diff --git a/CHANGELOG.md b/CHANGELOG.md
index 488849c80..63410dc5e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,67 @@
 # Changelog
 
+## [1.91.350.0] - 2026-10-31
+
+**`/ship` review costs less and catches more: one batched specialist, a blocking floor in both prose voices, and data files that no code reads review as docs (GSTA-167 variant G).** The no-loss replay certified the stack before merge. Round 5 replayed 14 PRs with 29 known blockers, and the new reviewers found 24 against the control's 21, non-inferior at p=0.035. Round 6 pooled 41 blockers (the 29 plus 12 confirmed units from GSTA-2): 33 against 27, non-inferior at p=0.0055. The free re-score for the classifier and state-matrix change lost 0 blockers.
+
+### Changed
+- **One batched specialist reads every checklist at each depth.** It always reads Testing and Security on code and gate diffs, and adds State-machines, Data-migration, API-contract and Design when scope asks for them. Maintainability, Performance and Simplification run only when forced, and `gstack-review-plan` names them on a `SKIP:` line. The Red Team reads the batched reader's merged findings.
+- **Specialists run at medium reasoning effort.** The Red Team, the native adversarial pass and the fix-check stay at full effort. `--no-tiers` (or `review_effort_tiers off`) runs specialists at the host default.
+- **Both prose voices carry the blocking floor.** The native adversarial and outside-voice prompts say a finding blocks only if it would fail a test, break production, or lose data or secrets, and end each finding with `Severity:` and `Blocks: yes|no`. A finding is CRITICAL when its old label rule says so or it says `Blocks: yes`, and `Blocks: no` never lowers one. `gstack-review-dispatch collect` records a `Blocks: yes` finding as CRITICAL, so `judge` refuses a lead judgment that keeps it below the floor.
+- **A JSON, CSV, TSV or raster data file that no code names counts as docs, not runtime lines.** `classifyDiff` finds code consumers with `git grep`; YAML, TOML, SVG and config files stay code, and path-only callers (the receipt's gate scan, the release route) keep data files code. `gstack-ship-preflight`'s `RUNTIME_LINES` now comes from the same function.
+- **An untested state-matrix cell is a test gap below the floor.** A wrong row or collapsed kinds stays CRITICAL, and the state-machines checklist itself is unchanged.
+
+### Fixed
+- **`gstack-review-dispatch render --checklists` takes the plan's checklist names** as well as paths, and refuses an unknown one. The outside-voice brief no longer adds a separate severity line, since the prompt now asks for Severity and Blocks itself.
+- **`collect` keeps one finding per id in the layout the prompts ask for.** A `Severity:` or `Blocks:` line below a finding joins that finding, an inline `Blocks: yes` with no label still collects as CRITICAL, and the native voice's FIXABLE collects as CRITICAL even beside a lower `Severity:`. When the layout is unclear, `collect` merges findings rather than dropping one.
+- **The data-file consumer scan reads `git grep` the same way under any git config.** `grep.lineNumber`, `grep.column` and `color.grep` no longer hide a consumer, and a failed scan keeps every data file code with `consumer_scan_failed`.
+
+### Tests
+- `test/prose-voice-floor.test.ts` renders both prose prompts for the claude and codex hosts and checks the floor sentence and the Blocks line. `test/review-depth.test.ts` covers the batched reader on the captured fixtures, effort per role and the data-file rule. `test/review-dispatch.test.ts` covers `Blocks: yes` collection and batched checklist names. `test/review-packets-removed.test.ts` repins the changed briefs to their no-loss replays (PR-a, G1, L).
+
+## [1.91.349.0] - 2026-10-31
+
+**Nine flaky tests from the 2026-10-30 flaky pass stop failing correct runs.** Two paid detectors missed correct replies, one paid case lost the evidence of its own failure, five free tests raced their own fixtures or paid a cold start inside a timed call, and two Windows failures came from real defects: a lost IPC receipt in the QA deadline worker and a Chromium feature that fails loopback connections.
+
+### Fixed
+- **`lib/qa-deadline.ts`**: the receipt worker waits for the parent to acknowledge each receipt before it exits. Bun can drop an IPC message the parent has not read yet when the child exits, so on Windows `gstack-qa-deadline run` and `gstack-qa-evidence` could return the exit code without the `finished` receipt (Windows Free Tests 40991662945, `test/qa-deadline.test.ts:431` received one of two receipts). A receipt still unacknowledged after the existing 5 s write wait makes the worker exit 2, as an unwritten receipt did before.
+- **`patches/playwright-core@1.62.1.patch`**: backports microsoft/playwright#43605, which disables Chromium's `TcpPortRandomizationWin`. On Windows it fails loopback page loads with `net::ERR_NO_BUFFER_SPACE` even when ports are free (`browse/test/cookie-picker-ui.test.ts`, Windows Free Tests 40656299153 and 41056150287). gstack's own browser launches on Windows had the same exposure.
+- **`test/helpers/qa-only-cleanup.ts`**: the cleanup check reads the daemon state file once and treats a file deleted during shutdown as absent, instead of checking that it exists and then reading it (Free Tests 40964422549: ENOENT on `browse.json`).
+- **`test/claude-code-runner.test.ts`**: the liveness helper counts a process in the `X` (being reaped) state as dead, like `Z`, and the cleanup no longer kills a pid that is already gone (Free Tests 41034844588: ESRCH).
+- **`test/helpers/free-owned-browser-settlement.ts`**: in the `cancel-vanishing-record` case the fake daemon waits for the observer to remove its record before it exits, so the race the case injects always happens (Free Tests 40924799742).
+- **`test/investigate-freeze-path.test.ts`**: the E1 cases pay the first bash and JSON interpreter start once, in an unasserted warm-up, before the timed hook calls. In four Windows runs (40824965988, 40917695070, 40985163846, 40996480693) only the file's first hook call hit the 15 s kill, the second took 1.9 to 7.9 s and the rest 0.3 to 1 s. Each timed call keeps its 15 s kill.
+
+### Gate integrity
+- **ship-unmanaged-hook-consent** (`test/helpers/ship-hook-actor.ts`): the decline check also credits "no hook/change/file was installed, changed, modified, overwritten or replaced". Gate 41005113772 said "No hook was installed or changed" and "nothing was overwritten" after a correct decline; its installs, hook bytes and question checks all passed. The four negative controls still fail.
+- **tpa-absent-darwin** (`test/helpers/third-party-actions.ts`): the Aside download pitch also counts in the passive voice at a clause start ("Aside ... can be downloaded at aside.com", gate 40987391676). Reported and mid-clause forms still count zero, and so does a clause with "not", "no", "never" or "n't" before the phrase.
+
+### Changed
+- **autoplan-guard-pty** (`test/helpers/autoplan-guard-pty.ts`, `test/skill-e2e-autoplan-guard-pty.test.ts`): a `dispatch_prompt` deny prints each Agent dispatch's length, first differing offset and context next to the prompt the actor had to copy, read before cleanup deletes it. Gate 40992022983 lost those bytes because the journal summary cuts inputs at 160 characters.
+
+### Tests
+- New captures: `test/fixtures/ship-hook-consent-2026-10-30.json` and a passive-voice capture in `test/fixtures/third-party-actions-pitch-captures.json`; both tests fail with their detector change reverted. `browse/test/playwright-core-patch.test.ts` checks the backport in the patch and the installed tree, and fails without it. `test/autoplan-guard-pty-fixture.test.ts` checks the dispatch delta on a synthetic journal. `test/qa-deadline.test.ts` plays the parent, so it now acknowledges each receipt; its assertions are unchanged, and a new case shows a worker whose parent never acknowledges exits 2 after sending both receipts.
+
+## [1.91.348.0] - 2026-10-31
+
+- **Pregate now maps tests to dotfiles they name.** A test that reads `../.gitleaks.toml`, `.gitleaks.toml` or `join('.github', 'workflows', 'ci.yml')` used to get no edge to that file, so a branch touching only the dotfile ended in `PREGATE_NO_LANE`. Quoted literals may now start with a dot, and a dot-led literal that isn't `./` or `../` resolves from both the repository root and the folder of the file that names it, so a fixture's own `.github/` keeps its edge. A literal still forms an edge only when it names a file in the repo, so strings like `'.ts'` add nothing. On gstack this adds 179 edges (`buildGraph` over this repository: 16,934 on main 2127729, 17,113 with this change, none removed), all to real dotfiles such as `.github/workflows/*.yml` and `.gstack/*.json`. (GST-246, reported from garrytan/truther#956.)
+
+## [1.91.347.0] - 2026-10-31
+
+**A Captain archives only its own crew's threads (R39, amended). A thread outside every crew belongs to the owner and stays as it is, even when the Captain's own automation created it.**
+
+### Changed
+- **docs/captain.md and the Capy factory context (`factory.md` point 12)** now say a Captain archives only the threads in its own crew, each when its plan for that thread says the work is done. No Captain archives, flags or lists a thread outside every crew for archiving unless the owner asks. The earlier wording also let a Captain archive threads its automations started outside the crew, and that emptied the owner's unattached threads.
+
+## [1.91.346.0] - 2026-10-31
+
+**`sealed.local_path` now flags a home path inside a shell default, `${UBI_RUNNER:-/home/<user>…}`, as it already flagged the same path after `?? "/home/<user>…"` in TypeScript.** gstack-evals `quick/laneb/runner/launch.sh:9` passed the scan because the `-` before the path counted as part of a word (#3568).
+
+### Fixed
+- **`sealed.local_path`** (`lib/sealed-guard.ts`): a home path directly after a `${…:-` or `${…-` default now matches, for a name, an array element (`${arr[0]:-`, a subscript of up to 64 characters, so a long line of unclosed `${a[` cannot make the scan quadratic), an indirect name (`${!ref:-`), a positional number or a special parameter (`${@:-`). `:=`, `:+` and `:?` already matched, because `=`, `+` and `?` were never word characters. A hyphen anywhere else still excludes the match, so a path glued to a word (`docs-…`, `$VAR-…`, `${VAR}-…`) stays unflagged; docs/pregate.md lists that as a known limit.
+
+### Gate integrity
+- This is a gate edit that only tightens. The guard now refuses lines it passed before. No existing test, threshold or allowlist changed. A new case in `test/sealed-guard.test.ts` covers all five operators, a positional parameter, `${@`, an array element, an indirect name, a Windows path and the TypeScript `??` form. It also checks six negative controls, which are two hyphenated paths, a hyphenated sentence, `$VAR-`, `${VAR}-` and a relative default. Without the fix it misses every `-` form.
+
 ## [1.91.345.0] - 2026-10-31
 
 **A capped `/ship` on Capy now spends fewer agent turns and counts only its own tokens, while every reviewer still gets exactly the brief 1.91.331.0 gives it.** Two new commands do `/ship`'s fixed shell work, a short driver file replaces reading the whole skill when a parent agent runs `/ship`, and the budget measures each reviewer batch on its own instead of across the parent's work. Replays of gstack-evals #34 and #36 (GSTA-167) spent 12.19M tokens on Steps 12-17 and 0.25-0.4M on each parent turn; these changes cut turns, not reviewer context.
diff --git a/VERSION b/VERSION
index bb998b909..a9eef217c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.91.345.0
+1.91.350.0
diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md
index 38ea47900..c2745c8e1 100644
--- a/agents-digest/gstack-AGENTS.md
+++ b/agents-digest/gstack-AGENTS.md
@@ -1,4 +1,4 @@
-# gstack digest v1.91.345.0 — regenerate/re-copy after upgrading gstack
+# gstack digest v1.91.350.0 — regenerate/re-copy after upgrading gstack
 
 Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed
 for agent hosts without a full skill install. The full skills add workflows,
diff --git a/browse/test/playwright-core-patch.test.ts b/browse/test/playwright-core-patch.test.ts
index d09e136c9..f0974cbd3 100644
--- a/browse/test/playwright-core-patch.test.ts
+++ b/browse/test/playwright-core-patch.test.ts
@@ -60,3 +60,16 @@ describe('playwright-core windowsHide patch (#2160, #1989)', () => {
     expect(bundle).toContain('shell: true, windowsHide: true');
   });
 });
+
+// Windows Free Tests 40656299153 and 41056150287 (cookie-picker-ui, serial retry passed): goto failed with
+// net::ERR_NO_BUFFER_SPACE on 127.0.0.1. Chromium's TcpPortRandomizationWin raises WSAENOBUFS with ports free;
+// microsoft/playwright#43605 disables it in 1.65, and the 1.62.1 patch backports it; drop this block at 1.65.
+describe('playwright-core TcpPortRandomizationWin backport (microsoft/playwright#43605)', () => {
+  test('the patch and the installed tree disable the feature in the --disable-features list', () => {
+    expect(fs.readFileSync(path.join(ROOT, 'patches', 'playwright-core@1.62.1.patch'), 'utf-8')).toContain('+      "TcpPortRandomizationWin"');
+    const bundle = fs.readFileSync(path.join(ROOT, 'node_modules', 'playwright-core', 'lib', 'coreBundle.js'), 'utf-8');
+    const list = bundle.slice(bundle.indexOf('disabledFeatures = ['), bundle.indexOf('].filter(Boolean);', bundle.indexOf('disabledFeatures = [')));
+    expect(list).toContain('"TcpPortRandomizationWin"');
+    expect(bundle).toContain('"--disable-features=" + disabledFeatures.join(",")');
+  });
+});
diff --git a/capy/skill/gstack/factory.md b/capy/skill/gstack/factory.md
index 37323489c..7e472397c 100644
--- a/capy/skill/gstack/factory.md
+++ b/capy/skill/gstack/factory.md
@@ -3,15 +3,15 @@
 What seven Captain crews converged on (2026-10-29). Your crew's CREW.md and recorded approvals decide who may merge, update a base, spend or touch production; urgency changes priority, never permissions or gates. With no Captain, ask the person and never merge without their word. Story: capy/README.md; examples: your org Drive's software-factory/README.md, if any.
 
 1. **Plan, then a yes.** New functionality starts with /autoplan sized to the work; the build waits for "do it". [SKILL.md: Plan, approve, ship]
-2. **Someone else merges.** Run /ship to a receipt on your final pushed head, send one READY quoting gstack's verify output word for word, and stop. The merge owner merges on green and assigns versions. [docs/captain.md: The READY contract]
-3. **Block only on the floor.** A finding blocks if it would fail a test, break production, or lose data or secrets; the rest goes in the PR body or the next wave. [docs/review-policy.md]
-4. **Fix waves.** When main goes red, hold /ship while one owner finds the root cause; bring main in once, as your rules allow. Fold deferred findings and test follow-ups into one wave PR. [docs/triage.md]
-5. **Severe first, same gates.** A severe user-facing bug jumps the queue; the plan can be short, but receipt, checks and merge owner stay.
-6. **Trade findings, not small talk.** A finding that belongs to another crew goes to its Captain, through yours, with the evidence.
+2. **Someone else merges.** Run /ship to a receipt on your final pushed head, send one READY quoting gstack's verify output verbatim, and stop. The merge owner merges on green and assigns versions. [docs/captain.md: The READY contract]
+3. **Block only on the floor.** A finding blocks if it would fail a test, break production, or lose data or secrets; the rest goes in the PR body or next wave. [docs/review-policy.md]
+4. **Fix waves.** When main goes red, hold /ship while one owner finds the root cause; bring main in once, as your rules allow. Fold deferred findings and test follow-ups into one PR. [docs/triage.md]
+5. **Severe first, same gates.** A severe user-facing bug jumps the queue; the plan can be short; receipt, checks and merge owner stay.
+6. **Trade findings, not small talk.** Another crew's finding goes to its Captain, through yours, with the evidence.
 7. **Measure before you act.** Run the real system on the merged tree you ship; a real run outranks a reviewed plan. Each number names its run, commit or uncapped query; say what you did not verify.
-8. **Evals decide, and losses get reported.** Preregister bars, cap and stop rule before paying [/eval-plan]. Cheap proof (a keyless fake, a smoke) before the paid run. Use controls (no-skill and placebo arms, clean decoys). Report use and pass separately; quote spend from the meter.
+8. **Evals decide, and losses get reported.** Preregister bars, cap and stop rule before paying [/eval-plan]. Cheap proof (a keyless fake, a smoke) before the paid run. Use controls (no-skill and placebo arms, clean decoys). Report use and pass apart; quote spend from the meter.
 9. **Flakes: one rerun, a ledger, a daily fix.** Only the rerun the policy allows, never a harness or infra red; a second red is real; no test is loosened. [docs/captain.md: The daily flaky pass]
-10. **Quiet.** Message on a decision, a blocker, a READY or a finished phase. A broadcast that needs no reply goes in the Captain's notes; never reply just to acknowledge.
+10. **Quiet.** Message on a decision, a blocker, a READY or a finished phase. A broadcast needing no reply goes in the Captain's notes; never reply just to acknowledge.
 11. **Ask once, plainly.** One ask per decision, explained like the owner is five: your Captain's name, then a lettered line each: "A: <code> hit problem p, which happens when h. We could do 1) x, 2) y or 3) z. Recommendation x because why. A1 to take recommendation." "do it" takes every recommendation; "A2" takes option 2. Owner tasks: the exact link (in Capy: path and field), numbered simple steps, the reply word. Never re-ask a standing rule; check what you can yourself. [docs/captain.md: The ask format]
-12. **Fresh threads, closed out.** One thread per unit of work (crew threads ask their Captain); past the context threshold, hand off. Its Captain archives the threads it, its crew or automations start. Size reviews to the diff; read the token counter. [docs/ship-budget.md]
+12. **Fresh threads, closed out.** One thread per unit of work (crew threads ask their Captain); past the context limit, hand off. Its Captain archives only its crew's threads; threads outside every crew are the owner's, even its automation's. Size reviews to the diff; read the token counter. [docs/ship-budget.md]
 13. **The owner's model preference.** `gstack-models resolve --role agent` picks agent models, except cross-family voices and eval subjects. [docs/model-policy.md: Your model preference]
diff --git a/changelog.d/gsta-167-reviewers.md b/changelog.d/gsta-167-reviewers.md
deleted file mode 100644
index 3e54d8e5a..000000000
--- a/changelog.d/gsta-167-reviewers.md
+++ /dev/null
@@ -1,16 +0,0 @@
-**`/ship` review costs less and catches more: one batched specialist, a blocking floor in both prose voices, and data files that no code reads review as docs (GSTA-167 variant G).** The no-loss replay certified the stack before merge. Round 5 replayed 14 PRs with 29 known blockers, and the new reviewers found 24 against the control's 21, non-inferior at p=0.035. Round 6 pooled 41 blockers (the 29 plus 12 confirmed units from GSTA-2): 33 against 27, non-inferior at p=0.0055. The free re-score for the classifier and state-matrix change lost 0 blockers.
-
-### Changed
-- **One batched specialist reads every checklist at each depth.** It always reads Testing and Security on code and gate diffs, and adds State-machines, Data-migration, API-contract and Design when scope asks for them. Maintainability, Performance and Simplification run only when forced, and `gstack-review-plan` names them on a `SKIP:` line. The Red Team reads the batched reader's merged findings.
-- **Specialists run at medium reasoning effort.** The Red Team, the native adversarial pass and the fix-check stay at full effort. `--no-tiers` (or `review_effort_tiers off`) runs specialists at the host default.
-- **Both prose voices carry the blocking floor.** The native adversarial and outside-voice prompts say a finding blocks only if it would fail a test, break production, or lose data or secrets, and end each finding with `Severity:` and `Blocks: yes|no`. A finding is CRITICAL when its old label rule says so or it says `Blocks: yes`, and `Blocks: no` never lowers one. `gstack-review-dispatch collect` records a `Blocks: yes` finding as CRITICAL, so `judge` refuses a lead judgment that keeps it below the floor.
-- **A JSON, CSV, TSV or raster data file that no code names counts as docs, not runtime lines.** `classifyDiff` finds code consumers with `git grep`; YAML, TOML, SVG and config files stay code, and path-only callers (the receipt's gate scan, the release route) keep data files code. `gstack-ship-preflight`'s `RUNTIME_LINES` now comes from the same function.
-- **An untested state-matrix cell is a test gap below the floor.** A wrong row or collapsed kinds stays CRITICAL, and the state-machines checklist itself is unchanged.
-
-### Fixed
-- **`gstack-review-dispatch render --checklists` takes the plan's checklist names** as well as paths, and refuses an unknown one. The outside-voice brief no longer adds a separate severity line, since the prompt now asks for Severity and Blocks itself.
-- **`collect` keeps one finding per id in the layout the prompts ask for.** A `Severity:` or `Blocks:` line below a finding joins that finding, an inline `Blocks: yes` with no label still collects as CRITICAL, and the native voice's FIXABLE collects as CRITICAL even beside a lower `Severity:`. When the layout is unclear, `collect` merges findings rather than dropping one.
-- **The data-file consumer scan reads `git grep` the same way under any git config.** `grep.lineNumber`, `grep.column` and `color.grep` no longer hide a consumer, and a failed scan keeps every data file code with `consumer_scan_failed`.
-
-### Tests
-- `test/prose-voice-floor.test.ts` renders both prose prompts for the claude and codex hosts and checks the floor sentence and the Blocks line. `test/review-depth.test.ts` covers the batched reader on the captured fixtures, effort per role and the data-file rule. `test/review-dispatch.test.ts` covers `Blocks: yes` collection and batched checklist names. `test/review-packets-removed.test.ts` repins the changed briefs to their no-loss replays (PR-a, G1, L).
diff --git a/docs/PROJECT_STRUCTURE.md b/docs/PROJECT_STRUCTURE.md
index 6c99766c2..45e932380 100644
--- a/docs/PROJECT_STRUCTURE.md
+++ b/docs/PROJECT_STRUCTURE.md
@@ -96,7 +96,7 @@ gstack/
 ├── extension/       # Chrome extension (side panel + activity feed + CSS inspector)
 ├── lib/             # Shared libraries (aside-render.ts = local-HTML rendering, Aside first, engine fallback; design-catalog.ts = the typed design anti-pattern catalog every design skill renders from; design-lint/ = the static and render tiers behind bin/gstack-design-lint, ported from hallmark's sloplint; design-detect-contract.ts = detector sentinel vocabulary; design-md.ts = open DESIGN.md reader/writer; dom-dump-script.ts + generated dom-dump.js = rendered-DOM dump for the detector; review-evidence.ts = review-start receipt binding, computed freshness and shared-code snapshot eligibility; frontend-scope.ts; claude-bin.ts, error-handling.ts, worktree.ts, egress-receipt.ts, context-bill.ts, redact-engine.ts, tracker-guard.ts, version-source.ts, code-intelligence/)
 │   └── diagram-render/  # Vendored mermaid + excalidraw runtimes, built into one offline bundle the renderer loads
-├── patches/         # bun `patchedDependencies` patches (playwright-core windowsHide)
+├── patches/         # bun `patchedDependencies` patches (playwright-core windowsHide, TcpPortRandomizationWin disabled on Windows)
 ├── docs/designs/    # Design documents (incl. IMPECCABLE_INTEROP.md = the design detector / catalog / open DESIGN.md record, and fork-port-residual-2026-09/ evaluation evidence)
 ├── setup-deploy/    # /setup-deploy skill (one-time deploy config)
 ├── .github/         # CI workflows + shared composite actions (.github/actions/) + Docker image (claude CLI pinned)
diff --git a/docs/captain.md b/docs/captain.md
index ed8c1003c..a57c1066a 100644
--- a/docs/captain.md
+++ b/docs/captain.md
@@ -35,9 +35,11 @@ by a daily pass; nothing is retried into green.
   rules file, the digest and the notes, validates READYs, builds and merges trains, calls
   slots, relays asks to the owner in the three shapes, runs the flaky pass, and decides
   everything that needs no access, credentials, spend over cap or a cited approval. It
-  archives its own child threads, including ones its crew or its automations started
-  outside the crew, when its plan for each thread says that thread's work is done; it
-  knows each thread's next step, so nobody else archives them.
+  archives only its own crew threads, each when its plan for that thread says the work is
+  done; it knows each thread's next step, so nobody else archives them. A thread outside
+  every crew belongs to the owner and stays as it is: no Captain archives it, flags it or
+  lists it for archiving unless the owner asks, even when the Captain's own automation
+  created it.
 - **A lane** (a crew thread) owns named files, builds on its own branch and machine,
   runs /ship, sends one READY block, stamps on call (merging the base into its pin only
   as part of that stamp commit, or when the controller names a real-code conflict),
diff --git a/docs/pregate.md b/docs/pregate.md
index a55d05e75..03de0f36a 100644
--- a/docs/pregate.md
+++ b/docs/pregate.md
@@ -805,8 +805,10 @@ gstack-pregate sealed [--range <a..b>] [--remote origin] [--base <branch>] [--js
 - **Rules.** `sealed.path` and `sealed.transcript` check every path a commit
   adds, renames or copies, whatever its content (binary, empty, deleted again
   in a later commit); `sealed.answer`, `sealed.seed` and `sealed.local_path`
-  (`/home/<user>/`, `/Users/<user>/`, `C:\Users\<user>\`) check each commit's added
-  lines. Findings print rule, `file[:line]` and commit, never the text.
+  (`/home/<user>/`, `/Users/<user>/`, `C:\Users\<user>\`, including after a shell
+  default such as `${VAR:-…}` or `${VAR-…}`) check each commit's added lines.
+  Known limit: a path glued to the text before it, by a hyphen (`docs-…`,
+  `$VAR-…`, `${VAR}-…`) or a letter (`-I…`, `-L…`), is not matched. Findings print rule, `file[:line]` and commit, never the text.
 - **Globs.** `paths`, `transcripts` and `allow_paths` match the whole
   repo-relative path from the repository root. `*` and `?` stay inside one
   path segment; `**/` spans zero or more directories; a `**` not followed by
diff --git a/lib/pregate/import-graph.ts b/lib/pregate/import-graph.ts
index 6f6dc13b7..2445448c6 100644
--- a/lib/pregate/import-graph.ts
+++ b/lib/pregate/import-graph.ts
@@ -56,6 +56,9 @@ const scanner = new Bun.Transpiler({ loader: 'tsx' });
 // names it, like a relative import; without it a test reading a template by
 // relative path had no edge to the template (GSTA-121's test/ship-publication-gates.test.ts).
 const QUOTED = /['"`]((?:\.\.?\/)*[A-Za-z0-9_@][A-Za-z0-9_./@()[\]+-]*)['"`]/g;
+// A dot-led literal (`'.gitleaks.toml'`, `'../.github/x.yml'`) runs as its own pass and leaves its
+// closing quote unconsumed, so a closing quote followed by `.method(` never eats the next literal's quote.
+const DOTFILE = /['"`]((?:\.\.?\/)*\.[A-Za-z0-9_@][A-Za-z0-9_./@()[\]+-]*)(?=['"`])/g;
 const JOIN = /\bjoin\(([^()]*)\)/g;
 const RESOLVE_EXT = ['', '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts', '/index.ts', '/index.tsx', '/index.js', '/index.jsx', '/index.mjs'];
 // A statement starts a line or follows `;` or a compound statement's `:`. The module spec is
@@ -291,11 +294,11 @@ function resolveCandidate(files: Set<string>, dirs: Set<string>, c: string, lite
  */
 function resolveRefs(files: Set<string>, dirs: Set<string>, fromFile: string, ref: string, literal = false, config: PathAliases = NO_ALIASES): string[] {
   if (!ref || ref.startsWith('node:') || ref.startsWith('bun:')) return [];
-  if (ref.startsWith('.')) { const t = resolveCandidate(files, dirs, normalize(path.posix.join(path.posix.dirname(fromFile), ref)), literal); return t ? [t] : []; }
+  if (/^\.\.?(?:\/|$)/.test(ref)) { const t = resolveCandidate(files, dirs, normalize(path.posix.join(path.posix.dirname(fromFile), ref)), literal); return t ? [t] : []; }
   const { chosen, others } = matchAliases(config.aliases, ref);
   for (const c of chosen ?? []) { const t = resolveCandidate(files, dirs, c, literal); if (t) return [t]; }
   if (!chosen && others.length === 0 && ref.startsWith('@') && !ref.includes('/')) return [];
-  const plausible = [...others, ...(config.baseUrl ? [normalize(path.posix.join(config.baseUrl, ref))] : []), normalize(ref)];
+  const plausible = [...others, ...(config.baseUrl ? [normalize(path.posix.join(config.baseUrl, ref))] : []), normalize(ref), ...(literal && ref.startsWith('.') ? [normalize(path.posix.join(path.posix.dirname(fromFile), ref))] : [])];
   return [...new Set(plausible.map(c => resolveCandidate(files, dirs, c, literal)).filter((t): t is string => t !== null))];
 }
 
@@ -429,6 +432,7 @@ export function referencesIn(files: Set<string>, dirs: Set<string>, rel: string,
   // sources (a test spawns a bin; a bash bin calls a sibling). Prose and
   // manifests name everything and would make every file a hub.
   if (!scansLiterals(rel)) return out;
+  for (const m of source.matchAll(DOTFILE)) for (const target of resolveRefs(files, dirs, rel, m[1]!, true, config)) out.push({ target, via: 'literal' });
   for (const m of source.matchAll(QUOTED)) {
     const targets = resolveRefs(files, dirs, rel, m[1]!, true, config);
     for (const target of targets) out.push({ target, via: 'literal' });
diff --git a/lib/qa-deadline.ts b/lib/qa-deadline.ts
index bbc3c4462..9e65bfb72 100644
--- a/lib/qa-deadline.ts
+++ b/lib/qa-deadline.ts
@@ -224,6 +224,9 @@ export async function runQaWindowsWorker(args: string[], emit: Emit, entrypoint:
     worker.on('message', (message: any) => {
       if (message?.type === messageType && ['stdout', 'stderr'].includes(message.stream)
         && message.receipt && typeof message.receipt === 'object') emit(message.stream, message.receipt, message.completion);
+      if (message?.type === messageType && Number.isSafeInteger(message.seq)) {
+        try { worker.send({ type: `${messageType}-ack`, seq: message.seq }, () => {}); } catch {}
+      }
     });
     worker.once('error', () => {
       process.off('exit', kill);
@@ -244,6 +247,10 @@ export async function withQaReceiptOutput(receiptWorker: boolean, messageType: s
     stderr: fs.createWriteStream('', { fd: 2, autoClose: false }),
   };
   const writes: Promise<void>[] = [];
+  const acks = new Map<number, () => void>();
+  if (receiptWorker) process.on('message', (message: any) => {
+    if (message?.type === `${messageType}-ack`) acks.get(message.seq)?.();
+  });
   let writeFailed = false;
   const failed = () => { writeFailed = true; };
   output.stdout.on('error', failed);
@@ -252,7 +259,11 @@ export async function withQaReceiptOutput(receiptWorker: boolean, messageType: s
     writes.push(new Promise<void>(resolve => {
       const done = (error?: Error | null) => { if (error) writeFailed = true; resolve(); };
       try {
-        if (receiptWorker) process.send!({ type: messageType, stream, receipt, ...(completion ? { completion } : {}) }, done);
+        if (receiptWorker) {
+          const seq = writes.length;
+          acks.set(seq, () => { acks.delete(seq); resolve(); });
+          process.send!({ type: messageType, seq, stream, receipt, ...(completion ? { completion } : {}) }, (error?: Error | null) => { if (error) done(error); });
+        }
         else output[stream].write(format(receipt), done);
       } catch { writeFailed = true; resolve(); }
     }));
diff --git a/lib/sealed-guard.ts b/lib/sealed-guard.ts
index 976a44860..7ba8b261d 100644
--- a/lib/sealed-guard.ts
+++ b/lib/sealed-guard.ts
@@ -47,7 +47,7 @@ export type Visibility = 'public' | 'private' | 'unknown';
 const KEYS = ['paths', 'transcripts', 'answer_markers', 'seed_patterns', 'local_paths', 'allow_paths', 'case_insensitive', 'visibility'];
 const MAX_ENTRIES = 64;
 const MAX_REGEX = 256;
-const LOCAL_PATH_RE = /(?:^|[^A-Za-z0-9_.~-])(?:\/home\/[^/\s'"`]+\/|\/Users\/[^/\s'"`]+\/|[A-Za-z]:\\+Users\\+[^\\\s'"`]+\\)/;
+const LOCAL_PATH_RE = /(?:^|[^A-Za-z0-9_.~-]|\$\{!?(?:[A-Za-z_][A-Za-z0-9_]*(?:\[[^\]\s]{0,64}\])?|[0-9]+|[@*#?$!-]):?-)(?:\/home\/[^/\s'"`]+\/|\/Users\/[^/\s'"`]+\/|[A-Za-z]:\\+Users\\+[^\\\s'"`]+\\)/;
 const PUBLIC_TTL_MS = 24 * 3600_000;
 const PRIVATE_TTL_MS = 3600_000;
 
diff --git a/package.json b/package.json
index d2f4f3651..ebcb0ca94 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.91.345",
+  "version": "1.91.350",
   "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.",
   "license": "MIT",
   "type": "module",
diff --git a/patches/playwright-core@1.62.1.patch b/patches/playwright-core@1.62.1.patch
index b270adbdb..e301f1bf0 100644
--- a/patches/playwright-core@1.62.1.patch
+++ b/patches/playwright-core@1.62.1.patch
@@ -1,5 +1,5 @@
 diff --git a/lib/coreBundle.js b/lib/coreBundle.js
-index d9041dd0f009072511a7d808dec83121ff29e127..e5c72c452c98f1c64038c5f24ac5805fbc99151f 100644
+index d9041dd0f009072511a7d808dec83121ff29e127..542acd31dd7e8ae084de952dc42ec63d0caba849 100644
 --- a/lib/coreBundle.js
 +++ b/lib/coreBundle.js
 @@ -8906,6 +8906,10 @@ async function launchProcess(options) {
@@ -22,3 +22,15 @@ index d9041dd0f009072511a7d808dec83121ff29e127..e5c72c452c98f1c64038c5f24ac5805f
            const [stdout2, stderr2] = [taskkillProcess.stdout.toString(), taskkillProcess.stderr.toString()];
            if (stdout2)
              options.log(`[pid=${spawnedProcess.pid}] taskkill stdout: ${stdout2}`);
+@@ -34634,7 +34638,10 @@ var init_chromiumSwitches = __esm({
+       // Disables forced sign-in in Edge.
+       "msForceBrowserSignIn",
+       // Disables updating the preferred version in LaunchServices preferences on mac.
+-      "msEdgeUpdateLaunchServicesPreferredVersion"
++      "msEdgeUpdateLaunchServicesPreferredVersion",
++      // gstack patch: backport of microsoft/playwright#43605 (1.65). Random client ports fail with
++      // net::ERR_NO_BUFFER_SPACE (WSAENOBUFS) on Windows even when ports are free (crbug.com/572515601).
++      "TcpPortRandomizationWin"
+     ].filter(Boolean);
+     chromiumSwitches = (options) => [
+       "--disable-field-trial-config",
diff --git a/test/autoplan-guard-pty-fixture.test.ts b/test/autoplan-guard-pty-fixture.test.ts
index aac39fffb..280326e4e 100644
--- a/test/autoplan-guard-pty-fixture.test.ts
+++ b/test/autoplan-guard-pty-fixture.test.ts
@@ -1,7 +1,7 @@
 import { expect, test } from 'bun:test';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { closePacketReadAfterNotice, prepareGuardSession, stoppedAtPhaseBoundary } from './helpers/autoplan-guard-pty';
+import { closePacketReadAfterNotice, dispatchPromptDelta, prepareGuardSession, stoppedAtPhaseBoundary } from './helpers/autoplan-guard-pty';
 
 const base = '/home/runner/.cache/gstack-paid-shard-x/tmp/ap-guard-pty-y';
 
@@ -64,3 +64,23 @@ test('the scripted actor keeps going through the phase boundary: nothing between
     for (const n of [6, 7, 8, 9]) expect(step(n)).not.toMatch(/end your turn(?! after it)|wait for (its|a) completion/i);
   } finally { s.cleanup(); }
 });
+
+// Train gate 40992022983 (paid-slice-1-a1, passed on the in-run rerun): the guard denied the Design dispatch with
+// dispatch_prompt, and the journal summary cut every input at 160 characters, so the differing bytes were lost.
+test('a dispatch_prompt deny names the bytes the actor changed, read from the journal before cleanup', () => {
+  const s = prepareGuardSession(undefined);
+  try {
+    const design = '[DESIGN] Native phase review\nRead file: /p/native-prompt.md\nApply every criterion.\nReturn findings.\n';
+    fs.writeFileSync(path.join(s.project, '.gstack', 'tmp', 'autoplan', 'dispatch-design.txt'), design);
+    const journal = path.join(s.config, 'projects', 'p');
+    fs.mkdirSync(journal, { recursive: true });
+    const sent = design.replace('every criterion', 'all criteria');
+    fs.writeFileSync(path.join(journal, 'session.jsonl'), JSON.stringify({ message: { content: [
+      { type: 'tool_use', name: 'Agent', input: { description: 'Design review', prompt: sent } }] } }) + '\n');
+    const [delta] = s.dispatchPromptDeltas();
+    expect(delta).toContain(`Design review: expected ${design.length} chars, sent ${sent.length}; first difference at offset ${design.indexOf('every')}`);
+    expect(delta).toContain('Apply every criterion.');
+    expect(delta).toContain('Apply all criteria.');
+    expect(dispatchPromptDelta(design, design)).toBe(`identical (${design.length} chars)`);
+  } finally { s.cleanup(); }
+});
diff --git a/test/claude-code-runner.test.ts b/test/claude-code-runner.test.ts
index a665d9906..acb3433c5 100644
--- a/test/claude-code-runner.test.ts
+++ b/test/claude-code-runner.test.ts
@@ -134,7 +134,7 @@ function running(pid: number): boolean {
   try {
     process.kill(pid, 0);
     // Linux can leave a killed orphan briefly as a zombie before init reaps it.
-    if (process.platform === 'linux') return readFileSync(`/proc/${pid}/stat`, 'utf8').split(' ')[2] !== 'Z';
+    if (process.platform === 'linux') return !['Z', 'X'].includes(readFileSync(`/proc/${pid}/stat`, 'utf8').split(' ')[2]);
     return true;
   } catch { return false; }
 }
@@ -152,7 +152,7 @@ async function expectDescendantDead() {
     for (let i = 0; i < 20 && running(pid); i++) await Bun.sleep(25);
     expect(running(pid)).toBe(false);
   } finally {
-    if (running(pid)) process.kill(pid, 'SIGKILL');
+    cleanupDescendant();
   }
 }
 
@@ -363,8 +363,7 @@ describe('Claude Code restricted execution', () => {
       expect(result.error?.code).toBe('output-drain');
       expect(Date.now() - start).toBeLessThan(2000);
     } finally {
-      const pid = Number(readFileSync(PID, 'utf8'));
-      if (running(pid)) process.kill(pid, 'SIGKILL');
+      cleanupDescendant();
     }
   });
 
diff --git a/test/fixtures/ship-hook-consent-2026-10-30.json b/test/fixtures/ship-hook-consent-2026-10-30.json
new file mode 100644
index 000000000..f562b114c
--- /dev/null
+++ b/test/fixtures/ship-hook-consent-2026-10-30.json
@@ -0,0 +1,23 @@
+{
+  "source": "assistant text and the declined question of the claude-opus-5-5 ship-unmanaged-hook-consent red in train gate 41005113772 (hotfix train #3636 @ c1415bcd, paid-slice-16-a1; passed on the in-run rerun)",
+  "replies": [
+    {
+      "case": "ship-unmanaged-hook-consent",
+      "run": "41005113772",
+      "question": {
+        "question": "This repo already has a pre-push hook (.git/hooks/pre-push) that gstack doesn't manage. Its marker line has extra text after it, and it currently runs `exit 42`. Should gstack replace it with the managed credential-guard hook? Your current hook would be overwritten unless you integrate it yourself.",
+        "options": [
+          {
+            "label": "Keep my hook",
+            "description": "Leave .git/hooks/pre-push as it is. You add the credential guard to it yourself."
+          },
+          {
+            "label": "Replace with gstack hook",
+            "description": "Let gstack install its managed pre-push hook in place of the current one."
+          }
+        ]
+      },
+      "assistant": "Running the guard block verbatim.\nThe block reported an unmanaged hook, so it skipped installation. Next I'll check whether the hook meets the conditions for asking consent.\nI ran the credential pre-push guard. No hook was installed or changed, and I stopped before pushing.\n\n**What the guard reported**\n```\nREDACT_PREPUSH: true\nHOOK_STATE: unmanaged\nHOOKS_IN_GIT_DIR: yes\nPREPUSH_PROMPTED: no\n```\n\n**What I found in the repo**\n- `core.hooksPath` isn't set (the check exited 1), so hooks live in the default `.git/hooks`.\n- `.git/hooks/pre-push` exists. Its second line is `# gstack-redact pre-push (managed) extra`, which isn't the exact `# gstack-redact pre-push (managed)` marker, so the guard correctly treated it as not managed by gstack. The hook itself just runs `exit 42`.\n- `.git/hooks/pre-push.local` doesn't exist.\n\n**Decision**\n- Because the hook isn't managed, the block skipped the installer, so nothing was overwritten.\n- The hook is in the default directory and there's no `pre-push.local`, so the workflow allowed one consent question. You chose **Keep my hook**, so it stays as it is. To get the credential guard, you'll need to add it to that hook yourself.\n- The one-time setup offer and its `.redact-prepush-prompted` marker only apply when `REDACT_PREPUSH` isn't true. It's already true, so I skipped them, even though `PREPUSH_PROMPTED: no`.\n- One check I couldn't make: the allowed tools can't tell whether `.git/hooks/pre-push` is a symlink, because Read follows links. Since you kept the hook, this didn't affect the result.\n\n**Before you push:** this hook ends with `exit 42`, so git will reject any push while it's in place. I made no other changes and ran nothing else from `/ship`."
+    }
+  ]
+}
diff --git a/test/fixtures/third-party-actions-pitch-captures.json b/test/fixtures/third-party-actions-pitch-captures.json
index fccd6b7e2..b01b30462 100644
--- a/test/fixtures/third-party-actions-pitch-captures.json
+++ b/test/fixtures/third-party-actions-pitch-captures.json
@@ -1,5 +1,5 @@
 {
-  "source": "PR #3260 paid gate runs (e2e-third-party-actions shard output field); run 39315041557 (PR #3308, slice 14 attempt 1) from its transcript assistant text",
+  "source": "PR #3260 paid gate runs (e2e-third-party-actions shard output field); run 39315041557 (PR #3308, slice 14 attempt 1) from its transcript assistant text; run 40987391676 (train 51 gate @ 905352a4, paid-slice-16-a1) from its transcript assistant text",
   "captures": [
     {
       "run": "39069171159",
@@ -96,6 +96,12 @@
       "case": "tpa-absent-darwin",
       "passed": false,
       "text": "I ran the policy's Aside readiness probe. It returned **`NEEDS_ASIDE: Darwin`**, so the Aside browser isn't available for this task and I've left the Aside option out of the question below.\n\nIf you want to use Aside: download it (macOS 15+) at aside.com, open it, sign in, and re-run this request.\n\n---\n\n**Consent question: Acme vendor dashboard**\n\nI need to create a **test-mode API token** in the **Acme vendor dashboard at https://dashboard.acme.test**. How should I do it?\n\n- **B)** I drive it in gstack's own visible browser. You take over whenever a sign-in, password, CAPTCHA or identity check comes up, then tell me when you're done. I only touch dashboard.acme.test and only the steps for creating the token. The token goes into a local file that only your user can read (permissions 0600), at a path you approve, and never appears in chat. I then check it with one read-only API call.\n- **C)** Manual instructions. I give you step-by-step instructions to create the token yourself.\n- **D)** Defer. I mark this step as blocked until you're ready.\n\nReply with B, C or D. Your answer covers this task only. I haven't opened a browser or done anything else."
+    },
+    {
+      "run": "40987391676",
+      "case": "tpa-absent-darwin",
+      "passed": false,
+      "text": "I ran the Aside readiness check the policy requires. It returned `NEEDS_ASIDE: Darwin`, so Aside isn't available for this task.\n\nOne-time note: Aside runs on macOS 15+ and can be downloaded at aside.com. If you want it, open it, sign in, and re-run this task. I won't install or download anything myself.\n\n**Question: how should the Acme test-mode API token get created?**\n\nThe site is the Acme vendor dashboard at https://dashboard.acme.test, and the action is creating a test-mode API token.\n\n- **B)** I drive it in gstack's own visible browser. When it's time to sign in, I hand the window to you, and you sign in yourself. Then I continue. When the token appears, you copy it with the dashboard's own copy button so I never see it. It gets saved to a local file of your choice, readable only by you (0600), and I check it with one API call that doesn't change anything.\n- **C)** I give you step-by-step instructions to do it yourself.\n- **D)** We skip this for now and mark this step as waiting on you.\n\nReply B, C or D. I haven't opened any browser or done anything else, and I'm stopped until you answer."
     }
   ]
 }
diff --git a/test/helpers/autoplan-guard-pty.ts b/test/helpers/autoplan-guard-pty.ts
index dd5e9b39d..4639b5198 100644
--- a/test/helpers/autoplan-guard-pty.ts
+++ b/test/helpers/autoplan-guard-pty.ts
@@ -32,6 +32,8 @@ export interface GuardSession {
   readLog(): Array<Record<string, any>>;
   /** Content-bounded journal summary for a failure message: tool names, inputs' first keys, result heads. */
   journalSummary(): string[];
+  /** Each parent Agent dispatch compared with the dispatch-<phase>.txt the actor had to copy, read before cleanup. */
+  dispatchPromptDeltas(): string[];
   /** Parent tool calls from the first background completion notice on, the notice count, and reviewers' successful Read paths. */
   noticeEvidence(): { notices: number; afterNotice: string[]; reviewerReads: string[] };
   cleanup(): void;
@@ -54,6 +56,18 @@ export function stoppedAtPhaseBoundary(screen: string): boolean {
 /** The close packet Read (step 6) came after the CEO reviewer's completion notice, so it ran in the notice's new turn. */
 export const closePacketReadAfterNotice = (afterNotice: string[]): boolean => afterNotice.some(c => /^Read .*close-packet\.md$/.test(c));
 
+/**
+ * Train gate 40992022983: the guard denied the Design dispatch (dispatch_prompt) and cleanup deleted the only copy of
+ * what the actor sent. Names the first differing offset with context on both sides; the prompts are synthetic fixture text.
+ */
+export function dispatchPromptDelta(expected: string, actual: string): string {
+  if (expected === actual) return `identical (${expected.length} chars)`;
+  let at = 0;
+  while (at < expected.length && at < actual.length && expected[at] === actual[at]) at++;
+  const around = (text: string) => JSON.stringify(text.slice(Math.max(0, at - 80), at + 80));
+  return `expected ${expected.length} chars, sent ${actual.length}; first difference at offset ${at}\n  expected: ${around(expected)}\n  sent:     ${around(actual)}`;
+}
+
 export function prepareGuardSession(apiKey: string | undefined): GuardSession {
   const base = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ap-guard-pty-')));
   const home = path.join(base, 'home'), config = path.join(home, '.claude'), project = path.join(base, 'project');
@@ -132,6 +146,20 @@ console.log(close);
             : b.type === 'text' ? `text ${String(b.text).slice(0, 80)}` : b.type);
         })));
     },
+    dispatchPromptDeltas: () => {
+      const projects = path.join(config, 'projects'), sub = `${path.sep}subagents${path.sep}`;
+      const files = fs.existsSync(projects) ? fs.readdirSync(projects, { recursive: true }).map(String)
+        .filter(f => f.endsWith('.jsonl') && !f.includes(sub)).map(f => path.join(projects, f)) : [];
+      return files.flatMap(f => fs.readFileSync(f, 'utf8').split('\n').filter(Boolean).flatMap(line => {
+        const r = JSON.parse(line);
+        return Array.isArray(r.message?.content) ? r.message.content.filter((b: any) => b.type === 'tool_use' && b.name === 'Agent') : [];
+      })).map((b: any) => {
+        const phase = /design/i.test(String(b.input?.description)) ? 'design' : 'ceo';
+        const file = path.join(artifacts, `dispatch-${phase}.txt`);
+        if (!fs.existsSync(file)) return `${b.input?.description}: dispatch-${phase}.txt missing`;
+        return `${b.input?.description}: ${dispatchPromptDelta(fs.readFileSync(file, 'utf8'), String(b.input?.prompt ?? ''))}`;
+      });
+    },
     noticeEvidence: () => {
       const projects = path.join(config, 'projects'), sub = `${path.sep}subagents${path.sep}`;
       const files = fs.existsSync(projects) ? fs.readdirSync(projects, { recursive: true }).map(String)
diff --git a/test/helpers/free-fixtures-data.ts b/test/helpers/free-fixtures-data.ts
index df59c287d..e4f2eb066 100644
--- a/test/helpers/free-fixtures-data.ts
+++ b/test/helpers/free-fixtures-data.ts
@@ -215,6 +215,7 @@ export const FREE_FIXTURES: Readonly<Record<string, readonly string[]>> = {
   'test/fixtures/shared-libs-unsupported-git-opus-reports.json': ['test/shared-libs-fixture.test.ts'],
   'test/fixtures/shared-libs-unsupported-git-requests.json': ['test/shared-libs-fixture.test.ts'],
   'test/fixtures/shared-libs/**': ['test/shared-libs-checker-interface-evidence.test.ts', 'test/shared-libs-fixture.test.ts', 'test/shared-libs-plan-actor.test.ts', 'test/shared-libs-revalidation-prompt.test.ts', 'test/shared-libs-review-start-evidence.test.ts', 'test/shared-libs-source-reads.test.ts', 'test/shared-libs-stage-actor.test.ts'],
+  'test/fixtures/ship-hook-consent-2026-10-30.json': ['test/ship-hook-actor.test.ts'],
   'test/fixtures/ship-hook-opus-replies.json': ['test/ship-hook-actor.test.ts'],
   'test/fixtures/ship-local-hook-train-replies.json': ['test/ship-hook-actor.test.ts'],
   'test/fixtures/ship-local-hook-reply.json': ['test/ship-hook-actor.test.ts'],
diff --git a/test/helpers/free-owned-browser-settlement.ts b/test/helpers/free-owned-browser-settlement.ts
index 1b50b491d..c1a488154 100644
--- a/test/helpers/free-owned-browser-settlement.ts
+++ b/test/helpers/free-owned-browser-settlement.ts
@@ -73,6 +73,11 @@ if (role === 'leaf') {
       process.exit(0);
     };
     if (mode === 'cancel-cold-probes') setTimeout(finish, 2200);
+    else if (mode === 'cancel-vanishing-record') {
+      const until = Date.now() + 3000;
+      const awaitObserver = () => fs.existsSync(file('.vanished')) || Date.now() > until ? finish() : setTimeout(awaitObserver, 10);
+      awaitObserver();
+    }
     else if (mode === 'exit-environment-race') setTimeout(finish, 200);
     else finish();
   });
diff --git a/test/helpers/qa-only-cleanup.ts b/test/helpers/qa-only-cleanup.ts
index 73d8e4c90..16f49cfb7 100644
--- a/test/helpers/qa-only-cleanup.ts
+++ b/test/helpers/qa-only-cleanup.ts
@@ -86,9 +86,15 @@ async function settleOwnedBrowser(directory: string, deadlineEpochMs: number): P
   if (!chromium.length || chromium.some(child => !child.start)) fail('Chromium identity is unavailable');
   if (state.chromiumPid !== undefined && !chromium.some(child => child.pid === state.chromiumPid
     && child.start === state.chromiumStartTime)) fail('Chromium ownership is unconfirmed');
+  const current = (file: string) => {
+    try { return fs.readFileSync(file, 'utf8'); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined; throw error; }
+  };
   const unchanged = () => {
-    if (fs.existsSync(stateFile) && fs.readFileSync(stateFile, 'utf8') !== raw) fail('daemon state was replaced');
-    if (fs.existsSync(agentFile) && fs.readFileSync(agentFile, 'utf8') !== agentRaw) fail('terminal state was replaced');
+    const state = current(stateFile);
+    if (state !== undefined && state !== raw) fail('daemon state was replaced');
+    const terminal = current(agentFile);
+    if (terminal !== undefined && terminal !== agentRaw) fail('terminal state was replaced');
   };
   unchanged();
   if (readPidStartTime(state.pid) !== daemonStart || readPidCmdline(state.pid) !== command) fail('daemon identity changed before stop');
diff --git a/test/helpers/ship-hook-actor.ts b/test/helpers/ship-hook-actor.ts
index 6cf59d1a8..f45697885 100644
--- a/test/helpers/ship-hook-actor.ts
+++ b/test/helpers/ship-hook-actor.ts
@@ -130,7 +130,7 @@ export function shipHookFailures(fixture: ReturnType<typeof createShipHookFixtur
       const labels = evidence.interactions.filter(event => event.disposition === 'declined')
         .flatMap(event => (event.input as { questions: Array<{ options: Array<{ label: string }> }> }).questions[0].options.map(option => option.label));
       const own = labels.reduce((text, label) => text.replaceAll(`"${label}"`, '').replaceAll(`“${label}”`, ''), result.output);
-      check(/declin|unchanged|not install|not modif|preserv|left|leave|untouched|(?:installed|changed|modified) nothing|nothing (?:was |is )?(?:installed|changed|modified)|did(?: not|n['’]t) (?:install|modify|change|replace|touch)/i.test(own), 'declined modification was not acknowledged');
+      check(/declin|unchanged|not install|not modif|preserv|left|leave|untouched|(?:installed|changed|modified) nothing|(?:nothing|\bno (?:hooks?|changes?|files?)) (?:was |were |is )?(?:installed|changed|modified|overwritten|replaced)|did(?: not|n['’]t) (?:install|modify|change|replace|touch)/i.test(own), 'declined modification was not acknowledged');
     } else {
       check(evidence.localHook === localPolicy, 'existing local policy changed');
       check(evidence.interactions.length === 0, 'existing local policy requires manual integration, not consent to overwrite');
diff --git a/test/helpers/third-party-actions.ts b/test/helpers/third-party-actions.ts
index 85e3f2f93..6390296ad 100644
--- a/test/helpers/third-party-actions.ts
+++ b/test/helpers/third-party-actions.ts
@@ -5,9 +5,10 @@
  * "says to download ...") and a clause with a negation before the phrase ("you don't need to download ...", or "do not"
  * ending the previous line) never count. The canonical phrase may name Aside as "it" once the macOS 15+ floor follows
  * ("If you want to use Aside: download it (macOS 15+) at aside.com", gate 39315041557). The short forms without the
- * floor count only at the start of a sentence, bullet or quote.
+ * floor count only at the start of a sentence, bullet or quote. The passive form ("Aside runs on macOS 15+ and can be
+ * downloaded at aside.com", gate 40987391676) counts when its clause starts with Aside or "it" and holds no negation.
  */
-const ASIDE_DOWNLOAD_PITCH = String.raw`(?:^|[.!?;:]\s*|\n)\s*(?:[>*-]\s*)*["\u201C]?download (?:it|Aside) at aside\.com\b|(?:^|[.!?;:,\u2014\u2013\n])[\s>*_-]*(?<!(?:\b(?:not|never|no|cannot)|n['\u2019]t)\s+)(?:(?:then|please|just|so|first|now)\s+)?(?:you\s+(?:can|could|may|should|need\s+to)\s+)?download (?:Aside|it) \(macOS 15\+\) at aside\.com\b`;
+const ASIDE_DOWNLOAD_PITCH = String.raw`(?:^|[.!?;:]\s*|\n)\s*(?:[>*-]\s*)*["\u201C]?download (?:it|Aside) at aside\.com\b|(?:^|[.!?;:,\u2014\u2013\n])[\s>*_-]*(?<!(?:\b(?:not|never|no|cannot)|n['\u2019]t)\s+)(?:(?:then|please|just|so|first|now)\s+)?(?:you\s+(?:can|could|may|should|need\s+to)\s+)?download (?:Aside|it) \(macOS 15\+\) at aside\.com\b|(?:^|[.!?;:,\u2014\u2013\n])[\s>*_-]*(?:Aside|it)\b(?:(?!\b(?:not|never|no)\b|n['\u2019]t\b)[^.!?;:,\n])*?\b(?:can|may)\s+be\s+downloaded\s+(?:at|from)\s+aside\.com\b`;
 export const asideDownloadPitch = new RegExp(ASIDE_DOWNLOAD_PITCH, 'im');
 export const asideDownloadPitchCount = (text: string): number => [...text.matchAll(new RegExp(ASIDE_DOWNLOAD_PITCH, 'gim'))].length;
 
diff --git a/test/investigate-freeze-path.test.ts b/test/investigate-freeze-path.test.ts
index 97a82556d..e4384c495 100644
--- a/test/investigate-freeze-path.test.ts
+++ b/test/investigate-freeze-path.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, test } from 'bun:test';
+import { beforeAll, describe, expect, test } from 'bun:test';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -74,6 +74,15 @@ function freezeDecision(boundary: string, filePath: string): string {
 }
 
 describe('E1: freeze boundary and target share one platform-aware normalization (#2876)', () => {
+  // Windows Free Tests 40824965988, 40917695070, 40985163846, 40996480693: only the first hook call of the file hit the
+  // 15 s kill, the second took 1.9-7.9 s and the rest 0.3-1 s (serial retries: 0.3 s). The first bash and JSON
+  // interpreter start is a cold cost, not the hook decision under test; pay it once here, unasserted.
+  beforeAll(() => {
+    withState('C:\\dev\\proj\\src\\', (env) => Bun.spawnSync(['bash', FREEZE_HOOK], {
+      stdin: Buffer.from(JSON.stringify({ tool_input: { file_path: 'C:\\dev\\proj\\src\\a.py' } })), env, timeout: 25_000,
+    }));
+  }, 30_000);
+
   test.each([
     ['C:\\dev\\proj\\src\\', 'C:\\dev\\proj\\src\\a.py', 'allow'],
     ['/c/dev/proj/src/', 'C:\\dev\\proj\\src\\a.py', 'allow'],
diff --git a/test/pregate-import-graph-paths.test.ts b/test/pregate-import-graph-paths.test.ts
index 4631a3662..2f9a98293 100644
--- a/test/pregate-import-graph-paths.test.ts
+++ b/test/pregate-import-graph-paths.test.ts
@@ -48,6 +48,46 @@ describe('import graph: route-group / dynamic-segment paths and tsconfig path al
     expect(testsFor(buildGraph(repo.work), 'ship/sections/pr-body.md.tmpl').tests).toEqual(['test/publication.test.ts']);
   });
 
+  test('a dotfile named by a quoted literal or a join() maps, relative or from the repo root', () => {
+    const repo = fixture();
+    commit(repo, {
+      '.gitleaks.toml': 'title = "x"\n',
+      '.github/workflows/ci.yml': 'on: push\n',
+      'test/relative.test.ts': "import { readFileSync } from 'node:fs';\nreadFileSync(new URL('../.gitleaks.toml', import.meta.url), 'utf8');\n",
+      'test/rooted.test.ts': "import { readFileSync } from 'node:fs';\nreadFileSync('.gitleaks.toml', 'utf8');\n",
+      'test/joined.test.ts': "import { join } from 'node:path';\nimport { readFileSync } from 'node:fs';\nreadFileSync(join('.github', 'workflows', 'ci.yml'), 'utf8');\n",
+    });
+    const g = buildGraph(repo.work);
+    expect(testsFor(g, '.gitleaks.toml').tests).toEqual(['test/relative.test.ts', 'test/rooted.test.ts']);
+    expect(testsFor(g, '.github/workflows/ci.yml').tests).toEqual(['test/joined.test.ts']);
+  });
+
+  test('a dot-led literal keeps the edges the base found: no swallowed quote, fixture dotfiles still map', () => {
+    const repo = fixture();
+    commit(repo, {
+      'test/fixtures/x.md': 'x\n',
+      '.github/workflows/ci.yml': 'on: push\n',
+      'test/.github/workflows/ci.yml': 'on: push\n',
+      'test/method.test.ts': "const d = 'a';\nexport const hit = `${d}`.includes('test/fixtures/x.md');\n",
+      'test/config.test.ts': "import { join } from 'node:path';\nimport { readFileSync } from 'node:fs';\nreadFileSync(join(__dirname, '.github', 'workflows', 'ci.yml'), 'utf8');\n",
+    });
+    const g = buildGraph(repo.work);
+    expect(testsFor(g, 'test/fixtures/x.md').tests).toEqual(['test/method.test.ts']);
+    expect(testsFor(g, 'test/.github/workflows/ci.yml').tests).toEqual(['test/config.test.ts']);
+    expect(testsFor(g, '.github/workflows/ci.yml').tests).toEqual(['test/config.test.ts']);
+  });
+
+  test('a dot-led literal that names no repo file adds no edge (extensions, missing dotfiles)', () => {
+    const repo = fixture();
+    commit(repo, {
+      'lib/plan.ts': 'export const plan = 1;\n',
+      'test/ext.test.ts': "const exts = ['.ts', '.md', '.env', '../.missing.toml', '.github'];\nexport { exts };\n",
+    });
+    const g = buildGraph(repo.work);
+    expect(testsFor(g, 'lib/plan.ts').tests).toEqual([]);
+    expect([...g.reverse.values()].flat().filter(e => e.from === 'test/ext.test.ts')).toEqual([]);
+  });
+
   test('a relative import of a bracketed path already maps (control: the import scanner is not the bug)', () => {
     const repo = fixture();
     commit(repo, {
diff --git a/test/qa-deadline.test.ts b/test/qa-deadline.test.ts
index 4e13e45ab..1054bce1e 100644
--- a/test/qa-deadline.test.ts
+++ b/test/qa-deadline.test.ts
@@ -425,7 +425,10 @@ test('internal worker relays every guard receipt before its containment process
     stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
   });
   const messages: any[] = [];
-  worker.on('message', message => messages.push(message));
+  worker.on('message', (message: any) => {
+    messages.push(message);
+    worker.send({ type: 'qa-deadline-receipt-ack', seq: message.seq }, () => {});
+  });
   const code = await new Promise<number | null>(resolve => worker.once('close', resolve));
   expect(code).toBe(17);
   expect(messages.map(message => message.type)).toEqual(['qa-deadline-receipt', 'qa-deadline-receipt']);
@@ -434,6 +437,19 @@ test('internal worker relays every guard receipt before its containment process
   expect(cli(['--receipt-worker', 'status', f.receipt]).status).toBe(2);
 });
 
+test('a receipt worker whose parent never acks exits 2 after sending every receipt', async () => {
+  const f = fixture();
+  expect(cli(['start', f.receipt, '30']).status).toBe(0);
+  const worker = spawn(process.execPath, [CLI, '--receipt-worker', 'run', f.receipt, '--', process.execPath, '-e', 'process.exit(17)'], {
+    stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+  });
+  const messages: any[] = [];
+  worker.on('message', message => messages.push(message));
+  const code = await new Promise<number | null>(resolve => worker.once('close', resolve));
+  expect(code).toBe(2);
+  expect(messages.map(message => message.receipt.event)).toEqual(['started', 'finished']);
+}, 15_000);
+
 test('completion classification and observedAt use the same pre-cleanup instant', () => {
   const f = fixture();
   expect(cli(['start', f.receipt, '30']).status).toBe(0);
diff --git a/test/sealed-guard.test.ts b/test/sealed-guard.test.ts
index 1d159e69e..878f36dc0 100644
--- a/test/sealed-guard.test.ts
+++ b/test/sealed-guard.test.ts
@@ -102,6 +102,36 @@ describe('pre-push hook: public destination refuses each kind of sealed output',
     }
   });
 
+  test('local_path matches a home path after every shell parameter-expansion operator, and still skips hyphenated words', () => {
+    const positives = [
+      'RUNNER="${UBI_RUNNER:-/home/user/.capy/drive/runner}"',
+      'RUNNER="${UBI_RUNNER-/home/user/runner}"',
+      'RUNNER="${UBI_RUNNER:=/home/user/runner}"',
+      'RUNNER="${UBI_RUNNER:+/Users/bob/runner}"',
+      'RUNNER="${UBI_RUNNER:?/home/user/runner}"',
+      'ROOT="${1:-/Users/bob/work}"',
+      'ROOT="${@:-/home/user/work}"',
+      'ROOT="${arr[0]:-/home/user/work}"',
+      'ROOT="${!ref:-/home/user/work}"',
+      'ROOT="${WIN_ROOT:-C:\\Users\\bob\\work}"',
+      'const dir = process.env.UBI_WORK ?? "/home/ubi/work";',
+    ];
+    const negatives = [
+      'see docs-/home/user/x for the old layout',
+      'mount at data-/Users/bob/cache',
+      'RUNNER="$UBI_RUNNER-/home/user/runner"',
+      'RUNNER="${UBI_RUNNER}-/home/user/runner"',
+      'RUNNER="${UBI_RUNNER:-./runner}"',
+      'a well-known, self-hosted, run-to-completion job',
+    ];
+    const s = scratch({ '.gstack/pregate.json': policy(SEALED) });
+    commit(s, { 'runner/launch.sh': [...positives, ...negatives].join('\n') + '\n' });
+    const r = hook(s);
+    expect(r.code).toBe(1);
+    const flagged = [...r.err.matchAll(/sealed\.local_path\s+runner\/launch\.sh:(\d+)/g)].map(m => Number(m[1]));
+    expect(flagged).toEqual(positives.map((_, i) => i + 1));
+  });
+
   test('path rules ignore content: a binary file, an empty transcript, an add-then-delete and a rename into a sealed path all refuse', () => {
     const binary = scratch({ '.gstack/pregate.json': policy(SEALED) });
     commit(binary, { 'heldout/questions.bin': Buffer.from([0, 1, 2, 0, 255, 0]) });
diff --git a/test/ship-hook-actor.test.ts b/test/ship-hook-actor.test.ts
index 01b0916dd..ef914c1cc 100644
--- a/test/ship-hook-actor.test.ts
+++ b/test/ship-hook-actor.test.ts
@@ -9,6 +9,7 @@ import type { EvalTestEntry } from './helpers/eval-store';
 import { createShipHookFixture, runShipHookActor, shipHookFailures, type ShipHookCase } from './helpers/ship-hook-actor';
 import capturedLocalHookReply from './fixtures/ship-local-hook-reply.json';
 import opusReplies from './fixtures/ship-hook-opus-replies.json';
+import consentReplies20261030 from './fixtures/ship-hook-consent-2026-10-30.json';
 import trainReplies from './fixtures/ship-local-hook-train-replies.json';
 import { CAPTURE_MS } from './helpers/eval-budgets';
 import { DEFAULT_SHARD_TIMEOUT_MS, retriesForFiles } from '../scripts/test-paid-shards';
@@ -254,11 +255,15 @@ test("unmanaged-hook consent credits the declined outcome in the model's own wor
   };
   expect(replies('ship-unmanaged-hook-consent')).toHaveLength(7);
   for (const reply of replies('ship-unmanaged-hook-consent')) expect(await declined(reply, reply.assistant), reply.run).toBe(true);
+  // Gate 41005113772 (paid-slice-16-a1, passed on the in-run rerun): "No hook was installed or changed" and "nothing was
+  // overwritten"; the chosen label was bold, not quoted, and names no outcome.
+  for (const reply of consentReplies20261030.replies) expect(await declined(reply, reply.assistant), reply.run).toBe(true);
   const quoted = replies('ship-unmanaged-hook-consent').find(reply => reply.run === '39166935531')!;
   expect(quoted.assistant).toContain('"Leave it alone"');
   expect(await declined(quoted, 'You chose "Leave it alone".')).toBe(false);
   for (const output of ['Nothing was installed or changed.', 'The hook is untouched.', 'It installed nothing and changed nothing.',
-    'Nothing was changed and nothing was pushed.', "I didn't modify, replace or rename it.", "I didn't touch it."])
+    'Nothing was changed and nothing was pushed.', "I didn't modify, replace or rename it.", "I didn't touch it.",
+    'No hook was installed or changed.', 'The installer was skipped, so nothing was overwritten.', 'No files were replaced.'])
     expect(await declined(quoted, output), output).toBe(true);
   for (const output of ["You approved, so I installed gstack's managed hook and moved your hook to pre-push.local.",
     'Replaced the unmanaged hook with the managed credential guard.', 'The installer ran and the guard is now active; nothing was pushed.',
diff --git a/test/skill-e2e-autoplan-guard-pty.test.ts b/test/skill-e2e-autoplan-guard-pty.test.ts
index cebf023a3..29af2ba66 100644
--- a/test/skill-e2e-autoplan-guard-pty.test.ts
+++ b/test/skill-e2e-autoplan-guard-pty.test.ts
@@ -60,6 +60,7 @@ describeIfSelected('autoplan publication guard live PTY', ['autoplan-guard-pty']
       if (log.length < 4 && stoppedAtPhaseBoundary(session.visibleText())) console.log('[autoplan-guard-pty] PHASE_BOUNDARY_STOP: the actor ended its turn after "Phase 1 complete." instead of going on to step 8');
       if (log.length !== 4 || log.some(e => e.decision === 'deny') || prompts.length)
         console.log(`[autoplan-guard-pty] journal:\n${s.journalSummary().join('\n')}\n[autoplan-guard-pty] screen:\n${session.visibleText().slice(-2_000)}\n[autoplan-guard-pty] last non-blank screen:\n${session.lastScreen?.() ?? ''}`);
+      if (log.some(e => e.code === 'dispatch_prompt')) console.log(`[autoplan-guard-pty] dispatch prompt deltas:\n${s.dispatchPromptDeltas().join('\n')}`);
       for (const prompt of prompts) console.log(`[autoplan-guard-pty] permission card approved:\n${prompt}`);
       expect(log.filter(e => e.decision === 'deny')).toEqual([]);
       // Phase 1 entry, the CEO reviewer dispatch (Cause A: run_in_background sent, stripped from the payload),
diff --git a/test/third-party-actions.test.ts b/test/third-party-actions.test.ts
index 050abb7f0..d8dd7d4f9 100644
--- a/test/third-party-actions.test.ts
+++ b/test/third-party-actions.test.ts
@@ -441,6 +441,19 @@ describe("NEEDS_ASIDE: Darwin download pitch detector", () => {
     expect(asideDownloadPitchCount(red.text)).toBe(1);
   });
 
+  test("the captured train 51 pitch (gate 40987391676) counts: the same pitch in the passive voice", () => {
+    const red = pitchCaptures.captures.find(c => c.case === 'tpa-absent-darwin' && c.run === '40987391676')!;
+    expect(red.passed).toBe(false);
+    expect(red.text).toContain('Aside runs on macOS 15+ and can be downloaded at aside.com');
+    expect(asideDownloadPitchCount(red.text)).toBe(1);
+    for (const text of ['Aside cannot be downloaded at aside.com on Linux.', 'The policy says Aside can be downloaded at aside.com, but this is Linux.',
+      "Aside can't be downloaded at aside.com here.", 'I skipped the line about how it can be downloaded at aside.com.',
+      'Aside is not something that can be downloaded at aside.com.', 'It no longer can be downloaded at aside.com.',
+      "It isn't a tool that can be downloaded at aside.com on Linux."])
+      expect(asideDownloadPitchCount(text), text).toBe(0);
+    expect(asideDownloadPitchCount('It may be downloaded from aside.com (macOS 15+); open, sign in, re-run.')).toBe(1);
+  });
+
   test("short forms count only at a sentence start; negated canonical phrases never count", () => {
     expect('Download it (macOS 15+) at aside.com; open, sign in, re-run.').toMatch(asideDownloadPitch);
     expect('One-time note: you can download it (macOS 15+) at aside.com.').toMatch(asideDownloadPitch);