses_global_activation_pointer_issue1689) {
     struct stat state;
     int fresh_rc = cbm_install_agent_configs(tmpdir, binary_path, false, false);
     char *fresh_agents = read_test_file_alloc(agents_path);
-    bool fresh_pointer_installed = fresh_rc == 0 && fresh_agents &&
-                                   strcmp(fresh_agents, test_codex_activation_block) == 0;
+    bool fresh_pointer_installed =
+        fresh_rc == 0 && fresh_agents && strcmp(fresh_agents, test_codex_activation_block) == 0;
     char *config = read_test_file_alloc(config_path);
     bool other_surfaces_installed =
         fresh_rc == 0 && config && strstr(config, "[mcp_servers.codebase-memory-mcp]") &&
@@ -8423,8 +9462,7 @@ TEST(cli_codex_install_uses_global_activation_pointer_issue1689) {
     bool unowned_preserved =
         user_pointer_written > 0 && (size_t)user_pointer_written < sizeof(expected_user_pointer) &&
         dry_rc == 0 && unowned_rc == 0 && after_dry && after_unowned &&
-        strcmp(after_dry, user_only) == 0 &&
-        strcmp(after_unowned, expected_user_pointer) == 0;
+        strcmp(after_dry, user_only) == 0 && strcmp(after_unowned, expected_user_pointer) == 0;
     free(after_dry);
     free(after_unowned);
 
@@ -8469,11 +9507,10 @@ TEST(cli_codex_install_uses_global_activation_pointer_issue1689) {
     int malformed_rc = cbm_install_agent_configs(tmpdir, binary_path, false, false);
     char *after_malformed = read_test_file_alloc(agents_path);
     config = read_test_file_alloc(config_path);
-    bool malformed_preserved = malformed_rc != 0 && after_malformed &&
-                               strcmp(after_malformed, malformed) == 0 && config &&
-                               strstr(config, "[mcp_servers.codebase-memory-mcp]") &&
-                               strstr(config, "SessionStart") && stat(skill_path, &state) == 0 &&
-                               stat(profile_path, &state) == 0;
+    bool malformed_preserved =
+        malformed_rc != 0 && after_malformed && strcmp(after_malformed, malformed) == 0 && config &&
+        strstr(config, "[mcp_servers.codebase-memory-mcp]") && strstr(config, "SessionStart") &&
+        stat(skill_path, &state) == 0 && stat(profile_path, &state) == 0;
     free(config);
     free(after_malformed);
 
@@ -8481,8 +9518,8 @@ TEST(cli_codex_install_uses_global_activation_pointer_issue1689) {
     char *uninstall_argv[] = {"uninstall", "--yes"};
     int uninstall_rc = cli_test_cmd_uninstall(2, uninstall_argv);
     char *after_uninstall = read_test_file_alloc(agents_path);
-    bool uninstall_preserved_foreign = uninstall_rc == 0 && after_uninstall &&
-                                       strcmp(after_uninstall, user_only) == 0;
+    bool uninstall_preserved_foreign =
+        uninstall_rc == 0 && after_uninstall && strcmp(after_uninstall, user_only) == 0;
     free(after_uninstall);
 
     restore_test_env("HOME", saved_home);
@@ -9343,6 +10380,175 @@ TEST(cli_hook_session_exhausts_project_registry_pages) {
     PASS();
 }
 
+#ifndef _WIN32
+/* A linked git worktree is indexed as its OWN project, keyed by its checkout
+ * path. The SessionStart hook must return that project for a payload cwd inside
+ * the worktree (or a subdir of it) — never the main checkout's — and the main
+ * checkout's own resolution must be unchanged. Pins the payload-cwd → project
+ * resolution so a worktree can never regress to resolving a sibling checkout or
+ * to nothing (the historical silent-0-bytes worktree bug). */
+TEST(cli_hook_worktree_cwd_resolves_own_indexed_project) {
+    char tmpdir[256];
+    snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-hook-worktree-XXXXXX");
+    if (!cbm_mkdtemp(tmpdir))
+        FAIL("cbm_mkdtemp failed");
+    char cache[512];
+    char maindir[512];
+    char wtdir[512];
+    char subdir[600];
+    snprintf(cache, sizeof(cache), "%s/cache", tmpdir);
+    snprintf(maindir, sizeof(maindir), "%s/checkout-main", tmpdir);
+    snprintf(wtdir, sizeof(wtdir), "%s/checkout-side", tmpdir);
+    snprintf(subdir, sizeof(subdir), "%s/nested", wtdir);
+    test_mkdirp(cache);
+    test_mkdirp(maindir);
+
+    /* A real linked worktree so is_worktree/git_common_dir/canonical_root are
+     * exactly what the hook resolves against in the field. */
+    char cmd[2048];
+    snprintf(cmd, sizeof(cmd),
+             "cd \"%s\" && git init -q && git config user.email t@t && git config user.name t && "
+             ": > f.txt && git add f.txt && git commit -qm init && "
+             "git worktree add -q \"%s\" -b agl7branch",
+             maindir, wtdir);
+    if (system(cmd) != 0) {
+        test_rmdir_r(tmpdir);
+        FAIL("git worktree setup failed");
+    }
+    test_mkdirp(subdir);
+
+    /* Register each checkout as its own indexed project under the exact
+     * path-derived name the indexer uses (the db filename == that name). */
+    char *main_name = cbm_project_name_from_path(maindir);
+    char *wt_name = cbm_project_name_from_path(wtdir);
+    ASSERT_NOT_NULL(main_name);
+    ASSERT_NOT_NULL(wt_name);
+    ASSERT_STR_NEQ(main_name, wt_name);
+    char db_main[900];
+    char db_wt[900];
+    snprintf(db_main, sizeof(db_main), "%s/%s.db", cache, main_name);
+    snprintf(db_wt, sizeof(db_wt), "%s/%s.db", cache, wt_name);
+    cbm_store_t *sm = cbm_store_open_path(db_main);
+    ASSERT_NOT_NULL(sm);
+    ASSERT_EQ(cbm_store_upsert_project(sm, main_name, maindir), CBM_STORE_OK);
+    cbm_store_close(sm);
+    cbm_store_t *sw = cbm_store_open_path(db_wt);
+    ASSERT_NOT_NULL(sw);
+    ASSERT_EQ(cbm_store_upsert_project(sw, wt_name, wtdir), CBM_STORE_OK);
+    cbm_store_close(sw);
+
+    char *saved_cache = save_test_env("CBM_CACHE_DIR");
+    cbm_setenv("CBM_CACHE_DIR", cache, 1);
+
+    /* The two names share a prefix but diverge (checkout-main vs checkout-side),
+     * so a bare-name strstr for one never matches the other's context. */
+    char input[1024];
+    snprintf(input, sizeof(input), "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"%s\"}", wtdir);
+    char *wt_out = cbm_hook_augment_lifecycle_json(input);
+    bool wt_ok = wt_out && strstr(wt_out, wt_name) && strstr(wt_out, "is indexed") &&
+                 !strstr(wt_out, main_name);
+    free(wt_out);
+
+    snprintf(input, sizeof(input), "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"%s\"}", subdir);
+    char *sub_out = cbm_hook_augment_lifecycle_json(input);
+    bool sub_ok = sub_out && strstr(sub_out, wt_name) && strstr(sub_out, "is indexed");
+    free(sub_out);
+
+    snprintf(input, sizeof(input), "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"%s\"}",
+             maindir);
+    char *main_out = cbm_hook_augment_lifecycle_json(input);
+    bool main_ok = main_out && strstr(main_out, main_name) && strstr(main_out, "is indexed") &&
+                   !strstr(main_out, wt_name);
+    free(main_out);
+
+    restore_test_env("CBM_CACHE_DIR", saved_cache);
+    free(main_name);
+    free(wt_name);
+    snprintf(cmd, sizeof(cmd), "cd \"%s\" && git worktree remove --force \"%s\" >/dev/null 2>&1",
+             maindir, wtdir);
+    (void)system(cmd);
+    test_rmdir_r(tmpdir);
+
+    if (!wt_ok)
+        FAIL("worktree cwd must resolve the worktree's own indexed project");
+    if (!sub_ok)
+        FAIL("a subdir of the worktree must resolve the worktree's own project");
+    if (!main_ok)
+        FAIL("main-checkout resolution must be unchanged and not leak the worktree project");
+    PASS();
+}
+
+/* Completes the payload-cwd matrix (with the indexed-worktree test above and the
+ * deadline/logging contract in cli_hook_augment_deadline_breadcrumb_issue858): a
+ * linked worktree that was never indexed must yield a deliberate, non-empty "no
+ * project matched — run index_repository" notice, never a silent 0-byte reply
+ * that an agent cannot distinguish from "no matches". */
+TEST(cli_hook_unindexed_worktree_reports_no_match_not_silent) {
+    char tmpdir[256];
+    snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-hook-unindexed-wt-XXXXXX");
+    if (!cbm_mkdtemp(tmpdir))
+        FAIL("cbm_mkdtemp failed");
+    char cache[512];
+    char maindir[512];
+    char wtdir[512];
+    snprintf(cache, sizeof(cache), "%s/cache", tmpdir);
+    snprintf(maindir, sizeof(maindir), "%s/checkout-main", tmpdir);
+    snprintf(wtdir, sizeof(wtdir), "%s/checkout-side", tmpdir);
+    test_mkdirp(cache);
+    test_mkdirp(maindir);
+
+    char cmd[2048];
+    snprintf(cmd, sizeof(cmd),
+             "cd \"%s\" && git init -q && git config user.email t@t && git config user.name t && "
+             ": > f.txt && git add f.txt && git commit -qm init && "
+             "git worktree add -q \"%s\" -b agl7unindexed",
+             maindir, wtdir);
+    if (system(cmd) != 0) {
+        test_rmdir_r(tmpdir);
+        FAIL("git worktree setup failed");
+    }
+
+    /* Index ONLY the main checkout; the worktree is deliberately left out. */
+    char *main_name = cbm_project_name_from_path(maindir);
+    ASSERT_NOT_NULL(main_name);
+    char db_main[900];
+    snprintf(db_main, sizeof(db_main), "%s/%s.db", cache, main_name);
+    cbm_store_t *sm = cbm_store_open_path(db_main);
+    ASSERT_NOT_NULL(sm);
+    ASSERT_EQ(cbm_store_upsert_project(sm, main_name, maindir), CBM_STORE_OK);
+    cbm_store_close(sm);
+
+    char *saved_cache = save_test_env("CBM_CACHE_DIR");
+    cbm_setenv("CBM_CACHE_DIR", cache, 1);
+
+    char input[1024];
+    snprintf(input, sizeof(input), "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"%s\"}", wtdir);
+    char *wt_out = cbm_hook_augment_lifecycle_json(input);
+    bool deliberate = wt_out && wt_out[0] && strstr(wt_out, "no indexed graph project matched") &&
+                      !strstr(wt_out, "is indexed");
+    free(wt_out);
+
+    snprintf(input, sizeof(input), "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"%s\"}",
+             maindir);
+    char *main_out = cbm_hook_augment_lifecycle_json(input);
+    bool main_ok = main_out && strstr(main_out, main_name) && strstr(main_out, "is indexed");
+    free(main_out);
+
+    restore_test_env("CBM_CACHE_DIR", saved_cache);
+    free(main_name);
+    snprintf(cmd, sizeof(cmd), "cd \"%s\" && git worktree remove --force \"%s\" >/dev/null 2>&1",
+             maindir, wtdir);
+    (void)system(cmd);
+    test_rmdir_r(tmpdir);
+
+    if (!deliberate)
+        FAIL("unindexed worktree must get a deliberate no-match notice, never a silent 0 bytes");
+    if (!main_ok)
+        FAIL("the indexed main checkout must still resolve in the same matrix");
+    PASS();
+}
+#endif
+
 TEST(cli_hook_session_sanitizes_untrusted_project_metadata) {
     char tmpdir[256];
     snprintf(tmpdir, sizeof(tmpdir), "/tmp/cli-hook-untrusted-project-XXXXXX");
@@ -10671,7 +11877,7 @@ TEST(cli_codex_migrates_to_single_hook_representation) {
 #else
     snprintf(binary_path, sizeof(binary_path), "%s/codebase-memory-mcp", binary_dir);
 #endif
-    write_test_file(binary_path, "installed binary must survive failed cleanup\n");
+    write_test_file(binary_path, "installed binary goes even when a config cannot be cleaned\n");
 
     char *saved_home = save_test_env("HOME");
     char *saved_path = save_test_env("PATH");
@@ -10726,7 +11932,9 @@ TEST(cli_codex_migrates_to_single_hook_representation) {
     struct stat state;
     hooks = read_test_file_alloc(hooks_path);
     char *agents_after_uninstall = read_test_file_alloc(agents_path);
-    bool independent_cleanup = uninstall_rc != 0 && stat(binary_path, &state) == 0 &&
+    /* #1954: the ambiguous/foreign hook still fails the exit code, but the binary
+     * is removed anyway (uninstall is no longer held hostage by agent-config). */
+    bool independent_cleanup = uninstall_rc != 0 && stat(binary_path, &state) != 0 &&
                                stat(skill_path, &state) != 0 && stat(agent_path, &state) != 0 &&
                                hooks && !strstr(hooks, "hook-augment") && agents_after_uninstall &&
                                agents_after_uninstall[0] == '\0';
@@ -10761,8 +11969,7 @@ TEST(cli_codex_migrates_to_single_hook_representation) {
     restore_test_env("PATH", saved_path);
     restore_test_env("CODEX_HOME", saved_codex);
     test_rmdir_r(tmpdir);
-    if (!lifecycle_ok || !migrated || !independent_cleanup ||
-        !pointer_only_on_preflight_failure)
+    if (!lifecycle_ok || !migrated || !independent_cleanup || !pointer_only_on_preflight_failure)
         FAIL("Codex lifecycle preflight must be idempotent, preserve the activation pointer "
              "contract, and independently clean owned side files");
     PASS();
@@ -10802,8 +12009,7 @@ TEST(cli_codex_pointer_migration_precedes_hook_preflight_issue1689) {
         test_rmdir_r(tmpdir);
         FAIL("failed to build expected Codex pointer migration");
     }
-    if (write_test_file(config_path, ambiguous) != 0 ||
-        write_test_file(agents_path, legacy) != 0) {
+    if (write_test_file(config_path, ambiguous) != 0 || write_test_file(agents_path, legacy) != 0) {
         test_rmdir_r(tmpdir);
         FAIL("failed to write Codex cleanup preflight fixture");
     }
@@ -10826,14 +12032,13 @@ TEST(cli_codex_pointer_migration_precedes_hook_preflight_issue1689) {
                                 strcmp(config_after_plan, ambiguous) == 0 &&
                                 strcmp(agents_after_plan, legacy) == 0;
 
-    int install_rc =
-        cbm_install_agent_configs(tmpdir, "/opt/codebase-memory-mcp", false, false);
+    int install_rc = cbm_install_agent_configs(tmpdir, "/opt/codebase-memory-mcp", false, false);
     char *config_after_install = read_test_file_alloc(config_path);
     char *agents_after_install = read_test_file_alloc(agents_path);
     struct stat state;
-    bool preflight_failed_closed =
-        install_rc != 0 && config_after_install && strcmp(config_after_install, ambiguous) == 0 &&
-        stat(skill_path, &state) != 0 && stat(profile_path, &state) != 0;
+    bool preflight_failed_closed = install_rc != 0 && config_after_install &&
+                                   strcmp(config_after_install, ambiguous) == 0 &&
+                                   stat(skill_path, &state) != 0 && stat(profile_path, &state) != 0;
     bool pointer_migrated =
         agents_after_install && strcmp(agents_after_install, legacy_migrated) == 0;
 
@@ -14164,6 +15369,34 @@ TEST(cli_build_args_json_bare_boolean_issue680) {
     PASS();
 }
 
+/* An array-typed flag given a JSON array literal — the shape the help's
+ * `<array>` invites — contributes the literal's elements, not one element
+ * holding the literal text (2026-09-16 probe: check_index_coverage reported
+ * the fake path `["lib","t"]`). Repeated plain values still accumulate. */
+TEST(cli_build_args_json_array_flag_accepts_json_literal) {
+    char *err = NULL;
+    char *argv[] = {"--project", "p", "--paths", "[\"lib\",\"t\"]"};
+    char *json = cbm_cli_build_args_json("check_index_coverage", 4, argv, &err);
+    ASSERT_NOT_NULL(json);
+    ASSERT_NULL(err);
+    ASSERT(strstr(json, "\"paths\":[\"lib\",\"t\"]") != NULL);
+    free(json);
+
+    char *argv2[] = {"--project", "p", "--paths", "lib", "--paths", "t"};
+    json = cbm_cli_build_args_json("check_index_coverage", 6, argv2, &err);
+    ASSERT_NOT_NULL(json);
+    ASSERT(strstr(json, "\"paths\":[\"lib\",\"t\"]") != NULL);
+    free(json);
+
+    /* A value that merely starts with '[' but is not JSON stays one element. */
+    char *argv3[] = {"--project", "p", "--paths", "[weird"};
+    json = cbm_cli_build_args_json("check_index_coverage", 4, argv3, &err);
+    ASSERT_NOT_NULL(json);
+    ASSERT(strstr(json, "\"paths\":[\"[weird\"]") != NULL);
+    free(json);
+    PASS();
+}
+
 /* An unknown flag for a KNOWN tool must be rejected loudly, not silently
  * typed as a string and dropped server-side (#997). GF1 eval: `trace_path
  * --max-depth 1` was accepted, the real --depth stayed at default 3, and
@@ -14272,6 +15505,21 @@ TEST(cli_print_tool_help_issue680) {
     PASS();
 }
 
+/* #2102: top-level `cli --help` (CLI_USAGE) must point at tool-level
+ * `--format json` and distinguish it from outer `--json`. This is help-only:
+ * the usage synopsis still has no session-wide --format / CBM_CLI_FORMAT. */
+TEST(cli_usage_points_to_tool_format_json_issue2102) {
+    ASSERT_NOT_NULL(strstr(CBM_CLI_USAGE, "--format tree|json"));
+    ASSERT_NOT_NULL(strstr(CBM_CLI_USAGE, "payload JSON"));
+    ASSERT_NOT_NULL(strstr(CBM_CLI_USAGE, "full MCP envelope"));
+    ASSERT_NOT_NULL(strstr(CBM_CLI_USAGE, "--json      Print the raw MCP result envelope"));
+    ASSERT_NOT_NULL(strstr(CBM_CLI_USAGE, "cli [--quiet] [--progress] [--verbose] [--json] "
+                                          "<tool_name>"));
+    ASSERT_NULL(strstr(CBM_CLI_USAGE, "[--format"));
+    ASSERT_NULL(strstr(CBM_CLI_USAGE, "CBM_CLI_FORMAT"));
+    PASS();
+}
+
 /* #1359: `cli <tool>` with no argument-bearing token used to slurp stdin to EOF
  * for ANY non-terminal stdin. The ordinary automation caller never sends that
  * EOF — Node's child_process.spawn defaults to stdio:['pipe','pipe','pipe'] and
@@ -14931,11 +16179,16 @@ SUITE(cli) {
     RUN_TEST(cli_activation_cleanup_failure_fail_stops_before_lease_release);
     RUN_TEST(cli_activation_quiesce_does_not_wait_on_bootstrap_startup);
     RUN_TEST(cli_install_recovers_markerless_stale_rendezvous);
+    RUN_TEST(cli_install_skip_binary_into_foreign_home_never_drains_host_cohort);
+    RUN_TEST(cli_install_binary_into_foreign_home_never_drains_host_cohort);
+    RUN_TEST(cli_install_into_host_namespace_still_drains_host_cohort);
+    RUN_TEST(cli_install_skip_binary_unchanged_in_host_namespace_quiesces_nothing);
 #endif
     RUN_TEST(cli_install_force_quiesces_active_cohort_before_replacing_binary);
     RUN_TEST(cli_install_dir_and_skip_config_stage_first_install_safely);
     RUN_TEST(cli_activation_commands_reject_malformed_and_unknown_flags);
     RUN_TEST(cli_install_reset_deletion_waits_for_final_activation_guard);
+    RUN_TEST(cli_remove_indexes_deletes_orphan_sqlite_sidecars_issue2054);
     RUN_TEST(cli_install_config_only_waits_for_cohort_drain);
     RUN_TEST(cli_install_config_and_path_finish_before_guard_release);
     RUN_TEST(cli_install_config_failure_keeps_published_binary);
@@ -14950,6 +16203,10 @@ SUITE(cli) {
     RUN_TEST(cli_update_agent_configs_finish_before_guard_release);
     RUN_TEST(cli_uninstall_quiesces_active_cohort_before_removing_binary_and_index);
     RUN_TEST(cli_uninstall_preserves_binary_and_index_when_cohort_does_not_drain);
+#ifndef _WIN32
+    RUN_TEST(cli_uninstall_removes_binary_and_index_when_agent_config_cleanup_fails);
+    RUN_TEST(cli_uninstall_cleans_user_owned_symlinked_config);
+#endif
     RUN_TEST(cli_activation_guard_is_bypassed_for_dry_run_and_plan);
 #ifdef _WIN32
     RUN_TEST(cli_windows_update_hands_off_to_install_script);
@@ -15016,6 +16273,8 @@ SUITE(cli) {
     RUN_TEST(cli_openclaw_mcp_preserves_valid_json5);
     RUN_TEST(cli_openclaw_mcp_uninstall_uses_nested_servers);
     RUN_TEST(cli_openclaw_compaction_preserves_user_owned_section);
+    RUN_TEST(cli_openhands_registers_settings_mcp_config_and_profile_refs_issue1826);
+    RUN_TEST(cli_openhands_creates_settings_and_skips_missing_profiles_issue1826);
     RUN_TEST(cli_openclaw_profile_uses_profile_state_and_default_workspace);
     RUN_TEST(cli_openclaw_uninstall_removes_compaction_when_workspace_is_ambiguous);
 
@@ -15142,6 +16401,10 @@ SUITE(cli) {
     RUN_TEST(cli_augment_session_uses_workspace_roots);
     RUN_TEST(cli_hook_session_resolves_custom_named_index_by_root_path);
     RUN_TEST(cli_hook_session_exhausts_project_registry_pages);
+#ifndef _WIN32
+    RUN_TEST(cli_hook_worktree_cwd_resolves_own_indexed_project);
+    RUN_TEST(cli_hook_unindexed_worktree_reports_no_match_not_silent);
+#endif
     RUN_TEST(cli_hook_session_sanitizes_untrusted_project_metadata);
     RUN_TEST(cli_hook_ownership_requires_exact_command_identity);
     RUN_TEST(cli_gemini_hook_upgrade_migrates_released_exact_commands);
@@ -15294,12 +16557,14 @@ SUITE(cli) {
     RUN_TEST(cli_build_args_json_string_flag_issue680);
     RUN_TEST(cli_build_args_json_integer_flag_issue680);
     RUN_TEST(cli_build_args_json_bare_boolean_issue680);
+    RUN_TEST(cli_build_args_json_array_flag_accepts_json_literal);
     RUN_TEST(cli_build_args_json_unknown_flag_rejected);
     RUN_TEST(cli_build_args_json_repeated_array_issue680);
     RUN_TEST(cli_build_args_json_kebab_to_snake_issue680);
     RUN_TEST(cli_build_args_json_key_equals_value_issue680);
     RUN_TEST(cli_build_args_json_bad_positional_errors_issue680);
     RUN_TEST(cli_print_tool_help_issue680);
+    RUN_TEST(cli_usage_points_to_tool_format_json_issue2102);
 
     /* Stdin argument gate (#1359) */
     RUN_TEST(cli_zero_argument_tool_never_reads_stdin_issue1359);
diff --git a/tests/test_config_json_like.c b/tests/test_config_json_like.c
index c6f29a387..43f325e10 100644
--- a/tests/test_config_json_like.c
+++ b/tests/test_config_json_like.c
@@ -8,6 +8,8 @@
 
 #define CBM_JSON_LIKE_ENABLE_TEST_API 1
 #include "../src/cli/config_json_like.h"
+#define CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API 1
+#include "../src/cli/config_edit_path.h"
 #include "../src/foundation/compat.h"
 #include "../src/foundation/compat_fs.h"
 
@@ -281,7 +283,28 @@ TEST(config_json_like_rejects_non_regular_path) {
 }
 
 #ifndef _WIN32
-TEST(config_json_like_rejects_symlink_without_touching_target) {
+/* Any editor temp file left anywhere in the fixture directory, whatever
+ * document it was staged for: a link's target lives in the same directory. */
+static size_t jl_stray_temp_count(const jl_fixture_t *fixture) {
+    cbm_dir_t *directory = cbm_opendir(fixture->directory);
+    if (!directory) {
+        return SIZE_MAX;
+    }
+    size_t count = 0U;
+    cbm_dirent_t *entry = NULL;
+    while ((entry = cbm_readdir(directory)) != NULL) {
+        if (strstr(entry->name, ".cbm.tmp.")) {
+            count++;
+        }
+    }
+    cbm_closedir(directory);
+    return count;
+}
+
+/* A link owned by someone else is never followed. A test cannot create a
+ * foreign-owned link without root, so the observer moves instead (test seam):
+ * the refusal touches neither the link nor its target and stages no temp file. */
+TEST(config_json_like_rejects_foreign_owned_symlink_without_touching_target) {
     jl_fixture_t fixture;
     ASSERT_EQ(jl_fixture_open(&fixture), 0);
     char target[sizeof(fixture.path) + 32U];
@@ -289,9 +312,18 @@ TEST(config_json_like_rejects_symlink_without_touching_target) {
     const char *original = "{\"target\":true}\n";
     ASSERT_EQ(jl_write(target, original), 0);
     ASSERT_EQ(symlink(target, fixture.path), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.directory), 0);
+    cbm_config_edit_path_set_invoking_uid_for_test((unsigned)geteuid() + 1U, 1);
 
     const char *root[] = {NULL};
-    ASSERT_EQ(cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true"), -1);
+    int upsert_rc = cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true");
+    char reason[256];
+    int refused = cbm_config_edit_path_refusal(fixture.path, reason, sizeof(reason));
+    cbm_config_edit_path_set_invoking_uid_for_test(0U, 0);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(upsert_rc, -1);
+    ASSERT_EQ(refused, 1);
+    ASSERT_NOT_NULL(strstr(reason, "not the invoking user"));
     struct stat link_state;
     ASSERT_EQ(lstat(fixture.path, &link_state), 0);
     ASSERT(S_ISLNK(link_state.st_mode));
@@ -299,7 +331,7 @@ TEST(config_json_like_rejects_symlink_without_touching_target) {
     ASSERT_NOT_NULL(content);
     ASSERT_STR_EQ(content, original);
     free(content);
-    ASSERT_EQ(jl_temp_file_count(&fixture), 0U);
+    ASSERT_EQ(jl_stray_temp_count(&fixture), 0U);
 
     ASSERT_EQ(cbm_unlink(fixture.path), 0);
     ASSERT_EQ(cbm_unlink(target), 0);
@@ -307,6 +339,350 @@ TEST(config_json_like_rejects_symlink_without_touching_target) {
     PASS();
 }
 
+/* A root process never follows a link a non-root user owns: a user-planted
+ * link must not redirect a privileged writer. A real root run (CI containers)
+ * demotes the link to an unprivileged owner first; elsewhere the observer moves. */
+TEST(config_json_like_root_refuses_user_owned_symlink) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    char target[sizeof(fixture.path) + 32U];
+    ASSERT(snprintf(target, sizeof(target), "%s/target.json", fixture.directory) > 0);
+    const char *original = "{\"target\":true}\n";
+    ASSERT_EQ(jl_write(target, original), 0);
+    ASSERT_EQ(symlink(target, fixture.path), 0);
+    if (geteuid() == 0 && lchown(fixture.path, 65534, 65534) != 0) {
+        (void)cbm_unlink(fixture.path);
+        (void)cbm_unlink(target);
+        jl_fixture_close(&fixture);
+        FAIL("lchown to an unprivileged owner failed");
+    }
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.directory), 0);
+    cbm_config_edit_path_set_invoking_uid_for_test(0U, 1);
+
+    const char *root[] = {NULL};
+    int upsert_rc = cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true");
+    char reason[256];
+    int refused = cbm_config_edit_path_refusal(fixture.path, reason, sizeof(reason));
+    cbm_config_edit_path_set_invoking_uid_for_test(0U, 0);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(upsert_rc, -1);
+    ASSERT_EQ(refused, 1);
+    ASSERT_NOT_NULL(strstr(reason, "root process"));
+    struct stat link_state;
+    ASSERT_EQ(lstat(fixture.path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    char *content = jl_read(target);
+    ASSERT_NOT_NULL(content);
+    ASSERT_STR_EQ(content, original);
+    free(content);
+    ASSERT_EQ(jl_stray_temp_count(&fixture), 0U);
+
+    ASSERT_EQ(cbm_unlink(fixture.path), 0);
+    ASSERT_EQ(cbm_unlink(target), 0);
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
+TEST(config_json_like_refuses_dangling_symlink) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    char missing[sizeof(fixture.path) + 32U];
+    ASSERT(snprintf(missing, sizeof(missing), "%s/missing.json", fixture.directory) > 0);
+    ASSERT_EQ(symlink(missing, fixture.path), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.directory), 0);
+
+    const char *root[] = {NULL};
+    int upsert_rc = cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true");
+    char *document = NULL;
+    size_t length = 0U;
+    int read_rc = cbm_json_like_read_document(fixture.path, &document, &length);
+    free(document);
+    char reason[256];
+    int refused = cbm_config_edit_path_refusal(fixture.path, reason, sizeof(reason));
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(upsert_rc, -1);
+    ASSERT_EQ(read_rc, -1);
+    ASSERT_EQ(refused, 1);
+    ASSERT_NOT_NULL(strstr(reason, "dangling"));
+    struct stat state;
+    ASSERT_EQ(lstat(fixture.path, &state), 0);
+    ASSERT(S_ISLNK(state.st_mode));
+    ASSERT(lstat(missing, &state) != 0);
+    ASSERT_EQ(jl_stray_temp_count(&fixture), 0U);
+
+    ASSERT_EQ(cbm_unlink(fixture.path), 0);
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
+TEST(config_json_like_refuses_symlink_to_directory) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    char sub[sizeof(fixture.path) + 32U];
+    ASSERT(snprintf(sub, sizeof(sub), "%s/sub", fixture.directory) > 0);
+    ASSERT_EQ(cbm_mkdir(sub), 0);
+    ASSERT_EQ(symlink(sub, fixture.path), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.directory), 0);
+
+    const char *root[] = {NULL};
+    int upsert_rc = cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true");
+    char reason[256];
+    int refused = cbm_config_edit_path_refusal(fixture.path, reason, sizeof(reason));
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(upsert_rc, -1);
+    ASSERT_EQ(refused, 1);
+    ASSERT_NOT_NULL(strstr(reason, "directory"));
+    struct stat state;
+    ASSERT_EQ(lstat(fixture.path, &state), 0);
+    ASSERT(S_ISLNK(state.st_mode));
+    ASSERT_EQ(jl_stray_temp_count(&fixture), 0U);
+
+    ASSERT_EQ(cbm_unlink(fixture.path), 0);
+    ASSERT_EQ(cbm_rmdir(sub), 0);
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
+/* Without the agent-config writers' opt-in, a same-owner link is still
+ * refused: the follow is never a property of every editor caller. */
+TEST(config_json_like_refuses_symlink_without_opt_in) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    char target[sizeof(fixture.path) + 32U];
+    ASSERT(snprintf(target, sizeof(target), "%s/target.json", fixture.directory) > 0);
+    const char *original = "{\"target\":true}\n";
+    ASSERT_EQ(jl_write(target, original), 0);
+    ASSERT_EQ(symlink(target, fixture.path), 0);
+    cbm_config_edit_path_follow_clear();
+
+    const char *root[] = {NULL};
+    ASSERT_EQ(cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true"), -1);
+    char reason[256];
+    ASSERT_EQ(cbm_config_edit_path_refusal(fixture.path, reason, sizeof(reason)), 1);
+    ASSERT_NOT_NULL(strstr(reason, "not followed by this command"));
+
+    /* An opt-in for a different root does not cover this link either. */
+    char elsewhere[sizeof(fixture.path) + 32U];
+    ASSERT(snprintf(elsewhere, sizeof(elsewhere), "%s/elsewhere", fixture.directory) > 0);
+    ASSERT_EQ(cbm_mkdir(elsewhere), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(elsewhere), 0);
+    int outside_rc = cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true");
+    int outside_refused = cbm_config_edit_path_refusal(fixture.path, reason, sizeof(reason));
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(outside_rc, -1);
+    ASSERT_EQ(outside_refused, 1);
+    ASSERT_NOT_NULL(strstr(reason, "outside the opted-in configuration roots"));
+
+    struct stat link_state;
+    ASSERT_EQ(lstat(fixture.path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    char *content = jl_read(target);
+    ASSERT_NOT_NULL(content);
+    ASSERT_STR_EQ(content, original);
+    free(content);
+    ASSERT_EQ(jl_stray_temp_count(&fixture), 0U);
+
+    ASSERT_EQ(cbm_rmdir(elsewhere), 0);
+    ASSERT_EQ(cbm_unlink(fixture.path), 0);
+    ASSERT_EQ(cbm_unlink(target), 0);
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
+/* The validated descriptor must be the very file stat(realpath) saw: a
+ * target swapped between the two checks (seam) is refused, untouched. */
+TEST(config_json_like_refuses_symlink_when_target_identity_skews) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    char target[sizeof(fixture.path) + 32U];
+    ASSERT(snprintf(target, sizeof(target), "%s/target.json", fixture.directory) > 0);
+    const char *original = "{\"target\":true}\n";
+    ASSERT_EQ(jl_write(target, original), 0);
+    ASSERT_EQ(symlink(target, fixture.path), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.directory), 0);
+    cbm_config_edit_path_set_identity_skew_for_test(1);
+
+    const char *root[] = {NULL};
+    int upsert_rc = cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true");
+    char reason[256];
+    int refused = cbm_config_edit_path_refusal(fixture.path, reason, sizeof(reason));
+    cbm_config_edit_path_set_identity_skew_for_test(0);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(upsert_rc, -1);
+    ASSERT_EQ(refused, 1);
+    ASSERT_NOT_NULL(strstr(reason, "changed while it was being checked"));
+    char *content = jl_read(target);
+    ASSERT_NOT_NULL(content);
+    ASSERT_STR_EQ(content, original);
+    free(content);
+    ASSERT_EQ(jl_stray_temp_count(&fixture), 0U);
+
+    ASSERT_EQ(cbm_unlink(fixture.path), 0);
+    ASSERT_EQ(cbm_unlink(target), 0);
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
+/* The target's parent directory is pinned and must not be writable by others
+ * (a sticky directory is fine): otherwise anyone could stage a swap there. */
+TEST(config_json_like_refuses_symlink_with_world_writable_parent) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    char dotfiles[sizeof(fixture.path) + 32U];
+    char target[sizeof(fixture.path) + 64U];
+    ASSERT(snprintf(dotfiles, sizeof(dotfiles), "%s/dotfiles", fixture.directory) > 0);
+    ASSERT(snprintf(target, sizeof(target), "%s/target.json", dotfiles) > 0);
+    ASSERT_EQ(cbm_mkdir(dotfiles), 0);
+    const char *original = "{\"target\":true}\n";
+    ASSERT_EQ(jl_write(target, original), 0);
+    ASSERT_EQ(symlink(target, fixture.path), 0);
+    ASSERT_EQ(chmod(dotfiles, 0777), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.directory), 0);
+
+    const char *root[] = {NULL};
+    int loose_rc = cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true");
+    char reason[256];
+    int loose_refused = cbm_config_edit_path_refusal(fixture.path, reason, sizeof(reason));
+    ASSERT_EQ(chmod(dotfiles, 0755), 0);
+    int tight_rc = cbm_json_like_upsert_entry(fixture.path, root, 0U, "owned", "true");
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(loose_rc, -1);
+    ASSERT_EQ(loose_refused, 1);
+    ASSERT_NOT_NULL(strstr(reason, "writable by others"));
+    ASSERT_EQ(tight_rc, 0);
+    char *content = jl_read(target);
+    ASSERT_NOT_NULL(content);
+    ASSERT_NOT_NULL(strstr(content, "\"owned\""));
+    free(content);
+
+    ASSERT_EQ(cbm_unlink(fixture.path), 0);
+    ASSERT_EQ(cbm_unlink(target), 0);
+    ASSERT_EQ(cbm_rmdir(dotfiles), 0);
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
+typedef struct {
+    char seen_path[640];
+    size_t temps_beside_target;
+    size_t calls;
+} jl_follow_hook_state_t;
+
+/* Pre-commit hook: the editor hands over the path it is about to publish —
+ * for a followed link that must be the RESOLVED target, with the staged
+ * temp file sitting right beside it, never beside the link. */
+static void jl_follow_precommit_hook(const char *path, void *context) {
+    jl_follow_hook_state_t *state = context;
+    state->calls++;
+    (void)snprintf(state->seen_path, sizeof(state->seen_path), "%s", path);
+    char directory[640];
+    (void)snprintf(directory, sizeof(directory), "%s", path);
+    char *slash = strrchr(directory, '/');
+    if (!slash) {
+        return;
+    }
+    const char *base = slash + 1;
+    char prefix[320];
+    (void)snprintf(prefix, sizeof(prefix), "%s.cbm.tmp.", base);
+    *slash = '\0';
+    cbm_dir_t *handle = cbm_opendir(directory);
+    if (!handle) {
+        return;
+    }
+    cbm_dirent_t *entry = NULL;
+    while ((entry = cbm_readdir(handle)) != NULL) {
+        if (strncmp(entry->name, prefix, strlen(prefix)) == 0) {
+            state->temps_beside_target++;
+        }
+    }
+    cbm_closedir(handle);
+}
+
+/* Decision C (#1954): a symlink the invoking user owns, pointing at a regular
+ * file the same user owns, is edited THROUGH once the writer opted in — the
+ * link survives and still points at the same target, the temp file is staged
+ * beside the target, and every edit is byte-identical to the same edit on a
+ * plain file. */
+TEST(config_json_like_follows_user_owned_symlink_in_place) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    char target[sizeof(fixture.path) + 32U];
+    char control[sizeof(fixture.path) + 32U];
+    ASSERT(snprintf(target, sizeof(target), "%s/target.json", fixture.directory) > 0);
+    ASSERT(snprintf(control, sizeof(control), "%s/control.json", fixture.directory) > 0);
+    const char *original = "{\n  // dotfiles\n  \"mcpServers\": {\n"
+                           "    \"keep\": {\"command\": \"x\"}\n  }\n}\n";
+    ASSERT_EQ(jl_write(target, original), 0);
+    ASSERT_EQ(jl_write(control, original), 0);
+    /* Relative, the way a dotfiles checkout links its files. */
+    ASSERT_EQ(symlink("target.json", fixture.path), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.directory), 0);
+    char target_real[CBM_CONFIG_EDIT_PATH_MAX];
+    ASSERT_EQ(cbm_canonical_path(target, target_real, sizeof(target_real)), 1);
+    jl_follow_hook_state_t hook_state = {0};
+    cbm_json_like_set_precommit_hook_for_testing(jl_follow_precommit_hook, &hook_state);
+
+    const char *path[] = {"mcpServers"};
+    int through_rc =
+        cbm_json_like_upsert_entry(fixture.path, path, 1U, "owned", "{\"command\":\"y\"}");
+    cbm_json_like_set_precommit_hook_for_testing(NULL, NULL);
+    int plain_rc = cbm_json_like_upsert_entry(control, path, 1U, "owned", "{\"command\":\"y\"}");
+    if (through_rc != 0 || plain_rc != 0) {
+        cbm_config_edit_path_follow_clear();
+    }
+    ASSERT_EQ(through_rc, 0);
+    ASSERT_EQ(plain_rc, 0);
+    ASSERT_EQ(hook_state.calls, 1U);
+    ASSERT_STR_EQ(hook_state.seen_path, target_real);
+    ASSERT_EQ(hook_state.temps_beside_target, 1U);
+    struct stat link_state;
+    ASSERT_EQ(lstat(fixture.path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    char link_value[256] = {0};
+    ASSERT(readlink(fixture.path, link_value, sizeof(link_value) - 1U) > 0);
+    ASSERT_STR_EQ(link_value, "target.json");
+    char *through = jl_read(target);
+    char *plain = jl_read(control);
+    ASSERT_NOT_NULL(through);
+    ASSERT_NOT_NULL(plain);
+    ASSERT_STR_EQ(through, plain);
+    ASSERT_NOT_NULL(strstr(through, "\"owned\""));
+    ASSERT_NOT_NULL(strstr(through, "// dotfiles"));
+
+    /* Reading through the link sees the target, and the compare-and-remove
+     * form uninstall relies on works through the link as well. */
+    char *document = NULL;
+    size_t length = 0U;
+    ASSERT_EQ(cbm_json_like_read_document(fixture.path, &document, &length), 0);
+    ASSERT_NOT_NULL(document);
+    ASSERT_STR_EQ(document, through);
+    ASSERT_EQ(
+        cbm_json_like_remove_entry_if_unchanged(fixture.path, path, 1U, "owned", document, length),
+        0);
+    ASSERT_EQ(cbm_json_like_remove_entry(control, path, 1U, "owned"), 0);
+    free(document);
+    free(through);
+    free(plain);
+    through = jl_read(target);
+    plain = jl_read(control);
+    ASSERT_NOT_NULL(through);
+    ASSERT_NOT_NULL(plain);
+    ASSERT_STR_EQ(through, plain);
+    ASSERT_NULL(strstr(through, "\"owned\""));
+    free(through);
+    free(plain);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(lstat(fixture.path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    ASSERT_EQ(jl_stray_temp_count(&fixture), 0U);
+
+    ASSERT_EQ(cbm_unlink(fixture.path), 0);
+    ASSERT_EQ(cbm_unlink(target), 0);
+    ASSERT_EQ(cbm_unlink(control), 0);
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
 TEST(config_json_like_rejects_hard_link_without_splitting_identity) {
     jl_fixture_t fixture;
     ASSERT_EQ(jl_fixture_open(&fixture), 0);
@@ -671,6 +1047,176 @@ TEST(config_json_like_top_level_array_unique_string) {
     PASS();
 }
 
+/* OpenHands profiles ship `"mcp_server_refs": null` (#1826). A null value is
+ * the documented "no list yet" shape, so adding a unique string must replace
+ * exactly that token with a one-element array, preserving everything around
+ * it, and stay idempotent. Removal leaves the minimal edit: an empty array. */
+TEST(config_json_like_array_add_replaces_null_value_issue1826) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    const char *original = "{\n"
+                           "  \"name\": \"default\",\n"
+                           "  \"mcp_server_refs\": null, // keep this user comment\n"
+                           "  \"tools\": [\"bash\"]\n"
+                           "}\n";
+    ASSERT_EQ(jl_write(fixture.path, original), 0);
+    ASSERT_EQ(
+        cbm_json_like_add_unique_string(fixture.path, "mcp_server_refs", "codebase-memory-mcp"), 0);
+    char *first = jl_read(fixture.path);
+    ASSERT_NOT_NULL(first);
+    ASSERT_STR_EQ(first,
+                  "{\n"
+                  "  \"name\": \"default\",\n"
+                  "  \"mcp_server_refs\": [\"codebase-memory-mcp\"], // keep this user comment\n"
+                  "  \"tools\": [\"bash\"]\n"
+                  "}\n");
+
+    ASSERT_EQ(
+        cbm_json_like_add_unique_string(fixture.path, "mcp_server_refs", "codebase-memory-mcp"), 0);
+    char *second = jl_read(fixture.path);
+    ASSERT_NOT_NULL(second);
+    ASSERT_STR_EQ(second, first);
+    free(first);
+    free(second);
+
+    ASSERT_EQ(cbm_json_like_remove_string(fixture.path, "mcp_server_refs", "codebase-memory-mcp"),
+              0);
+    char *removed = jl_read(fixture.path);
+    ASSERT_NOT_NULL(removed);
+    ASSERT_STR_EQ(removed, "{\n"
+                           "  \"name\": \"default\",\n"
+                           "  \"mcp_server_refs\": [], // keep this user comment\n"
+                           "  \"tools\": [\"bash\"]\n"
+                           "}\n");
+    free(removed);
+
+    /* Only the literal null converts; any other non-array value still fails
+     * closed byte-identically. */
+    const char *wrong_type = "{\"mcp_server_refs\": \"null\", \"keep\": true}\n";
+    ASSERT_EQ(jl_write(fixture.path, wrong_type), 0);
+    ASSERT_EQ(cbm_json_like_add_unique_string(fixture.path, "mcp_server_refs", "x"), -1);
+    char *content = jl_read(fixture.path);
+    ASSERT_NOT_NULL(content);
+    ASSERT_STR_EQ(content, wrong_type);
+    free(content);
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
+/* The OpenHands settings entry carries `enabled: true` (#1826). A literal shape
+ * lets ownership matching require that token exactly, so uninstall recognises
+ * our own entry instead of treating the boolean as a foreign annotation. */
+static int jl_match_openhands_entry(const char *document,
+                                    const cbm_json_like_object_field_t *fields, size_t field_count,
+                                    char **captured) {
+    static const char *const path[] = {"mcp_config"};
+    return cbm_json_like_match_object_entry(document, strlen(document), path, 1U,
+                                            "codebase-memory-mcp", fields, field_count, captured);
+}
+
+TEST(config_json_like_match_object_entry_literal_shape_issue1826) {
+    const cbm_json_like_object_field_t fields[] = {
+        {.key = "command",
+         .shape = CBM_JSON_LIKE_VALUE_STRING,
+         .expected_string = NULL,
+         .flags = CBM_JSON_LIKE_FIELD_REQUIRED | CBM_JSON_LIKE_FIELD_CAPTURE_STRING},
+        {.key = "transport",
+         .shape = CBM_JSON_LIKE_VALUE_STRING,
+         .expected_string = "stdio",
+         .flags = CBM_JSON_LIKE_FIELD_REQUIRED},
+        {.key = "enabled",
+         .shape = CBM_JSON_LIKE_VALUE_LITERAL,
+         .expected_string = "true",
+         .flags = CBM_JSON_LIKE_FIELD_REQUIRED},
+    };
+    char *captured = NULL;
+    const char *ours = "{\"mcp_config\": {\"codebase-memory-mcp\": {\"transport\": \"stdio\", "
+                       "\"command\": \"/x/cbm\", \"enabled\": true}}}\n";
+    ASSERT_EQ(jl_match_openhands_entry(ours, fields, 3U, &captured), CBM_JSON_LIKE_OBJECT_MATCH);
+    ASSERT_NOT_NULL(captured);
+    ASSERT_STR_EQ(captured, "/x/cbm");
+    free(captured);
+
+    /* Trivia around the token is not part of the value. */
+    const char *spaced = "{\"mcp_config\": {\"codebase-memory-mcp\": {\"transport\": \"stdio\", "
+                         "\"command\": \"/x/cbm\", \"enabled\" :  true /* on */ }}}\n";
+    ASSERT_EQ(jl_match_openhands_entry(spaced, fields, 3U, &captured), CBM_JSON_LIKE_OBJECT_MATCH);
+    free(captured);
+
+    const char *disabled = "{\"mcp_config\": {\"codebase-memory-mcp\": {\"transport\": \"stdio\", "
+                           "\"command\": \"/x/cbm\", \"enabled\": false}}}\n";
+    ASSERT_EQ(jl_match_openhands_entry(disabled, fields, 3U, &captured),
+              CBM_JSON_LIKE_OBJECT_MISMATCH);
+    ASSERT_NULL(captured);
+
+    const char *quoted = "{\"mcp_config\": {\"codebase-memory-mcp\": {\"transport\": \"stdio\", "
+                         "\"command\": \"/x/cbm\", \"enabled\": \"true\"}}}\n";
+    ASSERT_EQ(jl_match_openhands_entry(quoted, fields, 3U, &captured),
+              CBM_JSON_LIKE_OBJECT_MISMATCH);
+    ASSERT_NULL(captured);
+
+    const char *missing = "{\"mcp_config\": {\"codebase-memory-mcp\": {\"transport\": \"stdio\", "
+                          "\"command\": \"/x/cbm\"}}}\n";
+    ASSERT_EQ(jl_match_openhands_entry(missing, fields, 3U, &captured),
+              CBM_JSON_LIKE_OBJECT_MISMATCH);
+    ASSERT_NULL(captured);
+
+    /* A literal field can neither lack its token nor be captured. */
+    const cbm_json_like_object_field_t no_token[] = {
+        fields[0],
+        {.key = "enabled",
+         .shape = CBM_JSON_LIKE_VALUE_LITERAL,
+         .expected_string = NULL,
+         .flags = CBM_JSON_LIKE_FIELD_REQUIRED},
+    };
+    ASSERT_EQ(jl_match_openhands_entry(ours, no_token, 2U, &captured), -1);
+    const cbm_json_like_object_field_t captured_literal[] = {
+        {.key = "enabled",
+         .shape = CBM_JSON_LIKE_VALUE_LITERAL,
+         .expected_string = "true",
+         .flags = CBM_JSON_LIKE_FIELD_REQUIRED | CBM_JSON_LIKE_FIELD_CAPTURE_STRING},
+    };
+    ASSERT_EQ(jl_match_openhands_entry(ours, captured_literal, 1U, &captured), -1);
+    PASS();
+}
+
+/* An OpenHands profile with an existing single-line list (#1826): the added
+ * name follows the list's own spacing, and removing it again restores the
+ * original bytes exactly — no stray space before the closing bracket. */
+static bool jl_round_trips(jl_fixture_t *fixture, const char *original, const char *expected) {
+    if (jl_write(fixture->path, original) != 0 ||
+        cbm_json_like_add_unique_string(fixture->path, "mcp_server_refs", "codebase-memory-mcp") !=
+            0) {
+        return false;
+    }
+    char *added = jl_read(fixture->path);
+    bool ok = added && strcmp(added, expected) == 0;
+    free(added);
+    if (!ok ||
+        cbm_json_like_remove_string(fixture->path, "mcp_server_refs", "codebase-memory-mcp") != 0) {
+        return false;
+    }
+    char *restored = jl_read(fixture->path);
+    ok = restored && strcmp(restored, original) == 0;
+    free(restored);
+    return ok;
+}
+
+TEST(config_json_like_single_line_array_round_trips_byte_for_byte_issue1826) {
+    jl_fixture_t fixture;
+    ASSERT_EQ(jl_fixture_open(&fixture), 0);
+    ASSERT_TRUE(jl_round_trips(
+        &fixture, "{\"name\": \"custom\", \"mcp_server_refs\": [\"other-mcp\"]}\n",
+        "{\"name\": \"custom\", \"mcp_server_refs\": [\"other-mcp\", \"codebase-memory-mcp\"]}\n"));
+    ASSERT_TRUE(
+        jl_round_trips(&fixture, "{ \"mcp_server_refs\": [ \"other-mcp\" ] }\n",
+                       "{ \"mcp_server_refs\": [ \"other-mcp\", \"codebase-memory-mcp\" ] }\n"));
+    ASSERT_TRUE(jl_round_trips(&fixture, "{\"mcp_server_refs\": [ ]}\n",
+                               "{\"mcp_server_refs\": [ \"codebase-memory-mcp\" ]}\n"));
+    jl_fixture_close(&fixture);
+    PASS();
+}
+
 TEST(config_json_like_top_level_array_create_escape_and_fail_closed) {
     jl_fixture_t fixture;
     ASSERT_EQ(jl_fixture_open(&fixture), 0);
@@ -853,7 +1399,7 @@ TEST(config_json_like_nested_array_fails_closed_on_ambiguous_or_invalid_paths) {
 }
 
 #ifndef _WIN32
-TEST(config_json_like_nested_array_rejects_symlink_and_hardlink) {
+TEST(config_json_like_nested_array_rejects_foreign_symlink_and_hardlink) {
     jl_fixture_t fixture;
     ASSERT_EQ(jl_fixture_open(&fixture), 0);
     const char *path[] = {"options"};
@@ -862,12 +1408,18 @@ TEST(config_json_like_nested_array_rejects_symlink_and_hardlink) {
     ASSERT(snprintf(target, sizeof(target), "%s/target.json", fixture.directory) > 0);
     ASSERT_EQ(jl_write(target, original), 0);
     ASSERT_EQ(symlink(target, fixture.path), 0);
-    ASSERT_EQ(
-        cbm_json_like_add_unique_string_at_path(fixture.path, path, 1U, "context_paths", "owned"),
-        -1);
+    /* Foreign-owned link (observer moved by the test seam): still refused. */
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.directory), 0);
+    cbm_config_edit_path_set_invoking_uid_for_test((unsigned)geteuid() + 1U, 1);
+    int add_rc =
+        cbm_json_like_add_unique_string_at_path(fixture.path, path, 1U, "context_paths", "owned");
     char *workspace = (char *)(uintptr_t)1U;
-    ASSERT_EQ(cbm_json_like_get_string_at_path(fixture.path, path, 1U, "context_paths", &workspace),
-              -1);
+    int get_rc =
+        cbm_json_like_get_string_at_path(fixture.path, path, 1U, "context_paths", &workspace);
+    cbm_config_edit_path_set_invoking_uid_for_test(0U, 0);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(add_rc, -1);
+    ASSERT_EQ(get_rc, -1);
     ASSERT_NULL(workspace);
     char *content = jl_read(target);
     ASSERT_NOT_NULL(content);
@@ -1007,7 +1559,14 @@ SUITE(config_json_like) {
     RUN_TEST(config_json_like_existing_target_swap_after_check_preserves_winner);
     RUN_TEST(config_json_like_rejects_non_regular_path);
 #ifndef _WIN32
-    RUN_TEST(config_json_like_rejects_symlink_without_touching_target);
+    RUN_TEST(config_json_like_rejects_foreign_owned_symlink_without_touching_target);
+    RUN_TEST(config_json_like_root_refuses_user_owned_symlink);
+    RUN_TEST(config_json_like_refuses_dangling_symlink);
+    RUN_TEST(config_json_like_refuses_symlink_to_directory);
+    RUN_TEST(config_json_like_refuses_symlink_without_opt_in);
+    RUN_TEST(config_json_like_refuses_symlink_when_target_identity_skews);
+    RUN_TEST(config_json_like_refuses_symlink_with_world_writable_parent);
+    RUN_TEST(config_json_like_follows_user_owned_symlink_in_place);
     RUN_TEST(config_json_like_rejects_hard_link_without_splitting_identity);
     RUN_TEST(config_json_like_preserves_owner_group_and_mode);
 #endif
@@ -1025,12 +1584,15 @@ SUITE(config_json_like) {
     RUN_TEST(config_json_like_removes_first_middle_last_and_only);
     RUN_TEST(config_json_like_removal_preserves_comments_and_siblings);
     RUN_TEST(config_json_like_top_level_array_unique_string);
+    RUN_TEST(config_json_like_array_add_replaces_null_value_issue1826);
+    RUN_TEST(config_json_like_match_object_entry_literal_shape_issue1826);
+    RUN_TEST(config_json_like_single_line_array_round_trips_byte_for_byte_issue1826);
     RUN_TEST(config_json_like_top_level_array_create_escape_and_fail_closed);
     RUN_TEST(config_json_like_nested_array_creates_missing_path_and_escapes);
     RUN_TEST(config_json_like_nested_array_preserves_jsonc_and_is_idempotent);
     RUN_TEST(config_json_like_nested_array_fails_closed_on_ambiguous_or_invalid_paths);
 #ifndef _WIN32
-    RUN_TEST(config_json_like_nested_array_rejects_symlink_and_hardlink);
+    RUN_TEST(config_json_like_nested_array_rejects_foreign_symlink_and_hardlink);
 #endif
     RUN_TEST(config_json_like_nested_array_rejects_precommit_content_and_identity_races);
     RUN_TEST(config_json_like_nested_string_lookup_decodes_json5_workspace);
diff --git a/tests/test_config_text_edit.c b/tests/test_config_text_edit.c
index 47135be84..4ce474853 100644
--- a/tests/test_config_text_edit.c
+++ b/tests/test_config_text_edit.c
@@ -2,6 +2,8 @@
  * test_config_text_edit.c — Hardened managed-text editor contracts.
  */
 #include "../src/cli/config_text_edit.h"
+#define CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API 1
+#include "../src/cli/config_edit_path.h"
 #include "test_framework.h"
 #include "test_helpers.h"
 
@@ -384,8 +386,16 @@ TEST(config_text_rejects_links_privileged_mode_and_preserves_metadata) {
     ASSERT(snprintf(alias, sizeof(alias), "%s/alias.md", dir) > 0);
     ASSERT_EQ(th_write_file(target, "target\n"), 0);
     ASSERT_EQ(symlink(target, path), 0);
-    ASSERT_EQ(cbm_text_write_owned_document(path, "owned\n"), -1);
-    ASSERT_EQ(cbm_text_migrate_owned_document_mode(path, "owned\n", NULL, 0U, 0755U), -1);
+    /* Foreign-owned link (observer moved by the test seam): still refused. */
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(dir), 0);
+    cbm_config_edit_path_set_invoking_uid_for_test((unsigned)geteuid() + 1U, 1);
+    int foreign_write_rc = cbm_text_write_owned_document(path, "owned\n");
+    int foreign_migrate_rc = cbm_text_migrate_owned_document_mode(path, "owned\n", NULL, 0U, 0755U);
+    cbm_config_edit_path_set_invoking_uid_for_test(0U, 0);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(foreign_write_rc, -1);
+    ASSERT_EQ(foreign_migrate_rc, -1);
+    ASSERT(cte_assert_bytes(target, "target\n", strlen("target\n")));
     ASSERT_EQ(cbm_unlink(path), 0);
 
     ASSERT_EQ(th_write_file(path, "shared\n"), 0);
@@ -414,6 +424,65 @@ TEST(config_text_rejects_links_privileged_mode_and_preserves_metadata) {
     PASS();
 }
 
+/* Decision C (#1954): a managed block behind a user-owned symlink is edited
+ * through the link — the link survives and the target carries the same bytes
+ * the same edit produces on a plain file. */
+TEST(config_text_follows_user_owned_symlink_in_place) {
+    char dir[CTE_PATH_CAP];
+    char path[CTE_PATH_CAP];
+    char target[CTE_PATH_CAP];
+    char control[CTE_PATH_CAP];
+    ASSERT_EQ(cte_fixture(dir, sizeof(dir), path, sizeof(path)), 0);
+    ASSERT(snprintf(target, sizeof(target), "%s/target.md", dir) > 0);
+    ASSERT(snprintf(control, sizeof(control), "%s/control.md", dir) > 0);
+    ASSERT_EQ(th_write_file(target, "# user notes\n"), 0);
+    ASSERT_EQ(th_write_file(control, "# user notes\n"), 0);
+    ASSERT_EQ(symlink("target.md", path), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(dir), 0);
+
+    int through_rc = cbm_text_upsert_managed_block(path, CTE_BEGIN, CTE_END, "owned");
+    int plain_rc = cbm_text_upsert_managed_block(control, CTE_BEGIN, CTE_END, "owned");
+    if (through_rc != 0 || plain_rc != 0) {
+        cbm_config_edit_path_follow_clear();
+    }
+    ASSERT_EQ(through_rc, 0);
+    ASSERT_EQ(plain_rc, 0);
+    struct stat link_state;
+    ASSERT_EQ(lstat(path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    size_t through_len = 0U;
+    size_t plain_len = 0U;
+    char *through = cte_read_bytes(target, &through_len);
+    char *plain = cte_read_bytes(control, &plain_len);
+    ASSERT_NOT_NULL(through);
+    ASSERT_NOT_NULL(plain);
+    ASSERT_EQ(through_len, plain_len);
+    ASSERT_EQ(memcmp(through, plain, plain_len), 0);
+    ASSERT_NOT_NULL(strstr(through, "owned"));
+    free(through);
+    free(plain);
+
+    int through_remove_rc = cbm_text_remove_managed_block(path, CTE_BEGIN, CTE_END);
+    int plain_remove_rc = cbm_text_remove_managed_block(control, CTE_BEGIN, CTE_END);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(through_remove_rc, 0);
+    ASSERT_EQ(plain_remove_rc, 0);
+    ASSERT_EQ(lstat(path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    through = cte_read_bytes(target, &through_len);
+    plain = cte_read_bytes(control, &plain_len);
+    ASSERT_NOT_NULL(through);
+    ASSERT_NOT_NULL(plain);
+    ASSERT_EQ(through_len, plain_len);
+    ASSERT_EQ(memcmp(through, plain, plain_len), 0);
+    ASSERT_NULL(strstr(through, "owned"));
+    free(through);
+    free(plain);
+    ASSERT_EQ(cte_temp_count(dir), 0U);
+    th_cleanup(dir);
+    PASS();
+}
+
 TEST(config_text_owned_document_mode_publishes_exact_bytes_atomically) {
     char dir[CTE_PATH_CAP];
     char path[CTE_PATH_CAP];
@@ -670,6 +739,7 @@ SUITE(config_text_edit) {
     RUN_TEST(config_text_rejects_non_regular_paths);
 #ifndef _WIN32
     RUN_TEST(config_text_rejects_links_privileged_mode_and_preserves_metadata);
+    RUN_TEST(config_text_follows_user_owned_symlink_in_place);
     RUN_TEST(config_text_owned_document_mode_publishes_exact_bytes_atomically);
     RUN_TEST(config_text_owned_document_mode_rejects_prepublish_replacement);
     RUN_TEST(config_text_owned_document_mode_rejects_closed_temp_replacement);
diff --git a/tests/test_config_toml_edit.c b/tests/test_config_toml_edit.c
index 1266556e0..cc64fd576 100644
--- a/tests/test_config_toml_edit.c
+++ b/tests/test_config_toml_edit.c
@@ -5,6 +5,8 @@
  */
 #define CBM_TOML_EDIT_ENABLE_TEST_API 1
 #include "cli/config_toml_edit.h"
+#define CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API 1
+#include "cli/config_edit_path.h"
 #include "foundation/compat.h"
 #include "foundation/compat_fs.h"
 #include "test_framework.h"
@@ -312,7 +314,13 @@ TEST(config_toml_rejects_symlink_hardlink_and_preserves_metadata) {
     ASSERT(snprintf(alias, sizeof(alias), "%s/alias.toml", dir) > 0);
     ASSERT_EQ(th_write_file(target, "target = true\n"), 0);
     ASSERT_EQ(symlink(target, path), 0);
-    ASSERT_EQ(cbm_toml_upsert_managed_block(path, CTE_BEGIN, CTE_END, "owned = true\n"), -1);
+    /* Foreign-owned link (observer moved by the test seam): still refused. */
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(dir), 0);
+    cbm_config_edit_path_set_invoking_uid_for_test((unsigned)geteuid() + 1U, 1);
+    int foreign_rc = cbm_toml_upsert_managed_block(path, CTE_BEGIN, CTE_END, "owned = true\n");
+    cbm_config_edit_path_set_invoking_uid_for_test(0U, 0);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(foreign_rc, -1);
     struct stat link_state;
     ASSERT_EQ(lstat(path, &link_state), 0);
     ASSERT(S_ISLNK(link_state.st_mode));
@@ -351,6 +359,59 @@ TEST(config_toml_rejects_symlink_hardlink_and_preserves_metadata) {
 }
 #endif
 
+#ifndef _WIN32
+/* Decision C (#1954): a managed block behind a user-owned symlink is edited
+ * through the link — the link survives and the target carries the same bytes
+ * the same edit produces on a plain file. */
+TEST(config_toml_follows_user_owned_symlink_in_place) {
+    char dir[CTE_PATH_CAP];
+    char path[CTE_PATH_CAP];
+    char target[CTE_PATH_CAP];
+    char control[CTE_PATH_CAP];
+    char through[CTE_FILE_CAP];
+    char plain[CTE_FILE_CAP];
+    ASSERT_EQ(cte_fixture(dir, sizeof(dir), path, sizeof(path)), 0);
+    ASSERT(snprintf(target, sizeof(target), "%s/target.toml", dir) > 0);
+    ASSERT(snprintf(control, sizeof(control), "%s/control.toml", dir) > 0);
+    ASSERT_EQ(th_write_file(target, "target = true\n"), 0);
+    ASSERT_EQ(th_write_file(control, "target = true\n"), 0);
+    ASSERT_EQ(symlink("target.toml", path), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(dir), 0);
+
+    int through_rc = cbm_toml_upsert_managed_block(path, CTE_BEGIN, CTE_END, "owned = true\n");
+    int plain_rc = cbm_toml_upsert_managed_block(control, CTE_BEGIN, CTE_END, "owned = true\n");
+    if (through_rc != 0 || plain_rc != 0) {
+        cbm_config_edit_path_follow_clear();
+    }
+    ASSERT_EQ(through_rc, 0);
+    ASSERT_EQ(plain_rc, 0);
+    struct stat link_state;
+    ASSERT_EQ(lstat(path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    ASSERT_EQ(cte_read(target, through, sizeof(through)), 0);
+    ASSERT_EQ(cte_read(control, plain, sizeof(plain)), 0);
+    ASSERT_STR_EQ(through, plain);
+    ASSERT_NOT_NULL(strstr(through, "owned = true"));
+
+    int through_remove_rc = cbm_toml_remove_managed_block(path, CTE_BEGIN, CTE_END);
+    int plain_remove_rc = cbm_toml_remove_managed_block(control, CTE_BEGIN, CTE_END);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(through_remove_rc, 0);
+    ASSERT_EQ(plain_remove_rc, 0);
+    ASSERT_EQ(lstat(path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    ASSERT_EQ(cte_read(target, through, sizeof(through)), 0);
+    ASSERT_EQ(cte_read(control, plain, sizeof(plain)), 0);
+    ASSERT_STR_EQ(through, plain);
+    ASSERT_NULL(strstr(through, "owned = true"));
+    ASSERT_EQ(cte_temp_count(dir), 0U);
+    ASSERT_EQ(cbm_unlink(target), 0);
+    ASSERT_EQ(cbm_unlink(control), 0);
+    th_cleanup(dir);
+    PASS();
+}
+#endif
+
 TEST(config_toml_managed_markers_ignore_multiline_strings) {
     char dir[CTE_PATH_CAP];
     char path[CTE_PATH_CAP];
@@ -1411,6 +1472,7 @@ SUITE(config_toml_edit) {
     RUN_TEST(config_toml_rejects_non_regular_path);
 #ifndef _WIN32
     RUN_TEST(config_toml_rejects_symlink_hardlink_and_preserves_metadata);
+    RUN_TEST(config_toml_follows_user_owned_symlink_in_place);
 #endif
     RUN_TEST(config_toml_managed_markers_ignore_multiline_strings);
     RUN_TEST(config_toml_managed_rejects_marker_in_block_and_unclosed_multiline);
diff --git a/tests/test_config_yaml_edit.c b/tests/test_config_yaml_edit.c
index 27530757a..f6f80d47e 100644
--- a/tests/test_config_yaml_edit.c
+++ b/tests/test_config_yaml_edit.c
@@ -8,6 +8,8 @@
 
 #define CBM_YAML_ENABLE_TEST_API 1
 #include <cli/config_yaml_edit.h>
+#define CBM_CONFIG_EDIT_PATH_ENABLE_TEST_API 1
+#include <cli/config_edit_path.h>
 
 #include <stdbool.h>
 #include <stdint.h>
@@ -476,7 +478,13 @@ TEST(config_yaml_edit_rejects_symlinks_without_touching_target) {
     ASSERT_EQ(th_write_file(target, original), 0);
     ASSERT_EQ(symlink(target, fixture.path), 0);
 
-    ASSERT_EQ(cbm_yaml_upsert_string_list_item(fixture.path, "read", "AGENTS.md"), -1);
+    /* Foreign-owned link (observer moved by the test seam): still refused. */
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.dir), 0);
+    cbm_config_edit_path_set_invoking_uid_for_test((unsigned)geteuid() + 1U, 1);
+    int foreign_rc = cbm_yaml_upsert_string_list_item(fixture.path, "read", "AGENTS.md");
+    cbm_config_edit_path_set_invoking_uid_for_test(0U, 0);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(foreign_rc, -1);
     struct stat link_state;
     ASSERT_EQ(lstat(fixture.path, &link_state), 0);
     ASSERT(S_ISLNK(link_state.st_mode));
@@ -492,6 +500,64 @@ TEST(config_yaml_edit_rejects_symlinks_without_touching_target) {
     PASS();
 }
 
+/* Decision C (#1954): a user-owned symlink is edited through — the link
+ * survives and the target carries the bytes the same edit yields on a plain file. */
+TEST(config_yaml_edit_follows_user_owned_symlink_in_place) {
+    const char *original = "model: safe\n";
+    yaml_fixture_t fixture;
+    ASSERT_EQ(yaml_fixture_init(&fixture, NULL), 0);
+    char target[sizeof(fixture.path) + 32U];
+    char control[sizeof(fixture.path) + 32U];
+    ASSERT(snprintf(target, sizeof(target), "%s/target.yaml", fixture.dir) > 0);
+    ASSERT(snprintf(control, sizeof(control), "%s/control.yaml", fixture.dir) > 0);
+    ASSERT_EQ(th_write_file(target, original), 0);
+    ASSERT_EQ(th_write_file(control, original), 0);
+    ASSERT_EQ(symlink("target.yaml", fixture.path), 0);
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.dir), 0);
+
+    int through_rc = cbm_yaml_upsert_string_list_item(fixture.path, "read", "AGENTS.md");
+    int plain_rc = cbm_yaml_upsert_string_list_item(control, "read", "AGENTS.md");
+    if (through_rc != 0 || plain_rc != 0) {
+        cbm_config_edit_path_follow_clear();
+    }
+    ASSERT_EQ(through_rc, 0);
+    ASSERT_EQ(plain_rc, 0);
+    struct stat link_state;
+    ASSERT_EQ(lstat(fixture.path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    char *through = yaml_read_alloc(target);
+    char *plain = yaml_read_alloc(control);
+    ASSERT_NOT_NULL(through);
+    ASSERT_NOT_NULL(plain);
+    ASSERT_STR_EQ(through, plain);
+    ASSERT_NOT_NULL(strstr(through, "AGENTS.md"));
+    free(through);
+    free(plain);
+
+    int through_remove_rc = cbm_yaml_remove_string_list_item(fixture.path, "read", "AGENTS.md");
+    int plain_remove_rc = cbm_yaml_remove_string_list_item(control, "read", "AGENTS.md");
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(through_remove_rc, 0);
+    ASSERT_EQ(plain_remove_rc, 0);
+    ASSERT_EQ(lstat(fixture.path, &link_state), 0);
+    ASSERT(S_ISLNK(link_state.st_mode));
+    through = yaml_read_alloc(target);
+    plain = yaml_read_alloc(control);
+    ASSERT_NOT_NULL(through);
+    ASSERT_NOT_NULL(plain);
+    ASSERT_STR_EQ(through, plain);
+    ASSERT_NULL(strstr(through, "AGENTS.md"));
+    free(through);
+    free(plain);
+    ASSERT_EQ(yaml_temp_file_count(&fixture), 0U);
+
+    ASSERT_EQ(cbm_unlink(fixture.path), 0);
+    ASSERT_EQ(cbm_unlink(target), 0);
+    ASSERT_EQ(cbm_unlink(control), 0);
+    th_cleanup(fixture.dir);
+    PASS();
+}
+
 TEST(config_yaml_edit_rejects_dangling_symlink) {
     yaml_fixture_t fixture;
     ASSERT_EQ(yaml_fixture_init(&fixture, NULL), 0);
@@ -2038,9 +2104,15 @@ TEST(config_yaml_edit_nested_sequence_rejects_symlink_byte_identically) {
     ASSERT(snprintf(target, sizeof(target), "%s/target-hooks.yaml", fixture.dir) > 0);
     ASSERT_EQ(th_write_file(target, original), 0);
     ASSERT_EQ(symlink(target, fixture.path), 0);
-    ASSERT_EQ(cbm_yaml_upsert_mapping_sequence_item(fixture.path, yaml_hook_sequence_path, 2U, "id",
-                                                    yaml_hook_identity, yaml_hook_canonical_item),
-              CBM_YAML_IDENTITY_EDIT_ERROR);
+    /* Foreign-owned link (observer moved by the test seam): still refused. */
+    ASSERT_EQ(cbm_config_edit_path_follow_add_root(fixture.dir), 0);
+    cbm_config_edit_path_set_invoking_uid_for_test((unsigned)geteuid() + 1U, 1);
+    int foreign_rc =
+        cbm_yaml_upsert_mapping_sequence_item(fixture.path, yaml_hook_sequence_path, 2U, "id",
+                                              yaml_hook_identity, yaml_hook_canonical_item);
+    cbm_config_edit_path_set_invoking_uid_for_test(0U, 0);
+    cbm_config_edit_path_follow_clear();
+    ASSERT_EQ(foreign_rc, CBM_YAML_IDENTITY_EDIT_ERROR);
     char *after = yaml_read_alloc(target);
     ASSERT_NOT_NULL(after);
     ASSERT_STR_EQ(after, original);
@@ -2071,6 +2143,7 @@ SUITE(config_yaml_edit) {
     RUN_TEST(config_yaml_edit_rejects_non_regular_path);
 #ifndef _WIN32
     RUN_TEST(config_yaml_edit_rejects_symlinks_without_touching_target);
+    RUN_TEST(config_yaml_edit_follows_user_owned_symlink_in_place);
     RUN_TEST(config_yaml_edit_rejects_dangling_symlink);
     RUN_TEST(config_yaml_edit_preserves_owner_group_and_mode);
     RUN_TEST(config_yaml_edit_rejects_hard_links_without_splitting_identity);
diff --git a/tests/test_cypher.c b/tests/test_cypher.c
index fbd9d36bf..8bdee76c9 100644
--- a/tests/test_cypher.c
+++ b/tests/test_cypher.c
@@ -485,6 +485,53 @@ TEST(cypher_parse_order_by_over_cap_rejected_issue1334) {
     PASS();
 }
 
+/* #1994: a non-numeric SKIP/LIMIT operand must be a loud parse error too. The old
+ * failure mode was the same one #1334 banned by a different route: expect()
+ * returned NULL, the clause was dropped, and the query still reported success
+ * with limit left at its -1 "no LIMIT" sentinel - so query_graph answered a
+ * bounded query with the entire result set. Cypher parameters ($limit) are the
+ * everyday trigger: they are what a Neo4j-shaped client writes by default. */
+TEST(cypher_parse_nonnumeric_limit_rejected_issue1994) {
+    cbm_query_t *q = NULL;
+    char *err = NULL;
+    int rc = cbm_cypher_parse("MATCH (f:Function) RETURN f.name LIMIT $limit", &q, &err);
+    ASSERT(rc != 0);
+    free(err);
+    PASS();
+}
+
+TEST(cypher_parse_nonnumeric_skip_rejected_issue1994) {
+    cbm_query_t *q = NULL;
+    char *err = NULL;
+    /* The orphaned operand also swallowed the LIMIT that followed it. */
+    int rc = cbm_cypher_parse("MATCH (f:Function) RETURN f.name SKIP $offset LIMIT 10", &q, &err);
+    ASSERT(rc != 0);
+    free(err);
+    PASS();
+}
+
+TEST(cypher_parse_word_limit_operand_rejected_issue1994) {
+    cbm_query_t *q = NULL;
+    char *err = NULL;
+    int rc = cbm_cypher_parse("MATCH (f:Function) RETURN f.name LIMIT abc", &q, &err);
+    ASSERT(rc != 0);
+    free(err);
+    PASS();
+}
+
+/* Control: a well-formed SKIP/LIMIT still parses and still carries its values. */
+TEST(cypher_parse_numeric_skip_limit_still_accepted) {
+    cbm_query_t *q = NULL;
+    char *err = NULL;
+    int rc = cbm_cypher_parse("MATCH (f:Function) RETURN f.name SKIP 2 LIMIT 10", &q, &err);
+    ASSERT_EQ(rc, 0);
+    ASSERT_EQ(q->ret->skip, 2);
+    ASSERT_EQ(q->ret->limit, 10);
+
+    cbm_query_free(q);
+    PASS();
+}
+
 TEST(cypher_parse_return_distinct) {
     cbm_query_t *q = NULL;
     char *err = NULL;
@@ -1744,6 +1791,35 @@ TEST(cypher_exec_count) {
     PASS();
 }
 
+TEST(cypher_exec_optional_bound_terminal_count_ignores_unbound) {
+    cbm_store_t *s = setup_cypher_store();
+    cbm_cypher_result_t r = {0};
+
+    int rc = cbm_cypher_execute(s,
+                                "MATCH (f:Function) OPTIONAL MATCH (t)-[:CALLS]->(f) "
+                                "RETURN f.name, COUNT(t) AS cnt",
+                                "test", 0, &r);
+    ASSERT_EQ(rc, 0);
+    ASSERT_EQ(r.row_count, 4);
+
+    for (int i = 0; i < r.row_count; i++) {
+        const char *name = r.rows[i][0];
+        const char *count = r.rows[i][1];
+        if (strcmp(name, "HandleOrder") == 0) {
+            ASSERT_STR_EQ(count, "0");
+        } else if (strcmp(name, "ValidateOrder") == 0 || strcmp(name, "SubmitOrder") == 0 ||
+                   strcmp(name, "LogError") == 0) {
+            ASSERT_STR_EQ(count, "1");
+        } else {
+            ASSERT_TRUE(false);
+        }
+    }
+
+    cbm_cypher_result_free(&r);
+    cbm_store_close(s);
+    PASS();
+}
+
 TEST(cypher_exec_limit) {
     cbm_store_t *s = setup_cypher_store();
     cbm_cypher_result_t r = {0};
@@ -4392,6 +4468,63 @@ TEST(cypher_exec_prop_array_with_internal_commas) {
 
 /* A string property must not end at an ESCAPED quote: the scan stopped at the
  * first '"' regardless of a preceding backslash, cutting the value short. */
+/* Planner (2026-09-16): a single-hop pattern whose FAR node carries the
+ * selective filter is walked from that end. `MATCH (a)-[:CALLS]->(b) WHERE
+ * b.name = 'X'` used to scan every node before the filter on b could act — on
+ * the 8.5 M node kernel graph it hit the execution-time limit while the
+ * anchored spelling answered in seconds. The rows must be the same in every
+ * spelling, including the inline-property and inbound-direction forms, and
+ * the caller-side variable must still bind the right nodes after the swap. */
+TEST(cypher_single_hop_seeds_from_selective_far_node) {
+    cbm_store_t *s = setup_cypher_store();
+
+    cbm_cypher_result_t where_form = {0};
+    ASSERT_EQ(cbm_cypher_execute(s,
+                                 "MATCH (a)-[:CALLS]->(b) WHERE b.name = 'ValidateOrder' "
+                                 "RETURN a.name ORDER BY a.name",
+                                 "test", 0, &where_form),
+              0);
+    ASSERT_EQ(where_form.row_count, 1);
+    ASSERT_STR_EQ(where_form.rows[0][0], "HandleOrder");
+    cbm_cypher_result_free(&where_form);
+
+    cbm_cypher_result_t inline_form = {0};
+    ASSERT_EQ(cbm_cypher_execute(s,
+                                 "MATCH (a)-[:CALLS]->(b {name: 'SubmitOrder'}) "
+                                 "RETURN a.name",
+                                 "test", 0, &inline_form),
+              0);
+    ASSERT_EQ(inline_form.row_count, 1);
+    ASSERT_STR_EQ(inline_form.rows[0][0], "ValidateOrder");
+    cbm_cypher_result_free(&inline_form);
+
+    /* Inbound spelling: the far node is now the CALLER; direction inverts back. */
+    cbm_cypher_result_t inbound_form = {0};
+    ASSERT_EQ(cbm_cypher_execute(s,
+                                 "MATCH (callee)<-[:CALLS]-(caller) WHERE caller.name = "
+                                 "'HandleOrder' RETURN callee.name ORDER BY callee.name",
+                                 "test", 0, &inbound_form),
+              0);
+    ASSERT_EQ(inbound_form.row_count, 2);
+    ASSERT_STR_EQ(inbound_form.rows[0][0], "LogError");
+    ASSERT_STR_EQ(inbound_form.rows[1][0], "ValidateOrder");
+    cbm_cypher_result_free(&inbound_form);
+
+    /* Count aggregation through the swapped seed. */
+    cbm_cypher_result_t count_form = {0};
+    ASSERT_EQ(cbm_cypher_execute(s,
+                                 "MATCH (a)-[:CALLS]->(b) WHERE b.name = 'LogError' "
+                                 "RETURN count(a) AS callers",
+                                 "test", 0, &count_form),
+              0);
+    ASSERT_EQ(count_form.row_count, 1);
+    ASSERT_STR_EQ(count_form.rows[0][0], "1");
+    cbm_cypher_result_free(&count_form);
+
+    cbm_store_close(s);
+    PASS();
+}
+
 TEST(cypher_exec_prop_string_with_escaped_quote) {
     cbm_store_t *s = cbm_store_open_memory();
     cbm_store_upsert_project(s, "test", "/tmp/test");
@@ -4527,6 +4660,10 @@ SUITE(cypher) {
     RUN_TEST(cypher_parse_return_order_limit);
     RUN_TEST(cypher_parse_multikey_order_by_issue1334);
     RUN_TEST(cypher_parse_order_by_over_cap_rejected_issue1334);
+    RUN_TEST(cypher_parse_nonnumeric_limit_rejected_issue1994);
+    RUN_TEST(cypher_parse_nonnumeric_skip_rejected_issue1994);
+    RUN_TEST(cypher_parse_word_limit_operand_rejected_issue1994);
+    RUN_TEST(cypher_parse_numeric_skip_limit_still_accepted);
     RUN_TEST(cypher_parse_return_distinct);
     RUN_TEST(cypher_parse_inline_props);
     RUN_TEST(cypher_parse_error);
@@ -4578,6 +4715,7 @@ SUITE(cypher) {
     RUN_TEST(cypher_exec_calls_with_where);
     RUN_TEST(cypher_exec_inbound);
     RUN_TEST(cypher_exec_count);
+    RUN_TEST(cypher_exec_optional_bound_terminal_count_ignores_unbound);
     RUN_TEST(cypher_exec_limit);
     RUN_TEST(cypher_exec_order_by);
     RUN_TEST(cypher_exec_variable_length);
@@ -4711,4 +4849,5 @@ SUITE(cypher) {
     /* Composite property projection (arrays/objects, escaped quotes) */
     RUN_TEST(cypher_exec_prop_array_with_internal_commas);
     RUN_TEST(cypher_exec_prop_string_with_escaped_quote);
+    RUN_TEST(cypher_single_hop_seeds_from_selective_far_node);
 }
diff --git a/tests/test_daemon_application.c b/tests/test_daemon_application.c
index f587940c2..0108e8ec5 100644
--- a/tests/test_daemon_application.c
+++ b/tests/test_daemon_application.c
@@ -1348,6 +1348,7 @@ TEST(daemon_application_prune_clears_logical_watch_for_reregistration) {
 }
 
 enum { APP_FAKE_MAX_ATTEMPTS = 16 };
+enum { APP_FAKE_ARGS_CAP = 2048 };
 
 typedef struct {
     atomic_int starts;
@@ -1368,6 +1369,11 @@ typedef struct {
     char marker_paths[APP_FAKE_MAX_ATTEMPTS][APP_TEST_PATH_CAP];
     char quarantine_paths[APP_FAKE_MAX_ATTEMPTS][APP_TEST_PATH_CAP];
     char quarantine_seen[APP_FAKE_MAX_ATTEMPTS][APP_TEST_PATH_CAP];
+    char args_json[APP_FAKE_MAX_ATTEMPTS][APP_FAKE_ARGS_CAP];
+    /* `starts` is incremented before the slot is filled, so waiting on it says
+     * a worker began, not that its arguments are readable. Each slot publishes
+     * itself instead, which is the edge a reader on another thread needs. */
+    atomic_bool args_captured[APP_FAKE_MAX_ATTEMPTS];
     size_t memory_budgets[APP_FAKE_MAX_ATTEMPTS];
 } app_fake_worker_context_t;
 
@@ -1432,6 +1438,9 @@ static int app_fake_worker_start(void *opaque, const char *args_json, size_t mem
     atomic_init(&worker->cancelled, false);
     worker->result.exit_code = -1;
     if (worker->attempt < APP_FAKE_MAX_ATTEMPTS) {
+        (void)snprintf(context->args_json[worker->attempt], APP_FAKE_ARGS_CAP, "%s",
+                       args_json ? args_json : "");
+        atomic_store(&context->args_captured[worker->attempt], true);
         context->memory_budgets[worker->attempt] = memory_budget_bytes;
         if (marker_file) {
             (void)snprintf(context->marker_paths[worker->attempt], APP_TEST_PATH_CAP, "%s",
@@ -1456,6 +1465,33 @@ static int app_fake_worker_start(void *opaque, const char *args_json, size_t mem
     return 0;
 }
 
+static bool app_wait_for_atomic_bool(atomic_bool *value, bool expected);
+
+static bool app_fake_worker_policy_equals(app_fake_worker_context_t *context, int attempt,
+                                          const char *max_files, const char *max_source_mb) {
+    if (!context || attempt < 0 || attempt >= APP_FAKE_MAX_ATTEMPTS) {
+        return false;
+    }
+    if (!app_wait_for_atomic_bool(&context->args_captured[attempt], true)) {
+        return false;
+    }
+    const char *args = context->args_json[attempt];
+    yyjson_doc *document = yyjson_read(args, strlen(args), 0);
+    yyjson_val *root = document ? yyjson_doc_get_root(document) : NULL;
+    yyjson_val *policy =
+        root && yyjson_is_obj(root) ? yyjson_obj_get(root, "_cbm_index_policy") : NULL;
+    yyjson_val *files =
+        policy && yyjson_is_obj(policy) ? yyjson_obj_get(policy, CBM_INDEX_CONFIG_MAX_FILES) : NULL;
+    yyjson_val *bytes = policy && yyjson_is_obj(policy)
+                            ? yyjson_obj_get(policy, CBM_INDEX_CONFIG_MAX_SOURCE_MB)
+                            : NULL;
+    bool equal = files && bytes && yyjson_is_str(files) && yyjson_is_str(bytes) &&
+                 strcmp(yyjson_get_str(files), max_files) == 0 &&
+                 strcmp(yyjson_get_str(bytes), max_source_mb) == 0;
+    yyjson_doc_free(document);
+    return equal;
+}
+
 static cbm_index_worker_poll_t app_fake_worker_poll(void *opaque,
                                                     cbm_daemon_application_worker_t handle,
                                                     const cbm_index_worker_result_t **result_out) {
@@ -2009,7 +2045,9 @@ TEST(daemon_application_initialize_coalesces_auto_index_for_full_sessions) {
     cbm_config_t *stored_config = cache_set ? cbm_config_open(cache) : NULL;
     bool config_ready = stored_config &&
                         cbm_config_set(stored_config, CBM_CONFIG_AUTO_INDEX, "true") == 0 &&
-                        cbm_config_set(stored_config, CBM_CONFIG_AUTO_WATCH, "false") == 0;
+                        cbm_config_set(stored_config, CBM_CONFIG_AUTO_WATCH, "false") == 0 &&
+                        cbm_config_set(stored_config, CBM_INDEX_CONFIG_MAX_FILES, "3") == 0 &&
+                        cbm_config_set(stored_config, CBM_INDEX_CONFIG_MAX_SOURCE_MB, "4") == 0;
     char canonical_root[APP_TEST_PATH_CAP] = {0};
     bool canonical = dirs_ok && cbm_canonical_path(root, canonical_root, sizeof(canonical_root));
     char *project = canonical ? cbm_project_name_from_path(canonical_root) : NULL;
@@ -2054,6 +2092,7 @@ TEST(daemon_application_initialize_coalesces_auto_index_for_full_sessions) {
     bool first_owned = first_initialized && project &&
                        app_wait_for_subscribers(application, project, 1) &&
                        app_wait_for_atomic_int(&fake.starts, 1);
+    bool auto_policy_propagated = first_owned && app_fake_worker_policy_equals(&fake, 0, "3", "4");
     bool second_initialized = app_test_initialize_profile(&callbacks, sessions[1], root,
                                                           CBM_MCP_TOOL_PROFILE_ALL, NULL, NULL);
     bool coalesced = first_owned && second_initialized && project &&
@@ -2115,6 +2154,7 @@ TEST(daemon_application_initialize_coalesces_auto_index_for_full_sessions) {
     ASSERT_TRUE(restricted_started_nothing);
     ASSERT_TRUE(first_initialized);
     ASSERT_TRUE(first_owned);
+    ASSERT_TRUE(auto_policy_propagated);
     ASSERT_TRUE(second_initialized);
     ASSERT_TRUE(coalesced);
     ASSERT_TRUE(restricted_disconnect_kept_job);
@@ -2389,6 +2429,46 @@ TEST(daemon_application_sensitive_root_blocks_watch_but_preserves_controls) {
     PASS();
 }
 
+TEST(daemon_application_programmatic_index_injects_resource_policy) {
+    char *root = th_mktempdir("cbm_app_policy_root");
+    char *cache = th_mktempdir("cbm_app_policy_cache");
+    ASSERT_NOT_NULL(root);
+    ASSERT_NOT_NULL(cache);
+    cbm_config_t *stored_config = cbm_config_open(cache);
+    bool configured = stored_config &&
+                      cbm_config_set(stored_config, CBM_INDEX_CONFIG_MAX_FILES, "5") == 0 &&
+                      cbm_config_set(stored_config, CBM_INDEX_CONFIG_MAX_SOURCE_MB, "6") == 0;
+
+    app_fake_worker_context_t fake;
+    app_fake_worker_context_init(&fake);
+    atomic_store(&fake.allow_completion, true);
+    cbm_daemon_application_worker_ops_t worker_ops = {
+        .context = &fake,
+        .start = app_fake_worker_start,
+        .poll = app_fake_worker_poll,
+        .cancel = app_fake_worker_cancel,
+        .log_path = app_fake_worker_log_path,
+        .destroy = app_fake_worker_destroy,
+    };
+    cbm_daemon_application_config_t config = {
+        .config = stored_config,
+        .worker_ops = &worker_ops,
+    };
+    cbm_daemon_application_t *application = configured ? cbm_daemon_application_new(&config) : NULL;
+    int index_rc =
+        application ? cbm_daemon_application_index(application, "policy-programmatic", root) : -1;
+    bool policy_propagated = index_rc == 0 && app_fake_worker_policy_equals(&fake, 0, "5", "6");
+    bool stopped = application && cbm_daemon_application_shutdown(application, APP_TEST_TIMEOUT_MS);
+
+    cbm_daemon_application_free(application);
+    cbm_config_close(stored_config);
+    th_cleanup(root);
+    th_cleanup(cache);
+    ASSERT_TRUE(configured);
+    ASSERT_TRUE(policy_propagated);
+    ASSERT_TRUE(stopped);
+    PASS();
+}
 TEST(daemon_application_auto_index_honors_tracked_file_limit) {
     app_env_backup_t cache_environment;
     bool cache_saved = app_env_backup_capture(&cache_environment, "CBM_CACHE_DIR");
@@ -2464,6 +2544,9 @@ TEST(daemon_application_auto_index_honors_tracked_file_limit) {
     PASS();
 }
 
+/* Native discovery never interprets a repository path as command text. Valid
+ * non-Git paths containing shell metacharacters remain countable literally. */
+
 /* Native discovery never interprets a repository path as command text. Valid
  * non-Git paths containing shell metacharacters remain countable literally. */
 TEST(daemon_application_auto_index_file_count_handles_literal_metacharacter_path) {
@@ -5570,6 +5653,7 @@ SUITE(daemon_application) {
     RUN_TEST(daemon_application_sensitive_root_blocks_auto_index_but_preserves_controls);
     RUN_TEST(daemon_application_sensitive_root_blocks_watch_but_preserves_controls);
     RUN_TEST(daemon_application_index_args_compare_repo_path_separator_equivalently);
+    RUN_TEST(daemon_application_programmatic_index_injects_resource_policy);
     RUN_TEST(daemon_application_auto_index_honors_tracked_file_limit);
     RUN_TEST(daemon_application_auto_index_file_count_handles_literal_metacharacter_path);
     RUN_TEST(daemon_application_auto_index_file_count_supports_non_git_roots);
diff --git a/tests/test_daemon_bootstrap.c b/tests/test_daemon_bootstrap.c
index a9c8a368e..c2243cbea 100644
--- a/tests/test_daemon_bootstrap.c
+++ b/tests/test_daemon_bootstrap.c
@@ -1,18 +1,30 @@
 /* RED contract for early process-role classification. */
 #include "test_framework.h"
+#include "test_helpers.h"
 
 #include "daemon/bootstrap.h"
+#include "daemon/host.h"
 #include "daemon/ipc.h"
+#include "daemon/ipc_internal.h"
+#include "daemon/runtime.h"
 #include "daemon/service.h"
 #include "foundation/compat.h"
 #include "foundation/compat_fs.h"
 #include "foundation/compat_thread.h"
 #include "foundation/platform.h"
 
+#include <errno.h>
 #include <stdatomic.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
+#include <time.h>
+#ifndef _WIN32
+#include <signal.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#endif
 
 enum {
     BOOTSTRAP_TEST_PATH_CAP = 1024,
@@ -874,6 +886,276 @@ TEST(daemon_bootstrap_darwin_launch_failure_is_synchronous) {
 }
 #endif
 
+#ifndef _WIN32
+enum { BOOTSTRAP_ENOSPC_MAX_CHILDREN = 16, BOOTSTRAP_ENOSPC_LOG_CAP = 65536 };
+
+typedef struct {
+    char parent[BOOTSTRAP_TEST_PATH_CAP];
+    cbm_daemon_build_identity_t identity;
+    pid_t children[BOOTSTRAP_ENOSPC_MAX_CHILDREN];
+    int exit_status[BOOTSTRAP_ENOSPC_MAX_CHILDREN];
+    bool reaped[BOOTSTRAP_ENOSPC_MAX_CHILDREN];
+    size_t child_count;
+    size_t spawn_calls;
+} bootstrap_enospc_host_t;
+
+/* The production spawn exec's the product binary; this one forks a REAL daemon
+ * host (cbm_daemon_host_run, the same entry `--cbm-daemon-internal` reaches)
+ * whose record publication fails with ENOSPC through the inherited seam. */
+static bool bootstrap_enospc_host_spawn(void *opaque,
+                                        const cbm_daemon_bootstrap_launch_spec_t *spec) {
+    bootstrap_enospc_host_t *state = opaque;
+    if (!spec || !spec->detached) {
+        return false;
+    }
+    state->spawn_calls++;
+    if (state->child_count >= BOOTSTRAP_ENOSPC_MAX_CHILDREN) {
+        /* RED-run guard only: a client that keeps respawning a doomed daemon
+         * for its whole deadline must not fork without bound. */
+        return true;
+    }
+    pid_t child = fork();
+    if (child < 0) {
+        return false;
+    }
+    if (child == 0) {
+        cbm_daemon_ipc_endpoint_t *endpoint = cbm_daemon_bootstrap_endpoint_new(state->parent);
+        atomic_int stop_requested = ATOMIC_VAR_INIT(0);
+        cbm_daemon_host_config_t config = {
+            .endpoint = endpoint,
+            .identity = state->identity,
+            .executable_path = "/enospc-host-test",
+            .stop_requested = &stop_requested,
+        };
+        int run_result = endpoint ? cbm_daemon_host_run(&config) : 0;
+        _exit(run_result == -1 ? 0 : 50);
+    }
+    /* SYNCHRONOUS on purpose. The daemon host writes its start-failure record
+     * and only then lets go of its lifetime reservation and exits, so once it
+     * has been reaped "record on disk, reservation released" is a STABLE state
+     * pinned by construction. The client's first look after the spawn (the
+     * wait loop always runs once and its first failure check is unthrottled)
+     * therefore finds the record however long the host took to get there.
+     *
+     * Returning while the host was still running made the verdict ride on the
+     * client's 30 s startup deadline: before it listens the host SHA-256s its
+     * own image, which for the ~450 MB test runner is ~3 s natively and ~26 s
+     * under MSan (48 CI samples: 20-32 s). The deadline won that race on slow
+     * runs and the reaper then SIGKILLed a host that had not failed yet --
+     * `ASSERT(daemon_named_cause)` red on PRs that touch no C at all (#2245,
+     * #2158, #2140). A deadline must never decide a test (O9). */
+    size_t slot = state->child_count++;
+    state->children[slot] = child;
+    int status = 0;
+    pid_t waited;
+    do {
+        waited = waitpid(child, &status, 0);
+    } while (waited < 0 && errno == EINTR);
+    state->reaped[slot] = waited == child;
+    state->exit_status[slot] = status;
+    return true;
+}
+
+static void bootstrap_enospc_reap(bootstrap_enospc_host_t *state, int *nonzero_exits) {
+    *nonzero_exits = 0;
+    for (size_t i = 0; i < state->child_count; i++) {
+        int status = state->exit_status[i];
+        if (!state->reaped[i]) {
+            /* Only reachable when the synchronous wait in the spawn itself
+             * failed; never leave a host behind. */
+            pid_t waited;
+            (void)kill(state->children[i], SIGKILL);
+            do {
+                waited = waitpid(state->children[i], &status, 0);
+            } while (waited < 0 && errno == EINTR);
+        }
+        if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
+            (*nonzero_exits)++;
+        }
+    }
+}
+
+static bool bootstrap_read_file(const char *path, char *out, size_t capacity) {
+    FILE *file = cbm_fopen(path, "rb");
+    if (!file) {
+        return false;
+    }
+    size_t used = fread(out, 1, capacity - 1, file);
+    out[used] = '\0';
+    (void)fclose(file);
+    return true;
+}
+
+/* The record contract behind the fail-fast: a real listener failure in this
+ * process is recorded and read back with stage, errno, and path; a record
+ * older than the reader's spawn or for another endpoint is not evidence. */
+TEST(daemon_bootstrap_start_failure_record_round_trip) {
+    bootstrap_endpoint_fixture_t fixture;
+    bootstrap_endpoint_fixture_t other;
+    ASSERT_TRUE(bootstrap_endpoint_fixture_start(&fixture, "failure-record"));
+    char other_parent[BOOTSTRAP_TEST_PATH_CAP];
+    int other_written =
+        snprintf(other_parent, sizeof(other_parent), "%s/other-XXXXXX", fixture.parent);
+    ASSERT(other_written > 0 && other_written < (int)sizeof(other_parent));
+    ASSERT_TRUE(cbm_mkdtemp(other_parent) != NULL);
+    memset(&other, 0, sizeof(other));
+    other.endpoint = cbm_daemon_ipc_endpoint_new("1828000000000002", other_parent);
+    ASSERT_TRUE(other.endpoint != NULL);
+    char logs[BOOTSTRAP_TEST_PATH_CAP];
+    int logs_written = snprintf(logs, sizeof(logs), "%s/logs", fixture.parent);
+    ASSERT(logs_written > 0 && logs_written < (int)sizeof(logs));
+    char expected_path[BOOTSTRAP_TEST_PATH_CAP];
+    int path_written = snprintf(expected_path, sizeof(expected_path), "%s.pending.tmp",
+                                cbm_daemon_ipc_endpoint_address(fixture.endpoint));
+    ASSERT(path_written > 0 && path_written < (int)sizeof(expected_path));
+
+    cbm_daemon_ipc_posix_record_write_failure_set_for_test(ENOSPC);
+    cbm_daemon_ipc_listener_t *listener = cbm_daemon_ipc_listen(fixture.endpoint);
+    cbm_daemon_ipc_posix_record_write_failure_set_for_test(0);
+    ASSERT_TRUE(listener == NULL);
+
+    uint64_t now_s = (uint64_t)time(NULL);
+    bool recorded = cbm_daemon_bootstrap_start_failure_record(logs, fixture.endpoint, "runtime");
+    cbm_daemon_bootstrap_start_failure_t failure;
+    int found =
+        cbm_daemon_bootstrap_start_failure_read(logs, fixture.endpoint, now_s - 2, &failure);
+    cbm_daemon_bootstrap_start_failure_t stale;
+    int stale_found =
+        cbm_daemon_bootstrap_start_failure_read(logs, fixture.endpoint, now_s + 60, &stale);
+    cbm_daemon_bootstrap_start_failure_t foreign;
+    int foreign_found =
+        cbm_daemon_bootstrap_start_failure_read(logs, other.endpoint, now_s - 2, &foreign);
+    char message[CBM_DAEMON_CONFLICT_MESSAGE_SIZE];
+    cbm_daemon_bootstrap_start_failure_format(&failure, logs, message, sizeof(message));
+
+    cbm_daemon_ipc_endpoint_free(other.endpoint);
+    (void)th_rmtree(fixture.parent);
+    bootstrap_endpoint_fixture_finish(&fixture);
+
+    ASSERT_TRUE(recorded);
+    ASSERT_EQ(found, 1);
+    ASSERT_STR_EQ(failure.component, "runtime");
+    ASSERT_STR_EQ(failure.stage, "pending_publication");
+    ASSERT_EQ(failure.errno_value, ENOSPC);
+    ASSERT_STR_EQ(failure.path, expected_path);
+    ASSERT_TRUE(failure.pid == (uint64_t)getpid());
+    ASSERT_EQ(stale_found, 0);
+    ASSERT_EQ(foreign_found, 0);
+    ASSERT_TRUE(strstr(message, "CBM daemon failed to start: pending_publication failed with "
+                                "ENOSPC (") != NULL);
+    ASSERT_TRUE(strstr(message, expected_path) != NULL);
+    ASSERT_TRUE(strstr(message, "/cbm-daemon.log") != NULL);
+    PASS();
+}
+
+/* #1828: a daemon that dies at publication (full /tmp) left every client
+ * waiting the full 30 s and then reporting "active or starting" -- the
+ * opposite of the truth. A real host is spawned against a runtime directory
+ * whose record writes fail with ENOSPC; the client must report "failed to
+ * start" naming the errno and the path by ending the wait on the recorded
+ * cause, not by exhausting the deadline. The proof is the surfaced record and
+ * the single spawn (see the assertions), never a wall-clock measurement. */
+TEST(daemon_bootstrap_fails_fast_when_daemon_dies_at_publication) {
+    const char *old_cache = getenv("CBM_CACHE_DIR");
+    char *saved_cache = old_cache ? cbm_strdup(old_cache) : NULL;
+    bool snapshot_ok = !old_cache || saved_cache;
+
+    bootstrap_endpoint_fixture_t fixture;
+    bool fixture_ok = snapshot_ok && bootstrap_endpoint_fixture_start(&fixture, "enospc-host");
+    char cache[BOOTSTRAP_TEST_PATH_CAP] = {0};
+    char daemon_log[BOOTSTRAP_TEST_PATH_CAP] = {0};
+    char expected_path[BOOTSTRAP_TEST_PATH_CAP] = {0};
+    int cache_written =
+        fixture_ok ? snprintf(cache, sizeof(cache), "%s/cache", fixture.parent) : -1;
+    int log_written =
+        fixture_ok ? snprintf(daemon_log, sizeof(daemon_log), "%s/logs/cbm-daemon.log", cache) : -1;
+    int path_written = fixture_ok ? snprintf(expected_path, sizeof(expected_path), "%s.pending.tmp",
+                                             cbm_daemon_ipc_endpoint_address(fixture.endpoint))
+                                  : -1;
+    bool environment_ready = cache_written > 0 && cache_written < (int)sizeof(cache) &&
+                             log_written > 0 && log_written < (int)sizeof(daemon_log) &&
+                             path_written > 0 && path_written < (int)sizeof(expected_path) &&
+                             cbm_mkdir_p(cache, 0700) && cbm_setenv("CBM_CACHE_DIR", cache, 1) == 0;
+
+    char self_build[CBM_DAEMON_BUILD_FINGERPRINT_SIZE] = {0};
+    bool identity_ready = environment_ready && cbm_daemon_runtime_process_build_fingerprint(
+                                                   (uint64_t)getpid(), self_build);
+    static bootstrap_enospc_host_t host;
+    memset(&host, 0, sizeof(host));
+    (void)snprintf(host.parent, sizeof(host.parent), "%s", fixture_ok ? fixture.parent : "");
+    host.identity = bootstrap_identity("2.4.0", self_build);
+
+    cbm_daemon_bootstrap_config_t config = {
+        .role = CBM_DAEMON_PROCESS_MCP_CLIENT,
+        .endpoint = fixture.endpoint,
+        .identity = &host.identity,
+        .executable_path = "/enospc-host-test",
+        .connect_timeout_ms = 200,
+        .startup_timeout_ms = 30000,
+    };
+    cbm_daemon_bootstrap_result_t result;
+    memset(&result, 0, sizeof(result));
+    cbm_daemon_bootstrap_status_t status = CBM_DAEMON_BOOTSTRAP_FAILED;
+    if (identity_ready) {
+        cbm_daemon_ipc_posix_record_write_failure_set_for_test(ENOSPC);
+        cbm_daemon_bootstrap_spawn_override_set_for_test(bootstrap_enospc_host_spawn, &host);
+        status = cbm_daemon_bootstrap_execute(&config, &result);
+        cbm_daemon_bootstrap_spawn_override_set_for_test(NULL, NULL);
+        cbm_daemon_ipc_posix_record_write_failure_set_for_test(0);
+    }
+    int nonzero_exits = 0;
+    bootstrap_enospc_reap(&host, &nonzero_exits);
+
+    static char log[BOOTSTRAP_ENOSPC_LOG_CAP];
+    log[0] = '\0';
+    bool log_read = bootstrap_read_file(daemon_log, log, sizeof(log));
+    const char *listen_failed = strstr(log, "msg=daemon.ipc.listen_failed");
+    bool daemon_named_cause = listen_failed && strstr(listen_failed, "errno=ENOSPC") != NULL &&
+                              strstr(listen_failed, expected_path) != NULL;
+    bool message_names_failure = strstr(result.message, "failed to start") != NULL;
+    bool message_names_errno = strstr(result.message, "ENOSPC") != NULL;
+    bool message_names_path = strstr(result.message, expected_path) != NULL;
+    bool stale_wording = strstr(result.message, "active or starting") != NULL;
+
+    if (saved_cache) {
+        (void)cbm_setenv("CBM_CACHE_DIR", saved_cache, 1);
+    } else {
+        (void)cbm_unsetenv("CBM_CACHE_DIR");
+    }
+    free(saved_cache);
+    if (fixture_ok) {
+        (void)th_rmtree(fixture.parent);
+        bootstrap_endpoint_fixture_finish(&fixture);
+    }
+
+    ASSERT_TRUE(snapshot_ok);
+    ASSERT_TRUE(fixture_ok);
+    ASSERT_TRUE(environment_ready);
+    ASSERT_TRUE(identity_ready);
+    ASSERT_EQ(status, CBM_DAEMON_BOOTSTRAP_FAILED);
+    ASSERT_TRUE(result.daemon_spawned);
+    ASSERT_TRUE(host.child_count >= 1);
+    ASSERT_TRUE(log_read);
+    ASSERT_TRUE(daemon_named_cause);
+    /* Fast-fail is proven by the MECHANISM, never by wall-clock (O9: a gate
+     * never asserts a transient timing window). The recorded ENOSPC cause is
+     * surfaced verbatim ("failed to start" + errno + path) and the slow
+     * "active or starting" timeout wording is absent -- that message is emitted
+     * ONLY on the fast-fail break (cbm_daemon_bootstrap_start_failure_format),
+     * never on the 30 s deadline path -- and the client stopped after exactly
+     * one spawn instead of respawning a doomed daemon until the deadline. Any
+     * regression to the pre-#1828 30 s hang trips these deterministically. */
+    ASSERT_FALSE(stale_wording);
+    ASSERT_TRUE(message_names_failure);
+    ASSERT_TRUE(message_names_errno);
+    ASSERT_TRUE(message_names_path);
+    ASSERT_EQ(host.child_count, 1U);
+    ASSERT_EQ(nonzero_exits, 0);
+    bootstrap_endpoint_fixture_finish(&fixture);
+    PASS();
+}
+#endif
+
 SUITE(daemon_bootstrap) {
     RUN_TEST(daemon_bootstrap_classifies_default_and_ui_as_mcp_clients);
     RUN_TEST(daemon_bootstrap_classifies_stateless_commands_without_client);
@@ -903,4 +1185,8 @@ SUITE(daemon_bootstrap) {
 #ifdef __APPLE__
     RUN_TEST(daemon_bootstrap_darwin_launch_failure_is_synchronous);
 #endif
+#ifndef _WIN32
+    RUN_TEST(daemon_bootstrap_start_failure_record_round_trip);
+    RUN_TEST(daemon_bootstrap_fails_fast_when_daemon_dies_at_publication);
+#endif
 }
diff --git a/tests/test_daemon_ipc.c b/tests/test_daemon_ipc.c
index 252351957..815f630a6 100644
--- a/tests/test_daemon_ipc.c
+++ b/tests/test_daemon_ipc.c
@@ -13,6 +13,7 @@
 #include "daemon/ipc_internal.h"
 #include "foundation/compat.h"
 #include "foundation/compat_thread.h"
+#include "foundation/log.h"
 #include "foundation/platform.h"
 #include "foundation/private_file_lock_internal.h"
 #include "foundation/subprocess.h"
@@ -881,6 +882,129 @@ TEST(daemon_ipc_windows_private_directory_ace_is_inheritable) {
     PASS();
 }
 
+typedef struct {
+    int calls;
+    bool plant_file; /* false: play a racer that creates the DIRECTORY first */
+    bool planted;
+} ipc_test_win_create_racer_t;
+
+/* Plays the concurrent process that wins the creation of a path component the
+ * walk has just observed absent. Runs inside the walk, at the exact point the
+ * race lives, so the interleaving is pinned by construction: no threads, no
+ * timing. */
+static void ipc_test_win_create_racer(const wchar_t *path, void *context) {
+    ipc_test_win_create_racer_t *racer = context;
+    racer->calls++;
+    if (racer->calls != 1) {
+        return;
+    }
+    if (racer->plant_file) {
+        HANDLE file =
+            CreateFileW(path, GENERIC_WRITE, 0, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL);
+        racer->planted = file != INVALID_HANDLE_VALUE;
+        if (racer->planted) {
+            (void)CloseHandle(file);
+        }
+    } else {
+        racer->planted = CreateDirectoryW(path, NULL) != 0;
+    }
+}
+
+/* Cold-start race (test-windows-guards section_cold_storm, 2026-09-21; the
+ * same thing a user gets when a host launches several MCP servers on its very
+ * first run): N processes first-start against a runtime directory that does
+ * not exist yet. All of them observe the final component absent, one
+ * CreateDirectoryW wins, and every other process gets ERROR_ALREADY_EXISTS.
+ * The walk treated that as a failure and recorded no detail, so the losers
+ * exited with a bare "secure CLI coordination could not be created
+ * (endpoint)". Losing the creation race is not a failure: the directory this
+ * process wanted now exists, and the owner / DACL / not-a-reparse-point checks
+ * that follow are exactly the ones a pre-existing directory gets. The POSIX
+ * walk has always tolerated EEXIST here. */
+TEST(daemon_ipc_windows_private_directory_survives_lost_creation_race) {
+    char parent[TEST_PATH_CAP] = {0};
+    char cache[TEST_PATH_CAP] = {0};
+    bool paths_ok = false;
+    bool secured = false;
+    bool owner_only = false;
+    ipc_test_win_create_racer_t racer = {0};
+
+    if (ipc_test_parent_new(parent, "win-create-race")) {
+        int written = snprintf(cache, sizeof(cache), "%s/cache", parent);
+        paths_ok = written > 0 && written < (int)sizeof(cache);
+    }
+    if (paths_ok) {
+        cbm_daemon_ipc_win_directory_create_hook_set_for_test(ipc_test_win_create_racer, &racer);
+        secured = cbm_daemon_ipc_private_directory_secure(cache);
+        cbm_daemon_ipc_win_directory_create_hook_set_for_test(NULL, NULL);
+    }
+    if (secured) {
+        /* The racer created the directory with an inherited DACL; the winner's
+         * directory must still end up owner-only, like any adopted one. */
+        PACL dacl = NULL;
+        PSECURITY_DESCRIPTOR descriptor = NULL;
+        ACL_SIZE_INFORMATION information;
+        memset(&information, 0, sizeof(information));
+        if (GetNamedSecurityInfoA(cache, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL,
+                                  &dacl, NULL, &descriptor) == ERROR_SUCCESS &&
+            dacl &&
+            GetAclInformation(dacl, &information, sizeof(information), AclSizeInformation)) {
+            owner_only = information.AceCount == 1;
+        }
+        if (descriptor) {
+            (void)LocalFree(descriptor);
+        }
+    }
+
+    (void)RemoveDirectoryA(cache);
+    ipc_test_remove_flat_dir(parent);
+
+    ASSERT_TRUE(paths_ok);
+    /* The seam sat on the path and the racer really won: without these two the
+     * test could pass without ever exercising the race. */
+    ASSERT_EQ(racer.calls, 1);
+    ASSERT_TRUE(racer.planted);
+    ASSERT_TRUE(secured);
+    ASSERT_TRUE(owner_only);
+    PASS();
+}
+
+/* The tolerance above must not admit anything: when what appeared at the path
+ * is NOT a directory, the walk still refuses -- and it says why. A bare
+ * "(endpoint)" is what four reporters in #1533/#1574 were left with; every
+ * refusal on this path names the component and the rule. */
+TEST(daemon_ipc_windows_private_directory_refuses_and_names_a_planted_file) {
+    char parent[TEST_PATH_CAP] = {0};
+    char cache[TEST_PATH_CAP] = {0};
+    char detail[512] = {0};
+    bool paths_ok = false;
+    bool refused = false;
+    ipc_test_win_create_racer_t racer = {.plant_file = true};
+
+    if (ipc_test_parent_new(parent, "win-create-race-file")) {
+        int written = snprintf(cache, sizeof(cache), "%s/cache", parent);
+        paths_ok = written > 0 && written < (int)sizeof(cache);
+    }
+    if (paths_ok) {
+        cbm_daemon_ipc_win_directory_create_hook_set_for_test(ipc_test_win_create_racer, &racer);
+        refused = !cbm_daemon_ipc_private_directory_secure(cache);
+        cbm_daemon_ipc_win_directory_create_hook_set_for_test(NULL, NULL);
+        const char *why = cbm_daemon_ipc_validation_detail();
+        (void)snprintf(detail, sizeof(detail), "%s", why ? why : "");
+    }
+
+    (void)DeleteFileA(cache);
+    ipc_test_remove_flat_dir(parent);
+
+    ASSERT_TRUE(paths_ok);
+    ASSERT_EQ(racer.calls, 1);
+    ASSERT_TRUE(racer.planted);
+    ASSERT_TRUE(refused);
+    ASSERT_NOT_NULL(strstr(detail, "cache"));
+    ASSERT_NOT_NULL(strstr(detail, "not a directory"));
+    PASS();
+}
+
 TEST(daemon_ipc_windows_private_directory_allows_add_subdirectory_only_ancestor) {
     char parent[TEST_PATH_CAP] = {0};
     char add_only[TEST_PATH_CAP] = {0};
@@ -923,6 +1047,120 @@ TEST(daemon_ipc_windows_private_directory_allows_add_subdirectory_only_ancestor)
     PASS();
 }
 
+/* Derive THIS machine's account-domain SID (S-1-5-21-a-b-c) from the current
+ * process token (S-1-5-21-a-b-c-<rid>), independently of production's LSA-based
+ * resolution. Caller frees with FreeSid. */
+static PSID ipc_test_local_account_domain_sid(void) {
+    HANDLE token = NULL;
+    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token)) {
+        return NULL;
+    }
+    DWORD needed = 0;
+    (void)GetTokenInformation(token, TokenUser, NULL, 0, &needed);
+    PSID domain = NULL;
+    if (needed > 0) {
+        void *buffer = calloc(1, needed);
+        if (buffer && GetTokenInformation(token, TokenUser, buffer, needed, &needed)) {
+            PSID user = ((TOKEN_USER *)buffer)->User.Sid;
+            if (user && IsValidSid(user)) {
+                UCHAR count = *GetSidSubAuthorityCount(user);
+                SID_IDENTIFIER_AUTHORITY *authority = GetSidIdentifierAuthority(user);
+                /* Machine/domain account SID: NT authority (Value[5]==5), first
+                 * sub-authority 21, at least the three domain sub-authorities plus
+                 * the account RID. Drop the RID to recover the domain SID. */
+                if (count >= 4 && authority->Value[5] == 5 && *GetSidSubAuthority(user, 0) == 21U) {
+                    SID_IDENTIFIER_AUTHORITY nt = {SECURITY_NT_AUTHORITY};
+                    (void)AllocateAndInitializeSid(
+                        &nt, 4, *GetSidSubAuthority(user, 0), *GetSidSubAuthority(user, 1),
+                        *GetSidSubAuthority(user, 2), *GetSidSubAuthority(user, 3), 0, 0, 0, 0,
+                        &domain);
+                }
+            }
+        }
+        free(buffer);
+    }
+    (void)CloseHandle(token);
+    return domain;
+}
+
+/* Synthesize the RID-500 built-in Administrator SID for a given account-domain
+ * SID, exactly as production does. Caller frees with free(). */
+static PSID ipc_test_admin_sid_for_domain(PSID domain_sid) {
+    if (!domain_sid) {
+        return NULL;
+    }
+    DWORD needed = 0;
+    (void)CreateWellKnownSid(WinAccountAdministratorSid, domain_sid, NULL, &needed);
+    if (needed == 0) {
+        return NULL;
+    }
+    PSID admin = malloc(needed);
+    if (admin && CreateWellKnownSid(WinAccountAdministratorSid, domain_sid, admin, &needed) &&
+        IsValidSid(admin)) {
+        return admin;
+    }
+    free(admin);
+    return NULL;
+}
+
+/* #1705: THIS machine's built-in Administrator ACCOUNT (RID-500 under the local
+ * account-domain SID) is a trusted directory owner/grantee, while a FOREIGN
+ * S-1-5-21-*-500 (a domain administrator, or another machine's built-in
+ * Administrator) must never be.
+ *
+ * RED without the fix: win_sid_trusted rejects the local RID-500 — on the VM this
+ * process runs as `test`, whose RID is not 500, so the -500 SID matches neither
+ * the current user nor SYSTEM, the Administrators GROUP, or TrustedInstaller — so
+ * local_ok is false. GREEN with the fix. foreign_ok is false either way, which is
+ * the exact cross-machine bypass this must never open. */
+TEST(daemon_ipc_windows_sid_trust_accepts_local_admin_rejects_foreign_500) {
+    PSID local_domain = ipc_test_local_account_domain_sid();
+    PSID local_admin = ipc_test_admin_sid_for_domain(local_domain);
+
+    SID_IDENTIFIER_AUTHORITY nt = {SECURITY_NT_AUTHORITY};
+    PSID foreign_domain = NULL;
+    (void)AllocateAndInitializeSid(&nt, 4, 21U, 111U, 222U, 333U, 0, 0, 0, 0, &foreign_domain);
+    PSID foreign_admin = ipc_test_admin_sid_for_domain(foreign_domain);
+
+    PSID builtin_admins = NULL;
+    DWORD builtin_needed = 0;
+    (void)CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, NULL, &builtin_needed);
+    if (builtin_needed > 0) {
+        builtin_admins = malloc(builtin_needed);
+        if (builtin_admins &&
+            !CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, builtin_admins, &builtin_needed)) {
+            free(builtin_admins);
+            builtin_admins = NULL;
+        }
+    }
+
+    bool local_built = local_admin != NULL;
+    bool foreign_built = foreign_admin != NULL;
+    bool builtin_built = builtin_admins != NULL;
+
+    bool local_ok = local_built && cbm_daemon_ipc_win_sid_trusted_for_testing(local_admin);
+    bool foreign_ok = foreign_built && cbm_daemon_ipc_win_sid_trusted_for_testing(foreign_admin);
+    bool builtin_ok = builtin_built && cbm_daemon_ipc_win_sid_trusted_for_testing(builtin_admins);
+
+    free(local_admin);
+    free(foreign_admin);
+    free(builtin_admins);
+    if (local_domain) {
+        FreeSid(local_domain);
+    }
+    if (foreign_domain) {
+        FreeSid(foreign_domain);
+    }
+
+    ASSERT_TRUE(local_built);
+    ASSERT_TRUE(foreign_built);
+    ASSERT_TRUE(builtin_built);
+    ASSERT_TRUE(builtin_ok);  /* the seam works: an already-trusted SID passes */
+    ASSERT_TRUE(local_ok);    /* #1705 fix: THIS machine's RID-500 is trusted */
+    ASSERT_FALSE(foreign_ok); /* safety: a foreign -500 is NEVER trusted */
+    PASS();
+}
+
 TEST(daemon_ipc_windows_legacy_bridge_covers_handoff_and_lifetime) {
     static const char key[] = "91a2b3c4d5e6f708";
     char parent[TEST_PATH_CAP] = {0};
@@ -5009,6 +5247,49 @@ TEST(daemon_ipc_posix_overflow_ancestor_tolerated_only_in_single_uid_ns_issue183
     PASS();
 }
 
+/* #1830 regression guard, and the test that would have caught the original bug
+ * with no namespace at all. The overflow uid used to be memoised per process
+ * via pthread_once. That made a SECURITY decision sticky: pthread_once state
+ * survives fork(), unshare(CLONE_NEWUSER) rewrites /proc/self/uid_map, so a
+ * process that forked and then entered a namespace kept the parent verdict.
+ * Nothing in the suite could see it, because every deterministic #1830 test
+ * drives the override seam rather than the real derivation -- they bind the
+ * decision TABLE, not the WIRING.
+ *
+ * So assert the wiring directly: two ancestor checks must perform two real
+ * derivations. Re-introduce any cache and the second call derives zero times
+ * and this fails by name, on every platform, with no namespace required. */
+TEST(daemon_ipc_posix_overflow_uid_is_never_cached_issue1830) {
+#if defined(__linux__)
+    char parent[TEST_PATH_CAP];
+    if (!ipc_test_parent_new(parent, "overflow-nocache")) {
+        FAIL("could not create the probe parent directory");
+    }
+    char probe[TEST_PATH_CAP];
+    (void)snprintf(probe, sizeof(probe), "%s/x", parent);
+
+    /* The override seam short-circuits derivation, so it must be OFF here or
+     * the test would measure nothing. */
+    cbm_daemon_ipc_posix_set_ancestor_overflow_uid_for_test(false, 0);
+
+    unsigned before = cbm_daemon_ipc_posix_overflow_compute_count_for_test();
+    (void)cbm_daemon_ipc_private_directory_secure(probe);
+    unsigned after_first = cbm_daemon_ipc_posix_overflow_compute_count_for_test();
+    (void)cbm_daemon_ipc_private_directory_secure(probe);
+    unsigned after_second = cbm_daemon_ipc_posix_overflow_compute_count_for_test();
+
+    (void)rmdir(probe);
+    ipc_test_remove_flat_dir(parent);
+
+    ASSERT_TRUE(after_first > before);
+    /* The decisive half: the SECOND call must derive again. */
+    ASSERT_TRUE(after_second > after_first);
+    PASS();
+#else
+    SKIP_PLATFORM("the overflow-uid derivation is Linux-only");
+#endif
+}
+
 /* #1830 real end-to-end smoke: inside a single-uid user namespace the
  * root-owned ancestors (/, /tmp) are overflow-owned, and the daemon must still
  * create its private directory there. An overflow-owned ancestor cannot be
@@ -5016,9 +5297,23 @@ TEST(daemon_ipc_posix_overflow_ancestor_tolerated_only_in_single_uid_ns_issue183
  * namespace is actually available. O10 whitelisted-skip everywhere it is not:
  * macOS has no user namespaces (compile-gated out); Docker's default seccomp
  * blocks unshare(CLONE_NEWUSER) on the Colima container leg; some kernels ship
- * user namespaces disabled. WHAT WAS TRIED when it skips: fork + unshare
+ * user namespaces disabled. NOT on that list any more: Ubuntu 23.10+ restricts
+ * unprivileged userns via AppArmor, which used to confine this test to the two
+ * ubuntu-22.04 legs -- broad-matrix only, so it ran in no PR and sat on
+ * GitHub's 2027-04-17 retirement clock. _test.yml now lifts that with
+ * kernel.apparmor_restrict_unprivileged_userns=0 on every ubuntu leg, so this
+ * runs on the CORE matrix. WHAT WAS TRIED when it skips: fork + unshare
  * CLONE_NEWUSER + a 1:1 uid_map write, which the sandbox denied (EPERM). The
- * deterministic decision coverage above is what binds the fix. */
+ * deterministic decision coverage above is what binds the fix.
+ *
+ * TO REPRODUCE IT LOCALLY two things are needed, and the second is easy to
+ * miss: run the container with --security-opt seccomp=unconfined so unshare is
+ * permitted, AND run the suite as a NON-ROOT uid. As root the mapped range
+ * covers uid 0, so root-owned /tmp stays 1:1 inside the namespace, never turns
+ * overflow, and this test passes without ever reaching the branch it exists to
+ * cover -- it passes just as happily with the fix reverted. Under `su tester`
+ * (uid 1001, the shape CI's runner user has) the ancestors do go overflow and
+ * the assertion becomes real. */
 TEST(daemon_ipc_posix_single_uid_userns_real_smoke_issue1830) {
 #if defined(__linux__)
     uid_t host_uid = geteuid();
@@ -5049,9 +5344,20 @@ TEST(daemon_ipc_posix_single_uid_userns_real_smoke_issue1830) {
             _exit(2);
         }
         /* Inside the ns / and /tmp now show the overflow uid. With #1830 the
-         * daemon can still build its private tree there; without it, refused. */
-        bool secured = cbm_daemon_ipc_private_directory_secure(probe);
-        _exit(secured ? 0 : 1);
+         * daemon can still build its private tree there; without it, refused.
+         *
+         * EXEC, do not just call. The overflow uid is derived once per process
+         * (pthread_once) from /proc/self/uid_map, and that state survives
+         * fork(): seven earlier call sites in this suite prime it with the HOST
+         * answer, so a forked child keeps "no overflow uid" and refuses no
+         * matter what its namespace says. That made this test fail on the only
+         * platform where it actually runs (ubuntu-22.04; macOS compile-gates it
+         * out, Colima's seccomp blocks unshare, and 23.10+ restricts
+         * unprivileged userns) -- while looking like a product regression.
+         * Re-exec so the decision is made by a process that STARTED here, which
+         * is also the only shape production ever takes. */
+        (void)execl("/proc/self/exe", "test-runner", "--userns-secure-probe", probe, (char *)NULL);
+        _exit(3); /* exec failed -- distinct from secure(0)/refused(1)/skip(2) */
     }
     if (child < 0) {
         FAIL("fork failed for userns smoke");
@@ -5063,7 +5369,24 @@ TEST(daemon_ipc_posix_single_uid_userns_real_smoke_issue1830) {
     if (WIFEXITED(status) && WEXITSTATUS(status) == 2) {
         SKIP_PLATFORM("user namespaces unavailable (no CLONE_NEWUSER / seccomp-blocked)");
     }
-    ASSERT_TRUE(WIFEXITED(status));
+    /* A failed re-exec must never read as a product refusal: 3 is its own code
+     * so a broken probe is a loud harness failure, not a quiet "refused". */
+    if (WIFEXITED(status) && WEXITSTATUS(status) == 3) {
+        FAIL("userns smoke could not re-exec /proc/self/exe for the probe");
+    }
+    /* {0,1,2,3} is the whole protocol. Any other code -- a sanitizer exit (LSan
+     * defaults to 23), an abort, a signal -- is a broken harness, not a refusal,
+     * and must say so with the code it actually saw. */
+    if (!WIFEXITED(status)) {
+        FAIL("userns probe did not exit normally (signalled) -- not a security verdict");
+    }
+    if (WEXITSTATUS(status) != 0 && WEXITSTATUS(status) != 1) {
+        char unexpected[128];
+        (void)snprintf(unexpected, sizeof(unexpected),
+                       "userns probe exited %d -- not a security verdict",
+                       WEXITSTATUS(status));
+        FAIL(unexpected);
+    }
     ASSERT_EQ(0, WEXITSTATUS(status));
     PASS();
 #else
@@ -5073,6 +5396,83 @@ TEST(daemon_ipc_posix_single_uid_userns_real_smoke_issue1830) {
 #endif /* CBM_ENABLE_TEST_SEAMS */
 #endif /* !_WIN32 */
 
+#ifndef _WIN32
+enum { IPC_TEST_LOG_CAPTURE_CAP = 16384 };
+static char ipc_test_log_capture[IPC_TEST_LOG_CAPTURE_CAP];
+static size_t ipc_test_log_capture_used;
+
+static void ipc_test_log_capture_sink(const char *line) {
+    if (!line) {
+        return;
+    }
+    size_t length = strlen(line);
+    if (ipc_test_log_capture_used + length + 2 > sizeof(ipc_test_log_capture)) {
+        return;
+    }
+    memcpy(ipc_test_log_capture + ipc_test_log_capture_used, line, length);
+    ipc_test_log_capture_used += length;
+    ipc_test_log_capture[ipc_test_log_capture_used++] = '\n';
+    ipc_test_log_capture[ipc_test_log_capture_used] = '\0';
+}
+
+/* #1828: a full /tmp made every daemon start die at pending publication, and
+ * the only durable trace was `daemon.ipc.listen_failed stage=pending_publication`
+ * -- no syscall, no errno, no path. The reporter needed hours (and a wrong
+ * `df` on the wrong mount) to find the cause. The failure line must name the
+ * errno and the exact artifact path that could not be written. */
+TEST(daemon_ipc_listen_failure_names_errno_and_path) {
+    static const char key[] = "1828000000000001";
+    char parent[TEST_PATH_CAP] = {0};
+    char runtime_dir[TEST_PATH_CAP] = {0};
+    char socket_path[TEST_PATH_CAP] = {0};
+    char pending_path[TEST_PATH_CAP] = {0};
+    char expected_path[TEST_PATH_CAP + 16] = {0};
+    cbm_daemon_ipc_endpoint_t *endpoint = NULL;
+    cbm_daemon_ipc_listener_t *listener = NULL;
+
+    bool parent_ok = ipc_test_parent_new(parent, "enospc-diag");
+    if (parent_ok) {
+        endpoint = cbm_daemon_ipc_endpoint_new(key, parent);
+    }
+    if (endpoint) {
+        ipc_test_copy_path(runtime_dir, cbm_daemon_ipc_endpoint_runtime_dir(endpoint));
+        ipc_test_copy_path(socket_path, cbm_daemon_ipc_endpoint_address(endpoint));
+    }
+    bool paths_ok = endpoint && ipc_test_socket_pending_path(pending_path, socket_path) &&
+                    snprintf(expected_path, sizeof(expected_path), "path=%s.tmp", pending_path) > 0;
+    if (paths_ok) {
+        ipc_test_log_capture_used = 0;
+        ipc_test_log_capture[0] = '\0';
+        cbm_daemon_ipc_posix_record_write_failure_set_for_test(ENOSPC);
+        cbm_log_set_sink_ex(ipc_test_log_capture_sink, CBM_LOG_SINK_REPLACE);
+        listener = cbm_daemon_ipc_listen(endpoint);
+        cbm_log_set_sink(NULL);
+        cbm_daemon_ipc_posix_record_write_failure_set_for_test(0);
+    }
+    const char *failed = strstr(ipc_test_log_capture, "msg=daemon.ipc.listen_failed");
+    bool stage_named = failed && strstr(failed, "stage=pending_publication") != NULL;
+    bool errno_named = failed && strstr(failed, "errno=ENOSPC") != NULL;
+    bool path_named = failed && strstr(failed, expected_path) != NULL;
+    struct stat leftover;
+    bool namespace_clean = paths_ok && lstat(socket_path, &leftover) != 0 && errno == ENOENT &&
+                           lstat(pending_path, &leftover) != 0 && errno == ENOENT;
+
+    cbm_daemon_ipc_listener_close(listener);
+    cbm_daemon_ipc_endpoint_free(endpoint);
+    th_cleanup(parent_ok ? parent : NULL);
+
+    ASSERT_TRUE(parent_ok);
+    ASSERT_TRUE(paths_ok);
+    ASSERT_TRUE(listener == NULL);
+    ASSERT_TRUE(failed != NULL);
+    ASSERT_TRUE(stage_named);
+    ASSERT_TRUE(errno_named);
+    ASSERT_TRUE(path_named);
+    ASSERT_TRUE(namespace_clean);
+    PASS();
+}
+#endif
+
 SUITE(daemon_ipc) {
     RUN_TEST(daemon_ipc_pending_timeout_race_returns_completed_io);
     RUN_TEST(daemon_ipc_pending_wait_failure_cancels_and_drains);
@@ -5084,7 +5484,10 @@ SUITE(daemon_ipc) {
     RUN_TEST(daemon_ipc_windows_default_endpoint_ignores_temp_environment);
     RUN_TEST(daemon_ipc_windows_private_directory_rejects_untrusted_ancestor_acl);
     RUN_TEST(daemon_ipc_windows_private_directory_ace_is_inheritable);
+    RUN_TEST(daemon_ipc_windows_private_directory_survives_lost_creation_race);
+    RUN_TEST(daemon_ipc_windows_private_directory_refuses_and_names_a_planted_file);
     RUN_TEST(daemon_ipc_windows_private_directory_allows_add_subdirectory_only_ancestor);
+    RUN_TEST(daemon_ipc_windows_sid_trust_accepts_local_admin_rejects_foreign_500);
     RUN_TEST(daemon_ipc_windows_legacy_bridge_covers_handoff_and_lifetime);
     RUN_TEST(daemon_ipc_windows_local_transition_atomically_reserves_legacy_pipe);
     RUN_TEST(daemon_ipc_windows_startup_retries_transient_rendezvous_reader);
@@ -5116,6 +5519,7 @@ SUITE(daemon_ipc) {
 #ifdef CBM_ENABLE_TEST_SEAMS
     RUN_TEST(daemon_ipc_posix_uid_map_single_uid_parse_issue1830);
     RUN_TEST(daemon_ipc_posix_overflow_ancestor_tolerated_only_in_single_uid_ns_issue1830);
+    RUN_TEST(daemon_ipc_posix_overflow_uid_is_never_cached_issue1830);
     RUN_TEST(daemon_ipc_posix_single_uid_userns_real_smoke_issue1830);
 #endif
     RUN_TEST(daemon_ipc_posix_startup_lock_is_cross_process);
@@ -5145,5 +5549,8 @@ SUITE(daemon_ipc) {
     RUN_TEST(daemon_ipc_posix_private_directory_rejects_world_writable_ancestor);
     RUN_TEST(daemon_ipc_posix_private_log_rejects_symlinks_and_is_owner_only);
     RUN_TEST(daemon_ipc_posix_rejects_non_socket_and_symlink_endpoints);
+#ifndef _WIN32
+    RUN_TEST(daemon_ipc_listen_failure_names_errno_and_path);
+#endif
 #endif
 }
diff --git a/tests/test_daemon_runtime.c b/tests/test_daemon_runtime.c
index 991506a74..8bfb611bc 100644
--- a/tests/test_daemon_runtime.c
+++ b/tests/test_daemon_runtime.c
@@ -21,6 +21,7 @@
 #include "foundation/compat_thread.h"
 #include "foundation/log.h"
 #include "foundation/platform.h"
+#include "foundation/sanitized.h"
 #include "pipeline/pipeline.h"
 #include "store/store.h"
 
@@ -2617,6 +2618,126 @@ TEST(daemon_runtime_final_disconnect_automatically_exits_within_bound) {
     PASS();
 }
 
+/* Cold-storm ephemeral-retirement gate (2026-09). A one-shot client sharing an
+ * ephemeral generation and racing connect() must not be stranded when another
+ * one-shot's connection just left. The generation lingers while a peer is still
+ * accepted (mid-HELLO) at the moment the last committed client disconnects; the
+ * accept loop retires it once the peer drains or a bounded window elapses. A raw
+ * connection (accepted, no HELLO sent) is exactly that racing peer. */
+#if defined(CBM_ENABLE_TEST_SEAMS)
+/* Direction 1 (the fix): with a peer accepted mid-HELLO, closing the last
+ * committed client leaves the generation RUNNING (lingering), not STOPPING, so
+ * the peer is not stranded. Reverting the active_connections gate flips
+ * `lingered` RED. A window far longer than the test keeps expiry from deciding
+ * the verdict. */
+TEST(daemon_runtime_ephemeral_lingers_while_peer_mid_hello) {
+    cbm_daemon_build_identity_t identity =
+        runtime_test_identity("2.4.0", runtime_test_self_build());
+    cbm_daemon_runtime_service_set_ephemeral_linger_timeout_for_testing(600000);
+    runtime_test_fixture_t fixture;
+    bool started = runtime_test_fixture_start(&fixture, "storm-peer", &identity);
+    cbm_daemon_runtime_client_t *client = NULL;
+    cbm_daemon_ipc_connection_t *peer = NULL;
+    cbm_daemon_runtime_connect_result_t result = {0};
+    bool peer_accepted = false;
+    bool lingered = false;
+    bool held_through_reconcile = false;
+
+    if (started) {
+        client = cbm_daemon_runtime_client_connect(fixture.endpoint, &identity,
+                                                   RUNTIME_TEST_TIMEOUT_MS, &result);
+    }
+    if (client) {
+        /* A racing peer: accepted (active_connections++), still mid-HELLO (no
+         * HELLO frame), so not a committed client. */
+        peer = cbm_daemon_ipc_connect(fixture.endpoint, RUNTIME_TEST_TIMEOUT_MS);
+        for (int i = 0; i < 1000 && !peer_accepted; i++) {
+            if (cbm_daemon_runtime_service_active_connections(fixture.service) >= 2) {
+                peer_accepted = true;
+                break;
+            }
+            cbm_usleep(2000);
+        }
+    }
+    if (peer_accepted) {
+        (void)cbm_daemon_runtime_client_close(client, RUNTIME_TEST_TIMEOUT_MS);
+        client = NULL;
+        lingered =
+            cbm_daemon_runtime_service_state(fixture.service) == CBM_DAEMON_RUNTIME_SERVICE_RUNNING;
+        cbm_daemon_runtime_service_reconcile_lifetime(fixture.service);
+        held_through_reconcile =
+            cbm_daemon_runtime_service_state(fixture.service) == CBM_DAEMON_RUNTIME_SERVICE_RUNNING;
+    }
+    if (peer) {
+        cbm_daemon_ipc_connection_close(peer);
+    }
+    if (client) {
+        (void)cbm_daemon_runtime_client_close(client, RUNTIME_TEST_TIMEOUT_MS);
+    }
+    cbm_daemon_runtime_service_set_ephemeral_linger_timeout_for_testing(UINT32_MAX);
+    runtime_test_fixture_finish(&fixture);
+
+    ASSERT_TRUE(started);
+    ASSERT_TRUE(peer_accepted);
+    ASSERT_TRUE(lingered);
+    ASSERT_TRUE(held_through_reconcile);
+    PASS();
+}
+
+/* Direction 2 (bounded, no hang): a peer that never commits must not wedge the
+ * lingering generation forever (the host_serving 900s hang). With the window
+ * collapsed to zero the accept loop reconcile reaches the backstop and retires
+ * even while the peer is still accepted. Removing the window backstop hangs
+ * this test. */
+TEST(daemon_runtime_ephemeral_linger_retires_within_bound) {
+    cbm_daemon_build_identity_t identity =
+        runtime_test_identity("2.4.0", runtime_test_self_build());
+    cbm_daemon_runtime_service_set_ephemeral_linger_timeout_for_testing(0);
+    runtime_test_fixture_t fixture;
+    bool started = runtime_test_fixture_start(&fixture, "storm-bound", &identity);
+    cbm_daemon_runtime_client_t *client = NULL;
+    cbm_daemon_ipc_connection_t *peer = NULL;
+    cbm_daemon_runtime_connect_result_t result = {0};
+    bool peer_accepted = false;
+    bool exited = false;
+
+    if (started) {
+        client = cbm_daemon_runtime_client_connect(fixture.endpoint, &identity,
+                                                   RUNTIME_TEST_TIMEOUT_MS, &result);
+    }
+    if (client) {
+        peer = cbm_daemon_ipc_connect(fixture.endpoint, RUNTIME_TEST_TIMEOUT_MS);
+        for (int i = 0; i < 1000 && !peer_accepted; i++) {
+            if (cbm_daemon_runtime_service_active_connections(fixture.service) >= 2) {
+                peer_accepted = true;
+                break;
+            }
+            cbm_usleep(2000);
+        }
+    }
+    if (peer_accepted) {
+        (void)cbm_daemon_runtime_client_close(client, RUNTIME_TEST_TIMEOUT_MS);
+        client = NULL;
+        /* Peer never commits + window already elapsed -> the bounded backstop in
+         * the accept loop reconcile must retire the generation, not hang. */
+        exited = cbm_daemon_runtime_service_wait_exited(fixture.service, RUNTIME_TEST_TIMEOUT_MS);
+    }
+    if (peer) {
+        cbm_daemon_ipc_connection_close(peer);
+    }
+    if (client) {
+        (void)cbm_daemon_runtime_client_close(client, RUNTIME_TEST_TIMEOUT_MS);
+    }
+    cbm_daemon_runtime_service_set_ephemeral_linger_timeout_for_testing(UINT32_MAX);
+    runtime_test_fixture_finish(&fixture);
+
+    ASSERT_TRUE(started);
+    ASSERT_TRUE(peer_accepted);
+    ASSERT_TRUE(exited);
+    PASS();
+}
+#endif
+
 TEST(daemon_runtime_authenticated_idle_connection_outlives_lease_interval) {
     cbm_daemon_build_identity_t identity =
         runtime_test_identity("2.4.0", runtime_test_self_build());
@@ -3556,10 +3677,18 @@ TEST(daemon_runtime_disconnect_cancels_blocked_non_index_child_and_preserves_oth
     SKIP_PLATFORM("requires a queryable copied process image");
 #else
     enum {
+#if CBM_SANITIZED
+        /* This readiness wait is a liveness backstop, not the behavior under
+         * test. The copied instrumented runner can take several seconds to
+         * reach main on macOS, especially while the parallel gate is busy. */
+        CHILD_READY_BOUND_MS = 60000,
+        REQUEST_TIMEOUT_MS = 90000,
+#else
         CHILD_READY_BOUND_MS = 5000,
+        REQUEST_TIMEOUT_MS = 15000,
+#endif
         CHILD_CANCEL_BOUND_MS = 3000,
         CHILD_CLEANUP_BOUND_MS = 5000,
-        REQUEST_TIMEOUT_MS = 15000,
     };
     const char *old_cache = getenv("CBM_CACHE_DIR");
     const char *old_path = getenv("PATH");
@@ -5002,6 +5131,10 @@ SUITE(daemon_runtime) {
     RUN_TEST(daemon_runtime_conflict_log_failure_uses_operation_log_fallback);
     RUN_TEST(daemon_runtime_disconnect_releases_only_connection_subscriptions);
     RUN_TEST(daemon_runtime_final_disconnect_automatically_exits_within_bound);
+#if defined(CBM_ENABLE_TEST_SEAMS)
+    RUN_TEST(daemon_runtime_ephemeral_lingers_while_peer_mid_hello);
+    RUN_TEST(daemon_runtime_ephemeral_linger_retires_within_bound);
+#endif
     RUN_TEST(daemon_runtime_authenticated_idle_connection_outlives_lease_interval);
     RUN_TEST(daemon_runtime_connection_cap_covers_slow_hello_and_stopping_is_terminal);
     RUN_TEST(daemon_runtime_rejects_forged_identity_extension);
diff --git a/tests/test_discover.c b/tests/test_discover.c
index d0ab9a020..91afd8392 100644
--- a/tests/test_discover.c
+++ b/tests/test_discover.c
@@ -475,6 +475,163 @@ TEST(discover_bounded_count_matches_shebang_discovery) {
     PASS();
 }
 
+TEST(discover_resource_policy_off_matches_legacy_discovery) {
+    char *base = th_mktempdir("cbm_disc_policy_off");
+    ASSERT(base != NULL);
+    th_write_file(TH_PATH(base, "src/first.c"), "int first;\n");
+    th_write_file(TH_PATH(base, "src/second.py"), "second = 2\n");
+    th_write_file(TH_PATH(base, "src/ignored.png"), "not source\n");
+
+    cbm_file_info_t *legacy_files = NULL;
+    int legacy_count = 0;
+    cbm_discover_opts_t legacy_opts = {.mode = CBM_MODE_FULL};
+    ASSERT_EQ(cbm_discover(base, &legacy_opts, &legacy_files, &legacy_count), CBM_DISCOVER_OK);
+
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    cbm_index_resource_violation_t violation = {0};
+    cbm_file_info_t *policy_files = NULL;
+    int policy_count = 0;
+    cbm_discover_opts_t policy_opts = {
+        .mode = CBM_MODE_FULL,
+        .resource_policy = &policy,
+        .resource_violation = &violation,
+    };
+    cbm_discover_status_t status = cbm_discover(base, &policy_opts, &policy_files, &policy_count);
+
+    ASSERT_EQ(status, CBM_DISCOVER_OK);
+    ASSERT_EQ(policy_count, legacy_count);
+    ASSERT_EQ(violation.resource, CBM_INDEX_RESOURCE_NONE);
+    for (int index = 0; index < legacy_count; index++) {
+        ASSERT_STR_EQ(policy_files[index].rel_path, legacy_files[index].rel_path);
+        ASSERT_EQ(policy_files[index].size, legacy_files[index].size);
+    }
+
+    cbm_discover_free(legacy_files, legacy_count);
+    cbm_discover_free(policy_files, policy_count);
+    th_cleanup(base);
+    PASS();
+}
+
+TEST(discover_resource_file_limit_is_exact_and_counts_only_accepted_sources) {
+    char *base = th_mktempdir("cbm_disc_policy_files");
+    ASSERT(base != NULL);
+    th_write_file(TH_PATH(base, ".gitignore"), "ignored.c\n");
+    th_write_file(TH_PATH(base, "accepted.c"), "int accepted;\n");
+    th_write_file(TH_PATH(base, "ignored.c"), "int ignored;\n");
+    th_write_file(TH_PATH(base, "unsupported.png"), "not source\n");
+
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    policy.max_files = (cbm_index_limit_u64_t){.enabled = true, .value = 1};
+    cbm_index_resource_violation_t violation = {0};
+    cbm_discover_opts_t opts = {
+        .mode = CBM_MODE_FULL,
+        .resource_policy = &policy,
+        .resource_violation = &violation,
+    };
+    cbm_file_info_t *files = NULL;
+    int count = 0;
+    ASSERT_EQ(cbm_discover(base, &opts, &files, &count), CBM_DISCOVER_OK);
+    ASSERT_EQ(count, 1);
+    ASSERT_EQ(violation.resource, CBM_INDEX_RESOURCE_NONE);
+    cbm_discover_free(files, count);
+
+    th_write_file(TH_PATH(base, "second.py"), "second = 2\n");
+    files = NULL;
+    count = 99;
+    ASSERT_EQ(cbm_discover(base, &opts, &files, &count), CBM_DISCOVER_LIMIT_EXCEEDED);
+    ASSERT(files == NULL);
+    ASSERT_EQ(count, 0);
+    ASSERT_EQ(violation.resource, CBM_INDEX_RESOURCE_FILES);
+    ASSERT_EQ(violation.observed, 2);
+    ASSERT_EQ(violation.limit, 1);
+
+    th_cleanup(base);
+    PASS();
+}
+
+TEST(discover_resource_source_bytes_allows_equality_and_rejects_one_more_byte) {
+    char *base = th_mktempdir("cbm_disc_policy_bytes");
+    ASSERT(base != NULL);
+    th_write_file(TH_PATH(base, "exact.c"), "1234567");
+
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    policy.max_source_bytes = (cbm_index_limit_u64_t){.enabled = true, .value = 7};
+    cbm_index_resource_violation_t violation = {0};
+    cbm_discover_opts_t opts = {
+        .mode = CBM_MODE_FULL,
+        .resource_policy = &policy,
+        .resource_violation = &violation,
+    };
+    cbm_file_info_t *files = NULL;
+    int count = 0;
+    ASSERT_EQ(cbm_discover(base, &opts, &files, &count), CBM_DISCOVER_OK);
+    ASSERT_EQ(count, 1);
+    cbm_discover_free(files, count);
+
+    th_write_file(TH_PATH(base, "plus.py"), "x");
+    files = NULL;
+    count = 99;
+    ASSERT_EQ(cbm_discover(base, &opts, &files, &count), CBM_DISCOVER_LIMIT_EXCEEDED);
+    ASSERT(files == NULL);
+    ASSERT_EQ(count, 0);
+    ASSERT_EQ(violation.resource, CBM_INDEX_RESOURCE_SOURCE_BYTES);
+    ASSERT_EQ(violation.observed, 8);
+    ASSERT_EQ(violation.limit, 7);
+
+    th_cleanup(base);
+    PASS();
+}
+
+TEST(discover_resource_file_budget_excludes_existing_oversized_skip) {
+    char *base = th_mktempdir("cbm_disc_policy_oversized");
+    ASSERT(base != NULL);
+    th_write_file(TH_PATH(base, "accepted.c"), "x");
+    th_write_file(TH_PATH(base, "oversized.py"), "123");
+    const char *saved_limit = getenv("CBM_MAX_FILE_BYTES");
+    char *saved_limit_copy = saved_limit ? strdup(saved_limit) : NULL;
+    cbm_setenv("CBM_MAX_FILE_BYTES", "2", 1);
+
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    policy.max_files = (cbm_index_limit_u64_t){.enabled = true, .value = 1};
+    cbm_index_resource_violation_t violation = {0};
+    cbm_discover_opts_t opts = {
+        .mode = CBM_MODE_FULL,
+        .resource_policy = &policy,
+        .resource_violation = &violation,
+    };
+    cbm_file_info_t *files = NULL;
+    int count = 0;
+    cbm_discover_status_t initial_status = cbm_discover(base, &opts, &files, &count);
+    bool oversized_did_not_consume_budget = initial_status == CBM_DISCOVER_OK && count == 2 &&
+                                            violation.resource == CBM_INDEX_RESOURCE_NONE;
+    cbm_discover_free(files, count);
+
+    th_write_file(TH_PATH(base, "second.c"), "y");
+    files = NULL;
+    count = 0;
+    cbm_discover_status_t exceeded_status = cbm_discover(base, &opts, &files, &count);
+    bool accepted_sources_exceeded = exceeded_status == CBM_DISCOVER_LIMIT_EXCEEDED &&
+                                     files == NULL && count == 0 &&
+                                     violation.resource == CBM_INDEX_RESOURCE_FILES &&
+                                     violation.observed == 2 && violation.limit == 1;
+
+    if (saved_limit_copy) {
+        cbm_setenv("CBM_MAX_FILE_BYTES", saved_limit_copy, 1);
+    } else {
+        cbm_unsetenv("CBM_MAX_FILE_BYTES");
+    }
+    free(saved_limit_copy);
+    th_cleanup(base);
+
+    ASSERT_TRUE(oversized_did_not_consume_budget);
+    ASSERT_TRUE(accepted_sources_exceeded);
+    PASS();
+}
+
 TEST(discover_skips_git_dir) {
     char *base = th_mktempdir("cbm_disc_git");
     ASSERT(base != NULL);
@@ -2137,6 +2294,10 @@ SUITE(discover) {
     RUN_TEST(discover_bounded_count_is_allocation_free_and_limit_exact);
     RUN_TEST(discover_bounded_count_fails_closed_after_deadline);
     RUN_TEST(discover_bounded_count_matches_shebang_discovery);
+    RUN_TEST(discover_resource_policy_off_matches_legacy_discovery);
+    RUN_TEST(discover_resource_file_limit_is_exact_and_counts_only_accepted_sources);
+    RUN_TEST(discover_resource_source_bytes_allows_equality_and_rejects_one_more_byte);
+    RUN_TEST(discover_resource_file_budget_excludes_existing_oversized_skip);
     RUN_TEST(discover_skips_git_dir);
     RUN_TEST(discover_with_gitignore);
     RUN_TEST(discover_with_global_xdg_ignore);
diff --git a/tests/test_doclinks.c b/tests/test_doclinks.c
new file mode 100644
index 000000000..af24c2447
--- /dev/null
+++ b/tests/test_doclinks.c
@@ -0,0 +1,556 @@
+/*
+ * test_doclinks.c — Tests for markdown → file reference linking.
+ *
+ * Unit-test approach mirrors test_configlink.c: create real files in a
+ * tmpdir (the pass reads content from disk), set up File nodes in a gbuf,
+ * run the pass, check REFERENCES_FILE edges.
+ */
+#include "../src/foundation/compat.h"
+#include "test_framework.h"
+#include "test_helpers.h"
+#include "pipeline/pipeline.h"
+#include "pipeline/pipeline_internal.h"
+#include "graph_buffer/graph_buffer.h"
+
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdatomic.h>
+
+/* ── Helpers ─────────────────────────────────────────────────────── */
+
+/* Run the pass with a minimal ctx (same shape as run_configlink). */
+static int run_doclinks(cbm_gbuf_t *gb, const char *project, const char *repo_path) {
+    atomic_int cancelled;
+    atomic_init(&cancelled, 0);
+    cbm_pipeline_ctx_t ctx = {
+        .project_name = project,
+        .repo_path = repo_path,
+        .gbuf = gb,
+        .cancelled = &cancelled,
+    };
+    return cbm_pipeline_pass_doclinks(&ctx);
+}
+
+/* Create a File node the way pass_structure does: QN via fqn_compute with
+ * "__file__", file_path = repo-relative path. Returns the node id. */
+static int64_t add_file_node(cbm_gbuf_t *gb, const char *project, const char *rel) {
+    char *qn = cbm_pipeline_fqn_compute(project, rel, "__file__");
+    const char *slash = strrchr(rel, '/');
+    const char *basename = slash ? slash + 1 : rel;
+    int64_t id = cbm_gbuf_upsert_node(gb, "File", basename, qn, rel, 0, 0, NULL);
+    free(qn);
+    return id;
+}
+
+/* Find the REFERENCES_FILE edge between two node ids. NULL if absent. */
+static const cbm_gbuf_edge_t *find_ref_edge(cbm_gbuf_t *gb, int64_t src, int64_t tgt) {
+    const cbm_gbuf_edge_t **edges = NULL;
+    int count = 0;
+    cbm_gbuf_find_edges_by_type(gb, "REFERENCES_FILE", &edges, &count);
+    for (int i = 0; i < count; i++) {
+        if (edges[i]->source_id == src && edges[i]->target_id == tgt) {
+            return edges[i];
+        }
+    }
+    return NULL;
+}
+
+/* True when the edge's props JSON carries the given strategy. */
+static bool edge_has_strategy(const cbm_gbuf_edge_t *e, const char *strategy) {
+    char needle[64];
+    snprintf(needle, sizeof(needle), "\"strategy\":\"%s\"", strategy);
+    return e && e->properties_json && strstr(e->properties_json, needle) != NULL;
+}
+
+/* Total REFERENCES_FILE edge count. */
+static int ref_edge_count(cbm_gbuf_t *gb) {
+    return cbm_gbuf_edge_count_by_type(gb, "REFERENCES_FILE");
+}
+
+/* Fixture: tmpdir + project + gbuf. */
+typedef struct {
+    char tmpdir[256];
+    char *project;
+    cbm_gbuf_t *gb;
+} dl_fix_t;
+
+static bool dl_fix_init(dl_fix_t *fx) {
+    snprintf(fx->tmpdir, sizeof(fx->tmpdir), "/tmp/cbm_doclinks_XXXXXX");
+    if (!cbm_mkdtemp(fx->tmpdir)) {
+        return false;
+    }
+    fx->project = cbm_project_name_from_path(fx->tmpdir);
+    fx->gb = cbm_gbuf_new(fx->project, fx->tmpdir);
+    return fx->gb != NULL;
+}
+
+static void dl_fix_free(dl_fix_t *fx) {
+    cbm_gbuf_free(fx->gb);
+    free(fx->project);
+    th_rmtree(fx->tmpdir);
+}
+
+/* ── Markdown: inline link ───────────────────────────────────────── */
+
+TEST(doclinks_md_inline_link) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "docs/guide.md"),
+                  "# Guide\n\nSee [the build script](../scripts/build.sh) for details.\n");
+    th_write_file(TH_PATH(fx.tmpdir, "scripts/build.sh"), "#!/bin/sh\necho build\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "docs/guide.md");
+    int64_t script_id = add_file_node(fx.gb, fx.project, "scripts/build.sh");
+
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_GT(n, 0);
+
+    const cbm_gbuf_edge_t *e = find_ref_edge(fx.gb, doc_id, script_id);
+    ASSERT_NOT_NULL(e);
+    ASSERT_TRUE(edge_has_strategy(e, "md_inline_link"));
+    ASSERT_NOT_NULL(strstr(e->properties_json, "\"confidence\":0.95"));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Markdown: backtick path ─────────────────────────────────────── */
+
+TEST(doclinks_md_backtick_path) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"),
+                  "Run `scripts/build.sh` before pushing. `not_a_file.xyz` is unknown.\n");
+    th_write_file(TH_PATH(fx.tmpdir, "scripts/build.sh"), "#!/bin/sh\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "README.md");
+    int64_t script_id = add_file_node(fx.gb, fx.project, "scripts/build.sh");
+
+    run_doclinks(fx.gb, fx.project, fx.tmpdir);
+
+    const cbm_gbuf_edge_t *e = find_ref_edge(fx.gb, doc_id, script_id);
+    ASSERT_NOT_NULL(e);
+    ASSERT_TRUE(edge_has_strategy(e, "md_backtick_path"));
+    /* `not_a_file.xyz` has no File node → no invented target */
+    ASSERT_EQ(ref_edge_count(fx.gb), 1);
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Markdown: bare mention ──────────────────────────────────────── */
+
+TEST(doclinks_md_bare_mention) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "STANDARDS.md"),
+                  "All handlers live in src/handlers.c and follow the pattern there.\n");
+    th_write_file(TH_PATH(fx.tmpdir, "src/handlers.c"), "int h(void) { return 0; }\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "STANDARDS.md");
+    int64_t code_id = add_file_node(fx.gb, fx.project, "src/handlers.c");
+
+    run_doclinks(fx.gb, fx.project, fx.tmpdir);
+
+    const cbm_gbuf_edge_t *e = find_ref_edge(fx.gb, doc_id, code_id);
+    ASSERT_NOT_NULL(e);
+    ASSERT_TRUE(edge_has_strategy(e, "md_bare_mention"));
+    ASSERT_NOT_NULL(strstr(e->properties_json, "\"confidence\":0.70"));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Markdown: non-file links ignored (http / mailto / #anchor) ──── */
+
+TEST(doclinks_md_non_file_link_ignored) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"),
+                  "See [the site](https://example.com/scripts/build.sh) or\n"
+                  "[mail us](mailto:dev@example.com) or [below](#usage).\n");
+    th_write_file(TH_PATH(fx.tmpdir, "scripts/build.sh"), "#!/bin/sh\n");
+
+    add_file_node(fx.gb, fx.project, "README.md");
+    add_file_node(fx.gb, fx.project, "scripts/build.sh");
+
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_EQ(n, 0);
+    ASSERT_EQ(ref_edge_count(fx.gb), 0);
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Markdown: anchor suffix on a file link still resolves ───────── */
+
+TEST(doclinks_md_link_with_anchor_resolves_file) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "docs/a.md"), "See [setup](../INSTALL.md#quick-start).\n");
+    th_write_file(TH_PATH(fx.tmpdir, "INSTALL.md"), "# Install\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "docs/a.md");
+    int64_t tgt_id = add_file_node(fx.gb, fx.project, "INSTALL.md");
+
+    run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_NOT_NULL(find_ref_edge(fx.gb, doc_id, tgt_id));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Dedupe: repeated references collapse to one counted edge ────── */
+
+TEST(doclinks_dedupe_keeps_count) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"),
+                  "Use [build](scripts/build.sh) daily.\n"
+                  "Run `scripts/build.sh` first, then scripts/build.sh again.\n");
+    th_write_file(TH_PATH(fx.tmpdir, "scripts/build.sh"), "#!/bin/sh\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "README.md");
+    int64_t script_id = add_file_node(fx.gb, fx.project, "scripts/build.sh");
+
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    /* three matches, ONE edge */
+    ASSERT_EQ(n, 1);
+    ASSERT_EQ(ref_edge_count(fx.gb), 1);
+
+    const cbm_gbuf_edge_t *e = find_ref_edge(fx.gb, doc_id, script_id);
+    ASSERT_NOT_NULL(e);
+    ASSERT_NOT_NULL(strstr(e->properties_json, "\"count\":3"));
+    /* highest-confidence match kind wins the edge label */
+    ASSERT_TRUE(edge_has_strategy(e, "md_inline_link"));
+    ASSERT_NOT_NULL(strstr(e->properties_json, "\"confidence\":0.95"));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Path resolution: relative to the referencing file's directory ── */
+
+TEST(doclinks_resolves_relative_to_file_dir) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    /* docs/deep/page.md links an upward "../../src/main.c" path and a
+     * sibling-relative "notes.md" path, neither repo-root-relative. */
+    th_write_file(TH_PATH(fx.tmpdir, "docs/deep/page.md"),
+                  "See [main](../../src/main.c) and [notes](notes.md).\n");
+    th_write_file(TH_PATH(fx.tmpdir, "docs/deep/notes.md"), "# notes\n");
+    th_write_file(TH_PATH(fx.tmpdir, "src/main.c"), "int main(void) { return 0; }\n");
+
+    int64_t page_id = add_file_node(fx.gb, fx.project, "docs/deep/page.md");
+    int64_t notes_id = add_file_node(fx.gb, fx.project, "docs/deep/notes.md");
+    int64_t main_id = add_file_node(fx.gb, fx.project, "src/main.c");
+
+    run_doclinks(fx.gb, fx.project, fx.tmpdir);
+
+    ASSERT_NOT_NULL(find_ref_edge(fx.gb, page_id, main_id));
+    ASSERT_NOT_NULL(find_ref_edge(fx.gb, page_id, notes_id));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Never invent nodes: unresolvable targets produce nothing ────── */
+
+TEST(doclinks_unresolvable_target_no_edge) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"),
+                  "See [gone](docs/removed.md) and `also/missing.sh`.\n");
+
+    add_file_node(fx.gb, fx.project, "README.md");
+
+    int node_count_before = cbm_gbuf_node_count(fx.gb);
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_EQ(n, 0);
+    ASSERT_EQ(ref_edge_count(fx.gb), 0);
+    ASSERT_EQ(cbm_gbuf_node_count(fx.gb), node_count_before);
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── NULL repo_path (configlink-style unit setups) is a clean skip ── */
+
+TEST(doclinks_null_repo_path_skips) {
+    cbm_gbuf_t *gb = cbm_gbuf_new("test", "/tmp/test");
+    add_file_node(gb, "test", "README.md");
+    int n = run_doclinks(gb, "test", NULL);
+    ASSERT_EQ(n, 0);
+    cbm_gbuf_free(gb);
+    PASS();
+}
+
+/* ── Rooted "/x" resolves against the repo root ONLY ─────────────── */
+
+TEST(doclinks_rooted_reference_skips_directory_join) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    /* docs/guide.md links "/README.md" (repo-root-relative by doc
+     * convention). Both docs/README.md and the root README.md exist: a
+     * rooted reference must resolve to the root file, never to a
+     * same-named file in the referencing directory. */
+    th_write_file(TH_PATH(fx.tmpdir, "docs/guide.md"), "See [home](/README.md).\n");
+    th_write_file(TH_PATH(fx.tmpdir, "docs/README.md"), "# Wrong target\n");
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"), "# Root\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "docs/guide.md");
+    int64_t docs_readme_id = add_file_node(fx.gb, fx.project, "docs/README.md");
+    int64_t root_readme_id = add_file_node(fx.gb, fx.project, "README.md");
+
+    run_doclinks(fx.gb, fx.project, fx.tmpdir);
+
+    ASSERT_NOT_NULL(find_ref_edge(fx.gb, doc_id, root_readme_id));
+    ASSERT_NULL(find_ref_edge(fx.gb, doc_id, docs_readme_id));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Explicit "./x" resolves against the referencing dir ONLY ────── */
+
+TEST(doclinks_explicit_relative_no_root_fallback) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    /* docs/a.md links "./config.md". docs/config.md does not exist, but a
+     * root config.md does — an explicit "./" reference must not fall back
+     * to an unrelated same-named file at the repo root. */
+    th_write_file(TH_PATH(fx.tmpdir, "docs/a.md"), "See [cfg](./config.md).\n");
+    th_write_file(TH_PATH(fx.tmpdir, "config.md"), "# Root config\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "docs/a.md");
+    add_file_node(fx.gb, fx.project, "config.md");
+
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_EQ(n, 0);
+    ASSERT_EQ(ref_edge_count(fx.gb), 0);
+    (void)doc_id;
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── A line past the old 4 KiB copy cap is scanned in full ───────── */
+
+TEST(doclinks_long_line_no_truncation) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    /* Padding + "src/foo.cpp" (no trailing newline) straddles the old
+     * CBM_SZ_4K line-copy cap so that, under the old bug, the copy cut
+     * exactly after "src/foo.c" and dropped "pp": a bare mention of
+     * src/foo.cpp silently became a reference to the wrong file. Both
+     * files exist so a wrong match is observable. */
+    enum { FILLER_WORDS = 681 }; /* 681 * strlen("lorem ") == 4086 */
+    char content[CBM_SZ_4K * 2];
+    size_t pos = 0;
+    for (int i = 0; i < FILLER_WORDS; i++) {
+        memcpy(content + pos, "lorem ", 6);
+        pos += 6;
+    }
+    ASSERT_EQ((int)pos, 4086);
+    memcpy(content + pos, "src/foo.cpp", 11);
+    pos += 11;
+    content[pos] = '\0';
+
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"), content);
+    th_write_file(TH_PATH(fx.tmpdir, "src/foo.c"), "// wrong target\n");
+    th_write_file(TH_PATH(fx.tmpdir, "src/foo.cpp"), "// right target\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "README.md");
+    int64_t short_id = add_file_node(fx.gb, fx.project, "src/foo.c");
+    int64_t long_id = add_file_node(fx.gb, fx.project, "src/foo.cpp");
+
+    run_doclinks(fx.gb, fx.project, fx.tmpdir);
+
+    ASSERT_NOT_NULL(find_ref_edge(fx.gb, doc_id, long_id));
+    ASSERT_NULL(find_ref_edge(fx.gb, doc_id, short_id));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── More than the old 256-target cap: nothing is dropped ────────── */
+
+TEST(doclinks_many_distinct_targets_no_cap) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    enum { TARGETS = 300 }; /* > the old DOCLINK_MAX_REFS (256) */
+    char content[TARGETS * 24];
+    size_t pos = 0;
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "MANY.md");
+    for (int i = 0; i < TARGETS; i++) {
+        char rel[32];
+        char line[40];
+        snprintf(rel, sizeof(rel), "gen/f%03d.txt", i);
+        th_write_file(TH_PATH(fx.tmpdir, rel), "x\n");
+        add_file_node(fx.gb, fx.project, rel);
+        int n = snprintf(line, sizeof(line), "%s\n", rel);
+        memcpy(content + pos, line, (size_t)n);
+        pos += (size_t)n;
+    }
+    content[pos] = '\0';
+    th_write_file(TH_PATH(fx.tmpdir, "MANY.md"), content);
+
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_EQ(n, TARGETS);
+    ASSERT_EQ(ref_edge_count(fx.gb), TARGETS);
+    (void)doc_id;
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── ".." past the repo root is dropped, not resolved ────────────── */
+
+TEST(doclinks_dotdot_escaping_root_dropped) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    /* README.md sits at the repo root (depth 0): "../outside.md" has
+     * nowhere to go up from and must be dropped, not resolved. */
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"), "See [x](../outside.md).\n");
+
+    add_file_node(fx.gb, fx.project, "README.md");
+
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_EQ(n, 0);
+    ASSERT_EQ(ref_edge_count(fx.gb), 0);
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── A bare URL in prose is not mistaken for a repo file path ────── */
+
+TEST(doclinks_bare_url_in_prose_no_edge) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"),
+                  "Fetch it from http://host/path/file.c directly.\n");
+    th_write_file(TH_PATH(fx.tmpdir, "path/file.c"), "int x;\n");
+
+    add_file_node(fx.gb, fx.project, "README.md");
+    add_file_node(fx.gb, fx.project, "path/file.c");
+
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_EQ(n, 0);
+    ASSERT_EQ(ref_edge_count(fx.gb), 0);
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Exact-path matching: a bare basename never fuzzy-binds ──────── */
+
+TEST(doclinks_backtick_basename_does_not_fuzzy_match) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    /* `main.c` in docs/ must resolve against docs/main.c or the repo-root
+     * main.c ONLY (exact path match) — never against src/main.c just
+     * because the basename matches. */
+    th_write_file(TH_PATH(fx.tmpdir, "docs/a.md"), "See `main.c` for the entry point.\n");
+    th_write_file(TH_PATH(fx.tmpdir, "src/main.c"), "int main(void) { return 0; }\n");
+
+    add_file_node(fx.gb, fx.project, "docs/a.md");
+    add_file_node(fx.gb, fx.project, "src/main.c");
+
+    int n = run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_EQ(n, 0);
+    ASSERT_EQ(ref_edge_count(fx.gb), 0);
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── CRLF line endings do not corrupt a matched target ───────────── */
+
+TEST(doclinks_crlf_line_endings) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"),
+                  "# Title\r\nSee [build](scripts/build.sh) for details.\r\n");
+    th_write_file(TH_PATH(fx.tmpdir, "scripts/build.sh"), "#!/bin/sh\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "README.md");
+    int64_t script_id = add_file_node(fx.gb, fx.project, "scripts/build.sh");
+
+    run_doclinks(fx.gb, fx.project, fx.tmpdir);
+    ASSERT_NOT_NULL(find_ref_edge(fx.gb, doc_id, script_id));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Fenced code blocks are scanned like prose (pinned, not fixed) ── */
+
+TEST(doclinks_fenced_code_block_bare_mention_pinned) {
+    dl_fix_t fx;
+    ASSERT_TRUE(dl_fix_init(&fx));
+
+    th_write_file(TH_PATH(fx.tmpdir, "README.md"),
+                  "Build it:\n\n```\ngcc src/main.c -o out\n```\n");
+    th_write_file(TH_PATH(fx.tmpdir, "src/main.c"), "int main(void) { return 0; }\n");
+
+    int64_t doc_id = add_file_node(fx.gb, fx.project, "README.md");
+    int64_t code_id = add_file_node(fx.gb, fx.project, "src/main.c");
+
+    run_doclinks(fx.gb, fx.project, fx.tmpdir);
+
+    const cbm_gbuf_edge_t *e = find_ref_edge(fx.gb, doc_id, code_id);
+    ASSERT_NOT_NULL(e);
+    ASSERT_TRUE(edge_has_strategy(e, "md_bare_mention"));
+    ASSERT_NOT_NULL(strstr(e->properties_json, "\"confidence\":0.70"));
+
+    dl_fix_free(&fx);
+    PASS();
+}
+
+/* ── Suite ───────────────────────────────────────────────────────── */
+
+SUITE(doclinks) {
+    /* Markdown strategies */
+    RUN_TEST(doclinks_md_inline_link);
+    RUN_TEST(doclinks_md_backtick_path);
+    RUN_TEST(doclinks_md_bare_mention);
+    RUN_TEST(doclinks_md_non_file_link_ignored);
+    RUN_TEST(doclinks_md_link_with_anchor_resolves_file);
+
+    /* Dedupe + resolution + guards */
+    RUN_TEST(doclinks_dedupe_keeps_count);
+    RUN_TEST(doclinks_resolves_relative_to_file_dir);
+    RUN_TEST(doclinks_unresolvable_target_no_edge);
+    RUN_TEST(doclinks_null_repo_path_skips);
+
+    /* Reference-kind precedence (rooted / explicit-relative / bare) */
+    RUN_TEST(doclinks_rooted_reference_skips_directory_join);
+    RUN_TEST(doclinks_explicit_relative_no_root_fallback);
+
+    /* Negative controls / regression guards */
+    RUN_TEST(doclinks_long_line_no_truncation);
+    RUN_TEST(doclinks_many_distinct_targets_no_cap);
+    RUN_TEST(doclinks_dotdot_escaping_root_dropped);
+    RUN_TEST(doclinks_bare_url_in_prose_no_edge);
+    RUN_TEST(doclinks_backtick_basename_does_not_fuzzy_match);
+    RUN_TEST(doclinks_crlf_line_endings);
+    RUN_TEST(doclinks_fenced_code_block_bare_mention_pinned);
+}
diff --git a/tests/test_edge_structural.c b/tests/test_edge_structural.c
index 3f43628fa..798fef3d0 100644
--- a/tests/test_edge_structural.c
+++ b/tests/test_edge_structural.c
@@ -258,6 +258,7 @@ static const char *ES_ALL_EDGE_TYPES[] = {"CALLS",
                                           "INHERITS",
                                           "INFRA_MAPS",
                                           "OVERRIDE",
+                                          "REFERENCES_FILE",
                                           "SEMANTICALLY_RELATED",
                                           "SIMILAR_TO",
                                           "TESTS_FILE",
diff --git a/tests/test_edge_types_probe.c b/tests/test_edge_types_probe.c
index 84d7713ee..b330e05e8 100644
--- a/tests/test_edge_types_probe.c
+++ b/tests/test_edge_types_probe.c
@@ -842,6 +842,37 @@ TEST(async_calls_celery_python) {
     PASS();
 }
 
+/* RED-repro: a wall-clock / scheduling artifact must NOT drop a parseable
+ * file's defs. The CBM_TEST_WALL_STALL_ON seam forces the parse-timeout callback
+ * to read the WALL clock as (budget + 1 s) ahead while CPU time is untouched —
+ * emulating a worker descheduled under CI contention. celery/app.py DEFINES
+ * Celery.send_task; under the old wall-only 5 s budget that file is abandoned
+ * with zero defs, the "celery" QN the caller resolves against vanishes, and the
+ * ASYNC_CALLS edge count drops to 0 (the intermittent async_calls_celery_python
+ * failure). With the CPU-time budget the parse still completes (CPU under budget,
+ * wall under the generous ceiling) and the edge survives. Deterministic: the
+ * seam is a fixed offset, never real timing. Binds only under CBM_ENABLE_TEST_SEAMS
+ * (always set for the test-runner); a no-seam build exercises the plain edge. */
+TEST(async_calls_celery_wall_stall_seam) {
+    static const EtFile f[] = {
+        {"celery/app.py",
+         "class Celery:\n"
+         "    def task(self):\n        def decorator(fn): return fn\n        return decorator\n\n"
+         "    def send_task(self, name, args=None): return (name, args)\n\n"
+         "app = Celery()\n"},
+        {"tasks/order_tasks.py",
+         "from celery.app import app\n\n\n"
+         "def dispatch_order_created(order_id):\n"
+         "    return app.send_task('order_created', args=[order_id])\n\n\n"
+         "def dispatch_order_shipped(order_id):\n"
+         "    return app.send_task('order_shipped', args=[order_id])\n"}};
+    cbm_setenv("CBM_TEST_WALL_STALL_ON", "celery/app.py", 1);
+    int ok = et_edge_present(f, 2, "ASYNC_CALLS", 1);
+    cbm_unsetenv("CBM_TEST_WALL_STALL_ON");
+    ASSERT_TRUE(ok);
+    PASS();
+}
+
 /* Sidekiq (Ruby) — "Sidekiq" substring in resolved QN */
 TEST(async_calls_sidekiq_ruby) {
     static const EtFile f[] = {
@@ -1625,6 +1656,7 @@ SUITE(edge_types_probe) {
 
     /* ASYNC_CALLS — message queue dispatch (5 brokers × languages) */
     RUN_TEST(async_calls_celery_python);
+    RUN_TEST(async_calls_celery_wall_stall_seam);
     RUN_TEST(async_calls_sidekiq_ruby);
     RUN_TEST(async_calls_kafkajs_ts);
     RUN_TEST(async_calls_sqs_go);
diff --git a/tests/test_extraction.c b/tests/test_extraction.c
index cb01dcf14..1e6506ed1 100644
--- a/tests/test_extraction.c
+++ b/tests/test_extraction.c
@@ -8,10 +8,13 @@
 #include "test_framework.h"
 #include "cbm.h"
 #include "foundation/constants.h"     /* CBM_SZ_* */
+#include "preprocessor.h"             /* cbm_export_macro_candidates (#1989) */
 #include "../src/foundation/compat.h" /* cbm_clock_gettime (wide-flat scaling guard) */
 #include "../src/foundation/compat_fs.h"
 #include <time.h>
 #include "macro_table.h"
+#include "result_spill.h"
+#include "pipeline/pass_lsp_cross.h"
 #include "iris_export_xml.h"
 
 /* ── Helpers ───────────────────────────────────────────────────── */
@@ -974,6 +977,65 @@ TEST(c_struct) {
     PASS();
 }
 
+/* return_type of the first definition named `name`; NULL when there is no such
+ * definition or it carries no return type. */
+static const char *def_return_type(CBMFileResult *r, const char *name) {
+    for (int i = 0; i < r->defs.count; i++) {
+        if (strcmp(r->defs.items[i].name, name) == 0) {
+            return r->defs.items[i].return_type;
+        }
+    }
+    return NULL;
+}
+
+/* PR #1245: the C grammar splits a declared return type across the `type` node,
+ * sibling type_qualifier nodes and the pointer_declarator chain wrapping the
+ * function declarator. Taking only the `type` node published `const char *` as
+ * "char". Canonical spelling: qualifiers, base type, one space, then the
+ * declarator markers unspaced (`const char *`, `char **`). */
+TEST(c_function_return_type_preserves_pointer_and_qualifier) {
+    CBMFileResult *r = extract("static const char *text_end(const char *text) { return text; }\n"
+                               "char **table(void) { return 0; }\n"
+                               "char const *east_const(void) { return 0; }\n"
+                               "const struct Point *find_point(void) { return 0; }\n"
+                               "volatile unsigned long *reg(void) { return 0; }\n"
+                               "char *const *frozen(void) { return 0; }\n",
+                               CBM_LANG_C, "t", "returns.c");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    ASSERT_STR_EQ(def_return_type(r, "text_end"), "const char *");
+    ASSERT_STR_EQ(def_return_type(r, "table"), "char **");
+    ASSERT_STR_EQ(def_return_type(r, "east_const"), "const char *");
+    ASSERT_STR_EQ(def_return_type(r, "find_point"), "const struct Point *");
+    ASSERT_STR_EQ(def_return_type(r, "reg"), "volatile unsigned long *");
+    ASSERT_STR_EQ(def_return_type(r, "frozen"), "char *const *");
+    cbm_free_result(r);
+    PASS();
+}
+
+/* Guard for the fix above: a return type with no qualifier and no declarator
+ * marker is already correct and must come out byte-identical. */
+TEST(c_function_return_type_plain_unchanged) {
+    CBMFileResult *r = extract("int scalar(void) { return 0; }\n"
+                               "void nothing(void) {}\n"
+                               "unsigned long wide(void) { return 0; }\n"
+                               "struct Point make_point(void) { struct Point p; return p; }\n"
+                               "static inline size_t count(void) { return 0; }\n"
+                               "_Noreturn void die(void) { for (;;) {} }\n",
+                               CBM_LANG_C, "t", "plain.c");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    ASSERT_STR_EQ(def_return_type(r, "scalar"), "int");
+    ASSERT_STR_EQ(def_return_type(r, "nothing"), "void");
+    ASSERT_STR_EQ(def_return_type(r, "wide"), "unsigned long");
+    ASSERT_STR_EQ(def_return_type(r, "make_point"), "struct Point");
+    ASSERT_STR_EQ(def_return_type(r, "count"), "size_t");
+    /* _Noreturn parses as a type_qualifier but is not part of the type. */
+    ASSERT_STR_EQ(def_return_type(r, "die"), "void");
+    cbm_free_result(r);
+    PASS();
+}
+
 /* --- C++ --- */
 TEST(cpp_class) {
     CBMFileResult *r = extract(
@@ -987,6 +1049,42 @@ TEST(cpp_class) {
     PASS();
 }
 
+/* PR #1245, C++ side: in-class methods go through a separate extraction path
+ * from free functions, and C++ adds reference markers (`&`, `&&`) whose
+ * reference_declarator carries no `declarator` field. */
+TEST(cpp_method_return_type_preserves_pointer_and_qualifier) {
+    CBMFileResult *r = extract("class Text {\n"
+                               "public:\n"
+                               "    const char *end() { return nullptr; }\n"
+                               "    char **table() { return nullptr; }\n"
+                               "    Text &self() { return *this; }\n"
+                               "    const Text &cself() const { return *this; }\n"
+                               "    Text *&slot() { return next_; }\n"
+                               "    Text *next_;\n"
+                               "    int width() const { return 0; }\n"
+                               "    constexpr int square(int x) const { return x * x; }\n"
+                               "};\n"
+                               "const Text &shared() { static Text t; return t; }\n"
+                               "Text &&moved(Text &t) { return static_cast<Text &&>(t); }\n"
+                               "const char *Text::c_str() const { return nullptr; }\n",
+                               CBM_LANG_CPP, "t", "text.cpp");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    ASSERT_STR_EQ(def_return_type(r, "end"), "const char *");
+    ASSERT_STR_EQ(def_return_type(r, "table"), "char **");
+    ASSERT_STR_EQ(def_return_type(r, "self"), "Text &");
+    ASSERT_STR_EQ(def_return_type(r, "cself"), "const Text &");
+    ASSERT_STR_EQ(def_return_type(r, "slot"), "Text *&");
+    ASSERT_STR_EQ(def_return_type(r, "width"), "int");
+    /* constexpr parses as a type_qualifier but is not part of the type. */
+    ASSERT_STR_EQ(def_return_type(r, "square"), "int");
+    ASSERT_STR_EQ(def_return_type(r, "shared"), "const Text &");
+    ASSERT_STR_EQ(def_return_type(r, "moved"), "Text &&");
+    ASSERT_STR_EQ(def_return_type(r, "c_str"), "const char *");
+    cbm_free_result(r);
+    PASS();
+}
+
 /* ═══════════════════════════════════════════════════════════════════
  * Group C: Scripting / Dynamic Languages
  * ═══════════════════════════════════════════════════════════════════ */
@@ -2938,6 +3036,106 @@ TEST(commonlisp_defmacro) {
     PASS();
 }
 
+/* 2026-09-16 probe: config extractors handed multi-line node text over as a
+ * name (8,301 elasticsearch YAML Fields, 91 kernel Makefile/.conf nodes with a
+ * line break inside), and JS/TS baselines named functions `{}` and variables
+ * `1`. The definition push is the one place every extractor goes through. */
+TEST(defs_push_cuts_multiline_names_and_rejects_js_literal_names) {
+    CBMArena a;
+    cbm_arena_init(&a);
+    CBMDefArray defs = {0};
+
+    CBMDefinition make = {0};
+    make.name = "endif\n\n$(obj)/pm_data-offsets.h";
+    make.qualified_name = "proj.arch.arm.mach-at91.Makefile.endif\n\n$(obj)/pm_data-offsets.h";
+    make.label = "Function";
+    make.file_path = "arch/arm/mach-at91/Makefile";
+    cbm_defs_push(&defs, &a, make);
+    ASSERT_EQ(defs.count, 1);
+    ASSERT_STR_EQ(defs.items[0].name, "endif");
+    ASSERT_STR_EQ(defs.items[0].qualified_name, "proj.arch.arm.mach-at91.Makefile.endif");
+
+    CBMDefinition yaml = {0};
+    yaml.name = "Test get datafeed stats given missing datafeed_id   \r\n  - do:";
+    yaml.qualified_name =
+        "proj.spec.Test get datafeed stats given missing datafeed_id   \r\n  - do:";
+    yaml.label = "Field";
+    yaml.file_path = "rest-api-spec/test/ml/get_datafeed_stats.yml";
+    cbm_defs_push(&defs, &a, yaml);
+    ASSERT_EQ(defs.count, 2);
+    ASSERT_STR_EQ(defs.items[1].name, "Test get datafeed stats given missing datafeed_id");
+
+    /* JS/TS: a literal token is not a name. */
+    CBMDefinition brace = {0};
+    brace.name = "{}";
+    brace.qualified_name = "proj.tests.baselines.x.{}";
+    brace.label = "Function";
+    brace.file_path = "tests/baselines/reference/x.js";
+    cbm_defs_push(&defs, &a, brace);
+    CBMDefinition one = {0};
+    one.name = "1";
+    one.qualified_name = "proj.tests.cases.y.1";
+    one.label = "Variable";
+    one.file_path = "tests/cases/y.ts";
+    cbm_defs_push(&defs, &a, one);
+    ASSERT_EQ(defs.count, 2);
+
+    /* Real JS names, including private members and `$`-prefixed ones, stay. */
+    CBMDefinition priv = {0};
+    priv.name = "#secret";
+    priv.qualified_name = "proj.src.a.Klass.#secret";
+    priv.label = "Method";
+    priv.file_path = "src/a.ts";
+    cbm_defs_push(&defs, &a, priv);
+    CBMDefinition dollar = {0};
+    dollar.name = "$scope";
+    dollar.qualified_name = "proj.src.b.$scope";
+    dollar.label = "Variable";
+    dollar.file_path = "src/b.js";
+    cbm_defs_push(&defs, &a, dollar);
+    ASSERT_EQ(defs.count, 4);
+
+    /* Member keys JS spells without an identifier start are names too:
+     * computed, string-literal and escaped (1,782 real definitions in the
+     * TypeScript corpus wore these spellings). */
+    const char *member_keys[] = {"[Symbol.iterator]", "\"my-key\"", "'x'", "\\u0410"};
+    for (int i = 0; i < 4; i++) {
+        CBMDefinition member = {0};
+        member.name = member_keys[i];
+        member.qualified_name = member_keys[i];
+        member.label = "Method";
+        member.file_path = "src/c.ts";
+        cbm_defs_push(&defs, &a, member);
+    }
+    ASSERT_EQ(defs.count, 8);
+
+    /* Tokens that are not names in any spelling: patterns, numeric literals,
+     * parenthesised types, rest elements. */
+    const char *tokens[] = {"{ b11 } = { b11: \"string\" }", "0x0",  "3.2e1",
+                            "(x: number) => string",         "...a", "?"};
+    for (int i = 0; i < 6; i++) {
+        CBMDefinition token = {0};
+        token.name = tokens[i];
+        token.qualified_name = tokens[i];
+        token.label = "Variable";
+        token.file_path = "tests/cases/z.js";
+        cbm_defs_push(&defs, &a, token);
+    }
+    ASSERT_EQ(defs.count, 8);
+
+    /* Other languages may legitimately name operators: untouched. */
+    CBMDefinition op = {0};
+    op.name = "<$>";
+    op.qualified_name = "proj.Data.Functor.<$>";
+    op.label = "Function";
+    op.file_path = "src/Data/Functor.hs";
+    cbm_defs_push(&defs, &a, op);
+    ASSERT_EQ(defs.count, 9);
+
+    cbm_arena_destroy(&a);
+    PASS();
+}
+
 TEST(makefile_rule_as_function) {
     CBMFileResult *r = extract("all:\n\t@echo hello\n", CBM_LANG_MAKEFILE, "test", "Makefile");
     ASSERT_NOT_NULL(r);
@@ -3112,6 +3310,25 @@ TEST(go_imports) {
     PASS();
 }
 
+/* cgo's `import "C"` is a pseudo-package, not a real import: keeping it lets the
+ * import resolver name-match "C" onto an arbitrary project symbol called C. The
+ * real imports of the same file must survive. */
+TEST(go_cgo_pseudo_import_dropped) {
+    CBMFileResult *r = extract("package m\n\n/*\nstatic int helper(void) { return 1; }\n*/\n"
+                               "import \"C\"\n\nimport \"fmt\"\n\n"
+                               "func Run() { fmt.Println(C.helper()) }\n",
+                               CBM_LANG_GO, "t", "cgo.go");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    ASSERT(has_import(r, "fmt"));
+    for (int i = 0; i < r->imports.count; i++) {
+        ASSERT_NOT_NULL(r->imports.items[i].module_path);
+        ASSERT_TRUE(strcmp(r->imports.items[i].module_path, "C") != 0);
+    }
+    cbm_free_result(r);
+    PASS();
+}
+
 /* #1935: Go struct fields were never extracted — find_class_body() returns the
  * struct_type node, whose only named child is a field_declaration_list, so the
  * member loop matched nothing and every field was silently skipped (0 Field
@@ -4356,10 +4573,68 @@ TEST(swift_labeled_call_string_arg_issue1892) {
     PASS();
 }
 
+/* Swift has no URL literal, so real code builds one and force-unwraps it. The
+ * string then sits two levels below the argument list. */
+TEST(swift_nested_url_constructor_issue1892) {
+    CBMFileResult *r = extract("func fetch() { URLSession.shared.dataTask(with: URL(string: "
+                               "\"https://example.com/api/v1/widgets\")!) }\n",
+                               CBM_LANG_SWIFT, "t", "Fetch.swift");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    const CBMCall *c = find_call_by_callee(r, "URLSession.shared.dataTask");
+    ASSERT_NOT_NULL(c);
+    ASSERT_NOT_NULL(c->first_string_arg);
+    ASSERT_STR_EQ(c->first_string_arg, "https://example.com/api/v1/widgets");
+    cbm_free_result(r);
+    PASS();
+}
+
+/* Without the trailing "!" the constructor is not wrapped in a
+ * postfix_expression, so this covers the other shape. */
+TEST(swift_nested_url_no_bang_issue1892) {
+    CBMFileResult *r =
+        extract("func fetch() { client.send(to: URLRequest(url: \"/api/v1/widgets/1\")) }\n",
+                CBM_LANG_SWIFT, "t", "Send.swift");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    const CBMCall *c = find_call_by_callee(r, "client.send");
+    ASSERT_NOT_NULL(c);
+    ASSERT_NOT_NULL(c->first_string_arg);
+    ASSERT_STR_EQ(c->first_string_arg, "/api/v1/widgets/1");
+    cbm_free_result(r);
+    PASS();
+}
+
+/* A constructor that is not one of the three URL types keeps its own meaning:
+ * the outer call must not borrow the inner call's string. */
+TEST(swift_non_url_constructor_untouched_issue1892) {
+    CBMFileResult *r = extract("func f() { log.write(to: Formatter(pattern: \"%s-%d\")) }\n",
+                               CBM_LANG_SWIFT, "t", "Log.swift");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    const CBMCall *c = find_call_by_callee(r, "log.write");
+    ASSERT_NOT_NULL(c);
+    ASSERT_NULL(c->first_string_arg);
+    cbm_free_result(r);
+    PASS();
+}
+
 /* Issue #1009: URL-builder helper pattern — a function returning a URL-shaped
  * literal, consumed as client(buildPath(id)). The builder's URL is recorded in
  * the per-file constant map and resolved at the call site, for both return
  * statements and arrow expression bodies. */
+TEST(extract_ts_await_generic_call_issue2210) {
+    CBMFileResult *r = extract("function parseJsonBody<T>() { return {} as T; }\n"
+                               "async function plain() { return await parseJsonBody(); }\n"
+                               "async function generic() { return await parseJsonBody<string>(); }\n",
+                               CBM_LANG_TYPESCRIPT, "t", "await.ts");
+    ASSERT_NOT_NULL(r);
+    ASSERT_FALSE(r->has_error);
+    ASSERT_EQ(count_calls_named(r, "parseJsonBody"), 2);
+    cbm_free_result(r);
+    PASS();
+}
+
 TEST(extract_ts_url_builder_issue1009) {
     CBMFileResult *r = extract("function thingDetail(id: string): string {\n"
                                "  return `/api/v1/things/${id}/detail`;\n"
@@ -5737,6 +6012,370 @@ TEST(extract_c_clean_file_no_recovery_duplicates_issue961) {
     PASS();
 }
 
+/* #1989: build-system export macros (UE "<MOD>_API", CMake generate_export_header
+ * "<lib>_EXPORT") are empty on the real compile line but opaque to tree-sitter,
+ * so `class MOD_API Foo` misparses. The preprocessed second pass predefines the
+ * conventional export-macro-shaped identifiers found in the file as empty, and
+ * the recovery loop adopts the corrected type defs (superseding the raw
+ * misparse artifacts). */
+TEST(extract_cpp_export_macro_class_recovery_issue1989) {
+    CBMFileResult *r = extract("#pragma once\n"
+                               "UCLASS()\n"
+                               "class DUMMY_API UFoo : public UObject\n"
+                               "{\n"
+                               "    GENERATED_BODY()\n"
+                               "public:\n"
+                               "    int32 X = 0;\n"
+                               "};\n",
+                               CBM_LANG_CPP, "p", "ue.h");
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *cls = find_def(r, "UFoo");
+    ASSERT_NOT_NULL(cls); /* was missing entirely before the fix */
+    ASSERT_EQ(cls->start_line, 3u);
+    ASSERT_NULL(find_def(r, "DUMMY_API")); /* macro-as-name artifact superseded */
+    /* The raw misparse also mints a phantom Function def NAMED AFTER THE BASE
+     * CLASS spanning the whole class ("UObject" from the declarator of the
+     * broken function_definition shape) — it must be suppressed, not just the
+     * macro-named artifact. */
+    ASSERT_NULL(find_def(r, "UObject"));
+    cbm_free_result(r);
+    PASS();
+}
+
+TEST(extract_cpp_export_macro_struct_recovery_issue1989) {
+    /* The struct case is the SILENT failure: the raw tree parses "successfully"
+     * with the macro token as the name and raises no error flag at all. */
+    CBMFileResult *r = extract("#pragma once\n"
+                               "USTRUCT()\n"
+                               "struct DUMMY_API FBar\n"
+                               "{\n"
+                               "    int32 Y;\n"
+                               "};\n",
+                               CBM_LANG_CPP, "p", "ue_struct.h");
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *st = find_def(r, "FBar");
+    ASSERT_NOT_NULL(st);
+    ASSERT(st->label && strcmp(st->label, "Class") == 0); /* struct_specifier -> Class */
+    ASSERT_NULL(find_def(r, "DUMMY_API"));
+    cbm_free_result(r);
+    PASS();
+}
+
+TEST(extract_cpp_export_macro_enum_recovery_issue1989) {
+    /* `enum class MOD_API EKind` is lost to an ERROR region entirely. */
+    CBMFileResult *r = extract("#pragma once\n"
+                               "UENUM()\n"
+                               "enum class DUMMY_API EKind : uint8\n"
+                               "{\n"
+                               "    A,\n"
+                               "    B\n"
+                               "};\n",
+                               CBM_LANG_CPP, "p", "ue_enum.h");
+    ASSERT_NOT_NULL(r);
+    ASSERT_NOT_NULL(find_def(r, "EKind"));
+    cbm_free_result(r);
+    PASS();
+}
+
+TEST(extract_cpp_export_macro_free_function_recovery_issue1989) {
+    /* A free function DEFINED with the export macro is lost to an ERROR region
+     * on the raw tree (prototypes never mint defs — same as clean code). */
+    CBMFileResult *r = extract("#pragma once\n"
+                               "DUMMY_API int Add(int a, int b)\n"
+                               "{\n"
+                               "    return a + b;\n"
+                               "}\n",
+                               CBM_LANG_CPP, "p", "ue_fn.h");
+    ASSERT_NOT_NULL(r);
+    ASSERT_NOT_NULL(find_def(r, "Add"));
+    cbm_free_result(r);
+    PASS();
+}
+
+TEST(extract_cpp_export_macro_inline_method_recovery_issue1989) {
+    /* The misparsed class parsed as a function body on the raw tree, so the
+     * raw walk never extracted its inline methods — the rescued class def must
+     * carry them in via the nested-span adoption. */
+    CBMFileResult *r = extract("#pragma once\n"
+                               "class DUMMY_API FCalc\n"
+                               "{\n"
+                               "public:\n"
+                               "    int Add(int a, int b) { return a + b; }\n"
+                               "};\n",
+                               CBM_LANG_CPP, "p", "ue_inline.h");
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *cls = find_def(r, "FCalc");
+    ASSERT_NOT_NULL(cls);
+    ASSERT(cls->label && strcmp(cls->label, "Class") == 0); /* not the raw "Function" mislabel */
+    const CBMDefinition *m = find_def(r, "Add");
+    ASSERT_NOT_NULL(m);
+    ASSERT(m->label && strcmp(m->label, "Method") == 0);
+    cbm_free_result(r);
+    PASS();
+}
+
+/* Negative control the maintainer asked for: ordinary ALL_CAPS identifiers
+ * (constants, enum values) must NOT be swept in as export-macro candidates and
+ * stripped from the graph. Only the narrow _API/_EXPORT/... suffix shape is. */
+TEST(extract_cpp_export_macro_negative_control_ordinary_caps_issue1989) {
+    CBMFileResult *r = extract("#pragma once\n"
+                               "#define MAX_CONNECTIONS 16\n"
+                               "const int TIMEOUT_MS = 250;\n"
+                               "enum class State { IDLE, RUNNING };\n"
+                               "struct Config { int MAX_RETRIES; };\n",
+                               CBM_LANG_CPP, "p", "caps.h");
+    ASSERT_NOT_NULL(r);
+    ASSERT_NOT_NULL(find_def(r, "Config"));
+    ASSERT_TRUE(has_def(r, "Variable", "TIMEOUT_MS"));
+    cbm_free_result(r);
+    PASS();
+}
+
+/* C files get the same rescue (SQLITE_API-style prefixes are C, not C++). */
+TEST(extract_c_export_macro_recovery_issue1989) {
+    CBMFileResult *r = extract("typedef struct sqlite3 sqlite3;\n"
+                               "SQLITE_API int sqlite3_open(const char *path)\n"
+                               "{\n"
+                               "    return 0;\n"
+                               "}\n",
+                               CBM_LANG_C, "p", "db.c");
+    ASSERT_NOT_NULL(r);
+    ASSERT_NOT_NULL(find_def(r, "sqlite3_open"));
+    cbm_free_result(r);
+    PASS();
+}
+
+/* #1989 review (P1): an over-long candidate-shaped identifier (>= 96 chars)
+ * arriving AFTER a stored candidate must be rejected BEFORE the dedup
+ * compares — the pre-fix dedup ran strncmp(out[k], src, len) with
+ * len >= CBM_EXPORT_MACRO_NAME_MAX against 96-byte rows (out-of-bounds read;
+ * sanitizer lanes crash). Locally unsanitized, so this pins the behavior
+ * (normal candidate still recovers, no crash); CI's sanitized lanes guard
+ * the memory error itself. */
+TEST(extract_cpp_export_macro_overlong_candidate_safe_issue1989) {
+    char src[4096];
+    int off = snprintf(src, sizeof(src), "class MOD_API First { int v; };\nclass ");
+    ASSERT_GTE(off, 0);
+    memset(src + off, 'A', 100);
+    off += 100;
+    ASSERT_GTE(snprintf(src + off, sizeof(src) - (size_t)off, "_API Long { int w; };\n"), 0);
+    CBMFileResult *r = extract(src, CBM_LANG_CPP, "p", "overlong.h");
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *first = find_def(r, "First");
+    ASSERT_NOT_NULL(first);
+    ASSERT(first->label && strcmp(first->label, "Class") == 0);
+    cbm_free_result(r);
+    PASS();
+}
+
+/* #1989 review (P2): candidate-shaped tokens inside comments and string
+ * literals must NOT consume the bounded budget — 32 of them ahead of the real
+ * class would otherwise exhaust the cap and leave the real macro undefined. */
+TEST(extract_cpp_export_macro_comment_string_budget_issue1989) {
+    char src[8192];
+    int off = 0;
+    for (int n = 0; n < 31; n++) {
+        ASSERT_GTE(snprintf(src + off, sizeof(src) - (size_t)off, "// see DOC%02d_API notes\n", n),
+                   0);
+        off += (int)strlen(src + off);
+    }
+    ASSERT_GTE(snprintf(src + off, sizeof(src) - (size_t)off,
+                        "static const char *kRef = \"STRING_DOC_API\";\n"
+                        "class REALMOD_API Real { int v; };\n"),
+               0);
+    CBMFileResult *r = extract(src, CBM_LANG_CPP, "p", "budget.h");
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *cls = find_def(r, "Real");
+    ASSERT_NOT_NULL(cls);
+    ASSERT(cls->label && strcmp(cls->label, "Class") == 0);
+    cbm_free_result(r);
+    PASS();
+}
+
+/* #1989 review: the bounded-budget contract — 33 distinct candidates collect
+ * only the first CBM_EXPORT_MACRO_MAX (32, in source order); the 33rd stays
+ * unpredefined and its class keeps the raw misparse (value label, not Class). */
+TEST(extract_cpp_export_macro_candidate_cap_issue1989) {
+    char src[8192];
+    int off = 0;
+    for (int n = 0; n < 33; n++) {
+        ASSERT_GTE(
+            snprintf(src + off, sizeof(src) - (size_t)off, "class CAP%02d_API K%02d {};\n", n, n),
+            0);
+        off += (int)strlen(src + off);
+    }
+    CBMFileResult *r = extract(src, CBM_LANG_CPP, "p", "cap.h");
+    ASSERT_NOT_NULL(r);
+    int recovered = 0;
+    for (int n = 0; n < 33; n++) {
+        char name[8];
+        snprintf(name, sizeof(name), "K%02d", n);
+        const CBMDefinition *d = find_def(r, name);
+        if (d && d->label && strcmp(d->label, "Class") == 0) {
+            recovered++;
+        }
+    }
+    ASSERT_EQ(recovered, 32);
+    /* The cap contract's other half: the 33rd candidate (K32) must STILL be
+     * present with its raw misparse — dropping the def entirely would be a
+     * regression, not a graceful cap. */
+    const CBMDefinition *cap_tail = find_def(r, "K32");
+    ASSERT_NOT_NULL(cap_tail);
+    ASSERT_TRUE(!cap_tail->label || strcmp(cap_tail->label, "Class") != 0);
+    cbm_free_result(r);
+    PASS();
+}
+
+/* #1989 review round 2: line-spliced // comments. A backslash before the
+ * newline continues the comment (splicing happens before comment
+ * recognition), so "FAKE_API" below is comment text and must NOT consume
+ * budget. 32 spliced fake comments would otherwise exhaust the cap and leave
+ * the real class unrecovered. */
+TEST(extract_cpp_export_macro_spliced_comment_budget_issue1989) {
+    char src[8192];
+    int off = 0;
+    for (int n = 0; n < 31; n++) {
+        ASSERT_GTE(
+            snprintf(src + off, sizeof(src) - (size_t)off, "// fake \\\nFAKE%02d_API notes\n", n),
+            0);
+        off += (int)strlen(src + off);
+    }
+    ASSERT_GTE(snprintf(src + off, sizeof(src) - (size_t)off,
+                        "// last \\\r\nSPLICEFAKE_API notes\n"
+                        "class REALMOD_API Real { int v; };\n"),
+               0);
+    CBMFileResult *r = extract(src, CBM_LANG_CPP, "p", "spliced.h");
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *cls = find_def(r, "Real");
+    ASSERT_NOT_NULL(cls);
+    ASSERT(cls->label && strcmp(cls->label, "Class") == 0);
+    cbm_free_result(r);
+    PASS();
+}
+
+/* #1989 review round 2: C++ raw string literals. Tokens inside R"(...)"
+ * must not be collected, and code after the literal must still be scanned —
+ * an unmodeled raw string previously let "BAR_API" leak in AND masked the
+ * real candidate after the literal's closing quote. An unrecognizable raw
+ * form (unterminated/malformed delimiter) stops collection entirely so scan
+ * state cannot be poisoned. */
+TEST(extract_cpp_export_macro_raw_string_issue1989) {
+    CBMFileResult *r = extract("const char *s = R\"(foo \" BAR_API)\";\n"
+                               "class REALMOD_API Real { int v; };\n",
+                               CBM_LANG_CPP, "p", "raw.h");
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *cls = find_def(r, "Real");
+    ASSERT_NOT_NULL(cls);
+    ASSERT(cls->label && strcmp(cls->label, "Class") == 0);
+    cbm_free_result(r);
+    PASS();
+}
+
+TEST(extract_cpp_export_macro_raw_string_delimited_issue1989) {
+    CBMFileResult *r = extract("auto log = R\"log(FOO_API \"quote\")log\";\n"
+                               "class DELIMMOD_API Delim { int v; };\n",
+                               CBM_LANG_CPP, "p", "raw_delim.h");
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *cls = find_def(r, "Delim");
+    ASSERT_NOT_NULL(cls);
+    ASSERT(cls->label && strcmp(cls->label, "Class") == 0);
+    cbm_free_result(r);
+    PASS();
+}
+
+/* #1989 review: every conventional suffix variant must be collected and
+ * recovered, not just _API. */
+TEST(extract_cpp_export_macro_suffix_variants_issue1989) {
+    CBMFileResult *r = extract("class LIB_EXPORT A1 { int v; };\n"
+                               "class LIB_IMPORT B2 { int v; };\n"
+                               "class LIB_DLLEXPORT C3 { int v; };\n"
+                               "class LIB_DEPRECATED D4 { int v; };\n",
+                               CBM_LANG_CPP, "p", "suffix.h");
+    ASSERT_NOT_NULL(r);
+    const char *names[] = {"A1", "B2", "C3", "D4"};
+    for (int n = 0; n < 4; n++) {
+        const CBMDefinition *d = find_def(r, names[n]);
+        ASSERT_NOT_NULL(d);
+        ASSERT(d->label && strcmp(d->label, "Class") == 0);
+    }
+    cbm_free_result(r);
+    PASS();
+}
+
+/* #1989 review: caller-provided defines win — the collector must not push a
+ * define for a name the caller already provided (a duplicate could flip the
+ * expansion and silently change what parses). With an explicit empty define
+ * the class still recovers; with a caller define that corrupts the header,
+ * the injected empty define must NOT clobber it back into parsing. */
+TEST(extract_cpp_export_macro_explicit_define_priority_issue1989) {
+    const char *src = "class MYMOD_API Foo { int v; };\n";
+
+    const char *empty_defines[] = {"MYMOD_API=", NULL};
+    CBMFileResult *r = cbm_extract_file(src, (int)strlen(src), CBM_LANG_CPP, "p", "prio_empty.h", 0,
+                                        empty_defines, NULL);
+    ASSERT_NOT_NULL(r);
+    const CBMDefinition *cls = find_def(r, "Foo");
+    ASSERT_NOT_NULL(cls);
+    ASSERT(cls->label && strcmp(cls->label, "Class") == 0);
+    cbm_free_result(r);
+
+    const char *body_defines[] = {"MYMOD_API=Junk", NULL};
+    CBMFileResult *r2 = cbm_extract_file(src, (int)strlen(src), CBM_LANG_CPP, "p", "prio_body.h", 0,
+                                         body_defines, NULL);
+    ASSERT_NOT_NULL(r2);
+    const CBMDefinition *foo2 = find_def(r2, "Foo");
+    ASSERT_TRUE(foo2 == NULL || (foo2->label && strcmp(foo2->label, "Class") != 0));
+    cbm_free_result(r2);
+    PASS();
+}
+
+/* #1989 review round 2: the collector CONTRACT itself, called directly (the
+ * reviewer's method): the raw string's inner token is not a candidate and the
+ * code after the literal IS. */
+TEST(extract_cpp_export_macro_collector_raw_string_contract_issue1989) {
+    const char *src = "const char *s = R\"(foo \" BAR_API)\";\n"
+                      "class REALMOD_API Real { int v; };\n";
+    char out[CBM_EXPORT_MACRO_MAX][CBM_EXPORT_MACRO_NAME_MAX];
+    int n = cbm_export_macro_candidates(src, (int)strlen(src), out, CBM_EXPORT_MACRO_MAX);
+    ASSERT_EQ(n, 1);
+    ASSERT(strcmp(out[0], "REALMOD_API") == 0);
+    PASS();
+}
+
+/* Delimiter form R"log(...)log" works the same way. */
+TEST(extract_cpp_export_macro_collector_raw_string_delim_contract_issue1989) {
+    const char *src = "auto log = R\"log(FOO_API \"q\")log\";\n"
+                      "class DELIMMOD_API Delim { int v; };\n";
+    char out[CBM_EXPORT_MACRO_MAX][CBM_EXPORT_MACRO_NAME_MAX];
+    int n = cbm_export_macro_candidates(src, (int)strlen(src), out, CBM_EXPORT_MACRO_MAX);
+    ASSERT_EQ(n, 1);
+    ASSERT(strcmp(out[0], "DELIMMOD_API") == 0);
+    PASS();
+}
+
+/* A double quote is a legal raw-string delimiter character. Keep scanning
+ * after R"""(...)""" so a later export macro is still collected. */
+TEST(extract_cpp_export_macro_collector_raw_string_quote_delim_issue1989) {
+    const char *src = "const char *s = R\"\"\"(FOO_API)\"\"\";\n"
+                      "class QUOTEMOD_API Quoted { int v; };\n";
+    char out[CBM_EXPORT_MACRO_MAX][CBM_EXPORT_MACRO_NAME_MAX];
+    int n = cbm_export_macro_candidates(src, (int)strlen(src), out, CBM_EXPORT_MACRO_MAX);
+    ASSERT_EQ(n, 1);
+    ASSERT(strcmp(out[0], "QUOTEMOD_API") == 0);
+    PASS();
+}
+
+/* Unterminated raw literal: the scan stops rather than mis-tokenizing the
+ * rest of the file (uncertain state -> fail toward raw behavior). */
+TEST(extract_cpp_export_macro_collector_raw_string_unterminated_issue1989) {
+    const char *src = "const char *s = R\"(never closed BAR_API\n"
+                      "class REALMOD_API Real { int v; };\n";
+    char out[CBM_EXPORT_MACRO_MAX][CBM_EXPORT_MACRO_NAME_MAX];
+    int n = cbm_export_macro_candidates(src, (int)strlen(src), out, CBM_EXPORT_MACRO_MAX);
+    ASSERT_EQ(n, 0);
+    PASS();
+}
+
 /* #668: walk_defs used a fixed `walk_defs_frame_t stack[4096]` — a ~160 KB
  * C-stack frame that overflowed small thread stacks (the reporter's crash was in
  * the "definitions pass" on a large SQL file), and whose `top < 4096` push guards
@@ -6191,6 +6830,96 @@ TEST(extract_wide_flat_reference_fields_are_linear) {
     }
     PASS();
 }
+
+/* The same guard for C#, whose callable-value site walk was the last one still
+ * climbing with ts_node_parent instead of the walk cursor. tree-sitter answers
+ * ts_node_parent by descending from the ROOT, so every step costs O(depth) and
+ * a deep file pays it per identifier. The .NET JIT tests are exactly that —
+ * single expressions megabytes deep — and they cost 18-48 us per node, which is
+ * why they were the only files a CPU-time budget ever cut off, and why the C#
+ * graph differed between two runs on one machine (2026-09-19). The budget is
+ * gone; this keeps the reason it was needed from coming back. */
+static uint64_t extract_csharp_argument_value_work(int statement_count, int *out_usages,
+                                                   uint64_t *out_slow_parent_fallbacks) {
+    static const char prefix[] = "class C {\n"
+                                 "  static void Sink(object o) {}\n"
+                                 "  static void Target() {}\n"
+                                 "  static void Wide() {\n";
+    /* Parenthesised on purpose: a bare `Sink(Target)` needs no climb at all, so
+     * it cannot tell the cursor walk from the root-descending one and the test
+     * would pass either way. The wrapper makes the site walk take a step. */
+    static const char statement[] = "    Sink((Target));\n";
+    static const char suffix[] = "  }\n}\n";
+    size_t capacity = sizeof(prefix) + (size_t)statement_count * sizeof(statement) + sizeof(suffix);
+    char *source = malloc(capacity);
+    if (!source) {
+        return UINT64_MAX;
+    }
+    size_t offset = 0;
+    memcpy(source + offset, prefix, sizeof(prefix) - 1U);
+    offset += sizeof(prefix) - 1U;
+    for (int i = 0; i < statement_count; i++) {
+        memcpy(source + offset, statement, sizeof(statement) - 1U);
+        offset += sizeof(statement) - 1U;
+    }
+    memcpy(source + offset, suffix, sizeof(suffix));
+    offset += sizeof(suffix) - 1U;
+
+    cbm_usage_field_lookup_test_reset();
+    CBMFileResult *result =
+        cbm_extract_file(source, (int)offset, CBM_LANG_CSHARP, "proj", "Wide.cs", 0, NULL, NULL);
+    free(source);
+    if (!result) {
+        return UINT64_MAX;
+    }
+    int usages = 0;
+    for (int i = 0; i < result->usages.count; i++) {
+        if (result->usages.items[i].ref_name &&
+            strcmp(result->usages.items[i].ref_name, "Target") == 0) {
+            usages++;
+        }
+    }
+    uint64_t work = cbm_usage_field_lookup_test_work();
+    *out_slow_parent_fallbacks = cbm_usage_slow_parent_fallback_test_count();
+    cbm_free_result(result);
+    *out_usages = usages;
+    return work;
+}
+
+TEST(extract_csharp_argument_values_use_the_walk_cursor) {
+    enum { SMALL = 128, BIG = 1024, INPUT_GROWTH = 8, WORK_RATIO_MAX = 12 };
+    int small_usages = 0;
+    int big_usages = 0;
+    uint64_t small_slow_parent_fallbacks = 0;
+    uint64_t big_slow_parent_fallbacks = 0;
+    uint64_t small_work =
+        extract_csharp_argument_value_work(SMALL, &small_usages, &small_slow_parent_fallbacks);
+    uint64_t big_work =
+        extract_csharp_argument_value_work(BIG, &big_usages, &big_slow_parent_fallbacks);
+    ASSERT_TRUE(small_work != UINT64_MAX);
+    ASSERT_TRUE(big_work != UINT64_MAX);
+    /* Anti-vacuous: the occurrences really were classified, so a zero fallback
+     * count means "took the cursor", not "never looked". */
+    ASSERT_EQ(small_usages, SMALL);
+    ASSERT_EQ(big_usages, BIG);
+    /* The assertion this test exists for: not one occurrence fell back to the
+     * root-descending parent lookup. */
+    ASSERT_EQ(small_slow_parent_fallbacks, 0);
+    ASSERT_EQ(big_slow_parent_fallbacks, 0);
+    fprintf(stderr, "  [csharp-argument-values] work(%d)=%llu work(%d)=%llu input_growth=%dx\n",
+            SMALL, (unsigned long long)small_work, BIG, (unsigned long long)big_work, INPUT_GROWTH);
+    uint64_t maximum = small_work * WORK_RATIO_MAX + 256U;
+    if (big_work > maximum) {
+        char message[192];
+        snprintf(message, sizeof(message),
+                 "csharp argument-value lookup grew from %llu to %llu for %dx input "
+                 "(maximum %dx + 256) -- the site walk is not linear",
+                 (unsigned long long)small_work, (unsigned long long)big_work, INPUT_GROWTH,
+                 WORK_RATIO_MAX);
+        FAIL(message);
+    }
+    PASS();
+}
 #endif
 
 /* ===================================================================
@@ -6676,6 +7405,38 @@ static int find_call_args(const CBMFileResult *r, const char *callee, const char
     return -1;
 }
 
+/* tree-sitter lists a comment inside an argument list as a named child; it is
+ * not an argument. A Java constructor call whose argument list opened with a
+ * slash-star comment handed the comment text to the Route pass as a URL
+ * (three Route nodes named by comments on elasticsearch, 2026-09-16). */
+TEST(call_args_skip_comments_between_arguments) {
+    CBMFileResult *r = extract("class A {\n"
+                               "  void f() {\n"
+                               "    app.get(/* the orders listing */ \"/orders\", handler);\n"
+                               "    new TestCase(\n"
+                               "        /*\n"
+                               "         * a multi-line note\n"
+                               "         */\n"
+                               "        \"x\", // trailing\n"
+                               "        1);\n"
+                               "  }\n"
+                               "}\n",
+                               CBM_LANG_JAVA, "t", "A.java");
+    ASSERT_NOT_NULL(r);
+    const char *arg0 = NULL;
+    const char *arg1 = NULL;
+    int argc = find_call_args(r, "get", &arg0, &arg1);
+    ASSERT_EQ(argc, 2);
+    ASSERT_STR_EQ(arg0, "\"/orders\"");
+    ASSERT_STR_EQ(arg1, "handler");
+    argc = find_call_args(r, "TestCase", &arg0, &arg1);
+    ASSERT_EQ(argc, 2);
+    ASSERT_STR_EQ(arg0, "\"x\"");
+    ASSERT_STR_EQ(arg1, "1");
+    cbm_free_result(r);
+    PASS();
+}
+
 TEST(objectscript_data_flows_class_method_args) {
     CBMFileResult *r = extract("Class MyApp.Caller Extends %RegisteredObject\n"
                                "{\n"
@@ -7120,7 +7881,383 @@ TEST(non_config_language_module_has_no_promoted_description_issue519) {
     PASS();
 }
 
+/* ── Result compaction (cbm_result_compact) ────────────────────────────── */
+
+static const char *COMPACT_PY_SRC = "import os\n"
+                                    "from typing import List\n"
+                                    "\n"
+                                    "@app.route(\"/items\")\n"
+                                    "def list_items(limit: int, offset: int = 0) -> List[str]:\n"
+                                    "    \"\"\"Return items.\"\"\"\n"
+                                    "    rows = fetch(limit, offset=offset)\n"
+                                    "    total = len(rows)\n"
+                                    "    for r in rows:\n"
+                                    "        print(r, total)\n"
+                                    "    return rows\n"
+                                    "\n"
+                                    "class Store(Base):\n"
+                                    "    def get(self, key):\n"
+                                    "        return self.data.get(key, None)\n"
+                                    "\n"
+                                    "    def put(self, key, value):\n"
+                                    "        self.data[key] = value\n"
+                                    "        return fetch(key, value)\n";
+
+static bool cmp_str_eq(const char *a, const char *b) {
+    if (!a || !b) {
+        return a == b;
+    }
+    return strcmp(a, b) == 0;
+}
+
+static bool cmp_list_eq(const char **a, const char **b) {
+    if (!a || !b) {
+        return a == b;
+    }
+    int i = 0;
+    for (; a[i] && b[i]; i++) {
+        if (strcmp(a[i], b[i]) != 0) {
+            return false;
+        }
+    }
+    return a[i] == NULL && b[i] == NULL;
+}
+
+static size_t arena_capacity(const CBMArena *a) {
+    size_t total = 0;
+    for (int i = 0; i < a->nblocks; i++) {
+        total += a->block_sizes[i];
+    }
+    return total;
+}
+
+TEST(extract_compact_keeps_every_field_and_shrinks_the_arena) {
+    CBMFileResult *r = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "svc.py");
+    CBMFileResult *ref = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "svc.py");
+    ASSERT_NOT_NULL(r);
+    ASSERT_NOT_NULL(ref);
+    ASSERT_FALSE(r->has_error);
+    ASSERT(r->defs.count >= 4);  /* list_items, Store, get, put (+ module) */
+    ASSERT(r->calls.count >= 4); /* fetch x2, len, print, get */
+    ASSERT(r->usages.count >= 1);
+    ASSERT(r->imports.count >= 2);
+    bool saw_args = false;
+    for (int i = 0; i < ref->calls.count; i++) {
+        saw_args = saw_args || ref->calls.items[i].arg_count > 0;
+    }
+    ASSERT(saw_args);
+
+    size_t used_before = cbm_arena_total(&r->arena);
+    size_t cap_before = arena_capacity(&r->arena);
+    cbm_result_compact(r);
+
+    /* One exact block: capacity == bytes used, no dead headroom. */
+    ASSERT_EQ(r->arena.nblocks, 1);
+    ASSERT_EQ(arena_capacity(&r->arena), cbm_arena_total(&r->arena));
+    ASSERT(cbm_arena_total(&r->arena) < used_before);
+    ASSERT(arena_capacity(&r->arena) < cap_before);
+    ASSERT_EQ(r->defs.cap, r->defs.count);
+    ASSERT_EQ(r->calls.cap, r->calls.count);
+    ASSERT_EQ(r->usages.cap, r->usages.count);
+
+    /* Every field survives, by value. */
+    ASSERT_EQ(r->defs.count, ref->defs.count);
+    for (int i = 0; i < r->defs.count; i++) {
+        const CBMDefinition *a = &r->defs.items[i];
+        const CBMDefinition *b = &ref->defs.items[i];
+        ASSERT(cmp_str_eq(a->name, b->name));
+        ASSERT(cmp_str_eq(a->qualified_name, b->qualified_name));
+        ASSERT(cmp_str_eq(a->label, b->label));
+        ASSERT(cmp_str_eq(a->file_path, b->file_path));
+        ASSERT(cmp_str_eq(a->signature, b->signature));
+        ASSERT(cmp_str_eq(a->return_type, b->return_type));
+        ASSERT(cmp_str_eq(a->docstring, b->docstring));
+        ASSERT(cmp_str_eq(a->parent_class, b->parent_class));
+        ASSERT(cmp_str_eq(a->route_path, b->route_path));
+        ASSERT(cmp_str_eq(a->body_tokens, b->body_tokens));
+        ASSERT(cmp_str_eq(a->structural_profile, b->structural_profile));
+        ASSERT(cmp_list_eq(a->decorators, b->decorators));
+        ASSERT(cmp_list_eq(a->base_classes, b->base_classes));
+        ASSERT(cmp_list_eq(a->param_names, b->param_names));
+        ASSERT(cmp_list_eq(a->param_types, b->param_types));
+        ASSERT(cmp_list_eq(a->return_types, b->return_types));
+        ASSERT_EQ(a->signature_param_count, b->signature_param_count);
+        for (int k = 0; k < a->signature_param_count; k++) {
+            ASSERT(cmp_str_eq(a->signature_param_types[k], b->signature_param_types[k]));
+        }
+        ASSERT_EQ(a->start_line, b->start_line);
+        ASSERT_EQ(a->end_line, b->end_line);
+        ASSERT_EQ(a->complexity, b->complexity);
+        ASSERT_EQ(a->lines, b->lines);
+        ASSERT_EQ(a->is_exported, b->is_exported);
+        ASSERT_EQ(a->fingerprint_k, b->fingerprint_k);
+        if (a->fingerprint_k > 0) {
+            ASSERT_NOT_NULL(a->fingerprint);
+            ASSERT(memcmp(a->fingerprint, b->fingerprint,
+                          (size_t)a->fingerprint_k * sizeof(uint32_t)) == 0);
+        }
+    }
+    ASSERT_EQ(r->calls.count, ref->calls.count);
+    for (int i = 0; i < r->calls.count; i++) {
+        const CBMCall *a = &r->calls.items[i];
+        const CBMCall *b = &ref->calls.items[i];
+        ASSERT(cmp_str_eq(a->callee_name, b->callee_name));
+        ASSERT(cmp_str_eq(a->enclosing_func_qn, b->enclosing_func_qn));
+        ASSERT(cmp_str_eq(a->first_string_arg, b->first_string_arg));
+        ASSERT_EQ(a->arg_count, b->arg_count);
+        ASSERT_EQ(a->start_line, b->start_line);
+        ASSERT_EQ(a->site_start_byte, b->site_start_byte);
+        ASSERT_EQ(a->site_end_byte, b->site_end_byte);
+        ASSERT_EQ(a->is_method, b->is_method);
+        for (int k = 0; k < a->arg_count; k++) {
+            ASSERT(cmp_str_eq(a->args[k].expr, b->args[k].expr));
+            ASSERT(cmp_str_eq(a->args[k].value, b->args[k].value));
+            ASSERT(cmp_str_eq(a->args[k].keyword, b->args[k].keyword));
+            ASSERT_EQ(a->args[k].index, b->args[k].index);
+        }
+    }
+    ASSERT_EQ(r->usages.count, ref->usages.count);
+    for (int i = 0; i < r->usages.count; i++) {
+        ASSERT(cmp_str_eq(r->usages.items[i].ref_name, ref->usages.items[i].ref_name));
+        ASSERT(cmp_str_eq(r->usages.items[i].enclosing_func_qn,
+                          ref->usages.items[i].enclosing_func_qn));
+        ASSERT_EQ(r->usages.items[i].kind, ref->usages.items[i].kind);
+        ASSERT_EQ(r->usages.items[i].site_start_byte, ref->usages.items[i].site_start_byte);
+        ASSERT_EQ(r->usages.items[i].is_member_access, ref->usages.items[i].is_member_access);
+    }
+    ASSERT_EQ(r->imports.count, ref->imports.count);
+    for (int i = 0; i < r->imports.count; i++) {
+        ASSERT(cmp_str_eq(r->imports.items[i].local_name, ref->imports.items[i].local_name));
+        ASSERT(cmp_str_eq(r->imports.items[i].module_path, ref->imports.items[i].module_path));
+    }
+    ASSERT_EQ(r->rw.count, ref->rw.count);
+    ASSERT_EQ(r->type_refs.count, ref->type_refs.count);
+    ASSERT(cmp_str_eq(r->module_qn, ref->module_qn));
+    ASSERT(cmp_list_eq(r->exports, ref->exports));
+
+    /* Interned by content: two records with the same enclosing QN share one
+     * copy after compaction. */
+    bool shared = false;
+    for (int i = 0; i < r->calls.count && !shared; i++) {
+        for (int j = i + 1; j < r->calls.count && !shared; j++) {
+            if (r->calls.items[i].enclosing_func_qn && r->calls.items[j].enclosing_func_qn &&
+                strcmp(r->calls.items[i].enclosing_func_qn, r->calls.items[j].enclosing_func_qn) ==
+                    0) {
+                shared = r->calls.items[i].enclosing_func_qn == r->calls.items[j].enclosing_func_qn;
+            }
+        }
+    }
+    ASSERT(shared);
+
+    /* The arena stays usable for the cross-file pass: growth restarts at the
+     * small append block, never at twice the compact block. (It restarted at
+     * the 64 KB default until 2026-09-17: the cross-file pass appends a few
+     * resolved calls, so that block was ~60 KB of untouched memory per
+     * appended-to result — 0.5 GB of the worker's peak on the Go corpus.
+     * See CBM_ARENA_APPEND_BLOCK.) */
+    char *later = cbm_arena_strdup(&r->arena, "appended after compaction");
+    ASSERT_NOT_NULL(later);
+    ASSERT_EQ(r->arena.nblocks, 2);
+    ASSERT_EQ(r->arena.block_sizes[1], CBM_ARENA_APPEND_BLOCK);
+
+    cbm_free_result(r);
+    cbm_free_result(ref);
+    PASS();
+}
+
+TEST(extract_compact_is_idempotent_and_survives_empty_results) {
+    CBMFileResult *r = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "svc.py");
+    ASSERT_NOT_NULL(r);
+    cbm_result_compact(r);
+    size_t once = cbm_arena_total(&r->arena);
+    int defs = r->defs.count;
+    cbm_result_compact(r);
+    ASSERT_EQ(cbm_arena_total(&r->arena), once);
+    ASSERT_EQ(r->defs.count, defs);
+    ASSERT_EQ(r->arena.nblocks, 1);
+    cbm_free_result(r);
+
+    CBMFileResult *empty = extract("", CBM_LANG_PYTHON, "t", "empty.py");
+    ASSERT_NOT_NULL(empty);
+    cbm_result_compact(empty);
+    ASSERT_EQ(empty->defs.count + empty->calls.count, empty->defs.count + empty->calls.count);
+    ASSERT(empty->arena.nblocks >= 1);
+    cbm_free_result(empty);
+
+    cbm_result_compact(NULL); /* no-op */
+    PASS();
+}
+
+/* ── Result spill (result_spill.c): park -> load is a faithful round trip ── */
+
+TEST(extract_spill_round_trip_keeps_every_field) {
+    CBMFileResult *r = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "svc.py");
+    CBMFileResult *ref = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "svc.py");
+    ASSERT_NOT_NULL(r);
+    ASSERT_NOT_NULL(ref);
+    cbm_result_compact(r);
+    cbm_result_compact(ref);
+
+    char dir[512];
+    snprintf(dir, sizeof(dir), "%s/cbm_spill_XXXXXX", cbm_tmpdir());
+    ASSERT_NOT_NULL(cbm_mkdtemp(dir));
+    cbm_result_spill_t *sp = cbm_result_spill_open(dir, 2, 3);
+    ASSERT_NOT_NULL(sp);
+    ASSERT_FALSE(cbm_result_spill_has(sp, 1));
+
+    /* A result that is not compacted (two blocks) is refused, untouched. */
+    CBMFileResult *raw = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "raw.py");
+    ASSERT_NOT_NULL(raw);
+    if (raw->arena.nblocks > 1) {
+        ASSERT_FALSE(cbm_result_spill_park(sp, 0, 2, raw));
+        ASSERT_FALSE(cbm_result_spill_has(sp, 2));
+    }
+    cbm_free_result(raw);
+
+    /* Park frees the in-memory result; the slot is then on disk. Each
+     * precondition is named so a refusal says which one it was. */
+    int defs_before = r->defs.count;
+    int calls_before = r->calls.count;
+    ASSERT_EQ(r->arena.nblocks, 1);
+    ASSERT_EQ(r->owned_result_count, 0);
+    ASSERT_NOT_NULL(r->cached_tree); /* the extraction helper keeps the tree: park drops it */
+    ASSERT_TRUE(cbm_result_spill_park(sp, 1, 1, r));
+    r = NULL;
+    ASSERT_TRUE(cbm_result_spill_has(sp, 1));
+    int peek_defs = -1;
+    int peek_impls = -1;
+    cbm_result_spill_peek_counts(sp, 1, &peek_defs, &peek_impls);
+    ASSERT_EQ(peek_defs, defs_before);
+    ASSERT_EQ(peek_impls, 0);
+
+    CBMFileResult *back = cbm_result_spill_load(sp, 1);
+    ASSERT_NOT_NULL(back);
+    ASSERT_NULL(back->cached_tree);
+    ASSERT_EQ(back->arena.nblocks, 1);
+    ASSERT_EQ(back->defs.count, defs_before);
+    ASSERT_EQ(back->calls.count, calls_before);
+    for (int i = 0; i < back->defs.count; i++) {
+        const CBMDefinition *a = &back->defs.items[i];
+        const CBMDefinition *b = &ref->defs.items[i];
+        ASSERT(cmp_str_eq(a->name, b->name));
+        ASSERT(cmp_str_eq(a->qualified_name, b->qualified_name));
+        ASSERT(cmp_str_eq(a->label, b->label));
+        ASSERT(cmp_str_eq(a->file_path, b->file_path));
+        ASSERT(cmp_str_eq(a->signature, b->signature));
+        ASSERT(cmp_str_eq(a->docstring, b->docstring));
+        ASSERT(cmp_list_eq(a->decorators, b->decorators));
+        ASSERT(cmp_list_eq(a->param_names, b->param_names));
+        ASSERT_EQ(a->start_line, b->start_line);
+        ASSERT_EQ(a->fingerprint_k, b->fingerprint_k);
+        if (a->fingerprint_k > 0) {
+            ASSERT(memcmp(a->fingerprint, b->fingerprint,
+                          (size_t)a->fingerprint_k * sizeof(uint32_t)) == 0);
+        }
+        /* Every pointer now lives in the loaded block, none in the old one. */
+        const char *lo = back->arena.blocks[0];
+        const char *hi = lo + back->arena.used;
+        ASSERT(a->name >= lo && a->name < hi);
+        ASSERT(a->qualified_name >= lo && a->qualified_name < hi);
+    }
+    for (int i = 0; i < back->calls.count; i++) {
+        const CBMCall *a = &back->calls.items[i];
+        const CBMCall *b = &ref->calls.items[i];
+        ASSERT(cmp_str_eq(a->callee_name, b->callee_name));
+        ASSERT(cmp_str_eq(a->enclosing_func_qn, b->enclosing_func_qn));
+        ASSERT_EQ(a->arg_count, b->arg_count);
+        for (int k = 0; k < a->arg_count; k++) {
+            ASSERT(cmp_str_eq(a->args[k].expr, b->args[k].expr));
+        }
+    }
+    ASSERT_EQ(back->usages.count, ref->usages.count);
+    for (int i = 0; i < back->usages.count; i++) {
+        ASSERT(cmp_str_eq(back->usages.items[i].ref_name, ref->usages.items[i].ref_name));
+    }
+    ASSERT(cmp_str_eq(back->module_qn, ref->module_qn));
+    ASSERT(cmp_list_eq(back->exports, ref->exports));
+
+    /* Loading twice yields two independent copies. */
+    CBMFileResult *again = cbm_result_spill_load(sp, 1);
+    ASSERT_NOT_NULL(again);
+    ASSERT(again->arena.blocks[0] != back->arena.blocks[0]);
+    ASSERT_EQ(again->defs.count, defs_before);
+    int64_t parked = 0;
+    int64_t bytes = 0;
+    int64_t loads = 0;
+    cbm_result_spill_stats(sp, &parked, &bytes, &loads);
+    ASSERT_EQ(parked, 1);
+    ASSERT(bytes > 0);
+    ASSERT_EQ(loads, 2);
+
+    cbm_free_result(again);
+    cbm_free_result(back);
+    cbm_free_result(ref);
+    cbm_result_spill_close(sp);
+    cbm_rmdir(dir);
+    PASS();
+}
+
+/* ── A skipped file gets no LSP walk, per-file or cross-file ── */
+
+/* CBM_TEST_LSP_SKIP_ON names the file: the result carries lsp_skipped, the
+ * per-file LSP walk did not run (no LSP-resolved calls), and the shared
+ * cross-file dispatcher returns without touching it. The unified extractor
+ * definitions are still there. Nothing in production sets lsp_skipped from a
+ * clock any more — this pins what the flag DOES, which is what the cross-file
+ * dispatcher and the per-file walks both have to honour. */
+TEST(extract_lsp_skipped_file_gets_no_walk) {
+    cbm_setenv("CBM_TEST_LSP_SKIP_ON", "budget_share.py", 1);
+    CBMFileResult *skipped = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "budget_share.py");
+    cbm_unsetenv("CBM_TEST_LSP_SKIP_ON");
+    CBMFileResult *walked = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "walked.py");
+    ASSERT_NOT_NULL(skipped);
+    ASSERT_NOT_NULL(walked);
+    ASSERT_TRUE(skipped->lsp_skipped);
+    ASSERT_FALSE(walked->lsp_skipped);
+    ASSERT_GT(skipped->defs.count, 0);                      /* the unified extractor still ran */
+    ASSERT_TRUE(skipped->defs.count <= walked->defs.count); /* the LSP walk adds its own defs */
+    ASSERT_EQ(skipped->resolved_calls.count, 0);
+
+    /* The dispatcher is the one gate for every language and both drivers. */
+    int calls_before = skipped->calls.count;
+    cbm_pxc_dispatch_file(CBM_LANG_PYTHON, skipped, COMPACT_PY_SRC, (int)strlen(COMPACT_PY_SRC),
+                          "budget_share.py", "t", NULL, NULL, NULL, 0, NULL, NULL, 0, NULL, NULL);
+    ASSERT_EQ(skipped->calls.count, calls_before);
+    ASSERT_EQ(skipped->resolved_calls.count, 0);
+
+    cbm_free_result(skipped);
+    cbm_free_result(walked);
+    PASS();
+}
+
+/* CBM_TEST_WALK_BUDGET_NODES stops the unified walk after that many nodes: the
+ * result is walk_truncated, therefore lsp_skipped, and the definitions the walk
+ * had not reached are the only loss. There is no budget by default (see
+ * CBM_WALK_MAX_NODES_DEFAULT), so this drives the same node counter an operator
+ * would set with CBM_WALK_MAX_NODES rather than a mechanism of its own. */
+TEST(extract_walk_truncated_when_a_node_budget_is_set) {
+    cbm_setenv("CBM_TEST_WALK_BUDGET_NODES", "8", 1);
+    CBMFileResult *cut = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "walk_budget.py");
+    cbm_unsetenv("CBM_TEST_WALK_BUDGET_NODES");
+    CBMFileResult *full = extract(COMPACT_PY_SRC, CBM_LANG_PYTHON, "t", "walk_full.py");
+    ASSERT_NOT_NULL(cut);
+    ASSERT_NOT_NULL(full);
+    ASSERT_TRUE(cut->walk_truncated);
+    ASSERT_TRUE(cut->lsp_skipped);
+    ASSERT_FALSE(full->walk_truncated);
+    ASSERT_TRUE(cut->usages.count <= full->usages.count);
+    ASSERT_TRUE(cut->calls.count <= full->calls.count);
+    cbm_free_result(cut);
+    cbm_free_result(full);
+    PASS();
+}
+
 SUITE(extraction) {
+    RUN_TEST(extract_compact_keeps_every_field_and_shrinks_the_arena);
+    RUN_TEST(extract_compact_is_idempotent_and_survives_empty_results);
+    RUN_TEST(extract_spill_round_trip_keeps_every_field);
+    RUN_TEST(extract_lsp_skipped_file_gets_no_walk);
+    RUN_TEST(extract_walk_truncated_when_a_node_budget_is_set);
     /* Initialize extraction library */
     cbm_init();
 
@@ -7128,6 +8265,7 @@ SUITE(extraction) {
     RUN_TEST(extract_wide_flat_file_is_linear);
 #if defined(CBM_CALL_REFERENCE_LOOKUP_TEST_API) && CBM_CALL_REFERENCE_LOOKUP_TEST_API
     RUN_TEST(extract_wide_flat_reference_fields_are_linear);
+    RUN_TEST(extract_csharp_argument_values_use_the_walk_cursor);
 #endif
 
     /* Perl call-graph noise (#459 follow-up) */
@@ -7168,6 +8306,7 @@ SUITE(extraction) {
     RUN_TEST(objectscript_macro_constant_no_extra_call);
     RUN_TEST(objectscript_udl_method_return_type);
     RUN_TEST(objectscript_udl_scalar_return_type_not_resolved);
+    RUN_TEST(call_args_skip_comments_between_arguments);
     RUN_TEST(objectscript_data_flows_class_method_args);
     RUN_TEST(objectscript_data_flows_instance_method_args);
     RUN_TEST(iris_export_xml_simple_class);
@@ -7227,8 +8366,11 @@ SUITE(extraction) {
     RUN_TEST(go_interface);
     RUN_TEST(zig_function);
     RUN_TEST(c_function);
+    RUN_TEST(c_function_return_type_preserves_pointer_and_qualifier);
+    RUN_TEST(c_function_return_type_plain_unchanged);
     RUN_TEST(c_struct);
     RUN_TEST(cpp_class);
+    RUN_TEST(cpp_method_return_type_preserves_pointer_and_qualifier);
 
     /* Scripting */
     RUN_TEST(python_function);
@@ -7301,6 +8443,9 @@ SUITE(extraction) {
     RUN_TEST(swift_chained_call);
     RUN_TEST(swift_force_unwrap_scanner_shift);
     RUN_TEST(swift_call_string_arg_issue1892);
+    RUN_TEST(swift_nested_url_constructor_issue1892);
+    RUN_TEST(swift_nested_url_no_bang_issue1892);
+    RUN_TEST(swift_non_url_constructor_untouched_issue1892);
     RUN_TEST(swift_labeled_call_string_arg_issue1892);
     RUN_TEST(objc_interface);
     RUN_TEST(objc_implementation);
@@ -7378,6 +8523,7 @@ SUITE(extraction) {
     RUN_TEST(commonlisp_defun);
     RUN_TEST(commonlisp_multiple_functions);
     RUN_TEST(commonlisp_defmacro);
+    RUN_TEST(defs_push_cuts_multiline_names_and_rejects_js_literal_names);
     RUN_TEST(makefile_rule_as_function);
     RUN_TEST(makefile_multiple_targets);
     RUN_TEST(makefile_variable_extraction);
@@ -7393,6 +8539,7 @@ SUITE(extraction) {
     RUN_TEST(python_imports);
     RUN_TEST(js_imports);
     RUN_TEST(go_imports);
+    RUN_TEST(go_cgo_pseudo_import_dropped);
     RUN_TEST(extract_go_struct_fields_have_nodes);
     RUN_TEST(java_imports);
     RUN_TEST(rust_imports);
@@ -7461,6 +8608,7 @@ SUITE(extraction) {
     RUN_TEST(extract_go_binary_concat_url_issue1249);
     RUN_TEST(extract_go_binary_concat_url_no_literal_suffix_issue1249);
     RUN_TEST(extract_ts_url_builder_issue1009);
+    RUN_TEST(extract_ts_await_generic_call_issue2210);
     RUN_TEST(extract_ts_route_handler_after_named_middleware);
     RUN_TEST(extract_ts_route_handler_after_inline_middleware);
     RUN_TEST(extract_ts_url_builder_composed_issue1009);
@@ -7492,6 +8640,25 @@ SUITE(extraction) {
     RUN_TEST(extract_cpp_preproc_macro_generated_callable_skipped_issue949);
     RUN_TEST(extract_c_ifdef_split_brace_after_include_remapped_issue949);
     RUN_TEST(extract_c_clean_file_no_recovery_duplicates_issue961);
+    RUN_TEST(extract_cpp_export_macro_class_recovery_issue1989);
+    RUN_TEST(extract_cpp_export_macro_struct_recovery_issue1989);
+    RUN_TEST(extract_cpp_export_macro_enum_recovery_issue1989);
+    RUN_TEST(extract_cpp_export_macro_free_function_recovery_issue1989);
+    RUN_TEST(extract_cpp_export_macro_inline_method_recovery_issue1989);
+    RUN_TEST(extract_cpp_export_macro_negative_control_ordinary_caps_issue1989);
+    RUN_TEST(extract_c_export_macro_recovery_issue1989);
+    RUN_TEST(extract_cpp_export_macro_overlong_candidate_safe_issue1989);
+    RUN_TEST(extract_cpp_export_macro_comment_string_budget_issue1989);
+    RUN_TEST(extract_cpp_export_macro_candidate_cap_issue1989);
+    RUN_TEST(extract_cpp_export_macro_spliced_comment_budget_issue1989);
+    RUN_TEST(extract_cpp_export_macro_raw_string_issue1989);
+    RUN_TEST(extract_cpp_export_macro_raw_string_delimited_issue1989);
+    RUN_TEST(extract_cpp_export_macro_collector_raw_string_contract_issue1989);
+    RUN_TEST(extract_cpp_export_macro_collector_raw_string_delim_contract_issue1989);
+    RUN_TEST(extract_cpp_export_macro_collector_raw_string_quote_delim_issue1989);
+    RUN_TEST(extract_cpp_export_macro_collector_raw_string_unterminated_issue1989);
+    RUN_TEST(extract_cpp_export_macro_suffix_variants_issue1989);
+    RUN_TEST(extract_cpp_export_macro_explicit_define_priority_issue1989);
     RUN_TEST(walk_defs_no_truncation_over_4096_issue668);
     RUN_TEST(extract_rust_test_attr_marks_is_test_issue855);
     RUN_TEST(extract_c_test_dir_marks_is_test_issue1294);
diff --git a/tests/test_graph_buffer.c b/tests/test_graph_buffer.c
index 232286045..8a32d5a34 100644
--- a/tests/test_graph_buffer.c
+++ b/tests/test_graph_buffer.c
@@ -6,7 +6,13 @@
  */
 #include "test_framework.h"
 #include "graph_buffer/graph_buffer.h"
+#include "foundation/mem_core.h"
+#include <stdatomic.h>
 #include "store/store.h"
+#include "../src/foundation/compat.h"
+#include "foundation/compat_fs.h"
+#include "foundation/log.h"
+#include <stdio.h>
 #include <string.h>
 
 /* ── Node operations ───────────────────────────────────────────── */
@@ -1118,9 +1124,106 @@ TEST(gbuf_flush_skips_orphan_edges) {
     PASS();
 }
 
+/* ── Publish failure reporting ───────────────────────────────── */
+
+static char g_log_capture[4096];
+static CBMLogLevel g_prev_log_level;
+static CBMLogFormat g_prev_log_format;
+
+static void capture_log_sink(const char *line) {
+    size_t used = strlen(g_log_capture);
+    size_t avail = sizeof(g_log_capture) - used;
+    if (avail <= 1) {
+        return;
+    }
+    int n = snprintf(g_log_capture + used, avail, "%s\n", line);
+    if (n < 0 || (size_t)n >= avail) {
+        g_log_capture[sizeof(g_log_capture) - 1] = '\0';
+    }
+}
+
+static void capture_logs_start(void) {
+    g_log_capture[0] = '\0';
+    g_prev_log_level = cbm_log_get_level();
+    g_prev_log_format = cbm_log_get_format();
+    cbm_log_set_level(CBM_LOG_DEBUG);
+    /* The assertions below read the text encoding, so pin it rather than
+     * inherit whatever CBM_LOG_FORMAT left set. */
+    cbm_log_set_format(CBM_LOG_FORMAT_TEXT);
+    cbm_log_set_sink(capture_log_sink);
+}
+
+static const char *capture_logs_end(void) {
+    cbm_log_set_sink(NULL);
+    cbm_log_set_level(g_prev_log_level);
+    cbm_log_set_format(g_prev_log_format);
+    return g_log_capture;
+}
+
+/* A dump that publishes nothing has to say so, and say why. Renaming onto an
+ * existing directory is how test_sqlite_writer already forces the publish to
+ * fail; here it stands in for any host that denies the rename (#1620). */
+TEST(gbuf_dump_failure_logs_reason) {
+    char dir[256];
+    snprintf(dir, sizeof(dir), "/tmp/cbm_gbuf_pub_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(dir));
+
+    cbm_gbuf_t *gb = cbm_gbuf_new("test", "/tmp/repo");
+    ASSERT_NOT_NULL(gb);
+    int64_t id = cbm_gbuf_upsert_node(gb, "Function", "main", "pkg.main", "main.go", 1, 10, "{}");
+    ASSERT_GT(id, 0);
+
+    capture_logs_start();
+    int rc = cbm_gbuf_dump_to_sqlite(gb, dir);
+    const char *logs = capture_logs_end();
+
+    ASSERT(rc != 0);
+    ASSERT_NOT_NULL(strstr(logs, "gbuf.dump_failed"));
+    /* The reason survived the cleanup unlink. */
+    ASSERT_NOT_NULL(strstr(logs, "errno="));
+    ASSERT(strstr(logs, "errno=0 ") == NULL);
+    /* And the run is not also reported as a successful dump. */
+    ASSERT(strstr(logs, "msg=gbuf.dump ") == NULL);
+
+    cbm_gbuf_free(gb);
+    cbm_rmdir(dir);
+    PASS();
+}
+
 /* ── Suite ─────────────────────────────────────────────────────── */
 
+/* A worker buffer draws ids from the shared counter, so a dense id -> node
+ * array in it spans the whole global id space: 18 workers x (next power of
+ * two above the highest id) x 8 B, doubling in lockstep -- a 1 GB step
+ * inside one gate interval on the kernel at 8M ids (2026-09-14). A worker
+ * buffer is never asked by id before the merge, so it keeps no such array;
+ * the main buffer it merges into still answers by id. One node at id 2M
+ * would cost a 16 MB array; the index class must not grow by even 1 MB. */
+TEST(gbuf_worker_buffer_keeps_no_by_id_array) {
+    _Atomic int64_t ids;
+    atomic_init(&ids, (int64_t)1 << 21);
+    size_t before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_INDEX);
+    cbm_gbuf_t *w = cbm_gbuf_new_worker("p", "/r", &ids);
+    ASSERT_NOT_NULL(w);
+    int64_t id = cbm_gbuf_upsert_node(w, "Function", "f", "p.f", "a.c", 1, 2, "{}");
+    ASSERT_TRUE(id >= ((int64_t)1 << 21));
+    size_t after = cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_INDEX);
+    size_t grown = after > before ? after - before : 0;
+    ASSERT_TRUE(grown < ((size_t)1 << 20));
+    ASSERT_TRUE(cbm_gbuf_find_by_id(w, id) == NULL);
+    ASSERT_NOT_NULL(cbm_gbuf_find_by_qn(w, "p.f"));
+
+    cbm_gbuf_t *main_gb = cbm_gbuf_new("p", "/r");
+    ASSERT_NOT_NULL(main_gb);
+    cbm_gbuf_merge(main_gb, w);
+    ASSERT_NOT_NULL(cbm_gbuf_find_by_id(main_gb, id));
+    cbm_gbuf_free(w);
+    cbm_gbuf_free(main_gb);
+    PASS();
+}
+
 SUITE(graph_buffer) {
+    RUN_TEST(gbuf_worker_buffer_keeps_no_by_id_array);
     /* Original tests */
     RUN_TEST(gbuf_create_free);
     RUN_TEST(gbuf_free_null);
@@ -1188,4 +1291,7 @@ SUITE(graph_buffer) {
     RUN_TEST(gbuf_shared_ids_null_fallback);
     RUN_TEST(gbuf_next_id_set_next_id_roundtrip);
     RUN_TEST(gbuf_next_id_null_safe);
+
+    /* Publish failure reporting */
+    RUN_TEST(gbuf_dump_failure_logs_reason);
 }
diff --git a/tests/test_hash_table.c b/tests/test_hash_table.c
index cd50bcc77..4df4212c6 100644
--- a/tests/test_hash_table.c
+++ b/tests/test_hash_table.c
@@ -4,6 +4,8 @@
 #include "test_framework.h"
 #include "../src/foundation/hash_table.h"
 
+#include <string.h>
+
 TEST(ht_create_free) {
     CBMHashTable *ht = cbm_ht_create(16);
     ASSERT_NOT_NULL(ht);
@@ -37,6 +39,29 @@ TEST(ht_set_overwrite) {
     PASS();
 }
 
+/* Keys are BORROWED. Overwriting an existing key must adopt the new key pointer
+ * too, because the caller may free the old string right after: cbm_ht_set does
+ * one probe now (get_or_insert) instead of get-then-insert, and the replace of
+ * both key and value is what _insert used to do implicitly. */
+TEST(ht_set_overwrite_adopts_the_new_key_pointer) {
+    CBMHashTable *ht = cbm_ht_create(8);
+    char first[8];
+    char second[8];
+    memcpy(first, "shared", 7);
+    memcpy(second, "shared", 7);
+    int v1 = 1;
+    int v2 = 2;
+    ASSERT_NULL(cbm_ht_set(ht, first, &v1));
+    ASSERT_EQ(cbm_ht_get_key(ht, "shared"), first);
+    ASSERT_EQ(cbm_ht_set(ht, second, &v2), &v1);
+    ASSERT_EQ(cbm_ht_get_key(ht, "shared"), second); /* the old buffer is no longer referenced */
+    memcpy(first, "gone!!", 7);                      /* the caller reuses the old buffer */
+    ASSERT_EQ(*(int *)cbm_ht_get(ht, "shared"), 2);
+    ASSERT_EQ(cbm_ht_count(ht), 1);
+    cbm_ht_free(ht);
+    PASS();
+}
+
 TEST(ht_get_missing) {
     CBMHashTable *ht = cbm_ht_create(8);
     ASSERT_NULL(cbm_ht_get(ht, "nope"));
@@ -367,6 +392,7 @@ SUITE(hash_table) {
     RUN_TEST(ht_create_free);
     RUN_TEST(ht_set_get);
     RUN_TEST(ht_set_overwrite);
+    RUN_TEST(ht_set_overwrite_adopts_the_new_key_pointer);
     RUN_TEST(ht_get_missing);
     RUN_TEST(ht_has);
     RUN_TEST(ht_delete);
diff --git a/tests/test_index_policy.c b/tests/test_index_policy.c
new file mode 100644
index 000000000..d866a0631
--- /dev/null
+++ b/tests/test_index_policy.c
@@ -0,0 +1,403 @@
+#include "test_framework.h"
+#include "test_helpers.h"
+
+#include "cli/cli.h"
+#include "foundation/compat.h"
+#include "foundation/index_policy.h"
+#include "mcp/index_supervisor.h"
+#include "mcp/mcp.h"
+#include "store/store.h"
+
+#include <sqlite3.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+TEST(index_policy_defaults_are_disabled) {
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+
+    ASSERT_FALSE(policy.max_files.enabled);
+    ASSERT_FALSE(policy.max_source_bytes.enabled);
+    ASSERT_FALSE(cbm_index_policy_enabled(&policy));
+    ASSERT_STR_EQ(cbm_index_policy_default_value(CBM_INDEX_CONFIG_MAX_FILES), "off");
+    ASSERT_STR_EQ(cbm_index_policy_default_value(CBM_INDEX_CONFIG_MAX_SOURCE_MB), "off");
+    PASS();
+}
+
+TEST(index_policy_file_limit_accepts_off_and_exact_range) {
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    char error[256];
+
+    ASSERT_TRUE(
+        cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_FILES, "1", error, sizeof(error)));
+    ASSERT_TRUE(policy.max_files.enabled);
+    ASSERT_EQ(policy.max_files.value, 1);
+    ASSERT_TRUE(cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_FILES, "10000000", error,
+                                     sizeof(error)));
+    ASSERT_EQ(policy.max_files.value, 10000000);
+    ASSERT_TRUE(
+        cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_FILES, "off", error, sizeof(error)));
+    ASSERT_FALSE(policy.max_files.enabled);
+    PASS();
+}
+
+TEST(index_policy_source_limit_converts_mib_without_overflow) {
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    char error[256];
+
+    ASSERT_TRUE(
+        cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_SOURCE_MB, "1", error, sizeof(error)));
+    ASSERT_TRUE(policy.max_source_bytes.enabled);
+    ASSERT_EQ(policy.max_source_bytes.value, UINT64_C(1024) * UINT64_C(1024));
+    ASSERT_TRUE(cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_SOURCE_MB, "1048576", error,
+                                     sizeof(error)));
+    ASSERT_EQ(policy.max_source_bytes.value, UINT64_C(1048576) * UINT64_C(1024) * UINT64_C(1024));
+    PASS();
+}
+
+TEST(index_policy_invalid_value_is_rejected_atomically) {
+    static const char *const invalid[] = {"",   "0",  "-1",       "1MB",
+                                          "1 ", "+1", "10000001", "18446744073709551616"};
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    char error[256];
+    ASSERT_TRUE(
+        cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_FILES, "42", error, sizeof(error)));
+
+    for (size_t index = 0; index < sizeof(invalid) / sizeof(invalid[0]); index++) {
+        cbm_index_resource_policy_t before = policy;
+        ASSERT_FALSE(cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_FILES, invalid[index],
+                                          error, sizeof(error)));
+        ASSERT_EQ(memcmp(&policy, &before, sizeof(policy)), 0);
+        ASSERT_TRUE(error[0] != '\0');
+    }
+    ASSERT_FALSE(cbm_index_policy_set(&policy, "index_unknown_limit", "1", error, sizeof(error)));
+    PASS();
+}
+
+TEST(index_policy_format_round_trips_public_values) {
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    char error[256];
+    char value[64];
+
+    ASSERT_TRUE(
+        cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_FILES, "321", error, sizeof(error)));
+    ASSERT_TRUE(cbm_index_policy_format(&policy, CBM_INDEX_CONFIG_MAX_FILES, value, sizeof(value)));
+    ASSERT_STR_EQ(value, "321");
+    ASSERT_TRUE(
+        cbm_index_policy_set(&policy, CBM_INDEX_CONFIG_MAX_SOURCE_MB, "7", error, sizeof(error)));
+    ASSERT_TRUE(
+        cbm_index_policy_format(&policy, CBM_INDEX_CONFIG_MAX_SOURCE_MB, value, sizeof(value)));
+    ASSERT_STR_EQ(value, "7");
+    PASS();
+}
+
+TEST(index_policy_violation_metadata_is_stable) {
+    ASSERT_STR_EQ(cbm_index_resource_name(CBM_INDEX_RESOURCE_FILES), "files");
+    ASSERT_STR_EQ(cbm_index_resource_name(CBM_INDEX_RESOURCE_SOURCE_BYTES), "source_bytes");
+    ASSERT_STR_EQ(cbm_index_resource_unit(CBM_INDEX_RESOURCE_FILES), "files");
+    ASSERT_STR_EQ(cbm_index_resource_unit(CBM_INDEX_RESOURCE_SOURCE_BYTES), "bytes");
+    ASSERT_STR_EQ(cbm_index_resource_config_key(CBM_INDEX_RESOURCE_FILES),
+                  CBM_INDEX_CONFIG_MAX_FILES);
+    ASSERT_STR_EQ(cbm_index_resource_config_key(CBM_INDEX_RESOURCE_SOURCE_BYTES),
+                  CBM_INDEX_CONFIG_MAX_SOURCE_MB);
+    PASS();
+}
+
+TEST(index_policy_config_loads_defaults_values_and_rejects_corruption) {
+    char *cache = th_mktempdir("cbm_index_policy_config");
+    ASSERT_NOT_NULL(cache);
+    cbm_config_t *config = cbm_config_open(cache);
+    ASSERT_NOT_NULL(config);
+    cbm_index_resource_policy_t policy;
+    char error[256];
+
+    ASSERT_TRUE(cbm_config_load_index_policy(config, &policy, error, sizeof(error)));
+    ASSERT_FALSE(cbm_index_policy_enabled(&policy));
+    ASSERT_EQ(cbm_config_set(config, CBM_INDEX_CONFIG_MAX_FILES, "9"), 0);
+    ASSERT_EQ(cbm_config_set(config, CBM_INDEX_CONFIG_MAX_SOURCE_MB, "3"), 0);
+    ASSERT_TRUE(cbm_config_load_index_policy(config, &policy, error, sizeof(error)));
+    ASSERT_EQ(policy.max_files.value, 9);
+    ASSERT_EQ(policy.max_source_bytes.value, UINT64_C(3) * CBM_INDEX_MIB_BYTES);
+
+    ASSERT_EQ(cbm_config_set(config, CBM_INDEX_CONFIG_MAX_FILES, "corrupt"), 0);
+    ASSERT_FALSE(cbm_config_load_index_policy(config, &policy, error, sizeof(error)));
+    ASSERT_TRUE(strstr(error, CBM_INDEX_CONFIG_MAX_FILES) != NULL);
+
+    cbm_config_close(config);
+    th_cleanup(cache);
+    PASS();
+}
+
+TEST(index_policy_cli_lists_both_operator_keys) {
+    bool files_found = false;
+    bool bytes_found = false;
+    for (size_t index = 0; index < cbm_cli_config_key_count_for_testing(); index++) {
+        const char *key = cbm_cli_config_key_at_for_testing(index);
+        files_found = files_found || (key && strcmp(key, CBM_INDEX_CONFIG_MAX_FILES) == 0);
+        bytes_found = bytes_found || (key && strcmp(key, CBM_INDEX_CONFIG_MAX_SOURCE_MB) == 0);
+    }
+    ASSERT_TRUE(files_found);
+    ASSERT_TRUE(bytes_found);
+    PASS();
+}
+
+TEST(index_policy_cli_set_rejects_invalid_value_without_overwrite) {
+    char *cache = th_mktempdir("cbm_index_policy_cli");
+    ASSERT_NOT_NULL(cache);
+    const char *saved_cache = getenv("CBM_CACHE_DIR");
+    char *saved_cache_copy = saved_cache ? strdup(saved_cache) : NULL;
+    (void)cbm_setenv("CBM_CACHE_DIR", cache, 1);
+
+    char *set_valid[] = {"set", CBM_INDEX_CONFIG_MAX_FILES, "7"};
+    char *set_invalid[] = {"set", CBM_INDEX_CONFIG_MAX_FILES, "0"};
+    char *reset[] = {"reset", CBM_INDEX_CONFIG_MAX_FILES};
+    int valid_rc = cbm_cmd_config(3, set_valid);
+    cbm_config_t *config = cbm_config_open(cache);
+    const char *stored =
+        config ? cbm_config_get(config, CBM_INDEX_CONFIG_MAX_FILES, "missing") : "missing";
+    bool valid_stored = strcmp(stored, "7") == 0;
+    int invalid_rc = cbm_cmd_config(3, set_invalid);
+    stored = config ? cbm_config_get(config, CBM_INDEX_CONFIG_MAX_FILES, "missing") : "missing";
+    bool invalid_preserved = strcmp(stored, "7") == 0;
+    int reset_rc = cbm_cmd_config(2, reset);
+    stored = config ? cbm_config_get(config, CBM_INDEX_CONFIG_MAX_FILES, "off") : "missing";
+    bool reset_to_default = strcmp(stored, "off") == 0;
+    cbm_config_close(config);
+
+    if (saved_cache_copy) {
+        (void)cbm_setenv("CBM_CACHE_DIR", saved_cache_copy, 1);
+    } else {
+        (void)cbm_unsetenv("CBM_CACHE_DIR");
+    }
+    free(saved_cache_copy);
+    th_cleanup(cache);
+
+    ASSERT_EQ(valid_rc, 0);
+    ASSERT_TRUE(valid_stored);
+    ASSERT_TRUE(invalid_rc != 0);
+    ASSERT_TRUE(invalid_preserved);
+    ASSERT_EQ(reset_rc, 0);
+    ASSERT_TRUE(reset_to_default);
+    PASS();
+}
+
+/* Capture stderr across one cbm_cmd_config invocation, mirroring the stdout
+ * idiom in test_cli.c: tmpfile+dup2+rewind is what works on the MinGW leg. */
+static int index_policy_config_stderr(int argc, char **argv, char *out, size_t cap) {
+    out[0] = '\0';
+    FILE *capture = tmpfile();
+    int saved = capture ? dup(fileno(stderr)) : -1;
+    if (!capture || saved < 0) {
+        if (capture) {
+            (void)fclose(capture);
+        }
+        if (saved >= 0) {
+            (void)close(saved);
+        }
+        return -1000;
+    }
+    (void)fflush(stderr);
+    if (dup2(fileno(capture), fileno(stderr)) < 0) {
+        (void)fclose(capture);
+        (void)close(saved);
+        return -1000;
+    }
+    int rc = cbm_cmd_config(argc, argv);
+    (void)fflush(stderr);
+    (void)dup2(saved, fileno(stderr));
+    (void)close(saved);
+    rewind(capture);
+    size_t got = fread(out, 1, cap - 1, capture);
+    out[got] = '\0';
+    (void)fclose(capture);
+    return rc;
+}
+
+/* `config set` suppresses its own generic message for a policy key, trusting
+ * the policy writer to name the precise reason. That trust held only for a
+ * value the writer rejects. A value it accepts whose write then fails — a
+ * _config.db that cannot be written — exited non-zero having printed nothing
+ * at all, which is a CLI that failed in silence.
+ *
+ * The unwritable database here is a `config` that is a view: CREATE TABLE IF
+ * NOT EXISTS finds the name taken and succeeds, so the command gets past open
+ * with a healthy handle and fails at the INSERT. That is the exact path with
+ * no message, and it needs no file permissions, so it behaves the same on
+ * every leg and under a root CI container. */
+TEST(index_policy_cli_set_reports_a_failed_write) {
+    char *cache = th_mktempdir("cbm_index_policy_cli_write");
+    ASSERT_NOT_NULL(cache);
+    const char *saved_cache = getenv("CBM_CACHE_DIR");
+    char *saved_cache_copy = saved_cache ? strdup(saved_cache) : NULL;
+    (void)cbm_setenv("CBM_CACHE_DIR", cache, 1);
+
+    char db_path[1024];
+    (void)snprintf(db_path, sizeof(db_path), "%s/_config.db", cache);
+    sqlite3 *db = NULL;
+    bool fixture_ready =
+        sqlite3_open(db_path, &db) == SQLITE_OK &&
+        sqlite3_exec(db, "CREATE VIEW config(key, value) AS SELECT 'pinned', 'pinned'", NULL, NULL,
+                     NULL) == SQLITE_OK;
+    if (db) {
+        (void)sqlite3_close(db);
+    }
+
+    char captured[1024];
+    char *set_valid[] = {"set", CBM_INDEX_CONFIG_MAX_FILES, "7"};
+    int rc = index_policy_config_stderr(3, set_valid, captured, sizeof(captured));
+
+    if (saved_cache_copy) {
+        (void)cbm_setenv("CBM_CACHE_DIR", saved_cache_copy, 1);
+    } else {
+        (void)cbm_unsetenv("CBM_CACHE_DIR");
+    }
+    free(saved_cache_copy);
+    th_cleanup(cache);
+
+    ASSERT_TRUE(fixture_ready);
+    ASSERT_TRUE(rc != 0);
+    ASSERT_TRUE(strstr(captured, CBM_INDEX_CONFIG_MAX_FILES) != NULL);
+    PASS();
+}
+
+TEST(index_policy_worker_rejects_missing_parent_policy) {
+    char *repo = th_mktempdir("cbm_index_policy_worker");
+    ASSERT_NOT_NULL(repo);
+    char args[1024];
+    (void)snprintf(args, sizeof(args), "{\"repo_path\":\"%s\",\"mode\":\"fast\"}", repo);
+    cbm_mcp_server_t *server = cbm_mcp_server_new(NULL);
+
+    cbm_index_set_worker_role(true, NULL);
+    char *response = server ? cbm_mcp_handle_tool(server, "index_repository", args) : NULL;
+    cbm_index_set_worker_role(false, NULL);
+    bool rejected = response && strstr(response, "missing or incomplete trusted worker policy");
+
+    free(response);
+    cbm_mcp_server_free(server);
+    th_cleanup(repo);
+    ASSERT_TRUE(rejected);
+    PASS();
+}
+
+TEST(index_policy_mcp_rejects_forged_override_and_preserves_serving_index) {
+    char *repo = th_mktempdir("cbm_index_policy_mcp_repo");
+    char *cache = th_mktempdir("cbm_index_policy_mcp_cache");
+    ASSERT_NOT_NULL(repo);
+    ASSERT_NOT_NULL(cache);
+    ASSERT_EQ(th_write_file(TH_PATH(repo, "first.c"), "int first(void) { return 1; }\n"), 0);
+
+    const char *saved_cache = getenv("CBM_CACHE_DIR");
+    char *saved_cache_copy = saved_cache ? strdup(saved_cache) : NULL;
+    (void)cbm_setenv("CBM_CACHE_DIR", cache, 1);
+    cbm_config_t *config = cbm_config_open(cache);
+    cbm_mcp_server_t *server = cbm_mcp_server_new(NULL);
+    if (server && config) {
+        cbm_mcp_server_set_config(server, config);
+    }
+
+    char args[2048];
+    (void)snprintf(args, sizeof(args),
+                   "{\"repo_path\":\"%s\",\"name\":\"ResourcePolicyFixture\","
+                   "\"mode\":\"fast\"}",
+                   repo);
+    char *first_response =
+        server && config ? cbm_mcp_handle_tool(server, "index_repository", args) : NULL;
+    bool first_indexed = first_response && strstr(first_response, "\\\"status\\\":\\\"indexed\\\"");
+    free(first_response);
+
+    char db_path[2048];
+    (void)snprintf(db_path, sizeof(db_path), "%s/ResourcePolicyFixture.db", cache);
+    cbm_store_t *before_store = cbm_store_open_path_query(db_path);
+    cbm_project_t before_project = {0};
+    bool before_read = before_store && cbm_store_get_project(before_store, "ResourcePolicyFixture",
+                                                             &before_project) == CBM_STORE_OK;
+    char *indexed_at_before =
+        before_read && before_project.indexed_at ? strdup(before_project.indexed_at) : NULL;
+    cbm_project_free_fields(&before_project);
+    cbm_store_close(before_store);
+
+    bool configured =
+        config && cbm_config_set(config, CBM_INDEX_CONFIG_MAX_FILES, "1") == 0 &&
+        th_write_file(TH_PATH(repo, "second.py"), "def second():\n    return 2\n") == 0;
+    (void)snprintf(args, sizeof(args),
+                   "{\"repo_path\":\"%s\",\"name\":\"ResourcePolicyFixture\","
+                   "\"mode\":\"fast\",\"_cbm_index_policy\":{"
+                   "\"index_max_files\":\"off\",\"index_max_source_mb\":\"off\"}}",
+                   repo);
+    char *limited_response =
+        configured && server ? cbm_mcp_handle_tool(server, "index_repository", args) : NULL;
+    bool contract_ok = limited_response && strstr(limited_response, "resource_limit_exceeded") &&
+                       strstr(limited_response, "\\\"stage\\\":\\\"discovery\\\"") &&
+                       strstr(limited_response, "\\\"resource\\\":\\\"files\\\"") &&
+                       strstr(limited_response, "\\\"observed\\\":2") &&
+                       strstr(limited_response, "\\\"limit\\\":1") &&
+                       strstr(limited_response, "\\\"unit\\\":\\\"files\\\"") &&
+                       strstr(limited_response, "\\\"retryable\\\":true") &&
+                       strstr(limited_response, "\\\"serving_index_preserved\\\":true");
+    free(limited_response);
+
+    cbm_store_t *after_store = cbm_store_open_path_query(db_path);
+    cbm_project_t after_project = {0};
+    bool after_read = after_store && cbm_store_get_project(after_store, "ResourcePolicyFixture",
+                                                           &after_project) == CBM_STORE_OK;
+    bool generation_preserved = indexed_at_before && after_read && after_project.indexed_at &&
+                                strcmp(indexed_at_before, after_project.indexed_at) == 0;
+    cbm_project_free_fields(&after_project);
+    cbm_store_close(after_store);
+    free(indexed_at_before);
+
+    (void)snprintf(args, sizeof(args),
+                   "{\"repo_path\":\"%s\",\"name\":\"ResourcePolicyFixture\","
+                   "\"mode\":\"cross-repo-intelligence\"}",
+                   repo);
+    char *cross_response = server ? cbm_mcp_handle_tool(server, "index_repository", args) : NULL;
+    bool cross_repo_unaffected =
+        cross_response && strstr(cross_response, "resource_limit_exceeded") == NULL;
+    free(cross_response);
+
+    cbm_mcp_server_free(server);
+    cbm_config_close(config);
+    (void)cbm_unlink(db_path);
+    char sidecar[2100];
+    (void)snprintf(sidecar, sizeof(sidecar), "%s-wal", db_path);
+    (void)cbm_unlink(sidecar);
+    (void)snprintf(sidecar, sizeof(sidecar), "%s-shm", db_path);
+    (void)cbm_unlink(sidecar);
+    th_cleanup(repo);
+    th_cleanup(cache);
+    if (saved_cache_copy) {
+        (void)cbm_setenv("CBM_CACHE_DIR", saved_cache_copy, 1);
+    } else {
+        (void)cbm_unsetenv("CBM_CACHE_DIR");
+    }
+    free(saved_cache_copy);
+
+    ASSERT_TRUE(first_indexed);
+    ASSERT_TRUE(configured);
+    ASSERT_TRUE(contract_ok);
+    ASSERT_TRUE(generation_preserved);
+    ASSERT_TRUE(cross_repo_unaffected);
+    PASS();
+}
+
+SUITE(index_policy) {
+    RUN_TEST(index_policy_defaults_are_disabled);
+    RUN_TEST(index_policy_file_limit_accepts_off_and_exact_range);
+    RUN_TEST(index_policy_source_limit_converts_mib_without_overflow);
+    RUN_TEST(index_policy_invalid_value_is_rejected_atomically);
+    RUN_TEST(index_policy_format_round_trips_public_values);
+    RUN_TEST(index_policy_violation_metadata_is_stable);
+    RUN_TEST(index_policy_config_loads_defaults_values_and_rejects_corruption);
+    RUN_TEST(index_policy_cli_lists_both_operator_keys);
+    RUN_TEST(index_policy_cli_set_rejects_invalid_value_without_overwrite);
+    RUN_TEST(index_policy_cli_set_reports_a_failed_write);
+    RUN_TEST(index_policy_worker_rejects_missing_parent_policy);
+    RUN_TEST(index_policy_mcp_rejects_forged_override_and_preserves_serving_index);
+}
diff --git a/tests/test_index_supervisor.c b/tests/test_index_supervisor.c
index 8a65a4c03..d69354d76 100644
--- a/tests/test_index_supervisor.c
+++ b/tests/test_index_supervisor.c
@@ -6,6 +6,7 @@
 #include "daemon/bootstrap.h"
 #include "foundation/compat.h"
 #include "foundation/compat_fs.h"
+#include "foundation/log.h"
 #include "foundation/platform.h"
 #include "foundation/profile.h"
 #include "mcp/index_supervisor.h"
@@ -560,7 +561,8 @@ static bool index_supervisor_test_run_probe(const char *mode, bool profiling,
     (void)snprintf(args, sizeof(args), "{\"__cbm_test_worker\":\"%s\"}", mode);
     cbm_profile_active = profiling;
     cbm_index_worker_handle_t *handle = NULL;
-    if (cbm_index_worker_start(args, 0, false, NULL, NULL, &handle) != 0 || !handle) {
+    const size_t budget = (size_t)1024U * 1024U * 1024U;
+    if (cbm_index_worker_start(args, budget, false, NULL, NULL, &handle) != 0 || !handle) {
         return false;
     }
     char log_path[INDEX_SUPERVISOR_TEST_PATH_CAP];
@@ -588,6 +590,17 @@ static bool index_supervisor_test_run_probe(const char *mode, bool profiling,
     return terminal;
 }
 
+static char g_index_supervisor_memory_log[1024];
+static int g_index_supervisor_memory_log_count;
+
+static void index_supervisor_test_memory_log_sink(const char *line) {
+    if (strstr(line, "index.supervisor.worker_memory")) {
+        g_index_supervisor_memory_log_count++;
+        (void)snprintf(g_index_supervisor_memory_log, sizeof(g_index_supervisor_memory_log), "%s",
+                       line);
+    }
+}
+
 TEST(index_supervisor_terminal_log_lifecycle_matches_outcome_and_profiling) {
     char cache[INDEX_SUPERVISOR_TEST_PATH_CAP];
     (void)snprintf(cache, sizeof(cache), "%s/cbm-index-logs-XXXXXX", cbm_tmpdir());
@@ -597,6 +610,14 @@ TEST(index_supervisor_terminal_log_lifecycle_matches_outcome_and_profiling) {
     bool saved_profile = cbm_profile_active;
     (void)cbm_setenv("CBM_CACHE_DIR", cache, 1);
 
+    CBMLogLevel saved_level = cbm_log_get_level();
+    CBMLogFormat saved_format = cbm_log_get_format();
+    cbm_log_set_level(CBM_LOG_INFO);
+    cbm_log_set_format(CBM_LOG_FORMAT_TEXT);
+    g_index_supervisor_memory_log[0] = '\0';
+    g_index_supervisor_memory_log_count = 0;
+    cbm_log_set_sink_ex(index_supervisor_test_memory_log_sink, CBM_LOG_SINK_TEE);
+
     cbm_proc_outcome_t clean_outcome = CBM_PROC_SPAWN_FAILED;
     cbm_proc_outcome_t profile_outcome = CBM_PROC_SPAWN_FAILED;
     cbm_proc_outcome_t crash_outcome = CBM_PROC_SPAWN_FAILED;
@@ -621,6 +642,9 @@ TEST(index_supervisor_terminal_log_lifecycle_matches_outcome_and_profiling) {
     bool crash_classified_failure = crash_outcome == CBM_PROC_CRASH;
 #endif
 
+    cbm_log_set_sink(NULL);
+    cbm_log_set_level(saved_level);
+    cbm_log_set_format(saved_format);
     cbm_profile_active = saved_profile;
     index_supervisor_test_restore_env("CBM_CACHE_DIR", saved_cache);
     (void)th_rmtree(cache);
@@ -640,6 +664,14 @@ TEST(index_supervisor_terminal_log_lifecycle_matches_outcome_and_profiling) {
     ASSERT_FALSE(crash_response);
     ASSERT_TRUE(crash_log);
     ASSERT_FALSE(crash_response_file);
+#ifdef _WIN32
+    ASSERT_EQ(g_index_supervisor_memory_log_count, 1); /* crash only, never clean */
+    ASSERT_TRUE(strstr(g_index_supervisor_memory_log, "job_limit_bytes=1610612736") != NULL);
+    ASSERT_TRUE(strstr(g_index_supervisor_memory_log, "peak_job_memory_bytes=") != NULL);
+    ASSERT_TRUE(strstr(g_index_supervisor_memory_log, "unavailable") == NULL);
+#else
+    ASSERT_EQ(g_index_supervisor_memory_log_count, 0);
+#endif
     PASS();
 }
 
@@ -893,7 +925,24 @@ TEST(index_supervisor_killed_worker_log_is_never_empty_and_names_the_run) {
     PASS();
 }
 
+TEST(index_supervisor_job_memory_limit_has_floor_headroom_and_no_overflow) {
+    const size_t mib = (size_t)1024U * 1024U;
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(0) == 0);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(4096) == 0);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(8192) == 0);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(512U * mib - 1) == 0);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(512U * mib) == 768U * mib);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(512U * mib + 1) == 768U * mib + 1);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(1024U * mib) == 1536U * mib);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(SIZE_MAX / 2) ==
+                SIZE_MAX / 2 + (SIZE_MAX / 2) / 2);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(SIZE_MAX - 1) == SIZE_MAX);
+    ASSERT_TRUE(cbm_index_worker_job_memory_limit(SIZE_MAX) == SIZE_MAX);
+    PASS();
+}
+
 SUITE(index_supervisor) {
+    RUN_TEST(index_supervisor_job_memory_limit_has_floor_headroom_and_no_overflow);
     RUN_TEST(index_supervisor_worker_argv_requires_exact_build_bound_grammar);
     RUN_TEST(index_supervisor_async_jobs_are_isolated_cancellable_and_terminal_cached);
     RUN_TEST(index_supervisor_sync_wrapper_forwards_cancel_and_drains_tree);
diff --git a/tests/test_infrascan.c b/tests/test_infrascan.c
index f6da94955..a9bf1aef9 100644
--- a/tests/test_infrascan.c
+++ b/tests/test_infrascan.c
@@ -1,11 +1,11 @@
 #include "test_framework.h"
 #include "graph_buffer/graph_buffer.h"
 #include "pipeline/pipeline_internal.h"
+#include "service_patterns.h"
 
 #include <stdbool.h>
 #include <stdint.h>
-
-bool cbm_service_pattern_is_http_route_literal(const char *literal, const char *callee_name);
+#include <stdio.h>
 
 static int has_data_flow(cbm_gbuf_t *gb, int64_t source_id, int64_t target_id) {
     const cbm_gbuf_edge_t **edges = NULL;
@@ -32,6 +32,196 @@ TEST(infrascan_http_route_literal_guard_rejects_filesystem_paths) {
     ASSERT_TRUE(cbm_service_pattern_is_http_route_literal("/api/orders", "requests.get"));
     ASSERT_TRUE(cbm_service_pattern_is_http_route_literal("https://orders.example/api/orders",
                                                           "requests.get"));
+    /* A comment that leads an argument list is not a route (elasticsearch
+     * RestHandler routes: three Java block comments became Route nodes). */
+    ASSERT_FALSE(cbm_service_pattern_is_http_route_literal(
+        "/*\n                 * Deprecated in #64227, 7.12/8.0.\n                 */",
+        "Route.builder"));
+    ASSERT_FALSE(cbm_service_pattern_is_http_route_literal("// legacy path", "Route.builder"));
+    ASSERT_FALSE(cbm_service_pattern_is_http_route_literal("/_cat\n/indices", "Route.builder"));
+    ASSERT_FALSE(cbm_service_pattern_is_http_route_literal("/* all */", "Route.builder"));
+    ASSERT_TRUE(cbm_service_pattern_is_http_route_literal("/_cat/indices", "Route.builder"));
+    /* The wildcard path (slash-star alone) is a route, not a comment:
+     * elasticsearch's RestClient.buildUri(null, wildcard) registers one. */
+    ASSERT_TRUE(cbm_service_pattern_is_http_route_literal("/*", "RestClient.buildUri"));
+    ASSERT_TRUE(cbm_service_pattern_is_http_route_literal("/api/*", "app.get"));
+    PASS();
+}
+
+/* ── Service-pattern QN boundaries (distilled from PR #1245) ─────────
+ * A library id must sit on an identifier boundary inside the QN. A raw
+ * substring match classified "proj.plugin.loader" as gin ("gin.") and
+ * "proj.studio.x" as Dio ("dio"), which minted bogus Route / HTTP_CALLS
+ * edges. The rule must stay open for CamelCase glue ("GuzzleHttp",
+ * "FeignClient", "KafkaProducer", "IHttpClientFactory") and for version
+ * suffixes ("urllib2", "amqp091-go"). */
+typedef struct {
+    const char *qn;
+    cbm_svc_kind_t want;
+} svc_case_t;
+
+static int svc_case_mismatches(const svc_case_t *cases) {
+    int bad = 0;
+    for (int i = 0; cases[i].qn != NULL; i++) {
+        cbm_svc_kind_t got = cbm_service_pattern_match(cases[i].qn);
+        if (got != cases[i].want) {
+            printf("  service-pattern mismatch: \"%s\" -> %d, expected %d\n", cases[i].qn, (int)got,
+                   (int)cases[i].want);
+            bad++;
+        }
+    }
+    return bad;
+}
+
+TEST(infrascan_service_pattern_match_rejects_ids_inside_words) {
+    static const svc_case_t cases[] = {
+        /* "gin." inside plugin. */
+        {"proj.plugins.autorun.tests.test_plugin._dispatch", CBM_SVC_NONE},
+        {"proj.plugin.loader", CBM_SVC_NONE},
+        /* "chi." / "echo." / "fiber." */
+        {"proj.hibachi.grill", CBM_SVC_NONE},
+        {"sound.reecho.apply", CBM_SVC_NONE},
+        {"textile.microfiber.weave", CBM_SVC_NONE},
+        /* "dio" inside studio / radio */
+        {"proj.studio.x", CBM_SVC_NONE},
+        {"radio.tune", CBM_SVC_NONE},
+        /* "surf" / "resty" / "curl" / "phin" / "hyper" / "sling" / "needle" / "treq" */
+        {"app.surface.draw", CBM_SVC_NONE},
+        {"ui.restyle.apply", CBM_SVC_NONE},
+        /* control: "forestry" spells "restr", never contained "resty" */
+        {"pkg.forestry.trees", CBM_SVC_NONE},
+        {"util.curly.brace", CBM_SVC_NONE},
+        {"sea.dolphin.swim", CBM_SVC_NONE},
+        {"math.hyperbolic.tanh", CBM_SVC_NONE},
+        {"farm.gosling.walk", CBM_SVC_NONE},
+        {"sewing.needles.sort", CBM_SVC_NONE},
+        {"util.streq", CBM_SVC_NONE},
+        /* "requests" glued to a lowercase prefix (upstream's case) */
+        {"proj.myrequests.client.get", CBM_SVC_NONE},
+        /* "express" / "rocket" / "tonic" / "nconf" */
+        {"ast.expression.eval", CBM_SVC_NONE},
+        {"mq.rocketmq.send", CBM_SVC_NONE},
+        {"geo.tectonic.plates", CBM_SVC_NONE},
+        {"app.unconfigured.warn", CBM_SVC_NONE},
+        {"cli.runconfig.load", CBM_SVC_NONE},
+        {"aws.s3express.session", CBM_SVC_NONE},
+        /* not clients of the id they contain: ASGI server, URL library,
+         * nginx platform, Memgraph OGM, Celery settings module, a word */
+        {"hypercorn.run.serve", CBM_SVC_NONE},
+        {"hyperlink.URL.from_text", CBM_SVC_NONE},
+        {"openresty.core.request", CBM_SVC_NONE},
+        {"gqlalchemy.Memgraph.execute", CBM_SVC_NONE},
+        {"celeryconfig.broker_url", CBM_SVC_NONE},
+        {"kafkaesque.story.tell", CBM_SVC_NONE},
+        {NULL, CBM_SVC_NONE},
+    };
+    ASSERT_EQ(svc_case_mismatches(cases), 0);
+    PASS();
+}
+
+TEST(infrascan_service_pattern_match_keeps_real_library_qns) {
+    static const svc_case_t cases[] = {
+        /* Route registration: ids that end in a separator, own segment */
+        {"github.com/gin-gonic/gin.Default", CBM_SVC_ROUTE_REG},
+        {"proj.gin.router.GET", CBM_SVC_ROUTE_REG},
+        {"gin.GET", CBM_SVC_ROUTE_REG},
+        {"chi.NewRouter", CBM_SVC_ROUTE_REG},
+        {"github.com/labstack/echo.New", CBM_SVC_ROUTE_REG},
+        {"fiber.New", CBM_SVC_ROUTE_REG},
+        {"proj.express.router.get", CBM_SVC_ROUTE_REG},
+        {"@hapi/hapi.server.route", CBM_SVC_ROUTE_REG},
+        /* HTTP: own segment / separator-joined wrapper */
+        {"proj.venv.requests.api.get", CBM_SVC_HTTP},
+        {"proj.service.requests_get", CBM_SVC_HTTP},
+        {"package:dio/dio.dart", CBM_SVC_HTTP},
+        {"dio.Dio.get", CBM_SVC_HTTP},
+        {"pkg.net.curl.get", CBM_SVC_HTTP},
+        {"curl_exec", CBM_SVC_HTTP},
+        {"surf.get", CBM_SVC_HTTP},
+        {"hyper.Client.request", CBM_SVC_HTTP},
+        {"phin.promisified", CBM_SVC_HTTP},
+        {"needle.get", CBM_SVC_HTTP},
+        {"github.com/go-resty/resty.New", CBM_SVC_HTTP},
+        {"github.com/dghubble/sling.New", CBM_SVC_HTTP},
+        /* HTTP: CamelCase glue after the id */
+        {"GuzzleHttp\\Client", CBM_SVC_HTTP},
+        {"proj.GuzzleHttp.Client.get", CBM_SVC_HTTP},
+        {"org.springframework.cloud.openfeign.FeignClientBuilder.build", CBM_SVC_HTTP},
+        {"com.acme.net.HttpClientFactory.create", CBM_SVC_HTTP},
+        /* HTTP: CamelCase glue before the id */
+        {"System.Net.Http.IHttpClientFactory.CreateClient", CBM_SVC_HTTP},
+        {"org.asynchttpclient.AsyncHttpClient.prepareGet", CBM_SVC_HTTP},
+        {"Foundation.NSURLSession.dataTask", CBM_SVC_HTTP},
+        /* HTTP: version suffix after the id */
+        {"urllib2.urlopen", CBM_SVC_HTTP},
+        {"Mint.HTTP2.request", CBM_SVC_HTTP},
+        /* Async */
+        {"com.acme.events.KafkaProducer.send", CBM_SVC_ASYNC},
+        {"this.kafkaProducer.send", CBM_SVC_ASYNC},
+        {"org.apache.kafka.clients.producer.KafkaProducer.send", CBM_SVC_ASYNC},
+        {"github.com/rabbitmq/amqp091-go.Channel.Publish", CBM_SVC_ASYNC},
+        {"github.com/nats-io/nats.go.Conn.Publish", CBM_SVC_ASYNC},
+        /* Config */
+        {"os.getenv", CBM_SVC_CONFIG},
+        {"os.Getenv", CBM_SVC_CONFIG},
+        /* Glued-name libraries: the library's own name glues a lowercase
+         * prefix/suffix onto another id, so each has an explicit table entry.
+         * Every QN below contains NO other id — only the entry can match. */
+        {"grequests.map", CBM_SVC_HTTP},
+        {"txrequests.Session.send", CBM_SVC_HTTP},
+        {"redaxios.create", CBM_SVC_HTTP},
+        {"gaxios.request", CBM_SVC_HTTP},
+        {"libcurl.version", CBM_SVC_HTTP},
+        {"node-libcurl.Easy.perform", CBM_SVC_HTTP},
+        {"curlpp.Easy.perform", CBM_SVC_HTTP},
+        {"curlcpp.easy.perform", CBM_SVC_HTTP},
+        {"hyperlocal.UnixConnector.call", CBM_SVC_HTTP},
+        {"guzzlehttp/psr7.Utils.streamFor", CBM_SVC_HTTP},
+        {"aiokafka.helpers.create_ssl_context", CBM_SVC_ASYNC},
+        {"pykafka.topic.Topic.get_producer", CBM_SVC_ASYNC},
+        {"librdkafka.rd_version", CBM_SVC_ASYNC},
+        {"rdkafkacpp.version", CBM_SVC_ASYNC},
+        {"rskafka.client.partition.write", CBM_SVC_ASYNC},
+        {"aioamqp.connect", CBM_SVC_ASYNC},
+        {"amqpstorm.Connection.channel", CBM_SVC_ASYNC},
+        {"pamqp.frame.marshal", CBM_SVC_ASYNC},
+        {"kombu.transport.pyamqp.Transport.establish_connection", CBM_SVC_ASYNC},
+        {"amqprs.channel.basic_publish", CBM_SVC_ASYNC},
+        {"amqpcpp.TcpChannel.publish", CBM_SVC_ASYNC},
+        {"pynats.client.send", CBM_SVC_ASYNC},
+        {"jnats.options.build", CBM_SVC_ASYNC},
+        {"aiomqtt.client.publish", CBM_SVC_ASYNC},
+        {"amqtt.session.deliver", CBM_SVC_ASYNC},
+        {"hbmqtt.session.deliver", CBM_SVC_ASYNC},
+        {"umqtt.simple.publish", CBM_SVC_ASYNC},
+        {"mqttools.client.publish", CBM_SVC_ASYNC},
+        {"emqtt.publish", CBM_SVC_ASYNC},
+        {"rumqtt.client.publish", CBM_SVC_ASYNC},
+        {"github.com/256dpi/gomqtt/client.Publish", CBM_SVC_ASYNC},
+        {"libmosquitto.publish", CBM_SVC_ASYNC},
+        {"mosquittopp.publish", CBM_SVC_ASYNC},
+        {"google.cloud.pubsublite.admin.create_topic", CBM_SVC_ASYNC},
+        {"gocelery.client.delay", CBM_SVC_ASYNC},
+        {"_wgetenv", CBM_SVC_CONFIG},
+        {"_wgetenv_s", CBM_SVC_CONFIG},
+        {"os.getenvb", CBM_SVC_CONFIG},
+        {"qgetenv", CBM_SVC_CONFIG},
+        {"@dotenvx/dotenvx.config", CBM_SVC_CONFIG},
+        {"vlucas/phpdotenv.load", CBM_SVC_CONFIG},
+        {"apiflask.scaffold.get", CBM_SVC_ROUTE_REG},
+        {"honox.factory.createRoute", CBM_SVC_ROUTE_REG},
+        {"fasthttprouter.Router.GET", CBM_SVC_ROUTE_REG},
+        {"github.com/vektah/gqlparser/v2.LoadSchema", CBM_SVC_GRAPHQL},
+        {"github.com/Yamashou/gqlgenc.client.Post", CBM_SVC_GRAPHQL},
+        {"aiogqlc.client.execute", CBM_SVC_GRAPHQL},
+        {NULL, CBM_SVC_NONE},
+    };
+    ASSERT_EQ(svc_case_mismatches(cases), 0);
+    ASSERT_STR_EQ(cbm_service_pattern_broker("aiokafka.helpers.create_ssl_context"), "kafka");
+    ASSERT_STR_EQ(cbm_service_pattern_broker("umqtt.simple.publish"), "mqtt");
+    ASSERT_STR_EQ(cbm_service_pattern_broker("com.acme.events.KafkaProducer.send"), "kafka");
+    ASSERT_STR_EQ(cbm_service_pattern_broker("github.com/rabbitmq/amqp091-go.Channel.Publish"),
+                  "rabbitmq");
     PASS();
 }
 
@@ -115,6 +305,8 @@ TEST(infrascan_http_calls_join_matching_handler_route) {
 
 SUITE(infrascan) {
     RUN_TEST(infrascan_http_route_literal_guard_rejects_filesystem_paths);
+    RUN_TEST(infrascan_service_pattern_match_rejects_ids_inside_words);
+    RUN_TEST(infrascan_service_pattern_match_keeps_real_library_qns);
     RUN_TEST(infrascan_route_nodes_skip_bad_http_url_paths);
     RUN_TEST(infrascan_http_calls_join_matching_handler_route);
 }
diff --git a/tests/test_lang_contract.c b/tests/test_lang_contract.c
index 5a32bcda0..6eb993564 100644
--- a/tests/test_lang_contract.c
+++ b/tests/test_lang_contract.c
@@ -1070,6 +1070,7 @@ static const char *ALL_EDGE_TYPES[] = {"CALLS",
                                        "INHERITS",
                                        "INFRA_MAPS",
                                        "OVERRIDE",
+                                       "REFERENCES_FILE",
                                        "SEMANTICALLY_RELATED",
                                        "SIMILAR_TO",
                                        "TESTS_FILE",
diff --git a/tests/test_language.c b/tests/test_language.c
index 6dbc9b49c..18ad09600 100644
--- a/tests/test_language.c
+++ b/tests/test_language.c
@@ -413,6 +413,36 @@ TEST(lang_ext_svg) {
     ASSERT_EQ(cbm_language_for_extension(".svg"), CBM_LANG_XML);
     PASS();
 }
+/* Issue #2229: the XML documents that make up a .NET repository's project
+ * system were unmapped, so a solution's package references, target frameworks,
+ * localized strings and app manifests were never indexed or searchable. */
+TEST(lang_ext_msbuild_projects) {
+    ASSERT_EQ(cbm_language_for_extension(".csproj"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".vbproj"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".fsproj"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".props"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".targets"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".nuspec"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".slnx"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".runsettings"), CBM_LANG_XML);
+    PASS();
+}
+TEST(lang_ext_resx) {
+    ASSERT_EQ(cbm_language_for_extension(".resx"), CBM_LANG_XML);
+    PASS();
+}
+TEST(lang_ext_xaml) {
+    ASSERT_EQ(cbm_language_for_extension(".xaml"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".axaml"), CBM_LANG_XML);
+    PASS();
+}
+TEST(lang_ext_app_manifests) {
+    ASSERT_EQ(cbm_language_for_extension(".plist"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".xcprivacy"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".manifest"), CBM_LANG_XML);
+    ASSERT_EQ(cbm_language_for_extension(".appxmanifest"), CBM_LANG_XML);
+    PASS();
+}
 TEST(lang_ext_markdown) {
     ASSERT_EQ(cbm_language_for_extension(".md"), CBM_LANG_MARKDOWN);
     PASS();
@@ -1361,6 +1391,10 @@ SUITE(language) {
     RUN_TEST(lang_ext_xsl);
     RUN_TEST(lang_ext_xsd);
     RUN_TEST(lang_ext_svg);
+    RUN_TEST(lang_ext_msbuild_projects);
+    RUN_TEST(lang_ext_resx);
+    RUN_TEST(lang_ext_xaml);
+    RUN_TEST(lang_ext_app_manifests);
     RUN_TEST(lang_ext_markdown);
     RUN_TEST(lang_ext_mdx);
     RUN_TEST(lang_ext_makefile);
diff --git a/tests/test_main.c b/tests/test_main.c
index 72d45be10..db3748288 100644
--- a/tests/test_main.c
+++ b/tests/test_main.c
@@ -23,7 +23,7 @@ int tf_skip_count = 0;
 #include "daemon/version_cohort.h" /* Windows crash-turnover re-exec probe */
 #include "mcp/index_supervisor.h"  /* cbm_index_set_worker_role */
 #include "mcp/mcp.h"               /* cbm_mcp_handle_tool — act as a real worker */
-#include "ui/http_server.h"       /* deleted-self executable probe */
+#include "ui/http_server.h"        /* deleted-self executable probe */
 #include <sqlite3.h>
 #include <errno.h>
 #include <stdbool.h>
@@ -34,6 +34,7 @@ int tf_skip_count = 0;
 #include <signal.h>
 #ifdef _WIN32
 #include <winsock2.h> /* #798 follow-up: socket-isolation re-exec probe */
+#include <windows.h>
 #else
 #include <unistd.h>
 #ifdef __APPLE__
@@ -51,6 +52,29 @@ int tf_skip_count = 0;
  * unwind after either production containment or the test's verified backstop. */
 #define TF_BLOCKING_GIT_MARKER_ENV "CBM_TEST_RUNTIME_BLOCKING_GIT_PID_FILE"
 
+/* Native child for subprocess_windows_job_object_enforces_memory_limit. The
+ * fixed-size commit keeps the RED path bounded: without a Job memory limit it
+ * succeeds and exits 0; with the limit it is denied and exits with the sentinel
+ * code expected by the parent test. */
+static int tf_maybe_run_windows_memory_limit_probe(int argc, char **argv) {
+#ifdef _WIN32
+    if (argc == 2 && argv && strcmp(argv[1], "__cbm_windows_memory_limit_probe") == 0) {
+        const SIZE_T allocation_size = (SIZE_T)2U * 1024U * 1024U * 1024U;
+        void *allocation =
+            VirtualAlloc(NULL, allocation_size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+        if (!allocation) {
+            return 73;
+        }
+        (void)VirtualFree(allocation, 0, MEM_RELEASE);
+        return 0;
+    }
+#else
+    (void)argc;
+    (void)argv;
+#endif
+    return -1;
+}
+
 #ifdef _WIN32
 static bool tf_invoked_as_windows_git_module(void) {
     /* CreateProcessW authenticates the executable with lpApplicationName, but
@@ -752,6 +776,7 @@ extern void suite_dyn_array(void);
 extern void suite_str_intern(void);
 extern void suite_log(void);
 extern void suite_str_util(void);
+extern void suite_index_policy(void);
 extern void suite_workspace(void);
 extern void suite_platform(void);
 extern void suite_diagnostics(void);
@@ -827,6 +852,7 @@ extern void suite_store_pragmas(void);
 extern void suite_store_checkpoint(void);
 extern void suite_traces(void);
 extern void suite_configlink(void);
+extern void suite_doclinks(void);
 extern void suite_infrascan(void);
 extern void suite_cli(void);
 extern void suite_agent_clients(void);
@@ -856,6 +882,7 @@ extern void suite_repro_harness_cleanup(void);
 extern void suite_repro_runner_filter(void);
 extern void suite_call_reference_contract(void);
 extern void suite_mem(void);
+extern void suite_mem_events(void);
 extern void suite_ui(void);
 extern void suite_httpd(void);
 extern void suite_security(void);
@@ -905,6 +932,10 @@ int main(int argc, char **argv) {
         (void)cbm_setenv("CBM_TEST_BUILD_FINGERPRINT",
                          "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", 1);
     }
+    int memory_limit_probe_rc = tf_maybe_run_windows_memory_limit_probe(argc, argv);
+    if (memory_limit_probe_rc >= 0) {
+        return memory_limit_probe_rc;
+    }
     int blocking_git_rc = tf_maybe_run_blocking_git_probe(argc, argv);
     if (blocking_git_rc >= 0) {
         return blocking_git_rc;
@@ -915,6 +946,26 @@ int main(int argc, char **argv) {
         (void)puts("codebase-memory-mcp test-runner");
         return 0;
     }
+    /* #1830 userns smoke probe -- see the test that spawns it.
+     *
+     * The ancestor overflow uid is derived ONCE per process (pthread_once in
+     * src/daemon/ipc.c) from /proc/self/uid_map. That file is not immutable:
+     * unshare(CLONE_NEWUSER) is exactly what changes it, and pthread_once state
+     * survives fork(). A forked child therefore keeps the HOST answer and never
+     * re-derives inside its new namespace, so a fork-only smoke test refuses and
+     * cannot pass once anything earlier in the suite has primed the cache --
+     * seven call sites do. Re-exec into this probe so the decision is made by a
+     * process that STARTED inside the namespace, which is the production shape
+     * the test means to cover. */
+#if defined(__linux__) && defined(CBM_ENABLE_TEST_SEAMS)
+    if (argc == 3 && strcmp(argv[1], "--userns-secure-probe") == 0) {
+        /* _exit, not return: this process exists to answer ONE boolean. A
+         * return runs the atexit chain, and the runner is built with
+         * -fsanitize=address, so a future leak anywhere in the prologue would
+         * exit 23 and read as a security verdict on a test that has none. */
+        _exit(cbm_daemon_ipc_private_directory_secure(argv[2]) ? 0 : 1);
+    }
+#endif
     int mcp_idxfailclosed_rc = tf_maybe_run_mcp_idxfailclosed_probe(argc, argv);
     if (mcp_idxfailclosed_rc >= 0) {
         return mcp_idxfailclosed_rc;
@@ -1005,6 +1056,7 @@ int main(int argc, char **argv) {
     RUN_SELECTED_SUITE(str_intern);
     RUN_SELECTED_SUITE(log);
     RUN_SELECTED_SUITE(str_util);
+    RUN_SELECTED_SUITE(index_policy);
     RUN_SELECTED_SUITE(workspace);
     RUN_SELECTED_SUITE(platform);
     RUN_SELECTED_SUITE(diagnostics);
@@ -1130,6 +1182,9 @@ int main(int argc, char **argv) {
     /* Config link */
     RUN_SELECTED_SUITE(configlink);
 
+    /* Markdown file reference link */
+    RUN_SELECTED_SUITE(doclinks);
+
     /* Infrastructure scanning */
     RUN_SELECTED_SUITE(infrascan);
 
@@ -1156,6 +1211,7 @@ int main(int argc, char **argv) {
     /* mem + arena + slab integration */
     RUN_SELECTED_SUITE(slab_alloc);
     RUN_SELECTED_SUITE(mem);
+    RUN_SELECTED_SUITE(mem_events);
 
     /* UI (config, external asset pack, layout) */
     RUN_SELECTED_SUITE(ui);
diff --git a/tests/test_mcp.c b/tests/test_mcp.c
index 10d5b9e6e..ffa9ea3a3 100644
--- a/tests/test_mcp.c
+++ b/tests/test_mcp.c
@@ -3786,6 +3786,124 @@ TEST(tool_search_graph_bm25_reports_candidate_saturation) {
     PASS();
 }
 
+/* Shared fixture for the two BM25 findability probes (2026-09-16, measured on
+ * JetBrains/Exposed and django/django): a Class named exactly like the query,
+ * that class's own Methods, and test Methods whose long names repeat the
+ * query token — the shapes that outranked the class and hid it entirely. */
+static void bm25_findability_fixture(cbm_store_t *store, const char *project) {
+    cbm_store_upsert_project(store, project, "/tmp/bm25-findability");
+    struct {
+        const char *label, *name, *qn, *file;
+    } rows[] = {
+        {"Class", "Table", "bm25-find.core.Table.Table", "core/Table.kt"},
+        {"Method", "unquoted", "bm25-find.core.Table.Table.unquoted", "core/Table.kt"},
+        {"Method", "describe", "bm25-find.core.Table.Table.describe", "core/Table.kt"},
+        {"Method", "table references table with same name in other database",
+         "bm25-find.tests.SchemaTests.table_references_table_with_same_name", "tests/Schema.kt"},
+        {"Method", "table references table with same name in mysql",
+         "bm25-find.tests.SchemaTests.table_references_table_with_same_name_mysql",
+         "tests/Schema.kt"},
+        {"Function", "get_object_or_404", "bm25-find.shortcuts.get_object_or_404", "shortcuts.py"},
+        {"Method", "test_get_object_or_404",
+         "bm25-find.tests.GetObjectOr404Tests.test_get_object_or_404", "tests/tests.py"},
+        {"Method", "test_get_object_or_404_queryset_attribute_error",
+         "bm25-find.tests.GetObjectOr404Tests.test_get_object_or_404_queryset_attribute_error",
+         "tests/tests.py"},
+        {"Method", "test_get_object_or_404_bad_class",
+         "bm25-find.tests.GetListObjectOr404Test.test_get_object_or_404_bad_class",
+         "tests/async.py"},
+    };
+    for (size_t i = 0; i < sizeof(rows) / sizeof(rows[0]); i++) {
+        cbm_node_t node = {.project = project,
+                           .label = rows[i].label,
+                           .name = rows[i].name,
+                           .qualified_name = rows[i].qn,
+                           .file_path = rows[i].file,
+                           .start_line = (int)i + 1,
+                           .end_line = (int)i + 2};
+        cbm_store_upsert_node(store, &node);
+    }
+    cbm_store_exec(store, "INSERT INTO nodes_fts(nodes_fts) VALUES('delete-all');");
+    cbm_store_exec(store, "INSERT INTO nodes_fts(rowid, name, qualified_name, label, "
+                          "file_path) SELECT id, cbm_camel_split(name), qualified_name, "
+                          "label, file_path FROM nodes;");
+}
+
+/* The label filter must apply in query (BM25) mode exactly as in structural
+ * mode: `query=Table label=Class` returns the class, and no Method. */
+TEST(tool_search_graph_bm25_applies_label_filter) {
+    cbm_mcp_server_t *srv = cbm_mcp_server_new(NULL);
+    ASSERT_NOT_NULL(srv);
+    cbm_store_t *store = cbm_mcp_server_store(srv);
+    ASSERT_NOT_NULL(store);
+    const char *project = "bm25-find";
+    cbm_mcp_server_set_project(srv, project);
+    bm25_findability_fixture(store, project);
+
+    char *resp = cbm_mcp_server_handle(
+        srv, "{\"jsonrpc\":\"2.0\",\"id\":554,\"method\":\"tools/call\","
+             "\"params\":{\"name\":\"search_graph\",\"arguments\":{"
+             "\"project\":\"bm25-find\",\"query\":\"Table\",\"label\":\"Class\","
+             "\"limit\":5,\"format\":\"json\"}}}");
+    ASSERT_NOT_NULL(resp);
+    char *inner = extract_text_content(resp);
+    ASSERT_NOT_NULL(inner);
+    ASSERT_NOT_NULL(strstr(inner, "\"bm25-find.core.Table.Table\",\"Class\""));
+    ASSERT_NULL(strstr(inner, "\"Method\""));
+    /* The reported total describes the filtered rows, not the unfiltered window. */
+    ASSERT_NOT_NULL(strstr(inner, "\"total\":1"));
+    free(inner);
+    free(resp);
+    cbm_mcp_server_free(srv);
+    PASS();
+}
+
+/* The definition whose NAME is the query ranks first: the `Table` class above
+ * its own methods and above test methods that repeat "table" three times; the
+ * `get_object_or_404` function above the test methods that contain it. */
+TEST(tool_search_graph_bm25_ranks_exact_name_first) {
+    cbm_mcp_server_t *srv = cbm_mcp_server_new(NULL);
+    ASSERT_NOT_NULL(srv);
+    cbm_store_t *store = cbm_mcp_server_store(srv);
+    ASSERT_NOT_NULL(store);
+    const char *project = "bm25-find";
+    cbm_mcp_server_set_project(srv, project);
+    bm25_findability_fixture(store, project);
+
+    char *resp = cbm_mcp_server_handle(
+        srv, "{\"jsonrpc\":\"2.0\",\"id\":555,\"method\":\"tools/call\","
+             "\"params\":{\"name\":\"search_graph\",\"arguments\":{"
+             "\"project\":\"bm25-find\",\"query\":\"Table\",\"limit\":5,\"format\":\"json\"}}}");
+    ASSERT_NOT_NULL(resp);
+    char *inner = extract_text_content(resp);
+    ASSERT_NOT_NULL(inner);
+    const char *rows = strstr(inner, "\"rows\":[");
+    ASSERT_NOT_NULL(rows);
+    const char *first_qn = strstr(rows, "[\"");
+    ASSERT_NOT_NULL(first_qn);
+    ASSERT_EQ(strncmp(first_qn, "[\"bm25-find.core.Table.Table\"", 29), 0);
+    free(inner);
+    free(resp);
+
+    resp = cbm_mcp_server_handle(
+        srv, "{\"jsonrpc\":\"2.0\",\"id\":556,\"method\":\"tools/call\","
+             "\"params\":{\"name\":\"search_graph\",\"arguments\":{"
+             "\"project\":\"bm25-find\",\"query\":\"get_object_or_404\",\"limit\":5,"
+             "\"format\":\"json\"}}}");
+    ASSERT_NOT_NULL(resp);
+    inner = extract_text_content(resp);
+    ASSERT_NOT_NULL(inner);
+    rows = strstr(inner, "\"rows\":[");
+    ASSERT_NOT_NULL(rows);
+    first_qn = strstr(rows, "[\"");
+    ASSERT_NOT_NULL(first_qn);
+    ASSERT_EQ(strncmp(first_qn, "[\"bm25-find.shortcuts.get_object_or_404\"", 40), 0);
+    free(inner);
+    free(resp);
+    cbm_mcp_server_free(srv);
+    PASS();
+}
+
 /* `query` selects the BM25 fast path, which returns before semantic_query is
  * evaluated. Accepting both therefore used to report success while silently
  * discarding one of the caller's two requested result sets. The contract is
@@ -5583,9 +5701,9 @@ TEST(tool_check_index_coverage_reports_truncation_marker_issue963) {
 
     /* The marked file: both real ranges survive, the marker is flagged, and the
      * "12" from the marker never becomes a range of its own. */
-    char *marked =
-        cbm_mcp_handle_tool(srv, "check_index_coverage",
-                            "{\"project\":\"coverage-marker\",\"paths\":[\"src/marked.c\"],\"format\":\"json\"}");
+    char *marked = cbm_mcp_handle_tool(
+        srv, "check_index_coverage",
+        "{\"project\":\"coverage-marker\",\"paths\":[\"src/marked.c\"],\"format\":\"json\"}");
     ASSERT_NOT_NULL(marked);
     char *marked_inner = extract_text_content(marked);
     ASSERT_NOT_NULL(marked_inner);
@@ -5597,9 +5715,9 @@ TEST(tool_check_index_coverage_reports_truncation_marker_issue963) {
     free(marked);
 
     /* The same ranges without a marker must NOT be reported as truncated. */
-    char *plain =
-        cbm_mcp_handle_tool(srv, "check_index_coverage",
-                            "{\"project\":\"coverage-marker\",\"paths\":[\"src/plain.c\"],\"format\":\"json\"}");
+    char *plain = cbm_mcp_handle_tool(
+        srv, "check_index_coverage",
+        "{\"project\":\"coverage-marker\",\"paths\":[\"src/plain.c\"],\"format\":\"json\"}");
     ASSERT_NOT_NULL(plain);
     char *plain_inner = extract_text_content(plain);
     ASSERT_NOT_NULL(plain_inner);
@@ -5610,9 +5728,9 @@ TEST(tool_check_index_coverage_reports_truncation_marker_issue963) {
 
     /* The reader's own limit stops the list early, so it must say so even
      * though the producer sent no marker. */
-    char *widest =
-        cbm_mcp_handle_tool(srv, "check_index_coverage",
-                            "{\"project\":\"coverage-marker\",\"paths\":[\"src/wide.c\"],\"format\":\"json\"}");
+    char *widest = cbm_mcp_handle_tool(
+        srv, "check_index_coverage",
+        "{\"project\":\"coverage-marker\",\"paths\":[\"src/wide.c\"],\"format\":\"json\"}");
     ASSERT_NOT_NULL(widest);
     char *wide_inner = extract_text_content(widest);
     ASSERT_NOT_NULL(wide_inner);
@@ -5726,20 +5844,15 @@ TEST(tool_check_index_coverage_accepts_truncated_ignored_catalog_for_fresh_path_
     ASSERT_NOT_NULL(store);
     char source_path[512];
     snprintf(source_path, sizeof(source_path), "%s/project/main.go", tmp);
-    struct stat source_stat;
-    ASSERT_EQ(stat(source_path, &source_stat), 0);
-#ifdef __APPLE__
-    int64_t source_mtime_ns =
-        ((int64_t)source_stat.st_mtimespec.tv_sec * (int64_t)CBM_NSEC_PER_SEC) +
-        (int64_t)source_stat.st_mtimespec.tv_nsec;
-#elif defined(_WIN32)
-    int64_t source_mtime_ns = (int64_t)source_stat.st_mtime * (int64_t)CBM_NSEC_PER_SEC;
-#else
-    int64_t source_mtime_ns = ((int64_t)source_stat.st_mtim.tv_sec * (int64_t)CBM_NSEC_PER_SEC) +
-                              (int64_t)source_stat.st_mtim.tv_nsec;
-#endif
-    ASSERT_EQ(cbm_store_upsert_file_hash(store, "test-project", "main.go", "", source_mtime_ns,
-                                         source_stat.st_size),
+    /* The fixture must record the hash with the SAME mtime source the indexer
+     * writes with — cbm_path_info_utf8 — not struct stat. On Windows stat
+     * truncates to seconds while the stored record carries FILETIME-derived
+     * nanoseconds, so a stat-written fixture would never compare equal and the
+     * metadata_match contract below would fail. */
+    cbm_path_info_t path_info;
+    ASSERT_EQ(cbm_path_info_utf8(source_path, &path_info), 0);
+    ASSERT_EQ(cbm_store_upsert_file_hash(store, "test-project", "main.go", "", path_info.mtime_ns,
+                                         path_info.size),
               CBM_STORE_OK);
     cbm_project_t project = {0};
     ASSERT_EQ(cbm_store_get_project(store, "test-project", &project), CBM_STORE_OK);
@@ -5782,6 +5895,63 @@ TEST(tool_check_index_coverage_accepts_truncated_ignored_catalog_for_fresh_path_
     PASS();
 }
 
+/* #1714: coverage freshness must compare mtime_ns at the SAME precision the
+ * indexer records it. The pipeline records cbm_path_info_utf8's value (which
+ * on Windows derives from FILETIME — nanosecond), while the freshness reader
+ * used to recompute from struct stat, which on Windows truncates to seconds
+ * (st_mtime). A byte-identical file therefore never matched and every path was
+ * reported metadata_changed. The reader now uses the indexer's own source. */
+TEST(tool_check_index_coverage_freshness_uses_indexer_mtime_source_issue1714) {
+    char tmp[256];
+    cbm_mcp_server_t *srv = setup_snippet_server(tmp, sizeof(tmp));
+    ASSERT_NOT_NULL(srv);
+    cbm_store_t *store = cbm_mcp_server_store(srv);
+    ASSERT_NOT_NULL(store);
+
+    char source_path[512];
+    snprintf(source_path, sizeof(source_path), "%s/project/main.go", tmp);
+    cbm_path_info_t info;
+    ASSERT_EQ(cbm_path_info_utf8(source_path, &info), 0);
+
+    /* The hash exactly as the indexer writes it: same source, ns precision. */
+    ASSERT_EQ(cbm_store_upsert_file_hash(store, "test-project", "main.go", "", info.mtime_ns,
+                                         info.size),
+              CBM_STORE_OK);
+
+    /* format=json, like every other coverage test here: the DEFAULT response is
+     * the compact table, in which a field name never appears. Keeping the
+     * assertion on the JSON field is what makes it exact — a bare strstr for
+     * "metadata_match" would also be satisfied by a neighbouring column or by
+     * another path's row. */
+    char *response = cbm_mcp_handle_tool(srv, "check_index_coverage",
+                                         "{\"project\":\"test-project\",\"paths\":[\"main.go\"],"
+                                         "\"format\":\"json\"}");
+    ASSERT_NOT_NULL(response);
+    ASSERT_NOT_NULL(strstr(response, "\"freshness\":\"metadata_match\""));
+    free(response);
+
+    /* A hash stored at seconds precision — what a stat-based reader previously
+     * compared against — must NOT match an unchanged file: the comparison must
+     * stay nanosecond-exact, or part of mtime resolution is silently dropped. */
+    int64_t seconds_mtime_ns = (info.mtime_ns / (int64_t)CBM_NSEC_PER_SEC) *
+                               (int64_t)CBM_NSEC_PER_SEC;
+    if (seconds_mtime_ns != info.mtime_ns) {
+        ASSERT_EQ(cbm_store_upsert_file_hash(store, "test-project", "main.go", "",
+                                             seconds_mtime_ns, info.size),
+                  CBM_STORE_OK);
+        response = cbm_mcp_handle_tool(srv, "check_index_coverage",
+                                       "{\"project\":\"test-project\",\"paths\":[\"main.go\"],"
+                                       "\"format\":\"json\"}");
+        ASSERT_NOT_NULL(response);
+        ASSERT_NOT_NULL(strstr(response, "\"freshness\":\"metadata_changed\""));
+        free(response);
+    }
+
+    cleanup_snippet_dir(tmp);
+    cbm_mcp_server_free(srv);
+    PASS();
+}
+
 TEST(tool_check_index_coverage_rejects_stale_generation) {
     char tmp[256];
     cbm_mcp_server_t *srv = setup_snippet_server(tmp, sizeof(tmp));
@@ -17773,8 +17943,15 @@ TEST(index_repository_over_budget_reports_named_reason) {
     bool reason_named = second_reason && strcmp(second_reason, "over_memory_budget") == 0;
     bool previous_preserved = second_previous && strcmp(second_previous, "preserved") == 0;
     bool hint_names_knob = second_hint && strstr(second_hint, "CBM_MEM_BUDGET_MB") != NULL;
+    /* The hint must also say that peak_rss_mb is NOT the requirement. The abort
+     * fires when RSS crosses the budget, so the peak is pinned just above it by
+     * construction; a caller who retries at peak+10% fails again. Measured on
+     * the linux kernel 2026-09-13: aborted at 25622 MB against a 24576 MB
+     * budget, but completing it took 31.75 GB. */
+    bool hint_warns_peak_is_not_need = second_hint && strstr(second_hint, "STOPPED") != NULL;
     int budget_mb = budget_doc_int(second_doc, "budget_mb", -1);
     int peak_rss_mb = budget_doc_int(second_doc, "peak_rss_mb", -1);
+    int suggested_mb = budget_doc_int(second_doc, "suggested_budget_mb", -1);
     yyjson_doc_free(second_doc);
     free(second);
     long db_size_after = (long)cbm_file_size(db_path);
@@ -17817,8 +17994,11 @@ TEST(index_repository_over_budget_reports_named_reason) {
     ASSERT_TRUE(reason_named);
     ASSERT_TRUE(previous_preserved);
     ASSERT_TRUE(hint_names_knob);
+    ASSERT_TRUE(hint_warns_peak_is_not_need);
     ASSERT_EQ(budget_mb, 1);
     ASSERT_GT(peak_rss_mb, budget_mb);
+    /* A CONCRETE retry value, not just the knob name: 1.5x the budget. */
+    ASSERT_GT(suggested_mb, budget_mb);
     /* Preserved on disk and still served: same file size, same node count. */
     ASSERT_GT(db_size_before, 0L);
     ASSERT_EQ(db_size_after, db_size_before);
@@ -19099,22 +19279,72 @@ TEST(mcp_auto_watch_false_skips_watcher_on_connect) {
 }
 
 /* ══════════════════════════════════════════════════════════════════
- *  #1466 — autoindex.skip must report the effective numeric limit
+ *  #1466 / #713 — the auto_index_limit guard
+ *
+ *  #1466: autoindex.skip must report the effective numeric limit.
+ *  #713:  the guard must bound NON-git roots. The 0.8.x guard counted
+ *         `git ls-files | wc -l`, which is 0 outside a checkout, so a plain
+ *         directory of 60k files was walked in full (tens of GB RSS). The
+ *         bounded discovery count applies to every root, and the skip line
+ *         names the limit AND the root so the reporter can act on it.
  * ══════════════════════════════════════════════════════════════════ */
 
 static char autoindex_skip_log[1024];
+static bool autoindex_saw_done;
 
-/* Keeps only the too_many_files skip line, so later lines cannot displace it. */
-static void autoindex_skip_capture_log(const char *line) {
-    if (line && strstr(line, "msg=autoindex.skip") && strstr(line, "reason=too_many_files")) {
+/* Keeps only the too_many_files skip line, so later lines cannot displace it,
+ * and records whether an admitted auto-index actually ran to completion. */
+static void autoindex_limit_capture_log(const char *line) {
+    if (!line) {
+        return;
+    }
+    if (strstr(line, "msg=autoindex.skip") && strstr(line, "reason=too_many_files")) {
         snprintf(autoindex_skip_log, sizeof(autoindex_skip_log), "%s", line);
     }
+    if (strstr(line, "msg=autoindex.done")) {
+        autoindex_saw_done = true;
+    }
 }
 
-/* Drive initialize → maybe_auto_index over a fresh project holding more tracked
- * files than auto_index_limit, and capture the resulting skip warning.
+typedef struct {
+    int files;     /* indexable .py files written into the root */
+    int limit;     /* auto_index_limit */
+    bool git_root; /* emulate a checkout via <root>/.git/HEAD (no git binary) */
+} autoindex_limit_probe_t;
+
+static bool autoindex_limit_write_fixture(const char *repodir,
+                                          const autoindex_limit_probe_t *probe) {
+    if (th_mkdir_p(repodir) != 0) {
+        return false;
+    }
+    for (int i = 0; i < probe->files; i++) {
+        char path[640];
+        char body[96];
+        snprintf(path, sizeof(path), "%s/f%d.py", repodir, i);
+        snprintf(body, sizeof(body), "def f%d():\n    return %d\n", i, i);
+        if (th_write_file(path, body) != 0) {
+            return false;
+        }
+    }
+    if (probe->git_root) {
+        char gitdir[640];
+        char head[700];
+        snprintf(gitdir, sizeof(gitdir), "%s/.git", repodir);
+        snprintf(head, sizeof(head), "%s/HEAD", gitdir);
+        if (th_mkdir_p(gitdir) != 0 || th_write_file(head, "ref: refs/heads/main\n") != 0) {
+            return false;
+        }
+    }
+    return true;
+}
+
+/* Drive initialize → maybe_auto_index over a fresh root holding probe->files
+ * indexable files under auto_index_limit=probe->limit. skip_out receives the
+ * too_many_files warning (empty when admitted); *done_out reports whether an
+ * admitted auto-index ran to completion (the server free joins the thread).
  * Returns false on fixture setup failure. */
-static bool autoindex_skip_warning(char *out, size_t out_size) {
+static bool autoindex_limit_probe(const autoindex_limit_probe_t *probe, char *skip_out,
+                                  size_t skip_size, bool *done_out) {
     char cache[256];
     snprintf(cache, sizeof(cache), "%s/cbm-autoindex-limit-XXXXXX", cbm_tmpdir());
     if (!cbm_mkdtemp(cache)) {
@@ -19123,12 +19353,7 @@ static bool autoindex_skip_warning(char *out, size_t out_size) {
 
     char repodir[512];
     snprintf(repodir, sizeof(repodir), "%s/repo", cache);
-    char file_a[640];
-    char file_b[640];
-    snprintf(file_a, sizeof(file_a), "%s/a.py", repodir);
-    snprintf(file_b, sizeof(file_b), "%s/b.py", repodir);
-    if (th_mkdir_p(repodir) != 0 || th_write_file(file_a, "def a():\n    return 1\n") != 0 ||
-        th_write_file(file_b, "def b():\n    return 2\n") != 0) {
+    if (!autoindex_limit_write_fixture(repodir, probe)) {
         th_rmtree(cache);
         return false;
     }
@@ -19148,27 +19373,31 @@ static bool autoindex_skip_warning(char *out, size_t out_size) {
     bool ok = false;
     cbm_config_t *cfg = cbm_config_open(cache);
     if (cfg) {
+        char limit[32];
+        snprintf(limit, sizeof(limit), "%d", probe->limit);
         cbm_config_set(cfg, CBM_CONFIG_AUTO_INDEX, "true");
-        cbm_config_set(cfg, CBM_CONFIG_AUTO_INDEX_LIMIT, "1");
+        cbm_config_set(cfg, CBM_CONFIG_AUTO_INDEX_LIMIT, limit);
 
         cbm_mcp_server_t *srv = cbm_mcp_server_new(NULL);
         if (srv) {
             autoindex_skip_log[0] = '\0';
+            autoindex_saw_done = false;
             CBMLogLevel prev_level = cbm_log_get_level();
-            cbm_log_set_level(CBM_LOG_WARN);
+            cbm_log_set_level(CBM_LOG_INFO);
             cbm_log_set_format(CBM_LOG_FORMAT_TEXT);
-            cbm_log_set_sink_ex(autoindex_skip_capture_log, CBM_LOG_SINK_REPLACE);
+            cbm_log_set_sink_ex(autoindex_limit_capture_log, CBM_LOG_SINK_REPLACE);
 
             cbm_mcp_server_set_config(srv, cfg);
             char *resp = cbm_mcp_server_handle(
                 srv, "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{}}");
             free(resp);
-            cbm_mcp_server_free(srv);
+            cbm_mcp_server_free(srv); /* joins an admitted autoindex thread */
 
             cbm_log_set_sink(NULL);
             cbm_log_set_level(prev_level);
 
-            snprintf(out, out_size, "%s", autoindex_skip_log);
+            snprintf(skip_out, skip_size, "%s", autoindex_skip_log);
+            *done_out = autoindex_saw_done;
             ok = true;
         }
         cbm_config_close(cfg);
@@ -19184,8 +19413,10 @@ static bool autoindex_skip_warning(char *out, size_t out_size) {
 /* RED before the fix: the warning carries `limit=auto_index_limit`, the config
  * key constant, instead of the configured value. */
 TEST(autoindex_skip_reports_numeric_limit_issue1466) {
+    autoindex_limit_probe_t probe = {.files = 2, .limit = 1, .git_root = false};
     char warning[1024];
-    if (!autoindex_skip_warning(warning, sizeof(warning))) {
+    bool done = false;
+    if (!autoindex_limit_probe(&probe, warning, sizeof(warning), &done)) {
         PASS(); /* fixture setup failed (tmpdir/cwd unavailable) — skip */
     }
     /* Not vacuous: the skip path must actually have been taken. */
@@ -19194,6 +19425,58 @@ TEST(autoindex_skip_reports_numeric_limit_issue1466) {
     ASSERT_NOT_NULL(strstr(warning, "files=2"));
     ASSERT_NOT_NULL(strstr(warning, "limit=1"));
     ASSERT_NULL(strstr(warning, "limit=auto_index_limit"));
+    ASSERT_FALSE(done);
+    PASS();
+}
+
+/* #713 at the reporter's shape scaled down (60 files vs limit 50, from
+ * 60k vs 50k): a PLAIN directory over the limit is refused, and the line
+ * names the limit and the root. RED on the `git ls-files` guard (count 0 →
+ * admitted → indexed) and RED while the line does not name the root. */
+TEST(autoindex_limit_guards_non_git_root_issue713) {
+    autoindex_limit_probe_t probe = {.files = 60, .limit = 50, .git_root = false};
+    char warning[1024];
+    bool done = false;
+    if (!autoindex_limit_probe(&probe, warning, sizeof(warning), &done)) {
+        PASS(); /* fixture setup failed (tmpdir/cwd unavailable) — skip */
+    }
+    ASSERT_NOT_NULL(strstr(warning, "msg=autoindex.skip"));
+    ASSERT_NOT_NULL(strstr(warning, "reason=too_many_files"));
+    ASSERT_NOT_NULL(strstr(warning, "limit=50"));
+    const char *root = strstr(warning, "root=");
+    ASSERT_NOT_NULL(root);
+    ASSERT_NOT_NULL(strstr(root, "/repo"));
+    ASSERT_FALSE(done);
+    PASS();
+}
+
+/* The same plain directory one file UNDER the limit is admitted and indexed:
+ * the guard bounds, it does not fail closed on every non-git root. */
+TEST(autoindex_limit_admits_non_git_root_under_limit_issue713) {
+    autoindex_limit_probe_t probe = {.files = 49, .limit = 50, .git_root = false};
+    char warning[1024];
+    bool done = false;
+    if (!autoindex_limit_probe(&probe, warning, sizeof(warning), &done)) {
+        PASS(); /* fixture setup failed (tmpdir/cwd unavailable) — skip */
+    }
+    ASSERT(warning[0] == '\0');
+    ASSERT_TRUE(done);
+    PASS();
+}
+
+/* A checkout keeps its behaviour: one bounded count for both root kinds. */
+TEST(autoindex_limit_guards_git_root_issue713) {
+    autoindex_limit_probe_t probe = {.files = 60, .limit = 50, .git_root = true};
+    char warning[1024];
+    bool done = false;
+    if (!autoindex_limit_probe(&probe, warning, sizeof(warning), &done)) {
+        PASS(); /* fixture setup failed (tmpdir/cwd unavailable) — skip */
+    }
+    ASSERT_NOT_NULL(strstr(warning, "msg=autoindex.skip"));
+    ASSERT_NOT_NULL(strstr(warning, "reason=too_many_files"));
+    ASSERT_NOT_NULL(strstr(warning, "limit=50"));
+    ASSERT_NOT_NULL(strstr(warning, "root="));
+    ASSERT_FALSE(done);
     PASS();
 }
 
@@ -20253,6 +20536,8 @@ SUITE(mcp) {
     RUN_TEST(tool_output_byte_budgets);
     RUN_TEST(tool_search_graph_query_honors_file_pattern_issue552);
     RUN_TEST(tool_search_graph_bm25_reports_candidate_saturation);
+    RUN_TEST(tool_search_graph_bm25_applies_label_filter);
+    RUN_TEST(tool_search_graph_bm25_ranks_exact_name_first);
     RUN_TEST(tool_search_graph_rejects_bm25_and_semantic_query_together);
     RUN_TEST(tool_search_graph_semantic_ceiling_never_emits_unusable_continuation);
     RUN_TEST(tool_search_graph_semantic_pagination_is_lossless_and_independent);
@@ -20276,6 +20561,7 @@ SUITE(mcp) {
     RUN_TEST(tool_check_index_coverage_preserves_multiple_scope_labels);
     RUN_TEST(tool_check_index_coverage_accepts_truncated_ignored_catalog_for_fresh_path_issue1613);
     RUN_TEST(tool_check_index_coverage_rejects_stale_generation);
+    RUN_TEST(tool_check_index_coverage_freshness_uses_indexer_mtime_source_issue1714);
     RUN_TEST(tool_check_index_coverage_requires_source_when_file_metadata_changed);
     RUN_TEST(tool_check_index_coverage_surfaces_lookup_errors);
     RUN_TEST(tool_index_status_includes_git_metadata);
@@ -20477,6 +20763,9 @@ SUITE(mcp) {
     RUN_TEST(mcp_auto_watch_false_skips_watcher_on_connect);
     RUN_TEST(mcp_auto_watch_false_skips_supervised_autoindex_issue853);
     RUN_TEST(autoindex_skip_reports_numeric_limit_issue1466);
+    RUN_TEST(autoindex_limit_guards_non_git_root_issue713);
+    RUN_TEST(autoindex_limit_admits_non_git_root_under_limit_issue713);
+    RUN_TEST(autoindex_limit_guards_git_root_issue713);
 }
 
 /* Kept separate so daemon-coordination regressions can be iterated without
diff --git a/tests/test_mem.c b/tests/test_mem.c
index 7db92b735..11b3e2c2c 100644
--- a/tests/test_mem.c
+++ b/tests/test_mem.c
@@ -6,6 +6,8 @@
 #include "test_framework.h"
 #include "test_helpers.h"
 #include "../src/foundation/mem.h"
+#include "../src/foundation/platform.h" /* cbm_system_info, cbm_system_available_ram */
+#include "../src/foundation/mem_core.h"
 #include "../src/foundation/arena.h"
 #include "../src/foundation/slab_alloc.h"
 #include "../src/foundation/compat_thread.h"
@@ -476,6 +478,33 @@ TEST(resolve_budget_no_override_uses_fraction) {
     PASS();
 }
 
+/* A budget derived from TOTAL ram plans to use memory that may already belong
+ * to another process. Measured 2026-09-18 on a 48 GB host: the 24 GB default
+ * was sized while a 12 GiB VM ran, the kernel index took its full 24.5 GB, and
+ * the machine ran out — the same run completed once the VM was stopped. */
+TEST(clamp_to_available_leaves_headroom_for_the_rest_of_the_machine) {
+    size_t budget = 24576 * CBM_TEST_MB; /* 24 GB, the 50%-of-48 GB default */
+
+    /* Plenty free: the fraction-derived budget stands. */
+    ASSERT_EQ(cbm_mem_clamp_to_available(budget, 40960 * CBM_TEST_MB), budget);
+
+    /* Only 8 GB free: headroom is a quarter of it, so the budget becomes 6 GB
+     * instead of planning to use three times what the machine has. */
+    ASSERT_EQ(cbm_mem_clamp_to_available(budget, 8192 * CBM_TEST_MB), 6144 * CBM_TEST_MB);
+
+    /* Headroom is capped so a big machine does not behave like a small one:
+     * 64 GB free reserves 8 GB, not 16 GB, and 24 GB still fits under that. */
+    ASSERT_EQ(cbm_mem_clamp_to_available(budget, 65536 * CBM_TEST_MB), budget);
+
+    /* Nearly nothing free: clamped to the floor rather than to zero — refusing
+     * to index at all is worse than trying and spilling. */
+    ASSERT_EQ(cbm_mem_clamp_to_available(budget, 256 * CBM_TEST_MB), 512 * CBM_TEST_MB);
+
+    /* The platform could not answer: the ceiling stands, no guessing. */
+    ASSERT_EQ(cbm_mem_clamp_to_available(budget, 0), budget);
+    PASS();
+}
+
 TEST(resolve_budget_invalid_fraction_defaults) {
     /* Out-of-range fractions fall back to the 0.5 default. */
     size_t total = 8192 * CBM_TEST_MB;
@@ -1336,6 +1365,362 @@ TEST(extract_traversal_stacks_come_from_ctx_scratch_issue2010) {
     PASS();
 }
 
+static TSTree *parse_for_test(TSParser *parser, CBMLanguage lang, const char *src) {
+    ts_parser_set_language(parser, cbm_ts_language(lang));
+    return ts_parser_parse_string(parser, NULL, src, (uint32_t)strlen(src));
+}
+
+/* The field-id cache behind ts_node_child_by_field_name (cbm.h) must answer
+ * exactly what tree-sitter answers, for every node and name -- including names
+ * that are not fields, a name handed in through a REUSED buffer, and the same
+ * name in another grammar. The real function is reached with parentheses, which
+ * suppress the macro. */
+TEST(field_id_cache_answers_exactly_what_tree_sitter_answers) {
+    static const char *const names[] = {"name",   "body",     "type",  "parameters",
+                                        "result", "receiver", "value", "not_a_field"};
+    const char *go_src = "package p\n"
+                         "type T struct { A int }\n"
+                         "func (t *T) Area(x int) (int, error) { return x, nil }\n"
+                         "func F() { var v = T{}; _ = v }\n";
+    TSParser *parser = ts_parser_new();
+    ASSERT_NOT_NULL(parser);
+    TSTree *tree = parse_for_test(parser, CBM_LANG_GO, go_src);
+    ASSERT_NOT_NULL(tree);
+
+    int compared = 0;
+    TSTreeCursor walk = ts_tree_cursor_new(ts_tree_root_node(tree));
+    bool more = true;
+    while (more) {
+        TSNode node = ts_tree_cursor_current_node(&walk);
+        for (size_t n = 0; n < sizeof(names) / sizeof(names[0]); n++) {
+            uint32_t len = (uint32_t)strlen(names[n]);
+            TSNode cached = cbm_ts_child_by_field_name(node, names[n], len);
+            TSNode real = (ts_node_child_by_field_name)(node, names[n], len);
+            ASSERT_TRUE(ts_node_eq(cached, real));
+            compared++;
+        }
+        if (ts_tree_cursor_goto_first_child(&walk)) {
+            continue;
+        }
+        while (!ts_tree_cursor_goto_next_sibling(&walk)) {
+            if (!ts_tree_cursor_goto_parent(&walk)) {
+                more = false;
+                break;
+            }
+        }
+    }
+    ts_tree_cursor_delete(&walk);
+    ASSERT_GT(compared, 100);
+
+    /* A reused buffer: same pointer, different name. */
+    TSNode root = ts_tree_root_node(tree);
+    TSNode method = ts_node_named_child(root, 2);
+    char buf[16];
+    memcpy(buf, "name", 5);
+    TSNode by_name = cbm_ts_child_by_field_name(method, buf, 4);
+    memcpy(buf, "body", 5);
+    TSNode by_body = cbm_ts_child_by_field_name(method, buf, 4);
+    ASSERT_TRUE(ts_node_eq(by_body, (ts_node_child_by_field_name)(method, "body", 4)));
+    ASSERT_FALSE(ts_node_eq(by_name, by_body));
+
+    /* The same name in another grammar resolves against that grammar. */
+    TSTree *ts_tree = parse_for_test(parser, CBM_LANG_TYPESCRIPT, "function g(a) { return a; }\n");
+    ASSERT_NOT_NULL(ts_tree);
+    TSNode fn = ts_node_named_child(ts_tree_root_node(ts_tree), 0);
+    ASSERT_TRUE(ts_node_eq(cbm_ts_child_by_field_name(fn, "name", 4),
+                           (ts_node_child_by_field_name)(fn, "name", 4)));
+    ASSERT_FALSE(ts_node_is_null(cbm_ts_child_by_field_name(fn, "name", 4)));
+
+    ts_tree_delete(ts_tree);
+    ts_tree_delete(tree);
+    ts_parser_delete(parser);
+    PASS();
+}
+
+/* Recursive walkers take one pooled cursor per depth (cbm_cursor_acquire). A
+ * depth whose slot is still held -- another walker nested on this thread --
+ * must get a private cursor, never the busy one; and a pooled cursor walks the
+ * children exactly like a fresh one. */
+TEST(cursor_pool_hands_each_depth_its_own_cursor) {
+    TSParser *parser = ts_parser_new();
+    ASSERT_NOT_NULL(parser);
+    TSTree *tree =
+        parse_for_test(parser, CBM_LANG_GO, "package p\nfunc A() {}\nfunc B() {}\nvar C = 1\n");
+    ASSERT_NOT_NULL(tree);
+    TSNode root = ts_tree_root_node(tree);
+
+    cbm_cursor_lease_t d0;
+    cbm_cursor_lease_t d1;
+    cbm_cursor_lease_t nested;
+    TSTreeCursor *c0 = cbm_cursor_acquire(&d0, 0, root);
+    TSTreeCursor *c1 = cbm_cursor_acquire(&d1, 1, ts_node_named_child(root, 0));
+    TSTreeCursor *cn = cbm_cursor_acquire(&nested, 0, root); /* depth 0 is busy */
+    ASSERT_TRUE(d0.slot == 0);
+    ASSERT_TRUE(d1.slot == 1);
+    ASSERT_TRUE(nested.slot == -1);
+    ASSERT_TRUE(c0 != c1 && cn != c0 && cn != c1);
+
+    /* The pooled cursor walks the same children as a fresh one. */
+    TSTreeCursor fresh = ts_tree_cursor_new(root);
+    bool pooled_ok = ts_tree_cursor_goto_first_child(c0);
+    bool fresh_ok = ts_tree_cursor_goto_first_child(&fresh);
+    int siblings = 0;
+    while (pooled_ok && fresh_ok) {
+        ASSERT_TRUE(
+            ts_node_eq(ts_tree_cursor_current_node(c0), ts_tree_cursor_current_node(&fresh)));
+        siblings++;
+        pooled_ok = ts_tree_cursor_goto_next_sibling(c0);
+        fresh_ok = ts_tree_cursor_goto_next_sibling(&fresh);
+    }
+    ASSERT_FALSE(pooled_ok || fresh_ok);
+    ASSERT_GT(siblings, 2);
+    ts_tree_cursor_delete(&fresh);
+
+    cbm_cursor_release(&nested);
+    cbm_cursor_release(&d1);
+    cbm_cursor_release(&d0);
+    /* Released: the same depth hands out its pooled cursor again. */
+    cbm_cursor_lease_t again;
+    ASSERT_TRUE(cbm_cursor_acquire(&again, 0, root) == c0);
+    cbm_cursor_release(&again);
+
+    cbm_destroy_thread_parser(); /* releases the pool */
+    ts_tree_delete(tree);
+    ts_parser_delete(parser);
+    PASS();
+}
+
+/* ── mem_core: the central allocation route ────────────────────────────
+ *
+ * Every assertion below is a DELTA, never an absolute. Other code in this
+ * process may allocate through the core concurrently, so a test that pinned an
+ * absolute total would be measuring the rest of the suite. */
+
+TEST(mem_core_accounts_alloc_and_free) {
+    size_t before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_NODE);
+    size_t blocks_before = cbm_mem_class_live_blocks(CBM_MEM_CLASS_GBUF_NODE);
+
+    void *p = cbm_alloc(CBM_MEM_CLASS_GBUF_NODE, 4096);
+    ASSERT_TRUE(p != NULL);
+    size_t during = cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_NODE);
+    /* Charged at least what was asked for; usable size may round UP, never
+     * down, so a strict >= is the honest assertion. */
+    ASSERT_TRUE(during >= before + 4096);
+    ASSERT_EQ((int)(cbm_mem_class_live_blocks(CBM_MEM_CLASS_GBUF_NODE) - blocks_before), 1);
+
+    cbm_free(CBM_MEM_CLASS_GBUF_NODE, p);
+    ASSERT_EQ((int)(cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_NODE) - before), 0);
+    ASSERT_EQ((int)(cbm_mem_class_live_blocks(CBM_MEM_CLASS_GBUF_NODE) - blocks_before), 0);
+    PASS();
+}
+
+/* The whole point of classes: attribution. If a gbuf allocation could show up
+ * under semantic, the table could not choose between "park workers" and
+ * "stream the vectors" -- the decision this core exists to inform. */
+TEST(mem_core_classes_do_not_bleed) {
+    size_t node_before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_NODE);
+    size_t sem_before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_SEMANTIC);
+
+    void *p = cbm_alloc(CBM_MEM_CLASS_SEMANTIC, 8192);
+    ASSERT_TRUE(p != NULL);
+    ASSERT_EQ((int)(cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_NODE) - node_before), 0);
+    ASSERT_TRUE(cbm_mem_class_live_bytes(CBM_MEM_CLASS_SEMANTIC) >= sem_before + 8192);
+    cbm_free(CBM_MEM_CLASS_SEMANTIC, p);
+    PASS();
+}
+
+TEST(mem_core_realloc_replaces_the_old_charge) {
+    size_t before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_DUMP);
+    void *p = cbm_alloc(CBM_MEM_CLASS_DUMP, 1024);
+    ASSERT_TRUE(p != NULL);
+    p = cbm_realloc(CBM_MEM_CLASS_DUMP, p, 65536);
+    ASSERT_TRUE(p != NULL);
+    size_t grown = cbm_mem_class_live_bytes(CBM_MEM_CLASS_DUMP);
+    /* The old 1024 must be gone, not stacked on top: exactly one block is live,
+     * so the delta is bounded by the new size plus rounding, not by the sum. */
+    ASSERT_TRUE(grown >= before + 65536);
+    ASSERT_TRUE(grown < before + 65536 + 65536);
+    cbm_free(CBM_MEM_CLASS_DUMP, p);
+    ASSERT_EQ((int)(cbm_mem_class_live_bytes(CBM_MEM_CLASS_DUMP) - before), 0);
+    PASS();
+}
+
+/* realloc(NULL) is alloc, and free(NULL) is a no-op: the core must match the C
+ * library exactly or adoption stops being a mechanical rename. */
+TEST(mem_core_matches_libc_null_semantics) {
+    size_t before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_STORE);
+    cbm_free(CBM_MEM_CLASS_STORE, NULL);
+    ASSERT_EQ((int)(cbm_mem_class_live_bytes(CBM_MEM_CLASS_STORE) - before), 0);
+
+    void *p = cbm_realloc(CBM_MEM_CLASS_STORE, NULL, 2048);
+    ASSERT_TRUE(p != NULL);
+    ASSERT_TRUE(cbm_mem_class_live_bytes(CBM_MEM_CLASS_STORE) >= before + 2048);
+    cbm_free(CBM_MEM_CLASS_STORE, p);
+
+    /* A zero-size request still yields a freeable pointer. */
+    void *z = cbm_alloc(CBM_MEM_CLASS_STORE, 0);
+    ASSERT_TRUE(z != NULL);
+    cbm_free(CBM_MEM_CLASS_STORE, z);
+    ASSERT_EQ((int)(cbm_mem_class_live_bytes(CBM_MEM_CLASS_STORE) - before), 0);
+    PASS();
+}
+
+TEST(mem_core_strdup_copies_and_accounts) {
+    size_t before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_STRING);
+    ASSERT_TRUE(cbm_mem_strdup(CBM_MEM_CLASS_GBUF_STRING, NULL) == NULL);
+
+    const char *src = "qualified::name::example";
+    char *copy = cbm_mem_strdup(CBM_MEM_CLASS_GBUF_STRING, src);
+    ASSERT_TRUE(copy != NULL);
+    ASSERT_TRUE(strcmp(copy, src) == 0);
+    ASSERT_TRUE(copy != src);
+    ASSERT_TRUE(cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_STRING) > before);
+    cbm_free(CBM_MEM_CLASS_GBUF_STRING, copy);
+    ASSERT_EQ((int)(cbm_mem_class_live_bytes(CBM_MEM_CLASS_GBUF_STRING) - before), 0);
+    PASS();
+}
+
+/* A budget decision is about the PEAK, not about whatever was live when
+ * someone looked. Peak must survive the free that follows it. */
+TEST(mem_core_peak_survives_the_free) {
+    cbm_mem_class_reset_peaks();
+    size_t base = cbm_mem_class_peak_bytes(CBM_MEM_CLASS_EXTRACT);
+    void *p = cbm_alloc(CBM_MEM_CLASS_EXTRACT, 32768);
+    ASSERT_TRUE(p != NULL);
+    size_t peak_live = cbm_mem_class_peak_bytes(CBM_MEM_CLASS_EXTRACT);
+    ASSERT_TRUE(peak_live >= base + 32768);
+    cbm_free(CBM_MEM_CLASS_EXTRACT, p);
+    ASSERT_EQ((int)(cbm_mem_class_peak_bytes(CBM_MEM_CLASS_EXTRACT) - peak_live), 0);
+    PASS();
+}
+
+/* Arena-backed memory reports in bulk rather than per object: the extraction
+ * engine has 1301 arena call sites and rewriting them to per-object cbm_alloc
+ * would undo the batching that keeps its allocation count low. */
+TEST(mem_core_external_bulk_accounting_is_symmetric) {
+    size_t before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_EXTRACT);
+    cbm_mem_class_add_external(CBM_MEM_CLASS_EXTRACT, 1024 * 1024);
+    ASSERT_EQ((int)(cbm_mem_class_live_bytes(CBM_MEM_CLASS_EXTRACT) - before), 1024 * 1024);
+    cbm_mem_class_remove_external(CBM_MEM_CLASS_EXTRACT, 1024 * 1024);
+    ASSERT_EQ((int)(cbm_mem_class_live_bytes(CBM_MEM_CLASS_EXTRACT) - before), 0);
+    PASS();
+}
+
+/* The one mistake a caller can actually make is freeing with the wrong class.
+ * That must never underflow the counter: an unsigned wrap would turn a small
+ * drift into a colossal bogus total that reads as a catastrophic leak and
+ * sends someone hunting a phantom. Clamp at zero instead. */
+TEST(mem_core_mismatched_class_never_wraps) {
+    void *p = cbm_alloc(CBM_MEM_CLASS_GBUF_EDGE, 4096);
+    ASSERT_TRUE(p != NULL);
+    /* Free against a class that was never charged for it. */
+    size_t other_before = cbm_mem_class_live_bytes(CBM_MEM_CLASS_DUMP);
+    cbm_free(CBM_MEM_CLASS_DUMP, p);
+    size_t other_after = cbm_mem_class_live_bytes(CBM_MEM_CLASS_DUMP);
+    ASSERT_TRUE(other_after <= other_before); /* clamped, never wrapped */
+    ASSERT_TRUE(other_after < (size_t)-1 / 2);
+    PASS();
+}
+
+TEST(mem_core_report_json_is_wellformed_or_empty) {
+    void *p = cbm_alloc(CBM_MEM_CLASS_GBUF_INDEX, 4096);
+    ASSERT_TRUE(p != NULL);
+    char buf[CBM_SZ_1K];
+    int n = cbm_mem_class_report_json(buf, sizeof(buf));
+    ASSERT_TRUE(n > 0);
+    ASSERT_TRUE(buf[0] == '[');
+    ASSERT_TRUE(buf[n - 1] == ']');
+    ASSERT_TRUE(strstr(buf, "gbuf_index") != NULL);
+    /* A buffer too small must yield NOTHING, never a truncated array that a
+     * JSON reader would reject or, worse, silently mis-parse. */
+    char tiny[8];
+    ASSERT_EQ(cbm_mem_class_report_json(tiny, sizeof(tiny)), 0);
+    cbm_free(CBM_MEM_CLASS_GBUF_INDEX, p);
+    PASS();
+}
+
+/* ── Pressure primitives and the charged reading ─────────────────────── */
+
+TEST(mem_charged_is_positive_and_consistent_with_rss) {
+    size_t charged = cbm_mem_charged();
+    size_t rss = cbm_mem_rss();
+    ASSERT(charged > 0);
+    ASSERT(rss > 0);
+    /* Same order of magnitude as RSS on every platform: the charged value
+     * may sit below RSS (purged-but-resident pages) or slightly above it
+     * (compressed pages), never at zero or at a multiple. */
+    ASSERT(charged < rss * 4);
+    ASSERT(rss < charged * 4 + (size_t)64 * 1024 * 1024);
+    PASS();
+}
+
+/* The charged high-water mark never reads below a charge just taken, and a
+ * later, larger charge lifts it: it is a max over every reading. */
+TEST(mem_peak_charged_is_the_high_water_of_charged) {
+    size_t charged = cbm_mem_charged();
+    ASSERT_TRUE(charged > 0);
+    ASSERT_TRUE(cbm_mem_peak_charged() >= charged);
+    size_t peak_before = cbm_mem_peak_charged();
+    (void)cbm_mem_charged();
+    ASSERT_TRUE(cbm_mem_peak_charged() >= peak_before);
+    PASS();
+}
+
+TEST(mem_footprint_zero_or_plausible) {
+    size_t fp = cbm_mem_footprint();
+    if (fp > 0) {
+        ASSERT(fp >= (size_t)1024 * 1024); /* a live test process is more than 1 MB */
+    }
+    PASS();
+}
+
+TEST(mem_system_available_ram_is_within_total) {
+    size_t avail = cbm_system_available_ram();
+    cbm_system_info_t info = cbm_system_info();
+    if (avail == 0 || info.total_ram == 0) {
+        PASS(); /* platform cannot answer; the caller treats that as unknown */
+    }
+    ASSERT(avail <= info.total_ram);
+    PASS();
+}
+
+TEST(mem_system_under_pressure_is_a_pure_threshold) {
+    size_t avail = cbm_system_available_ram();
+    cbm_system_info_t info = cbm_system_info();
+    bool under = cbm_mem_system_under_pressure();
+    if (avail == 0 || info.total_ram == 0) {
+        ASSERT_FALSE(under); /* never abort on a guess */
+        PASS();
+    }
+    ASSERT_EQ(under, avail < info.total_ram / 8);
+    PASS();
+}
+
+TEST(mem_over_budget_follows_the_charged_reading) {
+    size_t saved = cbm_mem_budget();
+    size_t charged = cbm_mem_charged();
+    ASSERT(charged > 0);
+    cbm_mem_set_budget_for_tests(charged * 4);
+    ASSERT_FALSE(cbm_mem_over_budget());
+    cbm_mem_set_budget_for_tests(charged / 4 + 1);
+    ASSERT_TRUE(cbm_mem_over_budget());
+    cbm_mem_set_budget_for_tests(saved);
+    PASS();
+}
+
+TEST(mem_core_class_names_are_total) {
+    ASSERT_TRUE(strcmp(cbm_mem_class_name(CBM_MEM_CLASS_SEMANTIC), "semantic") == 0);
+    ASSERT_TRUE(strcmp(cbm_mem_class_name(CBM_MEM_CLASS_ARENA), "arena") == 0);
+    ASSERT_TRUE(strcmp(cbm_mem_class_name(CBM_MEM_CLASS_TS_TREE), "ts_tree") == 0);
+    ASSERT_TRUE(strcmp(cbm_mem_class_name(CBM_MEM_CLASS_STORE), "store") == 0);
+    ASSERT_TRUE(strcmp(cbm_mem_class_name(CBM_MEM_CLASS_HASH_TABLE), "hash_table") == 0);
+    ASSERT_TRUE(strcmp(cbm_mem_class_name(CBM_MEM_CLASS_DYN_ARRAY), "dyn_array") == 0);
+    /* Out of range must still answer, so a log line never takes a NULL. */
+    ASSERT_TRUE(cbm_mem_class_name((cbm_mem_class_t)(CBM_MEM_CLASS_COUNT + 5)) != NULL);
+    ASSERT_TRUE(cbm_mem_class_name((cbm_mem_class_t)-1) != NULL);
+    PASS();
+}
+
 SUITE(mem) {
     /* mem API */
     RUN_TEST(mem_arena_eager_commit_follows_platform_commit_cost);
@@ -1370,6 +1755,7 @@ SUITE(mem) {
     RUN_TEST(mem_init_second_call_noop);
     /* CBM_MEM_BUDGET_MB budget override */
     RUN_TEST(resolve_budget_no_override_uses_fraction);
+    RUN_TEST(clamp_to_available_leaves_headroom_for_the_rest_of_the_machine);
     RUN_TEST(resolve_budget_invalid_fraction_defaults);
     RUN_TEST(resolve_budget_override_wins);
     RUN_TEST(resolve_budget_override_clamped_to_total);
@@ -1402,4 +1788,22 @@ SUITE(mem) {
 
     /* extraction scratch arena (#2010) */
     RUN_TEST(extract_traversal_stacks_come_from_ctx_scratch_issue2010);
+    RUN_TEST(field_id_cache_answers_exactly_what_tree_sitter_answers);
+    RUN_TEST(cursor_pool_hands_each_depth_its_own_cursor);
+    RUN_TEST(mem_core_accounts_alloc_and_free);
+    RUN_TEST(mem_core_classes_do_not_bleed);
+    RUN_TEST(mem_core_realloc_replaces_the_old_charge);
+    RUN_TEST(mem_core_matches_libc_null_semantics);
+    RUN_TEST(mem_core_strdup_copies_and_accounts);
+    RUN_TEST(mem_core_peak_survives_the_free);
+    RUN_TEST(mem_core_external_bulk_accounting_is_symmetric);
+    RUN_TEST(mem_core_mismatched_class_never_wraps);
+    RUN_TEST(mem_core_report_json_is_wellformed_or_empty);
+    RUN_TEST(mem_core_class_names_are_total);
+    RUN_TEST(mem_charged_is_positive_and_consistent_with_rss);
+    RUN_TEST(mem_peak_charged_is_the_high_water_of_charged);
+    RUN_TEST(mem_footprint_zero_or_plausible);
+    RUN_TEST(mem_system_available_ram_is_within_total);
+    RUN_TEST(mem_system_under_pressure_is_a_pure_threshold);
+    RUN_TEST(mem_over_budget_follows_the_charged_reading);
 }
diff --git a/tests/test_mem_events.c b/tests/test_mem_events.c
new file mode 100644
index 000000000..d49e91db5
--- /dev/null
+++ b/tests/test_mem_events.c
@@ -0,0 +1,512 @@
+/*
+ * test_mem_events.c — the allocation-event layer of the waste sanitizer.
+ *
+ * The layer never dereferences a block, so these tests feed it synthetic
+ * addresses: every assertion is about ACCOUNTING, and the verdicts are pure
+ * functions of the event sequence (O9) — no allocator, no clock, no timing.
+ */
+#include "test_framework.h"
+#include "../src/foundation/compat.h"
+#include "../src/foundation/compat_fs.h"
+#include "../src/foundation/compat_thread.h"
+#include "../src/foundation/mem_events.h"
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#ifndef _WIN32
+#include <unistd.h>
+#else
+#include <process.h>
+#define getpid _getpid
+#endif
+
+#define BLK(n) ((void *)(uintptr_t)(0x100000u + ((uintptr_t)(n) << 4)))
+#define SITE_A ((void *)(uintptr_t)0xA000)
+#define SITE_B ((void *)(uintptr_t)0xB000)
+#define SITE_C ((void *)(uintptr_t)0xC000)
+
+static void fresh(void) {
+    cbm_memev_force_for_tests(true);
+    cbm_memev_reset_for_tests();
+}
+
+static bool site_row(void *site, cbm_memev_site_t *out) {
+    static cbm_memev_site_t rows[64];
+    size_t n = cbm_memev_sites(rows, 64);
+    for (size_t i = 0; i < n; i++) {
+        if (rows[i].site == (uintptr_t)site) {
+            *out = rows[i];
+            return true;
+        }
+    }
+    return false;
+}
+
+/* Requested vs usable is the allocator's slack, and it belongs to the site
+ * that asked: 3 x (100 requested, 112 handed out) = 36 bytes nobody can use. */
+TEST(memev_slack_is_charged_to_the_asking_site) {
+    fresh();
+    for (int i = 0; i < 3; i++) {
+        cbm_memev_alloc(BLK(i), 100, 112, SITE_A);
+    }
+    cbm_memev_alloc(BLK(9), 64, 64, SITE_B);
+    cbm_memev_site_t a;
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_EQ(a.allocs, 3);
+    ASSERT_EQ(a.requested_bytes, 300);
+    ASSERT_EQ(a.usable_bytes, 336);
+    ASSERT_EQ(a.live_bytes, 336);
+    ASSERT_EQ(a.live_blocks, 3);
+    cbm_memev_free(BLK(1));
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_EQ(a.frees, 1);
+    ASSERT_EQ(a.live_bytes, 224);
+    ASSERT_EQ(a.live_blocks, 2);
+    cbm_memev_totals_t t;
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.allocs, 4);
+    ASSERT_EQ(t.sites, 2);
+    ASSERT_EQ(t.live_bytes, 288);
+    ASSERT_EQ(t.untracked_frees, 0);
+    PASS();
+}
+
+/* A block freed by its own thread within a few allocations is churn: an
+ * arena or a stack buffer would have served. One that outlives the window
+ * is not. */
+TEST(memev_short_lived_blocks_are_counted_as_churn) {
+    fresh();
+    for (int i = 0; i < 10; i++) {
+        cbm_memev_alloc(BLK(i), 32, 32, SITE_A);
+        cbm_memev_free(BLK(i));
+    }
+    cbm_memev_alloc(BLK(100), 32, 32, SITE_B); /* lives across the window */
+    for (int i = 0; i < CBM_MEMEV_CHURN_WINDOW + 8; i++) {
+        cbm_memev_alloc(BLK(200 + i), 8, 8, SITE_C);
+    }
+    cbm_memev_free(BLK(100));
+    cbm_memev_site_t a;
+    cbm_memev_site_t b;
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_TRUE(site_row(SITE_B, &b));
+    ASSERT_EQ(a.short_lived, 10);
+    ASSERT_EQ(b.frees, 1);
+    ASSERT_EQ(b.short_lived, 0);
+    PASS();
+}
+
+/* A realloc chain is ONE object growing. The bytes the allocator had to move
+ * are that object's cost, charged to the site that created it — not to the
+ * realloc call. Growth in place moves nothing. */
+TEST(memev_realloc_copy_bytes_go_to_the_original_site) {
+    fresh();
+    cbm_memev_alloc(BLK(1), 64, 64, SITE_A);
+    cbm_memev_realloc(BLK(1), BLK(2), 128, 128, SITE_B); /* moved: 64 bytes copied */
+    cbm_memev_realloc(BLK(2), BLK(2), 200, 256, SITE_B); /* in place: nothing copied */
+    cbm_memev_realloc(BLK(2), BLK(3), 512, 512, SITE_B); /* moved: 256 bytes copied */
+    cbm_memev_site_t a;
+    cbm_memev_site_t b;
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_FALSE(site_row(SITE_B, &b)); /* the realloc call site owns nothing */
+    ASSERT_EQ(a.reallocs, 3);
+    ASSERT_EQ(a.realloc_copy_bytes, 64 + 256);
+    ASSERT_EQ(a.live_blocks, 1);
+    ASSERT_EQ(a.live_bytes, 512);
+    cbm_memev_free(BLK(3));
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_EQ(a.live_bytes, 0);
+    cbm_memev_totals_t t;
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.untracked_frees, 0);
+    PASS();
+}
+
+/* The memory core announces itself before calling its backing allocator. An
+ * observer underneath consumes the hint: one event, the CORE's caller as the
+ * site, the class attached. Without an observer the hint stays pending and the
+ * core emits the event itself. Either way the block is counted once. */
+TEST(memev_hint_gives_one_event_with_the_cores_site_and_class) {
+    fresh();
+    /* observed path: hint, then the observer's event (which passes its own frame) */
+    cbm_memev_hint(SITE_A, 5);
+    ASSERT_TRUE(cbm_memev_hint_pending());
+    cbm_memev_alloc(BLK(1), 40, 48, SITE_C);
+    ASSERT_FALSE(cbm_memev_hint_pending());
+    /* unobserved path: nobody consumed it, the core emits */
+    cbm_memev_hint(SITE_A, 5);
+    if (cbm_memev_hint_pending()) {
+        cbm_memev_alloc(BLK(2), 40, 48, NULL);
+    }
+    /* an allocation that never touched the core */
+    cbm_memev_alloc(BLK(3), 40, 48, SITE_B);
+
+    cbm_memev_site_t a;
+    cbm_memev_site_t b;
+    cbm_memev_site_t c;
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_TRUE(site_row(SITE_B, &b));
+    ASSERT_FALSE(site_row(SITE_C, &c)); /* the observer's frame never becomes a site */
+    ASSERT_EQ(a.allocs, 2);
+    ASSERT_EQ(a.raw_bytes, 0);  /* tagged by the core */
+    ASSERT_EQ(b.raw_bytes, 48); /* the unmigrated surface, as a number */
+    cbm_memev_totals_t t;
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.raw_bytes, 48);
+
+    /* frees carry no handshake: whoever is responsible reports BEFORE the block goes back */
+    cbm_memev_free(BLK(1));
+    cbm_memev_free(BLK(2));
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.frees, 2);
+    ASSERT_EQ(t.untracked_frees, 0);
+    PASS();
+}
+
+/* A free of a block the layer never saw is a NUMBER, not a silent no-op: it
+ * measures how much traffic predates or bypasses the observers. */
+TEST(memev_untracked_free_is_counted_not_dropped) {
+    fresh();
+    cbm_memev_free(BLK(77));
+    cbm_memev_free(NULL);
+    cbm_memev_totals_t t;
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.untracked_frees, 1);
+    ASSERT_EQ(t.frees, 0);
+    PASS();
+}
+
+/* A block another allocator made (the Windows C runtime, a system DLL) is not a
+ * block the layer missed: it is counted apart, so the soundness gate that reads
+ * untracked frees sees only real misses (the Windows daemon's 14 CRT blocks
+ * tripped it, 2026-09-17). */
+TEST(memev_foreign_free_is_counted_apart_from_untracked) {
+    fresh();
+    cbm_memev_free_foreign(BLK(78));
+    cbm_memev_free_foreign(NULL);
+    cbm_memev_totals_t t;
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.foreign_frees, 1);
+    ASSERT_EQ(t.untracked_frees, 0);
+    ASSERT_EQ(t.frees, 0);
+    PASS();
+}
+
+typedef struct {
+    int first;
+    int count;
+    void *site;
+} span_t;
+
+static void *alloc_span(void *arg) {
+    const span_t *s = (const span_t *)arg;
+    for (int i = 0; i < s->count; i++) {
+        cbm_memev_alloc(BLK(s->first + i), 48, 64, s->site);
+    }
+    cbm_memev_flush_thread();
+    return NULL;
+}
+
+static void *free_span(void *arg) {
+    const span_t *s = (const span_t *)arg;
+    for (int i = 0; i < s->count; i++) {
+        cbm_memev_free(BLK(s->first + i));
+    }
+    cbm_memev_flush_thread();
+    return NULL;
+}
+
+enum { MEMEV_T = 4, MEMEV_PER_T = 50000 };
+
+/* Blocks are routinely freed by a thread that did not allocate them, and the
+ * per-site totals are SUMS — so they cannot depend on which thread did what or
+ * in which order the threads ran. 200,000 live blocks also walks every shard
+ * through several growth steps. */
+TEST(memev_cross_thread_frees_balance_and_totals_are_order_independent) {
+    fresh();
+    cbm_thread_t th[MEMEV_T];
+    span_t spans[MEMEV_T];
+    for (int i = 0; i < MEMEV_T; i++) {
+        spans[i] = (span_t){
+            .first = i * MEMEV_PER_T, .count = MEMEV_PER_T, .site = (i % 2) ? SITE_A : SITE_B};
+        ASSERT_EQ(cbm_thread_create(&th[i], 0, alloc_span, &spans[i]), 0);
+    }
+    for (int i = 0; i < MEMEV_T; i++) {
+        cbm_thread_join(&th[i]);
+    }
+    cbm_memev_totals_t t;
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.allocs, (uint64_t)MEMEV_T * MEMEV_PER_T);
+    ASSERT_EQ(t.live_blocks, (uint64_t)MEMEV_T * MEMEV_PER_T);
+    ASSERT_EQ(t.live_bytes, (uint64_t)MEMEV_T * MEMEV_PER_T * 64);
+    ASSERT_EQ(t.pointer_table_full, 0);
+
+    /* every span is freed by a DIFFERENT thread than the one that allocated it */
+    span_t rotated[MEMEV_T];
+    for (int i = 0; i < MEMEV_T; i++) {
+        rotated[i] = spans[(i + 1) % MEMEV_T];
+        ASSERT_EQ(cbm_thread_create(&th[i], 0, free_span, &rotated[i]), 0);
+    }
+    for (int i = 0; i < MEMEV_T; i++) {
+        cbm_thread_join(&th[i]);
+    }
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.frees, (uint64_t)MEMEV_T * MEMEV_PER_T);
+    ASSERT_EQ(t.live_blocks, 0);
+    ASSERT_EQ(t.live_bytes, 0);
+    ASSERT_EQ(t.untracked_frees, 0);
+    cbm_memev_site_t a;
+    cbm_memev_site_t b;
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_TRUE(site_row(SITE_B, &b));
+    ASSERT_EQ(a.allocs, (uint64_t)(MEMEV_T / 2) * MEMEV_PER_T);
+    ASSERT_EQ(b.usable_bytes, (uint64_t)(MEMEV_T / 2) * MEMEV_PER_T * 64);
+    ASSERT_EQ(a.short_lived, 0); /* freed by another thread: never churn */
+    PASS();
+}
+
+/* Dormant means dormant: with the layer off nothing is recorded and a hint
+ * never lingers to mis-attribute a later event. */
+TEST(memev_dormant_layer_records_nothing) {
+    fresh();
+    cbm_memev_force_for_tests(false);
+    cbm_memev_hint(SITE_A, 3);
+    cbm_memev_alloc(BLK(1), 10, 16, SITE_A);
+    ASSERT_FALSE(cbm_memev_hint_pending());
+    cbm_memev_free(BLK(1));
+    cbm_memev_force_for_tests(true);
+    cbm_memev_totals_t t;
+    cbm_memev_totals(&t);
+    ASSERT_EQ(t.allocs, 0);
+    ASSERT_EQ(t.untracked_frees, 0);
+    ASSERT_EQ(t.sites, 0);
+    PASS();
+}
+
+/* The report is JSON lines: one header, then one line per site and one per
+ * work row. Ordering is the report tool's job; the dump only has to be
+ * complete. */
+TEST(memev_dump_writes_header_sites_and_work) {
+    fresh();
+    cbm_memev_alloc(BLK(1), 10, 16, SITE_A);
+    cbm_memev_alloc(BLK(2), 900, 1024, SITE_B);
+    cbm_work_note(CBM_WORK_MEMCPY, SITE_C, 4096, 0, 0);
+    char path[512];
+    snprintf(path, sizeof(path), "%s/cbm_memev_dump_%d.jsonl", cbm_tmpdir(), (int)getpid());
+    (void)remove(path);
+    ASSERT_TRUE(cbm_memev_dump(path, "test"));
+    FILE *f = cbm_fopen(path, "r");
+    ASSERT_NOT_NULL(f);
+    char line[4096];
+    int n = 0;
+    bool header = false;
+    bool site_a = false;
+    bool site_b = false;
+    bool work = false;
+    while (fgets(line, sizeof(line), f)) {
+        if (n++ == 0) {
+            header = strstr(line, "\"memwaste\":2") && strstr(line, "\"why\":\"test\"") &&
+                     strstr(line, "\"allocs\":2");
+        }
+        site_a = site_a || strstr(line, "\"site\":\"0xa000\",\"allocs\":1");
+        site_b = site_b ||
+                 (strstr(line, "\"site\":\"0xb000\"") && strstr(line, "\"usable_bytes\":1024"));
+        work =
+            work || (strstr(line, "\"work\":\"memcpy\"") && strstr(line, "\"site\":\"0xc000\"") &&
+                     strstr(line, "\"bytes\":4096") && strstr(line, "\"peak\":4096"));
+    }
+    fclose(f);
+    (void)remove(path);
+    ASSERT_TRUE(header);
+    ASSERT_TRUE(site_a);
+    ASSERT_TRUE(site_b);
+    ASSERT_TRUE(work);
+    ASSERT_EQ(n, 4);
+    PASS();
+}
+
+static bool work_row(cbm_work_kind_t kind, void *site, cbm_work_row_t *out) {
+    static cbm_work_row_t rows[128];
+    size_t n = cbm_work_rows(rows, 128);
+    for (size_t i = 0; i < n; i++) {
+        if (rows[i].kind == kind && rows[i].site == (uintptr_t)site) {
+            *out = rows[i];
+            return true;
+        }
+    }
+    return false;
+}
+
+/* The fill pattern is how the layer sees memory nobody wrote. A 4 KB block
+ * that got 100 bytes: 3,996 bytes never written, and of the 1,000 requested
+ * 900 lie beyond the last write. A hole in the middle is never-written memory
+ * too, but it is not over-requested: the bytes after it were used. */
+TEST(memev_fill_scan_measures_never_written_and_over_requested) {
+    fresh();
+    cbm_memev_scan_for_tests(true, false);
+    static uint8_t big[4096];
+    static uint8_t holed[128];
+    cbm_memev_alloc(big, 1000, sizeof(big), SITE_A);
+    ASSERT_EQ(big[4095], 0xA5); /* the layer filled it */
+    memset(big, 1, 100);
+    cbm_memev_free(big);
+
+    cbm_memev_alloc(holed, 80, sizeof(holed), SITE_B);
+    memset(holed, 2, 16);      /* [0, 16) written */
+    memset(holed + 64, 3, 16); /* [64, 80) written: [16, 64) is a 48-byte hole */
+    cbm_memev_free(holed);
+
+    cbm_memev_site_t a;
+    cbm_memev_site_t b;
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_TRUE(site_row(SITE_B, &b));
+    ASSERT_EQ(a.scanned_blocks, 1);
+    ASSERT_EQ(a.never_written_bytes, 3996);
+    ASSERT_EQ(a.over_requested_bytes, 900);
+    ASSERT_EQ(b.never_written_bytes, 48 + 48); /* the hole + the unwritten tail */
+    ASSERT_EQ(b.over_requested_bytes, 0);
+    PASS();
+}
+
+/* A calloc'd block is not filled -- its zeros are the contract. Its zero tail
+ * at free is an UPPER bound on untouched memory (a written zero looks the same). */
+TEST(memev_calloc_tail_is_scanned_for_zeros) {
+    fresh();
+    cbm_memev_scan_for_tests(true, false);
+    static uint8_t block[256];
+    memset(block, 0, sizeof(block)); /* what calloc hands out */
+    cbm_memev_alloc_ex(block, 256, sizeof(block), SITE_A, CBM_MEMEV_ZEROED);
+    ASSERT_EQ(block[200], 0); /* never filled */
+    memset(block, 7, 32);
+    cbm_memev_free(block);
+    cbm_memev_site_t a;
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_EQ(a.zero_untouched_bytes, 224);
+    ASSERT_EQ(a.never_written_bytes, 0);
+    PASS();
+}
+
+/* A phase boundary is a snapshot: what each site still holds, and which small
+ * live blocks carry the same bytes as another -- memory an interning table or
+ * a shared constant would have served once. */
+TEST(memev_phase_snapshot_finds_retained_memory_and_duplicates) {
+    fresh();
+    cbm_memev_scan_for_tests(true, true);
+    static uint8_t blocks[4][64];
+    for (int i = 0; i < 3; i++) {
+        cbm_memev_alloc(blocks[i], 16, sizeof(blocks[i]), SITE_A);
+        memcpy(blocks[i], "same bytes here!", 16);
+    }
+    cbm_memev_alloc(blocks[3], 16, sizeof(blocks[3]), SITE_B);
+    memcpy(blocks[3], "different bytes!", 16);
+    cbm_memev_phase("snapshot");
+    cbm_memev_site_t a;
+    cbm_memev_site_t b;
+    ASSERT_TRUE(site_row(SITE_A, &a));
+    ASSERT_TRUE(site_row(SITE_B, &b));
+    ASSERT_EQ(a.retained_bytes, 3 * 64);
+    ASSERT_EQ(a.dup_blocks, 2); /* the first copy is the original */
+    ASSERT_EQ(a.dup_bytes, 2 * 64);
+    ASSERT_EQ(b.retained_bytes, 64);
+    ASSERT_EQ(b.dup_blocks, 0);
+    for (int i = 0; i < 4; i++) {
+        cbm_memev_free(blocks[i]);
+    }
+    PASS();
+}
+
+/* Work rows sum per (kind, site); `peak` keeps the largest single note. For a
+ * container that is the biggest capacity one instance left unused -- the sums
+ * run over USES, the peak is the memory figure. */
+TEST(memev_work_rows_sum_and_keep_the_peak) {
+    fresh();
+    cbm_work_note(CBM_WORK_MEMCPY, SITE_A, 100, 0, 0);
+    cbm_work_note(CBM_WORK_MEMCPY, SITE_A, 5000, 0, 0);
+    cbm_memev_container(CBM_WORK_CT_ARENA, SITE_B, 1000, 100, 2);
+    cbm_memev_container(CBM_WORK_CT_ARENA, SITE_B, 500, 450, 0);
+    cbm_work_row_t w;
+    ASSERT_TRUE(work_row(CBM_WORK_MEMCPY, SITE_A, &w));
+    ASSERT_EQ(w.calls, 2);
+    ASSERT_EQ(w.bytes, 5100);
+    ASSERT_EQ(w.peak, 5000);
+    ASSERT_TRUE(work_row(CBM_WORK_CT_ARENA, SITE_B, &w));
+    ASSERT_EQ(w.calls, 2);
+    ASSERT_EQ(w.bytes, 1500);
+    ASSERT_EQ(w.aux1, 550);
+    ASSERT_EQ(w.aux2, 2);
+    ASSERT_EQ(w.peak, 900);
+    PASS();
+}
+
+/* A repeat is work whose answer could not have changed. strlen of the same
+ * buffer holding a DIFFERENT string of the same length is new work; a lookup
+ * of the same key text repeats even from another buffer, unless the table was
+ * written in between. */
+TEST(memev_repeats_require_unchanged_input) {
+    fresh();
+    char buf[16];
+    memcpy(buf, "alpha", 6);
+    cbm_work_note_strlen(SITE_A, buf, 5);
+    cbm_work_note_strlen(SITE_A, buf, 5); /* repeat */
+    memcpy(buf, "omega", 6);
+    cbm_work_note_strlen(SITE_A, buf, 5); /* same pointer, same length, new text */
+    cbm_work_row_t w;
+    ASSERT_TRUE(work_row(CBM_WORK_STRLEN, SITE_A, &w));
+    ASSERT_EQ(w.calls, 3);
+    ASSERT_EQ(w.repeats, 1);
+
+    static const int table = 0;
+    char k1[8];
+    char k2[8];
+    memcpy(k1, "key", 4);
+    memcpy(k2, "key", 4);
+    cbm_work_note_ht(CBM_WORK_HT_GET, SITE_B, &table, k1, 0, true);
+    cbm_work_note_ht(CBM_WORK_HT_GET, SITE_B, &table, k2, 0, true); /* same text: repeat */
+    cbm_work_note_ht(CBM_WORK_HT_GET, SITE_B, &table, k2, 1, true); /* table written since */
+    cbm_work_note_ht(CBM_WORK_HT_GET, SITE_B, &table, "other", 1, false);
+    ASSERT_TRUE(work_row(CBM_WORK_HT_GET, SITE_B, &w));
+    ASSERT_EQ(w.calls, 4);
+    ASSERT_EQ(w.repeats, 1);
+    ASSERT_EQ(w.aux1, 1); /* one miss */
+
+    cbm_work_note_path(CBM_WORK_STAT, SITE_A, "/tmp/cbm-memev-path", false);
+    cbm_work_note_path(CBM_WORK_STAT, SITE_C, "/tmp/cbm-memev-path", false); /* process-wide */
+    cbm_work_note_path(CBM_WORK_OPEN, SITE_C, "/tmp/cbm-memev-path", true);  /* other kind */
+    ASSERT_TRUE(work_row(CBM_WORK_STAT, SITE_C, &w));
+    ASSERT_EQ(w.repeats, 1);
+    ASSERT_TRUE(work_row(CBM_WORK_OPEN, SITE_C, &w));
+    ASSERT_EQ(w.repeats, 0);
+    ASSERT_EQ(w.aux1, 1); /* a failure */
+    PASS();
+}
+
+/* Pools compare their workers by the events each produced. */
+TEST(memev_thread_ops_count_this_threads_events) {
+    fresh();
+    uint64_t before = cbm_memev_thread_ops();
+    cbm_memev_alloc(BLK(1), 8, 8, SITE_A);
+    cbm_memev_alloc(BLK(2), 8, 8, SITE_A);
+    cbm_work_note(CBM_WORK_MEMSET, SITE_B, 8, 0, 0);
+    ASSERT_EQ(cbm_memev_thread_ops() - before, 3);
+    cbm_memev_free(BLK(1));
+    cbm_memev_free(BLK(2));
+    PASS();
+}
+
+SUITE(mem_events) {
+    RUN_TEST(memev_slack_is_charged_to_the_asking_site);
+    RUN_TEST(memev_short_lived_blocks_are_counted_as_churn);
+    RUN_TEST(memev_realloc_copy_bytes_go_to_the_original_site);
+    RUN_TEST(memev_hint_gives_one_event_with_the_cores_site_and_class);
+    RUN_TEST(memev_untracked_free_is_counted_not_dropped);
+    RUN_TEST(memev_foreign_free_is_counted_apart_from_untracked);
+    RUN_TEST(memev_cross_thread_frees_balance_and_totals_are_order_independent);
+    RUN_TEST(memev_dormant_layer_records_nothing);
+    RUN_TEST(memev_dump_writes_header_sites_and_work);
+    RUN_TEST(memev_fill_scan_measures_never_written_and_over_requested);
+    RUN_TEST(memev_calloc_tail_is_scanned_for_zeros);
+    RUN_TEST(memev_phase_snapshot_finds_retained_memory_and_duplicates);
+    RUN_TEST(memev_work_rows_sum_and_keep_the_peak);
+    RUN_TEST(memev_repeats_require_unchanged_input);
+    RUN_TEST(memev_thread_ops_count_this_threads_events);
+}
diff --git a/tests/test_memlab_runtime_isolation_contract.sh b/tests/test_memlab_runtime_isolation_contract.sh
new file mode 100755
index 000000000..f414c41c5
--- /dev/null
+++ b/tests/test_memlab_runtime_isolation_contract.sh
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Runtime-isolation contract for the memlab harness (#1696, follow-up to #1691).
+#
+# scripts/memlab.sh starts the product over stdio to attribute retained memory
+# and then removes its work directory. It used to give the run a private
+# CBM_CACHE_DIR only, but only CBM_RUNTIME_DIR moves the daemon rendezvous
+# (docs/CONFIGURATION.md), so the profiled process joined the operator's
+# account daemon — refused with a cache-root conflict when one was live, or
+# left as the account daemon with its cache deleted underneath it otherwise.
+#
+# memlab launches the product through its Python driver, and the driver hands
+# the product the environment it inherited (memlab-drive.py passes no env= to
+# Popen). Recording the environment at the driver boundary therefore observes
+# exactly what the product receives, on every host — including Windows, whose
+# native Python cannot exec a shell fixture — so a python3 shim stands in for
+# the driver and no product process is started at all.
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "$WORKDIR"' EXIT
+
+fail() {
+    echo "FAIL: $*" >&2
+    exit 1
+}
+
+normalize_path() {
+    local path=${1%$'\r'}
+    if command -v cygpath >/dev/null 2>&1; then
+        cygpath -u "$path" 2>/dev/null && return 0
+    fi
+    printf '%s\n' "${path//\\//}"
+}
+
+if grep -q 'env=' "$ROOT/scripts/memlab-drive.py"; then
+    fail "memlab-drive.py no longer passes the harness environment through unchanged"
+fi
+
+SHIM_DIR="$WORKDIR/bin"
+mkdir -p "$SHIM_DIR"
+cat > "$SHIM_DIR/python3" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\t%s\n' "${CBM_CACHE_DIR-}" "${CBM_RUNTIME_DIR-}" >> "$CBM_MEMLAB_ENV_PROBE"
+echo "served=0 failed=0"
+exit 1
+EOF
+DUMMY_BINARY="$WORKDIR/dummy-binary"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$DUMMY_BINARY"
+chmod +x "$SHIM_DIR/python3" "$DUMMY_BINARY"
+
+CALLER_CACHE="$WORKDIR/caller-cache"
+CALLER_RUNTIME="$WORKDIR/caller-runtime"
+ENV_LOG="$WORKDIR/environment.log"
+mkdir -p "$CALLER_CACHE" "$CALLER_RUNTIME" "$WORKDIR/cwd"
+
+# memlab writes its profile and log into $PWD, hence the cwd change. It is
+# tracked without an executable bit, so run it through bash.
+(
+    cd "$WORKDIR/cwd"
+    PATH="$SHIM_DIR:$PATH" \
+    CBM_CACHE_DIR="$CALLER_CACHE" \
+    CBM_RUNTIME_DIR="$CALLER_RUNTIME" \
+    CBM_MEMLAB_ENV_PROBE="$ENV_LOG" \
+        bash "$ROOT/scripts/memlab.sh" "$DUMMY_BINARY" 1 probe > "$WORKDIR/memlab.out" 2>&1 || true
+)
+
+[[ -s "$ENV_LOG" ]] || fail "memlab did not reach its driver"
+
+CALLER_CACHE_NORMALIZED=$(normalize_path "$CALLER_CACHE")
+CALLER_RUNTIME_NORMALIZED=$(normalize_path "$CALLER_RUNTIME")
+private_root=""
+while IFS=$'\t' read -r child_cache_raw child_runtime_raw; do
+    child_cache=$(normalize_path "$child_cache_raw")
+    child_runtime=$(normalize_path "$child_runtime_raw")
+    if [[ -z "$child_runtime" || "$child_runtime" == "$CALLER_RUNTIME_NORMALIZED" ]]; then
+        fail "memlab exposed the caller CBM_RUNTIME_DIR to the product"
+    fi
+    if [[ -z "$child_cache" || "$child_cache" == "$CALLER_CACHE_NORMALIZED" ]]; then
+        fail "memlab exposed the caller CBM_CACHE_DIR to the product"
+    fi
+    if [[ "${child_runtime%/*}" != "${child_cache%/*}" ||
+          "${child_runtime##*/}" != "runtime" || "${child_cache##*/}" != "cache" ]]; then
+        fail "memlab runtime/cache were not isolated beneath one private root"
+    fi
+    private_root="${child_runtime%/*}"
+done < "$ENV_LOG"
+
+[[ ! -e "$private_root" ]] || fail "memlab left its private root behind: $private_root"
+
+echo "PASS: memlab harness isolates its daemon runtime and cache from the caller"
diff --git a/tests/test_parallel.c b/tests/test_parallel.c
index 631446f9c..85df7d55d 100644
--- a/tests/test_parallel.c
+++ b/tests/test_parallel.c
@@ -19,6 +19,7 @@
 #include "foundation/platform.h"
 #include "foundation/log.h"
 #include "cbm.h"
+#include "result_spill.h"
 
 #include <stdlib.h>
 #include <string.h>
@@ -118,6 +119,33 @@ static int setup_parallel_repo(void) {
                "    @Override\n    public double area() { return 0.0; }\n}\n");
     fclose(f);
 
+    /* NAMESPACE-declaring files whose import resolves through the namespace
+     * map (PHP `use`; C# `using` and Java package imports take the same path).
+     * Without these the spill-parity test compared a Go+Java fixture that never
+     * touches that map, so it passed while spilling silently changed import
+     * resolution for every namespaced repository: the map is built from the
+     * in-memory result cache, where a PARKED result is NULL, so a spilled file
+     * contributed no namespace at all and its imports fell through to the
+     * looser fallback (php corpus, 2026-09-18: 57,182 edges in memory against
+     * 59,379 while spilling, same binary, reproducible 3/3 each way). */
+    snprintf(path, sizeof(path), "%s/app", g_par_tmpdir);
+    cbm_mkdir(path);
+    snprintf(path, sizeof(path), "%s/app/Models.php", g_par_tmpdir);
+    f = fopen(path, "w");
+    if (!f)
+        return -1;
+    fprintf(f, "<?php\nnamespace App\\Models;\n\n"
+               "class User {\n    public function name() { return \"u\"; }\n}\n");
+    fclose(f);
+    snprintf(path, sizeof(path), "%s/app/Services.php", g_par_tmpdir);
+    f = fopen(path, "w");
+    if (!f)
+        return -1;
+    fprintf(f, "<?php\nnamespace App\\Services;\n\nuse App\\Models\\User;\n\n"
+               "class UserService {\n"
+               "    public function make() { $u = new User(); return $u->name(); }\n}\n");
+    fclose(f);
+
     return 0;
 }
 
@@ -271,6 +299,11 @@ static cbm_gbuf_t *run_sequential_with_lsp_cross(const char *project, const char
 
 /* ── Run parallel pipeline on files, returning gbuf ───────────────── */
 
+/* Spill mode for the harness: the run below opts its context in (the way
+ * run_parallel_pipeline does) and records how many results the store parked. */
+static bool g_harness_spill = false;
+static int64_t g_harness_parked = -1;
+
 static cbm_gbuf_t *run_parallel_with_extract_opts_and_mutator(
     const char *project, const char *repo_path, cbm_file_info_t *files, int file_count,
     int worker_count, const cbm_parallel_extract_opts_t *extract_opts,
@@ -286,6 +319,7 @@ static cbm_gbuf_t *run_parallel_with_extract_opts_and_mutator(
         .gbuf = gbuf,
         .registry = reg,
         .cancelled = &cancelled,
+        .spill_allowed = g_harness_spill,
     };
 
     if (seed_structure) {
@@ -306,6 +340,14 @@ static cbm_gbuf_t *run_parallel_with_extract_opts_and_mutator(
         cbm_parallel_extract(&ctx, files, file_count, result_cache, &shared_ids, worker_count);
     }
     cbm_gbuf_set_next_id(gbuf, atomic_load(&shared_ids));
+    if (g_harness_spill) {
+        int64_t bytes = 0;
+        int64_t loads = 0;
+        g_harness_parked = -1;
+        if (ctx.spill) {
+            cbm_result_spill_stats(ctx.spill, &g_harness_parked, &bytes, &loads);
+        }
+    }
 
     if (mutator) {
         mutator(result_cache, file_count, mutator_ud);
@@ -323,8 +365,10 @@ static cbm_gbuf_t *run_parallel_with_extract_opts_and_mutator(
      * cbm_pxc_run_one(_ts) per file BEFORE materializing CALLS edges. */
     char **def_modules = (char **)calloc((size_t)file_count, sizeof(char *));
     int def_count = 0;
+    CBMArena cross_arena;
+    cbm_arena_init(&cross_arena);
     CBMLSPDef *all_defs =
-        def_modules ? cbm_pxc_collect_all_defs(&ctx, result_cache, files, file_count,
+        def_modules ? cbm_pxc_collect_all_defs(&ctx, &cross_arena, result_cache, files, file_count,
                                                ctx.project_name, def_modules, &def_count, NULL)
                     : NULL;
     CBMModuleDefIndex *module_def_index =
@@ -337,6 +381,7 @@ static cbm_gbuf_t *run_parallel_with_extract_opts_and_mutator(
 
     cbm_pxc_free_module_def_index(module_def_index);
     free(all_defs);
+    cbm_arena_destroy(&cross_arena);
     if (def_modules) {
         for (int i = 0; i < file_count; i++) {
             free(def_modules[i]);
@@ -348,6 +393,7 @@ static cbm_gbuf_t *run_parallel_with_extract_opts_and_mutator(
         if (result_cache[i])
             cbm_free_result(result_cache[i]);
     free(result_cache);
+    cbm_pipeline_spill_close(&ctx);
 
     harness_ctx_free_tables(&ctx);
     cbm_registry_free(reg);
@@ -528,6 +574,48 @@ TEST(parallel_total_edges) {
     PASS();
 }
 
+/* ── Spill mode: the graph is the in-memory graph ─────────────────── */
+
+/* CBM_MEM_SPILL=1 parks every compacted result on disk the moment it is
+ * extracted; registry build, def collection, surfaces, resolve and the infra
+ * passes read each one back only for the moment they need it. The graph must
+ * not be able to tell: same nodes, same edges per type as the in-memory run
+ * of the same repo -- and every file must actually have gone through the
+ * store (a store that failed to open would silently test nothing). */
+TEST(parallel_spill_mode_builds_the_same_graph) {
+    if (ensure_parity_setup() != 0)
+        FAIL("setup failed");
+    cbm_discover_opts_t opts = {.mode = CBM_MODE_FULL};
+    cbm_file_info_t *files = NULL;
+    int file_count = 0;
+    ASSERT_EQ(cbm_discover(g_par_tmpdir, &opts, &files, &file_count), 0);
+    ASSERT_GT(file_count, 0);
+
+    cbm_setenv("CBM_MEM_SPILL", "1", 1);
+    g_harness_spill = true;
+    cbm_gbuf_t *spilled = run_parallel("par-test", g_par_tmpdir, files, file_count, 2);
+    g_harness_spill = false;
+    cbm_unsetenv("CBM_MEM_SPILL");
+    cbm_discover_free(files, file_count);
+    ASSERT(spilled != NULL);
+
+    ASSERT_EQ((int)g_harness_parked, file_count);
+    ASSERT_EQ(cbm_gbuf_node_count(spilled), cbm_gbuf_node_count(g_par_gbuf));
+    ASSERT_EQ(cbm_gbuf_edge_count(spilled), cbm_gbuf_edge_count(g_par_gbuf));
+    static const char *const types[] = {"CALLS", "DEFINES",  "DEFINES_METHOD", "IMPORTS",
+                                        "USES",  "INHERITS", "IMPLEMENTS"};
+    for (size_t t = 0; t < sizeof(types) / sizeof(types[0]); t++) {
+        int in_memory = cbm_gbuf_edge_count_by_type(g_par_gbuf, types[t]);
+        int on_disk = cbm_gbuf_edge_count_by_type(spilled, types[t]);
+        if (in_memory != on_disk) {
+            printf("  FAIL: %s edges: in_memory=%d spilled=%d\n", types[t], in_memory, on_disk);
+        }
+        ASSERT_EQ(in_memory, on_disk);
+    }
+    cbm_gbuf_free(spilled);
+    PASS();
+}
+
 /* ── Empty file list ──────────────────────────────────────────────── */
 
 TEST(parallel_empty_files) {
@@ -2583,10 +2671,9 @@ TEST(parallel_kotlin_nonbinary_operator_carriers_reach_graph) {
  * the test green.  The optional crate_b-local helper pins the second failure
  * mode where a confident in-file resolution used to suppress cross-LSP. */
 static cbm_gbuf_t *run_issue56_parallel_workspace(bool local_decoy) {
-    static const char workspace_toml[] =
-        "[workspace]\n"
-        "members = [\"crate_a\", \"crate_b\"]\n"
-        "resolver = \"2\"\n";
+    static const char workspace_toml[] = "[workspace]\n"
+                                         "members = [\"crate_a\", \"crate_b\"]\n"
+                                         "resolver = \"2\"\n";
     static const char crate_a_toml[] =
         "[package]\nname = \"crate_a\"\nversion = \"0.1.0\"\nedition = \"2021\"\n";
     static const char crate_b_toml[] =
@@ -2594,13 +2681,11 @@ static cbm_gbuf_t *run_issue56_parallel_workspace(bool local_decoy) {
         "\n[dependencies]\ncrate_a = { path = \"../crate_a\" }\n";
     static const char crate_a_source[] = "pub fn helper() {}\n";
     static const char unlisted_source[] = "pub fn helper() {}\n";
-    static const char caller_without_local[] =
-        "fn run() { crate_a::helper(); }\n"
-        "fn main() { run(); }\n";
-    static const char caller_with_local[] =
-        "fn helper() {}\n"
-        "fn run() { crate_a::helper(); }\n"
-        "fn main() { run(); }\n";
+    static const char caller_without_local[] = "fn run() { crate_a::helper(); }\n"
+                                               "fn main() { run(); }\n";
+    static const char caller_with_local[] = "fn helper() {}\n"
+                                            "fn run() { crate_a::helper(); }\n"
+                                            "fn main() { run(); }\n";
 
     char tmpdir[256];
     snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_issue56_parallel_XXXXXX");
@@ -2669,13 +2754,12 @@ TEST(parallel_rust_cross_crate_worker_receives_workspace_manifest) {
     const cbm_gbuf_edge_t *correct =
         find_call_edge_to_target_fragment(gbuf, "main.run", ".crate_a.");
     const bool correct_found = correct != NULL;
-    const bool unlisted =
-        callable_has_call_target_fragment(gbuf, "main.run", ".unlisted.");
+    const bool unlisted = callable_has_call_target_fragment(gbuf, "main.run", ".unlisted.");
     const bool manifest_strategy =
         correct && correct->properties_json && strstr(correct->properties_json, "lsp_cross_crate");
     if (!correct || unlisted || !manifest_strategy) {
-        printf("  issue56 manifest diagnostic: correct=%d unlisted=%d strategy=%d\n",
-               correct_found, unlisted, manifest_strategy);
+        printf("  issue56 manifest diagnostic: correct=%d unlisted=%d strategy=%d\n", correct_found,
+               unlisted, manifest_strategy);
     }
     cbm_gbuf_free(gbuf);
 
@@ -2692,8 +2776,7 @@ TEST(parallel_rust_cross_crate_manifest_beats_confident_local_resolution) {
     const cbm_gbuf_edge_t *correct =
         find_call_edge_to_target_fragment(gbuf, "main.run", ".crate_a.");
     const bool correct_found = correct != NULL;
-    const bool wrong_local =
-        callable_has_call_target_fragment(gbuf, "main.run", ".crate_b.");
+    const bool wrong_local = callable_has_call_target_fragment(gbuf, "main.run", ".crate_b.");
     const bool manifest_strategy =
         correct && correct->properties_json && strstr(correct->properties_json, "lsp_cross_crate");
     if (!correct || wrong_local || !manifest_strategy) {
@@ -3259,7 +3342,8 @@ static cbm_gbuf_t *run_go_field_chain_sequential(const char *project, const char
                    r->defs.count, r->imports.count, r->calls.count, r->resolved_calls.count);
             for (int j = 0; j < r->resolved_calls.count; j++) {
                 const CBMResolvedCall *rc = &r->resolved_calls.items[j];
-                printf("  [diag]   rc caller=%s callee=%s strategy=%s conf=%.2f kind=%d span=[%u,%u)\n",
+                printf("  [diag]   rc caller=%s callee=%s strategy=%s conf=%.2f kind=%d "
+                       "span=[%u,%u)\n",
                        rc->caller_qn ? rc->caller_qn : "?", rc->callee_qn ? rc->callee_qn : "?",
                        rc->strategy ? rc->strategy : "?", rc->confidence, (int)rc->kind,
                        (unsigned)rc->site_start_byte, (unsigned)rc->site_end_byte);
@@ -3267,13 +3351,16 @@ static cbm_gbuf_t *run_go_field_chain_sequential(const char *project, const char
             for (int j = 0; j < r->calls.count; j++) {
                 const CBMCall *c = &r->calls.items[j];
                 printf("  [diag]   call callee=%s enclosing=%s span=[%u,%u) req=%d\n",
-                       c->callee_name ? c->callee_name : "?", c->enclosing_func_qn ? c->enclosing_func_qn : "?",
-                       (unsigned)c->site_start_byte, (unsigned)c->site_end_byte, (int)c->requires_lsp_resolution);
+                       c->callee_name ? c->callee_name : "?",
+                       c->enclosing_func_qn ? c->enclosing_func_qn : "?",
+                       (unsigned)c->site_start_byte, (unsigned)c->site_end_byte,
+                       (int)c->requires_lsp_resolution);
             }
             for (int j = 0; j < r->defs.count; j++) {
                 const CBMDefinition *d = &r->defs.items[j];
-                printf("  [diag]   def label=%s qn=%s parent=%s ret=%s\n", d->label ? d->label : "?",
-                       d->qualified_name ? d->qualified_name : "?", d->parent_class ? d->parent_class : "?",
+                printf("  [diag]   def label=%s qn=%s parent=%s ret=%s\n",
+                       d->label ? d->label : "?", d->qualified_name ? d->qualified_name : "?",
+                       d->parent_class ? d->parent_class : "?",
                        d->return_type ? d->return_type : "?");
             }
         }
@@ -3324,11 +3411,13 @@ TEST(parallel_go_cross_package_field_chain_resolves) {
                                 "\n"
                                 "type OrderService struct{}\n"
                                 "\n"
-                                "func (s *OrderService) PlaceOrder(ctx context.Context, req *pb.PlaceOrderReq) (*pb.PlaceOrderRsp, error) {\n"
+                                "func (s *OrderService) PlaceOrder(ctx context.Context, req "
+                                "*pb.PlaceOrderReq) (*pb.PlaceOrderRsp, error) {\n"
                                 "    return nil, nil\n"
                                 "}\n"
                                 "\n"
-                                "func (s *OrderService) ListOrders(ctx context.Context, req *pb.ListOrdersReq) (*pb.ListOrdersRsp, error) {\n"
+                                "func (s *OrderService) ListOrders(ctx context.Context, req "
+                                "*pb.ListOrdersReq) (*pb.ListOrdersRsp, error) {\n"
                                 "    return nil, nil\n"
                                 "}\n") != 0 ||
         th_write_file(app_path, "package handler\n"
@@ -3353,15 +3442,18 @@ TEST(parallel_go_cross_package_field_chain_resolves) {
                                 "    searchSvc    *service.SearchService\n"
                                 "}\n"
                                 "\n"
-                                "func (h *OrderHandler) ListOrders(ctx context.Context, req *pb.ListOrdersReq) (*pb.ListOrdersRsp, error) {\n"
+                                "func (h *OrderHandler) ListOrders(ctx context.Context, req "
+                                "*pb.ListOrdersReq) (*pb.ListOrdersRsp, error) {\n"
                                 "    return h.orderSvc.ListOrders(ctx, req)\n"
                                 "}\n"
                                 "\n"
-                                "func (h *OrderHandler) PlaceOrder(ctx context.Context, req *pb.PlaceOrderReq) (*pb.PlaceOrderRsp, error) {\n"
+                                "func (h *OrderHandler) PlaceOrder(ctx context.Context, req "
+                                "*pb.PlaceOrderReq) (*pb.PlaceOrderRsp, error) {\n"
                                 "    return h.orderSvc.PlaceOrder(ctx, req)\n"
                                 "}\n"
                                 "\n"
-                                "func (h *OrderHandler) UpdateCart(ctx context.Context, req *pb.UpdateCartReq) (*pb.UpdateCartRsp, error) {\n"
+                                "func (h *OrderHandler) UpdateCart(ctx context.Context, req "
+                                "*pb.UpdateCartReq) (*pb.UpdateCartRsp, error) {\n"
                                 "    return h.cartSvc.UpdateCart(ctx, req)\n"
                                 "}\n") != 0) {
         th_rmtree(tmpdir);
@@ -3379,11 +3471,11 @@ TEST(parallel_go_cross_package_field_chain_resolves) {
     cbm_gbuf_t *gbuf = run_go_field_chain_sequential("go_field_fold", tmpdir, files, 2);
     ASSERT_NOT_NULL(gbuf);
 
-    const cbm_gbuf_edge_t *edge = find_call_edge_to_target_fragment(gbuf, "handler.PlaceOrder", ".service.PlaceOrder");
+    const cbm_gbuf_edge_t *edge =
+        find_call_edge_to_target_fragment(gbuf, "handler.PlaceOrder", ".service.PlaceOrder");
     const bool found = edge != NULL;
-    const bool dispatch =
-        edge && edge->properties_json &&
-        strstr(edge->properties_json, "\"strategy\":\"lsp_type_dispatch\"");
+    const bool dispatch = edge && edge->properties_json &&
+                          strstr(edge->properties_json, "\"strategy\":\"lsp_type_dispatch\"");
     if (!found || !dispatch) {
         printf("  go field chain diagnostic: found=%d dispatch=%d\n", found, dispatch);
         if (edge && edge->properties_json) {
@@ -3414,8 +3506,7 @@ TEST(parallel_go_cross_package_field_chain_resolves) {
                         all[i] ? cbm_gbuf_find_by_id(gbuf, all[i]->source_id) : NULL;
                     const cbm_gbuf_node_t *dst =
                         all[i] ? cbm_gbuf_find_by_id(gbuf, all[i]->target_id) : NULL;
-                    printf("  CALLS edge: %s -> %s  props=%s\n",
-                           src ? src->qualified_name : "?",
+                    printf("  CALLS edge: %s -> %s  props=%s\n", src ? src->qualified_name : "?",
                            dst ? dst->qualified_name : "?",
                            all[i]->properties_json ? all[i]->properties_json : "{}");
                 }
@@ -3797,8 +3888,8 @@ TEST(lsp_resolve_project_prefixed_duplicate_is_not_ambiguous) {
     const char *project = "proj";
     cbm_gbuf_t *gbuf = cbm_gbuf_new(project, "/tmp");
     ASSERT_NOT_NULL(gbuf);
-    int64_t target_id = cbm_gbuf_upsert_node(gbuf, "Function", "handler",
-                                             "proj.mod.Target.handler", "target.py", 1, 1, "{}");
+    int64_t target_id = cbm_gbuf_upsert_node(gbuf, "Function", "handler", "proj.mod.Target.handler",
+                                             "target.py", 1, 1, "{}");
     ASSERT_GT(target_id, 0);
 
     CBMCall call = make_call("proj.mod.Caller.run", "handler");
@@ -3807,8 +3898,7 @@ TEST(lsp_resolve_project_prefixed_duplicate_is_not_ambiguous) {
     CBMResolvedCall raw = make_rc("proj.mod.Caller.run", "mod.Target.handler", 0.75f);
     raw.site_start_byte = call.site_start_byte;
     raw.site_end_byte = call.site_end_byte;
-    CBMResolvedCall prefixed =
-        make_rc("proj.mod.Caller.run", "proj.mod.Target.handler", 0.90f);
+    CBMResolvedCall prefixed = make_rc("proj.mod.Caller.run", "proj.mod.Target.handler", 0.90f);
     prefixed.site_start_byte = call.site_start_byte;
     prefixed.site_end_byte = call.site_end_byte;
     CBMResolvedCall items[] = {raw, prefixed};
@@ -3827,9 +3917,8 @@ TEST(lsp_resolve_project_prefix_spellings_stay_ambiguous_when_both_nodes_exist)
     ASSERT_NOT_NULL(gbuf);
     int64_t raw_id = cbm_gbuf_upsert_node(gbuf, "Function", "handler", "mod.Target.handler",
                                           "raw.py", 1, 1, "{}");
-    int64_t prefixed_id = cbm_gbuf_upsert_node(gbuf, "Function", "handler",
-                                               "proj.mod.Target.handler", "prefixed.py", 1, 1,
-                                               "{}");
+    int64_t prefixed_id = cbm_gbuf_upsert_node(
+        gbuf, "Function", "handler", "proj.mod.Target.handler", "prefixed.py", 1, 1, "{}");
     ASSERT_GT(raw_id, 0);
     ASSERT_GT(prefixed_id, 0);
     ASSERT(raw_id != prefixed_id);
@@ -3840,8 +3929,7 @@ TEST(lsp_resolve_project_prefix_spellings_stay_ambiguous_when_both_nodes_exist)
     CBMResolvedCall raw = make_rc("proj.mod.Caller.run", "mod.Target.handler", 0.75f);
     raw.site_start_byte = call.site_start_byte;
     raw.site_end_byte = call.site_end_byte;
-    CBMResolvedCall prefixed =
-        make_rc("proj.mod.Caller.run", "proj.mod.Target.handler", 0.90f);
+    CBMResolvedCall prefixed = make_rc("proj.mod.Caller.run", "proj.mod.Target.handler", 0.90f);
     prefixed.site_start_byte = call.site_start_byte;
     prefixed.site_end_byte = call.site_end_byte;
     CBMResolvedCall items[] = {raw, prefixed};
@@ -4348,6 +4436,7 @@ SUITE(parallel) {
     RUN_TEST(parallel_implements_parity);
     RUN_TEST(parallel_semantic_fixture_expected_counts);
     RUN_TEST(parallel_total_edges);
+    RUN_TEST(parallel_spill_mode_builds_the_same_graph);
     RUN_TEST(parallel_empty_files);
     RUN_TEST(parallel_args_json_no_overflow);
 
diff --git a/tests/test_parse_coverage.c b/tests/test_parse_coverage.c
index f657e1e81..fd0e64e47 100644
--- a/tests/test_parse_coverage.c
+++ b/tests/test_parse_coverage.c
@@ -112,21 +112,21 @@ static const char *PY_CLEAN = "def ok():\n"
  * Guards against over-suppression: the preprocessor explains the guarded
  * region but explains nothing about the garbage, so BOTH must stay flagged
  * and they must be reported as two separate ranges, not one big one. */
-static const char *C_IFDEF_SPLIT_PLUS_GARBAGE = "#include <stdio.h>\n"           /* 1 */
-                                                "\n"                            /* 2 */
-                                                "void ok_before(void) { }\n"    /* 3 */
-                                                "\n"                            /* 4 */
-                                                "#ifdef FEATURE_A\n"            /* 5 */
-                                                "static int guarded(int x) {\n" /* 6 */
-                                                "#else\n"                       /* 7 */
+static const char *C_IFDEF_SPLIT_PLUS_GARBAGE = "#include <stdio.h>\n"              /* 1 */
+                                                "\n"                                /* 2 */
+                                                "void ok_before(void) { }\n"        /* 3 */
+                                                "\n"                                /* 4 */
+                                                "#ifdef FEATURE_A\n"                /* 5 */
+                                                "static int guarded(int x) {\n"     /* 6 */
+                                                "#else\n"                           /* 7 */
                                                 "static int guarded_alt(int x) {\n" /* 8 */
-                                                "#endif\n"                      /* 9 */
-                                                "    return x + 1;\n"           /* 10 */
-                                                "}\n"                           /* 11 */
-                                                "\n"                            /* 12 */
-                                                "%%% ((( &&& ))) %%%\n"         /* 13 */
-                                                "\n"                            /* 14 */
-                                                "void ok_after(void) { }\n";    /* 15 */
+                                                "#endif\n"                          /* 9 */
+                                                "    return x + 1;\n"               /* 10 */
+                                                "}\n"                               /* 11 */
+                                                "\n"                                /* 12 */
+                                                "%%% ((( &&& ))) %%%\n"             /* 13 */
+                                                "\n"                                /* 14 */
+                                                "void ok_after(void) { }\n";        /* 15 */
 
 /* Perl formats have a line-oriented body terminated by a lone dot.  The
  * following named sub pins the important recovery boundary: a grammar must
@@ -494,7 +494,8 @@ TEST(real_error_before_eof_still_flagged_without_final_newline_issue1610) {
     bool has_ranges = r->error_ranges != NULL;
     cbm_free_result(r);
     if (!flagged) {
-        FAIL("a real mid-file parse failure must still be reported when the file also lacks its final newline");
+        FAIL("a real mid-file parse failure must still be reported when the file also lacks its "
+             "final newline");
     }
     if (!has_ranges) {
         FAIL("a reported failure must still name its line range");
@@ -529,11 +530,8 @@ TEST(perl_format_followed_by_named_sub_is_complete_issue1838) {
     bool has_error_ranges = r->error_ranges != NULL;
     bool has_following_sub = has_def(r, "after_format");
     if (partial || error_regions != 0 || has_error_ranges || !has_following_sub) {
-        fprintf(stderr,
-                "  Perl format result: partial=%d regions=%d ranges=%s following_sub=%d\n",
-                partial,
-                error_regions,
-                r->error_ranges ? r->error_ranges : "(none)",
+        fprintf(stderr, "  Perl format result: partial=%d regions=%d ranges=%s following_sub=%d\n",
+                partial, error_regions, r->error_ranges ? r->error_ranges : "(none)",
                 has_following_sub);
         cbm_free_result(r);
         FAIL("a valid Perl format and its following named sub must parse completely");
@@ -619,7 +617,8 @@ TEST(width_bearing_error_at_eof_still_flagged_with_trailing_blank_issue1746) {
     bool flagged = r->parse_incomplete;
     cbm_free_result(r);
     if (!flagged) {
-        FAIL("a width-bearing parse failure at EOF must still be reported when the file ends in blanks");
+        FAIL("a width-bearing parse failure at EOF must still be reported when the file ends in "
+             "blanks");
     }
     PASS();
 }
@@ -734,7 +733,6 @@ TEST(c_clean_file_stays_unflagged_after_refinement) {
     PASS();
 }
 
-
 /* The whole-file class, and the reason the parse_unusable kind exists.
  *
  * The Phase 2 refinement that narrows a whole-file range using the
@@ -806,18 +804,31 @@ TEST(c_ifdef_split_is_partial_never_unusable) {
  * says so, instead of leaving a wrong note in the plan. (The plan's Phase 0
  * also listed the pointer form as failing. It does not fail today.) */
 TEST(c_thread_local_grammar_limit_is_pinned_issue963) {
+    /* The init form used to read as "parses clean", but that was a masking
+     * effect, not a clean parse: the grammar leaves an ERROR on line 1 and
+     * salvages a one-line Variable named `int` from it, which the old
+     * all-or-nothing recovery rule accepted as evidence the line was
+     * understood. Since 2026-09-16 a one-line salvage is not evidence, so the
+     * line is flagged — honest, because `x` is what the graph lacks. */
     CBMFileResult *ok = do_extract("static _Thread_local int x = 0;\n"
                                    "void f(void) { x = 1; }\n",
                                    CBM_LANG_C, "tls_init.c");
     ASSERT_NOT_NULL(ok);
-    ASSERT_FALSE(ok->parse_incomplete);
+    ASSERT_TRUE(ok->parse_incomplete);
+    ASSERT_NOT_NULL(ok->error_ranges);
+    ASSERT_STR_EQ("1-1", ok->error_ranges);
+    ASSERT_TRUE(has_def(ok, "f"));
     cbm_free_result(ok);
 
+    /* The pointer form: the same masking, the same honest answer now. */
     CBMFileResult *ptr = do_extract("static _Thread_local int *p;\n"
                                     "void f(void) { p = 0; }\n",
                                     CBM_LANG_C, "tls_ptr.c");
     ASSERT_NOT_NULL(ptr);
-    ASSERT_FALSE(ptr->parse_incomplete);
+    ASSERT_TRUE(ptr->parse_incomplete);
+    ASSERT_NOT_NULL(ptr->error_ranges);
+    ASSERT_STR_EQ("1-1", ptr->error_ranges);
+    ASSERT_TRUE(has_def(ptr, "f"));
     cbm_free_result(ptr);
 
     CBMFileResult *arr = do_extract("static _Thread_local char b[8];\n"
@@ -879,6 +890,99 @@ TEST(coverage_range_never_ends_past_the_last_line_issue963) {
     PASS();
 }
 
+/* ── Residual ranges (2026-09-16) ─────────────────────────────────────────
+ * The recovery subtraction used to be all-or-nothing: a region stayed flagged
+ * whole unless every one of its lines was covered by a definition that started
+ * inside it. On torvalds/linux one ERROR node that swallowed the second half of
+ * kernel/sched/core.c (lines 5522-11284) survived on the strength of the
+ * comment and macro lines BETWEEN its 286 extracted functions, and
+ * check_index_coverage told a reader 68 % of the scheduler was unindexed. The
+ * ranges must now name only the lines no extracted definition covers. */
+
+/* A brace-unbalanced junk line between two clean functions: the recovery
+ * walker still extracts both functions, so the reported range must not cover
+ * either of them, only the junk. */
+static const char *C_JUNK_BETWEEN_FUNCTIONS = "int alpha(void) {\n" /* 1 */
+                                              "    return 1;\n"     /* 2 */
+                                              "}\n"                 /* 3 */
+                                              "\n"                  /* 4 */
+                                              "} ] junk ( {\n"      /* 5 */
+                                              "\n"                  /* 6 */
+                                              "int beta(void) {\n"  /* 7 */
+                                              "    return 2;\n"     /* 8 */
+                                              "}\n"                 /* 9 */
+                                              "\n"                  /* 10 */
+                                              "int gamma(void) {\n" /* 11 */
+                                              "    return 3;\n"     /* 12 */
+                                              "}\n";                /* 13 */
+
+static int range_covers_line(const char *ranges, unsigned int line) {
+    const char *p = ranges;
+    while (p && *p) {
+        unsigned int s = 0;
+        unsigned int e = 0;
+        if (sscanf(p, "%u-%u", &s, &e) == 2 && s <= line && line <= e) {
+            return 1;
+        }
+        p = strchr(p, ',');
+        if (p) {
+            p++;
+        }
+    }
+    return 0;
+}
+
+TEST(coverage_range_never_covers_an_extracted_definition) {
+    CBMFileResult *r = do_extract(C_JUNK_BETWEEN_FUNCTIONS, CBM_LANG_C, "junk.c");
+    ASSERT_NOT_NULL(r);
+    ASSERT_TRUE(has_def(r, "alpha"));
+    ASSERT_TRUE(has_def(r, "beta"));
+    ASSERT_TRUE(has_def(r, "gamma"));
+    ASSERT_TRUE(r->parse_incomplete);
+    ASSERT_NOT_NULL(r->error_ranges);
+    /* Every extracted definition's own lines are in the graph, so no reported
+     * range may cover its start line. */
+    for (int i = 0; i < r->defs.count; i++) {
+        const CBMDefinition *d = &r->defs.items[i];
+        if (!d->label || strcmp(d->label, "Module") == 0) {
+            continue;
+        }
+        ASSERT_FALSE(range_covers_line(r->error_ranges, d->start_line));
+    }
+    /* And the junk line itself is still reported. */
+    ASSERT_TRUE(range_covers_line(r->error_ranges, 5u));
+    cbm_free_result(r);
+    PASS();
+}
+
+/* The lines between recovered definitions are comments and blanks here: a gap
+ * with no code in it is not a miss, so nothing may be reported for it. The
+ * junk line stays reported. */
+static const char *C_JUNK_WITH_COMMENT_GAPS = "int alpha(void) {\n"                /* 1 */
+                                              "    return 1;\n"                    /* 2 */
+                                              "}\n"                                /* 3 */
+                                              "/* between alpha and the junk */\n" /* 4 */
+                                              "} ] junk ( {\n"                     /* 5 */
+                                              "// trailing note\n"                 /* 6 */
+                                              "int beta(void) {\n"                 /* 7 */
+                                              "    return 2;\n"                    /* 8 */
+                                              "}\n";                               /* 9 */
+
+TEST(coverage_gap_of_only_comments_is_not_a_miss) {
+    CBMFileResult *r = do_extract(C_JUNK_WITH_COMMENT_GAPS, CBM_LANG_C, "gaps.c");
+    ASSERT_NOT_NULL(r);
+    ASSERT_TRUE(has_def(r, "alpha"));
+    ASSERT_TRUE(has_def(r, "beta"));
+    ASSERT_TRUE(r->parse_incomplete);
+    ASSERT_NOT_NULL(r->error_ranges);
+    ASSERT_TRUE(range_covers_line(r->error_ranges, 5u));
+    ASSERT_FALSE(range_covers_line(r->error_ranges, 1u));
+    ASSERT_FALSE(range_covers_line(r->error_ranges, 7u));
+    ASSERT_FALSE(range_covers_line(r->error_ranges, 9u));
+    cbm_free_result(r);
+    PASS();
+}
+
 SUITE(parse_coverage) {
     RUN_TEST(c_ifdef_split_brace_sets_parse_incomplete);
     RUN_TEST(c_ifdef_split_brace_neighbors_still_extracted);
@@ -917,4 +1021,6 @@ SUITE(parse_coverage) {
     RUN_TEST(c_thread_local_grammar_limit_is_pinned_issue963);
     RUN_TEST(coverage_repeated_error_line_reports_one_range_issue963);
     RUN_TEST(coverage_range_never_ends_past_the_last_line_issue963);
+    RUN_TEST(coverage_range_never_covers_an_extracted_definition);
+    RUN_TEST(coverage_gap_of_only_comments_is_not_a_miss);
 }
diff --git a/tests/test_pipeline.c b/tests/test_pipeline.c
index 738445fdf..6ef16a89b 100644
--- a/tests/test_pipeline.c
+++ b/tests/test_pipeline.c
@@ -151,6 +151,34 @@ TEST(pipeline_run_null) {
     PASS();
 }
 
+TEST(pipeline_discovery_limit_returns_exact_violation_without_publishing) {
+    char *repo = th_mktempdir("cbm_pipeline_discovery_limit");
+    ASSERT_NOT_NULL(repo);
+    ASSERT_EQ(th_write_file(TH_PATH(repo, "first.c"), "int first;\n"), 0);
+    ASSERT_EQ(th_write_file(TH_PATH(repo, "second.py"), "second = 2\n"), 0);
+
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/index.db", repo);
+    cbm_pipeline_t *pipeline = cbm_pipeline_new(repo, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(pipeline);
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    policy.max_files = (cbm_index_limit_u64_t){.enabled = true, .value = 1};
+    cbm_pipeline_set_resource_policy(pipeline, &policy);
+
+    ASSERT_EQ(cbm_pipeline_run(pipeline), CBM_PIPELINE_RESOURCE_LIMIT);
+    cbm_index_resource_violation_t violation = {0};
+    cbm_pipeline_get_resource_violation(pipeline, &violation);
+    ASSERT_EQ(violation.resource, CBM_INDEX_RESOURCE_FILES);
+    ASSERT_EQ(violation.observed, 2);
+    ASSERT_EQ(violation.limit, 1);
+    ASSERT_FALSE(cbm_file_exists(db_path));
+
+    cbm_pipeline_free(pipeline);
+    th_cleanup(repo);
+    PASS();
+}
+
 /* ── Focused: file-backed store persistence ─────────────────────── */
 
 TEST(store_file_persistence) {
@@ -223,6 +251,167 @@ TEST(store_bulk_persistence) {
     PASS();
 }
 
+static void write_temp_file(const char *dir, const char *name, const char *content);
+
+/* EVERY proto service gets its Routes, not the first 64 the graph buffer
+ * happened to hold.
+ *
+ * create_grpc_routes() collected services into a fixed `services[CBM_SZ_64]`
+ * and stopped there, in graph-buffer insertion order — which is parallel
+ * worker merge order. So on a repo with more than 64 services the extras were
+ * silently dropped, and WHICH ones were dropped changed between runs of the
+ * same binary: two kubernetes indexes differed by 5 Routes one way and 4 the
+ * other, plus their HANDLES edges (2026-09-18). 70 services here, so the old
+ * cap fails this test whatever order the workers produce. */
+TEST(pipeline_grpc_routes_cover_every_service_past_the_old_cap) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_grpc_cap_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+
+    enum { SERVICES = 70 }; /* > the 64 the fixed array used to hold */
+    for (int i = 0; i < SERVICES; i++) {
+        char name[64];
+        char body[512];
+        snprintf(name, sizeof(name), "svc%02d.proto", i);
+        snprintf(body, sizeof(body),
+                 "syntax = \"proto3\";\npackage demo%02d;\n\n"
+                 "message Req%02d { string id = 1; }\n"
+                 "message Resp%02d { string ok = 1; }\n\n"
+                 "service Svc%02d {\n"
+                 "  rpc Ping (Req%02d) returns (Resp%02d);\n}\n",
+                 i, i, i, i, i, i);
+        write_temp_file(tmp, name, body);
+    }
+
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/grpc.db", tmp);
+    cbm_pipeline_t *p = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(p);
+    ASSERT_EQ(cbm_pipeline_run(p), 0);
+
+    cbm_store_t *s = cbm_store_open_path(db_path);
+    ASSERT_NOT_NULL(s);
+    const char *project = cbm_pipeline_project_name(p);
+    cbm_node_t *routes = NULL;
+    int route_count = 0;
+    ASSERT_EQ(cbm_store_find_nodes_by_label(s, project, "Route", &routes, &route_count),
+              CBM_STORE_OK);
+    int grpc_routes = 0;
+    for (int i = 0; i < route_count; i++) {
+        if (routes[i].qualified_name &&
+            strncmp(routes[i].qualified_name, "__grpc__", strlen("__grpc__")) == 0) {
+            grpc_routes++;
+        }
+    }
+    cbm_store_free_nodes(routes, route_count);
+    cbm_store_close(s);
+    cbm_pipeline_free(p);
+    th_rmtree(tmp);
+
+    /* One rpc per service: every service must be represented. The old cap
+     * produced at most 64 however the workers interleaved. */
+    ASSERT_EQ(grpc_routes, SERVICES);
+    PASS();
+}
+
+/* Pipeline-level: the doclinks pass runs as part of a real index and its
+ * REFERENCES_FILE edges land in the store, not just in a unit test that
+ * calls cbm_pipeline_pass_doclinks() directly. Registration-list gap: every
+ * doclinks unit test calls the pass function by hand, so deleting its
+ * {predump_doclinks, "doclinks", false} entry in pipeline.c would leave
+ * every one of them green. */
+TEST(pipeline_doclinks_edge_lands_in_store) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_doclinks_pipeline_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+
+    write_temp_file(tmp, "README.md", "See [main](src/main.go) for the entry point.\n");
+    write_temp_file(tmp, "src/main.go", "package main\n\nfunc main() {}\n");
+
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/doclinks.db", tmp);
+    cbm_pipeline_t *p = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(p);
+    ASSERT_EQ(cbm_pipeline_run(p), 0);
+
+    cbm_store_t *s = cbm_store_open_path(db_path);
+    ASSERT_NOT_NULL(s);
+    const char *project = cbm_pipeline_project_name(p);
+    ASSERT_GT(cbm_store_count_edges_by_type(s, project, "REFERENCES_FILE"), 0);
+    cbm_store_close(s);
+    cbm_pipeline_free(p);
+    th_rmtree(tmp);
+    PASS();
+}
+
+/* Spilling must be invisible in the OUTPUT: the same repository indexed with
+ * results parked on disk must produce the same graph as one indexed entirely in
+ * memory. It did not. The namespace map that `use`/`using`/package imports
+ * resolve through was built from the in-memory result cache, where a PARKED
+ * result is NULL, so every spilled file contributed no namespace and its
+ * imports fell through to the looser fallback. Measured on the php corpus
+ * (2026-09-18, reproducible 3/3 each way, and present on main): 57,182 edges in
+ * memory against 59,379 while spilling — differing in BOTH directions, because
+ * a file missing from that map does not fail to resolve, it resolves
+ * differently.
+ *
+ * Why this needs its own fixture: test_parallel's spill-parity test uses the
+ * compact parity harness, which omits the production pass that builds the map,
+ * and its repo is Go+Java — neither reaches the namespace path. This one runs
+ * the REAL pipeline over >MIN_FILES_FOR_PARALLEL files so the parallel route is
+ * taken, with namespaced PHP that imports across files. */
+TEST(pipeline_spill_resolves_namespace_imports_like_memory) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_spill_ns_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+
+    /* 60 modules: each declares a namespace and the next one imports it, so
+     * every file both contributes to the namespace map and depends on it. */
+    enum { NS_FILES = 60 };
+    for (int i = 0; i < NS_FILES; i++) {
+        char name[64];
+        char body[512];
+        snprintf(name, sizeof(name), "Mod%02d.php", i);
+        snprintf(body, sizeof(body),
+                 "<?php\nnamespace App\\Mod%02d;\n\nuse App\\Mod%02d\\Thing%02d;\n\n"
+                 "class Thing%02d {\n"
+                 "    public function run() { $t = new Thing%02d(); return $t->run(); }\n}\n",
+                 i, (i + 1) % NS_FILES, (i + 1) % NS_FILES, i, (i + 1) % NS_FILES);
+        write_temp_file(tmp, name, body);
+    }
+
+    int counts[2] = {0, 0};
+    int imports[2] = {0, 0};
+    for (int pass = 0; pass < 2; pass++) {
+        char db_path[512];
+        snprintf(db_path, sizeof(db_path), "%s/ns%d.db", tmp, pass);
+        if (pass == 1) {
+            cbm_setenv("CBM_MEM_SPILL", "1", 1); /* park every result on disk */
+        }
+        cbm_pipeline_t *p = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+        ASSERT_NOT_NULL(p);
+        int rc = cbm_pipeline_run(p);
+        if (pass == 1) {
+            cbm_unsetenv("CBM_MEM_SPILL");
+        }
+        ASSERT_EQ(rc, 0);
+        cbm_store_t *s = cbm_store_open_path(db_path);
+        ASSERT_NOT_NULL(s);
+        const char *project = cbm_pipeline_project_name(p);
+        counts[pass] = cbm_store_count_edges(s, project);
+        imports[pass] = cbm_store_count_edges_by_type(s, project, "IMPORTS");
+        cbm_store_close(s);
+        cbm_pipeline_free(p);
+    }
+    th_rmtree(tmp);
+
+    /* The imports must actually have resolved, or this compares 0 == 0. */
+    ASSERT_GT(imports[0], 0);
+    ASSERT_EQ(imports[0], imports[1]);
+    ASSERT_EQ(counts[0], counts[1]);
+    PASS();
+}
+
 /* ── Integration: structure pass on temp repo ────────────────────── */
 
 TEST(pipeline_structure_nodes) {
@@ -2278,7 +2467,7 @@ TEST(pipeline_complexity_props_independent_of_worker_order) {
     ASSERT_EQ(sequential_rc, 0);
     ASSERT_NOT_NULL(sequential_sig);
     ASSERT_GTE(sequential_funcs, copied); /* at least the one function per fixture file */
-    ASSERT_TRUE(cycles_detected);        /* the cycles must reach the pass at all */
+    ASSERT_TRUE(cycles_detected);         /* the cycles must reach the pass at all */
     if (mismatch_run >= 0) {
         printf("\n    parallel run %d diverges from sequential: %s\n", mismatch_run, diff);
         FAIL("complexity props depend on worker id order");
@@ -3281,6 +3470,44 @@ static void mutate_semantic_input_before_final_manifest(void *userdata) {
     mutation->write_rc = th_write_file(mutation->path, mutation->replacement);
 }
 
+TEST(pipeline_late_source_limit_preserves_previous_generation) {
+    char *repo = th_mktempdir("cbm_pipeline_late_limit");
+    ASSERT_NOT_NULL(repo);
+    ASSERT_EQ(th_write_file(TH_PATH(repo, "first.c"), "int first;\n"), 0);
+    char db_path[512];
+    char late_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/index.db", repo);
+    snprintf(late_path, sizeof(late_path), "%s/late.py", repo);
+
+    manifest_race_mutation_t mutation = {
+        .path = late_path,
+        .replacement = "late = 2\n",
+        .write_rc = -1,
+    };
+    cbm_pipeline_incremental_test_before_final_manifest_once(
+        mutate_semantic_input_before_final_manifest, &mutation);
+    cbm_pipeline_t *pipeline = cbm_pipeline_new(repo, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(pipeline);
+    cbm_index_resource_policy_t policy;
+    cbm_index_policy_init(&policy);
+    policy.max_files = (cbm_index_limit_u64_t){.enabled = true, .value = 1};
+    cbm_pipeline_set_resource_policy(pipeline, &policy);
+    int rc = cbm_pipeline_run(pipeline);
+    cbm_index_resource_violation_t violation = {0};
+    cbm_pipeline_get_resource_violation(pipeline, &violation);
+    cbm_pipeline_free(pipeline);
+    cbm_pipeline_incremental_test_reset_faults();
+
+    ASSERT_EQ(mutation.write_rc, 0);
+    ASSERT_EQ(rc, CBM_PIPELINE_RESOURCE_LIMIT);
+    ASSERT_EQ(violation.resource, CBM_INDEX_RESOURCE_FILES);
+    ASSERT_EQ(violation.observed, 2);
+    ASSERT_EQ(violation.limit, 1);
+    ASSERT_FALSE(cbm_file_exists(db_path));
+    th_cleanup(repo);
+    PASS();
+}
+
 /* A graph and its exact manifest are one generation. If source bytes change
  * after extraction but before publication, the mixed generation must be
  * rejected and the previous live DB preserved. */
@@ -3416,6 +3643,527 @@ TEST(pipeline_publication_never_uses_a_predictable_staging_path) {
     PASS();
 }
 
+static int count_substring(const char *haystack, const char *needle) {
+    int count = 0;
+    size_t needle_len = strlen(needle);
+    for (const char *at = strstr(haystack, needle); at; at = strstr(at + needle_len, needle)) {
+        count++;
+    }
+    return count;
+}
+
+static int count_nested_stage_entries(const char *dir_path, const char *db_basename) {
+    cbm_dir_t *dir = cbm_opendir(dir_path);
+    if (!dir) {
+        return -1;
+    }
+    size_t base_len = strlen(db_basename);
+    int count = 0;
+    cbm_dirent_t *entry;
+    while ((entry = cbm_readdir(dir)) != NULL) {
+        if (strncmp(entry->name, db_basename, base_len) == 0 &&
+            count_substring(entry->name + base_len, ".stage.") >= 2) {
+            count++;
+        }
+    }
+    cbm_closedir(dir);
+    return count;
+}
+
+/* #1839: the outer run rewrites the pipeline's db_path to its stage, so the
+ * inner publication (dump or delta clone) minted ITS stage from a stage:
+ * <db>.stage.A.stage.B, plus -wal/-shm under WAL. A generation's stage is a
+ * sibling of the live database, whichever path it is minted from; a database
+ * whose own basename merely contains ".stage." is not a stage and keeps its
+ * full name. */
+TEST(pipeline_stage_names_never_nest) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_stage_nesting_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/generation.db", tmp);
+    char odd_db[512];
+    snprintf(odd_db, sizeof(odd_db), "%s/x.stage.y.db", tmp);
+
+    char *outer = cbm_pipeline_create_staging_path(db_path);
+    ASSERT_NOT_NULL(outer);
+    char *inner = cbm_pipeline_create_staging_path(outer);
+    ASSERT_NOT_NULL(inner);
+    char *odd_stage = cbm_pipeline_create_staging_path(odd_db);
+    ASSERT_NOT_NULL(odd_stage);
+
+    size_t db_len = strlen(db_path);
+    size_t odd_len = strlen(odd_db);
+    int outer_tokens = count_substring(outer, ".stage.");
+    int inner_tokens = count_substring(inner, ".stage.");
+    bool inner_is_sibling =
+        strncmp(inner, db_path, db_len) == 0 && strncmp(inner + db_len, ".stage.", 7) == 0;
+    bool inner_distinct = strcmp(inner, outer) != 0;
+    bool odd_keeps_basename =
+        strncmp(odd_stage, odd_db, odd_len) == 0 && strncmp(odd_stage + odd_len, ".stage.", 7) == 0;
+    int nested_entries = count_nested_stage_entries(tmp, "generation.db");
+
+    cbm_pipeline_discard_stage(inner);
+    cbm_pipeline_discard_stage(outer);
+    cbm_pipeline_discard_stage(odd_stage);
+    int leftover_entries = count_generation_stage_artifacts(tmp, "generation.db") +
+                           count_generation_stage_artifacts(tmp, "x.stage.y.db");
+    free(inner);
+    free(outer);
+    free(odd_stage);
+    th_rmtree(tmp);
+
+    ASSERT_EQ(outer_tokens, 1);
+    ASSERT_EQ(inner_tokens, 1);
+    ASSERT_TRUE(inner_is_sibling);
+    ASSERT_TRUE(inner_distinct);
+    ASSERT_TRUE(odd_keeps_basename);
+    ASSERT_EQ(nested_entries, 0);
+    ASSERT_EQ(leftover_entries, 0);
+    PASS();
+}
+
+static bool path_exists(const char *path) {
+    cbm_path_info_t info;
+    return cbm_path_info_utf8(path, &info) == CBM_PATH_INFO_OK;
+}
+
+/* #1839: a minted stage is OWNED through an exclusive kernel lock on its
+ * "<stage>.lock" sidecar for exactly as long as the stage exists. A second
+ * holder cannot take it while the writer is live; discarding the stage frees
+ * the name and removes the sidecar, so nothing stays behind. */
+TEST(pipeline_minted_stage_is_owned_until_released) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_stage_owner_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/generation.db", tmp);
+
+    char *stage = cbm_pipeline_create_staging_path(db_path);
+    ASSERT_NOT_NULL(stage);
+    char lock_path[600];
+    snprintf(lock_path, sizeof(lock_path), "%s.lock", stage);
+    bool lock_present_while_live = path_exists(lock_path);
+    int hold_while_live = cbm_pipeline_stage_lock_hold(stage);
+    if (hold_while_live >= 0) {
+        cbm_pipeline_stage_lock_drop(stage, hold_while_live);
+    }
+
+    cbm_pipeline_discard_stage(stage);
+    bool stage_gone = !path_exists(stage);
+    bool lock_gone = !path_exists(lock_path);
+
+    int hold_after_discard = cbm_pipeline_stage_lock_hold(stage);
+    int second_holder = cbm_pipeline_stage_lock_hold(stage);
+    if (second_holder >= 0) {
+        cbm_pipeline_stage_lock_drop(stage, second_holder);
+    }
+    cbm_pipeline_stage_lock_drop(stage, hold_after_discard);
+    int hold_after_drop = cbm_pipeline_stage_lock_hold(stage);
+    cbm_pipeline_stage_lock_drop(stage, hold_after_drop);
+    int leftovers = count_generation_stage_artifacts(tmp, "generation.db");
+    free(stage);
+    th_rmtree(tmp);
+
+    ASSERT_TRUE(lock_present_while_live);
+    ASSERT_EQ(hold_while_live, -1);
+    ASSERT_TRUE(stage_gone);
+    ASSERT_TRUE(lock_gone);
+    ASSERT_TRUE(hold_after_discard >= 0);
+    ASSERT_EQ(second_holder, -1);
+    ASSERT_TRUE(hold_after_drop >= 0);
+    ASSERT_EQ(leftovers, 0);
+    PASS();
+}
+
+static bool file_has_content(const char *path, const char *expected) {
+    FILE *f = cbm_fopen(path, "rb");
+    if (!f) {
+        return false;
+    }
+    char buf[256] = {0};
+    size_t n = fread(buf, 1, sizeof(buf) - 1, f);
+    (void)fclose(f);
+    return n == strlen(expected) && memcmp(buf, expected, n) == 0;
+}
+
+/* #1839 / #1864: a stage a dead writer left beside a VALID database is swept
+ * by the next run and never influences its route. The 0-byte shape is what a
+ * worker killed before its backup wrote a page leaves behind; a stale -shm
+ * beside it is swept with it. */
+TEST(pipeline_stale_zero_byte_stage_beside_valid_db_routes_incremental_and_is_swept) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_stale_stage_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+    write_temp_file(tmp, "generation.py", "def StableGeneration():\n    return 1\n");
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/generation.db", tmp);
+
+    cbm_pipeline_incremental_test_reset_faults();
+    cbm_pipeline_t *baseline = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(baseline);
+    ASSERT_EQ(cbm_pipeline_run(baseline), 0);
+    char project[256];
+    snprintf(project, sizeof(project), "%s", cbm_pipeline_project_name(baseline));
+    cbm_pipeline_free(baseline);
+
+    char stale_stage[600];
+    char stale_shm[600];
+    snprintf(stale_stage, sizeof(stale_stage), "%s.stage.deadbe", db_path);
+    snprintf(stale_shm, sizeof(stale_shm), "%s.stage.deadbe-shm", db_path);
+    ASSERT_EQ(th_write_file(stale_stage, ""), 0);
+    ASSERT_EQ(th_write_file(stale_shm, "stale-shm"), 0);
+
+    /* A body-only change: no added names, so the planner may repair. */
+    write_temp_file(tmp, "generation.py", "def StableGeneration():\n    return 2\n");
+    cbm_pipeline_incremental_test_reset_faults();
+    cbm_pipeline_t *incr = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(incr);
+    int incr_rc = cbm_pipeline_run(incr);
+    cbm_incremental_route_t route = cbm_pipeline_incremental_test_last_route();
+    cbm_pipeline_free(incr);
+
+    bool stale_stage_gone = !path_exists(stale_stage);
+    bool stale_shm_gone = !path_exists(stale_shm);
+    int stage_count = count_generation_stage_artifacts(tmp, "generation.db");
+    int stable_count = -1;
+    int absent_count = -1;
+    observe_named_generation(db_path, project, "StableGeneration", "NeverDefined", &stable_count,
+                             &absent_count);
+    cbm_pipeline_incremental_test_reset_faults();
+    th_rmtree(tmp);
+
+    ASSERT_EQ(incr_rc, 0);
+    ASSERT_TRUE(route != CBM_INCREMENTAL_ROUTE_FORCED_FULL);
+    ASSERT_TRUE(route != CBM_INCREMENTAL_ROUTE_NONE);
+    ASSERT_TRUE(stale_stage_gone);
+    ASSERT_TRUE(stale_shm_gone);
+    ASSERT_EQ(stage_count, 0);
+    ASSERT_EQ(stable_count, 1);
+    ASSERT_EQ(absent_count, 0);
+    PASS();
+}
+
+/* A killed run cleans up nothing, and until 2026-09-18 its staging database was
+ * reclaimed only when THAT project was indexed again: a kernel index killed by
+ * the OOM killer left ~15 GB parked until someone re-indexed the kernel, and
+ * indefinitely if nobody ever did. Indexing ANY project now reclaims the
+ * orphans of every project sharing that cache directory -- while the lock probe
+ * still keeps a LIVE writer's stage, whichever project owns it. */
+TEST(pipeline_sweep_reclaims_orphans_of_other_projects_and_keeps_their_live_stages) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_stage_sweep_other_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+    write_temp_file(tmp, "generation.py", "def StableGeneration():\n    return 1\n");
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/mine.db", tmp);
+
+    /* Two stages of a DIFFERENT project sharing the cache directory: one whose
+     * writer died (nothing holds its lock) and one whose writer is alive. */
+    char other_dead[600];
+    char other_dead_wal[600];
+    char other_live[600];
+    snprintf(other_dead, sizeof(other_dead), "%s/other.db.stage.cccccc", tmp);
+    snprintf(other_dead_wal, sizeof(other_dead_wal), "%s/other.db.stage.cccccc-wal", tmp);
+    snprintf(other_live, sizeof(other_live), "%s/other.db.stage.dddddd", tmp);
+    static const char other_live_bytes[] = "other-project-live-bytes";
+    ASSERT_EQ(th_write_file(other_dead, "other-project-dead-bytes"), 0);
+    ASSERT_EQ(th_write_file(other_dead_wal, "other-project-dead-wal"), 0);
+    ASSERT_EQ(th_write_file(other_live, other_live_bytes), 0);
+    int other_live_fd = cbm_pipeline_stage_lock_hold(other_live);
+    ASSERT_TRUE(other_live_fd >= 0);
+
+    cbm_pipeline_incremental_test_reset_faults();
+    cbm_pipeline_t *mine = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(mine);
+    ASSERT_EQ(cbm_pipeline_run(mine), 0);
+    cbm_pipeline_free(mine);
+
+    bool dead_gone = !path_exists(other_dead);
+    bool dead_wal_gone = !path_exists(other_dead_wal);
+    bool live_kept = file_has_content(other_live, other_live_bytes);
+    cbm_pipeline_stage_lock_drop(other_live, other_live_fd);
+
+    ASSERT_TRUE(dead_gone);     /* reclaimed even though it belongs to "other" */
+    ASSERT_TRUE(dead_wal_gone); /* sidecars go with their stage */
+    ASSERT_TRUE(live_kept);     /* another project's LIVE stage is untouched */
+    PASS();
+}
+
+/* #1839: the sweep removes exactly the stages nobody owns. A dead writer's
+ * stage (main, -wal, and the unlocked .lock sidecar its death left) goes; a
+ * stage whose writer is LIVE -- here the test, holding its lock -- is kept
+ * byte for byte, and goes only once that lock is dropped. No timing: liveness
+ * is the kernel lock, nothing else. */
+TEST(pipeline_sweep_removes_dead_writer_stage_keeps_locked_stage) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_stage_sweep_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+    write_temp_file(tmp, "generation.py", "def StableGeneration():\n    return 1\n");
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/generation.db", tmp);
+
+    cbm_pipeline_incremental_test_reset_faults();
+    cbm_pipeline_t *baseline = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(baseline);
+    ASSERT_EQ(cbm_pipeline_run(baseline), 0);
+    char project[256];
+    snprintf(project, sizeof(project), "%s", cbm_pipeline_project_name(baseline));
+    cbm_pipeline_free(baseline);
+
+    char dead_stage[600];
+    char dead_wal[600];
+    char dead_lock[600];
+    char live_stage[600];
+    char live_lock[600];
+    snprintf(dead_stage, sizeof(dead_stage), "%s.stage.aaaaaa", db_path);
+    snprintf(dead_wal, sizeof(dead_wal), "%s.stage.aaaaaa-wal", db_path);
+    snprintf(dead_lock, sizeof(dead_lock), "%s.stage.aaaaaa.lock", db_path);
+    snprintf(live_stage, sizeof(live_stage), "%s.stage.bbbbbb", db_path);
+    snprintf(live_lock, sizeof(live_lock), "%s.stage.bbbbbb.lock", db_path);
+    static const char live_bytes[] = "live-stage-bytes";
+    ASSERT_EQ(th_write_file(dead_stage, "dead-stage-bytes"), 0);
+    ASSERT_EQ(th_write_file(dead_wal, "dead-wal"), 0);
+    ASSERT_EQ(th_write_file(dead_lock, ""), 0);
+    ASSERT_EQ(th_write_file(live_stage, live_bytes), 0);
+    int live_fd = cbm_pipeline_stage_lock_hold(live_stage);
+    ASSERT_TRUE(live_fd >= 0);
+
+    write_temp_file(tmp, "generation.py", "def StableGeneration():\n    return 2\n");
+    cbm_pipeline_incremental_test_reset_faults();
+    cbm_pipeline_t *first = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(first);
+    int first_rc = cbm_pipeline_run(first);
+    cbm_pipeline_free(first);
+
+    bool dead_stage_gone = !path_exists(dead_stage);
+    bool dead_wal_gone = !path_exists(dead_wal);
+    bool dead_lock_gone = !path_exists(dead_lock);
+    bool live_kept = file_has_content(live_stage, live_bytes);
+    bool live_lock_kept = path_exists(live_lock);
+    int stable_after_first = -1;
+    int absent_after_first = -1;
+    observe_named_generation(db_path, project, "StableGeneration", "NeverDefined",
+                             &stable_after_first, &absent_after_first);
+
+    cbm_pipeline_stage_lock_drop(live_stage, live_fd);
+    cbm_pipeline_incremental_test_reset_faults();
+    cbm_pipeline_t *second = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(second);
+    int second_rc = cbm_pipeline_run(second);
+    cbm_pipeline_free(second);
+
+    bool live_gone = !path_exists(live_stage);
+    bool live_lock_gone = !path_exists(live_lock);
+    int stage_count = count_generation_stage_artifacts(tmp, "generation.db");
+    int stable_after_second = -1;
+    int absent_after_second = -1;
+    observe_named_generation(db_path, project, "StableGeneration", "NeverDefined",
+                             &stable_after_second, &absent_after_second);
+    cbm_pipeline_incremental_test_reset_faults();
+    th_rmtree(tmp);
+
+    ASSERT_EQ(first_rc, 0);
+    ASSERT_TRUE(dead_stage_gone);
+    ASSERT_TRUE(dead_wal_gone);
+    ASSERT_TRUE(dead_lock_gone);
+    ASSERT_TRUE(live_kept);
+    ASSERT_TRUE(live_lock_kept);
+    ASSERT_EQ(stable_after_first, 1);
+    ASSERT_EQ(absent_after_first, 0);
+    ASSERT_EQ(second_rc, 0);
+    ASSERT_TRUE(live_gone);
+    ASSERT_TRUE(live_lock_gone);
+    ASSERT_EQ(stage_count, 0);
+    ASSERT_EQ(stable_after_second, 1);
+    ASSERT_EQ(absent_after_second, 0);
+    PASS();
+}
+
+/* #2111 create->register TOCTOU guard. The bug this pins: create_staging_path()
+ * used to make the stage's main file visible (via mkstemp) BEFORE taking its
+ * sidecar lock, and sweep_orphan_stages() treats an absent lock sidecar
+ * (ENOENT) as a confirmed-dead writer (kernel released the lock on death). So a
+ * second, concurrent cbm_pipeline_run() against the SAME final_path, landing
+ * its own sweep in that narrow unlocked window, removed the first run's
+ * in-flight stage out from under it: every extraction pass still completed
+ * (none touch the stage file on disk), but the publish that followed found its
+ * own stage gone. Two writers racing the same project is a real scenario this
+ * PR's own sweep exists to clean up after (auto_index; the recently-fixed
+ * stale-rendezvous-recovery retry path) -- not hypothetical, and exactly the
+ * shape of #2111's windows-guards red (every pass logged success, nothing was
+ * ever committed, "Pipeline failed" surfaced generic; on Windows the sidecar
+ * collision surfaced as EACCES/errno=13).
+ *
+ * The fix takes the sidecar lock BEFORE the main file becomes visible, so this
+ * hook -- fired the instant the main file exists -- finds the stage already
+ * lock-protected and the racing sweep keeps it. The hook fires at the same
+ * point under the old ordering, where the lock was NOT yet held, so this test
+ * goes RED if that ordering ever regresses.
+ *
+ * The racing run is cancelled immediately so it never reaches ITS OWN
+ * publish -- isolating the sweep's effect on the first run's stage from the
+ * separate question of two full runs both completing for the same project. */
+typedef struct {
+    const char *tmp_dir;
+    const char *db_path;
+    bool stage_survived;
+} racing_sweep_arg_t;
+
+static bool find_sole_stage_path(const char *dir, const char *db_basename, char *out,
+                                 size_t out_sz) {
+    cbm_dir_t *d = cbm_opendir(dir);
+    if (!d) {
+        return false;
+    }
+    char prefix[256];
+    snprintf(prefix, sizeof(prefix), "%s.stage.", db_basename);
+    size_t prefix_len = strlen(prefix);
+    bool found = false;
+    cbm_dirent_t *entry;
+    while ((entry = cbm_readdir(d)) != NULL) {
+        size_t name_len = strlen(entry->name);
+        enum { STAGE_SUFFIX_RANDOM_CHARS = 6 }; /* mirrors CBM_STAGE_SUFFIX_RANDOM_CHARS */
+        if (strncmp(entry->name, prefix, prefix_len) == 0 &&
+            name_len == prefix_len + STAGE_SUFFIX_RANDOM_CHARS) {
+            snprintf(out, out_sz, "%s/%s", dir, entry->name);
+            found = true;
+            break;
+        }
+    }
+    cbm_closedir(d);
+    return found;
+}
+
+static void *racing_sweep_thread(void *arg) {
+    racing_sweep_arg_t *a = (racing_sweep_arg_t *)arg;
+    cbm_pipeline_t *p = cbm_pipeline_new(a->tmp_dir, a->db_path, CBM_MODE_FULL);
+    if (p) {
+        /* Its own sweep_orphan_stages() runs at the very start, before this
+         * run mints its own stage -- exactly like the first run's. Cancel
+         * immediately: this run must reach the sweep and nothing past it. */
+        cbm_pipeline_cancel(p);
+        (void)cbm_pipeline_run(p);
+        cbm_pipeline_free(p);
+    }
+    return NULL;
+}
+
+/* Fired from inside the FIRST run's create_staging_path(), the instant its
+ * stage main file exists (under the fix, with its sidecar lock already held;
+ * under the old create-then-lock ordering, before the lock was taken): run a
+ * second, cancelled cbm_pipeline_run() for the same project synchronously on
+ * another thread, so its sweep has every chance to reach the stage before
+ * control returns to the first run. */
+static void racing_sweep_hook(void *userdata) {
+    racing_sweep_arg_t *a = (racing_sweep_arg_t *)userdata;
+    char stage_path[600] = {0};
+    bool had_stage =
+        find_sole_stage_path(a->tmp_dir, "generation.db", stage_path, sizeof(stage_path));
+    cbm_thread_t tid;
+    if (cbm_thread_create(&tid, 0, racing_sweep_thread, a) == 0) {
+        cbm_thread_join(&tid);
+    }
+    a->stage_survived = had_stage && path_exists(stage_path);
+}
+
+TEST(pipeline_concurrent_sweep_must_not_remove_inflight_stage) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_stage_race_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+    write_temp_file(tmp, "generation.py", "def StableGeneration():\n    return 1\n");
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/generation.db", tmp);
+
+    cbm_pipeline_incremental_test_reset_faults();
+    racing_sweep_arg_t race_arg = {.tmp_dir = tmp, .db_path = db_path, .stage_survived = false};
+    cbm_pipeline_incremental_test_after_stage_created_once(racing_sweep_hook, &race_arg);
+
+    cbm_pipeline_t *p = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(p);
+    char project[256];
+    snprintf(project, sizeof(project), "%s", cbm_pipeline_project_name(p));
+    int rc = cbm_pipeline_run(p);
+    cbm_pipeline_free(p);
+
+    bool db_exists = path_exists(db_path);
+    int defined_count = -1;
+    int absent_count = -1;
+    observe_named_generation(db_path, project, "StableGeneration", "NeverDefined", &defined_count,
+                             &absent_count);
+    int stage_count = count_generation_stage_artifacts(tmp, "generation.db");
+    cbm_pipeline_incremental_test_reset_faults();
+    th_rmtree(tmp);
+
+    ASSERT_TRUE(race_arg.stage_survived);
+    ASSERT_EQ(rc, 0);
+    ASSERT_TRUE(db_exists);
+    ASSERT_EQ(defined_count, 1);
+    ASSERT_EQ(absent_count, 0);
+    ASSERT_EQ(stage_count, 0);
+    PASS();
+}
+
+static char g_route_log_capture[8192];
+static atomic_flag g_route_log_spin = ATOMIC_FLAG_INIT;
+
+/* Keeps only the route decisions; worker threads log too, and only the
+ * appends need serialising. */
+static void capture_route_log_sink(const char *line) {
+    if (!line || !strstr(line, "pipeline.route")) {
+        return;
+    }
+    while (atomic_flag_test_and_set_explicit(&g_route_log_spin, memory_order_acquire)) {}
+    size_t used = strlen(g_route_log_capture);
+    size_t avail = sizeof(g_route_log_capture) - used;
+    if (avail > 1) {
+        int n = snprintf(g_route_log_capture + used, avail, "%s\n", line);
+        if (n < 0 || (size_t)n >= avail) {
+            g_route_log_capture[sizeof(g_route_log_capture) - 1] = '\0';
+        }
+    }
+    atomic_flag_clear_explicit(&g_route_log_spin, memory_order_release);
+}
+
+/* #1864: a first index has no previous generation. The route probe used to
+ * open the run's own EMPTY stage placeholder, fail its integrity check, and
+ * warn "reason=invalid_existing_db" on every first index of every project,
+ * which the report read as a corrupted database and a crash loop. A fresh
+ * index says what it is. */
+TEST(pipeline_fresh_index_never_reports_invalid_existing_db) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_fresh_route_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+    write_temp_file(tmp, "generation.py", "def StableGeneration():\n    return 1\n");
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/generation.db", tmp);
+
+    g_route_log_capture[0] = '\0';
+    CBMLogLevel previous_level = cbm_log_get_level();
+    cbm_log_set_level(CBM_LOG_DEBUG);
+    cbm_log_set_sink(capture_route_log_sink);
+    cbm_pipeline_incremental_test_reset_faults();
+    cbm_pipeline_t *fresh = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    int fresh_rc = fresh ? cbm_pipeline_run(fresh) : -1;
+    cbm_pipeline_free(fresh);
+    cbm_log_set_sink(NULL);
+    cbm_log_set_level(previous_level);
+
+    bool invalid_reported = strstr(g_route_log_capture, "invalid_existing_db") != NULL;
+    bool fresh_reported = strstr(g_route_log_capture, "reason=no_existing_db") != NULL;
+    bool db_present = path_exists(db_path);
+    int stage_count = count_generation_stage_artifacts(tmp, "generation.db");
+    cbm_pipeline_incremental_test_reset_faults();
+    th_rmtree(tmp);
+
+    ASSERT_EQ(fresh_rc, 0);
+    ASSERT_TRUE(!invalid_reported);
+    ASSERT_TRUE(fresh_reported);
+    ASSERT_TRUE(db_present);
+    ASSERT_EQ(stage_count, 0);
+    PASS();
+}
+
 /* Discovery and extraction must describe the same immutable generation. A
  * source file created after extraction is not present in the original file
  * list, so merely re-hashing that list cannot detect the race. Publication
@@ -4992,6 +5740,123 @@ TEST(pipeline_python_receiver_suppresses_weak_method_edge) {
     PASS();
 }
 
+/* The member guard's one exemption (2026-09-16, v0.10.8 → v0.11.0 A/B on
+ * django/django): a member call whose receiver is an attribute chain rooted at
+ * self/cls, whose callee has exactly ONE definition in the project and is not a
+ * builtin type's own method keeps its unique_name edge —
+ * `self.compiler.apply_converters()` names the only apply_converters there is.
+ * A bare parameter receiver and the builtin-member class the guard was built
+ * for (`parts.extend()` -> a project ListMixin.extend) stay suppressed.
+ * Fewer than 50 files exercises pass_calls.c. */
+TEST(pipeline_python_receiver_keeps_specific_unique_name_member_call) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_python_uniq_XXXXXX");
+    if (!cbm_mkdtemp(tmp)) {
+        FAIL("tmpdir");
+    }
+
+    write_temp_file(tmp, "compiler.py",
+                    "class SQLCompiler:\n"
+                    "    def apply_converters(self, rows):\n"
+                    "        return rows\n");
+    write_temp_file(tmp, "mixin.py",
+                    "class ListMixin:\n"
+                    "    def extend(self, other):\n"
+                    "        return other\n");
+    write_temp_file(tmp, "caller.py",
+                    "class RawIterable:\n"
+                    "    def __init__(self, compiler):\n"
+                    "        self.compiler = compiler\n"
+                    "\n"
+                    "    def iterate(self):\n"
+                    "        return self.compiler.apply_converters([])\n"
+                    "\n"
+                    "\n"
+                    "def collect(parts):\n"
+                    "    parts.extend([1])\n"
+                    "    return parts\n"
+                    "\n"
+                    "\n"
+                    "def handed_in(compiler):\n"
+                    "    return compiler.apply_converters([])\n");
+
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/python_uniq.db", tmp);
+    cbm_pipeline_t *p = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(p);
+    ASSERT_EQ(cbm_pipeline_run(p), 0);
+    const char *project = cbm_pipeline_project_name(p);
+
+    cbm_store_t *s = cbm_store_open_path(db_path);
+    ASSERT_NOT_NULL(s);
+
+    /* POSITIVE: the only apply_converters in the project binds through
+     * self.compiler, an object the class owns. */
+    ASSERT_TRUE(cross_file_call_exists(s, project, "iterate", "apply_converters"));
+    /* NEGATIVE: the same unique name through a bare parameter carries no
+     * ownership evidence and stays suppressed (#1276's own shape). */
+    ASSERT_FALSE(cross_file_call_exists(s, project, "handed_in", "apply_converters"));
+    /* NEGATIVE: list.extend on a parameter must not bind ListMixin.extend. */
+    ASSERT_FALSE(cross_file_call_exists(s, project, "collect", "extend"));
+    /* Tripwire against a vacuous run. */
+    ASSERT_GTE(cbm_store_count_edges_by_type(s, project, "CALLS"), 1);
+
+    cbm_store_close(s);
+    cbm_pipeline_free(p);
+    th_rmtree(tmp);
+    PASS();
+}
+
+/* Embedded-script hosts (2026-09-16 probe on JetBrains/Exposed): a member call
+ * inside an HTML <script> body is extracted as JavaScript and carries the JS
+ * receiver flag, but the weak-member guard was gated on the FILE language, so
+ * 4,207 generated Dokka pages bound `localStorage.getItem` to a docs bundle
+ * function through unique_name. HTML (and Vue/Svelte/Astro) join the gate.
+ * POSITIVE tripwire: a bare project call in a plain .js file still resolves. */
+TEST(pipeline_html_embedded_member_call_stays_unbound) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_html_member_XXXXXX");
+    if (!cbm_mkdtemp(tmp)) {
+        FAIL("tmpdir");
+    }
+
+    /* One directory level each: write_temp_file creates a single parent. */
+    write_temp_file(tmp, "scripts/storage.js",
+                    "function getItem(key) {\n"
+                    "    return key;\n"
+                    "}\n");
+    write_temp_file(tmp, "scripts/theme.js",
+                    "import { getItem } from './storage.js';\n"
+                    "\n"
+                    "function loadTheme() {\n"
+                    "    return getItem('theme');\n"
+                    "}\n");
+    write_temp_file(tmp, "docs/index.html",
+                    "<html><head><script>\n"
+                    "var mode = localStorage.getItem('dokka-dark-mode');\n"
+                    "</script></head><body></body></html>\n");
+
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/html_member.db", tmp);
+    cbm_pipeline_t *p = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(p);
+    ASSERT_EQ(cbm_pipeline_run(p), 0);
+    const char *project = cbm_pipeline_project_name(p);
+
+    cbm_store_t *s = cbm_store_open_path(db_path);
+    ASSERT_NOT_NULL(s);
+
+    /* NEGATIVE: localStorage's own method must not bind the docs bundle. */
+    ASSERT_FALSE(cross_file_call_exists(s, project, "index", "getItem"));
+    /* POSITIVE: the bare project call in storage.js resolves as before. */
+    ASSERT_TRUE(cross_file_call_exists(s, project, "loadTheme", "getItem"));
+
+    cbm_store_close(s);
+    cbm_pipeline_free(p);
+    th_rmtree(tmp);
+    PASS();
+}
+
 /* Fixture for the #1928 cross-language reference-guard probes (sequential and
  * parallel twins). pad_files > 0 adds filler files to push the index over the
  * parallel-pipeline threshold, since USAGE/WRITES/READS have one resolver per
@@ -5910,6 +6775,55 @@ TEST(pipeline_native_fetch_classified_as_http_calls) {
  * no call arguments at all. Alamofire/URLSession were already in the service
  * pattern table; the URL simply never reached it. This is the Swift twin of
  * the TypeScript fetch case above. */
+/* The shape real Swift actually writes: the URL is built by a constructor and
+ * force-unwrapped, so the literal is two levels below the argument list. This
+ * is what issue #1892 reported from a real project. */
+TEST(pipeline_swift_nested_url_makes_route_issue1892) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_swiftnested_XXXXXX");
+    if (!cbm_mkdtemp(tmp)) {
+        FAIL("tmpdir");
+    }
+
+    write_temp_file(tmp, "Sources/Client.swift",
+                    "import Foundation\n"
+                    "final class Client {\n"
+                    "    func listWidgets() {\n"
+                    "        URLSession.shared.dataTask(with: "
+                    "URL(string: \"/api/v1/widgets\")!)\n"
+                    "    }\n"
+                    "}\n");
+
+    char db_path[512];
+    snprintf(db_path, sizeof(db_path), "%s/swiftnested.db", tmp);
+    cbm_pipeline_t *p = cbm_pipeline_new(tmp, db_path, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(p);
+    ASSERT_EQ(cbm_pipeline_run(p), 0);
+    const char *project = cbm_pipeline_project_name(p);
+
+    cbm_store_t *s = cbm_store_open_path(db_path);
+    ASSERT_NOT_NULL(s);
+
+    ASSERT_GTE(cbm_store_count_edges_by_type(s, project, "HTTP_CALLS"), 1);
+
+    cbm_node_t *routes = NULL;
+    int route_count = 0;
+    cbm_store_find_nodes_by_label(s, project, "Route", &routes, &route_count);
+    int widget_routes = 0;
+    for (int i = 0; i < route_count; i++) {
+        if (routes[i].qualified_name && strstr(routes[i].qualified_name, "/api/v1/widgets")) {
+            widget_routes++;
+        }
+    }
+    cbm_store_free_nodes(routes, route_count);
+    ASSERT_GTE(widget_routes, 1);
+
+    cbm_store_close(s);
+    cbm_pipeline_free(p);
+    th_rmtree(tmp);
+    PASS();
+}
+
 TEST(pipeline_swift_http_call_makes_route_issue1892) {
     char tmp[256];
     snprintf(tmp, sizeof(tmp), "/tmp/cbm_swifthttp_XXXXXX");
@@ -6871,6 +7785,60 @@ TEST(pipeline_python_project) {
     PASS();
 }
 
+/* `#include <linux/device.h>` from arch/x/bugs.c: two headers end with the
+ * include path (include/linux/device.h, tools/virtio/linux/device.h) and each
+ * declares `struct device`. The exact-file lookup returned the first matching
+ * node in by-name bucket order — the workers' merge order, different run to
+ * run: 5,821 kernel IMPORTS edges moved between two indexes of one tree and
+ * the CALLS resolved through their import maps moved with them. The target is
+ * the least nested File node, whichever order the nodes were registered in. */
+static void add_device_header(cbm_gbuf_t *gb, const char *rel, const char *qn_stem) {
+    char fqn[256];
+    snprintf(fqn, sizeof(fqn), "%s.h.__file__", qn_stem);
+    cbm_gbuf_upsert_node(gb, "File", "device.h", fqn, rel, 0, 0, "{}");
+    char cqn[256];
+    snprintf(cqn, sizeof(cqn), "%s.device", qn_stem);
+    cbm_gbuf_upsert_node(gb, "Class", "device", cqn, rel, 10, 40, "{}");
+}
+
+static const cbm_gbuf_node_t *resolve_device_h_from(cbm_gbuf_t *gb) {
+    atomic_int cancelled = 0;
+    cbm_pipeline_ctx_t ctx = {
+        .project_name = "p",
+        .repo_path = "/tmp/p",
+        .gbuf = gb,
+        .registry = NULL,
+        .cancelled = &cancelled,
+    };
+    CBMImport imp = {0};
+    imp.module_path = "linux/device.h";
+    imp.local_name = "h";
+    return cbm_pipeline_resolve_import_node(&ctx, "arch/x/bugs.c", "p.arch.x.bugs.c.__file__", &imp,
+                                            NULL);
+}
+
+TEST(pipeline_header_include_target_is_independent_of_registration_order) {
+    cbm_gbuf_t *a = cbm_gbuf_new("p", "/tmp/cbm_include_order_a");
+    cbm_gbuf_t *b = cbm_gbuf_new("p", "/tmp/cbm_include_order_b");
+    ASSERT_NOT_NULL(a);
+    ASSERT_NOT_NULL(b);
+    add_device_header(a, "include/linux/device.h", "p.include.linux.device");
+    add_device_header(a, "tools/virtio/linux/device.h", "p.tools.virtio.linux.device");
+    add_device_header(b, "tools/virtio/linux/device.h", "p.tools.virtio.linux.device");
+    add_device_header(b, "include/linux/device.h", "p.include.linux.device");
+
+    const cbm_gbuf_node_t *ta = resolve_device_h_from(a);
+    const cbm_gbuf_node_t *tb = resolve_device_h_from(b);
+    ASSERT_NOT_NULL(ta);
+    ASSERT_NOT_NULL(tb);
+    ASSERT_STR_EQ(ta->qualified_name, "p.include.linux.device.h.__file__");
+    ASSERT_STR_EQ(tb->qualified_name, "p.include.linux.device.h.__file__");
+
+    cbm_gbuf_free(a);
+    cbm_gbuf_free(b);
+    PASS();
+}
+
 /* #768 end-to-end: `import { A, B } from './lib'` must survive the REAL
  * pipeline (extract -> gbuf dedup -> raw SQLite dump) as TWO IMPORTS edges
  * with distinct local_name — and the dumped DB must satisfy its own schema.
@@ -7137,19 +8105,18 @@ TEST(pipeline_python_cross_module_call) {
  * unique_name (candidates==1) is #1572 and is not this claim. */
 TEST(pipeline_cross_language_same_name_does_not_share_calls_issue725) {
     const char *files[] = {"store.py", "app.py", "web/src/pages/Editor.js"};
-    const char *contents[] = {
-        "class Store:\n"
-        "    def commit(self):\n"
-        "        return True\n",
+    const char *contents[] = {"class Store:\n"
+                              "    def commit(self):\n"
+                              "        return True\n",
 
-        "from store import Store\n"
-        "\n"
-        "def save():\n"
-        "    return Store().commit()\n",
+                              "from store import Store\n"
+                              "\n"
+                              "def save():\n"
+                              "    return Store().commit()\n",
 
-        "export function commit() {\n"
-        "  return 1;\n"
-        "}\n"};
+                              "export function commit() {\n"
+                              "  return 1;\n"
+                              "}\n"};
 
     if (setup_lang_repo(files, contents, 3) != 0)
         FAIL("tmpdir");
@@ -9800,6 +10767,61 @@ TEST(registry_receiver_chain_keeps_project_extension_issue1893) {
     PASS();
 }
 
+/* A factory chain into a nested type: Settings.builder().putList names the only
+ * putList in the project, Settings.Builder.putList, and Settings — the chain's
+ * root — is in the candidate's ancestry even though the candidate's immediate
+ * parent (Builder) is not spelled in the chain. The parent-only rule refused
+ * 9,473 such unique-name calls on elastic/elasticsearch (v0.10.8 → v0.11.0 A/B,
+ * 2026-09-16). */
+TEST(registry_receiver_chain_admits_factory_chain_into_nested_type) {
+    cbm_registry_t *reg = cbm_registry_new();
+    cbm_registry_add(reg, "putList", "org.elasticsearch.common.settings.Settings.Builder.putList",
+                     "Method");
+
+    cbm_resolution_t r = cbm_registry_resolve(
+        reg, "Settings.builder().putList", "org.elasticsearch.index.IndexSettings", NULL, NULL, 0);
+    ASSERT_STR_EQ(r.qualified_name, "org.elasticsearch.common.settings.Settings.Builder.putList");
+    ASSERT_STR_EQ(r.strategy, "unique_name");
+
+    /* The same shape through a value in between: RequestOptions.DEFAULT
+     * .toBuilder().setWarningsHandler -> RequestOptions.Builder.setWarningsHandler. */
+    cbm_registry_add(reg, "setWarningsHandler",
+                     "org.elasticsearch.client.RequestOptions.Builder.setWarningsHandler",
+                     "Method");
+    r = cbm_registry_resolve(reg, "RequestOptions.DEFAULT.toBuilder().setWarningsHandler",
+                             "org.elasticsearch.client.Rest", NULL, NULL, 0);
+    ASSERT_STR_EQ(r.qualified_name,
+                  "org.elasticsearch.client.RequestOptions.Builder.setWarningsHandler");
+
+    cbm_registry_free(reg);
+    PASS();
+}
+
+/* The ancestry rule must not widen the gate to foreign roots: Base64 is the
+ * JDK's, so the project's DocOffsetsCodec.getEncoder stays refused, exactly as
+ * #1893's URLSession case above. */
+TEST(registry_receiver_chain_still_refuses_foreign_root_with_ancestry_rule) {
+    cbm_registry_t *reg = cbm_registry_new();
+    cbm_registry_add(reg, "getEncoder", "org.elasticsearch.index.codec.DocOffsetsCodec.getEncoder",
+                     "Method");
+
+    cbm_resolution_t r = cbm_registry_resolve(
+        reg, "Base64.getEncoder", "org.elasticsearch.index.IndexSettings", NULL, NULL, 0);
+    ASSERT_NULL(r.qualified_name);
+
+    /* Nor may a package segment admit it: Math.toIntExact must not bind
+     * org.elasticsearch.common.Math.toIntExact through "Math" appearing as an
+     * ancestry segment ONLY IF that segment really is the type — here it is, and
+     * that is the correct outcome (the project's own Math.toIntExact). */
+    cbm_registry_add(reg, "toIntExact", "org.elasticsearch.common.Math.toIntExact", "Method");
+    r = cbm_registry_resolve(reg, "Math.toIntExact", "org.elasticsearch.index.IndexSettings", NULL,
+                             NULL, 0);
+    ASSERT_STR_EQ(r.qualified_name, "org.elasticsearch.common.Math.toIntExact");
+
+    cbm_registry_free(reg);
+    PASS();
+}
+
 /* A lower-case root names a value, whose type the chain does not show. The gate
  * must not look at it, or every ordinary vm.load style call would be refused. */
 TEST(registry_receiver_chain_ignores_lowercase_root_issue1893) {
@@ -13723,7 +14745,6 @@ TEST(pipeline_delta_patch_indexes_docstring_into_fts_body) {
     PASS();
 }
 
-
 /* End-to-end for #518/#519: source → docstring → properties JSON → nodes_fts
  * `body` → findable. Each layer has its own test; this one proves they connect.
  * It is also the guard on the size budget: build_def_props drops an oversized
@@ -13796,6 +14817,151 @@ TEST(pipeline_markdown_and_config_prose_reaches_fts_body) {
  * attribute, so the sanitizer is silent there. The label counts pin the
  * fixture to what it claims: at least one Struct and zero Function/Method,
  * i.e. the scan genuinely finds nothing to sort. */
+/* ── Semantic pass, batched == unbatched ─────────────────────────────── */
+
+/* Under memory pressure the semantic pass tokenizes, counts and vectorizes
+ * in headroom-sized batches of functions (tokenizing twice) instead of
+ * holding every function's tokens at once. The graph must not be able to
+ * tell: the same repo indexed with CBM_SEM_BATCH=5 (forced batches, 30
+ * functions -> 6 batches) yields byte-identical node vectors, token vectors
+ * and SEMANTICALLY_RELATED edges. Rows are compared by qualified name, never
+ * by node id: parallel extraction hands out ids in worker order. */
+static void write_sem_family(const char *base, const char *file, const char *subject) {
+    char path[512];
+    snprintf(path, sizeof(path), "%s/%s", base, file);
+    char body[4096];
+    snprintf(body, sizeof(body),
+             "package main\n\n"
+             "// Parse%sConfig reads the %s config file and returns the parsed %s config.\n"
+             "func Parse%sConfig(path string) (*%sConfig, error) {\n"
+             "\treturn Load%sConfig(path)\n}\n\n"
+             "// Load%sConfig loads the %s config from disk and validates it.\n"
+             "func Load%sConfig(path string) (*%sConfig, error) {\n"
+             "\tcfg := &%sConfig{}\n\tValidate%sConfig(cfg)\n\treturn cfg, nil\n}\n\n"
+             "// Validate%sConfig checks the %s config for missing fields.\n"
+             "func Validate%sConfig(cfg *%sConfig) bool {\n\treturn cfg != nil\n}\n\n"
+             "// Write%sConfig serializes the %s config back to disk.\n"
+             "func Write%sConfig(path string, cfg *%sConfig) error {\n"
+             "\tValidate%sConfig(cfg)\n\treturn nil\n}\n\n"
+             /* A near-duplicate of Load: same doc, same body, same calls -- the
+              * pair the pass must relate, in every venue. */
+             "// Load%sConfigFile loads the %s config from disk and validates it.\n"
+             "func Load%sConfigFile(path string) (*%sConfig, error) {\n"
+             "\tcfg := &%sConfig{}\n\tValidate%sConfig(cfg)\n\treturn cfg, nil\n}\n\n"
+             "type %sConfig struct{ Name string }\n",
+             subject, subject, subject, subject, subject, subject, subject, subject, subject,
+             subject, subject, subject, subject, subject, subject, subject, subject, subject,
+             subject, subject, subject, subject, subject, subject, subject, subject, subject,
+             subject);
+    th_write_file(path, body);
+}
+
+/* Step both statements in lockstep; every column of every row must match. */
+static bool sem_same_rows(sqlite3 *a, sqlite3 *b, const char *sql, int *rows) {
+    sqlite3_stmt *sa = NULL;
+    sqlite3_stmt *sb = NULL;
+    bool same = sqlite3_prepare_v2(a, sql, -1, &sa, NULL) == SQLITE_OK &&
+                sqlite3_prepare_v2(b, sql, -1, &sb, NULL) == SQLITE_OK;
+    *rows = 0;
+    while (same) {
+        int ra = sqlite3_step(sa);
+        int rb = sqlite3_step(sb);
+        if (ra != rb) {
+            same = false;
+            break;
+        }
+        if (ra != SQLITE_ROW) {
+            break;
+        }
+        int cols = sqlite3_column_count(sa);
+        for (int c = 0; c < cols && same; c++) {
+            const unsigned char *va = sqlite3_column_text(sa, c);
+            const unsigned char *vb = sqlite3_column_text(sb, c);
+            same = (va == NULL) == (vb == NULL) &&
+                   (!va || strcmp((const char *)va, (const char *)vb) == 0);
+        }
+        (*rows)++;
+    }
+    sqlite3_finalize(sa);
+    sqlite3_finalize(sb);
+    return same;
+}
+
+TEST(pipeline_semantic_batched_matches_unbatched) {
+    char tmp[256];
+    snprintf(tmp, sizeof(tmp), "/tmp/cbm_sembatch_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(tmp));
+    static const char *const subjects[] = {"User", "Server", "Client", "Cache", "Queue", "Mail"};
+    for (size_t i = 0; i < sizeof(subjects) / sizeof(subjects[0]); i++) {
+        char file[64];
+        snprintf(file, sizeof(file), "%s_config.go", subjects[i]);
+        write_sem_family(tmp, file, subjects[i]);
+    }
+
+    char db_plain[512];
+    char db_batched[512];
+    snprintf(db_plain, sizeof(db_plain), "%s/plain.db", tmp);
+    snprintf(db_batched, sizeof(db_batched), "%s/batched.db", tmp);
+
+    /* The default threshold (0.75) admits no pair on a 30-function fixture;
+     * 0.3 admits the near-duplicates. The test is about equality, not the bar. */
+    cbm_setenv("CBM_SEMANTIC_THRESHOLD", "0.3", 1);
+    cbm_unsetenv("CBM_SEM_BATCH");
+    cbm_pipeline_t *p = cbm_pipeline_new(tmp, db_plain, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(p);
+    ASSERT_EQ(cbm_pipeline_run(p), 0);
+    cbm_pipeline_free(p);
+
+    p = cbm_pipeline_new(tmp, db_batched, CBM_MODE_FULL);
+    ASSERT_NOT_NULL(p);
+    cbm_setenv("CBM_SEM_BATCH", "5", 1); /* read by the pass, once per run */
+    int rc = cbm_pipeline_run(p);
+    cbm_unsetenv("CBM_SEM_BATCH");
+    cbm_unsetenv("CBM_SEMANTIC_THRESHOLD");
+    cbm_pipeline_free(p);
+    ASSERT_EQ(rc, 0);
+
+    cbm_store_t *sp = cbm_store_open_path(db_plain);
+    cbm_store_t *sb = cbm_store_open_path(db_batched);
+    ASSERT_NOT_NULL(sp);
+    ASSERT_NOT_NULL(sb);
+    sqlite3 *a = cbm_store_get_db(sp);
+    sqlite3 *b = cbm_store_get_db(sb);
+
+    /* The fixture must exercise batching: more functions than the forced
+     * batch, and a semantic pass that actually stored vectors and edges. */
+    sqlite3_stmt *st = NULL;
+    ASSERT_EQ(
+        sqlite3_prepare_v2(a, "SELECT COUNT(*) FROM nodes WHERE label = 'Function'", -1, &st, NULL),
+        SQLITE_OK);
+    ASSERT_EQ(sqlite3_step(st), SQLITE_ROW);
+    int functions = sqlite3_column_int(st, 0);
+    sqlite3_finalize(st);
+    ASSERT_GT(functions, 5);
+
+    int rows = 0;
+    ASSERT_TRUE(sem_same_rows(a, b,
+                              "SELECT n.qualified_name, hex(v.vector) FROM node_vectors v "
+                              "JOIN nodes n ON n.id = v.node_id ORDER BY n.qualified_name",
+                              &rows));
+    ASSERT_EQ(rows, functions);
+    ASSERT_TRUE(sem_same_rows(
+        a, b, "SELECT token, hex(vector), idf FROM token_vectors ORDER BY token", &rows));
+    ASSERT_GT(rows, 0);
+    ASSERT_TRUE(
+        sem_same_rows(a, b,
+                      "SELECT s.qualified_name, t.qualified_name, e.properties FROM edges e "
+                      "JOIN nodes s ON s.id = e.source_id JOIN nodes t ON t.id = e.target_id "
+                      "WHERE e.type = 'SEMANTICALLY_RELATED' ORDER BY 1, 2",
+                      &rows));
+    ASSERT_GT(rows, 0);
+
+    cbm_store_close(sp);
+    cbm_store_close(sb);
+    th_rmtree(tmp);
+    PASS();
+}
+
 TEST(pipeline_semantic_edges_no_functions) {
     char tmp[256];
     snprintf(tmp, sizeof(tmp), "/tmp/cbm_nofunc_XXXXXX");
@@ -13931,6 +15097,8 @@ SUITE(pipeline) {
     RUN_TEST(pipeline_cancel);
     RUN_TEST(pipeline_cancel_null);
     RUN_TEST(pipeline_run_null);
+    RUN_TEST(pipeline_discovery_limit_returns_exact_violation_without_publishing);
+    RUN_TEST(pipeline_late_source_limit_preserves_previous_generation);
     /* Extraction back-pressure */
     RUN_TEST(pipeline_backpressure_futile_nap_disengages);
     RUN_TEST(pipeline_over_budget_after_futility_fails_whole_and_preserves_db);
@@ -13940,6 +15108,9 @@ SUITE(pipeline) {
     RUN_TEST(store_file_persistence);
     RUN_TEST(store_bulk_persistence);
     /* Integration: structure pass */
+    RUN_TEST(pipeline_grpc_routes_cover_every_service_past_the_old_cap);
+    RUN_TEST(pipeline_doclinks_edge_lands_in_store);
+    RUN_TEST(pipeline_spill_resolves_namespace_imports_like_memory);
     RUN_TEST(pipeline_structure_nodes);
     RUN_TEST(pipeline_committed_counts_match_persisted);
     RUN_TEST(pipeline_adr_survives_full_reindex);
@@ -13976,6 +15147,8 @@ SUITE(pipeline) {
 #endif
     RUN_TEST(pipeline_tsjs_receiver_suppresses_weak_method_edge);
     RUN_TEST(pipeline_python_receiver_suppresses_weak_method_edge);
+    RUN_TEST(pipeline_python_receiver_keeps_specific_unique_name_member_call);
+    RUN_TEST(pipeline_html_embedded_member_call_stays_unbound);
     RUN_TEST(pipeline_go_rw_usage_never_cross_into_c);
     RUN_TEST(pipeline_go_rw_usage_never_cross_into_c_parallel);
     RUN_TEST(pipeline_go_bare_ref_never_binds_field);
@@ -13988,6 +15161,7 @@ SUITE(pipeline) {
     RUN_TEST(pipeline_parallel_rust_cross_only_macro_hidden_gets_synthetic_carrier);
     RUN_TEST(pipeline_arg_url_rejects_non_http_slash_arguments);
     RUN_TEST(pipeline_native_fetch_classified_as_http_calls);
+    RUN_TEST(pipeline_swift_nested_url_makes_route_issue1892);
     RUN_TEST(pipeline_swift_http_call_makes_route_issue1892);
     RUN_TEST(pipeline_native_fetch_parallel_classified_as_http_calls);
     RUN_TEST(pipeline_local_fetch_shadow_not_classified_as_http);
@@ -14011,6 +15185,7 @@ SUITE(pipeline) {
     RUN_TEST(usages_kotlin_no_duplicate_calls);
     /* Language integration tests */
     RUN_TEST(pipeline_python_project);
+    RUN_TEST(pipeline_header_include_target_is_independent_of_registration_order);
     RUN_TEST(pipeline_imports_multi_symbol_edges);
     RUN_TEST(pipeline_go_cross_package_call);
     RUN_TEST(pipeline_swift_cross_package_import);
@@ -14154,6 +15329,8 @@ SUITE(pipeline) {
     RUN_TEST(registry_receiver_chain_refuses_library_unique_name_issue1893);
     RUN_TEST(registry_receiver_chain_refuses_library_suffix_match_issue1893);
     RUN_TEST(registry_receiver_chain_keeps_project_extension_issue1893);
+    RUN_TEST(registry_receiver_chain_admits_factory_chain_into_nested_type);
+    RUN_TEST(registry_receiver_chain_still_refuses_foreign_root_with_ancestry_rule);
     RUN_TEST(registry_receiver_chain_ignores_lowercase_root_issue1893);
     RUN_TEST(registry_receiver_chain_ignores_bare_name_issue1893);
     RUN_TEST(registry_fuzzy_confidence_single);
@@ -14257,6 +15434,7 @@ SUITE(pipeline) {
     RUN_TEST(pipeline_delta_patch_indexes_docstring_into_fts_body);
     RUN_TEST(pipeline_markdown_and_config_prose_reaches_fts_body);
     RUN_TEST(pipeline_semantic_edges_no_functions);
+    RUN_TEST(pipeline_semantic_batched_matches_unbatched);
 }
 
 /* Focused semantic-manifest and publication contracts. Kept separate from the
@@ -14280,6 +15458,13 @@ SUITE(pipeline_semantic_manifest_repro) {
     RUN_TEST(pipeline_git_context_change_forces_full_and_refreshes_branch);
     RUN_TEST(pipeline_global_extension_config_change_forces_full);
     RUN_TEST(pipeline_publication_never_uses_a_predictable_staging_path);
+    RUN_TEST(pipeline_stage_names_never_nest);
+    RUN_TEST(pipeline_minted_stage_is_owned_until_released);
+    RUN_TEST(pipeline_stale_zero_byte_stage_beside_valid_db_routes_incremental_and_is_swept);
+    RUN_TEST(pipeline_sweep_reclaims_orphans_of_other_projects_and_keeps_their_live_stages);
+    RUN_TEST(pipeline_sweep_removes_dead_writer_stage_keeps_locked_stage);
+    RUN_TEST(pipeline_concurrent_sweep_must_not_remove_inflight_stage);
+    RUN_TEST(pipeline_fresh_index_never_reports_invalid_existing_db);
     RUN_TEST(pipeline_source_mutation_before_publication_preserves_previous_generation);
     RUN_TEST(pipeline_source_addition_before_publication_preserves_previous_generation);
     RUN_TEST(pipeline_tsconfig_mutation_before_publication_preserves_previous_generation);
diff --git a/tests/test_registry.c b/tests/test_registry.c
index 247ca61ad..5f751a899 100644
--- a/tests/test_registry.c
+++ b/tests/test_registry.c
@@ -301,8 +301,7 @@ TEST(resolve_qualified_disambiguates_same_name) {
     ASSERT_TRUE(!nomatch.strategy || strcmp(nomatch.strategy, "qualified_suffix") != 0);
 
     /* A bare call stays ambiguous (no qualifier → no disambiguation signal). */
-    cbm_resolution_t bare =
-        cbm_registry_resolve(r, "save", "proj.lib.App.Caller", NULL, NULL, 0);
+    cbm_resolution_t bare = cbm_registry_resolve(r, "save", "proj.lib.App.Caller", NULL, NULL, 0);
     ASSERT_TRUE(!bare.strategy || strcmp(bare.strategy, "qualified_suffix") != 0);
 
     cbm_registry_free(r);
@@ -578,6 +577,44 @@ TEST(resolve_import_reachable_prefix) {
     PASS();
 }
 
+/* The per-file reachability memo answers exactly what the uncached check
+ * answers, file after file: its key arena opens on the first memoized key and
+ * is destroyed with the file, and one key is longer than the arena's first
+ * block. The two files import different packages, so a memo leaking between
+ * files would flip an answer. */
+TEST(reach_cache_memo_matches_uncached_across_files) {
+    static char long_qn[6000];
+    memset(long_qn, 'a', sizeof(long_qn) - 1);
+    long_qn[sizeof(long_qn) - 1] = '\0';
+    memcpy(long_qn, "pkg.io.", 7);
+    long_qn[5000] = '.';
+    const char *cands[] = {"pkg.io.Reader", "pkg.net.Dial", "other.fmt.Println", long_qn};
+    enum { NCANDS = 4 };
+    const char *imports_io[] = {"pkg.io"};
+    const char *imports_net[] = {"pkg.net", "other.fmt"};
+    for (int file = 0; file < 4; file++) {
+        bool io = (file % 2) == 0;
+        const char **imports = io ? imports_io : imports_net;
+        int nimports = io ? 1 : 2;
+        bool expect[NCANDS];
+        for (int i = 0; i < NCANDS; i++) {
+            expect[i] = cbm_registry_is_import_reachable(cands[i], imports, nimports);
+        }
+        /* the uncached answers really differ between the files */
+        ASSERT_EQ(expect[0], io);
+        ASSERT_EQ(expect[1], !io);
+        ASSERT_EQ(expect[3], io);
+        cbm_registry_reach_cache_begin(8);
+        for (int pass = 0; pass < 2; pass++) { /* the second pass is served by the memo */
+            for (int i = 0; i < NCANDS; i++) {
+                ASSERT_EQ(cbm_registry_is_import_reachable(cands[i], imports, nimports), expect[i]);
+            }
+        }
+        cbm_registry_reach_cache_end();
+    }
+    PASS();
+}
+
 /* ── Negative import evidence ─────────────────────────────────── */
 
 TEST(negative_import_rejects_unimported) {
@@ -783,31 +820,121 @@ TEST(perl_suppress_keeps_high_confidence_and_genuine_calls) {
     PASS();
 }
 
+/* 2026-09-16 probe on torvalds/linux: a Makefile target bound the C function
+ * `sk_psock.eval` through unique_name. Build and configuration languages have
+ * no cross-language call semantics, so for them a unique match into another
+ * language is a collision by construction; a code caller keeps #1572. */
+TEST(cross_language_config_caller_drops_unique_name_too) {
+    ASSERT_TRUE(cbm_suppress_cross_language_suffix_match(CBM_LANG_MAKEFILE, "include/linux/skmsg.h",
+                                                         "unique_name"));
+    ASSERT_TRUE(
+        cbm_suppress_cross_language_suffix_match(CBM_LANG_CMAKE, "src/main.c", "unique_name"));
+    ASSERT_TRUE(
+        cbm_suppress_cross_language_suffix_match(CBM_LANG_YAML, "app/models.py", "unique_name"));
+    /* A code caller's unique_name into another language is still #1572. */
+    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(
+        CBM_LANG_PYTHON, "web/src/pages/Editor.js", "unique_name"));
+    /* Same-language config targets are untouched. */
+    ASSERT_FALSE(
+        cbm_suppress_cross_language_suffix_match(CBM_LANG_MAKEFILE, "lib/Makefile", "unique_name"));
+    /* Receiver-aware strategies are never this guard's business. */
+    ASSERT_FALSE(
+        cbm_suppress_cross_language_suffix_match(CBM_LANG_MAKEFILE, "src/main.c", "same_module"));
+    PASS();
+}
+
+/* Same-named candidates that tie on test-status and namespace proximity used
+ * to be settled by bucket position, i.e. by the order files were registered:
+ * two indexes of one kernel tree differed by 632 CALLS edges, `dev_name`
+ * landing on any of twenty same-named struct fields or on nothing at all.
+ * The tie is now a function of the candidate set: the least nested
+ * definition, then the smaller QN — whichever order the registry was built
+ * in (O9). */
+TEST(registry_tie_break_is_independent_of_registration_order) {
+    const char *cands[] = {
+        "proj.drivers.media.cec.i2c.ch7322.ch7322_conn_match.dev_name", /* struct field */
+        "proj.sound.soc.codecs.tas2783-sdw.tas2783_prv.dev_name",       /* struct field */
+        "proj.include.linux.device.dev_name",                           /* the function */
+        "proj.arch.um.drivers.pty.pty_chan.dev_name",                   /* struct field */
+    };
+    const char *labels[] = {"Field", "Field", "Function", "Field"};
+    const int n = 4;
+
+    cbm_registry_t *forward = cbm_registry_new();
+    cbm_registry_t *backward = cbm_registry_new();
+    for (int i = 0; i < n; i++) {
+        cbm_registry_add(forward, "dev_name", cands[i], labels[i]);
+        cbm_registry_add(backward, "dev_name", cands[n - 1 - i], labels[n - 1 - i]);
+    }
+
+    /* A far-away caller with no imports: every candidate scores the same. */
+    cbm_resolution_t f =
+        cbm_registry_resolve(forward, "dev_name", "proj.kernel.irq.msi", NULL, NULL, 0);
+    cbm_resolution_t b =
+        cbm_registry_resolve(backward, "dev_name", "proj.kernel.irq.msi", NULL, NULL, 0);
+    ASSERT_NOT_NULL(f.qualified_name);
+    ASSERT_NOT_NULL(b.qualified_name);
+    ASSERT_STR_EQ(f.qualified_name, "proj.include.linux.device.dev_name");
+    ASSERT_STR_EQ(b.qualified_name, "proj.include.linux.device.dev_name");
+    ASSERT_STR_EQ(f.strategy, "suffix_match");
+    ASSERT_STR_EQ(b.strategy, "suffix_match");
+
+    /* Equal depth: the smaller QN, from either order. */
+    cbm_registry_t *lex_a = cbm_registry_new();
+    cbm_registry_t *lex_b = cbm_registry_new();
+    cbm_registry_add(lex_a, "sg_next", "proj.tools.virtio.scatterlist.sg_next", "Function");
+    cbm_registry_add(lex_a, "sg_next", "proj.include.linux.scatterlist.sg_next", "Function");
+    cbm_registry_add(lex_b, "sg_next", "proj.include.linux.scatterlist.sg_next", "Function");
+    cbm_registry_add(lex_b, "sg_next", "proj.tools.virtio.scatterlist.sg_next", "Function");
+    cbm_resolution_t la =
+        cbm_registry_resolve(lex_a, "sg_next", "proj.drivers.scsi.arm_scsi", NULL, NULL, 0);
+    cbm_resolution_t lb =
+        cbm_registry_resolve(lex_b, "sg_next", "proj.drivers.scsi.arm_scsi", NULL, NULL, 0);
+    ASSERT_STR_EQ(la.qualified_name, "proj.include.linux.scatterlist.sg_next");
+    ASSERT_STR_EQ(lb.qualified_name, "proj.include.linux.scatterlist.sg_next");
+
+    /* Proximity still outranks depth: the sibling wins over a shallower stranger. */
+    cbm_registry_t *near = cbm_registry_new();
+    cbm_registry_add(near, "vnic_rq_free", "proj.lib.vnic_rq_free", "Function");
+    cbm_registry_add(near, "vnic_rq_free", "proj.drivers.scsi.fnic.vnic_rq.vnic_rq_free",
+                     "Function");
+    cbm_resolution_t nr = cbm_registry_resolve(near, "vnic_rq_free",
+                                               "proj.drivers.scsi.fnic.fnic_res", NULL, NULL, 0);
+    ASSERT_STR_EQ(nr.qualified_name, "proj.drivers.scsi.fnic.vnic_rq.vnic_rq_free");
+
+    cbm_registry_free(forward);
+    cbm_registry_free(backward);
+    cbm_registry_free(lex_a);
+    cbm_registry_free(lex_b);
+    cbm_registry_free(near);
+    PASS();
+}
+
 TEST(cross_language_suffix_match_drops_py_vs_js) {
     /* #725: two same-named symbols in different languages. suffix_match is the
      * strategy that collapses them; unique_name is #1572 and must stay. */
     ASSERT_TRUE(cbm_suppress_cross_language_suffix_match(CBM_LANG_PYTHON, "web/src/pages/Editor.js",
                                                          "suffix_match"));
-    ASSERT_TRUE(cbm_suppress_cross_language_suffix_match(CBM_LANG_JAVASCRIPT, "store.py",
-                                                         "suffix_match"));
-    ASSERT_TRUE(cbm_suppress_cross_language_suffix_match(CBM_LANG_BASH, "cli/main.py",
-                                                         "suffix_match"));
-    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_PYTHON, "store.py",
-                                                          "suffix_match"));
-    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_PYTHON, "web/src/pages/Editor.js",
-                                                          "unique_name"));
-    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_PYTHON, "web/src/pages/Editor.js",
-                                                          "same_module"));
-    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_PYTHON, "web/src/pages/Editor.js",
-                                                          "import_map"));
+    ASSERT_TRUE(
+        cbm_suppress_cross_language_suffix_match(CBM_LANG_JAVASCRIPT, "store.py", "suffix_match"));
+    ASSERT_TRUE(
+        cbm_suppress_cross_language_suffix_match(CBM_LANG_BASH, "cli/main.py", "suffix_match"));
+    ASSERT_FALSE(
+        cbm_suppress_cross_language_suffix_match(CBM_LANG_PYTHON, "store.py", "suffix_match"));
+    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(
+        CBM_LANG_PYTHON, "web/src/pages/Editor.js", "unique_name"));
+    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(
+        CBM_LANG_PYTHON, "web/src/pages/Editor.js", "same_module"));
+    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_PYTHON,
+                                                          "web/src/pages/Editor.js", "import_map"));
     /* JS/TS/TSX are one family. */
     ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_JAVASCRIPT, "lib/util.ts",
                                                           "suffix_match"));
     ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_TYPESCRIPT, "ui/Panel.tsx",
                                                           "suffix_match"));
     ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_PYTHON, NULL, "suffix_match"));
-    ASSERT_FALSE(cbm_suppress_cross_language_suffix_match(CBM_LANG_COUNT, "store.py",
-                                                          "suffix_match"));
+    ASSERT_FALSE(
+        cbm_suppress_cross_language_suffix_match(CBM_LANG_COUNT, "store.py", "suffix_match"));
     PASS();
 }
 
@@ -902,6 +1029,53 @@ TEST(dynamic_suppress_keeps_high_confidence_and_non_methods) {
     PASS();
 }
 
+TEST(python_builtin_member_table_matches_builtin_type_methods) {
+    /* Ends and middle of the sorted table, so a mis-sorted insert shows up. */
+    ASSERT_TRUE(cbm_python_is_builtin_member("add"));
+    ASSERT_TRUE(cbm_python_is_builtin_member("extend"));
+    ASSERT_TRUE(cbm_python_is_builtin_member("items"));
+    ASSERT_TRUE(cbm_python_is_builtin_member("print"));
+    ASSERT_TRUE(cbm_python_is_builtin_member("startswith"));
+    ASSERT_TRUE(cbm_python_is_builtin_member("zfill"));
+    /* Project-specific spellings are not builtin members. */
+    ASSERT_FALSE(cbm_python_is_builtin_member("apply_converters"));
+    ASSERT_FALSE(cbm_python_is_builtin_member("lazy_model_operation"));
+    ASSERT_FALSE(cbm_python_is_builtin_member("describe"));
+    ASSERT_FALSE(cbm_python_is_builtin_member(NULL));
+    ASSERT_FALSE(cbm_python_is_builtin_member(""));
+    PASS();
+}
+
+TEST(weak_member_unique_name_exempt_is_python_self_rooted_unique_and_specific_only) {
+    /* The exemption: Python, self/cls-rooted receiver, unique_name, callee not
+     * a builtin member. */
+    ASSERT_TRUE(cbm_weak_member_unique_name_exempt(true, true, "self.compiler.apply_converters",
+                                                   "unique_name"));
+    ASSERT_TRUE(cbm_weak_member_unique_name_exempt(true, true, "cls.registry.lazy_model_operation",
+                                                   "unique_name"));
+    /* A bare parameter/local receiver carries no ownership evidence: #1276's
+     * accelerator.backward() and c.describe() stay suppressed. */
+    ASSERT_FALSE(
+        cbm_weak_member_unique_name_exempt(true, false, "accelerator.backward", "unique_name"));
+    /* A builtin type's own method stays suppressed even on self. */
+    ASSERT_FALSE(
+        cbm_weak_member_unique_name_exempt(true, true, "self.parts.extend", "unique_name"));
+    ASSERT_FALSE(cbm_weak_member_unique_name_exempt(true, true, "self.out.print", "unique_name"));
+    /* Only unique_name carries the one-definition evidence. */
+    ASSERT_FALSE(cbm_weak_member_unique_name_exempt(true, true, "self.compiler.apply_converters",
+                                                    "suffix_match"));
+    ASSERT_FALSE(cbm_weak_member_unique_name_exempt(true, true, "self.compiler.apply_converters",
+                                                    "field_type_hint"));
+    /* Python only: the JS/TS family keeps its recorded trade. */
+    ASSERT_FALSE(
+        cbm_weak_member_unique_name_exempt(false, true, "this.compiler.apply", "unique_name"));
+    /* Degenerate inputs never exempt. */
+    ASSERT_FALSE(cbm_weak_member_unique_name_exempt(true, true, NULL, "unique_name"));
+    ASSERT_FALSE(cbm_weak_member_unique_name_exempt(true, true, "", "unique_name"));
+    ASSERT_FALSE(cbm_weak_member_unique_name_exempt(true, true, "self.x.y", NULL));
+    PASS();
+}
+
 TEST(local_binding_suppress_drops_weak_shadowed_bare_calls) {
     /* A bare `run()` whose callee is a parameter of an enclosing scope cannot be
      * the module-level `run`, so a weak short-name match fabricates the edge. */
@@ -1046,6 +1220,7 @@ SUITE(registry) {
     /* Import reachability */
     RUN_TEST(resolve_is_import_reachable);
     RUN_TEST(resolve_import_reachable_prefix);
+    RUN_TEST(reach_cache_memo_matches_uncached_across_files);
     /* Negative import evidence */
     RUN_TEST(negative_import_rejects_unimported);
     /* Fuzzy resolve */
@@ -1065,10 +1240,14 @@ SUITE(registry) {
     RUN_TEST(perl_suppress_drops_weak_builtin_and_method_matches);
     RUN_TEST(perl_suppress_keeps_high_confidence_and_genuine_calls);
     RUN_TEST(cross_language_suffix_match_drops_py_vs_js);
+    RUN_TEST(cross_language_config_caller_drops_unique_name_too);
+    RUN_TEST(registry_tie_break_is_independent_of_registration_order);
     RUN_TEST(cross_language_ref_drops_go_vs_c);
     RUN_TEST(go_bare_ref_never_binds_field);
     RUN_TEST(dynamic_suppress_drops_weak_method_matches);
     RUN_TEST(dynamic_suppress_keeps_high_confidence_and_non_methods);
+    RUN_TEST(python_builtin_member_table_matches_builtin_type_methods);
+    RUN_TEST(weak_member_unique_name_exempt_is_python_self_rooted_unique_and_specific_only);
     RUN_TEST(local_binding_suppress_drops_weak_shadowed_bare_calls);
     RUN_TEST(local_binding_suppress_keeps_unshadowed_and_strong_strategies);
     RUN_TEST(weak_call_guards_share_one_drop_list);
diff --git a/tests/test_security_gate_fail_closed.sh b/tests/test_security_gate_fail_closed.sh
new file mode 100644
index 000000000..0e79f2356
--- /dev/null
+++ b/tests/test_security_gate_fail_closed.sh
@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# The code-scanning gate must FAIL CLOSED.
+#
+# History. `codeql-gate` in .github/workflows/_security.yml counted open alerts
+# with:
+#
+#   ALERTS=$(gh api '.../code-scanning/alerts?state=open' --jq 'length' 2>/dev/null || echo "0")
+#
+# That reads as defensive and is the exact opposite. The job declared no
+# `permissions:` block, so it inherited the workflow's `contents: read` and the
+# alert API answered 403. `gh` writes the API error BODY to stdout, so `ALERTS`
+# became the string
+#
+#   {"message":"Resource not accessible by integration",...,"status":"403"}0
+#
+# every `[ ... -gt ... ]` then failed as a non-integer comparison, the `if` took
+# its false branch, and the step printed "CodeQL gate passed (0 alerts)" and
+# exited 0. Observed live in a GREEN run (34700514102 / job 103571322660), while
+# the repository had an open high-severity alert.
+#
+# A security gate that cannot read its input must stop the build, not wave it
+# through. This test pins both halves of that: the permission that makes the
+# read possible, and the fail-closed handling for when it still is not.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+python3 - "$ROOT" <<'PY'
+from __future__ import annotations
+
+import pathlib
+import re
+import sys
+
+root = pathlib.Path(sys.argv[1])
+failures: list[str] = []
+
+
+def require(condition: bool, message: str) -> None:
+    if not condition:
+        failures.append(message)
+
+
+workflow = (root / ".github" / "workflows" / "_security.yml").read_text(encoding="utf-8")
+
+# Isolate the codeql-gate job so a permission granted to some OTHER job cannot
+# satisfy this test.
+gate = re.search(r"\n  codeql-gate:\n(?P<body>(?:    .*\n|\n)*)", workflow)
+require(gate is not None, "_security.yml no longer defines a codeql-gate job")
+body = gate.group("body") if gate else ""
+
+# 1. The read has to be possible at all.
+require(
+    re.search(r"^    permissions:\s*$", body, re.M) is not None,
+    "codeql-gate must declare its own permissions block -- inheriting the "
+    "workflow default leaves it without security-events access and the alert "
+    "API answers 403",
+)
+require(
+    re.search(r"^      security-events:\s*read\s*$", body, re.M) is not None,
+    "codeql-gate must request security-events: read, or the code-scanning "
+    "alert query 403s and the gate cannot see any alert",
+)
+
+# 2. The failure direction. `|| echo "0"` on the alert query is the specific
+#    construct that turned an API error into a clean pass.
+require(
+    re.search(r"code-scanning/alerts[^\n]*\|\|\s*echo", body) is None,
+    "the alert count must not fall back to a literal on error -- an unreadable "
+    "alert list is not zero alerts",
+)
+require(
+    "BLOCKED: cannot read code scanning alerts" in body,
+    "codeql-gate must fail with a named error when the alert API cannot be read",
+)
+require(
+    re.search(r"alert count was not a number", body) is not None,
+    "codeql-gate must reject a non-numeric alert count instead of comparing it",
+)
+
+# 3. The count is produced in a command substitution, so a bare `exit` inside
+#    the helper would end only the subshell and let the caller proceed with an
+#    empty value -- the same class of silent pass. The callers must check.
+assignments = re.findall(r"^\s*ALERTS2?=\$\(count_open_alerts\)(.*)$", body, re.M)
+require(
+    len(assignments) >= 2,
+    "expected both alert samples to go through the checked helper",
+)
+require(
+    all("|| exit 1" in tail for tail in assignments),
+    "every count_open_alerts call must be followed by || exit 1 -- a failure "
+    "inside a command substitution does not stop the caller on its own",
+)
+
+# 4. Every caller must GRANT what the job requests. A reusable workflow cannot
+#    request more permission than its caller holds: asking for
+#    security-events:read from a caller that grants only contents:read does not
+#    downgrade, it fails the entire run with a startup_failure before a single
+#    job executes. Checking only the called workflow is how this test passed
+#    while the PR pipeline never started.
+#    The caller list is DERIVED, never hardcoded. An earlier revision listed
+#    ("pr.yml", "release.yml") by hand and stayed green while dry-run.yml -- a
+#    third caller nobody had listed -- failed every run at startup. A test that
+#    only checks the callers you remembered cannot catch the one you forgot.
+workflow_dir = root / ".github" / "workflows"
+callers = sorted(
+    path.name
+    for path in workflow_dir.glob("*.yml")
+    if "uses: ./.github/workflows/_security.yml" in path.read_text(encoding="utf-8")
+)
+require(
+    len(callers) >= 3,
+    "expected at least 3 callers of _security.yml, found: "
+    + (", ".join(callers) or "none")
+    + " -- if a caller was deliberately removed, lower this floor on purpose",
+)
+
+for caller_name in callers:
+    caller = (workflow_dir / caller_name).read_text(encoding="utf-8")
+    # The next sibling may be a comment line, not a key, so the lookahead has to
+    # accept any 2-space-indented non-space -- matching only `  \w` silently
+    # failed to find release.yml's job at all.
+    call = re.search(
+        r"\n  security:\n(?P<body>(?:    .*\n|\n)*?)(?=\n?  \S|\Z)", caller
+    )
+    require(call is not None, f"{caller_name} no longer has a security: job")
+    call_body = call.group("body") if call else ""
+    require(
+        "uses: ./.github/workflows/_security.yml" in call_body,
+        f"{caller_name}'s security job must call _security.yml",
+    )
+    require(
+        re.search(r"^      security-events:\s*read\s*$", call_body, re.M) is not None,
+        f"{caller_name} must grant security-events: read to the security job -- "
+        "a called workflow cannot request more than its caller grants, and the "
+        "run fails at startup rather than degrading",
+    )
+    require(
+        re.search(r"^      actions:\s*read\s*$", call_body, re.M) is not None,
+        f"{caller_name} must grant actions: read to the security job",
+    )
+
+if failures:
+    print("Security gate fail-closed contract FAILED:")
+    for failure in failures:
+        print(f"  - {failure}")
+    sys.exit(1)
+
+print("Security gate fail-closed contract passed")
+PY
diff --git a/tests/test_semantic.c b/tests/test_semantic.c
index d1bf7b54b..e56c02c23 100644
--- a/tests/test_semantic.c
+++ b/tests/test_semantic.c
@@ -328,6 +328,33 @@ TEST(sem_corpus_idf) {
     PASS();
 }
 
+/* The vector build resolves each token once and reads idf and vector by index
+ * (pass_semantic_edges.c): the index accessors must give the same answers as
+ * the name-keyed ones, before and after finalize, and agree on unknown tokens. */
+TEST(sem_corpus_index_accessors_match_name_lookups) {
+    cbm_sem_corpus_t *c = cbm_sem_corpus_new();
+    ASSERT_NOT_NULL(c);
+    const char *doc1[] = {"alpha", "beta", "gamma"};
+    const char *doc2[] = {"alpha", "delta", "beta"};
+    const char *doc3[] = {"epsilon", "alpha"};
+    cbm_sem_corpus_add_doc(c, doc1, 3);
+    cbm_sem_corpus_add_doc(c, doc2, 3);
+    cbm_sem_corpus_add_doc(c, doc3, 2);
+    static const char *const probe[] = {"alpha", "beta", "gamma", "delta", "epsilon", "absent"};
+    for (int round = 0; round < 2; round++) {
+        for (size_t i = 0; i < sizeof(probe) / sizeof(probe[0]); i++) {
+            int idx = cbm_sem_corpus_token_index(c, probe[i]);
+            ASSERT_FLOAT_EQ(cbm_sem_corpus_idf_at(c, idx), cbm_sem_corpus_idf(c, probe[i]), 0.0);
+            ASSERT_TRUE(cbm_sem_corpus_ri_vec_at(c, idx) == cbm_sem_corpus_ri_vec(c, probe[i]));
+        }
+        ASSERT_EQ(cbm_sem_corpus_token_index(c, "absent"), -1);
+        ASSERT_NULL(cbm_sem_corpus_ri_vec_at(c, -1));
+        cbm_sem_corpus_finalize(c); /* second round: the finalized corpus */
+    }
+    cbm_sem_corpus_free(c);
+    PASS();
+}
+
 TEST(sem_corpus_add_null_doc) {
     cbm_sem_corpus_t *c = cbm_sem_corpus_new();
     ASSERT_NOT_NULL(c);
@@ -503,6 +530,7 @@ SUITE(semantic) {
     RUN_TEST(sem_corpus_new_free);
     RUN_TEST(sem_corpus_add_one_doc);
     RUN_TEST(sem_corpus_idf);
+    RUN_TEST(sem_corpus_index_accessors_match_name_lookups);
     RUN_TEST(sem_corpus_add_null_doc);
     RUN_TEST(sem_corpus_free_null);
     RUN_TEST(sem_get_config_defaults);
diff --git a/tests/test_shell_line_endings.sh b/tests/test_shell_line_endings.sh
index a6f3fc387..1bc38c1c6 100644
--- a/tests/test_shell_line_endings.sh
+++ b/tests/test_shell_line_endings.sh
@@ -12,6 +12,26 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
+# This contract reads REPOSITORY metadata (.gitattributes, through git's own
+# attribute matcher). The Linux container leg mounts the WORKING TREE only, and
+# a git worktree's .git is a file pointing at the host's main repository, which
+# is not inside the container — so `git ls-files` cannot run there at all
+# (verified 2026-09-17: `fatal: not a git repository`). The property is
+# platform-independent and stays gated in every venue that has the metadata:
+# the macOS host leg, the Windows VM (a real checkout at C:\cbm — 117 files
+# checked there), and every hosted-CI checkout.
+# Tried and rejected: mounting the host .git into the container — the worktree
+# gitdir path would have to be reproduced inside, and container-root writes to
+# the host repository are worse than a scoped skip; and matching .gitattributes
+# patterns ourselves, which is a partial copy of git's attribute semantics and
+# so a false-green risk. tests/test_version_metadata_contract.sh guards the
+# same way for the same reason.
+if ! git rev-parse --git-dir >/dev/null 2>&1; then
+    echo "SKIP: no repository metadata in this checkout (working tree without" \
+        "its git dir) — the line-ending contract gates on the host leg and CI"
+    exit 0
+fi
+
 failures=0
 checked=0
 while IFS= read -r -d '' path &&
diff --git a/tests/test_simhash.c b/tests/test_simhash.c
index 9f17576bf..a7f538d4c 100644
--- a/tests/test_simhash.c
+++ b/tests/test_simhash.c
@@ -69,118 +69,118 @@ static int count_similar_to_edges(const cbm_gbuf_t *gb) {
 /* Large Go function template for fingerprint tests.  Must have enough
  * structural diversity (>= 32 unique structural trigrams) after leaf-only
  * tokenisation and normalisation. */
-#define GO_VALIDATE_USER_SRC \
-    "package main\n" \
-    "import \"errors\"\n" \
-    "import \"strings\"\n" \
-    "func ValidateUser(u User) error {\n" \
-    "    if u.Name == \"\" {\n" \
-    "        return errors.New(\"name required\")\n" \
-    "    }\n" \
-    "    if len(u.Name) > 100 {\n" \
-    "        return errors.New(\"name too long\")\n" \
-    "    }\n" \
-    "    if u.Age < 0 {\n" \
-    "        return errors.New(\"invalid age\")\n" \
-    "    }\n" \
-    "    if u.Age > 200 {\n" \
-    "        return errors.New(\"age too high\")\n" \
-    "    }\n" \
-    "    if u.Email == \"\" {\n" \
-    "        return errors.New(\"email required\")\n" \
-    "    }\n" \
-    "    if !strings.Contains(u.Email, \"@\") {\n" \
-    "        return errors.New(\"invalid email\")\n" \
-    "    }\n" \
-    "    if u.Phone == \"\" {\n" \
-    "        return errors.New(\"phone required\")\n" \
-    "    }\n" \
-    "    if len(u.Phone) < 7 {\n" \
-    "        return errors.New(\"phone too short\")\n" \
-    "    }\n" \
-    "    if u.Country == \"\" {\n" \
+#define GO_VALIDATE_USER_SRC                            \
+    "package main\n"                                    \
+    "import \"errors\"\n"                               \
+    "import \"strings\"\n"                              \
+    "func ValidateUser(u User) error {\n"               \
+    "    if u.Name == \"\" {\n"                         \
+    "        return errors.New(\"name required\")\n"    \
+    "    }\n"                                           \
+    "    if len(u.Name) > 100 {\n"                      \
+    "        return errors.New(\"name too long\")\n"    \
+    "    }\n"                                           \
+    "    if u.Age < 0 {\n"                              \
+    "        return errors.New(\"invalid age\")\n"      \
+    "    }\n"                                           \
+    "    if u.Age > 200 {\n"                            \
+    "        return errors.New(\"age too high\")\n"     \
+    "    }\n"                                           \
+    "    if u.Email == \"\" {\n"                        \
+    "        return errors.New(\"email required\")\n"   \
+    "    }\n"                                           \
+    "    if !strings.Contains(u.Email, \"@\") {\n"      \
+    "        return errors.New(\"invalid email\")\n"    \
+    "    }\n"                                           \
+    "    if u.Phone == \"\" {\n"                        \
+    "        return errors.New(\"phone required\")\n"   \
+    "    }\n"                                           \
+    "    if len(u.Phone) < 7 {\n"                       \
+    "        return errors.New(\"phone too short\")\n"  \
+    "    }\n"                                           \
+    "    if u.Country == \"\" {\n"                      \
     "        return errors.New(\"country required\")\n" \
-    "    }\n" \
-    "    for _, c := range u.Tags {\n" \
-    "        if c == \"\" {\n" \
-    "            return errors.New(\"empty tag\")\n" \
-    "        }\n" \
-    "    }\n" \
-    "    return nil\n" \
+    "    }\n"                                           \
+    "    for _, c := range u.Tags {\n"                  \
+    "        if c == \"\" {\n"                          \
+    "            return errors.New(\"empty tag\")\n"    \
+    "        }\n"                                       \
+    "    }\n"                                           \
+    "    return nil\n"                                  \
     "}\n"
 
 /* Same structure, different names/types — near-clone */
-#define GO_VALIDATE_ORDER_SRC \
-    "package main\n" \
-    "import \"errors\"\n" \
-    "import \"strings\"\n" \
-    "func ValidateOrder(o Order) error {\n" \
-    "    if o.Title == \"\" {\n" \
-    "        return errors.New(\"title required\")\n" \
-    "    }\n" \
-    "    if len(o.Title) > 100 {\n" \
-    "        return errors.New(\"title too long\")\n" \
-    "    }\n" \
-    "    if o.Amount < 0 {\n" \
-    "        return errors.New(\"invalid amount\")\n" \
-    "    }\n" \
-    "    if o.Amount > 200 {\n" \
-    "        return errors.New(\"amount too high\")\n" \
-    "    }\n" \
-    "    if o.Status == \"\" {\n" \
-    "        return errors.New(\"status required\")\n" \
-    "    }\n" \
-    "    if !strings.Contains(o.Status, \"@\") {\n" \
-    "        return errors.New(\"invalid status\")\n" \
-    "    }\n" \
-    "    if o.Region == \"\" {\n" \
-    "        return errors.New(\"region required\")\n" \
-    "    }\n" \
-    "    if len(o.Region) < 7 {\n" \
+#define GO_VALIDATE_ORDER_SRC                           \
+    "package main\n"                                    \
+    "import \"errors\"\n"                               \
+    "import \"strings\"\n"                              \
+    "func ValidateOrder(o Order) error {\n"             \
+    "    if o.Title == \"\" {\n"                        \
+    "        return errors.New(\"title required\")\n"   \
+    "    }\n"                                           \
+    "    if len(o.Title) > 100 {\n"                     \
+    "        return errors.New(\"title too long\")\n"   \
+    "    }\n"                                           \
+    "    if o.Amount < 0 {\n"                           \
+    "        return errors.New(\"invalid amount\")\n"   \
+    "    }\n"                                           \
+    "    if o.Amount > 200 {\n"                         \
+    "        return errors.New(\"amount too high\")\n"  \
+    "    }\n"                                           \
+    "    if o.Status == \"\" {\n"                       \
+    "        return errors.New(\"status required\")\n"  \
+    "    }\n"                                           \
+    "    if !strings.Contains(o.Status, \"@\") {\n"     \
+    "        return errors.New(\"invalid status\")\n"   \
+    "    }\n"                                           \
+    "    if o.Region == \"\" {\n"                       \
+    "        return errors.New(\"region required\")\n"  \
+    "    }\n"                                           \
+    "    if len(o.Region) < 7 {\n"                      \
     "        return errors.New(\"region too short\")\n" \
-    "    }\n" \
-    "    if o.Vendor == \"\" {\n" \
-    "        return errors.New(\"vendor required\")\n" \
-    "    }\n" \
-    "    for _, c := range o.Items {\n" \
-    "        if c == \"\" {\n" \
-    "            return errors.New(\"empty item\")\n" \
-    "        }\n" \
-    "    }\n" \
-    "    return nil\n" \
+    "    }\n"                                           \
+    "    if o.Vendor == \"\" {\n"                       \
+    "        return errors.New(\"vendor required\")\n"  \
+    "    }\n"                                           \
+    "    for _, c := range o.Items {\n"                 \
+    "        if c == \"\" {\n"                          \
+    "            return errors.New(\"empty item\")\n"   \
+    "        }\n"                                       \
+    "    }\n"                                           \
+    "    return nil\n"                                  \
     "}\n"
 
 /* Completely different structure */
-#define GO_HANDLE_REQUEST_SRC \
-    "package main\n" \
-    "import \"net/http\"\n" \
-    "import \"encoding/json\"\n" \
-    "import \"io\"\n" \
+#define GO_HANDLE_REQUEST_SRC                                        \
+    "package main\n"                                                 \
+    "import \"net/http\"\n"                                          \
+    "import \"encoding/json\"\n"                                     \
+    "import \"io\"\n"                                                \
     "func HandleRequest(w http.ResponseWriter, r *http.Request) {\n" \
-    "    body, err := io.ReadAll(r.Body)\n" \
-    "    if err != nil {\n" \
-    "        http.Error(w, err.Error(), 400)\n" \
-    "        return\n" \
-    "    }\n" \
-    "    defer r.Body.Close()\n" \
-    "    var data map[string]interface{}\n" \
-    "    if err := json.Unmarshal(body, &data); err != nil {\n" \
-    "        http.Error(w, err.Error(), 400)\n" \
-    "        return\n" \
-    "    }\n" \
-    "    result := make(map[string]interface{})\n" \
-    "    for k, v := range data {\n" \
-    "        switch val := v.(type) {\n" \
-    "        case string:\n" \
-    "            result[k] = strings.ToUpper(val)\n" \
-    "        case float64:\n" \
-    "            result[k] = val * 2\n" \
-    "        default:\n" \
-    "            result[k] = v\n" \
-    "        }\n" \
-    "    }\n" \
-    "    w.Header().Set(\"Content-Type\", \"application/json\")\n" \
-    "    json.NewEncoder(w).Encode(result)\n" \
+    "    body, err := io.ReadAll(r.Body)\n"                          \
+    "    if err != nil {\n"                                          \
+    "        http.Error(w, err.Error(), 400)\n"                      \
+    "        return\n"                                               \
+    "    }\n"                                                        \
+    "    defer r.Body.Close()\n"                                     \
+    "    var data map[string]interface{}\n"                          \
+    "    if err := json.Unmarshal(body, &data); err != nil {\n"      \
+    "        http.Error(w, err.Error(), 400)\n"                      \
+    "        return\n"                                               \
+    "    }\n"                                                        \
+    "    result := make(map[string]interface{})\n"                   \
+    "    for k, v := range data {\n"                                 \
+    "        switch val := v.(type) {\n"                             \
+    "        case string:\n"                                         \
+    "            result[k] = strings.ToUpper(val)\n"                 \
+    "        case float64:\n"                                        \
+    "            result[k] = val * 2\n"                              \
+    "        default:\n"                                             \
+    "            result[k] = v\n"                                    \
+    "        }\n"                                                    \
+    "    }\n"                                                        \
+    "    w.Header().Set(\"Content-Type\", \"application/json\")\n"   \
+    "    json.NewEncoder(w).Encode(result)\n"                        \
     "}\n"
 
 /* ═══════════════════════════════════════════════════════════════════
@@ -205,8 +205,7 @@ TEST(minhash_identical_source_same_fingerprint) {
     ASSERT_EQ(d1->fingerprint_k, CBM_MINHASH_K);
 
     /* Identical source → identical fingerprint */
-    ASSERT_MEM_EQ(d1->fingerprint, d2->fingerprint,
-                  (size_t)CBM_MINHASH_K * sizeof(uint32_t));
+    ASSERT_MEM_EQ(d1->fingerprint, d2->fingerprint, (size_t)CBM_MINHASH_K * sizeof(uint32_t));
 
     cbm_free_result(r1);
     cbm_free_result(r2);
@@ -230,9 +229,8 @@ TEST(minhash_renamed_vars_same_fingerprint) {
     ASSERT_NOT_NULL(da->fingerprint);
     ASSERT_NOT_NULL(db->fingerprint);
 
-    double j = cbm_minhash_jaccard(
-        (const cbm_minhash_t *)da->fingerprint,
-        (const cbm_minhash_t *)db->fingerprint);
+    double j = cbm_minhash_jaccard((const cbm_minhash_t *)da->fingerprint,
+                                   (const cbm_minhash_t *)db->fingerprint);
     /* Renamed vars + same structure → very high Jaccard */
     ASSERT_TRUE(j >= 0.90);
 
@@ -258,9 +256,8 @@ TEST(minhash_different_code_different_fingerprint) {
     ASSERT_NOT_NULL(da->fingerprint);
     ASSERT_NOT_NULL(db->fingerprint);
 
-    double j = cbm_minhash_jaccard(
-        (const cbm_minhash_t *)da->fingerprint,
-        (const cbm_minhash_t *)db->fingerprint);
+    double j = cbm_minhash_jaccard((const cbm_minhash_t *)da->fingerprint,
+                                   (const cbm_minhash_t *)db->fingerprint);
     /* Different structure → low Jaccard */
     ASSERT_TRUE(j < 0.5);
 
@@ -274,48 +271,47 @@ TEST(minhash_minor_edit_high_jaccard) {
     const char *src_a = GO_VALIDATE_USER_SRC;
 
     /* ValidateUser with one extra check added at the end */
-    const char *src_b =
-        "package main\n"
-        "import \"errors\"\n"
-        "import \"strings\"\n"
-        "func ValidateUser(u User) error {\n"
-        "    if u.Name == \"\" {\n"
-        "        return errors.New(\"name required\")\n"
-        "    }\n"
-        "    if len(u.Name) > 100 {\n"
-        "        return errors.New(\"name too long\")\n"
-        "    }\n"
-        "    if u.Age < 0 {\n"
-        "        return errors.New(\"invalid age\")\n"
-        "    }\n"
-        "    if u.Age > 200 {\n"
-        "        return errors.New(\"age too high\")\n"
-        "    }\n"
-        "    if u.Email == \"\" {\n"
-        "        return errors.New(\"email required\")\n"
-        "    }\n"
-        "    if !strings.Contains(u.Email, \"@\") {\n"
-        "        return errors.New(\"invalid email\")\n"
-        "    }\n"
-        "    if u.Phone == \"\" {\n"
-        "        return errors.New(\"phone required\")\n"
-        "    }\n"
-        "    if len(u.Phone) < 7 {\n"
-        "        return errors.New(\"phone too short\")\n"
-        "    }\n"
-        "    if u.Country == \"\" {\n"
-        "        return errors.New(\"country required\")\n"
-        "    }\n"
-        "    for _, c := range u.Tags {\n"
-        "        if c == \"\" {\n"
-        "            return errors.New(\"empty tag\")\n"
-        "        }\n"
-        "    }\n"
-        "    if u.Active == false {\n"
-        "        return errors.New(\"user inactive\")\n"
-        "    }\n"
-        "    return nil\n"
-        "}\n";
+    const char *src_b = "package main\n"
+                        "import \"errors\"\n"
+                        "import \"strings\"\n"
+                        "func ValidateUser(u User) error {\n"
+                        "    if u.Name == \"\" {\n"
+                        "        return errors.New(\"name required\")\n"
+                        "    }\n"
+                        "    if len(u.Name) > 100 {\n"
+                        "        return errors.New(\"name too long\")\n"
+                        "    }\n"
+                        "    if u.Age < 0 {\n"
+                        "        return errors.New(\"invalid age\")\n"
+                        "    }\n"
+                        "    if u.Age > 200 {\n"
+                        "        return errors.New(\"age too high\")\n"
+                        "    }\n"
+                        "    if u.Email == \"\" {\n"
+                        "        return errors.New(\"email required\")\n"
+                        "    }\n"
+                        "    if !strings.Contains(u.Email, \"@\") {\n"
+                        "        return errors.New(\"invalid email\")\n"
+                        "    }\n"
+                        "    if u.Phone == \"\" {\n"
+                        "        return errors.New(\"phone required\")\n"
+                        "    }\n"
+                        "    if len(u.Phone) < 7 {\n"
+                        "        return errors.New(\"phone too short\")\n"
+                        "    }\n"
+                        "    if u.Country == \"\" {\n"
+                        "        return errors.New(\"country required\")\n"
+                        "    }\n"
+                        "    for _, c := range u.Tags {\n"
+                        "        if c == \"\" {\n"
+                        "            return errors.New(\"empty tag\")\n"
+                        "        }\n"
+                        "    }\n"
+                        "    if u.Active == false {\n"
+                        "        return errors.New(\"user inactive\")\n"
+                        "    }\n"
+                        "    return nil\n"
+                        "}\n";
 
     CBMFileResult *ra = extract_one(src_a, CBM_LANG_GO, "test", "a.go");
     CBMFileResult *rb = extract_one(src_b, CBM_LANG_GO, "test", "b.go");
@@ -329,9 +325,8 @@ TEST(minhash_minor_edit_high_jaccard) {
     ASSERT_NOT_NULL(da->fingerprint);
     ASSERT_NOT_NULL(db->fingerprint);
 
-    double j = cbm_minhash_jaccard(
-        (const cbm_minhash_t *)da->fingerprint,
-        (const cbm_minhash_t *)db->fingerprint);
+    double j = cbm_minhash_jaccard((const cbm_minhash_t *)da->fingerprint,
+                                   (const cbm_minhash_t *)db->fingerprint);
     /* Minor edit → moderately high Jaccard.  Trigram-based MinHash
      * is sensitive to insertions (shifts the trigram window), so a
      * single added statement may drop Jaccard more than expected.
@@ -348,9 +343,8 @@ TEST(minhash_minor_edit_high_jaccard) {
  * Note: even a 2-line Go function can have 15+ AST nodes (Go's AST is verbose).
  * Use a truly minimal function to test the threshold. */
 TEST(minhash_empty_body_skipped) {
-    const char *src =
-        "package main\n"
-        "func Noop() {}\n";
+    const char *src = "package main\n"
+                      "func Noop() {}\n";
 
     CBMFileResult *r = extract_one(src, CBM_LANG_GO, "test", "tiny.go");
     ASSERT_NOT_NULL(r);
@@ -384,9 +378,8 @@ TEST(minhash_type_annotation_normalized) {
     ASSERT_NOT_NULL(da->fingerprint);
     ASSERT_NOT_NULL(db->fingerprint);
 
-    double j = cbm_minhash_jaccard(
-        (const cbm_minhash_t *)da->fingerprint,
-        (const cbm_minhash_t *)db->fingerprint);
+    double j = cbm_minhash_jaccard((const cbm_minhash_t *)da->fingerprint,
+                                   (const cbm_minhash_t *)db->fingerprint);
     /* Type annotations normalised → high Jaccard */
     ASSERT_TRUE(j >= 0.90);
 
@@ -710,7 +703,8 @@ TEST(pass_similarity_edge_properties) {
     make_fp_props(props_b, sizeof(props_b), &fp_b);
 
     cbm_gbuf_t *gb = cbm_gbuf_new("test", "/tmp");
-    int64_t id_a = cbm_gbuf_upsert_node(gb, "Function", "foo", "test.a.foo", "a.go", 1, 10, props_a);
+    int64_t id_a =
+        cbm_gbuf_upsert_node(gb, "Function", "foo", "test.a.foo", "a.go", 1, 10, props_a);
     cbm_gbuf_upsert_node(gb, "Function", "bar", "test.b.bar", "b.go", 1, 10, props_b);
 
     atomic_int cancelled = 0;
@@ -856,7 +850,8 @@ static int setup_sim_test_repo(void) {
 
     /* Near-clone: ValidateUser and ValidateOrder have same structure, different names.
      * Must be large enough (>= 30 leaf tokens, >= 32 unique structural trigrams). */
-    th_write_file(TH_PATH(g_sim_tmpdir, "pkg/validation/user_validator.go"),
+    th_write_file(
+        TH_PATH(g_sim_tmpdir, "pkg/validation/user_validator.go"),
         "package validation\n"
         "import \"errors\"\n"
         "import \"strings\"\n"
@@ -876,7 +871,8 @@ static int setup_sim_test_repo(void) {
         "    return nil\n"
         "}\n");
 
-    th_write_file(TH_PATH(g_sim_tmpdir, "pkg/validation/order_validator.go"),
+    th_write_file(
+        TH_PATH(g_sim_tmpdir, "pkg/validation/order_validator.go"),
         "package validation\n"
         "import \"errors\"\n"
         "import \"strings\"\n"
@@ -897,17 +893,15 @@ static int setup_sim_test_repo(void) {
         "}\n");
 
     /* Completely different function — also large enough for fingerprinting */
-    th_write_file(TH_PATH(g_sim_tmpdir, "pkg/handler/user_handler.go"),
-        GO_HANDLE_REQUEST_SRC);
+    th_write_file(TH_PATH(g_sim_tmpdir, "pkg/handler/user_handler.go"), GO_HANDLE_REQUEST_SRC);
 
     /* Tiny function — should be skipped */
-    th_write_file(TH_PATH(g_sim_tmpdir, "pkg/util/tiny_helper.go"),
-        "package util\n"
-        "\n"
-        "func Max(a, b int) int {\n"
-        "    if a > b { return a }\n"
-        "    return b\n"
-        "}\n");
+    th_write_file(TH_PATH(g_sim_tmpdir, "pkg/util/tiny_helper.go"), "package util\n"
+                                                                    "\n"
+                                                                    "func Max(a, b int) int {\n"
+                                                                    "    if a > b { return a }\n"
+                                                                    "    return b\n"
+                                                                    "}\n");
 
     return 0;
 }
@@ -976,44 +970,42 @@ TEST(pipeline_minhash_no_false_positives) {
     }
 
     /* 5 diverse functions — no clones */
-    th_write_file(TH_PATH(g_sim_tmpdir, "a.go"),
-        "package main\n"
-        "func SortSlice(s []int) {\n"
-        "    for i := 0; i < len(s); i++ {\n"
-        "        for j := i+1; j < len(s); j++ {\n"
-        "            if s[i] > s[j] {\n"
-        "                s[i], s[j] = s[j], s[i]\n"
-        "            }\n"
-        "        }\n"
-        "    }\n"
-        "}\n");
+    th_write_file(TH_PATH(g_sim_tmpdir, "a.go"), "package main\n"
+                                                 "func SortSlice(s []int) {\n"
+                                                 "    for i := 0; i < len(s); i++ {\n"
+                                                 "        for j := i+1; j < len(s); j++ {\n"
+                                                 "            if s[i] > s[j] {\n"
+                                                 "                s[i], s[j] = s[j], s[i]\n"
+                                                 "            }\n"
+                                                 "        }\n"
+                                                 "    }\n"
+                                                 "}\n");
 
     th_write_file(TH_PATH(g_sim_tmpdir, "b.go"),
-        "package main\n"
-        "import \"net/http\"\n"
-        "func ServeAPI(mux *http.ServeMux) {\n"
-        "    mux.HandleFunc(\"/health\", func(w http.ResponseWriter, r *http.Request) {\n"
-        "        w.WriteHeader(200)\n"
-        "        w.Write([]byte(\"ok\"))\n"
-        "    })\n"
-        "    mux.HandleFunc(\"/ready\", func(w http.ResponseWriter, r *http.Request) {\n"
-        "        w.WriteHeader(200)\n"
-        "        w.Write([]byte(\"ready\"))\n"
-        "    })\n"
-        "}\n");
+                  "package main\n"
+                  "import \"net/http\"\n"
+                  "func ServeAPI(mux *http.ServeMux) {\n"
+                  "    mux.HandleFunc(\"/health\", func(w http.ResponseWriter, r *http.Request) {\n"
+                  "        w.WriteHeader(200)\n"
+                  "        w.Write([]byte(\"ok\"))\n"
+                  "    })\n"
+                  "    mux.HandleFunc(\"/ready\", func(w http.ResponseWriter, r *http.Request) {\n"
+                  "        w.WriteHeader(200)\n"
+                  "        w.Write([]byte(\"ready\"))\n"
+                  "    })\n"
+                  "}\n");
 
-    th_write_file(TH_PATH(g_sim_tmpdir, "c.go"),
-        "package main\n"
-        "import \"fmt\"\n"
-        "func PrintTree(node *Node, depth int) {\n"
-        "    for i := 0; i < depth; i++ {\n"
-        "        fmt.Print(\"  \")\n"
-        "    }\n"
-        "    fmt.Println(node.Value)\n"
-        "    for _, child := range node.Children {\n"
-        "        PrintTree(child, depth+1)\n"
-        "    }\n"
-        "}\n");
+    th_write_file(TH_PATH(g_sim_tmpdir, "c.go"), "package main\n"
+                                                 "import \"fmt\"\n"
+                                                 "func PrintTree(node *Node, depth int) {\n"
+                                                 "    for i := 0; i < depth; i++ {\n"
+                                                 "        fmt.Print(\"  \")\n"
+                                                 "    }\n"
+                                                 "    fmt.Println(node.Value)\n"
+                                                 "    for _, child := range node.Children {\n"
+                                                 "        PrintTree(child, depth+1)\n"
+                                                 "    }\n"
+                                                 "}\n");
 
     char db_path[512];
     snprintf(db_path, sizeof(db_path), "%s/test.db", g_sim_tmpdir);
@@ -1029,7 +1021,8 @@ TEST(pipeline_minhash_no_false_positives) {
 
     cbm_edge_t *edges = NULL;
     int edge_count = 0;
-    cbm_store_find_edges_by_type(s, cbm_pipeline_project_name(p), "SIMILAR_TO", &edges, &edge_count);
+    cbm_store_find_edges_by_type(s, cbm_pipeline_project_name(p), "SIMILAR_TO", &edges,
+                                 &edge_count);
 
     ASSERT_EQ(edge_count, 0); /* No clones → no SIMILAR_TO edges */
 
@@ -1072,17 +1065,17 @@ TEST(pipeline_minhash_incremental) {
 
     /* Step 2: Modify order_validator.go to be completely different */
     th_write_file(TH_PATH(g_sim_tmpdir, "pkg/validation/order_validator.go"),
-        "package validation\n"
-        "\n"
-        "import \"net/http\"\n"
-        "\n"
-        "func HandleOrder(w http.ResponseWriter, r *http.Request) {\n"
-        "    data := make(map[string]interface{})\n"
-        "    for k, v := range r.URL.Query() {\n"
-        "        data[k] = v[0]\n"
-        "    }\n"
-        "    w.Header().Set(\"Content-Type\", \"application/json\")\n"
-        "}\n");
+                  "package validation\n"
+                  "\n"
+                  "import \"net/http\"\n"
+                  "\n"
+                  "func HandleOrder(w http.ResponseWriter, r *http.Request) {\n"
+                  "    data := make(map[string]interface{})\n"
+                  "    for k, v := range r.URL.Query() {\n"
+                  "        data[k] = v[0]\n"
+                  "    }\n"
+                  "    w.Header().Set(\"Content-Type\", \"application/json\")\n"
+                  "}\n");
 
     /* Step 3: Incremental reindex */
     cbm_pipeline_t *p2 = cbm_pipeline_new(g_sim_tmpdir, db_path, CBM_MODE_FULL);
@@ -1132,7 +1125,8 @@ TEST(pipeline_minhash_incremental_new_clone) {
     cbm_pipeline_free(p1);
 
     /* Step 2: Add a new near-clone of ValidateUser */
-    th_write_file(TH_PATH(g_sim_tmpdir, "pkg/validation/address_validator.go"),
+    th_write_file(
+        TH_PATH(g_sim_tmpdir, "pkg/validation/address_validator.go"),
         "package validation\n"
         "import \"errors\"\n"
         "import \"strings\"\n"
@@ -1178,6 +1172,48 @@ TEST(pipeline_minhash_incremental_new_clone) {
  * Suite Registration
  * ═══════════════════════════════════════════════════════════════════ */
 
+/* The reused dedup set answers exactly what a fresh one does, query after
+ * query: same candidates, same order, no leakage between queries. */
+TEST(lsh_reused_seen_set_matches_fresh_query) {
+    enum { ENTRY_COUNT = 40, QUERIES = 6 };
+    static cbm_minhash_t fps[ENTRY_COUNT];
+    static cbm_lsh_entry_t entries[ENTRY_COUNT];
+    cbm_lsh_index_t *idx = cbm_lsh_new();
+    for (int e = 0; e < ENTRY_COUNT; e++) {
+        for (int i = 0; i < CBM_MINHASH_K; i++) {
+            /* Neighbouring entries share most values, so buckets collide and
+             * the same candidate turns up through several bands. */
+            fps[e].values[i] = (uint32_t)((i * 7 + 13) + (i % 4 == 0 ? e / 3 : 0));
+        }
+        entries[e].node_id = e + 1;
+        entries[e].fingerprint = &fps[e];
+        entries[e].file_path = "a.go";
+        entries[e].file_ext = ".go";
+        entries[e].qualified_name = "pkg.fn";
+        cbm_lsh_insert(idx, &entries[e]);
+    }
+
+    cbm_lsh_seen_t *seen = cbm_lsh_seen_new();
+    ASSERT_NOT_NULL(seen);
+    enum { CAP = 64 };
+    const cbm_lsh_entry_t *fresh_buf[CAP];
+    const cbm_lsh_entry_t *reused_buf[CAP];
+    int total = 0;
+    for (int q = 0; q < QUERIES; q++) {
+        int fresh = cbm_lsh_query_into(idx, &fps[q * 3], fresh_buf, CAP);
+        int reused = cbm_lsh_query_into_seen(idx, &fps[q * 3], reused_buf, CAP, seen);
+        ASSERT_EQ(reused, fresh);
+        for (int i = 0; i < fresh; i++) {
+            ASSERT_EQ(reused_buf[i]->node_id, fresh_buf[i]->node_id);
+        }
+        total += fresh;
+    }
+    ASSERT_GT(total, 0); /* the queries really returned candidates */
+    cbm_lsh_seen_free(seen);
+    cbm_lsh_free(idx);
+    PASS();
+}
+
 SUITE(simhash) {
     /* Suite 1: MinHash Core */
     RUN_TEST(minhash_identical_source_same_fingerprint);
@@ -1194,6 +1230,7 @@ SUITE(simhash) {
     RUN_TEST(minhash_hex_roundtrip);
     RUN_TEST(lsh_same_bucket_similar);
     RUN_TEST(lsh_different_bucket_dissimilar);
+    RUN_TEST(lsh_reused_seen_set_matches_fresh_query);
     RUN_TEST(lsh_index_build_and_query);
 
     /* Suite 3: Edge Generation */
diff --git a/tests/test_smoke_runtime_isolation_contract.sh b/tests/test_smoke_runtime_isolation_contract.sh
new file mode 100755
index 000000000..31ba7a7b6
--- /dev/null
+++ b/tests/test_smoke_runtime_isolation_contract.sh
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Runtime-isolation contract for the smoke harness (#1696, follow-up to #1691).
+#
+# scripts/smoke-test.sh is the process that actually starts the product during
+# a smoke run, and it retires "the account daemon" seven times through
+# `daemon stop`. Its wrappers sandbox HOME/XDG/TMPDIR and CBM_CACHE_DIR, but
+# only CBM_RUNTIME_DIR moves the daemon rendezvous (docs/CONFIGURATION.md), so
+# without a private runtime every one of those stops lands on the operator's
+# live daemon. Drive the harness with an environment-probe fixture and require
+# that no product process ever receives the caller's runtime or cache.
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "$WORKDIR"' EXIT
+
+fail() {
+    echo "FAIL: $*" >&2
+    exit 1
+}
+
+normalize_path() {
+    local path=${1%$'\r'}
+    if command -v cygpath >/dev/null 2>&1; then
+        cygpath -u "$path" 2>/dev/null && return 0
+    fi
+    printf '%s\n' "${path//\\//}"
+}
+
+ENV_PROBE="$WORKDIR/environment-probe"
+cat > "$ENV_PROBE" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\t%s\n' "${CBM_CACHE_DIR-}" "${CBM_RUNTIME_DIR-}" >> "$CBM_SMOKE_ENV_PROBE"
+case "${1-}" in
+    --version) echo "v0.0.0-probe"; exit 0 ;;
+    daemon) [[ "${2-}" == status ]] && exit 1; exit 0 ;;
+esac
+echo '{}'
+exit 0
+EOF
+chmod +x "$ENV_PROBE"
+
+CALLER_CACHE="$WORKDIR/caller-cache"
+CALLER_RUNTIME="$WORKDIR/caller-runtime"
+ENV_LOG="$WORKDIR/environment.log"
+mkdir -p "$CALLER_CACHE" "$CALLER_RUNTIME"
+
+# The fixture answers nothing beyond --version, so the smoke fails early; only
+# the environment it handed to the product is under test here.
+CBM_CACHE_DIR="$CALLER_CACHE" \
+CBM_RUNTIME_DIR="$CALLER_RUNTIME" \
+CBM_SMOKE_ENV_PROBE="$ENV_LOG" \
+    "$ROOT/scripts/smoke-test.sh" "$ENV_PROBE" > "$WORKDIR/smoke.out" 2>&1 || true
+
+[[ -s "$ENV_LOG" ]] || fail "smoke-test did not execute the environment-probe fixture"
+
+CALLER_CACHE_NORMALIZED=$(normalize_path "$CALLER_CACHE")
+CALLER_RUNTIME_NORMALIZED=$(normalize_path "$CALLER_RUNTIME")
+private_root=""
+while IFS=$'\t' read -r child_cache_raw child_runtime_raw; do
+    child_cache=$(normalize_path "$child_cache_raw")
+    child_runtime=$(normalize_path "$child_runtime_raw")
+    if [[ -z "$child_runtime" || "$child_runtime" == "$CALLER_RUNTIME_NORMALIZED" ]]; then
+        fail "smoke-test exposed the caller CBM_RUNTIME_DIR to a product process"
+    fi
+    if [[ -z "$child_cache" || "$child_cache" == "$CALLER_CACHE_NORMALIZED" ]]; then
+        fail "smoke-test exposed the caller CBM_CACHE_DIR to a product process"
+    fi
+    if [[ "${child_runtime%/*}" != "${child_cache%/*}" ||
+          "${child_runtime##*/}" != "runtime" || "${child_cache##*/}" != "cache" ]]; then
+        fail "smoke runtime/cache were not isolated beneath one private root"
+    fi
+    if [[ -n "$private_root" && "$private_root" != "${child_runtime%/*}" ]]; then
+        fail "smoke-test switched private roots mid-run"
+    fi
+    private_root="${child_runtime%/*}"
+done < "$ENV_LOG"
+
+[[ ! -e "$private_root" ]] || fail "smoke-test left its private root behind: $private_root"
+
+# The run above exits through the fixture trap, so it cannot show what happens
+# to the private root when the harness dies before that trap exists — the
+# fixture mktemp and its cygpath conversion are in that window, and under
+# `set -e` either can end the run. Reproducing that failure would mean scanning
+# the shared /tmp parent for orphaned roots, which races every other harness
+# test in the same suite, so pin the ordering instead: the cleanup trap is
+# armed between the init call and the first fixture work.
+smoke="$ROOT/scripts/smoke-test.sh"
+smoke_line_of() {
+    # A missing pattern is the failure this check reports, not a reason to end
+    # the test silently under `set -e`.
+    grep -n "$1" "$smoke" | head -1 | cut -d: -f1 || true
+}
+init_line=$(smoke_line_of '^cbm_test_runtime_init$')
+early_trap_line=$(smoke_line_of "^trap 'cbm_test_runtime_cleanup \"\$BINARY\"' EXIT\$")
+fixture_line=$(smoke_line_of '^TMPDIR=\$(smoke_mktemp_dir)$')
+if [[ -z "$init_line" || -z "$early_trap_line" || -z "$fixture_line" ]] ||
+    ((early_trap_line < init_line || early_trap_line > fixture_line)); then
+    fail "smoke-test must arm the runtime cleanup trap between cbm_test_runtime_init and its first fixture"
+fi
+
+echo "PASS: smoke harness isolates its daemon runtime and cache from the caller"
diff --git a/tests/test_soak_runtime_isolation_contract.sh b/tests/test_soak_runtime_isolation_contract.sh
new file mode 100755
index 000000000..340df7f0a
--- /dev/null
+++ b/tests/test_soak_runtime_isolation_contract.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Runtime-isolation contract for the soak harness (#1696, follow-up to #1691).
+#
+# scripts/soak-test.sh must be the only client of the daemon it measures: it
+# asserts that a session crash and the final shutdown each stop "the daemon".
+# It used to claim isolation from interactive sessions through a private
+# CBM_CACHE_DIR, but only CBM_RUNTIME_DIR moves the daemon rendezvous
+# (docs/CONFIGURATION.md), so the soak shared the operator's account daemon
+# and either stopped it or was refused with a cache-root conflict. Drive the
+# harness with an environment-probe fixture and require that no product
+# process ever receives the caller's runtime or cache.
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "$WORKDIR"' EXIT
+
+fail() {
+    echo "FAIL: $*" >&2
+    exit 1
+}
+
+normalize_path() {
+    local path=${1%$'\r'}
+    if command -v cygpath >/dev/null 2>&1; then
+        cygpath -u "$path" 2>/dev/null && return 0
+    fi
+    printf '%s\n' "${path//\\//}"
+}
+
+ENV_PROBE="$WORKDIR/environment-probe"
+cat > "$ENV_PROBE" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\t%s\n' "${CBM_CACHE_DIR-}" "${CBM_RUNTIME_DIR-}" >> "$CBM_SOAK_ENV_PROBE"
+[[ "${1-} ${2-}" == "daemon status" ]] && exit 1
+exit 0
+EOF
+chmod +x "$ENV_PROBE"
+
+CALLER_CACHE="$WORKDIR/caller-cache"
+CALLER_RUNTIME="$WORKDIR/caller-runtime"
+ENV_LOG="$WORKDIR/environment.log"
+mkdir -p "$CALLER_CACHE" "$CALLER_RUNTIME"
+
+# The fixture exits as soon as it has recorded its environment, so the soak
+# fails at "server did not start"; only the environment it handed to the
+# product is under test here. RESULTS_DIR keeps the soak's metrics out of cwd.
+CBM_CACHE_DIR="$CALLER_CACHE" \
+CBM_RUNTIME_DIR="$CALLER_RUNTIME" \
+CBM_SOAK_ENV_PROBE="$ENV_LOG" \
+RESULTS_DIR="$WORKDIR/results" \
+    "$ROOT/scripts/soak-test.sh" "$ENV_PROBE" 1 --skip-crash-test \
+    > "$WORKDIR/soak.out" 2>&1 || true
+
+[[ -s "$ENV_LOG" ]] || fail "soak-test did not execute the environment-probe fixture"
+
+CALLER_CACHE_NORMALIZED=$(normalize_path "$CALLER_CACHE")
+CALLER_RUNTIME_NORMALIZED=$(normalize_path "$CALLER_RUNTIME")
+private_root=""
+while IFS=$'\t' read -r child_cache_raw child_runtime_raw; do
+    child_cache=$(normalize_path "$child_cache_raw")
+    child_runtime=$(normalize_path "$child_runtime_raw")
+    if [[ -z "$child_runtime" || "$child_runtime" == "$CALLER_RUNTIME_NORMALIZED" ]]; then
+        fail "soak-test exposed the caller CBM_RUNTIME_DIR to a product process"
+    fi
+    if [[ -z "$child_cache" || "$child_cache" == "$CALLER_CACHE_NORMALIZED" ]]; then
+        fail "soak-test exposed the caller CBM_CACHE_DIR to a product process"
+    fi
+    if [[ "${child_runtime%/*}" != "${child_cache%/*}" ||
+          "${child_runtime##*/}" != "runtime" || "${child_cache##*/}" != "cache" ]]; then
+        fail "soak runtime/cache were not isolated beneath one private root"
+    fi
+    if [[ -n "$private_root" && "$private_root" != "${child_runtime%/*}" ]]; then
+        fail "soak-test switched private roots mid-run"
+    fi
+    private_root="${child_runtime%/*}"
+done < "$ENV_LOG"
+
+[[ ! -e "$private_root" ]] || fail "soak-test left its private root behind: $private_root"
+
+echo "PASS: soak harness isolates its daemon runtime and cache from the caller"
diff --git a/tests/test_sqlite_writer.c b/tests/test_sqlite_writer.c
index 1084d0529..a80fee059 100644
--- a/tests/test_sqlite_writer.c
+++ b/tests/test_sqlite_writer.c
@@ -13,6 +13,7 @@
 /* sqlite_writer.h is at internal/cbm/ — Makefile adds -Iinternal/cbm */
 #include "sqlite_writer.h" /* CBMDumpNode, CBMDumpEdge, cbm_write_db */
 #include "sqlite3.h"       /* vendored/sqlite3/ via -Ivendored/sqlite3 */
+#include <errno.h>
 #include <unistd.h>
 
 /* ── Helper: create temp file path ─────────────────────────────── */
@@ -101,6 +102,45 @@ static int count_temp_outputs_for(const char *path) {
     return count;
 }
 
+/* Locate the writer's temp output for `path`. Same naming rule as
+ * count_temp_outputs_for, but returns the full path of the first match. */
+static int find_temp_output_for(const char *path, char *out, size_t out_size) {
+    char dir[256];
+    char base[256];
+    const char *slash = strrchr(path, '/');
+    if (slash) {
+        size_t dir_len = (size_t)(slash - path);
+        if (dir_len == 0 || dir_len >= sizeof(dir)) {
+            return -1;
+        }
+        memcpy(dir, path, dir_len);
+        dir[dir_len] = '\0';
+        snprintf(base, sizeof(base), "%s", slash + 1);
+    } else {
+        snprintf(dir, sizeof(dir), ".");
+        snprintf(base, sizeof(base), "%s", path);
+    }
+
+    cbm_dir_t *d = cbm_opendir(dir);
+    if (!d) {
+        return -1;
+    }
+    size_t base_len = strlen(base);
+    int found = -1;
+    cbm_dirent_t *ent;
+    while ((ent = cbm_readdir(d)) != NULL) {
+        size_t name_len = strlen(ent->name);
+        if (name_len > base_len + 5 && strncmp(ent->name, base, base_len) == 0 &&
+            strncmp(ent->name + base_len, ".tmp.", 5) == 0) {
+            snprintf(out, out_size, "%s/%s", dir, ent->name);
+            found = 0;
+            break;
+        }
+    }
+    cbm_closedir(d);
+    return found;
+}
+
 /* ── Tests ─────────────────────────────────────────────────────── */
 
 TEST(sw_minimal_data) {
@@ -877,6 +917,61 @@ TEST(sw_publish_preserves_live_reader) {
 
 /* ── Suite ─────────────────────────────────────────────────────── */
 
+TEST(sw_open_truncated_path_names_its_reason) {
+    /* final_path is a fixed 4K buffer and make_writer_temp_path only fails by
+     * truncation. Neither sets an errno of its own, so without naming one the
+     * caller reports whatever was left behind by an unrelated call. */
+    char longpath[5000];
+    memset(longpath, 'a', sizeof(longpath) - 1);
+    longpath[sizeof(longpath) - 1] = '\0';
+    longpath[0] = '/';
+
+    errno = 0;
+    cbm_db_writer_t *w = cbm_writer_open(longpath);
+    ASSERT(w == NULL);
+    ASSERT_EQ(errno, ENAMETOOLONG);
+    PASS();
+}
+
+TEST(sw_publish_failure_reports_the_rename_not_the_cleanup) {
+#ifdef _WIN32
+    SKIP_PLATFORM("removing a still-open file to make the cleanup unlink fail");
+#endif
+    char dir[256];
+    snprintf(dir, sizeof(dir), "/tmp/cbm_sw_cleanup_XXXXXX");
+    ASSERT(cbm_mkdtemp(dir) != NULL);
+
+    char final_path[320];
+    snprintf(final_path, sizeof(final_path), "%s/db.sqlite", dir);
+    ASSERT_EQ(write_fixture_file(final_path, "destination"), 0);
+
+    cbm_db_writer_t *w = cbm_writer_open(final_path);
+    ASSERT(w != NULL);
+
+    /* Turn the still-open temp into a directory. The publish rename then fails
+     * with ENOTDIR (directory onto a file), and the cleanup unlink fails too
+     * (EISDIR on Linux, EPERM on macOS) — so only a saved errno still carries
+     * the rename's reason out to the caller. */
+    char temp[512];
+    ASSERT_EQ(find_temp_output_for(final_path, temp, sizeof(temp)), 0);
+    ASSERT_EQ(cbm_unlink(temp), 0);
+    ASSERT(cbm_mkdir_p(temp, 0700));
+
+    errno = 0;
+    int rc = cbm_writer_finalize(w, "test", "/tmp/test", "2026-07-07T00:00:00Z", NULL, 0, NULL, 0,
+                                 NULL, 0, NULL, 0);
+    int publish_errno = errno;
+    ASSERT(rc != 0);
+    ASSERT_EQ(publish_errno, ENOTDIR);
+    /* The destination is intact: a failed publish never replaces it. */
+    ASSERT(fixture_file_equals(final_path, "destination"));
+
+    cbm_rmdir(temp);
+    cbm_unlink(final_path);
+    cbm_rmdir(dir);
+    PASS();
+}
+
 SUITE(sqlite_writer) {
     RUN_TEST(sw_minimal_data);
     RUN_TEST(sw_imports_local_name_unique);
@@ -890,4 +985,6 @@ SUITE(sqlite_writer) {
     RUN_TEST(sw_publish_failure_preserves_destination_sidecars);
     RUN_TEST(sw_publish_supports_non_ascii_path);
     RUN_TEST(sw_publish_preserves_live_reader);
+    RUN_TEST(sw_open_truncated_path_names_its_reason);
+    RUN_TEST(sw_publish_failure_reports_the_rename_not_the_cleanup);
 }
diff --git a/tests/test_str_util.c b/tests/test_str_util.c
index cd6f54210..7ad729df9 100644
--- a/tests/test_str_util.c
+++ b/tests/test_str_util.c
@@ -436,6 +436,30 @@ TEST(json_escape_control_chars) {
     PASS();
 }
 
+/* A truncated escape must never end inside a multibyte UTF-8 sequence: the
+ * callee text of a CALLS edge is escaped into a fixed buffer, and a cut umlaut
+ * persisted bytes SQLite could not decode as text (2026-09-16 probe: rust,
+ * java and typescript stores). "aé" is a, 0xC3, 0xA9. */
+TEST(json_escape_never_splits_utf8) {
+    char buf[3]; /* room for two payload bytes + NUL: the lead byte would fit, its continuation not
+                  */
+    int len = cbm_json_escape(buf, sizeof(buf), "a\xC3\xA9");
+    ASSERT_STR_EQ(buf, "a");
+    ASSERT_EQ(len, 1);
+
+    char whole[4];
+    len = cbm_json_escape(whole, sizeof(whole), "a\xC3\xA9");
+    ASSERT_STR_EQ(whole, "a\xC3\xA9");
+    ASSERT_EQ(len, 3);
+
+    /* A four-byte sequence cut after two bytes is dropped whole. */
+    char emoji[3];
+    len = cbm_json_escape(emoji, sizeof(emoji), "\xF0\x9F\x98\x80z");
+    ASSERT_STR_EQ(emoji, "");
+    ASSERT_EQ(len, 0);
+    PASS();
+}
+
 /* ── SNPRINTF_APPEND tests ────────────────────────────────────── */
 
 TEST(snprintf_append_basic) {
@@ -547,6 +571,7 @@ SUITE(str_util) {
     RUN_TEST(validate_shell_arg_spaces);
     /* JSON Escaping */
     RUN_TEST(json_escape_control_chars);
+    RUN_TEST(json_escape_never_splits_utf8);
     /* SNPRINTF_APPEND */
     RUN_TEST(snprintf_append_basic);
     RUN_TEST(snprintf_append_fills_exactly);
diff --git a/tests/test_subprocess.c b/tests/test_subprocess.c
index 1554821c6..308d6b584 100644
--- a/tests/test_subprocess.c
+++ b/tests/test_subprocess.c
@@ -25,6 +25,7 @@
 #include <unistd.h>
 #else
 #include <windows.h>
+#include "../src/foundation/win_utf8.h"
 #endif
 
 /* ── Layer 1: pure classifier (all platforms) ─────────────────────────────── */
@@ -279,10 +280,20 @@ TEST(subprocess_run_spawn_failure) {
 TEST(subprocess_run_null_bin_rejected) {
     cbm_proc_opts_t opts = {0};
     opts.bin = NULL;
-    cbm_proc_result_t r;
+    /* Reusing a previous result must not expose stale Job Object diagnostics
+     * when validation rejects the next spawn before a process exists. */
+    cbm_proc_result_t r = {
+        .job_memory_limit_bytes = 123,
+        .peak_job_memory_bytes = 456,
+        .job_memory_available = true,
+    };
     int rc = cbm_subprocess_run(&opts, &r);
     ASSERT_EQ(rc, -1);
     ASSERT_EQ(r.outcome, CBM_PROC_SPAWN_FAILED);
+    ASSERT_EQ(r.exit_code, -1);
+    ASSERT_TRUE(r.job_memory_limit_bytes == 0);
+    ASSERT_TRUE(r.peak_job_memory_bytes == 0);
+    ASSERT_FALSE(r.job_memory_available);
     PASS();
 }
 
@@ -744,6 +755,46 @@ TEST(subprocess_windows_job_object_cancellation_quiesces_descendant_tree) {
 #endif
 }
 
+TEST(subprocess_windows_job_object_enforces_memory_limit) {
+#ifndef _WIN32
+    SKIP_PLATFORM("native Windows Job Object memory-limit probe");
+#else
+    char *self_path = cbm_module_path_utf8();
+    ASSERT_TRUE(self_path != NULL);
+    const char *argv[] = {self_path, "__cbm_windows_memory_limit_probe", NULL};
+    cbm_proc_opts_t opts = {0};
+    opts.bin = self_path;
+    opts.argv = argv;
+    opts.quiet_timeout_ms = 5000;
+
+    /* Without the cap the SAME allocation must succeed. A machine-wide commit
+     * shortage must fail this test, not masquerade as Job Object enforcement. */
+    cbm_proc_result_t uncapped = {0};
+    int uncapped_rc = cbm_subprocess_run(&opts, &uncapped);
+    opts.memory_limit_bytes = (size_t)1024U * 1024U * 1024U;
+    cbm_proc_result_t result = {0};
+    int run_rc = cbm_subprocess_run(&opts, &result);
+    free(self_path);
+    ASSERT_EQ(uncapped_rc, 0);
+    ASSERT_EQ(uncapped.outcome, CBM_PROC_CLEAN);
+    ASSERT_EQ(uncapped.exit_code, 0);
+    ASSERT_TRUE(uncapped.tree_quiesced);
+    ASSERT_FALSE(uncapped.supervision_failed);
+    ASSERT_TRUE(uncapped.job_memory_limit_bytes == 0);
+    ASSERT_EQ(run_rc, 0);
+    ASSERT_EQ(result.outcome, CBM_PROC_EXIT_NONZERO);
+    ASSERT_EQ(result.exit_code, 73);
+    ASSERT_TRUE(result.tree_quiesced);
+    ASSERT_FALSE(result.supervision_failed);
+    ASSERT_TRUE(result.job_memory_available);
+    ASSERT_TRUE(result.job_memory_limit_bytes == opts.memory_limit_bytes);
+    ASSERT_TRUE(result.peak_job_memory_bytes > 0);
+    /* Windows may include the denied reservation in its peak counter, so peak
+     * can exceed the cap. The uncapped/capped exit codes prove enforcement. */
+    PASS();
+#endif
+}
+
 TEST(subprocess_cancel_grace_is_hard_capped) {
 #ifdef _WIN32
     SKIP_PLATFORM("POSIX process-group grace cap probe; native Windows coverage pending");
@@ -1228,6 +1279,7 @@ SUITE(subprocess) {
     RUN_TEST(subprocess_cancel_is_idempotent_and_kills_ignoring_tree);
     RUN_TEST(subprocess_quiet_timeout_kills_ignoring_tree);
     RUN_TEST(subprocess_windows_job_object_cancellation_quiesces_descendant_tree);
+    RUN_TEST(subprocess_windows_job_object_enforces_memory_limit);
     RUN_TEST(subprocess_cancel_grace_is_hard_capped);
     RUN_TEST(subprocess_poll_log_delivery_is_bounded_and_terminal_is_lossless);
     RUN_TEST(subprocess_final_log_drain_error_is_terminal_and_preserves_classification);
diff --git a/tests/test_thread_stack_tls_contract.sh b/tests/test_thread_stack_tls_contract.sh
new file mode 100755
index 000000000..9dd516db4
--- /dev/null
+++ b/tests/test_thread_stack_tls_contract.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Static TLS must fit inside the SMALLEST stack any thread asks for.
+#
+# Why this exists: glibc places a thread's static TLS block inside the stack
+# allocation it makes for that thread. So growing a thread-local — anywhere in
+# the image, in a file that has nothing to do with threads — silently shrinks
+# the usable stack of every thread, and once the block no longer fits the
+# smallest requested stack, pthread_create returns EINVAL for that thread and
+# ONLY that thread.
+#
+# What that looked like in practice (PR #2233): ~45 KB of new thread-local
+# caches (a 512-slot field cache, per-depth tree cursors and two parked arenas —
+# a CBMArena is ~4 KB because it carries blocks[256] + block_sizes[256]) pushed
+# static TLS from 47.9 KB to 93.5 KB. The 64 KB parent-death watchdog thread
+# then could not start, the index worker correctly refused to run without
+# process-tree containment and SIGKILLed its own group, and every venue reported
+# the same uninformative "index worker ended with killed (signal 9)". Local
+# macOS and arm64 Linux legs were fully green throughout: nothing on the ladder
+# built x86-64, and the arm64 TLS layout stayed just under the line.
+#
+# The gate: PT_TLS MemSiz of the built product binary must stay a safe margin
+# below the smallest stack size the code requests for a thread. That is an ELF
+# property, so the check is Linux-only; the macOS host leg skips with a reason
+# (Mach-O has no PT_TLS, and its TLS is not carved from the thread stack).
+#
+# Usage: tests/test_thread_stack_tls_contract.sh [binary]
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BINARY="${1:-${CBM_TEST_BINARY:-}}"
+
+if [ -z "$BINARY" ] || [ ! -f "$BINARY" ]; then
+    echo "FAIL: no product binary to inspect (pass one, or set CBM_TEST_BINARY)" >&2
+    exit 1
+fi
+
+case "$(uname -s)" in
+Linux) ;;
+*)
+    echo "SKIP: static-TLS budget is an ELF/glibc property (Mach-O keeps TLS off" \
+        "the thread stack) — the Linux legs own this contract"
+    exit 0
+    ;;
+esac
+
+if ! command -v readelf >/dev/null 2>&1; then
+    echo "SKIP: readelf not available to read PT_TLS"
+    exit 0
+fi
+
+# The smallest stack the code asks for, read from the source rather than
+# duplicated here: a future smaller stack must tighten this gate automatically.
+smallest_kb=$(grep -ho '[A-Z_]*STACK_SIZE = [0-9]* \* CBM_SZ_1K' "$ROOT"/src/*.c "$ROOT"/src/*/*.c |
+    sed 's/.* = \([0-9]*\) \* CBM_SZ_1K/\1/' | sort -n | head -1)
+if [ -z "$smallest_kb" ]; then
+    echo "FAIL: could not find any <NAME>_STACK_SIZE in the sources — the gate lost its input" >&2
+    exit 1
+fi
+smallest=$((smallest_kb * 1024))
+
+tls_hex=$(readelf -lW "$BINARY" | awk '$1 == "TLS" { print $6 }' | head -1)
+if [ -z "$tls_hex" ]; then
+    echo "SKIP: binary has no PT_TLS segment (nothing to bound)"
+    exit 0
+fi
+tls=$((tls_hex))
+
+# The thread descriptor and guard share that allocation too, so the budget is
+# not the whole stack. A quarter of it is reserve enough to notice growth long
+# before a thread stops being creatable.
+budget=$((smallest - smallest / 4))
+
+echo "static TLS ${tls} bytes; smallest requested thread stack ${smallest} bytes; budget ${budget}"
+if [ "$tls" -ge "$budget" ]; then
+    echo "FAIL: static TLS (${tls} B) is within a quarter of the smallest thread stack" \
+        "(${smallest} B). glibc takes the TLS block out of that stack, so this is how" \
+        "a thread silently stops being creatable — move large thread-locals to the" \
+        "heap behind a thread-local POINTER (see cbm.c's field cache/cursor pool)." >&2
+    exit 1
+fi
+echo "Thread-stack TLS contract passed"
diff --git a/tests/test_ts_lsp.c b/tests/test_ts_lsp.c
index 52c3bbacb..b5e38b592 100644
--- a/tests/test_ts_lsp.c
+++ b/tests/test_ts_lsp.c
@@ -729,6 +729,17 @@ TEST(tslsp_nocrash_megasource) {
 
 /* ── Category 11: generics (deeper) ─────────────────────────────────────────── */
 
+TEST(tslsp_await_generic_call_issue2210) {
+    CBMFileResult *r = extract_ts("function parseJsonBody<T>(): T { return null as T; }\n"
+                                  "async function plain() { return await parseJsonBody(); }\n"
+                                  "async function generic() { return await parseJsonBody<string>(); }\n");
+    ASSERT_NOT_NULL(r);
+    ASSERT_TRUE(find_resolved(r, "plain", "parseJsonBody") >= 0);
+    ASSERT_TRUE(find_resolved(r, "generic", "parseJsonBody") >= 0);
+    cbm_free_result(r);
+    PASS();
+}
+
 TEST(tslsp_generic_identity_inference) {
     CBMFileResult *r = extract_ts("function identity<T>(x: T): T { return x; }\n"
                                   "class Box { use(): void {} }\n"
@@ -4316,6 +4327,8 @@ SUITE(ts_lsp) {
     RUN_TEST(tslsp_nocrash_using_decl);
     RUN_TEST(tslsp_nocrash_megasource);
 
+    RUN_TEST(tslsp_await_generic_call_issue2210);
+
     /* Category 11: generics deeper */
     RUN_TEST(tslsp_generic_identity_inference);
     RUN_TEST(tslsp_generic_array_map_chain);
diff --git a/tests/test_venue_parity_contract.sh b/tests/test_venue_parity_contract.sh
index 4bcd694d7..81e431a1e 100755
--- a/tests/test_venue_parity_contract.sh
+++ b/tests/test_venue_parity_contract.sh
@@ -47,7 +47,11 @@ failures: list[str] = []
 
 # ── The canonical leg entries (the ONLY product-exercising calls allowed) ──
 CANONICAL = re.compile(
-    r"scripts/(test|build|lint|clean|smoke-local|soak-legs|smoke-invariants|package-release)\.sh"
+    # fuzz.sh and memwaste.sh own their legs end to end (build, corpus/binary,
+    # artifact paths, exit code), exactly as soak-legs.sh owns the soak — the
+    # venue passes shape flags and collects the report, nothing more.
+    r"scripts/(test|build|lint|clean|smoke-local|soak-legs|smoke-invariants"
+    r"|package-release|fuzz|memwaste)\.sh"
     r"|test-infrastructure/vm/vm-smoke\.sh"
     r"|scripts/ci/[a-z0-9-]+\.(sh|ps1|py)"
     r"|scripts/security-[a-z0-9-]+\.sh"
@@ -78,7 +82,7 @@ FORBIDDEN = [
 VENUE_WORKFLOWS = [
     "pr.yml", "dry-run.yml", "release.yml", "nightly-soak.yml",
     "_test.yml", "_smoke.yml", "_soak.yml", "_build.yml", "_lint.yml",
-    "smoke.yml",
+    "smoke.yml", "_memwaste.yml",
 ]
 
 # Provisioning / plumbing commands a venue may run (first word of a line).
@@ -391,6 +395,8 @@ scripts/ci/verify-shard-union.sh
 scripts/ci/generate-sbom.py
 scripts/package-release.sh
 scripts/ci/smoke-artifact.sh
+scripts/fuzz.sh
+scripts/memwaste.sh
 test-infrastructure/run.sh
 test-infrastructure/vm/vm-smoke.sh
 test-infrastructure/vm/vm-run-tests.sh
@@ -428,6 +434,8 @@ scripts/soak-legs.sh
 scripts/ci/preflight-docker.sh
 test-infrastructure/vm/vm-smoke.sh
 scripts/smoke-invariants.sh
+scripts/fuzz.sh
+scripts/memwaste.sh
 "
     for entry in $STRICT_ENTRIES; do
         out=$(cd "$ROOT" && bash "$entry" --definitely-not-a-flag 2>&1) && rc=0 || rc=$?
diff --git a/tests/test_vm_verdict_contract.sh b/tests/test_vm_verdict_contract.sh
new file mode 100755
index 000000000..275f865e8
--- /dev/null
+++ b/tests/test_vm_verdict_contract.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# The Windows leg's verdict must not be decided by the exit status alone.
+#
+# Why: that status travels ssh -> cmd.exe -> msys2_shell.cmd and the chain
+# loses it. On 2026-09-18 a leg that printed "7925 passed, 0 failed" and
+# "=== All tests passed ===" exited 1, while the identical work run through
+# win.sh's other entry exited 0. A channel that turns 0 into 1 can turn 1 into
+# 0, and that direction is a FALSE GREEN: a red Windows leg reported as
+# passing, which is exactly the class of defect the local ladder exists to
+# catch. The log is written by the runner on the VM and cannot be mangled in
+# transit, so it decides the test outcome; rc only decides what the log cannot
+# see.
+#
+# This drives the REAL function (vm-run-tests.sh --verdict) rather than a copy,
+# so the contract cannot drift from the code it pins.
+#
+# Usage: tests/test_vm_verdict_contract.sh [repo-root]
+
+set -uo pipefail
+
+ROOT="${1:-$(cd "$(dirname "$0")/.." && pwd)}"
+RUNNER="$ROOT/test-infrastructure/vm/vm-run-tests.sh"
+if [ ! -f "$RUNNER" ]; then
+    echo "FAIL: $RUNNER not found" >&2
+    exit 1
+fi
+
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/cbm-vm-verdict.XXXXXX") || exit 1
+trap 'rm -rf "$WORK"' EXIT
+
+printf '  7925 passed, 0 failed, 74 skipped\n=== All tests passed ===\n' > "$WORK/green"
+printf '  7863 passed, 1 failed, 74 skipped\n' > "$WORK/red"
+printf '  7863 passed, 1 failed\n=== All tests passed ===\n' > "$WORK/red_with_marker"
+printf '  100 passed, 0 failed\n  200 passed, 3 failed\n=== All tests passed ===\n' > "$WORK/red_later_suite"
+printf '  7925 passed, 0 failed, 74 skipped\n' > "$WORK/no_marker"
+printf 'configure: something exploded\n' > "$WORK/no_summary"
+
+failures=0
+expect() { # description log rc want [mode]
+    local description="$1" log="$2" rc="$3" want="$4" mode="${5:-full}" got
+    bash "$RUNNER" --verdict "$WORK/$log" "$rc" "$mode" >/dev/null 2>&1
+    got=$?
+    if [ "$got" -ne "$want" ]; then
+        echo "FAIL: $description — verdict $got, expected $want" >&2
+        failures=$((failures + 1))
+    fi
+}
+
+# The observed fault: a complete, green log whose exit status was lost. The
+# leg is green; the transport problem is reported, not the tests.
+expect "green log with a lost exit status is green" green 1 0
+expect "green log with a clean exit status is green" green 0 0
+
+# The dangerous direction. A zero exit status must never launder failures.
+expect "failures in the log are red even when rc says 0" red 0 1
+expect "failures in the log are red when rc says 1" red 1 1
+expect "a completion marker cannot launder failures" red_with_marker 0 1
+expect "failures in a LATER suite are still counted" red_later_suite 0 1
+
+# Incomplete runs are never green: a leg that stopped after one suite has a
+# summary but no marker.
+expect "a summary without the completion marker is red" no_marker 0 1
+
+# No summary at all keeps its own distinct code, so "never ran" stays
+# distinguishable from "ran and failed".
+expect "a log with no summary is the no-summary guard" no_summary 0 90
+
+# Iteration mode: `test.sh --suites` finishes after the suites it was named and
+# prints no completion marker, because it has no end to reach. Demanding one
+# turned a passing subset run into a failure — 23 passed, 1 skipped, rc=0,
+# reported red (win.sh test artifact, 2026-09-19). A guard against false greens
+# must not invent false reds, so the marker is required of the full leg only.
+expect "a subset run with no marker is green in iteration mode" no_marker 0 0 iteration
+expect "the same log is still red for the full leg" no_marker 0 1 full
+# Without a marker to lean on, rc is the only evidence left that a subset run
+# ended badly after its last summary, so iteration mode obeys it.
+expect "a non-zero status is red in iteration mode" no_marker 1 1 iteration
+# Failures still outrank everything, in either mode.
+expect "failures are red in iteration mode too" red 0 1 iteration
+
+if [ "$failures" -gt 0 ]; then
+    echo "VM verdict contract VIOLATED: $failures case(s)" >&2
+    exit 1
+fi
+echo "VM verdict contract passed (12 cases: lost exit status, false green, partial runs, iteration mode)"
diff --git a/tests/test_watcher.c b/tests/test_watcher.c
index b6cc364dd..5ca2d95e8 100644
--- a/tests/test_watcher.c
+++ b/tests/test_watcher.c
@@ -7,6 +7,7 @@
 #include "../src/foundation/compat.h"
 #include "../src/foundation/compat_thread.h"
 #include "../src/foundation/constants.h"
+#include "../src/foundation/log.h"
 #include "../src/foundation/platform.h"
 #include "test_framework.h"
 #include "test_helpers.h"
@@ -15,6 +16,7 @@
 #include <pipeline/artifact.h>
 #include <store/store.h>
 #include <errno.h>
+#include <limits.h>
 #include <stdatomic.h>
 #include <signal.h>
 #include <string.h>
@@ -86,6 +88,71 @@ TEST(poll_interval_small) {
     PASS();
 }
 
+/* ══════════════════════════════════════════════════════════════════
+ *  HARD INDEX-FAILURE BACKOFF
+ * ══════════════════════════════════════════════════════════════════ */
+
+TEST(index_backoff_no_failures_keeps_interval) {
+    /* The success and busy-skip paths must be completely unaffected. */
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, 0), 5000);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(60000, 0), 60000);
+    PASS();
+}
+
+TEST(index_backoff_doubles_per_failure) {
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, 1), 10000);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, 2), 20000);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, 3), 40000);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, 4), 80000);
+    PASS();
+}
+
+TEST(index_backoff_reaches_ceiling_and_stays) {
+    /* 5000 << 6 = 320000, above the 5-minute ceiling. The shift is capped
+     * too, so an arbitrarily long failure streak cannot overflow the
+     * intermediate value or wrap back to a short delay. */
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, 6), 300000);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, 100), 300000);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, INT_MAX), 300000);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(60000, INT_MAX), 300000);
+    PASS();
+}
+
+TEST(index_backoff_is_monotonic_and_bounded) {
+    /* The property that actually matters: the delay never decreases as the
+     * streak grows, and never exceeds the ceiling. This is what bounds the
+     * fork rate of a permanently failing project. */
+    int previous = cbm_watcher_index_backoff_ms(5000, 0);
+    for (int failures = 1; failures < 200; failures++) {
+        int delay = cbm_watcher_index_backoff_ms(5000, failures);
+        ASSERT_TRUE(delay >= previous);
+        ASSERT_TRUE(delay <= 300000);
+        previous = delay;
+    }
+    PASS();
+}
+
+TEST(index_backoff_degenerate_inputs) {
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(0, 5), 0);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(-1, 0), 0);
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(5000, -1), 5000);
+    PASS();
+}
+
+TEST(index_backoff_never_schedules_sooner_than_the_interval) {
+    /* An interval above the ceiling must not be SHORTENED by backing off:
+     * the clamp is a floor as well as a cap. Not reachable while
+     * POLL_MAX_MS < the ceiling, but the helper is exported, so its contract
+     * has to hold for what a caller can pass, not only for what today's
+     * constants produce. */
+    int over = 400000; /* > INDEX_FAIL_CEILING_MS */
+    ASSERT_EQ(cbm_watcher_index_backoff_ms(over, 0), over);
+    for (int failures = 1; failures < 20; failures++) {
+        ASSERT_TRUE(cbm_watcher_index_backoff_ms(over, failures) >= over);
+    }
+    PASS();
+}
+
 /* ══════════════════════════════════════════════════════════════════
  *  LIFECYCLE
  * ══════════════════════════════════════════════════════════════════ */
@@ -1864,6 +1931,243 @@ TEST(watcher_failed_reindex_retries_issue937) {
     PASS();
 }
 
+/* The failure state machine the backoff feeds (#2015): the streak must count
+ * consecutive HARD failures and reset the moment one reindex succeeds. The
+ * delay it computes is covered by the index_backoff_* unit tests; what is
+ * covered here is the counter that selects which delay applies, because a
+ * streak that never increments — or never resets — silently reverts the
+ * backoff to the unbounded retry it exists to prevent, with every other test
+ * still green. Each poll is preceded by cbm_watcher_touch, which zeroes
+ * next_poll_ns, so this exercises the counter without depending on a clock. */
+TEST(watcher_index_failure_streak_increments_and_resets_issue2015) {
+    char tmpdir[256];
+    snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_strk_XXXXXX");
+    if (!cbm_mkdtemp(tmpdir))
+        FAIL("cbm_mkdtemp failed");
+
+    if (wt_git(tmpdir, "init -q") != 0) {
+        th_rmtree(tmpdir);
+        FAIL("git init failed");
+    }
+    {
+        char p[300];
+        th_write_file(wt_path(p, sizeof(p), tmpdir, "file.txt"), "hello\n");
+    }
+    wt_git(tmpdir, "add file.txt");
+    wt_git(tmpdir, "commit -q -m init");
+
+    cbm_store_t *store = cbm_store_open_memory();
+    cbm_watcher_t *w = cbm_watcher_new(store, failing_index_callback, NULL);
+
+    cbm_watcher_watch(w, "strk-repo", tmpdir);
+    failing_index_calls = 0;
+    failing_index_fail_first_n = 2; /* first TWO reindex attempts fail hard */
+
+    /* Baseline (clean tree): no reindex, so no failures yet. */
+    cbm_watcher_poll_once(w);
+    ASSERT_EQ(failing_index_calls, 0);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "strk-repo"), 0);
+
+    /* HEAD moves. */
+    {
+        char p[300];
+        th_append_file(wt_path(p, sizeof(p), tmpdir, "file.txt"), "world\n");
+    }
+    wt_git(tmpdir, "add file.txt");
+    wt_git(tmpdir, "commit -q -m add-world");
+
+    /* First hard failure → streak 1. */
+    cbm_watcher_touch(w, "strk-repo");
+    cbm_watcher_poll_once(w);
+    ASSERT_EQ(failing_index_calls, 1);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "strk-repo"), 1);
+
+    /* Second consecutive hard failure → streak 2 (it accumulates; it is not
+     * a boolean, which is what makes the delay grow). */
+    cbm_watcher_touch(w, "strk-repo");
+    cbm_watcher_poll_once(w);
+    ASSERT_EQ(failing_index_calls, 2);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "strk-repo"), 2);
+
+    /* Third attempt succeeds → streak resets, so a project that recovers
+     * returns to its normal cadence instead of staying backed off. */
+    cbm_watcher_touch(w, "strk-repo");
+    cbm_watcher_poll_once(w);
+    ASSERT_EQ(failing_index_calls, 3);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "strk-repo"), 0);
+
+    cbm_watcher_free(w);
+    cbm_store_close(store);
+    th_rmtree(tmpdir);
+    PASS();
+}
+
+/* The delay WIRE-UP (#2015): a hard failure must leave SOME deadline behind,
+ * so the failing project is not re-polled on the very next cycle. Observable
+ * without a clock by simply not calling cbm_watcher_touch between polls —
+ * touch zeroes next_poll_ns, so a wire-up that never assigns one leaves it at
+ * 0 and the callback fires on every poll.
+ *
+ * Be precise about what this does NOT prove, because it is less than it looks.
+ * The code before this change also assigned a deadline here (the plain
+ * adaptive interval), so this test passes against the unfixed tree: it is a
+ * regression guard on the assignment existing, NOT a demonstration of the
+ * backoff.
+ *
+ * Measured, not assumed: replacing the backoff call with the pre-change
+ * `ctx->now + interval_ms * US_PER_MS` leaves this whole suite green at 82/82.
+ * No test in this file fails when the behavioural change is removed — the
+ * index_backoff_* tests still pass because they exercise the pure function
+ * directly, and the streak tests still pass because the counter is unaffected.
+ * What distinguishes backed-off from plain cadence is the delay's MAGNITUDE,
+ * and observing that needs a controllable clock the watcher does not have, or
+ * a further accessor exposing next_poll_ns. Both were judged out of scope; the
+ * gap is recorded here rather than papered over. */
+TEST(watcher_index_failure_backoff_gates_repolling_issue2015) {
+    char tmpdir[256];
+    snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_gate_XXXXXX");
+    if (!cbm_mkdtemp(tmpdir))
+        FAIL("cbm_mkdtemp failed");
+
+    if (wt_git(tmpdir, "init -q") != 0) {
+        th_rmtree(tmpdir);
+        FAIL("git init failed");
+    }
+    {
+        char p[300];
+        th_write_file(wt_path(p, sizeof(p), tmpdir, "file.txt"), "hello\n");
+    }
+    wt_git(tmpdir, "add file.txt");
+    wt_git(tmpdir, "commit -q -m init");
+
+    cbm_store_t *store = cbm_store_open_memory();
+    cbm_watcher_t *w = cbm_watcher_new(store, failing_index_callback, NULL);
+
+    cbm_watcher_watch(w, "gate-repo", tmpdir);
+    failing_index_calls = 0;
+    failing_index_fail_first_n = 100; /* never succeeds */
+
+    cbm_watcher_poll_once(w); /* baseline */
+
+    {
+        char p[300];
+        th_append_file(wt_path(p, sizeof(p), tmpdir, "file.txt"), "world\n");
+    }
+    wt_git(tmpdir, "add file.txt");
+    wt_git(tmpdir, "commit -q -m add-world");
+
+    /* One failure, forced by touch. */
+    cbm_watcher_touch(w, "gate-repo");
+    cbm_watcher_poll_once(w);
+    ASSERT_EQ(failing_index_calls, 1);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "gate-repo"), 1);
+
+    /* Now poll repeatedly WITHOUT touching. The change is still pending (the
+     * baseline stays uncommitted per #937), so the ONLY thing that can stop a
+     * re-fork is the deadline the failure just scheduled. Before the backoff
+     * wire-up existed this project was re-forked at the poll cadence; with no
+     * deadline set at all it would fire on every one of these iterations. */
+    for (int i = 0; i < 5; i++) {
+        cbm_watcher_poll_once(w);
+    }
+    ASSERT_EQ(failing_index_calls, 1);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "gate-repo"), 1);
+
+    /* Control: the watcher is not simply dead — clearing the deadline lets the
+     * retry through, which is what keeps #937's at-least-once guarantee. */
+    cbm_watcher_touch(w, "gate-repo");
+    cbm_watcher_poll_once(w);
+    ASSERT_EQ(failing_index_calls, 2);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "gate-repo"), 2);
+
+    cbm_watcher_free(w);
+    cbm_store_close(store);
+    th_rmtree(tmpdir);
+    PASS();
+}
+
+/* The sustained-failure line must fire EXACTLY once, at the threshold — the
+ * other single-token mutation round 1 named (`==` widened to `>=`) would emit
+ * it on every failure from the threshold onward and turn a one-shot signal
+ * into the log spam the whole change is meant to avoid. */
+static int sustained_log_hits = 0;
+static void sustained_log_sink(const char *line) {
+    if (line && strstr(line, "watcher.index.sustained_failure") != NULL) {
+        sustained_log_hits++;
+    }
+}
+
+TEST(watcher_sustained_failure_logs_once_issue2015) {
+    char tmpdir[256];
+    snprintf(tmpdir, sizeof(tmpdir), "/tmp/cbm_watcher_sust_XXXXXX");
+    if (!cbm_mkdtemp(tmpdir))
+        FAIL("cbm_mkdtemp failed");
+
+    if (wt_git(tmpdir, "init -q") != 0) {
+        th_rmtree(tmpdir);
+        FAIL("git init failed");
+    }
+    {
+        char p[300];
+        th_write_file(wt_path(p, sizeof(p), tmpdir, "file.txt"), "hello\n");
+    }
+    wt_git(tmpdir, "add file.txt");
+    wt_git(tmpdir, "commit -q -m init");
+
+    cbm_store_t *store = cbm_store_open_memory();
+    cbm_watcher_t *w = cbm_watcher_new(store, failing_index_callback, NULL);
+
+    cbm_watcher_watch(w, "sust-repo", tmpdir);
+    failing_index_calls = 0;
+    failing_index_fail_first_n = 100; /* never succeeds */
+
+    cbm_watcher_poll_once(w); /* baseline */
+
+    {
+        char p[300];
+        th_append_file(wt_path(p, sizeof(p), tmpdir, "file.txt"), "world\n");
+    }
+    wt_git(tmpdir, "add file.txt");
+    wt_git(tmpdir, "commit -q -m add-world");
+
+    sustained_log_hits = 0;
+    cbm_log_set_sink(sustained_log_sink);
+
+    /* Drive well past the threshold (10). touch clears the deadline each time
+     * so every iteration actually attempts a reindex. */
+    for (int i = 0; i < 14; i++) {
+        cbm_watcher_touch(w, "sust-repo");
+        cbm_watcher_poll_once(w);
+    }
+
+    cbm_log_set_sink(NULL);
+
+    ASSERT_EQ(failing_index_calls, 14);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "sust-repo"), 14);
+    /* Exactly one, not four (11..14) and not zero. */
+    ASSERT_EQ(sustained_log_hits, 1);
+
+    cbm_watcher_free(w);
+    cbm_store_close(store);
+    th_rmtree(tmpdir);
+    PASS();
+}
+
+TEST(watcher_index_failure_count_unknown_project) {
+    cbm_store_t *store = cbm_store_open_memory();
+    cbm_watcher_t *w = cbm_watcher_new(store, index_callback, NULL);
+
+    /* Unwatched and NULL inputs report -1, distinct from a watched project
+     * sitting at a legitimate 0. */
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, "never-watched"), -1);
+    ASSERT_EQ(cbm_watcher_index_failure_count(w, NULL), -1);
+    ASSERT_EQ(cbm_watcher_index_failure_count(NULL, "x"), -1);
+
+    cbm_watcher_free(w);
+    cbm_store_close(store);
+    PASS();
+}
+
 TEST(watcher_multiple_projects) {
     /* Create two temporary git repos */
     char tmpdirA[256];
@@ -3271,6 +3575,16 @@ SUITE(watcher) {
     RUN_TEST(poll_interval_scaling);
     RUN_TEST(poll_interval_cap);
     RUN_TEST(poll_interval_small);
+    RUN_TEST(index_backoff_no_failures_keeps_interval);
+    RUN_TEST(index_backoff_doubles_per_failure);
+    RUN_TEST(index_backoff_reaches_ceiling_and_stays);
+    RUN_TEST(index_backoff_is_monotonic_and_bounded);
+    RUN_TEST(index_backoff_degenerate_inputs);
+    RUN_TEST(index_backoff_never_schedules_sooner_than_the_interval);
+    RUN_TEST(watcher_index_failure_streak_increments_and_resets_issue2015);
+    RUN_TEST(watcher_index_failure_backoff_gates_repolling_issue2015);
+    RUN_TEST(watcher_sustained_failure_logs_once_issue2015);
+    RUN_TEST(watcher_index_failure_count_unknown_project);
 
     /* Lifecycle */
     RUN_TEST(watcher_create_free);
diff --git a/tests/test_windows_bundle_contract.sh b/tests/test_windows_bundle_contract.sh
index a40ac3083..4c4c681cd 100644
--- a/tests/test_windows_bundle_contract.sh
+++ b/tests/test_windows_bundle_contract.sh
@@ -242,6 +242,38 @@ require(
     "install.ps1 version probes must relax EAP with restore and pre-seed LASTEXITCODE (#1255)",
 )
 
+# ── 3c. The TLS bitmask must not name a protocol schannel cannot negotiate ───
+# Windows 10's schannel has no TLS 1.3 (it arrives with Windows 11 / Server
+# 2022, build 20348). .NET Framework 4.8 still DEFINES SecurityProtocolType
+# .Tls13, so setting the bit succeeds silently and nothing warns -- then the
+# first HTTPS request dies with "Could not create SSL/TLS secure channel",
+# because an unsupported flag in this bitmask is a hard failure rather than a
+# downgrade. That blocked the installer on every Windows 10 machine before it
+# downloaded a single byte (#1856). Pin both halves of the guard: the build
+# gate, and the enum-name probe that keeps the script parsing on 4.7, where
+# Tls13 does not exist.
+require(
+    "[Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13" not in installer,
+    "install.ps1 must not set the TLS 1.3 bit unconditionally -- it hard-fails "
+    "the handshake on Windows 10, whose schannel cannot negotiate it (#1856)",
+)
+require(
+    re.search(r"\[Environment\]::OSVersion\.Version\.Build\s+-ge\s+20348", installer) is not None,
+    "install.ps1 must gate TLS 1.3 on build 20348+ (Windows 11 / Server 2022) (#1856)",
+)
+require(
+    re.search(
+        r"\[enum\]::GetNames\(\[Net\.SecurityProtocolType\]\)\s+-contains\s+'Tls13'", installer
+    )
+    is not None,
+    "install.ps1 must probe the enum before naming Tls13, so it still parses on "
+    ".NET Framework 4.7 where the member is undefined (#1856)",
+)
+require(
+    "[Net.ServicePointManager]::SecurityProtocol = $CbmProtocols" in installer,
+    "install.ps1 must assign the computed protocol set, not a literal bitmask (#1856)",
+)
+
 # ── 4. Package-manager shims resolve the single Windows binary ───────────────
 single_binary_contracts = {
     "pkg/npm/install.js": (
diff --git a/tests/test_worker_error_response.sh b/tests/test_worker_error_response.sh
index 33e2db115..500c57ff7 100755
--- a/tests/test_worker_error_response.sh
+++ b/tests/test_worker_error_response.sh
@@ -48,7 +48,7 @@ trap cleanup EXIT
 
 missing="${tmpdir}/repository-does-not-exist"
 response="${tmpdir}/worker.response"
-args="{\"repo_path\":\"${missing}\",\"mode\":\"fast\"}"
+args="{\"repo_path\":\"${missing}\",\"mode\":\"fast\",$(cbm_test_index_worker_policy_json)}"
 
 if ! CBM_CACHE_DIR="${tmpdir}/cache-worker" \
   "${BINARY}" cli --index-worker \
diff --git a/tests/test_worker_session_scope.sh b/tests/test_worker_session_scope.sh
new file mode 100644
index 000000000..ab018ba76
--- /dev/null
+++ b/tests/test_worker_session_scope.sh
@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# A supervised index worker (`cli --index-worker index_repository ...`) runs in
+# the DAEMON's environment, not the requesting client's. The daemon has already
+# admitted the request under the client's session policy and re-executes the
+# worker with the canonical repo_path in its args, so the worker must scope its
+# own workspace boundary to that request. Before the fix it built an unscoped
+# server, fell back to the process-wide CBM_ALLOWED_ROOT it inherited from the
+# daemon starter, and refused every admitted session outside that root with
+# "... is outside the allowed root". A missing repo_path must fail closed: a
+# worker never indexes under an ambient policy.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BINARY="${CBM_TEST_BINARY:-${ROOT}/build/c/codebase-memory-mcp}"
+if [[ ! -x "${BINARY}" && -x "${BINARY}.exe" ]]; then
+  BINARY="${BINARY}.exe"
+fi
+
+if [[ ! -x "${BINARY}" ]]; then
+  echo "missing binary: ${BINARY}" >&2
+  exit 2
+fi
+
+if command -v shasum >/dev/null 2>&1; then
+  BUILD_FINGERPRINT="$(shasum -a 256 "${BINARY}" | awk '{print $1}')"
+elif command -v sha256sum >/dev/null 2>&1; then
+  BUILD_FINGERPRINT="$(sha256sum "${BINARY}" | awk '{print $1}')"
+elif command -v openssl >/dev/null 2>&1; then
+  BUILD_FINGERPRINT="$(openssl dgst -sha256 "${BINARY}" | awk '{print $NF}')"
+else
+  echo "no SHA-256 command available for worker build binding" >&2
+  exit 2
+fi
+if [[ ! "${BUILD_FINGERPRINT}" =~ ^[0-9a-f]{64}$ ]]; then
+  echo "invalid worker build fingerprint: ${BUILD_FINGERPRINT}" >&2
+  exit 2
+fi
+
+# shellcheck source=../scripts/test-runtime.sh
+source "${ROOT}/scripts/test-runtime.sh"
+cbm_test_runtime_init
+tmpdir="${CBM_TEST_RUNTIME_ROOT}"
+cleanup() {
+  cbm_test_runtime_cleanup "${BINARY}"
+}
+trap cleanup EXIT
+
+# Product-facing path, the way the daemon hands it to the worker: canonical on
+# POSIX, mixed-style on a native Windows binary (test-runtime.sh's convention).
+product_path() {
+  case "$(uname -s)" in
+    MINGW*|MSYS*|CYGWIN*) cygpath -m "$1" ;;
+    *) (cd "$1" && pwd -P) ;;
+  esac
+}
+
+# Root A is what the daemon's starter allowed; the admitted session lives under
+# root B. The two share no prefix.
+mkdir -p "${tmpdir}/root-a" "${tmpdir}/root-b/tiny"
+printf 'int tiny_main(void) { return 0; }\n' >"${tmpdir}/root-b/tiny/tiny.c"
+root_a="$(product_path "${tmpdir}/root-a")"
+repo="$(product_path "${tmpdir}/root-b/tiny")"
+
+run_worker() {
+  local args="$1" response="$2" out="$3" err="$4"
+  CBM_ALLOWED_ROOT="${root_a}" \
+    "${BINARY}" cli --index-worker \
+    --index-worker-build "${BUILD_FINGERPRINT}" \
+    index_repository "${args}" \
+    --response-out "${response}" >"${out}" 2>"${err}"
+}
+
+# A worker never reads the resource policy from config or environment: the
+# supervisor resolves it and sends it inside the request, and a request
+# without one is refused ("missing or incomplete trusted worker policy").
+# This script plays the supervisor, so it sends what the supervisor sends --
+# both limits off, the default.
+policy='"_cbm_index_policy":{"index_max_files":"off","index_max_source_mb":"off"}'
+
+response="${tmpdir}/scoped.response"
+if ! run_worker "{\"repo_path\":\"${repo}\",\"mode\":\"fast\",${policy}}" "${response}" \
+  "${tmpdir}/scoped.out" "${tmpdir}/scoped.err"; then
+  echo "worker exited nonzero for an admitted request" >&2
+  cat "${tmpdir}/scoped.err" >&2
+  exit 1
+fi
+if [[ ! -s "${response}" ]]; then
+  echo "worker delivered no response" >&2
+  exit 1
+fi
+if grep -q 'outside the allowed root' "${response}"; then
+  echo "worker re-decided the workspace boundary from the daemon environment" >&2
+  cat "${response}" >&2
+  exit 1
+fi
+if ! grep -q '"status":"indexed"' "${response}"; then
+  echo "worker did not index the admitted repository" >&2
+  cat "${response}" >&2
+  exit 1
+fi
+
+# Fail closed: no repo_path means no request scope, so no indexing at all.
+unscoped="${tmpdir}/unscoped.response"
+if run_worker "{\"mode\":\"fast\",${policy}}" "${unscoped}" "${tmpdir}/unscoped.out" "${tmpdir}/unscoped.err"; then
+  echo "worker ran without a request workspace scope" >&2
+  exit 1
+fi
+if [[ -s "${unscoped}" ]] || ! grep -q 'request workspace scope invalid' "${tmpdir}/unscoped.err"; then
+  echo "worker without repo_path did not fail closed on scope" >&2
+  cat "${tmpdir}/unscoped.err" >&2
+  exit 1
+fi
+
+echo "ok: index worker is scoped to the admitted request, not the daemon environment"
diff --git a/tests/test_worker_watchdog.sh b/tests/test_worker_watchdog.sh
index 7a52603a0..e38be10bf 100755
--- a/tests/test_worker_watchdog.sh
+++ b/tests/test_worker_watchdog.sh
@@ -109,7 +109,7 @@ SH
 chmod +x "${tmpdir}/wrapper.sh"
 
 CBM_BINARY="${BINARY}" BUILD_FINGERPRINT="${BUILD_FINGERPRINT}" TMPDIR_PATH="${tmpdir}" \
-  ARGS_JSON="{\"repo_path\":\"${tmpdir}/repo\"}" \
+  ARGS_JSON="{\"repo_path\":\"${tmpdir}/repo\",$(cbm_test_index_worker_policy_json)}" \
   CBM_TEST_HANG_ON=hang_me \
   CBM_TEST_WORKER_DESCENDANT_PID_FILE="${tmpdir}/descendant.pid" \
   "${tmpdir}/wrapper.sh" &