diff --git a/.github/workflows/free-durations-record.yml b/.github/workflows/free-durations-record.yml
index 8faa4598f..85749eea0 100644
--- a/.github/workflows/free-durations-record.yml
+++ b/.github/workflows/free-durations-record.yml
@@ -164,7 +164,7 @@ jobs:
           - Files that failed while recording (durations kept; this PR's own free checks decide): $failed_line
           - Seed growth ratchet (60 s ceiling, shrink-only allowlist): $ratchet_line
 
-          Data only. This run dispatched Free Tests (the required free-tests check), Windows Free Tests and Quality gate on this branch; those are this PR's checks. The pull_request runs wait as "action required" because a token-opened PR never starts them without approval. Stamp and merge per docs/ship-policy.md; the stamp push runs the full PR checks.
+          Data only. This run dispatched Free Tests (the required free-tests check), Windows Smoke and Quality gate on this branch; those are this PR's checks. The pull_request runs wait as "action required" because a token-opened PR never starts them without approval. Stamp and merge per docs/ship-policy.md; the stamp push runs the full PR checks.
           EOF
           if [ -n "$number" ]; then
             gh pr edit "$number" --body-file pr-body.md
@@ -172,5 +172,5 @@ jobs:
             gh pr create --base main --head "$branch" --title "test(seed): refresh the free-suite duration seeds" --body-file pr-body.md
           fi
           gh workflow run free-tests.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
-          gh workflow run windows-free-tests.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
+          gh workflow run windows-smoke.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
           gh workflow run quality-gate.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
diff --git a/.github/workflows/windows-free-tests.yml b/.github/workflows/windows-free-tests.yml
index 33e896c42..6146e927d 100644
--- a/.github/workflows/windows-free-tests.yml
+++ b/.github/workflows/windows-free-tests.yml
@@ -1,9 +1,15 @@
 name: Windows Free Tests
 
-# The Windows-safe subset of the free suite on GitHub's free `windows-latest`
-# runners. scripts/test-free-shards.ts --windows-only is the single source of
-# truth for which files run: POSIX-bound tests (bin/ shebang spawns, raw /tmp
-# paths, /bin/sh, mode bitmasks, the Bun-driven browse server) are excluded by
+# Nightly, not a PR gate. Windows has minimal support (docs/support-tiers.md):
+# the required Windows check is windows-smoke.yml (./setup plus the core
+# skills). This workflow runs the curated Windows-safe subset of the free suite
+# on main every night and on workflow_dispatch, and never blocks a pull
+# request. A red nightly run gets a fix only when it shows an install, startup
+# or core-workflow break; other Windows-only failures close as won't fix.
+#
+# scripts/test-free-shards.ts --windows-only is the single source of truth for
+# which files run: POSIX-bound tests (bin/ shebang spawns, raw /tmp paths,
+# /bin/sh, mode bitmasks, the Bun-driven browse server) are excluded by
 # pattern there, with explicit force-include and known-incompatible lists.
 # Every run prints the curated count and top exclusion reasons in the job
 # summary so a shrinking subset is visible.
@@ -27,13 +33,9 @@ name: Windows Free Tests
 # dispatch and duration-recording runs never consume.
 
 on:
-  pull_request:
-    branches: [main]
-  # Also on main pushes, as free-tests.yml does: trains dispatch only the
-  # Linux free workflow, so without this no Windows run ever sees a train's
-  # combined tree or main after a merge.
-  push:
-    branches: [main]
+  # 09:17 UTC, about 2 AM Pacific, on the default branch (main).
+  schedule:
+    - cron: '17 9 * * *'
   workflow_dispatch:
     inputs:
       record_durations:
@@ -113,8 +115,10 @@ jobs:
           if-no-files-found: error
 
   windows-free-shard:
+    # gstack-pregate reads a job keyed on a dispatch input as manual, never a
+    # PR obligation; this lane runs only nightly or by hand.
     needs: [windows-plan, reuse]
-    if: ${{ !cancelled() && needs.windows-plan.result == 'success' && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
+    if: ${{ !cancelled() && !inputs.record_durations && needs.windows-plan.result == 'success' && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: windows-latest
     timeout-minutes: 15
     strategy:
@@ -139,14 +143,8 @@ jobs:
           name: windows-plan
           path: ${{ runner.temp }}
 
-      # bun's install cache lives under ~/.bun/install/cache on every platform.
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: ~/.bun/install/cache
-          key: windows-bun-${{ hashFiles('bun.lock') }}
-          # A lockfile bump starts from the previous cache instead of cold.
-          restore-keys: |
-            windows-bun-
+      # No bun install cache: restoring the ~450 MB entry took 33-42 s per
+      # shard, a cold install 16-17 s (GSTA-203 PR 1 A/B, 3 runs per arm).
 
       - name: Configure git identity (required by tests that init temp repos)
         run: |
diff --git a/.github/workflows/windows-setup-e2e.yml b/.github/workflows/windows-setup-e2e.yml
index 6b2b928fe..2ca74e7b4 100644
--- a/.github/workflows/windows-setup-e2e.yml
+++ b/.github/workflows/windows-setup-e2e.yml
@@ -92,16 +92,8 @@ jobs:
         with:
           bun-version: 1.4.2
 
-      # Same lockfile-keyed install cache as windows-free-tests.yml (install
-      # was 45s of a 64s job, all network).
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: ~/.bun/install/cache
-          key: windows-bun-${{ hashFiles('bun.lock') }}
-          # A lockfile bump starts from the previous cache instead of cold
-          # (restore alone costs ~43s; without this a bump pays it for nothing).
-          restore-keys: |
-            windows-bun-
+      # No bun install cache, as in windows-free-tests.yml: a cold install is
+      # faster on windows-latest than restoring the ~450 MB cache entry.
 
       - name: Configure git identity
         run: |
diff --git a/.github/workflows/windows-smoke.yml b/.github/workflows/windows-smoke.yml
new file mode 100644
index 000000000..525f50553
--- /dev/null
+++ b/.github/workflows/windows-smoke.yml
@@ -0,0 +1,170 @@
+name: Windows Smoke
+
+# The required Windows check under minimal support (docs/support-tiers.md):
+# with a default Git for Windows install, ./setup installs and the core skills
+# start. One windows-latest job, under 5 minutes:
+#   1. ./setup --host claude into an isolated HOME under Git Bash, with
+#      gstack's own browser (Playwright Chromium).
+#   2. The core skills start: gstack-skill-start for /ship, /review,
+#      /qa-only, /investigate and /browse answers SKILL_START_PROTO: 1.
+#   3. /browse on gstack's own browser: the installed browse runs a piped
+#      chain flow against a local page from an unrelated directory.
+#   4. The fastest Windows-safe free tests for those paths (list below).
+# The full curated Windows suite is windows-free-tests.yml: nightly on main
+# and on dispatch, never a PR gate.
+#
+# No bun install cache: a cold install took 16-17 s on windows-latest, a
+# restore of the ~450 MB cache 33-42 s (GSTA-203 PR 1 A/B, 3 runs per arm).
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: windows-smoke-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  windows-smoke:
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.2
+
+      - name: Configure git identity (required by tests that init temp repos)
+        run: |
+          git config --global user.email "windows-smoke@gstack.test"
+          git config --global user.name "Windows Smoke"
+          git config --global init.defaultBranch main
+        shell: bash
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        shell: bash
+
+      - name: ./setup installs into an isolated HOME
+        run: |
+          set -euo pipefail
+          SMOKE_HOME="$RUNNER_TEMP/smoke-home"
+          mkdir -p "$SMOKE_HOME"
+          HOME="$SMOKE_HOME" USERPROFILE="$(cygpath -w "$SMOKE_HOME")" ./setup --host claude
+          test -x "$SMOKE_HOME/.claude/skills/gstack/bin/gstack-skill-start" || (echo "MISSING: installed gstack-skill-start" && exit 1)
+        shell: bash
+
+      - name: The core skills start
+        run: |
+          set -euo pipefail
+          SMOKE_HOME="$RUNNER_TEMP/smoke-home"
+          USERPROFILE="$(cygpath -w "$SMOKE_HOME")"
+          export HOME="$SMOKE_HOME" USERPROFILE
+          for skill in ship review qa-only investigate browse; do
+            set +e
+            OUT=$(timeout 120 "$SMOKE_HOME/.claude/skills/gstack/bin/gstack-skill-start" --skill "$skill" --model claude 2>&1 < /dev/null)
+            CODE=$?
+            set -e
+            echo "::group::$skill"; echo "$OUT"; echo "::endgroup::"
+            test "$CODE" -eq 0 || (echo "/$skill: gstack-skill-start exited $CODE" && exit 1)
+            grep -q '^SKILL_START_PROTO: 1' <<< "$OUT" || (echo "/$skill: no SKILL_START_PROTO: 1 line" && exit 1)
+          done
+        shell: bash
+
+      - name: /browse on gstack's own browser runs a piped chain flow from an unrelated directory
+        run: |
+          set -euo pipefail
+          SMOKE_HOME="$RUNNER_TEMP/smoke-home"
+          USERPROFILE="$(cygpath -w "$SMOKE_HOME")"
+          export HOME="$SMOKE_HOME" USERPROFILE
+          BROWSE="$SMOKE_HOME/.claude/skills/gstack/browse/dist/browse.exe"
+          [ -f "$BROWSE" ] || BROWSE="$SMOKE_HOME/.claude/skills/gstack/browse/dist/browse"
+          test -f "$BROWSE" || (echo "MISSING: installed browse" && exit 1)
+          bun -e 'Bun.serve({ hostname: "127.0.0.1", port: 47124, fetch: () => new Response("<title>gstack smoke</title><h1>gstack-windows-smoke-ok</h1>", { headers: { "content-type": "text/html" } }) }); setInterval(() => {}, 1 << 30);' &
+          PAGE_PID=$!
+          trap 'kill "$PAGE_PID" 2>/dev/null || true; "$BROWSE" stop >/dev/null 2>&1 || true' EXIT
+          mkdir -p "$RUNNER_TEMP/unrelated-dir" && cd "$RUNNER_TEMP/unrelated-dir"
+          set +e
+          OUT=$(printf '%s\n' '[["goto","http://127.0.0.1:47124/"],["text"]]' | "$BROWSE" chain 2>&1)
+          CODE=$?
+          set -e
+          echo "$OUT"
+          if [ "$CODE" -ne 0 ]; then
+            find "$RUNNER_TEMP/unrelated-dir" "$SMOKE_HOME" -maxdepth 4 \( -name 'browse-daemon.log' -o -name 'browse-startup-error.log' \) -print -exec tail -n 60 {} \; 2>/dev/null || true
+            echo "browse chain exited $CODE" && exit 1
+          fi
+          grep -q 'gstack-windows-smoke-ok' <<< "$OUT" || (echo "chain output lacks the page text: the flow did not run" && exit 1)
+        shell: bash
+
+      - name: Fastest Windows-safe free tests for install and the core skills
+        # Windows-measured seconds from scripts/free-test-durations-windows.json.
+        #   setup-windows-fallback (0.1): setup's _link_or_copy copies, never links, on Windows
+        #   setup-staged-copy (0.6): a copy install is staged and swapped in only when complete
+        #   setup-windows-rerun-refresh (1.7): re-running ./setup refreshes copied skills (#2444)
+        #   setup-skill-copies (0.1): copied SKILL.md hashes and the backup of an edited copy
+        #   setup-bun-cmd-and-pipe-bugs (0.4): setup's bun.cmd and pipe handling
+        #   gstack-launch-probe (0.1): setup's Smart App Control launch probe (#2595)
+        #   state-root-parity (2.1): every skill start resolves one state root in TS and bash
+        #   bun-isolation-launch (1.1): Bun entries ignore .env and bunfig under Git Bash (#3415)
+        #   gstack-lease-git-bash (3.7): the skill-start lease under Git Bash (#3330)
+        #   gstack-wtree-windows-paths (1.3): /review and /ship record a start on C:/ paths (#3101)
+        #   ship-hook-windows-paths (2.3): /ship's pre-push guard in a Windows worktree (#2805)
+        #   qa-only-browser-probe (2.4): /qa-only's browser probe fixture
+        #   find-browse (0.1): /browse resolves its binary (.exe)
+        #   cli-chain-stdin (0.3): /browse chain reads its flow from stdin on Windows (#3039)
+        #   windows-spawn-hide (0.1): /browse's spawns hide their console window (#1835)
+        env:
+          GSTACK_FREE_RETRY_FLAKY: '1'
+          GSTACK_FLAKE_LEDGER: ${{ runner.temp }}/flake-ledger.jsonl
+          TEMP: ${{ runner.temp }}
+          TMP: ${{ runner.temp }}
+        run: |
+          set -euo pipefail
+          cat > "$RUNNER_TEMP/windows-smoke-files.txt" <<'LIST'
+          test/setup-windows-fallback.test.ts
+          test/setup-staged-copy.test.ts
+          test/setup-windows-rerun-refresh.test.ts
+          test/setup-skill-copies.test.ts
+          test/setup-bun-cmd-and-pipe-bugs.test.ts
+          test/gstack-launch-probe.test.ts
+          test/state-root-parity.test.ts
+          test/bun-isolation-launch.test.ts
+          test/gstack-lease-git-bash.test.ts
+          test/gstack-wtree-windows-paths.test.ts
+          test/ship-hook-windows-paths.test.ts
+          test/qa-only-browser-probe.test.ts
+          browse/test/find-browse.test.ts
+          browse/test/cli-chain-stdin.test.ts
+          browse/test/windows-spawn-hide.test.ts
+          LIST
+          bun run scripts/test-free-shards.ts --files-from "$RUNNER_TEMP/windows-smoke-files.txt"
+        shell: bash
+
+      - name: Upload full test logs
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: windows-smoke-logs
+          path: |
+            .context/free-test-logs/gstack-free-test-*.log
+            ${{ runner.temp }}/gstack-free-test-*.log
+          include-hidden-files: true
+          if-no-files-found: ignore
+
+      - name: Upload flake ledger
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: flake-ledger-windows-smoke
+          path: ${{ runner.temp }}/flake-ledger.jsonl
+          if-no-files-found: ignore
+          retention-days: 90
diff --git a/.gstack/pregate.json b/.gstack/pregate.json
index c424957cc..74a99f1ad 100644
--- a/.gstack/pregate.json
+++ b/.gstack/pregate.json
@@ -16,8 +16,7 @@
     "supabase/**": []
   },
   "selection": {
-    "free-tests.yml/free-suite": "bun run scripts/test-free-shards.ts --list",
-    "windows-free-tests.yml/windows-free-shard": "bun run scripts/test-free-shards.ts --windows-only --list"
+    "free-tests.yml/free-suite": "bun run scripts/test-free-shards.ts --list"
   },
   "run_profiles": {
     "ci-reuse/free-tests": { "workflow": "free-tests.yml", "events": ["pull_request", "workflow_dispatch"], "jobs": ["free-plan", "typecheck", "quick-bun-default", "cso-macos-launcher", "macos-named-regressions", "cso-windows-launcher", "cso-docker-integration", "free-tests"], "artifact": "tested-tree", "os": "Linux" },
diff --git a/.gstack/ship-policy.json b/.gstack/ship-policy.json
index 2ae73849b..a37b11ca4 100644
--- a/.gstack/ship-policy.json
+++ b/.gstack/ship-policy.json
@@ -14,6 +14,6 @@
   "pr_count": { "default_pr_count": 1, "split_requires_owner": true },
   "maintainers": ["garrytan"],
   "train": { "gate_workflow": "evals.yml", "free_workflow": "free-tests.yml", "full_gate_check": "gstack/full-gate", "record_artifact": "gstack-train-record", "max_size": 5, "fill_hours": 1, "screen_selection": "gstack-paid", "trial_reservation_usd": 1.5 },
-  "changelog_fragments": { "dir": "changelog.d", "required_checks": ["free-tests", "windows-free-tests", "Check VERSION is not stale vs queue", "quality", "check-freshness", "actionlint"] },
+  "changelog_fragments": { "dir": "changelog.d", "required_checks": ["free-tests", "windows-smoke", "Check VERSION is not stale vs queue", "quality", "check-freshness", "actionlint"] },
   "min_gstack_version": "1.91.340.0"
 }
diff --git a/AGENTS.md b/AGENTS.md
index febab17af..1b724461b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -285,9 +285,11 @@ Support tiers (full: macOS, Linux; minimal: Windows, Gemini models) are in
 [docs/support-tiers.md](docs/support-tiers.md).
 
 - **macOS** + **Linux**: full test suite supported.
-- **Windows**: the curated Windows-safe subset runs in the `windows-free-tests`
-  CI workflow across six `windows-latest` jobs, packed by Windows-measured
-  durations. Setup script (`./setup`) requires Git Bash or
+- **Windows**: minimal support; [docs/support-tiers.md](docs/support-tiers.md)
+  says what is promised. Every PR must pass the `windows-smoke` check (`./setup`,
+  the core skills start, the fastest Windows-safe tests); the curated
+  Windows-safe subset runs nightly on main in `windows-free-tests` and never
+  blocks a PR. Setup script (`./setup`) requires Git Bash or
   MSYS today; native PowerShell support is a future expansion. The `bin/gstack-paths`
   helper resolves state roots through `CLAUDE_PLUGIN_DATA` / `GSTACK_HOME` so plugin
   installs work on every platform.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7a2763c2..1a662182b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,155 @@
 # Changelog
 
+## [1.92.56.0] - 2026-11-02
+
+**`gstack-ship-receipt write` records the session kind on Windows.** Without `--session-kind` or `GSTACK_SESSION_KIND`, it asks the `gstack-session-kind` bash helper. It used to spawn that helper by path, which never starts on Windows, so every /ship receipt there carried no `session_kind`. It now starts the helper through `lib/script-invocation.ts`, which uses Git Bash on Windows. This is the /ship half of #3541.
+
+### Fixed
+- **`bin/gstack-ship-receipt`** starts `gstack-session-kind` with `runScriptSync`.
+
+### Tests
+- `test/ship-receipt-session-kind.test.ts` (windows-free-tests too): a receipt written without a session kind records what `gstack-session-kind` prints.
+
+## [1.92.55.0] - 2026-11-02
+
+- **`/ship` finish no longer stops on a branch whose restamp moved its own stale stamp after a lost slot** (`gstack-ship-release finish`, GST-895). When a branch loses its merge slot, merges main and runs `gstack-restamp --next`, the restamp moves the branch's own `since:` rows from the lost version to the new one. Finish only accepted a moved version at or above the reviewed tree's VERSION, which now came from main, so it read those rows as a behavior change and stopped with "insert 5–11.5 → 12–14 → 16" (gbrain #8134 on 1.92.46.0). Now a line the branch added itself, by the same rule restamp uses (added since the merge base with main, and not added by main), may move any version newer than the branch's fork point, and finish routes it as release metadata. A row main carries, a row main edited after the merge, and a branch row at or before the fork point still stop. Only `stamp_files` paths count, and nothing else on the line may change.
+
+### Tests
+- `test/ship-rereview-triggers.test.ts`: after a lost slot, a merge of main and a restamp, the branch's moved row routes as metadata; moving main's own row, a merged main row that main later edited, a branch row at the fork version, or one older than the fork point each stop. The first case fails on main with `behavior=1`.
+
+## [1.92.54.0] - 2026-11-02
+
+**`train land` and a single-PR `land` can no longer publish onto main at the same time, and a slot that forgot its version bump can no longer merge (#3599, #3531; GSTA-157).** Before, `train land` took no lock, so it and `land` could both read the same main and publish a combined tree neither tested. And train 33's `verify --train` said "may merge" for #3527's head after a bare commit dropped the stamp that restamp had written but not staged, so #3527 shipped under #3526's version.
+
+### Fixed
+- **`train land` takes the shared land lock** (`refs/notes/gstack-land`, now in lib/ship-queue-land-lock.ts) as `train <nonce> slot <i> (#<pr>)`. Whichever of `land` and `train land` starts second refuses with `QUEUE_LAND_LOCKED`, naming the holder. Once a slot has merged, the train keeps the lock in phase `between` until its last slot lands, through a refusal on the next slot too, so no single land slips in between slots and sets off a freeze. A stop that freezes the queue leaves the lock in phase `freeze`, which only the admitted repair train takes over while the freeze lasts; once the freeze is cleared, the next `land` or `train land` takes over a freeze lock whose release push failed. A lock ref deleted on origin now reads as no lock, not as this clone's cached copy.
+- **`--break-lock` prints the holder** (`LOCK_HOLDER:`), keeps land's staleness, mid-push and drift rules, never breaks a `freeze` lock, waits 10 minutes on a `between` lock, and refuses a live train run's lock unless `--break-train-lock` is also given. `train land` accepts both flags.
+- **`verify --train` checks the slot stamp itself**: the head's VERSION must be above main's and its CHANGELOG headed with that version directly above main's top release, or it refuses with the new `QUEUE_TRAIN_UNSTAMPED`, naming the rule and both versions. It prints `STAMP_VERSION:` from the head.
+- **`verify --train` calls a PR merged only when GitHub reports it MERGED.** An open release-only PR (#3530's shape) now gets the pre-merge check, and any other open or unreadable PR refuses with `QUEUE_PROOF_MISSING` without freezing the queue. So does a verify that could not read the PR's current head (`--no-fetch` or a failed fetch), instead of judging the unstamped pin.
+- **`gstack-restamp` stages the files it writes** and prints `STAGED:`. It refuses before writing when a stamp file holds unstaged edits of your own (`RESTAMP_UNSTAGED_EDITS`); when staging fails, it says `RESTAMP_NOT_STAGED` and the next run stages the files.
+- Two comments in lib/ship-queue-train-gate.ts now say "one spend cap per command gate across every prefix of the train", which is what the code does.
+
+### Tests
+- `test/ship-queue-land-lock.test.ts`: two writers racing one lock sha, the four lock read states, owner kinds, the `--break-lock` rules, and both lock directions, the between phase, refusal and resume, and the freeze lock's repair takeover through `bin/gstack-ship-queue`.
+- `test/ship-queue-train.test.ts`: the #3527 and #3530 shapes, the CHANGELOG rule, a claim-at-open pin, and no false freeze. `test/gstack-restamp-queue.test.ts`: staging after a no-commit merge, the unstaged-edits refusal, and a staging failure and its rerun.
+
+## [1.92.53.0] - 2026-11-02
+
+**`reap` and `up` now destroy only your own Ubicloud VMs (GST-573).** Before, every `up` destroyed any VM in the project whose TTL had ended, whoever created it, which broke the rule that cloud deletes stay with the owner who made the resource. Now reap destroys only the caller's own expired VMs and its own old TTL-less ones, and only counts other owners' expired VMs in its log (`reap: left N expired VMs of other owners; only their owners reap them`).
+
+### Changed
+- **Owner-scoped reap.** Another owner's VM, even an expired one, and an untagged one are never reaped. A lane's leftover VM is destroyed by that owner's own next `up` or `reap`, so a lane that never runs again leaves its VM until someone with that owner runs `reap` or `down`.
+
+## [1.92.52.0] - 2026-11-02
+
+**/ship on Capy runs Exploratory QA again.** Since v1.91.345.0 (#3648) the driver sent Step 9.2.1 out as a QA reader subagent, but the section says only the parent runs report-only discovery, so the reader refused on every pass ("parent-only") and the parent ran the probes afterward anyway, an extra reader call each pass (the C4-36 and C5-36 replays).
+
+### Fixed
+- **The parent runs Step 9.2.1's probes itself, as the section says.** Phase 3 does the section's method Reads and no probe; Phase 4's one program runs the smoke and plan checks after Step 8.1 collects the plan checks and before Scope Check, dedup and Fix-First, and the record's Checks heading carries the `Exploratory QA:` line. The call count is unchanged, and the section text is untouched.
+- **`gstack-review-dispatch pass` refuses a QA extra.** An extra named `qa`, or one whose prompt holds Step 9.2.1's "Only the parent runs report-only discovery.", stops the pass before any reader is created. A prompt file that cannot be read stops as an unreadable prompt, not a raw read error. The Capy skill lists Steps 7, 8 and 14.5 as extras, not Step 9.2.1.
+
+## [1.92.51.0] - 2026-11-01
+
+**PRs no longer wait on the six-shard Windows suite. A short `windows-smoke` check is the required Windows check, and the full suite runs nightly on main.** Windows has minimal support (docs/support-tiers.md). Since 2026-11-01 06:00 UTC, Windows Free Tests finished last on 71 of 73 PR heads, with a wall time of 892 s at p50 and 1,886 s at p90 over 71 green PR runs, and each run used about 59 Windows runner-minutes. The new smoke check finished in 198 s on this PR (run 41325664750). With smoke in its place, the slowest required check on a PR drops from 892 s to 562 s at p50 and from 1,877 s to 1,193 s at p90.
+
+### Changed
+- **New `windows-smoke.yml`** (check `windows-smoke`, on pull requests, pushes to main and by hand). It installs gstack with `./setup --host claude` into a separate home, starts /ship, /review, /qa-only, /investigate and /browse with `gstack-skill-start`, runs the installed browse chain against gstack's own browser, and runs 15 Windows-safe test files. Each file's reason is written next to it in the workflow. No cache: a cold `bun install` took 16 to 17 s, while restoring the cache took 33 to 42 s in a three-round A/B.
+- **`windows-free-tests.yml` runs nightly** (09:17 UTC) on main, and by hand. It no longer runs on pull requests or pushes and never blocks a merge. A red nightly gets a fix only when it shows a broken install, startup or core workflow. Other Windows-only failures close as won't fix with a link to docs/support-tiers.md.
+- **Bun cache removed** from `windows-free-tests.yml` and `windows-setup-e2e.yml`. The 18 cache entries on pull-request refs (8.05 GB) were deleted. Main's entries were left alone.
+- **`gstack-ship-queue ready --dispatch-ci`** skips a named workflow that main has but the PR branch predates, and prints a note instead of failing. GitHub reads the workflow file from the branch, so dispatching `windows-smoke.yml` on an older branch could only fail.
+
+### Gate integrity
+- `.gstack/ship-policy.json` `required_checks`: `windows-free-tests` is replaced by `windows-smoke`. The ci-hint, `--dispatch-ci` docs, train CLI help and `free-durations-record.yml` now name `windows-smoke.yml`.
+- `.gstack/pregate.json`: the `windows-free-tests.yml/windows-free-shard` remote lane is removed, since that suite no longer runs on PRs. Linux and macOS lanes are unchanged.
+- `scripts/test-health-report.ts` measures Windows from `windows-smoke.yml` PR runs.
+- No test file was deleted, skipped or re-tiered. `scripts/harness-version.json` records `scripts/test-pr-profile.ts` as a non-behavioral change, because it only lists `windows-smoke.yml` among files no paid case reads.
+
+## [1.92.50.0] - 2026-11-01
+
+### Fixed
+- **`/autoplan` no longer locks a Claude Code session after a snapshot init run as `cd <dir> && …` (#3651).** When that `cd` leaves the session's folder, Claude Code adds a `Shell cwd was reset to …` line to the command's output. The guard now removes exactly that one line before reading the init or checkpoint JSON; any other extra text still fails. An init whose output still can't be read now counts as a failed init with a "re-run" hint, so a later clean init in the same session works again. Before, every later phase read was denied with code `evidence` until a new session.
+
+### Fixed
+- **`/eval-plan` pilots with a subscription arm can now be approved, and the cost projection is per arm (#3653).** `gstack-eval-plan pilot start --seat-metered <arm>` declares an arm that runs on a subscription with no extra charge (for example `claude -p` on a seat). Its attempts hold none of the spend cap, settle as `unknown` (an arm that settles a real charge is projected like any priced arm), and get their own `PILOT_SEAT_METERED:` line, so the verdict covers the arms that cost money. `pilot report` now projects each arm from its own attempts (one `PILOT_ARM:` line each) and adds them up. Before, it averaged all arms together: a priced arm's cost was multiplied across arms with no price, and two arms at different prices got a band so wide that a pilot that fit the cap was told it exceeded it. The skill also says to stop a seat-metered run at its first quota or rate-limit error, with no retry (idea from #3273 by @merit-blake).
+
+**`/autoplan --ceo-only` runs the CEO review by itself and asks nothing from start to finish (GST-537).** Garry asked for a CEO review that "just automatically does the right thing", and the planning eval needed a gstack CEO arm that a harness can run without a simulated user. Before, /autoplan always ran the Eng review too and stopped at a final approval question, and standalone /plan-ceo-review asks for the mode, offers to chain to the next skill and adds a Codex voice.
+
+### Added
+- **`/autoplan --ceo-only`** (`autoplan/sections/ceo-only.md`): runs Phase 0, the outside-reviewer preflight and the CEO phase only. Every question takes its recommendation and gets an audit-trail row; consent and destructive options take the conservative choice. The review mode comes from plan-ceo-review's 0E rule. User challenges are never applied; each one is listed at the top of `<run dir>/ceo-review.md`, with scope added, conservative choices, findings and the audit trail. The run ends with `GSTACK_RESULT: skill=autoplan status=reviewed run=<dir>` and approves nothing.
+- **`--no-outside`** with `--ceo-only` skips the outside voice, so one model does the whole review.
+- **`gstack-ceo-mode-handoff --ceo-only`** prints `Auto-selected review mode → <mode> (CEO-only run: Step 0E's rule)` instead of crediting a saved preference.
+- **`status=reviewed`** joins the `GSTACK_RESULT` statuses (`docs/unattended.md`, "CEO-only runs").
+
+### For contributors
+- The paid case `autoplan-ceo-only` fails if the mode asks anything, skips a later phase's file, or leaves new files in HOME outside its folders. It takes 6 to 16 minutes, so it runs in the weekly marathon lane, not on autoplan PRs. The mode needs Claude Code for now.
+
+**/autoplan fixes from a field report (GBRA-223): findings without a line number pair across voices, open Critical and High findings reach the gate, a spend cap binds on any host, `run` works with the API runner, and an earlier item-by-item answer carries forward.** OpenClaw's /autoplan run on a real plan hit six problems at once. We reproduced each on main with a failing test first (GST-672). A follow-up from GEVA-2 adds a record of whose words answered a gate.
+
+### Fixed
+- **Plan reviews that name a file but no line now pair across voices.** A same-file pair, with a line missing on either side, is associated as `unverified` instead of both findings counting as new. Title matching ignores a leading DX cap code (`CAP4:<path>:`) and never pairs findings on two different files. The same-file fallback runs only after every title and line match is placed, and a same-file pair never merges two findings into one gate item.
+- **DX cap findings carry real titles.** `CAP4` and `CAP6` findings are titled `CAP<n>:<path>:<item> <what fails>`, so the gate shows the problem and not only the item name.
+- **Every open Critical or High finding becomes a gate item.** `a` applies the reviewer's fix to the plan and is recommended. `b` carries it into the build as a blocking task. `rec` and `p1b` apply the fix. An unanswered item keeps the plan as written unless the reply is `p1b`, and a partial reply never locks that choice early. A finding carried with `b` stays open, so a rerun that raises it again asks again.
+- **A spend cap binds on any host.** With `--spend-cap` set and no `--estimate-usd`, each host-subagent attempt reserves the default $5 per voice, on Capy or off it, in any session kind, and so does an API call whose model has no price. `next --estimate-usd <n>` sets the reservation for the rest of the run. `run` reserves each API call's priced worst case (prompt size plus the output limit) and settles it at its real token cost, so `--spend-cap 0` refuses before any call.
+- **`gstack-autoplan run` with `--native-runner api --runner api` reaches the gate.** Results are checked as autoplan results, so they bind. A response cut off at the output limit is named `truncated` and interrupts the run instead of binding a partial review. The default output limit is 16384 tokens for both providers (OpenAI counts reasoning tokens toward it), `--max-tokens <n>` sets it, and an outside result refused at submit leaves the run native-only instead of aborting it.
+- **An earlier item-by-item answer carries forward when nothing changed.** When every item on the new gate is carried by origin, the owner's `p1` choice is replayed and their tokens are recorded verbatim as the basis. Any new or changed item still goes to the owner.
+- **A spend cap stays closed when a call fails.** For the native voice, a call cut off at its output limit is settled at what it cost, and a retry with a larger `--max-tokens` is admitted against the cap afresh. A call that timed out, dropped, was cancelled or had its result refused after it was sent is settled at its usage, or its full reservation when the usage is unknown, because the provider may have billed it. A call still in flight when the process died is charged its reservation by the next `run`, which then sends a fresh attempt. A call refused before anything was sent (no API key, for example) charges nothing, and the rerun reuses its reservation. A failed outside call is still counted at its full reservation while the phase continues native-only.
+- **A finding you chose to fix stays open until the revised plan is reviewed.** If the reviewer raises it again after a revise that missed it, it comes back to the gate instead of being treated as settled. A withdrawn fix leaves its finding open.
+- **Two findings that only sit near each other are no longer merged.** A user challenge one line away from an unrelated Critical no longer hides the Critical. Findings are merged only when their titles match or the parent says they are the same problem.
+- **A plan gate answered in an agent's own words is not owner approval.** `gstack-ship-receipt` rejects a plan-sha approval citation whose gate was answered with `--words-by agent:<id>`.
+- **A later gate answer replaces the earlier answer's authorship.** When someone else answers again, the earlier answerer's words, `words_by` and carry fields are cleared, so the approval record names who actually answered.
+
+### Added
+- **`gstack-autoplan answer --words-by agent:<id>`** records that the words came from the answering agent itself, as `answer_words` and `words_by`, never as `owner_reply`. The default stays `owner`. A later gate never carries those words forward, and `gstack-approvals import` lists that row under the agent, while `--by` names only the rows that hold the owner's words.
+
+### Tests
+- New failing-first tests in test/autoplan-pairing.test.ts, test/autoplan-gate-judgment.test.ts, test/autoplan-budget.test.ts, test/autoplan-run-api.test.ts (a local fake provider, no key or network), test/autoplan-carry.test.ts and test/approval-record.test.ts.
+
+## [1.92.49.0] - 2026-11-01
+
+**The timeline Stop hook returns within its 2-second budget even when the host keeps stdin open.** The hook read its payload with a blocking read that waits for end of input, so a host that writes the Stop payload and leaves the pipe open held the hook for as long as the pipe stayed open. A local run with the pipe held for 8 seconds took 8 seconds, past the hook's 2-second budget and on the way to Claude Code's 15-second hook window (#3628, reported on Windows). Rewritten from PR #3628 by shahab (mashtii85).
+
+### Fixed
+- **`hosts/claude/hooks/timeline-stop-hook.ts`** reads stdin for at most 500 ms and stops at the first complete JSON payload, then repairs the timeline as before. The hook still exits 0 on every path.
+
+### Tests
+- `test/timeline-stop-hook-stdin.test.ts` (runs on windows-latest): a complete payload on a pipe that never closes returns within budget and still writes the repair; an open pipe with no data returns within budget. Both failed before the fix (10 s, killed).
+
+## [1.92.48.0] - 2026-11-01
+
+**On Windows, `gstack-review-scope summary` works again, and the JSONL merge driver no longer fails on non-English text or rewrites files with CRLF.** Before, the summary started the bash script `gstack-review-read` directly, which Windows cannot run, so it always refused with an empty "gstack-review-read failed:" message and /ship could not write its review-loop file (#3541). The `jsonl-append` merge driver wrote its result with Python's `print()`, so a line the console code page could not encode (Cyrillic text under cp1250, for example) made it exit 1 and git reported a conflict with no markers, and every merge on Windows turned LF files into CRLF (#3659).
+
+### Fixed
+- **`gstack-review-scope summary`** runs `gstack-review-read` through `lib/script-invocation.ts` (Git Bash on Windows). When the helper cannot start, the refusal names the launch error instead of an empty string.
+- **`gstack-jsonl-merge`** writes UTF-8 bytes with LF line endings on every platform and code page.
+
+### Tests
+- `test/review-scope-windows-launch.test.ts` runs the summary against a seeded review log through the same launcher; it runs on windows-latest.
+- `test/jsonl-merge-encoding.test.ts` merges a Cyrillic line with `PYTHONIOENCODING=cp1252` and checks the bytes are UTF-8 with no CR. It failed before the fix on Linux too.
+- `test/script-invocation-tripwire.test.ts` now also catches a bin spawned through `path.join(path.dirname(...import.meta.url...), ...)` or `import.meta.dir`, the shape that hid #3541. `bin/gstack-ship-receipt`'s `gstack-session-kind` spawn is listed as a known site until its own follow-up.
+
+## [1.92.47.0] - 2026-11-01
+
+- **`/ship` Step 5 runs its test lanes one at a time on machines with 4 or fewer cores, and `--lanes serial|parallel` picks the mode by hand** (`gstack-ship-preflight`, GST-851). Preflight used to start every `--lane` at once. On garrytan/gstack-evals#115 six lanes (a 1,451-test bun suite, tsc, a Docker tier and an arm tarball trial) started within 60 ms of each other on a 4-core, 16 GB machine, and running lanes together has taken machines down before (gstack-evals #101, #106, #107). Now, with no flag, preflight runs one lane at a time when `os.availableParallelism()` is 4 or less and all of them at once above that. `--lanes serial` or `--lanes parallel` overrides the default, and any other value, or `--lanes` with no value, is a usage error (exit 2). A new `LANES: serial|parallel (--lanes|<n> cores)` line before the `LANE` lines says which mode ran and why. Each lane still prints its own `LANE` line with its own `tests_ran` count, in the order the lanes were given. Serial runs take the sum of the lane times instead of the longest one. There is no ship-policy key for this: a new key needs key versioning and a `min_gstack_version` bump, and the core-count default already covers the 4-core case.
+
+### Tests
+- `test/ship-preflight.test.ts`: `--lanes serial` runs lanes one after another and keeps each lane's count; `--lanes parallel` keeps lane order when a later lane finishes first; an unflagged run names the core count; a bad or missing `--lanes` value is a usage error; and the core-count default is serial at 4 cores or fewer.
+
+## [1.92.46.0] - 2026-11-01
+
+**brain-sync no longer publishes a synced JSON file that doesn't parse, and the profile and doctor now say when one is broken.** When two machines edit `developer-profile.json` before syncing, git's merge can leave conflict markers in it. brain-sync committed and pushed that file, so every machine got a profile that no longer parsed, while `gstack-developer-profile --profile` and `gstack-doctor` both reported everything ok (#3763).
+
+### Fixed
+- **brain-sync holds back a synced `.json` file that doesn't parse** (`bin/gstack-brain-sync`). Before each commit it parses every staged `*.json` file (today `developer-profile.json` and `projects/*/decisions.active.json`). A file that doesn't parse is held with rule `invalid-json`, along with any file coupled to it (`decisions.jsonl` with its snapshot). It stays queued and syncs on the next run after you repair it; everything else syncs as usual. The fix line says to repair the file. It does not offer `--skip-file`, which would stop the profile syncing for good.
+- **A held file in an unfinished git merge stops the sync instead of committing half the merge.** If a held file is part of a merge that git could not finish, committing the merge without it would quietly keep only this machine's version and drop the other machine's edit. brain-sync now commits nothing and reports `blocked` until you repair the file; the merge and the queue are kept.
+- **Held-status messages name the right cause.** The skill-start attention line, `--status` and `gstack-doctor` no longer blame the secret scan for every held file; doctor reports how many held files are not valid JSON.
+- **`gstack-doctor` warns when a synced JSON file holds conflict markers**, naming the file and how to restore it from the sync repo's history.
+
+### Changed
+- **`gstack-developer-profile --profile` now exits 1 when the profile is not valid JSON.** It prints `<file> is not valid JSON: <parse error>` on stderr (noting conflict markers when it finds them) and nothing on stdout. It used to print the broken file and exit 0, so scripts that read `--profile` should check its exit status.
+
+### Tests
+- `test/brain-sync.test.ts`: a queued profile with conflict markers, a marker-free syntax error, an invalid `decisions.active.json` holding its coupled `decisions.jsonl` until repaired, two machines editing the profile (the other machine's edit stays on the remote), and an unfinished merge with a held profile. `test/gstack-developer-profile.test.ts`: `--profile` on an unparseable profile. `test/gstack-doctor.test.ts`: a conflict-marker warning, and a JSON hold not attributed to the secret scan. All fail on main.
+
 ## [1.92.45.0] - 2026-11-01
 
 ### /ship review scales to risk, not size
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6132d56ac..634968ea6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -73,8 +73,8 @@ project where you actually felt the pain.
 
 **What CI does on a fork PR.** GitHub never gives a fork PR this repository's
 secrets, so CI runs everything that needs none: the required `free-tests` check
-(the Linux free suite, typecheck, the macOS and Windows gates), Windows Free
-Tests, Skill Docs Freshness, Workflow Lint, Version Gate, Quality gate, the
+(the Linux free suite, typecheck, the macOS and Windows gates), Windows
+Smoke, Skill Docs Freshness, Workflow Lint, Version Gate, Quality gate, the
 make-pdf gate, and any path-triggered gates your change touches. E2E Evals
 still builds the CI image from your `Dockerfile.ci` without publishing it, and
 skips its paid eval jobs, which need provider API keys. That skip is expected
@@ -192,7 +192,7 @@ the new defaults.
 | Run full free acceptance before publishing | `bun run test` | Free, a few minutes | Bun 1.4.2 |
 | Run the full free suite from a small machine | `bun run test:ubicloud` | Free suite on a billed 16-vCPU VM, about 5 minutes | `UBICLOUD_API_KEY`, `UBI_OWNER` |
 | Clear pregate's test tier on a machine under 8 cores ([remote gate](docs/pregate.md#remote-gate)) | `gstack-pregate --stage tests --remote --spend-cap 2 --timeout 2700 --allow-repo-commands` (same command keyed or keyless) | Keyed: one billed 16-vCPU VM, about 7 minutes and $0.06 for the whole free tier, worst case $0.38; keyless: free, local parallel shards, practical for small selections only (98 files took 103 s on 4 cores) | Keyed: `UBICLOUD_API_KEY`, `UBI_OWNER`; keyless: nothing |
-| Run the curated Windows-safe subset | `bun run test:windows` (CI: six `windows-latest` jobs) | Free | Windows, Git Bash |
+| Run the curated Windows-safe subset | `bun run test:windows` (CI: six `windows-latest` jobs, nightly on main; PRs run the shorter `windows-smoke` check) | Free | Windows, Git Bash |
 | Refresh the Windows duration seed | `gh workflow run windows-free-tests.yml --ref <branch> -f record_durations=true`, then commit the `free-test-durations-windows` artifact | Free CI runners | Pushed branch, `gh` with workflow rights |
 | Run a native Windows qualification campaign | `gh workflow run native-qualification.yml --ref <branch> -f mode=<mode>` ([modes](docs/TESTING_INTERNALS.md#windows-free-lane)) | Free CI runners | Pushed branch, `gh` with workflow rights |
 | Preview which paid cases my diff selects | `bun run eval:select` (PR profile; `--profile full` for the plain touchfile selection) | Free | — |
diff --git a/TODOS.md b/TODOS.md
index a95320ccd..eb40e432b 100644
--- a/TODOS.md
+++ b/TODOS.md
@@ -17,6 +17,12 @@
 - **Derive `carry.covers` from depth.** A carried receipt's `covers` is the fixed `CARRY_COVERS` list (lib/ship-receipt.ts); derive it from the recorded `review_depth` so a light review's carry does not claim the checks a full review ran (plan item 5, deferred at /ship). **Effort:** S. **Priority:** P1.
 - **Bound the queue's recompute time.** `gstack-ship-queue` recomputes each receipt's needed depth at READY and at train build; add a test that a five-PR train recomputes within a fixed budget, so a large diff cannot stall the train. **Effort:** S. **Priority:** P1.
 
+### P2/P3: Windows smoke follow-ups (filed 2026-11-01, from the GSTA-203 PR 1 /ship review)
+- **Branches cut before windows-smoke.yml still owe the old Windows lane (P2)** — pregate reads lanes from the branch's own workflows, so such a branch keeps an uncleared `windows-free-tests.yml/windows-free-shard` obligation, and `ready --dispatch-ci` skips `windows-smoke.yml` there. The lane clears it by passing `windows-free-tests.yml` to `--dispatch-ci` (the old cost) or with a main-merge grant. Have the skip note name that route, or dispatch the old workflow in smoke's place. The skip also treats a branch that deletes or renames `windows-smoke.yml` as one that predates it; check the merge base too. **Effort:** S. **Priority:** P2.
+- **Someone owns the nightly (P2)** — nothing reads the scheduled `windows-free-tests.yml` result or its flake ledgers. Add a test-health-report metric for scheduled runs on main, or have the daily flaky pass read the latest nightly. **Effort:** S. **Priority:** P2.
+- **Smoke /browse step waits for its page server (P3)** — `windows-smoke.yml` starts `Bun.serve` in the background and calls `browse chain goto` right away; poll the port first. **Effort:** XS. **Priority:** P3.
+- **Smoke seed ceiling vs the weekly reseed (P3)** — `test/windows-native-workflows.test.ts` holds each smoke file to 5 s in the Windows seed, which `free-durations-record.yml` rewrites weekly; one slow recording turns the seed PR red. Report the overrun there or re-pick files at reseed. **Effort:** S. **Priority:** P3.
+
 ### P2/P3: pregate head-policy follow-ups (filed 2026-10-31, from the GST-419/GST-420 /ship review)
 - **`finish` fallback drops head-policy lanes (P2)** — `lib/ship-release.ts` reruns pregate on the stamped tree under the base policy, so after a version bump a lane the branch added under `--policy-from head` is gone and `finish` reports `PREGATE: fail (rerun on the stamped tree)`. GSTA-194 owns that file and has the note. **Effort:** S. **Priority:** P2.
 - **The 3600 s preflight and `finish` wrapper deadline (P3)** — it caps the whole pregate run, so several runners that each fit `timeout_s` can still be cut off together. Derive the wrapper deadline from `timeout_s` and the lane count, or document the cap. **Effort:** S. **Priority:** P3.
diff --git a/VERSION b/VERSION
index 603bff1c3..dd192841b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.92.45.0
+1.92.56.0
diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md
index d00c52753..e8c563d3f 100644
--- a/agents-digest/gstack-AGENTS.md
+++ b/agents-digest/gstack-AGENTS.md
@@ -1,4 +1,4 @@
-# gstack digest v1.92.45.0 — regenerate/re-copy after upgrading gstack
+# gstack digest v1.92.56.0 — regenerate/re-copy after upgrading gstack
 
 Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed
 for agent hosts without a full skill install. The full skills add workflows,
diff --git a/autoplan/DRIVER.md b/autoplan/DRIVER.md
index 875ea1068..ff551298e 100644
--- a/autoplan/DRIVER.md
+++ b/autoplan/DRIVER.md
@@ -57,28 +57,28 @@ line yourself; gstack never writes the plan.
 
 ### Commands
 
-- `gstack-autoplan next --out <dir> --plan <plan.md> [scope flags] [--light] [--spend-cap <usd>] [--max-rounds <n>] [--scaffold]`
-  first call: init the run, print PHASE:, SCOPE:, DRIVER: and one ATTEMPT: per voice; --max-rounds caps review rounds per phase (default 2 unattended), and an unattended Capy run reserves 5.00 per host attempt unless --estimate-usd <n> says otherwise, so --spend-cap binds.
+- `gstack-autoplan next --out <dir> --plan <plan.md> [scope flags] [--light] [--spend-cap <usd>] [--max-rounds <n>] [--estimate-usd <n>] [--scaffold]`
+  first call: init the run, print PHASE:, SCOPE:, DRIVER: and one ATTEMPT: per voice; --max-rounds caps review rounds per phase (default 2 unattended); a run with --spend-cap, in any session kind (or any unattended Capy run), reserves 5.00 per voice for each attempt, so the cap binds; --estimate-usd <n> sets that reservation and the run keeps it for later phases.
+- `gstack-autoplan run --out <dir> --plan <plan.md> --native-model <id> --outside-model <id> --native-runner api --runner api [--max-tokens <n>] [--spend-cap <usd>]`
+  hosts without subagents: one command calls both models directly (ANTHROPIC_API_KEY, OPENAI_API_KEY) and loops next/submit to the gate; a response cut off at the output limit is reported truncated, so raise --max-tokens (default 16384 for both providers; OpenAI counts reasoning tokens toward it); each api call reserves its priced worst case (a model with no price reserves the per-voice default under a cap), a native call that went out but bound no result settles at its usage, or its full reservation when the usage is unknown, and a failed outside call stays counted at its reservation.
 - `gstack-autoplan next --out <dir> [--redispatch <attempt>]`
   later calls: open the next phase or reprint open attempts; never redispatches on its own.
 - `gstack-autoplan submit --out <dir> --phase <p> --voice native|outside --record <file.md> --model <id> [--attempt <id>]`
   bind a free-form review record (canonical fence, one findings table or list, or `No findings.`).
 - `gstack-autoplan submit ... --record <file.md> --attest "<reason>" --attempt <id>`
   bind a record with no INPUT: line as receipt: attested (a wrong INPUT: always refuses).
-- `gstack-autoplan submit --out <dir> --phase <p> --voice native|outside --result <file> --model <id> --attempt <id>`
-  bind a canonical result (the RESULT FORMAT below).
+- `gstack-autoplan submit --out <dir> --phase <p> --voice native|outside --result <file> --model <id> --attempt <id> [--usage-usd <n>] [--reconcile <jsonl>]`
+  bind a canonical result (the RESULT FORMAT below); `--usage-usd` settles the attempt at what the reviewer actually cost (else it stays priced unknown at its reservation); on the submit that closes the phase, `--reconcile` takes your own pairing of findings both voices raised, one `{"outside_id","native_id","disposition","resolution"}` row each, over the structural one.
 - `gstack-autoplan submit --out <dir> --phase <p> --voice outside --unavailable|--failed "<reason>"`
   close the phase native-only when no outside voice can run.
-- `gstack-autoplan answer --out <dir> --gate-rev <n> --reply "<reply>" --by human|agent:<id> [--owner-reply <text>|-] [--rec-hash <h>]`
-  answer the gate with the reply grammar below; an agent answer stores the owner's words verbatim.
+- `gstack-autoplan answer --out <dir> --gate-rev <n> --reply "<reply>" --by human|agent:<id> [--owner-reply <text>|-] [--words-by agent:<id>] [--rec-hash <h>]`
+  answer the gate with the reply grammar below; an agent answer stores the owner's words verbatim, and passes --words-by agent:<id> whenever the words are its own (the default is owner).
 - `gstack-autoplan recommend --out <dir> --gate-rev <n> --item <id> --option <k> --basis "<why>"`
   change one recommendation before relay; then render and relay again (a `rec` needs the new `--rec-hash`).
 - `gstack-autoplan revise --out <dir> --plan <plan v2> --incorporates <decision ids>`
   bind the amended plan; reopens every phase whose reviewed plan changed, Eng last.
-- `gstack-autoplan revise --out <dir> --settle <decision id|d4>`
-  discharge a packaging or ordering change with no plan edit; reopens nothing.
-- `gstack-autoplan revise --out <dir> --withdraw <decision id>`
-  drop a pending amendment instead of applying it.
+- `gstack-autoplan revise --out <dir> --settle <decision id|d4> | --withdraw <decision id>`
+  --settle discharges a packaging or ordering change with no plan edit and reopens nothing; --withdraw drops a pending amendment instead of applying it.
 - `gstack-autoplan close --out <dir> --phase <p> --deferred "<reason>" --by human|agent:<id>`
   close a phase accepted-with-findings: its open findings go to tasks.jsonl, and Critical, urgent or user-challenge findings become gate items; also the recovery from `STOP: reason=budget_exhausted`.
 - `gstack-autoplan budget --out <dir> [--spend-cap <usd>] [--max-rounds <n>] --by human|agent:<id>`
@@ -111,7 +111,7 @@ A reply binds to the `gate_rev` you read (`--gate-rev`). Bare `yes`/`no` is unpa
 
 - `rec`: every item takes its recommendation, plan changes included (each prints APPLY:); `all` and `do it` are aliases.
 - `as-is`: keep every direction; no plan change.
-- `d3b uc1a`: one <id><option> token per item you set; unanswered auto items take their default.
+- `d3b uc1a`: one <id><option> token per item you set; unanswered auto items take their default (a finding item keeps the plan as written; `p1b` applies it).
 - `rec except d3b`: recommendations, with the listed overrides.
 
 ## Run directory
diff --git a/autoplan/SKILL.md b/autoplan/SKILL.md
index 1614c60ec..9dcdf7751 100644
--- a/autoplan/SKILL.md
+++ b/autoplan/SKILL.md
@@ -269,6 +269,7 @@ sections. Read a section in full before doing its step; do not work from memory.
 | closing a review phase, after its reviews finish and before announcing completion or loading the next phase (read afresh at each exit) | `sections/phase-close.md` |
 | presenting the Final Approval Gate (Phase 4) — the aggregator computes $AGGREGATED_TASKS that the gate message substitutes | `sections/tasks-aggregator.md` |
 | the preamble echoed `SESSION_KIND: unattended` (read before Phase 1 and at the Phase 4 gate) | `sections/unattended.md` |
+| the invocation names `--ceo-only` (read before any preamble instruction block) | `sections/ceo-only.md` |
 
 ---
 
diff --git a/autoplan/bin/guard-journal.ts b/autoplan/bin/guard-journal.ts
index 418b879ac..76df6191c 100644
--- a/autoplan/bin/guard-journal.ts
+++ b/autoplan/bin/guard-journal.ts
@@ -17,6 +17,10 @@ type Event = ClaudeParentPublicEvent;
 type Use = NativePublicToolEvent & { order: number };
 /** Claude Code's reply to a Read of an unchanged file it already returned in full. */
 export const DEDUP_REPLY = 'Wasted call — file unchanged since your last Read. Refer to that earlier tool_result instead.';
+/** Claude Code appends exactly this one line to a Bash result when the command's `cd` left the session cwd (#3651). */
+const SHELL_CWD_RESET = /\nShell cwd was reset to [^\n]+$/;
+/** A Bash result's JSON, without that one host footer; anything else must still be strict JSON. */
+export function bashJson(text: string): any { return JSON.parse(text.replace(SHELL_CWD_RESET, '')); }
 /** The longest Read input or Bash command the index keeps; a literal init is far shorter. */
 const INDEX_INPUT_MAX = 4096;
 
@@ -69,11 +73,13 @@ function select(tests: GuardJournalTests, currentToolUseId: string) {
       const replies = (resultsOf.get(init.use.toolUseId) ?? []).flatMap(r => r.events)
         .filter(e => e.kind === 'result' && e.toolUseId === init.use.toolUseId && e.order > init.use.order);
       let reply: unknown;
-      try { reply = replies.length === 1 ? JSON.parse(textResult(replies[0]!) ?? 'null') : undefined; } catch { reply = undefined; }
+      try { reply = replies.length === 1 ? bashJson(textResult(replies[0]!) ?? 'null') : undefined; } catch { reply = undefined; }
+      // A failed or unreadable init binds nothing and is skipped, as invocation() does.
+      if (!object(reply)) continue;
       // A reused:true init keeps the earlier binding, as invocation() does.
       if (object(reply) && reply.reused === true && bound && bound.activePlan === reply.activePlan &&
           bound.restorePath === reply.restorePath) continue;
-      chainStart = init.record; bound = object(reply) ? reply : undefined;
+      chainStart = init.record; bound = reply;
     }
     let start = 0;
     for (let i = chainStart ?? records.length - 1; i >= 0; i--)
diff --git a/autoplan/bin/phase-publication-hook.ts b/autoplan/bin/phase-publication-hook.ts
index d8cf0c214..1cb6b8347 100644
--- a/autoplan/bin/phase-publication-hook.ts
+++ b/autoplan/bin/phase-publication-hook.ts
@@ -10,7 +10,7 @@ import { extractImplementationPlan, checkPhaseImplementation, acceptedBlocks, ca
 import { autoplanPhaseCompletions } from '../../lib/autoplan-phase-publication';
 import { nativePathSpelling, ownedNativePath, sameNativePath, type ClaudeParentPublicEvent } from '../../lib/claude-journal-records';
 import { ownedRecordLimit, ownedRetainedLimit, type JournalPrefix, type OwnedRead, type OwnedReadMeasure } from '../../lib/claude-owned-journal';
-import { readGuardJournal, textResult, DEDUP_REPLY } from './guard-journal';
+import { bashJson, readGuardJournal, textResult, DEDUP_REPLY } from './guard-journal';
 import { REASONS, reasonCode, reasonText, type Detail, type ReasonCode } from './guard-reasons';
 import { logGuardDecision } from './guard-log';
 import { approveOwnedRead, renderSectionBase, userRenderRoot } from './owned-read';
@@ -227,7 +227,7 @@ function checkpointResult(result: Event, tools: Tools, init: Invocation): { phas
   if (use?.name !== 'Bash' || use.order >= result.order) return;
   const text = textResult(result);
   if (text === undefined) return;
-  const output = JSON.parse(text);
+  const output = bashJson(text);
   if (!object(output) || !['ceo', 'design', 'dx', 'eng'].includes(output.phase) ||
       !ownPath(output.snapshotPath) || typeof output.nativePrompt !== 'string' || !object(output.baselineEdits)) return;
   const { nativePrompt, baselineEdits, ...identity } = output;
@@ -260,6 +260,7 @@ function initArguments(command: unknown, root: string): string[] | undefined {
 
 const INIT_MISMATCH_CAUSE = 'Snapshot init returned paths that do not match the canonical form of its own command arguments';
 const INIT_FAILED_CAUSE = 'The most recent snapshot init call failed; re-run the same init command with the same three paths';
+const INIT_UNPARSEABLE_CAUSE = 'The most recent snapshot init printed something other than its JSON result; re-run the same init command with the same three paths, without a leading cd';
 
 /** Diagnostic only, never binds: a Bash call that ran snapshot init in a shape the guard cannot bind (#3045). */
 const UNBINDABLE_INIT = /(?:gstack-autoplan-snapshot|SNAPSHOT_TOOL|\$\{?[A-Z_]+\}?"?)\S*\s+init\s/;
@@ -268,8 +269,8 @@ function invocation(events: Event[], root: string): Invocation {
   let bound: Invocation | undefined;
   let chosen: Record<string, any> | undefined;
   let unbindable = false;
-  // True while the most recent bindable init use errored (a later success clears it).
-  let lastErrored = false;
+  // The cause while the most recent bindable init use failed (a later success clears it).
+  let lastFailure: string | undefined;
   const tools = byTool(events);
   for (const use of events) {
     if (use.kind !== 'use' || use.name !== 'Bash') continue;
@@ -278,10 +279,12 @@ function invocation(events: Event[], root: string): Invocation {
     const results = tools.results(use.toolUseId).filter(x => x.order > use.order);
     if (results.length !== 1) fail('init_mismatch');
     // An errored init published nothing; a later correct init may still bind.
-    if (results[0]!.isError === true) { lastErrored = true; continue; }
+    if (results[0]!.isError === true) { lastFailure = INIT_FAILED_CAUSE; continue; }
     const text = textResult(results[0]!);
-    if (text === undefined) fail('init_failed');
-    const result = JSON.parse(text);
+    if (text === undefined) { lastFailure = INIT_FAILED_CAUSE; continue; }
+    let result: any;
+    // Output that is not the init's JSON bound nothing; a later correct init may still bind.
+    try { result = bashJson(text); } catch { lastFailure = INIT_UNPARSEABLE_CAUSE; continue; }
     // init reports canonical destinations (macOS /tmp is /private/tmp); canonicalize the argv the same way.
     let active: string, restore: string;
     try { active = canonicalDestination(args[1]!); restore = canonicalDestination(args[2]!); }
@@ -289,13 +292,13 @@ function invocation(events: Event[], root: string): Invocation {
     if (!object(result) || !samePath(result.sourcePlan, fs.realpathSync(args[0]!)) || !samePath(result.activePlan, active) ||
         !samePath(result.restorePath, restore) || typeof result.reused !== 'boolean' || !positive(result.originalBytes) ||
         !/^[a-f0-9]{64}$/.test(result.originalSha256)) fail('init_mismatch', { cause: INIT_MISMATCH_CAUSE });
-    lastErrored = false;
+    lastFailure = undefined;
     if (result.reused && bound && bound.activePlan === result.activePlan && bound.restorePath === result.restorePath) continue;
     chosen = result;
     bound = { activePlan: result.activePlan, restorePath: result.restorePath,
       originalSha256: result.originalSha256, start: results[0]!.order };
   }
-  if (lastErrored) fail('init_failed', { cause: INIT_FAILED_CAUSE });
+  if (lastFailure) fail('init_failed', { cause: lastFailure });
   if ((!chosen || !bound) && unbindable) fail('init_unbindable');
   if (!chosen || !bound) fail('init_required');
   const restore = read(bound.restorePath, true), active = read(bound.activePlan);
diff --git a/autoplan/sections/ceo-only.md b/autoplan/sections/ceo-only.md
new file mode 100644
index 000000000..b5df3e232
--- /dev/null
+++ b/autoplan/sections/ceo-only.md
@@ -0,0 +1,41 @@
+<!-- AUTO-GENERATED from ceo-only.md.tmpl — do not edit directly -->
+<!-- Regenerate: bun run gen:skill-docs -->
+## CEO-only run (`--ceo-only`)
+
+This section governs the whole run and wins over the skeleton. The run reviews
+the plan; it never approves it.
+
+**Zero questions.** Never call AskUserQuestion (native or `mcp__*`) or
+ExitPlanMode, never ask the user in prose, never wait for a reply, whatever
+`SESSION_KIND` says. A preamble instruction block that would ask takes its
+non-consenting default (off, not now, skip). Each decision takes its
+`(recommended)` option, else the 6 principles; consent, destructive or
+irreversible options take the conservative choice. Log each as a Decision Audit
+Trail row.
+
+**Scope.** Run Phases 0, 0.5 and 1 only; send "Phases 2, 2.5, 3 and 4 skipped
+(CEO-only run)" and record it in ACTIVE_PLAN. With `--no-outside`, skip every
+outside dispatch: `outside_status: disabled (--no-outside)`.
+
+**Mode.** Instead of SELECTIVE EXPANSION, use plan-ceo-review 0E step 2's rule
+(an explicit mode in the request wins), skip step 3, run
+`~/.claude/skills/gstack/bin/gstack-ceo-mode-handoff "<mode>" --ceo-only --decisions "<rows or none>"`
+and send its line verbatim.
+
+**Never applied:** a user challenge (keep the direction; list it below).
+**Skipped and logged `skipped (ceo-only)`:** office-hours and BENEFITS_FROM
+offers, 0E's question, plan archive cleanup, Next Steps chaining and CEO plan
+promotion; the row satisfies its checklist entry.
+
+**State.** Write only in `$_AP`, ACTIVE_PLAN and `GSTACK_STATE_ROOT`
+(the override; docs/state-root.md).
+
+**Finish.** After Phase 1 closes, write `$_AP/ceo-review.md`: `# CEO-only
+review: <plan title>`; a line with the mode, outside-voice status and "Not
+approved"; then `## User challenges (direction kept)` (plan says, proposal,
+why, cost if wrong), `## Scope added`, `## Conservative choices`,
+`## Findings` (severity, section, fix, disposition) and `## Decision Audit
+Trail` (copied), each "None." when empty. Send the CEO Completion Summary and
+both paths, skip Completion's logs, approval and `/ship`, and end with:
+
+`GSTACK_RESULT: skill=autoplan status=reviewed run=<absolute $_AP>`
diff --git a/autoplan/sections/ceo-only.md.tmpl b/autoplan/sections/ceo-only.md.tmpl
new file mode 100644
index 000000000..636943ed9
--- /dev/null
+++ b/autoplan/sections/ceo-only.md.tmpl
@@ -0,0 +1,39 @@
+## CEO-only run (`--ceo-only`)
+
+This section governs the whole run and wins over the skeleton. The run reviews
+the plan; it never approves it.
+
+**Zero questions.** Never call AskUserQuestion (native or `mcp__*`) or
+ExitPlanMode, never ask the user in prose, never wait for a reply, whatever
+`SESSION_KIND` says. A preamble instruction block that would ask takes its
+non-consenting default (off, not now, skip). Each decision takes its
+`(recommended)` option, else the 6 principles; consent, destructive or
+irreversible options take the conservative choice. Log each as a Decision Audit
+Trail row.
+
+**Scope.** Run Phases 0, 0.5 and 1 only; send "Phases 2, 2.5, 3 and 4 skipped
+(CEO-only run)" and record it in ACTIVE_PLAN. With `--no-outside`, skip every
+outside dispatch: `outside_status: disabled (--no-outside)`.
+
+**Mode.** Instead of SELECTIVE EXPANSION, use plan-ceo-review 0E step 2's rule
+(an explicit mode in the request wins), skip step 3, run
+`~/.claude/skills/gstack/bin/gstack-ceo-mode-handoff "<mode>" --ceo-only --decisions "<rows or none>"`
+and send its line verbatim.
+
+**Never applied:** a user challenge (keep the direction; list it below).
+**Skipped and logged `skipped (ceo-only)`:** office-hours and BENEFITS_FROM
+offers, 0E's question, plan archive cleanup, Next Steps chaining and CEO plan
+promotion; the row satisfies its checklist entry.
+
+**State.** Write only in `$_AP`, ACTIVE_PLAN and `GSTACK_STATE_ROOT`
+(the override; docs/state-root.md).
+
+**Finish.** After Phase 1 closes, write `$_AP/ceo-review.md`: `# CEO-only
+review: <plan title>`; a line with the mode, outside-voice status and "Not
+approved"; then `## User challenges (direction kept)` (plan says, proposal,
+why, cost if wrong), `## Scope added`, `## Conservative choices`,
+`## Findings` (severity, section, fix, disposition) and `## Decision Audit
+Trail` (copied), each "None." when empty. Send the CEO Completion Summary and
+both paths, skip Completion's logs, approval and `/ship`, and end with:
+
+`GSTACK_RESULT: skill=autoplan status=reviewed run=<absolute $_AP>`
diff --git a/autoplan/sections/manifest.json b/autoplan/sections/manifest.json
index 0afec4240..74071ed66 100644
--- a/autoplan/sections/manifest.json
+++ b/autoplan/sections/manifest.json
@@ -45,6 +45,12 @@
       "file": "unattended.md",
       "title": "Unattended profile: parent-driven next/submit loop, gate answers, export, terminal line",
       "trigger": "the preamble echoed `SESSION_KIND: unattended` (read before Phase 1 and at the Phase 4 gate)"
+    },
+    {
+      "id": "ceo-only",
+      "file": "ceo-only.md",
+      "title": "CEO-only run: zero questions, CEO phase only, review report, no gate",
+      "trigger": "the invocation names `--ceo-only` (read before any preamble instruction block)"
     }
   ]
 }
diff --git a/bin/gstack-autoplan b/bin/gstack-autoplan
index c42062867..faccea3fd 100755
--- a/bin/gstack-autoplan
+++ b/bin/gstack-autoplan
@@ -9,8 +9,8 @@
  *   gstack-autoplan submit  --out <dir> --phase <p> --voice outside --unavailable <reason> | --failed <reason> [--json]
  *   gstack-autoplan revise  --out <dir> --plan <file> [--incorporates <id,...>] [--withdraw <id>] [--settle <id>] [--json]   review a revised plan in this run
  *   gstack-autoplan run     --out <dir> --plan <file> --native-model <id> --outside-model <id> [--runner codex-cli|api] [--native-runner api]
- *                           [--deadline <min>] [--spend-cap <usd>] [--estimate-usd <n>] [--json]      next in a loop; needs runners for both voices
- *   gstack-autoplan answer  --out <dir> --gate-rev <rev> --reply "<grammar>" --by <human|agent:<id>> [--owner-reply <text>|-] [--rec-hash <h>] [--json]
+ *                           [--deadline <min>] [--spend-cap <usd>] [--estimate-usd <n>] [--max-tokens <n>] [--json]      next in a loop; needs runners for both voices
+ *   gstack-autoplan answer  --out <dir> --gate-rev <rev> --reply "<grammar>" --by <human|agent:<id>> [--owner-reply <text>|-] [--words-by owner|agent:<id>] [--rec-hash <h>] [--json]
  *   gstack-autoplan recommend --out <dir> --gate-rev <n> --item <id> --option <k> --basis "<why>" [--by <who>]
  *   gstack-autoplan resume  --out <dir> [--from <checkpoint>] [--json]   take ownership; intent without a terminal record becomes EXECUTION_UNKNOWN
  *   gstack-autoplan status  --out <dir> [--json]        query: the manifest, no GSTACK_RESULT line
@@ -43,11 +43,13 @@ import { capyRelayLine } from '../lib/captain-brief';
 import { exportPublic } from '../lib/autoplan-public';
 import { migrateRun } from '../lib/autoplan-migrate';
 import { reviseRun } from '../lib/autoplan-revise';
-import { pendingAmendments, type RunState } from '../lib/autoplan-state';
-import { FILES, RunError, currentPhase, initRun, markOutside, nextStep, readState, resumeRun, statusLines, submitResult, withRunLock, writeState } from '../lib/autoplan-run';
+import { pendingAmendments, type RunState, type Voice } from '../lib/autoplan-state';
+import { FILES, RunError, currentPhase, fitReservation, initRun, markOutside, markSent, nextStep, readState, resumeRun, retireAttempt, statusLines, submitResult, withRunLock, writeState, type NextOptions } from '../lib/autoplan-run';
 import { driverFile, type Phase } from '../lib/autoplan-prompts';
 import { EXIT, exitTableHelp } from '../lib/headless-artifacts';
 import { createRunner, familyConflict, type RunnerId } from '../lib/outside-voice-runner';
+import { DEFAULT_MAX_TOKENS, apiTimeoutMs } from '../lib/outside-voice-api';
+import { estimateCostUsd, pricingRow } from '../lib/pricing';
 import { resultLine } from '../lib/result-codes';
 import { release } from '../lib/spend-ledger';
 import { COORDINATOR_CONTRACT } from '../lib/coordinator-contract';
@@ -59,7 +61,7 @@ DRIVER: ${driverFile()}
           [--no-outside] [--light] [--spend-cap <usd>] [--max-rounds <n>] [--estimate-usd <n>] [--deadline <min>] [--redispatch <attempt>] [--json]
           --max-rounds (first next): review rounds per phase (default 2 unattended); at the cap a phase closes accepted-with-findings
           --docs-only (first next; also detected when every Implementation-plan path is docs-class): CEO (native voice only) + Eng
-          --estimate-usd: reserved per new attempt; unattended Capy runs reserve a default for host attempts so --spend-cap binds
+          --estimate-usd: reserved per new attempt, kept for the rest of the run; with --spend-cap any run (or an unattended run on Capy) reserves a default so the cap binds
           --scaffold (first next): a plan missing one of its two sections is reviewed from <out>/plan-source.md with the heading added
           --light loads each phase's checklist plus the sections its scope needs (the unattended default); interactive kinds load everything
           --no-carry-forward (first next): every later gate revision goes to the owner, even one that asks nothing new
@@ -80,9 +82,12 @@ DRIVER: ${driverFile()}
           comes into scope, the edit applies without re-review (APPLIED:); --withdraw (alone or with --plan) drops one;
           --settle records a packaging/ordering change that needs no plan edit and reopens nothing (ids: decision id or d4)
   run     --out <dir> --plan <file> --native-model <id> --outside-model <id> [--runner codex-cli|api] [--native-runner api] ...
-          next in a loop, only when a runner executes both voices here; --deadline cancels the children it started
+          next in a loop, only when a runner executes both voices here (hosts without subagents: --native-runner api --runner api);
+          --deadline cancels the children it started; --max-tokens caps each api call's output (default 16384; OpenAI counts reasoning tokens in it), and a
+          response cut off at that limit is reported truncated; submit's result checks judge every completed response
   answer  --out <dir> --gate-rev <rev> --reply "<rec | rec except d3a | d3b uc1a | as-is>" --by <human|agent:<id>> [--json]
           --by agent:<id> needs --owner-reply "<owner's words>" (- reads stdin; --owner-reply-file <path>), stored verbatim;
+          --words-by agent:<id> (the same agent) when those words are its own: recorded as its words, never the owner's, never carried;
           --rec-hash <h> binds a rec to the render the owner saw (required once recommend ran); accepted changes leave amend_pending
   recommend --out <dir> --gate-rev <n> --item <id> --option <k> --basis "<why>" [--by <who>]
           set one item's recommendation before relay (provenance recorded, p1 follows); re-render and relay afterwards
@@ -178,7 +183,7 @@ function emit(json: boolean, lines: string[], payload: Record<string, unknown>):
   else process.stdout.write(lines.join('\n') + '\n');
 }
 
-function doNext(out: string, rest: string[], json: boolean): number {
+function doNext(out: string, rest: string[], json: boolean, price?: NextOptions['price']): number {
   const cwd = process.cwd();
   const initLines: string[] = [];
   const fresh = !fs.existsSync(path.join(out, FILES.run));
@@ -195,7 +200,7 @@ function doNext(out: string, rest: string[], json: boolean): number {
       deadlineMin: num(rest, '--deadline'), light: rest.includes('--light'), scaffold: rest.includes('--scaffold'), scope: { ui, developerTool: rest.includes('--developer-tool'), agentPrimary: rest.includes('--agent-primary'), dx: rest.includes('--no-dx') ? false : undefined, ...(rest.includes('--docs-only') ? { docsOnly: true } : {}) } }, initLines);
   }
   const redispatch = rest.flatMap((a, i) => (a === '--redispatch' && rest[i + 1] ? [rest[i + 1]!] : []));
-  const r = nextStep({ out, cwd, estimateUsd: num(rest, '--estimate-usd'), redispatch });
+  const r = nextStep({ out, cwd, estimateUsd: num(rest, '--estimate-usd'), redispatch, price });
   moment = fresh ? 'init' : r.attempts.some(a => a.new) || r.lines.some(l => l.startsWith('PHASE_DEFERRED: ')) ? 'transition' : undefined;
   const status = r.state.status;
   const lines = [...initLines, ...r.lines];
@@ -305,10 +310,25 @@ async function doRun(out: string, rest: string[], json: boolean): Promise<number
   if (!['codex-cli', 'api'].includes(outsideRunner)) return usage('--runner must be codex-cli or api for run (host-subagent cannot execute here; use next/submit)');
   const conflict = familyConflict(outsideModel, nativeModel);
   if (conflict) throw new RunError('MODEL_FAMILY_CONFLICT', conflict, 3);
+  const maxTokens = num(rest, '--max-tokens');
+  if (maxTokens !== undefined && (!Number.isInteger(maxTokens) || maxTokens <= 0)) return usage('--max-tokens needs a positive integer');
   const deadline = num(rest, '--deadline');
   const deadlineAt = deadline ? Date.now() + deadline * 60_000 : undefined;
+  const modelOf = (voice: Voice) => (voice === 'native' ? nativeModel : outsideModel);
+  const isApi = (voice: Voice) => (voice === 'native' ? nativeRunner : outsideRunner) === 'api';
+  // An api call reserves its worst case (prompt bytes / 3 input tokens plus the output limit it is sent) and settles at its usage.
+  const price = (voice: Voice, promptFile: string) => {
+    const row = isApi(voice) ? pricingRow(modelOf(voice)) : undefined;
+    return row ? +((fs.statSync(promptFile).size / 3 * row.input_per_mtok + (maxTokens ?? DEFAULT_MAX_TOKENS) * row.output_per_mtok) / 1e6).toFixed(6) : undefined;
+  };
+  const usdOf = (voice: Voice, used: { input_tokens?: number; output_tokens?: number } | undefined) =>
+    isApi(voice) && pricingRow(modelOf(voice)) && typeof used?.input_tokens === 'number' && typeof used?.output_tokens === 'number' ? estimateCostUsd({ input: used.input_tokens, output: used.output_tokens }, modelOf(voice)) : undefined;
+  // Every exit after a paid call went out settles its attempt: a failure, a cancel, a refused result, or a process that died
+  // mid-call (sent_at, found on the next run) settles at its usage, or its reservation when the usage is unknown. Only a call
+  // refused before any request left this machine bills nothing, so its attempt stays open for the rerun.
+  const NOT_SENT = new Set(['runner_unavailable', 'cli_missing', 'model_unselected']);
   for (let guard = 0; guard < 40; guard++) {
-    const code = withRunLock(out, () => doNext(out, rest, true));
+    const code = withRunLock(out, () => doNext(out, rest, true, price));
     if (code !== EXIT.ok) return code;
     const state = readState(out);
     if (state.status !== 'awaiting_result') {
@@ -316,27 +336,39 @@ async function doRun(out: string, rest: string[], json: boolean): Promise<number
       process.stdout.write(resultLineFor(state.status, out) + '\n'); return EXIT.ok;
     }
     const phase = state.phase_order.find(p => state.phases[p]?.snapshot && !state.phases[p]?.closed_at)!;
+    const lost = (['native', 'outside'] as const).flatMap(voice => (state.phases[phase]![voice]!.attempts ?? []).filter(a => a.state === 'dispatched' && a.sent_at).map(a => [voice, a.attempt] as const));
+    if (lost.length) { withRunLock(out, () => { for (const [voice, attempt] of lost) retireAttempt(out, phase as Phase, voice, attempt, 'unknown'); }); continue; }
     for (const voice of ['native', 'outside'] as const) {
       const v = state.phases[phase]![voice]!;
       const open = v.attempts?.find(a => a.state === 'dispatched');
       if (!open) continue;
       const runnerId = voice === 'native' ? nativeRunner : outsideRunner;
+      const cost = price(voice, open.prompt);
+      if (cost !== undefined) withRunLock(out, () => fitReservation(out, phase as Phase, voice, open.attempt, cost));
       const runner = createRunner(runnerId);
-      const remaining = deadlineAt ? deadlineAt - Date.now() : 300_000;
+      const remaining = deadlineAt ? deadlineAt - Date.now() : runnerId === 'api' ? apiTimeoutMs(maxTokens) : 300_000;
       if (remaining <= 0) { withRunLock(out, () => { const s = readState(out); s.status = 'interrupted'; writeState(s); }); process.stdout.write(resultLineFor('interrupted', out) + '\n'); return EXIT.fail; }
       const timer = deadlineAt ? setTimeout(() => runner.cancel(), remaining) : undefined;
-      const res = await runner.run({ promptFile: open.prompt, outFile: `${open.result}.raw`, model: voice === 'native' ? nativeModel : outsideModel, timeoutMs: Math.min(remaining, 600_000), cwd: process.cwd(), gate: 'review' });
+      withRunLock(out, () => markSent(out, phase as Phase, voice, open.attempt, true));
+      const res = await runner.run({ promptFile: open.prompt, outFile: `${open.result}.raw`, model: voice === 'native' ? nativeModel : outsideModel, timeoutMs: Math.min(remaining, runnerId === 'api' ? apiTimeoutMs(maxTokens) : 600_000), cwd: process.cwd(), gate: 'execution', maxTokens: runnerId === 'api' ? maxTokens ?? DEFAULT_MAX_TOKENS : maxTokens });
       if (timer) clearTimeout(timer);
       if (!json) process.stdout.write(`VOICE: ${phase} ${voice} ${res.status} runner=${res.runner} model=${res.model ?? 'unknown'}\n`);
-      if (res.status === 'cancelled') { withRunLock(out, () => { const s = readState(out); s.status = 'interrupted'; writeState(s); }); process.stdout.write(resultLineFor('interrupted', out) + '\n'); return EXIT.fail; }
+      const retire = () => { if (NOT_SENT.has(res.reason ?? '')) markSent(out, phase as Phase, voice, open.attempt, false); else retireAttempt(out, phase as Phase, voice, open.attempt, usdOf(voice, res.usage) ?? 'unknown'); };
+      if (res.status === 'cancelled') { withRunLock(out, () => { retire(); const s = readState(out); s.status = 'interrupted'; writeState(s); }); process.stdout.write(resultLineFor('interrupted', out) + '\n'); return EXIT.fail; }
       if (res.status !== 'completed' && res.status !== 'unverified') {
         if (voice === 'outside') { withRunLock(out, () => markOutside(out, phase as Phase, 'unavailable', `${res.runner} ${res.status}${res.detail ? `: ${res.detail}` : ''}`)); continue; }
-        process.stderr.write(`gstack-autoplan run: native voice ${res.status}${res.detail ? `: ${res.detail}` : ''}\n`);
-        withRunLock(out, () => { const s = readState(out); s.status = 'interrupted'; writeState(s); });
+        process.stderr.write(`gstack-autoplan run: native voice ${res.status}${res.reason ? `: ${res.reason}` : ''}${res.detail ? `: ${res.detail}` : ''}\n`);
+        withRunLock(out, () => { retire(); const s = readState(out); s.status = 'interrupted'; writeState(s); });
         process.stdout.write(resultLineFor('interrupted', out) + '\n');
         return EXIT.fail;
       }
-      withRunLock(out, () => doSubmit(out, ['--phase', phase, '--voice', voice, '--result', `${open.result}.raw`, '--model', res.model ?? (voice === 'native' ? nativeModel : outsideModel), '--attempt', open.attempt, '--runner', res.runner], true));
+      const usd = usdOf(voice, res.usage);
+      const usage = usd === undefined ? [] : ['--usage-usd', String(usd)];
+      try { withRunLock(out, () => doSubmit(out, ['--phase', phase, '--voice', voice, '--result', `${open.result}.raw`, '--model', res.model ?? modelOf(voice), '--attempt', open.attempt, '--runner', res.runner, ...usage], true)); }
+      catch (e) {
+        if (voice !== 'outside' || !(e instanceof RunError)) { withRunLock(out, () => { retire(); const s = readState(out); s.status = 'interrupted'; writeState(s); }); throw e; }
+        withRunLock(out, () => markOutside(out, phase as Phase, 'unavailable', `${res.runner} result refused: ${e.code}`));
+      }
     }
   }
   return EXIT.fail;
@@ -386,10 +418,12 @@ async function main(argv: string[]): Promise<number> {
       if (rev === undefined) { const s = readState(out); process.stderr.write(resultLine('gstack-autoplan answer', 'GATE_REV_STALE', `no --gate-rev given; current gate_rev=${s.gate_rev ?? 0}`) + '\n'); return EXIT.refused; }
       const replyFile = flag(rest, '--owner-reply-file'); const ownerFlag = flag(rest, '--owner-reply');
       if (replyFile !== undefined && ownerFlag !== undefined) return usage('--owner-reply and --owner-reply-file are exclusive');
+      const wordsBy = flag(rest, '--words-by') ?? 'owner';
+      if (wordsBy !== 'owner' && (wordsBy !== by || !by.startsWith('agent:'))) return usage(`--words-by must be owner or the answering agent (--by ${by ?? '<unset>'}), got ${wordsBy}`);
       const ownerReply = replyFile !== undefined ? fs.readFileSync(replyFile, 'utf8') : ownerFlag === '-' ? fs.readFileSync(0, 'utf8') : ownerFlag;
       return mutating(out, json, () => {
         const state = readState(out);
-        const r = answerGate(state, Number(rev), reply, by, { recHash: flag(rest, '--rec-hash'), ownerReply });
+        const r = answerGate(state, Number(rev), reply, by, { recHash: flag(rest, '--rec-hash'), ownerReply, ...(wordsBy === 'owner' ? {} : { wordsBy }) });
         writeState(state);
         const lines = [...r.lines];
         if (r.outcome === 'reopened' || r.outcome === 'amend_pending') lines.push(nextLine(state, out));
diff --git a/bin/gstack-autoplan-snapshot.ts b/bin/gstack-autoplan-snapshot.ts
index 93877f418..7cfbf958f 100644
--- a/bin/gstack-autoplan-snapshot.ts
+++ b/bin/gstack-autoplan-snapshot.ts
@@ -55,7 +55,7 @@ For each finding: what's wrong, severity (critical/high/medium), and the fix.`,
 reviewing this plan. You have NOT seen any prior review. Evaluate:
 1. Getting started: how many steps from zero to hello world? What's the TTHW?
 2. API/CLI ergonomics: naming consistency, sensible defaults, progressive disclosure?
-3. Error handling: Score every error path against the agent-ready error contract (https://github.com/garrytan/gstack/blob/main/docs/agent-ready-errors.md): what (operation and actual values), fix (a safe, authorized command or edit on the first or last line, or the precise thing a human must provide), recovery (retry, fix and retry, do X first, or ask a human; side effects none/partial/complete/unknown, reconcile before retrying an unknown outcome, a retry bound), code (stable, with a doc anchor), context (versions, config, env var names, the underlying cause; caller-safe only for remote services), trace (unexpected failures only: a compact trace or its file path locally, a correlation id remotely), redaction (no secret values anywhere), channel (the surface's native failure signal: non-zero exit and stderr for a CLI, status plus RFC 9457 body for an API, a typed error for an SDK, isError for an MCP tool). Usage and validation errors rejected before any work need only what, fix, code, redaction and channel; items apply per surface, N/A needs a reason, an item the plan never specifies for a path it introduces is a gap, and unknown is reserved for existing behavior you could not inspect. Report a leaked secret, a failure signalled as success, an unsafe fix, or a block on a terminal (a hang, or a no-terminal failure that names no non-interactive alternative such as --yes) as a Critical finding titled "CAP4:<path>:<item>" (caps the Error Messages score at 4/10); report a missing applicable fix, recovery, context or trace as a High finding titled "CAP6:<path>:<item>" (caps it at 6/10).
+3. Error handling: Score every error path against the agent-ready error contract (https://github.com/garrytan/gstack/blob/main/docs/agent-ready-errors.md): what (operation and actual values), fix (a safe, authorized command or edit on the first or last line, or what a human must provide), recovery (retry, fix and retry, do X first, or ask a human; side effects none/partial/complete/unknown, reconcile before retrying an unknown outcome, a retry bound), code (stable, with a doc anchor), context (versions, config, env var names, the underlying cause; caller-safe only for remote services), trace (unexpected failures only: a compact trace or its file path locally, a correlation id remotely), redaction (no secret values anywhere), channel (the surface's native failure signal: non-zero exit and stderr for a CLI, status plus RFC 9457 body for an API, a typed error for an SDK, isError for an MCP tool). Usage and validation errors rejected before any work need only what, fix, code, redaction and channel; items apply per surface, N/A needs a reason, an item the plan never specifies for a path it introduces is a gap, and unknown is reserved for existing behavior you could not inspect. Report a leaked secret, a failure signalled as success, an unsafe fix, or a block on a terminal (a hang, or a no-terminal failure naming no non-interactive alternative such as --yes) as a Critical finding titled "CAP4:<path>:<item> <what fails>" (caps Error Messages at 4/10); report a missing applicable fix, recovery, context or trace as a High finding titled "CAP6:<path>:<item> <what fails>" (caps it at 6/10).
 4. Documentation: copy-paste examples? Information architecture? Interactive elements?
 5. Escape hatches: can developers override every opinionated default?
 For each finding: what's wrong, severity (critical/high/medium), and the fix.`,
diff --git a/bin/gstack-brain-sync b/bin/gstack-brain-sync
index 25625c2bb..c95c6985e 100755
--- a/bin/gstack-brain-sync
+++ b/bin/gstack-brain-sync
@@ -38,11 +38,11 @@
 # applies; `ok` and `idle` print none. <bin> is this script's absolute path
 # and <N> the held count. Rows are read by test/gstack-skill-start.test.ts.
 #
-#   held         trigger: status=held: the secret scan held back flagged files and synced the rest
-#                line:    ARTIFACTS_SYNC: attention: status=held held=<N>. The secret scan is holding back <N> file(s); everything else still syncs. See which files and how to fix them: <bin> --status
-#                fix:     edit the file so the scan no longer matches, or <bin> --skip-file <path> (permanent; undo with <bin> --unskip-file <path>)
+#   held         trigger: status=held: the secret scan or the JSON check held back flagged files and synced the rest
+#                line:    ARTIFACTS_SYNC: attention: status=held held=<N>. Sync is holding back <N> file(s) that the secret scan flagged or that are not valid JSON; everything else still syncs. See which files and how to fix them: <bin> --status
+#                fix:     edit the file so the scan no longer matches (or repair a file that is not valid JSON), or <bin> --skip-file <path> (permanent; undo with <bin> --unskip-file <path>)
 #   blocked      trigger: status=blocked: a re-scan still flagged after the hold, so nothing was committed
-#                line:    ARTIFACTS_SYNC: attention: status=blocked. The secret scan flagged a file it could not hold back on its own, so nothing is syncing. See the fix: <bin> --status
+#                line:    ARTIFACTS_SYNC: attention: status=blocked. Sync committed nothing: a flagged file could not be held back on its own, or held files are part of an unfinished git merge. See the fix: <bin> --status
 #                fix:     edit or skip the files named by <bin> --status, or clear the batch with <bin> --drop-queue --yes
 #   push_failed  trigger: status=push_failed: a commit is saved locally but the push failed
 #                line:    ARTIFACTS_SYNC: attention: status=push_failed. Synced files are committed locally but the push failed; it retries at skill start. See the cause: <bin> --status
@@ -144,7 +144,7 @@ remote_auth_hint() {
 # Status file schema (one JSON object; readers: --status, --attention, doctor):
 #   status        ok | idle | held | collision | blocked | push_failed | error
 #                 (collision: files were held only for case-colliding paths)
-#   held_count    files the secret scan held back this drain (hits + dependents)
+#   held_count    files the secret scan or the JSON check held back this drain (hits + dependents)
 #   case_held     queued files held because their path differs only by letter
 #                 case from another path in the repo or the batch
 #   case_names    the colliding path component names, comma-separated and
@@ -953,6 +953,8 @@ for rule, path in hits:
         "rule": rule,
         "dependents": deps,
         "fixes": [
+            f"{path} is not valid JSON (often git conflict markers from a merge); repair it and the next sync re-checks it"
+        ] if rule == "invalid-json" else [
             f"edit {path} so the secret scan no longer matches ({rule}); the next sync re-scans it",
             f"{self_bin} --skip-file {path}  (permanently excludes it{also} from future syncs; undo with {self_bin} --unskip-file {path})",
         ],
@@ -982,6 +984,52 @@ for path, rows in ((unstage_out, unstage), (wait_out, waiting)):
 PYEOF
 }
 
+# Append "invalid-json<TAB><path>" to the hits file $2 for every staged *.json
+# path in the NUL-separated names file $1 whose index blob does not parse
+# (#3763): a git merge can leave conflict markers in a synced JSON file, and
+# committing it spreads an unreadable file to every machine. A path the
+# secret scan already flagged is held for that reason alone. One
+# `git cat-file --batch` reads the index blobs; a staged deletion has none.
+append_invalid_json_hits() {
+  python3 - "$1" "$2" "$1.json" <<'PYEOF' || return 1
+import sys
+names_path, hits_path, out_path = sys.argv[1:4]
+with open(names_path, "rb") as f:
+    names = [p for p in f.read().decode("utf-8", "surrogateescape").split("\0") if p.endswith(".json") and "\n" not in p]
+with open(hits_path, encoding="utf-8", errors="surrogateescape") as f:
+    flagged = {l.rstrip("\r\n").split("\t", 1)[-1] for l in f if "\t" in l}
+with open(out_path, "w", encoding="utf-8", errors="surrogateescape", newline="\n") as out:
+    for p in names:
+        if p not in flagged:
+            out.write(":" + p + "\n")
+PYEOF
+  [ -s "$1.json" ] || return 0
+  git -C "$GSTACK_HOME" cat-file --batch < "$1.json" > "$1.json.blobs" 2>/dev/null || return 1
+  python3 - "$1.json" "$1.json.blobs" "$2" <<'PYEOF'
+import json, sys
+batch_path, blobs_path, hits_path = sys.argv[1:4]
+with open(batch_path, encoding="utf-8", errors="surrogateescape") as f:
+    names = [l[1:].rstrip("\n") for l in f if l.startswith(":")]
+with open(blobs_path, "rb") as f:
+    data = f.read()
+pos = 0
+with open(hits_path, "a", encoding="utf-8", errors="surrogateescape", newline="\n") as out:
+    for p in names:
+        nl = data.index(b"\n", pos)
+        header = data[pos:nl].split(b" ")
+        pos = nl + 1
+        if header[-1] == b"missing":
+            continue
+        size = int(header[2])
+        blob = data[pos:pos + size]
+        pos += size + 1
+        try:
+            json.loads(blob.decode("utf-8"))
+        except ValueError:
+            out.write("invalid-json\t" + p + "\n")
+PYEOF
+}
+
 # Fail closed: unstage everything, keep the queue, status blocked.
 block_drain() {
   git -C "$GSTACK_HOME" reset -q HEAD -- . >/dev/null 2>&1 || true
@@ -994,7 +1042,9 @@ block_drain() {
 # one scanner pass attributes findings to staged paths, plan_holds decides
 # what is held or waits, those paths are unstaged and leave $1 (their records
 # stay queued), then the whole remaining staged diff must re-scan clean.
-# Sets ST_HELD and WAITING. Returns 1 after falling back to block_drain.
+# Sets ST_HELD and WAITING. Returns 1 after falling back to block_drain, or
+# when a path would be held during an unfinished merge (the merge commit
+# would silently keep only this side of it).
 hold_flagged_paths() {
   local paths_file="$1" groups_file="$2" scan="$1.scan" rc=0 gate_rc=0 gate_out
   WAITING=0
@@ -1003,6 +1053,7 @@ hold_flagged_paths() {
   git -C "$GSTACK_HOME" diff --cached --no-renames > "$scan.diff" 2>/dev/null || rc=1
   git -C "$GSTACK_HOME" diff --cached --no-renames -z --name-only > "$scan.names" 2>/dev/null || rc=1
   [ "$rc" -eq 0 ] && { secret_scan attribute "$scan.diff" "$scan.names" "$scan.hits" || rc=1; }
+  [ "$rc" -eq 0 ] && { append_invalid_json_hits "$scan.names" "$scan.hits" || rc=1; }
   # A successful add need not stage the requested spelling or current bytes
   # (case-insensitive indexes and assume-unchanged can both report success).
   # Reuse the scanner's name snapshot; refusal preserves the index and queue.
@@ -1023,6 +1074,12 @@ hold_flagged_paths() {
   ST_HELD=$(cat "$scan.held")
   WAITING=$(grep -c . "$scan.wait" 2>/dev/null || true)
   WAITING=${WAITING:-0}
+  if [ -s "$scan.unstage" ] && git -C "$GSTACK_HOME" rev-parse -q --verify MERGE_HEAD >/dev/null 2>&1; then
+    ST_DRAINABLE=0
+    write_status "blocked" "a git merge in $GSTACK_HOME is unfinished and $(grep -c . "$scan.unstage") file(s) are held back or wait for their coupled group; committing the merge without them would drop the other side's changes. Repair the files held[] names (they stay queued and sync on the next run), or finish the merge yourself; --skip-file and --drop-queue do not clear this. Nothing was committed; the merge and the queue are kept"
+    echo "BRAIN_SYNC: blocked: unfinished merge with held files" >&2
+    return 1
+  fi
   if [ -s "$scan.unstage" ]; then
     if ! tr -d '\r' < "$scan.unstage" | git --literal-pathspecs -C "$GSTACK_HOME" reset -q HEAD --pathspec-from-file=- >/dev/null 2>&1; then
       block_drain "git could not unstage the held files"
@@ -1347,11 +1404,13 @@ subcmd_once() {
   hold_flagged_paths "$paths_file" "$groups_file" || exit 0
   ST_DRAINABLE=$(( ADD_FAILED + WAITING ))
   [ "$WAITING" -gt 0 ] && ST_NOTE="$ST_NOTE; $WAITING file(s) of a coupled group wait for a consistent generation (still queued)"
-  local held_n ok_code="ok"
+  local held_n json_n ok_code="ok"
   held_n=$(printf '%s' "$ST_HELD" | grep -o '"rule"' | wc -l | tr -d ' ')
+  json_n=$(printf '%s' "$ST_HELD" | grep -o '"rule": "invalid-json"' | wc -l | tr -d ' ')
   if [ "$held_n" -gt 0 ]; then
     ok_code="held"
-    ST_NOTE="$ST_NOTE; the secret scan held back $held_n flagged file(s) (and any coupled files), NOT synced; see held[] for each file's fixes"
+    [ "$held_n" -gt "$json_n" ] && ST_NOTE="$ST_NOTE; the secret scan held back $(( held_n - json_n )) flagged file(s) (and any coupled files), NOT synced; see held[] for each file's fixes"
+    [ "$json_n" -gt 0 ] && ST_NOTE="$ST_NOTE; $json_n synced file(s) are not valid JSON (often git conflict markers) and were held back (and any coupled files), NOT synced and still queued; see held[] for each file's fixes"
     echo "BRAIN_SYNC: held $held_n flagged file(s); see $SELF_BIN --status" >&2
   elif [ "$ST_CASE_HELD" -gt 0 ]; then
     ok_code="collision"
@@ -1552,8 +1611,8 @@ subcmd_attention() {
   case "$last_push" in $iso) ;; *) last_push="" ;; esac
 
   case "$code" in
-    held) echo "ARTIFACTS_SYNC: attention: status=held held=$held. The secret scan is holding back $held file(s); everything else still syncs. See which files and how to fix them: $bin --status" ;;
-    blocked) echo "ARTIFACTS_SYNC: attention: status=blocked. The secret scan flagged a file it could not hold back on its own, so nothing is syncing. See the fix: $bin --status" ;;
+    held) echo "ARTIFACTS_SYNC: attention: status=held held=$held. Sync is holding back $held file(s) that the secret scan flagged or that are not valid JSON; everything else still syncs. See which files and how to fix them: $bin --status" ;;
+    blocked) echo "ARTIFACTS_SYNC: attention: status=blocked. Sync committed nothing: a flagged file could not be held back on its own, or held files are part of an unfinished git merge. See the fix: $bin --status" ;;
     push_failed) echo "ARTIFACTS_SYNC: attention: status=push_failed. Synced files are committed locally but the push failed; it retries at skill start. See the cause: $bin --status" ;;
     error) echo "ARTIFACTS_SYNC: attention: status=error. The last sync stopped before committing; the queue is kept and retried. See the cause: $bin --status" ;;
     unknown) echo "ARTIFACTS_SYNC: attention: status=unknown. The sync status file is unreadable. See it: $bin --status" ;;
diff --git a/bin/gstack-ceo-mode-handoff b/bin/gstack-ceo-mode-handoff
index 393f4886a..ccb4c0a52 100755
--- a/bin/gstack-ceo-mode-handoff
+++ b/bin/gstack-ceo-mode-handoff
@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
 # gstack-ceo-mode-handoff — print /plan-ceo-review's Step 0E mode handoff line.
 #
-# Usage: gstack-ceo-mode-handoff <MODE> [--auto] [--decisions "<rows>"]
+# Usage: gstack-ceo-mode-handoff <MODE> [--auto | --ceo-only] [--decisions "<rows>"]
 #   MODE: HOLD SCOPE | SCOPE EXPANSION | SELECTIVE EXPANSION | SCOPE REDUCTION
 #         (underscores accepted for spaces)
 #   --auto       the mode came from a saved AUTO_DECIDE preference
+#   --ceo-only   the mode came from 0E's rule in an /autoplan --ceo-only run
 #   --decisions  governing approved rows; defaults to "none"
 #
 # The handoff used to be chat-only, and the model often composed it in its
@@ -15,10 +16,12 @@ set -euo pipefail
 mode="${1:-}"
 [ "$#" -gt 0 ] && shift
 auto=0
+ceo_only=0
 decisions="none"
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --auto) auto=1; shift ;;
+    --ceo-only) ceo_only=1; shift ;;
     --decisions)
       [ "$#" -ge 2 ] || { echo "gstack-ceo-mode-handoff: --decisions needs a value" >&2; exit 2; }
       decisions="$2"; shift 2 ;;
@@ -31,11 +34,14 @@ case "$mode" in
   "HOLD SCOPE"|"SCOPE EXPANSION"|"SELECTIVE EXPANSION"|"SCOPE REDUCTION") ;;
   *) echo "gstack-ceo-mode-handoff: unknown mode: ${mode:-<empty>}" >&2; exit 2 ;;
 esac
+[ "$auto$ceo_only" != 11 ] || { echo "gstack-ceo-mode-handoff: --auto and --ceo-only conflict" >&2; exit 2; }
 decisions="${decisions//$'\n'/ }"
 decisions="${decisions%.}"
 [ -n "${decisions// /}" ] || decisions="none"
 
-if [ "$auto" = 1 ]; then
+if [ "$ceo_only" = 1 ]; then
+  echo "Auto-selected review mode → $mode (CEO-only run: Step 0E's rule). Approved decisions: $decisions."
+elif [ "$auto" = 1 ]; then
   echo "Auto-decided review mode → $mode (your preference). Change with /plan-tune. Approved decisions: $decisions."
 else
   echo "Mode: $mode; approved decisions: $decisions."
diff --git a/bin/gstack-developer-profile b/bin/gstack-developer-profile
index b5db05262..f64178e2b 100755
--- a/bin/gstack-developer-profile
+++ b/bin/gstack-developer-profile
@@ -394,6 +394,18 @@ do_read() {
 # -----------------------------------------------------------------------
 do_profile() {
   ensure_profile
+  local PARSE_ERR
+  if ! PARSE_ERR=$(PROFILE_FILE_PATH="$PROFILE_FILE" bun --no-env-file --config="${GSTACK_BUN_CONFIG:-/dev/null}" -e "
+    const text = require('fs').readFileSync(process.env.PROFILE_FILE_PATH, 'utf-8');
+    try { JSON.parse(text); } catch (e) {
+      const markers = /^(<{7}|={7}|>{7})( |\$)/m.test(text) ? ' (it holds git conflict markers from a merge)' : '';
+      console.log(e.message + markers);
+      process.exit(1);
+    }
+  " 2>&1); then
+    echo "gstack-developer-profile: $PROFILE_FILE is not valid JSON: $PARSE_ERR; repair the file or restore it from git -C $GSTACK_HOME log -- developer-profile.json" >&2
+    return 1
+  fi
   cat "$PROFILE_FILE"
 }
 
diff --git a/bin/gstack-doctor b/bin/gstack-doctor
index 0690fb3a9..18adb49fc 100755
--- a/bin/gstack-doctor
+++ b/bin/gstack-doctor
@@ -275,7 +275,7 @@ check_codex_probe() {
 }
 
 check_sync() {
-  local mode file json status held drainable drain push queue=0 now f detail case_names fix="$BIN/gstack-brain-sync --status"
+  local mode file json json_held status held drainable drain push queue=0 now f detail case_names fix="$BIN/gstack-brain-sync --status"
   cfg artifacts_sync_mode off; mode=$_cfg
   if [ ! -d "$STATE_ROOT/.git" ]; then
     row "not configured" "artifacts sync" "off; cross-machine artifacts sync is unavailable" "$BIN/gstack-artifacts-init"
@@ -285,6 +285,11 @@ check_sync() {
     row "not configured" "artifacts sync" "artifacts_sync_mode off; cross-machine artifacts sync is unavailable" "$BIN/gstack-config set artifacts_sync_mode artifacts-only"
     return
   fi
+  for f in "$STATE_ROOT/developer-profile.json" "$STATE_ROOT"/projects/*/decisions.active.json; do
+    [ -f "$f" ] && grep -qE '^(<{7}|>{7})( |$)' "$f" 2>/dev/null || continue
+    row warn "artifacts sync" "${f#"$STATE_ROOT"/} holds git conflict markers and does not parse" "repair the file, or restore it from git -C $STATE_ROOT log -- ${f#"$STATE_ROOT"/}"
+    return
+  done
   for f in "$STATE_ROOT/.brain-queue.d"/*.json; do [ -f "$f" ] && queue=$((queue + 1)); done
   for f in "$STATE_ROOT/.brain-queue.jsonl" "$STATE_ROOT/.brain-queue.jsonl.migrating"; do
     [ -f "$f" ] && queue=$((queue + $(wc -l < "$f" | tr -d ' ')))
@@ -306,8 +311,15 @@ check_sync() {
   [ -n "$push" ] || push=$(epoch_of "$(head -1 "$STATE_ROOT/.brain-last-push" 2>/dev/null)")
   now=$(date +%s)
   case "$status" in
-    held) row warn "artifacts sync" "status held${held:+ ($held file(s) held by the secret scanner)}" "$fix"; return ;;
-    blocked) row warn "artifacts sync" "status blocked (a re-scan still flags staged content)" "$fix"; return ;;
+    held)
+      json_held=$(printf '%s' "$json" | grep -o '"rule": *"invalid-json"' | wc -l | tr -d ' ')
+      if [ "${json_held:-0}" -gt 0 ]; then
+        row warn "artifacts sync" "status held ($json_held synced file(s) are not valid JSON${held:+; $held held in all})" "$fix"
+      else
+        row warn "artifacts sync" "status held${held:+ ($held file(s) held by the secret scanner)}" "$fix"
+      fi
+      return ;;
+    blocked) row warn "artifacts sync" "status blocked (nothing was committed; --status names the cause)" "$fix"; return ;;
     push_failed|error|unknown) row warn "artifacts sync" "status $status" "$fix"; return ;;
   esac
   if [ -n "$case_names" ]; then
diff --git a/bin/gstack-doctor-components.sh b/bin/gstack-doctor-components.sh
index 33f77842f..5bda51ce5 100644
--- a/bin/gstack-doctor-components.sh
+++ b/bin/gstack-doctor-components.sh
@@ -338,6 +338,9 @@ gstack_result_anchor() {
     RECEIPT_GIT_TOO_OLD) printf '%s' 'receipt-git-too-old' ;;
     CHANGELOG_FRAGMENT_INVALID) printf '%s' 'changelog-fragment-invalid' ;;
     QUEUE_LAND_LOCKED) printf '%s' 'queue-land-locked' ;;
+    QUEUE_TRAIN_UNSTAMPED) printf '%s' 'queue-train-unstamped' ;;
+    RESTAMP_NOT_STAGED) printf '%s' 'restamp-not-staged' ;;
+    RESTAMP_UNSTAGED_EDITS) printf '%s' 'restamp-unstaged-edits' ;;
     QUEUE_LAND_CONFLICT) printf '%s' 'queue-land-conflict' ;;
     QUEUE_LAND_DRIFT) printf '%s' 'queue-land-drift' ;;
     QUEUE_LAND_BASE_BUSY) printf '%s' 'queue-land-base-busy' ;;
diff --git a/bin/gstack-eval-plan b/bin/gstack-eval-plan
index 020494a43..8a52cc109 100755
--- a/bin/gstack-eval-plan
+++ b/bin/gstack-eval-plan
@@ -6,7 +6,7 @@
  *   gstack-eval-plan arms [--arms <model,model>] [--policy-doc <file>] [--input-tokens N] [--output-tokens N] [--json]
  *   gstack-eval-plan dry-run --input <rows.jsonl> --arms <model,model> [--fields a,b] [--output-budget N]
  *                            [--retry-prompt <file>] [--max-rows N] [--out <dir>] [--json]
- *   gstack-eval-plan pilot start  --out <dir> --cap <usd> --arms <model[#loadout],...> --dry-run <dry-run.json> [--n 3]
+ *   gstack-eval-plan pilot start  --out <dir> --cap <usd> --arms <model[#loadout],...> --dry-run <dry-run.json> [--n 3] [--seat-metered <arm,...>]
  *   gstack-eval-plan pilot settle --out <dir> --attempt <id> --usd <n|unknown>
  *   gstack-eval-plan pilot release --out <dir> --attempt <id>
  *   gstack-eval-plan pilot report --out <dir> --total <items> [--workers W] [--json]
@@ -53,9 +53,11 @@ const HELP = `gstack-eval-plan — preregistration, priced arms, $0 dry run, pri
   dry-run --input rows.jsonl --arms m,m [--fields a,b] [--output-budget N] [--retry-prompt f] [--max-rows N] [--cap usd] [--out dir] [--json]
                                      stub model over the real rows; checklist: price table, output budget, retry prompt text,
                                      and with --cap reservation-fits-cap (one call: largest row + output budget, priced)
-  pilot start --out dir --cap usd --arms m,m#no-gstack --dry-run dry-run.json [--n 3]
+  pilot start --out dir --cap usd --arms m,m#no-gstack --dry-run dry-run.json [--n 3] [--seat-metered arm,...]
+                                     --seat-metered: arms on a subscription with no incremental charge; they reserve $0,
+                                     settle unknown, and sit outside the cap and the projection until one settles a charge
   pilot settle --out dir --attempt id --usd <n|unknown>      pilot release --out dir --attempt id
-  pilot report --out dir --total items [--workers W] [--json]  spend table + extrapolation with a 95% band, then the approval ask
+  pilot report --out dir --total items [--workers W] [--json]  spend table + per-arm extrapolation with a 95% band, then the approval ask
   results --check <prereg> <results.md> [--json]
                                      one table in the results file has a filled row for every Arms identity, each no-gstack arm
                                      beside its variants; reads text only (docs/TESTING_INTERNALS.md#no-gstack-arm)
@@ -185,7 +187,7 @@ function doPilot(rest: string[]): number {
     if (cap === undefined || !arms.length || !dry || !fs.existsSync(dry)) return usage('pilot start needs --cap <usd> --arms <m,m> --dry-run <existing dry-run.json>');
     const rules = lintModels(args, arms.map(model => ({ model, scope: scopeOf(args), where: 'pilot start --arms' })), 'pilot start');
     if (!rules.ok) return EXIT.fail;
-    const r = startPilot({ out, cap, n: num(args, '--n', 3)!, arms, dryRun: dry });
+    const r = startPilot({ out, cap, n: num(args, '--n', 3)!, arms, seatMetered: csv(flag(args, '--seat-metered')), dryRun: dry });
     if (r.error && !r.record) { process.stderr.write(resultLine('gstack-eval-plan pilot start', r.error.code, r.error.message) + '\n'); return EXIT.refused; }
     for (const a of r.record.attempts) process.stdout.write(`PILOT_ATTEMPT: ${a.attempt} model=${a.model} estimate=$${a.estimate_usd.toFixed(4)}\n`);
     process.stdout.write(`PILOT: status=${r.record.status} reserved=${r.record.attempts.length} cap=$${cap.toFixed(2)} ledger=${path.join(out, 'spend.json')}\n`);
diff --git a/bin/gstack-jsonl-merge b/bin/gstack-jsonl-merge
index ce439d2ac..4a7074186 100755
--- a/bin/gstack-jsonl-merge
+++ b/bin/gstack-jsonl-merge
@@ -91,8 +91,12 @@ for path in paths:
         sys.exit(1)
 
 # Timestamp-ordered entries first (group 0), then hash-ordered (group 1).
+# UTF-8 bytes and LF on every platform: print() encodes with the stdout code
+# page and writes CRLF on Windows (#3659).
+out = sys.stdout.buffer
 for line, _ in sorted(seen.items(), key=lambda item: item[1]):
-    print(line)
+    out.write(line.encode('utf-8') + b'\n')
+out.flush()
 PYEOF
 
 _PYEXIT=$?
diff --git a/bin/gstack-outside-voice b/bin/gstack-outside-voice
index 28a03e3be..d2b2c56c1 100755
--- a/bin/gstack-outside-voice
+++ b/bin/gstack-outside-voice
@@ -4,7 +4,7 @@
  *
  *   gstack-outside-voice run --runner codex-cli|api|host-subagent --prompt <file> --out <file>
  *                            [--model <id>] [--result <file>] [--native-model <id>] [--fallback <runner>]
- *                            [--gate review|structured|spec|proposal] [--timeout-ms N] [--cwd <dir>] [--json]
+ *                            [--gate review|structured|spec|proposal] [--timeout-ms N] [--max-tokens N] [--cwd <dir>] [--json]
  *   gstack-outside-voice runners [--model <id>] [--json]   the runner table: capabilities and availability here
  *   gstack-outside-voice family <model-id>                  the model's family (same-family rule)
  *
@@ -20,18 +20,21 @@ import { EXIT, exitTableHelp } from '../lib/headless-artifacts';
 import type { OutsideGate } from '../lib/outside-review-result';
 import { RUNNER_IDS, createRunner, familyConflict, modelFamily, outsideStatusLine, runnerTable, selectRunner, type RunnerId } from '../lib/outside-voice-runner';
 import { outsideConsent } from '../lib/outside-consent';
+import { apiTimeoutMs } from '../lib/outside-voice-api';
 import { resultLine } from '../lib/result-codes';
 
 const HELP = `gstack-outside-voice — one outside voice, three runners (docs/unattended.md)
 
   run --runner <r> --prompt <file> --out <file> [--model <id>] [--result <file>] [--native-model <id>]
-      [--fallback <r>] [--gate review|structured|spec|proposal] [--timeout-ms N] [--cwd <dir>] [--json]
+      [--fallback <r>] [--gate review|structured|spec|proposal] [--timeout-ms N] [--max-tokens N] [--cwd <dir>] [--json]
   runners [--model <id>] [--json]        the runner table: id, capabilities, available here
   family <model-id>                      print the model family (anthropic, openai, google, ...)
 
 Runners: codex-cli (repository review via codex exec), api (supplied-input review via
 OPENAI_API_KEY/ANTHROPIC_API_KEY; needs --model), host-subagent (binds --result from a
-cross-family subagent the host ran; needs --model). --native-model enforces the same-family
+cross-family subagent the host ran; needs --model). --max-tokens caps the api runner's output
+(Anthropic default 16384; its default time limit grows with it); a response cut off at the limit
+is unavailable (truncated). --native-model enforces the same-family
 rule. GSTACK_OUTSIDE_RUNNER names the fallback when --fallback is absent.
 Prints OUTSIDE_STATUS: <status> provider=<runner> model=<id> family=<f> and writes <out>.meta.json.
 codex_reviews=disabled (or an unreadable config) refuses every runner before it starts:
@@ -75,9 +78,12 @@ async function main(argv: string[]): Promise<number> {
   if (!fs.existsSync(promptFile)) return usage(`prompt file not found: ${promptFile}`);
   const gate = (flag(rest, '--gate') ?? 'review') as OutsideGate;
   if (!['review', 'structured', 'spec', 'proposal'].includes(gate)) return usage('--gate must be review, structured, spec or proposal');
+  const maxTokensText = flag(rest, '--max-tokens');
+  const maxTokens = maxTokensText === undefined ? undefined : Number(maxTokensText);
+  if (maxTokens !== undefined && (!Number.isInteger(maxTokens) || maxTokens <= 0)) return usage('--max-tokens needs a positive integer');
   const timeoutText = flag(rest, '--timeout-ms');
-  const timeoutMs = timeoutText === undefined ? 300_000 : Number(timeoutText);
-  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) return usage('--timeout-ms needs a positive integer');
+  const timeoutMs = timeoutText === undefined ? undefined : Number(timeoutText);
+  if (timeoutMs !== undefined && (!Number.isInteger(timeoutMs) || timeoutMs <= 0)) return usage('--timeout-ms needs a positive integer');
   const fallbackText = flag(rest, '--fallback') ?? process.env.GSTACK_OUTSIDE_RUNNER;
   if (fallbackText !== undefined && !isRunner(fallbackText)) return usage(`--fallback must be one of ${RUNNER_IDS.join(', ')}`);
   const model = flag(rest, '--model');
@@ -110,7 +116,7 @@ async function main(argv: string[]): Promise<number> {
   const stop = () => runner.cancel();
   process.on('SIGTERM', stop);
   process.on('SIGINT', stop);
-  const result = await runner.run({ promptFile: path.resolve(promptFile), outFile: path.resolve(outFile), model, timeoutMs, cwd, gate, resultFile: resultFile ? path.resolve(resultFile) : undefined });
+  const result = await runner.run({ promptFile: path.resolve(promptFile), outFile: path.resolve(outFile), model, timeoutMs: timeoutMs ?? (choice.runner === 'api' ? apiTimeoutMs(maxTokens) : 300_000), cwd, gate, maxTokens, resultFile: resultFile ? path.resolve(resultFile) : undefined });
   fs.mkdirSync(path.dirname(path.resolve(outFile)), { recursive: true });
   fs.writeFileSync(`${path.resolve(outFile)}.meta.json`, JSON.stringify(result, null, 2) + '\n');
   if (json) process.stdout.write(JSON.stringify(result) + '\n');
diff --git a/bin/gstack-restamp b/bin/gstack-restamp
index b4922171b..ef6e44c7b 100755
--- a/bin/gstack-restamp
+++ b/bin/gstack-restamp
@@ -10,11 +10,18 @@
  * Runs gstack-version-bump write, the policy's release_tool, the CHANGELOG
  * re-heading and the stamp_paths rewrites in an isolated staging worktree,
  * shows the diff limited to stamp files, and writes the branch only after
- * every stage validated (journal: .gstack/tmp/restamp-journal.json).
- * Idempotent; --dry-run writes nothing. Workflow command: ends with the
+ * every stage validated (journal: .gstack/tmp/restamp-journal.json), then
+ * stages what it wrote (`git add -A -- <FILES>`, STAGED:), so a bare commit after
+ * a --no-commit base merge cannot drop the stamp (#3531). A stamp file holding
+ * unstaged edits of the caller's own refuses before anything is written
+ * (RESTAMP_UNSTAGED_EDITS); a staging failure leaves the files written and
+ * .gstack/tmp/restamp-staging.json, which the noop rerun stages, or drops when a
+ * file changed since (RESTAMP_NOT_STAGED). Idempotent; --dry-run writes nothing. Workflow command: ends with the
  * GSTACK_RESULT line. Logic: lib/restamp.ts; policy: lib/ship-policy.ts.
  */
 import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 import { EXIT, exitTableHelp, formatResult } from '../lib/headless-artifacts';
 import { GATE_AHEAD_REL, JOURNAL_REL, restamp, type RestampResult } from '../lib/restamp';
 import { RESULT_CODES, type ResultCodeName } from '../lib/result-codes';
@@ -39,7 +46,7 @@ const HELP = `gstack-restamp — stamp the version, release tool, CHANGELOG and
   --dry-run                  print the full diff, write nothing
   --json                     JSON only on stdout
 
-Prints STAMP_VERSION: <X>, the stage table, the stamp diff and
+Prints STAMP_VERSION: <X>, the stage table, the stamp diff, STAGED: <files it staged> and
 GSTACK_RESULT: skill=restamp status=complete|refused|incomplete run=${JOURNAL_REL}.
 ${exitTableHelp()}`;
 
@@ -48,6 +55,49 @@ function flag(args: string[], name: string): string | undefined {
   return i >= 0 ? args[i + 1] : undefined;
 }
 
+const STAGING_REL = '.gstack/tmp/restamp-staging.json';
+interface Pending { files: string[]; blobs: Record<string, string | null> }
+interface Staging { staged?: string[]; dropped?: string[]; failure?: string }
+
+const gitIn = (root: string, args: string[]) => spawnSync('git', args, { cwd: root, encoding: 'utf8', timeout: 60_000 });
+/** Each file's blob sha in the worktree (one git call), null for a file that does not exist. */
+function blobsOf(root: string, files: string[]): Record<string, string | null> {
+  const present = files.filter(f => fs.existsSync(path.join(root, f)));
+  const shas = present.length ? gitIn(root, ['hash-object', '--', ...present]).stdout.trim().split('\n') : [];
+  return Object.fromEntries(files.map(f => [f, present.includes(f) ? shas[present.indexOf(f)] ?? '' : null]));
+}
+function readPending(root: string): Pending | null {
+  try { return JSON.parse(fs.readFileSync(path.join(root, STAGING_REL), 'utf8')) as Pending; } catch { return null; }
+}
+
+/** Files with unstaged edits that are the caller's own (not bytes a pending restamp wrote and could not stage). */
+function ownUnstaged(root: string): string[] {
+  const pending = readPending(root);
+  const unstaged = gitIn(root, ['diff', '--name-only', '-z']).stdout.split('\0').filter(Boolean);
+  const now = pending ? blobsOf(root, unstaged.filter(f => f in pending.blobs)) : {};
+  return unstaged.filter(f => !(pending && f in now && pending.blobs[f] === now[f]));
+}
+
+/**
+ * Stage what restamp wrote (`written`), or what a pending marker says is still unstaged; a marker file whose bytes
+ * changed since (a hand commit, another branch, a base merge) is stale for that file and dropped, never a failure.
+ * Null when there is nothing to stage.
+ */
+function stage(root: string, written: string[] | null): Staging | null {
+  const marker = path.join(root, STAGING_REL);
+  const pending = written ? { files: written, blobs: blobsOf(root, written) } : readPending(root);
+  if (!pending?.files.length) return null;
+  if (written) { fs.mkdirSync(path.dirname(marker), { recursive: true }); fs.writeFileSync(marker, JSON.stringify(pending, null, 2) + '\n'); }
+  const now = written ? pending.blobs : blobsOf(root, pending.files);
+  const dropped = pending.files.filter(f => now[f] !== pending.blobs[f]);
+  const files = pending.files.filter(f => !dropped.includes(f));
+  if (!files.length) { fs.rmSync(marker, { force: true }); return { staged: [], dropped }; }
+  const add = gitIn(root, ['add', '-A', '--', ...files]);
+  if (add.status !== 0) return { failure: `git add of ${files.join(' ')} failed (${(add.stderr || add.stdout).trim().split('\n')[0]}); the stamp stays written and ${STAGING_REL} names it` };
+  fs.rmSync(marker, { force: true });
+  return { staged: gitIn(root, ['diff', '--cached', '--name-only', '-z', '--', ...files]).stdout.split('\0').filter(Boolean), dropped };
+}
+
 function main(argv: string[]): number {
   if (argv.includes('--help') || argv.includes('-h')) { process.stdout.write(HELP + '\n'); return EXIT.ok; }
   const json = argv.includes('--json');
@@ -65,23 +115,32 @@ function main(argv: string[]): number {
   const after = flag(argv, '--after');
   const base = resolveBaseBranch(repoRoot, flag(argv, '--base'));
 
-  const result = restamp({
+  const options = {
     repoRoot, base, version: flag(argv, '--version'), next: argv.includes('--next'), bump, queueMode,
     after: after ? { pr: after, ref: flag(argv, '--predecessor-ref') } : undefined, pr: flag(argv, '--pr'),
     expectBase: flag(argv, '--expect-base'), was: flag(argv, '--was'), expectOrder: flag(argv, '--expect-order')?.split(',').map(s => s.trim()).filter(Boolean),
     policyFrom, allowRepoCommands: argv.includes('--allow-repo-commands'), dryRun: argv.includes('--dry-run'),
     failAfter: process.env.GSTACK_RESTAMP_FAIL_AFTER,
-  });
-  return report(result, json);
+  };
+  const writes = !after && !options.dryRun;
+  const own = writes ? ownUnstaged(repoRoot) : [];
+  const dry = own.length ? restamp({ ...options, dryRun: true }) : null;
+  if (dry && (dry.status === 'refused' || dry.status === 'failed')) return report(dry, json);
+  const clash = (dry?.files ?? []).filter(f => own.includes(f));
+  if (clash.length) return report({ status: 'refused', code: 'RESTAMP_UNSTAGED_EDITS', message: `${clash.join(', ')} ${clash.length === 1 ? 'holds' : 'hold'} unstaged edits of your own, which staging the stamp would sweep into the stamp commit; nothing written`, stages: [] }, json);
+  const result = restamp(options);
+  const staging = writes && (result.status === 'stamped' || result.status === 'noop') ? stage(repoRoot, result.status === 'stamped' ? result.files ?? [] : null) : null;
+  return report(result, json, staging);
 }
 
-function report(r: RestampResult, json: boolean): number {
-  const status = r.status === 'refused' ? 'refused' : r.status === 'failed' ? 'incomplete' : 'complete';
-  const code = r.status === 'refused' ? EXIT.refused : r.status === 'failed' ? EXIT.fail : EXIT.ok;
+function report(r: RestampResult, json: boolean, staging: Staging | null = null): number {
+  const status = r.status === 'refused' ? 'refused' : r.status === 'failed' || staging?.failure ? 'incomplete' : 'complete';
+  const code = r.status === 'refused' ? EXIT.refused : r.status === 'failed' || staging?.failure ? EXIT.fail : EXIT.ok;
   if (json) {
-    process.stdout.write(JSON.stringify({ ...r, result: status }) + '\n');
+    process.stdout.write(JSON.stringify({ ...r, ...(staging ?? {}), ...(staging?.failure && !r.code ? { code: 'RESTAMP_NOT_STAGED' } : {}), result: status }) + '\n');
     return code;
   }
+  if (staging?.failure) process.stderr.write(`gstack-restamp: ${staging.failure}; fix: ${RESULT_CODES.RESTAMP_NOT_STAGED.fix} (RESTAMP_NOT_STAGED)\n`);
   if (r.code) {
     const row = RESULT_CODES[r.code as ResultCodeName];
     process.stderr.write(`gstack-restamp: ${r.message}; fix: ${r.fix ?? row.fix} (${r.code})\n`);
@@ -95,6 +154,8 @@ function report(r: RestampResult, json: boolean): number {
     if (r.gateAhead) process.stdout.write(`GATE_AHEAD: head=${r.gateAhead.gated_head} tree=${r.gateAhead.gated_tree} predecessor=#${r.gateAhead.predecessor_pr}@${r.gateAhead.predecessor_head.slice(0, 12)} worktree=${r.gateAhead.worktree} evidence_branch=${r.gateAhead.evidence_branch_key}\n`);
     if (r.diff) process.stdout.write(r.diff + (r.diff.endsWith('\n') ? '' : '\n'));
     process.stdout.write(`FILES: ${(r.files ?? []).join(' ') || '(none)'}\n`);
+    if (staging?.staged) process.stdout.write(`STAGED: ${staging.staged.join(' ') || '(none)'}\n`);
+    if (staging?.dropped?.length) process.stdout.write(`NOTE: ${staging.dropped.join(' ')} changed since an earlier restamp wrote ${staging.dropped.length === 1 ? 'it' : 'them'}; not staged, and that run's staging marker is dropped\n`);
     if (r.mergeCondition) process.stdout.write(`MERGE_CONDITION: sha=${r.mergeCondition}\n`);
     if (r.status === 'gate-ahead' && r.gateAhead) process.stdout.write(`next: run the verification gate in ${r.gateAhead.worktree}, then \`gstack-evidence bundle --out <file>\` there; the branch is untouched. At this PR's turn rerun \`gstack-restamp --next\` here and read \`gstack-tree-receipt --from ${GATE_AHEAD_REL}\` before deciding what to rerun.\n`);
     else if ((r.status === 'stamped' || r.status === 'noop') && r.queueMode === 'stamp-at-merge') process.stdout.write(`next: NEW_VERSION=${r.newVersion}; commit and push only the stamp diff above (FILES), with no edit of your own: the train's verify accepts the CHANGELOG only as the base's plus this PR's entry re-headed; merge with the expected head ${r.mergeCondition ?? 'sha'} and recompute on a stale queue.\n`);
diff --git a/bin/gstack-review-scope b/bin/gstack-review-scope
index 3d4c843b6..fb2f2388e 100755
--- a/bin/gstack-review-scope
+++ b/bin/gstack-review-scope
@@ -23,6 +23,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { EXIT, exitTableHelp } from '../lib/headless-artifacts';
 import { resultLineWithDocs } from '../lib/result-codes';
+import { runScriptSync } from '../lib/script-invocation';
 import { isUnavailable, loadPolicyFromBase, policyUnavailableLine, resolveBaseBranch } from '../lib/ship-policy';
 import { EXIT as POST_EXIT, runPost } from '../lib/gstack-post';
 import {
@@ -237,8 +238,8 @@ function cmdRender(rest: string[]): number {
 function cmdSummary(rest: string[], json: boolean): number {
   const since = flag(rest, '--since');
   if (!since || !Number.isFinite(Date.parse(since))) return refuse('summary', 'REVIEW_SCOPE_INPUT', '--since <ISO-8601 timestamp> (the invocation\'s first Step 9 entry) is required');
-  const read = spawnSync(path.join(path.dirname(Bun.fileURLToPath(import.meta.url)), 'gstack-review-read'), [], { encoding: 'utf8', timeout: 60_000, maxBuffer: 64 * 1024 * 1024 });
-  if (read.status !== 0) return refuse('summary', 'REVIEW_SCOPE_INPUT', `gstack-review-read failed: ${(read.stderr ?? '').trim().split('\n')[0] ?? ''}`);
+  const read = runScriptSync(path.join(path.dirname(Bun.fileURLToPath(import.meta.url)), 'gstack-review-read'), [], { encoding: 'utf8', timeout: 60_000, maxBuffer: 64 * 1024 * 1024 });
+  if (read.status !== 0) return refuse('summary', 'REVIEW_SCOPE_INPUT', `gstack-review-read failed: ${read.error?.message ?? (read.stderr ?? '').trim().split('\n')[0] ?? ''}`);
   const rows: Record<string, unknown>[] = [];
   for (const line of (read.stdout ?? '').split('---CONFIG---')[0]!.split('\n')) {
     if (!line.trim() || line === 'NO_REVIEWS') continue;
diff --git a/bin/gstack-ship-queue b/bin/gstack-ship-queue
index f72bd0e8f..738acc9c2 100755
--- a/bin/gstack-ship-queue
+++ b/bin/gstack-ship-queue
@@ -14,7 +14,7 @@
  *   gstack-ship-queue gate-ahead --list --pr <n>
  *   gstack-ship-queue verify --pr <n> --screen                  (train policy: the head's screen verdict from its run)
  *   gstack-ship-queue verify --post-merge <sha> [--timeout <s>] (after a merge: main's push workflows at that commit until they settle)
- *   gstack-ship-queue land --pr <n> [--dry-run] [--no-wait] [--break-lock]   (the merge step; lib/ship-queue-land.ts)
+ *   gstack-ship-queue land --pr <n> [--dry-run] [--no-wait] [--break-lock [--break-train-lock]]   (the merge step; lib/ship-queue-land.ts)
  *   gstack-ship-queue land --pr <n> --repair                    (after QUEUE_LAND_DRIFT: open the outside merge's release PR)
  *   gstack-ship-queue land --census
  *   gstack-ship-queue train build|status|verdict|bisect|rebuild|watch|prune ...   (merge trains; train --help)
@@ -57,7 +57,7 @@ const HELP = `gstack-ship-queue — the shared merge queue's protocol steps (doc
   verify --pr <n> --screen                 (train policy) the PR head's screen verdict read from its run (SCREEN_VERDICT)
   verify --post-merge <sha> [--timeout <s>] wait for every check run at a merged commit to settle: POST_MERGE: green|red|pending
                                            and one CHECK: line per workflow; resumable, default timeout 2700 s
-  land --pr <n> [--dry-run] [--no-wait] [--timeout <min>] [--break-lock] [--allow-repo-commands]
+  land --pr <n> [--dry-run] [--no-wait] [--timeout <min>] [--break-lock [--break-train-lock]] [--allow-repo-commands]
                                            the merge step: lock, merge the base, stamp (fragments folded), push the stamp commit,
                                            wait for its checks, squash with --match-head-commit, confirm the base tree; resumable
   land --pr <n> --repair                   after QUEUE_LAND_DRIFT: open the PR that gives the merge outside land its own
@@ -172,7 +172,7 @@ async function main(argv: string[]): Promise<number> {
     if (args.includes('--census')) return finish('land', l.census(ctx));
     if (!pr || !/^\d+$/.test(pr)) return usage('land needs --pr <number> (or --census)');
     const timeout = flag(args, '--timeout');
-    return finish('land', l.land(ctx, { pr, repair: args.includes('--repair'), dryRun: args.includes('--dry-run'), noWait: args.includes('--no-wait'), breakLock: args.includes('--break-lock'), allowRepoCommands: args.includes('--allow-repo-commands'), waitTimeoutMin: timeout && /^\d+$/.test(timeout) ? Number(timeout) : undefined }));
+    return finish('land', l.land(ctx, { pr, repair: args.includes('--repair'), dryRun: args.includes('--dry-run'), noWait: args.includes('--no-wait'), breakLock: args.includes('--break-lock'), breakTrainLock: args.includes('--break-train-lock'), allowRepoCommands: args.includes('--allow-repo-commands'), waitTimeoutMin: timeout && /^\d+$/.test(timeout) ? Number(timeout) : undefined }));
   }
   if (!pr || !/^\d+$/.test(pr)) return usage(`${cmd} needs --pr <number>`);
   const gateExit = flag(args, '--gate-exit');
diff --git a/bin/gstack-ship-receipt b/bin/gstack-ship-receipt
index b2d902b65..3de38d032 100755
--- a/bin/gstack-ship-receipt
+++ b/bin/gstack-ship-receipt
@@ -37,6 +37,7 @@ import * as path from 'node:path';
 import { EXIT, exitTableHelp, type ShipReceipt } from '../lib/headless-artifacts';
 import { resultLine, resultLineWithDocs } from '../lib/result-codes';
 import { versionAtRef } from '../lib/restamp';
+import { runScriptSync } from '../lib/script-invocation';
 import { readPregateFile, verifyPregate } from '../lib/pregate/index';
 import { isUnavailable, loadPolicyFromBase, matchesAny, policyUnavailableLine, resolveBaseBranch, runningGstackVersion, stampFilesInTree, validatePolicy, type ShipPolicy } from '../lib/ship-policy';
 import { approvalForReceipt } from '../lib/approval-citations';
@@ -179,7 +180,7 @@ function cmdWrite(rest: string[], json: boolean): number {
   const tree = receiptFile ? JSON.parse(fs.readFileSync(receiptFile, 'utf8')) : null;
   let sessionKind = flag(rest, '--session-kind') ?? process.env.GSTACK_SESSION_KIND;
   if (!sessionKind) {
-    const r = spawnSync(path.join(path.dirname(Bun.fileURLToPath(import.meta.url)), 'gstack-session-kind'), [], { encoding: 'utf8', timeout: 15_000 });
+    const r = runScriptSync(path.join(path.dirname(Bun.fileURLToPath(import.meta.url)), 'gstack-session-kind'), [], { encoding: 'utf8', timeout: 15_000 });
     sessionKind = r.status === 0 ? r.stdout.trim() || undefined : undefined;
   }
   let pregate: PregateField | undefined;
diff --git a/captain/templates/slot-call.md b/captain/templates/slot-call.md
index f1908884a..36d70f1db 100644
--- a/captain/templates/slot-call.md
+++ b/captain/templates/slot-call.md
@@ -12,10 +12,12 @@ Run: gstack-restamp --next --base <BASE> --pr <n> --expect-base <sha> --expect-o
 Slot 2 and later (and slot 1 when BASE moved): merge BASE into your pin first (expect a
 CHANGELOG-only conflict; resolve it with mergeChangelogs from lib/changelog-check.ts, the
 one-liner in docs/ship-policy.md's merge-train section, never by hand; grep for conflict
-markers before you stamp). Commit only the BASE merge and the stamp files this call names:
-<STAMP_FILES> (plus the file carrying a `*_KEY_VERSION` your PR introduced, on your own
-line only, when this call names it), never a fifth: a file the restamp lists that this call
-does not name is not a stamp, leave it out and say so.
+markers before you stamp). The restamp stages what it writes (STAGED:); commit what it
+staged, which must be only the BASE merge and the stamp files this call names: <STAMP_FILES>
+(plus the file carrying a `*_KEY_VERSION` your PR introduced, on your own line only, when this
+call names it), never a fifth: a file the call does not name is not a stamp, `git restore
+--staged --worktree` it and say so. verify reads the head's own STAMP_VERSION and refuses an unstamped
+head (QUEUE_TRAIN_UNSTAMPED).
 A pin stacked on a PR that merged earlier conflicts beyond the CHANGELOG where the parent's
 squash touched your lines: take your pin's bytes there (verify checks the tree against
 T<i>); mergeChangelogs carries your edits to the parent's released entry as Gate integrity
diff --git a/capy/skill/gstack/SKILL.md b/capy/skill/gstack/SKILL.md
index 7c87a2786..c6d85c010 100644
--- a/capy/skill/gstack/SKILL.md
+++ b/capy/skill/gstack/SKILL.md
@@ -46,7 +46,7 @@ Capy checklist for `/autoplan`: drive `gstack-autoplan`, never a hand adaptation
 
 Token caps on /ship: pass a brief's cap as `--token-cap <n>`. /ship reads `cost.tokens` and `cost.credits` from `tools.thread.get({ thread_id: "<your own jam id>" })` (its own jam; a subagent reading root `"this"` starts `--subagent --reading-from this --meter-scope tree`) inside the same execute program as the `gstack-ship-budget` command that takes them as `--reading <n> --credits <c>`, never alone. `ship/DRIVER.md` starts `--mode observe`: each program ends with `note`, and only a note past the cap stops (`docs/ship-budget.md`).
 
-/ship on Capy is about a dozen calls, each one execute program (`ship/DRIVER.md`). Each review pass and Step 11 is one call to the checked-in pass program (fill only `input`): `const t0 = await now(); const p = (await tools.capy.bash({ command: ". '<launch file>' && gstack-review-dispatch program", description: "Pass" })).output.split("\n"); return p[0] + "\n" + (await new (Object.getPrototypeOf(async () => {}).constructor)("tools", "sleep", "now", "input", JSON.parse(p[1]))(tools, sleep, now, { startedAt: t0, launch: "<launch file>", cwd: "<repo>", base: "<base>", out: "<run dir>/p<n>", pass: "<run>-p<n>", laneModel: "<your model id>", planFlags: [], logStart: ["review"], jam: "<jam id>", record: "<rec>", step: "9.2" }));` It plans, logs `logStart` (`reservation` mode from `RESERVATION_ID:`), sends each brief on `machine: "shared"`, then polls: one `tools.subagent.list` per ~20 s tick, returning 200 s after the program's first line, where a reader is settled only at status `done` or `failed` or with a `summary` (a just-created `idle` reader has not run); it starts readers under `rejected` with `tools.subagent.start` as slots free and stops on one stuck 20 minutes. It ends on `NEXT:` (`poll`: rerun) or `STOP:`. `models` maps roles to models (`outside-voice`: another family); Step 11 adds `stage: "voices"`; a full repeat pass, `diffBase: "<RANGE_BASE>"`. Steps 7, 8, 9.2.1 and 14.5 (`step: "14.5"`) use `extras`, JSON `{name, prompt_file, first, model}` (prompts verbatim from their sections, Step 7 `first`); they cannot block, so `model: { model_id: "anthropic/claude-sonnet-5-5", reasoning_mode: "low" }` (`anthropic/claude-haiku-5-5` also fits). Waits: never let 5 minutes pass between calls. While readers run, never end the turn on `wait`; rerun the loader. Otherwise re-issue `wait` with `duration_seconds: 200` and operation ids. At Step 22 report the `CALLS:` line of `gstack-ship-budget calls --events <file>` on your jam's transcript since /ship began. A small waiting child saves nothing.
+/ship on Capy is about a dozen calls, each one execute program (`ship/DRIVER.md`). Each review pass and Step 11 is one call to the checked-in pass program (fill only `input`): `const t0 = await now(); const p = (await tools.capy.bash({ command: ". '<launch file>' && gstack-review-dispatch program", description: "Pass" })).output.split("\n"); return p[0] + "\n" + (await new (Object.getPrototypeOf(async () => {}).constructor)("tools", "sleep", "now", "input", JSON.parse(p[1]))(tools, sleep, now, { startedAt: t0, launch: "<launch file>", cwd: "<repo>", base: "<base>", out: "<run dir>/p<n>", pass: "<run>-p<n>", laneModel: "<your model id>", planFlags: [], logStart: ["review"], jam: "<jam id>", record: "<rec>", step: "9.2" }));` It plans, logs `logStart` (`reservation` mode from `RESERVATION_ID:`), sends each brief on `machine: "shared"`, then polls: one `tools.subagent.list` per ~20 s tick, returning 200 s after the program's first line, where a reader is settled only at status `done` or `failed` or with a `summary` (a just-created `idle` reader has not run); it starts readers under `rejected` with `tools.subagent.start` as slots free and stops on one stuck 20 minutes. It ends on `NEXT:` (`poll`: rerun) or `STOP:`. `models` maps roles to models (`outside-voice`: another family); Step 11 adds `stage: "voices"`; a full repeat pass, `diffBase: "<RANGE_BASE>"`. Steps 7, 8 and 14.5 (`step: "14.5"`) use `extras`, JSON `{name, prompt_file, first, model}` (prompts verbatim from their sections, Step 7 `first`); they cannot block, so `model: { model_id: "anthropic/claude-sonnet-5-5", reasoning_mode: "low" }` (`anthropic/claude-haiku-5-5` also fits). Waits: never let 5 minutes pass between calls. While readers run, never end the turn on `wait`; rerun the loader. Otherwise re-issue `wait` with `duration_seconds: 200` and operation ids. At Step 22 report the `CALLS:` line of `gstack-ship-budget calls --events <file>` on your jam's transcript since /ship began. A small waiting child saves nothing.
 
 ## Plan, approve, ship
 
diff --git a/docs/TESTING_INTERNALS.md b/docs/TESTING_INTERNALS.md
index caa047811..8c913e020 100644
--- a/docs/TESTING_INTERNALS.md
+++ b/docs/TESTING_INTERNALS.md
@@ -1002,7 +1002,7 @@ with `UBICLOUD: left=<0|1|unknown> owner=<o> vm=<name> others=<n>`, checked
 against the project's VM list after teardown; anything but `left=0` turns a
 passing command into exit 1. pregate-remote.sh reads that line from the file
 named by `UBI_LEFT_FILE`, never from the command's output. No owner-age sweep runs by default (the TTL reaper
-below covers every owner); set
+below covers this owner's expired VMs); set
 `UBI_GC_HOURS` to a positive number (or run `gc HOURS`; `gc 0` is a no-op) to
 sweep only this owner's VMs older than that. For other commands, use the runner
 directly: `scripts/ubicloud/ubi-runner.sh run --setup <script> -- '<command>'`,
@@ -1011,12 +1011,12 @@ or its `up` / `ssh` / `sync` / `pull` / `down` steps (`--help` lists them).
 The runner is also the `/ubicloud` skill's engine (`bin/gstack-ubi` execs it).
 A generated name ends in `-t<hours>` (`UBI_TTL_HOURS`, 1-999, default 3; pregate-remote.sh
 uses its stop deadline plus 15 minutes, rounded up: `-t1` today), the creator's own statement of how long the VM may live: `reap`
-destroys every VM in the project whose TTL ended more than ten minutes ago,
-whichever owner made it, and the caller's own `ubirun-<UBI_OWNER>-*` names
-without a TTL (older runner copies) once they are `UBI_LEGACY_HOURS` old
-(default 4). Another owner's TTL-less VM and an untagged one are never reaped,
-because only a TTL lets reap judge another lane's VM. Every `up` runs it
-first (`UBI_REAP=0` skips it). Names outside the `ubirun-` prefix are never reaped. The
+destroys only the caller's own VMs: its `ubirun-<UBI_OWNER>-*` names whose TTL
+ended more than ten minutes ago, and those without a TTL (older runner copies)
+once they are `UBI_LEGACY_HOURS` old (default 4). Another owner's VM and an
+untagged one are never reaped, even after their TTL ends; reap only counts them
+in its log, because cloud deletes stay with the owner that created the VM
+(GST-573). Every `up` runs it first (`UBI_REAP=0` skips it). Names outside the `ubirun-` prefix are never reaped. The
 quota preflight adds the size's vCPUs to the project's running VMs and refuses
 before the create request when that exceeds the known ceiling
 (`UBI_QUOTA_VCPUS`, or the maximum the last refusal printed, remembered in the
@@ -1070,7 +1070,7 @@ machine swap, in this order:
    one side local and the other remote.
 4. Profiling very large imports (a whole-repo ingest, the full free suite under
    a profiler) is warned about before it starts: it holds the VM for hours, and
-   any other lane's `up` reaps it once its TTL (`UBI_TTL_HOURS`, default 3)
+   the same owner's next `up` or `reap` destroys it once its TTL (`UBI_TTL_HOURS`, default 3)
    plus ten minutes has passed, so set `UBI_TTL_HOURS` above the expected
    duration and name that duration in the thread before launching.
 
@@ -1547,7 +1547,7 @@ refresh to a maintainer.
   (`ubicloud-standard-4`); both are Ubicloud standard runners. When either recording adds
   or drops a test file, it force-updates the `bot/free-duration-seeds` branch,
   opens or refreshes one seed PR whose body states the ratchet result, and
-  dispatches Free Tests, Windows Free Tests and Quality gate on it. Those
+  dispatches Free Tests, Windows Smoke and Quality gate on it. Those
   dispatched runs are the seed PR's checks, and Free Tests supplies the required
   `free-tests` check. GitHub holds the pull_request runs of a token-opened PR as
   "action required" until someone approves them. A file that fails while recording turns its
@@ -1561,6 +1561,13 @@ refresh to a maintainer.
 
 ### Windows free lane
 
+Windows has minimal support ([support tiers](support-tiers.md)). The required
+PR check is `windows-smoke.yml`: one `windows-latest` job runs `./setup`, starts
+the core skills, drives `/browse` on gstack's own browser, and runs the short
+test list in its last step, where each file's reason sits beside it.
+`test/windows-native-workflows.test.ts` keeps that list Windows-safe and fast.
+
+The curated suite below runs nightly on main and on dispatch, never on a PR.
 `windows-free-tests.yml` plans on Linux (`--windows-only --ci-plan --shards 6`),
 runs one strict serial shard per `windows-latest` job
 (`bun run test:windows --ci-run`), and verifies every shard receipt on Linux
diff --git a/docs/agent-ready-errors.md b/docs/agent-ready-errors.md
index 3da3f8140..3be4b3431 100644
--- a/docs/agent-ready-errors.md
+++ b/docs/agent-ready-errors.md
@@ -37,8 +37,8 @@ unknown is reserved for existing behavior you could not inspect. In a live audit
 you never triggered are unknown, not extrapolated.
 
 **Caps.** Name the path and item behind every cap and show the corrected error line.
-- **4/10 (Critical finding, title `CAP4:<path>:<item>`):** a path leaks a secret, signals failure as success, gives an unsafe fix, or blocks waiting for a terminal (hangs, or fails for lack of a terminal without naming a non-interactive alternative such as `--yes`).
-- **6/10 (High finding, title `CAP6:<path>:<item>`):** a path lacks an applicable fix, recovery, context or trace item.
+- **4/10 (Critical finding, title `CAP4:<path>:<item> <what fails>`):** a path leaks a secret, signals failure as success, gives an unsafe fix, or blocks waiting for a terminal (hangs, or fails for lack of a terminal without naming a non-interactive alternative such as `--yes`).
+- **6/10 (High finding, title `CAP6:<path>:<item> <what fails>`):** a path lacks an applicable fix, recovery, context or trace item.
 
 Every mode, DX TRIAGE included, reports every CAP4 finding.
 
diff --git a/docs/autoplan-guard-troubleshooting.md b/docs/autoplan-guard-troubleshooting.md
index ff7970f5b..4e7feaaa7 100644
--- a/docs/autoplan-guard-troubleshooting.md
+++ b/docs/autoplan-guard-troubleshooting.md
@@ -257,6 +257,13 @@ the same three paths. An errored init is skipped, so a later successful init
 still binds. This denial applies when no init ever succeeded, or when an
 errored init follows a good one.
 
+An init whose output is not its JSON result (extra text, or no single text
+block) also counts as failed, and the message adds "without a leading cd" to
+the re-run hint. The one exception is the `Shell cwd was reset to <dir>` line
+Claude Code adds as the last line of a Bash result when the command's `cd`
+left the session's folder: the guard removes exactly that line before reading
+an init or checkpoint result (#3651).
+
 <a id="init-unbindable"></a>
 ### `init_unbindable`
 Init ran through a shell variable, substitution, chaining, a pipe or a
diff --git a/docs/captain.md b/docs/captain.md
index 313e006f6..cdc83da98 100644
--- a/docs/captain.md
+++ b/docs/captain.md
@@ -172,7 +172,7 @@ not a new ask ([carry-forward](unattended.md#carry-forward)).
 
 **The record.** `gstack-approvals import --autoplan <run dir> --by "<owner>"` (with
 `--stack <b1,b2,...>` for a stacked PR set) writes the approval row (date, the ask, the owner's exact words, the lane that answered as relayer,
-what it covers); `gstack-approvals render` puts it in the report and the PR body. Before
+what it covers; a gate answered with `--words-by agent:<id>` is listed under that agent as its own decision, not the owner's words); `gstack-approvals render` puts it in the report and the PR body. Before
 training the PR the controller compares that row's words and `gate_rev` with the ask it
 relayed and the reply it carried back; a row that does not match is not READY (shape A).
 The brief's done line names the row. A plan approval is not a READY field; the
@@ -317,8 +317,9 @@ stamp on the bare pin leaves the PR conflicting on the CHANGELOG. The lane merge
 into its pin first (expect a CHANGELOG-only conflict; resolve it with `mergeChangelogs`
 from `lib/changelog-check.ts`, the `bun -e` one-liner in
 [ship-policy.md](ship-policy.md#run-a-merge-train), never by hand, and grep for conflict
-markers before stamping), then restamps, then commits only the merge and the stamp
-files. In practice slot 1 needs the same merge whenever the base moved after the pin was
+markers before stamping), then restamps (the restamp stages the stamp files it wrote,
+so a plain `git commit` after a `--no-commit` merge keeps them), then commits only the
+merge and the stamp files. In practice slot 1 needs the same merge whenever the base moved after the pin was
 taken. A stamp commit with one extra byte freezes the queue for every
 lane behind it.
 
diff --git a/docs/gbrain-sync-errors.md b/docs/gbrain-sync-errors.md
index cd81aa9dd..2d14d7f07 100644
--- a/docs/gbrain-sync-errors.md
+++ b/docs/gbrain-sync-errors.md
@@ -38,8 +38,8 @@ cause, the held files and the fix.
 
 | State | Trigger | Attention line (after `ARTIFACTS_SYNC: attention: `) | Fix |
 |---|---|---|---|
-| `held` | The secret scan held back flagged files and synced the rest | `status=held held=<N>. The secret scan is holding back <N> file(s); everything else still syncs. See which files and how to fix them: <bin> --status` | Edit the file so the scan no longer matches, or `<bin> --skip-file <path>` (permanent; undo with `--unskip-file <path>`) |
-| `blocked` | A re-scan still flagged after the hold, so nothing was committed | `status=blocked. The secret scan flagged a file it could not hold back on its own, so nothing is syncing. See the fix: <bin> --status` | Edit or skip the files `--status` names, or clear the batch with `<bin> --drop-queue --yes` |
+| `held` | The secret scan or the JSON check held back flagged files and synced the rest | `status=held held=<N>. Sync is holding back <N> file(s) that the secret scan flagged or that are not valid JSON; everything else still syncs. See which files and how to fix them: <bin> --status` | Edit the file so the scan no longer matches, or `<bin> --skip-file <path>` (permanent; undo with `--unskip-file <path>`), or repair a file that is not valid JSON |
+| `blocked` | A re-scan still flagged after the hold, or a file would be held during an unfinished git merge, so nothing was committed | `status=blocked. Sync committed nothing: a flagged file could not be held back on its own, or held files are part of an unfinished git merge. See the fix: <bin> --status` | Edit or skip the files `--status` names, or clear the batch with `<bin> --drop-queue --yes`. For an unfinished merge, repair the held files or finish the merge; skipping files or dropping the queue does not clear it |
 | `push_failed` | A commit is saved locally but the push failed | `status=push_failed. Synced files are committed locally but the push failed; it retries at skill start. See the cause: <bin> --status` | The fix `--status` names (usually `gh auth status`) |
 | `error` | The drain stopped before committing and kept the queue | `status=error. The last sync stopped before committing; the queue is kept and retried. See the cause: <bin> --status` | The cause `--status` names: a git index lock, a commit hook, a `git add` failure |
 | `unknown` | The status file holds a status code outside this table | `status=unknown. The sync status file is unreadable. See it: <bin> --status` | Run `<bin> --once` to rewrite it |
@@ -76,6 +76,11 @@ both fixes:
    ~/.claude/skills/gstack/bin/gstack-brain-sync --drop-queue --yes
    ```
 
+A synced `.json` file that does not parse (often git conflict markers from a
+merge) is held the same way under rule `invalid-json`. Its only fix is to
+repair the file; `--skip-file` is not offered, because it would stop that
+file syncing for good. The next sync re-checks it.
+
 **Git index lock.** A git process killed mid-write leaves
 `~/.gstack/.git/index.lock`. The sync removes it once it is older than 10
 minutes, because every gstack writer to `~/.gstack` takes the same sync lock
diff --git a/docs/gbrain-sync.md b/docs/gbrain-sync.md
index 43d7f2e00..756e8186f 100644
--- a/docs/gbrain-sync.md
+++ b/docs/gbrain-sync.md
@@ -91,8 +91,8 @@ gstack-brain-sync --status
 ```
 
 Shows: the status (`ok`, `idle`, `held`, `collision`, `blocked`,
-`push_failed`, `error`), files held back by the secret scan with their
-fixes, files held because their path differs only by letter case from
+`push_failed`, `error`), files held back by the secret scan or because
+they are not valid JSON, with their fixes, files held because their path differs only by letter case from
 another path (`case_held`, `case_names`; see
 [troubleshooting](troubleshooting.md#artifact-case-collision)), the
 `drainable` count, the last sync and push times, pending queue depth, and
@@ -156,7 +156,7 @@ to it); everything else syncs. The held file stays queued and is re-scanned
 at every sync, and skill start prints:
 
 ```
-ARTIFACTS_SYNC: attention: status=held held=1. The secret scan is holding back 1 file(s); everything else still syncs. See which files and how to fix them: <bin> --status
+ARTIFACTS_SYNC: attention: status=held held=1. Sync is holding back 1 file(s) that the secret scan flagged or that are not valid JSON; everything else still syncs. See which files and how to fix them: <bin> --status
 ```
 
 To remediate:
@@ -200,6 +200,12 @@ is kept in a git stash; `gstack-brain-sync --status` names the stash and the
 `git -C ~/.gstack --literal-pathspecs restore --source=<stash> -- <path>`
 command that brings it back.
 
+JSON files such as `developer-profile.json` have no merge driver, so a
+merge can leave conflict markers in them. The sync parses every staged
+`.json` file and holds back one that does not parse (status `held`, rule
+`invalid-json`) until you repair it, and `gstack-doctor` warns when a synced profile or
+decision snapshot holds conflict markers.
+
 ## Cross-machine pull cadence
 
 The preamble runs `git fetch` + `git merge --ff-only` once per 24 hours
diff --git a/docs/pregate.md b/docs/pregate.md
index 057788ade..def98ef6a 100644
--- a/docs/pregate.md
+++ b/docs/pregate.md
@@ -848,7 +848,9 @@ path records and uploads `tested-tree`, after its verification passes, so a
 red, partial or reused run never leaves a record and a reuse is never reused.
 The pull request lookup needs no `pull-requests` permission on a public
 repository; a private fork of this setup would need `pull-requests: read`,
-and without it every push falls back to the full run.
+and without it every push falls back to the full run. Windows Free Tests now
+runs nightly and by hand only (docs/support-tiers.md), never on a push, so its
+`reuse` job is always skipped and every nightly run takes the strict path.
 
 <a id="guards"></a>
 ## Guards and the lane-done rule
diff --git a/docs/review-policy.md b/docs/review-policy.md
index 1d62b14de..1d4e3612b 100644
--- a/docs/review-policy.md
+++ b/docs/review-policy.md
@@ -545,8 +545,9 @@ ones, and the arm lost blockers. `bin/gstack-review-dispatch` closes both ends:
    prompts prints `VERIFY: no brief records` (exit 3), never clean.
 6. `pass --base <b> --out <dir> --pass <id> -- <plan flags>` runs one pass from a
    staged manifest (`<dir>/pass-manifest.json`): audit readers marked first, then
-   the specialists with QA and the other audits, then the Red Team, then Step 11's
-   voices. Each reviewer keeps its plan entry and is rendered by the same code as
+   the specialists with the other audit readers, then the Red Team, then Step 11's
+   voices. A QA extra is refused before any reader is created: Step 9.2.1's probes
+   are the parent's. Each reviewer keeps its plan entry and is rendered by the same code as
    `render`, once its inputs exist; the Red Team's findings file is the specialists'
    `merged.jsonl` lines byte for byte. A brief leaves the bin in indexed chunks of at
    most 65,536 characters (`chunk`), so no tool output line carries a whole brief and a
diff --git a/docs/ship-policy.md b/docs/ship-policy.md
index 4e0488229..26f3ef71e 100644
--- a/docs/ship-policy.md
+++ b/docs/ship-policy.md
@@ -92,7 +92,7 @@ hard-code:
   "changelog": "CHANGELOG.md",
   "history": "squash-ok",
   "stamp_sensitive_gates": ["tests"],
-  "changelog_fragments": { "dir": "changelog.d", "required_checks": ["free-tests", "windows-free-tests", "Check VERSION is not stale vs queue", "quality", "check-freshness", "actionlint"] },
+  "changelog_fragments": { "dir": "changelog.d", "required_checks": ["free-tests", "windows-smoke", "Check VERSION is not stale vs queue", "quality", "check-freshness", "actionlint"] },
   "min_gstack_version": "1.91.340.0"
 }
 ```
@@ -210,16 +210,18 @@ READY PR as conflicting each time main stamps; the train merges the CHANGELOG
 by section, so the lane never merges main for it. The conflict does mean GitHub
 has no merge ref for the PR, so no `pull_request` CI runs on the head and
 `ready` prints `ci: none at <head12>` with a `ci-hint:` line. The lane then
-runs `ready … --dispatch-ci free-tests.yml,windows-free-tests.yml [--timeout
+runs `ready … --dispatch-ci free-tests.yml,windows-smoke.yml [--timeout
 <s>]` (under a train policy): it dispatches each named workflow on the branch
 (`gh workflow run <wf> --ref <branch>`, skipped when a run at this head already
-concluded), waits for the runs (`CI_DISPATCH: <wf> --ref <branch> run <id> <url>
-<conclusion>`), clears every requires-remote pregate lane whose workflow is one
-of them with the run URL (`PREGATE_CLEARED: <lane> <url>`; a lane of another
-workflow stays uncleared and is named in the refusal), and then reads the head
-as usual, which passes because the dispatched check runs attach to the commit;
-the `ci-hint:` line then says those non-pull_request runs count. A red run
-clears no lane and refuses (`QUEUE_NOT_READY`); a run still going at `--timeout`
+concluded, and skipped with a note when the base has the workflow file but the
+branch predates it, since GitHub reads the file from the branch), waits for the
+runs (`CI_DISPATCH: <wf> --ref <branch> run <id> <url> <conclusion>`), clears
+every requires-remote pregate lane whose workflow is one of them with the run
+URL (`PREGATE_CLEARED: <lane> <url>`; a lane of another workflow stays
+uncleared and is named in the refusal), and then reads the head as usual,
+which passes because the dispatched check runs attach to the commit; the
+`ci-hint:` line then says those non-pull_request runs count. A red run clears
+no lane and refuses (`QUEUE_NOT_READY`); a run still going at `--timeout`
 (default 2700 s) is `QUEUE_TRAIN_PENDING`, and rerunning the command keeps
 waiting; a fork head is never dispatched here (`QUEUE_TRAIN_UNTRUSTED`). By hand the same four steps are `gh workflow
 run <wf> --ref <branch>`, wait, `gstack-pregate clear --remote <lane> --run-url
@@ -399,6 +401,28 @@ release paths (version files, CHANGELOG, fragments, `release_outputs`,
 train head and branch are S_k, and the one full gate runs on S_k, the exact
 tree the last merge publishes.
 
+**One land lock.** `train land` takes the same repository land lock as
+[`land`](#land), `refs/notes/gstack-land`, as `train <nonce> slot <i> (#<pr>)`,
+before its first read of main, so a standalone land and a train slot never
+both publish onto one main: whichever starts second refuses with
+`QUEUE_LAND_LOCKED`, naming the holder. Once a slot has merged, the train keeps
+the lock in phase `between`, which only the same train's next slot takes over,
+until its last landable slot lands; a refusal before a later slot's push (a
+failed `gh` or `git fetch` read, say) keeps it too, so no standalone land slips
+in while the train waits on a rerun. Before any slot merged, a refusal before
+the push releases it. After a push, a failure keeps the lock in its phase and a
+rerun of the same slot takes it back. A stop that freezes the queue
+leaves the lock in phase `freeze`, which `--break-lock` never breaks: only the
+repair train the freeze admits takes it over, and it is released when that
+train clears the freeze. `--break-lock` prints the holder (`LOCK_HOLDER:`),
+keeps land's staleness, mid-push and drift rules, refuses a `between` lock
+younger than 10 minutes, and refuses a live train run's lock unless
+`--break-train-lock` is also given. `train watch --land` goes through `train
+land`, so it stops with `NEXT:` on `QUEUE_LAND_LOCKED` like any refusal. A train
+`train land` refuses (one built without stamped prefixes or a gate) still merges
+through `verify --train` and `gh pr merge`, which neither take nor check this
+lock.
+
 Slots merge with `train land --train <nonce> --pr <n>`, never a slot call:
 
 1. The record must be the gated head's own chain. Walking first parents from
@@ -849,8 +873,8 @@ git fetch origin main
 git merge --no-ff --no-commit origin/main        # expect a CHANGELOG.md conflict only
 bun --no-env-file --config=/dev/null -e "import { mergeChangelogsWithNotes } from './lib/changelog-check'; import { spawnSync } from 'node:child_process'; import { writeFileSync } from 'node:fs'; const s = (n) => spawnSync('git', ['show', ':' + n + ':CHANGELOG.md'], { encoding: 'utf8', maxBuffer: 1 << 26, timeout: 30000 }).stdout; const m = mergeChangelogsWithNotes(s(2), s(3), s(1)); for (const n of m.notes) console.error('CHANGELOG: carried as a Gate integrity correction: ' + n); if (!m.text) { console.error('CHANGELOG needs a hand merge'); process.exit(1); } writeFileSync('CHANGELOG.md', m.text);"
 git add CHANGELOG.md && git commit --no-edit
-gstack-restamp --next --base main --pr 42 --expect-base <main sha> --expect-order <order> --allow-repo-commands
-git add CHANGELOG.md VERSION package.json <release outputs> && git commit -m "v<X> stamp" && git push
+gstack-restamp --next --base main --pr 42 --expect-base <main sha> --expect-order <order> --allow-repo-commands   # stages what it writes (STAGED:)
+git commit -m "v<X> stamp" && git push
 ```
 
 A conflict in any file other than CHANGELOG.md means the merge isn't the train's prefix. Stop and report it. When the helper says the CHANGELOG needs a hand merge, take main's CHANGELOG unchanged and put your own entry above it. `verify` accepts the resulting head because it contains main and its tree equals T<i> modulo stamps, with its CHANGELOG judged as main's plus lines your pin added, however the conflict was resolved; the `head:` line says "T<i> with main merged in".
@@ -863,8 +887,12 @@ introduced). A line the base added since the pin's fork point is the base's,
 whether the base merge is committed or still staged (`stage stamp_paths` says
 "N line(s) the base added since the fork point are the base's"; train 24,
 2026-10-27, moved main's `DOCS_CAPS_KEY_VERSION` in both slots before this
-rule). A file the restamp lists that the slot call did not name is not a stamp:
-leave it out and report it. The tree receipt refuses such a move after the fact
+rule). Restamp stages what it writes and prints `STAGED:`; commit what restamp
+staged. A file the slot call does not name is not a stamp: `git restore --staged
+--worktree` it and report it. A stamp file holding unstaged edits of your own refuses before
+anything is written (`RESTAMP_UNSTAGED_EDITS`), and a staging failure leaves the
+files written for the noop rerun to stage (`RESTAMP_NOT_STAGED`), so a bare
+commit after a `--no-commit` base merge can no longer drop the stamp (#3527). The tree receipt refuses such a move after the fact
 only while the moved version is older than the base's at the build, so the
 restamp, not the receipt, is what keeps the base's key in place.
 
@@ -935,7 +963,18 @@ saw, itself the prefix before modulo stamps) plus the PR's own entry under the
 same rule. One CHANGELOG rule applies before and after, so a head the pre-merge
 verify accepted confirms after its squash merge with the same CHANGELOG, and a
 stacked child whose one `[Unreleased]` became two released sections is not a
-mismatch (train 24, 2026-10-27, froze on exactly that). Anything else is
+mismatch (train 24, 2026-10-27, froze on exactly that). Before
+`MERGE_CONDITION`, the head must also carry its own stamp: its `VERSION` above
+main's, and its CHANGELOG headed with that version directly above main's top
+release, with no `[Unreleased]` section main does not have; otherwise
+`QUEUE_TRAIN_UNSTAMPED` names the rule and both versions (train 33 merged #3527
+under #3526's version without it). verify prints `STAMP_VERSION:` from the head
+itself. A post-merge confirmation needs GitHub to report the PR MERGED: an open
+PR whose stamp-only diff already matches main (a release-only PR, #3530) takes
+the pre-merge path, and any other open or unreadable PR refuses
+`QUEUE_PROOF_MISSING` without freezing, as does a verify that could not read
+the PR's current head (`--no-fetch` or a failed fetch) instead of judging the
+unstamped pin. Anything else is
 `QUEUE_TRAIN_TREE_MISMATCH` (or `QUEUE_TRAIN_MOVED`). When nothing of the train
 has merged, that is a plain refusal, and a new train is built on current main. When
 earlier slots already merged, main holds a prefix no gate covered on its own,
@@ -1627,9 +1666,12 @@ command:
 2. **Lock.** Take the repository land lock, `refs/notes/gstack-land` (its own
    ref, never the trains notes ref), by exact lease. It records the PR, holder,
    phase and journal. A held lock is `QUEUE_LAND_LOCKED` naming the holder;
-   `--break-lock` takes over a crashed holder's lock and is refused while that
-   holder entered a push or a merge less than 10 minutes ago, and for a drift
-   lock. A refusal before the push releases the lock.
+   `--break-lock` prints the holder (`LOCK_HOLDER:`), takes over a crashed
+   holder's lock and is refused while that holder entered a push or a merge
+   less than 10 minutes ago, and for a drift lock. `train land` shares this
+   lock ([one land lock](#train-land)); a train slot's lock needs
+   `--break-train-lock` as well while its train still lands, and a `freeze`
+   lock is never broken. A refusal before the push releases the lock.
 3. **Merge and stamp.** In a scratch worktree, merge the base into the pin.
    Conflicts in release fields only (the version file and `release_outputs`
    take the base's side, the CHANGELOG merges by section, a manifest or npm
diff --git a/docs/skills.md b/docs/skills.md
index dde699409..c121fc89d 100644
--- a/docs/skills.md
+++ b/docs/skills.md
@@ -962,8 +962,12 @@ blank (`PREREG_INCOMPLETE`). `arms` resolves the `eval-arms` model role against
 `lib/pricing.ts` and stops on an unpriced model (`EVAL_PRICE_MISSING`); `dry-run`
 runs every row through the stub model for $0 and flags malformed rows
 (`EVAL_DRY_RUN_FAILED`); `pilot start|settle|release|report` runs three priced
-items, records actual spend, extrapolates to the full set against the cap
-(`EVAL_BUDGET_EXHAUSTED`) and prints the spend table the approval question shows.
+items, records actual spend, extrapolates each priced arm to the full set against
+the cap (`EVAL_BUDGET_EXHAUSTED`) and prints the spend table the approval question
+shows. An arm on a subscription with no extra charge is declared with
+`pilot start --seat-metered <arm,...>`: it reserves $0, settles as `unknown`, and
+stays out of the projection until one of its attempts settles a real charge.
+A run stops at the first quota or rate-limit error on such an arm.
 `results --check <prereg> <results.md>` refuses a finished results file unless one
 table holds a filled row for every arm, each `<model>#no-gstack` row beside its
 variants (`EVAL_REPORT_NO_GSTACK_ROW`); no number leaves the run before it passes.
@@ -1002,8 +1006,8 @@ VM. `/ubicloud` runs it there through one entry point, `bin/gstack-ubi`
 (`scripts/ubicloud/ubi-runner.sh`), with the discipline a shared quota needs:
 every VM is named `ubirun-<owner>-<epoch>-<suffix>-t<hours>`, so its owner
 (`UBI_OWNER`, required to create one) and TTL (`UBI_TTL_HOURS`, default 3) are
-visible to everyone; every `up` first reaps VMs whose TTL ended, whichever owner
-made them, and its own owner's VMs with no TTL once they are 4 hours old; every run
+visible to everyone; every `up` first reaps its own owner's VMs whose TTL ended,
+and those with no TTL once they are 4 hours old, never another owner's; every run
 ends with `UBICLOUD: left=0` or fails; the
 quota preflight refuses before the create request when the project's running
 VMs plus the new size exceed the known ceiling (`UBI_QUOTA_VCPUS`, or the
@@ -1026,7 +1030,7 @@ Claude: UBICLOUD_API_KEY: set; UBI_OWNER=lane7
         gstack-ubi verify  (.gstack/ubicloud.json: bootstrap.sh, "bash scripts/verify.sh", standard-16)
         ubi-runner: reap: no expired VMs
         ubi-runner: creating eu-central-h1/ubirun-lane7-1761500000-9f3a2c10-t3 (standard-16)
-        ubi-runner: ubirun-lane7-1761500000-9f3a2c10-t3 carries a 3h TTL (any later run of this script reaps it); if this process dies first: gstack-ubi down ubirun-lane7-1761500000-9f3a2c10-t3
+        ubi-runner: ubirun-lane7-1761500000-9f3a2c10-t3 carries a 3h TTL (this owner's next up or reap destroys it once it expires); if this process dies first: gstack-ubi down ubirun-lane7-1761500000-9f3a2c10-t3
         ubi-runner: heartbeat: command 300s elapsed, last output 2s ago
         ubi-runner: command exited 0 after 1140s
         ubi-runner: destroyed eu-central-h1/ubirun-lane7-1761500000-9f3a2c10-t3
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index b63323749..159dda2f4 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -314,6 +314,20 @@ network.
 
 **Expected result.** `OUTSIDE_STATUS: completed`.
 
+<a id="outside-review-truncated"></a>
+### `... outside review unavailable: the reviewer hit its output token limit and the response is cut off (...)`
+
+**Meaning.** The api runner's provider stopped at the output token limit
+(Anthropic `stop_reason: max_tokens`, OpenAI `finish_reason: length`), so the
+review ends mid-sentence and its findings may be missing.
+
+**Fix.** Re-run with a larger `--max-tokens` (`gstack-outside-voice run` or
+`gstack-autoplan run`), or shorten the prompt. `gstack-autoplan run` sends a
+default of 16384 to both providers, and OpenAI counts reasoning tokens toward
+it; `gstack-outside-voice run` sends that default to Anthropic only.
+
+**Expected result.** `OUTSIDE_STATUS: completed`.
+
 <a id="outside-review-missing-markers"></a>
 ### `... outside review unavailable: the response lacks the markers this gate requires (...)`
 
@@ -4590,7 +4604,10 @@ train still building, running or merging, `train watch` on an unknown record,
 unreadable run), `verify --pr <n> --train <nonce>` when main's tree mismatches
 and whether a slot merged on GitHub cannot be read (so whether the queue must
 freeze is unknown; it never answers "nothing merged" from an unreadable
-state), `train land` when the base or the train branch cannot be fetched or
+state), `verify --pr <n> --train <nonce>` when GitHub does not report the PR
+MERGED and it is not a release-only PR whose stamp-only diff already matches
+main, or when it could not read the PR's current head (`--no-fetch` or a failed
+fetch), without freezing the queue, `train land` when the base or the train branch cannot be fetched or
 the record's T0 and S_1..S_k are not the gated head's first-parent chain
 (each S_i's second parent slot i's pin), `train land` when main's tree is the
 slot's S_i but GitHub does not report the PR as MERGED (a record whose slot
@@ -4696,14 +4713,60 @@ the name already landed. Then rerun.
 <a id="queue-land-locked"></a>
 ### `QUEUE_LAND_LOCKED`
 
-**Meaning.** Another `gstack-ship-queue land` holds the repository land lock
-(`refs/notes/gstack-land`), or took it from under this run, so this one would
-race it for the next version. The line names the holder, its PR and phase.
+**Meaning.** Another `gstack-ship-queue land`, or a `train land` slot, holds the
+repository land lock (`refs/notes/gstack-land`), or took it from under this run,
+so this one would race it onto main. The line names the holder: `#<pr>` for a
+land, `train <nonce> slot <i> (#<pr>)` for a train, with its holder and phase. A
+train keeps the lock in phase `between` from one merged slot to the next, so no
+standalone land slips in between slots.
 
 **Fix.** Wait for the holder to finish. If it crashed, rerun with
-`--break-lock`; that is refused while the holder entered a push or a merge
-less than 10 minutes ago. A lock in phase `drift` is released by landing its
-repair PR ([QUEUE_LAND_DRIFT](#queue-land-drift)).
+`--break-lock`, which prints the holder (`LOCK_HOLDER:`). That is refused while
+the holder entered a push or a merge less than 10 minutes ago, while a train is
+between slots for less than 10 minutes, and for a live train run unless you also
+pass `--break-train-lock`. A lock in phase `drift` is released by landing its
+repair PR ([QUEUE_LAND_DRIFT](#queue-land-drift)); a lock in phase `freeze` is
+released by the verify that clears the freeze
+([QUEUE_TRAIN_FROZEN](#queue-train-frozen)). If that release push failed, the
+next `land` or `train land` takes the lock over once the freeze record it fetches
+shows the freeze cleared after the lock was written; `--break-lock` never does.
+
+<a id="queue-train-unstamped"></a>
+### `QUEUE_TRAIN_UNSTAMPED`
+
+**Meaning.** `verify --pr <n> --train <nonce>` found the slot head it would let
+merge without its own stamp: the head's `VERSION` is not above main's, or its
+CHANGELOG's top section is not headed with that version directly above main's
+top release (or keeps an `[Unreleased]` section main does not have). The line
+names the rule, the head's version and main's. Train 33 merged #3527 this way
+(a no-commit base merge, a restamp whose files were never staged, a bare
+commit) and shipped it under #3526's version. Nothing was merged.
+
+**Fix.** On the lane, run `gstack-restamp --next` on the head, commit what
+restamp staged, push, and rerun the verify.
+
+<a id="restamp-not-staged"></a>
+### `RESTAMP_NOT_STAGED`
+
+**Meaning.** `gstack-restamp` wrote the stamp but `git add` failed, so a bare
+`git commit` would leave the stamp out. The files stay written, and
+`.gstack/tmp/restamp-staging.json` records what is still to stage.
+
+**Fix.** Clear what blocked `git add` (a stale `.git/index.lock`, for
+example) and rerun `gstack-restamp`; the rerun is a noop that stages the files
+it wrote. When any of them changed since restamp wrote it (you committed by
+hand, switched branches or merged the base), the marker is stale: the noop
+rerun drops it and stages nothing, and a stamp still owed is restamped as usual.
+
+<a id="restamp-unstaged-edits"></a>
+### `RESTAMP_UNSTAGED_EDITS`
+
+**Meaning.** A file `gstack-restamp` would stamp holds unstaged edits of yours.
+Restamp stages what it writes, so those edits would ride along in the stamp
+commit. Nothing was written.
+
+**Fix.** Stage (`git add`) or stash your own edits to the named files, then
+rerun `gstack-restamp`.
 
 <a id="queue-land-conflict"></a>
 ### `QUEUE_LAND_CONFLICT`
diff --git a/docs/unattended.md b/docs/unattended.md
index 398b9fd59..e1a5a865b 100644
--- a/docs/unattended.md
+++ b/docs/unattended.md
@@ -65,10 +65,12 @@ A run that writes a record ends with one line the parent greps:
 GSTACK_RESULT: skill=<name> status=<status> run=<dir>
 ```
 
-`status` is one of `complete`, `gate_pending`, `incomplete`, `interrupted` or
-`refused`; `run` is where the run's record is. `/autoplan`
+`status` is one of `complete`, `reviewed`, `gate_pending`, `incomplete`,
+`interrupted` or `refused`; `run` is where the run's record is. `/autoplan`
 always ends `gate_pending` when it reaches the final gate, because the gate is
-written and never approved. Pure queries (`gstack-artifact schema`,
+written and never approved. `/autoplan --ceo-only` ends `reviewed`: it runs the
+CEO phase alone, asks nothing, writes no gate and approves nothing (see
+[CEO-only runs](#ceo-only-runs)). Pure queries (`gstack-artifact schema`,
 `gstack-gate render`) print no result line.
 
 Not every workflow writes this line or a run directory today:
@@ -374,7 +376,14 @@ the plan.
    refuses to open without one (`CONSENSUS_MISSING`).
 3. **Loop `next` until `status=gate_pending`.** Eng always runs last. The gate
    (`gate.json`, `gate_rev`) lists user challenges as approval items,
-   disagreements as auto items and `p1` plan approval; nothing is approved.
+   disagreements as auto items, each open Critical or High finding as an
+   auto item (a twin pair is one item; `a` applies the reviewer's fix to the
+   plan and is recommended, `b` carries it into the build as a blocking task)
+   and `p1` plan approval; nothing is approved. An unanswered auto item whose
+   recommendation changes the plan keeps the plan's direction, so only `rec`,
+   `p1b` (approve with the recommended changes) or an explicit `<id>a` applies
+   a fix; a finding carried with `b` stays
+   open, so a rerun that raises it again asks again.
 4. **Answer the gate** with the reply grammar and the revision you read:
    ```bash
    $AP answer --out <dir> --gate-rev 1 --reply "rec" --by human            # every recommendation, plan changes included (APPLY: ...; amend_pending)
@@ -385,12 +394,18 @@ the plan.
    means an agent relayed them, and then `--owner-reply` (or `-` for stdin,
    `--owner-reply-file <path>`) stores the owner's words verbatim
    (`OWNER_REPLY_REQUIRED`); owner words that parse to different choices are
-   refused (`GATE_OWNER_REPLY_MISMATCH`). An unattended run refuses an answer
+   refused (`GATE_OWNER_REPLY_MISMATCH`). The words default to the owner's: an
+   agent that answers in its own words (a Captain deciding on its own
+   authority) must pass `--words-by agent:<id>` with its own `--by` id. They
+   are then recorded as `answer_words` with `words_by`, never as
+   `owner_reply`; a later gate never carries them (`CARRY: no`), and
+   `gstack-approvals import` lists that row under the agent, not the owner.
+   An unattended run refuses an answer
    without `--by` (`ANSWER_BY_REQUIRED`, exit 3) and records the value as
    `answered_by` on every decision row and in the review record's gate line,
    so a gate an agent closed is distinguishable from one the owner closed.
    `gstack-autoplan recommend` changes one recommendation before relay; it
-   bumps the gate's `rec_rev`, and a later `rec` needs the `--rec-hash` from
+   bumps the gate's `rec_rev`, and a later `rec` or `p1b` needs the `--rec-hash` from
    the render the owner saw (`GATE_REC_STALE`). Every `GATE:` line is followed
    by `GATE_SPEND:` and `GATE_REC_COST:` (also `gate_cost` in `--json`; see
    `autoplan/DRIVER.md`).
@@ -440,7 +455,19 @@ Concurrency and recovery: every state write is a locked read-modify-write
 (`test/autoplan-run-recovery.test.ts`, `test/autoplan-run-concurrency.test.ts`,
 `test/autoplan-answer-invalidation.test.ts`). `--spend-cap` admits each attempt
 through `spend.json` (`SPEND_CAP_EXCEEDED` refuses, exit 3); host-subagent
-spend is `unknown` and counted in `worst_case`. `--deadline <min>` makes the
+spend is `unknown` and counted in `worst_case`. Under a cap, in any session
+kind (or unattended on Capy), each host-subagent attempt, and each api attempt
+whose model has no price, reserves the default per voice unless
+`next --estimate-usd <n>` sets the reservation, which the run keeps for later
+phases (`run` reserves an api attempt's priced worst case, prompt bytes / 3
+input tokens plus the output limit, and settles it at its token usage; every
+native call that went out and bound no result, whether it failed, was cancelled,
+had its result refused, or was in flight when the process died (the next `run`
+finds it), settles at its usage, or at its full reservation when the usage is
+unknown, while one refused before anything was sent, such as with no API key,
+keeps its attempt open for the rerun, and a failed outside call leaves the phase
+native-only and stays counted at its reservation); `submit
+--usage-usd <n>` settles an attempt at its real cost. `--deadline <min>` makes the
 `run` subcommand cancel the children it started and marks the run
 `interrupted`.
 
@@ -520,9 +547,8 @@ A gate revision after the first (`gate_rev` 2 and later, written after a
 it when nothing new needs their decision. `gstack-autoplan` prints
 `CARRIED: gate_rev=<n> <- gate_rev=<m> words="<their words>" by=<relayer> reason=<why>`,
 then the usual `APPROVED:` lines, and journals `gate_carried`. The carry needs
-all of: the earlier gate approved (`p1a` or `p1b`) with `rec` or "do it"
-(not item tokens), no item there left pending, and the owner's words
-recorded; that gate was not itself carried; every accepted change incorporated
+all of: the earlier gate approved (`p1a` or `p1b`), no item there left
+pending, and the owner's words recorded; that gate was not itself carried; every accepted change incorporated
 or settled; the plan file's bytes equal those recorded at the gate or at the
 `revise` that took the changes (any later edit refuses, an ELI5-only one
 included); no urgent or
@@ -531,6 +557,13 @@ Anything else prints `CARRY: no (<why>)` (journal `carry_refused`) and the gate
 goes to the owner as before. `--no-carry-forward` on the first `next` turns it
 off for the run.
 
+An earlier answer given item by item (`<id><option>` tokens, not `rec` or "do
+it") carries only what the owner already answered: every item on the new gate
+must be carried by origin (the same proposal, so the same choice), and only an
+unreviewed post-cap delta (below) may be new. The carry replays the owner's own
+`p1` choice and records their tokens verbatim as its basis; any new or changed
+item, "do it" cases included, goes to the owner.
+
 - **"do it".** When the owner's words were "do it" (their words, not a
   `captain:` relay of them), a new `auto` item that changes no scope, cost or
   direction, whose recommended option changes no plan text, and is no round
@@ -560,6 +593,40 @@ and `gstack-owner-brief render --captain` opens with "Nothing pending.
 Carried forward from gate_rev <m>", followed by any items taken under "do it"
 without being shown to the owner.
 
+## CEO-only runs
+
+`/autoplan --ceo-only` runs the CEO review by itself and asks nothing. It runs
+in the session that invokes the skill; `gstack-autoplan`, the driver a parent
+agent uses, has no CEO-only mode yet, and `run.json` does not accept the
+`reviewed` status. It needs Claude Code: other hosts inline autoplan's sections
+and do not carry this one yet. It is for a harness or a crew that wants the strategy pass
+without the full gauntlet, such as an eval comparing gstack's CEO review with a
+plain prompt.
+
+- **What runs:** Phase 0, the outside-reviewer preflight and the CEO phase.
+  Design, DX, Eng and the final gate do not run.
+- **How it decides:** every question takes its recommendation and is logged in
+  the Decision Audit Trail. The review mode comes from plan-ceo-review's 0E
+  rule (file count, then greenfield, added capability or fix), not autoplan's
+  fixed SELECTIVE EXPANSION, and the mode line says `CEO-only run`. Consent,
+  destructive and irreversible options take the conservative choice.
+- **What it never does:** apply a user challenge (the plan's direction stays;
+  each challenge is listed), chain to another skill, promote the CEO plan, or
+  approve anything.
+- **One model:** add `--no-outside` to skip the outside voice, so every
+  reviewer runs on the host model.
+- **Where it writes:** the run directory (`.gstack/tmp/autoplan/` in the
+  repository), the reviewed plan, and CEO plans and task files under
+  `GSTACK_STATE_ROOT`. Point that variable inside a trial folder to keep every
+  write there.
+- **What it leaves:** the reviewed plan (its original is kept at the restore
+  point), `<run dir>/ceo-review.md` (user challenges, scope added,
+  conservative choices, findings and the audit trail), and the last line
+  `GSTACK_RESULT: skill=autoplan status=reviewed run=<dir>`.
+
+`test/skill-e2e-autoplan-ceo-only.test.ts` runs it on a plan that makes the
+interactive CEO review ask a question and fails if this mode asks anything.
+
 ## Owner brief
 
 `gstack-owner-brief render --out <dir>` is what the owner sees at the final
diff --git a/eval-plan/SKILL.md b/eval-plan/SKILL.md
index 66d7d8920..494f42885 100644
--- a/eval-plan/SKILL.md
+++ b/eval-plan/SKILL.md
@@ -138,7 +138,7 @@ Write (or open) the preregistration file. Each section is required and must be f
 | Arms | one line per arm: the arm identity first (`<model>` or `<model>#<loadout>`), settings, per-item cost from Step 1b |
 | Comparison | `stack: loaded` when any arm loads gstack or another skill stack; otherwise `stack: none` and a `why:` line |
 | Decoys | inputs the scorer must reject or score low; how many, how they were made, what a decoy pass proves |
-| Stop rules | the spend cap, a bar missed on the pilot, a scorer below its bar, `budget_exhausted` |
+| Stop rules | the spend cap, a bar missed on the pilot, a scorer below its bar, `budget_exhausted`, the first quota or rate-limit error on a seat-metered arm |
 | Held-out exposure | every held-out set the plan touches: prior exposure (which runs, which models), the reservation on it |
 | No-gstack arm | required with `stack: loaded`: `arms:`, `inputs:`, `prompt:`, `panel:`, `report:` (below) |
 
@@ -254,7 +254,14 @@ anything else (`EVAL_DRY_RUN_FAILED`).
 `--out`): admission is `spent + reserved + unknown + estimate <= cap`, under a file lock
 shared with any concurrent worker. Run each `PILOT_ATTEMPT:` through the project's own
 eval command, then settle it with the actual cost from the provider's usage field, or
-`unknown` when the call was seat-metered or CLI-metered:
+`unknown` when the call was seat-metered or CLI-metered.
+
+An arm on a subscription with no extra charge (say `claude -p` on a seat) is declared at
+start with `--seat-metered <arm,...>`, each also in `--arms`. Its attempts hold none of the
+cap, settle as `unknown` and get a `PILOT_SEAT_METERED:` line instead of a projection; an
+arm that settles a real charge is projected as priced. The first quota or rate-limit error
+on such an arm ends the run: no retry, no new attempt; release the unstarted ones. Settle
+each attempt, then report:
 
 ```bash
 ~/.claude/skills/gstack/bin/gstack-eval-plan pilot settle --out <outdir> --attempt <attempt-id> --usd <usd|unknown>
@@ -263,8 +270,9 @@ eval command, then settle it with the actual cost from the provider's usage fiel
 
 `pilot report` prints the spend table (`spent`, `reserved`, `unknown charges`, the worst case
 with one in-flight call per worker, the worst-case overrun against the cap) and
-`PILOT_PROJECTION:` — mean cost per item, its sample deviation, the projection to
-`--total` items across the arms, and a 95% band. Regenerate the table at every later gate
+one `PILOT_ARM:` line per money arm (its own mean, deviation, projection and band), then
+`PILOT_PROJECTION:` — the arms summed: cost per item, deviation, the projection to
+`--total` items, and a 95% band. Regenerate the table at every later gate
 of the run. Stop and report, without asking for approval, when the pilot missed a bar from
 the preregistration, when `status=budget_exhausted`, or when `verdict=exceeds`.
 
diff --git a/eval-plan/SKILL.md.tmpl b/eval-plan/SKILL.md.tmpl
index 8a2fc4d75..1029b4053 100644
--- a/eval-plan/SKILL.md.tmpl
+++ b/eval-plan/SKILL.md.tmpl
@@ -60,7 +60,7 @@ Write (or open) the preregistration file. Each section is required and must be f
 | Arms | one line per arm: the arm identity first (`<model>` or `<model>#<loadout>`), settings, per-item cost from Step 1b |
 | Comparison | `stack: loaded` when any arm loads gstack or another skill stack; otherwise `stack: none` and a `why:` line |
 | Decoys | inputs the scorer must reject or score low; how many, how they were made, what a decoy pass proves |
-| Stop rules | the spend cap, a bar missed on the pilot, a scorer below its bar, `budget_exhausted` |
+| Stop rules | the spend cap, a bar missed on the pilot, a scorer below its bar, `budget_exhausted`, the first quota or rate-limit error on a seat-metered arm |
 | Held-out exposure | every held-out set the plan touches: prior exposure (which runs, which models), the reservation on it |
 | No-gstack arm | required with `stack: loaded`: `arms:`, `inputs:`, `prompt:`, `panel:`, `report:` (below) |
 
@@ -176,7 +176,14 @@ anything else (`EVAL_DRY_RUN_FAILED`).
 `--out`): admission is `spent + reserved + unknown + estimate <= cap`, under a file lock
 shared with any concurrent worker. Run each `PILOT_ATTEMPT:` through the project's own
 eval command, then settle it with the actual cost from the provider's usage field, or
-`unknown` when the call was seat-metered or CLI-metered:
+`unknown` when the call was seat-metered or CLI-metered.
+
+An arm on a subscription with no extra charge (say `claude -p` on a seat) is declared at
+start with `--seat-metered <arm,...>`, each also in `--arms`. Its attempts hold none of the
+cap, settle as `unknown` and get a `PILOT_SEAT_METERED:` line instead of a projection; an
+arm that settles a real charge is projected as priced. The first quota or rate-limit error
+on such an arm ends the run: no retry, no new attempt; release the unstarted ones. Settle
+each attempt, then report:
 
 ```bash
 ~/.claude/skills/gstack/bin/gstack-eval-plan pilot settle --out <outdir> --attempt <attempt-id> --usd <usd|unknown>
@@ -185,8 +192,9 @@ eval command, then settle it with the actual cost from the provider's usage fiel
 
 `pilot report` prints the spend table (`spent`, `reserved`, `unknown charges`, the worst case
 with one in-flight call per worker, the worst-case overrun against the cap) and
-`PILOT_PROJECTION:` — mean cost per item, its sample deviation, the projection to
-`--total` items across the arms, and a 95% band. Regenerate the table at every later gate
+one `PILOT_ARM:` line per money arm (its own mean, deviation, projection and band), then
+`PILOT_PROJECTION:` — the arms summed: cost per item, deviation, the projection to
+`--total` items, and a 95% band. Regenerate the table at every later gate
 of the run. Stop and report, without asking for approval, when the pilot missed a bar from
 the preregistration, when `status=budget_exhausted`, or when `verdict=exceeds`.
 
diff --git a/hosts/claude/hooks/timeline-stop-hook.ts b/hosts/claude/hooks/timeline-stop-hook.ts
index a71255200..d5b2d42e4 100755
--- a/hosts/claude/hooks/timeline-stop-hook.ts
+++ b/hosts/claude/hooks/timeline-stop-hook.ts
@@ -59,6 +59,8 @@ import { readVersionedSlugCache } from '../../../lib/bin-context';
 import { logHookError as sharedLogHookError } from './hook-log';
 
 const DEADLINE_MS = 2000;
+/** A host may keep stdin open after its payload (#3628); never wait for EOF past this. */
+const STDIN_DEADLINE_MS = 500;
 const REPAIR_SLUG_TIMEOUT_MS = 30_000;
 const LOCK_TTL_MS = 60_000;
 const MISS_TTL_MS = 5 * 60_000;
@@ -161,9 +163,35 @@ function slugOverride(): string | undefined {
   return slug && slug !== '.' && slug !== '..' ? slug : undefined;
 }
 
-function readStopCwd(): string {
+/** The Stop payload: returns at EOF, at the first complete JSON object, or at the deadline. */
+function readStdinBounded(ms: number): Promise<string> {
+  return new Promise((resolve) => {
+    let buf = '';
+    const done = () => {
+      clearTimeout(timer);
+      process.stdin.removeAllListeners('data');
+      process.stdin.destroy();
+      resolve(buf);
+    };
+    const timer = setTimeout(done, ms);
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk: string) => {
+      buf += chunk;
+      try {
+        JSON.parse(buf);
+        done();
+      } catch {
+        // incomplete payload: keep reading until EOF or the deadline
+      }
+    });
+    process.stdin.on('end', done);
+    process.stdin.on('error', done);
+  });
+}
+
+async function readStopCwd(): Promise<string> {
   try {
-    const stdin = fs.readFileSync(0, 'utf8');
+    const stdin = await readStdinBounded(STDIN_DEADLINE_MS);
     if (stdin.trim()) {
       const payload = JSON.parse(stdin) as { cwd?: string };
       if (payload.cwd && fs.existsSync(payload.cwd)) return payload.cwd;
@@ -209,12 +237,12 @@ function backgroundRepair(cwd: string): void {
   });
 }
 
-function main(): void {
+async function main(): Promise<void> {
   if (process.argv[2] === '--repair' && process.argv[3]) {
     backgroundRepair(process.argv[3]);
     return;
   }
-  const cwd = readStopCwd();
+  const cwd = await readStopCwd();
   const slug = slugOverride() ?? readVersionedSlugCache(resolveStateRoot(), cwd);
   if (!slug) {
     spawnRepair(cwd);
@@ -318,9 +346,6 @@ function repairTimeline(slug: string, deadline: number): void {
   }
 }
 
-try {
-  main();
-} catch (err) {
-  logHookError(`unexpected: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
-}
-process.exit(0);
+main()
+  .catch((err) => logHookError(`unexpected: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`))
+  .finally(() => process.exit(0));
diff --git a/lib/approval-citations.ts b/lib/approval-citations.ts
index 831f40bda..0bea4b3c4 100644
--- a/lib/approval-citations.ts
+++ b/lib/approval-citations.ts
@@ -78,6 +78,7 @@ function planGate(dir: string, run: Record<string, any>): Resolution {
   const p1 = readJsonl(path.join(dir, 'decisions.jsonl')).find(d => d.label === 'P1' && d.gate_rev === rev);
   const approved = run.status === 'complete' && typeof gate.plan === 'string' && !['c', 'e'].includes(gate.plan) && p1 && p1.chosen === gate.plan && p1.status !== 'pending';
   if (!approved) return { state: 'rejected', why: `run ${run.run} holds this plan but its gate is not APPROVED (status ${run.status}, p1 ${p1?.chosen ?? 'unanswered'})` };
+  if (p1.words_by) return { state: 'rejected', why: `run ${run.run}: its gate was answered in ${p1.words_by}'s own words, not the owner's` };
   return { state: 'resolved', evidence: `plan ${run.run} gate_rev=${rev} p1=${gate.plan} answered_by=${gate.answered_by ?? p1.answered_by ?? 'unrecorded'}`, text: fs.readFileSync(planFile, 'utf8') };
 }
 
diff --git a/lib/approval-record.ts b/lib/approval-record.ts
index 3f3cd82bd..74418d987 100644
--- a/lib/approval-record.ts
+++ b/lib/approval-record.ts
@@ -235,7 +235,7 @@ export function renderRecord(read: ReadResult, loc: StoreLocation, o: { heading?
   return [...head, ...lines, '', `Source: gstack-approvals record for ${cell(loc.branch)} ${APPROVALS_FOOTER_END}`, ''].join('\n');
 }
 
-interface DecisionLike { id?: string; title?: string; status?: string; chosen?: string | null; recommended?: string | null; gate_rev?: number; answered_at?: string; answered_by?: string; reply?: string; owner_reply?: string; carried_from?: string; label?: string; chosen_text?: string;
+interface DecisionLike { id?: string; title?: string; status?: string; chosen?: string | null; recommended?: string | null; gate_rev?: number; answered_at?: string; answered_by?: string; reply?: string; owner_reply?: string; answer_words?: string; words_by?: string; carried_from?: string; label?: string; chosen_text?: string;
   carried_gate_from?: string; carried_gate_rev?: number; carried_answered_by?: string; carried_under?: string; carry_check?: string }
 
 const stripRef = (t: string) => t.replace(/\s*\[[^\]]*\]\s*$/, '').trim();
@@ -278,7 +278,8 @@ export function importAutoplan(runDir: string, branch: string, by?: string): App
     const answerer = first.answered_by ?? 'unknown';
     const carried = p1?.carried_gate_from ? p1 : undefined;
     const relayed = carried?.carried_answered_by && carried.carried_answered_by !== 'human' ? `, relayed by ${carried.carried_answered_by}` : '';
-    const who = carried ? `${by ?? 'the owner'} (words from gate_rev ${carried.carried_gate_rev}${relayed}), carried forward by gstack-autoplan`
+    const who = first.words_by ? `${first.words_by}, its own decision (not the owner's words)`
+      : carried ? `${by ?? 'the owner'} (words from gate_rev ${carried.carried_gate_rev}${relayed}), carried forward by gstack-autoplan`
       : answerer === 'human' ? (by ? `${by}, typed at the gate` : 'the owner, typed at the gate') : `${by ?? 'the owner'}, relayed by ${answerer}`;
     const unseen = items.filter(r => r.carried_under).map(r => stripRef(r.title ?? ''));
     const checked = [...new Set(items.map(r => r.carry_check).filter((c): c is string => !!c))];
@@ -286,7 +287,7 @@ export function importAutoplan(runDir: string, branch: string, by?: string): App
       unseen.length ? `taken under "do it", not seen by the owner: ${unseen.join('; ')}` : '', checked.length ? `post-cap delta checked by ${checked.join(', ')}` : ''].filter(Boolean).join('; ');
     const built = buildRow({
       ask: `Approve the plan "${planTitle}" (autoplan run ${runId}, ${carried ? `gate_rev ${rev} carried forward from gate_rev ${carried.carried_gate_rev}, ` : ''}${items.length + (p1 ? 1 : 0)} decisions)`.slice(0, CAPS.ask),
-      words: first.owner_reply ?? first.reply ?? '(no words recorded)',
+      words: first.owner_reply ?? first.answer_words ?? first.reply ?? '(no words recorded)',
       by: who.slice(0, CAPS.by),
       scope: scope.slice(0, CAPS.scope),
       pending: (stillPending.length ? `${stillPending.length} decision(s) unanswered: ${stillPending.map(r => stripRef(r.title ?? '')).join('; ')}` : outcome === 'pending' ? 'the plan approval itself' : 'none').slice(0, CAPS.pending),
diff --git a/lib/autoplan-budget.ts b/lib/autoplan-budget.ts
index acb10f2ec..06ec4db30 100644
--- a/lib/autoplan-budget.ts
+++ b/lib/autoplan-budget.ts
@@ -16,12 +16,12 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { ANSWERED_BY_RE, type GateItem } from './gate-list';
 import { settledIds } from './autoplan-confirm';
-import type { ConsensusRecord } from './autoplan-reconcile';
+import { sameProblem, type ConsensusRecord } from './autoplan-reconcile';
 import { FILES, RunError, journal, now, readJournal, voiceRows, type RunState, type RunStop } from './autoplan-state';
 import { readLedger, release, setCap, summarize } from './spend-ledger';
 
 export const DEFAULT_MAX_ROUNDS = 2;
-/** Reserved per voice for a host-subagent attempt with no `--estimate-usd` in an unattended Capy run. */
+/** Reserved per voice for a host-subagent attempt with no `--estimate-usd` in an unattended run with a spend cap or on Capy. */
 export const DEFAULT_HOST_ESTIMATE_USD = 5;
 
 /** Round r of a phase: 1 plus the times it was reopened. */
@@ -35,17 +35,20 @@ export const atCap = (state: RunState, phase: string): boolean => { const cap =
 /** The phase is about to open past its cap (a rerun-all reply reopened it). */
 export const overCap = (state: RunState, phase: string): boolean => { const cap = roundCap(state, phase); return cap !== null && roundOf(state, phase) > cap; };
 
-/** Open High or Critical findings of a closed phase: the deferred counts, else bound rows not settled or answered, an outside row paired with a native one counted once. */
+/** Open High or Critical findings of a closed phase: the deferred counts, else bound rows not settled or answered, an outside row naming the same problem (`sameProblem`) as a High or Critical native one counted once. */
 function openHigh(state: RunState, phase: string): number {
   const ps = state.phases[phase];
   if (ps?.deferred) return (ps.deferred.counts.High ?? 0) + (ps.deferred.counts.Critical ?? 0);
   const file = path.join(state.out, `${phase}-consensus.json`);
   let rows: ConsensusRecord['rows'] = [];
   try { rows = fs.existsSync(file) ? (JSON.parse(fs.readFileSync(file, 'utf8')) as ConsensusRecord).rows : []; } catch {}
-  const paired = new Set(rows.filter(r => r.native_id).map(r => r.outside_id));
+  const high = (s: string | undefined) => s === 'High' || s === 'Critical';
+  const native = voiceRows(state, phase, 'native');
+  const nativeHigh = new Set(native.filter(r => high(r.severity)).map(r => r.id));
+  const paired = new Set(rows.filter(r => r.native_id && sameProblem(r) && nativeHigh.has(r.native_id)).map(r => r.outside_id));
   const answered = settledIds(state);
-  return [...voiceRows(state, phase, 'native'), ...voiceRows(state, phase, 'outside')]
-    .filter(r => !paired.has(r.id) && !(r as { settled_by?: string }).settled_by && !answered.has(r.id) && (r.severity === 'High' || r.severity === 'Critical')).length;
+  return [...native, ...voiceRows(state, phase, 'outside')]
+    .filter(r => !paired.has(r.id) && !(r as { settled_by?: string }).settled_by && !answered.has(r.id) && high(r.severity)).length;
 }
 
 /** At the round cap with High or Critical findings still open, more rounds buy nothing: the owner decides. */
@@ -59,11 +62,16 @@ export function roundsLine(state: RunState): string {
   return `ROUNDS: ${state.phase_order.map(cell).join(' ')} max_rounds=${state.max_rounds ?? 'none'} host_spend=unknown`;
 }
 
-/** The estimate one new attempt reserves: the flag, else the Capy unattended default, else 0 (host spend unknown, not admitted). */
+/**
+ * The estimate one new attempt reserves: the flag, else the run's persisted `--estimate-usd`, else the default whenever
+ * the run has a spend cap (any session kind) or an unattended run is on Capy, else 0 (host spend unknown, not admitted).
+ * `run` prices its api attempts from the price table instead (NextOptions.price); an unpriced model falls back to this.
+ */
 export function attemptEstimate(state: RunState, flag: number | undefined, env: NodeJS.ProcessEnv): { usd: number; line?: string } {
-  if (flag !== undefined) return { usd: flag };
-  if (state.session_kind !== 'unattended' || env.GSTACK_CAPY !== '1') return { usd: 0 };
-  return { usd: DEFAULT_HOST_ESTIMATE_USD, line: `ESTIMATE: ${DEFAULT_HOST_ESTIMATE_USD.toFixed(2)} per voice reserved for each host-subagent attempt (Capy unattended default; --estimate-usd <n> sets it); actual host spend stays unknown` };
+  const set = flag ?? state.estimate_usd;
+  if (set !== undefined) return { usd: set };
+  if (state.spend_cap_usd === null && (state.session_kind !== 'unattended' || env.GSTACK_CAPY !== '1')) return { usd: 0 };
+  return { usd: DEFAULT_HOST_ESTIMATE_USD, line: `ESTIMATE: ${DEFAULT_HOST_ESTIMATE_USD.toFixed(2)} per voice reserved for each host-subagent attempt (default under a spend cap, or unattended on Capy; --estimate-usd <n> sets it for the rest of the run); actual host spend stays unknown` };
 }
 
 /** Stop the run: terminal `incomplete` with the structured budget_exhausted stop, journaled. Returns the STOP and RECOVER lines. */
diff --git a/lib/autoplan-carry.ts b/lib/autoplan-carry.ts
index 0e6ae18ef..b5f2ab5bd 100644
--- a/lib/autoplan-carry.ts
+++ b/lib/autoplan-carry.ts
@@ -7,11 +7,13 @@
  * carried answer is the owner's own earlier words, and every refusal says which condition failed.
  *
  * A carry needs all of: carry not turned off (`--no-carry-forward`); gate_rev N approved (p1 a or b)
- * with the owner's words recorded, and not itself a carry; every change accepted at N
+ * with the owner's words recorded, and not itself a carry; nothing left pending there; every change accepted at N
  * incorporated or settled; the plan file unchanged since the gate or the revise that took those
  * changes, and the reviewed plan equal to it; no open urgent finding; and every new item already
- * carried. Two kinds of new item do not block: items a "do it" covers (the owner's words are
- * "do it": an auto item that changes no scope, cost or direction and is no round grant), and a
+ * carried. An answer given item by item (tokens, not `rec`) carries only that: every item on
+ * N+1 already carried by origin, its p1 choice replayed and its tokens recorded verbatim as the
+ * basis; any other new or changed item goes to the owner (an unreviewed capped delta, below, is the one exception). After `rec` or "do it", two kinds of new
+ * item do not block: items a "do it" covers (the owner's words are "do it": an auto item that changes no scope, cost or direction and is no round grant), and a
  * capped-delta item recommending "accept", which first gets one reviewer on just the delta
  * (`CARRY_CHECK:`, answered with `gstack-autoplan check`); a High or Critical finding there
  * means no carry, and the gate goes to the owner as before.
@@ -92,7 +94,8 @@ function deltaSince(state: RunState, rev: number): { diff: string; sha: string }
   return { diff, sha: sha256(diff) };
 }
 
-interface Source { id: string; gate_rev: number; words: string; by?: string }
+/** `p1`: an item-token answer's own p1 choice, replayed as given. */
+interface Source { id: string; gate_rev: number; words: string; by?: string; p1?: string }
 type Plan = { source: Source; doIt: GateItem[]; deltas: GateItem[] } | { reason: string; from?: number };
 
 /** Every condition but the delta check; returns why not, or what the carry takes. */
@@ -105,7 +108,8 @@ function assess(state: RunState, prev: GateList, list: GateList): Plan {
   if (unanswered) return { reason: `gate_rev ${from} left ${unanswered.label ?? unanswered.id} unanswered`, from };
   if (p1.chosen !== 'a' && p1.chosen !== 'b') return { reason: `gate_rev ${from} answer was p1${p1.chosen}, not an approval`, from };
   if (p1.carried_gate_from) return { reason: `gate_rev ${from} was itself carried; the owner answers this one`, from };
-  if (parseReply(p1.reply ?? '', prev).mode !== 'rec') return { reason: `gate_rev ${from} was answered with item tokens, not rec or "do it"`, from };
+  const tokens = parseReply(p1.reply ?? '', prev).mode !== 'rec';
+  if (p1.words_by) return { reason: `gate_rev ${from} was answered in ${p1.words_by}'s own words, not the owner's`, from };
   const words = p1.owner_reply ?? (p1.answered_by === 'human' ? p1.reply : undefined);
   if (!words?.trim()) return { reason: `no owner words recorded at gate_rev ${from}`, from };
   const amendments = (state.amendments ?? []).filter(a => a.gate_rev === from);
@@ -125,10 +129,10 @@ function assess(state: RunState, prev: GateList, list: GateList): Plan {
     if (item.id === 'p1' || item.carried) continue;
     const option = item.options.find(o => o.key === item.recommended);
     if (item.cap?.kind === 'delta' && !option?.changes_plan && item.recommended === 'a') { deltas.push(item); continue; }
-    if (isDoIt(words) && item.kind === 'auto' && !item.cap && !option?.changes_plan && !['scope', 'cost', 'direction'].includes(item.changes ?? '')) { doIt.push(item); continue; }
+    if (!tokens && isDoIt(words) && item.kind === 'auto' && !item.cap && !option?.changes_plan && !['scope', 'cost', 'direction'].includes(item.changes ?? '')) { doIt.push(item); continue; }
     return { reason: `new item ${item.id}: ${item.title}`, from };
   }
-  return { source: { id: p1.id, gate_rev: from, words, by: p1.answered_by }, doIt, deltas };
+  return { source: { id: p1.id, gate_rev: from, words, by: p1.answered_by, ...(tokens ? { p1: p1.chosen } : {}) }, doIt, deltas };
 }
 
 /** Called by finishGate once gate_rev N+1 is written (status gate_pending): carry, set up the delta check, or say why not. */
@@ -178,7 +182,7 @@ function dispatchCheck(state: RunState, prev: GateList, list: GateList, plan: Ex
 function carry(state: RunState, list: GateList, source: Source, doIt: GateItem[], deltas: GateItem[], check?: CarryCheck): CarryRecord {
   const rev = list.gate_rev;
   const p1 = list.items.find(i => i.id === 'p1')!;
-  const reply = list.items.map(i => `${i.id}${i.id === 'p1' ? p1.recommended : i.carried?.chosen ?? i.recommended}`).join(' ');
+  const reply = list.items.map(i => `${i.id}${i.id === 'p1' ? source.p1 ?? p1.recommended : i.carried?.chosen ?? i.recommended}`).join(' ');
   const reason = [doIt.length || deltas.length ? '' : 'no new choice', doIt.length ? `"do it" covers ${doIt.map(i => i.id).join(',')}` : '', deltas.length ? `delta check passed on ${deltas.map(i => i.id).join(',')}` : '',
     'plan unchanged since the accepted changes'].filter(Boolean).join('; ');
   const answered = answerGate(state, rev, reply, 'agent:gstack-autoplan', { carry: { from: source.id, gate_rev: source.gate_rev, words: source.words, by: source.by, reason } });
diff --git a/lib/autoplan-confirm.ts b/lib/autoplan-confirm.ts
index 75d9102d1..4589d1d81 100644
--- a/lib/autoplan-confirm.ts
+++ b/lib/autoplan-confirm.ts
@@ -13,7 +13,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import type { FindingRow } from './headless-artifacts';
 import { readJsonl } from './headless-artifacts';
-import { jaccard, tokens } from './autoplan-reconcile';
+import { titleScore } from './autoplan-reconcile';
 import { readDecisions, type PhaseState, type RunState } from './autoplan-state';
 
 export interface DiffLine { op: ' ' | '+' | '-'; text: string; a?: number; b?: number }
@@ -108,11 +108,18 @@ export function reviewRows(state: RunState, prev: PhaseState | undefined): Findi
 const earlierRows = (state: RunState, phase: string): FindingRow[] =>
   state.history.filter(h => h.event === 'reopened' && h.phase === phase).flatMap(h => reviewRows(state, h.previous as PhaseState | undefined));
 
-/** Earlier finding id -> the answered decision whose gate item named it. */
-export function settledIds(state: RunState): Map<string, string> {
+/** The origin tag of an open Critical/High finding's gate item: only `a` (its fix applied to the plan) settles it. */
+export const FINDING_ORIGIN = 'finding';
+
+/**
+ * Earlier finding id -> the answered decision whose gate item named it. A finding carried into the build stays open,
+ * and `findings: false` also leaves an applied one open, so a confirm round re-raising it is never suppressed.
+ */
+export function settledIds(state: RunState, o: { findings?: boolean } = {}): Map<string, string> {
   const out = new Map<string, string>();
   for (const d of readDecisions(state.out)) {
     if (d.chosen == null || d.status === 'pending' || !d.origin) continue;
+    if (d.origin.endsWith(`|${FINDING_ORIGIN}`) && (d.chosen !== 'a' || o.findings === false)) continue;
     for (const id of (d.origin.split('|')[1] ?? '').split('+')) if (id && id !== 'null') out.set(id, d.id);
   }
   return out;
@@ -125,13 +132,13 @@ export function settledIds(state: RunState): Map<string, string> {
 export function annotateConfirm(state: RunState, phase: string, rows: FindingRow[], ctx: { planName: string; planSource: string; snapshotPath: string }): { correlated: number; settled: number } {
   const earlier = earlierRows(state, phase);
   if (!earlier.length) return { correlated: 0, settled: 0 };
-  const settled = settledIds(state);
+  const settled = settledIds(state, { findings: false });
   const added = new Set((phaseDelta(state, phase, ctx.snapshotPath)?.ops ?? []).filter(o => o.op === '+' && o.text.trim()).map(o => o.text.trim()));
   const planLines = (read(ctx.planSource) ?? '').split('\n');
   const isPlan = (f: FindingRow) => f.file === ctx.planName;
   let correlated = 0, settledCount = 0;
   for (const row of rows as Array<FindingRow & { correlates?: string[]; settled_by?: string }>) {
-    const same = earlier.filter(e => jaccard(tokens(e.title), tokens(row.title)) >= 0.6 || (!!e.file && !isPlan(e) && e.file === row.file && e.line === row.line));
+    const same = earlier.filter(e => titleScore(e.title, row.title) >= 0.6 || (!!e.file && !isPlan(e) && e.file === row.file && e.line === row.line));
     if (!same.length) continue;
     row.correlates = same.map(e => e.id);
     correlated++;
diff --git a/lib/autoplan-gate.ts b/lib/autoplan-gate.ts
index 1488dbc05..0e03be117 100644
--- a/lib/autoplan-gate.ts
+++ b/lib/autoplan-gate.ts
@@ -3,7 +3,7 @@
  * (plan B2, B9, B11). `closePhase` reconciles the outside pass against the
  * native one from canonical ids (lib/autoplan-reconcile.ts), writes the
  * consensus record and the timing row, and marks the phase closed.
- * `finishGate` turns disagreements and user challenges into one gate list
+ * `finishGate` turns disagreements, user challenges and open Critical/High findings into one gate list
  * (lib/gate-list.ts: `d<n>` auto items, `uc<n>` approval items, `p1` the plan
  * approval), writes decisions.jsonl, tasks.jsonl and the exported files, and
  * leaves the run `gate_pending`: unattended never approves. `answerGate`
@@ -20,15 +20,15 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { exportRun } from './autoplan-export';
 import { driftLine, reviewHash } from './autoplan-plan-text';
-import { consensusRecord, reconcile, remedyKey, renderConsensus, SETTLEABLE_CHANGES, type ConsensusRecord, type ReconciliationOverride, type ReconciliationRow } from './autoplan-reconcile';
+import { consensusRecord, reconcile, remedyKey, renderConsensus, sameProblem, SETTLEABLE_CHANGES, type ConsensusRecord, type ReconciliationOverride, type ReconciliationRow } from './autoplan-reconcile';
 import type { Phase } from './autoplan-prompts';
 import { FILES, RunError, journal as journalRow, now, readDecisions, voiceRows, voiceTerminal, writeDecisions, type Amendment, type RunState, type VoiceState } from './autoplan-state';
 import { applyCapChoices, pendingDeltas, releaseUndispatched, roundCap, roundOf } from './autoplan-budget';
 import { evaluateCarry, gateEvidence, voidPendingCheck } from './autoplan-carry';
 import { buildEli5, capyRelayLine } from './captain-brief';
-import { previousReview, reviewRows, settledIds } from './autoplan-confirm';
+import { FINDING_ORIGIN, previousReview, reviewRows, settledIds } from './autoplan-confirm';
 import { phaseClose } from './autoplan-timing';
-import { ANSWERED_BY_RE, applyReply, decisionId, decisionRows, keepDirection, parseReply, pendingHint, recHash, validateGateList, type GateChoice, type GateItem, type GateList, type GateOption, type ParsedReply } from './gate-list';
+import { ANSWERED_BY_RE, applyReply, autoDefault, decisionId, decisionRows, keepDirection, parseReply, pendingHint, recHash, validateGateList, type GateChoice, type GateItem, type GateList, type GateOption, type ParsedReply } from './gate-list';
 import type { FindingRow } from './headless-artifacts';
 import { readJsonl, sha256File } from './headless-artifacts';
 import { closeDraftDirectionsFile, loadBriefInputs } from './owner-brief';
@@ -205,14 +205,15 @@ export function buildGate(state: RunState, gateRev: number): GateList {
     const byId = new Map([...native, ...outside].map(f => [f.id, f]));
     const reran = gateRev > 1 && state.history.some(h => h.event === 'reopened' && h.phase === phase);
     const origin = (ids: string, options: GateOption[]) => [phase, ids, ps.closed_at, ps.snapshot, optionHash(options)].join('|');
-    const push = (item: GateItem, ids: string) => items.push({ ...item, origin: origin(ids, item.options) });
+    const push = (item: GateItem, ids: string, tag?: string) => items.push({ ...item, origin: [origin(ids, item.options), ...(tag ? [tag] : [])].join('|') });
     const challenged = new Set<string>();
+    const twins = new Map(consensus.rows.filter(r => sameProblem(r) && (r.disposition === 'confirmed' || r.disposition === 'unverified')).map(r => [r.native_id!, r.outside_id]));
     for (const row of consensus.rows) {
       const o = byId.get(row.outside_id)! as FindingRow & { user_challenge?: boolean; changes?: string; settled_by?: string };
       if (o.settled_by) continue;
       const n = (row.native_id ? byId.get(row.native_id) : undefined) as (FindingRow & { user_challenge?: boolean; changes?: string }) | undefined;
       const ids = `${row.native_id}+${row.outside_id}`;
-      if (o.user_challenge && n?.user_challenge && row.disposition !== 'new') {
+      if (o.user_challenge && n?.user_challenge && row.disposition !== 'new' && row.basis !== 'file') {
         challenged.add(o.id); challenged.add(n.id);
         const title = `${n.title} [${row.native_id} + ${row.outside_id}]`;
         if (reran && !n.changes && !o.changes) { push(agentDecision(`d${++d}`, title, phase, 'both voices recommend changing your stated direction'), ids); continue; }
@@ -223,6 +224,7 @@ export function buildGate(state: RunState, gateRev: number): GateList {
         continue;
       }
       if (row.disposition === 'disagree') {
+        challenged.add(o.id); challenged.add(n!.id);
         push({ id: `d${++d}`, title: `${n!.title} [${row.native_id} vs ${row.outside_id}]`, kind: 'auto', recommended: 'a', phase,
           why: `voices disagree: ${row.resolution}`, cost: `b reopens ${phase}${phase === 'eng' ? '' : ' and eng'}`,
           options: [{ key: 'a', text: `native position (${row.severity.native})`, changes_plan: false }, { key: 'b', text: `outside position (${row.severity.outside})`, changes_plan: true }] }, ids);
@@ -235,6 +237,20 @@ export function buildGate(state: RunState, gateRev: number): GateList {
       push({ id: `d${++d}`, title: `${f.title} [${f.id}]`, kind: 'auto', recommended: 'a', phase, why, ...(f.changes ? { changes: f.changes } : {}),
         cost: `b reopens ${phase}${phase === 'eng' ? '' : ' and eng'}`, options: [KEEP('keep your direction'), { key: 'b', text: 'accept the change', changes_plan: true }] }, f.id);
     }
+    // An open Critical or High finding the items above do not cover: rec applies its fix to the plan.
+    const pairedOutside = new Set(twins.values());
+    for (const f of [...native, ...outside] as Array<FindingRow & { user_challenge?: boolean; settled_by?: string }>) {
+      if (f.voice === 'outside' && pairedOutside.has(f.id)) continue;
+      const group = [f, ...(twins.has(f.id) ? [byId.get(twins.get(f.id)!)!] : [])] as Array<FindingRow & { user_challenge?: boolean; settled_by?: string }>;
+      if (group.some(g => challenged.has(g.id) || g.user_challenge || g.settled_by)) continue;
+      const severity = group.some(g => g.severity === 'Critical') ? 'Critical' : group.some(g => g.severity === 'High') ? 'High' : null;
+      if (!severity) continue;
+      const ids = group.map(g => g.id);
+      const fixes = [...new Set(group.map(g => g.resolution).filter((r): r is string => !!r))];
+      push({ id: `d${++d}`, title: `${severity}: ${f.title} [${ids.join(' + ')}]`, kind: 'auto', recommended: 'a', phase, finding: ids,
+        why: `an open ${severity} finding (${group.map(g => g.voice).join(' + ')}); rec applies its fix to the plan`, cost: `a reopens ${phase}${phase === 'eng' ? '' : ' and eng'} once the plan is revised`,
+        options: [{ key: 'a', text: `apply the fix to the plan: ${fixes.length ? fixes.join('; ') : `resolve "${f.title}"`}`, changes_plan: true }, { key: 'b', text: 'carry it into the build as a blocking task (no plan change)', changes_plan: false }] }, ids.join('+'), FINDING_ORIGIN);
+    }
   }
   items.push(...capItems(state, { d: () => `d${++d}`, uc: () => `uc${++uc}` }));
   items.push(planApproval(state, items));
@@ -277,7 +293,7 @@ export function recommendGate(state: RunState, gateRev: number, itemId: string,
   writeDecisions(state.out, readDecisions(state.out).map(r => {
     const i = updated.get(r.id);
     if (!i) return r;
-    return { ...r, recommended: i.recommended, ...(i.kind === 'auto' ? { default_if_unanswered: i.recommended } : {}), ...(i.recommended_basis ? { recommended_basis: i.recommended_basis } : {}), ...(i.recommended_by ? { recommended_by: i.recommended_by } : {}) };
+    return { ...r, recommended: i.recommended, ...(i.kind === 'auto' ? { default_if_unanswered: autoDefault(i) } : {}), ...(i.recommended_basis ? { recommended_basis: i.recommended_basis } : {}), ...(i.recommended_by ? { recommended_by: i.recommended_by } : {}) };
   }));
   const hash = recHash(list);
   journalRow(state.out, { event: 'recommended', gate_rev: gateRev, item: itemId, option, basis, by, rec_rev: list.rec_rev, rec_hash: hash });
@@ -344,6 +360,8 @@ export interface AnswerOptions {
   recHash?: string;
   /** The owner's verbatim words; required for every `--by agent:<id>` answer. */
   ownerReply?: string;
+  /** `agent:<id>` when those words are the answering agent's own: recorded as `answer_words`/`words_by`, never as `owner_reply`, and never carried. */
+  wordsBy?: string;
   /** A whole-gate carry (lib/autoplan-carry.ts): the earlier p1 decision and the owner's words it reuses. Replaces ownerReply and its re-parse. */
   carry?: { from: string; gate_rev: number; words: string; by?: string; reason: string };
 }
@@ -396,22 +414,24 @@ export function answerGate(state: RunState, gateRev: number, reply: string, answ
   const currentHash = recHash(list);
   if (o.recHash !== undefined && o.recHash !== currentHash) throw new RunError('GATE_REC_STALE', `--rec-hash ${o.recHash} was rendered before the recommendations changed; current rec_hash=${currentHash}`, 3);
   if (parsed.mode === 'rec' && list.rec_rev === undefined && o.recHash === undefined) throw new RunError('GATE_REC_STALE', `this gate was written before \`rec\`/\`all\` took plan changes (gate.json has no rec_rev), so the owner saw a different meaning; render it again (gstack-gate render ${gateFile} --all), relay it, and answer with --rec-hash ${currentHash}, or reply with explicit <id><option> tokens`, 3);
-  if (parsed.mode === 'rec' && (list.rec_rev ?? 0) > 0 && o.recHash === undefined) throw new RunError('GATE_REC_STALE', `recommend changed this gate (rec_rev=${list.rec_rev}); pass --rec-hash from the render the owner saw (current rec_hash=${currentHash})`, 3);
+  const takesRecs = parsed.mode === 'rec' || parsed.choices.some(c => c.id === 'p1' && c.chosen === 'b' && !c.prior);
+  if (takesRecs && (list.rec_rev ?? 0) > 0 && o.recHash === undefined) throw new RunError('GATE_REC_STALE', `recommend changed this gate (rec_rev=${list.rec_rev}); \`rec\` and \`p1b\` take its recommendations, so pass --rec-hash from the render the owner saw (current rec_hash=${currentHash})`, 3);
   const ownerParsed = o.ownerReply !== undefined && !o.carry ? checkOwnerReply(list, gateRev, prior, parsed, o.ownerReply) : undefined;
   const provenance = o.carry ? { owner_reply: o.carry.words, carried_gate_from: o.carry.from, carried_gate_rev: o.carry.gate_rev, carry_reason: o.carry.reason, ...(o.carry.by ? { carried_answered_by: o.carry.by } : {}) }
+    : o.ownerReply !== undefined && o.wordsBy ? { answer_words: o.ownerReply, answer_words_parsed: ownerParsed, words_by: o.wordsBy }
     : o.ownerReply !== undefined ? { owner_reply: o.ownerReply, owner_reply_parsed: ownerParsed } : {};
   const itemOf = (id: string) => list.items.find(i => i.id === id)!;
   const optionOf = (c: GateChoice) => itemOf(c.id).options.find(o => o.key === c.chosen)!;
   const plan = parsed.choices.find(c => c.id === 'p1');
   const lines: string[] = o.carry ? [] : voidPendingCheck(state, `the owner answered gate_rev ${gateRev}`);
   const answeredAt = now();
-  const record = () => writeDecisions(state.out, applyReply(rows, parsed, answeredAt, answeredBy, provenance).map(r => {
+  const record = (answered = parsed) => writeDecisions(state.out, applyReply(rows, answered, answeredAt, answeredBy, provenance).map(r => {
     const c = r.gate_rev === list.gate_rev && r.chosen && !r.chosen_text ? itemOf((r.label ?? '').toLowerCase())?.options.find(o => o.key === r.chosen) : undefined;
     return c ? { ...r, chosen_text: c.text } : r;
   }));
   if (!plan || parsed.pending.length) {
-    // Approvals unanswered: record what was answered, keep the gate pending; nothing reviewed changes.
-    record();
+    // Approvals unanswered: record what was answered, but not an auto default that p1b would change (the final answer decides it).
+    record({ ...parsed, choices: parsed.choices.filter(c => c.how !== 'auto_default' || c.chosen === itemOf(c.id).recommended) });
     const pending = parsed.pending.length ? parsed.pending : ['p1'];
     state.gate = { ...(state.gate ?? {}), last_reply: reply, pending };
     lines.push(`GATE_PENDING: ${pending.join(', ')} unanswered (${pendingHint(list, pending)})`);
@@ -421,7 +441,7 @@ export function answerGate(state: RunState, gateRev: number, reply: string, answ
   const carried = (c: GateChoice) => itemOf(c.id).carried?.chosen === c.chosen;
   const changing = proceeds ? parsed.choices.filter(c => c.id !== 'p1' && !carried(c) && itemOf(c.id).reopens !== false && (optionOf(c).changes_plan ?? c.how === 'override')) : [];
   const tokens = (cs: GateChoice[]) => cs.map(c => `${c.id}${c.chosen}`);
-  const overrides = parsed.choices.filter(c => c.how === 'override' && c.id !== 'p1');
+  const overrides = parsed.choices.filter(c => c.id !== 'p1' && (c.how === 'override' || (c.how === 'auto_default' && c.chosen !== itemOf(c.id).recommended)));
   const reopenSet = new Set<Phase>(plan.chosen === 'd' ? state.phase_order : []);
   record();
   state.gate = { ...(state.gate ?? {}), answered_at: answeredAt, reply, gate_rev: gateRev, plan: plan.chosen, overrides: tokens(overrides), ...(answeredBy ? { answered_by: answeredBy } : {}), ...provenance };
diff --git a/lib/autoplan-reconcile.ts b/lib/autoplan-reconcile.ts
index 48b64ff19..cda0de854 100644
--- a/lib/autoplan-reconcile.ts
+++ b/lib/autoplan-reconcile.ts
@@ -196,20 +196,30 @@ export interface ReconciliationRow {
   outside_id: string; native_id: string | null; disposition: ReconciliationDisposition;
   /** Why this disposition: the matched location or title, or the parent's override reason. */
   resolution: string;
-  basis: 'file_line' | 'title' | 'override' | 'none';
+  basis: 'file_line' | 'file' | 'title' | 'override' | 'none';
   severity: { outside: Severity; native: Severity | null };
   /** A parent override's one shared proposal for both voices' user challenge; the gate renders it as option b. */
   proposal?: string;
 }
 export interface ReconciliationOverride { outside_id: string; native_id?: string | null; disposition: ReconciliationDisposition; resolution: string; proposal?: string }
 
-export const tokens = (title: string) => new Set(title.toLowerCase().replace(/[^a-z0-9 ]+/g, ' ').split(/\s+/).filter(t => t.length > 2));
+/** A DX cap code (`CAP4:<path>:<item>`) names a location, not the problem, so title comparison skips it. */
+export const tokens = (title: string) => new Set(title.replace(/^\s*CAP[46]\s*:[^:]*:\s*/i, '').toLowerCase().replace(/[^a-z0-9 ]+/g, ' ').split(/\s+/).filter(t => t.length > 2));
 export function jaccard(a: Set<string>, b: Set<string>): number {
   if (!a.size || !b.size) return 0;
   let inter = 0;
   for (const t of a) if (b.has(t)) inter++;
   return inter / (a.size + b.size - inter);
 }
+const capPath = (title: string) => /^\s*CAP[46]\s*:([^:]*):/i.exec(title)?.[1]!.trim();
+/** Title similarity. Two CAP-coded titles on different paths name different problems, so they never match. */
+export function titleScore(a: string, b: string): number {
+  const pa = capPath(a), pb = capPath(b);
+  if (pa !== undefined && pb !== undefined && pa !== pb) return 0;
+  return jaccard(tokens(a), tokens(b));
+}
+/** The voices name one problem: a title association or the parent's override. A shared location (file, or file:line with unrelated titles) associates two findings but never makes them one. */
+export const sameProblem = (r: ReconciliationRow) => !!r.native_id && (r.basis === 'title' || r.basis === 'override' || (r.basis === 'file_line' && !r.resolution.startsWith('same location')));
 const level = (s: Severity) => SEVERITIES.indexOf(s);
 /** A remedy compared as words: case, punctuation and spacing ignored. */
 export const remedyKey = (text: string | undefined) => (text ?? '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
@@ -225,7 +235,9 @@ function contradictory(a: string, b: string): boolean {
 
 /**
  * Structural reconciliation. Findings associate by a title overlap of at least
- * half the words, or by file:line (±3 lines). Association alone never
+ * half the words (a leading CAP code ignored; never across two different files),
+ * or by file:line (±3 lines), or, when either finding has no line, by the same
+ * file. Association alone never
  * confirms: a title association is `confirmed` only when both voices state the
  * same remedy, `disagree` when severities differ by two or more levels or the
  * remedies contradict (one keeps, drops or negates what the other changes),
@@ -250,6 +262,8 @@ export function reconcile(native: FindingRow[], outside: FindingRow[], overrides
   }
   const used = new Set<string>();
   const rows: ReconciliationRow[] = [];
+  const later: Array<[number, FindingRow]> = [];
+  const unmatched = (o: FindingRow): ReconciliationRow => ({ outside_id: o.id, native_id: null, disposition: 'new', resolution: 'not raised by the native voice', basis: 'none', severity: { outside: o.severity, native: null } });
   for (const o of outside) {
     const override = byOutside.get(o.id);
     if (override) {
@@ -260,17 +274,17 @@ export function reconcile(native: FindingRow[], outside: FindingRow[], overrides
       continue;
     }
     const near = (n: FindingRow) => !!o.file && o.line !== undefined && n.file === o.file && n.line !== undefined && Math.abs(n.line - o.line) <= 3;
-    const ot = tokens(o.title);
     let match: FindingRow | undefined;
     let best = 0;
     for (const n of native) {
-      if (used.has(n.id)) continue;
-      const score = jaccard(ot, tokens(n.title)) + (near(n) ? 0.01 : 0);
+      if (used.has(n.id) || (o.file && n.file && o.file !== n.file)) continue;
+      const score = titleScore(o.title, n.title) + (near(n) ? 0.01 : 0);
       if (score >= 0.5 && score > best) { best = score; match = n; }
     }
     const titled = !!match;
     match ??= native.find(n => !used.has(n.id) && near(n));
-    if (!match) { rows.push({ outside_id: o.id, native_id: null, disposition: 'new', resolution: 'not raised by the native voice', basis: 'none', severity: { outside: o.severity, native: null } }); continue; }
+    if (!match && o.file) { later.push([rows.length, o]); rows.push(unmatched(o)); continue; }
+    if (!match) { rows.push(unmatched(o)); continue; }
     used.add(match.id);
     const basis: ReconciliationRow['basis'] = near(match) ? 'file_line' : 'title';
     const where = near(match) ? `${o.file}:${o.line}` : 'same title';
@@ -286,6 +300,14 @@ export function reconcile(native: FindingRow[], outside: FindingRow[], overrides
     if (remedyKey(match.resolution) !== remedyKey(o.resolution)) { pair('unverified', `same title, remedies differ (${where}): ${match.title}`); continue; }
     pair('confirmed', `both voices, same remedy (${where}): ${match.title}`);
   }
+  // Plan reviews name a file without a line: same file, a line missing on either side, once every title and line match is placed.
+  for (const [i, o] of later) {
+    const match = native.filter(n => !used.has(n.id) && n.file === o.file && (o.line === undefined || n.line === undefined))
+      .reduce<FindingRow | undefined>((b, n) => (!b || titleScore(o.title, n.title) > titleScore(o.title, b.title) ? n : b), undefined);
+    if (!match) continue;
+    used.add(match.id);
+    rows[i] = { outside_id: o.id, native_id: match.id, disposition: 'unverified', resolution: `same file, agreement unverified (${o.file}): ${match.title}`, basis: 'file', severity: { outside: o.severity, native: match.severity } };
+  }
   return { rows, native_only: native.filter(n => !used.has(n.id)).map(n => n.id), errors };
 }
 
diff --git a/lib/autoplan-run.ts b/lib/autoplan-run.ts
index d6a4fbdbd..59833f2fc 100644
--- a/lib/autoplan-run.ts
+++ b/lib/autoplan-run.ts
@@ -31,7 +31,7 @@ import type { RunStatus } from './headless-artifacts';
 import { sha256File } from './headless-artifacts';
 import { outsideConsent } from './outside-consent';
 import { familyConflict, modelFamily } from './outside-voice-runner';
-import { renderSpend, reserve, settle, summarize, readLedger } from './spend-ledger';
+import { SpendCapExceeded, release, renderSpend, reserve, settle, summarize, readLedger } from './spend-ledger';
 import { DEFAULT_MAX_ROUNDS, attemptEstimate, overCap, resumeStop, roundCap, roundOf, roundsLine, stopForBudget, stopLines } from './autoplan-budget';
 import { annotateConfirm, confirmBlock } from './autoplan-confirm';
 
@@ -142,7 +142,11 @@ export function voiceState(state: RunState, phase: Phase, voice: Voice): VoiceSt
 }
 const openAttempt = (v: VoiceState) => v.attempts?.find(a => a.state === 'dispatched' || a.state === 'execution_unknown');
 
-export interface NextOptions { out: string; cwd: string; estimateUsd?: number; redispatch?: string[] }
+export interface NextOptions {
+  out: string; cwd: string; estimateUsd?: number; redispatch?: string[];
+  /** `run`: a voice's priced reservation from its prompt (undefined when unpriced); `--estimate-usd` wins over it. */
+  price?: (voice: Voice, promptFile: string) => number | undefined;
+}
 export interface NextResult { state: RunState; phase?: Phase; attempts: Array<{ attempt: string; voice: Voice; prompt: string; result: string; model_family: string; new: boolean }>; lines: string[] }
 
 function openPhase(state: RunState, phase: Phase, cwd: string): void {
@@ -219,15 +223,20 @@ export function nextStep(o: NextOptions): NextResult {
   if (ps.outside?.reason === 'docs_only') lines.push(`OUTSIDE: ${phase} not_run reason=docs_only (native voice only)`);
   if (ps.sections) lines.push(`Skipped sections: ${ps.sections.skipped.length ? ps.sections.skipped.join(',') : 'none'} (scope: ui=${state.scope.ui ? 'yes' : 'no'},dx=${state.scope.dx ? 'yes' : 'no'},source=${scopeSourceLabel(state.scope)}; checklist=${ps.sections.checklist ? 'loaded' : 'none'})`);
   const prompts = ps.prompts!;
+  if (o.estimateUsd !== undefined) state.estimate_usd = o.estimateUsd;
   const estimate = attemptEstimate(state, o.estimateUsd, process.env);
-  if (estimate.line) lines.push(estimate.line);
+  const usdFor = (voice: Voice) => (state.estimate_usd === undefined ? o.price?.(voice, prompts[voice]) : undefined) ?? estimate.usd;
+  if (estimate.line && (['native', 'outside'] as const).some(voice => usdFor(voice) === estimate.usd)) lines.push(estimate.line);
   if (first) lines.push(reviewEstimateLine(state, estimate.usd));
   const fresh = (['native', 'outside'] as const).filter(voice => { const v = voiceState(state, phase!, voice); const open = openAttempt(v); return !voiceTerminal(v) && (!open || (open.state === 'execution_unknown' && o.redispatch?.includes(open.attempt))); });
+  const resultOf = (voice: Voice, attempt: string) => path.join(state.out, attemptFile(phase!, voice, attempt.slice(state.run.length + 1), 'md'));
+  fresh.forEach((voice, i) => bindPromptResult(prompts[voice], resultOf(voice, `${state.run}-a${state.attempt_counter + i + 1}`)));
   const before = summarize(readLedger(path.join(state.out, FILES.spend), state.spend_cap_usd));
-  if (state.spend_cap_usd !== null && fresh.length && before.worst_case_usd + fresh.length * estimate.usd > state.spend_cap_usd + 1e-9) {
-    const stop = stopForBudget(state, phase, fresh.length * estimate.usd);
+  const asked = fresh.reduce((sum, voice) => sum + usdFor(voice), 0);
+  if (state.spend_cap_usd !== null && fresh.length && before.worst_case_usd + asked > state.spend_cap_usd + 1e-9) {
+    const stop = stopForBudget(state, phase, asked);
     writeState(state);
-    throw new RunError('SPEND_CAP_EXCEEDED', `spent ${before.spent_usd} + reserved ${before.reserved_usd} + unknown ${before.unknown_usd} + ${fresh.length} x estimate ${estimate.usd} > cap ${state.spend_cap_usd}; the run stopped incomplete (budget_exhausted)`, 3, { status: 'incomplete', lines: [...lines, ...stop] });
+    throw new RunError('SPEND_CAP_EXCEEDED', `spent ${before.spent_usd} + reserved ${before.reserved_usd} + unknown ${before.unknown_usd} + ${fresh.length} attempt(s) reserving ${+asked.toFixed(6)} > cap ${state.spend_cap_usd}; the run stopped incomplete (budget_exhausted)`, 3, { status: 'incomplete', lines: [...lines, ...stop] });
   }
   for (const voice of ['native', 'outside'] as const) {
     const v = voiceState(state, phase, voice);
@@ -243,11 +252,12 @@ export function nextStep(o: NextOptions): NextResult {
       continue;
     }
     const attempt = `${state.run}-a${++state.attempt_counter}`;
-    try { reserve(path.join(state.out, FILES.spend), attempt, estimate.usd, { cap: state.spend_cap_usd, label: `${phase}/${voice}` }); }
+    const resultFile = resultOf(voice, attempt);
+    const usd = usdFor(voice);
+    try { reserve(path.join(state.out, FILES.spend), attempt, usd, { cap: state.spend_cap_usd, label: `${phase}/${voice}` }); }
     catch (e: any) { if (e.code === 'SPEND_CAP_EXCEEDED') { state.attempt_counter--; writeState(state); throw new RunError('SPEND_CAP_EXCEEDED', e.message, 3); } throw e; }
-    const row: AttemptState = { attempt, state: 'dispatched', prompt: prompts[voice], result: path.join(state.out, attemptFile(phase, voice, attempt.slice(state.run.length + 1), 'md')), estimate_usd: estimate.usd, dispatched_at: now() };
-    bindPromptResult(row.prompt, row.result);
-    journal(state.out, { event: 'dispatched', attempt, phase, voice, snapshot: ps.snapshot, prompt: path.relative(state.out, row.prompt), prompt_sha256: sha256File(row.prompt), prompt_bytes: fs.statSync(row.prompt).size, result: path.relative(state.out, row.result), estimate_usd: estimate.usd });
+    const row: AttemptState = { attempt, state: 'dispatched', prompt: prompts[voice], result: resultFile, estimate_usd: usd, dispatched_at: now() };
+    journal(state.out, { event: 'dispatched', attempt, phase, voice, snapshot: ps.snapshot, prompt: path.relative(state.out, row.prompt), prompt_sha256: sha256File(row.prompt), prompt_bytes: fs.statSync(row.prompt).size, result: path.relative(state.out, row.result), estimate_usd: usd });
     (v.attempts ??= []).push(row);
     v.attempt = attempt; v.status = 'running';
     result.attempts.push({ attempt, voice, prompt: row.prompt, result: row.result, model_family: familyHint(state, voice), new: true });
@@ -405,6 +415,44 @@ export function closeOutside(state: RunState, phase: Phase, status: 'unavailable
   return lines;
 }
 
+/** Raise an open attempt's reservation to what the call about to run can cost; the cap still binds (SPEND_CAP_EXCEEDED). */
+export function fitReservation(out: string, phase: Phase, voice: Voice, attempt: string, usd: number): void {
+  const state = readState(out);
+  const a = voiceState(state, phase, voice).attempts?.find(x => x.attempt === attempt);
+  if (!a || usd <= a.estimate_usd + 1e-9) return;
+  const file = path.join(out, FILES.spend);
+  release(file, attempt);
+  const label = `${phase}/${voice}`;
+  try { reserve(file, attempt, usd, { cap: state.spend_cap_usd, label }); }
+  catch (e) {
+    reserve(file, attempt, a.estimate_usd, { label });
+    if (e instanceof SpendCapExceeded) throw new RunError('SPEND_CAP_EXCEEDED', `${attempt} (${phase} ${voice}) was admitted at ${a.estimate_usd}; the call it is about to make can cost ${usd}, past the cap ${state.spend_cap_usd}`, 3);
+    throw e;
+  }
+  a.estimate_usd = usd;
+  writeState(state);
+}
+
+/** Record that `run`'s paid call for an open attempt is going out (true) or never left this machine (false). */
+export function markSent(out: string, phase: Phase, voice: Voice, attempt: string, sent: boolean): void {
+  const state = readState(out);
+  const a = voiceState(state, phase, voice).attempts?.find(x => x.attempt === attempt);
+  if (!a) return;
+  if (sent) a.sent_at = now(); else delete a.sent_at;
+  writeState(state);
+}
+
+/** A paid call that did not bind a result (failed, refused, lost with its process): settle what it cost and supersede its open attempt, so a retry is admitted afresh. */
+export function retireAttempt(out: string, phase: Phase, voice: Voice, attempt: string, usd: number | 'unknown'): void {
+  const state = readState(out);
+  const a = voiceState(state, phase, voice).attempts?.find(x => x.attempt === attempt);
+  if (!a || a.state !== 'dispatched') return;
+  a.state = 'superseded'; a.terminal_at = now();
+  settle(path.join(out, FILES.spend), attempt, usd);
+  journal(out, { event: 'superseded', attempt, phase, voice, usage_usd: usd });
+  writeState(state);
+}
+
 /** Mark the outside voice of the current phase unavailable/failed (the runner could not run); closes the phase if native is bound. */
 export function markOutside(out: string, phase: Phase, status: 'unavailable' | 'failed', detail: string): RunState {
   const state = readState(out);
diff --git a/lib/autoplan-state.ts b/lib/autoplan-state.ts
index 01b345688..1709a9097 100644
--- a/lib/autoplan-state.ts
+++ b/lib/autoplan-state.ts
@@ -13,7 +13,7 @@ import { readJsonl } from './headless-artifacts';
 import type { ResultCodeName } from './result-codes';
 
 export type Voice = 'native' | 'outside';
-export interface AttemptState { attempt: string; state: 'dispatched' | 'submitted' | 'execution_unknown' | 'cancelled' | 'superseded' | 'deferred'; prompt: string; result: string; estimate_usd: number; dispatched_at: string; terminal_at?: string }
+export interface AttemptState { attempt: string; state: 'dispatched' | 'submitted' | 'execution_unknown' | 'cancelled' | 'superseded' | 'deferred'; prompt: string; result: string; estimate_usd: number; dispatched_at: string; terminal_at?: string; /** `run` set it before the paid call went out; an open attempt still carrying it was in flight when its process died. */ sent_at?: string }
 export interface VoiceState extends VoiceOutcome {
   attempt?: string; attempts?: AttemptState[]; result_sha256?: string; findings?: number; label?: string; usage?: Record<string, unknown>; detail?: string;
   /** verified: the INPUT receipt matched the snapshot; attested: a --record bound without one, on the parent's word (attest_reason). */
@@ -58,7 +58,7 @@ export interface DispatchCounts { total: number; by_phase: Record<string, Partia
 export interface RunState extends RunManifest {
   revision: number; out: string; plan_source: string; active_plan: string; restore: string; scope: Scope; phase_order: Phase[];
   phases: Record<string, PhaseState>; native_model?: string; outside_model?: string; outside_enabled: boolean; attempt_counter: number;
-  spend_cap_usd: number | null; deadline_at?: string; light?: boolean; history: Array<Record<string, unknown>>; created_at: string; updated_at: string;
+  spend_cap_usd: number | null; /** `next --estimate-usd`, kept for every later attempt. */ estimate_usd?: number; deadline_at?: string; light?: boolean; history: Array<Record<string, unknown>>; created_at: string; updated_at: string;
   /** The gstack that last wrote this run (lib/autoplan-migrate.ts); absent on runs written before 1.91.96. */
   gstack_version?: string;
   /** The --plan file the owner edits (drift hints, revise), the --plan-heading it was cut from, and the scope flags revise re-detects with. */
diff --git a/lib/dx-error-contract.ts b/lib/dx-error-contract.ts
index d4c920110..03f871cea 100644
--- a/lib/dx-error-contract.ts
+++ b/lib/dx-error-contract.ts
@@ -14,9 +14,9 @@ export const DX_ERROR_ITEMS = ['what', 'fix', 'recovery', 'code', 'context', 'tr
 export const DX_ERROR_DOC = 'https://github.com/garrytan/gstack/blob/main/docs/agent-ready-errors.md';
 
 export const DX_ERROR_COMPACT =
-  `Score every error path against the agent-ready error contract (${DX_ERROR_DOC}): what (operation and actual values), fix (a safe, authorized command or edit on the first or last line, or the precise thing a human must provide), recovery (retry, fix and retry, do X first, or ask a human; side effects none/partial/complete/unknown, reconcile before retrying an unknown outcome, a retry bound), code (stable, with a doc anchor), context (versions, config, env var names, the underlying cause; caller-safe only for remote services), trace (unexpected failures only: a compact trace or its file path locally, a correlation id remotely), redaction (no secret values anywhere), channel (the surface's native failure signal: non-zero exit and stderr for a CLI, status plus RFC 9457 body for an API, a typed error for an SDK, isError for an MCP tool). ` +
+  `Score every error path against the agent-ready error contract (${DX_ERROR_DOC}): what (operation and actual values), fix (a safe, authorized command or edit on the first or last line, or what a human must provide), recovery (retry, fix and retry, do X first, or ask a human; side effects none/partial/complete/unknown, reconcile before retrying an unknown outcome, a retry bound), code (stable, with a doc anchor), context (versions, config, env var names, the underlying cause; caller-safe only for remote services), trace (unexpected failures only: a compact trace or its file path locally, a correlation id remotely), redaction (no secret values anywhere), channel (the surface's native failure signal: non-zero exit and stderr for a CLI, status plus RFC 9457 body for an API, a typed error for an SDK, isError for an MCP tool). ` +
   'Usage and validation errors rejected before any work need only what, fix, code, redaction and channel; items apply per surface, N/A needs a reason, an item the plan never specifies for a path it introduces is a gap, and unknown is reserved for existing behavior you could not inspect. ' +
-  'Report a leaked secret, a failure signalled as success, an unsafe fix, or a block on a terminal (a hang, or a no-terminal failure that names no non-interactive alternative such as --yes) as a Critical finding titled "CAP4:<path>:<item>" (caps the Error Messages score at 4/10); report a missing applicable fix, recovery, context or trace as a High finding titled "CAP6:<path>:<item>" (caps it at 6/10).';
+  'Report a leaked secret, a failure signalled as success, an unsafe fix, or a block on a terminal (a hang, or a no-terminal failure naming no non-interactive alternative such as --yes) as a Critical finding titled "CAP4:<path>:<item> <what fails>" (caps Error Messages at 4/10); report a missing applicable fix, recovery, context or trace as a High finding titled "CAP6:<path>:<item> <what fails>" (caps it at 6/10).';
 
 export const DX_ERROR_CONTRACT = `#### The agent-ready error contract (${DX_ERROR_RUBRIC})
 
@@ -53,7 +53,7 @@ unknown is reserved for existing behavior you could not inspect. In a live audit
 you never triggered are unknown, not extrapolated.
 
 **Caps.** Name the path and item behind every cap and show the corrected error line.
-- **4/10 (Critical finding, title \`CAP4:<path>:<item>\`):** a path leaks a secret, signals failure as success, gives an unsafe fix, or blocks waiting for a terminal (hangs, or fails for lack of a terminal without naming a non-interactive alternative such as \`--yes\`).
-- **6/10 (High finding, title \`CAP6:<path>:<item>\`):** a path lacks an applicable fix, recovery, context or trace item.
+- **4/10 (Critical finding, title \`CAP4:<path>:<item> <what fails>\`):** a path leaks a secret, signals failure as success, gives an unsafe fix, or blocks waiting for a terminal (hangs, or fails for lack of a terminal without naming a non-interactive alternative such as \`--yes\`).
+- **6/10 (High finding, title \`CAP6:<path>:<item> <what fails>\`):** a path lacks an applicable fix, recovery, context or trace item.
 
 Every mode, DX TRIAGE included, reports every CAP4 finding.`;
diff --git a/lib/eval-plan.ts b/lib/eval-plan.ts
index 6bb74db94..21ae8b6e5 100644
--- a/lib/eval-plan.ts
+++ b/lib/eval-plan.ts
@@ -366,15 +366,24 @@ function renderReservationCheck(c: NonNullable<DryRunResult['checks']['reservati
 // ---------------------------------------------------------------------------
 export const PILOT_FILES = { spend: 'spend.json', pilot: 'pilot.json' } as const;
 export interface PilotAttempt { attempt: string; model: string; row: number; estimate_usd: number }
-export interface PilotRecord { schema_version: 1; n: number; arms: string[]; cap_usd: number; dry_run: string; attempts: PilotAttempt[]; started_at: string; status: 'reserved' | 'budget_exhausted' }
-export interface PilotStartOptions { out: string; cap: number; n: number; arms: string[]; dryRun: string; tokens?: TokenEstimate; now?: Date }
+export interface PilotRecord { schema_version: 1; n: number; arms: string[]; seat_metered?: string[]; cap_usd: number; dry_run: string; attempts: PilotAttempt[]; started_at: string; status: 'reserved' | 'budget_exhausted' }
+export interface PilotStartOptions { out: string; cap: number; n: number; arms: string[]; seatMetered?: string[]; dryRun: string; tokens?: TokenEstimate; now?: Date }
 
-/** Reserve n attempts per arm under the cap; a refused reservation ends the pilot `budget_exhausted` with nothing else reserved. */
+/**
+ * Reserve n attempts per arm under the cap; a refused reservation ends the pilot `budget_exhausted` with nothing else reserved.
+ * A seat-metered arm (operator-declared: a subscription call with no incremental charge) reserves $0 and stays outside the projection.
+ */
 export function startPilot(o: PilotStartOptions): { record: PilotRecord; error?: { code: ResultCodeName; message: string } } {
   const dry = JSON.parse(fs.readFileSync(o.dryRun, 'utf8')) as DryRunResult;
   if (!dry.pass) return { record: null as unknown as PilotRecord, error: { code: 'EVAL_DRY_RUN_FAILED', message: `${o.dryRun} did not pass; the pilot never starts on a failed dry run` } };
   const tokens = o.tokens ?? { input: dry.rows ? Math.ceil(dry.est_input_tokens / dry.rows) : DEFAULT_TOKENS.input, output: dry.checks.output_budget.budget };
-  const record: PilotRecord = { schema_version: 1, n: o.n, arms: o.arms, cap_usd: o.cap, dry_run: o.dryRun, attempts: [], started_at: (o.now ?? new Date()).toISOString(), status: 'reserved' };
+  const seat = o.seatMetered ?? [];
+  const stray = seat.filter(a => !o.arms.includes(a));
+  if (stray.length) throw new Error(`--seat-metered ${stray.join(',')} needs to name arms listed in --arms`);
+  const prior = path.join(o.out, PILOT_FILES.pilot);
+  const priorSeat = fs.existsSync(prior) ? (JSON.parse(fs.readFileSync(prior, 'utf8')) as PilotRecord).seat_metered ?? [] : seat;
+  if ([...priorSeat].sort().join(',') !== [...seat].sort().join(',')) throw new Error(`${o.out} holds a pilot started with --seat-metered ${priorSeat.join(',') || '(none)'}; seat-metered arms are fixed when a pilot starts, so this one needs a new --out`);
+  const record: PilotRecord = { schema_version: 1, n: o.n, arms: o.arms, ...(seat.length ? { seat_metered: seat } : {}), cap_usd: o.cap, dry_run: o.dryRun, attempts: [], started_at: (o.now ?? new Date()).toISOString(), status: 'reserved' };
   const keyOf = (a: string) => `${armModel(a).replace(/[^A-Za-z0-9.-]/g, '_')}${armLoadout(a) !== null ? `.${armLoadout(a)!.replace(/[^A-Za-z0-9.-]/g, '_')}` : ''}`;
   const keys = o.arms.map(keyOf);
   const duplicates = [...new Set(o.arms.filter((_, i) => keys.indexOf(keys[i]!) !== i).map(a => o.arms.filter(b => keyOf(b) === keyOf(a)).join(' = ')))];
@@ -383,11 +392,12 @@ export function startPilot(o: PilotStartOptions): { record: PilotRecord; error?:
   const ledgerFile = path.join(o.out, PILOT_FILES.spend);
   let error: { code: ResultCodeName; message: string } | undefined;
   outer: for (const model of o.arms) {
+    const seated = seat.includes(model);
     if (!hasPricing(armModel(model))) { error = { code: 'EVAL_PRICE_MISSING', message: `${armModel(model)} has no row in lib/pricing.ts` }; break; }
     for (let i = 1; i <= o.n; i++) {
-      const estimate = estimateCostUsd(tokens, armModel(model));
+      const estimate = seated ? 0 : estimateCostUsd(tokens, armModel(model));
       const attempt = `pilot-${keyOf(model)}-${i}`;
-      try { reserve(ledgerFile, attempt, estimate, { cap: o.cap, label: `pilot ${model} #${i}`, now: o.now }); }
+      try { reserve(ledgerFile, attempt, estimate, { cap: o.cap, label: `pilot ${model} #${i}${seated ? ' (seat-metered)' : ''}`, now: o.now }); }
       catch (e) {
         if (e instanceof SpendCapExceeded) { record.status = 'budget_exhausted'; error = { code: 'EVAL_BUDGET_EXHAUSTED', message: e.message }; break outer; }
         throw e;
@@ -408,31 +418,44 @@ export function releasePilot(out: string, attempt: string): SpendLedger {
 
 /** Two-sided 95% Student t for n-1 degrees of freedom (n settled items); 2.0 past the table. */
 const T95: Record<number, number> = { 2: 12.706, 3: 4.303, 4: 3.182, 5: 2.776, 6: 2.571, 7: 2.447, 8: 2.365, 9: 2.306, 10: 2.262 };
-export interface Projection { n: number; per_item_usd: number | null; sd_usd: number | null; total: number; projected_usd: number | null; band_usd: [number, number] | null; verdict: 'within' | 'exceeds' | 'unknown' }
+export interface ArmProjection { arm: string; n: number; per_item_usd: number | null; sd_usd: number | null; projected_usd: number | null; band_usd: [number, number] | null }
+export interface Projection { n: number; per_item_usd: number | null; sd_usd: number | null; total: number; projected_usd: number | null; band_usd: [number, number] | null; verdict: 'within' | 'exceeds' | 'unknown'; arms: ArmProjection[] }
 export interface SpendTable { summary: SpendSummary; workers: number; max_estimate_usd: number; worst_case_usd: number; worst_case_overrun_usd: number }
-export interface PilotReport { record: PilotRecord; spend: SpendTable; projection: Projection; settled_known: number; settled_unknown: number }
+export interface PilotReport { record: PilotRecord; spend: SpendTable; projection: Projection; settled_known: number; settled_unknown: number; seat_metered: Array<{ arm: string; calls: number; settled: number }> }
 
 export function pilotReport(out: string, o: { total: number; workers?: number }): PilotReport {
   const record = JSON.parse(fs.readFileSync(path.join(out, PILOT_FILES.pilot), 'utf8')) as PilotRecord;
   const ledger = readLedger(path.join(out, PILOT_FILES.spend), record.cap_usd);
   const summary = summarize(ledger);
-  const known = ledger.settled.filter(s => typeof s.usd === 'number').map(s => s.usd as number);
-  const unknown = ledger.settled.length - known.length;
+  const armOf = new Map(record.attempts.map(a => [a.attempt, a.model]));
+  const charged = new Set(ledger.settled.filter(s => typeof s.usd === 'number' && s.usd > 0).map(s => armOf.get(s.attempt)));
+  const seat = new Set((record.seat_metered ?? []).filter(arm => !charged.has(arm)));
+  const unknown = ledger.settled.filter(s => s.usd === 'unknown' && !seat.has(armOf.get(s.attempt) ?? '')).length;
   const workers = Math.max(1, o.workers ?? 1);
   const maxEstimate = Math.max(0, ...record.attempts.map(a => a.estimate_usd));
   const worst = summary.worst_case_usd + workers * maxEstimate;
-  const n = known.length;
-  const mean = n ? known.reduce((s, x) => s + x, 0) / n : null;
-  const sd = n > 1 && mean !== null ? Math.sqrt(known.reduce((s, x) => s + (x - mean) ** 2, 0) / (n - 1)) : null;
-  const perArmTotal = o.total * Math.max(1, record.arms.length);
-  const projected = mean === null ? null : mean * perArmTotal;
-  const half = sd !== null && mean !== null ? (T95[n] ?? 2.0) * (sd / Math.sqrt(n)) * perArmTotal : null;
-  const band: [number, number] | null = projected !== null && half !== null ? [Math.max(0, projected - half), projected + half] : null;
-  const verdict: Projection['verdict'] = projected === null || band === null || unknown > 0 ? 'unknown' : band[1] + summary.worst_case_usd <= record.cap_usd ? 'within' : 'exceeds';
+  const arms: ArmProjection[] = record.arms.filter(arm => !seat.has(arm)).map(arm => {
+    const xs = ledger.settled.filter(s => armOf.get(s.attempt) === arm && typeof s.usd === 'number').map(s => s.usd as number);
+    const n = xs.length;
+    const mean = n ? xs.reduce((s, x) => s + x, 0) / n : null;
+    const sd = n > 1 && mean !== null ? Math.sqrt(xs.reduce((s, x) => s + (x - mean) ** 2, 0) / (n - 1)) : null;
+    const projected = mean === null ? null : mean * o.total;
+    const half = sd !== null ? (T95[n] ?? 2.0) * (sd / Math.sqrt(n)) * o.total : null;
+    return { arm, n, per_item_usd: mean, sd_usd: sd, projected_usd: projected, band_usd: projected !== null && half !== null ? [Math.max(0, projected - half), projected + half] : null };
+  });
+  const priced = arms.filter(a => a.per_item_usd !== null);
+  const n = priced.reduce((s, a) => s + a.n, 0);
+  const mean = priced.length || !arms.length ? priced.reduce((s, a) => s + a.per_item_usd!, 0) : null;
+  const sd = mean !== null && priced.every(a => a.sd_usd !== null) ? priced.reduce((s, a) => s + a.sd_usd!, 0) : null;
+  const projected = mean === null ? null : mean * o.total;
+  const band: [number, number] | null = projected !== null && priced.every(a => a.band_usd)
+    ? [priced.reduce((s, a) => s + a.band_usd![0], 0), priced.reduce((s, a) => s + a.band_usd![1], 0)] : null;
+  const verdict: Projection['verdict'] = band === null || unknown > 0 || priced.length < arms.length ? 'unknown' : band[1] + summary.worst_case_usd <= record.cap_usd ? 'within' : 'exceeds';
   return {
     record, settled_known: n, settled_unknown: unknown,
     spend: { summary, workers, max_estimate_usd: maxEstimate, worst_case_usd: worst, worst_case_overrun_usd: Math.max(0, worst - record.cap_usd) },
-    projection: { n, per_item_usd: mean, sd_usd: sd, total: o.total, projected_usd: projected, band_usd: band, verdict },
+    projection: { n, per_item_usd: mean, sd_usd: sd, total: o.total, projected_usd: projected, band_usd: band, verdict, arms },
+    seat_metered: [...seat].map(arm => ({ arm, calls: record.attempts.filter(a => a.model === arm).length, settled: ledger.settled.filter(s => armOf.get(s.attempt) === arm).length })),
   };
 }
 
@@ -449,11 +472,17 @@ export function renderSpendTable(t: SpendTable, cap: number): string {
 
 export function renderPilotReport(r: PilotReport): string {
   const p = r.projection;
+  const band = (b: [number, number] | null) => (b ? `[${usd(b[0])}, ${usd(b[1])}]` : 'unknown');
+  const notReady = r.settled_unknown > 0
+    ? 'unknown charges make the band meaningless; settle them with actual cost, or start a new pilot in a new `--out` with `pilot start --seat-metered <arm>` for an arm on a subscription with no incremental charge'
+    : 'settle at least 2 attempts per priced arm with actual cost';
   return [
     `PILOT: n=${r.record.n} arms=${r.record.arms.join(',')} settled=${r.settled_known} unknown=${r.settled_unknown} status=${r.record.status}`,
     renderSpendTable(r.spend, r.record.cap_usd),
-    `PILOT_PROJECTION: items=${p.total} per_item=${usd(p.per_item_usd)} sd=${usd(p.sd_usd)} projected=${usd(p.projected_usd)} band=${p.band_usd ? `[${usd(p.band_usd[0])}, ${usd(p.band_usd[1])}]` : 'unknown'} cap=$${r.record.cap_usd.toFixed(2)} verdict=${p.verdict}`,
-    p.verdict === 'unknown' ? `APPROVAL: not ready — ${r.settled_known < 2 ? 'settle at least 2 pilot attempts with actual cost' : 'unknown charges make the band meaningless'}; settle, then rerun report` : `APPROVAL: run ${p.total} items at projected ${usd(p.projected_usd)} (95% band ${usd(p.band_usd![0])}–${usd(p.band_usd![1])}) under cap $${r.record.cap_usd.toFixed(2)}: ${p.verdict === 'within' ? 'fits; ask the owner before any further priced call' : 'EXCEEDS the cap; stop, raise the cap on purpose or cut arms or items'}`,
+    ...p.arms.map(a => `PILOT_ARM: arm=${a.arm} n=${a.n} per_item=${usd(a.per_item_usd)} sd=${usd(a.sd_usd)} projected=${usd(a.projected_usd)} band=${band(a.band_usd)}`),
+    ...r.seat_metered.map(s => `PILOT_SEAT_METERED: arm=${s.arm} calls=${s.calls} settled=${s.settled} (declared seat-metered: no incremental charge, outside the cap and the projection; usage-limited)`),
+    `PILOT_PROJECTION: items=${p.total} known_arms=${p.arms.filter(a => a.per_item_usd !== null).length}/${p.arms.length} per_item=${usd(p.per_item_usd)} sd=${usd(p.sd_usd)} projected=${usd(p.projected_usd)} band=${band(p.band_usd)} cap=$${r.record.cap_usd.toFixed(2)} verdict=${p.verdict}`,
+    p.verdict === 'unknown' ? `APPROVAL: not ready — ${notReady}; then rerun report` : `APPROVAL: run ${p.total} items at projected ${usd(p.projected_usd)} (95% band ${usd(p.band_usd![0])}–${usd(p.band_usd![1])}) under cap $${r.record.cap_usd.toFixed(2)}: ${p.verdict === 'within' ? 'fits; ask the owner before any further priced call' : 'EXCEEDS the cap; stop, raise the cap on purpose or cut arms or items'}`,
   ].join('\n') + '\n';
 }
 
diff --git a/lib/gate-list.ts b/lib/gate-list.ts
index 6dc3bb1ae..8baa3715d 100644
--- a/lib/gate-list.ts
+++ b/lib/gate-list.ts
@@ -2,7 +2,9 @@
  * gate-list — one gate list instead of four-option sequences (plan B9).
  * A gate list is numbered items, each with a stable id, a recommended default
  * and lettered options; `auto` items take their recommendation when
- * unanswered, `approval` items stay pending until answered. One reply
+ * unanswered (one whose recommendation changes the plan keeps the plan's
+ * direction instead, unless the reply approves with the recommended changes,
+ * `p1b`), `approval` items stay pending until answered. One reply
  * grammar: `rec` (every item takes its recommendation, plan changes
  * included), `<id><option>` tokens (`d3b uc1a`), or `rec except <tokens>`
  * (the same operation as listing the overrides). `all`, `approve all`,
@@ -39,6 +41,8 @@ export interface GateItem {
   carried?: { from: string; chosen: string; gate_rev: number };
   /** A round-cap item (lib/autoplan-budget.ts): `b` grants the phase one more round and reopens it. */
   cap?: { phase: string; kind: 'deferred' | 'blocker' | 'delta'; ref?: string };
+  /** An open Critical or High finding (its ids, a paired twin included): `a` applies the reviewer's fix to the plan. */
+  finding?: string[];
 }
 export interface GateList { schema_version: 1; run: string; gate_rev: number; items: GateItem[]; title?: string;
   /** Bumped by every `recommend`, so a `rec` relayed before it no longer matches `recHash`. */
@@ -196,6 +200,7 @@ export function parseReply(reply: string, list: GateList, gateRev?: number, prio
   const choices: GateChoice[] = [];
   const pending: string[] = [];
   const how = (item: GateItem, chosen: string) => (chosen === item.recommended ? 'recommended' : 'override') as GateChoice['how'];
+  const withChanges = overrides.get('p1') === 'b';
   for (const item of list.items) {
     const chosen = overrides.get(item.id);
     const earlier = prior[item.id] ?? item.carried?.chosen;
@@ -203,7 +208,7 @@ export function parseReply(reply: string, list: GateList, gateRev?: number, prio
     else if (earlier !== undefined && item.options.some(o => o.key === earlier)) choices.push({ id: item.id, chosen: earlier, kind: item.kind, how: how(item, earlier), prior: true });
     else if (asIs) { const keep = keepDirection(item); choices.push({ id: item.id, chosen: keep, kind: item.kind, how: how(item, keep) }); }
     else if (rec) choices.push({ id: item.id, chosen: item.recommended, kind: item.kind, how: 'recommended' });
-    else if (item.kind === 'auto') choices.push({ id: item.id, chosen: item.recommended, kind: item.kind, how: 'auto_default' });
+    else if (item.kind === 'auto') choices.push({ id: item.id, chosen: withChanges ? item.recommended : autoDefault(item), kind: item.kind, how: 'auto_default' });
     else pending.push(item.id);
   }
   return { ...base, valid: true, choices, pending, mode: rec ? 'rec' : asIs ? 'as-is' : 'tokens' };
@@ -214,6 +219,11 @@ export function keepDirection(item: GateItem): string {
   return item.options.find(o => o.changes_plan === false)?.key ?? (item.id === 'p1' && item.options.some(o => o.key === 'a') ? 'a' : item.recommended);
 }
 
+/** What an unanswered `auto` item resolves to: its recommendation, unless that changes the plan (then the plan's direction). */
+export function autoDefault(item: GateItem): string {
+  return item.options.find(o => o.key === item.recommended)?.changes_plan ? keepDirection(item) : item.recommended;
+}
+
 /** The decisions.jsonl id for a gate item. Item ids restart at every gate revision, so revisions after the first carry `r<rev>-`. */
 export function decisionId(run: string, gateRev: number, itemId: string): string {
   return gateRev > 1 ? `${run}-r${gateRev}-${itemId}` : `${run}-${itemId}`;
@@ -224,7 +234,7 @@ export function decisionRows(list: GateList, extra: Partial<DecisionRow> = {}):
   return list.items.map(item => ({
     schema_version: 1, run: list.run, id: decisionId(list.run, list.gate_rev, item.id), label: item.id.toUpperCase(), title: item.title,
     options: item.options.map(o => o.key), recommended: item.recommended, kind: item.kind, status: 'pending',
-    default_if_unanswered: item.kind === 'auto' ? item.recommended : null, gate_rev: list.gate_rev,
+    default_if_unanswered: item.kind === 'auto' ? autoDefault(item) : null, gate_rev: list.gate_rev,
     ...(item.phase ? { phase: item.phase } : {}), ...(item.cost ? { cost: item.cost } : {}),
     ...(item.recommended_basis ? { recommended_basis: item.recommended_basis } : {}), ...(item.changes ? { changes: item.changes } : {}),
     ...(item.origin ? { origin: item.origin } : {}), ...(item.reopens === false ? { source: 'agent' } : {}), ...extra,
@@ -234,14 +244,19 @@ export function decisionRows(list: GateList, extra: Partial<DecisionRow> = {}):
 /** `--by` values: the owner typing tokens, or an agent relaying or deciding them. */
 export const ANSWERED_BY_RE = /^(human|agent:[A-Za-z0-9_.:-]+)$/;
 
+/** Who answered and in whose words: a new answer replaces all of it, so an earlier answerer's fields never survive under a later one. */
+const PROVENANCE = ['answered_by', 'owner_reply', 'owner_reply_parsed', 'answer_words', 'answer_words_parsed', 'words_by', 'carried_gate_from', 'carried_gate_rev', 'carry_reason', 'carried_answered_by'] as const;
+
 export function applyReply(rows: DecisionRow[], parsed: ParsedReply, answeredAt: string, answeredBy?: string, extra: Partial<DecisionRow> = {}): DecisionRow[] {
   if (!parsed.valid) return rows;
   const byId = new Map(parsed.choices.map(c => [c.id, c]));
   return rows.map(row => {
     const choice = byId.get(row.label?.toLowerCase() ?? '') ?? byId.get(row.id.slice(row.run.length + 1).replace(/^r\d+-/, ''));
     if (!choice || choice.prior || row.gate_rev !== parsed.gate_rev) return row;
+    const fresh = { ...row };
+    for (const k of PROVENANCE) delete (fresh as Record<string, unknown>)[k];
     return {
-      ...row, chosen: choice.chosen, answered_at: answeredAt, reply: parsed.reply, ...(answeredBy ? { answered_by: answeredBy } : {}), ...extra,
+      ...fresh, chosen: choice.chosen, answered_at: answeredAt, reply: parsed.reply, ...(answeredBy ? { answered_by: answeredBy } : {}), ...extra,
       status: choice.how === 'override' ? 'overridden' : 'approved',
     };
   });
diff --git a/lib/gate-outcomes.ts b/lib/gate-outcomes.ts
index 0834d58f2..d29ade2be 100644
--- a/lib/gate-outcomes.ts
+++ b/lib/gate-outcomes.ts
@@ -48,6 +48,11 @@ export const GATE_OUTCOMES = {
     summary: 'the reviewer declined to review',
     fix: 're-run the review; if it declines again, review the change natively',
   },
+  truncated: {
+    state: 'unavailable', anchor: 'outside-review-truncated',
+    summary: 'the reviewer hit its output token limit and the response is cut off',
+    fix: 're-run with a larger --max-tokens (or a smaller prompt); a cut-off response never counts as a review',
+  },
   missing_markers: {
     state: 'unavailable', anchor: 'outside-review-missing-markers',
     summary: 'the response lacks the markers this gate requires',
diff --git a/lib/headless-artifacts.ts b/lib/headless-artifacts.ts
index 1e184b184..328295150 100644
--- a/lib/headless-artifacts.ts
+++ b/lib/headless-artifacts.ts
@@ -23,7 +23,7 @@ export type DecisionKind = 'auto' | 'approval' | 'user_challenge';
 export type DecisionStatus = 'pending' | 'approved' | 'overridden' | 'rejected';
 export type TaskStatus = 'pending' | 'ready' | 'blocked_on_dependency' | 'blocked_on_decision' | 'in_progress' | 'done';
 export type VoiceStatus = 'completed' | 'unavailable' | 'disabled' | 'skipped' | 'failed' | 'pending' | 'running';
-export type ResultStatus = 'complete' | 'gate_pending' | 'amend_pending' | 'incomplete' | 'interrupted' | 'refused';
+export type ResultStatus = 'complete' | 'reviewed' | 'gate_pending' | 'amend_pending' | 'incomplete' | 'interrupted' | 'refused';
 export type RunStatus = ResultStatus | 'awaiting_result' | 'running';
 
 export interface FindingRow {
@@ -41,6 +41,8 @@ export interface DecisionRow {
   recommended_basis?: string; changes?: string; origin?: string; carried_from?: string; chosen_text?: string;
   /** An agent-relayed answer: the owner's verbatim words, and whether they parsed under the gate grammar. */
   owner_reply?: string; owner_reply_parsed?: boolean; recommended_by?: string;
+  /** An agent's own words (`--words-by agent:<id>`): never the owner's, so never carried or imported as the owner's. */
+  answer_words?: string; answer_words_parsed?: boolean; words_by?: string;
   /** A whole-gate carry (lib/autoplan-carry.ts): the earlier p1 decision whose owner words this answer reuses, its gate_rev, why, who relayed them, items taken under "do it", and the delta check attempt. */
   carried_gate_from?: string; carried_gate_rev?: number; carry_reason?: string; carried_answered_by?: string; carried_under?: string; carry_check?: string;
 }
@@ -119,7 +121,7 @@ export interface ShipReceipt {
   base_red?: { cases: string[]; files: string[]; base: string; lane: string; expires_at: string };
 }
 
-export const RESULT_STATUSES: readonly ResultStatus[] = ['complete', 'gate_pending', 'amend_pending', 'incomplete', 'interrupted', 'refused'];
+export const RESULT_STATUSES: readonly ResultStatus[] = ['complete', 'reviewed', 'gate_pending', 'amend_pending', 'incomplete', 'interrupted', 'refused'];
 const TERMINAL_RUN: readonly string[] = ['complete', 'gate_pending', 'amend_pending', 'refused', 'incomplete'];
 const TERMINAL_VOICE: readonly string[] = ['completed', 'unavailable', 'disabled', 'skipped', 'failed'];
 const RESOLVED: readonly string[] = ['accepted', 'partially_accepted', 'rejected', 'deferred', 'fixed'];
diff --git a/lib/outside-voice-api.ts b/lib/outside-voice-api.ts
index f5c6d17e2..f31722d2e 100644
--- a/lib/outside-voice-api.ts
+++ b/lib/outside-voice-api.ts
@@ -13,7 +13,13 @@ import { modelFamily, type ModelFamily } from './outside-voice-runner';
 
 export interface ApiCallRequest { model: string; prompt: string; timeoutMs: number; env?: Record<string, string | undefined>; signal?: AbortSignal; maxTokens?: number }
 export interface ApiUsage { input_tokens?: number; output_tokens?: number }
-export interface ApiCallResult { text: string; model: string; usage: ApiUsage; provider: 'openai' | 'anthropic'; status: number }
+/** `truncated`: the provider stopped at the output token limit (Anthropic `max_tokens`, OpenAI `length`), so the text is cut off. */
+export interface ApiCallResult { text: string; model: string; usage: ApiUsage; provider: 'openai' | 'anthropic'; status: number; truncated: boolean }
+
+/** Anthropic requires max_tokens; a full review needs more than 8192. `run` sends this to OpenAI too, where reasoning tokens count toward it. */
+export const DEFAULT_MAX_TOKENS = 16_384;
+/** The api runner's default time limit: five minutes, or about 40 ms per output token the call may write. */
+export const apiTimeoutMs = (maxTokens?: number): number => Math.max(300_000, (maxTokens ?? DEFAULT_MAX_TOKENS) * 40);
 
 export const API_FAMILIES: readonly ModelFamily[] = ['openai', 'anthropic'];
 
@@ -57,17 +63,17 @@ export async function callModel(req: ApiCallRequest): Promise<ApiCallResult> {
   const model = req.model.includes('/') ? req.model.slice(req.model.indexOf('/') + 1) : req.model;
   if (auth.provider === 'anthropic') {
     const base = (env.ANTHROPIC_BASE_URL ?? 'https://api.anthropic.com').replace(/\/$/, '');
-    const body = JSON.stringify({ model, max_tokens: req.maxTokens ?? 8192, messages: [{ role: 'user', content: req.prompt }] });
+    const body = JSON.stringify({ model, max_tokens: req.maxTokens ?? DEFAULT_MAX_TOKENS, messages: [{ role: 'user', content: req.prompt }] });
     const { status, json } = await post(`${base}/v1/messages`, { 'x-api-key': auth.key, 'anthropic-version': '2023-06-01' }, body, req, 'anthropic');
     if (status < 200 || status >= 300) throw new Error(`anthropic ${status}: ${json?.error?.message ?? json?.raw ?? JSON.stringify(json)}`);
     const text = Array.isArray(json?.content) ? json.content.filter((c: any) => c?.type === 'text').map((c: any) => c.text).join('\n') : '';
-    return { text, model: typeof json?.model === 'string' ? json.model : model, usage: { input_tokens: json?.usage?.input_tokens, output_tokens: json?.usage?.output_tokens }, provider: 'anthropic', status };
+    return { text, model: typeof json?.model === 'string' ? json.model : model, usage: { input_tokens: json?.usage?.input_tokens, output_tokens: json?.usage?.output_tokens }, provider: 'anthropic', status, truncated: json?.stop_reason === 'max_tokens' };
   }
   const base = (env.OPENAI_BASE_URL ?? 'https://api.openai.com/v1').replace(/\/$/, '');
-  const body = JSON.stringify({ model, messages: [{ role: 'user', content: req.prompt }] });
+  const body = JSON.stringify({ model, messages: [{ role: 'user', content: req.prompt }], ...(req.maxTokens ? { max_completion_tokens: req.maxTokens } : {}) });
   const { status, json } = await post(`${base}/chat/completions`, { authorization: `Bearer ${auth.key}` }, body, req, 'openai');
   if (status < 200 || status >= 300) throw new Error(`openai ${status}: ${json?.error?.message ?? json?.raw ?? JSON.stringify(json)}`);
   const content = json?.choices?.[0]?.message?.content;
   const text = typeof content === 'string' ? content : Array.isArray(content) ? content.map((c: any) => c?.text ?? '').join('\n') : '';
-  return { text, model: typeof json?.model === 'string' ? json.model : model, usage: { input_tokens: json?.usage?.prompt_tokens, output_tokens: json?.usage?.completion_tokens }, provider: 'openai', status };
+  return { text, model: typeof json?.model === 'string' ? json.model : model, usage: { input_tokens: json?.usage?.prompt_tokens, output_tokens: json?.usage?.completion_tokens }, provider: 'openai', status, truncated: json?.choices?.[0]?.finish_reason === 'length' };
 }
diff --git a/lib/outside-voice-runner.ts b/lib/outside-voice-runner.ts
index f56c5e2c9..1ac6d569d 100644
--- a/lib/outside-voice-runner.ts
+++ b/lib/outside-voice-runner.ts
@@ -36,6 +36,8 @@ export interface RunnerRequest {
   promptFile: string; outFile: string; model?: string; timeoutMs: number; cwd: string; gate: OutsideGate;
   /** host-subagent: the file the host's subagent wrote. */
   resultFile?: string;
+  /** api: the output token limit (lib/outside-voice-api.ts DEFAULT_MAX_TOKENS for Anthropic when unset). */
+  maxTokens?: number;
   env?: Record<string, string | undefined>;
   /** Directory of the gstack bins (gstack-codex-probe); defaults to this module's sibling bin/. */
   binDir?: string;
@@ -199,10 +201,11 @@ class ApiRunner implements OutsideRunner {
     if (!avail.ok) return finish({ ...base, status: 'unavailable', exit: 1, reason: 'runner_unavailable', detail: avail.reason }, started);
     const { callModel } = await import('./outside-voice-api');
     try {
-      const res = await callModel({ model: req.model!, prompt, timeoutMs: req.timeoutMs, env: req.env, signal: this.controller.signal });
+      const res = await callModel({ model: req.model!, prompt, timeoutMs: req.timeoutMs, env: req.env, signal: this.controller.signal, maxTokens: req.maxTokens });
       fs.mkdirSync(path.dirname(req.outFile), { recursive: true });
       fs.writeFileSync(req.outFile, res.text);
       const usage: RunnerUsage = { ...res.usage, usd: 'unknown' };
+      if (res.truncated) return finish({ ...base, model: res.model, family: modelFamily(res.model), status: 'unavailable', exit: 0, usage, reason: 'truncated', detail: `stopped at the output limit after ${res.usage.output_tokens ?? 'an unknown number of'} output tokens; raise --max-tokens` }, started, req.outFile);
       const { status, verdict } = classify(res.text, req.gate, { exit: 0 });
       return finish({ ...base, model: res.model, family: modelFamily(res.model), status, exit: 0, usage, verdict, ...(verdict.reason ? { reason: verdict.reason } : {}), ...(verdict.detail ? { detail: verdict.detail } : {}) }, started, req.outFile);
     } catch (e: any) {
diff --git a/lib/result-codes-release.ts b/lib/result-codes-release.ts
index 9c6496756..3797aeae2 100644
--- a/lib/result-codes-release.ts
+++ b/lib/result-codes-release.ts
@@ -418,8 +418,24 @@ export const RELEASE_RESULT_CODES = {
   },
   QUEUE_LAND_LOCKED: {
     anchor: 'queue-land-locked',
-    summary: 'another gstack-ship-queue land holds the repository land lock (refs/notes/gstack-land), so this one would race it for the next version',
-    fix: 'wait for the holder named in the line to finish; if it crashed, gstack-ship-queue land --pr <n> --break-lock (refused while its journal shows a push in flight)',
+    summary: 'another gstack-ship-queue land or train land slot holds the repository land lock (refs/notes/gstack-land), so this one would race it onto main',
+    fix: 'wait for the holder named in the line to finish; if it crashed, rerun with --break-lock (refused while it is mid-push or mid-merge, between train slots less than 10 minutes, and for a live train run without --break-train-lock)',
+  },
+  // #3531: verify --train's slot stamp proof and gstack-restamp's staging of what it writes.
+  QUEUE_TRAIN_UNSTAMPED: {
+    anchor: 'queue-train-unstamped',
+    summary: 'the slot head verify --train would let merge is not stamped above main: its VERSION is not above main\'s, or its CHANGELOG is not headed with that version directly above main\'s top release',
+    fix: 'on the lane, run gstack-restamp --next on the head, commit what restamp staged, push, then rerun gstack-ship-queue verify --pr <n> --train <nonce>',
+  },
+  RESTAMP_NOT_STAGED: {
+    anchor: 'restamp-not-staged',
+    summary: 'gstack-restamp wrote the stamp but could not stage it, so a bare git commit would leave the stamp out',
+    fix: 'clear what blocked git add (an index.lock), then rerun gstack-restamp: the noop rerun stages the files it wrote, or drops the marker when they changed since',
+  },
+  RESTAMP_UNSTAGED_EDITS: {
+    anchor: 'restamp-unstaged-edits',
+    summary: 'a file gstack-restamp would stamp holds unstaged edits of the caller, which staging the stamp would sweep into the stamp commit; nothing was written',
+    fix: 'stage (git add) or stash your own edits to the files named, then rerun gstack-restamp',
   },
   QUEUE_LAND_CONFLICT: {
     anchor: 'queue-land-conflict',
diff --git a/lib/review-pass.ts b/lib/review-pass.ts
index 29928d8e9..365069720 100644
--- a/lib/review-pass.ts
+++ b/lib/review-pass.ts
@@ -3,7 +3,7 @@
  *
  * gstack-review-dispatch pass turns gstack-review-plan's dispatches into a manifest: stage `first`
  * (audit readers that may write tests, so they settle before any reviewer reads the tree), stage
- * `specialists` (the specialists, plus the other audit and QA readers), stage `red-team` and stage
+ * `specialists` (the specialists, plus the other audit readers), stage `red-team` and stage
  * `voices` (Step 11). Each reviewer keeps its plan entry (role, effort, exclusions) and is rendered
  * once, when its inputs exist, by lib/review-brief.ts; the Red Team's findings file is the
  * specialists' merged.jsonl lines, byte for byte. Briefs travel to the dispatch program in bounded
@@ -28,7 +28,7 @@ export interface PassReader {
   role?: BriefRole; name?: string; effort?: string; exclude?: string; checklists?: string[];
   /** The targeted reader: the plan's TARGETED classes and the merge base it reads on every pass. */
   classes?: string[]; diff_base?: string;
-  /** An audit or QA reader: its prompt is a file the parent wrote from its section; its output is returned, never collected. */
+  /** An audit reader: its prompt is a file the parent wrote from its section; its output is returned, never collected. */
   prompt_file?: string; model?: PassModel;
   file?: string; sha256?: string; bytes?: number; chunks?: number; findings_sha256?: string;
   /** The fingerprint the reader's reply must report: the checkout's HEAD^{tree} and toplevel when its brief was rendered (GST-482). */
@@ -47,6 +47,9 @@ export interface Manifest {
 }
 export interface FixCheckFiles { fix_list: string; hunks: string; tests: string; callers?: string }
 export interface Extra { name: string; prompt_file: string; first?: boolean; model?: PassModel }
+/** Step 9.2.1's own first line: its probes are the parent's, so a QA subagent only refuses (C4-36, C5-36: "parent-only"). */
+export const PARENT_ONLY_QA = 'Only the parent runs report-only discovery.';
+const qaRefusal = (name: string) => new BriefError(`Step 9.2.1 is the parent's report-only discovery (ship/sections/review-army.md: "${PARENT_ONLY_QA}"), never an audit reader: ${name}`);
 
 /** Brief characters per transport chunk: even with every character escaped, one chunk line stays far under 1 MiB. */
 export const CHUNK_CHARS = 65_536;
@@ -96,6 +99,9 @@ export function buildManifest(o: {
   }
   for (const e of o.extras ?? []) {
     if (!/^[a-z0-9-]+$/.test(e.name)) throw new BriefError(`an audit reader's name is lowercase letters, digits and dashes: ${e.name}`);
+    let brief = '';
+    try { brief = fs.readFileSync(e.prompt_file, 'utf8'); } catch { brief = ''; }
+    if (/(^|-)qa(-|$)/.test(e.name) || brief.includes(PARENT_ONLY_QA)) throw qaRefusal(e.name);
     readers.push({ reader: `audit/${e.name}`, stage: e.first ? 'first' : 'specialists', title: `ship ${o.pass} audit/${e.name}`, state: 'planned', prompt_file: path.resolve(e.prompt_file), model: e.model });
   }
   if (new Set(readers.map(r => r.reader)).size !== readers.length) throw new BriefError('two readers share a key in this pass');
diff --git a/lib/ship-bin-common.ts b/lib/ship-bin-common.ts
index 2702f251f..630a33ea1 100644
--- a/lib/ship-bin-common.ts
+++ b/lib/ship-bin-common.ts
@@ -7,9 +7,10 @@
  */
 import { spawn, spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import { fragmentSlug } from './changelog-fragments';
-import { parseUnifiedDiff, stampOnlyLine, versionAtRef } from './restamp';
+import { branchAddedLines, forkVersion, parseUnifiedDiff, stampMentions, stampOnlyLine, versionAtRef } from './restamp';
 import { matchesAny } from './ship-policy';
 import { extractVersion } from './version-source';
 import { BIN_DIR, runBashSync, runScriptSync, scriptInvocation } from './script-invocation';
@@ -95,19 +96,23 @@ export function versionOnlyEdit(cwd: string, ref: string, p: string): boolean {
  * never a behavior change. A manifest counts only while its edit is version-only (a dependency, script or
  * lockfile change is a build input); bun.lock never counts.
  */
-export function releasePaths(policy: Record<string, any> | null, cwd: string, ref: string): string[] {
+export function releasePaths(policy: Record<string, any> | null, cwd: string, ref: string, base: string): string[] {
   const list = (v: unknown) => (Array.isArray(v) ? v.filter((s): s is string => typeof s === 'string') : []);
   const fragment = fragmentPath(policy, cwd);
   return [...new Set(['VERSION', 'CHANGELOG.md', 'TODOS.md', 'agents-digest/gstack-AGENTS.md', ...VERSIONED_MANIFESTS.filter(p => versionOnlyEdit(cwd, ref, p)),
     ...(typeof policy?.changelog === 'string' ? [policy.changelog] : []), ...(fragment ? [fragment] : []), ...list(policy?.release_outputs), ...list(policy?.stamp_paths),
-    ...stampedFiles(policy, cwd, ref)])];
+    ...stampedFiles(policy, cwd, ref, base)])];
 }
 
 /**
  * `stamp_files` paths whose working-tree edit against `ref` is a version stamp alone: every changed line swaps the
  * old version for the new one under a built-in form or a `stamp_patterns` template (lib/tree-receipt.ts classifyFile).
+ * A moved version is floored at `ref`'s VERSION, except on a line the branch added itself (gstack-restamp's own rule:
+ * added since the merge base with origin/<base>, and not added by the base since): after a lost slot and a merge of the
+ * base its stale stamp is older than `ref`'s VERSION, so it must be newer than the fork point's version instead, the
+ * bound gstack-restamp's stamp_paths stage uses (GST-895).
  */
-export function stampedFiles(policy: Record<string, any> | null, cwd: string, ref: string): string[] {
+export function stampedFiles(policy: Record<string, any> | null, cwd: string, ref: string, base: string): string[] {
   const globs = Array.isArray(policy?.stamp_files) ? policy.stamp_files.filter((s: unknown): s is string => typeof s === 'string') : [];
   if (!globs.length) return [];
   const before = versionAtRef(cwd, ref);
@@ -118,8 +123,27 @@ export function stampedFiles(policy: Record<string, any> | null, cwd: string, re
   const templates = Array.isArray(policy?.stamp_patterns) ? policy.stamp_patterns.filter((s: unknown): s is string => typeof s === 'string') : [];
   const diff = git(cwd, ['diff', '--unified=0', '--no-color', '--no-ext-diff', '--no-textconv', '--no-renames', ref]);
   if (diff.status !== 0) return [];
+  let fork: string | undefined;
+  let since: string | undefined;
+  const own = new Map<string, Set<string>>();
+  const ownLines = (rel: string): Set<string> => {
+    if (own.has(rel)) return own.get(rel)!;
+    since ??= git(cwd, ['merge-base', `origin/${base}`, 'HEAD']).stdout.trim();
+    let lines = new Set<string>();
+    if (since) {
+      try { lines = branchAddedLines(cwd, since, [rel], ref, branchAddedLines(cwd, since, [rel], `origin/${base}`)).get(rel)?.text ?? lines; } catch {}
+    }
+    own.set(rel, lines);
+    return lines;
+  };
+  const stamp = (rel: string, removed: string, added: string): boolean => {
+    if (stampOnlyLine(removed, added, before.version, after, templates)) return true;
+    if (!ownLines(rel).has(removed)) return false;
+    fork ??= forkVersion(cwd, `origin/${base}`, before.version);
+    return stampOnlyLine(removed, added, fork, after, templates) && (!stampMentions(removed, templates).has(fork) || stampMentions(added, templates).has(fork));
+  };
   return parseUnifiedDiff(diff.stdout).filter(f => f.status === 'M' && !f.binary && !f.modeChanged && matchesAny(globs, f.path) && f.hunks.length > 0 &&
-    f.hunks.every(h => h.removed.length === h.added.length && h.removed.every((line, i) => stampOnlyLine(line, h.added[i]!, before.version, after, templates)))).map(f => f.path);
+    f.hunks.every(h => h.removed.length === h.added.length && h.removed.every((line, i) => stamp(f.path, line, h.added[i]!)))).map(f => f.path);
 }
 
 /** Under `changelog_fragments`, the branch's own Step 13 entry `<dir>/<branch-slug>.md` (docs/ship-policy.md#changelog-fragments); null without the key. */
@@ -150,13 +174,32 @@ export class Report {
   }
 }
 
-/** Run each lane through gstack-evidence run in parallel and read its recorded line. */
-export async function runLanes(cwd: string, list: { label: string; command: string }[]): Promise<{ label: string; exit: number | null; testsRan: string; log: string }[]> {
-  return Promise.all(list.map(async l => {
-    const r = await binAsync(cwd, 'gstack-evidence', ['run', '--label', l.label, '--', l.command]);
-    const m = /gstack-evidence: recorded label=\S+ exit=(\S+) tests_ran=(\S+) log=(\S+)/.exec(r.stderr);
-    return { label: l.label, exit: r.status, testsRan: m?.[2] ?? 'unknown', log: m?.[3] ?? '-' };
-  }));
+/**
+ * How many lanes run at once (GST-851): `--lanes serial` one, `--lanes parallel` all; unset, one on a machine with 4 or fewer
+ * cores (six lanes at once took 4-core machines down on gstack-evals) and all above that. Any other value is a usage error.
+ */
+export function laneConcurrency(mode: string | undefined, cpus = os.availableParallelism()): number | string {
+  if (mode === 'serial') return 1;
+  if (mode === 'parallel') return Infinity;
+  if (mode !== undefined) return `--lanes ${mode} is not serial or parallel`;
+  return cpus <= 4 ? 1 : Infinity;
+}
+
+/** Run each lane through gstack-evidence run, at most `concurrency` at a time, and read its recorded line; results keep the lanes' order. */
+export async function runLanes(cwd: string, list: { label: string; command: string }[], concurrency = Infinity): Promise<{ label: string; exit: number | null; testsRan: string; log: string }[]> {
+  const out: { label: string; exit: number | null; testsRan: string; log: string }[] = [];
+  let next = 0;
+  const worker = async () => {
+    while (next < list.length) {
+      const i = next++;
+      const l = list[i]!;
+      const r = await binAsync(cwd, 'gstack-evidence', ['run', '--label', l.label, '--', l.command]);
+      const m = /gstack-evidence: recorded label=\S+ exit=(\S+) tests_ran=(\S+) log=(\S+)/.exec(r.stderr);
+      out[i] = { label: l.label, exit: r.status, testsRan: m?.[2] ?? 'unknown', log: m?.[3] ?? '-' };
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, Math.min(concurrency, list.length)) }, worker));
+  return out;
 }
 
 /** Step 5's lane verdict: a lane passes on its runner count, never exit 0 alone. */
diff --git a/lib/ship-preflight.ts b/lib/ship-preflight.ts
index ed1f48f50..519ee5475 100644
--- a/lib/ship-preflight.ts
+++ b/lib/ship-preflight.ts
@@ -6,22 +6,24 @@
  * agent (a merge conflict, a failing or zero-run lane, the carry route, the Apple target).
  */
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import { classifyDiff } from './review-depth';
 import { audit } from './ship-audit';
-import { bin, firstLine, flagReader, gh, git, hostedOrigin, laneLine, lanes, Report, runLanes, shipPolicy, short } from './ship-bin-common';
+import { bin, firstLine, flagReader, gh, git, hostedOrigin, laneConcurrency, laneLine, lanes, Report, runLanes, shipPolicy, short } from './ship-bin-common';
 
 export const PREFLIGHT_HELP = `gstack-ship-preflight — /ship Steps 1-3 and Step 5's pregate and lanes in one call (ship/SKILL.md)
 
   gstack-ship-preflight --base <base> [--lane <label>=<command>]...   Steps 1-3; with lanes also Step 5
   gstack-ship-preflight --tests-only --base <base> --lane <label>=<command>...   Step 5 only (after a repair)
+      --lanes serial|parallel   how Step 5 runs its lanes; unset, one at a time on 4 or fewer cores, all at once above
       --policy-from head   Step 5's pregate reads the branch's .gstack/pregate.json, which may only add test lanes
                            (a branch that adds the lane for a file it touches); anything else is PREGATE_HEAD_POLICY_LOOSENS
   gstack-ship-preflight --audit --base <base> --out <dir>   the single reads and Steps 7-8's deterministic audits
       (CONTEXT, TODOS, COVERAGE_MAP, Coverage, PLAN_*, READER: coverage=needed|none plan=needed|none)
 
 Prints at most 30 lines: BRANCH, STATUS, DIFF, PR/CARRY, APPLE, SCOPE, MERGE, DISTRIBUTION, POLICY,
-RUNTIME_LINES, PREGATE (with up to three PREGATE_DETAIL lines when it does not pass), one LANE line per lane,
+RUNTIME_LINES, PREGATE (with up to three PREGATE_DETAIL lines when it does not pass), LANES, one LANE line per lane,
 then NEXT: lines. STOP: names what the agent must
 decide or repair; nothing after it ran. Exit codes: 0 ok · 2 usage · 3 STOP`;
 
@@ -122,7 +124,7 @@ function merge(cwd: string, base: string, r: Report): boolean {
   return true;
 }
 
-async function tests(cwd: string, base: string, list: { label: string; command: string }[], policyFrom: string, r: Report): Promise<void> {
+async function tests(cwd: string, base: string, list: { label: string; command: string }[], policyFrom: string, run: { concurrency: number; line: string }, r: Report): Promise<void> {
   const pg = bin(cwd, 'gstack-pregate', ['--allow-repo-commands', '--base', base, '--policy-from', policyFrom], 3_600_000);
   const refusal = pg.status === 3 ? /\((PREGATE_[A-Z_]+|POLICY_[A-Z_]+)[;)]/.exec(pg.stderr)?.[1] : undefined;
   const verdict = refusal ? `refused (${refusal})` : /^PREGATE: (.+?) tree=/m.exec(pg.stdout + pg.stderr)?.[1] ?? `unreadable (exit ${pg.status})`;
@@ -133,7 +135,8 @@ async function tests(cwd: string, base: string, list: { label: string; command:
     return;
   }
   if (/uncleared/.test(verdict)) r.next('pregate requires-remote: gstack-pregate clear, or --remote --spend-cap <usd> under a user cap, before Step 18');
-  const results = (await runLanes(cwd, list)).map(laneLine);
+  r.add(run.line);
+  const results = (await runLanes(cwd, list, run.concurrency)).map(laneLine);
   for (const l of results) r.add(l.line);
   const bad = results.filter(l => !l.ok);
   if (bad.length) { r.stop(`${bad.length} lane(s) failed or ran zero tests: Step 5 triage (read each log; a free-suite shard failure reruns its file list per measure.md); in-branch failures stop the ship`); return; }
@@ -154,9 +157,12 @@ export async function preflight(argv: readonly string[], cwd: string): Promise<{
   if (!['base', 'head'].includes(policyFrom)) return { text: 'gstack-ship-preflight: --policy-from needs base|head\n', exit: 2 };
   if (!base || typeof list === 'string') return { text: `gstack-ship-preflight: ${typeof list === 'string' ? list : '--base <base> is required'}\n`, exit: 2 };
   if (has('--tests-only') && !list.length) return { text: 'gstack-ship-preflight: --tests-only needs at least one --lane <label>=<command>\n', exit: 2 };
+  const mode = flag('--lanes');
+  const concurrency = has('--lanes') && mode === undefined ? '--lanes needs serial or parallel' : laneConcurrency(mode);
+  if (typeof concurrency === 'string') return { text: `gstack-ship-preflight: ${concurrency}\n`, exit: 2 };
   const r = new Report();
   if (has('--tests-only') || integrate(cwd, base, r)) {
-    if (list.length) await tests(cwd, base, list, policyFrom, r);
+    if (list.length) await tests(cwd, base, list, policyFrom, { concurrency, line: `LANES: ${concurrency === 1 ? 'serial' : 'parallel'} (${mode ? '--lanes' : `${os.availableParallelism()} cores`})` }, r);
     else if (r.exit === 0) r.next('Step 4: confirm the test framework, then rerun with --tests-only --lane <label>=<command> per suite (Step 5)');
   }
   return { text: r.render(), exit: r.exit };
diff --git a/lib/ship-queue-dispatch-ci.ts b/lib/ship-queue-dispatch-ci.ts
index 0c496ab8c..d099b75c7 100644
--- a/lib/ship-queue-dispatch-ci.ts
+++ b/lib/ship-queue-dispatch-ci.ts
@@ -9,7 +9,10 @@
  * run at this head already concluded), a wait for each run, and one
  * `PREGATE_CLEARED:` per requires-remote lane whose workflow is one of them
  * and whose run concluded success. A red run clears no lane and refuses. A
- * fork head is never dispatched here (QUEUE_TRAIN_UNTRUSTED).
+ * fork head is never dispatched here (QUEUE_TRAIN_UNTRUSTED). A workflow the
+ * base has but the head predates (windows-smoke.yml on a branch cut before it
+ * landed) is skipped with a note: GitHub reads the workflow file from the
+ * branch, so the dispatch could only fail.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -17,6 +20,7 @@ import type { PregateFile } from './headless-artifacts';
 import { PREGATE_OUT_REL, clearObligation, readPregateFile, writePregateFile } from './pregate/index';
 import type { QueueContext } from './ship-queue';
 import type { QueueFailure } from './ship-queue-gate';
+import { git } from './ship-queue-gate';
 import { prInfo, repoSlug, runView } from './ship-queue-train-github';
 
 const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));
@@ -47,6 +51,11 @@ export async function dispatchCi(ctx: QueueContext, o: DispatchCiOptions): Promi
     const prior = atHead.find(r => r.status === 'completed');
     if (prior) { lines.push(`CI_DISPATCH: ${wf} not dispatched (run ${prior.databaseId} already concluded ${prior.conclusion ?? 'unknown'} at this head)`); concluded.set(wf, prior); continue; }
     const live = atHead[0];
+    const wfPath = `.github/workflows/${wf}`;
+    if (!live && git(ctx.repoRoot, ['cat-file', '-e', `${head}^{commit}`]).ok && git(ctx.repoRoot, ['cat-file', '-e', `${ctx.remote ?? 'origin'}/${ctx.base}:${wfPath}`]).ok && !git(ctx.repoRoot, ['cat-file', '-e', `${head}:${wfPath}`]).ok) {
+      lines.push(`CI_DISPATCH: ${wf} not dispatched (${wfPath} is on ${ctx.base} but not in ${head.slice(0, 12)}; the branch predates it, so its pull_request run comes with the stamp commit)`);
+      continue;
+    }
     if (!live) {
       const d = ctx.gh(['workflow', 'run', wf, '--ref', branch]);
       if (!d.ok) return { lines, failure: { code: 'QUEUE_NOT_READY', message: `gh workflow run ${wf} --ref ${branch} failed (${(d.err ?? d.out).trim().replace(/\s+/g, ' ').slice(0, 120) || 'no output'})` } };
diff --git a/lib/ship-queue-land-lock.ts b/lib/ship-queue-land-lock.ts
new file mode 100644
index 000000000..9751e3754
--- /dev/null
+++ b/lib/ship-queue-land-lock.ts
@@ -0,0 +1,137 @@
+/**
+ * The repository land lock (docs/ship-policy.md#land, #3599): one ref, refs/notes/gstack-land, whose commit
+ * holds lock.json, shared by `gstack-ship-queue land` (owner `{ pr }`) and `train land` (owner
+ * `{ train, slot, pr }`), so a standalone land and a train slot never both publish onto one main. Every write
+ * is an exact lease on the sha read, so two writers racing one sha leave one winner. A lock is resumed only by
+ * the same owner kind, identity and journal; anything else is a takeover the caller allows (a drift repair, a
+ * train's next slot, the admitted repair train) or a --break-lock under the staleness, mid-push, drift, freeze
+ * and live-train rules.
+ */
+import { git, type QueueFailure } from './ship-queue-gate';
+
+export const LAND_LOCK_REF = 'refs/notes/gstack-land';
+export const PUSH_STALE_MS = 10 * 60_000;
+export type LandLockPhase = 'stamping' | 'pushing' | 'waiting' | 'merging' | 'drift' | 'between' | 'freeze';
+export interface LandLock { pr: string; holder: string; started_at: string; phase: LandLockPhase; journal: string; phase_at?: string; repair_pr?: string; drift_of?: string; train?: string; slot?: number }
+export type LockOwner = { pr: string; train?: undefined; slot?: undefined } | { pr: string; train: string; slot: number };
+export type LockRead = { state: 'absent'; sha: '' } | { state: 'released'; sha: string } | { state: 'held'; sha: string; lock: LandLock } | { state: 'unreadable'; sha: string; detail: string };
+type Released = { released: true; by: string; at: string };
+
+const isSha = (s: string | undefined) => /^[0-9a-f]{40,64}$/.test(s ?? '');
+/** How a lock names its owner in every message: `#<pr>`, or `train <nonce> slot <i> (#<pr>)`. */
+export const lockLabel = (lock: LandLock): string => (lock.train ? `train ${lock.train} slot ${lock.slot} (#${lock.pr})` : `#${lock.pr}`);
+/** The same owner kind, identity and journal: a resume of this run's journal, never just the same PR. */
+export const ownsLock = (lock: LandLock, owner: LockOwner, journal: string): boolean =>
+  lock.pr === owner.pr && (lock.train ?? null) === (owner.train ?? null) && (lock.slot ?? null) === (owner.slot ?? null) && lock.journal === journal;
+
+export function readLock(root: string, remote = 'origin'): LockRead {
+  const fetched = git(root, ['fetch', '-q', remote, `+${LAND_LOCK_REF}:${LAND_LOCK_REF}`]);
+  if (!fetched.ok) {
+    const listed = git(root, ['ls-remote', remote, LAND_LOCK_REF]);
+    if (listed.ok && !listed.out.trim()) git(root, ['update-ref', '-d', LAND_LOCK_REF]);
+  }
+  const sha = git(root, ['rev-parse', '--verify', '--quiet', LAND_LOCK_REF]).out;
+  if (!sha) return { state: 'absent', sha: '' };
+  const body = git(root, ['show', `${sha}:lock.json`]);
+  if (!body.ok) return { state: 'unreadable', sha, detail: 'no lock.json' };
+  let value: Partial<LandLock> & { released?: boolean };
+  try { value = JSON.parse(body.out); } catch { return { state: 'unreadable', sha, detail: 'lock.json is not JSON' }; }
+  if (value?.released === true) return { state: 'released', sha };
+  if (!/^\d+$/.test(String(value?.pr)) || typeof value.phase !== 'string' || typeof value.holder !== 'string') return { state: 'unreadable', sha, detail: 'lock.json names no PR, holder and phase' };
+  return { state: 'held', sha, lock: value as LandLock };
+}
+
+export function writeLock(root: string, expected: string, value: LandLock | Released, remote = 'origin'): { ok: boolean; sha: string } {
+  const blob = git(root, ['hash-object', '-w', '--stdin'], undefined, JSON.stringify(value, null, 2) + '\n').out;
+  const tree = git(root, ['mktree'], undefined, `100644 blob ${blob}\tlock.json\n`).out;
+  const message = 'released' in value ? `land lock released by ${value.by}` : `land lock ${value.train ? `train ${value.train} slot ${value.slot} ` : ''}#${value.pr} ${value.phase}`;
+  const commit = git(root, ['commit-tree', tree, ...(expected ? ['-p', expected] : []), '-m', message]).out;
+  if (![blob, tree, commit].every(isSha)) return { ok: false, sha: '' };
+  const push = git(root, ['push', '-q', `--force-with-lease=${LAND_LOCK_REF}:${expected}`, remote, `${commit}:${LAND_LOCK_REF}`]);
+  if (push.ok) git(root, ['update-ref', LAND_LOCK_REF, commit]);
+  return { ok: push.ok, sha: commit };
+}
+
+export interface HeldLandLock {
+  /** The lock as this run last wrote it. */
+  readonly lock: LandLock;
+  /** This owner's lock as it was before this run took it back (a resume), else null. */
+  readonly resumed: LandLock | null;
+  /** Move to a phase under the exact lease; a failure is another lander's lock (QUEUE_LAND_LOCKED) or a refused push (QUEUE_NOT_READY). */
+  set(phase: LandLockPhase, extra?: Partial<LandLock>): QueueFailure | null;
+  release(): boolean;
+}
+export interface AcquireOptions {
+  root: string; remote?: string; holder: string; owner: LockOwner; journal: string; now: () => Date;
+  /** The first phase, given this owner's own lock when this run resumes it. */
+  phase: (own: LandLock | null) => LandLockPhase;
+  breakLock?: boolean; breakTrainLock?: boolean;
+  /** A takeover the caller allows (a drift repair, a train's next slot, the admitted repair train): its LOCK: line, else null. */
+  takeover?: (lock: LandLock) => string | null;
+  /** Whether a train still lands (its record is not terminal); unknown counts as live. */
+  liveTrain?: (nonce: string) => boolean;
+  /** Fields every write of this run carries (land's drift_of), given this owner's own lock when resumed. */
+  extra?: (own: LandLock | null) => Partial<LandLock>;
+}
+
+/** Why --break-lock may not break a foreign lock, or null when it may. */
+function unbreakable(lock: LandLock, o: AcquireOptions, age: number): QueueFailure | null {
+  const label = lockLabel(lock);
+  if (lock.phase === 'drift' || lock.drift_of) return { code: 'QUEUE_LAND_DRIFT', message: `#${lock.drift_of ?? lock.pr} holds a drift lock; --break-lock never breaks it, only its repair PR's land takes it over`, fix: `gstack-ship-queue land --pr ${lock.drift_of ?? lock.pr} --repair` };
+  if (lock.phase === 'freeze') return { code: 'QUEUE_TRAIN_FROZEN', message: `${label} holds the land lock for a frozen queue; --break-lock never breaks it, only the repair train the freeze admits takes it over` };
+  if (lock.train && (o.liveTrain?.(lock.train) ?? true) && !o.breakTrainLock) return { code: 'QUEUE_LAND_LOCKED', message: `${label} is a live train run's lock (phase ${lock.phase}); --break-lock refused without --break-train-lock` };
+  if ((lock.phase === 'pushing' || lock.phase === 'merging') && age < PUSH_STALE_MS) return { code: 'QUEUE_LAND_LOCKED', message: `${label}'s holder is mid-${lock.phase === 'pushing' ? 'push' : 'merge'} (${Math.round(age / 1000)} s ago); --break-lock refused` };
+  if (lock.phase === 'between' && age < PUSH_STALE_MS) return { code: 'QUEUE_LAND_LOCKED', message: `${label} is between slots (${Math.round(age / 1000)} s ago); --break-lock refused until it is ${PUSH_STALE_MS / 60_000} minutes old` };
+  return null;
+}
+
+/**
+ * Take the land lock for `owner`: resume this owner's own lock, take over one the caller allows, or (with
+ * --break-lock, which always names the holder) break a foreign one the rules permit; then write the first
+ * phase under the exact lease on the sha read.
+ */
+export function acquireLandLock(o: AcquireOptions): { held: HeldLandLock; lines: string[] } | { failure: QueueFailure; lines: string[] } {
+  const remote = o.remote ?? 'origin';
+  const lines: string[] = [];
+  const read = readLock(o.root, remote);
+  let sha = read.sha;
+  let current: LandLock | null = read.state === 'held' ? read.lock : null;
+  const own = current && ownsLock(current, o.owner, o.journal) ? current : null;
+  if (read.state === 'unreadable') {
+    if (!o.breakLock) return { failure: { code: 'QUEUE_LAND_LOCKED', message: `the land lock at ${read.sha.slice(0, 12)} cannot be read (${read.detail}); --break-lock replaces it` }, lines };
+    lines.push(`LOCK: broke an unreadable lock at ${read.sha.slice(0, 12)} (${read.detail})`);
+  } else if (current && !own) {
+    const allowed = o.takeover?.(current) ?? null;
+    if (allowed) lines.push(allowed);
+    else {
+      const age = o.now().getTime() - Date.parse(current.phase_at ?? current.started_at);
+      if (!o.breakLock) return { failure: { code: 'QUEUE_LAND_LOCKED', message: `${lockLabel(current)} holds the land lock (${current.holder}, phase ${current.phase}, since ${current.started_at})` }, lines };
+      lines.push(`LOCK_HOLDER: ${lockLabel(current)} holder=${current.holder} phase=${current.phase} since=${current.started_at}`);
+      const refusal = unbreakable(current, o, age);
+      if (refusal) return { failure: refusal, lines };
+      lines.push(`LOCK: broke ${lockLabel(current)}'s lock (${current.holder}, phase ${current.phase})`);
+    }
+  }
+  const startedAt = own?.started_at ?? o.now().toISOString();
+  const always = o.extra?.(own) ?? {};
+  const set = (phase: LandLockPhase, extra: Partial<LandLock> = {}): QueueFailure | null => {
+    const next: LandLock = { pr: o.owner.pr, ...(o.owner.train ? { train: o.owner.train, slot: o.owner.slot } : {}), holder: o.holder, started_at: startedAt, phase, journal: o.journal, phase_at: o.now().toISOString(), ...always, ...extra };
+    const w = writeLock(o.root, sha, next, remote);
+    if (!w.ok) {
+      return readLock(o.root, remote).sha === sha
+        ? { code: 'QUEUE_NOT_READY', message: `the land lock push to ${remote} failed and the lock there is unchanged; nothing was pushed` }
+        : { code: 'QUEUE_LAND_LOCKED', message: 'the land lock moved under this run (another lander took it)' };
+    }
+    sha = w.sha; current = next;
+    return null;
+  };
+  const failed = set(o.phase(own));
+  if (failed) return { failure: failed, lines };
+  const held: HeldLandLock = {
+    get lock() { return current!; },
+    resumed: own,
+    set,
+    release: () => writeLock(o.root, sha, { released: true, by: o.holder, at: o.now().toISOString() }, remote).ok,
+  };
+  return { held, lines };
+}
diff --git a/lib/ship-queue-land.ts b/lib/ship-queue-land.ts
index ee71af2f6..dd8d22d31 100644
--- a/lib/ship-queue-land.ts
+++ b/lib/ship-queue-land.ts
@@ -17,15 +17,15 @@ import * as path from 'node:path';
 import { mergeChangelogs, parseChangelog } from './changelog-check';
 import { fragmentSlug, readFragments } from './changelog-fragments';
 import { restamp, versionAtRef } from './restamp';
+import { acquireLandLock, lockLabel, readLock, writeLock, type LandLockPhase } from './ship-queue-land-lock';
 import { matchesAny, type ShipPolicy } from './ship-policy';
 import { ciAtHead, loadBasePolicy, type QueueContext, type StepOutput } from './ship-queue';
 import { QUEUE_DIR_REL, git, writeJsonAtomic, type QueueFailure } from './ship-queue-gate';
 import { bindShippedReceipt } from './ship-receipt-depth';
-import { loadReady, rebuildFromNotes, repoIdentity } from './ship-queue-train-record';
+import { TERMINAL_STATES, freezeLockCleared, loadReady, loadTrain, rebuildFromNotes, repoIdentity } from './ship-queue-train-record';
 
-export const LAND_LOCK_REF = 'refs/notes/gstack-land';
+export { LAND_LOCK_REF } from './ship-queue-land-lock';
 export const MAX_RESTAMPS = 2;
-const PUSH_STALE_MS = 10 * 60_000;
 const MANIFESTS = ['package.json', 'package-lock.json', 'npm-shrinkwrap.json'];
 const isSha = (s: string | undefined) => /^[0-9a-f]{40,64}$/.test(s ?? '');
 /** The first path segment of `rel` inside `wt` that is a symlink, or null: land writes only inside the checkout. */
@@ -49,35 +49,13 @@ export interface LandJournal {
   drift_main?: string; repair_pr?: string;
   phase: 'locked' | 'stamped' | 'pushed' | 'merged' | 'landed' | 'drift';
 }
-export interface LandLock { pr: string; holder: string; started_at: string; phase: 'stamping' | 'pushing' | 'waiting' | 'merging' | 'drift'; journal: string; phase_at?: string; repair_pr?: string; drift_of?: string }
-export interface LandOptions { pr: string; repair?: boolean; dryRun?: boolean; noWait?: boolean; breakLock?: boolean; allowRepoCommands?: boolean; waitTimeoutMin?: number; now?: () => Date; holder?: string }
+export interface LandOptions { pr: string; repair?: boolean; dryRun?: boolean; noWait?: boolean; breakLock?: boolean; breakTrainLock?: boolean; allowRepoCommands?: boolean; waitTimeoutMin?: number; now?: () => Date; holder?: string }
 
 const fail = (lines: string[], failure: QueueFailure, run: string): StepOutput => ({ ok: false, lines, failure, run });
 export const landJournalRel = (pr: string) => `${QUEUE_DIR_REL}/land/${pr}.json`;
 
 function readJson<T>(file: string): T | null { try { return JSON.parse(fs.readFileSync(file, 'utf8')) as T; } catch { return null; } }
 
-/** The remote land lock: a ref whose commit holds lock.json, or a released marker. Updated only by exact lease. */
-function readLock(root: string): { sha: string; lock: LandLock | null } {
-  git(root, ['fetch', '-q', 'origin', `+${LAND_LOCK_REF}:${LAND_LOCK_REF}`]);
-  const sha = git(root, ['rev-parse', '--verify', '--quiet', LAND_LOCK_REF]).out;
-  if (!sha) return { sha: '', lock: null };
-  const body = git(root, ['show', `${sha}:lock.json`]);
-  let lock: LandLock | { released: true } | null = null;
-  try { lock = body.ok ? JSON.parse(body.out) : null; } catch { lock = null; }
-  return { sha, lock: lock && 'pr' in lock && /^\d+$/.test(String(lock.pr)) ? lock : null };
-}
-
-function writeLock(root: string, expected: string, value: LandLock | { released: true; by: string; at: string }): { ok: boolean; sha: string } {
-  const blob = git(root, ['hash-object', '-w', '--stdin'], undefined, JSON.stringify(value, null, 2) + '\n').out;
-  const tree = git(root, ['mktree'], undefined, `100644 blob ${blob}\tlock.json\n`).out;
-  const commit = git(root, ['commit-tree', tree, ...(expected ? ['-p', expected] : []), '-m', 'released' in value ? `land lock released by ${value.by}` : `land lock #${value.pr} ${value.phase}`]).out;
-  if (![blob, tree, commit].every(isSha)) return { ok: false, sha: '' };
-  const push = git(root, ['push', '-q', `--force-with-lease=${LAND_LOCK_REF}:${expected}`, 'origin', `${commit}:${LAND_LOCK_REF}`]);
-  if (push.ok) git(root, ['update-ref', LAND_LOCK_REF, commit]);
-  return { ok: push.ok, sha: commit };
-}
-
 /**
  * Release-version conflicts only: the version file and release outputs take the base's side, the
  * CHANGELOG merges by section (mergeChangelogs), and a manifest or npm lockfile is re-merged with
@@ -328,7 +306,7 @@ function repair(ctx: QueueContext, policy: ShipPolicy, j: LandJournal | null, fi
     if (!n) return fail(lines, { code: 'QUEUE_NOT_READY', message: `gh pr create failed: ${(pr.err ?? pr.out).trim().slice(0, 160)}` }, run);
     j.repair_pr = n; writeJsonAtomic(file, j);
     const held = readLock(root);
-    if (held.lock?.pr === j.pr && held.lock.phase === 'drift') writeLock(root, held.sha, { ...held.lock, repair_pr: n });
+    if (held.state === 'held' && !held.lock.train && held.lock.pr === j.pr && held.lock.phase === 'drift') writeLock(root, held.sha, { ...held.lock, repair_pr: n });
     return { ok: true, run, lines: [...lines, `REPAIR_PR: #${n} ${branch} ${pushed}`, `NEXT: run /ship on #${n}, then gstack-ship-queue land --pr ${n} (it takes over #${j.pr}'s drift lock and releases it)`] };
   } finally {
     git(root, ['worktree', 'remove', '--force', wt]);
@@ -379,28 +357,31 @@ export function land(ctx: QueueContext, o: LandOptions): StepOutput {
     return { ok: true, run, lines: [...lines, ...s.lines, `STAMP_VERSION: ${s.version}`, `STAMP_TREE: ${s.tree}`, 'DRY-RUN: nothing locked, pushed or merged'] };
   }
 
-  let { sha: lockSha, lock } = readLock(root);
-  const drifted = lock && lock.pr !== o.pr && lock.phase === 'drift' ? lock.pr : null;
-  const repairOf = drifted ? readJson<LandJournal>(path.join(root, landJournalRel(drifted))) : null;
-  const driftOf = drifted && (lock!.repair_pr === o.pr || repairOf?.repair_pr === o.pr) ? drifted : lock?.pr === o.pr ? lock.drift_of : undefined;
-  if (drifted && driftOf) lines.push(`LOCK: taking over #${drifted}'s drift lock for its repair`);
-  else if (lock && lock.pr !== o.pr) {
-    const age = now().getTime() - Date.parse(lock.phase_at ?? lock.started_at);
-    if (!o.breakLock) return fail(lines, { code: 'QUEUE_LAND_LOCKED', message: `#${lock.pr} holds the land lock (${lock.holder}, phase ${lock.phase}, since ${lock.started_at})` }, run);
-    if (lock.phase === 'drift' || lock.drift_of) return fail(lines, { code: 'QUEUE_LAND_DRIFT', message: `#${lock.drift_of ?? lock.pr} holds a drift lock; --break-lock never breaks it, only its repair PR's land takes it over`, fix: `gstack-ship-queue land --pr ${lock.drift_of ?? lock.pr} --repair` }, run);
-    if ((lock.phase === 'pushing' || lock.phase === 'merging') && age < PUSH_STALE_MS) return fail(lines, { code: 'QUEUE_LAND_LOCKED', message: `#${lock.pr}'s holder is mid-${lock.phase === 'pushing' ? 'push' : 'merge'} (${Math.round(age / 1000)} s ago); --break-lock refused` }, run);
-    lines.push(`LOCK: broke #${lock.pr}'s lock (${lock.holder}, phase ${lock.phase})`);
-  }
-  const setLock = (phase: LandLock['phase']): QueueFailure | null => {
-    const next: LandLock = { pr: o.pr, holder, started_at: lock?.pr === o.pr ? lock.started_at : now().toISOString(), phase, journal: run, phase_at: now().toISOString(), ...(driftOf ? { drift_of: driftOf } : {}) };
-    const w = writeLock(root, lockSha, next);
-    if (!w.ok) return { code: 'QUEUE_LAND_LOCKED', message: 'the land lock moved under this run (another lander took it)' };
-    lockSha = w.sha; lock = next;
-    return null;
-  };
+  let driftOf: string | undefined;
+  const got = acquireLandLock({
+    root, holder, owner: { pr: o.pr }, journal: run, now, breakLock: o.breakLock, breakTrainLock: o.breakTrainLock,
+    takeover: held => {
+      if (held.phase === 'freeze') {
+        const cleared = freezeLockCleared(root, ctx.remote ?? 'origin', keys, held);
+        return cleared ? `LOCK: taking over ${lockLabel(held)}'s freeze lock; that freeze was cleared at ${cleared}` : null;
+      }
+      if (held.train || held.phase !== 'drift' || (held.repair_pr !== o.pr && readJson<LandJournal>(path.join(root, landJournalRel(held.pr)))?.repair_pr !== o.pr)) return null;
+      driftOf = held.pr;
+      return `LOCK: taking over #${held.pr}'s drift lock for its repair`;
+    },
+    liveTrain: nonce => {
+      if (!loadTrain(nonce)) rebuildFromNotes(root, ctx.remote ?? 'origin');
+      const t = loadTrain(nonce);
+      return !t || !TERMINAL_STATES.includes(t.state);
+    },
+    extra: own => { driftOf ??= own?.drift_of; return driftOf ? { drift_of: driftOf } : {}; },
+    phase: () => (j?.phase === 'pushed' ? 'waiting' : j?.phase === 'merged' ? 'merging' : 'stamping'),
+  });
+  lines.push(...got.lines);
+  if ('failure' in got) return fail(lines, got.failure, run);
+  const lock = got.held;
+  const setLock = (phase: LandLockPhase) => lock.set(phase);
   const save = () => writeJsonAtomic(file, j);
-  const failed = setLock(j?.phase === 'pushed' ? 'waiting' : j?.phase === 'merged' ? 'merging' : 'stamping');
-  if (failed) return fail(lines, failed, run);
   if (!j) { j = { schema_version: 1, pr: o.pr, branch: info.headRefName, reviewed_pin: pin, last_pushed_head: recovered ? info.headRefOid : null, stamp_commit: null, stamp_tree: null, base_sha: null, version: null, date: null, restamps: 0, phase: 'locked' }; save(); }
 
   for (;;) {
@@ -409,7 +390,7 @@ export function land(ctx: QueueContext, o: LandOptions): StepOutput {
     if (j.phase === 'pushed' && j.base_sha !== baseNow) {
       if (j.restamps >= MAX_RESTAMPS) {
         j.restamps = 0; save();
-        if (!driftOf) writeLock(root, lockSha, { released: true, by: holder, at: now().toISOString() });
+        if (!driftOf) lock.release();
         return fail(lines, { code: 'QUEUE_LAND_BASE_BUSY', message: `origin/${ctx.base} moved during CI ${MAX_RESTAMPS + 1} times; the lock is released and a later run restamps from the pin` }, run);
       }
       lines.push(`BASE_MOVED: ${j.base_sha?.slice(0, 12)} -> ${baseNow.slice(0, 12)}; restamping`);
@@ -419,7 +400,7 @@ export function land(ctx: QueueContext, o: LandOptions): StepOutput {
       const s = buildStamp(ctx, policy, { pin, baseSha: baseNow, pr: o.pr, title: info.title, allowRepoCommands: !!o.allowRepoCommands, now: j.date ? new Date(`${j.date}T12:00:00Z`) : now() });
       if ('code' in s) {
         if (driftOf) setLock('stamping');
-        else writeLock(root, lockSha, { released: true, by: holder, at: now().toISOString() });
+        else lock.release();
         return fail([...lines], s, run);
       }
       lines.push(...s.lines);
@@ -471,8 +452,8 @@ export function land(ctx: QueueContext, o: LandOptions): StepOutput {
       j.phase = 'landed'; save();
       const driftJournal = driftOf ? readJson<LandJournal>(path.join(root, landJournalRel(driftOf))) : null;
       if (driftOf && driftJournal) writeJsonAtomic(path.join(root, landJournalRel(driftOf)), { ...driftJournal, phase: 'landed' });
-      const rel = writeLock(root, lockSha, { released: true, by: holder, at: now().toISOString() });
-      return { ok: true, run, lines: [...lines, `MERGED: #${o.pr} as ${main} (${j.version})`, `LANDED: origin/${ctx.base} tree ${tree} equals the stamped tree`, `LOCK: ${rel.ok ? 'released' : 'release push failed (the next land takes it over)'}`] };
+      const released = lock.release();
+      return { ok: true, run, lines: [...lines, `MERGED: #${o.pr} as ${main} (${j.version})`, `LANDED: origin/${ctx.base} tree ${tree} equals the stamped tree`, `LOCK: ${released ? 'released' : 'release push failed (the next land takes it over)'}`] };
     }
     if (j.phase === 'drift') return fail(lines, { code: 'QUEUE_LAND_DRIFT', message: 'a previous land of this PR found drift', fix: `gstack-ship-queue land --pr ${o.pr} --repair` }, run);
   }
diff --git a/lib/ship-queue-train-cli.ts b/lib/ship-queue-train-cli.ts
index fe561b3c9..dcbd2431d 100644
--- a/lib/ship-queue-train-cli.ts
+++ b/lib/ship-queue-train-cli.ts
@@ -36,7 +36,7 @@ export const TRAIN_HELP = `  train build --prs <n>@<sha>[,...] [--order <n>,...]
   train status [--train <nonce>]           never spends: rebuild records from refs/notes/gstack-trains, reconcile
                                            unconfirmed dispatches by nonce
   train verdict --train <nonce>            read the gate run and its record: GREEN, RED, INCOMPLETE or PENDING
-  train land --train <nonce> --pr <n> [--no-wait] [--timeout <min>]
+  train land --train <nonce> --pr <n> [--no-wait] [--timeout <min>] [--break-lock [--break-train-lock]]
                                            publish slot n's prefix (stamped S_i, else gated T_i): update mode commits its tree on
                                            [pin, main], pushes under the pin's lease, waits for checks and merges; direct mode
                                            (trains with gates, no strict protection, a green pin) runs gh pr merge
@@ -156,7 +156,7 @@ export async function trainMain(ctx: QueueContext, args: string[]): Promise<numb
     if (!pr || !/^\d+$/.test(pr)) return usage('train land needs --pr <number>');
     const timeout = positive(flag(rest, '--timeout'), 60);
     if (Number.isNaN(timeout)) return usage('--timeout needs minutes');
-    return guarded('train land', async () => (await import('./ship-queue-train-land')).trainLand(ctx, { train: nonce, pr, noWait: rest.includes('--no-wait'), timeoutMin: timeout }));
+    return guarded('train land', async () => (await import('./ship-queue-train-land')).trainLand(ctx, { train: nonce, pr, noWait: rest.includes('--no-wait'), timeoutMin: timeout, breakLock: rest.includes('--break-lock'), breakTrainLock: rest.includes('--break-train-lock') }));
   }
   if (sub === 'rebuild') return guarded('train rebuild', () => trainRebuild(ctx, { train: nonce, infra: rest.includes('--infra') }));
   if (sub === 'bisect') {
@@ -174,7 +174,7 @@ export async function readyMain(ctx: QueueContext, args: string[], base: { pr: s
   if (args.includes('--broad') && !screen) return usage('--broad selects the screen policy; it needs --screen');
   const dispatchCi = flag(args, '--dispatch-ci');
   const workflows = dispatchCi === undefined ? [] : dispatchCi.split(',').map(s => s.trim()).filter(Boolean);
-  if (dispatchCi !== undefined && (!workflows.length || workflows.some(w => !/^[\w.-]+\.ya?ml$/.test(w)))) return usage('--dispatch-ci names workflow files under .github/workflows, comma-separated (free-tests.yml,windows-free-tests.yml)');
+  if (dispatchCi !== undefined && (!workflows.length || workflows.some(w => !/^[\w.-]+\.ya?ml$/.test(w)))) return usage('--dispatch-ci names workflow files under .github/workflows, comma-separated (free-tests.yml,windows-smoke.yml)');
   const timeoutSec = positive(flag(args, '--timeout'), 2700);
   if (!Number.isFinite(timeoutSec)) return usage('--timeout needs a positive number of seconds');
   const fixer = flag(args, '--fixer');
diff --git a/lib/ship-queue-train-gate.ts b/lib/ship-queue-train-gate.ts
index 6b7e3056d..a7867cb1d 100644
--- a/lib/ship-queue-train-gate.ts
+++ b/lib/ship-queue-train-gate.ts
@@ -11,7 +11,7 @@
  *   a second red is real; both attempts' jobs are kept.
  * - `command`: a clean detached checkout of the prefix head runs on a Ubicloud VM through
  *   scripts/ubicloud/ubi-runner.sh, forwarding only `pass_env`; the VM's `git write-tree` must equal the prefix
- *   tree and exit 0 is GREEN. One spend cap covers every run of the train.
+ *   tree and exit 0 is GREEN. One spend cap per command gate covers that gate's runs across every prefix of the train.
  *
  * The verdict is per prefix; the train is GREEN when every prefix is, and otherwise the first red prefix after a
  * green one names the culprit (classifyPrefixes). Slot 1's READY may declare FIXES_BASE_RED: T0 is then allowed
@@ -366,7 +366,7 @@ async function settleCommand(env: TrainEnv, t: TrainRecord, a: AttemptRecord, g:
   lines.push(`COMMAND: gate ${a.gate} on T${p.index} ${r.outcome} (${r.detail})`);
 }
 
-/** Run every command unit that has no finished attempt, all prefixes in parallel, under the train's one spend cap. */
+/** Run every command unit that has no finished attempt, all prefixes in parallel, under one spend cap per command gate across every prefix of the train. */
 async function runCommands(env: TrainEnv, t: TrainRecord, units: GateUnit[], lines: string[]): Promise<QueueFailure | null> {
   const commands = units.filter(u => u.workflow === 'command');
   if (!commands.length) return null;
diff --git a/lib/ship-queue-train-land.ts b/lib/ship-queue-train-land.ts
index 0ed0c86a4..1a7d42c85 100644
--- a/lib/ship-queue-train-land.ts
+++ b/lib/ship-queue-train-land.ts
@@ -17,16 +17,24 @@
  * Either way main's tree must be the prefix after the merge; any other main is the freeze path
  * (QUEUE_TRAIN_TREE_MISMATCH), as for verify. Fork heads are refused. Journaled beside the train record; a rerun
  * resumes: open at the pin, open at the update commit, or merged (confirmed through main's tree).
+ *
+ * Train land takes the shared land lock (lib/ship-queue-land-lock.ts, #3599) as `train <nonce> slot <i> (#pr)`
+ * before its first main read, so no standalone land publishes beside a slot. After a slot merges with landable
+ * slots left, the lock stays in a train-owned `between` phase that the same train's next slot takes over; a stop
+ * that freezes the queue leaves it in a `freeze` phase only the admitted repair train takes over. The release is
+ * decided once, at the trainLand boundary (settleLock).
  */
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
 import { ciAtHead, type QueueContext } from './ship-queue';
-import { git, writeJsonAtomic } from './ship-queue-gate';
+import { git, writeJsonAtomic, type QueueFailure } from './ship-queue-gate';
+import { acquireLandLock, lockLabel, type HeldLandLock, type LandLock, type LandLockPhase } from './ship-queue-land-lock';
 import { waitChecks } from './ship-queue-land';
 import { verifyPostMerge } from './ship-queue-post-merge';
 import { bindTrainReceipt } from './ship-queue-train-gate';
 import { checkRun, prInfo, type PrInfo } from './ship-queue-train-github';
-import { activeFreeze, attemptsOf, nowIso, trainFile, type LandingRecord, type TrainRecord } from './ship-queue-train-record';
+import { TERMINAL_STATES, activeFreeze, attemptsOf, freezeLockCleared, nowIso, trainFile, type LandingRecord, type TrainRecord } from './ship-queue-train-record';
 import { fetchBase, fetchTrainBranch, findTrain, frozenLines, nextFor, outFailed, outPending, outRefused, save, trainEnv, type TrainEnv, type TrainOut } from './ship-queue-train';
 import { confirmMerged, stopped } from './ship-queue-train-verify';
 
@@ -36,7 +44,10 @@ const STAMP_IDENTITY = { GIT_AUTHOR_NAME: 'gstack-ship-queue', GIT_AUTHOR_EMAIL:
 const isSha = (s: string) => /^[0-9a-f]{40,64}$/.test(s);
 interface SlotJournal { schema_version: 1; pr: string; pin: string; stamp_commit: string; base: string }
 interface Link { index: number; commit: string; tree: string; pin: string }
-interface Slot { env: TrainEnv; t: TrainRecord; i: number; pin: string; target: Link & { version?: string }; pred: Link; run: string; rerun: string; lines: string[] }
+interface Slot { env: TrainEnv; t: TrainRecord; i: number; pin: string; target: Link & { version?: string }; pred: Link; run: string; rerun: string; lines: string[]; lock: { held: HeldLandLock | null; effect: boolean } }
+
+/** Move this slot's land lock to a phase; a failure means another lander took it, so nothing remote may follow. */
+const lockPhase = (s: Slot, phase: LandLockPhase): QueueFailure | null => s.lock.held?.set(phase) ?? null;
 
 /** The checks train land requires on the landing commit: changelog_fragments.required_checks, else train.land.required_checks. */
 export const landRequiredChecks = (env: TrainEnv): string[] => env.policy.policy.changelog_fragments?.required_checks ?? env.train.land?.required_checks ?? [];
@@ -131,6 +142,9 @@ async function mergeAt(ctx: QueueContext, s: Slot, head: string, base: string):
   const target = prInfo(ctx, pr);
   if ('error' in target) return outPending({ code: 'QUEUE_PROOF_MISSING', message: target.error }, s.lines, s.rerun, s.run);
   if (target.baseRefName && target.baseRefName !== ctx.base) return retargeted(s, target.baseRefName, ctx.base);
+  const moved = lockPhase(s, 'merging');
+  if (moved) return outFailed(moved, s.lines, s.rerun, s.run);
+  s.lock.effect = true;
   const m = ctx.gh(['pr', 'merge', pr, `--${method}`, '--match-head-commit', head]);
   if (!m.ok) return outFailed({ code: 'QUEUE_NOT_READY', message: `gh pr merge refused: ${(m.err ?? m.out).trim().slice(0, 200)}` }, s.lines, s.rerun, s.run);
   main = mainNow(ctx, s.env);
@@ -189,6 +203,8 @@ async function landUpdate(ctx: QueueContext, s: Slot, info: PrInfo, base: string
     writeJsonAtomic(file, j);
     recordLanding(s, 'update', commit, base);
     const pushed = info.headRefOid !== commit;
+    const pushing = lockPhase(s, 'pushing');
+    if (pushing) return outFailed(pushing, s.lines, s.rerun, s.run);
     if (pushed) {
       const push = git(root, ['push', '-q', `--force-with-lease=refs/heads/${info.headRefName}:${info.headRefOid}`, env.remote, `${commit}:refs/heads/${info.headRefName}`]);
       if (!push.ok) {
@@ -198,6 +214,9 @@ async function landUpdate(ctx: QueueContext, s: Slot, info: PrInfo, base: string
         if (!remote.ok || now !== commit) return outFailed({ code: 'QUEUE_NOT_READY', message: `the ${what} push failed and ${info.headRefName} still reads ${remote.ok ? info.headRefOid.slice(0, 12) : 'unknown'}: ${push.err.split('\n')[0]}` }, s.lines, s.rerun, s.run);
       }
     }
+    s.lock.effect = true;
+    const waiting = lockPhase(s, 'waiting');
+    if (waiting) return outFailed(waiting, s.lines, s.rerun, s.run);
     s.lines.push(`${pushed ? 'PUSHED' : 'RESUMED'}: ${commit} (tree ${label(s)}, parents [pin, main ${base.slice(0, 12)}]) ${pushed ? 'to' : 'is already the head of'} ${info.headRefName}`);
     if (o.noWait && pushed) return outPending({ code: 'QUEUE_NOT_READY', message: `checks run on the ${what} commit ${commit.slice(0, 12)}` }, s.lines, `gstack-pr-wait ${pr} --until green && ${s.rerun}`, s.run);
     if (!o.noWait) waitChecks(ctx, commit, o.timeoutMin ?? 60);
@@ -220,7 +239,43 @@ async function landUpdate(ctx: QueueContext, s: Slot, info: PrInfo, base: string
 
 const retargeted = (s: Slot, b: string, base: string) => outRefused({ code: 'QUEUE_NOT_READY', message: `#${s.t.slots[s.i]!.pr} targets ${b}, not ${base}; train land merges only PRs on the base the train built` }, s.lines, `retarget #${s.t.slots[s.i]!.pr} to ${base}, then ${s.rerun}`, s.run);
 
-export async function trainLand(ctx: QueueContext, o: { train: string; pr: string; noWait?: boolean; timeoutMin?: number }): Promise<TrainOut> {
+interface TrainLandOptions { train: string; pr: string; noWait?: boolean; timeoutMin?: number; breakLock?: boolean; breakTrainLock?: boolean }
+
+/**
+ * The takeovers train land allows: its own train's between-slots lock, the freeze lock when the freeze admits this
+ * train as its repair (or, with the notes ref fetched, a freeze record cleared after the lock was written: absence
+ * is never proof), and a lock whose train record is terminal.
+ */
+function trainTakeover(env: TrainEnv, t: TrainRecord, i: number, lock: LandLock): string | null {
+  if (lock.train === t.nonce && lock.phase === 'between') return `LOCK: train ${t.nonce} slot ${i + 1} takes over its train's between-slots lock (from slot ${lock.slot})`;
+  if (lock.phase === 'freeze') {
+    const cleared = freezeLockCleared(env.ctx.repoRoot, env.remote, env.repo.keys, lock);
+    if (activeFreeze(env.repo.keys)?.repair?.train === t.nonce) return `LOCK: repair train ${t.nonce} takes over the freeze lock of ${lockLabel(lock)}`;
+    return cleared ? `LOCK: train ${t.nonce} takes over ${lockLabel(lock)}'s freeze lock; that freeze was cleared at ${cleared}` : null;
+  }
+  if (!lock.train || lock.train === t.nonce) return null;
+  const other = findTrain(env, lock.train);
+  return other && TERMINAL_STATES.includes(other.state) ? `LOCK: train ${t.nonce} takes over ${lockLabel(lock)}'s lock; that train is ${other.state}` : null;
+}
+
+/**
+ * The one release point: a freeze keeps the lock in `freeze`; once a slot merged, a train still merging keeps it
+ * `between` (a merged slot, a pending wait or a refusal before this slot's push); a failure after a remote effect
+ * keeps its phase for the resume; anything else releases it.
+ */
+function settleLock(s: Slot, out: TrainOut): TrainOut {
+  const held = s.lock.held!;
+  const midway = s.t.state === 'merging' && s.t.merged.length > 0;
+  const keep = (phase: LandLockPhase, line: string) => { const failed = held.set(phase); return failed ? `LOCK: ${phase} could not be written (${failed.message})` : line; };
+  let line: string;
+  if (activeFreeze(s.env.repo.keys)) line = keep('freeze', 'LOCK: freeze (kept for the repair train the freeze admits; --break-lock never breaks it)');
+  else if (midway && (out.exit === 0 || !s.lock.effect)) line = keep('between', `LOCK: between (train ${s.t.nonce} keeps the land lock for its next slot)`);
+  else if (out.exit !== 0 && s.lock.effect) line = `LOCK: kept in phase ${held.lock.phase}; ${s.rerun} resumes it`;
+  else line = held.release() ? 'LOCK: released' : 'LOCK: release push failed (the next lander takes it over)';
+  return { ...out, lines: [...out.lines, line] };
+}
+
+export async function trainLand(ctx: QueueContext, o: TrainLandOptions): Promise<TrainOut> {
   const fetchErr = fetchBase(ctx);
   const env = trainEnv(ctx);
   if ('code' in env) return outRefused(env, [], 'none', 'none');
@@ -241,8 +296,24 @@ export async function trainLand(ctx: QueueContext, o: { train: string; pr: strin
   if (!chain) return outRefused({ code: 'QUEUE_PROOF_MISSING', message: `the record's T0 and ${t.stamped ? 'S' : 'T'}1..${t.stamped ? 'S' : 'T'}${k} (with each slot's pin as second parent) are not the first-parent chain of the gated head ${t.head.slice(0, 12)}` }, [], `${Q} train status --train ${t.nonce}`, run);
   const pin = t.slots[i]!.head;
   const rerun = `${Q} train land --train ${t.nonce} --pr ${o.pr}`;
-  const s: Slot = { env, t, i, pin, target: { ...chain[i + 1]!, version: t.stamped?.[i]?.version }, pred: chain[i]!, run, rerun, lines: [] };
+  const s: Slot = { env, t, i, pin, target: { ...chain[i + 1]!, version: t.stamped?.[i]?.version }, pred: chain[i]!, run, rerun, lines: [], lock: { held: null, effect: false } };
   s.lines.push(`TRAIN_LAND: ${t.nonce} slot ${i + 1}/${k} #${o.pr} pin ${pin} -> ${label(s)}${s.target.version ? ` v${s.target.version}` : ''} tree ${s.target.tree}`);
+  const got = acquireLandLock({
+    root: ctx.repoRoot, remote: env.remote, holder: `${os.hostname()}:${process.pid}`, owner: { train: t.nonce, slot: i + 1, pr: o.pr }, journal: `train/${t.nonce}/slot-${i + 1}`,
+    now: () => new Date(), breakLock: o.breakLock, breakTrainLock: o.breakTrainLock,
+    phase: own => (own && ['pushing', 'waiting', 'merging'].includes(own.phase) ? own.phase : 'stamping'),
+    takeover: lock => trainTakeover(env, t, i, lock),
+    liveTrain: nonce => { const other = findTrain(env, nonce); return !other || !TERMINAL_STATES.includes(other.state); },
+  });
+  s.lines.push(...got.lines);
+  if ('failure' in got) return outRefused(got.failure, s.lines, `wait for the holder named above, then ${rerun}`, run);
+  s.lock = { held: got.held, effect: !!got.held.resumed && ['pushing', 'waiting', 'merging'].includes(got.held.resumed.phase) };
+  return settleLock(s, await landSlot(ctx, s, chain, o));
+}
+
+/** Train land under the lock: main read, confirmation, post-merge checks of the previous slot, then direct or update. */
+async function landSlot(ctx: QueueContext, s: Slot, chain: Link[], o: TrainLandOptions): Promise<TrainOut> {
+  const { env, t, i, pin, run, rerun } = s;
   const main = mainNow(ctx, env);
   if ('error' in main) return outRefused({ code: 'QUEUE_PROOF_MISSING', message: main.error }, s.lines, rerun, run);
   if (main.tree === s.target.tree) return confirmed(s, main.sha, `main: ${main.sha} is ${label(s)} exactly`);
diff --git a/lib/ship-queue-train-record.ts b/lib/ship-queue-train-record.ts
index a35811f99..5d8f7df97 100644
--- a/lib/ship-queue-train-record.ts
+++ b/lib/ship-queue-train-record.ts
@@ -187,6 +187,15 @@ const firstOf = <T>(k: RepoKeys, read: (key: string) => T | null): T | null => {
 export const loadFreeze = (repoKeys: RepoKeys) => firstOf(repoKeys, key => readJson<FreezeRecord>(freezePath(key), 'freeze'));
 export const loadReady = (repoKeys: RepoKeys, pr: string, head: string) => firstOf(repoKeys, key => readJson<ReadyReceipt>(readyPath(key, pr, head), 'ready'));
 export const activeFreeze = (repoKeys: RepoKeys): FreezeRecord | null => firstOf(repoKeys, key => { const f = readJson<FreezeRecord>(freezePath(key), 'freeze'); return f && !f.cleared_at ? f : null; });
+/**
+ * When a freeze-phase land lock's freeze is over, the cleared_at that proves it: the notes ref fetched, no freeze
+ * active, and the last freeze cleared at or after the lock was written. Absence of a record is never proof.
+ */
+export function freezeLockCleared(repoRoot: string, remote: string, repoKeys: RepoKeys, lock: { phase_at?: string; started_at: string }): string | null {
+  if (!rebuildFromNotes(repoRoot, remote).fetched || activeFreeze(repoKeys)) return null;
+  const last = loadFreeze(repoKeys);
+  return last?.cleared_at && Date.parse(last.cleared_at) >= Date.parse(lock.phase_at ?? lock.started_at) ? last.cleared_at : null;
+}
 
 export const loadWave = (nonce: string) => (/^[A-Za-z0-9._-]{1,128}$/.test(nonce) ? readJson<WaveRecord>(wavePath(nonce), 'wave') : null);
 /** Every wave of this repository, newest first. */
@@ -325,13 +334,13 @@ export function forgetNotes(repoRoot: string, names: string[], remote = 'origin'
 }
 
 /** Rebuild local records from the notes ref: a note whose record is missing locally, or newer than the local copy, is written. */
-export function rebuildFromNotes(repoRoot: string, remote = 'origin'): { restored: number; read: number; detail: string } {
+export function rebuildFromNotes(repoRoot: string, remote = 'origin'): { restored: number; read: number; detail: string; fetched: boolean } {
   const f = fetchNotes(repoRoot, remote);
   const list = git(repoRoot, ['notes', `--ref=${NOTES_REF}`, 'list']);
-  if (!list.ok || !list.out.trim()) return { restored: 0, read: 0, detail: f.detail };
+  if (!list.ok || !list.out.trim()) return { restored: 0, read: 0, detail: f.detail, fetched: f.ok };
   const records = list.out.split('\n').map(l => l.split(' ')[0]!).filter(Boolean)
     .map(blob => parseNote(git(repoRoot, ['cat-file', 'blob', blob]).out)).filter((r): r is AnyRecord => !!r);
   const fresh = records.filter(newerOrMissing);
   for (const r of fresh) writeJsonAtomic(recordPath(r), r);
-  return { restored: fresh.length, read: records.length, detail: f.detail };
+  return { restored: fresh.length, read: records.length, detail: f.detail, fetched: f.ok };
 }
diff --git a/lib/ship-queue-train-verify.ts b/lib/ship-queue-train-verify.ts
index a67bc7d22..5c7981e00 100644
--- a/lib/ship-queue-train-verify.ts
+++ b/lib/ship-queue-train-verify.ts
@@ -6,8 +6,9 @@
  * head, or at a head whose tree is the slot's prefix after it modulo stamps
  * (from slot 2 on, the lane merges main into its pin so GitHub can merge it),
  * with main's tree equal to the prefix before the PR (pre-merge:
- * MERGE_CONDITION) or after it (post-merge confirmation), modulo stamps
- * (lib/tree-receipt.ts). When a train stops partway (a mismatch or a moved
+ * MERGE_CONDITION, once the head carries its own stamp above main's version,
+ * #3531) or after it (post-merge confirmation, once GitHub reports the PR
+ * MERGED), modulo stamps (lib/tree-receipt.ts). When a train stops partway (a mismatch or a moved
  * head after earlier slots merged) the queue freezes: the freeze is written
  * locally and to the notes ref first, then the backstop gate is dispatched on
  * main's published prefix at once. One repair train is admitted under the
@@ -25,6 +26,9 @@ import {
 } from './ship-queue-train';
 import { mergeChangelogs, ownEntryAboveMain, parseChangelog } from './changelog-check';
 import { buildReceipt } from './tree-receipt';
+import { versionAtRef } from './restamp';
+import { cmpVersion, parseVersion } from './version-source';
+import { readLock, writeLock } from './ship-queue-land-lock';
 import { genericBackstop } from './ship-queue-train-gate';
 
 const Q = 'gstack-ship-queue';
@@ -110,6 +114,31 @@ function published(env: TrainEnv, t: TrainRecord, i: number, main: string): { sa
   return { same: true, detail: `same modulo stamps (${r.files.filter(f => f.verdict === 'stamp').length} stamp file(s)) except ${cl}, main ${parent.slice(0, 12)}'s ${cl} plus #${t.slots[i]!.pr}'s own entry` };
 }
 
+/**
+ * The slot stamp a hand-stamped head must carry before it may merge (#3531, train 33 shipped #3527 under #3526's
+ * version): its VERSION above main's and, with a CHANGELOG, its top section headed with that version directly above
+ * main's top release, with no [Unreleased] section when main has none. The failing rule is named.
+ */
+function stampProof(env: TrainEnv, head: string, main: string): { version: string } | { rule: string; detail: string } {
+  const root = env.ctx.repoRoot;
+  const hv = versionAtRef(root, head);
+  const mv = versionAtRef(root, main);
+  if ('error' in hv) return { rule: 'version', detail: `the head's version cannot be read (${hv.error})` };
+  if ('error' in mv) return { rule: 'version', detail: `main's version cannot be read (${mv.error})` };
+  const [h, m] = [parseVersion(hv.version), parseVersion(mv.version)];
+  if (!h || !m || cmpVersion(h, m) <= 0) return { rule: 'version', detail: `the head's ${hv.rel} ${hv.version} is not above main's ${mv.version}` };
+  const cl = env.policy.policy.changelog;
+  if (!cl) return { version: hv.version };
+  const sections = (rev: string) => parseChangelog(git(root, ['show', `${rev}:${cl}`]).out).sections;
+  const [ours, theirs] = [sections(head), sections(main)];
+  const mainTop = theirs.find(s => !s.unreleased)?.version ?? null;
+  if (ours[0]?.version !== hv.version) return { rule: 'changelog', detail: `${cl}'s top section at the head is [${ours[0] ? ours[0].version ?? 'Unreleased' : 'none'}], not [${hv.version}]` };
+  const below = ours.slice(1).find(s => !s.unreleased)?.version ?? null;
+  if (below !== mainTop) return { rule: 'changelog', detail: `${cl}'s release below [${hv.version}] at the head is [${below ?? 'none'}], not main's top release [${mainTop ?? 'none'}]` };
+  if (!theirs.some(s => s.unreleased) && ours.some(s => s.unreleased)) return { rule: 'changelog', detail: `${cl} at the head keeps an [Unreleased] section that main does not have` };
+  return { version: hv.version };
+}
+
 /**
  * Freeze the queue: the record goes to local state and the notes ref before
  * anything remote, then the backstop gate is dispatched on main's sha.
@@ -225,8 +254,13 @@ export async function verifyTrain(ctx: QueueContext, o: { pr: string; train: str
   const before = t.prefixes[i]!;
   const post = published(env, t, i, main);
   const lines = [`TRAIN: ${t.nonce} slot ${i + 1}/${t.slots.length} #${o.pr} pinned ${t.slots[i]!.head}`];
-  if (post.same) return confirmMerged(env, t, o.pr, main, after.index, [...lines, `main: ${main} = T${after.index} (${post.detail})`]);
   const pre = sameModuloStamps(env, before.commit, main);
+  if (post.same) {
+    const state = prState(ctx, o.pr);
+    if (state === 'MERGED') return confirmMerged(env, t, o.pr, main, after.index, [...lines, `main: ${main} = T${after.index} (${post.detail})`]);
+    if (state !== 'OPEN' || !pre.same) return outRefused({ code: 'QUEUE_PROOF_MISSING', message: `main ${main.slice(0, 12)} is T${after.index} modulo stamps (${post.detail}), but GitHub reports #${o.pr} as ${state}, not MERGED; nothing is confirmed and the queue is not frozen` }, lines, `gh pr view ${o.pr} --json state,mergeCommit; rerun once GitHub reports #${o.pr} MERGED: ${Q} verify --pr ${o.pr} --train ${t.nonce}`, run);
+    lines.push(`main: also T${after.index} modulo stamps, but #${o.pr} is OPEN, so this is the pre-merge check (a stamp-only PR)`);
+  }
   if (!pre.same) {
     return stopped(env, t, 'QUEUE_TRAIN_TREE_MISMATCH', `main ${main.slice(0, 12)} is neither T${before.index} nor T${after.index} modulo stamps (vs T${after.index}: ${post.detail})`, main, lines, !o.noFetch);
   }
@@ -239,7 +273,10 @@ export async function verifyTrain(ctx: QueueContext, o: { pr: string; train: str
   if ('error' in info) return outRefused({ code: 'QUEUE_PROOF_MISSING', message: info.error }, lines, `${Q} verify --pr ${o.pr} --train ${t.nonce}`, run);
   const shipped = bindReceipt(info.body, o.pr, [t.slots[i]!.head, head]);
   if (!shipped.ok) return outRefused({ code: shipped.code, message: shipped.message }, [...lines, shipped.line], `#${o.pr}'s lane runs /ship and READYs again; then ${Q} train build --prs <pins>`, run);
-  return outOk([...lines, `main: ${main} = T${before.index} (${pre.detail})`, `head: ${head} (${stampOnly.detail})`, `${shipped.line} (binds ${shipped.head === t.slots[i]!.head ? 'the pinned head' : 'the current head'})`,
+  if (!headRef) return outRefused({ code: 'QUEUE_PROOF_MISSING', message: `#${o.pr}'s current head was not read (${o.noFetch ? '--no-fetch' : 'the head fetch failed'}), and the pin it falls back to is unstamped by design, so the stamp cannot be proved` }, lines, `${Q} verify --pr ${o.pr} --train ${t.nonce}`, run);
+  const stamp = stampProof(env, head, main);
+  if ('rule' in stamp) return outRefused({ code: 'QUEUE_TRAIN_UNSTAMPED', message: `#${o.pr}'s head ${head.slice(0, 12)} is not stamped above main: ${stamp.rule}: ${stamp.detail}` }, lines, `#${o.pr}'s lane runs gstack-restamp --next on its head, commits what restamp staged, pushes, then ${Q} verify --pr ${o.pr} --train ${t.nonce}`, run);
+  return outOk([...lines, `main: ${main} = T${before.index} (${pre.detail})`, `head: ${head} (${stampOnly.detail})`, `${shipped.line} (binds ${shipped.head === t.slots[i]!.head ? 'the pinned head' : 'the current head'})`, `STAMP_VERSION: ${stamp.version}`,
     `VERIFY_TRAIN: #${o.pr} may merge as slot ${i + 1} of train ${t.nonce} (green run ${gate.run?.id ?? '-'}, ${env.train.full_gate_check} success)`, `MERGE_CONDITION: sha=${head}`],
   `merge #${o.pr} with expected head ${head.slice(0, 12)} (gstack-restamp stamps at merge), then ${Q} verify --pr ${o.pr} --train ${t.nonce}`, run);
 }
@@ -262,6 +299,12 @@ export function confirmMerged(env: TrainEnv, t: TrainRecord, pr: string, main: s
     freeze.updated_at = freeze.cleared_at;
     persist(env.ctx.repoRoot, [freeze], { remote: env.remote });
     lines.push(`FREEZE: cleared (${freeze.cleared_by})`);
+    const held = readLock(env.ctx.repoRoot, env.remote);
+    if (held.state === 'held' && held.lock.phase === 'freeze') {
+      lines.push(writeLock(env.ctx.repoRoot, held.sha, { released: true, by: `verify #${pr} via train ${t.nonce}`, at: nowIso() }, env.remote).ok
+        ? 'LOCK: released the freeze lock'
+        : 'LOCK: the freeze lock could not be released; the next land or train land takes it over once it reads this cleared freeze');
+    }
     const rebuild = freeze.unmerged.length ? `${Q} train build --prs ${pinList(freeze.unmerged)}` : '';
     const unread = freeze.unreadable ?? [];
     const check = unread.length ? `${unread.map(u => `gh pr view ${u.pr} --json state,headRefOid`).join(' && ')} (unreadable at the freeze: ${unread.map(u => `#${u.pr}@${u.head.slice(0, 12)}`).join(', ')}); seat each that is OPEN in a train` : '';
diff --git a/lib/ship-queue.ts b/lib/ship-queue.ts
index ae3925ece..09471df27 100644
--- a/lib/ship-queue.ts
+++ b/lib/ship-queue.ts
@@ -175,7 +175,7 @@ function conflictHint(mergeable: unknown, ci: { green: boolean; none: boolean },
   if (mergeable !== 'CONFLICTING') return null;
   const ref = branch && /^[\w.][\w./-]*$/.test(branch) ? `--ref ${branch}` : '--ref <branch>';
   if (ci.none && fork) return `ci-hint: PR conflicts with the base (no merge ref, so pull_request CI did not run on ${head.slice(0, 12)}) and its head is on a fork, so the free workflows cannot be dispatched here; the coordinator decides (advisory)`;
-  if (ci.none) return `ci-hint: PR conflicts with the base (no merge ref, so pull_request CI did not run on ${head.slice(0, 12)}); dispatch the free workflows on the branch (gh workflow run free-tests.yml ${ref} && gh workflow run windows-free-tests.yml ${ref}), clear the pregate lanes with their run URLs (gstack-pregate clear --remote <lane> --run-url <run>), then rerun ready (advisory)`;
+  if (ci.none) return `ci-hint: PR conflicts with the base (no merge ref, so pull_request CI did not run on ${head.slice(0, 12)}); dispatch the free workflows on the branch (gh workflow run free-tests.yml ${ref} && gh workflow run windows-smoke.yml ${ref}), clear the pregate lanes with their run URLs (gstack-pregate clear --remote <lane> --run-url <run>), then rerun ready (advisory)`;
   if (ci.green) return `ci-hint: PR conflicts with the base (no merge ref); the runs at ${head.slice(0, 12)} were not pull_request runs (dispatched on the branch, or push-triggered), and they count (advisory)`;
   return null;
 }
diff --git a/lib/ship-release.ts b/lib/ship-release.ts
index b6e517d91..9bc72b8bd 100644
--- a/lib/ship-release.ts
+++ b/lib/ship-release.ts
@@ -285,17 +285,17 @@ export async function finish(argv: readonly string[], cwd: string): Promise<Repo
   const r = new Report();
   const list = lanes(argv) as { label: string; command: string }[];
   const policy = shipPolicy(cwd, base);
-  if (!commitRelease(cwd, releasePaths(policy, cwd, 'HEAD'), flag('--trailer'), r)) return r;
+  if (!commitRelease(cwd, releasePaths(policy, cwd, 'HEAD', base), flag('--trailer'), r)) return r;
   for (const cmd of all('--build')) {
     const b = sh(cwd, cmd);
     r.add(`BUILD: ${b.status === 0 ? 'ok' : `FAIL exit=${b.status}`} ${cmd.slice(0, 120)}`);
     if (b.status !== 0) return r.stop(`Build failed or prerequisite missing: ${firstLine(b.stderr || b.stdout)}; repair it, then repeat stage 1`);
   }
   if (!all('--build').length) r.add('BUILD: none passed (record the inspected sources, or pass --build per declared command)');
-  const release = releasePaths(policy, cwd, flag('--reviewed-tree')!);
+  const release = releasePaths(policy, cwd, flag('--reviewed-tree')!, base);
   const routed = route(cwd, base, flag('--reviewed-tree')!, flag('--reviewed-base'), release, { docsRechecked: has('--docs-rechecked'), contextReviewed: flag('--context-reviewed') }, r);
   if (!routed) return r;
-  if (!docsFresh(cwd, base, flag('--docs-post')!, [...routed.base, ...routed.context, ...stampedFiles(policy, cwd, flag('--reviewed-tree')!)], all('--docs-requested'), flag('--docs-result'), r)) return r;
+  if (!docsFresh(cwd, base, flag('--docs-post')!, [...routed.base, ...routed.context, ...stampedFiles(policy, cwd, flag('--reviewed-tree')!, base)], all('--docs-requested'), flag('--docs-result'), r)) return r;
   if (!list.length && !has('--no-lanes-approved')) return r.stop('no test lanes: require Step 5\'s explicit untested-scope approval (rerun with --no-lanes-approved) or run Steps 5-15');
   const allow = evidenceExempt(release).join(',');
   const check = (l: { label: string; command: string }) => bin(cwd, 'gstack-evidence', ['check', '--label', l.label, '--expect-cmd', l.command, '--max-age', '24', '--allow-paths', allow], 60_000).stdout;
diff --git a/package.json b/package.json
index 9b0d4049c..bd579db43 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.92.45",
+  "version": "1.92.56",
   "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.",
   "license": "MIT",
   "type": "module",
diff --git a/plan-devex-review/dx-hall-of-fame.md b/plan-devex-review/dx-hall-of-fame.md
index e44f4ddea..2c73199a6 100644
--- a/plan-devex-review/dx-hall-of-fame.md
+++ b/plan-devex-review/dx-hall-of-fame.md
@@ -76,8 +76,8 @@ unknown is reserved for existing behavior you could not inspect. In a live audit
 you never triggered are unknown, not extrapolated.
 
 **Caps.** Name the path and item behind every cap and show the corrected error line.
-- **4/10 (Critical finding, title `CAP4:<path>:<item>`):** a path leaks a secret, signals failure as success, gives an unsafe fix, or blocks waiting for a terminal (hangs, or fails for lack of a terminal without naming a non-interactive alternative such as `--yes`).
-- **6/10 (High finding, title `CAP6:<path>:<item>`):** a path lacks an applicable fix, recovery, context or trace item.
+- **4/10 (Critical finding, title `CAP4:<path>:<item> <what fails>`):** a path leaks a secret, signals failure as success, gives an unsafe fix, or blocks waiting for a terminal (hangs, or fails for lack of a terminal without naming a non-interactive alternative such as `--yes`).
+- **6/10 (High finding, title `CAP6:<path>:<item> <what fails>`):** a path lacks an applicable fix, recovery, context or trace item.
 
 Every mode, DX TRIAGE included, reports every CAP4 finding.
 
diff --git a/plan-devex-review/sections/review-sections.md b/plan-devex-review/sections/review-sections.md
index 4b0f40bea..166aa0b67 100644
--- a/plan-devex-review/sections/review-sections.md
+++ b/plan-devex-review/sections/review-sections.md
@@ -162,7 +162,7 @@ persona from 0A.
 Load reference: Read the "## Pass 3" section from `~/.claude/skills/gstack/plan-devex-review/dx-hall-of-fame.md`
 before scoring: the full contract, calibration examples and the standards mapping.
 
-Score every error path against the agent-ready error contract (https://github.com/garrytan/gstack/blob/main/docs/agent-ready-errors.md): what (operation and actual values), fix (a safe, authorized command or edit on the first or last line, or the precise thing a human must provide), recovery (retry, fix and retry, do X first, or ask a human; side effects none/partial/complete/unknown, reconcile before retrying an unknown outcome, a retry bound), code (stable, with a doc anchor), context (versions, config, env var names, the underlying cause; caller-safe only for remote services), trace (unexpected failures only: a compact trace or its file path locally, a correlation id remotely), redaction (no secret values anywhere), channel (the surface's native failure signal: non-zero exit and stderr for a CLI, status plus RFC 9457 body for an API, a typed error for an SDK, isError for an MCP tool). Usage and validation errors rejected before any work need only what, fix, code, redaction and channel; items apply per surface, N/A needs a reason, an item the plan never specifies for a path it introduces is a gap, and unknown is reserved for existing behavior you could not inspect. Report a leaked secret, a failure signalled as success, an unsafe fix, or a block on a terminal (a hang, or a no-terminal failure that names no non-interactive alternative such as --yes) as a Critical finding titled "CAP4:<path>:<item>" (caps the Error Messages score at 4/10); report a missing applicable fix, recovery, context or trace as a High finding titled "CAP6:<path>:<item>" (caps it at 6/10).
+Score every error path against the agent-ready error contract (https://github.com/garrytan/gstack/blob/main/docs/agent-ready-errors.md): what (operation and actual values), fix (a safe, authorized command or edit on the first or last line, or what a human must provide), recovery (retry, fix and retry, do X first, or ask a human; side effects none/partial/complete/unknown, reconcile before retrying an unknown outcome, a retry bound), code (stable, with a doc anchor), context (versions, config, env var names, the underlying cause; caller-safe only for remote services), trace (unexpected failures only: a compact trace or its file path locally, a correlation id remotely), redaction (no secret values anywhere), channel (the surface's native failure signal: non-zero exit and stderr for a CLI, status plus RFC 9457 body for an API, a typed error for an SDK, isError for an MCP tool). Usage and validation errors rejected before any work need only what, fix, code, redaction and channel; items apply per surface, N/A needs a reason, an item the plan never specifies for a path it introduces is a gap, and unknown is reserved for existing behavior you could not inspect. Report a leaked secret, a failure signalled as success, an unsafe fix, or a block on a terminal (a hang, or a no-terminal failure naming no non-interactive alternative such as --yes) as a Critical finding titled "CAP4:<path>:<item> <what fails>" (caps Error Messages at 4/10); report a missing applicable fix, recovery, context or trace as a High finding titled "CAP6:<path>:<item> <what fails>" (caps it at 6/10).
 
 The "## Pass 3" Hall of Fame section loaded above holds the full contract: the item table,
 the per-surface channel rules and the evidence states.
diff --git a/scripts/harness-version.json b/scripts/harness-version.json
index 99304ffaf..1e091511b 100644
--- a/scripts/harness-version.json
+++ b/scripts/harness-version.json
@@ -17,7 +17,7 @@
     "scripts/lib/published-text.ts": {"blob":"3f2e4d616b5dd0204035710c66b64d49055c5714","since":6},
     "scripts/lib/shard-engine.ts": {"blob":"dc714d7d897aed185c0ec3d2c92ad22d954039e5","since":6,"nonBehavioral":"createShardSandbox drops the Capy launch markers (GSTACK_SESSION_KIND, GSTACK_CAPY, GSTACK_EPHEMERAL, GSTACK_INSTALL_VERDICT) from shard environments; CI never sets them, so no case's input or verdict changes there, and on a Capy machine fixtures now see the session kind they set themselves instead of the installer's"},
     "scripts/test-paid-shards.ts": {"blob":"5439d0a8f6e1569fa7c924af20d67c30c81d5d30","since":6,"nonBehavioral":"credential rejections are classed infra instead of assertion: no case's pass or fail changes; only failed trials whose provider rejected the run's key move class, so no rerun spends on a rejected key"},
-    "scripts/test-pr-profile.ts": {"blob":"911e393d0c36c050c3a68db5a81ef21701bfd5ae","since":6,"nonBehavioral":"selection only: fragment exemption narrowed to .md files directly in the fragments dir; changed-file lists include a rename's old path; no case prompt, fixture, judge or verdict logic changes (GST-400)"},
+    "scripts/test-pr-profile.ts": {"blob":"25e2d88dd2e1caae5213fb396b977891bc67549a","since":6,"nonBehavioral":"scripts/test-pr-profile.ts only lists .github/workflows/windows-smoke.yml among files no paid case reads; no case's selection, prompt or verdict can change"},
     "scripts/test-strict-output.ts": {"blob":"01185d20dc9761b04b9b2f751ec98664fe0eaf93","since":6},
     "test/helpers/agent-sdk-runner.ts": {"blob":"210bba92d241a90df578b2c7fc943ac5755d0025","since":6},
     "test/helpers/auq-substance-panel.ts": {"blob":"4881260ef793668e4963a062db6d06a5e1f7a40f","since":6},
diff --git a/scripts/lib/windows-curation.ts b/scripts/lib/windows-curation.ts
index 04e37cac3..f9f351c9f 100644
--- a/scripts/lib/windows-curation.ts
+++ b/scripts/lib/windows-curation.ts
@@ -315,6 +315,10 @@ export const KNOWN_WINDOWS_INCOMPATIBLE: Array<{ file: string; reason: string }>
     file: 'test/ship-queue-train-land.test.ts',
     reason: 'drives train land against test/helpers/ship-queue-train-fixture.ts plus an extensionless node gh wrapper on a colon-joined PATH; on windows-latest spawnSync(\'gh\') resolves the runner\'s gh.exe instead, as for test/ship-queue-train.test.ts and test/ship-queue-land.test.ts (windows-free-shard 6, run 40824965988)',
   },
+  {
+    file: 'test/ship-queue-land-lock.test.ts',
+    reason: 'drives land and train land against test/helpers/ship-queue-train-fixture.ts plus an extensionless node gh wrapper on a colon-joined PATH; on windows-latest spawnSync(\'gh\') resolves the runner\'s gh.exe instead, as for test/ship-queue-train-land.test.ts and test/ship-queue-land.test.ts (windows-free-shard 6, run 40824965988)',
+  },
   {
     file: 'test/ship-queue-train.test.ts',
     reason: 'drives bin/gstack-ship-queue against the stateful #!/bin/sh gh shim in test/helpers/ship-queue-train-fixture.ts; on windows-latest spawnSync(\'gh\') resolves the runner\'s gh.exe instead of the shim (windows-free-shard run 39152702056)',
@@ -402,10 +406,14 @@ export const KNOWN_WINDOWS_SAFE: Array<{ file: string; reason: string }> = [
   { file: 'test/cso-windows-docker.test.ts', reason: '/cso docker.exe discovery under known-folder roots (real path, no reparse points) and the native-transport-unsupported outcome; pure win32 path logic' },
   { file: 'test/copilot-windows-bash.test.ts', reason: 'the Copilot glossary line that runs bash blocks in Git for Windows Bash; reads host config only' },
   { file: 'test/ship-hook-windows-paths.test.ts', reason: 'runs bin/ helpers through explicit bash and Bun argv with forward-slash paths; never executes a shebang; the path-spelling simulation is skipIf win32' },
+  { file: 'test/review-scope-windows-launch.test.ts', reason: '#3541: runs gstack-review-scope through lib/script-invocation.ts, which must reach the bash gstack-review-read through Git Bash (red at main: windows-free-shard 3, run 41228091417); os.tmpdir state only' },
+  { file: 'test/jsonl-merge-encoding.test.ts', reason: '#3659: runs gstack-jsonl-merge through lib/script-invocation.ts (Git Bash on win32); the CRLF half of the bug only reproduces with a Windows Python' },
   { file: 'test/gstack-wtree-windows-paths.test.ts', reason: '#3101: runs bin/gstack-wtree through explicit bash in an os.tmpdir linked worktree with forward-slash paths; never executes a shebang; the drive-letter simulation is skipIf win32' },
   { file: 'test/setup-hook-syntax-gate.test.ts', reason: '#3088/#3100: runs bin/gstack-hook-check and the setup hook sections through explicit bash with forward-slash paths; never executes a shebang. Its Bun drive-path spelling is the Windows bug it guards' },
   { file: 'test/bun-config-shell-bins.test.ts', reason: '#3415: runs the record bins through lib/script-invocation.ts (Git Bash on Windows) with MSYS path conversion off, the case it guards; its bun and cygpath stand-ins and simulated-OSTYPE cases are skipIf win32' },
+  { file: 'test/ship-receipt-session-kind.test.ts', reason: '#3541: runs gstack-ship-receipt write through lib/script-invocation.ts, which must reach the bash gstack-session-kind through Git Bash; os.tmpdir git fixture only' },
   { file: 'test/path-spelling.test.ts', reason: 'sources bin/gstack-path-spelling.sh through explicit bash and checks lib/path-spelling.ts; on Windows it exercises the real Git Bash spellings' },
+  { file: 'test/timeline-stop-hook-stdin.test.ts', reason: '#3628: the hook runs through Bun argv with a stdin pipe held open; the return-within-budget timing must meet real Windows process startup' },
   { file: 'test/state-root-parity.test.ts', reason: 'runs the bash twin and lib/state-root.ts over an env table with PATH empty; no shebang execution, raw-string comparison is platform-neutral' },
   { file: 'test/generator-eexist.test.ts',
     reason: 'E4: runs the generators through Bun argv with the Windows EEXIST emulation preload; no shebang execution' },
diff --git a/scripts/resolvers/autoplan-driver.ts b/scripts/resolvers/autoplan-driver.ts
index d84d63b95..260d7b2d4 100644
--- a/scripts/resolvers/autoplan-driver.ts
+++ b/scripts/resolvers/autoplan-driver.ts
@@ -17,17 +17,17 @@ import type { ResolverFn } from './types';
 
 /** One entry per command line the loop runs, as the field-wave plan specifies them. */
 export const AUTOPLAN_DRIVER_COMMANDS: Array<{ cmd: string; does: string }> = [
-  { cmd: 'gstack-autoplan next --out <dir> --plan <plan.md> [scope flags] [--light] [--spend-cap <usd>] [--max-rounds <n>] [--scaffold]', does: `first call: init the run, print PHASE:, SCOPE:, DRIVER: and one ATTEMPT: per voice; --max-rounds caps review rounds per phase (default ${DEFAULT_MAX_ROUNDS} unattended), and an unattended Capy run reserves ${DEFAULT_HOST_ESTIMATE_USD.toFixed(2)} per host attempt unless --estimate-usd <n> says otherwise, so --spend-cap binds` },
+  { cmd: 'gstack-autoplan next --out <dir> --plan <plan.md> [scope flags] [--light] [--spend-cap <usd>] [--max-rounds <n>] [--estimate-usd <n>] [--scaffold]', does: `first call: init the run, print PHASE:, SCOPE:, DRIVER: and one ATTEMPT: per voice; --max-rounds caps review rounds per phase (default ${DEFAULT_MAX_ROUNDS} unattended); a run with --spend-cap, in any session kind (or any unattended Capy run), reserves ${DEFAULT_HOST_ESTIMATE_USD.toFixed(2)} per voice for each attempt, so the cap binds; --estimate-usd <n> sets that reservation and the run keeps it for later phases` },
+  { cmd: 'gstack-autoplan run --out <dir> --plan <plan.md> --native-model <id> --outside-model <id> --native-runner api --runner api [--max-tokens <n>] [--spend-cap <usd>]', does: 'hosts without subagents: one command calls both models directly (ANTHROPIC_API_KEY, OPENAI_API_KEY) and loops next/submit to the gate; a response cut off at the output limit is reported truncated, so raise --max-tokens (default 16384 for both providers; OpenAI counts reasoning tokens toward it); each api call reserves its priced worst case (a model with no price reserves the per-voice default under a cap), a native call that went out but bound no result settles at its usage, or its full reservation when the usage is unknown, and a failed outside call stays counted at its reservation' },
   { cmd: 'gstack-autoplan next --out <dir> [--redispatch <attempt>]', does: 'later calls: open the next phase or reprint open attempts; never redispatches on its own' },
   { cmd: 'gstack-autoplan submit --out <dir> --phase <p> --voice native|outside --record <file.md> --model <id> [--attempt <id>]', does: 'bind a free-form review record (canonical fence, one findings table or list, or `No findings.`)' },
   { cmd: 'gstack-autoplan submit ... --record <file.md> --attest "<reason>" --attempt <id>', does: 'bind a record with no INPUT: line as receipt: attested (a wrong INPUT: always refuses)' },
-  { cmd: 'gstack-autoplan submit --out <dir> --phase <p> --voice native|outside --result <file> --model <id> --attempt <id>', does: 'bind a canonical result (the RESULT FORMAT below)' },
+  { cmd: 'gstack-autoplan submit --out <dir> --phase <p> --voice native|outside --result <file> --model <id> --attempt <id> [--usage-usd <n>] [--reconcile <jsonl>]', does: 'bind a canonical result (the RESULT FORMAT below); `--usage-usd` settles the attempt at what the reviewer actually cost (else it stays priced unknown at its reservation); on the submit that closes the phase, `--reconcile` takes your own pairing of findings both voices raised, one `{"outside_id","native_id","disposition","resolution"}` row each, over the structural one' },
   { cmd: 'gstack-autoplan submit --out <dir> --phase <p> --voice outside --unavailable|--failed "<reason>"', does: 'close the phase native-only when no outside voice can run' },
-  { cmd: 'gstack-autoplan answer --out <dir> --gate-rev <n> --reply "<reply>" --by human|agent:<id> [--owner-reply <text>|-] [--rec-hash <h>]', does: 'answer the gate with the reply grammar below; an agent answer stores the owner\'s words verbatim' },
+  { cmd: 'gstack-autoplan answer --out <dir> --gate-rev <n> --reply "<reply>" --by human|agent:<id> [--owner-reply <text>|-] [--words-by agent:<id>] [--rec-hash <h>]', does: 'answer the gate with the reply grammar below; an agent answer stores the owner\'s words verbatim, and passes --words-by agent:<id> whenever the words are its own (the default is owner)' },
   { cmd: 'gstack-autoplan recommend --out <dir> --gate-rev <n> --item <id> --option <k> --basis "<why>"', does: 'change one recommendation before relay; then render and relay again (a `rec` needs the new `--rec-hash`)' },
   { cmd: 'gstack-autoplan revise --out <dir> --plan <plan v2> --incorporates <decision ids>', does: 'bind the amended plan; reopens every phase whose reviewed plan changed, Eng last' },
-  { cmd: 'gstack-autoplan revise --out <dir> --settle <decision id|d4>', does: 'discharge a packaging or ordering change with no plan edit; reopens nothing' },
-  { cmd: 'gstack-autoplan revise --out <dir> --withdraw <decision id>', does: 'drop a pending amendment instead of applying it' },
+  { cmd: 'gstack-autoplan revise --out <dir> --settle <decision id|d4> | --withdraw <decision id>', does: '--settle discharges a packaging or ordering change with no plan edit and reopens nothing; --withdraw drops a pending amendment instead of applying it' },
   { cmd: 'gstack-autoplan close --out <dir> --phase <p> --deferred "<reason>" --by human|agent:<id>', does: 'close a phase accepted-with-findings: its open findings go to tasks.jsonl, and Critical, urgent or user-challenge findings become gate items; also the recovery from `STOP: reason=budget_exhausted`' },
   { cmd: 'gstack-autoplan budget --out <dir> [--spend-cap <usd>] [--max-rounds <n>] --by human|agent:<id>', does: 'the owner\'s journaled cap raise; after a budget stop, `resume` continues the run' },
   { cmd: 'gstack-autoplan export --out <dir>', does: 'write the artifact set; then `gstack-artifact validate <dir>/run.json`' },
@@ -40,7 +40,7 @@ export const AUTOPLAN_DRIVER_COMMANDS: Array<{ cmd: string; does: string }> = [
 export const GATE_REPLY_FORMS: Array<{ reply: string; means: string }> = [
   { reply: 'rec', means: 'every item takes its recommendation, plan changes included (each prints APPLY:); `all` and `do it` are aliases' },
   { reply: 'as-is', means: 'keep every direction; no plan change' },
-  { reply: 'd3b uc1a', means: 'one <id><option> token per item you set; unanswered auto items take their default' },
+  { reply: 'd3b uc1a', means: 'one <id><option> token per item you set; unanswered auto items take their default (a finding item keeps the plan as written; `p1b` applies it)' },
   { reply: 'rec except d3b', means: 'recommendations, with the listed overrides' },
 ];
 
diff --git a/scripts/test-health-report.ts b/scripts/test-health-report.ts
index 8d9e55168..7d89e60c9 100644
--- a/scripts/test-health-report.ts
+++ b/scripts/test-health-report.ts
@@ -292,13 +292,13 @@ export function collectHealth(inputs: HealthInputs): HealthReport {
       detail: window.files.slice(0, 15).map(file => `${file.file}: ${file.flakyRuns}/${window.runs} runs (${pct(file.rate)})${file.failing ? ' FAIL > 5%' : ''}`) };
   }));
 
-  metrics.push(metric('free-wall', 'Free-suite and Windows wall', 'p50 of run_started_at to updated_at for successful main runs of free-tests.yml and successful pull_request runs of windows-free-tests.yml (its workflow_dispatch duration recordings excluded)', () => {
+  metrics.push(metric('free-wall', 'Free-suite and Windows wall', 'p50 of run_started_at to updated_at for successful main runs of free-tests.yml and successful pull_request runs of windows-smoke.yml, the required Windows check (its workflow_dispatch runs excluded)', () => {
     const walls = (workflow: string, filter: { branch?: string; event?: string }) =>
       listWorkflowRuns(client, repo, workflow, { since, ...filter }).filter(run => run.conclusion === 'success').map(run => span(run.startedAt, run.updatedAt)!);
     const free = walls('free-tests.yml', { branch: 'main' });
-    const windows = walls('windows-free-tests.yml', { event: 'pull_request' });
+    const windows = walls('windows-smoke.yml', { event: 'pull_request' });
     const windowsValue = windows.length ? `${minutes(percentile(windows, 0.5))} (${windows.length} runs)` : 'no successful PR runs in window';
-    return { value: `free-tests ${minutes(percentile(free, 0.5))} (${free.length} runs); windows-free-tests (successful PR runs) ${windowsValue}` };
+    return { value: `free-tests ${minutes(percentile(free, 0.5))} (${free.length} runs); windows-smoke (successful PR runs) ${windowsValue}` };
   }));
 
   metrics.push(metric('free-serial', 'Free-suite serial time', 'sum of scripts/free-test-durations.json (the committed seed)', () => {
diff --git a/scripts/test-pr-profile.ts b/scripts/test-pr-profile.ts
index 911e393d0..25e2d88dd 100644
--- a/scripts/test-pr-profile.ts
+++ b/scripts/test-pr-profile.ts
@@ -294,6 +294,7 @@ export const FREE_ONLY_PR_FILES = [
   '.github/workflows/windows-free-tests.yml',
   '.github/workflows/windows-pregate-e2e.yml',
   '.github/workflows/windows-setup-e2e.yml',
+  '.github/workflows/windows-smoke.yml',
 ] as const;
 
 /**
diff --git a/scripts/ubicloud/ubi-runner.sh b/scripts/ubicloud/ubi-runner.sh
index bef063f33..03a698e4b 100755
--- a/scripts/ubicloud/ubi-runner.sh
+++ b/scripts/ubicloud/ubi-runner.sh
@@ -44,12 +44,13 @@
 #
 # TTL and reaper: a name this script generates ends in -t<hours> (UBI_TTL_HOURS,
 # 1-999, default 3), the creator's own declaration of how long the VM may live.
-# `reap` destroys every VM in the project whose TTL expired more than ten
-# minutes ago, whichever owner made it, and this owner's own ubirun-<owner>-*
-# names with no TTL once they are UBI_LEGACY_HOURS old (default 4; another
-# owner's or an untagged TTL-less VM is never reaped); every `up` runs it first (UBI_REAP=0 skips it), so a runner
-# killed by a sleeping machine leaves nothing behind for longer than its TTL.
-# Names outside the ubirun- prefix are never reaped.
+# `reap` destroys only this owner's VMs: its ubirun-<owner>-* names whose TTL
+# expired more than ten minutes ago, and those with no TTL once they are
+# UBI_LEGACY_HOURS old (default 4). Another owner's VM, an untagged one and
+# names outside the ubirun- prefix are never reaped, expired or not; reap only
+# counts other owners' expired VMs in its log (cloud deletes stay owner-scoped,
+# GST-573). Every `up` runs it first (UBI_REAP=0 skips it), so a lane killed by
+# a sleeping machine has its leftovers destroyed by its own next `up`.
 #
 # Leftover line: `run` and `verify` end with
 #   UBICLOUD: left=<0|1|unknown> owner=<owner> vm=<name> others=<n>
@@ -754,23 +755,26 @@ vm_rows() {
   done
 }
 
-# reap: destroy every VM whose name carries a TTL that ended more than
-# REAP_GRACE seconds ago, whichever owner created it (the TTL is that owner's
-# own declaration), and the caller's own TTL-less ubirun-<UBI_OWNER>-* names at
-# least LEGACY_HOURS old. Another owner's TTL-less VM, an untagged one, and names
-# outside the prefix are never touched: only a TTL lets reap judge another lane's VM.
+# reap: destroy the caller's own VMs whose TTL ended more than REAP_GRACE
+# seconds ago, and its TTL-less ubirun-<UBI_OWNER>-* names at least LEGACY_HOURS
+# old. Every other VM is never touched, whatever its TTL says: a delete stays
+# with the owner that created the VM. Other owners' expired VMs are only counted.
 cmd_reap() {
-  local now rows loc name owner expires created n=0 failed=0
+  local now rows loc name owner expires created n=0 failed=0 others=0
   [[ "$LEGACY_HOURS" =~ ^[1-9][0-9]{0,3}$ ]] || die "UBI_LEGACY_HOURS must be a whole number of hours from 1 to 9999 with no leading zero (how old a TTL-less ubirun-* VM must be before reap destroys it)"
   now=$(date +%s)
   rows=$(vm_rows) || { log "reap: could not list the project's VMs; nothing destroyed"; return 1; }
   while read -r loc name owner expires created; do
     [ -n "$name" ] || continue
+    if [ "$owner" != "$OWNER" ]; then
+      [ "$expires" = - ] || [ "$now" -lt $(( expires + REAP_GRACE )) ] || others=$(( others + 1 ))
+      continue
+    fi
     if [ "$expires" != - ]; then
       [ "$now" -ge $(( expires + REAP_GRACE )) ] || continue
       log "reaping expired $loc/$name (owner $owner; its TTL ended $(( (now - expires) / 60 )) min ago)"
     else
-      [ -n "${UBI_OWNER:-}" ] && [ "$owner" = "$OWNER" ] && [ "$created" != - ] || continue
+      [ -n "${UBI_OWNER:-}" ] && [ "$created" != - ] || continue
       [ $(( now - 10#$created )) -ge $(( LEGACY_HOURS * 3600 )) ] || continue
       log "reaping TTL-less $loc/$name (owner $owner; $(( (now - 10#$created) / 3600 ))h old, legacy sweep at ${LEGACY_HOURS}h)"
     fi
@@ -778,6 +782,7 @@ cmd_reap() {
     cmd_down "$name" -l "$loc" || { failed=$(( failed + 1 )); log "failed to reap $loc/$name"; }
   done <<<"$rows"
   [ "$n" -gt 0 ] || log "reap: no expired VMs"
+  [ "$others" -eq 0 ] || log "reap: left $others expired VMs of other owners; only their owners reap them"
   [ "$failed" -eq 0 ] || { log "reap: $failed of $n expired VMs could not be destroyed"; return 1; }
 }
 
@@ -1363,7 +1368,7 @@ cmd_run() {
     trap 'exit 130' INT TERM QUIT
     trap on_hup HUP
     if [[ "$name" =~ -t([0-9]+)$ ]]; then
-      log "$name carries a ${BASH_REMATCH[1]}h TTL (any later run of this script reaps it); if this process dies first: $0 down $name"
+      log "$name carries a ${BASH_REMATCH[1]}h TTL (this owner's next up or reap destroys it once it expires); if this process dies first: $0 down $name"
     elif [[ "$name" =~ ^$PREFIX-$OWNER-[0-9]{10}- ]]; then
       log "$name has no TTL (reap destroys it once it is ${LEGACY_HOURS}h old); if this process dies before its teardown line, destroy it with: $0 down $name"
     else
@@ -1579,8 +1584,8 @@ usage: ubi-runner.sh <command> [args]
   owner                  print this caller's owner tag ($OWNER)
   records                VMs this machine created and has not confirmed gone ($VM_RECORD)
   gc HOURS               destroy this owner's VMs older than HOURS (never other owners')
-  reap                   destroy every VM whose -t<hours> TTL has ended (any owner) and this
-                         owner's TTL-less ubirun-* VMs older than UBI_LEGACY_HOURS
+  reap                   destroy this owner's VMs whose -t<hours> TTL has ended and its
+                         TTL-less ubirun-* VMs older than UBI_LEGACY_HOURS (never other owners')
   cli ARGS...            raw Ubicloud CLI passthrough (e.g. cli vm list)
 
 signals: INT and TERM tear the VM down. HUP, once a remote phase is live, detaches
diff --git a/ship/DRIVER.md b/ship/DRIVER.md
index 3dec39134..ac19dd0bd 100644
--- a/ship/DRIVER.md
+++ b/ship/DRIVER.md
@@ -15,7 +15,7 @@ the next act. Read a section only when a phase or the list at the end sends you,
 up front. A STOP or decision this file does not cover: read `ship/SKILL.md` at that step, finish it
 there, come back. Unattended, take a question's recommended option (log it); gate
 dispositions and approvals stay pending and end the run. Keep a private invocation record (`--record`): write its six headings at Phase 1, then fill each as its phase ends: **Checks**
-(Phases 2-4: lanes, pregate, evals, `Coverage:`, the plan checks, `Scope Check:`), **Decisions** (any
+(Phases 2-4: lanes, pregate, evals, `Coverage:`, the plan checks, `Exploratory QA:`, `Scope Check:`), **Decisions** (any
 phase: each answered or auto-taken question, verbatim), **Reviews** (Phases 3-5: the plan line,
 start tokens, `Pre-Landing Review:`, `Gate edits:`, the reviewed tree), **Release** (Phases 5-7:
 version, CHANGELOG, commits), **Documentation** (Step 14.5) and **Next steps** (every phase: the next act).
@@ -24,7 +24,7 @@ version, CHANGELOG, commits), **Documentation** (Step 14.5) and **Next steps** (
 outside-voice and documentation brief, its severity and confidence rules and gates come from its
 section verbatim (placeholders filled); this file
 never shortens a reviewer's brief. A blocking reader's prompt is its `gstack-review-dispatch render`
-file, unchanged; its findings reach `merged.jsonl` only via `collect`; `judge` refuses a drop or downgrade. Audit readers (Steps 7, 8, 9.2.1, 14.5) cannot block, so each runs on a
+file, unchanged; its findings reach `merged.jsonl` only via `collect`; `judge` refuses a drop or downgrade. Audit readers (Steps 7, 8, 14.5) cannot block, so each runs on a
 small model at low effort; their findings go to the PR body.
 
 **Calls.** One pass with no fixes is 9 calls: Phases 1-8 and the report; at most 12 with a STOP's
@@ -77,13 +77,13 @@ Never read TODOS.md or the full diff into the parent. A `PERSIST:` hint never re
 ## 3. Audits and review: Steps 7, 8, 9, 9.1, 9.2, 9.2.1
 
 One program: the audit readers `READER:` names (Step 7 from `sections/test-coverage.md`, Step 8 from
-`sections/plan-completion.md`, each run as written; Step 7 may write tests, so it settles first), Step 9.2.1's QA reader (that step of
-`sections/review-army.md` as its brief) and the pass (above): Steps 9-9.2 as written. `Coverage:` and Step 8's line come from `--audit` when no
+`sections/plan-completion.md`, each run as written; Step 7 may write tests, so it settles first), 9.2.1's Reads only and the pass
+(above): Steps 9-9.2 from `sections/review-army.md` as written. `Coverage:` and Step 8's line come from `--audit` when no
 reader ran.
 
 ## 4. Judgment: Steps 8.1, 8.2, 9.3, 9.4 and Step 11
 
-Steps 8.1 and 8.2 (`Scope Check:`) on the todos and commits files, then the core checklist, Steps
+Step 8.1, 9.2.1's probes, 8.2 (`Scope Check:`) on the todos and commits files, then the core checklist, Steps
 9.3, 9.4 and the repeat decision as written (`gstack-review-plan` included;
 `JUDGMENT: ok` before any fix), fixes and persistence in
 one program. Prints `Pre-Landing Review:`, `Gate edits:`. `NEXT: stop` stops; `full` or
diff --git a/ship/DRIVER.md.tmpl b/ship/DRIVER.md.tmpl
index d4a874ae6..0298fb93e 100644
--- a/ship/DRIVER.md.tmpl
+++ b/ship/DRIVER.md.tmpl
@@ -13,7 +13,7 @@ the next act. Read a section only when a phase or the list at the end sends you,
 up front. A STOP or decision this file does not cover: read `ship/SKILL.md` at that step, finish it
 there, come back. Unattended, take a question's recommended option (log it); gate
 dispositions and approvals stay pending and end the run. Keep a private invocation record (`--record`): write its six headings at Phase 1, then fill each as its phase ends: **Checks**
-(Phases 2-4: lanes, pregate, evals, `Coverage:`, the plan checks, `Scope Check:`), **Decisions** (any
+(Phases 2-4: lanes, pregate, evals, `Coverage:`, the plan checks, `Exploratory QA:`, `Scope Check:`), **Decisions** (any
 phase: each answered or auto-taken question, verbatim), **Reviews** (Phases 3-5: the plan line,
 start tokens, `Pre-Landing Review:`, `Gate edits:`, the reviewed tree), **Release** (Phases 5-7:
 version, CHANGELOG, commits), **Documentation** (Step 14.5) and **Next steps** (every phase: the next act).
@@ -22,7 +22,7 @@ version, CHANGELOG, commits), **Documentation** (Step 14.5) and **Next steps** (
 outside-voice and documentation brief, its severity and confidence rules and gates come from its
 section verbatim (placeholders filled); this file
 never shortens a reviewer's brief. A blocking reader's prompt is its `gstack-review-dispatch render`
-file, unchanged; its findings reach `merged.jsonl` only via `collect`; `judge` refuses a drop or downgrade. Audit readers (Steps 7, 8, 9.2.1, 14.5) cannot block, so each runs on a
+file, unchanged; its findings reach `merged.jsonl` only via `collect`; `judge` refuses a drop or downgrade. Audit readers (Steps 7, 8, 14.5) cannot block, so each runs on a
 small model at low effort; their findings go to the PR body.
 
 **Calls.** One pass with no fixes is 9 calls: Phases 1-8 and the report; at most 12 with a STOP's
@@ -75,13 +75,13 @@ Never read TODOS.md or the full diff into the parent. A `PERSIST:` hint never re
 ## 3. Audits and review: Steps 7, 8, 9, 9.1, 9.2, 9.2.1
 
 One program: the audit readers `READER:` names (Step 7 from `sections/test-coverage.md`, Step 8 from
-`sections/plan-completion.md`, each run as written; Step 7 may write tests, so it settles first), Step 9.2.1's QA reader (that step of
-`sections/review-army.md` as its brief) and the pass (above): Steps 9-9.2 as written. `Coverage:` and Step 8's line come from `--audit` when no
+`sections/plan-completion.md`, each run as written; Step 7 may write tests, so it settles first), 9.2.1's Reads only and the pass
+(above): Steps 9-9.2 from `sections/review-army.md` as written. `Coverage:` and Step 8's line come from `--audit` when no
 reader ran.
 
 ## 4. Judgment: Steps 8.1, 8.2, 9.3, 9.4 and Step 11
 
-Steps 8.1 and 8.2 (`Scope Check:`) on the todos and commits files, then the core checklist, Steps
+Step 8.1, 9.2.1's probes, 8.2 (`Scope Check:`) on the todos and commits files, then the core checklist, Steps
 9.3, 9.4 and the repeat decision as written (`gstack-review-plan` included;
 `JUDGMENT: ok` before any fix), fixes and persistence in
 one program. Prints `Pre-Landing Review:`, `Gate edits:`. `NEXT: stop` stops; `full` or
diff --git a/ship/sections/tests.md b/ship/sections/tests.md
index 651562cfa..057f2477b 100644
--- a/ship/sections/tests.md
+++ b/ship/sections/tests.md
@@ -213,8 +213,9 @@ Only commit if there are changes. Stage the bootstrap's own files by name (confi
 **Run it:** `~/.claude/skills/gstack/bin/gstack-ship-preflight --tests-only --base <base> --lane <label>=<command>...`
 (or the Step 1 call with lanes). It runs the free pre-gate first, before any lane, eval or
 remote gate (`gstack-pregate --allow-repo-commands`: stage 1 regen, secrets, strays, literals;
-stage 2 the selected lanes under pipefail), then every lane in parallel inside the evidence
-ledger, and prints `PREGATE:` and one `LANE: <label> <state> exit= tests_ran= log=` line each.
+stage 2 the selected lanes under pipefail), then the lanes inside the evidence ledger (one at
+a time on 4 or fewer cores unless `--lanes serial|parallel`), and prints `PREGATE:`, `LANES:` and
+one `LANE: <label> <state> exit= tests_ran= log=` line each.
 `fail` or `incomplete` blocks: fix, rerun. `requires-remote` (other platforms; the remote gate under 8 cores) needs
 `gstack-pregate clear` or, under a user cap, `--remote --spend-cap <usd>`. Rerun
 after the final stamp (`gstack-ship-release finish` does); Step 18 refuses a stale one.
diff --git a/ship/sections/tests.md.tmpl b/ship/sections/tests.md.tmpl
index 02a2463cd..697c16099 100644
--- a/ship/sections/tests.md.tmpl
+++ b/ship/sections/tests.md.tmpl
@@ -9,8 +9,9 @@
 **Run it:** `~/.claude/skills/gstack/bin/gstack-ship-preflight --tests-only --base <base> --lane <label>=<command>...`
 (or the Step 1 call with lanes). It runs the free pre-gate first, before any lane, eval or
 remote gate (`gstack-pregate --allow-repo-commands`: stage 1 regen, secrets, strays, literals;
-stage 2 the selected lanes under pipefail), then every lane in parallel inside the evidence
-ledger, and prints `PREGATE:` and one `LANE: <label> <state> exit= tests_ran= log=` line each.
+stage 2 the selected lanes under pipefail), then the lanes inside the evidence ledger (one at
+a time on 4 or fewer cores unless `--lanes serial|parallel`), and prints `PREGATE:`, `LANES:` and
+one `LANE: <label> <state> exit= tests_ran= log=` line each.
 `fail` or `incomplete` blocks: fix, rerun. `requires-remote` (other platforms; the remote gate under 8 cores) needs
 `gstack-pregate clear` or, under a user cap, `--remote --spend-cap <usd>`. Rerun
 after the final stamp (`gstack-ship-release finish` does); Step 18 refuses a stale one.
diff --git a/test/approval-classes.test.ts b/test/approval-classes.test.ts
index a1a903564..3ca163047 100644
--- a/test/approval-classes.test.ts
+++ b/test/approval-classes.test.ts
@@ -16,7 +16,7 @@ import { EXIT } from '../lib/headless-artifacts';
 import { extractReceipt } from '../lib/ship-receipt';
 import { evaluateApprovals, parseCitations } from '../lib/approval-citations';
 import { scopeOf, type ApprovalHit } from '../lib/approval-classes';
-import { autoplan, runPhase } from './helpers/autoplan-run-fixture';
+import { autoplan, recCarrying, runPhase } from './helpers/autoplan-run-fixture';
 import { BASE_POLICY, cleanup, makeFixtureRepo, runBin, type FixtureRepo } from './helpers/restamp-fixture';
 
 const repos: FixtureRepo[] = [];
@@ -228,7 +228,7 @@ describe('gstack-ship-receipt write enforces declared classes (APPROVAL_CITATION
       expect(autoplan(['next', '--out', out, '--plan', path.join(dir, 'plan.md'), '--no-ui']).status).toBe(0);
       runPhase(out, 'ceo');
       runPhase(out, 'eng');
-      if (approve) expect(autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', 'all']).stdout).toMatch(/^APPROVED: gate_rev=1/m);
+      if (approve) expect(autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', recCarrying(out)]).stdout).toMatch(/^APPROVED: gate_rev=1/m);
       const sha = JSON.parse(fs.readFileSync(path.join(out, 'run.json'), 'utf8')).artifacts['plan.md'].sha256 as string;
       return { out, sha: sha.slice(0, 8) };
     };
@@ -237,17 +237,35 @@ describe('gstack-ship-receipt write enforces declared classes (APPROVAL_CITATION
     const other = run('docs-plan', 'Rewrite the quickstart in docs/quickstart.md with a shorter first step. Tests cover the links.', true);
     const ok = write(repo, `Approved by Garry 2026-10-16 via ${good.sha}\n`, ['--approval-run', other.out, '--approval-run', good.out]);
     expect(ok.status, ok.err).toBe(EXIT.ok);
-    expect(JSON.parse(ok.out).approval.classes[0]).toMatchObject({ class: 'data-repair', citation: 'verified', binding: 'paths', via: good.sha, evidence: expect.stringMatching(/^plan run-\d+ gate_rev=1 p1=a answered_by=human$/) });
+    expect(JSON.parse(ok.out).approval.classes[0]).toMatchObject({ class: 'data-repair', citation: 'verified', binding: 'paths', via: good.sha, evidence: expect.stringMatching(/^plan run-\d+ gate_rev=1 p1=b answered_by=human$/) });
     const notApproved = write(repo, `Approved by Garry 2026-10-16 via ${pending.sha}\n`, ['--approval-run', pending.out]);
     expect(notApproved.err).toMatch(/holds this plan but its gate is not APPROVED \(status gate_pending, p1 unanswered\).*\(APPROVAL_CITATION_MISSING\)$/m);
     const unrelated = write(repo, `Approved by Garry 2026-10-16 via ${other.sha}\n`, ['--approval-run', other.out]);
-    expect(unrelated.err).toMatch(/plan run-\d+ gate_rev=1 p1=a answered_by=human names neither/);
+    expect(unrelated.err).toMatch(/plan run-\d+ gate_rev=1 p1=b answered_by=human names neither/);
     const noRun = write(repo, `Approved by Garry 2026-10-16 via ${good.sha}\n`);
     expect(noRun.err).toMatch(/plan sha [0-9a-f]{8}: pass the autoplan run with --approval-run <dir>.*must attest "for data-repair@[0-9a-f]{12}"/);
     fs.appendFileSync(path.join(good.out, 'plan.md'), '\nsrc/commands/repair/later.ts\n');
     expect(write(repo, `Approved by Garry 2026-10-16 via ${good.sha}\n`, ['--approval-run', good.out]).err).toMatch(/plan\.md does not match its manifest hash/);
   }, 120_000);
 
+  test('a plan gate an agent answered in its own words is not the owner\'s approval: a plan-sha citation of it is rejected', () => {
+    const repo = classRepo();
+    commit(repo, REPAIR);
+    const dir = path.join(repo.root, 'self-approved');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'plan.md'), '# self-approved\n\n## Implementation plan\n\nAdd a data-repair command in src/commands/repair/accepted-takes.ts: explicit, preview-first, never at upgrade. Tests cover preview and apply.\n\n## Review record\n');
+    const out = path.join(dir, 'run');
+    expect(autoplan(['next', '--out', out, '--plan', path.join(dir, 'plan.md'), '--no-ui']).status).toBe(0);
+    runPhase(out, 'ceo');
+    runPhase(out, 'eng');
+    const reply = recCarrying(out);
+    expect(autoplan(['answer', '--by', 'agent:test', '--words-by', 'agent:test', '--owner-reply', reply, '--out', out, '--gate-rev', '1', '--reply', reply]).stdout).toMatch(/^APPROVED: gate_rev=1/m);
+    const sha = (JSON.parse(fs.readFileSync(path.join(out, 'run.json'), 'utf8')).artifacts['plan.md'].sha256 as string).slice(0, 8);
+    const cited = write(repo, `Approved by Garry 2026-10-16 via ${sha}\n`, ['--approval-run', out]);
+    expect(cited.status).toBe(EXIT.fail);
+    expect(cited.err).toMatch(/gate was answered in agent:test's own words, not the owner's.*\(APPROVAL_CITATION_MISSING\)$/m);
+  }, 120_000);
+
   test('an unresolvable reference counts only as an explicit for <class>@<digest> attestation, recorded unverified, and goes stale when the effects change', () => {
     const repo = classRepo();
     commit(repo, REPAIR);
diff --git a/test/approval-record.test.ts b/test/approval-record.test.ts
index facc3afd4..97d42c2cb 100644
--- a/test/approval-record.test.ts
+++ b/test/approval-record.test.ts
@@ -119,13 +119,13 @@ describe('the rendered table is display only', () => {
   });
 });
 
-function autoplanRun(dir: string, answers: Array<{ by: string; words?: string; at: string; p1: string }>) {
+function autoplanRun(dir: string, answers: Array<{ by: string; words?: string; at: string; p1: string; own?: boolean }>) {
   const rows = [];
   for (const a of answers) {
     for (const id of ['d1', 'p1']) rows.push({
       schema_version: 1, run: 'run-1', id: `run-1-${id}`, label: id.toUpperCase(), title: id === 'p1' ? 'Plan approval' : 'Split the CLI [run-1-ceo-native-2]',
       options: ['a', 'b'], recommended: 'a', kind: id === 'p1' ? 'approval' : 'auto', status: 'approved', gate_rev: 1,
-      chosen: id === 'p1' ? a.p1 : 'a', answered_at: a.at, reply: a.words ?? 'rec', answered_by: a.by, ...(a.by === 'human' ? {} : { owner_reply: a.words }),
+      chosen: id === 'p1' ? a.p1 : 'a', answered_at: a.at, reply: a.words ?? 'rec', answered_by: a.by, ...(a.by === 'human' ? {} : a.own ? { answer_words: a.words, words_by: a.by } : { owner_reply: a.words }),
     });
   }
   fs.writeFileSync(path.join(dir, 'decisions.jsonl'), rows.map(r => JSON.stringify(r)).join('\n') + '\n');
@@ -147,6 +147,14 @@ describe('import --autoplan', () => {
     expect(bin(['import', '--autoplan', run, '--by', 'Garry'], { cwd, env: { GSTACK_STATE_ROOT: state } }).out).toMatch(/^APPROVAL_IMPORTED: n=0 skipped=2 /);
   });
 
+  test("each row names its own answerer: --by names only the owner's words, an agent's own words import under the agent (GEVA-2)", () => {
+    const run = tmp('appr-run-');
+    autoplanRun(run, [{ by: 'agent:GSTA-36', words: 'Do it', at: '2026-10-20T21:35:42.697Z', p1: 'a' }, { by: 'agent:GSTA-36', words: 'Accepted on the standing approval', at: '2026-10-21T08:00:00.000Z', p1: 'a', own: true }]);
+    const rows = importAutoplan(run, 'b', 'Garry');
+    if ('code' in rows) throw new Error(rows.message);
+    expect(rows.map(r => [r.by, r.words])).toEqual([['Garry, relayed by agent:GSTA-36', 'Do it'], ["agent:GSTA-36, its own decision (not the owner's words)", 'Accepted on the standing approval']]);
+  });
+
   test('a default run id whose YYYYMMDDHHMMSS stamp passes Luhn still imports (capy-captain-flow flake)', () => {
     const run = tmp('appr-run-');
     autoplanRun(run, [{ by: 'agent:GSTA-1', words: 'rec', at: '2026-10-24T13:15:04.000Z', p1: 'a' }]);
diff --git a/test/autoplan-answer-invalidation.test.ts b/test/autoplan-answer-invalidation.test.ts
index 9eaa9b0d1..8b428b768 100644
--- a/test/autoplan-answer-invalidation.test.ts
+++ b/test/autoplan-answer-invalidation.test.ts
@@ -13,12 +13,12 @@ import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
-import { attemptsOf, autoplan, journal, readRun, resultOf, review, ROOT, runPhase, SMALL_PLAN, startSmallRun } from './helpers/autoplan-run-fixture';
+import { attemptsOf, autoplan, journal, readRun, recCarrying, resultOf, review, ROOT, runPhase, SMALL_PLAN, startSmallRun } from './helpers/autoplan-run-fixture';
 
 const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'autoplan-answer-'));
 afterAll(() => fs.rmSync(TMP, { recursive: true, force: true }));
 
-/** A gated run with a disagreement in ceo (taste item d1) and the fixture's user challenges (uc1 ceo, uc2 eng). */
+/** A gated run with a disagreement in ceo (taste item d1), the fixture's user challenges (uc1 ceo, uc2 eng) and its open Critical/High findings (d2 ceo, d3 and d4 eng). */
 function gatedRun(name: string, extra: string[] = []): string {
   const out = startSmallRun(path.join(TMP, name), extra);
   const disagree = JSON.stringify([
@@ -60,11 +60,12 @@ function incorporate(out: string, ids: string[], edit: string) {
 }
 
 describe('answer', () => {
-  test('the gate lists the disagreement as an auto item and the user challenges as approval items', () => {
+  test('the gate lists the disagreement and the open Critical/High findings as auto items and the user challenges as approval items', () => {
     const out = gatedRun('shape');
     const gate = JSON.parse(fs.readFileSync(path.join(out, 'gate.json'), 'utf8'));
     expect(gate.gate_rev).toBe(1);
-    expect(gate.items.map((i: any) => [i.id, i.kind, i.phase ?? null])).toEqual([['d1', 'auto', 'ceo'], ['uc1', 'approval', 'ceo'], ['uc2', 'approval', 'eng'], ['p1', 'approval', null]]);
+    expect(gate.items.map((i: any) => [i.id, i.kind, i.phase ?? null])).toEqual([['d1', 'auto', 'ceo'], ['uc1', 'approval', 'ceo'], ['d2', 'auto', 'ceo'], ['uc2', 'approval', 'eng'], ['d3', 'auto', 'eng'], ['d4', 'auto', 'eng'], ['p1', 'approval', null]]);
+    expect(gate.items.filter((i: any) => i.finding).map((i: any) => i.id)).toEqual(['d2', 'd3', 'd4']);
     expect(gate.items[0].why).toMatch(/voices disagree: severity: native High, outside Low/);
   }, 30_000);
 
@@ -86,26 +87,27 @@ describe('answer', () => {
     expect(fs.readFileSync(path.join(out, 'run.json'), 'utf8')).toBe(before.run);
     expect(fs.readFileSync(path.join(out, 'decisions.jsonl'), 'utf8')).toBe(before.decisions);
     expect(journal(out).length).toBe(before.journal);
-    // partial: only the auto item answered; approval items stay pending; nothing reviewed changes
+    // partial: only the auto item answered; approval items, and finding items whose default waits on p1 (p1b applies them), stay pending
     const partial = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', 'd1a', '--json']);
     expect(partial.status, partial.stderr).toBe(0);
     expect(JSON.parse(partial.stdout)).toMatchObject({ status: 'gate_pending', outcome: 'gate_pending', pending: ['uc1', 'uc2', 'p1'] });
     const rows = decisions(out);
     expect(rows.find((r: any) => r.label === 'D1')).toMatchObject({ status: 'approved', chosen: 'a' });
-    expect(rows.filter((r: any) => r.status === 'pending').map((r: any) => r.label)).toEqual(['UC1', 'UC2', 'P1']);
+    expect(rows.filter((r: any) => r.status === 'pending').map((r: any) => r.label)).toEqual(['UC1', 'D2', 'UC2', 'D3', 'D4', 'P1']);
   }, 30_000);
 
-  test('`all` finalizes without another paid phase: status complete, decisions approved, no phase reopened', () => {
+  test('`all` carrying the open findings finalizes without another paid phase: status complete, decisions answered, no phase reopened', () => {
     const out = gatedRun('approve');
     const counter = readRun(out).attempt_counter;
-    const r = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', 'all']);
+    const reply = recCarrying(out);
+    const r = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', reply]);
     expect(r.status, r.stderr).toBe(0);
     expect(r.stdout).toMatch(/^APPROVED: gate_rev=1 as-is$/m);
     expect(r.stdout).toContain('GSTACK_RESULT: skill=autoplan status=complete run=' + out);
     const run = readRun(out);
     expect(run.status).toBe('complete');
     expect(run.attempt_counter).toBe(counter);
-    expect(decisions(out).every((d: any) => d.status === 'approved' && d.reply === 'all')).toBe(true);
+    expect(decisions(out).every((d: any) => d.status === (/^D[234]$/.test(d.label) ? 'overridden' : 'approved') && d.reply === reply)).toBe(true);
     expect(journal(out).filter(j => j.event === 'reopened')).toEqual([]);
     const again = autoplan(['next', '--out', out]);
     expect(again.stdout).toContain('status=complete');
@@ -114,7 +116,7 @@ describe('answer', () => {
 
   test('a non-recommended choice on a ceo item is recorded without reopening; revise reopens the changed phases, archives their bound files, and the next gate is gate_rev 2', () => {
     const out = gatedRun('reopen', ['--no-carry-forward']);
-    const r = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', 'all except d1b', '--json']);
+    const r = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', recCarrying(out, 'all', ['d1b']), '--json']);
     expect(r.status, r.stderr).toBe(0);
     const runId = readRun(out).run;
     expect(JSON.parse(r.stdout)).toMatchObject({ status: 'amend_pending', outcome: 'amend_pending', reopened: [], amendments: [`${runId}-d1`] });
@@ -145,12 +147,12 @@ describe('answer', () => {
     expect(eng.outside.stdout).toContain('status=gate_pending');
     expect(readRun(out).gate_rev).toBe(2);
     const rows = decisions(out);
-    expect(rows.filter((x: any) => x.gate_rev === 1)).toHaveLength(4);
+    expect(rows.filter((x: any) => x.gate_rev === 1)).toHaveLength(7);
     expect(rows.filter((x: any) => x.gate_rev === 2 && x.status === 'pending').length).toBeGreaterThan(0);
     const staleAgain = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', 'all']);
     expect(staleAgain.status).toBe(3);
     // closing gate_rev 2 exports a run that validates: rev-2 rows get their own ids beside rev 1's
-    const approve = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '2', '--reply', 'all']);
+    const approve = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '2', '--reply', recCarrying(out)]);
     expect(approve.stdout).toContain('GSTACK_RESULT: skill=autoplan status=complete run=' + out);
     expect(autoplan(['export', '--out', out]).status).toBe(0);
     const ids = decisions(out).map((x: any) => x.id);
@@ -167,7 +169,7 @@ describe('answer', () => {
 
   test('an eng-only override reopens nothing at answer; revise reruns every phase that reviewed the old plan; p1d reopens every phase; p1c keeps the gate; p1e ends incomplete', () => {
     const out = gatedRun('eng-only', ['--max-rounds', '3', '--no-carry-forward']);
-    const engOnly = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', 'all except uc2b', '--json']);
+    const engOnly = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '1', '--reply', recCarrying(out, 'all', ['uc2b']), '--json']);
     const runId = readRun(out).run;
     expect(JSON.parse(engOnly.stdout)).toMatchObject({ outcome: 'amend_pending', reopened: [], amendments: [`${runId}-uc2`] });
     expect(readRun(out).phases.ceo.closed_at).toBeTruthy();
@@ -178,13 +180,13 @@ describe('answer', () => {
     expect(runPhase(out, 'ceo').outside.stdout).toMatch(/PHASE_CLOSED: ceo/);
     const eng = runPhase(out, 'eng');
     expect(eng.outside.stdout).toContain('status=gate_pending');
-    const interrogate = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '2', '--reply', 'all except p1c', '--json']);
+    const interrogate = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '2', '--reply', recCarrying(out, 'all', ['p1c']), '--json']);
     expect(JSON.parse(interrogate.stdout)).toMatchObject({ status: 'gate_pending', outcome: 'gate_pending' });
-    const revise = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '2', '--reply', 'all except p1d', '--json']);
+    const revise = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '2', '--reply', recCarrying(out, 'all', ['p1d']), '--json']);
     expect(JSON.parse(revise.stdout)).toMatchObject({ outcome: 'reopened', reopened: ['ceo', 'eng'] });
     runPhase(out, 'ceo');
     runPhase(out, 'eng');
-    const reject = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '3', '--reply', 'all except p1e']);
+    const reject = autoplan(['answer', '--by', 'human', '--out', out, '--gate-rev', '3', '--reply', recCarrying(out, 'all', ['p1e'])]);
     expect(reject.status).toBe(0);
     expect(reject.stdout).toContain('GSTACK_RESULT: skill=autoplan status=incomplete run=' + out);
     expect(readRun(out).deviations).toContain('plan rejected by the owner at gate_rev 3');
diff --git a/test/autoplan-budget.test.ts b/test/autoplan-budget.test.ts
index 82976daf1..56e6a8ad4 100644
--- a/test/autoplan-budget.test.ts
+++ b/test/autoplan-budget.test.ts
@@ -1,7 +1,7 @@
 /**
  * Field list 2, W5: the autoplan run budget on the simulated Capy host. An
- * unattended Capy run reserves the default per-voice estimate so --spend-cap
- * binds, and a refused dispatch stops the run `incomplete` with a structured
+ * unattended run under --spend-cap (or on Capy) reserves the default per-voice
+ * estimate so the cap binds, `--estimate-usd` persists for later phases, and a refused dispatch stops the run `incomplete` with a structured
  * stop object that export, validate and resume understand; `budget` journals
  * the owner's raise. `close --deferred` keeps a dispatched voice's
  * reservation, routes an open Critical to the gate and carries open findings
@@ -258,3 +258,37 @@ describe('confirm rounds', () => {
     expect(rows[1].settled_by).toBeUndefined();
   });
 });
+
+describe('the cap binds on every unattended host (GBRA-223 claim 4)', () => {
+  const OFF_CAPY = { GSTACK_CAPY: '' };
+  test('a capped unattended run off Capy reserves the default per voice, so the cap stops it; with no cap it reserves nothing', () => {
+    const dir = path.join(r.host.base, 'offcapy');
+    const out = path.join(dir, 'run');
+    const first = r.ap(['next', '--out', out, '--plan', writePlan(dir), '--no-ui', '--spend-cap', '12'], OFF_CAPY);
+    expect(first.status, first.stderr).toBe(0);
+    expect(first.stdout).toMatch(/^ESTIMATE: 5\.00 per voice reserved for each host-subagent attempt/m);
+    expect(spend(out).reserved.map((x: any) => x.estimate_usd)).toEqual([DEFAULT_HOST_ESTIMATE_USD, DEFAULT_HOST_ESTIMATE_USD]);
+    phaseVia(r, out, 'ceo', NONE);
+    const stopped = r.ap(['next', '--out', out], OFF_CAPY);
+    expect(stopped.status).toBe(3);
+    expect(stopped.stderr).toMatch(/\(SPEND_CAP_EXCEEDED\)$/m);
+    const freeDir = path.join(r.host.base, 'offcapy-nocap');
+    const free = path.join(freeDir, 'run');
+    const uncapped = r.ap(['next', '--out', free, '--plan', writePlan(freeDir), '--no-ui'], OFF_CAPY);
+    expect(uncapped.status, uncapped.stderr).toBe(0);
+    expect(uncapped.stdout).not.toMatch(/^ESTIMATE:/m);
+    expect(spend(free).reserved.map((x: any) => x.estimate_usd)).toEqual([0, 0]);
+  });
+
+  test('--estimate-usd persists: later phases reserve it without the flag', () => {
+    const s = start(['--spend-cap', '40', '--estimate-usd', '3']);
+    expect(spend(s.out).reserved.map((x: any) => x.estimate_usd)).toEqual([3, 3]);
+    expect(readRunJson(s.out).estimate_usd).toBe(3);
+    phaseVia(r, s.out, 'ceo', NONE);
+    expect(spend(s.out).settled.map((x: any) => x.reserved_usd)).toEqual([3, 3]);
+    const eng = r.ap(['next', '--out', s.out]);
+    expect(eng.status, eng.stderr).toBe(0);
+    expect(eng.stdout).toMatch(/^PHASE: eng /m);
+    expect(spend(s.out).reserved.map((x: any) => x.estimate_usd)).toEqual([3, 3]);
+  });
+});
diff --git a/test/autoplan-capy-e2e.test.ts b/test/autoplan-capy-e2e.test.ts
index f29a7c372..d5d52ec01 100644
--- a/test/autoplan-capy-e2e.test.ts
+++ b/test/autoplan-capy-e2e.test.ts
@@ -12,7 +12,7 @@ import { afterAll, describe, expect, test } from 'bun:test';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { RESULT_CODES } from '../lib/result-codes';
-import { ROOT, SMALL_PLAN, boundOf, resultOf } from './helpers/autoplan-run-fixture';
+import { ROOT, SMALL_PLAN, boundOf, recCarrying, resultOf } from './helpers/autoplan-run-fixture';
 import { capyRunner, phaseVia, readJsonl, readRunJson, writePlan, type CapyRunner } from './helpers/autoplan-capy';
 
 const r = capyRunner();
@@ -55,11 +55,11 @@ describe('unattended runs on the Capy host', () => {
       phaseVia(r, s.out, 'ceo');
       expect(phaseVia(r, s.out, 'eng').outside.stdout).toContain('status=gate_pending');
       expectReviewedHashes(s.out);
-      expect(ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', String(rev), '--reply', 'all except p1d'])).stdout).toMatch(/^REOPENED: ceo,eng \(Eng last\) reason=revise$/m);
+      expect(ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', String(rev), '--reply', recCarrying(s.out, 'all', ['p1d'])])).stdout).toMatch(/^REOPENED: ceo,eng \(Eng last\) reason=revise$/m);
     }
     phaseVia(r, s.out, 'ceo');
     phaseVia(r, s.out, 'eng');
-    expect(ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '3', '--reply', 'all'])).stdout).toContain('status=complete');
+    expect(ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '3', '--reply', recCarrying(s.out)])).stdout).toContain('status=complete');
     ok(r.ap(['export', '--out', s.out]));
     const v = ok(r.validate(s.out));
     expect(v.stdout).toMatch(/^ARTIFACT_VALID: run=\S+ status=complete/m);
@@ -83,7 +83,7 @@ describe('unattended runs on the Capy host', () => {
     const gated = ok(r.ap(['submit', '--out', s.out, '--phase', 'eng', '--voice', 'outside', '--unavailable', 'no cross-family subagent on this host']));
     expect(gated.stdout).toMatch(/^PHASE_CLOSED: eng .*coverage=native_only/m);
     expect(gated.stdout).toContain('status=gate_pending');
-    expect(ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '1', '--reply', 'all'])).stdout).toContain('status=complete');
+    expect(ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '1', '--reply', recCarrying(s.out)])).stdout).toContain('status=complete');
     ok(r.ap(['export', '--out', s.out]));
     expect(ok(r.validate(s.out)).stdout).toMatch(/^ARTIFACT_VALID: run=\S+ status=complete attested=1$/m);
     expect(fs.readFileSync(path.join(s.out, 'review-record.md'), 'utf8')).toMatch(/attested/);
@@ -94,7 +94,7 @@ describe('unattended runs on the Capy host', () => {
     const s = start();
     phaseVia(r, s.out, 'ceo');
     phaseVia(r, s.out, 'eng');
-    ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '1', '--reply', 'all except p1d']));
+    ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '1', '--reply', recCarrying(s.out, 'all', ['p1d'])]));
     phaseVia(r, s.out, 'ceo');
     phaseVia(r, s.out, 'eng');
     const file = path.join(s.out, 'decisions.jsonl');
@@ -102,7 +102,7 @@ describe('unattended runs on the Capy host', () => {
     const manifest = readRunJson(s.out);
     delete manifest.gstack_version;
     fs.writeFileSync(path.join(s.out, 'run.json'), JSON.stringify(manifest, null, 2) + '\n');
-    const res = ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '2', '--reply', 'all']));
+    const res = ok(r.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '2', '--reply', recCarrying(s.out)]));
     expect(res.stdout).toMatch(/^GSTACK_VERSION_CHANGED: run unknown -> /m);
     expect(res.stdout).toContain('status=complete');
     ok(r.ap(['export', '--out', s.out]));
@@ -150,7 +150,7 @@ describe('conformance: one run through every mechanism', () => {
     const accept = JSON.parse(fs.readFileSync(path.join(s.out, 'gate.json'), 'utf8')).items.find((i: any) => i.title.startsWith('Gate the backoff')).id;
     // partial, then full
     expect(ok(c.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '1', '--reply', `${accept}b`])).stdout).toMatch(/^GATE_PENDING: p1/m);
-    const full = ok(c.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '1', '--reply', 'all']));
+    const full = ok(c.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '1', '--reply', recCarrying(s.out)]));
     expect(full.stdout).toMatch(new RegExp(`^APPLY: ${run}-${accept} `, 'm'));
     const pendingNext = c.ap(['next', '--out', s.out]).stderr;
     expect(pendingNext).toMatch(/\(PLAN_AMEND_PENDING\)$/m);
@@ -169,10 +169,10 @@ describe('conformance: one run through every mechanism', () => {
     for (const voice of ['native', 'outside']) ok(c.ap(['submit', '--out', s.out, '--phase', 'ceo', '--voice', voice, '--result', resultOf(s.out, 'ceo', voice as 'native' | 'outside'), '--model', voice === 'native' ? 'anthropic/claude-opus-5-5' : 'openai/gpt-6.1-sol']));
     phaseVia(c, s.out, 'eng');
     expect(readRunJson(s.out).gate_rev).toBe(2);
-    ok(c.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '2', '--reply', 'all except p1d']));
+    ok(c.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '2', '--reply', recCarrying(s.out, 'all', ['p1d'])]));
     phaseVia(c, s.out, 'ceo');
     phaseVia(c, s.out, 'eng');
-    expect(ok(c.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '3', '--reply', 'all'])).stdout).toContain('status=complete');
+    expect(ok(c.ap(['answer', '--by', 'human', '--out', s.out, '--gate-rev', '3', '--reply', recCarrying(s.out)])).stdout).toContain('status=complete');
     ok(c.ap(['export', '--out', s.out]));
     expect(ok(c.validate(s.out)).stdout).toMatch(/^ARTIFACT_VALID: run=\S+ status=complete/m);
     const final = readRunJson(s.out);
diff --git a/test/autoplan-carry.test.ts b/test/autoplan-carry.test.ts
index 1243aa71f..3bbaf000c 100644
--- a/test/autoplan-carry.test.ts
+++ b/test/autoplan-carry.test.ts
@@ -31,7 +31,7 @@ const decisions = (out: string) => readJsonl(path.join(out, 'decisions.jsonl'));
 const journal = (out: string) => readJsonl(path.join(out, 'attempts.jsonl'));
 
 /** Gate 1 with one recommended plan change (uc1b), answered with the owner's words, then revised to take it. */
-function answeredAndRevised(args: string[] = [], words = 'Garry: Do it', ceo: { native?: unknown[]; outside?: unknown[] } = AGREE) {
+function answeredAndRevised(args: string[] = [], words = 'Garry: Do it', ceo: { native?: unknown[]; outside?: unknown[] } = AGREE, answerArgs: string[] = []) {
   const dir = path.join(r.host.base, `carry${++n}`);
   const plan = writePlan(dir);
   const out = path.join(dir, 'run');
@@ -39,7 +39,7 @@ function answeredAndRevised(args: string[] = [], words = 'Garry: Do it', ceo: {
   phaseVia(r, out, 'ceo', ceo);
   expect(phaseVia(r, out, 'eng', NONE).outside.stdout).toContain('status=gate_pending');
   const run = readRunJson(out).run;
-  const ans = r.ap(['answer', '--out', out, '--gate-rev', '1', '--reply', 'rec', '--rec-hash', recHashOf(out), '--by', 'agent:gstack-minder', '--owner-reply', words]);
+  const ans = r.ap(['answer', '--out', out, '--gate-rev', '1', '--reply', 'rec', '--rec-hash', recHashOf(out), '--by', 'agent:gstack-minder', '--owner-reply', words, ...answerArgs]);
   expect(ans.status, ans.stderr).toBe(0);
   expect(ans.stdout).toMatch(/^APPLY: /m);
   const v2 = path.join(dir, 'plan-v2.md');
@@ -50,6 +50,58 @@ function answeredAndRevised(args: string[] = [], words = 'Garry: Do it', ceo: {
 }
 const recHashOf = (out: string) => recHash(gateOf(out));
 
+describe('whose words answered the gate (GEVA-2, P7)', () => {
+  test("an agent's own words are recorded as its own, never as the owner's, never carried, and imported under the agent", () => {
+    const s = answeredAndRevised([], 'Accepted on the standing approval', AGREE, ['--words-by', 'agent:gstack-minder']);
+    const p1 = decisions(s.out).find(d => d.gate_rev === 1 && d.label === 'P1');
+    expect(p1).toMatchObject({ answer_words: 'Accepted on the standing approval', words_by: 'agent:gstack-minder' });
+    expect(p1.owner_reply).toBeUndefined();
+    phaseVia(r, s.out, 'ceo', NONE);
+    const eng = phaseVia(r, s.out, 'eng', NONE).outside;
+    expect(eng.stdout).toMatch(/^CARRY: no \(gate_rev 1 was answered in agent:gstack-minder's own words, not the owner's\)$/m);
+    expect(eng.stdout).toContain('status=gate_pending');
+    const rows = importAutoplan(s.out, 'feature/x', 'Garry');
+    if ('code' in rows) throw new Error(rows.message);
+    expect(rows[0]).toMatchObject({ by: "agent:gstack-minder, its own decision (not the owner's words)", words: 'Accepted on the standing approval' });
+    expect(r.ap(['export', '--out', s.out]).status).toBe(0);
+    expect(r.validate(s.out).status).toBe(0);
+  });
+
+  test('a later answer from someone else replaces the earlier answer\'s authorship and words; nothing stale survives', () => {
+    const dir = path.join(r.host.base, `carry${++n}`);
+    const out = path.join(dir, 'run');
+    expect(r.ap(['next', '--out', out, '--plan', writePlan(dir), '--no-ui']).status).toBe(0);
+    phaseVia(r, out, 'ceo', NONE);
+    phaseVia(r, out, 'eng', NONE);
+    const first = r.ap(['answer', '--out', out, '--gate-rev', '1', '--reply', 'p1c', '--by', 'agent:gstack-minder', '--words-by', 'agent:gstack-minder', '--owner-reply', 'p1c']);
+    expect(first.status, first.stderr).toBe(0);
+    const second = r.ap(['answer', '--out', out, '--gate-rev', '1', '--reply', 'p1a', '--by', 'human']);
+    expect(second.status, second.stderr).toBe(0);
+    expect(second.stdout).toMatch(/^APPROVED: gate_rev=1/m);
+    const p1 = decisions(out).find(d => d.gate_rev === 1 && d.label === 'P1');
+    expect(p1).toMatchObject({ chosen: 'a', answered_by: 'human' });
+    for (const stale of ['words_by', 'answer_words', 'answer_words_parsed', 'owner_reply', 'owner_reply_parsed']) expect(p1[stale]).toBeUndefined();
+    const rows = importAutoplan(out, 'feature/x', 'Garry');
+    if ('code' in rows) throw new Error(rows.message);
+    expect(rows[0]!.by).not.toContain('agent:gstack-minder');
+  });
+
+  test('--words-by names the owner or the answering agent; anything else is refused', () => {
+    const dir = path.join(r.host.base, `carry${++n}`);
+    const out = path.join(dir, 'run');
+    expect(r.ap(['next', '--out', out, '--plan', writePlan(dir), '--no-ui']).status).toBe(0);
+    phaseVia(r, out, 'ceo', AGREE);
+    phaseVia(r, out, 'eng', NONE);
+    const base = ['answer', '--out', out, '--gate-rev', '1', '--reply', 'rec', '--rec-hash', recHashOf(out), '--owner-reply', 'ok'];
+    for (const bad of [['--by', 'agent:gstack-minder', '--words-by', 'agent:someone-else'], ['--by', 'human', '--words-by', 'agent:gstack-minder'], ['--by', 'agent:gstack-minder', '--words-by', 'Garry']]) {
+      const res = r.ap([...base, ...bad]);
+      expect(res.status, res.stdout).not.toBe(0);
+      expect(res.stderr).toContain('--words-by must be owner or the answering agent');
+    }
+    expect(decisions(out).every(d => d.status === 'pending')).toBe(true);
+  });
+});
+
 describe('carry-forward', () => {
   test('a second gate with nothing new carries the owner\'s words: CARRIED, APPROVED, the record names its source', () => {
     const s = answeredAndRevised();
@@ -123,20 +175,36 @@ describe('carry-forward', () => {
     expect(phaseVia(r, rec.out, 'eng', PKG).outside.stdout).toMatch(/^CARRY: no \(new item \w+: Split the backoff/m);
   });
 
-test('an earlier answer in item tokens, or one that left an item unanswered, is not carried', () => {
+  /** Gate 1 answered item by item (every item's recommendation as tokens) by the owner, then revised to take uc1. */
+  function tokensAndRevised() {
     const dir = path.join(r.host.base, `carry${++n}`);
     const out = path.join(dir, 'run');
     expect(r.ap(['next', '--out', out, '--plan', writePlan(dir), '--no-ui']).status).toBe(0);
     phaseVia(r, out, 'ceo', AGREE);
     phaseVia(r, out, 'eng', NONE);
-    const g = gateOf(out);
-    const tokens = g.items.map((i: any) => `${i.id}${i.recommended}`).join(' ');
+    const tokens = gateOf(out).items.map((i: any) => `${i.id}${i.recommended}`).join(' ');
     expect(r.ap(['answer', '--out', out, '--gate-rev', '1', '--reply', tokens, '--by', 'human']).status).toBe(0);
     const v2 = path.join(dir, 'plan-v2.md');
     fs.writeFileSync(v2, V2);
     expect(r.ap(['revise', '--out', out, '--plan', v2, '--incorporates', 'uc1']).status).toBe(0);
     phaseVia(r, out, 'ceo', NONE);
-    expect(phaseVia(r, out, 'eng', NONE).outside.stdout).toMatch(/^CARRY: no \(gate_rev 1 was answered with item tokens, not rec or "do it"\)$/m);
+    return { out, tokens, p1: decisions(out).find(x => x.gate_rev === 1 && x.label === 'P1') };
+  }
+
+  test('an item-token answer carries when the later gate asks nothing new: the owner\'s p1 choice and verbatim tokens are the basis', () => {
+    const s = tokensAndRevised();
+    const eng = phaseVia(r, s.out, 'eng', NONE).outside;
+    expect(eng.status, eng.stderr).toBe(0);
+    expect(eng.stdout).toContain(`CARRIED: gate_rev=2 <- gate_rev=1 words=${JSON.stringify(s.tokens)} by=human reason=no new choice; plan unchanged since the accepted changes`);
+    expect(eng.stdout).toMatch(/^APPROVED: gate_rev=2/m);
+    expect(decisions(s.out).find(x => x.gate_rev === 2 && x.label === 'P1')).toMatchObject({ chosen: s.p1.chosen, carried_gate_from: s.p1.id });
+  });
+
+  test('an item-token answer is not carried past a new item', () => {
+    const s = tokensAndRevised();
+    const PKG = { native: [{ id: 'F7', severity: 'Medium', title: 'Split the backoff into its own PR', user_challenge: true, changes: 'packaging', fix: 'own PR' }], outside: [] };
+    expect(phaseVia(r, s.out, 'eng', PKG).outside.stdout).toMatch(/^CARRY: no \(new item \w+: Split the backoff/m);
+    expect(readRunJson(s.out).status).toBe('gate_pending');
   });
 
   test('an answer that left an approval item pending is not carried', () => {
diff --git a/test/autoplan-ceo-only.test.ts b/test/autoplan-ceo-only.test.ts
new file mode 100644
index 000000000..c301089a1
--- /dev/null
+++ b/test/autoplan-ceo-only.test.ts
@@ -0,0 +1,123 @@
+import { afterAll, describe, expect, test } from 'bun:test';
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { parseResult } from '../lib/headless-artifacts';
+import { CEO_REVIEW_HEADINGS, ceoOnlyEvidence, listFiles } from './helpers/autoplan-ceo-only-evidence';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+const read = (rel: string) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const handoff = (...args: string[]) => spawnSync('bash', [path.join(ROOT, 'bin/gstack-ceo-mode-handoff'), ...args], { encoding: 'utf8', timeout: 10_000 });
+
+describe('/autoplan --ceo-only skill text', () => {
+  const skill = read('autoplan/SKILL.md');
+  const section = read('autoplan/sections/ceo-only.md');
+
+  test('the section index routes --ceo-only to its section before any preamble block', () => {
+    expect(skill).toContain('| the invocation names `--ceo-only` (read before any preamble instruction block) | `sections/ceo-only.md` |');
+  });
+
+  test('the section forbids every question channel and names the skipped offers', () => {
+    for (const s of ['Never call AskUserQuestion (native or `mcp__*`) or\nExitPlanMode', 'never ask the user in prose', 'never wait for a reply',
+      'office-hours and BENEFITS_FROM', "0E's question", 'Next Steps chaining and CEO plan\npromotion', '**Never applied:** a user challenge'])
+      expect(section).toContain(s);
+  });
+
+  test('the section runs CEO only, honors --no-outside and the state root, and ends status=reviewed', () => {
+    expect(section).toContain('Run Phases 0, 0.5 and 1 only');
+    expect(section).toContain("`outside_status: disabled (--no-outside)`");
+    expect(section).toContain('`GSTACK_STATE_ROOT`\n(the override');
+    expect(section).toContain('gstack-ceo-mode-handoff "<mode>" --ceo-only');
+    expect(section).toContain('`GSTACK_RESULT: skill=autoplan status=reviewed run=<absolute $_AP>`');
+    for (const h of CEO_REVIEW_HEADINGS) expect(section.replace(/\`\n\`/g, '` `').replace(/\n/g, ' ')).toContain(h.replace(/\n/g, ' '));
+  });
+});
+
+test('a normal /autoplan run never reads sections/ceo-only.md (the parity raise in carve-guards.ts rests on it)', () => {
+  const skill = read('autoplan/SKILL.md');
+  expect(skill.split('ceo-only.md').length - 1).toBe(1);
+  expect(skill).toContain('| the invocation names `--ceo-only` (read before any preamble instruction block) | `sections/ceo-only.md` |');
+  const others = fs.readdirSync(path.join(ROOT, 'autoplan/sections')).filter(f => f.endsWith('.md') && f !== 'ceo-only.md')
+    .map(f => `autoplan/sections/${f}`);
+  const runner = ['bin/gstack-autoplan', 'autoplan/DRIVER.md', ...fs.readdirSync(path.join(ROOT, 'lib')).filter(f => f.startsWith('autoplan-')).map(f => `lib/${f}`)];
+  for (const rel of [...others, ...runner]) expect(read(rel), rel).not.toContain('ceo-only.md');
+});
+
+describe('gstack-ceo-mode-handoff --ceo-only', () => {
+  test('names the CEO-only rule, not a saved preference', () => {
+    const r = handoff('SELECTIVE_EXPANSION', '--ceo-only');
+    expect(r.status).toBe(0);
+    expect(r.stdout.trim()).toBe("Auto-selected review mode → SELECTIVE EXPANSION (CEO-only run: Step 0E's rule). Approved decisions: none.");
+  });
+  test('refuses --auto with --ceo-only', () => {
+    const r = handoff('HOLD SCOPE', '--auto', '--ceo-only');
+    expect(r.status).toBe(2);
+    expect(r.stderr).toContain('--auto and --ceo-only conflict');
+  });
+});
+
+test('GSTACK_RESULT parses status=reviewed', () => {
+  expect(parseResult('x\nGSTACK_RESULT: skill=autoplan status=reviewed run=/r')).toEqual({ skill: 'autoplan', status: 'reviewed', run: '/r' });
+});
+
+describe('ceo-only evidence: a passing run and each negative control', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ceo-only-evidence-'));
+  afterAll(() => fs.rmSync(root, { recursive: true, force: true }));
+  const runDir = path.join(root, 'run');
+  fs.mkdirSync(runDir);
+  const review = ['# CEO-only review: Pricing tier', '', 'Mode: HOLD SCOPE (ceo-only). Not approved.', '',
+    '## User challenges (direction kept)', 'None.', '## Scope added', 'None.', '## Conservative choices', 'None.',
+    '## Findings', '- High: the premise was never checked with developers; interview them first.',
+    '## Decision Audit Trail', '| # | Phase | Decision |', '|---|---|---|', '| 1 | CEO | Mode HOLD SCOPE |', ''].join('\n');
+  fs.writeFileSync(path.join(runDir, 'ceo-review.md'), review);
+  const assistant = (...content: any[]) => ({ type: 'assistant', message: { content } });
+  const user = (...content: any[]) => ({ type: 'user', message: { content } });
+  const good = [
+    assistant({ type: 'tool_use', id: 't1', name: 'Bash', input: { command: '~/.claude/skills/gstack/bin/gstack-ceo-mode-handoff "HOLD SCOPE" --ceo-only --decisions "none"' } }),
+    user({ type: 'tool_result', tool_use_id: 't1', content: "Auto-selected review mode → HOLD SCOPE (CEO-only run: Step 0E's rule). Approved decisions: none." }),
+    assistant({ type: 'tool_use', id: 't2', name: 'Agent', input: { prompt: 'native CEO review' } }),
+    assistant({ type: 'text', text: 'Phases 2, 2.5, 3 and 4 skipped (CEO-only run).' }),
+  ];
+  const output = `Review done.\nGSTACK_RESULT: skill=autoplan status=reviewed run=${runDir}`;
+  const base = { transcript: good, output, strayWrites: [] as string[], mustMention: [/developer/i, /interview|talk|validat/i] };
+
+  test('a complete run passes', () => {
+    const e = ceoOnlyEvidence(base);
+    expect(e.reasons).toEqual([]);
+    expect(e.runDir).toBe(runDir);
+  });
+  const fails = (name: string, patch: Partial<typeof base>, reason: RegExp) => test(name, () => {
+    const e = ceoOnlyEvidence({ ...base, ...patch });
+    expect(e.passed).toBe(false);
+    expect(e.reasons.join('\n')).toMatch(reason);
+  });
+  fails('an AskUserQuestion call fails', { transcript: [...good, assistant({ type: 'tool_use', id: 'q', name: 'AskUserQuestion', input: {} })] }, /asked 1 question/);
+  fails('an MCP AskUserQuestion variant fails', { transcript: [...good, assistant({ type: 'tool_use', id: 'q', name: 'mcp__conductor__AskUserQuestion', input: {} })] }, /asked 1 question/);
+  fails('ExitPlanMode fails', { transcript: [...good, assistant({ type: 'tool_use', id: 'q', name: 'ExitPlanMode', input: {} })] }, /tool ExitPlanMode/);
+  fails('a prose question fails', { output: `Which mode would you like me to use?\n${output}` }, /prose: Which mode would you like/);
+  fails('a wrong terminal status fails', { output: output.replace('status=reviewed', 'status=gate_pending') }, /status=gate_pending, expected reviewed/);
+  fails('a missing terminal line fails', { output: 'Review done.' }, /no GSTACK_RESULT line/);
+  fails('headings without a review fail', { transcript: [assistant({ type: 'text', text: 'Done.' })] }, /no gstack-ceo-mode-handoff[\s\S]*no CEO reviewer subagent/);
+  fails('loading a skipped phase fails', { transcript: [...good, assistant({ type: 'tool_use', id: 'r', name: 'Read', input: { file_path: '/h/.claude/skills/gstack/autoplan/sections/eng-phase.md' } })] }, /loaded a skipped phase/);
+  fails('loading a skipped phase through Bash fails', { transcript: [...good, assistant({ type: 'tool_use', id: 'b', name: 'Bash', input: { command: 'cat /h/.claude/skills/gstack/autoplan/sections/dx-phase.md' } })] }, /loaded a skipped phase: cat /);
+  fails('a write outside its roots fails', { strayWrites: ['.config/x.json'] }, /wrote 1 file\(s\) outside its roots, under \.config\/x\.json/);
+  fails('a review that misses the seeded flaw fails', { mustMention: [/churn/i] }, /never names the seeded flaw/);
+  test('a missing ceo-review.md fails', () => {
+    const empty = path.join(root, 'empty');
+    fs.mkdirSync(empty);
+    const e = ceoOnlyEvidence({ ...base, output: `GSTACK_RESULT: skill=autoplan status=reviewed run=${empty}` });
+    expect(e.reasons.join('\n')).toContain('ceo-review.md is missing');
+  });
+  test('listFiles skips the declared roots', () => {
+    const home = path.join(root, 'home');
+    fs.mkdirSync(path.join(home, 'state'), { recursive: true });
+    fs.writeFileSync(path.join(home, 'state', 'a'), '');
+    fs.writeFileSync(path.join(home, 'b'), '');
+    fs.mkdirSync(path.join(home, '.bun', 'install', 'cache'), { recursive: true });
+    fs.writeFileSync(path.join(home, '.bun', 'install', 'cache', 'c'), '');
+    fs.mkdirSync(path.join(home, '.bun', 'bin'), { recursive: true });
+    fs.writeFileSync(path.join(home, '.bun', 'bin', 'd'), '');
+    expect(listFiles(home, ['state', '.bun/install/cache'])).toEqual(['.bun/bin/d', 'b']);
+  });
+});
diff --git a/test/autoplan-gate-cost.test.ts b/test/autoplan-gate-cost.test.ts
index 95e8f35d0..f29869b2a 100644
--- a/test/autoplan-gate-cost.test.ts
+++ b/test/autoplan-gate-cost.test.ts
@@ -188,7 +188,7 @@ describe('E16 end to end: every gate-producing command prints the cost, and the
 
 
   test('the closing submit prints GATE_SPEND/GATE_REC_COST (text) or gate_cost (--json); the owner brief carries the Cost so far sentence and render --captain a ### Cost section above the relaying trailer', () => {
-    const out = gateRun('plain', {}, { challenge: false, json: true });
+    const out = gateRun('plain', { severity: 'Medium' }, { challenge: false, json: true });
     const brief = spawnSync(process.execPath, [path.join(ROOT, 'bin', 'gstack-owner-brief'), 'render', '--out', out], { cwd: ROOT, env: env(), encoding: 'utf8', timeout: 30_000 });
     expect(brief.stdout).toMatch(/Cost so far: spent \d+\.\d\d, worst case \d+\.\d\d \(/);
     const captain = spawnSync(process.execPath, [path.join(ROOT, 'bin', 'gstack-owner-brief'), 'render', '--captain', '--out', out, '--allow-incomplete'], { cwd: ROOT, env: env(), encoding: 'utf8', timeout: 30_000 });
@@ -203,7 +203,7 @@ describe('E16 end to end: every gate-producing command prints the cost, and the
   });
 
   test('run at a pending gate prints the gate lines once: text mode carries GATE_SPEND/GATE_REC_COST, --json exactly one payload with gate_cost', () => {
-    const out = gateRun('run-gate', {}, { challenge: false });
+    const out = gateRun('run-gate', { severity: 'Medium' }, { challenge: false });
     const models = ['--native-model', 'anthropic/claude-opus-4-7', '--outside-model', 'openai/gpt-6-astra'];
     const text = autoplan(['run', '--out', out, ...models]);
     expect(text.status).toBe(0);
diff --git a/test/autoplan-gate-judgment.test.ts b/test/autoplan-gate-judgment.test.ts
index 02e841837..89b0c6ae6 100644
--- a/test/autoplan-gate-judgment.test.ts
+++ b/test/autoplan-gate-judgment.test.ts
@@ -17,8 +17,9 @@ import { afterAll, describe, expect, test } from 'bun:test';
 import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { ROOT, SMALL_PLAN, boundOf, resultOf } from './helpers/autoplan-run-fixture';
+import { ROOT, SMALL_PLAN, boundOf, recCarrying, resultOf } from './helpers/autoplan-run-fixture';
 import { capyRunner, phaseVia, readJsonl, readRunJson, writePlan } from './helpers/autoplan-capy';
+import { settledIds } from '../lib/autoplan-confirm';
 
 const r = capyRunner();
 afterAll(() => r.cleanup());
@@ -119,7 +120,7 @@ describe('accepted changes are amendments', () => {
     expect(held.status, held.stderr).toBe(0);
     expect(held.stdout).toMatch(/^GATE_PENDING: uc2, p1 unanswered \(reply with uc2a\|uc2b p1a\|p1b\|p1c\|p1d\|p1e or rec\)$/m);
     expect(held.stdout).not.toMatch(/^APPLY:/m);
-    const res = answer(g.out, 1, 'rec');
+    const res = answer(g.out, 1, recCarrying(g.out, 'rec'));
     expect(res.status, res.stderr).toBe(0);
     expect(res.stdout).toMatch(new RegExp(`^APPLY: ${esc(g.run)}-uc1 Ship the backoff behind a flag first .* -> accept the change both reviewers recommend.*; edit the plan, then revise$`, 'm'));
     expect(res.stdout).not.toMatch(/^REOPENED:/m);
@@ -165,7 +166,7 @@ describe('accepted changes are amendments', () => {
     expect(asIs.stdout).not.toMatch(/^APPLY:/m);
     expect(decisions(g.out).find(d => d.label === 'UC1')).toMatchObject({ chosen: 'a', status: 'approved' });
     const w = gated(AGREE, {});
-    expect(answer(w.out, 1, 'rec except uc1b').stdout).toMatch(/^APPLY:/m);
+    expect(answer(w.out, 1, recCarrying(w.out, 'rec', ['uc1b'])).stdout).toMatch(/^APPLY:/m);
     const withdraw = r.ap(['revise', '--out', w.out, '--withdraw', `${w.run}-uc1`]);
     expect(withdraw.status, withdraw.stderr).toBe(0);
     expect(withdraw.stdout).toMatch(/^APPROVED: gate_rev=1 \(every accepted change is in the plan or settled\)$/m);
@@ -179,7 +180,7 @@ describe('record-only changes settle without a plan edit', () => {
   test('a packaging change: APPLY says settle, revise --settle reopens nothing and completes, export and validate pass; a scope change never settles', () => {
     const g = gated(PACKAGING, {});
     expect(gate(g.out).items.find((i: any) => i.id === 'uc1')).toMatchObject({ recommended: 'b', changes: 'packaging' });
-    const res = answer(g.out, 1, 'rec');
+    const res = answer(g.out, 1, recCarrying(g.out, 'rec'));
     expect(res.status, res.stderr).toBe(0);
     expect(res.stdout).toMatch(new RegExp(`^APPLY: ${esc(g.run)}-uc1 .*; no plan edit needed: revise --settle uc1$`, 'm'));
     expect(readRunJson(g.out).status).toBe('amend_pending');
@@ -196,7 +197,7 @@ describe('record-only changes settle without a plan edit', () => {
     expect(r.ap(['export', '--out', g.out]).status).toBe(0);
     expect(r.validate(g.out).status).toBe(0);
     const scope = gated(AGREE, {});
-    expect(answer(scope.out, 1, 'rec except uc1b').stdout).toMatch(/; edit the plan, then revise$/m);
+    expect(answer(scope.out, 1, recCarrying(scope.out, 'rec', ['uc1b'])).stdout).toMatch(/; edit the plan, then revise$/m);
     const refused = r.ap(['revise', '--out', scope.out, '--settle', 'uc1']);
     expect(refused.status).toBe(3);
     expect(refused.stderr).toMatch(/changes scope; only packaging or ordering changes settle.*\(AMENDMENT_NOT_SETTLEABLE\)$/m);
@@ -229,7 +230,7 @@ describe('mixed amendments: a scope change and a packaging change', () => {
     expect(readRunJson(g.out).status).toBe('running');
     phaseVia(r, g.out, 'ceo');
     expect(phaseVia(r, g.out, 'eng').outside.stdout).toContain('status=gate_pending');
-    expect(answer(g.out, 2, 'rec').stdout).toContain('status=complete');
+    expect(answer(g.out, 2, recCarrying(g.out, 'rec')).stdout).toContain('status=complete');
     expect(r.validate(g.out).status).toBe(0);
   });
   test('settle and incorporate in one revise; settling alone on an unreviewed plan edit is refused', () => {
@@ -262,7 +263,7 @@ describe('partial replies resolve against persisted decisions', () => {
 
   test('validate rejects a complete run with a pending approval', () => {
     const g = gated({}, {});
-    expect(answer(g.out, 1, 'all').stdout).toContain('status=complete');
+    expect(answer(g.out, 1, recCarrying(g.out)).stdout).toContain('status=complete');
     const file = path.join(g.out, 'decisions.jsonl');
     fs.writeFileSync(file, decisions(g.out).map(d => JSON.stringify(d.label === 'UC2' ? { ...d, status: 'pending', chosen: null } : d)).join('\n') + '\n');
     r.ap(['export', '--out', g.out]);
@@ -298,3 +299,100 @@ describe('reruns', () => {
     expect(decisions(g.out).find(d => d.gate_rev === 2 && d.label === demoted.id.toUpperCase())).toMatchObject({ chosen: 'b', source: 'agent' });
   });
 });
+
+describe('open Critical and High findings reach the gate (GBRA-223 claim 3)', () => {
+  const NONE = { native: [], outside: [] };
+  const KILL = { native: [{ id: 'F1', severity: 'Critical', title: 'No kill switch for the resolver rollout', fix: 'add a config kill switch' }], outside: [] };
+  test('each open Critical/High finding is an apply item that rec takes; a twin pair is one item; Medium stays a task', () => {
+    const g = gated({
+      native: [{ id: 'F1', severity: 'Critical', title: 'No kill switch for the resolver rollout', fix: 'add a config kill switch' }, { id: 'F2', severity: 'Medium', title: 'Name the flag consistently' }],
+      outside: [{ id: 'O1', severity: 'High', title: 'No kill switch for the resolver rollout', fix: 'ship behind a kill switch' }],
+    }, { native: [{ id: 'F3', severity: 'High', title: 'No test covers a hung resolver', file: 'test/resolver.test.ts', fix: 'add a hung-resolver test' }], outside: [] });
+    const items = gate(g.out).items;
+    const apply = items.filter((i: any) => i.finding);
+    expect(apply.map((i: any) => i.title)).toEqual([
+      expect.stringMatching(/^Critical: No kill switch for the resolver rollout \[.*-ceo-native-1 \+ .*-ceo-outside-1\]$/),
+      expect.stringMatching(/^High: No test covers a hung resolver \[.*-eng-native-1\]$/),
+    ]);
+    for (const i of apply) expect(i).toMatchObject({ kind: 'auto', recommended: 'a', options: [{ key: 'a', changes_plan: true }, { key: 'b', changes_plan: false }] });
+    expect(apply[0].options[0].text).toContain('add a config kill switch');
+    expect(apply[0].options[0].text).toContain('ship behind a kill switch');
+    expect(items.find((i: any) => i.id === 'p1')).toMatchObject({ recommended: 'b' });
+    expect(items.some((i: any) => /Name the flag/.test(i.title))).toBe(false);
+    const rec = answer(g.out, 1, 'rec');
+    expect(rec.stdout.match(/^APPLY: /gm)?.length).toBe(2);
+    expect(readRunJson(g.out).status).toBe('amend_pending');
+  });
+
+  test('a user challenge one line away does not hide an unrelated Critical: a location match alone is not a twin', () => {
+    const g = gated({
+      native: [{ id: 'F1', severity: 'Medium', title: 'Package the worker as its own service', file: 'plan.md', line: 10, user_challenge: true, changes: 'scope', fix: 'split the worker out' }],
+      outside: [{ id: 'O1', severity: 'Critical', title: 'Webhook payload reaches the SQL query unescaped', file: 'plan.md', line: 11, fix: 'use parameterized queries' }],
+    }, NONE);
+    const apply = gate(g.out).items.filter((i: any) => i.finding);
+    expect(apply.map((i: any) => i.title)).toEqual([expect.stringMatching(/^Critical: Webhook payload reaches the SQL query unescaped \[.*-ceo-outside-1\]$/)]);
+  });
+
+  test('b, as-is, or a token reply that leaves the item unanswered carries the finding into the build with no plan change', () => {
+    for (const pick of [(id: string) => `${id}b p1a`, () => 'as-is', () => 'p1a']) {
+      const g = gated(KILL, NONE);
+      const item = gate(g.out).items.find((i: any) => i.finding);
+      const done = answer(g.out, 1, pick(item.id), true);
+      expect(JSON.parse(done.stdout)).toMatchObject({ outcome: 'complete', reopened: [], amendments: [] });
+      expect(decisions(g.out).find(d => d.label === item.id.toUpperCase())).toMatchObject({ chosen: 'b' });
+      expect(readJsonl(path.join(g.out, 'tasks.jsonl')).some(t => /No kill switch/.test(t.title))).toBe(true);
+    }
+    const g = gated(KILL, NONE);
+    const item = gate(g.out).items.find((i: any) => i.finding);
+    answer(g.out, 1, 'p1a');
+    expect(readJsonl(path.join(g.out, 'attempts.jsonl')).find(e => e.event === 'answered')).toMatchObject({ answer_class: 'overrides', overrides: [`${item.id}b`] });
+    expect(settledIds({ out: g.out } as any).has(item.finding[0])).toBe(false);
+  });
+
+  test('p1b applies the finding fixes its option text lists, and an applied finding is settled', () => {
+    const g = gated(KILL, NONE);
+    const item = gate(g.out).items.find((i: any) => i.finding);
+    expect(gate(g.out).items.find((i: any) => i.id === 'p1').options[1].text).toContain(`${item.id}a`);
+    expect(answer(g.out, 1, 'p1b').stdout).toMatch(/^APPLY: /m);
+    expect(decisions(g.out).find(d => d.label === item.id.toUpperCase())).toMatchObject({ chosen: 'a' });
+    expect(readJsonl(path.join(g.out, 'attempts.jsonl')).find(e => e.event === 'answered')).toMatchObject({ answer_class: 'plan-changes', changes: [`${item.id}a`] });
+    expect(readRunJson(g.out).status).toBe('amend_pending');
+    expect(settledIds({ out: g.out } as any).has(item.finding[0])).toBe(true);
+    expect(settledIds({ out: g.out } as any, { findings: false }).has(item.finding[0])).toBe(false);
+  });
+
+  test('after recommend changes an item, p1b (which takes the recommendations) needs the --rec-hash the owner saw', () => {
+    const g = gated({ native: [{ id: 'F1', severity: 'High', title: 'Ship the backoff behind a flag first', user_challenge: true, changes: 'scope', fix: 'gate it behind RETRY_BACKOFF=1' }], outside: [] }, NONE);
+    const item = gate(g.out).items.find((i: any) => i.id !== 'p1' && i.kind === 'auto' && i.options.some((o: any) => o.key === 'b'));
+    expect(r.ap(['recommend', '--out', g.out, '--gate-rev', '1', '--item', item.id, '--option', 'b', '--basis', 'owner asked for the flag', '--by', 'agent:test']).status).toBe(0);
+    const stale = answer(g.out, 1, 'p1b');
+    expect(stale.status).toBe(3);
+    expect(stale.stderr).toContain('GATE_REC_STALE');
+    expect(decisions(g.out).every(d => d.status === 'pending')).toBe(true);
+  });
+
+  test('a partial reply records no auto default, so a later p1b still applies the finding fix', () => {
+    const g = gated({ native: [...AGREE.native, ...KILL.native.map(f => ({ ...f, id: 'F9' }))], outside: AGREE.outside }, NONE);
+    const item = gate(g.out).items.find((i: any) => i.finding);
+    const uc = gate(g.out).items.find((i: any) => i.id.startsWith('uc'));
+    expect(answer(g.out, 1, `${uc.id}a`).stdout).toMatch(/GATE_PENDING: p1/);
+    expect(decisions(g.out).find(d => d.label === item.id.toUpperCase())?.chosen ?? null).toBeNull();
+    answer(g.out, 1, 'p1b');
+    expect(decisions(g.out).find(d => d.label === item.id.toUpperCase())).toMatchObject({ chosen: 'a' });
+  });
+
+  test('a same-file association never merges an unrelated Critical into a user challenge', () => {
+    const g = gated({ native: [{ id: 'F1', severity: 'Medium', title: 'Split the backoff into its own PR', file: 'lib/worker.ts', user_challenge: true, changes: 'packaging', fix: 'land it separately' }],
+      outside: [{ id: 'O1', severity: 'Critical', title: 'SQL injection in the lookup query', file: 'lib/worker.ts', fix: 'parameterize the query' }] }, NONE);
+    expect(gate(g.out).items.some((i: any) => i.finding && /^Critical: SQL injection/.test(i.title))).toBe(true);
+  });
+
+  test('at the round cap, an outside Critical paired by file with an unrelated native Medium still counts as open', () => {
+    const dir = path.join(r.host.base, `gj${++n}`);
+    const out = path.join(dir, 'run');
+    expect(r.ap(['next', '--out', out, '--plan', writePlan(dir), '--no-ui', '--max-rounds', '1']).status).toBe(0);
+    phaseVia(r, out, 'ceo', { native: [{ id: 'F1', severity: 'Medium', title: 'rename the config key', file: 'src/resolver.ts' }], outside: [{ id: 'O1', severity: 'Critical', title: 'SQL injection in lookup query', file: 'src/resolver.ts' }] });
+    const eng = phaseVia(r, out, 'eng', NONE).outside.stdout;
+    expect(eng.split('\n').filter(l => l.startsWith('ESCALATE:'))).toEqual(['ESCALATE: evidence sufficient, decision needed (ceo: 1 High open)']);
+  });
+});
diff --git a/test/autoplan-pairing.test.ts b/test/autoplan-pairing.test.ts
index 71e9ab67f..e630772ab 100644
--- a/test/autoplan-pairing.test.ts
+++ b/test/autoplan-pairing.test.ts
@@ -7,7 +7,7 @@
  */
 import { describe, expect, test } from 'bun:test';
 import fixture from './fixtures/autoplan-pairing/run-20261014-pairs.json';
-import { reconcile } from '../lib/autoplan-reconcile';
+import { reconcile, titleScore } from '../lib/autoplan-reconcile';
 import { challengeDefault } from '../lib/autoplan-gate';
 
 const pair = (name: string) => fixture.pairs.find(p => p.name.startsWith(name))! as any;
@@ -61,3 +61,60 @@ describe('pairing negative control from a real run', () => {
     expect(challengeDefault(ok!, challenge(same.native, 'scope')[0], challenge(same.outside, 'scope')[0])).toMatchObject({ recommended: 'b', basis: 'both voices; same remedy' });
   });
 });
+
+describe('plan reviews name a file without a line (GBRA-223 claim 1)', () => {
+  const row = (voice: 'native' | 'outside', n: number, f: Record<string, unknown>) => ({ schema_version: 1, run: 'r', id: `r-dx-${voice}-${n}`, phase: 'dx', voice, disposition: 'open', ...f }) as any;
+  const native = row('native', 1, { severity: 'Critical', title: 'per-turn resolver call has no hard timeout or fail-open', file: 'src/resolver.ts', resolution: 'add a 2s timeout and fail open' });
+
+  test('a CAP-coded outside title on the same file is associated, unverified, never new', () => {
+    const outside = row('outside', 1, { severity: 'Critical', title: 'CAP4:src/resolver.ts:recovery', file: 'src/resolver.ts', resolution: 'bound the call' });
+    const { rows, native_only } = reconcile([native], [outside]);
+    expect(rows[0]).toMatchObject({ disposition: 'unverified', basis: 'file', native_id: native.id });
+    expect(rows[0]!.resolution).toStartWith('same file, agreement unverified (src/resolver.ts)');
+    expect(native_only).toEqual([]);
+  });
+
+  test('differently worded titles on the same file associate; the best title among same-file natives wins', () => {
+    const other = row('native', 2, { severity: 'Medium', title: 'resolver output is not cached between turns', file: 'src/resolver.ts' });
+    const outside = row('outside', 1, { severity: 'Critical', title: 'Resolver call has no timeout and can hang the turn', file: 'src/resolver.ts' });
+    expect(reconcile([other, native], [outside]).rows[0]).toMatchObject({ disposition: 'unverified', basis: 'file', native_id: native.id });
+  });
+
+  test('a CAP code is not part of the title comparison', () => {
+    const outside = row('outside', 1, { severity: 'Critical', title: 'CAP4:src/resolver.ts:recovery per-turn resolver call has no hard timeout or fail-open', file: 'src/resolver.ts', resolution: 'add a 2s timeout and fail open' });
+    expect(reconcile([native], [outside]).rows[0]).toMatchObject({ disposition: 'confirmed', basis: 'title' });
+  });
+
+  test('controls: two lines far apart, or different files, stay new', () => {
+    const lined = row('native', 1, { ...native, id: 'r-dx-native-1', line: 10 });
+    expect(reconcile([lined], [row('outside', 1, { severity: 'High', title: 'retry loop has no bound', file: 'src/resolver.ts', line: 90 })]).rows[0]!.disposition).toBe('new');
+    expect(reconcile([native], [row('outside', 1, { severity: 'High', title: 'CAP6:src/cli.ts:fix', file: 'src/cli.ts' })]).rows[0]!.disposition).toBe('new');
+  });
+
+  test('a title twin is placed before the same-file fallback, so an unrelated finding cannot take its native', () => {
+    const n1 = row('native', 1, { severity: 'High', title: 'token refresh race drops the session', file: 'plan.md' });
+    const o1 = row('outside', 1, { severity: 'High', title: 'migration lacks rollback', file: 'plan.md' });
+    const o2 = row('outside', 2, { severity: 'High', title: 'token refresh race drops the session', file: 'plan.md' });
+    const { rows } = reconcile([n1], [o1, o2]);
+    expect(rows.map(r => [r.outside_id, r.native_id, r.basis])).toEqual([[o1.id, null, 'none'], [o2.id, n1.id, 'title']]);
+  });
+
+  test('control: the same CAP item and wording on two different files never pairs by title', () => {
+    const a = row('native', 1, { severity: 'High', title: 'CAP6:bin/gstack-upgrade:recovery no retry bound on network failure', file: 'bin/gstack-upgrade' });
+    const b = row('outside', 1, { severity: 'High', title: 'CAP6:lib/telemetry-sync.ts:recovery no retry bound on network failure', file: 'lib/telemetry-sync.ts' });
+    expect(reconcile([a], [b]).rows[0]).toMatchObject({ disposition: 'new', native_id: null });
+  });
+
+  test('two CAP titles on different paths never match by title, even when both findings sit on the plan file', () => {
+    const A = 'CAP6:bin/gstack-eval-plan pilot start:fix no fix line names the command';
+    const B = 'CAP6:bin/gstack-outside-voice run:fix no fix line names the command';
+    expect(titleScore(A, B)).toBe(0);
+    expect(titleScore(A, A)).toBe(1);
+    expect(titleScore(A, 'no fix line names the command')).toBe(1);
+    const n = row('native', 1, { severity: 'High', title: A, file: 'plan.md', resolution: 'name the command' });
+    const o = row('outside', 1, { severity: 'High', title: B, file: 'plan.md', resolution: 'name the command' });
+    expect(reconcile([n], [o]).rows[0]).toMatchObject({ basis: 'file', disposition: 'unverified' });
+    const bare = (x: any) => { const { file, ...rest } = x; return rest; };
+    expect(reconcile([bare(n)], [bare(o)]).rows[0]).toMatchObject({ disposition: 'new', native_id: null });
+  });
+});
diff --git a/test/autoplan-publication-guard.test.ts b/test/autoplan-publication-guard.test.ts
index fb1199a7a..44a375db4 100644
--- a/test/autoplan-publication-guard.test.ts
+++ b/test/autoplan-publication-guard.test.ts
@@ -206,6 +206,16 @@ describe('Autoplan parent publication guard', () => {
     expect(f.evaluate()).toMatchObject({ allow: false, reason: expect.stringContaining('earlier checkpoint') });
   });
 
+  test('#3651: a rerun checkpoint whose create result carries the cwd-reset footer still retires the old close', () => {
+    const { f, tasks } = completedCycle(), create = checkpointWriter(f);
+    const oldClose = f.events.find(e => e.kind === 'use' && e.toolUseId === 'eng-close')!;
+    create('eng', 'new-generation');
+    (f.events.at(-1) as any).content += '\nShell cwd was reset to /home/user/project';
+    f.read('old-close-replayed', (oldClose as any).input.file_path as string); f.message('Phase 3 complete.');
+    f.input.tool_input = { file_path: tasks }; f.current();
+    expect(f.evaluate()).toMatchObject({ allow: false, reason: expect.stringContaining('earlier checkpoint') });
+  });
+
   for (const status of ['partial', 'failed', 'pending'] as const)
     test(`a ${status} rerun close cannot borrow the first cycle's completed report`, () => {
       const { f, create, tasks } = completedCycle(), rerun = create('eng', 'rerun');
@@ -1596,3 +1606,56 @@ describe('PAX-3638: symlinked plan directory and superseded failed inits', () =>
     expect(f.evaluate()).toMatchObject({ allow: false, reason: expect.stringContaining('(code mutation_pending,') });
   });
 });
+
+describe('#3651: Claude Code cwd-reset footer on a Bash result', () => {
+  const FOOTER = '\nShell cwd was reset to /home/user/project';
+  function withInitTail(tail: string) {
+    const f = fixture();
+    (f.events.find(e => e.kind === 'result' && e.toolUseId === 'init') as any).content += tail;
+    return f;
+  }
+  const ready = (f: ReturnType<typeof fixture>) => { f.message(); f.current(); f.reorder(); return f.evaluate(); };
+
+  test('an init result carrying the footer still binds', () => {
+    expect(ready(withInitTail(FOOTER))).toEqual({ allow: true });
+  });
+
+  for (const [name, tail] of [['other trailing text', '\nunexpected trailing output'], ['two footers', `${FOOTER}${FOOTER}`], ['a footer that is not the last line', `${FOOTER}\n`]] as const)
+    test(`${name} after an init result is init_failed with the re-run hint, not the generic evidence denial`, () => {
+      const decision = ready(withInitTail(tail)) as any;
+      expect(decision.allow).toBe(false);
+      expect(decision.reason).toContain('(code init_failed,');
+      expect(decision.reason).toContain('re-run');
+    });
+
+  test('#3651: the hook path keeps the first binding when an init is re-run after a typed user message', async () => {
+    const footer = '\nShell cwd was reset to /home/user/project';
+    const run = async (tail: string, failed?: unknown) => {
+      const f = fixture(); (f.events[1] as any).content += tail; f.message();
+      if (failed !== undefined) { f.use('bad-init', 'Bash', (f.events[0] as any).input); f.result('bad-init', { content: failed }); }
+      f.use('re-init', 'Bash', (f.events[0] as any).input); f.result('re-init', { content: JSON.stringify({ ...f.init, reused: true }) + tail });
+      f.current();
+      const { rows, record } = f.journal();
+      const at = rows.findIndex(r => Array.isArray(r.message.content) && r.message.content.some((b: any) => b.type === 'tool_use' && ['bad-init', 're-init'].includes(b.id)));
+      (rows[at - 1]!.message as any).stop_reason = 'end_turn';
+      rows.splice(at, 0, record('user', 'Looks good, keep going.', { origin: { kind: 'human' }, promptSource: 'typed', promptId: randomUUID() }));
+      rows.forEach((r, i) => { r.parentUuid = i ? rows[i - 1]!.uuid : null; });
+      fs.writeFileSync(f.input.transcript_path, rows.map(x => JSON.stringify(x)).join('\n') + '\n');
+      return withNativeProjectDirectory(f.cwd, () => runPublicationHook(f.input, ROOT));
+    };
+    expect(await run('')).toEqual(OWNED_READ_APPROVAL);
+    expect(await run(footer)).toEqual(OWNED_READ_APPROVAL);
+    expect(await run('', 'unexpected output')).toEqual(OWNED_READ_APPROVAL);
+    expect(await run('', [{ type: 'text', text: 'a' }, { type: 'text', text: 'b' }])).toEqual(OWNED_READ_APPROVAL);
+  });
+
+  for (const [name, content] of [['did not parse', undefined], ['had no single text block', [{ type: 'text', text: 'a' }, { type: 'text', text: 'b' }]]] as const)
+    test(`a later clean init recovers the session after an init whose output ${name}`, () => {
+    const f = withInitTail('\nunexpected trailing output');
+    if (content) (f.events[1] as any).content = content;
+    f.events.splice(2, 0, { ...(structuredClone(f.events[0]!) as any), toolUseId: 'again' },
+      { ...(structuredClone(f.events[1]!) as any), toolUseId: 'again', content: JSON.stringify({ ...f.init, reused: true }) });
+    expect(ready(f)).toEqual({ allow: true });
+  });
+});
+
diff --git a/test/autoplan-run-api.test.ts b/test/autoplan-run-api.test.ts
new file mode 100644
index 000000000..155ea7831
--- /dev/null
+++ b/test/autoplan-run-api.test.ts
@@ -0,0 +1,213 @@
+/**
+ * `gstack-autoplan run` with the api runner for both voices (GBRA-223 claim 6):
+ * a complete autoplan result (INPUT receipt plus the findings fence) binds and
+ * the run reaches its gate; a response stopped at the output limit is named
+ * truncated and interrupts the run. The provider is a local server, so no key
+ * or network is used.
+ */
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { DEFAULT_MAX_TOKENS } from '../lib/outside-voice-api';
+import { AUTOPLAN, ROOT, SMALL_PLAN, env } from './helpers/autoplan-run-fixture';
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'autoplan-run-api-'));
+let mode: 'ok' | 'cut' | 'bad-outside' | 'bad-native' | 'hang' | 'down' = 'ok';
+let calls = 0;
+let openaiLimits: unknown[] = [];
+let server: ReturnType<typeof Bun.serve>;
+beforeAll(() => {
+  server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      calls++;
+      if (mode === 'hang') { await Bun.sleep(5000); return new Response('late', { status: 504 }); }
+      if (mode === 'down') return new Response('overloaded', { status: 503 });
+      const body = await req.json();
+      const prompt = String(body.messages[0].content);
+      const m = /INPUT: ([a-z]+) ([0-9a-f]{64})/.exec(prompt.slice(prompt.lastIndexOf('RESULT FORMAT')))!;
+      const text = mode === 'cut'
+        ? `INPUT: ${m[1]} ${m[2]}\n\nA long review that ran out of output tokens before the findings fen`
+        : `INPUT: ${m[1]} ${m[2]}\n\nComplete review.\n\n\`\`\`gstack-findings\n{"id":"F1","severity":"Medium","title":"Name the retry metric","fix":"add retries_total"}\n\`\`\`\n`;
+      if (new URL(req.url).pathname.endsWith('/messages')) return Response.json({ model: body.model, stop_reason: mode === 'cut' ? 'max_tokens' : 'end_turn', content: [{ type: 'text', text: mode === 'bad-native' ? `INPUT: ${m[1]} ${m[2]}\n\nA review with no findings fence.` : text }], usage: { input_tokens: 10, output_tokens: 20 } });
+      openaiLimits.push(body.max_completion_tokens);
+      return Response.json({ model: body.model, choices: [{ finish_reason: mode === 'cut' ? 'length' : 'stop', message: { content: mode === 'bad-outside' ? `INPUT: ${m[1]} ${m[2]}\n\nA review with no findings fence.` : text } }], usage: { prompt_tokens: 10, completion_tokens: 20 } });
+    },
+  });
+});
+afterAll(() => { server.stop(true); fs.rmSync(TMP, { recursive: true, force: true }); });
+
+async function run(name: string, extra: string[] = [], keys: Record<string, string> = { ANTHROPIC_API_KEY: 'ak-test', OPENAI_API_KEY: 'sk-test' }, nativeModel = 'anthropic/claude-opus-5-5') {
+  const dir = path.join(TMP, name);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'plan.md'), SMALL_PLAN);
+  const out = path.join(dir, 'run');
+  const base = `http://127.0.0.1:${server.port}`;
+  const proc = Bun.spawn(['bun', AUTOPLAN, 'run', '--out', out, '--plan', path.join(dir, 'plan.md'), '--no-ui', '--no-dx', '--native-model', nativeModel, '--outside-model', 'openai/gpt-6-astra', '--runner', 'api', '--native-runner', 'api', ...extra], {
+    cwd: ROOT, stdout: 'pipe', stderr: 'pipe',
+    env: env({ ANTHROPIC_API_KEY: '', OPENAI_API_KEY: '', ...keys, ANTHROPIC_BASE_URL: base, OPENAI_BASE_URL: `${base}/v1`, GSTACK_AUTOPLAN_CHECKPOINT_DIR: '', GSTACK_STATE_ROOT: path.join(TMP, 'state') }),
+  });
+  const timer = setTimeout(() => proc.kill('SIGKILL'), 120_000);
+  const [status, stdout, stderr] = await Promise.all([proc.exited, new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
+  clearTimeout(timer);
+  return { status, stdout, stderr, out, state: fs.existsSync(path.join(out, 'run.json')) ? JSON.parse(fs.readFileSync(path.join(out, 'run.json'), 'utf8')) : null };
+}
+
+describe('gstack-autoplan run --native-runner api --runner api', () => {
+  test('a complete result binds both voices in every phase and the run reaches its gate', async () => {
+    mode = 'ok';
+    const r = await run('ok');
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.stdout).toContain(`GSTACK_RESULT: skill=autoplan status=gate_pending run=${r.out}`);
+    for (const phase of ['ceo', 'eng']) for (const voice of ['native', 'outside']) expect(r.state.phases[phase][voice]).toMatchObject({ status: 'completed', findings: 1 });
+  }, 150_000);
+
+  test('a spend cap binds api attempts at their priced worst case and settles them at their usage', async () => {
+    mode = 'ok';
+    openaiLimits = [];
+    const r = await run('capped', ['--spend-cap', '8']);
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.stdout).toContain(`GSTACK_RESULT: skill=autoplan status=gate_pending run=${r.out}`);
+    expect(r.stdout).not.toMatch(/^ESTIMATE:/m);
+    const ledger = JSON.parse(fs.readFileSync(path.join(r.out, 'spend.json'), 'utf8'));
+    expect(ledger.reserved).toEqual([]);
+    expect(ledger.settled.length).toBe(4);
+    for (const s of ledger.settled) expect(s.usd).toBeGreaterThan(0);
+    expect(openaiLimits.length).toBeGreaterThan(0);
+    for (const limit of openaiLimits) expect(limit).toBe(DEFAULT_MAX_TOKENS);
+    calls = 0;
+    const zero = await run('zero-cap', ['--spend-cap', '0']);
+    expect(zero.status).toBe(3);
+    expect(zero.stdout + zero.stderr).toContain('SPEND_CAP_EXCEEDED');
+    expect(calls).toBe(0);
+  }, 150_000);
+
+  test('an outside result with no findings fence leaves the run native-only instead of aborting it', async () => {
+    mode = 'bad-outside';
+    const r = await run('bad-outside');
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.state.status).toBe('gate_pending');
+    expect(r.state.phases.ceo.outside.status).toBe('unavailable');
+    expect(r.state.phases.ceo.native).toMatchObject({ status: 'completed', findings: 1 });
+  }, 150_000);
+
+  test('--max-tokens needs a positive integer', async () => {
+    const r = await run('max0', ['--max-tokens', '0']);
+    expect(r.status).toBe(2);
+    expect(r.stderr).toContain('--max-tokens needs a positive integer');
+    expect(r.state).toBeNull();
+  }, 30_000);
+
+  test('a response stopped at the output limit is named truncated and interrupts the run', async () => {
+    mode = 'cut';
+    const r = await run('cut');
+    expect(r.status).toBe(1);
+    expect(r.stderr).toMatch(/native voice unavailable: truncated: .*output limit/);
+    expect(r.state.status).toBe('interrupted');
+  }, 150_000);
+
+  test('a truncated call settles what it cost, and a retry with a larger output limit is admitted afresh against the cap', async () => {
+    mode = 'cut';
+    const first = await run('cut-retry', ['--spend-cap', '8']);
+    expect(first.state.status).toBe('interrupted');
+    const truncated = first.state.phases.ceo.native.attempts[0].attempt;
+    const ledger = JSON.parse(fs.readFileSync(path.join(first.out, 'spend.json'), 'utf8'));
+    expect(ledger.reserved.map((r: any) => r.attempt)).not.toContain(truncated);
+    expect(ledger.settled.find((s: any) => s.attempt === truncated).usd).toBeGreaterThan(0);
+    mode = 'ok';
+    calls = 0;
+    const retry = await run('cut-retry', ['--spend-cap', '8', '--max-tokens', '2000000']);
+    expect(retry.status).toBe(3);
+    expect(retry.stdout + retry.stderr).toContain('SPEND_CAP_EXCEEDED');
+    expect(calls).toBe(0);
+  }, 150_000);
+
+  test('a call refused before any request leaves charges nothing: with no key the attempt stays open and the rerun reuses it at the cap that admitted it', async () => {
+    mode = 'ok';
+    calls = 0;
+    const first = await run('no-key', ['--spend-cap', '8'], { OPENAI_API_KEY: 'sk-test' });
+    expect(first.state.status).toBe('interrupted');
+    expect(calls).toBe(0);
+    const open = first.state.phases.ceo.native.attempts[0];
+    expect(open.state).toBe('dispatched');
+    expect(JSON.parse(fs.readFileSync(path.join(first.out, 'spend.json'), 'utf8')).settled).toEqual([]);
+    const retry = await run('no-key', ['--spend-cap', '8']);
+    expect(retry.status, retry.stderr).toBe(0);
+    expect(retry.stdout).toContain(`GSTACK_RESULT: skill=autoplan status=gate_pending run=${retry.out}`);
+    expect(retry.state.phases.ceo.native.attempts.map((a: any) => a.attempt)).toEqual([open.attempt]);
+    const ledger = JSON.parse(fs.readFileSync(path.join(retry.out, 'spend.json'), 'utf8'));
+    expect(ledger.settled.length).toBe(4);
+    expect(ledger.released ?? []).toEqual([]);
+    for (const s of ledger.settled) expect(s.label).toMatch(/^(ceo|eng)\/(native|outside)$/);
+  }, 150_000);
+
+  test('a call that was sent and timed out with no usage is charged its reservation, so the cap binds on the rerun', async () => {
+    mode = 'hang';
+    const first = await run('timed-out', ['--spend-cap', '8', '--deadline', '0.02']);
+    expect(first.state.status).toBe('interrupted');
+    const sent = first.state.phases.ceo.native.attempts[0];
+    expect(sent.state).toBe('superseded');
+    const ledger = JSON.parse(fs.readFileSync(path.join(first.out, 'spend.json'), 'utf8'));
+    expect(ledger.reserved.map((r: any) => r.attempt)).not.toContain(sent.attempt);
+    expect(ledger.settled.find((s: any) => s.attempt === sent.attempt).usd).toBe('unknown');
+  }, 150_000);
+
+  test('a sent call the provider refused with a 503 is charged its reservation', async () => {
+    mode = 'down';
+    const r = await run('refused-503', ['--spend-cap', '8']);
+    expect(r.state.status).toBe('interrupted');
+    const sent = r.state.phases.ceo.native.attempts[0];
+    expect(sent.state).toBe('superseded');
+    const ledger = JSON.parse(fs.readFileSync(path.join(r.out, 'spend.json'), 'utf8'));
+    expect(ledger.reserved.map((x: any) => x.attempt)).not.toContain(sent.attempt);
+    expect(ledger.settled.find((s: any) => s.attempt === sent.attempt).usd).toBe('unknown');
+  }, 150_000);
+
+  test('a paid native call whose result submit refuses is settled at its usage, so the rerun is admitted afresh', async () => {
+    mode = 'bad-native';
+    const r = await run('refused-result', ['--spend-cap', '8']);
+    expect(r.status).not.toBe(0);
+    const sent = r.state.phases.ceo.native.attempts[0];
+    expect(sent.state).toBe('superseded');
+    const ledger = JSON.parse(fs.readFileSync(path.join(r.out, 'spend.json'), 'utf8'));
+    expect(ledger.reserved.map((x: any) => x.attempt)).not.toContain(sent.attempt);
+    expect(ledger.settled.find((s: any) => s.attempt === sent.attempt).usd).toBeGreaterThan(0);
+  }, 150_000);
+
+  test('a call in flight when the process died is charged its reservation on the next run, which dispatches a fresh attempt', async () => {
+    mode = 'hang';
+    calls = 0;
+    const dir = path.join(TMP, 'killed');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'plan.md'), SMALL_PLAN);
+    const out = path.join(dir, 'run');
+    const base = `http://127.0.0.1:${server.port}`;
+    const proc = Bun.spawn(['bun', AUTOPLAN, 'run', '--out', out, '--plan', path.join(dir, 'plan.md'), '--no-ui', '--no-dx', '--native-model', 'anthropic/claude-opus-5-5', '--outside-model', 'openai/gpt-6-astra', '--runner', 'api', '--native-runner', 'api', '--spend-cap', '8'], {
+      cwd: ROOT, stdout: 'ignore', stderr: 'ignore',
+      env: env({ ANTHROPIC_API_KEY: 'ak-test', OPENAI_API_KEY: 'sk-test', ANTHROPIC_BASE_URL: base, OPENAI_BASE_URL: `${base}/v1`, GSTACK_AUTOPLAN_CHECKPOINT_DIR: '', GSTACK_STATE_ROOT: path.join(TMP, 'state') }),
+    });
+    for (let i = 0; i < 200 && calls === 0; i++) await Bun.sleep(50);
+    expect(calls).toBe(1);
+    proc.kill('SIGKILL');
+    await proc.exited;
+    mode = 'ok';
+    const retry = await run('killed', ['--spend-cap', '8']);
+    expect(retry.status, retry.stderr).toBe(0);
+    const [lost, fresh] = retry.state.phases.ceo.native.attempts;
+    expect(lost.state).toBe('superseded');
+    expect(fresh.state).toBe('submitted');
+    const ledger = JSON.parse(fs.readFileSync(path.join(retry.out, 'spend.json'), 'utf8'));
+    expect(ledger.settled.find((s: any) => s.attempt === lost.attempt).usd).toBe('unknown');
+  }, 150_000);
+
+  test('with a spend cap an unpriced api model reserves the default in any session kind, so a cap below it refuses before any call', async () => {
+    mode = 'ok';
+    calls = 0;
+    const kind = ['GSTACK', 'SESSION', 'KIND'].join('_');
+    const r = await run('unpriced', ['--spend-cap', '1'], { ANTHROPIC_API_KEY: 'ak-test', OPENAI_API_KEY: 'sk-test', [kind]: 'spawned' }, 'anthropic/claude-haiku-5-5');
+    expect(r.status).toBe(3);
+    expect(r.stdout + r.stderr).toContain('SPEND_CAP_EXCEEDED');
+    expect(calls).toBe(0);
+  }, 150_000);
+});
diff --git a/test/autoplan-run-recovery.test.ts b/test/autoplan-run-recovery.test.ts
index 74dbf1361..81a6eb2c2 100644
--- a/test/autoplan-run-recovery.test.ts
+++ b/test/autoplan-run-recovery.test.ts
@@ -106,7 +106,8 @@ describe('next/submit loop', () => {
     expect(v.status, v.stdout + v.stderr).toBe(0);
     expect(JSON.parse(v.stdout)).toMatchObject({ valid: true, status: 'gate_pending' });
     const gate = JSON.parse(fs.readFileSync(path.join(out, 'gate.json'), 'utf8'));
-    expect(gate.items.map((i: any) => i.id)).toEqual(['uc1', 'uc2', 'p1']);
+    expect(gate.items.map((i: any) => i.id)).toEqual(['uc1', 'd1', 'd2', 'uc2', 'd3', 'd4', 'p1']);
+    expect(gate.items.filter((i: any) => i.finding).map((i: any) => i.title.split(':')[0])).toEqual(['Critical', 'High', 'Critical', 'High']);
     const decisions = fs.readFileSync(path.join(out, 'decisions.jsonl'), 'utf8').trim().split('\n').map(l => JSON.parse(l));
     expect(decisions.every((d: any) => d.status === 'pending' && d.gate_rev === 1)).toBe(true);
     const tasks = fs.readFileSync(path.join(out, 'tasks.jsonl'), 'utf8').trim().split('\n').map(l => JSON.parse(l));
diff --git a/test/brain-sync.test.ts b/test/brain-sync.test.ts
index ff7ee1432..0e5d60fde 100644
--- a/test/brain-sync.test.ts
+++ b/test/brain-sync.test.ts
@@ -843,7 +843,7 @@ describe('gstack-brain-sync per-file hold', () => {
     }
     function setup() {
       init();
-      write(SHARED, '# shared v1\n');
+      write(SHARED, '{"note":"shared v1"}\n');
       write(OTHER, '# other v1\n');
       expect(drain().status).toBe(0);
       expect(statusJson().status).toBe('ok');
@@ -856,15 +856,15 @@ describe('gstack-brain-sync per-file hold', () => {
 
     test('a dirty tracked file the remote did not touch rides through the merge', () => {
       setup();
-      peerCommit(SHARED, '# shared from the peer\n');
+      peerCommit(SHARED, '{"note":"shared from the peer"}\n');
       write(OTHER, '# other, local edit not queued\n', false);
       write(CLEAN, '# a plan\n');
       expect(drain().status).toBe(0);
       expect(statusJson().status).toBe('ok');
       expect(remoteFiles()).toContain(CLEAN);
-      expect(remoteShow(SHARED).stdout).toBe('# shared from the peer\n');
+      expect(remoteShow(SHARED).stdout).toBe('{"note":"shared from the peer"}\n');
       expect(fs.readFileSync(path.join(tmpHome, OTHER), 'utf-8')).toBe('# other, local edit not queued\n');
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared from the peer\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared from the peer"}\n');
     });
 
     /** The restore command the status names, run as printed. */
@@ -878,17 +878,17 @@ describe('gstack-brain-sync per-file hold', () => {
 
     test('a dirty tracked file the remote also changed no longer leaves the push failed', () => {
       setup();
-      peerCommit(SHARED, '# shared from the peer\n');
-      write(SHARED, '# shared, local edit not queued\n', false);
+      peerCommit(SHARED, '{"note":"shared from the peer"}\n');
+      write(SHARED, '{"note":"shared, local edit not queued"}\n', false);
       write(CLEAN, '# a plan\n');
       expect(drain().status).toBe(0);
       const s = statusJson();
       expect(s.status).toBe('ok');
       expect(remoteFiles()).toContain(CLEAN);
-      expect(remoteShow(SHARED).stdout).toBe('# shared from the peer\n');
+      expect(remoteShow(SHARED).stdout).toBe('{"note":"shared from the peer"}\n');
       // The merged version stays in the working tree: no conflict markers,
       // nothing staged, and nothing stale for a later sync to publish.
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared from the peer\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared from the peer"}\n');
       expect(unmerged()).toBe('');
       expect(staged()).toBe('');
       expect(s.message).toContain(`local edits to ${SHARED} conflicted`);
@@ -900,23 +900,23 @@ describe('gstack-brain-sync per-file hold', () => {
       write(OTHER, '# other v2\n');
       expect(drain().status).toBe(0);
       expect(statusJson().status).toBe('ok');
-      expect(remoteShow(SHARED).stdout).toBe('# shared from the peer\n');
-      expect(git(['show', `${sha}:${SHARED}`]).stdout).toBe('# shared, local edit not queued\n');
+      expect(remoteShow(SHARED).stdout).toBe('{"note":"shared from the peer"}\n');
+      expect(git(['show', `${sha}:${SHARED}`]).stdout).toBe('{"note":"shared, local edit not queued"}\n');
       // The printed command brings the local edit back.
       expect(recover(s.message)).toBe(sha!);
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared, local edit not queued"}\n');
     });
 
     test('a local deletion of a file the remote changed keeps the remote file and stashes the deletion', () => {
       setup();
-      peerCommit(SHARED, '# shared from the peer\n');
+      peerCommit(SHARED, '{"note":"shared from the peer"}\n');
       fs.rmSync(path.join(tmpHome, SHARED));
       write(CLEAN, '# a plan\n');
       expect(drain().status).toBe(0);
       const s = statusJson();
       expect(s.status).toBe('ok');
-      expect(remoteShow(SHARED).stdout).toBe('# shared from the peer\n');
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared from the peer\n');
+      expect(remoteShow(SHARED).stdout).toBe('{"note":"shared from the peer"}\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared from the peer"}\n');
       expect(unmerged()).toBe('');
       expect(s.message).toContain(`local edits to ${SHARED} conflicted`);
       recover(s.message);
@@ -934,7 +934,7 @@ describe('gstack-brain-sync per-file hold', () => {
       } finally {
         fs.rmSync(peer, { recursive: true, force: true });
       }
-      write(SHARED, '# shared, local edit not queued\n', false);
+      write(SHARED, '{"note":"shared, local edit not queued"}\n', false);
       write(CLEAN, '# a plan\n');
       expect(drain().status).toBe(0);
       const s = statusJson();
@@ -943,7 +943,7 @@ describe('gstack-brain-sync per-file hold', () => {
       expect(fs.existsSync(path.join(tmpHome, SHARED))).toBe(false);
       expect(unmerged()).toBe('');
       recover(s.message);
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared, local edit not queued"}\n');
     });
 
     test('a conflicting file whose name looks like a pattern resets only itself', () => {
@@ -954,16 +954,16 @@ describe('gstack-brain-sync per-file hold', () => {
       expect(git(['merge', '-q', '--ff-only', 'origin/main']).status).toBe(0);
       peerCommit(GLOB, '# glob from the peer\n');
       write(GLOB, '# glob, local edit not queued\n', false);
-      write(SHARED, '# shared, local edit not queued\n', false);
+      write(SHARED, '{"note":"shared, local edit not queued"}\n', false);
       write(CLEAN, '# a plan\n');
       expect(drain().status).toBe(0);
       const s = statusJson();
       expect(s.status).toBe('ok');
       expect(fs.readFileSync(path.join(tmpHome, GLOB), 'utf-8')).toBe('# glob from the peer\n');
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared, local edit not queued"}\n');
       recover(s.message);
       expect(fs.readFileSync(path.join(tmpHome, GLOB), 'utf-8')).toBe('# glob, local edit not queued\n');
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared, local edit not queued"}\n');
     });
 
     test('a file that never checks out clean does not strand the other local edits', () => {
@@ -973,7 +973,7 @@ describe('gstack-brain-sync per-file hold', () => {
       expect(drain().status).toBe(0);
       fs.mkdirSync(path.join(tmpHome, '.git', 'info'), { recursive: true });
       fs.writeFileSync(path.join(tmpHome, '.git', 'info', 'attributes'), '*.md text eol=lf\n');
-      peerCommit(SHARED, '# shared from the peer\n');
+      peerCommit(SHARED, '{"note":"shared from the peer"}\n');
       write(OTHER, '# other, local edit not queued\n', false);
       write(CLEAN, '# a plan\n');
       expect(drain().status).toBe(0);
@@ -987,28 +987,28 @@ describe('gstack-brain-sync per-file hold', () => {
       setup();
       write(OTHER, '# other, older stashed work\n', false);
       expect(git(['stash', 'push', '-q', '-m', 'older work']).status).toBe(0);
-      peerCommit(SHARED, '# shared from the peer\n');
-      write(SHARED, '# shared, local edit not queued\n', false);
+      peerCommit(SHARED, '{"note":"shared from the peer"}\n');
+      write(SHARED, '{"note":"shared, local edit not queued"}\n', false);
       write(CLEAN, '# a plan\n');
       const shim = gitShim('case " $* " in *" stash push "*) exit 0;; esac');
       expect(drain(shim.env).status).toBe(0);
       expect(statusJson().status).toBe('push_failed');
       expect(git(['stash', 'list']).stdout).toContain('older work');
       expect(fs.readFileSync(path.join(tmpHome, OTHER), 'utf-8')).toBe('# other v1\n');
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared, local edit not queued"}\n');
     });
 
     test('a conflicting merge is aborted and git\'s reason reaches the status', () => {
       setup();
-      peerCommit(SHARED, '# shared from the peer\n');
-      write(SHARED, '# shared, local commit\n');
+      peerCommit(SHARED, '{"note":"shared from the peer"}\n');
+      write(SHARED, '{"note":"shared, local commit"}\n');
       expect(drain().status).toBe(0);
       const s = statusJson();
       expect(s.status).toBe('push_failed');
       expect(s.message).toContain(`Merge conflict in ${SHARED}`);
       expect(mergeHead()).toBe(false);
       expect(unmerged()).toBe('');
-      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local commit\n');
+      expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('{"note":"shared, local commit"}\n');
       // The next drain is not blocked by a half-finished merge.
       write(OTHER, '# other v2\n');
       expect(drain().status).toBe(0);
@@ -1270,6 +1270,130 @@ describe('gstack-brain-sync per-file hold', () => {
       expect(remoteShow(SNAP).stdout).toContain('"ccc"');
     });
   });
+
+  describe('a synced JSON file that does not parse is never committed (#3763)', () => {
+    const PROFILE = 'developer-profile.json';
+    const MARKED = '{\n  "sessions": [],\n<<<<<<< HEAD\n  "v": "local"\n=======\n  "v": "peer"\n>>>>>>> origin/main\n}\n';
+    const parses = (text: string) => { try { JSON.parse(text); return true; } catch { return false; } };
+
+    test('a queued profile holding conflict markers is held back; the rest syncs; a repaired profile syncs next', () => {
+      init();
+      write(PROFILE, MARKED);
+      write(CLEAN, '# a plan\n');
+      expect(drain().status).toBe(0);
+      expect(remoteFiles()).toContain(CLEAN);
+      expect(remoteFiles()).not.toContain(PROFILE);
+      expect(staged()).toBe('');
+      expect(spoolText()).toContain(PROFILE);
+      const s = statusJson();
+      expect(s.status).toBe('held');
+      expect(s.held.map((h: { path: string; rule: string }) => [h.path, h.rule])).toEqual([[PROFILE, 'invalid-json']]);
+      expect(s.held[0].fixes[0]).toContain(`${PROFILE} is not valid JSON`);
+      expect(s.held[0].fixes).toHaveLength(1);
+      expect(s.message).toContain('not valid JSON');
+      expect(s.message).not.toContain('secret scan');
+
+      write(PROFILE, '{"sessions":[],"v":"repaired"}\n', false);
+      expect(drain().status).toBe(0);
+      expect(statusJson().status).toBe('ok');
+      expect(remoteShow(PROFILE).stdout).toBe('{"sessions":[],"v":"repaired"}\n');
+    });
+
+    test('a marker-free syntax error is held too', () => {
+      init();
+      write(PROFILE, '{"sessions": [],}\n');
+      expect(drain().status).toBe(0);
+      expect(remoteFiles()).not.toContain(PROFILE);
+      expect(statusJson().held.map((h: { rule: string }) => h.rule)).toEqual(['invalid-json']);
+      expect(spoolText()).toContain(PROFILE);
+    });
+
+    test('an unparseable decisions.active.json holds its coupled decisions.jsonl until repaired', () => {
+      init();
+      writeDecisions(['a'], ['a']);
+      expect(drain().status).toBe(0);
+      write(LOG, [decide('a'), decide('bb')].join('\n') + '\n', false);
+      write(SNAP, '[{"id":"a"},\n<<<<<<< HEAD\n{"id":"bb"}\n=======\n{"id":"c"}\n>>>>>>> origin/main\n]\n', false);
+      run(['gstack-brain-enqueue', LOG]);
+      expect(drain().status).toBe(0);
+      const s = statusJson();
+      expect(s.status).toBe('held');
+      expect(s.held.map((h: { path: string; rule: string; dependents: string[] }) => [h.path, h.rule, h.dependents])).toEqual([[SNAP, 'invalid-json', [LOG]]]);
+      expect(remoteShow(LOG).stdout).toBe(decide('a') + '\n');
+      expect(spoolText()).toContain(LOG);
+
+      writeDecisions(['a', 'bb'], ['a', 'bb']);
+      expect(drain().status).toBe(0);
+      expect(statusJson().status).toBe('ok');
+      expect(remoteShow(LOG).stdout).toBe([decide('a'), decide('bb')].join('\n') + '\n');
+    });
+
+    test('two machines editing the profile never put conflict markers on the remote', () => {
+      init();
+      write(PROFILE, '{"sessions":[],"v":"base"}\n');
+      expect(drain().status).toBe(0);
+      // The retry merge commits with the ambient identity; a CI runner has none.
+      expect(git(['config', 'user.name', 'fixture']).status).toBe(0);
+      expect(git(['config', 'user.email', 'fixture@example.com']).status).toBe(0);
+      const peer = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-sync-peer-'));
+      try {
+        expect(git(['clone', '-q', bareRemote, peer]).status).toBe(0);
+        fs.writeFileSync(path.join(peer, PROFILE), '{"sessions":[],"v":"peer"}\n');
+        expect(git(['add', '-f', '--', PROFILE], peer).status).toBe(0);
+        expect(git(['-c', 'user.name=peer', '-c', 'user.email=peer@example.com', 'commit', '-qm', 'peer profile'], peer).status).toBe(0);
+        expect(git(['push', '-q', 'origin', 'HEAD'], peer).status).toBe(0);
+      } finally {
+        fs.rmSync(peer, { recursive: true, force: true });
+      }
+      write(PROFILE, '{"sessions":[],"v":"local"}\n');
+      expect(drain().status).toBe(0);
+      // Every later profile write queues the file again.
+      run(['gstack-brain-enqueue', PROFILE]);
+      write(CLEAN, '# a plan\n');
+      expect(drain().status).toBe(0);
+      expect(parses(remoteShow(PROFILE).stdout)).toBe(true);
+      expect(remoteShow(PROFILE).stdout).not.toContain('<<<<<<<');
+      expect(remoteShow(PROFILE).stdout).toBe('{"sessions":[],"v":"peer"}\n');
+    });
+
+    test('an unfinished merge with a held profile commits nothing until the profile is repaired', () => {
+      init();
+      write(PROFILE, '{"sessions":[],"v":"base"}\n');
+      expect(drain().status).toBe(0);
+      expect(git(['config', 'user.name', 'fixture']).status).toBe(0);
+      expect(git(['config', 'user.email', 'fixture@example.com']).status).toBe(0);
+      const peer = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-sync-peer-'));
+      try {
+        expect(git(['clone', '-q', bareRemote, peer]).status).toBe(0);
+        fs.writeFileSync(path.join(peer, PROFILE), '{"sessions":[],"v":"peer"}\n');
+        expect(git(['add', '-f', '--', PROFILE], peer).status).toBe(0);
+        expect(git(['-c', 'user.name=peer', '-c', 'user.email=peer@example.com', 'commit', '-qm', 'peer profile'], peer).status).toBe(0);
+        expect(git(['push', '-q', 'origin', 'HEAD'], peer).status).toBe(0);
+      } finally {
+        fs.rmSync(peer, { recursive: true, force: true });
+      }
+      fs.writeFileSync(path.join(tmpHome, PROFILE), '{"sessions":[],"v":"local"}\n');
+      expect(git(['commit', '-qam', 'local profile']).status).toBe(0);
+      expect(git(['fetch', '-q', 'origin']).status).toBe(0);
+      const branch = git(['rev-parse', '--abbrev-ref', 'HEAD']).stdout.trim();
+      expect(git(['merge', '--no-edit', `origin/${branch}`]).status).not.toBe(0);
+      run(['gstack-brain-enqueue', PROFILE]);
+      write(CLEAN, '# a plan\n');
+      expect(drain().status).toBe(0);
+      expect(statusJson().status).toBe('blocked');
+      expect(statusJson().message).toContain('unfinished');
+      expect(statusJson().message).not.toContain('--skip-file <path>');
+      expect(remoteShow(PROFILE).stdout).toBe('{"sessions":[],"v":"peer"}\n');
+      expect(remoteFiles()).not.toContain(CLEAN);
+      expect(git(['rev-parse', '-q', '--verify', 'MERGE_HEAD']).status).toBe(0);
+
+      write(PROFILE, '{"sessions":[],"v":"merged"}\n', false);
+      expect(drain().status).toBe(0);
+      expect(statusJson().status).toBe('ok');
+      expect(remoteShow(PROFILE).stdout).toBe('{"sessions":[],"v":"merged"}\n');
+      expect(remoteFiles()).toContain(CLEAN);
+    });
+  });
 });
 
 // ---------------------------------------------------------------
diff --git a/test/capy-captain-flow.test.ts b/test/capy-captain-flow.test.ts
index f022e557b..9e5c9ec83 100644
--- a/test/capy-captain-flow.test.ts
+++ b/test/capy-captain-flow.test.ts
@@ -11,7 +11,7 @@ import { afterAll, describe, expect, test } from 'bun:test';
 import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { ROOT, resultOf } from './helpers/autoplan-run-fixture';
+import { ROOT, recCarrying, resultOf } from './helpers/autoplan-run-fixture';
 import { capyRunner, phaseVia, writePlan } from './helpers/autoplan-capy';
 
 const r = capyRunner();
@@ -69,7 +69,8 @@ describe('Capy Captain flow', () => {
     expect(j.brief).toStartWith('**Decision needed:** approve the plan "Retry backoff for the webhook worker".');
     for (const h of ['### Before → after', '### Why it matters', '### What caused this work', '### Big decisions', '### What we need from you']) expect(j.brief).toContain(h);
 
-    const answer = r.ap(['answer', '--out', out, '--gate-rev', String(j.gate_rev), '--reply', 'rec', '--rec-hash', j.rec_hash, '--by', 'agent:GSTA-1', '--owner-reply', 'rec']);
+    const reply = recCarrying(out, 'rec');
+    const answer = r.ap(['answer', '--out', out, '--gate-rev', String(j.gate_rev), '--reply', reply, '--rec-hash', j.rec_hash, '--by', 'agent:GSTA-1', '--owner-reply', reply]);
     expect(answer.status, answer.stderr + answer.stdout).toBe(0);
     expect(answer.stdout).toMatch(/^APPROVED: gate_rev=1/m);
 
@@ -84,7 +85,7 @@ describe('Capy Captain flow', () => {
     expect(bin('gstack-approvals', ['import', '--autoplan', out, '--by', 'Garry'], env, repo).stdout).toMatch(/^APPROVAL_IMPORTED: n=0 skipped=1 /);
     const table = bin('gstack-approvals', ['render'], env, repo).stdout;
     expect(table).toContain('Approve the plan "Retry backoff for the webhook worker"');
-    expect(table).toContain('“rec” (Garry, relayed by agent:GSTA-1) | approved |');
+    expect(table).toContain(`“${reply}” (Garry, relayed by agent:GSTA-1) | approved |`);
     expect(fs.readdirSync(path.join(mirror, 'acme-worker')).length).toBe(1);
   });
 
diff --git a/test/ci-reuse-workflow-wiring.test.ts b/test/ci-reuse-workflow-wiring.test.ts
index 0ad60e306..6d9b3b8d5 100644
--- a/test/ci-reuse-workflow-wiring.test.ts
+++ b/test/ci-reuse-workflow-wiring.test.ts
@@ -15,7 +15,7 @@ import { parseWorkflow } from '../lib/pregate/workflows';
 
 const ROOT = path.resolve(import.meta.dir, '..');
 const read = (rel: string) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
-const FILES = { 'free-tests.yml': { aggregate: 'free-tests', profile: 'ci-reuse/free-tests', plan: 'free-plan', exempt: [] as string[] }, 'windows-free-tests.yml': { aggregate: 'windows-free-tests', profile: 'ci-reuse/windows-free-tests', plan: 'windows-plan', exempt: ['windows-record-durations'] } };
+const FILES = { 'free-tests.yml': { aggregate: 'free-tests', profile: 'ci-reuse/free-tests', plan: 'free-plan', exempt: [] as string[], manual: false }, 'windows-free-tests.yml': { aggregate: 'windows-free-tests', profile: 'ci-reuse/windows-free-tests', plan: 'windows-plan', exempt: ['windows-record-durations'], manual: true } };
 const REUSE_IF = "github.event_name == 'push' && github.ref == 'refs/heads/main'";
 const SKIP = "steps.route.outputs.reused != 'true'";
 const PROFILES = JSON.parse(read('.gstack/pregate.json')).run_profiles as Record<string, { workflow: string; jobs: string[]; artifact: string; events: string[]; os: string }>;
@@ -74,8 +74,10 @@ for (const [file, spec] of Object.entries(FILES)) {
       for (const name of Object.keys(jobs).filter(downstream)) expect([name, jobs[name].if]).toEqual([name, expect.stringMatching(/!cancelled\(\)|always\(\)/)]);
     });
 
-    test('pregate still sees every test lane as required (no condition reads inputs or workflow_dispatch)', () => {
-      for (const lane of parseWorkflow(file, source, 'linux').filter(l => l.runsTests && !spec.exempt.includes(l.job))) expect([lane.id, lane.manual]).toEqual([lane.id, false]);
+    test(spec.manual ? 'pregate reads every test lane as manual: the nightly Windows suite is never a PR obligation (windows-smoke.yml is)' : 'pregate still sees every test lane as required (no condition reads inputs or workflow_dispatch)', () => {
+      const lanes = parseWorkflow(file, source, 'linux').filter(l => l.runsTests && !spec.exempt.includes(l.job));
+      expect(lanes.length).toBeGreaterThan(0);
+      for (const lane of lanes) expect([lane.id, lane.manual]).toEqual([lane.id, spec.manual]);
     });
 
     test('the aggregate routes first, before any download; the strict path follows unchanged and alone uploads tested-tree after verification', () => {
diff --git a/test/dx-error-contract-grader.test.ts b/test/dx-error-contract-grader.test.ts
index 4b601604c..1aa923325 100644
--- a/test/dx-error-contract-grader.test.ts
+++ b/test/dx-error-contract-grader.test.ts
@@ -21,8 +21,8 @@ describe('dx-error-contract-review grader (free controls for the paid case)', ()
   });
 
   test('the grader keys on the title and severity shapes the product prompt asks for', () => {
-    expect(DX_ERROR_COMPACT).toContain('as a Critical finding titled "CAP4:<path>:<item>"');
-    expect(DX_ERROR_COMPACT).toContain('as a High finding titled "CAP6:<path>:<item>"');
+    expect(DX_ERROR_COMPACT).toContain('as a Critical finding titled "CAP4:<path>:<item> <what fails>"');
+    expect(DX_ERROR_COMPACT).toContain('as a High finding titled "CAP6:<path>:<item> <what fails>"');
     const rows = DX_ERROR_ITEMS.map((item, index) => ({ id: `F${index}`, severity: 'High', title: `CAP6:P1:${item} gap` }));
     expect(capFindings(fence(rows)).map(cap => cap.item)).toEqual([...DX_ERROR_ITEMS]);
   });
diff --git a/test/dx-error-contract.test.ts b/test/dx-error-contract.test.ts
index be98a59d9..b72b4f4c0 100644
--- a/test/dx-error-contract.test.ts
+++ b/test/dx-error-contract.test.ts
@@ -20,6 +20,8 @@ describe('agent-ready error contract reaches every DX reviewer', () => {
     for (const text of [DX_ERROR_CONTRACT, DX_ERROR_COMPACT]) {
       expect(text).toContain('CAP4:<path>:<item>');
       expect(text).toContain('CAP6:<path>:<item>');
+      expect(text).toContain('CAP4:<path>:<item> <what fails>');
+      expect(text).toContain('CAP6:<path>:<item> <what fails>');
       expect(text).toContain('4/10');
       expect(text).toContain('6/10');
       expect(text).toMatch(/[Uu]sage (and|or) validation error/);
diff --git a/test/eng-finding-retry-budget.test.ts b/test/eng-finding-retry-budget.test.ts
index d547a0b8e..1b0039bf4 100644
--- a/test/eng-finding-retry-budget.test.ts
+++ b/test/eng-finding-retry-budget.test.ts
@@ -141,7 +141,7 @@ test('live periodic census fits the declared CI wall including setup', () => {
 
 test('registered allocation is deterministic and preserves every discovered file', () => {
   const files = collectPaidTestFiles();
-  expect(files).toHaveLength(114); // + skill-e2e-planning-wave (GSTA-228); + skill-e2e-model-panel (GSTA-173); + skill-e2e-write-skill (GSTA-133); + skill-e2e-ship-frozen-scope (frozen review scope, GSTA-113 PR 2); + skill-e2e-failure-routing (#3157/#3158); + skill-e2e-dx-error-contract (#3226); + skill-e2e-gate-integrity (HONEST_WORK_GATE_INTEGRITY W8); + skill-e2e-autoplan-schema-canary, -guard-pty and -long-session (Oct 7 wave, CEO-13, ENG-18, CEO-15); + skill-e2e-ship-measure-seeded-flake (v1.91.32.0); W5a: 15 carve wrappers became one case-sharded file; + codex-e2e-multiblock-live and skill-e2e-design-model-smoke (v1.91.30.0);
+  expect(files).toHaveLength(115); // + skill-e2e-autoplan-ceo-only (GST-537); + skill-e2e-planning-wave (GSTA-228); + skill-e2e-model-panel (GSTA-173); + skill-e2e-write-skill (GSTA-133); + skill-e2e-ship-frozen-scope (frozen review scope, GSTA-113 PR 2); + skill-e2e-failure-routing (#3157/#3158); + skill-e2e-dx-error-contract (#3226); + skill-e2e-gate-integrity (HONEST_WORK_GATE_INTEGRITY W8); + skill-e2e-autoplan-schema-canary, -guard-pty and -long-session (Oct 7 wave, CEO-13, ENG-18, CEO-15); + skill-e2e-ship-measure-seeded-flake (v1.91.32.0); W5a: 15 carve wrappers became one case-sharded file; + codex-e2e-multiblock-live and skill-e2e-design-model-smoke (v1.91.30.0);
   expect(files).toContain('test/skill-e2e-ship-skip.test.ts');
   const m = livePlan(files);
   expect(livePlan([...files].reverse())).toEqual(m);
diff --git a/test/fixtures/context-budget.json b/test/fixtures/context-budget.json
index ba51a7dba..5f0d85790 100644
--- a/test/fixtures/context-budget.json
+++ b/test/fixtures/context-budget.json
@@ -25,7 +25,7 @@
     "diagram": 4286,
     "document-generate": 6013,
     "document-release": 4454,
-    "eval-plan": 4887,
+    "eval-plan": 5021,
     "freeze": 1115,
     "gstack": 5350,
     "gstack-upgrade": 6297,
diff --git a/test/fixtures/module-size-ratchet.json b/test/fixtures/module-size-ratchet.json
index ad2cf1081..74e49bbc7 100644
--- a/test/fixtures/module-size-ratchet.json
+++ b/test/fixtures/module-size-ratchet.json
@@ -174,6 +174,7 @@
     { "file": "lib/ship-queue-train-verify.ts", "movedFrom": "(new: verify --train, the queue freeze and its backstop, plan GSTA-49 T1)" },
     { "file": "lib/ship-queue-train-ready.ts", "movedFrom": "(new: ready --screen|--no-screen and the READY receipt, plan GSTA-49 T1)" },
     { "file": "lib/ship-queue-train-cli.ts", "movedFrom": "(new: merge-train argument parsing and output, plan GSTA-49 T1)" },
+    { "file": "lib/ship-queue-land-lock.ts", "movedFrom": "lib/ship-queue-land.ts (the land lock, shared with train land, #3599)" },
     { "file": "lib/gate-cost.ts", "movedFrom": "(new: paid gate cost by model and token class, per-case costs, selection replays and the merge-train model, GSTA-49 T0)" },
     { "file": "scripts/gate-cost-replay.ts", "movedFrom": "(new: CLI behind lib/gate-cost.ts: cached report artifacts, merged-PR replay and the train model table, GSTA-49 T0)" },
     { "file": "lib/gate-cost-history.ts", "movedFrom": "(new: red attribution, red-head screen replay, READY times and the READY-arrival train replay, GSTA-49 T0b)" },
diff --git a/test/fixtures/skill-md-size-allowlist.json b/test/fixtures/skill-md-size-allowlist.json
index 45435e0a9..2547e6adb 100644
--- a/test/fixtures/skill-md-size-allowlist.json
+++ b/test/fixtures/skill-md-size-allowlist.json
@@ -4,53 +4,53 @@
   "pins": {
     "agy/gstack-autoplan": 109666,
     "agy/gstack-plan-design-review": 109116,
-    "agy/gstack-plan-devex-review": 114958,
+    "agy/gstack-plan-devex-review": 114957,
     "agy/gstack-plan-eng-review": 143590,
     "agy/gstack-review": 104276,
     "codex/gstack-autoplan": 108409,
     "codex/gstack-plan-design-review": 110473,
-    "codex/gstack-plan-devex-review": 116466,
+    "codex/gstack-plan-devex-review": 116465,
     "codex/gstack-plan-eng-review": 144755,
     "codex/gstack-review": 103799,
     "copilot/gstack-autoplan": 109109,
     "copilot/gstack-plan-design-review": 109382,
-    "copilot/gstack-plan-devex-review": 114420,
+    "copilot/gstack-plan-devex-review": 114419,
     "copilot/gstack-plan-eng-review": 143755,
     "copilot/gstack-review": 103857,
     "cursor/gstack-autoplan": 108341,
     "cursor/gstack-plan-design-review": 107924,
-    "cursor/gstack-plan-devex-review": 113690,
+    "cursor/gstack-plan-devex-review": 113689,
     "cursor/gstack-plan-eng-review": 142345,
     "cursor/gstack-review": 122147,
     "factory/gstack-autoplan": 110619,
     "factory/gstack-plan-design-review": 111022,
-    "factory/gstack-plan-devex-review": 117053,
+    "factory/gstack-plan-devex-review": 117052,
     "factory/gstack-plan-eng-review": 145453,
     "factory/gstack-review": 125920,
     "gbrain/gstack-autoplan": 108748,
     "gbrain/gstack-plan-eng-review": 124972,
     "gemini/gstack-autoplan": 108899,
     "gemini/gstack-plan-design-review": 109210,
-    "gemini/gstack-plan-devex-review": 114248,
+    "gemini/gstack-plan-devex-review": 114247,
     "gemini/gstack-plan-eng-review": 143588,
     "gemini/gstack-review": 103679,
     "hermes/gstack-autoplan": 108751,
     "hermes/gstack-plan-eng-review": 125008,
     "kiro/gstack-autoplan": 108115,
     "kiro/gstack-plan-design-review": 107770,
-    "kiro/gstack-plan-devex-review": 113542,
+    "kiro/gstack-plan-devex-review": 113541,
     "kiro/gstack-plan-eng-review": 142207,
     "kiro/gstack-review": 121971,
     "openclaw/gstack-autoplan": 108571,
     "openclaw/gstack-plan-eng-review": 123487,
     "opencode/gstack-autoplan": 109090,
     "opencode/gstack-plan-design-review": 109238,
-    "opencode/gstack-plan-devex-review": 114298,
+    "opencode/gstack-plan-devex-review": 114297,
     "opencode/gstack-plan-eng-review": 143614,
     "opencode/gstack-review": 122769,
     "slate/gstack-autoplan": 108228,
     "slate/gstack-plan-design-review": 107847,
-    "slate/gstack-plan-devex-review": 113616,
+    "slate/gstack-plan-devex-review": 113615,
     "slate/gstack-plan-eng-review": 142276,
     "slate/gstack-review": 122059
   }
diff --git a/test/free-durations-record-workflow.test.ts b/test/free-durations-record-workflow.test.ts
index 2ba947cbf..85f15f216 100644
--- a/test/free-durations-record-workflow.test.ts
+++ b/test/free-durations-record-workflow.test.ts
@@ -82,7 +82,7 @@ test('the propose step touches only the two seeds, never the allowlist, on one b
   expect(script).not.toContain('free-test-seed-allowlist.json');
   expect(script).toContain('branch=bot/free-duration-seeds');
   expect(script).toContain('bun test test/free-seed-ratchet.test.ts');
-  for (const workflow of ['free-tests.yml', 'windows-free-tests.yml', 'quality-gate.yml']) {
+  for (const workflow of ['free-tests.yml', 'windows-smoke.yml', 'quality-gate.yml']) {
     expect(script).toContain(`gh workflow run ${workflow} --repo "$GITHUB_REPOSITORY" --ref "$branch"`);
     expect(load(workflow).on).toHaveProperty('workflow_dispatch');
   }
diff --git a/test/gstack-developer-profile.test.ts b/test/gstack-developer-profile.test.ts
index 11685bb64..46a945508 100644
--- a/test/gstack-developer-profile.test.ts
+++ b/test/gstack-developer-profile.test.ts
@@ -628,6 +628,24 @@ describe('gstack-developer-profile --check-mismatch', () => {
 // Error handling
 // -----------------------------------------------------------------------
 
+describe('gstack-developer-profile --profile on an unparseable profile (#3763)', () => {
+  test('exits non-zero, prints nothing to stdout, and names the file and the conflict markers', () => {
+    fs.writeFileSync(path.join(tmpHome, 'developer-profile.json'), '{\n<<<<<<< HEAD\n  "sessions": []\n=======\n  "sessions": [1]\n>>>>>>> origin/main\n}\n');
+    const r = runDev('--profile');
+    expect(r.status).not.toBe(0);
+    expect(r.stdout).toBe('');
+    expect(r.stderr).toContain('developer-profile.json is not valid JSON');
+    expect(r.stderr).toContain('git conflict markers');
+  });
+
+  test('a valid profile still prints as before', () => {
+    fs.writeFileSync(path.join(tmpHome, 'developer-profile.json'), '{"sessions":[]}\n');
+    const r = runDev('--profile');
+    expect(r.status).toBe(0);
+    expect(r.stdout).toBe('{"sessions":[]}\n');
+  });
+});
+
 describe('gstack-developer-profile errors', () => {
   test('unknown subcommand exits non-zero', () => {
     const r = runDev('--not-a-real-subcommand');
diff --git a/test/gstack-doctor.test.ts b/test/gstack-doctor.test.ts
index 61a680b40..367034c42 100644
--- a/test/gstack-doctor.test.ts
+++ b/test/gstack-doctor.test.ts
@@ -136,6 +136,25 @@ describe('gstack-doctor', () => {
     expect(r.out).not.toContain('.brain-sync-status.json');
   });
 
+  test('artifacts sync: a synced JSON file with conflict markers warns by name (#3763)', () => {
+    const f = makeFixture();
+    syncOn(f, { status: 'ok', message: 'pushed 3 file(s)', drainable: 0, last_drain_at: iso(60), last_push_at: iso(60) });
+    write(path.join(f.state, 'developer-profile.json'), '{\n<<<<<<< HEAD\n  "v": 1\n=======\n  "v": 2\n>>>>>>> origin/main\n}\n');
+    const r = doctor(f);
+    expect(r.row('artifacts sync').state).toBe('warn');
+    expect(r.row('artifacts sync').detail).toBe('developer-profile.json holds git conflict markers and does not parse');
+    write(path.join(f.state, 'developer-profile.json'), '{"v": 2}\n');
+    expect(doctor(f).row('artifacts sync').state).toBe('ok');
+  });
+
+  test('artifacts sync: a JSON hold is not attributed to the secret scanner (#3763)', () => {
+    const f = makeFixture();
+    syncOn(f, { status: 'held', message: 'held', held_count: 1, held: [{ path: 'developer-profile.json', rule: 'invalid-json', dependents: [], fixes: ['repair', 'skip'] }], drainable: 0, last_drain_at: iso(60), last_push_at: iso(60) });
+    const r = doctor(f);
+    expect(r.row('artifacts sync').state).toBe('warn');
+    expect(r.row('artifacts sync').detail).toBe('status held (1 synced file(s) are not valid JSON; 1 held in all)');
+  });
+
   test('artifacts sync: held, then ok', () => {
     const f = makeFixture();
     syncOn(f, { status: 'held', message: 'held 2 file(s): sk-ant-secret', held_count: 2, held: [{ path: 'projects/p/notes.md', rule: 'anthropic_key', dependents: [], fixes: ['edit', 'skip'] }, { path: 'projects/p/b.md', rule: 'anthropic_key', dependents: [], fixes: ['edit', 'skip'] }], drainable: 0, last_drain_at: iso(60), last_push_at: iso(60) });
diff --git a/test/gstack-restamp-queue.test.ts b/test/gstack-restamp-queue.test.ts
index 253ef75b8..3f599fe7b 100644
--- a/test/gstack-restamp-queue.test.ts
+++ b/test/gstack-restamp-queue.test.ts
@@ -8,6 +8,7 @@
  * version-source shapes (package-manifest pin, monorepo pin, absent source).
  */
 import { afterEach, describe, expect, test } from 'bun:test';
+import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { EXIT } from '../lib/headless-artifacts';
@@ -163,7 +164,7 @@ describe('three PRs, reordered twice, zero manual edits', () => {
     expect(changed.status).toBe(EXIT.fail);
     expect(changed.out).toMatch(/^TREE: changed \(pr-b\.txt\)$/m);
     expect(changed.out).toMatch(/^gate-reuse: not-eligible \(tree changed: pr-b\.txt\) — fix: .* \(GATE_REUSE_NOT_ELIGIBLE\)$/m);
-  });
+  }, 30_000);
 
   test('--dry-run prints the full diff and writes nothing; --was overrides the mention source', () => {
     const repo = fixture();
@@ -191,7 +192,7 @@ describe('three PRs, reordered twice, zero manual edits', () => {
     const stamped = restamp(repo, ['--next']);
     expect(stamped.status).toBe(EXIT.ok);
     expect(stamped.out).toMatch(/^next: NEW_VERSION=1\.2\.4\.0; record the release decision, then write the CHANGELOG entry text only/m);
-  });
+  }, 30_000);
 
   // Value: protects=a bump never repo's --next never invents a MICRO stamp: without --bump or --version it refuses and writes nothing, and an explicit level stamps as before; fails_when=restamp falls back to micro for a repo whose policy names no level;
   //   why_new=GST-380 added bump never; seam=gstack-ship-policy, gstack-version-bump write; no_claim=the claim queue read
@@ -454,7 +455,7 @@ describe('gate-ahead (--after), predecessor movement and queue staleness', () =>
     const viaGh = runBin(repo, 'gstack-tree-receipt', ['--from', path.join(repo.work, '.gstack/tmp/gate-ahead.json'), '--predecessor-pr', '1', '--bundle', bundle, '--base', 'main', '--json'], ghShim(repo, { '1': { headRefOid: repo.git('rev-parse', 'pr-a') } }));
     expect(JSON.parse(viaGh.out).predecessor.moved).toBe(true);
     expect(JSON.parse(viaGh.out).code).toBe('RESTAMP_PREDECESSOR_MOVED');
-  });
+  }, 30_000);
 
   test('a gate-ahead merge that conflicts outside the stamp files is RESTAMP_MERGE_CONFLICT with nothing written', () => {
     const repo = fixture();
@@ -587,3 +588,97 @@ describe('version-source shapes', () => {
     expect(fs.existsSync(path.join(repo.work, 'VERSION'))).toBe(false);
   });
 });
+
+describe('gstack-restamp stages what it writes (#3531)', () => {
+  /** Branch b forks from main; branch a stamps and merges first, so b's base merge conflicts only on the CHANGELOG. */
+  function behindMain(): FixtureRepo {
+    const repo = fixture();
+    makePr(repo, 'pr-b');
+    makePr(repo, 'pr-a');
+    expect(restamp(repo, ['--next']).status).toBe(EXIT.ok);
+    repo.git('add', '-A');
+    repo.git('commit', '-q', '-m', 'stamp pr-a');
+    mergeToMain(repo, 'pr-a');
+    repo.git('fetch', '-q', 'origin');
+    repo.git('checkout', '-q', 'pr-b');
+    return repo;
+  }
+  const cached = (repo: FixtureRepo) => repo.git('diff', '--cached', '--name-only').split('\n').filter(Boolean);
+  const unstaged = (repo: FixtureRepo) => repo.git('diff', '--name-only').split('\n').filter(Boolean);
+  const filesOf = (out: string) => (/^FILES: (.*)$/m.exec(out)?.[1] ?? '').split(' ').filter(Boolean);
+
+  test('after --next on a staged no-commit base merge, every FILES entry is staged, STAGED: names them, and a bare commit carries the stamp', () => {
+    const repo = behindMain();
+    const merge = spawnSync('git', ['merge', '--no-ff', '--no-commit', '-q', 'origin/main'], { cwd: repo.work, encoding: 'utf8', timeout: 30_000, env: { ...process.env, ...repo.env } });
+    if (merge.status !== 0) {
+      fs.writeFileSync(path.join(repo.work, 'CHANGELOG.md'), mergeChangelogs(repo.git('show', ':2:CHANGELOG.md') + '\n', repo.git('show', ':3:CHANGELOG.md') + '\n')!);
+      repo.git('add', 'CHANGELOG.md');
+    }
+    const r = restamp(repo, ['--next']);
+    expect(r.status, r.err).toBe(EXIT.ok);
+    const files = filesOf(r.out);
+    expect(files).toEqual(expect.arrayContaining(['VERSION', 'CHANGELOG.md']));
+    expect(cached(repo)).toEqual(expect.arrayContaining(files));
+    expect(unstaged(repo).filter(f => files.includes(f))).toEqual([]);
+    const staged = /^STAGED: (.*)$/m.exec(r.out)?.[1]?.split(' ') ?? [];
+    expect(staged).toEqual(expect.arrayContaining(files));
+    repo.git('commit', '-q', '--no-edit');
+    expect(repo.git('show', 'HEAD:VERSION')).toBe('1.2.5.0');
+    expect(repo.git('show', 'HEAD:CHANGELOG.md')).toMatch(/^# Changelog\n\n## \[1\.2\.5\.0\]/);
+    expect(fs.existsSync(path.join(repo.work, '.gstack/tmp/restamp-staging.json'))).toBe(false);
+  });
+
+  test('a stamp file with unstaged edits of its own refuses before writing (RESTAMP_UNSTAGED_EDITS); nothing written or staged', () => {
+    const repo = fixture();
+    makePr(repo, 'pr-c');
+    fs.appendFileSync(path.join(repo.work, 'CHANGELOG.md'), '\n- an edit the caller has not staged\n');
+    const r = restamp(repo, ['--next']);
+    expect(r.status).toBe(EXIT.refused);
+    expect(r.err).toMatch(/CHANGELOG\.md holds? unstaged edits of your own.*nothing written.*\(RESTAMP_UNSTAGED_EDITS\)/);
+    expect(readFile(repo, 'VERSION')).toBe('1.2.3.0\n');
+    expect(cached(repo)).toEqual([]);
+  });
+
+  test('a staging failure prints RESTAMP_NOT_STAGED with the files written and a marker; the noop rerun stages them', () => {
+    const repo = fixture();
+    makePr(repo, 'pr-d');
+    const lock = path.join(repo.work, '.git', 'index.lock');
+    fs.writeFileSync(lock, '');
+    const r = restamp(repo, ['--next']);
+    expect(r.status).toBe(EXIT.fail);
+    expect(r.err).toContain('(RESTAMP_NOT_STAGED)');
+    expect(r.out).not.toMatch(/^STAGED:/m);
+    expect(readFile(repo, 'VERSION')).toBe('1.2.4.0\n');
+    expect(cached(repo)).toEqual([]);
+    expect(fs.existsSync(path.join(repo.work, '.gstack/tmp/restamp-staging.json'))).toBe(true);
+    fs.rmSync(lock, { force: true });
+    const again = restamp(repo, ['--next']);
+    expect(again.status, again.err).toBe(EXIT.ok);
+    expect(again.out).toMatch(/^RESTAMP: .*\(noop;/m);
+    expect(cached(repo)).toEqual(expect.arrayContaining(['VERSION', 'CHANGELOG.md']));
+    expect(again.out).toMatch(/^STAGED: .*VERSION/m);
+    expect(fs.existsSync(path.join(repo.work, '.gstack/tmp/restamp-staging.json'))).toBe(false);
+  });
+
+  // fails_when=a staging marker left by a failure the lane then cleared by hand makes every later noop restamp exit 1 with RESTAMP_NOT_STAGED, whose fix (rerun) can never clear it (outside voice, PR #3737); why_new=the test above reruns on the same unchanged files; seam=.git/index.lock; no_claim=how the lane cleared the failure
+  test('a stale staging marker (its files changed since: a hand commit, then another stamped branch) is dropped by the noop rerun instead of failing it', () => {
+    const repo = fixture();
+    makePr(repo, 'pr-a');
+    expect(restamp(repo, ['--next']).status).toBe(EXIT.ok);
+    repo.git('commit', '-q', '-m', 'stamp pr-a');
+    makePr(repo, 'pr-d');
+    const lock = path.join(repo.work, '.git', 'index.lock');
+    fs.writeFileSync(lock, '');
+    expect(restamp(repo, ['--next']).err).toContain('(RESTAMP_NOT_STAGED)');
+    fs.rmSync(lock, { force: true });
+    repo.git('add', '-A');
+    repo.git('commit', '-q', '-m', 'stamp pr-d by hand');
+    repo.git('checkout', '-q', 'pr-a');
+    const noop = restamp(repo, ['--next']);
+    expect(noop.status, noop.err).toBe(EXIT.ok);
+    expect(noop.err).not.toContain('RESTAMP_NOT_STAGED');
+    expect(noop.out).toMatch(/^NOTE: .*CHANGELOG\.md.* changed since an earlier restamp wrote (it|them); not staged/m);
+    expect(fs.existsSync(path.join(repo.work, '.gstack/tmp/restamp-staging.json'))).toBe(false);
+    expect(restamp(repo, ['--next']).status).toBe(EXIT.ok);
+  });
+});
diff --git a/test/gstack-ship-queue.test.ts b/test/gstack-ship-queue.test.ts
index 9b9248631..fab39a52a 100644
--- a/test/gstack-ship-queue.test.ts
+++ b/test/gstack-ship-queue.test.ts
@@ -562,10 +562,10 @@ describe('ready on a PR that conflicts with the base (CHANGELOG-only conflicts,
     const { r, at } = readyWith('CONFLICTING', { check_runs: [] });
     expect(r.status).toBe(EXIT.refused);
     expect(line(r.out, 'ci: ')).toBe(`ci: none at ${at} (passed=0 failed=0 pending=0 skipped=0)`);
-    expect(line(r.out, 'ci-hint: ')).toBe(`ci-hint: PR conflicts with the base (no merge ref, so pull_request CI did not run on ${at}); dispatch the free workflows on the branch (gh workflow run free-tests.yml --ref pr-a && gh workflow run windows-free-tests.yml --ref pr-a), clear the pregate lanes with their run URLs (gstack-pregate clear --remote <lane> --run-url <run>), then rerun ready (advisory)`);
+    expect(line(r.out, 'ci-hint: ')).toBe(`ci-hint: PR conflicts with the base (no merge ref, so pull_request CI did not run on ${at}); dispatch the free workflows on the branch (gh workflow run free-tests.yml --ref pr-a && gh workflow run windows-smoke.yml --ref pr-a), clear the pregate lanes with their run URLs (gstack-pregate clear --remote <lane> --run-url <run>), then rerun ready (advisory)`);
     for (const name of ['x;$(curl evil)', '--field']) {
       const odd = readyWith('CONFLICTING', { check_runs: [] }, { headRefName: name });
-      expect(line(odd.r.out, 'ci-hint: ')).toContain('gh workflow run free-tests.yml --ref <branch> && gh workflow run windows-free-tests.yml --ref <branch>');
+      expect(line(odd.r.out, 'ci-hint: ')).toContain('gh workflow run free-tests.yml --ref <branch> && gh workflow run windows-smoke.yml --ref <branch>');
     }
     const fork = readyWith('CONFLICTING', { check_runs: [] }, { isCrossRepository: true });
     expect(line(fork.r.out, 'ci-hint: ')).toBe(`ci-hint: PR conflicts with the base (no merge ref, so pull_request CI did not run on ${fork.at}) and its head is on a fork, so the free workflows cannot be dispatched here; the coordinator decides (advisory)`);
diff --git a/test/gstack-skill-start.test.ts b/test/gstack-skill-start.test.ts
index 5dca2124f..1fd895132 100644
--- a/test/gstack-skill-start.test.ts
+++ b/test/gstack-skill-start.test.ts
@@ -816,7 +816,7 @@ describe('ARTIFACTS_SYNC attention lines (sync status table)', () => {
       const held = runStart([], env);
       expect(held).toMatch(/^ARTIFACTS_SYNC: mode=full \| last_push=\S+ \| queue=\d+$/m);
       expect(attention(held)).toEqual([
-        `ARTIFACTS_SYNC: attention: status=held held=1. The secret scan is holding back 1 file(s); everything else still syncs. See which files and how to fix them: ${path.join(ROOT, 'bin', 'gstack-brain-sync')} --status`,
+        `ARTIFACTS_SYNC: attention: status=held held=1. Sync is holding back 1 file(s) that the secret scan flagged or that are not valid JSON; everything else still syncs. See which files and how to fix them: ${path.join(ROOT, 'bin', 'gstack-brain-sync')} --status`,
       ]);
       expect(held).not.toContain('ghp_');
       expect(remoteFiles()).toContain('projects/p/ceo-plans/clean.md');
diff --git a/test/helpers/autoplan-ceo-only-evidence.ts b/test/helpers/autoplan-ceo-only-evidence.ts
new file mode 100644
index 000000000..224cbac22
--- /dev/null
+++ b/test/helpers/autoplan-ceo-only-evidence.ts
@@ -0,0 +1,96 @@
+/**
+ * Evidence for the /autoplan --ceo-only paid case (test/skill-e2e-autoplan-ceo-only.test.ts):
+ * the run asked nothing, reviewed the plan through the CEO phase, skipped every
+ * later phase, wrote ceo-review.md, ended status=reviewed, and wrote nothing in
+ * HOME outside its declared roots. Pure over the transcript and files the test
+ * collects, so test/autoplan-ceo-only.test.ts proves each check fails on a
+ * synthetic negative control before any paid run.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+export const CEO_REVIEW_HEADINGS = [
+  '## User challenges (direction kept)', '## Scope added', '## Conservative choices', '## Findings', '## Decision Audit Trail',
+] as const;
+
+const QUESTION_TOOL = /(^|__)(AskUserQuestion|ExitPlanMode)$/;
+const PROSE_QUESTION = /\b(would you like|do you want|should i\b|want me to|shall i\b|which (?:option|mode|one) (?:do|would|should) you|reply with|let me know (?:if|which|whether))/i;
+const LATER_PHASE = /autoplan\/sections\/(?:design-phase|dx-phase|eng-phase|tasks-aggregator)\.md/;
+const DISPATCH_TOOL = /^(Agent|Task)$/;
+
+export interface CeoOnlyEvidenceInput {
+  transcript: any[];
+  /** The session's final result text. */
+  output: string;
+  /** New files under HOME outside the declared roots (the test's before/after diff). */
+  strayWrites: string[];
+  /** Patterns the reviewed plan or ceo-review.md must contain for the seeded flaw. */
+  mustMention: RegExp[];
+}
+export interface CeoOnlyEvidence { passed: boolean; reasons: string[]; runDir?: string; questions: string[] }
+
+function blocks(transcript: any[]): Array<{ role: string; block: any }> {
+  return transcript.flatMap(event => {
+    const role = event?.type === 'assistant' ? 'assistant' : event?.type === 'user' ? 'user' : '';
+    const content = event?.message?.content;
+    return role && Array.isArray(content) ? content.map((block: any) => ({ role, block })) : [];
+  });
+}
+
+export function ceoOnlyEvidence(input: CeoOnlyEvidenceInput): CeoOnlyEvidence {
+  const reasons: string[] = [];
+  const all = blocks(input.transcript);
+  const uses = all.filter(b => b.role === 'assistant' && b.block?.type === 'tool_use').map(b => b.block);
+  const texts = all.filter(b => b.role === 'assistant' && b.block?.type === 'text').map(b => String(b.block.text ?? ''));
+  const results = all.filter(b => b.role === 'user' && b.block?.type === 'tool_result')
+    .map(b => (typeof b.block.content === 'string' ? b.block.content : JSON.stringify(b.block.content ?? '')));
+
+  const questions = [
+    ...uses.filter(u => QUESTION_TOOL.test(String(u.name))).map(u => `tool ${u.name}`),
+    ...[...texts, input.output].flatMap(t => t.split('\n').filter(line => line.trim().endsWith('?') && PROSE_QUESTION.test(line)).map(line => `prose: ${line.trim().slice(0, 160)}`)),
+  ];
+  if (questions.length) reasons.push(`asked ${questions.length} question(s): ${questions.join(' | ')}`);
+
+  const handoff = uses.some(u => u.name === 'Bash' && /gstack-ceo-mode-handoff\b/.test(String(u.input?.command)) && /--ceo-only\b/.test(String(u.input?.command)))
+    && results.some(r => r.includes('(CEO-only run: Step 0E'));
+  if (!handoff) reasons.push('no gstack-ceo-mode-handoff --ceo-only call with its CEO-only line');
+  if (!uses.some(u => DISPATCH_TOOL.test(String(u.name)))) reasons.push('no CEO reviewer subagent was dispatched');
+  const later = uses.map(u => String(u.name === 'Bash' ? u.input?.command : (u.input?.file_path ?? u.input?.path ?? u.input?.pattern ?? '')))
+    .filter(arg => LATER_PHASE.test(arg));
+  if (later.length) reasons.push(`loaded a skipped phase: ${later.map(arg => arg.slice(0, 160)).join(', ')}`);
+
+  const result = /^GSTACK_RESULT: skill=autoplan status=(\S+) run=(.+)$/m.exec(input.output.split('\n').filter(l => l.startsWith('GSTACK_RESULT: ')).pop() ?? '');
+  if (!result) reasons.push('no GSTACK_RESULT line for autoplan in the final output');
+  else if (result[1] !== 'reviewed') reasons.push(`GSTACK_RESULT status=${result[1]}, expected reviewed`);
+  const runDir = result?.[2]?.trim();
+  const reviewFile = runDir ? path.join(runDir, 'ceo-review.md') : '';
+  const review = reviewFile && fs.existsSync(reviewFile) ? fs.readFileSync(reviewFile, 'utf8') : undefined;
+  if (runDir && review === undefined) reasons.push(`${reviewFile} is missing`);
+  if (review !== undefined) {
+    const missing = CEO_REVIEW_HEADINGS.filter(h => !review.includes(h));
+    if (missing.length) reasons.push(`ceo-review.md lacks ${missing.join(', ')}`);
+    if (!/\|\s*\d+\s*\|/.test(review.slice(review.indexOf('## Decision Audit Trail')))) reasons.push('ceo-review.md has no Decision Audit Trail rows');
+    const unmet = input.mustMention.filter(re => !re.test(review));
+    if (unmet.length) reasons.push(`ceo-review.md never names the seeded flaw (${unmet.map(String).join(', ')})`);
+  }
+  if (input.strayWrites.length) {
+    const dirs = [...new Set(input.strayWrites.map(f => f.split('/').slice(0, 2).join('/')))];
+    reasons.push(`wrote ${input.strayWrites.length} file(s) outside its roots, under ${dirs.join(', ')}: ${input.strayWrites.slice(0, 5).join(', ')}`);
+  }
+  return { passed: reasons.length === 0, reasons, runDir, questions };
+}
+
+/** Every file under root, relative, skipping the given relative prefixes. */
+export function listFiles(root: string, skip: string[] = []): string[] {
+  const out: string[] = [];
+  const walk = (dir: string) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const abs = path.join(dir, entry.name);
+      const rel = path.relative(root, abs);
+      if (skip.some(s => rel === s || rel.startsWith(s + path.sep))) continue;
+      if (entry.isDirectory()) walk(abs); else out.push(rel);
+    }
+  };
+  if (fs.existsSync(root)) walk(root);
+  return out.sort();
+}
diff --git a/test/helpers/autoplan-run-fixture.ts b/test/helpers/autoplan-run-fixture.ts
index de053d821..e651305a2 100644
--- a/test/helpers/autoplan-run-fixture.ts
+++ b/test/helpers/autoplan-run-fixture.ts
@@ -58,6 +58,16 @@ export function resultOf(out: string, phase: string, voice: 'native' | 'outside'
 }
 /** The sealed copy a completed voice is bound to. */
 export const boundOf = (out: string, phase: string, voice: 'native' | 'outside'): string => path.join(out, readRun(out).phases[phase][voice].output);
+/**
+ * A `rec`/`all` reply that carries every open Critical/High finding item into the build (`<id>b`, no plan change),
+ * so a test about another gate mechanism keeps its flow; `extra` tokens are appended to the except list.
+ */
+export function recCarrying(out: string, base = 'all', extra: string[] = []): string {
+  const carry = (JSON.parse(fs.readFileSync(path.join(out, 'gate.json'), 'utf8')).items as Array<{ id: string; finding?: string[] }>).filter(i => i.finding).map(i => `${i.id}b`);
+  const tokens = [...carry, ...extra];
+  return tokens.length ? `${base} except ${tokens.join(' ')}` : base;
+}
+
 export function attemptsOf(out: string, phase: string): { native: string; outside: string } {
   const run = readRun(out);
   return { native: run.phases[phase].native.attempt, outside: run.phases[phase].outside.attempt };
diff --git a/test/helpers/carve-guards.ts b/test/helpers/carve-guards.ts
index cc4ee6140..bd0b464b2 100644
--- a/test/helpers/carve-guards.ts
+++ b/test/helpers/carve-guards.ts
@@ -583,7 +583,7 @@ do not launch the downstream skill or open a browser.`,
     maxSkeletonBytes: 48_175, // GSTA-96 hoist (2026-10-26): lowered from 70_000 by the shared preamble that moved to sections/preamble.md, keeping the pre-hoist headroom of 4,888 bytes; measured 43,287. Before: Phase-specific outside coverage, native fallback, and harness guard.
     minUnionBytes: 85_000, // measured union 86,926
     mustContain: ['6 Decision Principles', 'TASTE DECISION', 'USER CHALLENGE', 'consensus', 'Restore Point'],
-    maxSizeRatio: 1.1511, // Four validated outside invocations replace raw CLI calls; phases keep independent coverage. + Oct 7 wave B3: the Codex probe runs as a command (select-model capture lines, check-sandbox/probe-model/run-with-timeout subcommands) instead of being sourced; measured 114,297 / 101,979 = 1.1208 (2026-10-07). + Oct 7 wave CEO-28/DX-11: review prompts ask for a severity per finding and design proposals use the proposal gate; measured 114,533 / 101,979 = 1.1231 (2026-10-07). + Oct 7 wave guard (CEO-20): conditional `run_in_background` request plus the background-run recovery at each foreground dispatch site, and phase-close publishing each report with the `true autoplan-published <phase>` no-op before the next phase entry in a later message (CEO-1); measured 114,320 / 101,979 = 1.1210 (2026-10-07). Merged with the guard area: measured 115,149 / 101,979 = 1.1291 (2026-10-07). + Oct 8 wave (permission cards after a background reviewer): Step 1 puts RESTORE_PATH, and so every phase artifact, in the project's git-excluded `.gstack/tmp/autoplan/`, which Claude Code reads without a card after the skill turn ends; measured 115,270 / 101,979 = 1.1303 (2026-10-08). + fix wave PR D: the prerequisite offer is skipped in spawned/headless sessions (#1958); measured 115,267 / 101,979 = 1.1303 (2026-10-07). Both merged: measured 115,126 / 101,979 = 1.1289 (2026-10-08). + Honest Work wave merged (W2/W3 gate integrity in review/ship, W4 kernel + DONE line in every tier-2+ skill, W5/W7 in spec/ship): re-measured on the integrated tree (2026-10-10). + Oct 10 multi-agent wave B9/B10/B12: Phase 0 ESTIMATE and the phase-close timing record, the final gate as a gate list (`gstack-gate render/parse`, stable ids, gate_rev) and the URGENT block above the summary, offset by tightening the Phase 4 prose and the tasks-section; measured 114,980 / 101,979 = 1.1275 (2026-10-10). + Oct 10 multi-agent wave PR D1 (reality rows): the reality-rows check line in the CEO and Eng phase files, the Pre-Gate rule (unattended miss is `incomplete`, never a warning) and the two Pre-Gate cells; measured 117,042 / 101,979 = 1.1477 (2026-10-10). + GSTA-96 shared-preamble hoist (owner-approved raise, Garry 2026-10-25: "do it"): the union now holds sections/preamble.md, so a fresh invocation reads the pointer plus the shared file; measured 117,388 / 101,979 = 1.1511 (2026-10-25). Before: 1.149.
+    maxSizeRatio: 1.1723, // GST-537 /autoplan --ceo-only (GStack Minder approved A1, 2026-10-31): sections/ceo-only.md (2,168 B) plus its Section index row, read only when the invocation names --ceo-only (test/autoplan-ceo-only.test.ts pins that a normal run never reads it); measured 119,545 / 101,979 = 1.1723 (2026-10-31), +2,276 B over main's 117,269 = 1.1499. Before: 1.1511. Four validated outside invocations replace raw CLI calls; phases keep independent coverage. + Oct 7 wave B3: the Codex probe runs as a command (select-model capture lines, check-sandbox/probe-model/run-with-timeout subcommands) instead of being sourced; measured 114,297 / 101,979 = 1.1208 (2026-10-07). + Oct 7 wave CEO-28/DX-11: review prompts ask for a severity per finding and design proposals use the proposal gate; measured 114,533 / 101,979 = 1.1231 (2026-10-07). + Oct 7 wave guard (CEO-20): conditional `run_in_background` request plus the background-run recovery at each foreground dispatch site, and phase-close publishing each report with the `true autoplan-published <phase>` no-op before the next phase entry in a later message (CEO-1); measured 114,320 / 101,979 = 1.1210 (2026-10-07). Merged with the guard area: measured 115,149 / 101,979 = 1.1291 (2026-10-07). + Oct 8 wave (permission cards after a background reviewer): Step 1 puts RESTORE_PATH, and so every phase artifact, in the project's git-excluded `.gstack/tmp/autoplan/`, which Claude Code reads without a card after the skill turn ends; measured 115,270 / 101,979 = 1.1303 (2026-10-08). + fix wave PR D: the prerequisite offer is skipped in spawned/headless sessions (#1958); measured 115,267 / 101,979 = 1.1303 (2026-10-07). Both merged: measured 115,126 / 101,979 = 1.1289 (2026-10-08). + Honest Work wave merged (W2/W3 gate integrity in review/ship, W4 kernel + DONE line in every tier-2+ skill, W5/W7 in spec/ship): re-measured on the integrated tree (2026-10-10). + Oct 10 multi-agent wave B9/B10/B12: Phase 0 ESTIMATE and the phase-close timing record, the final gate as a gate list (`gstack-gate render/parse`, stable ids, gate_rev) and the URGENT block above the summary, offset by tightening the Phase 4 prose and the tasks-section; measured 114,980 / 101,979 = 1.1275 (2026-10-10). + Oct 10 multi-agent wave PR D1 (reality rows): the reality-rows check line in the CEO and Eng phase files, the Pre-Gate rule (unattended miss is `incomplete`, never a warning) and the two Pre-Gate cells; measured 117,042 / 101,979 = 1.1477 (2026-10-10). + GSTA-96 shared-preamble hoist (owner-approved raise, Garry 2026-10-25: "do it"): the union now holds sections/preamble.md, so a fresh invocation reads the pointer plus the shared file; measured 117,388 / 101,979 = 1.1511 (2026-10-25). Before: 1.149.
   },
   spec: {
     skill: 'spec',
diff --git a/test/helpers/ship-queue-train-cases.ts b/test/helpers/ship-queue-train-cases.ts
index 5e265932b..3ec17945b 100644
--- a/test/helpers/ship-queue-train-cases.ts
+++ b/test/helpers/ship-queue-train-cases.ts
@@ -1,7 +1,12 @@
 /** Train setups shared by the test/ship-queue-train*.test.ts files (moved from test/ship-queue-train.test.ts, GSTA-151). */
+import { expect } from 'bun:test';
+import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { GREEN_GATE, nonceOf, openPr, queue, readyReceipt, type Rule, type TrainFixture } from './ship-queue-train-fixture';
+import { mergeChangelogs } from '../../lib/changelog-check';
+import { EXIT } from '../../lib/headless-artifacts';
+import { runBin } from './restamp-fixture';
+import { GREEN_GATE, line, nonceOf, openPr, queue, readyReceipt, type Rule, type TrainFixture } from './ship-queue-train-fixture';
 
 export function twoPrTrain(fx: TrainFixture, gate: Rule = GREEN_GATE) {
   const h1 = openPr(fx, '1');
@@ -27,3 +32,33 @@ export function publishMain(fx: TrainFixture, prefixCommit: string, version: str
   repo.git('fetch', '-q', 'origin');
   return repo.git('rev-parse', 'HEAD');
 }
+
+/** The lane's slot stamp on its pin (main merged in first from slot 2 on): gstack-restamp --next, then the stamp files committed and pushed as the PR head. */
+export function laneStamp(fx: TrainFixture, pr: string, pin: string, o: { mergeMain?: boolean; dropStamp?: boolean } = {}): string {
+  const { repo } = fx;
+  repo.git('reset', '-q', '--hard');
+  repo.git('fetch', '-q', 'origin');
+  repo.git('checkout', '-q', '-B', `lane${pr}`, pin);
+  if (o.mergeMain) {
+    const m = spawnSync('git', ['merge', '--no-ff', '--no-commit', '-q', 'origin/main'], { cwd: repo.work, encoding: 'utf8', timeout: 30_000, env: { ...process.env, ...repo.env } });
+    if (m.status !== 0) {
+      const side = (n: number) => repo.git('show', `:${n}:CHANGELOG.md`) + '\n';
+      fs.writeFileSync(path.join(repo.work, 'CHANGELOG.md'), mergeChangelogs(side(2), side(3), side(1))!);
+      repo.git('add', 'CHANGELOG.md');
+    }
+  }
+  const index = repo.git('write-tree');
+  const stamp = runBin(repo, 'gstack-restamp', ['--next', '--base', 'main', '--allow-repo-commands'], fx.env);
+  expect(stamp.status, stamp.err).toBe(EXIT.ok);
+  const files = line(stamp.out, 'FILES:').slice('FILES: '.length).split(' ').filter(Boolean);
+  if (o.dropStamp) repo.git('read-tree', index);
+  else repo.git('add', '-A', '--', ...files);
+  repo.git('commit', '-q', '--no-edit', '-m', `slot stamp #${pr}`);
+  if (o.dropStamp) repo.git('checkout', '-q', '--', '.');
+  const head = repo.git('rev-parse', 'HEAD');
+  repo.git('push', '-q', '-f', 'origin', `${head}:refs/pull/${pr}/head`);
+  return head;
+}
+
+/** GitHub reports the PR MERGED, which verify --train needs before it confirms a merge (#3531). */
+export const markMerged = (fx: TrainFixture, pr: string) => fx.write(d => { (d.prs[pr] as any).state = 'MERGED'; });
diff --git a/test/helpers/ship-queue-train-fixture.ts b/test/helpers/ship-queue-train-fixture.ts
index c48fed515..17e3f822b 100644
--- a/test/helpers/ship-queue-train-fixture.ts
+++ b/test/helpers/ship-queue-train-fixture.ts
@@ -147,6 +147,41 @@ export function trainJson(fx: TrainFixture, nonce: string, state = fx.state): an
 }
 export const dispatches = (fx: TrainFixture, workflow?: string) => fx.read().log.filter(l => l.cmd === 'workflow run' && (!workflow || l.workflow === workflow));
 
+/** For train land and land: pr view reads the head from origin's branch; pr edit and pr merge act on origin; any commit without recorded CI reads green. */
+export function wrapLand(fx: TrainFixture): void {
+  const dir = path.join(fx.repo.root, 'gh-land-wrap');
+  fs.mkdirSync(dir, { recursive: true });
+  const shim = path.join(fx.repo.root, 'gh-train-shim', 'shim.js');
+  fs.writeFileSync(path.join(dir, 'gh'), [
+    '#!/usr/bin/env node',
+    "const fs=require('fs');const cp=require('child_process');const D=process.env.LAND_WRAP_DATA;const a=process.argv.slice(2);",
+    "const d=JSON.parse(fs.readFileSync(D,'utf8'));const save=()=>fs.writeFileSync(D,JSON.stringify(d));",
+    "const g=(...x)=>cp.execFileSync('git',['--git-dir',d.origin,...x],{encoding:'utf8',timeout:30000}).trim();",
+    "const rev=r=>{try{return g('rev-parse','--verify','--quiet',r)}catch{return ''}};",
+    "if(a[0]==='pr'&&a[1]==='view'&&d.prs[a[2]]){const p=d.prs[a[2]];const h=rev('refs/heads/'+p.headRefName);if(h)p.headRefOid=h;save();console.log(JSON.stringify(p));process.exit(0)}",
+    "if(a[0]==='pr'&&a[1]==='edit'){(d.labels=d.labels||{})[a[2]]=a[a.indexOf('--add-label')+1];save();process.exit(0)}",
+    "if(a[0]==='pr'&&a[1]==='merge'){const p=d.prs[a[2]];const want=a[a.indexOf('--match-head-commit')+1];if(rev('refs/heads/'+p.headRefName)!==want){console.error('Head branch was modified');process.exit(1)}",
+    "  const before=rev('main');let tree=rev(want+'^{tree}');",
+    "  if(d.outsideOnMerge){const blob=cp.execFileSync('git',['--git-dir',d.origin,'hash-object','-w','--stdin'],{input:'outside\\n',encoding:'utf8',timeout:30000}).trim();",
+    "    const ls=g('ls-tree',before+'^{tree}')+'\\n100644 blob '+blob+'\\toutside.txt';const ot=cp.execFileSync('git',['--git-dir',d.origin,'mktree'],{input:ls+'\\n',encoding:'utf8',timeout:30000}).trim();",
+    "    g('update-ref','refs/heads/main',g('commit-tree',ot,'-p',before,'-m','outside'));tree=g('merge-tree','--write-tree','--merge-base='+before,rev('main'),want).split('\\n')[0];d.outsideOnMerge=false}",
+    "  g('update-ref','refs/heads/main',g('commit-tree',tree,'-p',rev('main'),'-m','squash #'+a[2]));p.state='MERGED';save();process.exit(0)}",
+    "const paged=/commits\\/([0-9a-f]+)\\/(check-runs|status)\\?.*page=(\\d+)/.exec(a[1]||'');",
+    "if(a[0]==='api'&&paged&&!(d.ci||{})[paged[1]]&&!((d.statuses||{})[paged[1]])){const list=paged[2]==='check-runs'?[{name:'free-tests',status:'completed',conclusion:'success',id:1,completed_at:'2026-10-26T00:00:00Z'}]:[];const key=paged[2]==='check-runs'?'check_runs':'statuses';console.log(JSON.stringify(paged[3]==='1'?{total_count:list.length,state:'success',[key]:list}:{total_count:list.length,[key]:[]}));process.exit(0)}",
+    `const r=cp.spawnSync('node',[${JSON.stringify(shim)},D,...a],{stdio:'inherit',timeout:120000});process.exit(r.status??1);`,
+    '',
+  ].join('\n'), { mode: 0o755 });
+  fx.env.PATH = `${dir}:${fx.env.PATH}`;
+  (fx.env as Record<string, string>).LAND_WRAP_DATA = fx.dataFile;
+}
+
+/** A changelog_fragments PR: a fragment under changelog.d/, pushed as pr-<n>, with a READY receipt. */
+export function fragmentPr(fx: TrainFixture, pr: string, fragment = `- #${pr} change\n`): string {
+  const head = openPr(fx, pr, { file: `changelog.d/pr-${pr}.md`, text: fragment, changelog: false });
+  fx.repo.git('push', '-q', 'origin', `${head}:refs/heads/pr-${pr}`);
+  readyReceipt(fx, pr, head);
+  return head;
+}
 function shimSource(): string {
   return [
     "const fs = require('fs'); const path = require('path'); const cp = require('child_process');",
diff --git a/test/helpers/touchfiles-data.ts b/test/helpers/touchfiles-data.ts
index 25aabf2d3..52618ed24 100644
--- a/test/helpers/touchfiles-data.ts
+++ b/test/helpers/touchfiles-data.ts
@@ -918,6 +918,12 @@ export const E2E_TOUCHFILES: Record<string, string[]> = {
      'test/fixtures/autoplan-phase-handoff-6714.json','scripts/resolvers/learnings.ts', 'scripts/resolvers/preamble/generate-completion-status.ts', 'scripts/resolvers/preamble/generate-preamble-bash.ts',  'test/fixtures/plan-scope-recovery-av.json',   'test/fixtures/design-scope-checkpoint-at.json',  'scripts/resolvers/composition.ts',   'autoplan/**', 'lib/claude-journal-records.ts', 'lib/claude-owned-journal.ts', 'codex/**', 'bin/gstack-codex-probe', 'scripts/resolvers/review-dashboard.ts', 'scripts/resolvers/plan-gates.ts', 'scripts/resolvers/spec-review.ts', 'scripts/resolvers/outside-voice-steps.ts', 'scripts/resolvers/review-scope.ts', 'scripts/resolvers/outside-voice.ts', 'scripts/resolvers/design.ts', 'test/skill-e2e-autoplan-dual-voice.test.ts', 'bin/gstack-autoplan-snapshot.ts',    'test/fixtures/autoplan/t-ceo-omitted-obligations.json', 'test/fixtures/autoplan/u-ceo-original-loss.json', 'test/fixtures/autoplan/v-ceo-dangling-references.json',
     'scripts/resolvers/design-doc-discovery.ts', 'bin/gstack-design-doc-find', 'bin/gstack-ceo-plan-find', 'plan-ceo-review/**', 'ETHOS.md', 'plan-eng-review/**', 'plan-design-review/**', 'plan-devex-review/**', 'scripts/resolvers/testing.ts', 'scripts/resolvers/preamble/generate-ask-user-format.ts',  'scripts/resolvers/tasks-section.ts', 'test/helpers/autoplan-phase-observer.ts', 'scripts/resolve-codex-generation-model.ts', 'scripts/resolvers/constants.ts'],
 
+  // /autoplan --ceo-only: zero questions through the CEO phase (GST-537)
+  'autoplan-ceo-only': ['autoplan/**', 'plan-ceo-review/**', 'ETHOS.md', 'scripts/resolvers/preamble.ts', 'scripts/resolvers/preamble-hoist.ts',
+    'scripts/resolvers/preamble/generate-ask-user-format.ts', 'bin/gstack-state-root.sh', 'lib/state-root.ts',
+    'lib/headless-artifacts.ts', 'bin/gstack-ceo-mode-handoff', 'test/helpers/autoplan-ceo-only-evidence.ts', 'test/helpers/hermetic-env.ts',
+    'test/skill-e2e-autoplan-ceo-only.test.ts', 'test/fixtures/forcing-finding-seeds.ts'],
+
   // Multi-provider benchmark adapters — live API smoke against real claude/codex/gemini CLIs
   'benchmark-providers-live': ['bin/gstack-model-benchmark', 'test/helpers/providers/**', 'test/helpers/benchmark-runner.ts', 'test/helpers/pricing.ts', 'test/skill-e2e-benchmark-providers.test.ts'],
 
@@ -1581,6 +1587,7 @@ export const E2E_TIERS: Record<string, 'gate' | 'periodic' | 'marathon'> = {
 
   // Autoplan — periodic (not yet implemented)
   'autoplan-dual-voice': 'periodic',
+  'autoplan-ceo-only': 'marathon',  // Full /autoplan --ceo-only CEO review (349–984 s over 6 runs, GST-537); the gate (I5) and periodic lanes are at their caps
 
   // Multi-provider benchmark — periodic (requires external CLIs + auth, paid)
   'benchmark-providers-live': 'periodic',
@@ -1995,6 +2002,7 @@ export const E2E_KINDS: Record<string, 'rule' | 'behavior' | 'judge'> = {
   'benchmark-workflow': 'rule',
   'setup-deploy-workflow': 'rule',
   'autoplan-dual-voice': 'rule',
+  'autoplan-ceo-only': 'rule',
   'benchmark-providers-live': 'rule',
   'scrape-match-path': 'behavior',
   'scrape-prototype-path': 'behavior',
diff --git a/test/jsonl-merge-encoding.test.ts b/test/jsonl-merge-encoding.test.ts
new file mode 100644
index 000000000..3728e9a23
--- /dev/null
+++ b/test/jsonl-merge-encoding.test.ts
@@ -0,0 +1,41 @@
+/**
+ * #3659: gstack-jsonl-merge read its inputs as UTF-8 but wrote them with
+ * print(), so a redirected stdout on a legacy code page (cp1250 on the
+ * reporter's Windows) raised UnicodeEncodeError on a Cyrillic line, and any
+ * Windows Python rewrote LF as CRLF. The driver must write UTF-8 with LF
+ * whatever the platform and code page. PYTHONIOENCODING=cp1252 reproduces the
+ * legacy code page on every OS.
+ *
+ * Windows-safe by construction: the driver launches through
+ * lib/script-invocation.ts (Git Bash on win32), files live under os.tmpdir().
+ */
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { runScriptSync } from '../lib/script-invocation';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+let tmp = '';
+
+beforeEach(() => { tmp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-jsonl-enc-'))); });
+afterEach(() => fs.rmSync(tmp, { recursive: true, force: true }));
+
+test('a line the stdout code page cannot encode merges as UTF-8 with LF endings (#3659)', () => {
+  const base = '{"ts":"2026-01-01T00:00:00Z","note":"base"}\n';
+  const ours = base + '{"ts":"2026-01-02T00:00:00Z","note":"ours"}\n';
+  const theirsLine = '{"ts":"2026-01-03T00:00:00Z","note":"привет"}';
+  const p = (n: string) => path.join(tmp, n);
+  fs.writeFileSync(p('base'), base);
+  fs.writeFileSync(p('ours'), ours);
+  fs.writeFileSync(p('theirs'), base + theirsLine + '\n');
+  const posix = (f: string) => f.replace(/\\/g, '/');
+  const r = runScriptSync(path.join(ROOT, 'bin', 'gstack-jsonl-merge'), [posix(p('base')), posix(p('ours')), posix(p('theirs'))], {
+    env: { ...process.env, PYTHONIOENCODING: 'cp1252', PYTHONUTF8: '0' }, encoding: 'utf8', timeout: 60_000,
+  });
+  expect(r.error).toBeUndefined();
+  expect(r.status, r.stderr).toBe(0);
+  const bytes = fs.readFileSync(p('ours'));
+  expect(bytes.includes(0x0d)).toBe(false);
+  expect(bytes.toString('utf8')).toBe(ours + theirsLine + '\n');
+});
diff --git a/test/outside-runner-contract.test.ts b/test/outside-runner-contract.test.ts
index 2c847e3ae..062f70595 100644
--- a/test/outside-runner-contract.test.ts
+++ b/test/outside-runner-contract.test.ts
@@ -240,3 +240,46 @@ describe('api runner (supplied-input review)', () => {
     expect(nokey.stderr).toMatch(/OPENAI_API_KEY is not set.*\(OUTSIDE_RUNNER_UNAVAILABLE\)$/m);
   });
 });
+
+describe('api runner output limits (GBRA-223 claim 6)', () => {
+  let server: ReturnType<typeof Bun.serve>;
+  const bodies: Array<{ url: string; body: any }> = [];
+  beforeAll(() => {
+    server = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        const url = new URL(req.url);
+        const body = await req.json();
+        bodies.push({ url: url.pathname, body });
+        const cut = String(body.model).includes('cut');
+        if (url.pathname === '/v1/messages') return Response.json({ model: body.model, stop_reason: cut ? 'max_tokens' : 'end_turn', content: [{ type: 'text', text: cut ? 'INPUT: ceo abc\n\nA long review cut off mid-sent' : REVIEW }], usage: { input_tokens: 10, output_tokens: body.max_tokens } });
+        return Response.json({ model: body.model, choices: [{ finish_reason: cut ? 'length' : 'stop', message: { content: cut ? 'INPUT: ceo abc\n\nA long review cut off' : REVIEW } }], usage: { prompt_tokens: 10, completion_tokens: 50 } });
+      },
+    });
+  });
+  afterAll(() => server.stop(true));
+  const anthropic = () => ({ ...cleanEnv(emptyBin), ANTHROPIC_API_KEY: 'ak-test', ANTHROPIC_BASE_URL: `http://127.0.0.1:${server.port}` });
+  const openai = () => ({ ...cleanEnv(emptyBin), OPENAI_API_KEY: 'sk-test', OPENAI_BASE_URL: `http://127.0.0.1:${server.port}/v1` });
+  const out = (name: string) => path.join(TMP, 'limits', name);
+
+  test('anthropic asks for 16384 output tokens by default and --max-tokens sets it; openai sends max_completion_tokens only when set', async () => {
+    expect((await runAsync(['run', '--runner', 'api', '--prompt', promptFile, '--out', out('a1.md'), '--model', 'claude-opus-5-5'], anthropic())).status).toBe(0);
+    expect((await runAsync(['run', '--runner', 'api', '--prompt', promptFile, '--out', out('a2.md'), '--model', 'claude-opus-5-5', '--max-tokens', '4000'], anthropic())).status).toBe(0);
+    expect(bodies.filter(b => b.url === '/v1/messages').map(b => b.body.max_tokens)).toEqual([16384, 4000]);
+    expect((await runAsync(['run', '--runner', 'api', '--prompt', promptFile, '--out', out('o1.md'), '--model', 'gpt-6-astra'], openai())).status).toBe(0);
+    expect((await runAsync(['run', '--runner', 'api', '--prompt', promptFile, '--out', out('o2.md'), '--model', 'gpt-6-astra', '--max-tokens', '4000'], openai())).status).toBe(0);
+    expect(bodies.filter(b => b.url === '/v1/chat/completions').map(b => b.body.max_completion_tokens ?? null)).toEqual([null, 4000]);
+  });
+
+  test('a response stopped at the output limit is truncated (exit 1), never a completed or missing-markers review', async () => {
+    for (const [model, env, tokens] of [['claude-cut', anthropic(), '16384'], ['gpt-cut', openai(), '50']] as const) {
+      const file = out(`${model}.md`);
+      const r = await runAsync(['run', '--runner', 'api', '--prompt', promptFile, '--out', file, '--model', model], env);
+      expect(r.status).toBe(1);
+      expect(r.stderr).toMatch(/api unavailable \(truncated\): .*output limit/);
+      const meta = JSON.parse(fs.readFileSync(`${file}.meta.json`, 'utf8'));
+      expect(meta).toMatchObject({ status: 'unavailable', reason: 'truncated' });
+      expect(meta.detail).toContain(tokens);
+    }
+  });
+});
diff --git a/test/pricing-eval-plan.test.ts b/test/pricing-eval-plan.test.ts
index 8784d88a0..5f78c45d0 100644
--- a/test/pricing-eval-plan.test.ts
+++ b/test/pricing-eval-plan.test.ts
@@ -159,6 +159,108 @@ describe('priced pilot', () => {
     expect(r.settled_unknown).toBe(1);
     expect(r.projection.verdict).toBe('unknown');
   });
+
+  test('#3653: each arm is projected on its own, so arms at different prices that fit the cap are not told they exceed it', () => {
+    const d = tmp();
+    const out = path.join(d, 'mixed');
+    const s = startPilot({ out, cap: 2, n: 3, arms: ['gpt-6-astra', 'gpt-5.4-mini'], dryRun: passingDryRun(d) });
+    expect(s.error).toBeUndefined();
+    const usd: Record<string, number[]> = { 'gpt-6-astra': [0.001, 0.001, 0.001], 'gpt-5.4-mini': [0.10, 0.11, 0.12] };
+    for (const a of s.record.attempts) settlePilot(out, a.attempt, usd[a.model]![a.row - 1]!);
+    const r = pilotReport(out, { total: 10, workers: 1 });
+    expect(r.projection.projected_usd).toBeCloseTo(1.11, 6);
+    expect(r.projection.band_usd![0]).toBeCloseTo(1.11 - 4.303 * 0.01 / Math.sqrt(3) * 10, 4);
+    expect(r.projection.band_usd![1]).toBeCloseTo(1.11 + 4.303 * 0.01 / Math.sqrt(3) * 10, 4);
+    expect(r.projection.verdict).toBe('within');
+    expect(r.projection.arms.map(a => [a.arm, a.n])).toEqual([['gpt-6-astra', 3], ['gpt-5.4-mini', 3]]);
+    expect(renderPilotReport(r)).toContain('PILOT_ARM: arm=gpt-5.4-mini n=3 per_item=$0.1100');
+  });
+
+  test('#3653: a priced arm mean is never multiplied across an arm settled unknown', () => {
+    const d = tmp();
+    const out = path.join(d, 'partial');
+    const s = startPilot({ out, cap: 10, n: 3, arms: ['gpt-6-astra', 'gpt-5.4-mini'], dryRun: passingDryRun(d) });
+    for (const a of s.record.attempts) settlePilot(out, a.attempt, a.model === 'gpt-6-astra' ? 0.0003 : 'unknown');
+    const r = pilotReport(out, { total: 400 });
+    expect(r.projection.projected_usd).toBeCloseTo(0.12, 6);
+    expect(r.projection.verdict).toBe('unknown');
+    expect(r.settled_unknown).toBe(3);
+    const text = renderPilotReport(r);
+    expect(text).toContain('known_arms=1/2');
+    expect(text).toContain('--seat-metered');
+  });
+
+  test('#3653: a declared seat-metered arm holds none of the cap, stays out of the verdict and gets its own line', () => {
+    const d = tmp();
+    const dry = passingDryRun(d);
+    const est = startPilot({ out: path.join(d, 'probe'), cap: 100, n: 1, arms: ['gpt-6-astra', 'gpt-5.4-mini'], dryRun: dry }).record.attempts;
+    const astra = est.find(a => a.model === 'gpt-6-astra')!.estimate_usd, mini = est.find(a => a.model === 'gpt-5.4-mini')!.estimate_usd;
+    const cap = Number((3 * mini + 2 * astra).toFixed(4));
+    expect(startPilot({ out: path.join(d, 'undeclared'), cap, n: 3, arms: ['gpt-5.4-mini', 'gpt-6-astra'], dryRun: dry }).error?.code).toBe('EVAL_BUDGET_EXHAUSTED');
+    const out = path.join(d, 'seat');
+    const s = startPilot({ out, cap, n: 3, arms: ['gpt-5.4-mini', 'gpt-6-astra'], seatMetered: ['gpt-6-astra'], dryRun: dry });
+    expect(s.error).toBeUndefined();
+    expect(s.record.seat_metered).toEqual(['gpt-6-astra']);
+    expect(s.record.attempts.filter(a => a.model === 'gpt-6-astra').map(a => a.estimate_usd)).toEqual([0, 0, 0]);
+    for (const a of s.record.attempts) settlePilot(out, a.attempt, a.model === 'gpt-6-astra' ? 'unknown' : 0.0003);
+    const r = pilotReport(out, { total: 400, workers: 3 });
+    expect(r.settled_unknown).toBe(0);
+    expect(r.spend.summary.unknown_usd).toBe(0);
+    expect(r.spend.max_estimate_usd).toBeCloseTo(mini, 6);
+    expect(r.projection.projected_usd).toBeCloseTo(0.12, 6);
+    expect(r.projection.verdict).toBe('within');
+    expect(r.seat_metered).toEqual([{ arm: 'gpt-6-astra', calls: 3, settled: 3 }]);
+    expect(renderPilotReport(r)).toContain('PILOT_SEAT_METERED: arm=gpt-6-astra calls=3 settled=3');
+  });
+
+  test('#3653: a charge on a seat-metered attempt still counts as spent; the declaration names listed arms and is fixed for its --out', () => {
+    const d = tmp();
+    const dry = passingDryRun(d);
+    const out = path.join(d, 'seat');
+    const s = startPilot({ out, cap: 10, n: 1, arms: ['gpt-6-astra'], seatMetered: ['gpt-6-astra'], dryRun: dry });
+    settlePilot(out, s.record.attempts[0]!.attempt, 0.05);
+    const charged = pilotReport(out, { total: 1000 });
+    expect(charged.spend.summary.spent_usd).toBeCloseTo(0.05, 6);
+    expect(charged.seat_metered).toEqual([]);
+    expect(charged.projection.arms.map(a => [a.arm, a.n])).toEqual([['gpt-6-astra', 1]]);
+    expect(charged.projection.verdict).toBe('unknown');
+    expect(() => startPilot({ out: path.join(d, 'stray'), cap: 10, n: 1, arms: ['gpt-6-astra'], seatMetered: ['gpt-5.4-mini'], dryRun: dry })).toThrow('--seat-metered');
+    const switched = path.join(d, 'switched');
+    startPilot({ out: switched, cap: 1, n: 3, arms: ['gpt-6-astra'], seatMetered: ['gpt-6-astra'], dryRun: dry });
+    expect(() => startPilot({ out: switched, cap: 1, n: 3, arms: ['gpt-6-astra'], dryRun: dry })).toThrow('needs a new --out');
+    expect(JSON.parse(fs.readFileSync(path.join(switched, 'pilot.json'), 'utf8')).seat_metered).toEqual(['gpt-6-astra']);
+  });
+
+  test('#3653: an all-seat-metered pilot spends nothing and fits; one priced attempt is not enough for a verdict', () => {
+    const d = tmp();
+    const dry = passingDryRun(d);
+    const seat = path.join(d, 'all-seat');
+    const s = startPilot({ out: seat, cap: 1, n: 3, arms: ['gpt-6-astra'], seatMetered: ['gpt-6-astra'], dryRun: dry });
+    for (const a of s.record.attempts) settlePilot(seat, a.attempt, 'unknown');
+    const all = pilotReport(seat, { total: 50 });
+    expect([all.projection.projected_usd, all.projection.verdict]).toEqual([0, 'within']);
+    expect(renderPilotReport(all)).toContain('known_arms=0/0');
+    const one = path.join(d, 'one');
+    settlePilot(one, startPilot({ out: one, cap: 10, n: 1, arms: ['gpt-6-astra'], dryRun: dry }).record.attempts[0]!.attempt, 0.1);
+    const r = pilotReport(one, { total: 50 });
+    expect([r.projection.band_usd, r.projection.verdict]).toEqual([null, 'unknown']);
+    expect(renderPilotReport(r)).toContain('settle at least 2 attempts per priced arm');
+  });
+
+  test('#3653: a seat-metered arm still needs a price row, as the dry run does', () => {
+    const d = tmp();
+    const s = startPilot({ out: path.join(d, 'seat'), cap: 1, n: 2, arms: ['gpt-5.4-mini', 'seat-only-model'], seatMetered: ['seat-only-model'], dryRun: passingDryRun(d) });
+    expect(s.error?.code).toBe('EVAL_PRICE_MISSING');
+  });
+
+  test('#3653: pilot start --seat-metered reaches the ledger through the CLI', () => {
+    const d = tmp();
+    const out = path.join(d, 'cli');
+    const r = spawnSync(BIN, ['pilot', 'start', '--out', out, '--cap', '10', '--arms', 'gpt-5.4-mini,gpt-6-astra', '--seat-metered', 'gpt-6-astra', '--dry-run', passingDryRun(d)], { cwd: d, encoding: 'utf8', timeout: 30_000 });
+    expect(r.status).toBe(0);
+    expect(r.stdout).toContain('PILOT_ATTEMPT: pilot-gpt-6-astra-1 model=gpt-6-astra estimate=$0.0000');
+    expect(JSON.parse(fs.readFileSync(path.join(out, 'pilot.json'), 'utf8')).seat_metered).toEqual(['gpt-6-astra']);
+  });
 });
 
 // ---------------------------------------------------------------------------
diff --git a/test/review-pass.test.ts b/test/review-pass.test.ts
index 46f3df0f7..9d440c612 100644
--- a/test/review-pass.test.ts
+++ b/test/review-pass.test.ts
@@ -8,7 +8,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { promptHash, sectionTexts, withWorkspace } from '../lib/review-brief';
-import { CHUNK_CHARS, buildManifest, chunkCount, chunkOf, markReader, renderStage, specialistFindings, type Manifest } from '../lib/review-pass';
+import { CHUNK_CHARS, PARENT_ONLY_QA, buildManifest, chunkCount, chunkOf, markReader, renderStage, specialistFindings, type Manifest } from '../lib/review-pass';
 import type { Dispatch } from '../lib/review-depth';
 
 const ROOT = path.resolve(import.meta.dir, '..');
@@ -87,6 +87,13 @@ describe('pass manifest', () => {
     expect(m.readers[0]).toMatchObject({ state: 'created', path: '4' });
   });
 
+  // Value: protects=an unreadable extra prompt stops as a BriefError naming the reader; fails_when=a directory prompt_file throws a raw
+  //   EISDIR from the QA guard's read (GST-450 adversarial #4); seam=none
+  test('a directory extra prompt stops as an unreadable prompt file, not a raw read error', () => {
+    const d = manifest([spec('testing')], { extras: [{ name: 'plan', prompt_file: tmp('rp-qa-') }] });
+    expect(() => renderStage(d, 'specialists', texts, () => '')).toThrow(/cannot read audit\/plan's prompt file/);
+  });
+
   test('a brief over 1 MiB with invalid UTF-8 in its diff travels in bounded chunks that rejoin to the rendered sha', () => {
     const m = manifest([{ role: 'outside-voice', name: 'outside-voice', effort: 'host', exclude: [] }]);
     const diff = Buffer.concat([Buffer.from('+line \u00e9\n'.repeat(90_000)), Buffer.from([0xff, 0xfe, 0x0a]), Buffer.from('+"quoted" \\ back\n'.repeat(20_000))]).toString('utf8');
@@ -504,16 +511,33 @@ describe('Capy pass program (fake host, real bins)', () => {
     const elsewhere = tmp('rp-cwd-');
     const out = path.join(dir, '.state/run/p1');
     fs.mkdirSync(out, { recursive: true });
-    fs.writeFileSync(path.join(out, 'qa.prompt.md'), 'QA brief');
+    fs.writeFileSync(path.join(out, 'plan.prompt.md'), 'Plan completion brief');
     const h = host(elsewhere, env, { lateSummary: true });
     const res = await runPass(h, { base: 'main', out, pass: 'x13p1', cwd: dir, planFlags: ['--depth-floor', 'full'],
-      extras: [{ name: 'qa', prompt_file: path.join(out, 'qa.prompt.md'), model: { model_id: 'anthropic/claude-haiku-5-5', reasoning_mode: 'low' } }] });
+      extras: [{ name: 'plan', prompt_file: path.join(out, 'plan.prompt.md'), model: { model_id: 'anthropic/claude-haiku-5-5', reasoning_mode: 'low' } }] });
     expect(res).not.toContain('STOP:');
     expect(res).toContain('NEXT: judge (Phase 4)');
-    expect(h.creates.find(c => c.title === 'ship x13p1 audit/qa')!.prompt).toBe(withWorkspace('QA brief', fs.realpathSync(dir)));
+    expect(h.creates.find(c => c.title === 'ship x13p1 audit/plan')!.prompt).toBe(withWorkspace('Plan completion brief', fs.realpathSync(dir)));
   }, 180_000);
 
-
+  // Value: protects=Step 9.2.1's probes stay the parent's, as its section says, so QA coverage is never a subagent's refusal; fails_when=the
+  //   pass program dispatches a QA extra (C4-36, C5-36: the QA reader refused both passes, "parent-only", and the parent ran the probes after it);
+  //   why_new=extras took any prompt (GST-450); seam=the pass program; no_claim=the parent's probes themselves (DRIVER Phase 4)
+  test('a QA extra, by name or by its section\'s parent-only brief, stops the pass before any reader is created', async () => {
+    const section = fs.readFileSync(path.join(ROOT, 'ship/sections/review-army.md'), 'utf8');
+    expect(section).toContain(PARENT_ONLY_QA);
+    const brief = section.slice(section.indexOf('### Step 9.2.1'), section.indexOf('### Step 9.3'));
+    for (const [name, text] of [['qa', 'QA brief'], ['exploratory', brief]] as const) {
+      const { dir, env } = repo();
+      const out = path.join(dir, '.state/run/p1');
+      fs.mkdirSync(out, { recursive: true });
+      fs.writeFileSync(path.join(out, name + '.prompt.md'), text);
+      const h = host(dir, env);
+      const res = await runPass(h, { base: 'main', out, pass: 'x14p1', planFlags: ['--depth-floor', 'full'],
+        extras: [{ name, prompt_file: path.join(out, name + '.prompt.md'), model: { model_id: 'anthropic/claude-haiku-5-5', reasoning_mode: 'low' } }] });
+      expect([name, res.includes('STOP:'), res.includes("Step 9.2.1 is the parent's report-only discovery"), h.creates.length]).toEqual([name, true, true, 0]);
+    }
+  }, 240_000);
 
   test('decision 3.5 runs in the program: one fix-check reader whose prompt is the render CLI brief byte for byte, sent and collected', async () => {
     const { dir, env } = repo();
@@ -704,8 +728,8 @@ describe('a scoped pass after a blocker fix (GST-619)', () => {
     const out = path.join(dir, '.state/run/p2');
     const extras = path.join(dir, '.state/extras.json');
     fs.mkdirSync(path.join(dir, '.state'), { recursive: true });
-    fs.writeFileSync(path.join(dir, '.state/qa.md'), 'QA the fix.\n');
-    fs.writeFileSync(extras, JSON.stringify([{ name: 'qa', prompt_file: path.join(dir, '.state/qa.md') }]));
+    fs.writeFileSync(path.join(dir, '.state/plan.md'), 'Check the plan items against the fix.\n');
+    fs.writeFileSync(extras, JSON.stringify([{ name: 'plan', prompt_file: path.join(dir, '.state/plan.md') }]));
     const args = ['pass', '--base', 'main', '--out', out, '--pass', 'p2', '--extras', extras, '--', '--pass', '1', '--last', 'full', '--pass1-depth', 'standard', '--fixed-blocking', ...flags, '--range-base', rangeBase.slice(0, 7)];
     const p = bin(dir, env, args);
     expect(p.status, p.stdout + p.stderr).toBe(0);
@@ -727,7 +751,7 @@ describe('a scoped pass after a blocker fix (GST-619)', () => {
     const s = scoped([]);
     expect(s.m.next).toBe('scoped');
     expect(s.m.diff_base).toBe(s.mergeBase);
-    expect(s.m.readers.map(r => [r.reader, r.diff_base ?? null])).toEqual([['red-team', s.rangeBase], ['adversarial-native', null], ['outside-voice', null], ['audit/qa', null]]);
+    expect(s.m.readers.map(r => [r.reader, r.diff_base ?? null])).toEqual([['red-team', s.rangeBase], ['adversarial-native', null], ['outside-voice', null], ['audit/plan', null]]);
     settle(s, 'specialists');
     const m = settle(s, 'red-team');
     const redTeam = fs.readFileSync(m.readers.find(r => r.reader === 'red-team')!.file!, 'utf8');
@@ -745,7 +769,7 @@ describe('a scoped pass after a blocker fix (GST-619)', () => {
   test('after Step 11 ran (--adversarial-ran), the whole scoped pass reads the fix range', () => {
     const s = scoped(['--adversarial-ran']);
     expect(s.m.diff_base).toBe(s.rangeBase);
-    expect(s.m.readers.map(r => [r.reader, r.diff_base ?? null])).toEqual([['red-team', s.rangeBase], ['adversarial-native', null], ['audit/qa', null]]);
+    expect(s.m.readers.map(r => [r.reader, r.diff_base ?? null])).toEqual([['red-team', s.rangeBase], ['adversarial-native', null], ['audit/plan', null]]);
   }, 120_000);
 });
 
diff --git a/test/review-scope-windows-launch.test.ts b/test/review-scope-windows-launch.test.ts
new file mode 100644
index 000000000..68c077bd5
--- /dev/null
+++ b/test/review-scope-windows-launch.test.ts
@@ -0,0 +1,60 @@
+/**
+ * #3541: `gstack-review-scope summary` reads the review log through
+ * gstack-review-read, a bash script. Spawned by path it never starts on
+ * Windows (no shebangs), so summary always refused with an empty
+ * "gstack-review-read failed:" and /ship could not write its review-loop file.
+ *
+ * Windows-safe by construction: both bins launch through
+ * lib/script-invocation.ts (Git Bash on win32), state lives under os.tmpdir().
+ */
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { runScriptSync } from '../lib/script-invocation';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+const SLUG = 'review-scope-launch';
+
+let tmp = '', repo = '', state = '', env: NodeJS.ProcessEnv = {};
+
+beforeEach(() => {
+  tmp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-rs-launch-')));
+  repo = path.join(tmp, 'repo');
+  state = path.join(tmp, 'state');
+  fs.mkdirSync(repo);
+  fs.mkdirSync(path.join(state, 'projects', SLUG), { recursive: true });
+  const gitconfig = path.join(tmp, 'gitconfig');
+  fs.writeFileSync(gitconfig, '');
+  env = {
+    ...process.env, HOME: tmp, USERPROFILE: tmp, GSTACK_STATE_ROOT: state, GSTACK_HOME: state, GSTACK_PROJECT_SLUG: SLUG,
+    GIT_CONFIG_GLOBAL: gitconfig, GIT_CONFIG_NOSYSTEM: '1', GIT_DIR: undefined, GIT_WORK_TREE: undefined, GIT_INDEX_FILE: undefined,
+  };
+  const git = (...args: string[]) => {
+    const r = spawnSync('git', args, { cwd: repo, env, encoding: 'utf8', timeout: 30_000 });
+    expect(r.status, r.stderr).toBe(0);
+  };
+  git('init', '-q', '-b', 'feat');
+  fs.writeFileSync(path.join(repo, 'a.txt'), 'a\n');
+  git('add', 'a.txt');
+  git('-c', 'user.email=fixture@example.test', '-c', 'user.name=Fixture', '-c', 'commit.gpgsign=false', 'commit', '-qm', 'fixture');
+});
+
+afterEach(() => fs.rmSync(tmp, { recursive: true, force: true }));
+
+test('summary reads the review log through gstack-review-read (#3541)', () => {
+  const rows = [
+    { skill: 'review', via: 'ship', timestamp: '2026-10-26T10:00:00Z', review_scope: 'frozen', findings: [{ fingerprint: 'a:1:x', blocking: true, action: 'fixed' }] },
+    { skill: 'review', via: 'ship', timestamp: '2026-10-26T10:30:00Z', review_scope: 'frozen', findings: [] },
+  ];
+  fs.writeFileSync(path.join(state, 'projects', SLUG, 'feat-reviews.jsonl'), rows.map(r => JSON.stringify(r)).join('\n') + '\n');
+  const out = path.join(tmp, 'review-loop.json');
+  const r = runScriptSync(path.join(ROOT, 'bin', 'gstack-review-scope'), ['summary', '--since', '2026-10-26T09:00:00Z', '--out', out, '--json'], {
+    cwd: repo, env, encoding: 'utf8', timeout: 120_000,
+  });
+  expect(r.error).toBeUndefined();
+  expect(r.status, r.stderr).toBe(0);
+  const summary = JSON.parse(fs.readFileSync(out, 'utf8'));
+  expect(summary).toMatchObject({ passes: 2, blocking_found: 1, fixed: 1, scope: 'frozen' });
+}, 150_000);
diff --git a/test/script-invocation-tripwire.test.ts b/test/script-invocation-tripwire.test.ts
index 3b14106d8..bc16fb04c 100644
--- a/test/script-invocation-tripwire.test.ts
+++ b/test/script-invocation-tripwire.test.ts
@@ -18,7 +18,7 @@ import * as path from 'node:path';
 
 const ROOT = path.resolve(import.meta.dir, '..');
 
-const SPAWN_BIN_BY_PATH = /\b(?:spawn|spawnSync|execFile|execFileSync)\(\s*(?:path\.)?join\(\s*(?:BIN_DIR|binDir|BIN|bin|binRoot|BIN_ROOT)\b/;
+const SPAWN_BIN_BY_PATH = /\b(?:spawn|spawnSync|execFile|execFileSync)\(\s*(?:path\.)?join\(\s*(?:(?:BIN_DIR|binDir|BIN|bin|binRoot|BIN_ROOT)\b|(?:path\.)?dirname\(|import\.meta\.dir\b)/;
 const SPAWN_BARE_BASH = /\b(?:spawn|spawnSync|execFile|execFileSync|execSync)\(\s*['"]bash['"]|Bun\.spawn(?:Sync)?\(\s*\[\s*['"]bash['"]|\[\s*['"]bash['"]\s*,\s*['"]-l?c['"]/;
 const COMMENT = /^\s*(?:\/\/|\*|\/\*)/;
 /** `const X = path.resolve(…, 'bin', 'gstack-…')`: a bin path held in a constant, then spawned by name (#3190's gstack-config). */
@@ -88,6 +88,8 @@ describe('#3197: shebang bins and bash go through lib/script-invocation.ts', ()
   test('the scanner catches both shapes', () => {
     expect(SPAWN_BIN_BY_PATH.test("spawnSync(path.join(BIN_DIR, 'gstack-wtree'), [], { timeout: 1 })")).toBe(true);
     expect(SPAWN_BIN_BY_PATH.test('spawnSync(join(BIN_DIR, "gstack-slug"), { timeout: 1 })')).toBe(true);
+    expect(SPAWN_BIN_BY_PATH.test("spawnSync(path.join(path.dirname(Bun.fileURLToPath(import.meta.url)), 'gstack-review-read'), [], { timeout: 1 })")).toBe(true);
+    expect(SPAWN_BIN_BY_PATH.test("spawnSync(join(import.meta.dir, 'gstack-slug'), [], { timeout: 1 })")).toBe(true);
     expect(SPAWN_BARE_BASH.test("spawnSync('bash', ['-c', cmd], { timeout: 1 })")).toBe(true);
     expect(SPAWN_BARE_BASH.test('const argv = ["bash", "-c", command];')).toBe(true);
     expect(SPAWN_BARE_BASH.test("spawnSync(process.execPath, [script], { timeout: 1 })")).toBe(false);
diff --git a/test/ship-driver.test.ts b/test/ship-driver.test.ts
index 70cf50cc4..58f9dc471 100644
--- a/test/ship-driver.test.ts
+++ b/test/ship-driver.test.ts
@@ -219,16 +219,37 @@ describe('variant G: the call plan, observe budget, waits and audit readers (GST
     expect(flat(read('ship/sections/budget-handoff.md.tmpl'))).toContain('the wait until the last settles (`done`, `failed` or a final summary; a fresh `idle` has not run)');
   });
 
-  // Value: protects=audits that cannot block (Steps 7, 8, 9.2.1, 14.5) run on a small model at low effort with their sections' own briefs, and skip their reader when --audit decides them; fails_when=an audit reader inherits the lane's model and effort (#36: the coverage audit alone was 2.45M at Opus), or an audit brief is paraphrased;
+  // Value: protects=audits that cannot block (Steps 7, 8, 14.5) run on a small model at low effort with their sections' own briefs, and skip their reader when --audit decides them; fails_when=an audit reader inherits the lane's model and effort (#36: the coverage audit alone was 2.45M at Opus), or an audit brief is paraphrased;
   //   why_new=audit model routing is new; seam=none; no_claim=the audits' recall
   test('audit readers run on a small model at low effort, named for Capy, and Phase 3 dispatches only what READER names', () => {
-    expect(flat(doc)).toContain('Audit readers (Steps 7, 8, 9.2.1, 14.5) cannot block, so each runs on a small model at low effort; their findings go to the PR body');
+    expect(flat(doc)).toContain('Audit readers (Steps 7, 8, 14.5) cannot block, so each runs on a small model at low effort; their findings go to the PR body');
     expect(flat(doc)).toContain('`Coverage:` and Step 8\'s line come from `--audit` when no reader ran');
     const capy = read('capy/skill/gstack/SKILL.md');
     expect(capy).toContain('model: { model_id: "anthropic/claude-sonnet-5-5", reasoning_mode: "low" }');
     expect(capy).toContain('`anthropic/claude-haiku-5-5` also fits');
   });
 
+  // Value: protects=Step 9.2.1's report-only probes run in the parent's own Phase 4 program, as the section says, with its Reads in Phase 3, and
+  //   their result line reaches the record, at no extra call; fails_when=the driver or the Capy skill sends Step 9.2.1 out as a QA reader
+  //   (C4-36, C5-36: it refused both passes, "parent-only", and QA coverage was empty), the probes leave the record, or they take their own call;
+  //   why_new=#3648 made Step 9.2.1 a reader (GST-450); seam=none; no_claim=the probes' recall
+  test('Step 9.2.1 is the parent\'s: Reads in Phase 3, probes in Phase 4\'s one program, Exploratory QA in the record, never an extra', () => {
+    const f = flat(doc);
+    const phase = (n: number) => f.slice(f.indexOf(`## ${n}. `), f.indexOf(`## ${n + 1}. `));
+    expect(phase(3)).not.toMatch(/QA reader/);
+    expect(phase(3)).toContain("9.2.1's Reads only");
+    expect(phase(4)).toContain("Step 8.1, 9.2.1's probes, 8.2 (`Scope Check:`)");
+    const at = ['Step 8.1', "9.2.1's probes", '8.2 (`Scope Check:`)', 'Steps 9.3, 9.4 and the repeat decision'].map(s => phase(4).indexOf(s));
+    expect(at[0]).toBeGreaterThanOrEqual(0);
+    expect(at).toEqual([...at].sort((a, b) => a - b));
+    expect(phase(4)).toContain('one program');
+    expect(f).toContain('the plan checks, `Exploratory QA:`, `Scope Check:`), **Decisions**');
+    const capy = flat(read('capy/skill/gstack/SKILL.md'));
+    expect(capy).toContain('Steps 7, 8 and 14.5 (`step: "14.5"`) use `extras`');
+    expect(capy).not.toMatch(/9\.2\.1[^.]*`extras`/);
+    expect(flat(read('ship/sections/review-army.md'))).toContain('### Step 9.2.1: Exploratory QA (before Fix-First) Only the parent runs report-only discovery.');
+  });
+
   // Value: protects=a driven /ship dispatches every blocking reader on its rendered brief file unchanged, checks it with `sent`, merges findings only through `collect`, gates judgment with `judge` and verifies the run before the bind; fails_when=the driver lets the model write or trim a brief again or merge findings in prose (round 4b: arm D lost 8 blockers with 75 of 112 briefs paraphrased);
   //   why_new=the driver named no renderer or hash check; seam=none; no_claim=the parent's adherence, which verify checks after the fact
   test('briefs go out as rendered and findings come back unchanged: render, sent, collect, judge, verify', () => {
diff --git a/test/ship-preflight.test.ts b/test/ship-preflight.test.ts
index 919f40612..a376a4116 100644
--- a/test/ship-preflight.test.ts
+++ b/test/ship-preflight.test.ts
@@ -6,6 +6,7 @@
 import { afterEach, describe, expect, setDefaultTimeout, test } from 'bun:test';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { laneConcurrency } from '../lib/ship-bin-common';
 import { lineOf, PREFLIGHT, shipFixture, type ShipFx } from './helpers/ship-bin-fixture';
 
 setDefaultTimeout(60_000);
@@ -107,6 +108,47 @@ describe('gstack-ship-preflight', () => {
     expect(lineOf(zero.stdout, 'LANE')).toMatch(/^LANE: tests ZERO-RUN exit=0 tests_ran=0/);
   });
 
+  // Value: protects=Step 5 can run its lanes one at a time, and each lane keeps its own tests_ran (GST-851: GSTA-2 saw six lanes start within
+  //   60 ms on a 4-core machine on gstack-evals#115); fails_when=--lanes serial lanes overlap, a lane loses its count, or a bad --lanes value runs;
+  //   why_new=runLanes started every lane at once with no serial mode; seam=runLanes; no_claim=how long a lane takes
+  test('--lanes serial runs one lane at a time and keeps each lane\'s count; a bad --lanes value is usage', () => {
+    const f = fx();
+    const log = path.join(f.root, 'lane-order.log');
+    const lane = (n: string) => `${n}=echo start ${n} >> '${log}'; sleep 1; echo end ${n} >> '${log}'; printf " 2 pass\\n 0 fail\\nRan 2 tests across 1 file. [5.00ms]\\n"`;
+    const r = f.run(PREFLIGHT, ['--tests-only', '--base', 'main', '--lanes', 'serial', '--lane', lane('a'), '--lane', lane('b')]);
+    expect(r.status).toBe(0);
+    const order = fs.readFileSync(log, 'utf8').trim().split('\n');
+    expect(order.length).toBe(4);
+    expect(order.map(l => l.split(' ')[0])).toEqual(['start', 'end', 'start', 'end']);
+    expect(order[1]!.split(' ')[1]).toBe(order[0]!.split(' ')[1]);
+    expect(r.stdout.split('\n').filter(l => l.startsWith('LANE: ')).map(l => l.replace(/ log=\S+$/, ''))).toEqual(['LANE: a pass exit=0 tests_ran=2', 'LANE: b pass exit=0 tests_ran=2']);
+    expect(lineOf(r.stdout, 'LANES')).toBe('LANES: serial (--lanes)');
+    expect(f.run(PREFLIGHT, ['--tests-only', '--base', 'main', '--lanes', 'fast', '--lane', LANE]).status).toBe(2);
+    expect(f.run(PREFLIGHT, ['--tests-only', '--base', 'main', '--lane', LANE, '--lanes']).status).toBe(2);
+  });
+
+  // Value: protects=parallel lanes report in the order given even when a later lane finishes first, and an unflagged run names the core count
+  //   behind its default (GST-851); fails_when=results come back in finish order or the LANES line drops its reason; why_new=runLanes became a
+  //   worker pool; seam=runLanes, LANES line; no_claim=which default any given machine picks
+  test('--lanes parallel keeps lane order when a later lane finishes first; unflagged LANES names the core count', () => {
+    const f = fx();
+    const lane = (n: string, wait: number) => `${n}=sleep ${wait}; printf " 1 pass\\n 0 fail\\nRan 1 tests across 1 file. [5.00ms]\\n"`;
+    const r = f.run(PREFLIGHT, ['--tests-only', '--base', 'main', '--lanes', 'parallel', '--lane', lane('slow', 1), '--lane', lane('fast', 0)]);
+    expect(r.status).toBe(0);
+    expect(lineOf(r.stdout, 'LANES')).toBe('LANES: parallel (--lanes)');
+    expect(r.stdout.split('\n').filter(l => l.startsWith('LANE: ')).map(l => l.split(' ')[1])).toEqual(['slow', 'fast']);
+    expect(lineOf(f.run(PREFLIGHT, ['--tests-only', '--base', 'main', '--lane', LANE]).stdout, 'LANES')).toMatch(/^LANES: (serial|parallel) \(\d+ cores\)$/);
+  });
+
+  // Value: protects=a small machine runs lanes one at a time without a flag, a large one keeps running them together, and the flag overrides
+  //   either way (GST-851); fails_when=a 4-core default runs lanes at once or the flag is ignored; why_new=no default existed; seam=laneConcurrency;
+  //   no_claim=the core count of any CI runner
+  test('lane concurrency: serial on 4 cores or fewer, parallel above, --lanes overrides', () => {
+    expect([laneConcurrency(undefined, 2), laneConcurrency(undefined, 4), laneConcurrency(undefined, 8)]).toEqual([1, 1, Infinity]);
+    expect([laneConcurrency('serial', 64), laneConcurrency('parallel', 2)]).toEqual([1, Infinity]);
+    expect(laneConcurrency('fast', 8)).toBe('--lanes fast is not serial or parallel');
+  });
+
   // Value: protects=Step 2's candidates and Step 1.4's carry check are reported for the agent to judge, and an open PR's carry verdict is printed; fails_when=a new bin/ artifact goes unmentioned or the carry check is skipped when a PR is open;
   //   why_new=moved from Steps 1.4 and 2; seam=gh, gstack-ship-receipt carry; no_claim=whether a candidate is a distributable
   test('a new artifact path is a Step 2 candidate; an open PR runs the carry dry-run and prints its verdict', () => {
diff --git a/test/ship-queue-land-lock.test.ts b/test/ship-queue-land-lock.test.ts
new file mode 100644
index 000000000..6afefbfce
--- /dev/null
+++ b/test/ship-queue-land-lock.test.ts
@@ -0,0 +1,368 @@
+/**
+ * The shared land lock (lib/ship-queue-land-lock.ts, #3599): `land` and `train land` take the same
+ * refs/notes/gstack-land lock, so a standalone land and a train slot can never both publish onto one main.
+ * Module cases run against a bare origin and two clones (the race, the read states, owner kinds, the
+ * --break-lock rules); command cases drive bin/gstack-ship-queue against the train fixture and its gh
+ * shims (both directions, the train-scoped between phase, refusal and resume, the freeze-owned lock and the
+ * repair train's takeover).
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { EXIT } from '../lib/headless-artifacts';
+import { acquireLandLock, LAND_LOCK_REF, readLock, writeLock, type LandLock, type LockOwner } from '../lib/ship-queue-land-lock';
+import { BASE_POLICY, cleanup, makeFixtureRepo, type FixtureRepo } from './helpers/restamp-fixture';
+import { coordinatorClone } from './helpers/ship-queue-fixture';
+import {
+  GREEN_GATE, TRAIN_POLICY, fragmentPr, nonceOf, queue, repoKey, trainFixture, trainJson, wrapLand, type TrainFixture,
+} from './helpers/ship-queue-train-fixture';
+
+const repos: FixtureRepo[] = [];
+const fixtures: TrainFixture[] = [];
+afterEach(() => {
+  while (repos.length) cleanup(repos.pop()!);
+  while (fixtures.length) cleanup(fixtures.pop()!.repo);
+});
+
+const T0 = Date.parse('2026-10-31T12:00:00Z');
+const at = (min: number) => () => new Date(T0 + min * 60_000);
+
+/** Run fn with the fixture's git identity in process.env (the lock writes commits in-process). */
+function withRepoEnv<T>(repo: FixtureRepo, fn: () => T): T {
+  const saved = Object.fromEntries(Object.keys(repo.env).map(k => [k, process.env[k]]));
+  Object.assign(process.env, repo.env);
+  try { return fn(); } finally {
+    for (const [k, v] of Object.entries(saved)) { if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+  }
+}
+function bareRepo(): FixtureRepo { const r = makeFixtureRepo({ policy: BASE_POLICY, prefix: 'gstack-land-lock-' }); repos.push(r); return r; }
+const standalone = (pr: string): LockOwner => ({ pr });
+const slotOf = (train: string, slot: number, pr: string): LockOwner => ({ train, slot, pr });
+function take(root: string, owner: LockOwner, o: { journal?: string; now?: () => Date; breakLock?: boolean; breakTrainLock?: boolean; liveTrain?: (nonce: string) => boolean; phase?: LandLock['phase'] } = {}) {
+  return acquireLandLock({
+    root, holder: 'test:1', owner, journal: o.journal ?? ('train' in owner && owner.train ? `train/${owner.train}/slot-${owner.slot}` : `land/${owner.pr}`),
+    phase: () => o.phase ?? 'stamping', now: o.now ?? at(0), breakLock: o.breakLock, breakTrainLock: o.breakTrainLock, liveTrain: o.liveTrain,
+  });
+}
+const failureOf = (r: ReturnType<typeof take>) => ('failure' in r ? r.failure : null);
+
+describe('the lock module', () => {
+  test('two writers racing the same lock sha leave one winner', () => {
+    const repo = bareRepo();
+    const other = coordinatorClone(repo);
+    withRepoEnv(repo, () => {
+      const lock = (pr: string): LandLock => ({ pr, holder: `h${pr}`, started_at: new Date(T0).toISOString(), phase: 'stamping', journal: `land/${pr}` });
+      expect(readLock(repo.work).state).toBe('absent');
+      const first = writeLock(repo.work, '', lock('1'));
+      const second = writeLock(other, '', lock('2'));
+      expect([first.ok, second.ok]).toEqual([true, false]);
+      const seen = readLock(other);
+      expect(seen.state === 'held' && seen.lock.pr).toBe('1');
+      const a = writeLock(repo.work, seen.sha, lock('3'));
+      const b = writeLock(other, seen.sha, lock('4'));
+      expect([a.ok, b.ok]).toEqual([true, false]);
+      const final = readLock(other);
+      expect(final.state === 'held' && final.lock.pr).toBe('3');
+    });
+  }, 60_000);
+
+  test('absent, released, held and unreadable are distinct; an unreadable lock refuses, and --break-lock replaces it', () => {
+    const repo = bareRepo();
+    withRepoEnv(repo, () => {
+      const root = repo.work;
+      expect(readLock(root)).toMatchObject({ state: 'absent' });
+      const got = take(root, standalone('5'));
+      expect(failureOf(got)).toBeNull();
+      expect(readLock(root)).toMatchObject({ state: 'held', lock: { pr: '5', phase: 'stamping' } });
+      if ('held' in got) expect(got.held.release()).toBe(true);
+      expect(readLock(root)).toMatchObject({ state: 'released' });
+      const junk = repo.git('commit-tree', '4b825dc642cb6eb9a060e54bf8d69288fbee4904', '-m', 'not a lock');
+      repo.git('push', '-q', '-f', 'origin', `${junk}:${LAND_LOCK_REF}`);
+      expect(readLock(root)).toMatchObject({ state: 'unreadable' });
+      const refused = take(root, standalone('6'));
+      expect(failureOf(refused)).toMatchObject({ code: 'QUEUE_LAND_LOCKED' });
+      expect(failureOf(refused)!.message).toContain('cannot be read');
+      const broke = take(root, standalone('6'), { breakLock: true });
+      expect(failureOf(broke)).toBeNull();
+      expect(broke.lines.join('\n')).toContain(`LOCK: broke an unreadable lock at ${junk.slice(0, 12)}`);
+      expect(readLock(root)).toMatchObject({ state: 'held', lock: { pr: '6' } });
+    });
+  }, 60_000);
+
+  test('ownership compares the owner kind and journal: the same PR across commands and across trains refuses; a resume of the same journal and a sequential acquisition succeed', () => {
+    const repo = bareRepo();
+    withRepoEnv(repo, () => {
+      const root = repo.work;
+      const mine = take(root, standalone('7'), { phase: 'waiting' });
+      expect(failureOf(mine)).toBeNull();
+      const asSlot = take(root, slotOf('trainA', 1, '7'));
+      expect(failureOf(asSlot)).toMatchObject({ code: 'QUEUE_LAND_LOCKED' });
+      expect(failureOf(asSlot)!.message).toMatch(/^#7 holds the land lock \(test:1, phase waiting, since /);
+      const resumed = take(root, standalone('7'), { now: at(3) });
+      expect(failureOf(resumed)).toBeNull();
+      expect(readLock(root)).toMatchObject({ state: 'held', lock: { pr: '7', started_at: new Date(T0).toISOString() } });
+      if ('held' in resumed) resumed.held.release();
+
+      const trainA = take(root, slotOf('trainA', 1, '7'), { phase: 'pushing' });
+      expect(failureOf(trainA)).toBeNull();
+      expect(readLock(root)).toMatchObject({ state: 'held', lock: { train: 'trainA', slot: 1, pr: '7' } });
+      const trainB = take(root, slotOf('trainB', 1, '7'));
+      expect(failureOf(trainB)!.message).toMatch(/^train trainA slot 1 \(#7\) holds the land lock/);
+      expect(failureOf(take(root, standalone('7')))!.message).toMatch(/^train trainA slot 1 \(#7\) holds the land lock/);
+      expect(failureOf(take(root, slotOf('trainA', 2, '8')))!.message).toMatch(/^train trainA slot 1 \(#7\) holds the land lock/);
+      const same = take(root, slotOf('trainA', 1, '7'));
+      expect(failureOf(same)).toBeNull();
+      if ('held' in same) same.held.release();
+      expect(failureOf(take(root, standalone('8')))).toBeNull();
+    });
+  }, 60_000);
+
+  test('--break-lock prints the holder, refuses a live train run\'s lock without --break-train-lock, and keeps the staleness, mid-push, between and freeze rules', () => {
+    const repo = bareRepo();
+    withRepoEnv(repo, () => {
+      const root = repo.work;
+      const hold = (owner: LockOwner, phase: LandLock['phase']) => {
+        const r = readLock(root);
+        if (r.state === 'held') writeLock(root, r.sha, { released: true, by: 'test', at: new Date(T0).toISOString() });
+        expect(failureOf(take(root, owner, { phase }))).toBeNull();
+      };
+      hold(slotOf('trainA', 2, '9'), 'waiting');
+      const live = take(root, standalone('3'), { breakLock: true, now: at(1) });
+      expect(failureOf(live)).toMatchObject({ code: 'QUEUE_LAND_LOCKED' });
+      expect(failureOf(live)!.message).toContain('--break-train-lock');
+      expect(live.lines).toContain(`LOCK_HOLDER: train trainA slot 2 (#9) holder=test:1 phase=waiting since=${new Date(T0).toISOString()}`);
+      const ended = take(root, standalone('3'), { breakLock: true, now: at(1), liveTrain: () => false });
+      expect(failureOf(ended)).toBeNull();
+      expect(ended.lines).toContain("LOCK: broke train trainA slot 2 (#9)'s lock (test:1, phase waiting)");
+
+      hold(slotOf('trainA', 2, '9'), 'waiting');
+      const forced = take(root, standalone('3'), { breakLock: true, breakTrainLock: true, now: at(1) });
+      expect(failureOf(forced)).toBeNull();
+
+      hold(slotOf('trainA', 1, '9'), 'between');
+      const young = take(root, standalone('3'), { breakLock: true, breakTrainLock: true, now: at(1) });
+      expect(failureOf(young)!.message).toMatch(/train trainA slot 1 \(#9\) is between slots \(60 s ago\); --break-lock refused/);
+      expect(failureOf(take(root, standalone('3'), { breakLock: true, breakTrainLock: true, now: at(11) }))).toBeNull();
+
+      hold(slotOf('trainA', 1, '9'), 'pushing');
+      expect(failureOf(take(root, standalone('3'), { breakLock: true, breakTrainLock: true, now: at(1) }))!.message).toMatch(/train trainA slot 1 \(#9\)'s holder is mid-push \(60 s ago\); --break-lock refused/);
+
+      hold(slotOf('trainA', 1, '9'), 'freeze');
+      const frozen = take(root, standalone('3'), { breakLock: true, breakTrainLock: true, now: at(60) });
+      expect(failureOf(frozen)).toMatchObject({ code: 'QUEUE_TRAIN_FROZEN' });
+      expect(failureOf(take(root, slotOf('trainB', 1, '4'), { breakLock: true, breakTrainLock: true, now: at(60) }))).toMatchObject({ code: 'QUEUE_TRAIN_FROZEN' });
+
+      hold(standalone('5'), 'waiting');
+      const plain = take(root, standalone('3'), { breakLock: true, now: at(1) });
+      expect(plain.lines).toContain(`LOCK_HOLDER: #5 holder=test:1 phase=waiting since=${new Date(T0).toISOString()}`);
+      expect(plain.lines).toContain("LOCK: broke #5's lock (test:1, phase waiting)");
+    });
+  }, 60_000);
+});
+
+const POLICY = { ...TRAIN_POLICY, release_tool: null, release_outputs: [], changelog_fragments: { dir: 'changelog.d' }, min_gstack_version: '1.91.336.0' };
+function stampedTrain(prs = ['1', '2']) {
+  const fx = trainFixture(POLICY, 'gstack-land-lock-'); fixtures.push(fx); wrapLand(fx);
+  const heads = prs.map(pr => fragmentPr(fx, pr));
+  fx.write(d => { d.rules['evals.yml'] = GREEN_GATE; });
+  const nonce = nonceOf(queue(fx, ['train', 'build', '--prs', prs.map((pr, i) => `${pr}@${heads[i]}`).join(',')]).out);
+  expect(queue(fx, ['train', 'verdict', '--train', nonce]).status).toBe(EXIT.ok);
+  return { fx, heads, nonce };
+}
+const trainLand = (fx: TrainFixture, nonce: string, pr: string, extra: string[] = []) => queue(fx, ['train', 'land', '--train', nonce, '--pr', pr, '--no-wait', ...extra]);
+const land = (fx: TrainFixture, pr: string, extra: string[] = []) => queue(fx, ['land', '--pr', pr, '--no-wait', '--allow-repo-commands', ...extra]);
+const originRev = (fx: TrainFixture, ref: string) => fx.repo.git('--git-dir', fx.repo.origin, 'rev-parse', '--verify', '-q', ref);
+/** The lock as origin holds it: the parsed lock.json, or null when origin has no lock ref. */
+function originLock(fx: TrainFixture): any {
+  const sha = (() => { try { return originRev(fx, LAND_LOCK_REF); } catch { return ''; } })();
+  return sha ? JSON.parse(fx.repo.git('--git-dir', fx.repo.origin, 'show', `${sha}:lock.json`)) : null;
+}
+const freezeFile = (fx: TrainFixture) => path.join(fx.state, 'ship-queue', 'freeze');
+
+describe('land and train land share the lock', () => {
+  test('a train slot holding the lock refuses a standalone land (no takeover, no freeze; --break-lock names the train and wants --break-train-lock); the train keeps it between slots and releases it after the last', () => {
+    const { fx, heads, nonce } = stampedTrain();
+    const pin3 = fragmentPr(fx, '3');
+    const pushed = trainLand(fx, nonce, '1');
+    expect(pushed.out, pushed.err).toMatch(/^PUSHED: [0-9a-f]{40}/m);
+    expect(originLock(fx)).toMatchObject({ train: nonce, slot: 1, pr: '1', phase: 'waiting' });
+    const lockSha = originRev(fx, LAND_LOCK_REF);
+
+    const blocked = land(fx, '3');
+    expect(blocked.status).toBe(EXIT.refused);
+    expect(blocked.err).toMatch(new RegExp(`train ${nonce} slot 1 \\(#1\\) holds the land lock .*phase waiting.*\\(QUEUE_LAND_LOCKED\\)`));
+    const broke = land(fx, '3', ['--break-lock']);
+    expect(broke.status).toBe(EXIT.refused);
+    expect(broke.err).toContain('--break-train-lock');
+    expect(broke.out).toMatch(new RegExp(`^LOCK_HOLDER: train ${nonce} slot 1 \\(#1\\) holder=\\S+ phase=waiting since=`, 'm'));
+    expect(originRev(fx, LAND_LOCK_REF)).toBe(lockSha);
+    expect(originRev(fx, 'refs/heads/pr-3')).toBe(pin3);
+    expect(fs.existsSync(freezeFile(fx))).toBe(false);
+
+    const merged = trainLand(fx, nonce, '1');
+    expect(merged.status, merged.err).toBe(EXIT.ok);
+    expect(originLock(fx)).toMatchObject({ train: nonce, slot: 1, pr: '1', phase: 'between' });
+    expect(land(fx, '3').err).toMatch(new RegExp(`train ${nonce} slot 1 \\(#1\\) holds the land lock .*phase between.*\\(QUEUE_LAND_LOCKED\\)`));
+    expect(originRev(fx, 'refs/heads/pr-3')).toBe(pin3);
+
+    const second = trainLand(fx, nonce, '2');
+    expect(second.out, second.err).toMatch(/^LOCK: train \S+ slot 2 takes over its train's between-slots lock/m);
+    expect(originLock(fx)).toMatchObject({ train: nonce, slot: 2, pr: '2', phase: 'waiting' });
+    expect(trainLand(fx, nonce, '2').status).toBe(EXIT.ok);
+    expect(originLock(fx)).toMatchObject({ released: true });
+    expect(trainJson(fx, nonce).state).toBe('merged');
+    expect(land(fx, '3').out).toMatch(/^PUSHED: [0-9a-f]{40}/m);
+    void heads;
+  }, 300_000);
+
+  // fails_when=settleLock releases the lock on a refusal partway through a train, so one transient gh or fetch failure on slot 2 lets a standalone land publish onto S1 and the rerun freezes the queue (red team, PR #3737 pass 1); why_new=the test above refuses slot 1 only, before anything merged; seam=the fixture's gh pr view; no_claim=the freeze itself
+  test('a refusal partway through a train (slot 1 merged, slot 2 cannot read its PR) keeps the lock between slots, so a standalone land still refuses', () => {
+    const { fx, nonce } = stampedTrain();
+    fragmentPr(fx, '3');
+    trainLand(fx, nonce, '1');
+    expect(trainLand(fx, nonce, '1').status).toBe(EXIT.ok);
+    const row = fx.read().prs['2'];
+    fx.write(d => { delete d.prs['2']; });
+    const refused = trainLand(fx, nonce, '2');
+    expect(refused.err).toContain('(QUEUE_PROOF_MISSING)');
+    expect(refused.out).toMatch(/^LOCK: between /m);
+    expect(originLock(fx)).toMatchObject({ train: nonce, phase: 'between' });
+    expect(land(fx, '3').err).toMatch(/holds the land lock .*phase between.*\(QUEUE_LAND_LOCKED\)/);
+    fx.write(d => { d.prs['2'] = row; });
+    expect(trainLand(fx, nonce, '2').out).toMatch(/^PUSHED: [0-9a-f]{40}/m);
+  }, 300_000);
+
+  /** Another train's lock, written to origin as that train's run would have left it. */
+  function seedLock(fx: TrainFixture, lock: Partial<LandLock> & { train: string; phase: LandLock['phase'] }): void {
+    withRepoEnv(fx.repo, () => {
+      const cur = readLock(fx.repo.work);
+      expect(writeLock(fx.repo.work, cur.sha, { pr: '9', slot: 1, holder: 'old:1', started_at: '2026-10-31T12:00:00.000Z', phase_at: '2026-10-31T12:00:00.000Z', journal: `train/${lock.train}/slot-1`, ...lock } as LandLock).ok).toBe(true);
+    });
+  }
+  /** A freeze record for this repository, cleared at `cleared`, written to the state root as the clearing verify leaves it. */
+  function clearedFreeze(fx: TrainFixture, train: string, cleared: string): void {
+    const file = path.join(freezeFile(fx), `${repoKey(fx)}.json`);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ schema: 1, kind: 'freeze', repo_key: repoKey(fx), train, merged: ['9'], unmerged: [], main: { sha: '0'.repeat(40), tree: '0'.repeat(40) }, reason: 'test', backstop: null, repair: null, created_at: '2026-10-31T11:00:00.000Z', cleared_at: cleared, cleared_by: 'test', updated_at: cleared }));
+  }
+
+  // fails_when=trainTakeover reads "no active freeze record here" as "the freeze is cleared", so a train whose notes fetch failed, or whose freezer never pushed the record, takes the freeze lock and lands onto a frozen main (red team, PR #3737 pass 2); why_new=the freeze test above only exercises the admitted repair train's takeover; seam=a lock and a freeze record written straight to origin and the state root; no_claim=how the record went missing
+  test('another train\'s freeze lock is taken over only on a freeze record cleared after the lock: no record, or one cleared before it, refuses', () => {
+    const { fx, nonce } = stampedTrain(['1']);
+    const old = 'gate.train-old';
+    seedLock(fx, { train: old, phase: 'freeze' });
+    const noRecord = trainLand(fx, nonce, '1');
+    expect(noRecord.status).toBe(EXIT.refused);
+    expect(noRecord.err).toMatch(/train gate\.train-old slot 1 \(#9\) holds the land lock .*phase freeze.*\(QUEUE_LAND_LOCKED\)/);
+    expect(noRecord.out).not.toMatch(/^PUSHED:/m);
+    expect(originLock(fx)).toMatchObject({ train: old, phase: 'freeze' });
+
+    clearedFreeze(fx, old, '2026-10-31T11:30:00.000Z');
+    expect(trainLand(fx, nonce, '1').err).toContain('(QUEUE_LAND_LOCKED)');
+    clearedFreeze(fx, old, '2026-10-31T12:30:00.000Z');
+    const taken = trainLand(fx, nonce, '1');
+    expect(taken.out, taken.err).toContain(`LOCK: train ${nonce} takes over train ${old} slot 1 (#9)'s freeze lock; that freeze was cleared at 2026-10-31T12:30:00.000Z`);
+    expect(taken.out).toMatch(/^PUSHED: [0-9a-f]{40}/m);
+  }, 300_000);
+
+  // fails_when=a freeze lock whose release failed after its freeze cleared refuses every standalone land for good, or a lock ref deleted on origin still reads held from this clone's cached copy (adversarial review, PR #3737 Step 11); why_new=the tests above take the freeze lock over only from train land; seam=a lock and a freeze record written straight to origin and the state root; no_claim=why the release failed
+  test('a standalone land takes over a freeze lock once a fetched freeze record shows it cleared after the lock, and a lock deleted on origin reads as absent', () => {
+    const { fx } = stampedTrain(['1']);
+    fragmentPr(fx, '3');
+    seedLock(fx, { train: 'gate.train-old', phase: 'freeze' });
+    const frozen = land(fx, '3');
+    expect(frozen.status).toBe(EXIT.refused);
+    expect(frozen.err).toMatch(/train gate\.train-old slot 1 \(#9\) holds the land lock .*phase freeze.*\(QUEUE_LAND_LOCKED\)/);
+    clearedFreeze(fx, 'gate.train-old', '2026-10-31T12:30:00.000Z');
+    const taken = land(fx, '3');
+    expect(taken.out, taken.err).toContain("LOCK: taking over train gate.train-old slot 1 (#9)'s freeze lock; that freeze was cleared at 2026-10-31T12:30:00.000Z");
+    expect(taken.out).toMatch(/^PUSHED: [0-9a-f]{40}/m);
+
+    const { fx: other } = stampedTrain(['1']);
+    fragmentPr(other, '3');
+    seedLock(other, { train: 'gate.train-old', phase: 'waiting' });
+    expect(land(other, '3').err).toContain('(QUEUE_LAND_LOCKED)');
+    other.repo.git('--git-dir', other.repo.origin, 'update-ref', '-d', LAND_LOCK_REF);
+    expect(land(other, '3').out).toMatch(/^PUSHED: [0-9a-f]{40}/m);
+  }, 300_000);
+
+  // fails_when=trainTakeover treats a live train as terminal (two landers publish onto one main) or never takes over a finished train's lock (a stale lock blocks every later train); why_new=no other test seats a foreign train's lock; seam=a second train record written into the state root; no_claim=how that train ended
+  test('another train\'s lock is taken over once that train\'s record is terminal, and refused while it is still merging', () => {
+    const { fx, nonce } = stampedTrain(['1']);
+    const other = `${nonce}-other`;
+    const put = (state: string) => {
+      const dir = path.join(fx.state, 'ship-queue', 'trains', other);
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(path.join(dir, 'train.json'), JSON.stringify({ ...trainJson(fx, nonce), nonce: other, state }));
+    };
+    put('merging');
+    seedLock(fx, { train: other, phase: 'waiting' });
+    expect(trainLand(fx, nonce, '1').err).toMatch(/holds the land lock .*phase waiting.*\(QUEUE_LAND_LOCKED\)/);
+    put('merged');
+    const taken = trainLand(fx, nonce, '1');
+    expect(taken.out, taken.err).toContain(`takes over train ${other} slot 1 (#9)'s lock; that train is merged`);
+    expect(taken.out).toMatch(/^PUSHED: [0-9a-f]{40}/m);
+  }, 300_000);
+
+  test('a standalone land holding the lock refuses train land; a refusal before any push releases the train\'s lock', () => {
+    const { fx, heads, nonce } = stampedTrain();
+    fragmentPr(fx, '3');
+    expect(land(fx, '3').out).toMatch(/^PUSHED: /m);
+    const blocked = trainLand(fx, nonce, '1');
+    expect(blocked.status).toBe(EXIT.refused);
+    expect(blocked.err).toMatch(/#3 holds the land lock .*phase waiting.*\(QUEUE_LAND_LOCKED\)/);
+    expect(blocked.out).not.toMatch(/^PUSHED:/m);
+    expect(originRev(fx, 'refs/heads/pr-1')).toBe(heads[0]);
+
+    expect(land(fx, '3').out).toContain('LOCK: released');
+    const stale = trainLand(fx, nonce, '1');
+    expect(stale.err).toMatch(/nothing of train \S+ merged, so the queue is not frozen.*\(QUEUE_TRAIN_TREE_MISMATCH\)/);
+    expect(originLock(fx)).toMatchObject({ released: true });
+  }, 300_000);
+
+  test('after a push the train keeps its lock through a failed wait and a resume takes it back', () => {
+    const { fx, nonce } = stampedTrain(['1']);
+    const stamp = /^PUSHED: ([0-9a-f]{40})/m.exec(trainLand(fx, nonce, '1').out)![1]!;
+    fx.write(d => { d.ci[stamp] = [{ name: 'free-tests', status: 'completed', conclusion: 'failure' }] as any; });
+    const red = trainLand(fx, nonce, '1');
+    expect(red.status).not.toBe(EXIT.ok);
+    expect(originLock(fx)).toMatchObject({ train: nonce, slot: 1, pr: '1', phase: 'waiting' });
+    fx.write(d => { delete d.ci[stamp]; });
+    const resumed = trainLand(fx, nonce, '1');
+    expect(resumed.status, resumed.err).toBe(EXIT.ok);
+    expect(originLock(fx)).toMatchObject({ released: true });
+  }, 300_000);
+
+  test('a stop that freezes leaves the lock in a freeze phase that --break-lock never breaks; only the admitted repair train takes it over, and it is released once the freeze clears', () => {
+    const { fx, nonce } = stampedTrain();
+    trainLand(fx, nonce, '1');
+    expect(trainLand(fx, nonce, '1').status).toBe(EXIT.ok);
+    trainLand(fx, nonce, '2');
+    fx.write(d => { (d as any).outsideOnMerge = true; });
+    const drift = trainLand(fx, nonce, '2');
+    expect(drift.err).toContain('(QUEUE_TRAIN_TREE_MISMATCH)');
+    expect(drift.out).toMatch(/^QUEUE_TRAIN_FROZEN: /m);
+    expect(originLock(fx)).toMatchObject({ train: nonce, phase: 'freeze' });
+    const lockSha = originRev(fx, LAND_LOCK_REF);
+
+    fragmentPr(fx, '3');
+    const refused = land(fx, '3', ['--break-lock', '--break-train-lock']);
+    expect(refused.status).toBe(EXIT.refused);
+    expect(refused.err).toContain('(QUEUE_TRAIN_FROZEN)');
+    expect(originRev(fx, LAND_LOCK_REF)).toBe(lockSha);
+
+    const h4 = fragmentPr(fx, '4');
+    const repair = queue(fx, ['train', 'build', '--repair', '--prs', `4@${h4}`]);
+    expect(repair.status, repair.err).toBe(EXIT.ok);
+    const rn = nonceOf(repair.out);
+    expect(queue(fx, ['train', 'verdict', '--train', rn]).status).toBe(EXIT.ok);
+    const taken = trainLand(fx, rn, '4');
+    expect(taken.out, taken.err).toMatch(new RegExp(`^LOCK: repair train ${rn} takes over the freeze lock of train ${nonce}`, 'm'));
+    expect(originLock(fx)).toMatchObject({ train: rn, slot: 1, pr: '4', phase: 'freeze' });
+    expect(land(fx, '3', ['--break-lock', '--break-train-lock']).err).toContain('(QUEUE_TRAIN_FROZEN)');
+    const cleared = trainLand(fx, rn, '4');
+    expect(cleared.status, cleared.err).toBe(EXIT.ok);
+    expect(cleared.out).toMatch(/^FREEZE: cleared /m);
+    expect(originLock(fx)).toMatchObject({ released: true });
+  }, 600_000);
+});
diff --git a/test/ship-queue-train-freeze.test.ts b/test/ship-queue-train-freeze.test.ts
index 13c09b2d4..a5602c003 100644
--- a/test/ship-queue-train-freeze.test.ts
+++ b/test/ship-queue-train-freeze.test.ts
@@ -5,7 +5,7 @@ import * as path from 'node:path';
 import { EXIT } from '../lib/headless-artifacts';
 import { cleanup } from './helpers/restamp-fixture';
 import { coordinatorClone } from './helpers/ship-queue-fixture';
-import { publishMain, twoPrTrain } from './helpers/ship-queue-train-cases';
+import { laneStamp, markMerged, publishMain, twoPrTrain } from './helpers/ship-queue-train-cases';
 import {
   TRAIN_POLICY, dispatches, line, nonceOf, openPr, queue, readyReceipt, repoKey, trainFixture, trainJson,
   type TrainFixture,
@@ -28,8 +28,10 @@ describe('verify, freeze, repair and clear', () => {
     const v = (pr: string) => queue(fx, ['verify', '--pr', pr, '--train', nonce], {}, coord);
     const released = (prefix: string, version: string) => fx.repo.git('show', `${prefix}:CHANGELOG.md`).replace('## [Unreleased]', `## [${version}] - 2026-10-18`) + '\n';
     const main1 = publishMain(fx, t.prefixes[1].commit, '1.2.4.0', { file: 'CHANGELOG.md', text: released(t.prefixes[1].commit, '1.2.4.0') });
+    markMerged(fx, '1');
     expect(v('1').status).toBe(EXIT.ok);
-    expect(line(v('2').out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${h2}`);
+    const s2 = laneStamp(fx, '2', h2, { mergeMain: true });
+    expect(line(v('2').out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${s2}`);
     // Main's CHANGELOG plus #2's stamped entry, with one line the pin never wrote.
     const smuggled = fx.repo.git('show', `${main1}:CHANGELOG.md`).replace('# Changelog\n', '# Changelog\n\n## [1.2.5.0] - 2026-10-18\n\n- #2 change\n- added after the gate\n') + '\n';
     const broken = publishMain(fx, t.prefixes[2].commit, '1.2.5.0', { file: 'CHANGELOG.md', text: smuggled });
@@ -111,6 +113,7 @@ describe('verify, freeze, repair and clear', () => {
     const rn = nonceOf(queue(fx, ['train', 'build', '--repair', '--prs', `3@${h3}`]).out);
     expect(queue(fx, ['train', 'verdict', '--train', rn]).status).toBe(EXIT.ok);
     publishMain(fx, trainJson(fx, rn).prefixes[1].commit, '1.2.6.0');
+    markMerged(fx, '3');
     const cleared = queue(fx, ['verify', '--pr', '3', '--train', rn], {}, coord);
     expect(cleared.out).toMatch(/^FREEZE: cleared /m);
     expect(next(cleared.out)).toBe(`NEXT: gh pr view 2 --json state,headRefOid (unreadable at the freeze: #2@${h2.slice(0, 12)}); seat each that is OPEN in a train`);
@@ -125,6 +128,7 @@ describe('verify, freeze, repair and clear', () => {
     const coord = coordinatorClone(fx.repo);
     const v = (pr: string) => queue(fx, ['verify', '--pr', pr, '--train', nonce], {}, coord);
     publishMain(fx, t.prefixes[1].commit, '1.2.4.0');
+    markMerged(fx, '1');
     expect(v('1').status).toBe(EXIT.ok);
     const later = publishMain(fx, t.prefixes[2].commit, '1.2.5.0', { file: 'stray.txt', text: 'a later train\n' });
     fx.write(d => { (d.prs['2'] as any).state = 'MERGED'; });
@@ -157,6 +161,7 @@ describe('verify, freeze, repair and clear', () => {
     const coord = coordinatorClone(fx.repo);
     const v = (pr: string) => queue(fx, ['verify', '--pr', pr, '--train', nonce], {}, coord);
     publishMain(fx, t.prefixes[1].commit, '1.2.4.0');
+    markMerged(fx, '1');
     expect(v('1').status).toBe(EXIT.ok);
     const later = publishMain(fx, t.prefixes[2].commit, '1.2.5.0', { file: 'stray.txt', text: 'a later train\n' });
     const tree = fx.repo.git('rev-parse', `${later}^{tree}`);
@@ -181,6 +186,7 @@ describe('verify, freeze, repair and clear', () => {
     const v = (pr: string) => queue(fx, ['verify', '--pr', pr, '--train', nonce], {}, coord);
     const released = fx.repo.git('show', `${t.prefixes[1].commit}:CHANGELOG.md`).replace('## [Unreleased]', '## [1.2.4.0] - 2026-10-18') + '\n';
     const main1 = publishMain(fx, t.prefixes[1].commit, '1.2.4.0', { file: 'CHANGELOG.md', text: released });
+    markMerged(fx, '1');
     expect(v('1').status).toBe(EXIT.ok);
     const foreign = publishMain(fx, t.prefixes[1].commit, '1.2.4.1', { file: 'stray.txt', text: 'landed between the two slots\n' });
     const text = fx.repo.git('show', `${main1}:CHANGELOG.md`).replace('# Changelog\n', '# Changelog\n\n## [1.2.5.0] - 2026-10-18\n\n- #2 change\n- added after the gate\n') + '\n';
diff --git a/test/ship-queue-train-land.test.ts b/test/ship-queue-train-land.test.ts
index 64a046ee7..9ac7ac65a 100644
--- a/test/ship-queue-train-land.test.ts
+++ b/test/ship-queue-train-land.test.ts
@@ -10,47 +10,13 @@ import * as path from 'node:path';
 import { EXIT } from '../lib/headless-artifacts';
 import { cleanup } from './helpers/restamp-fixture';
 import {
-  GREEN_GATE, RED_GATE, TRAIN_POLICY, line, nonceOf, openPr, queue, readyReceipt, shippedBody, trainFixture, trainJson, type TrainFixture,
+  GREEN_GATE, RED_GATE, TRAIN_POLICY, fragmentPr, line, nonceOf, openPr, queue, readyReceipt, shippedBody, trainFixture, trainJson, wrapLand as wrap, type TrainFixture,
 } from './helpers/ship-queue-train-fixture';
 
 const POLICY = { ...TRAIN_POLICY, release_tool: null, release_outputs: [], changelog_fragments: { dir: 'changelog.d' }, min_gstack_version: '1.91.336.0' };
 const fixtures: TrainFixture[] = [];
 afterEach(() => { while (fixtures.length) cleanup(fixtures.pop()!.repo); });
 
-/** pr view reads the head from origin's branch; pr edit and pr merge act on origin; any commit without recorded CI reads green. */
-function wrap(fx: TrainFixture): void {
-  const dir = path.join(fx.repo.root, 'gh-land-wrap');
-  fs.mkdirSync(dir, { recursive: true });
-  const shim = path.join(fx.repo.root, 'gh-train-shim', 'shim.js');
-  fs.writeFileSync(path.join(dir, 'gh'), [
-    '#!/usr/bin/env node',
-    "const fs=require('fs');const cp=require('child_process');const D=process.env.LAND_WRAP_DATA;const a=process.argv.slice(2);",
-    "const d=JSON.parse(fs.readFileSync(D,'utf8'));const save=()=>fs.writeFileSync(D,JSON.stringify(d));",
-    "const g=(...x)=>cp.execFileSync('git',['--git-dir',d.origin,...x],{encoding:'utf8',timeout:30000}).trim();",
-    "const rev=r=>{try{return g('rev-parse','--verify','--quiet',r)}catch{return ''}};",
-    "if(a[0]==='pr'&&a[1]==='view'&&d.prs[a[2]]){const p=d.prs[a[2]];const h=rev('refs/heads/'+p.headRefName);if(h)p.headRefOid=h;save();console.log(JSON.stringify(p));process.exit(0)}",
-    "if(a[0]==='pr'&&a[1]==='edit'){(d.labels=d.labels||{})[a[2]]=a[a.indexOf('--add-label')+1];save();process.exit(0)}",
-    "if(a[0]==='pr'&&a[1]==='merge'){const p=d.prs[a[2]];const want=a[a.indexOf('--match-head-commit')+1];if(rev('refs/heads/'+p.headRefName)!==want){console.error('Head branch was modified');process.exit(1)}",
-    "  const before=rev('main');let tree=rev(want+'^{tree}');",
-    "  if(d.outsideOnMerge){const blob=cp.execFileSync('git',['--git-dir',d.origin,'hash-object','-w','--stdin'],{input:'outside\\n',encoding:'utf8',timeout:30000}).trim();",
-    "    const ls=g('ls-tree',before+'^{tree}')+'\\n100644 blob '+blob+'\\toutside.txt';const ot=cp.execFileSync('git',['--git-dir',d.origin,'mktree'],{input:ls+'\\n',encoding:'utf8',timeout:30000}).trim();",
-    "    g('update-ref','refs/heads/main',g('commit-tree',ot,'-p',before,'-m','outside'));tree=g('merge-tree','--write-tree','--merge-base='+before,rev('main'),want).split('\\n')[0];d.outsideOnMerge=false}",
-    "  g('update-ref','refs/heads/main',g('commit-tree',tree,'-p',rev('main'),'-m','squash #'+a[2]));p.state='MERGED';save();process.exit(0)}",
-    "const paged=/commits\\/([0-9a-f]+)\\/(check-runs|status)\\?.*page=(\\d+)/.exec(a[1]||'');",
-    "if(a[0]==='api'&&paged&&!(d.ci||{})[paged[1]]&&!((d.statuses||{})[paged[1]])){const list=paged[2]==='check-runs'?[{name:'free-tests',status:'completed',conclusion:'success',id:1,completed_at:'2026-10-26T00:00:00Z'}]:[];const key=paged[2]==='check-runs'?'check_runs':'statuses';console.log(JSON.stringify(paged[3]==='1'?{total_count:list.length,state:'success',[key]:list}:{total_count:list.length,[key]:[]}));process.exit(0)}",
-    `const r=cp.spawnSync('node',[${JSON.stringify(shim)},D,...a],{stdio:'inherit',timeout:120000});process.exit(r.status??1);`,
-    '',
-  ].join('\n'), { mode: 0o755 });
-  fx.env.PATH = `${dir}:${fx.env.PATH}`;
-  (fx.env as Record<string, string>).LAND_WRAP_DATA = fx.dataFile;
-}
-
-function fragmentPr(fx: TrainFixture, pr: string, fragment = `- #${pr} change\n`): string {
-  const head = openPr(fx, pr, { file: `changelog.d/pr-${pr}.md`, text: fragment, changelog: false });
-  fx.repo.git('push', '-q', 'origin', `${head}:refs/heads/pr-${pr}`);
-  readyReceipt(fx, pr, head);
-  return head;
-}
 function stampedTrain(gate = GREEN_GATE, policy: Record<string, unknown> = POLICY) {
   const fx = trainFixture(policy, 'gstack-train-land-'); fixtures.push(fx); wrap(fx);
   const h1 = fragmentPr(fx, '1');
@@ -190,10 +156,15 @@ describe('stamped trains: build and land', () => {
   }, 300_000);
 
   test('a failed stamp push with the branch still at the pin fails retryably instead of reporting a move', () => {
-    const { fx, nonce } = stampedTrain();
+    const { fx, h1, nonce } = stampedTrain();
     expect(queue(fx, ['train', 'verdict', '--train', nonce]).status).toBe(EXIT.ok);
     const hook = path.join(fx.repo.origin, 'hooks', 'pre-receive');
     fs.writeFileSync(hook, '#!/bin/sh\nexit 1\n', { mode: 0o755 });
+    const refused = land(fx, nonce, '1');
+    expect(refused.err).toMatch(/the land lock push to origin failed and the lock there is unchanged; nothing was pushed.*\(QUEUE_NOT_READY\)/);
+    expect(refused.err).not.toContain('another lander');
+    expect(fx.repo.git('--git-dir', fx.repo.origin, 'rev-parse', 'refs/heads/pr-1')).toBe(h1);
+    fs.writeFileSync(hook, '#!/bin/sh\nwhile read old new ref; do [ "$ref" = refs/heads/pr-1 ] && exit 1; done\nexit 0\n', { mode: 0o755 });
     const failed = land(fx, nonce, '1');
     expect(failed.err).toMatch(/the stamp push failed and pr-1 still reads.*\(QUEUE_NOT_READY\)/);
     expect(failed.err).not.toContain('QUEUE_TRAIN_MOVED');
diff --git a/test/ship-queue-train-ops.test.ts b/test/ship-queue-train-ops.test.ts
index 61df3d0dd..c20468fb8 100644
--- a/test/ship-queue-train-ops.test.ts
+++ b/test/ship-queue-train-ops.test.ts
@@ -449,6 +449,33 @@ describe('ready --dispatch-ci', () => {
     expect([fork.status, fork.err]).toEqual([EXIT.refused, expect.stringMatching(/#1's head is on a fork.*not dispatched.*\(QUEUE_TRAIN_UNTRUSTED\)/)]);
     expect(queue(fx, ['ready', '--pr', '1', '--pregate', pregate, '--no-screen', '--dispatch-ci', '../evil.yml']).status).toBe(EXIT.usage);
   }, 120_000);
+
+  // Value: protects=a conflicting PR cut before main gained windows-smoke.yml still gets its free-tests dispatch when the hint names both workflows (GitHub reads the workflow file from the branch, so dispatching the missing one could only fail);
+  // fails_when=the missing workflow is dispatched, a missing workflow refuses the whole command, or a workflow the branch has is skipped; why_new=windows-smoke.yml replaced windows-free-tests.yml in the hint while open branches predate it; seam=git objects in the fixture checkout; no_claim=GitHub's exact error for a workflow missing at the ref
+  test('skips a workflow the base has but the PR head predates, with a note, and dispatches the rest', () => {
+    const { fx, head, pregate } = readyFixture();
+    const { repo } = fx;
+    repo.git('checkout', '-q', 'origin/main');
+    fs.mkdirSync(path.join(repo.work, '.github', 'workflows'), { recursive: true });
+    fs.writeFileSync(path.join(repo.work, '.github', 'workflows', 'windows-smoke.yml'), 'name: Windows Smoke\n');
+    repo.git('add', '-A');
+    repo.git('commit', '-q', '-m', 'add windows-smoke.yml');
+    repo.git('push', '-q', 'origin', 'HEAD:main');
+    repo.git('fetch', '-q', 'origin', 'main');
+    repo.git('checkout', '-q', 'pr-1');
+    fx.write(d => {
+      (d.prs['1'] as any).mergeable = 'CONFLICTING';
+      d.ci[head] = [];
+      d.rules['free-tests.yml'] = { ci: 'free-tests', headSha: head };
+      d.rules['windows-smoke.yml'] = { ci: 'windows-smoke', headSha: head };
+    });
+    const r = queue(fx, ['ready', '--pr', '1', '--pregate', pregate, '--no-screen', '--dispatch-ci', 'free-tests.yml,windows-smoke.yml', '--timeout', '5']);
+    expect(r.out.split('\n').filter(l => l.startsWith('CI_DISPATCH:'))).toEqual([
+      'CI_DISPATCH: free-tests.yml --ref pr-1 run 100 https://example.invalid/runs/100 success',
+      `CI_DISPATCH: windows-smoke.yml not dispatched (.github/workflows/windows-smoke.yml is on main but not in ${head.slice(0, 12)}; the branch predates it, so its pull_request run comes with the stamp commit)`]);
+    expect(dispatches(fx).map(l => l.workflow)).toEqual(['free-tests.yml']);
+    expect(line(r.out, 'ci:')).toBe(`ci: green at ${head.slice(0, 12)} (passed=1 failed=0 pending=0 skipped=0)`);
+  }, 120_000);
 });
 
 describe('train build --dry-run --stack-tests', () => {
diff --git a/test/ship-queue-train-verify.test.ts b/test/ship-queue-train-verify.test.ts
index 5c8551d0b..67ebcf224 100644
--- a/test/ship-queue-train-verify.test.ts
+++ b/test/ship-queue-train-verify.test.ts
@@ -6,7 +6,7 @@ import { mergeChangelogs, parseChangelog } from '../lib/changelog-check';
 import { EXIT } from '../lib/headless-artifacts';
 import { cleanup } from './helpers/restamp-fixture';
 import { coordinatorClone } from './helpers/ship-queue-fixture';
-import { publishMain, twoPrTrain } from './helpers/ship-queue-train-cases';
+import { laneStamp, markMerged, publishMain, twoPrTrain } from './helpers/ship-queue-train-cases';
 import {
   GREEN_GATE, TRAIN_POLICY, dispatches, line, nonceOf, openPr, queue, readyReceipt, repoKey, setPrBody, shippedBody, trainFixture, trainJson,
   type TrainFixture,
@@ -27,21 +27,24 @@ describe('verify, freeze, repair and clear', () => {
     const coord = coordinatorClone(fx.repo);
     const v = (pr: string, train = nonce) => queue(fx, ['verify', '--pr', pr, '--train', train], {}, coord);
 
+    const s1 = laneStamp(fx, '1', h1);
     const pre1 = v('1');
     expect(pre1.status).toBe(EXIT.ok);
     expect(pre1.out).toContain(`VERIFY_TRAIN: #1 may merge as slot 1 of train ${nonce}`);
-    expect(line(pre1.out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${h1}`);
+    expect(line(pre1.out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${s1}`);
     const early = v('2');
     expect(early.status).toBe(EXIT.fail);
     expect(early.err).toMatch(/is neither T1 nor T2 modulo stamps.*nothing of train \S+ merged, so the queue is not frozen.*\(QUEUE_TRAIN_TREE_MISMATCH\)/);
 
-    publishMain(fx, t.prefixes[1].commit, '1.2.4.0');
+    publishMain(fx, t.prefixes[1].commit, '1.2.4.0', { file: 'CHANGELOG.md', text: fx.repo.git('show', `${s1}:CHANGELOG.md`) + '\n' });
+    markMerged(fx, '1');
     const post1 = v('1');
     expect(post1.status).toBe(EXIT.ok);
-    expect(post1.out).toMatch(/^main: [0-9a-f]{40} = T1 \(same modulo stamps \(1 stamp file\(s\)\)\)$/m);
+    expect(post1.out).toMatch(/^main: [0-9a-f]{40} = T1 \(same modulo stamps \(2 stamp file\(s\)\)\)$/m);
     expect(post1.out).toContain(`VERIFY_TRAIN: #1 merged; main's tree is T1 of train ${nonce} (1/2 merged)`);
     expect(next(post1.out)).toBe(`NEXT: gstack-ship-queue verify --pr 2 --train ${nonce}`);
-    expect(line(v('2').out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${h2}`);
+    const s2 = laneStamp(fx, '2', h2, { mergeMain: true });
+    expect(line(v('2').out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${s2}`);
 
     const broken = publishMain(fx, t.prefixes[2].commit, '1.2.5.0', { file: 'stray.txt', text: 'not in the train\n' });
     const mismatch = v('2');
@@ -69,8 +72,16 @@ describe('verify, freeze, repair and clear', () => {
     expect(queue(fx, ['train', 'verdict', '--train', rn]).status).toBe(EXIT.ok);
     expect(v('2').err).toContain('(QUEUE_TRAIN_FROZEN)');
     expect(dispatches(fx, 'evals.yml').filter(d => d.ref === 'main').length).toBe(1);
-    expect(line(v('3', rn).out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${h3}`);
+    // The broken main still carries T2's [Unreleased] section, so #3's lane stamps its own entry by hand.
+    fx.repo.git('checkout', '-q', '-B', 'lane3', h3);
+    fs.writeFileSync(path.join(fx.repo.work, 'VERSION'), '1.2.6.0\n');
+    fs.writeFileSync(path.join(fx.repo.work, 'CHANGELOG.md'), fx.repo.git('show', `${h3}:CHANGELOG.md`).replace('## [Unreleased]', '## [1.2.6.0] - 2026-10-18') + '\n');
+    fx.repo.git('commit', '-qam', 'slot stamp #3');
+    const s3 = fx.repo.git('rev-parse', 'HEAD');
+    fx.repo.git('push', '-q', '-f', 'origin', `${s3}:refs/pull/3/head`);
+    expect(line(v('3', rn).out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${s3}`);
     publishMain(fx, trainJson(fx, rn).prefixes[1].commit, '1.2.6.0');
+    markMerged(fx, '3');
     const cleared = v('3', rn);
     expect(cleared.status).toBe(EXIT.ok);
     expect(cleared.out).toMatch(/^FREEZE: cleared \(repair #3 via train \S+; main [0-9a-f]{12} carries a green record\)$/m);
@@ -85,14 +96,10 @@ describe('verify, freeze, repair and clear', () => {
     const coord = coordinatorClone(fx.repo);
     const v = () => queue(fx, ['verify', '--pr', '1', '--train', nonce], {}, coord);
     const { repo } = fx;
-    repo.git('checkout', '-q', '-B', 'lane1', h1);
-    fs.writeFileSync(path.join(repo.work, 'VERSION'), '1.2.4.0\n');
-    repo.git('commit', '-qam', 'v1.2.4.0 stamp');
-    const stamped = repo.git('rev-parse', 'HEAD');
-    repo.git('push', '-q', '-f', 'origin', `${stamped}:refs/pull/1/head`);
+    const stamped = laneStamp(fx, '1', h1);
     const ok = v();
     expect(ok.status).toBe(EXIT.ok);
-    expect(ok.out).toContain(`head: ${stamped} (same modulo stamps (1 stamp file(s)))`);
+    expect(ok.out).toContain(`head: ${stamped} (same modulo stamps (5 stamp file(s)))`);
     expect(ok.out).toContain(`SHIP_RECEIPT: pr=1 head=${h1.slice(0, 12)} version=- base=main (binds the pinned head)`);
     expect(line(ok.out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${stamped}`);
     setPrBody(fx, '1', shippedBody('1', 'b'.repeat(40)));
@@ -133,6 +140,7 @@ describe('verify, freeze, repair and clear', () => {
     const coord = coordinatorClone(fx.repo);
     const v = (pr: string) => queue(fx, ['verify', '--pr', pr, '--train', nonce], {}, coord);
     const main1 = publishMain(fx, t.prefixes[1].commit, '1.2.4.0');
+    markMerged(fx, '1');
     expect(v('1').status).toBe(EXIT.ok);
 
     const { repo } = fx;
@@ -142,6 +150,7 @@ describe('verify, freeze, repair and clear', () => {
       repo.git('rm', '-rq', '.');
       repo.git('checkout', t.prefixes[2].commit, '--', '.');
       fs.writeFileSync(path.join(repo.work, 'VERSION'), '1.2.5.0\n');
+      fs.writeFileSync(path.join(repo.work, 'CHANGELOG.md'), repo.git('show', `${t.prefixes[2].commit}:CHANGELOG.md`).replace('## [Unreleased]', '## [1.2.5.0] - 2026-10-18') + '\n');
       if (extra) fs.writeFileSync(path.join(repo.work, extra.file), extra.text);
       repo.git('add', '-A');
       const tree = repo.git('write-tree');
@@ -224,8 +233,10 @@ describe('verify, freeze, repair and clear', () => {
     const v = (pr: string) => queue(fx, ['verify', '--pr', pr, '--train', nonce], {}, coord);
 
     // Slot 1: #1 squash-merges and is released as 1.2.4.0 (its [Unreleased] re-headed).
-    expect(line(v('1').out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${h1}`);
+    const s1 = laneStamp(fx, '1', h1);
+    expect(line(v('1').out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${s1}`);
     const main1 = publishMain(fx, t.prefixes[1].commit, '1.2.4.0', { file: 'CHANGELOG.md', text: repo.git('show', `${t.prefixes[1].commit}:CHANGELOG.md`).replace('## [Unreleased]', '## [1.2.4.0] - 2026-10-18') + '\n' });
+    markMerged(fx, '1');
     expect(v('1').out).toContain(`VERIFY_TRAIN: #1 merged; main's tree is T1 of train ${nonce} (1/2 merged)`);
 
     // Slot 2: the lane merges main into its pin; mergeChangelogs carries the child past its released parent.
@@ -249,6 +260,7 @@ describe('verify, freeze, repair and clear', () => {
     // The squash merge publishes exactly that tree; the post-merge verify confirms it instead of freezing the queue.
     const main2 = publishMain(fx, laneHead, '1.2.5.0');
     expect(repo.git('rev-parse', `${main2}^{tree}`)).toBe(repo.git('rev-parse', `${laneHead}^{tree}`));
+    markMerged(fx, '2');
     const post = v('2');
     expect([post.status, post.err]).toEqual([EXIT.ok, '']);
     expect(line(post.out, 'main:')).toBe(`main: ${main2} = T2 (same modulo stamps (1 stamp file(s)) except CHANGELOG.md, main ${main1.slice(0, 12)}'s CHANGELOG.md plus #2's own entry)`);
@@ -256,3 +268,133 @@ describe('verify, freeze, repair and clear', () => {
     expect(queue(fx, ['train', 'status']).out).not.toContain('QUEUE_TRAIN_FROZEN');
   }, 300_000);
 });
+
+describe('verify --train proves the slot stamp and a GitHub merge (#3531)', () => {
+  /** A main commit that carries an unstamped [Unreleased] entry, the way a bare commit after a no-commit merge shipped #3527. */
+  function unstampedMain(fx: TrainFixture, entry: string): string {
+    const { repo } = fx;
+    repo.git('fetch', '-q', 'origin');
+    repo.git('checkout', '-q', '-B', 'mainsim', 'origin/main');
+    fs.writeFileSync(path.join(repo.work, 'CHANGELOG.md'), fs.readFileSync(path.join(repo.work, 'CHANGELOG.md'), 'utf8').replace('# Changelog\n', `# Changelog\n\n## [Unreleased]\n\n${entry}\n`));
+    repo.git('commit', '-qam', 'merged without its stamp');
+    repo.git('push', '-q', 'origin', 'HEAD:refs/heads/main');
+    repo.git('fetch', '-q', 'origin');
+    return repo.git('rev-parse', 'HEAD');
+  }
+  const freezeFile = (fx: TrainFixture) => path.join(fx.state, 'ship-queue', 'freeze', `${repoKey(fx)}.json`);
+
+  test('#3527: an unstamped slot head (the bare pin, or a no-commit base merge committed without the restamp it wrote) refuses QUEUE_TRAIN_UNSTAMPED naming both versions; the stamped head passes with STAMP_VERSION from the head', () => {
+    const fx = make();
+    const { h1, h2, nonce } = twoPrTrain(fx);
+    expect(queue(fx, ['train', 'verdict', '--train', nonce]).status).toBe(EXIT.ok);
+    const t = trainJson(fx, nonce);
+    const coord = coordinatorClone(fx.repo);
+    const v = (pr: string) => queue(fx, ['verify', '--pr', pr, '--train', nonce], {}, coord);
+
+    const bare = v('1');
+    expect(bare.status).toBe(EXIT.refused);
+    expect(bare.err).toMatch(/#1's head [0-9a-f]{12} is not stamped above main: version: the head's VERSION 1\.2\.3\.0 is not above main's 1\.2\.3\.0.*\(QUEUE_TRAIN_UNSTAMPED\)/);
+    expect(bare.out).not.toContain('MERGE_CONDITION:');
+    expect(next(bare.out)).toMatch(/^NEXT: #1's lane runs gstack-restamp --next on its head, commits what restamp staged/);
+
+    const s1 = laneStamp(fx, '1', h1);
+    const ok = v('1');
+    expect(ok.status, ok.err).toBe(EXIT.ok);
+    expect(ok.out).toContain('STAMP_VERSION: 1.2.4.0');
+    expect(line(ok.out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${s1}`);
+    const unread = queue(fx, ['verify', '--pr', '1', '--train', nonce, '--no-fetch'], {}, coord);
+    expect(unread.status).toBe(EXIT.refused);
+    expect(unread.err).toMatch(/#1's current head was not read \(--no-fetch\).*\(QUEUE_PROOF_MISSING\)/);
+    expect(unread.out).not.toContain('MERGE_CONDITION:');
+    publishMain(fx, t.prefixes[1].commit, '1.2.4.0', { file: 'CHANGELOG.md', text: fx.repo.git('show', `${s1}:CHANGELOG.md`) + '\n' });
+    markMerged(fx, '1');
+    expect(v('1').out).toContain(`VERIFY_TRAIN: #1 merged; main's tree is T1 of train ${nonce} (1/2 merged)`);
+
+    laneStamp(fx, '2', h2, { mergeMain: true, dropStamp: true });
+    const dropped = v('2');
+    expect(dropped.status, dropped.err).toBe(EXIT.refused);
+    expect(dropped.err).toMatch(/#2's head [0-9a-f]{12} is not stamped above main: version: the head's VERSION 1\.2\.4\.0 is not above main's 1\.2\.4\.0.*\(QUEUE_TRAIN_UNSTAMPED\)/);
+    expect(dropped.out).not.toContain('MERGE_CONDITION:');
+    expect(fs.existsSync(freezeFile(fx))).toBe(false);
+    const s2 = laneStamp(fx, '2', h2, { mergeMain: true });
+    const stamped = v('2');
+    expect(stamped.status, stamped.err).toBe(EXIT.ok);
+    expect(stamped.out).toContain('STAMP_VERSION: 1.2.5.0');
+    expect(line(stamped.out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${s2}`);
+  }, 300_000);
+
+  test('the CHANGELOG rule is named: a head whose VERSION moved but whose entry is still [Unreleased] refuses', () => {
+    const fx = make();
+    const { h1, nonce } = twoPrTrain(fx);
+    expect(queue(fx, ['train', 'verdict', '--train', nonce]).status).toBe(EXIT.ok);
+    const { repo } = fx;
+    repo.git('checkout', '-q', '-B', 'lane1', h1);
+    fs.writeFileSync(path.join(repo.work, 'VERSION'), '1.2.4.0\n');
+    repo.git('commit', '-qam', 'VERSION only');
+    repo.git('push', '-q', '-f', 'origin', `${repo.git('rev-parse', 'HEAD')}:refs/pull/1/head`);
+    const r = queue(fx, ['verify', '--pr', '1', '--train', nonce], {}, coordinatorClone(fx.repo));
+    expect(r.status).toBe(EXIT.refused);
+    expect(r.err).toMatch(/is not stamped above main: changelog: CHANGELOG\.md's top section at the head is \[Unreleased\], not \[1\.2\.4\.0\].*\(QUEUE_TRAIN_UNSTAMPED\)/);
+  }, 300_000);
+
+  test('claim-at-open: a pin that carries its own stamp verifies at head == pin', () => {
+    const fx = make({ ...TRAIN_POLICY, queue_mode: 'claim-at-open' });
+    const h1 = openPr(fx, '1', { file: 'VERSION', text: '1.2.4.0\n', changelog: cl => cl.replace('# Changelog\n', '# Changelog\n\n## [1.2.4.0] - 2026-10-18\n\n- #1 change\n') });
+    readyReceipt(fx, '1', h1);
+    fx.write(d => { d.rules['evals.yml'] = GREEN_GATE; });
+    const nonce = nonceOf(queue(fx, ['train', 'build', '--prs', `1@${h1}`, '--urgent']).out);
+    expect(queue(fx, ['train', 'verdict', '--train', nonce]).status).toBe(EXIT.ok);
+    const r = queue(fx, ['verify', '--pr', '1', '--train', nonce], {}, coordinatorClone(fx.repo));
+    expect(r.status, r.err).toBe(EXIT.ok);
+    expect(r.out).toContain('STAMP_VERSION: 1.2.4.0');
+    expect(line(r.out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${h1}`);
+  }, 300_000);
+
+  test('#3530: an open release-only PR whose stamp-only diff makes main equal its prefix modulo stamps is not reported merged; it takes the pre-merge path', () => {
+    const fx = make();
+    unstampedMain(fx, '- #3527 change');
+    const h5 = openPr(fx, '5', { file: 'VERSION', text: '1.2.4.0\n', changelog: cl => cl.replace('## [Unreleased]', '## [1.2.4.0] - 2026-10-18') });
+    readyReceipt(fx, '5', h5);
+    fx.write(d => { d.rules['evals.yml'] = GREEN_GATE; });
+    const nonce = nonceOf(queue(fx, ['train', 'build', '--prs', `5@${h5}`, '--urgent']).out);
+    expect(queue(fx, ['train', 'verdict', '--train', nonce]).status).toBe(EXIT.ok);
+    const r = queue(fx, ['verify', '--pr', '5', '--train', nonce], {}, coordinatorClone(fx.repo));
+    expect(r.out).not.toMatch(/^VERIFY_TRAIN: #5 merged/m);
+    expect(r.status, r.err).toBe(EXIT.ok);
+    expect(r.out).toContain(`VERIFY_TRAIN: #5 may merge as slot 1 of train ${nonce}`);
+    expect(line(r.out, 'MERGE_CONDITION:')).toBe(`MERGE_CONDITION: sha=${h5}`);
+    expect(trainJson(fx, nonce).merged).toEqual([]);
+  }, 300_000);
+
+  test('no false freeze: main at the next prefix while GitHub reports the PR OPEN, or cannot be read, refuses QUEUE_PROOF_MISSING and never freezes; MERGED confirms', () => {
+    const fx = make();
+    const { h1, nonce } = twoPrTrain(fx);
+    expect(queue(fx, ['train', 'verdict', '--train', nonce]).status).toBe(EXIT.ok);
+    const t = trainJson(fx, nonce);
+    const coord = coordinatorClone(fx.repo);
+    const v = (pr: string) => queue(fx, ['verify', '--pr', pr, '--train', nonce], {}, coord);
+    laneStamp(fx, '1', h1);
+    expect(v('1').status).toBe(EXIT.ok);
+    publishMain(fx, t.prefixes[1].commit, '1.2.4.0');
+    markMerged(fx, '1');
+    expect(v('1').status).toBe(EXIT.ok);
+    publishMain(fx, t.prefixes[2].commit, '1.2.5.0');
+
+    const open = v('2');
+    expect(open.status).toBe(EXIT.refused);
+    expect(open.err).toMatch(/GitHub reports #2 as OPEN, not MERGED.*\(QUEUE_PROOF_MISSING\)/);
+    expect(open.out).not.toMatch(/^VERIFY_TRAIN: #2 merged/m);
+    expect(open.out).not.toMatch(/^QUEUE_TRAIN_FROZEN:/m);
+    expect(next(open.out)).toContain('rerun once GitHub reports #2 MERGED');
+    const saved = fx.read().prs['2'];
+    fx.write(d => { delete d.prs['2']; });
+    const unread = v('2');
+    expect(unread.err).toContain('(QUEUE_PROOF_MISSING)');
+    expect(unread.out).not.toMatch(/^QUEUE_TRAIN_FROZEN:/m);
+    expect(fs.existsSync(freezeFile(fx))).toBe(false);
+    fx.write(d => { d.prs['2'] = { ...(saved as object), state: 'MERGED' }; });
+    const done = v('2');
+    expect(done.status, done.err).toBe(EXIT.ok);
+    expect(done.out).toContain(`VERIFY_TRAIN: #2 merged; main's tree is T2 of train ${nonce} (2/2 merged)`);
+  }, 300_000);
+});
diff --git a/test/ship-receipt-session-kind.test.ts b/test/ship-receipt-session-kind.test.ts
new file mode 100644
index 000000000..48defdd94
--- /dev/null
+++ b/test/ship-receipt-session-kind.test.ts
@@ -0,0 +1,56 @@
+/**
+ * #3541 (the /ship half): `gstack-ship-receipt write` with no --session-kind
+ * and no GSTACK_SESSION_KIND asks bin/gstack-session-kind, a bash script.
+ * Spawned by path it never starts on Windows (no shebangs), so every receipt
+ * written there carried no session_kind.
+ *
+ * Windows-safe by construction: both bins launch through
+ * lib/script-invocation.ts (Git Bash on win32), state lives under os.tmpdir().
+ */
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { runScriptSync } from '../lib/script-invocation';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+
+let tmp = '', repo = '', env: NodeJS.ProcessEnv = {};
+
+beforeEach(() => {
+  tmp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-receipt-kind-')));
+  repo = path.join(tmp, 'repo');
+  fs.mkdirSync(repo);
+  const gitconfig = path.join(tmp, 'gitconfig');
+  fs.writeFileSync(gitconfig, '');
+  env = {
+    ...process.env, HOME: tmp, USERPROFILE: tmp, GSTACK_STATE_ROOT: path.join(tmp, 'state'), GSTACK_HOME: path.join(tmp, 'state'), GSTACK_SESSION_KIND: '',
+    GIT_CONFIG_GLOBAL: gitconfig, GIT_CONFIG_NOSYSTEM: '1', GIT_DIR: undefined, GIT_WORK_TREE: undefined, GIT_INDEX_FILE: undefined,
+  };
+  const git = (...args: string[]) => {
+    const r = spawnSync('git', args, { cwd: repo, env, encoding: 'utf8', timeout: 30_000 });
+    expect(r.status, r.stderr).toBe(0);
+  };
+  git('init', '-q', '-b', 'main');
+  fs.writeFileSync(path.join(repo, 'a.txt'), 'a\n');
+  git('add', 'a.txt');
+  git('-c', 'user.email=fixture@example.test', '-c', 'user.name=Fixture', '-c', 'commit.gpgsign=false', 'commit', '-qm', 'fixture');
+  git('update-ref', 'refs/remotes/origin/main', 'HEAD');
+  git('switch', '-q', '-c', 'feat');
+});
+
+afterEach(() => fs.rmSync(tmp, { recursive: true, force: true }));
+
+test('write without a session kind records what gstack-session-kind prints (#3541)', () => {
+  const kind = runScriptSync(path.join(ROOT, 'bin', 'gstack-session-kind'), [], { cwd: repo, env, encoding: 'utf8', timeout: 30_000 });
+  expect(kind.status, kind.stderr).toBe(0);
+  const body = path.join(tmp, 'body.md');
+  fs.writeFileSync(body, '## Summary\n');
+  const w = runScriptSync(path.join(ROOT, 'bin', 'gstack-ship-receipt'), ['write', '--pr', '1', '--base', 'main', '--body', body, '--json'], {
+    cwd: repo, env, encoding: 'utf8', timeout: 120_000,
+  });
+  expect(w.error).toBeUndefined();
+  expect(w.status, w.stderr).toBe(0);
+  expect(JSON.parse(w.stdout).session_kind).toBe(kind.stdout.trim());
+}, 150_000);
diff --git a/test/ship-rereview-triggers.test.ts b/test/ship-rereview-triggers.test.ts
index f06b65074..8795718cb 100644
--- a/test/ship-rereview-triggers.test.ts
+++ b/test/ship-rereview-triggers.test.ts
@@ -202,6 +202,53 @@ describe('a version stamp after review (GBRA-251, gbrain #8095)', () => {
   });
 });
 
+describe('a restamp after a lost slot (GST-895, GBRA-218, gbrain #8134)', () => {
+  // Value: protects=after a lost slot and a merge of the base, the restamp moves the branch's own stale stamp (older
+  //   than the reviewed tree's VERSION, newer than its fork point) and finish routes that line as a stamp; a row the
+  //   base carries (another PR's release at the same version), a merged base row the base later edited, or a branch row
+  //   at or older than the fork point, moved the same way still stops;
+  //   fails_when=stampedFiles floors every moved version at the reviewed tree's VERSION (behavior=1 on gbrain #8134) or
+  //   drops the floor for base lines; seam=lib/ship-bin-common.ts stampedFiles; no_claim=the restamp writer
+  const policy = JSON.stringify({ stamp_files: ['VERSION', 'src/notice.ts'], stamp_patterns: ["since: '{version}'"] });
+  const notice = (...rows: [string, string][]) => `export const NOTICES = [\n${rows.map(([v, text]) => `  { since: '${v}', text: '${text}' },`).join('\n')}\n];\n`;
+  const lostSlot = (ownRow: string) => {
+    const f = fx({ '.gstack/ship-policy.json': policy, VERSION: '1.0.0.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old']) },
+      { VERSION: '1.0.1.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], [ownRow, 'mine']) });
+    f.advanceBase({ VERSION: '1.0.2.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], ['1.0.1.0', 'theirs']) });
+    mergeMain(f, { VERSION: '1.0.2.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], ['1.0.1.0', 'theirs'], [ownRow, 'mine']) });
+    return { f, reviewed: wtree(f), reviewedBase: mergeBase(f), post: snapshot(f) };
+  };
+  const behaviorStop = 'STOP: behavior, tests or build inputs changed since review (src/notice.ts): insert 5–11.5 → 12–14 → 16 before Step 17 (stage 2.1)';
+
+  test('the moved stale stamp is metadata; a moved base row or pre-fork row stops', () => {
+    const own = lostSlot('1.0.1.0');
+    own.f.write({ VERSION: '1.0.3.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], ['1.0.1.0', 'theirs'], ['1.0.3.0', 'mine']) }); own.f.commit('restamp 1.0.3.0');
+    const ok = finish(own.f, own.reviewed, own.post, ['--reviewed-base', own.reviewedBase]);
+    expect([lineOf(ok.stdout, 'ROUTE'), lineOf(ok.stdout, 'DOCS')]).toEqual([expect.stringMatching(/ behavior=0 docs=0 metadata=2 tests=0 /), expect.not.stringContaining('src/notice.ts')]);
+
+    const base = lostSlot('1.0.1.0');
+    base.f.write({ VERSION: '1.0.3.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], ['1.0.3.0', 'theirs'], ['1.0.3.0', 'mine']) }); base.f.commit('restamp plus the base row');
+    const b = finish(base.f, base.reviewed, base.post, ['--reviewed-base', base.reviewedBase]);
+    expect([b.status, lineOf(b.stdout, 'STOP')]).toEqual([3, behaviorStop]);
+
+    const old = lostSlot('0.9.5.0');
+    old.f.write({ VERSION: '1.0.3.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], ['1.0.1.0', 'theirs'], ['1.0.3.0', 'mine']) }); old.f.commit('moves a pre-fork row');
+    const o = finish(old.f, old.reviewed, old.post, ['--reviewed-base', old.reviewedBase]);
+    expect([o.status, lineOf(o.stdout, 'STOP')]).toEqual([3, behaviorStop]);
+
+    const atFork = lostSlot('1.0.0.0');
+    atFork.f.write({ VERSION: '1.0.3.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], ['1.0.1.0', 'theirs'], ['1.0.3.0', 'mine']) }); atFork.f.commit('moves a row at the fork version');
+    const a = finish(atFork.f, atFork.reviewed, atFork.post, ['--reviewed-base', atFork.reviewedBase]);
+    expect([a.status, lineOf(a.stdout, 'STOP')]).toEqual([3, behaviorStop]);
+
+    const edited = lostSlot('1.0.1.0');
+    edited.f.advanceBase({ VERSION: '1.0.2.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], ['1.0.1.0', 'theirs, edited']) }); edited.f.git('fetch', '-q', 'origin');
+    edited.f.write({ VERSION: '1.0.3.0\n', 'src/notice.ts': notice(['0.9.0.0', 'old'], ['1.0.3.0', 'theirs'], ['1.0.3.0', 'mine']) }); edited.f.commit('moves a merged base row the base later edited');
+    const e = finish(edited.f, edited.reviewed, edited.post, ['--reviewed-base', edited.reviewedBase]);
+    expect([e.status, lineOf(e.stdout, 'STOP')]).toEqual([3, behaviorStop]);
+  });
+});
+
 describe('adjacent base edits (GST-384, #3631, founderstar#441)', () => {
   // Value: protects=a base edit next to the branch's unchanged hunk asks for a scoped review of only those hunks (finish
   //   context=N, carry RECEIPT_CARRY_SCOPED_REVIEW), and a clean scoped review lets it through; fails_when=it forces the
diff --git a/test/size-ledger/ship/gst-851-serial-lanes.json b/test/size-ledger/ship/gst-851-serial-lanes.json
new file mode 100644
index 000000000..42e1e2c22
--- /dev/null
+++ b/test/size-ledger/ship/gst-851-serial-lanes.json
@@ -0,0 +1,4 @@
+{
+  "bytes": 66,
+  "why": "GST-851: Step 5 prose says lanes run one at a time on 4 or fewer cores, names --lanes serial|parallel and the LANES line"
+}
diff --git a/test/skill-e2e-autoplan-ceo-only.test.ts b/test/skill-e2e-autoplan-ceo-only.test.ts
new file mode 100644
index 000000000..f0d251529
--- /dev/null
+++ b/test/skill-e2e-autoplan-ceo-only.test.ts
@@ -0,0 +1,108 @@
+import { describe, test, expect, beforeEach, afterEach, afterAll } from 'bun:test';
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { ceoOnlyEvidence, listFiles } from './helpers/autoplan-ceo-only-evidence';
+import { PTY_LONG_MS } from './helpers/eval-budgets';
+import { runSkillTest } from './helpers/session-runner';
+import { buildSeedConfig, seedHermeticGstackHome, seedHermeticRuntimeView } from './helpers/hermetic-env';
+import { FORCING_FLOOR_CEO } from './fixtures/forcing-finding-seeds';
+import {
+  ROOT, runId, evalsEnabled, describeIfSelected, logCost, recordE2E, copyDirSync, createEvalCollector, finalizeEvalCollector,
+} from './helpers/e2e-helpers';
+
+// /autoplan --ceo-only must finish a CEO review without asking anything (GST-537).
+// The seed is the plan that makes interactive /plan-ceo-review ask a question
+// (test/skill-e2e-plan-ceo-finding-floor.test.ts is the control on the same seed).
+// Every check is a pure function over the transcript and files,
+// proven against negative controls in test/autoplan-ceo-only.test.ts.
+
+const evalCollector = createEvalCollector('e2e-autoplan-ceo-only');
+// Declared roots in the isolated HOME: the state root, the host's own config and temp, and
+// Bun's package cache (the runtime writes it under HOME on first use; run gsta215-e2e-2).
+const OWNED_HOME_ROOTS = ['gstack-home', '.claude', 'tmp', '.bun/install/cache', '.capy/git-shim.log'];
+
+describeIfSelected('Autoplan CEO-only E2E', ['autoplan-ceo-only'], () => {
+  let workDir = '';
+  let stateDir = '';
+  let env: Record<string, string> = {};
+  let homeBefore: string[] = [];
+
+  const cleanup = () => {
+    for (const dir of [workDir, stateDir]) if (dir) fs.rmSync(dir, { recursive: true, force: true });
+  };
+
+  beforeEach(() => {
+    try {
+      workDir = fs.mkdtempSync(path.join(os.tmpdir(), 'skill-e2e-autoplan-ceo-only-'));
+      stateDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-autoplan-ceo-only-state-'));
+      const configDir = path.join(stateDir, '.claude');
+      const gstackHome = path.join(stateDir, 'gstack-home');
+      const tempDir = path.join(stateDir, 'tmp');
+      fs.mkdirSync(configDir);
+      fs.mkdirSync(gstackHome);
+      fs.mkdirSync(tempDir, { mode: 0o700 });
+      fs.writeFileSync(path.join(configDir, '.claude.json'), JSON.stringify(buildSeedConfig({
+        apiKey: process.env.ANTHROPIC_API_KEY ?? process.env.GSTACK_ANTHROPIC_API_KEY, trustedDirs: [workDir],
+      })), { mode: 0o600 });
+      seedHermeticGstackHome(gstackHome);
+      fs.mkdirSync(path.join(configDir, 'skills'));
+      seedHermeticRuntimeView(ROOT, path.join(configDir, 'skills', 'gstack'));
+      env = { HOME: stateDir, CLAUDE_CONFIG_DIR: configDir, GSTACK_HOME: gstackHome, GSTACK_STATE_ROOT: gstackHome,
+        TMPDIR: tempDir, TEMP: tempDir, TMP: tempDir };
+
+      const git = (...args: string[]) => {
+        const r = spawnSync('git', args, { cwd: workDir, encoding: 'utf8', timeout: 10_000 });
+        if (r.error || r.status !== 0) throw new Error(`CEO-only fixture setup failed: ${r.error?.message ?? r.stderr}`);
+      };
+      git('init', '-b', 'main');
+      git('config', 'user.email', 'test@test.com');
+      git('config', 'user.name', 'Test');
+      // The seed's first line asks for a /tmp plan copy; the plan itself is the rest.
+      fs.writeFileSync(path.join(workDir, 'PLAN.md'), FORCING_FLOOR_CEO.split('\n').slice(2).join('\n') + '\n');
+      fs.writeFileSync(path.join(workDir, 'README.md'), '# Acme API\n\nA paid HTTP API with one pricing tier.\n');
+      git('add', '.');
+      git('-c', 'commit.gpgsign=false', 'commit', '--no-verify', '-m', 'Plan');
+      for (const skill of ['autoplan', 'plan-ceo-review']) {
+        const dest = path.join(workDir, '.claude', 'skills', skill);
+        fs.mkdirSync(dest, { recursive: true });
+        fs.copyFileSync(path.join(ROOT, skill, 'SKILL.md'), path.join(dest, 'SKILL.md'));
+        copyDirSync(path.join(ROOT, skill, 'sections'), path.join(dest, 'sections'));
+      }
+      homeBefore = listFiles(stateDir, OWNED_HOME_ROOTS);
+    } catch (error) {
+      cleanup();
+      throw error;
+    }
+  });
+
+  afterEach(cleanup);
+  afterAll(() => finalizeEvalCollector(evalCollector));
+
+  // Titled by its E2E id so scripts/lib/paid-cases.ts needs no CASE_TEST_NAMES entry.
+  test.skipIf(!evalsEnabled)('autoplan-ceo-only', async () => {
+    const result = await runSkillTest({
+      testName: 'autoplan-ceo-only',
+      workingDirectory: workDir,
+      env,
+      prompt: '/autoplan --ceo-only --no-outside\n\nReview the plan in PLAN.md.',
+      timeout: PTY_LONG_MS,
+      allowedTools: ['Bash', 'Read', 'Write', 'Edit', 'Grep', 'Glob', 'Agent', 'Skill'],
+      maxTurns: 200,
+      runId,
+    });
+    const before = new Set(homeBefore);
+    const evidence = ceoOnlyEvidence({
+      transcript: Array.isArray(result.transcript) ? result.transcript : [],
+      output: result.output,
+      strayWrites: listFiles(stateDir, OWNED_HOME_ROOTS).filter(f => !before.has(f)),
+      mustMention: [/developer/i, /talk|interview|validat|evidence|research/i],
+    });
+    logCost('autoplan-ceo-only', result);
+    recordE2E(evalCollector, 'autoplan-ceo-only', 'Autoplan CEO-only E2E', result, {
+      passed: evidence.passed, ...(evidence.reasons.length ? { error: evidence.reasons.join('; ') } : {}),
+    });
+    expect(evidence.reasons).toEqual([]);
+  }, PTY_LONG_MS + 60_000);
+});
diff --git a/test/test-health-report.test.ts b/test/test-health-report.test.ts
index 0d654dba8..41f7d2736 100644
--- a/test/test-health-report.test.ts
+++ b/test/test-health-report.test.ts
@@ -189,7 +189,7 @@ describe('collectHealth over recorded fixture data', () => {
       [/workflows\/free-tests\.yml\/runs/, () => ({ workflow_runs: [run(60), run(61, { conclusion: 'failure' })] })],
       [/runs\/60\/artifacts/, () => ({ artifacts: [{ id: 61, name: 'flake-ledger-2', size_in_bytes: 10 }] })],
       [/runs\/61\/artifacts/, () => ({ artifacts: [] })],
-      [/workflows\/windows-free-tests\.yml\/runs/, () => ({ workflow_runs: windowsRuns })],
+      [/workflows\/windows-smoke\.yml\/runs/, () => ({ workflow_runs: windowsRuns })],
     ], {
       11: { 'manifest.json': JSON.stringify({ prCoverage: { mode: 'full-fallback', e2e: ['gate-a', 'gate-b'], judges: ['judge-a'],
         shadow: { e2e: ['gate-a', 'gate-b'], wouldDrop: [], wouldAdd: [], provenance: [], predictedSavingUsd: 0, unpricedCases: 0 } } }) },
@@ -218,7 +218,7 @@ describe('collectHealth over recorded fixture data', () => {
     expect(value('census-redispatch').value).toBe('0 of 1 census(es) re-dispatched; longest paid slice job 20.0 min');
     expect(value('quarantine-evidence').value).toContain('insufficient evidence (not the same as healthy)');
     expect(value('free-flaky-pass-rate').value).toStartWith('50.0% (1/2 main runs');
-    expect(value('free-wall').value).toBe('free-tests 0.0 min (1 runs); windows-free-tests (successful PR runs) 0.0 min (1 runs)');
+    expect(value('free-wall').value).toBe('free-tests 0.0 min (1 runs); windows-smoke (successful PR runs) 0.0 min (1 runs)');
     expect(value('free-serial').value).toBe('3 s over 3 files');
     for (const entry of report.metrics.filter(entry => entry.id !== 'net-complexity')) {
       expect(entry.rule.length).toBeGreaterThan(10);
@@ -287,10 +287,10 @@ describe('collectHealth over recorded fixture data', () => {
     const pr = (id: number, minutes: number, extra: Record<string, unknown> = {}) => run(id, { event: 'pull_request', head_branch: `pr-${id}`,
       run_started_at: day(1), updated_at: new Date(Date.parse(day(1)) + minutes * 60_000).toISOString(), ...extra });
     expect(wall([pr(70, 6), pr(71, 7), pr(74, 8), pr(72, 30, { conclusion: 'failure' }), run(73, { event: 'workflow_dispatch', run_started_at: day(3), updated_at: day(1) })]).value)
-      .toBe('free-tests 0.0 min (1 runs); windows-free-tests (successful PR runs) 7.0 min (3 runs)');
+      .toBe('free-tests 0.0 min (1 runs); windows-smoke (successful PR runs) 7.0 min (3 runs)');
     expect(wall([run(73, { event: 'workflow_dispatch', run_started_at: day(3), updated_at: day(1) })]).value)
-      .toBe('free-tests 0.0 min (1 runs); windows-free-tests (successful PR runs) no successful PR runs in window');
-    expect(wall([]).rule).toContain('workflow_dispatch duration recordings excluded');
+      .toBe('free-tests 0.0 min (1 runs); windows-smoke (successful PR runs) no successful PR runs in window');
+    expect(wall([]).rule).toContain('workflow_dispatch runs excluded');
   });
 
   test('a rate-limited API degrades every remote metric to a named unavailable reason, never 0, and keeps the issue open', () => {
diff --git a/test/timeline-stop-hook-stdin.test.ts b/test/timeline-stop-hook-stdin.test.ts
new file mode 100644
index 000000000..00db0e523
--- /dev/null
+++ b/test/timeline-stop-hook-stdin.test.ts
@@ -0,0 +1,65 @@
+/**
+ * #3628: a host that keeps the Stop hook's stdin open after writing its payload
+ * held the hook for as long as the pipe stayed open (fs.readFileSync(0) waits
+ * for EOF), well past the hook's 2 s budget and toward the host's 15 s RPC
+ * window. The hook must return within its budget and still repair the timeline.
+ *
+ * Windows-safe by construction: the hook runs through Bun argv
+ * (process.execPath), state lives under os.tmpdir().
+ */
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { bunIsolationArgs } from '../lib/bun-isolation';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+const HOOK_TS = path.join(ROOT, 'hosts', 'claude', 'hooks', 'timeline-stop-hook.ts');
+const SLUG = 'stop-hook-stdin';
+const BUDGET_MS = 2_000;
+const STARTUP_ALLOWANCE_MS = process.platform === 'win32' ? 3_000 : 1_500;
+
+let home = '', project = '', timeline = '';
+
+beforeEach(() => {
+  home = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-stop-stdin-home-')));
+  project = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-stop-stdin-proj-')));
+  fs.mkdirSync(path.join(home, 'projects', SLUG), { recursive: true });
+  timeline = path.join(home, 'projects', SLUG, 'timeline.jsonl');
+  fs.writeFileSync(timeline, JSON.stringify({ skill: 'review', event: 'started', session: '1-1' }) + '\n');
+});
+
+afterEach(() => {
+  fs.rmSync(home, { recursive: true, force: true });
+  fs.rmSync(project, { recursive: true, force: true });
+});
+
+async function runHookHoldingStdin(payload: string | null): Promise<{ code: number | null; ms: number }> {
+  const started = performance.now();
+  const child = Bun.spawn([process.execPath, ...bunIsolationArgs(), HOOK_TS], {
+    stdin: 'pipe', stdout: 'ignore', stderr: 'ignore',
+    env: { ...process.env, GSTACK_HOME: home, GSTACK_STATE_ROOT: home, GSTACK_PROJECT_SLUG: SLUG },
+  });
+  if (payload !== null) { child.stdin.write(payload); child.stdin.flush(); }
+  const kill = setTimeout(() => child.kill(), 10_000);
+  const code = await child.exited;
+  clearTimeout(kill);
+  const ms = performance.now() - started;
+  try { child.stdin.end(); } catch { /* already closed */ }
+  return { code, ms };
+}
+
+const repairs = () => fs.readFileSync(timeline, 'utf8').split('\n').filter(Boolean).map(l => JSON.parse(l)).filter(e => e.source === 'stop-hook');
+
+test('a complete payload on a pipe that never closes: returns within budget and repairs (#3628)', async () => {
+  const r = await runHookHoldingStdin(JSON.stringify({ hook_event_name: 'Stop', cwd: project }));
+  expect(r.code).toBe(0);
+  expect(r.ms).toBeLessThan(BUDGET_MS + STARTUP_ALLOWANCE_MS);
+  expect(repairs()).toHaveLength(1);
+}, 20_000);
+
+test('an open pipe with no data: returns within budget (#3628)', async () => {
+  const r = await runHookHoldingStdin(null);
+  expect(r.code).toBe(0);
+  expect(r.ms).toBeLessThan(BUDGET_MS + STARTUP_ALLOWANCE_MS);
+}, 20_000);
diff --git a/test/touchfiles.test.ts b/test/touchfiles.test.ts
index 2b4751774..7bd042652 100644
--- a/test/touchfiles.test.ts
+++ b/test/touchfiles.test.ts
@@ -310,8 +310,10 @@ describe('selectTests', () => {
     // The formerly keyless periodic AUQ probes drive the CEO skill too.
     expect(result.selected).toContain('auq-consistency');
     expect(result.selected).toContain('auq-verbose-vs-carved-ab');
-    expect(result.selected.length).toBe(21);
-    expect(result.skipped.length).toBe(Object.keys(E2E_TOUCHFILES).length - 21);
+    // /autoplan --ceo-only runs plan-ceo-review's Phase 1 and its 0E mode rule.
+    expect(result.selected).toContain('autoplan-ceo-only');
+    expect(result.selected.length).toBe(22);
+    expect(result.skipped.length).toBe(Object.keys(E2E_TOUCHFILES).length - 22);
   });
 
   test('global touchfile triggers ALL tests', () => {
diff --git a/test/ubicloud-runner-run.test.ts b/test/ubicloud-runner-run.test.ts
index 81890df77..2e4cabfad 100644
--- a/test/ubicloud-runner-run.test.ts
+++ b/test/ubicloud-runner-run.test.ts
@@ -50,6 +50,7 @@ describe('ubi-runner run, verify and quota against a fake API and a fake ssh', (
       const err = r.stderr.toString();
       expect(r.exitCode, err).toBe(0);
       expect(err).toMatch(/UBICLOUD: left=0 owner=thrd1 vm=ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3 others=1\n/);
+      expect(err).toMatch(/carries a 3h TTL \(this owner's next up or reap destroys it once it expires\); if this process dies first: /);
       expect(f.listed()).toBe('eu-central-h1 ubirun-thrd1-9999999999-sib1-t3\n');
       // Value: protects=UBI_LEFT_FILE carries the same leftover line pregate-remote.sh parses, apart from the command's output; fails_when=the file is not written or its format drifts from pregate-remote.sh's parser; why_new=the pregate stub hand-copies the format; seam=none; no_claim=real VM teardown (fake API and ssh)
       expect(readFileSync(leftFile, 'utf8')).toMatch(/^UBICLOUD: left=0 owner=thrd1 vm=ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3 others=1\n$/);
diff --git a/test/ubicloud-runner-verify-quota.test.ts b/test/ubicloud-runner-verify-quota.test.ts
index e099b9638..a7cbeea6b 100644
--- a/test/ubicloud-runner-verify-quota.test.ts
+++ b/test/ubicloud-runner-verify-quota.test.ts
@@ -210,12 +210,12 @@ describe('ubi-runner run, verify and quota against a fake API and a fake ssh', (
   }, 90_000);
 
   test('reap reports a failed list and a failed destroy as failures; UBI_TTL_HOURS rejects leading zeros and more than three digits', () => {
-    const f = fakeVm({ listed: 'eu-central-h1 ubirun-other-1000000000-bbbb-t1\n' });
+    const f = fakeVm({ listed: 'eu-central-h1 ubirun-thrd1-1000000000-bbbb-t1\n' });
     try {
-      writeFileSync(join(f.root, 'bin/curl'), '#!/usr/bin/env bash\nout=""; while [ $# -gt 0 ]; do [ "$1" = -o ] && out=$2; shift; done\nbody=$(cat)\ncase "$body" in\n  *\'"list"\'*) echo "eu-central-h1 ubirun-other-1000000000-bbbb-t1" > "$out"; printf 200 ;;\n  *\'"show"\'*) printf \'state: running\\nsize: standard-16\\nip4: 192.0.2.1\\n\' > "$out"; printf 200 ;;\n  *) echo "boom" > "$out"; printf 500 ;;\nesac\n');
+      writeFileSync(join(f.root, 'bin/curl'), '#!/usr/bin/env bash\nout=""; while [ $# -gt 0 ]; do [ "$1" = -o ] && out=$2; shift; done\nbody=$(cat)\ncase "$body" in\n  *\'"list"\'*) echo "eu-central-h1 ubirun-thrd1-1000000000-bbbb-t1" > "$out"; printf 200 ;;\n  *\'"show"\'*) printf \'state: running\\nsize: standard-16\\nip4: 192.0.2.1\\n\' > "$out"; printf 200 ;;\n  *) echo "boom" > "$out"; printf 500 ;;\nesac\n');
       const destroyFails = run(f, ['reap']);
       expect(destroyFails.exitCode).toBe(1);
-      expect(destroyFails.stderr.toString()).toContain('failed to reap eu-central-h1/ubirun-other-1000000000-bbbb-t1');
+      expect(destroyFails.stderr.toString()).toContain('failed to reap eu-central-h1/ubirun-thrd1-1000000000-bbbb-t1');
       expect(destroyFails.stderr.toString()).toContain('reap: 1 of 1 expired VMs could not be destroyed');
       writeFileSync(join(f.root, 'bin/curl'), '#!/usr/bin/env bash\nout=""; while [ $# -gt 0 ]; do [ "$1" = -o ] && out=$2; shift; done\ncat >/dev/null; echo "down" > "$out"; printf 503\n');
       const listFails = run(f, ['reap']);
diff --git a/test/ubicloud-runner.test.ts b/test/ubicloud-runner.test.ts
index 71d1de15e..66f6605bf 100644
--- a/test/ubicloud-runner.test.ts
+++ b/test/ubicloud-runner.test.ts
@@ -204,25 +204,25 @@ esac
     } finally { rmSync(f.root, { recursive: true, force: true }); }
   });
 
-  test('up reaps expired TTL VMs of any owner first, names its own VM with -t<hours>, and the quota preflight refuses before any create request', () => {
-    const listed = 'eu-central-h1 ubirun-other-1000000000-bbbb-t1\neu-central-h1 ubirun-peer-9999999999-cccc\n';
+  test('up reaps this owner\'s expired TTL VMs first and leaves another owner\'s, names its own VM with -t<hours>, and the quota preflight refuses before any create request', () => {
+    const listed = 'eu-central-h1 ubirun-thrd1-1000000000-hhhh-t1\neu-central-h1 ubirun-peer-9999999999-cccc\n';
     const f = fakeApi({ destroy: 200, listed });
     try {
       const r = Bun.spawnSync(['bash', join(DIR, 'ubi-runner.sh'), 'up'], { env: { ...process.env, PATH: `${join(f.root, 'bin')}:${process.env.PATH}`, UBICLOUD_API_KEY: 'offline', UBI_RUNNER_STATE: join(f.root, 'state'), UBI_POLL_SECONDS: '1', UBI_VM_RECORD: f.record, UBI_OWNER: 'thrd1', UBI_QUOTA_VCPUS: '31' }, timeout: 90_000 });
       expect(r.exitCode).toBe(1);
       const err = r.stderr.toString();
-      expect(err).toMatch(/reaping expired eu-central-h1\/ubirun-other-1000000000-bbbb-t1 \(owner other; its TTL ended \d+ min ago\)/);
+      expect(err).toMatch(/reaping expired eu-central-h1\/ubirun-thrd1-1000000000-hhhh-t1 \(owner thrd1; its TTL ended \d+ min ago\)/);
       expect(err).toMatch(/quota preflight refused eu-central-h1\/ubirun-thrd1-\d{10}-[0-9a-f]{8}-t3 \(standard-16\): it needs 16 vCPUs and the project's VMs already use 16 of 31/);
       expect(err).toContain('create refused before any request: vCPU quota exhausted');
       const destroyed = f.calls().split('\n').filter(l => l.includes('destroy'));
       expect(destroyed).toHaveLength(1);
-      expect(destroyed[0]).toContain('ubirun-other-1000000000-bbbb-t1');
+      expect(destroyed[0]).toContain('ubirun-thrd1-1000000000-hhhh-t1');
       expect(f.calls()).not.toContain('"create"');
       expect(existsSync(f.record)).toBe(false);
     } finally { rmSync(f.root, { recursive: true, force: true }); }
   });
 
-  test('UBI_REAP=0 skips the reap and UBI_TTL_HOURS sets the name\'s TTL; reap destroys expired TTLs and this owner\'s old TTL-less names, never unexpired, recent, another owner\'s TTL-less, untagged or foreign ones', () => {
+  test('UBI_REAP=0 skips the reap and UBI_TTL_HOURS sets the name\'s TTL; reap destroys this owner\'s expired TTLs and old TTL-less names, never unexpired, recent, another owner\'s expired or TTL-less, untagged or foreign ones', () => {
     const now = Math.floor(Date.now() / 1000);
     const listed = `eu-central-h1 ubirun-other-1000000000-bbbb-t1\neu-central-h1 ubirun-thrd1-9999999999-dddd-t1\neu-central-h1 ubirun-thrd1-1000000000-aaaa\neu-central-h1 ubirun-1000000000-cccc\neu-central-h1 ubirun-thrd1-${now - 3 * 3600}-eeee\neu-central-h1 ubirun-gbra240-1000000000-gggg\neu-central-h1 team-db-1000000000-ffff\n`;
     const f = fakeApi({ destroy: 200, listed });
@@ -235,7 +235,8 @@ esac
       expect(reap.exitCode).toBe(0);
       expect(reap.stderr.toString()).toMatch(/reaping TTL-less eu-central-h1\/ubirun-thrd1-1000000000-aaaa \(owner thrd1; \d+h old, legacy sweep at 4h\)/);
       const destroyed = f.calls().split('\n').filter(l => l.includes('destroy')).map(l => l.match(/ubirun-[a-z0-9-]+|team-db-[a-z0-9-]+/)?.[0]).sort();
-      expect(destroyed).toEqual(['ubirun-other-1000000000-bbbb-t1', 'ubirun-thrd1-1000000000-aaaa']);
+      expect(destroyed).toEqual(['ubirun-thrd1-1000000000-aaaa']);
+      expect(reap.stderr.toString()).toContain('reap: left 1 expired VMs of other owners; only their owners reap them');
       expect(f.run('reap').stderr.toString()).toContain('reap: no expired VMs');
       // Value: protects=UBI_LEGACY_HOURS sets reap's bound for TTL-less ubirun names (a 3h-old name is spared at 4h, reaped at 2h); fails_when=reap ignores UBI_LEGACY_HOURS and keeps a fixed bound; why_new=only the default bound and the validation are tested; seam=none; no_claim=real Ubicloud list and destroy (fake curl)
       const lowered = Bun.spawnSync(['bash', join(DIR, 'ubi-runner.sh'), 'reap'], { env: { ...process.env, PATH: `${join(f.root, 'bin')}:${process.env.PATH}`, UBICLOUD_API_KEY: 'offline', UBI_RUNNER_STATE: join(f.root, 'state'), UBI_POLL_SECONDS: '1', UBI_VM_RECORD: f.record, UBI_OWNER: 'thrd1', UBI_LEGACY_HOURS: '2' }, timeout: 90_000 });
@@ -243,13 +244,34 @@ esac
       expect(lowered.stderr.toString()).toMatch(/reaping TTL-less eu-central-h1\/ubirun-thrd1-\d{10}-eeee \(owner thrd1; 3h old, legacy sweep at 2h\)/);
       expect(f.calls()).toMatch(/ubirun-thrd1-\d{10}-eeee[^\n]*destroy/);
       // Value: protects=the legacy sweep never destroys another lane's or an untagged TTL-less VM (GST-324: 22 gbra240 eval VMs lost); fails_when=the sweep matches any owner again; why_new=the cross-owner sweep destroyed a paid eval; seam=none; no_claim=real Ubicloud list and destroy (fake curl)
-      expect(f.calls()).not.toMatch(/(team-db|dddd|gggg|cccc)[^\n]*destroy/);
+      expect(f.calls()).not.toMatch(/(team-db|dddd|gggg|cccc|bbbb)[^\n]*destroy/);
       const ownerless = Bun.spawnSync(['bash', join(DIR, 'ubi-runner.sh'), 'reap'], { env: { ...process.env, PATH: `${join(f.root, 'bin')}:${process.env.PATH}`, UBICLOUD_API_KEY: 'offline', UBI_RUNNER_STATE: join(f.root, 'state'), UBI_POLL_SECONDS: '1', UBI_VM_RECORD: f.record, UBI_OWNER: '', UBI_LEGACY_HOURS: '1' }, timeout: 90_000 });
       expect(ownerless.exitCode).toBe(0);
       expect(ownerless.stderr.toString()).not.toContain('reaping TTL-less');
     } finally { rmSync(f.root, { recursive: true, force: true }); }
   }, 30_000);
 
+  // Value: protects=reap and every up destroy only the caller's own VMs, never another owner's, even one whose TTL ran out (the 2026-10-30 owner-scoped-deletes rule; GST-324 lost 22 of gbrain's eval VMs to a cross-owner sweep); fails_when=reap judges another owner's VM by its TTL again; why_new=the old cases asserted the cross-owner TTL reap this rule forbids; seam=none; no_claim=real Ubicloud list and destroy (fake curl)
+  test('reap and up destroy only the caller\'s own expired VMs: another owner\'s and an untagged expired VM survive (GST-573)', () => {
+    const listed = 'eu-central-h1 ubirun-other-1000000000-bbbb-t1\neu-central-h1 ubirun-1000000000-cccc-t1\neu-central-h1 ubirun-thrd1-1000000000-hhhh-t1\n';
+    const f = fakeApi({ destroy: 200, listed });
+    try {
+      const reap = f.run('reap');
+      expect(reap.exitCode).toBe(0);
+      expect(reap.stderr.toString()).toMatch(/reaping expired eu-central-h1\/ubirun-thrd1-1000000000-hhhh-t1 \(owner thrd1; its TTL ended \d+ min ago\)/);
+      expect(reap.stderr.toString()).toContain('reap: left 2 expired VMs of other owners; only their owners reap them');
+      const destroyed = f.calls().split('\n').filter(l => l.includes('destroy'));
+      expect(destroyed).toHaveLength(1);
+      expect(destroyed[0]).toContain('ubirun-thrd1-1000000000-hhhh-t1');
+      const up = Bun.spawnSync(['bash', join(DIR, 'ubi-runner.sh'), 'up'], { env: { ...process.env, PATH: `${join(f.root, 'bin')}:${process.env.PATH}`, UBICLOUD_API_KEY: 'offline', UBI_RUNNER_STATE: join(f.root, 'state'), UBI_POLL_SECONDS: '1', UBI_VM_RECORD: f.record, UBI_OWNER: 'thrd1', UBI_QUOTA_VCPUS: '1' }, timeout: 90_000 });
+      expect(up.stderr.toString()).toContain('create refused before any request');
+      expect(up.stderr.toString()).toContain('reap: left 2 expired VMs of other owners; only their owners reap them');
+      expect(up.stderr.toString()).not.toMatch(/reaping[^\n]*(ubirun-other|ubirun-1000000000-cccc)/);
+      expect(f.calls().split('\n').filter(l => l.includes('destroy'))).toHaveLength(1);
+      for (const name of ['ubirun-other-1000000000-bbbb-t1', 'ubirun-1000000000-cccc-t1']) expect(readFileSync(join(f.root, 'listed'), 'utf8')).toContain(name);
+    } finally { rmSync(f.root, { recursive: true, force: true }); }
+  }, 90_000);
+
   // Value: protects=a project with no VMs (Ubicloud answers vm list with a bare newline) reads as empty everywhere vm_rows feeds; fails_when=a blank list row becomes a VM named "-" again and reap dies on it or usage asks to show it; why_new=every fake list in this file had at least one VM, so #3678 shipped green; seam=none; no_claim=the real API's empty-body shape (taken from #3678's reading of ubi_cli.rb)
   test('an empty project (vm list answers a bare or blank line) has no VMs: reap destroys nothing and exits 0, usage prints total 0 0, list --mine prints nothing (#3678)', () => {
     for (const listed of ['\n', '  \n']) {
diff --git a/test/windows-native-workflows.test.ts b/test/windows-native-workflows.test.ts
index b35bbe6c2..48ce50d9d 100644
--- a/test/windows-native-workflows.test.ts
+++ b/test/windows-native-workflows.test.ts
@@ -14,6 +14,8 @@ const root = path.resolve(import.meta.dir, '..');
 const load = (file: string) => Bun.YAML.parse(readFileSync(path.join(root, '.github/workflows', file), 'utf8')) as any;
 const windows = load('windows-free-tests.yml');
 const native = load('native-qualification.yml');
+const smoke = load('windows-smoke.yml');
+const smokeText = readFileSync(path.join(root, '.github/workflows/windows-smoke.yml'), 'utf8');
 
 /**
  * Ratchet: the Windows-safe subset may not silently shrink. If you deleted or
@@ -22,9 +24,9 @@ const native = load('native-qualification.yml');
  */
 const WINDOWS_CURATED_FLOOR = 795;
 
-test('the Windows lane plans, runs one strict shard per job and verifies every result', () => {
-  expect(Object.keys(windows.on).sort()).toEqual(['pull_request', 'push', 'workflow_call', 'workflow_dispatch']);
-  expect(windows.on.push).toEqual({ branches: ['main'] });
+test('the Windows lane runs nightly and by hand, plans, runs one strict shard per job and verifies every result', () => {
+  expect(Object.keys(windows.on).sort()).toEqual(['schedule', 'workflow_call', 'workflow_dispatch']);
+  expect(windows.on.schedule).toEqual([{ cron: '17 9 * * *' }]);
   expect(Object.keys(windows.on.workflow_dispatch.inputs)).toEqual(['record_durations']);
   expect(Object.keys(windows.on.workflow_call.inputs)).toEqual(['record_durations']);
   const plan = windows.jobs['windows-plan'];
@@ -35,6 +37,7 @@ test('the Windows lane plans, runs one strict shard per job and verifies every r
   const shard = windows.jobs['windows-free-shard'];
   expect(shard['runs-on']).toBe('windows-latest');
   expect(shard.needs).toEqual(['windows-plan', 'reuse']);
+  expect(shard.if).toStartWith('${{ !cancelled() && !inputs.record_durations && ');
   expect(shard.strategy).toEqual({ 'fail-fast': false, matrix: '${{ fromJSON(needs.windows-plan.outputs.matrix) }}' });
   const run = shard.steps.find((step: any) => step.name === 'Run Windows-safe shard');
   expect(run.run).toStartWith('bun run test:windows --ci-run "$RUNNER_TEMP/windows-plan.json" --shard ${{ matrix.shard }} --result ');
@@ -77,6 +80,50 @@ test('a record_durations dispatch times each Windows-safe file alone and uploads
   expect(job.steps.at(-1).if).toBe("always() && steps.seed.outcome == 'success'");
 });
 
+test('windows-smoke is the PR gate: every pull request and main push, one windows-latest job', () => {
+  expect(Object.keys(smoke.on).sort()).toEqual(['pull_request', 'push', 'workflow_dispatch']);
+  expect(smoke.on.pull_request).toEqual({ branches: ['main'] });
+  expect(smoke.on.push).toEqual({ branches: ['main'] });
+  expect(smoke.permissions).toEqual({ contents: 'read' });
+  expect(Object.keys(smoke.jobs)).toEqual(['windows-smoke']);
+  const job = smoke.jobs['windows-smoke'];
+  expect(job['runs-on']).toBe('windows-latest');
+  expect(job.if).toBeUndefined();
+  const step = (name: string) => job.steps.find((s: any) => s.name === name);
+  expect(step('./setup installs into an isolated HOME').run).toContain('./setup --host claude');
+  const start = step('The core skills start').run;
+  expect(start).toContain('for skill in ship review qa-only investigate browse; do');
+  expect(start).toContain("grep -q '^SKILL_START_PROTO: 1'");
+  expect(step("/browse on gstack's own browser runs a piped chain flow from an unrelated directory").run).toContain('| "$BROWSE" chain');
+  const tests = step('Fastest Windows-safe free tests for install and the core skills');
+  expect(tests.run).toContain('bun run scripts/test-free-shards.ts --files-from "$RUNNER_TEMP/windows-smoke-files.txt"');
+  expect(tests.env.GSTACK_FREE_RETRY_FLAKY).toBe('1');
+});
+
+test('every windows-smoke test is Windows-safe, seeded fast, and says why it is there', () => {
+  const run: string = smoke.jobs['windows-smoke'].steps.find((s: any) => s.name === 'Fastest Windows-safe free tests for install and the core skills').run;
+  const files = run.slice(run.indexOf("<<'LIST'\n") + 9, run.indexOf('\nLIST')).split('\n');
+  expect(files.length).toBeGreaterThan(0);
+  expect(new Set(files).size).toBe(files.length);
+  const { safe } = curateWindowsSafe(collectFreeTestFiles(root), root);
+  expect(files.filter(file => !safe.includes(file))).toEqual([]);
+  const seed = JSON.parse(readFileSync(path.join(root, 'scripts/free-test-durations-windows.json'), 'utf8')).durations as Record<string, number>;
+  expect(files.filter(file => !(seed[file] <= 5_000))).toEqual([]);
+  expect(files.reduce((sum, file) => sum + seed[file]!, 0)).toBeLessThan(60_000);
+  for (const file of files) expect(smokeText).toMatch(new RegExp('#   ' + path.basename(file, '.test.ts').replace(/[.-]/g, '\\$&') + ' \\([0-9.]+\\): \\S'));
+});
+
+test('no Windows job restores or saves the bun install cache', () => {
+  // GSTA-203 PR 1: a cold install (16-17 s) beat restoring the ~450 MB
+  // windows-bun entry (33-42 s), and PR merge-ref saves filled the 10 GB quota.
+  for (const file of ['windows-free-tests.yml', 'windows-smoke.yml', 'windows-setup-e2e.yml']) {
+    for (const [name, job] of Object.entries<any>(load(file).jobs)) {
+      const caches = (job.steps ?? []).filter((step: any) => step.uses?.startsWith('actions/cache'));
+      expect({ file, job: name, caches }).toEqual({ file, job: name, caches: [] });
+    }
+  }
+});
+
 test('Windows shards use the pinned Node runtime and retain complete logs on every run', () => {
   const steps = windows.jobs['windows-free-shard'].steps;
   const node = steps.find((step: any) => step.uses?.startsWith('actions/setup-node@'));
diff --git a/ubicloud/SKILL.md b/ubicloud/SKILL.md
index 4aaa63463..3b90355ae 100644
--- a/ubicloud/SKILL.md
+++ b/ubicloud/SKILL.md
@@ -102,7 +102,7 @@ telemetry — it never blocks the workflow.
 A full suite or verify that takes an hour on a 4-core sandbox takes minutes on a
 `standard-16` VM, and a VM that outlives its run costs the whole project its
 shared vCPU quota. This skill is one runner with the discipline built in: every
-VM carries its owner and a TTL in its name, any later run reaps expired VMs, the
+VM carries its owner and a TTL in its name, its owner's next run reaps it once expired, the
 create is refused before the quota fills, a silent remote command is killed with
 its last output instead of hanging, and a repository's verify is one committed
 definition rather than a wrapper per lane.
@@ -143,12 +143,12 @@ $U usage          # VMs and vCPUs per owner: who holds the shared quota
 ```
 
 A VM in `records` but absent from `list` is already gone: `$U down <name>`
-forgets it. A VM in the project under another owner is theirs; leave it (its
-TTL will reap it). Every `up` runs `$U reap` first, destroying any VM whose
-`-t<hours>` TTL ended more than ten minutes ago, whichever owner made it, and
-this owner's own `ubirun-<UBI_OWNER>-*` names with no TTL once they are
-`UBI_LEGACY_HOURS` old (default 4). Another owner's TTL-less VM, an untagged
-one and names outside the `ubirun-` prefix are never reaped.
+forgets it. A VM in the project under another owner is theirs; leave it.
+Every `up` runs `$U reap` first, destroying only this owner's
+`ubirun-<UBI_OWNER>-*` VMs whose `-t<hours>` TTL ended more than ten minutes
+ago, and those with no TTL once they are `UBI_LEGACY_HOURS` old (default 4).
+Another owner's VM, expired or not, an untagged one and names outside the
+`ubirun-` prefix are never reaped.
 
 Quota: with `UBI_QUOTA_VCPUS=<project ceiling>` exported (or after one refusal,
 whose maximum the runner remembers), `up` adds the size's vCPUs to the project's
@@ -171,7 +171,7 @@ background operation leaves its VM until the reaper. So:
   `### gstack-detach EXIT=<code> ###` sentinel.
 - Set `UBI_TTL_HOURS` above the longest plausible run (default 3; 1-999) and
   name the expected duration in the thread before launching anything over an
-  hour. A run that outlives its TTL is reaped by the next `up` anywhere.
+  hour. A run that outlives its TTL is reaped by its owner's next `up` or `reap`.
 
 The runner prints `<name> carries a <n>h TTL ...; if this process dies first:
 <self> down <name>` right after the VM is ready; quote that line in your report
diff --git a/ubicloud/SKILL.md.tmpl b/ubicloud/SKILL.md.tmpl
index 970627d94..1c339af9f 100644
--- a/ubicloud/SKILL.md.tmpl
+++ b/ubicloud/SKILL.md.tmpl
@@ -28,7 +28,7 @@ sensitive: false
 A full suite or verify that takes an hour on a 4-core sandbox takes minutes on a
 `standard-16` VM, and a VM that outlives its run costs the whole project its
 shared vCPU quota. This skill is one runner with the discipline built in: every
-VM carries its owner and a TTL in its name, any later run reaps expired VMs, the
+VM carries its owner and a TTL in its name, its owner's next run reaps it once expired, the
 create is refused before the quota fills, a silent remote command is killed with
 its last output instead of hanging, and a repository's verify is one committed
 definition rather than a wrapper per lane.
@@ -69,12 +69,12 @@ $U usage          # VMs and vCPUs per owner: who holds the shared quota
 ```
 
 A VM in `records` but absent from `list` is already gone: `$U down <name>`
-forgets it. A VM in the project under another owner is theirs; leave it (its
-TTL will reap it). Every `up` runs `$U reap` first, destroying any VM whose
-`-t<hours>` TTL ended more than ten minutes ago, whichever owner made it, and
-this owner's own `ubirun-<UBI_OWNER>-*` names with no TTL once they are
-`UBI_LEGACY_HOURS` old (default 4). Another owner's TTL-less VM, an untagged
-one and names outside the `ubirun-` prefix are never reaped.
+forgets it. A VM in the project under another owner is theirs; leave it.
+Every `up` runs `$U reap` first, destroying only this owner's
+`ubirun-<UBI_OWNER>-*` VMs whose `-t<hours>` TTL ended more than ten minutes
+ago, and those with no TTL once they are `UBI_LEGACY_HOURS` old (default 4).
+Another owner's VM, expired or not, an untagged one and names outside the
+`ubirun-` prefix are never reaped.
 
 Quota: with `UBI_QUOTA_VCPUS=<project ceiling>` exported (or after one refusal,
 whose maximum the runner remembers), `up` adds the size's vCPUs to the project's
@@ -97,7 +97,7 @@ background operation leaves its VM until the reaper. So:
   `### gstack-detach EXIT=<code> ###` sentinel.
 - Set `UBI_TTL_HOURS` above the longest plausible run (default 3; 1-999) and
   name the expected duration in the thread before launching anything over an
-  hour. A run that outlives its TTL is reaped by the next `up` anywhere.
+  hour. A run that outlives its TTL is reaped by its owner's next `up` or `reap`.
 
 The runner prints `<name> carries a <n>h TTL ...; if this process dies first:
 <self> down <name>` right after the VM is ready; quote that line in your report