diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 78be04e6..9870513b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -35,21 +35,21 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a
+      uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a
       with:
         languages: 'csharp'
         build-mode: none
         queries: security-and-quality
 
-    - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+    - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
       with:
         global-json-file: global.json
 
     - name: Autobuild
       if: ${{ github.actor != 'dependabot[bot]' }}
-      uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a
+      uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a
 
     - name: CodeQL Analysis
       if: ${{ github.actor != 'dependabot[bot]' }}
-      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a
+      uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a
       timeout-minutes: 100
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 3926da1b..289a1a15 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -85,6 +85,14 @@ env:
     s.symcb.com:80
     ocsp.digicert.com:80
 
+    # BouncyCastle's NuGet package signature chains to Sectigo/Comodo/UserTrust;
+    # its CRL/OCSP endpoints must be reachable to verify the signature's revocation.
+    crl.sectigo.com:443
+    ocsp.sectigo.com:443
+    crl.comodoca.com:443
+    ocsp.comodoca.com:443
+    crl.usertrust.com:443
+
     # Dotnet tools download CRL list from here.
     www.microsoft.com:80
 
@@ -112,12 +120,21 @@ jobs:
     steps:
     - name: Harden Runner
       if: ${{ matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm' }}
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
       with:
         disable-sudo: true
         egress-policy: block
         allowed-endpoints: ${{ env.COMMON_ALLOWED_ENDPOINTS }}
 
+    # Windows has no sudo to disable; otherwise the same block-mode allowlist so the
+    # workflow governs egress on the Windows host (package-signature revocation included).
+    - name: Harden Runner
+      if: ${{ matrix.os == 'windows-latest' }}
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
+      with:
+        egress-policy: block
+        allowed-endpoints: ${{ env.COMMON_ALLOWED_ENDPOINTS }}
+
     - name: Checkout code
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       with:
@@ -125,7 +142,7 @@ jobs:
         fetch-tags: true
 
     - name: Set up .NET SDK
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
       with:
         cache: true
         cache-dependency-path: '**/packages.lock.json'
@@ -382,7 +399,7 @@ jobs:
       if: ${{ matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm' }}
       # Note: disable-sudo is intentionally omitted here because apt-get is
       # needed below to install native AOT prerequisites (clang, zlib1g-dev).
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
       with:
         egress-policy: block
         allowed-endpoints: ${{ env.COMMON_ALLOWED_ENDPOINTS }}
@@ -394,7 +411,7 @@ jobs:
         fetch-tags: true
 
     - name: Set up .NET SDK
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
       with:
         cache: true
         cache-dependency-path: '**/packages.lock.json'
@@ -523,7 +540,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
       with:
         disable-sudo: true
         egress-policy: block
@@ -536,7 +553,7 @@ jobs:
         fetch-tags: true
 
     - name: Set up .NET SDK
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
       with:
         cache: true
         cache-dependency-path: '**/packages.lock.json'
@@ -672,7 +689,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
         with:
           disable-sudo: true
           egress-policy: block
@@ -727,7 +744,7 @@ jobs:
     environment: Release
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
         with:
           disable-sudo: true
           egress-policy: block
diff --git a/Directory.Packages.props b/Directory.Packages.props
index da790335..2e578c43 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -16,17 +16,17 @@
     <PackageVersion Include="Lumoin.Veridical.Bbs" Version="0.0.4" />
     <PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="5.6.0" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
     <PackageVersion Include="Microsoft.Sbom.Targets" Version="4.1.5" />
     <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.8.0" />
     <PackageVersion Include="NSec.Cryptography" Version="26.4.0" />
     <PackageVersion Include="BouncyCastle.Cryptography" Version="2.6.2" />
     <PackageVersion Include="System.Collections.Immutable" Version="10.0.9" />
-    <PackageVersion Include="System.Formats.Cbor" Version="10.0.9" />
+    <PackageVersion Include="System.Formats.Cbor" Version="10.0.10" />
     <PackageVersion Include="System.Net.Http.Json" Version="10.0.9" />
-    <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="10.0.9" />
+    <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="10.0.10" />
     <PackageVersion Include="System.Text.Json" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.7.0" />
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.8.0" />
     <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.9" />
     <PackageVersion Include="SIL.ReleaseTasks" Version="3.2.0" />
   </ItemGroup>
@@ -37,9 +37,11 @@
   -->
   <ItemGroup Label="CLI">
     <PackageVersion Include="dotNetRdf" Version="3.5.2" />
-    <PackageVersion Include="SimpleBase" Version="5.6.1" />
-    <PackageVersion Include="System.CommandLine" Version="2.0.9" />
-    <PackageVersion Include="ModelContextProtocol" Version="1.4.0" />
+    <!-- Transitive of dotNetRdf, pinned to a patched version to clear GHSA-pgww-w46g-26qg (vulnerable < 1.5.0). -->
+    <PackageVersion Include="AngleSharp" Version="1.5.2" />
+    <PackageVersion Include="SimpleBase" Version="5.6.2" />
+    <PackageVersion Include="System.CommandLine" Version="2.0.10" />
+    <PackageVersion Include="ModelContextProtocol" Version="1.4.1" />
   </ItemGroup>
   <!--
     Test packages used only in *.Tests projects.
@@ -48,11 +50,11 @@
   -->
   <ItemGroup Label="Test">
     <PackageVersion Include="CsCheck" Version="4.7.0" />
-    <PackageVersion Include="MessagePack" Version="3.1.4" />
+    <PackageVersion Include="MessagePack" Version="3.1.8" />
     <PackageVersion Include="LiquidTestReports.Markdown" Version="1.4.3-beta" />
     <PackageVersion Include="System.Reactive" Version="6.1.0" />
     <PackageVersion Include="Microsoft.Reactive.Testing" Version="6.1.0" />
-    <PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.19.1" />
+    <PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.19.2" />
   </ItemGroup>
   <!--
     Benchmark packages used only in *.Benchmarks projects.
diff --git a/README.md b/README.md
index d3d2df1f..4b0ba4b3 100644
--- a/README.md
+++ b/README.md
@@ -88,7 +88,7 @@ The library includes the following protocol flows, each with tests. The test sui
 - **DID resolution** — a multi-method resolver for did:key, did:web, did:peer, [did:webvh](https://identity.foundation/didwebvh/) (DID Log replay, SCID and key pre-rotation, witness verification, portability, version queries, and DID-URL dereferencing), and [did:webs](https://trustoverip.github.io/kswg-did-method-webs-specification/) (KERI-backed: resolution to the `did.json` and `keri.cesr` URLs, with the CESR event stream replayed to a verified KERI key state), with a [DID Resolution](https://w3c-ccg.github.io/did-resolution/) HTTP binding.
 - **WebFinger ([RFC 7033](https://www.rfc-editor.org/rfc/rfc7033))** — handle-to-resource discovery: a client that resolves a query target to a JSON Resource Descriptor over the guarded outbound path, and a capability-gated `/.well-known/webfinger` endpoint on the multi-tenant host, used to discover a subject's DID from an `acct:` handle.
 - **Passkeys ([WebAuthn Level 3](https://www.w3.org/TR/webauthn-3/) and CTAP 2.3)** — relying-party registration and authentication ceremonies over the Level 3 JSON wire, attestation statement verification (packed, tpm, android-key, fido-u2f, none) with FIDO Metadata Service BLOB validation, and a CTAP 2.3 authenticator and client covering clientPIN (PIN/UV auth protocols 1 and 2), credentialManagement, authenticatorConfig, reset, bioEnrollment, largeBlobs, enterprise attestation, and the credProtect, minPinLength, largeBlobKey, hmac-secret, and hmac-secret-mc extensions — exercised over an NFC/APDU transport and a Kestrel-hosted HTTP relying party.
-- **OAuth 2.0 / OpenID Connect** — authorization code with [PKCE](https://www.rfc-editor.org/rfc/rfc7636), [pushed authorization requests](https://www.rfc-editor.org/rfc/rfc9126), [signed request objects](https://www.rfc-editor.org/rfc/rfc9101), [DPoP](https://www.rfc-editor.org/rfc/rfc9449), [rich authorization requests](https://www.rfc-editor.org/rfc/rfc9396) with a per-type handler registry, [JWT-secured authorization responses](https://openid.net/specs/oauth-v2-jarm.html), [token introspection](https://www.rfc-editor.org/rfc/rfc7662) with [JWT responses](https://www.rfc-editor.org/rfc/rfc9701), token refresh and revocation, [dynamic client registration](https://www.rfc-editor.org/rfc/rfc7591), and [server](https://www.rfc-editor.org/rfc/rfc8414) and [protected-resource](https://www.rfc-editor.org/rfc/rfc9728) metadata, including the [FAPI 2.0](https://openid.net/specs/fapi-2_0-security-profile.html) security profile and [message signing](https://openid.net/specs/fapi-2_0-message-signing.html) constraints.
+- **OAuth 2.0 / OpenID Connect** — authorization code with [PKCE](https://www.rfc-editor.org/rfc/rfc7636), [pushed authorization requests](https://www.rfc-editor.org/rfc/rfc9126), [signed request objects](https://www.rfc-editor.org/rfc/rfc9101), [DPoP](https://www.rfc-editor.org/rfc/rfc9449), [rich authorization requests](https://www.rfc-editor.org/rfc/rfc9396) with a per-type handler registry, [JWT-secured authorization responses](https://openid.net/specs/oauth-v2-jarm.html), [token introspection](https://www.rfc-editor.org/rfc/rfc7662) with [JWT responses](https://www.rfc-editor.org/rfc/rfc9701), token refresh and revocation, [dynamic client registration](https://www.rfc-editor.org/rfc/rfc7591), and [server](https://www.rfc-editor.org/rfc/rfc8414) and [protected-resource](https://www.rfc-editor.org/rfc/rfc9728) metadata, including the [FAPI 2.0](https://openid.net/specs/fapi-2_0-security-profile.html) security profile and [message signing](https://openid.net/specs/fapi-2_0-message-signing.html) constraints. Clients identify by [Client ID Metadata Document](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/) — an `https` `client_id` resolved and validated at first use, with no pre-registration — and authenticate the code-exchange and refresh legs by `private_key_jwt` or a client secret. The authorization server emits [issuer identification](https://www.rfc-editor.org/rfc/rfc9207) and [JWT access tokens](https://www.rfc-editor.org/rfc/rfc9068), anchors OpenID Connect identity to an authenticated end-user across grants and refresh, and both mints ID Tokens and validates a received one per OpenID Connect Core §3.1.3.7. Identity and authorization chaining across trust domains combines [token exchange](https://www.rfc-editor.org/rfc/rfc8693) and the [JWT bearer grant](https://www.rfc-editor.org/rfc/rfc7523) into a cross-domain mint-and-redeem exercised end to end across two authorization servers.
 - **[OpenID Federation 1.0](https://openid.net/specs/openid-federation-1_0.html)** — entity configurations, trust chain resolution, metadata policy, trust marks, and client registration.
 - **Shared Signals ([SSF](https://openid.net/specs/openid-sharedsignals-framework-1_0.html), [CAEP](https://openid.net/specs/openid-caep-1_0.html), RISC)** — transmitter and receiver, with push and poll delivery and stream management.
 - **[AuthZEN](https://openid.net/specs/authorization-api-1_0.html)** — access evaluation, single and batch.
diff --git a/documents/ADRs/token-producer-selection-and-openid-anchoring.md b/documents/ADRs/token-producer-selection-and-openid-anchoring.md
new file mode 100644
index 00000000..584f272a
--- /dev/null
+++ b/documents/ADRs/token-producer-selection-and-openid-anchoring.md
@@ -0,0 +1,69 @@
+# Token Producer Selection and openid⇒End-User Anchoring
+
+## Context
+
+`Verifiable.OAuth`'s token endpoint composes its response from a set of `TokenProducer` modules (RFC 9068 access tokens, OIDC ID Tokens, and any application-supplied producer following the same shape) walked once per request. Two things needed a settled answer: which axis gates a producer running at all, and what stops an identity-bearing token (an ID Token, or an access token whose presence unlocks UserInfo) from being minted for a subject the library has no basis to call an authenticated End-User.
+
+Before this decision, `Rfc9068AccessTokenProducer.RequiredCapability` was pinned to `WellKnownCapabilityIdentifiers.OAuthAuthorizationCode` — a capability that has nothing to do with what the access-token producer actually needs (it needs "the grant that just matched is token-issuing", not "the grant that matched is specifically `authorization_code`"). A tenant configured for `jwt_bearer` only, `client_credentials` only, `token_exchange` only, or `pre_authorized_code` only would match its grant's endpoint successfully and then have the access-token producer skip itself, minting nothing. The defect was masked in the test suite by five test files granting the tenant `OAuthAuthorizationCode` as a capability it does not actually use, purely to satisfy the producer's gate.
+
+Independently, `IssuanceContext` carried no grant identity. Both `Oidc10IdTokenProducer.IsApplicableAsync` and `UserInfoEndpoints` gated identity issuance on the same proxy — "is `openid` present in the token's scope?" — with no independent check that the token in question was ever capable of representing an End-User. `openid` reaching the granted scope of a `client_credentials` token (whose `sub` is the `client_id`, not a person) or a `token_exchange`/`jwt_bearer` token exchanged for a non-End-User subject would, absent any other check, have produced a genuine ID Token or a served UserInfo identity body for a machine. Two independent consumers shared the same single point of failure — a class of defect, not an isolated bug in one file.
+
+The ID-JAG mint (`draft-ietf-oauth-identity-assertion-authz-grant`) already got this right elsewhere in the library: it gates on an explicit `requested_token_type` plus the app's own authorization decision, never on a scope proxy. This decision generalizes that pattern to the built-in producers.
+
+## Decision
+
+**Producer selection uses two independent, differently-scoped axes**, neither of which duplicates the endpoint-level capability match that already gated the grant itself:
+
+- `TokenProducer.RequiredCapability` (`CapabilityIdentifier?`, not required) is an *optional coarse tenant-feature gate*. `null` means the producer is not feature-gated — its applicability rests entirely on `IsApplicable`. `Rfc9068AccessTokenProducer` sets it `null`: an access token is the default response of every token-issuing grant, and the grant's own endpoint match already proved the tenant may run this grant before the producer walk starts. `Oidc10IdTokenProducer` keeps `WellKnownCapabilityIdentifiers.OidcOpenIdConnect`: whether a tenant offers OIDC at all is a genuine opt-in feature orthogonal to which grant capability matched.
+- `TokenProducer.IsApplicable` is the producer's own per-request decision, now able to read `IssuanceContext.GrantType` (a new required field carrying the wire `grant_type` from `WellKnownGrantTypes`, set at all six token-issuing call sites). The access-token producer is unconditionally applicable. The ID Token producer's applicability is `openid ∈ scope AND GrantType ∈ {authorization_code, refresh_token}` — grant-aware, independent of the scope check alone.
+
+**The `openid` ⇒ authenticated-End-User invariant is enforced at three independent layers** (defense-in-depth, per explicit owner direction — not collapsed to a single check):
+
+1. **Source.** The grants with no authenticated End-User by construction — `client_credentials` (subject is the client) and `pre_authorized_code` (no prior authorization session) — have `openid` and the OIDC Core §5.4 identity scopes (`profile`/`email`/`address`/`phone`) stripped from their granted scope before token issuance, per the RFC 6749 §3.3 narrowing allowance, with an OpenTelemetry span event naming what was dropped. `token_exchange` and `jwt_bearer` are exempted from this narrowing: their own authorization seams own whether the exchanged/asserted subject is an End-User, and the app opts in by granting `openid` itself.
+2. **Consumer — ID Token producer.** The grant-type check in `IsApplicable` (above) is independent of the scope check, so a defect that somehow left `openid` on a non-end-user-grant token's scope still cannot make this producer synthesize an ID Token for it.
+3. **Consumer — UserInfo.** The existing `openid`-in-token-scope check is kept, now provably correct because layer 1 guarantees it can never see `openid` on a `client_credentials` or `pre_authorized_code` token.
+
+**One shared issuance routine.** The identical producer-walk loop present at all six token-issuing call sites (`authorization_code`, `refresh_token`, `client_credentials`, `token_exchange`, `jwt_bearer`, `pre_authorized_code`) is factored into a single `IssueTokensAsync` helper that owns the two-axis filter, key resolution, `BuildAsync`, claim-contributor merge, and signing, returning a structured per-response-field result. Each call site keeps only its grant-specific `IssuanceContext` construction and response shaping.
+
+## Rationale
+
+**Two axes instead of one.** A single `RequiredCapability` field cannot simultaneously mean "coarse tenant feature switch" and "the exact scope/grant condition under which this producer should fire" without one of those concerns leaking into the other, which is precisely how the access-token producer ended up gated on a capability that had nothing to do with its actual applicability. Keeping the axes separate lets each producer declare a real tenant-feature dependency (or none) while expressing its per-request logic in code, not in the capability-identifier vocabulary.
+
+**Defense-in-depth over a single gate.** A single check — even a correct one — is one refactor away from silently becoming wrong again, and an identity-confusion defect (a machine's token read as a person's identity) is a security-relevant failure mode, not a cosmetic one. Three layers that each independently would have prevented the historical defect mean a regression in any one layer is caught by the other two, not by the next security audit.
+
+**Grant identity as its own signal, not inferred from capability or scope.** Both historical defects trace back to the same root: `IssuanceContext` had no notion of which grant produced it, so every identity decision reached for a proxy (a capability that happened to be granted, or a scope token that happened to be present) instead of the actual fact the decision depends on. Adding `GrantType` lets every current and future producer or consumer ask the real question directly.
+
+**One issuance routine.** Six byte-identical inlined loops is a correctness liability by construction — any fix to the walk (as this decision required) has to be applied and verified six times, or, more likely, applied once and left stale at the other five. Collapsing to one routine makes "correct at one site" mean "correct everywhere".
+
+## Alternatives Considered
+
+- **A single boolean or single capability expressing "identity issuance allowed".** Rejected: collapses the tenant-feature question ("does this tenant have OIDC configured?") and the per-request question ("is this specific token allowed to carry identity?") into one flag, which is exactly the shape that produced the original defect.
+- **Inferring end-user status from scope alone, with no grant-identity field.** Rejected: this is the status quo the investigation found broken. A scope-only check has no independent signal to fall back on if the scope computation itself has a bug — which is what happened.
+- **Gating only at the consumers (ID Token producer + UserInfo), leaving the source ungated.** Rejected: an app-configured claim contributor, a future producer, or an external system reading the granted scope directly all have no protection under a consumer-only design. Fixing the leak at its source removes it for every future consumer, not just the two known today.
+- **A generic "capability implies grant" registration-time mapping instead of an explicit `IssuanceContext.GrantType` field.** Considered and rejected as more indirection for no benefit — the grant type is already known precisely at every one of the six call sites; carrying it through explicitly is simpler than reconstructing it from the matched capability.
+
+## Consequences
+
+1. A tenant configured for exactly one non-`authorization_code` token-issuing grant now correctly mints an access token; the five test files that worked around the prior defect by over-granting `OAuthAuthorizationCode` lose their reason to do so.
+2. `client_credentials` and `pre_authorized_code` responses never carry `openid`-derived claims even if a caller requests `openid` in scope; the narrowing is silent to the caller (per RFC 6749 §3.3, narrowing does not require rejecting the request) but observable via the new OTel event.
+3. Adding a new built-in or application-supplied `TokenProducer` follows a clear two-question template: does it need a tenant-feature gate (`RequiredCapability`), and what per-request condition governs it (`IsApplicable`, which may now read `GrantType`)? Neither question requires touching the six issuance call sites, which stay generic.
+4. The six token-issuing call sites shrink to grant-specific setup and response shaping; the shared walk in `IssueTokensAsync` is the one place future producer-pipeline changes (a new key-resolution step, a new claim-contributor phase) need to land.
+5. Applications composing their own `TokenProducer` for a non-standard token type inherit the same two-axis model and, if the token type carries identity claims, should apply the same three-layer discipline (source narrowing, grant-aware applicability, consumer-side re-check) rather than a single scope check.
+
+## Status
+
+Accepted.
+
+## References
+
+- [RFC 6749 §3.3](https://www.rfc-editor.org/rfc/rfc6749#section-3.3) — scope narrowing.
+- [RFC 9068](https://www.rfc-editor.org/rfc/rfc9068) — JWT access tokens.
+- [OpenID Connect Core 1.0 §2](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) — ID Token.
+- [OpenID Connect Core 1.0 §5.3](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo) — UserInfo Endpoint.
+- [OpenID Connect Core 1.0 §5.4](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) — identity scopes (`profile`/`email`/`address`/`phone`).
+- `draft-ietf-oauth-identity-assertion-authz-grant` — the ID-JAG mint's explicit-request-type pattern this decision generalizes.
+- `documents/AuthorizationServerDesign.md` §9 — the resulting architecture in the working design document.
+
+## Revision History
+
+- Initial decision record, wave 4 of the CIMD arc (2026-07-18): grant identity on `IssuanceContext`, the optional-capability producer gate, grant-aware ID Token applicability, the three-layer `openid`⇒end-user invariant, and the shared `IssueTokensAsync` issuance routine.
diff --git a/documents/AuthorizationServerDesign.md b/documents/AuthorizationServerDesign.md
index e22bf3a4..eb9d4566 100644
--- a/documents/AuthorizationServerDesign.md
+++ b/documents/AuthorizationServerDesign.md
@@ -398,3 +398,42 @@ Decisions in this section have become so foundational they no longer need re-dis
 - **CAEP `session-revoked` emit, application-composed (Slice 7).** A revoked/terminated session MAY be signalled to Receivers as a best-effort CAEP `session-revoked` SET (CAEP 1.0 §3.1) — the "signal" end of the signal/command spectrum, distinct from the directed Back-Channel Logout fan-out. **There is deliberately no library issuance helper and no emit orchestrator:** the SET is composed from the primitives the application already holds — the typed `CaepSessionRevokedEvent.ToSecurityEvent()` carried by `SecurityEventTokenIssuance.IssueAsync`, with the revoked subject as the SET `sub_id` — inside the application's own seam (`RevokeSubjectTokensDelegate` for Global Token Revocation, or `TerminateSessionDelegate` for RP-Initiated Logout). A dedicated `CaepSessionRevokedSetIssuance` wrapper was considered and **rejected as thin sugar** over that one-line composition (which `CaepInteropEventTests` already exercises inline) — adding public surface without earning it. Every underlying piece was already covered on its own (the typed event + projection, SET issuance/reception, interop-profile conformance, the HTTP SET round-trip in `SsfHttpFlowTests`, and the documented app-driven hook in the GTR §8 decision); Slice 7 is the *flow-level* proof that ties them to the real revocation endpoint. `GlobalLogoutCaepEmitHttpTests.GlobalTokenRevocationEmitsConformantSessionRevokedSetToReceiverOverHttp`: a real `global_token_revocation_endpoint` request (returning §3 204) drops to the revoke-subject seam, which emits a CAEP-Interop-conformant (non-empty `reason_admin`) session-revoked SET about the revoked iss_sub subject and pushes it firewalled over Kestrel to a Receiver, which reconstructs from the wire bytes plus the OP's published public key alone and confirms the event type and `sub_id` through the full reception pipeline.
 - **RFC 9470 step-up authentication, server side (Slice 6).** Step-up enforcement converges on one authorize-decision seam: `Integration.EvaluateAuthorizationRequestAsync` (`EvaluateAuthorizationRequestDelegate`) is handed an `AuthorizationRequestEvaluation` (the requested `acr_values`/`max_age` and the session's `EstablishedAcr`/`auth_time`) and returns an `AuthorizationRequestDecision` — `Permit`, or `Deny(reason)` carrying an `AuthorizationDenialReason`. The library maps the reason to the OAuth error and error-redirect (`MapDenialReasonToError` in `AuthCodeEndpoints`: `UnmetAuthenticationRequirements` → `unmet_authentication_requirements` per OIDCUAR, `AccessDenied` → `access_denied`; a null/unmapped reason defaults to `access_denied`). The division of labour is **semantic decisions to the application, temporal to the library**: the app compares `acr` against its own authentication context (the library cannot know what an acr value *means*), while the library enforces `max_age` (OIDC Core §3.1.2.1) itself by whole-second comparison with **no clock skew** — `auth_time` and now share the AS clock, and any skew tolerance would defeat `max_age=0`. Every authorize path — direct, PAR, JAR — runs the same seam, so step-up cannot be bypassed by choice of request channel. The issued JWT access token carries `acr` + `auth_time` (RFC 9068 §2.2.1) and both survive refresh; `acr_values_supported` is advertised in discovery. Two front-channel hardenings rode the same slice: `state` is echoed on authorize **error** redirects (RFC 6749 §4.1.2.1), and PAR/JAR keep the pushed / `request_uri`-referenced value authoritative over a tampered front-channel duplicate (RFC 9126 + RFC 9101 §6.3), emitting an OTel span event when a tampering attempt is detected and ignored. Proven by `StepUpAccessTokenClaimsTests`, `UnmetAuthenticationRequirementsTests`, `AuthorizeStateEchoTests`, and `ParRequestIntegrityTests`.
 - **CAEP `credential-change` emit + credential status lists (the credential-side signal).** The signal/command spectrum extends from the *session* to the *credential*: where `session-revoked` (Slice 7) signals a revoked session, a CAEP `credential-change` SET (CAEP 1.0 §3.3, `change_type: revoke`, `credential_type: verifiable-credential`) signals a revoked credential — the same best-effort "signal" end, the same `SecurityEventTokenIssuance` / reception subsystem, the same **no library orchestrator** rule. The status runtime itself lives *outside* the AS, in `Verifiable.Core/StatusList`: one shared bit core (`StatusList` — packed N-bit entries over a pooled buffer, parameterized by a **required** `BitOrder`: least-significant-first for the IETF Token Status List, most-significant-first for the W3C Bitstring Status List) carrying two presentations — `StatusListToken` (IETF: ZLIB + base64url token) and `BitstringStatusListCodec` / `BitstringStatusListEntry` / `BitstringStatusListValidation` (W3C: GZIP + Multibase + the `BitstringStatusListCredential`, issued/verified over the existing JWS or Data Integrity surface). Revocation is the `UpdateCredentialStatusesDelegate` seam — the credential-side counterpart of `RevokeSubjectTokensDelegate`: the application flips the bit(s) and republishes each affected list once (the pull channel a verifier polls) and emits the `credential-change` SET to its Shared Signals receivers (the push channel). The seam is **batch-shaped** because a single credential may carry several entries across one or more lists (W3C §A.3/§A.4), grouped so a batch re-encodes each affected list exactly once with no half-applied intermediate. Proven by `BitstringStatusListRevocationDualChannelHttpTests` (one trigger → republished list + pushed SET, each verified firewalled) and `BitstringStatusListBatchRevocationTests`. Wire shapes verified against the verbatim specifications: Token Status List `draft-ietf-oauth-status-list-20` §4.1, CAEP 1.0 §3.3, RFC 8417 (SET), RFC 9493 (`sub_id`), and RFC 8935 (push delivery).
+
+---
+
+## 9. Token producer selection & identity issuance
+
+The token endpoint issues one JWT per applicable `TokenProducer` per request. Which producers run, and what identity claims they're allowed to carry, is decided across three independent layers rather than one central switch. See `documents/ADRs/token-producer-selection-and-openid-anchoring.md` for the decision record; this section describes the resulting shape.
+
+### 9.1 Endpoint match gates the grant capability
+
+Each of the six token-issuing grants — `authorization_code`, `refresh_token`, `client_credentials`, `token_exchange`, `jwt_bearer`, `pre_authorized_code` — is its own `EndpointCandidate` carrying a `Capability` (`WellKnownCapabilityIdentifiers.OAuthAuthorizationCode` / `OAuthClientCredentials` / `OAuthTokenExchange` / `OAuthJwtBearer` / `Oid4VciPreAuthorizedCodeGrant`). `EndpointChain.MatchAsync` (§2.2) only reaches a grant's `BuildInputAsync` when the registration's resolved capability set allows that capability, so by the time an `IssuanceContext` is constructed the request has already proven the tenant may run this grant at all — the coarsest gate in the pipeline runs once, before any producer is considered.
+
+`IssuanceContext.GrantType` (the wire `grant_type`, from `WellKnownGrantTypes`) carries that grant identity forward into the producer walk. It is not a re-check of what the endpoint match already gated — it's an independent signal producers read for decisions the endpoint match cannot express, because the endpoint match only knows "this tenant may run this grant", not "this grant establishes an authenticated End-User" or any other per-producer semantic the grant identity implies.
+
+### 9.2 Producer selection: optional feature gate + grant-aware `IsApplicable`
+
+`TokenProducer.RequiredCapability` is `CapabilityIdentifier?` — a coarse tenant-*feature* gate, orthogonal to the grant capability the endpoint match already checked. `null` means "not feature-gated at all"; the producer's applicability then rests entirely on `IsApplicable`.
+
+- `Rfc9068AccessTokenProducer` sets `RequiredCapability = null`. An RFC 9068 access token is the default response of every token-issuing grant, and the grant's own endpoint match already gated the request before the producer walk begins — there is nothing left for a second capability check to gate. Its `IsApplicable` is unconditionally `true`.
+- `Oidc10IdTokenProducer` keeps `RequiredCapability = WellKnownCapabilityIdentifiers.OidcOpenIdConnect`. Whether a tenant offers ID Tokens at all is a genuine opt-in feature, independent of which grant capability the request matched — a tenant can be `client_credentials`-only and never have OIDC wired at all. Its `IsApplicable` (`IsApplicableAsync`) is `openid ∈ scope AND GrantType ∈ {authorization_code, refresh_token}` — grant-aware, and checked independently of the capability gate (see §9.4).
+
+The walk itself — `IssueTokensAsync` in `AuthCodeEndpoints.cs` — applies both filters per producer, in order: skip when `RequiredCapability` is set and absent from `context.ResolvedCapabilities`; skip when `IsApplicable` returns `false`; otherwise resolve the signing key for the producer's `KeyUsage` via `SigningKeySelection.ResolveSigningKeyIdAsync`, call `BuildAsync`, merge claim-contributor output, and sign. A producer that needs a coarser tenant switch than its own `IsApplicable` logic can express reaches for `RequiredCapability`; a producer whose applicability depends on values already on `IssuanceContext` (scope, grant type, or anything else on the record) expresses it in `IsApplicable` instead. The two are deliberately different axes, not a fallback chain.
+
+### 9.3 One shared issuer
+
+All six token-issuing grant sites used to inline the same producer-walk loop. `IssueTokensAsync` is that loop factored out once: it owns the `RequiredCapability`/`IsApplicable` filter, key resolution, algorithm derivation (`CryptoFormatConversions.DefaultTagToJwaConverter` from the resolved key's `Tag`), `BuildAsync`, the claim-contributor merge, `UnsignedJwt.SignAsync`, and compact serialization — returning a `TokenIssuanceResult` (the compact JWS and an `IssuedTokenAudit` — `jti`/`keyid`/`iat`/`exp` — per response field, plus the latest `exp` across every token issued in the walk) or a `server_error` `ServerHttpResponse` when a producer's signing key could not be resolved.
+
+Each grant site keeps only what is genuinely grant-specific: constructing its `IssuanceContext` before the call, and shaping the response after it. `authorization_code` and `refresh_token` fold the audit dict into PDA state for `BuildResponse`; `client_credentials`, `token_exchange`, `jwt_bearer`, and `pre_authorized_code` write a scalar `expires_in` (read from `IssuedAudits[WellKnownTokenTypes.AccessToken]` rather than tracked separately) plus inline JSON. There is exactly one signing path in the library; a producer added for a new token type is correct at all six sites the moment it is added to `AuthorizationServerIntegration.TokenProducers`.
+
+### 9.4 The `openid` ⇒ end-user invariant
+
+`openid` in a token's scope is supposed to mean "this token identifies an authenticated End-User" — every ID Token and every UserInfo response makes that promise. The library defines its **end-user-authenticating grants** as `{authorization_code, refresh_token}`: the two grants where the library itself established an End-User authentication (refresh continues a prior one). `client_credentials` authenticates a client, not a person — its `sub` is the `client_id`. `pre_authorized_code` establishes no session at all. `token_exchange` and `jwt_bearer` are neither — whether the exchanged or asserted subject is an End-User is a decision the app's own authorization seam makes, not something the library can infer from the grant shape alone.
+
+The invariant is enforced at three independent layers so that a defect in any one of them cannot by itself mint an identity assertion for a non-End-User subject:
+
+1. **Source — scope narrowing.** `DropIdentityScopesForNonEndUserGrant` (`AuthCodeEndpoints.cs`) strips `openid` and the OIDC Core §5.4 identity scopes (`profile`/`email`/`address`/`phone`) from the granted scope before it reaches `IssuanceContext.Scope`, per the RFC 6749 §3.3 narrowing allowance. It runs at exactly the two grant sites with no authenticated End-User by construction — `client_credentials` and `pre_authorized_code` — and emits `OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant` (an `ActivityEvent` tagged with the dropped scopes) when narrowing actually occurs, so a deployment can observe the drop rather than have it happen silently. `token_exchange` and `jwt_bearer` do **not** call it: their authorization seams (`AuthorizationServerIntegration.AuthorizeTokenExchangeAsync`, `ValidateJwtBearerAssertionAsync`) own whether the exchanged/asserted subject is an End-User, and the app opts into identity claims by granting `openid` itself.
+2. **Consumer — the ID Token producer.** `Oidc10IdTokenProducer.IsApplicableAsync`'s grant-type check (§9.2) is independent of the scope check — it reads `IssuanceContext.GrantType` directly. Even if a defect ever left `openid` on a `client_credentials` or `token_exchange` token's scope, this producer still declines to synthesize an ID Token unless the grant is one the library itself recognizes as end-user-authenticating.
+3. **Consumer — UserInfo.** `UserInfoEndpoints` keeps its pre-existing `openid`-in-token-scope check (OIDC Core §5.3.1), and that check is correct *because* layer 1 guarantees `client_credentials` and `pre_authorized_code` tokens never carry `openid`. A `token_exchange` or `jwt_bearer` token that legitimately carries `openid` is correctly served — the app vouched for the subject by granting it. Absent the source-side guarantee, this check alone would be exactly the failure mode `WellKnownScopes` warns against in its own documentation: an access token issued without `openid` authorizes actions but does not identify a user, and its presence must never substitute for proof of identity.
+
+No single layer is trusted alone. The source layer is the one that actually prevents the leak; the two consumer layers are defense-in-depth against a defect that reaches them anyway.
diff --git a/global.json b/global.json
index 2049f395..f96f55c2 100644
--- a/global.json
+++ b/global.json
@@ -1,7 +1,7 @@
 {
     "sdk": {
         "allowPrerelease": true,
-        "version": "10.0.301"
+        "version": "10.0.302"
     },
     "msbuild-sdks": {
         "MSTest.Sdk": "4.2.3"
diff --git a/src/Verifiable.Acdc/packages.lock.json b/src/Verifiable.Acdc/packages.lock.json
index 8ace1bb4..b3932ec4 100644
--- a/src/Verifiable.Acdc/packages.lock.json
+++ b/src/Verifiable.Acdc/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -147,9 +147,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Apdu/packages.lock.json b/src/Verifiable.Apdu/packages.lock.json
index 723c63fe..84dc462a 100644
--- a/src/Verifiable.Apdu/packages.lock.json
+++ b/src/Verifiable.Apdu/packages.lock.json
@@ -16,9 +16,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -133,9 +133,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.BouncyCastle/packages.lock.json b/src/Verifiable.BouncyCastle/packages.lock.json
index 5b60d440..3133faad 100644
--- a/src/Verifiable.BouncyCastle/packages.lock.json
+++ b/src/Verifiable.BouncyCastle/packages.lock.json
@@ -16,9 +16,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -199,9 +199,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Cbor/packages.lock.json b/src/Verifiable.Cbor/packages.lock.json
index 8edcf988..f8c4f2d6 100644
--- a/src/Verifiable.Cbor/packages.lock.json
+++ b/src/Verifiable.Cbor/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -32,9 +32,9 @@
       },
       "System.Formats.Cbor": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "1iRjljxTMvQ1EtArg6kkj+9PV5LthrtlH//GM+MLez5L9jmZFDXGoH9lNiUpOeYY3sB60CgFVRnGctcmHEKqRw=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "V8XZBZsORS+NMhM5hc7doU0wKgDe0lJaaUkZGlAgpbYqN5Pd11I3pxwoRQgEyUVbDri/+qm7YCp49gCTYcbqJQ=="
       },
       "Markdig.Signed": {
         "type": "Transitive",
@@ -216,9 +216,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Cesr/packages.lock.json b/src/Verifiable.Cesr/packages.lock.json
index 73457b53..53f38458 100644
--- a/src/Verifiable.Cesr/packages.lock.json
+++ b/src/Verifiable.Cesr/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -133,9 +133,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Core/OutboundFetch/HttpCacheFreshness.cs b/src/Verifiable.Core/OutboundFetch/HttpCacheFreshness.cs
new file mode 100644
index 00000000..610c2c7a
--- /dev/null
+++ b/src/Verifiable.Core/OutboundFetch/HttpCacheFreshness.cs
@@ -0,0 +1,313 @@
+using System;
+using System.Globalization;
+
+namespace Verifiable.Core.OutboundFetch;
+
+/// <summary>
+/// Cacheability and remaining freshness lifetime of an <see cref="OutboundResponse"/>,
+/// computed purely from its headers per the subset of
+/// <see href="https://www.rfc-editor.org/rfc/rfc9111">RFC 9111 (HTTP Caching)</see> a
+/// shared-cache consumer needs: the <c>Cache-Control</c> <c>no-store</c>/<c>no-cache</c>/
+/// <c>max-age</c>/<c>s-maxage</c> directives (RFC 9111 §5.2.2), the <c>Age</c> header
+/// (RFC 9111 §5.1), and the <c>Expires</c>/<c>Date</c> fallback (RFC 9111 §5.3, §4.2.1).
+/// Consumed by the Client ID Metadata Document cache described in
+/// draft-ietf-oauth-client-id-metadata-document-02 §5.2, which respects HTTP cache
+/// headers when caching client metadata.
+/// </summary>
+/// <remarks>
+/// Deliberately <see cref="TimeProvider"/>-free: this is arithmetic over header values as
+/// received, not a staleness decision against wall-clock time. A caller that stores the
+/// result adds <see cref="FreshnessLifetime"/> to its own "stored at" instant (read from
+/// an injected <see cref="TimeProvider"/>) to get the moment a cache entry goes stale.
+/// Every unknown, absent, or malformed input resolves to zero freshness — fail-closed
+/// toward re-fetching rather than serving a document longer than the headers actually
+/// license.
+/// </remarks>
+[System.Diagnostics.DebuggerDisplay("{IsStorable ? \"Storable\" : \"NotStorable\",nq} {FreshnessLifetime}")]
+public readonly record struct HttpCacheFreshness
+{
+    private HttpCacheFreshness(bool isStorable, TimeSpan freshnessLifetime, bool mustRevalidate)
+    {
+        IsStorable = isStorable;
+        FreshnessLifetime = freshnessLifetime;
+        MustRevalidate = mustRevalidate;
+    }
+
+
+    /// <summary>
+    /// Whether a cache may retain the response at all. <see langword="false"/> only when
+    /// <c>Cache-Control: no-store</c> is present (RFC 9111 §5.2.2.5). A response with
+    /// <c>no-cache</c> (RFC 9111 §5.2.2.4) is still storable — it simply carries zero
+    /// <see cref="FreshnessLifetime"/>, so a cache that revalidates on every use can keep
+    /// the entry as a validation target.
+    /// </summary>
+    public bool IsStorable { get; }
+
+    /// <summary>
+    /// The remaining time, as of when this response was received, that it may be served
+    /// without re-fetching (RFC 9111 §4.2). Zero when <see cref="IsStorable"/> is
+    /// <see langword="false"/>, when <c>no-cache</c> is present, when no expiration signal
+    /// was found, or when the only expiration signal present was malformed.
+    /// </summary>
+    public TimeSpan FreshnessLifetime { get; }
+
+    /// <summary>
+    /// Whether <c>Cache-Control: no-cache</c> requires the response to be revalidated before
+    /// every reuse (RFC 9111 §5.2.2.4). When <see langword="true"/> the entry may be stored as
+    /// a validation target but must never be served fresh — distinct from a merely zero
+    /// <see cref="FreshnessLifetime"/> (an absent or short expiration signal), so a consumer that
+    /// applies a lower cache-lifetime bound must not raise a no-cache response to that floor.
+    /// </summary>
+    public bool MustRevalidate { get; }
+
+
+    /// <summary>The <c>Cache-Control</c> header name (RFC 9111 §5.2).</summary>
+    private const string CacheControlHeaderName = "Cache-Control";
+
+    /// <summary>The <c>Age</c> header name (RFC 9111 §5.1).</summary>
+    private const string AgeHeaderName = "Age";
+
+    /// <summary>The <c>Expires</c> header name (RFC 9111 §5.3).</summary>
+    private const string ExpiresHeaderName = "Expires";
+
+    /// <summary>The <c>Date</c> header name, used only as the Expires reference instant (RFC 9111 §4.2.1).</summary>
+    private const string DateHeaderName = "Date";
+
+    private const string NoStoreDirective = "no-store";
+    private const string NoCacheDirective = "no-cache";
+    private const string MaxAgeDirective = "max-age";
+    private const string SharedMaxAgeDirective = "s-maxage";
+
+    /// <summary>
+    /// The delta-seconds overflow ceiling: a value too large to represent, or any
+    /// larger-than-representable delta-seconds token, is treated as this value rather than
+    /// as invalid (RFC 9111 §1.2.2).
+    /// </summary>
+    private const long MaxDeltaSeconds = 2_147_483_648L;
+
+    /// <summary>The RFC 1123 / IMF-fixdate round-trip format recognized for <c>Expires</c> and <c>Date</c>.</summary>
+    private const string HttpDateFormat = "r";
+
+
+    /// <summary>
+    /// Computes cacheability and remaining freshness lifetime for <paramref name="response"/>.
+    /// Pure and total: never touches the network or a clock, and always returns a value —
+    /// there is no exception path for malformed headers, only fail-closed results.
+    /// </summary>
+    /// <param name="response">The response whose caching headers are evaluated.</param>
+    public static HttpCacheFreshness Compute(OutboundResponse response)
+    {
+        ArgumentNullException.ThrowIfNull(response);
+
+        response.TryGetHeader(CacheControlHeaderName, out string? cacheControlValue);
+        CacheControlDirectives directives = ParseCacheControlDirectives(cacheControlValue);
+
+        if(directives.HasNoStore)
+        {
+            return new HttpCacheFreshness(false, TimeSpan.Zero, mustRevalidate: false);
+        }
+
+        if(directives.HasNoCache)
+        {
+            return new HttpCacheFreshness(true, TimeSpan.Zero, mustRevalidate: true);
+        }
+
+        long? lifetimeSeconds = directives.SharedMaxAgeSeconds
+            ?? directives.MaxAgeSeconds
+            ?? ReadExpiresMinusDateSeconds(response);
+
+        if(lifetimeSeconds is null)
+        {
+            return new HttpCacheFreshness(true, TimeSpan.Zero, mustRevalidate: false);
+        }
+
+        long remainingSeconds = Math.Max(0, lifetimeSeconds.Value - ReadAgeSeconds(response));
+
+        return new HttpCacheFreshness(true, TimeSpan.FromSeconds(remainingSeconds), mustRevalidate: false);
+    }
+
+
+    //Walks the Cache-Control field value once, splitting on top-level commas (a
+    //quoted-string argument, e.g. no-cache="Set-Cookie, X-Foo", is not split), and folding
+    //each "name[=value]" token into the accumulated directive state via ApplyDirective.
+    private static CacheControlDirectives ParseCacheControlDirectives(string? headerValue)
+    {
+        CacheControlDirectives directives = default;
+        ReadOnlySpan<char> remaining = headerValue.AsSpan();
+
+        while(!remaining.IsEmpty)
+        {
+            int commaIndex = FindTopLevelComma(remaining);
+            ReadOnlySpan<char> token = (commaIndex >= 0 ? remaining[..commaIndex] : remaining).Trim();
+            remaining = commaIndex >= 0 ? remaining[(commaIndex + 1)..] : ReadOnlySpan<char>.Empty;
+
+            if(!token.IsEmpty)
+            {
+                directives = ApplyDirective(directives, token);
+            }
+        }
+
+        return directives;
+    }
+
+
+    //Recognizes the four directives this subset tracks and folds a match into
+    //directives via a non-destructive `with`; an unrecognized directive passes directives
+    //through unchanged per RFC 9111 §5.2.3 ("a cache MUST ignore unrecognized cache
+    //directives"). A max-age/s-maxage directive present with a value that fails to parse
+    //as delta-seconds is folded to zero rather than left absent: RFC 9111 §4.2.1
+    //encourages treating a response with invalid freshness information (its own example is
+    //"a max-age directive with non-integer content") as stale.
+    private static CacheControlDirectives ApplyDirective(CacheControlDirectives directives, ReadOnlySpan<char> token)
+    {
+        int equalsIndex = token.IndexOf('=');
+        ReadOnlySpan<char> name = (equalsIndex >= 0 ? token[..equalsIndex] : token).Trim();
+        ReadOnlySpan<char> value = equalsIndex >= 0 ? token[(equalsIndex + 1)..].Trim() : ReadOnlySpan<char>.Empty;
+
+        return name switch
+        {
+            _ when name.Equals(NoStoreDirective, StringComparison.OrdinalIgnoreCase) =>
+                directives with { HasNoStore = true },
+
+            _ when name.Equals(NoCacheDirective, StringComparison.OrdinalIgnoreCase) =>
+                directives with { HasNoCache = true },
+
+            _ when name.Equals(MaxAgeDirective, StringComparison.OrdinalIgnoreCase) =>
+                directives with { MaxAgeSeconds = TryParseDeltaSeconds(value, out long maxAgeSeconds) ? maxAgeSeconds : 0 },
+
+            _ when name.Equals(SharedMaxAgeDirective, StringComparison.OrdinalIgnoreCase) =>
+                directives with { SharedMaxAgeSeconds = TryParseDeltaSeconds(value, out long sharedMaxAgeSeconds) ? sharedMaxAgeSeconds : 0 },
+
+            _ => directives
+        };
+    }
+
+
+    //Cache directive arguments may use the quoted-string form (RFC 9111 §5.2: "recipients
+    //ought to accept both forms, even if a specific form is required for generation"), and
+    //a quoted-string argument can itself contain a comma; only a comma outside quotes
+    //separates directives.
+    private static int FindTopLevelComma(ReadOnlySpan<char> value)
+    {
+        bool isInsideQuotes = false;
+
+        for(int i = 0; i < value.Length; ++i)
+        {
+            char current = value[i];
+            if(current == '"')
+            {
+                isInsideQuotes = !isInsideQuotes;
+            }
+            else if(current == ',' && !isInsideQuotes)
+            {
+                return i;
+            }
+        }
+
+        return -1;
+    }
+
+
+    //delta-seconds = 1*DIGIT (RFC 9111 §1.2.2): no sign, at least one digit. A value that
+    //parses but exceeds the representable/overflow ceiling is clamped to MaxDeltaSeconds
+    //rather than rejected, per the same section.
+    private static bool TryParseDeltaSeconds(ReadOnlySpan<char> token, out long seconds)
+    {
+        token = Unquote(token.Trim());
+
+        if(token.IsEmpty)
+        {
+            seconds = 0;
+            return false;
+        }
+
+        foreach(char digit in token)
+        {
+            if(digit is < '0' or > '9')
+            {
+                seconds = 0;
+                return false;
+            }
+        }
+
+        if(!long.TryParse(token, NumberStyles.None, CultureInfo.InvariantCulture, out seconds))
+        {
+            seconds = MaxDeltaSeconds;
+            return true;
+        }
+
+        seconds = Math.Min(seconds, MaxDeltaSeconds);
+
+        return true;
+    }
+
+
+    private static ReadOnlySpan<char> Unquote(ReadOnlySpan<char> value) =>
+        value.Length >= 2 && value[0] == '"' && value[^1] == '"' ? value[1..^1] : value;
+
+
+    //RFC 9111 §5.1: the Age field is a delta-seconds; a list-based value uses only the
+    //first member, and an invalid value is ignored (treated as absent, i.e. zero).
+    private static long ReadAgeSeconds(OutboundResponse response)
+    {
+        if(!response.TryGetHeader(AgeHeaderName, out string? value) || value is not { Length: > 0 })
+        {
+            return 0;
+        }
+
+        ReadOnlySpan<char> span = value.AsSpan();
+        int commaIndex = span.IndexOf(',');
+        ReadOnlySpan<char> firstMember = (commaIndex >= 0 ? span[..commaIndex] : span).Trim();
+
+        return TryParseDeltaSeconds(firstMember, out long seconds) ? seconds : 0;
+    }
+
+
+    //RFC 9111 §4.2.1 fallback: Expires minus Date, only when both are present and parse as
+    //an RFC 1123 / IMF-fixdate HTTP-date. §5.3 requires an invalid Expires value to be
+    //interpreted as already expired; a missing or unparsable Date leaves no reference
+    //instant to compute a lifetime against — TimeProvider-free, so "use the time the
+    //message was received" (the RFC's fallback for an absent Date) is not available here.
+    private static long? ReadExpiresMinusDateSeconds(OutboundResponse response)
+    {
+        if(!response.TryGetHeader(ExpiresHeaderName, out string? expiresValue) || expiresValue is not { Length: > 0 })
+        {
+            return null;
+        }
+
+        if(!TryParseHttpDate(expiresValue, out DateTimeOffset expires))
+        {
+            return 0;
+        }
+
+        if(!response.TryGetHeader(DateHeaderName, out string? dateValue)
+            || dateValue is not { Length: > 0 }
+            || !TryParseHttpDate(dateValue, out DateTimeOffset date))
+        {
+            return null;
+        }
+
+        double totalSeconds = (expires - date).TotalSeconds;
+
+        return totalSeconds > 0 ? (long)totalSeconds : 0;
+    }
+
+
+    //The obsolete RFC 850 and asctime HTTP-date forms are not recognized: only the RFC
+    //1123 / IMF-fixdate form ("r") is; anything else is malformed for this component's
+    //purposes, folding into the zero-lifetime fail-closed path.
+    private static bool TryParseHttpDate(string value, out DateTimeOffset result) =>
+        DateTimeOffset.TryParseExact(
+            value,
+            HttpDateFormat,
+            CultureInfo.InvariantCulture,
+            DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
+            out result);
+
+
+    private readonly record struct CacheControlDirectives(
+        bool HasNoStore,
+        bool HasNoCache,
+        long? MaxAgeSeconds,
+        long? SharedMaxAgeSeconds);
+}
diff --git a/src/Verifiable.Core/packages.lock.json b/src/Verifiable.Core/packages.lock.json
index a429a293..77580071 100644
--- a/src/Verifiable.Core/packages.lock.json
+++ b/src/Verifiable.Core/packages.lock.json
@@ -31,9 +31,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -183,9 +183,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Cryptography/packages.lock.json b/src/Verifiable.Cryptography/packages.lock.json
index 7a556bf5..b8e0aba0 100644
--- a/src/Verifiable.Cryptography/packages.lock.json
+++ b/src/Verifiable.Cryptography/packages.lock.json
@@ -16,9 +16,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -126,9 +126,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.DidComm/packages.lock.json b/src/Verifiable.DidComm/packages.lock.json
index 2770fd17..3dd4ee58 100644
--- a/src/Verifiable.DidComm/packages.lock.json
+++ b/src/Verifiable.DidComm/packages.lock.json
@@ -16,9 +16,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -193,9 +193,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.DidWebs/packages.lock.json b/src/Verifiable.DidWebs/packages.lock.json
index 2ad5aaad..58d69407 100644
--- a/src/Verifiable.DidWebs/packages.lock.json
+++ b/src/Verifiable.DidWebs/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -207,9 +207,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Fido2/packages.lock.json b/src/Verifiable.Fido2/packages.lock.json
index ef584eb2..3d190112 100644
--- a/src/Verifiable.Fido2/packages.lock.json
+++ b/src/Verifiable.Fido2/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -200,9 +200,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Foundation/packages.lock.json b/src/Verifiable.Foundation/packages.lock.json
index c4cd4d87..80083aad 100644
--- a/src/Verifiable.Foundation/packages.lock.json
+++ b/src/Verifiable.Foundation/packages.lock.json
@@ -16,9 +16,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -120,9 +120,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.JCose/packages.lock.json b/src/Verifiable.JCose/packages.lock.json
index 73457b53..53f38458 100644
--- a/src/Verifiable.JCose/packages.lock.json
+++ b/src/Verifiable.JCose/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -133,9 +133,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Json/packages.lock.json b/src/Verifiable.Json/packages.lock.json
index 3a9f6bad..b4110490 100644
--- a/src/Verifiable.Json/packages.lock.json
+++ b/src/Verifiable.Json/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -253,9 +253,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.JsonPointer/packages.lock.json b/src/Verifiable.JsonPointer/packages.lock.json
index 2c813635..fb97c1b3 100644
--- a/src/Verifiable.JsonPointer/packages.lock.json
+++ b/src/Verifiable.JsonPointer/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -114,9 +114,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Keri/packages.lock.json b/src/Verifiable.Keri/packages.lock.json
index 4c33f6ab..dfbc3232 100644
--- a/src/Verifiable.Keri/packages.lock.json
+++ b/src/Verifiable.Keri/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -140,9 +140,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Microsoft/packages.lock.json b/src/Verifiable.Microsoft/packages.lock.json
index e0735471..01505560 100644
--- a/src/Verifiable.Microsoft/packages.lock.json
+++ b/src/Verifiable.Microsoft/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -32,9 +32,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "Markdig.Signed": {
         "type": "Transitive",
diff --git a/src/Verifiable.NSec/packages.lock.json b/src/Verifiable.NSec/packages.lock.json
index 9a74564e..3a8b4065 100644
--- a/src/Verifiable.NSec/packages.lock.json
+++ b/src/Verifiable.NSec/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -207,9 +207,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.OAuth/AcrAmrClaimContributor.cs b/src/Verifiable.OAuth/AcrAmrClaimContributor.cs
index bc5475d7..3cbdc360 100644
--- a/src/Verifiable.OAuth/AcrAmrClaimContributor.cs
+++ b/src/Verifiable.OAuth/AcrAmrClaimContributor.cs
@@ -16,12 +16,24 @@ namespace Verifiable.OAuth;
 /// </summary>
 /// <remarks>
 /// <para>
-/// On an <see cref="IdTokenTarget"/> the <c>acr</c> and <c>amr</c> claims come
-/// exclusively from <see cref="OidcClaims.AuthContext"/>; the <c>auth_time</c>
-/// claim has the documented fallback chain —
-/// <see cref="AuthenticationContext.AuthTime"/> when populated, otherwise
-/// <see cref="IssuanceContext.AuthTime"/> (the instant the End-User authenticated
-/// as observed by the AS).
+/// On an <see cref="IdTokenTarget"/> whose <see cref="IssuanceContext.GrantType"/> is
+/// <em>not</em> <c>refresh_token</c> — the original-authentication ID Token — the
+/// <c>acr</c> and <c>amr</c> claims come exclusively from
+/// <see cref="OidcClaims.AuthContext"/>, and <c>auth_time</c> follows the documented
+/// fallback chain: <see cref="AuthenticationContext.AuthTime"/> when populated,
+/// otherwise <see cref="IssuanceContext.AuthTime"/> (the instant the End-User
+/// authenticated as observed by the AS).
+/// </para>
+/// <para>
+/// On an <see cref="IdTokenTarget"/> whose <see cref="IssuanceContext.GrantType"/>
+/// <em>is</em> <c>refresh_token</c>, a refresh is not a new authentication event, so
+/// the resolver's <see cref="AuthenticationContext"/> is not consulted for the
+/// authentication-context claims: <c>auth_time</c> and <c>acr</c> are pinned to the
+/// carried-forward original values (<see cref="IssuanceContext.AuthTime"/> and
+/// <see cref="IssuanceContext.Acr"/>), and <c>amr</c> is suppressed because it names
+/// the methods used at authentication — which did not occur on this request — and the
+/// original <c>amr</c> is not carried forward on the refresh state. This is required by
+/// <see href="https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse">OIDC Core §12.2</see>.
 /// </para>
 /// <para>
 /// On an <see cref="AccessTokenTarget"/> the claims come from the threaded
@@ -64,9 +76,9 @@ public static async ValueTask<List<Claim>> GenerateAuthClassClaims(
         AuthenticationContext? authContext = await ResolveAuthContextAsync(
             idt, cancellationToken).ConfigureAwait(false);
 
-        DateTimeOffset? authTime = authContext?.AuthTime ?? idt.Issuance.AuthTime;
-        string? acr = authContext?.Acr;
-        bool hasAmr = authContext?.Amr is { Count: > 0 };
+        (DateTimeOffset? authTime, string? acr, IReadOnlyList<string>? amr) =
+            ResolveAuthContextClaims(idt, authContext);
+        bool hasAmr = amr is { Count: > 0 };
 
         List<Claim> claims = [];
 
@@ -95,7 +107,7 @@ public static async ValueTask<List<Claim>> GenerateAuthClassClaims(
             claims.Add(Success(
                 WellKnownClaimIds.OidcAuthClass,
                 WellKnownJwtClaimNames.Amr,
-                authContext!.Amr!));
+                amr!));
         }
 
         if(acr is null && !hasAmr)
@@ -148,6 +160,23 @@ private static List<Claim> GenerateAccessTokenClaims(AccessTokenTarget at)
     }
 
 
+    /// <summary>
+    /// Resolves the <c>auth_time</c>/<c>acr</c>/<c>amr</c> values for an
+    /// <see cref="IdTokenTarget"/>: the resolver's <paramref name="authContext"/> for an
+    /// original-authentication ID Token, or the carried-forward original values pinned
+    /// per
+    /// <see href="https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse">OIDC Core §12.2</see>
+    /// when <see cref="IssuanceContext.GrantType"/> is <c>refresh_token</c> — with
+    /// <c>amr</c> suppressed, since the refresh state carries no original <c>amr</c>.
+    /// </summary>
+    private static (DateTimeOffset? AuthTime, string? Acr, IReadOnlyList<string>? Amr) ResolveAuthContextClaims(
+        IdTokenTarget idt,
+        AuthenticationContext? authContext) =>
+        WellKnownGrantTypes.IsRefreshToken(idt.Issuance.GrantType)
+            ? (idt.Issuance.AuthTime, idt.Issuance.Acr, null)
+            : (authContext?.AuthTime ?? idt.Issuance.AuthTime, authContext?.Acr, authContext?.Amr);
+
+
     /// <summary>
     /// The "no authentication-context claims" outcome — both <c>acr</c> and
     /// <c>auth_time</c> reported as <see cref="ClaimOutcome.NotApplicable"/> for
diff --git a/src/Verifiable.OAuth/AuthCode/AuthCodeClient.cs b/src/Verifiable.OAuth/AuthCode/AuthCodeClient.cs
index a35b2aea..5c4f1155 100644
--- a/src/Verifiable.OAuth/AuthCode/AuthCodeClient.cs
+++ b/src/Verifiable.OAuth/AuthCode/AuthCodeClient.cs
@@ -142,7 +142,14 @@ public ValueTask<AuthCodeFlowEndpointResult> HandleCallbackAsync(
 
     /// <summary>
     /// Exchanges the authorization code and PKCE verifier for tokens at the
-    /// token endpoint.
+    /// token endpoint, attaching confidential-client authentication per
+    /// <see cref="ClientRegistration.AuthenticationMethod"/> (RFC 6749 §3.2.1). Covers
+    /// <see cref="ClientAuthenticationMethod.None"/>, <see cref="ClientAuthenticationMethod.ClientSecretPost"/>,
+    /// and <see cref="ClientAuthenticationMethod.ClientSecretBasic"/> — none of which need a signed
+    /// assertion. A <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/> registration needs the
+    /// <see cref="ExchangeTokenAsync(ClientRegistration, string, ExchangeContext, ClientAssertionOptions?, CancellationToken)"/>
+    /// overload instead, so the caller can supply the client-assertion signing inputs
+    /// (RFC 7523 §2.2) the AS-declared method requires.
     /// </summary>
     /// <param name="registration">The registration identifying the authorization server.</param>
     /// <param name="flowId">
@@ -163,6 +170,43 @@ public ValueTask<AuthCodeFlowEndpointResult> ExchangeTokenAsync(
         ClientRegistration registration,
         string flowId,
         ExchangeContext context,
+        CancellationToken cancellationToken) =>
+        ExchangeTokenAsync(registration, flowId, context, clientAssertionOptions: null, cancellationToken);
+
+
+    /// <summary>
+    /// Exchanges the authorization code and PKCE verifier for tokens at the
+    /// token endpoint, attaching confidential-client authentication per
+    /// <see cref="ClientRegistration.AuthenticationMethod"/> (RFC 6749 §3.2.1 / RFC 7523 §2.2) —
+    /// the overload that reaches <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/>.
+    /// </summary>
+    /// <remarks>
+    /// The signed <c>client_assertion</c>'s <c>iss</c>/<c>sub</c> (the client identifier), <c>aud</c>
+    /// (the resolved token endpoint), <c>iat</c>/<c>exp</c> (<see cref="OAuthClientInfrastructure.TimeProvider"/>),
+    /// and <c>jti</c> (<see cref="OAuthClientInfrastructure.GenerateIdentifierAsync"/> — the same
+    /// generator the <see cref="Verifiable.OAuth.IdJag.IdJagFlowHandlers"/> client path uses) all come
+    /// from <paramref name="registration"/> and <see cref="Infrastructure"/>; the signing key comes from
+    /// <see cref="ClientRegistration.AuthenticationKeyMaterial"/>. <paramref name="clientAssertionOptions"/>
+    /// supplies only what the application must still choose: the <c>kid</c> and the header/payload
+    /// serialisers.
+    /// </remarks>
+    /// <param name="registration">The registration identifying the authorization server.</param>
+    /// <param name="flowId">
+    /// The flow identifier (the <c>state</c> value) that correlates this token
+    /// request with the original PAR.
+    /// </param>
+    /// <param name="context">The per-operation exchange context threaded into the transport and flow-state delegates.</param>
+    /// <param name="clientAssertionOptions">
+    /// The <c>private_key_jwt</c> client-assertion signing inputs (RFC 7523 §2.2). Required when
+    /// <see cref="ClientRegistration.AuthenticationMethod"/> is
+    /// <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/>; ignored for every other method.
+    /// </param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    public ValueTask<AuthCodeFlowEndpointResult> ExchangeTokenAsync(
+        ClientRegistration registration,
+        string flowId,
+        ExchangeContext context,
+        ClientAssertionOptions? clientAssertionOptions,
         CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(registration);
@@ -174,12 +218,20 @@ public ValueTask<AuthCodeFlowEndpointResult> ExchangeTokenAsync(
             Infrastructure,
             registration,
             context,
+            clientAssertionOptions,
             cancellationToken);
     }
 
 
     /// <summary>
-    /// Refreshes an access token using a refresh token.
+    /// Refreshes an access token using a refresh token, attaching confidential-client
+    /// authentication per <see cref="ClientRegistration.AuthenticationMethod"/> (RFC 6749 §6, §3.2.1). Covers
+    /// <see cref="ClientAuthenticationMethod.None"/>, <see cref="ClientAuthenticationMethod.ClientSecretPost"/>,
+    /// and <see cref="ClientAuthenticationMethod.ClientSecretBasic"/> — none of which need a signed
+    /// assertion. A <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/> registration needs the
+    /// <see cref="RefreshAsync(ClientRegistration, RefreshTokenRequest, ExchangeContext, ClientAssertionOptions?, CancellationToken)"/>
+    /// overload instead, so the caller can supply the client-assertion signing inputs
+    /// (RFC 7523 §2.2) the AS-declared method requires.
     /// </summary>
     /// <param name="registration">The registration identifying the authorization server.</param>
     /// <param name="request">The refresh token request.</param>
@@ -197,13 +249,37 @@ public ValueTask<AuthCodeFlowEndpointResult> RefreshAsync(
         ClientRegistration registration,
         RefreshTokenRequest request,
         ExchangeContext context,
+        CancellationToken cancellationToken) =>
+        RefreshAsync(registration, request, context, clientAssertionOptions: null, cancellationToken);
+
+
+    /// <summary>
+    /// Refreshes an access token using a refresh token, attaching confidential-client
+    /// authentication per <see cref="ClientRegistration.AuthenticationMethod"/> (RFC 6749 §6 /
+    /// RFC 7523 §2.2) — the overload that reaches <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/>.
+    /// </summary>
+    /// <param name="registration">The registration identifying the authorization server.</param>
+    /// <param name="request">The refresh token request.</param>
+    /// <param name="context">The per-operation exchange context threaded into the transport and flow-state delegates.</param>
+    /// <param name="clientAssertionOptions">
+    /// The <c>private_key_jwt</c> client-assertion signing inputs (RFC 7523 §2.2). Required when
+    /// <see cref="ClientRegistration.AuthenticationMethod"/> is
+    /// <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/>; ignored for every other method.
+    /// </param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    public ValueTask<AuthCodeFlowEndpointResult> RefreshAsync(
+        ClientRegistration registration,
+        RefreshTokenRequest request,
+        ExchangeContext context,
+        ClientAssertionOptions? clientAssertionOptions,
         CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(registration);
         ArgumentNullException.ThrowIfNull(request);
         ArgumentNullException.ThrowIfNull(context);
 
-        return AuthCodeFlowHandlers.RefreshAsync(request, Infrastructure, registration, context, cancellationToken);
+        return AuthCodeFlowHandlers.RefreshAsync(
+            request, Infrastructure, registration, context, clientAssertionOptions, cancellationToken);
     }
 
 
diff --git a/src/Verifiable.OAuth/AuthCode/AuthCodeEndpoints.cs b/src/Verifiable.OAuth/AuthCode/AuthCodeEndpoints.cs
index a7823a8c..67c7491f 100644
--- a/src/Verifiable.OAuth/AuthCode/AuthCodeEndpoints.cs
+++ b/src/Verifiable.OAuth/AuthCode/AuthCodeEndpoints.cs
@@ -302,18 +302,32 @@ private static EndpointCandidate BuildPar() =>
                 }
 
                 //RFC 9700 §2.1 + OAuth 2.1 §2.3.1 — redirect_uri exact-match
-                //against the registered set. Parallel to the JAR-PAR check
-                //around line 988; this matcher's MatchesRequest already
-                //asserts context.ClientRegistration is non-null, so the read is
-                //unconditional here.
+                //against the registered set, per RedirectUriMatching (simple
+                //string comparison, not Uri equality). Parallel to the
+                //JAR-PAR check around line 988; this matcher's
+                //MatchesRequest already asserts context.ClientRegistration is
+                //non-null, so the read is unconditional here.
                 ClientRecord registration = context.ClientRegistration!;
-                if(!registration.AllowedRedirectUris.Contains(redirectUri))
+                if(!RedirectUriMatching.IsRegisteredExact(registration.AllowedRedirectUris, redirectUri))
                 {
                     return ((FlowInput?)null, (ServerHttpResponse?)ServerHttpResponse.BadRequest(
                         OAuthErrors.InvalidRequest,
                         $"redirect_uri '{redirectUri}' is not among the registered redirect URIs."));
                 }
 
+                //RFC 6749 §4.1.1 — response_type selects which grant the request is
+                //for; RFC 9126 §2.3 error responses at the PAR endpoint use the same
+                //error registry as the authorization endpoint, returned directly (PAR
+                //has no redirect leg of its own).
+                fields.TryGetValue(OAuthRequestParameterNames.ResponseType, out string? responseType);
+                if(IsUnsupportedResponseType(responseType))
+                {
+                    return ((FlowInput?)null, (ServerHttpResponse?)ServerHttpResponse.BadRequest(
+                        UnsupportedResponseTypeError,
+                        $"response_type '{responseType}' is not supported; this authorization "
+                        + $"server issues '{WellKnownResponseTypes.Code}' only."));
+                }
+
                 fields.TryGetValue(OAuthRequestParameterNames.Scope, out string? scope);
                 if(context.ScopeRequiredOnRequest && string.IsNullOrEmpty(scope))
                 {
@@ -714,6 +728,20 @@ private static EndpointCandidate BuildDirectAuthorize() =>
                     return ((FlowInput?)null, (ServerHttpResponse?)responseModeFailure);
                 }
 
+                //RFC 6749 §4.1.1 / §4.1.2.1 — response_type selects which grant the
+                //request is for. redirect_uri is already parsed at this point, so an
+                //unsupported response_type is reported as an Authorization Error
+                //Response redirect rather than a bare 400, per §4.1.2.1.
+                fields.TryGetValue(OAuthRequestParameterNames.ResponseType, out string? responseType);
+                if(IsUnsupportedResponseType(responseType))
+                {
+                    return ((FlowInput?)null, (ServerHttpResponse?)await BuildAuthorizeErrorResponseAsync(
+                        server, context, redirectUri, UnsupportedResponseTypeError,
+                        $"response_type '{responseType}' is not supported; this authorization "
+                        + $"server issues '{WellKnownResponseTypes.Code}' only.",
+                        requestState, responseMode, clientId, ct).ConfigureAwait(false));
+                }
+
                 //RFC 9396 / OID4VCI 1.0 §5.1.1 — same shape-validation as the PAR path; on the
                 //direct authorization request the parameter arrives on the front channel itself.
                 string? authorizationDetails = ReadAuthorizationDetails(fields);
@@ -938,6 +966,18 @@ await VerifyAndValidateAuthCodeJarAsync(fields, context, server, ct)
                 }
 
                 AuthCodeRequestObject ro = requestObject!;
+
+                //RFC 6749 §4.1.1 — same response_type gate as the bare PAR path; the
+                //JAR-PAR endpoint returns a JSON error directly, like PAR, rather than
+                //a redirect (there is no front channel at this leg).
+                if(IsUnsupportedResponseType(ro.ResponseType))
+                {
+                    return ((FlowInput?)null, ServerHttpResponse.BadRequest(
+                        UnsupportedResponseTypeError,
+                        $"response_type '{ro.ResponseType}' is not supported; this authorization "
+                        + $"server issues '{WellKnownResponseTypes.Code}' only."));
+                }
+
                 DateTimeOffset now = server.TimeProvider.GetUtcNow();
 
                 string flowId = context.FlowId!;
@@ -1067,6 +1107,18 @@ await VerifyAndValidateAuthCodeJarAsync(fields, context, server, ct)
 
                 AuthCodeRequestObject ro = requestObject!;
 
+                //RFC 6749 §4.1.1 / §4.1.2.1 — same response_type gate as the direct PKCE
+                //path. ro.RedirectUri is already registration-validated inside
+                //VerifyAndValidateAuthCodeJarAsync, so the error is safe to redirect.
+                if(IsUnsupportedResponseType(ro.ResponseType))
+                {
+                    return ((FlowInput?)null, await BuildAuthorizeErrorResponseAsync(
+                        server, context, ro.RedirectUri, UnsupportedResponseTypeError,
+                        $"response_type '{ro.ResponseType}' is not supported; this authorization "
+                        + $"server issues '{WellKnownResponseTypes.Code}' only.",
+                        ro.State, ro.ResponseMode, ro.ClientId, ct).ConfigureAwait(false));
+                }
+
                 //FAPI 2.0 §5.2.2 — when the profile mandates PAR, the JAR-by-value path
                 //is refused; the client must push the request first.
                 if(context.RequirePushedAuthorizationRequests)
@@ -1377,8 +1429,9 @@ await TryIssueJarmResponseJwtAsync(
             return (null, audFailure);
         }
 
-        //RFC 9700 §4.1 — redirect_uri exact-match against the registered set.
-        if(!registration.AllowedRedirectUris.Contains(requestObject.RedirectUri))
+        //RFC 9700 §4.1 — redirect_uri exact-match against the registered set, per
+        //RedirectUriMatching (simple string comparison, not Uri equality).
+        if(!RedirectUriMatching.IsRegisteredExact(registration.AllowedRedirectUris, requestObject.RedirectUri))
         {
             return (null, ServerHttpResponse.BadRequest(
                 OAuthErrors.InvalidRequestObject,
@@ -1537,13 +1590,22 @@ await TryIssueJarmResponseJwtAsync(
     /// request, before the producer loop. The resolved value flows through every
     /// <see cref="IdTokenTarget"/> and <see cref="UserInfoTarget"/> the
     /// contributor walk constructs in this request, so per-rule contributors
-    /// don't each re-issue the resolver call.
+    /// don't each re-issue the resolver call. Gated on <c>openid</c> being in
+    /// <see cref="IssuanceContext.Scope"/>: the app's OIDC-claims resolver carries
+    /// end-user identity data, so it must not run for a request that never asked
+    /// for identity, per the data-minimization principle in
+    /// <see cref="WellKnownScopes"/>.
     /// </summary>
     private static async ValueTask<OidcClaims?> PreResolveOidcClaimsAsync(
         EndpointServer server,
         IssuanceContext issuance,
         CancellationToken cancellationToken)
     {
+        if(!WellKnownScopes.ContainsOpenId(issuance.Scope))
+        {
+            return null;
+        }
+
         var oauth = server.OAuth();
         ResolveOidcClaimsDelegate? resolve = oauth.ResolveOidcClaimsAsync;
         if(resolve is null)
@@ -1623,6 +1685,209 @@ private static async ValueTask MergeContributedClaimsAsync(
     }
 
 
+    /// <summary>
+    /// The result of a successful <see cref="IssueTokensAsync"/> walk: every token minted for
+    /// the request, keyed by <see cref="TokenProducer.ResponseField"/>, alongside the matching
+    /// per-token audit record and the latest <c>exp</c> across all issued tokens.
+    /// </summary>
+    private sealed record TokenIssuanceResult
+    {
+        /// <summary>The compact JWS of each issued token, keyed by response field name.</summary>
+        public required Dictionary<string, string> IssuedTokens { get; init; }
+
+        /// <summary>The <see cref="IssuedTokenAudit"/> of each issued token, keyed by response field name.</summary>
+        public required Dictionary<string, IssuedTokenAudit> IssuedAudits { get; init; }
+
+        /// <summary>The latest <c>exp</c> among every token issued in this walk.</summary>
+        public required DateTimeOffset LatestExpiry { get; init; }
+    }
+
+
+    /// <summary>
+    /// Walks <paramref name="producers"/> and mints every applicable token for
+    /// <paramref name="issuance"/>: the per-producer optional-capability feature gate and
+    /// <see cref="TokenProducer.IsApplicable"/> filter, key resolution
+    /// (<see cref="SigningKeySelection.ResolveSigningKeyIdAsync"/> +
+    /// <see cref="AuthorizationServerCryptography.SigningKeyResolver"/>), algorithm derivation,
+    /// <see cref="TokenProducer.BuildAsync"/>, the claim-contributor merge
+    /// (<see cref="BuildTargetForProducer"/> + <see cref="MergeContributedClaimsAsync"/>),
+    /// <see cref="UnsignedJwt.SignAsync"/>, and compact serialization. Shared by all six grants
+    /// that mint tokens through the producer set — the walk is identical across grants; only
+    /// the <see cref="IssuanceContext"/> construction before it and the response shaping after
+    /// it are grant-specific.
+    /// </summary>
+    /// <returns>
+    /// The <see cref="TokenIssuanceResult"/> on success; a <see cref="ServerHttpResponse"/>
+    /// <c>server_error</c> failure when a producer's signing key could not be resolved.
+    /// </returns>
+    private static async ValueTask<(TokenIssuanceResult? Result, ServerHttpResponse? Failure)> IssueTokensAsync(
+        EndpointServer server,
+        ClientRecord registration,
+        ExchangeContext context,
+        IssuanceContext issuance,
+        IReadOnlyList<TokenProducer> producers,
+        OidcClaims? preResolvedOidcClaims,
+        DateTimeOffset now,
+        CancellationToken cancellationToken)
+    {
+        var oauth = server.OAuth();
+
+        Dictionary<string, string> issuedTokens = new(producers.Count);
+        Dictionary<string, IssuedTokenAudit> issuedAudits = new(producers.Count);
+        DateTimeOffset latestExpiry = now;
+
+        foreach(TokenProducer producer in producers)
+        {
+            //RequiredCapability is an optional coarse tenant-feature gate (null = every tenant
+            //may run this producer); when set, the resolver's per-request ResolvedCapabilities
+            //output must allow it — CAEP/RISC attenuation between issuance steps applies here,
+            //not just the registration's static AllowedCapabilities. IsApplicable is the
+            //producer's own grant/scope-aware decision (for example the ID Token producer's
+            //openid + end-user-authenticating-grant check). Together these replace the single
+            //endpoint-level capability match, which only gated the grant itself.
+            IReadOnlySet<CapabilityIdentifier>? resolved = context.ResolvedCapabilities;
+            if(producer.RequiredCapability is { } requiredCapability
+                && (resolved is null || !resolved.Contains(requiredCapability)))
+            {
+                continue;
+            }
+
+            if(!await producer.IsApplicable(issuance, cancellationToken).ConfigureAwait(false))
+            {
+                continue;
+            }
+
+            KeyId signingKeyId = await SigningKeySelection.ResolveSigningKeyIdAsync(
+                server, registration, producer.KeyUsage, context, cancellationToken)
+                .ConfigureAwait(false);
+
+            PrivateKeyMemory? signingKey = await oauth.Cryptography.SigningKeyResolver!(
+                signingKeyId, registration.TenantId, context, cancellationToken).ConfigureAwait(false);
+
+            if(signingKey is null)
+            {
+                return (null, ServerHttpResponse.ServerError(
+                    OAuthErrors.ServerError,
+                    $"Signing key unavailable for producer '{producer.Name}'."));
+            }
+
+            string algorithm = CryptoFormatConversions.DefaultTagToJwaConverter(signingKey.Tag);
+
+            TokenProducerOutput output = await producer.BuildAsync(
+                issuance, signingKeyId, algorithm, cancellationToken).ConfigureAwait(false);
+
+            JwtPayload payload = output.Payload;
+
+            ClaimContributionTarget? contributionTarget =
+                BuildTargetForProducer(producer, issuance, preResolvedOidcClaims);
+            await MergeContributedClaimsAsync(
+                server, contributionTarget, payload, cancellationToken).ConfigureAwait(false);
+
+            UnsignedJwt unsigned = new(output.Header, payload);
+
+            using JwsMessage jws = await unsigned.SignAsync(
+                signingKey,
+                oauth.Codecs.JwtHeaderSerializer!,
+                oauth.Codecs.JwtPayloadSerializer!,
+                oauth.Codecs.Encoder!,
+                BaseMemoryPool.Shared,
+                cancellationToken).ConfigureAwait(false);
+
+            string compactJws = JwsSerialization.SerializeCompact(jws, oauth.Codecs.Encoder!);
+
+            issuedTokens[producer.ResponseField] = compactJws;
+
+            string jti = ExtractJti(payload);
+            DateTimeOffset issuedAt = ExtractInstant(payload, WellKnownJwtClaimNames.Iat, now);
+            DateTimeOffset expiresAt = ExtractInstant(payload, WellKnownJwtClaimNames.Exp, now);
+
+            issuedAudits[producer.ResponseField] = new IssuedTokenAudit
+            {
+                Jti = jti,
+                SigningKeyId = signingKeyId.Value,
+                IssuedAt = issuedAt,
+                ExpiresAt = expiresAt
+            };
+
+            if(expiresAt > latestExpiry)
+            {
+                latestExpiry = expiresAt;
+            }
+        }
+
+        return (new TokenIssuanceResult
+        {
+            IssuedTokens = issuedTokens,
+            IssuedAudits = issuedAudits,
+            LatestExpiry = latestExpiry
+        }, null);
+    }
+
+
+    /// <summary>
+    /// RFC 6749 §3.3 scope narrowing for the library's non-end-user grants —
+    /// <c>client_credentials</c> (subject is the client itself) and <c>pre_authorized_code</c>
+    /// (no established End-User session). Drops <c>openid</c> and the OIDC Core §5.4 identity
+    /// scopes (<c>profile</c> / <c>email</c> / <c>address</c> / <c>phone</c>) from
+    /// <paramref name="grantedScope"/> so the source enforces the <c>openid</c> ⇒
+    /// authenticated-end-user invariant; <see cref="Oidc10IdTokenProducer"/> and
+    /// <see cref="Oidc.UserInfoEndpoints"/> are the two independent consumer-side layers of the
+    /// same invariant. <c>token_exchange</c> and <c>jwt_bearer</c> do not call this — their
+    /// authorization seams (<see cref="AuthorizationServerIntegration.AuthorizeTokenExchangeAsync"/>,
+    /// <see cref="AuthorizationServerIntegration.ValidateJwtBearerAssertionAsync"/>) own whether
+    /// the subject is an End-User, and the app opts in by granting <c>openid</c> itself.
+    /// </summary>
+    /// <returns>
+    /// <paramref name="grantedScope"/> unchanged when it carries none of the dropped scopes;
+    /// otherwise the narrowed scope string with those tokens removed. Emits
+    /// <see cref="OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant"/> naming the dropped
+    /// scopes when narrowing occurred.
+    /// </returns>
+    private static string DropIdentityScopesForNonEndUserGrant(string grantedScope)
+    {
+        if(string.IsNullOrEmpty(grantedScope))
+        {
+            return grantedScope;
+        }
+
+        string[] tokens = grantedScope.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+        List<string> retained = new(tokens.Length);
+        List<string>? dropped = null;
+
+        foreach(string token in tokens)
+        {
+            bool isIdentityScope = WellKnownScopes.IsOpenId(token)
+                || WellKnownScopes.IsProfile(token)
+                || WellKnownScopes.IsEmail(token)
+                || WellKnownScopes.IsAddress(token)
+                || WellKnownScopes.IsPhone(token);
+
+            if(isIdentityScope)
+            {
+                (dropped ??= []).Add(token);
+                continue;
+            }
+
+            retained.Add(token);
+        }
+
+        if(dropped is null)
+        {
+            return grantedScope;
+        }
+
+        System.Diagnostics.Activity.Current?.AddEvent(
+            new System.Diagnostics.ActivityEvent(
+                OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant,
+                tags: new System.Diagnostics.ActivityTagsCollection
+                {
+                    [OAuthEventNames.DroppedScopesTagName] = string.Join(' ', dropped)
+                }));
+
+        return string.Join(' ', retained);
+    }
+
+
     /// <summary>
     /// Builds the Token endpoint per
     /// <see href="https://www.rfc-editor.org/rfc/rfc6749#section-5.1">RFC 6749 §5.1</see>.
@@ -1728,6 +1993,18 @@ private static EndpointCandidate BuildToken() =>
                         OAuthErrors.InvalidClient, "Unknown client."));
                 }
 
+                //draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-049/050): a
+                //registration that declares a non-None token_endpoint_auth_method is a
+                //confidential client, and every token-endpoint communication MUST include
+                //client authentication of that type. Null/None is the PKCE-only public
+                //client shape and keeps today's behavior unchanged.
+                ServerHttpResponse? clientAuthFailure = await RequireClientAuthenticationIfDeclaredAsync(
+                    oauth, context.IncomingRequest, fields, registration, context, ct).ConfigureAwait(false);
+                if(clientAuthFailure is not null)
+                {
+                    return (null, clientAuthFailure);
+                }
+
                 Uri issuerUri;
                 try
                 {
@@ -1814,6 +2091,7 @@ await ResolveGrantedAuthorizationDetailsAsync(
                     Subject = codeState.SubjectId,
                     Scope = codeState.Scope,
                     ClientId = codeState.ClientId,
+                    GrantType = WellKnownGrantTypes.AuthorizationCode,
                     IssuedAt = now,
                     Nonce = string.IsNullOrEmpty(codeState.Nonce) ? null : codeState.Nonce,
                     AuthTime = codeState.AuthTime,
@@ -1832,97 +2110,20 @@ await ResolveGrantedAuthorizationDetailsAsync(
                 OidcClaims? preResolvedOidcClaims = await PreResolveOidcClaimsAsync(
                     server, issuance, ct).ConfigureAwait(false);
 
-                Dictionary<string, string> issuedTokens = new(producers.Count);
-                Dictionary<string, IssuedTokenAudit> issuedAudits = new(producers.Count);
-                DateTimeOffset latestExpiry = now;
-
-                foreach(TokenProducer producer in producers)
-                {
-                    //Per-producer capability filter. The chain-level filter via
-                    //ResolveCapabilitiesAsync gated the token *endpoint* itself
-                    //on the AuthorizationCode capability; the producer loop here
-                    //gates each individual token producer (access token, ID
-                    //token, refresh token) on its own RequiredCapability so the
-                    //response contains only the token shapes this request is
-                    //allowed to issue. Reads the resolver's per-request output
-                    //(stashed by EndpointChain.BuildForRequestAsync) rather
-                    //than the registration's static AllowedCapabilities — CAEP/
-                    //RISC attenuation between issuance steps applies here.
-                    IReadOnlySet<CapabilityIdentifier>? resolved =
-                        context.ResolvedCapabilities;
-                    if(resolved is null || !resolved.Contains(producer.RequiredCapability))
-                    {
-                        continue;
-                    }
-
-                    if(!await producer.IsApplicable(issuance, ct).ConfigureAwait(false))
-                    {
-                        continue;
-                    }
-
-                    KeyId signingKeyId = await SigningKeySelection.ResolveSigningKeyIdAsync(
-                        server, registration, producer.KeyUsage, context, ct)
+                (TokenIssuanceResult? issuanceResult, ServerHttpResponse? issuanceFailure) =
+                    await IssueTokensAsync(
+                        server, registration, context, issuance, producers, preResolvedOidcClaims, now, ct)
                         .ConfigureAwait(false);
-
-                    PrivateKeyMemory? signingKey = await oauth.Cryptography.SigningKeyResolver!(
-                        signingKeyId, registration.TenantId, context, ct).ConfigureAwait(false);
-
-                    if(signingKey is null)
-                    {
-                        return (null, ServerHttpResponse.ServerError(
-                            OAuthErrors.ServerError,
-                            $"Signing key unavailable for producer '{producer.Name}'."));
-                    }
-
-                    string algorithm =
-                        CryptoFormatConversions.DefaultTagToJwaConverter(signingKey.Tag);
-
-                    TokenProducerOutput output = await producer.BuildAsync(
-                        issuance, signingKeyId, algorithm, ct).ConfigureAwait(false);
-
-                    JwtPayload payload = output.Payload;
-
-                    //Composed contributor walk via AuthorizationServerIntegration.ClaimIssuer.
-                    //Emits scope-driven extension claims (profile / email /
-                    //address / phone / cnf / acr / amr) after the producer
-                    //returned its spec-mandated baseline.
-                    ClaimContributionTarget? contributionTarget =
-                        BuildTargetForProducer(producer, issuance, preResolvedOidcClaims);
-                    await MergeContributedClaimsAsync(
-                        server, contributionTarget, payload, ct).ConfigureAwait(false);
-
-                    UnsignedJwt unsigned = new(output.Header, payload);
-
-                    using JwsMessage jws = await unsigned.SignAsync(
-                        signingKey,
-                        oauth.Codecs.JwtHeaderSerializer!,
-                        oauth.Codecs.JwtPayloadSerializer!,
-                        oauth.Codecs.Encoder!,
-                        BaseMemoryPool.Shared,
-                        ct).ConfigureAwait(false);
-
-                    string compactJws = JwsSerialization.SerializeCompact(jws, oauth.Codecs.Encoder!);
-
-                    issuedTokens[producer.ResponseField] = compactJws;
-
-                    string jti = ExtractJti(payload);
-                    DateTimeOffset issuedAt = ExtractInstant(payload, WellKnownJwtClaimNames.Iat, now);
-                    DateTimeOffset expiresAt = ExtractInstant(payload, WellKnownJwtClaimNames.Exp, now);
-
-                    issuedAudits[producer.ResponseField] = new IssuedTokenAudit
-                    {
-                        Jti = jti,
-                        SigningKeyId = signingKeyId.Value,
-                        IssuedAt = issuedAt,
-                        ExpiresAt = expiresAt
-                    };
-
-                    if(expiresAt > latestExpiry)
-                    {
-                        latestExpiry = expiresAt;
-                    }
+                if(issuanceFailure is not null)
+                {
+                    return (null, issuanceFailure);
                 }
 
+                TokenIssuanceResult issued = issuanceResult!;
+                Dictionary<string, string> issuedTokens = issued.IssuedTokens;
+                Dictionary<string, IssuedTokenAudit> issuedAudits = issued.IssuedAudits;
+                DateTimeOffset latestExpiry = issued.LatestExpiry;
+
                 if(issuedTokens.Count == 0)
                 {
                     return (null, ServerHttpResponse.ServerError(
@@ -1963,7 +2164,9 @@ await MergeContributedClaimsAsync(
                         Scope = codeState.Scope,
                         Confirmation = confirmation,
                         AuthTime = codeState.AuthTime,
+                        SessionId = codeState.SessionId,
                         Acr = codeState.Acr,
+                        OriginatingGrantType = WellKnownGrantTypes.AuthorizationCode,
                         //RFC 9396 §11.2: granted authorization_details are stored as part of the
                         //grant so the refresh exchange can re-emit the §7 echo and §9.1 claim. The
                         //baseline a later refresh narrows against is the resource owner's
@@ -2193,6 +2396,11 @@ private static EndpointCandidate BuildClientCredentials() =>
                     grantedScope = string.Join(' ', registration.AllowedScopes);
                 }
 
+                //RFC 6749 §3.3 narrowing — client_credentials has no authenticated End-User (the
+                //subject is the client itself), so openid and the identity scopes never reach the
+                //granted set. See DropIdentityScopesForNonEndUserGrant's remarks for the invariant.
+                grantedScope = DropIdentityScopesForNonEndUserGrant(grantedScope);
+
                 //RFC 9396 §6: "The AS checks whether ... the client's policy (in case of grant
                 //type client_credentials) allows the issuance of an access token with the
                 //requested authorization details. Otherwise, the AS refuses the request with the
@@ -2250,6 +2458,7 @@ private static EndpointCandidate BuildClientCredentials() =>
                     Subject = registration.ClientId,
                     Scope = grantedScope,
                     ClientId = registration.ClientId,
+                    GrantType = WellKnownGrantTypes.ClientCredentials,
                     IssuedAt = now
                 };
 
@@ -2261,67 +2470,18 @@ private static EndpointCandidate BuildClientCredentials() =>
                 OidcClaims? preResolvedOidcClaims = await PreResolveOidcClaimsAsync(
                     server, issuance, ct).ConfigureAwait(false);
 
-                Dictionary<string, string> issuedTokens = new(producers.Count);
-                int expiresIn = 0;
-
-                foreach(TokenProducer producer in producers)
+                (TokenIssuanceResult? issuanceResult, ServerHttpResponse? issuanceFailure) =
+                    await IssueTokensAsync(
+                        server, registration, context, issuance, producers, preResolvedOidcClaims, now, ct)
+                        .ConfigureAwait(false);
+                if(issuanceFailure is not null)
                 {
-                    //Per-producer capability filter — see BuildToken for the
-                    //rationale; reads the resolver's per-request output so
-                    //capability attenuation applies to this grant too.
-                    IReadOnlySet<CapabilityIdentifier>? resolved =
-                        context.ResolvedCapabilities;
-                    if(resolved is null || !resolved.Contains(producer.RequiredCapability))
-                    {
-                        continue;
-                    }
-
-                    if(!await producer.IsApplicable(issuance, ct).ConfigureAwait(false))
-                    {
-                        continue;
-                    }
-
-                    KeyId signingKeyId = await SigningKeySelection.ResolveSigningKeyIdAsync(
-                        server, registration, producer.KeyUsage, context, ct).ConfigureAwait(false);
-                    PrivateKeyMemory? signingKey = await oauth.Cryptography.SigningKeyResolver!(
-                        signingKeyId, registration.TenantId, context, ct).ConfigureAwait(false);
-                    if(signingKey is null)
-                    {
-                        return (null, ServerHttpResponse.ServerError(
-                            OAuthErrors.ServerError,
-                            $"Signing key unavailable for producer '{producer.Name}'."));
-                    }
-
-                    string algorithm = CryptoFormatConversions.DefaultTagToJwaConverter(signingKey.Tag);
-                    TokenProducerOutput output = await producer.BuildAsync(
-                        issuance, signingKeyId, algorithm, ct).ConfigureAwait(false);
-                    JwtPayload payload = output.Payload;
-
-                    ClaimContributionTarget? contributionTarget =
-                        BuildTargetForProducer(producer, issuance, preResolvedOidcClaims);
-                    await MergeContributedClaimsAsync(
-                        server, contributionTarget, payload, ct).ConfigureAwait(false);
-
-                    UnsignedJwt unsigned = new(output.Header, payload);
-                    using JwsMessage jws = await unsigned.SignAsync(
-                        signingKey,
-                        oauth.Codecs.JwtHeaderSerializer!,
-                        oauth.Codecs.JwtPayloadSerializer!,
-                        oauth.Codecs.Encoder!,
-                        BaseMemoryPool.Shared,
-                        ct).ConfigureAwait(false);
-
-                    string compactJws = JwsSerialization.SerializeCompact(jws, oauth.Codecs.Encoder!);
-                    issuedTokens[producer.ResponseField] = compactJws;
-
-                    if(WellKnownTokenTypes.IsAccessToken(producer.ResponseField))
-                    {
-                        DateTimeOffset issuedAtClaim = ExtractInstant(payload, WellKnownJwtClaimNames.Iat, now);
-                        DateTimeOffset expiresAtClaim = ExtractInstant(payload, WellKnownJwtClaimNames.Exp, now);
-                        expiresIn = (int)(expiresAtClaim - issuedAtClaim).TotalSeconds;
-                    }
+                    return (null, issuanceFailure);
                 }
 
+                TokenIssuanceResult issued = issuanceResult!;
+                Dictionary<string, string> issuedTokens = issued.IssuedTokens;
+
                 if(!issuedTokens.TryGetValue(WellKnownTokenTypes.AccessToken, out string? accessToken))
                 {
                     return (null, ServerHttpResponse.ServerError(
@@ -2329,6 +2489,11 @@ await MergeContributedClaimsAsync(
                         "No access token was produced for the client_credentials grant."));
                 }
 
+                int expiresIn = issued.IssuedAudits.TryGetValue(
+                    WellKnownTokenTypes.AccessToken, out IssuedTokenAudit? accessAudit)
+                    ? (int)(accessAudit.ExpiresAt - accessAudit.IssuedAt).TotalSeconds
+                    : 0;
+
                 //RFC 6749 §4.4.3/§5.1: access_token, token_type, expires_in, and
                 //the granted scope; the response is stateless and uncacheable.
                 StringBuilder sb = JsonAppender.Rent();
@@ -2749,6 +2914,7 @@ private static EndpointCandidate BuildTokenExchange() =>
                     Subject = authorization.Subject,
                     Scope = authorization.Scope,
                     ClientId = registration.ClientId,
+                    GrantType = WellKnownGrantTypes.TokenExchange,
                     IssuedAt = now,
                     Act = act,
 
@@ -2766,67 +2932,18 @@ private static EndpointCandidate BuildTokenExchange() =>
                 OidcClaims? preResolvedOidcClaims = await PreResolveOidcClaimsAsync(
                     server, issuance, ct).ConfigureAwait(false);
 
-                Dictionary<string, string> issuedTokens = new(producers.Count);
-                int expiresIn = 0;
-
-                foreach(TokenProducer producer in producers)
+                (TokenIssuanceResult? issuanceResult, ServerHttpResponse? issuanceFailure) =
+                    await IssueTokensAsync(
+                        server, registration, context, issuance, producers, preResolvedOidcClaims, now, ct)
+                        .ConfigureAwait(false);
+                if(issuanceFailure is not null)
                 {
-                    //Per-producer capability filter — see BuildToken for the
-                    //rationale; reads the resolver's per-request output so
-                    //capability attenuation applies to this grant too.
-                    IReadOnlySet<CapabilityIdentifier>? resolved =
-                        context.ResolvedCapabilities;
-                    if(resolved is null || !resolved.Contains(producer.RequiredCapability))
-                    {
-                        continue;
-                    }
-
-                    if(!await producer.IsApplicable(issuance, ct).ConfigureAwait(false))
-                    {
-                        continue;
-                    }
-
-                    KeyId signingKeyId = await SigningKeySelection.ResolveSigningKeyIdAsync(
-                        server, registration, producer.KeyUsage, context, ct).ConfigureAwait(false);
-                    PrivateKeyMemory? signingKey = await oauth.Cryptography.SigningKeyResolver!(
-                        signingKeyId, registration.TenantId, context, ct).ConfigureAwait(false);
-                    if(signingKey is null)
-                    {
-                        return (null, ServerHttpResponse.ServerError(
-                            OAuthErrors.ServerError,
-                            $"Signing key unavailable for producer '{producer.Name}'."));
-                    }
-
-                    string algorithm = CryptoFormatConversions.DefaultTagToJwaConverter(signingKey.Tag);
-                    TokenProducerOutput output = await producer.BuildAsync(
-                        issuance, signingKeyId, algorithm, ct).ConfigureAwait(false);
-                    JwtPayload payload = output.Payload;
-
-                    ClaimContributionTarget? contributionTarget =
-                        BuildTargetForProducer(producer, issuance, preResolvedOidcClaims);
-                    await MergeContributedClaimsAsync(
-                        server, contributionTarget, payload, ct).ConfigureAwait(false);
-
-                    UnsignedJwt unsigned = new(output.Header, payload);
-                    using JwsMessage jws = await unsigned.SignAsync(
-                        signingKey,
-                        oauth.Codecs.JwtHeaderSerializer!,
-                        oauth.Codecs.JwtPayloadSerializer!,
-                        oauth.Codecs.Encoder!,
-                        BaseMemoryPool.Shared,
-                        ct).ConfigureAwait(false);
-
-                    string compactJws = JwsSerialization.SerializeCompact(jws, oauth.Codecs.Encoder!);
-                    issuedTokens[producer.ResponseField] = compactJws;
-
-                    if(WellKnownTokenTypes.IsAccessToken(producer.ResponseField))
-                    {
-                        DateTimeOffset issuedAtClaim = ExtractInstant(payload, WellKnownJwtClaimNames.Iat, now);
-                        DateTimeOffset expiresAtClaim = ExtractInstant(payload, WellKnownJwtClaimNames.Exp, now);
-                        expiresIn = (int)(expiresAtClaim - issuedAtClaim).TotalSeconds;
-                    }
+                    return (null, issuanceFailure);
                 }
 
+                TokenIssuanceResult issued = issuanceResult!;
+                Dictionary<string, string> issuedTokens = issued.IssuedTokens;
+
                 if(!issuedTokens.TryGetValue(WellKnownTokenTypes.AccessToken, out string? accessToken))
                 {
                     return (null, ServerHttpResponse.ServerError(
@@ -2834,6 +2951,11 @@ await MergeContributedClaimsAsync(
                         "No access token was produced for the token-exchange grant."));
                 }
 
+                int expiresIn = issued.IssuedAudits.TryGetValue(
+                    WellKnownTokenTypes.AccessToken, out IssuedTokenAudit? accessAudit)
+                    ? (int)(accessAudit.ExpiresAt - accessAudit.IssuedAt).TotalSeconds
+                    : 0;
+
                 //RFC 8693 §2.2.1: access_token, issued_token_type, token_type, expires_in, scope.
                 //token_type is Bearer (RFC 6750); issued_token_type is the wire URI of the type the
                 //authorization seam decided. The response is stateless and uncacheable.
@@ -2954,7 +3076,8 @@ await MergeContributedClaimsAsync(
                 RefreshToken = refreshToken,
                 IssuedAt = now,
                 SubjectId = authorization.Subject,
-                Scope = authorization.Scope
+                Scope = authorization.Scope,
+                OriginatingGrantType = WellKnownGrantTypes.TokenExchange
             };
             await oauth.SaveFlowStateAsync(
                 registration.TenantId, refreshFlowId, refreshState, stepCount: 0, context, cancellationToken).ConfigureAwait(false);
@@ -3328,15 +3451,23 @@ private static EndpointCandidate BuildJwtBearer() =>
                         OAuthErrors.InvalidClient, "Client identification is required for the jwt-bearer grant."));
                 }
 
-                //RFC 7523 §3.1: "if client credentials are present in the request, the authorization
+                //RFC 7523 §3.1 composed with draft-ietf-oauth-client-id-metadata-document-02 §8.2
+                //(CIMD-049): "if client credentials are present in the request, the authorization
                 //server MUST validate them." Client authentication is OPTIONAL for this grant (the
-                //assertion is the grant), so credentials are validated only when present — an
-                //anonymous request proceeds. Presence is an Authorization header (client_secret_basic /
+                //assertion is the grant), so a credential-less request from a client whose effective
+                //registration declares no token_endpoint_auth_method (or declares None) proceeds as
+                //anonymous. Presence is an Authorization header (client_secret_basic /
                 //private_key_jwt / mTLS) OR a client_secret / client_assertion form field; the seam owns
                 //the method and the comparison. When credentials ARE present they MUST be validated:
                 //if the client-authentication seam is not configured, the request cannot proceed as
                 //anonymous (that would silently ignore presented credentials, a §3.1 MUST bypass), so it
                 //is refused with 401 invalid_client. A present-but-invalid credential is 401 invalid_client.
+                //When credentials are ABSENT and the effective (possibly CIMD-materialized) registration
+                //declares a non-None token_endpoint_auth_method, the client is confidential and CIMD-049's
+                //"any communication with the authorization server MUST include client authentication of
+                //the registered type" governs: RequireClientAuthenticationIfDeclaredAsync refuses the
+                //request with 401 invalid_client, fail-closed. The two branches are disjoint, so
+                //credentials are never validated twice.
                 if(HasClientCredentials(context.IncomingRequest, fields))
                 {
                     if(oauth.ValidateClientCredentialsAsync is null)
@@ -3354,6 +3485,15 @@ private static EndpointCandidate BuildJwtBearer() =>
                             OAuthErrors.InvalidClient, "Client authentication failed."));
                     }
                 }
+                else
+                {
+                    ServerHttpResponse? declaredAuthFailure = await RequireClientAuthenticationIfDeclaredAsync(
+                        oauth, context.IncomingRequest, fields, registration, context, ct).ConfigureAwait(false);
+                    if(declaredAuthFailure is not null)
+                    {
+                        return (null, declaredAuthFailure);
+                    }
+                }
 
                 //RFC 7523 §2.1: the assertion parameter is REQUIRED and "MUST contain a single JWT."
                 if(!fields.TryGetValue(OAuthRequestParameterNames.Assertion, out string? assertion)
@@ -3485,6 +3625,7 @@ private static EndpointCandidate BuildJwtBearer() =>
                     Subject = grant.Subject,
                     Scope = grant.Scope,
                     ClientId = registration.ClientId,
+                    GrantType = WellKnownGrantTypes.JwtBearer,
                     IssuedAt = now,
                     Audience = grant.Audience is { Count: > 0 } ? grant.Audience : null,
                     Confirmation = tokenConfirmation
@@ -3498,66 +3639,18 @@ private static EndpointCandidate BuildJwtBearer() =>
                 OidcClaims? preResolvedOidcClaims = await PreResolveOidcClaimsAsync(
                     server, issuance, ct).ConfigureAwait(false);
 
-                Dictionary<string, string> issuedTokens = new(producers.Count);
-                int expiresIn = 0;
-
-                foreach(TokenProducer producer in producers)
+                (TokenIssuanceResult? issuanceResult, ServerHttpResponse? issuanceFailure) =
+                    await IssueTokensAsync(
+                        server, registration, context, issuance, producers, preResolvedOidcClaims, now, ct)
+                        .ConfigureAwait(false);
+                if(issuanceFailure is not null)
                 {
-                    //Per-producer capability filter — see BuildToken for the rationale; reads the
-                    //resolver's per-request output so capability attenuation applies to this grant too.
-                    IReadOnlySet<CapabilityIdentifier>? resolved =
-                        context.ResolvedCapabilities;
-                    if(resolved is null || !resolved.Contains(producer.RequiredCapability))
-                    {
-                        continue;
-                    }
-
-                    if(!await producer.IsApplicable(issuance, ct).ConfigureAwait(false))
-                    {
-                        continue;
-                    }
-
-                    KeyId signingKeyId = await SigningKeySelection.ResolveSigningKeyIdAsync(
-                        server, registration, producer.KeyUsage, context, ct).ConfigureAwait(false);
-                    PrivateKeyMemory? signingKey = await oauth.Cryptography.SigningKeyResolver!(
-                        signingKeyId, registration.TenantId, context, ct).ConfigureAwait(false);
-                    if(signingKey is null)
-                    {
-                        return (null, ServerHttpResponse.ServerError(
-                            OAuthErrors.ServerError,
-                            $"Signing key unavailable for producer '{producer.Name}'."));
-                    }
-
-                    string algorithm = CryptoFormatConversions.DefaultTagToJwaConverter(signingKey.Tag);
-                    TokenProducerOutput output = await producer.BuildAsync(
-                        issuance, signingKeyId, algorithm, ct).ConfigureAwait(false);
-                    JwtPayload payload = output.Payload;
-
-                    ClaimContributionTarget? contributionTarget =
-                        BuildTargetForProducer(producer, issuance, preResolvedOidcClaims);
-                    await MergeContributedClaimsAsync(
-                        server, contributionTarget, payload, ct).ConfigureAwait(false);
-
-                    UnsignedJwt unsigned = new(output.Header, payload);
-                    using JwsMessage jws = await unsigned.SignAsync(
-                        signingKey,
-                        oauth.Codecs.JwtHeaderSerializer!,
-                        oauth.Codecs.JwtPayloadSerializer!,
-                        oauth.Codecs.Encoder!,
-                        BaseMemoryPool.Shared,
-                        ct).ConfigureAwait(false);
-
-                    string compactJws = JwsSerialization.SerializeCompact(jws, oauth.Codecs.Encoder!);
-                    issuedTokens[producer.ResponseField] = compactJws;
-
-                    if(WellKnownTokenTypes.IsAccessToken(producer.ResponseField))
-                    {
-                        DateTimeOffset issuedAtClaim = ExtractInstant(payload, WellKnownJwtClaimNames.Iat, now);
-                        DateTimeOffset expiresAtClaim = ExtractInstant(payload, WellKnownJwtClaimNames.Exp, now);
-                        expiresIn = (int)(expiresAtClaim - issuedAtClaim).TotalSeconds;
-                    }
+                    return (null, issuanceFailure);
                 }
 
+                TokenIssuanceResult issued = issuanceResult!;
+                Dictionary<string, string> issuedTokens = issued.IssuedTokens;
+
                 if(!issuedTokens.TryGetValue(WellKnownTokenTypes.AccessToken, out string? accessToken))
                 {
                     return (null, ServerHttpResponse.ServerError(
@@ -3565,6 +3658,11 @@ await MergeContributedClaimsAsync(
                         "No access token was produced for the jwt-bearer grant."));
                 }
 
+                int expiresIn = issued.IssuedAudits.TryGetValue(
+                    WellKnownTokenTypes.AccessToken, out IssuedTokenAudit? accessAudit)
+                    ? (int)(accessAudit.ExpiresAt - accessAudit.IssuedAt).TotalSeconds
+                    : 0;
+
                 //RFC 6749 §5.1: a plain access-token response — access_token, token_type Bearer,
                 //expires_in, scope. No issued_token_type (that is the token-exchange §2.2.1 field).
                 //The response is stateless and uncacheable.
@@ -3636,6 +3734,54 @@ private static bool HasClientCredentials(IncomingRequest? request, RequestFields
     }
 
 
+    /// <summary>
+    /// Enforces draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-049/050) at the
+    /// authorization_code, refresh_token, and jwt-bearer grants: when the effective registration
+    /// declares a non-<see cref="ClientAuthenticationMethod.None"/> <c>token_endpoint_auth_method</c>,
+    /// this is a confidential client and "any communication with the authorization server MUST include
+    /// client authentication of the registered type." <see cref="AuthorizationServerIntegration.ValidateClientCredentialsAsync"/>
+    /// must be wired AND must return <see langword="true"/>; an unwired seam is a fail-closed
+    /// <c>401 invalid_client</c>, never silent passthrough. A <see langword="null"/> or
+    /// <see cref="ClientAuthenticationMethod.None"/> method leaves the PKCE-only public-client
+    /// behavior byte-identical — this method returns <see langword="null"/> immediately. The
+    /// jwt-bearer grant invokes this only when the request carries no credentials: RFC 7523 §3.1's
+    /// validate-if-present rule authenticates a credential-bearing request on its own path, so the
+    /// declared-method requirement composes with it without validating the same credentials twice.
+    /// </summary>
+    private static async ValueTask<ServerHttpResponse?> RequireClientAuthenticationIfDeclaredAsync(
+        AuthorizationServerIntegration oauth,
+        IncomingRequest? request,
+        RequestFields fields,
+        ClientRecord registration,
+        ExchangeContext context,
+        CancellationToken cancellationToken)
+    {
+        if(registration.TokenEndpointAuthMethod is not { } authMethod
+            || authMethod == ClientAuthenticationMethod.None)
+        {
+            return null;
+        }
+
+        if(oauth.ValidateClientCredentialsAsync is null)
+        {
+            return ServerHttpResponse.Unauthorized(
+                OAuthErrors.InvalidClient,
+                "This client declared a confidential token_endpoint_auth_method but client "
+                + "authentication is not configured for this authorization server.");
+        }
+
+        bool clientAuthenticated = await oauth.ValidateClientCredentialsAsync(
+            request, fields, registration, context, cancellationToken).ConfigureAwait(false);
+        if(!clientAuthenticated)
+        {
+            return ServerHttpResponse.Unauthorized(
+                OAuthErrors.InvalidClient, "Client authentication failed.");
+        }
+
+        return null;
+    }
+
+
     /// <summary>
     /// Builds the OID4VCI 1.0 §6 Pre-Authorized Code grant candidate on the shared token
     /// endpoint URL. Stateless: the Wallet presents a <c>pre-authorized_code</c> (and
@@ -3796,7 +3942,12 @@ await ResolveGrantedAuthorizationDetailsAsync(
                 //seam-resolved subject), not to the Wallet. An absent scope is the
                 //authorization_details path (§6.1.1); the granted scope, when present,
                 //is echoed in the response.
-                string grantedScope = decision.Scope ?? string.Empty;
+                //
+                //RFC 6749 §3.3 narrowing — the Pre-Authorized Code grant establishes no
+                //authenticated End-User session (there is no prior Authorization Request), so
+                //openid and the identity scopes never reach the granted set. See
+                //DropIdentityScopesForNonEndUserGrant's remarks for the invariant.
+                string grantedScope = DropIdentityScopesForNonEndUserGrant(decision.Scope ?? string.Empty);
 
                 IssuanceContext issuance = new()
                 {
@@ -3806,6 +3957,7 @@ await ResolveGrantedAuthorizationDetailsAsync(
                     Subject = subject,
                     Scope = grantedScope,
                     ClientId = clientId ?? registration.ClientId,
+                    GrantType = WellKnownGrantTypes.PreAuthorizedCode,
                     IssuedAt = now
                 };
 
@@ -3817,67 +3969,18 @@ await ResolveGrantedAuthorizationDetailsAsync(
                 OidcClaims? preResolvedOidcClaims = await PreResolveOidcClaimsAsync(
                     server, issuance, ct).ConfigureAwait(false);
 
-                Dictionary<string, string> issuedTokens = new(producers.Count);
-                int expiresIn = 0;
-
-                foreach(TokenProducer producer in producers)
+                (TokenIssuanceResult? issuanceResult, ServerHttpResponse? issuanceFailure) =
+                    await IssueTokensAsync(
+                        server, registration, context, issuance, producers, preResolvedOidcClaims, now, ct)
+                        .ConfigureAwait(false);
+                if(issuanceFailure is not null)
                 {
-                    //Per-producer capability filter — see BuildToken for the rationale;
-                    //reads the resolver's per-request output so capability attenuation
-                    //applies to this grant too.
-                    IReadOnlySet<CapabilityIdentifier>? resolved =
-                        context.ResolvedCapabilities;
-                    if(resolved is null || !resolved.Contains(producer.RequiredCapability))
-                    {
-                        continue;
-                    }
-
-                    if(!await producer.IsApplicable(issuance, ct).ConfigureAwait(false))
-                    {
-                        continue;
-                    }
-
-                    KeyId signingKeyId = await SigningKeySelection.ResolveSigningKeyIdAsync(
-                        server, registration, producer.KeyUsage, context, ct).ConfigureAwait(false);
-                    PrivateKeyMemory? signingKey = await oauth.Cryptography.SigningKeyResolver!(
-                        signingKeyId, registration.TenantId, context, ct).ConfigureAwait(false);
-                    if(signingKey is null)
-                    {
-                        return (null, ServerHttpResponse.ServerError(
-                            OAuthErrors.ServerError,
-                            $"Signing key unavailable for producer '{producer.Name}'."));
-                    }
-
-                    string algorithm = CryptoFormatConversions.DefaultTagToJwaConverter(signingKey.Tag);
-                    TokenProducerOutput output = await producer.BuildAsync(
-                        issuance, signingKeyId, algorithm, ct).ConfigureAwait(false);
-                    JwtPayload payload = output.Payload;
-
-                    ClaimContributionTarget? contributionTarget =
-                        BuildTargetForProducer(producer, issuance, preResolvedOidcClaims);
-                    await MergeContributedClaimsAsync(
-                        server, contributionTarget, payload, ct).ConfigureAwait(false);
-
-                    UnsignedJwt unsigned = new(output.Header, payload);
-                    using JwsMessage jws = await unsigned.SignAsync(
-                        signingKey,
-                        oauth.Codecs.JwtHeaderSerializer!,
-                        oauth.Codecs.JwtPayloadSerializer!,
-                        oauth.Codecs.Encoder!,
-                        BaseMemoryPool.Shared,
-                        ct).ConfigureAwait(false);
-
-                    string compactJws = JwsSerialization.SerializeCompact(jws, oauth.Codecs.Encoder!);
-                    issuedTokens[producer.ResponseField] = compactJws;
-
-                    if(WellKnownTokenTypes.IsAccessToken(producer.ResponseField))
-                    {
-                        DateTimeOffset issuedAtClaim = ExtractInstant(payload, WellKnownJwtClaimNames.Iat, now);
-                        DateTimeOffset expiresAtClaim = ExtractInstant(payload, WellKnownJwtClaimNames.Exp, now);
-                        expiresIn = (int)(expiresAtClaim - issuedAtClaim).TotalSeconds;
-                    }
+                    return (null, issuanceFailure);
                 }
 
+                TokenIssuanceResult issued = issuanceResult!;
+                Dictionary<string, string> issuedTokens = issued.IssuedTokens;
+
                 if(!issuedTokens.TryGetValue(WellKnownTokenTypes.AccessToken, out string? accessToken))
                 {
                     return (null, ServerHttpResponse.ServerError(
@@ -3885,6 +3988,11 @@ await MergeContributedClaimsAsync(
                         "No access token was produced for the pre-authorized_code grant."));
                 }
 
+                int expiresIn = issued.IssuedAudits.TryGetValue(
+                    WellKnownTokenTypes.AccessToken, out IssuedTokenAudit? accessAudit)
+                    ? (int)(accessAudit.ExpiresAt - accessAudit.IssuedAt).TotalSeconds
+                    : 0;
+
                 //§6.2/RFC 6749 §5.1: access_token, token_type, expires_in, and the granted
                 //scope when one was requested. The c_nonce is deliberately absent — OID4VCI
                 //1.0 moved it to the Nonce Endpoint (§7). The response is uncacheable.
@@ -4582,6 +4690,15 @@ private static EndpointCandidate BuildRefreshToken() =>
                         "client_id does not match the refresh token's bound client."));
                 }
 
+                //draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-049/050) — see
+                //RequireClientAuthenticationIfDeclaredAsync's remarks on BuildToken.
+                ServerHttpResponse? clientAuthFailure = await RequireClientAuthenticationIfDeclaredAsync(
+                    oauth, context.IncomingRequest, fields, registration, context, ct).ConfigureAwait(false);
+                if(clientAuthFailure is not null)
+                {
+                    return (null, clientAuthFailure);
+                }
+
                 Uri issuerUri;
                 try
                 {
@@ -4676,10 +4793,13 @@ await ResolveGrantedAuthorizationDetailsAsync(
                     Subject = storedRefresh.SubjectId,
                     Scope = storedRefresh.Scope,
                     ClientId = storedRefresh.ClientId,
+                    GrantType = WellKnownGrantTypes.RefreshToken,
                     IssuedAt = now,
                     AuthTime = storedRefresh.AuthTime,
+                    SessionId = storedRefresh.SessionId,
                     Acr = storedRefresh.Acr,
-                    Confirmation = confirmation
+                    Confirmation = confirmation,
+                    RefreshTokenOriginatingGrantType = storedRefresh.OriginatingGrantType
                 };
 
                 IReadOnlyList<TokenProducer> producers =
@@ -4692,81 +4812,20 @@ await ResolveGrantedAuthorizationDetailsAsync(
                 OidcClaims? preResolvedOidcClaims = await PreResolveOidcClaimsAsync(
                     server, issuance, ct).ConfigureAwait(false);
 
-                Dictionary<string, string> issuedTokens = new(producers.Count);
-                Dictionary<string, IssuedTokenAudit> issuedAudits = new(producers.Count);
-                DateTimeOffset latestExpiry = now;
-
-                foreach(TokenProducer producer in producers)
+                (TokenIssuanceResult? issuanceResult, ServerHttpResponse? issuanceFailure) =
+                    await IssueTokensAsync(
+                        server, registration, context, issuance, producers, preResolvedOidcClaims, now, ct)
+                        .ConfigureAwait(false);
+                if(issuanceFailure is not null)
                 {
-                    //Per-producer capability filter — see BuildToken for the
-                    //rationale on filtering producers (not the endpoint) here.
-                    //Reads the resolver's per-request output rather than the
-                    //registration's static set, so CAEP/RISC attenuation
-                    //applies to refresh-exchange just as to code-exchange.
-                    IReadOnlySet<CapabilityIdentifier>? resolved =
-                        context.ResolvedCapabilities;
-                    if(resolved is null || !resolved.Contains(producer.RequiredCapability))
-                    {
-                        continue;
-                    }
-                    if(!await producer.IsApplicable(issuance, ct).ConfigureAwait(false))
-                    {
-                        continue;
-                    }
-
-                    KeyId signingKeyId = await SigningKeySelection.ResolveSigningKeyIdAsync(
-                        server, registration, producer.KeyUsage, context, ct).ConfigureAwait(false);
-                    PrivateKeyMemory? signingKey = await oauth.Cryptography.SigningKeyResolver!(
-                        signingKeyId, registration.TenantId, context, ct).ConfigureAwait(false);
-                    if(signingKey is null)
-                    {
-                        return (null, ServerHttpResponse.ServerError(
-                            OAuthErrors.ServerError,
-                            $"Signing key unavailable for producer '{producer.Name}'."));
-                    }
-
-                    string algorithm = CryptoFormatConversions.DefaultTagToJwaConverter(signingKey.Tag);
-                    TokenProducerOutput output = await producer.BuildAsync(
-                        issuance, signingKeyId, algorithm, ct).ConfigureAwait(false);
-                    JwtPayload payload = output.Payload;
-
-                    //Composed contributor walk via AuthorizationServerIntegration.ClaimIssuer.
-                    //See BuildToken for rationale.
-                    ClaimContributionTarget? contributionTarget =
-                        BuildTargetForProducer(producer, issuance, preResolvedOidcClaims);
-                    await MergeContributedClaimsAsync(
-                        server, contributionTarget, payload, ct).ConfigureAwait(false);
-
-                    UnsignedJwt unsigned = new(output.Header, payload);
-                    using JwsMessage jws = await unsigned.SignAsync(
-                        signingKey,
-                        oauth.Codecs.JwtHeaderSerializer!,
-                        oauth.Codecs.JwtPayloadSerializer!,
-                        oauth.Codecs.Encoder!,
-                        BaseMemoryPool.Shared,
-                        ct).ConfigureAwait(false);
-
-                    string compactJws = JwsSerialization.SerializeCompact(jws, oauth.Codecs.Encoder!);
-                    issuedTokens[producer.ResponseField] = compactJws;
-
-                    string jti = ExtractJti(payload);
-                    DateTimeOffset issuedAt = ExtractInstant(payload, WellKnownJwtClaimNames.Iat, now);
-                    DateTimeOffset expiresAt = ExtractInstant(payload, WellKnownJwtClaimNames.Exp, now);
-
-                    issuedAudits[producer.ResponseField] = new IssuedTokenAudit
-                    {
-                        Jti = jti,
-                        SigningKeyId = signingKeyId.Value,
-                        IssuedAt = issuedAt,
-                        ExpiresAt = expiresAt
-                    };
-
-                    if(expiresAt > latestExpiry)
-                    {
-                        latestExpiry = expiresAt;
-                    }
+                    return (null, issuanceFailure);
                 }
 
+                TokenIssuanceResult issued = issuanceResult!;
+                Dictionary<string, string> issuedTokens = issued.IssuedTokens;
+                Dictionary<string, IssuedTokenAudit> issuedAudits = issued.IssuedAudits;
+                DateTimeOffset latestExpiry = issued.LatestExpiry;
+
                 if(issuedTokens.Count == 0)
                 {
                     return (null, ServerHttpResponse.ServerError(
@@ -4804,7 +4863,14 @@ await MergeContributedClaimsAsync(
                         Scope = storedRefresh.Scope,
                         Confirmation = confirmation,
                         AuthTime = storedRefresh.AuthTime,
+                        SessionId = storedRefresh.SessionId,
                         Acr = storedRefresh.Acr,
+
+                        //Propagated verbatim, never re-stamped to refresh_token — the field
+                        //tracks the chain's originating grant across every rotation so a later
+                        //redemption can still tell whether an End-User authentication backs it.
+                        OriginatingGrantType = storedRefresh.OriginatingGrantType,
+
                         //RFC 9396 §6.1: the authorization details ride rotation unchanged — a
                         //narrowing refresh reduces only the access token it mints, "but the
                         //resource owner's previous authorization is unchanged by such requests" —
@@ -4887,6 +4953,13 @@ await oauth.DeleteFlowStateAsync(
                     JsonAppender.AppendInt64Field(sb, "expires_in",
                         expiresIn, ref first);
 
+                    string? idToken = tokenSet.IdToken;
+                    if(idToken is not null)
+                    {
+                        JsonAppender.AppendStringField(sb, "id_token",
+                            idToken, ref first);
+                    }
+
                     string? refreshToken = tokenSet.RefreshToken;
                     if(refreshToken is not null)
                     {
@@ -5426,12 +5499,14 @@ private static async ValueTask<ServerHttpResponse> BuildSignedIntrospectionRespo
     /// 1 (missing <c>iss</c> on Authorize redirect).
     /// </summary>
     /// <remarks>
-    /// The issuer URL source order mirrors <c>DefaultIssuerResolver</c>:
-    /// <see cref="ClientRecord.IssuerUri"/> first, then the per-request
-    /// <see cref="ExchangeContextServerExtensions.Issuer"/>. When neither is
-    /// populated the parameter is omitted rather than failing the redirect —
-    /// the strict-default deployment populates one of the two and the
-    /// permissive deployment opts out via <c>policy.EmitIssOnRedirect</c>.
+    /// Reads <see cref="ExchangeContextServerExtensions.ResolvedIssuer"/>, populated by
+    /// <see cref="TryResolveRedirectIssuerAsync"/> during
+    /// <c>EvaluateAuthenticationRequirementsAsync</c> — the same resolution path
+    /// <c>MetadataEndpoints</c> uses for the discovery <c>issuer</c> field
+    /// (RFC 9207 §2.3). When resolution found no usable issuer the parameter is omitted
+    /// rather than failing the redirect — the strict-default deployment populates
+    /// <see cref="ClientRecord.IssuerUri"/> or <see cref="ExchangeContextServerExtensions.Issuer"/>
+    /// and the permissive deployment opts out via <c>policy.EmitIssOnRedirect</c>.
     /// </remarks>
     private static ServerHttpResponse BuildAuthorizeRedirect(
         ServerCodeIssuedState code, ExchangeContext context) =>
@@ -5471,10 +5546,11 @@ private static ServerHttpResponse BuildAuthorizeErrorRedirect(
     /// when a query is already present and <c>?</c> otherwise. The <c>state</c> is echoed
     /// verbatim on both the success and error responses per
     /// <see href="https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2">RFC 6749 §4.1.2</see> so
-    /// the client can bind the redirect to its pending request. The issuer URL source order
-    /// mirrors <c>DefaultIssuerResolver</c>: <see cref="ClientRecord.IssuerUri"/> first, then
-    /// the per-request <see cref="ExchangeContextServerExtensions.Issuer"/>; the parameter is
-    /// omitted when neither is populated.
+    /// the client can bind the redirect to its pending request. The <c>iss</c> value is
+    /// <see cref="ExchangeContextServerExtensions.ResolvedIssuer"/>, resolved once ahead of
+    /// both this success path and the error-redirect path by
+    /// <see cref="TryResolveRedirectIssuerAsync"/>; the parameter is omitted when resolution
+    /// found no usable issuer.
     /// </summary>
     private static ServerHttpResponse BuildAuthorizeRedirectWithParameters(
         Uri redirectUri, string parameters, string? state, ExchangeContext context)
@@ -5490,10 +5566,16 @@ private static ServerHttpResponse BuildAuthorizeRedirectWithParameters(
 
         if(context.EmitIssOnRedirect)
         {
-            Uri? issuer = context.ClientRegistration?.IssuerUri ?? context.Issuer;
+            Uri? issuer = context.ResolvedIssuer;
             if(issuer is not null)
             {
-                location += $"&iss={Uri.EscapeDataString(issuer.ToString())}";
+                //RFC 9207 §2.3: the iss parameter MUST be identical to the issuer value
+                //in the server's metadata document. Discovery emits Uri.OriginalString
+                //(see MetadataEndpoints), so the redirect emits the same member —
+                //Uri.ToString() re-canonicalizes (e.g. appends a trailing slash to an
+                //authority-only URL) and would break the byte-identity a client's
+                //RFC 3986 §6.2.1 simple string comparison requires.
+                location += $"&iss={Uri.EscapeDataString(issuer.OriginalString)}";
             }
         }
 
@@ -5852,6 +5934,42 @@ private static (int? MaxAge, bool IsWellFormed) ReadRequestedMaxAge(RequestField
     }
 
 
+    /// <summary>
+    /// Resolves the issuer URI for the RFC 9207 §2 Authorize-redirect <c>iss</c> parameter
+    /// through the identical resolution path
+    /// <c>MetadataEndpoints</c> uses for the discovery <c>issuer</c> field —
+    /// the application's <see cref="AuthorizationServerIntegration.ResolveIssuerAsync"/>
+    /// delegate when configured, otherwise <see cref="DefaultIssuerResolver"/> — so RFC 9207
+    /// §2.3's "the issuer identifier included in the server's metadata value issuer MUST be
+    /// identical to the iss parameter's value" holds by construction rather than by two
+    /// independently maintained code paths agreeing coincidentally. Returns
+    /// <see langword="null"/> when resolution fails — no issuer configured, or the configured
+    /// value fails the RFC 9207 §2 https/no-query/no-fragment shape
+    /// (<see cref="IssuerIdentifierValidation.IsValidIssuerShape"/>) — so the caller omits the
+    /// <c>iss</c> parameter rather than failing the redirect.
+    /// </summary>
+    private static async ValueTask<Uri?> TryResolveRedirectIssuerAsync(
+        EndpointServer server,
+        ClientRecord registration,
+        ExchangeContext context,
+        CancellationToken cancellationToken)
+    {
+        var oauth = server.OAuth();
+        try
+        {
+            Uri issuer = oauth.ResolveIssuerAsync is not null
+                ? (await oauth.ResolveIssuerAsync(registration, context, cancellationToken).ConfigureAwait(false))!
+                : await DefaultIssuerResolver.ResolveAsync(registration, context, cancellationToken).ConfigureAwait(false);
+
+            return issuer;
+        }
+        catch(InvalidOperationException)
+        {
+            return null;
+        }
+    }
+
+
     private static async ValueTask<ServerHttpResponse?> EvaluateAuthenticationRequirementsAsync(
         EndpointServer server,
         ExchangeContext context,
@@ -5870,6 +5988,21 @@ private static (int? MaxAge, bool IsWellFormed) ReadRequestedMaxAge(RequestField
         CancellationToken cancellationToken = default)
     {
         var oauth = server.OAuth();
+
+        //Resolved once, ahead of both the requirement checks below and the eventual
+        //success redirect, so BuildAuthorizeRedirectWithParameters (read from the sync
+        //BuildResponse for the success path, and from the async error path below) sees
+        //the identical value regardless of which path emits the RFC 9207 iss parameter.
+        if(context.ClientRegistration is { } registrationForIssuer)
+        {
+            Uri? resolvedIssuer = await TryResolveRedirectIssuerAsync(
+                server, registrationForIssuer, context, cancellationToken).ConfigureAwait(false);
+            if(resolvedIssuer is not null)
+            {
+                context.SetResolvedIssuer(resolvedIssuer);
+            }
+        }
+
         if(requestedMaxAge is int maxAge)
         {
             //RFC 9470 §5 / OIDC Core §3.1.2.1 — max_age bounds the elapsed seconds since the
@@ -5915,7 +6048,16 @@ private static (int? MaxAge, bool IsWellFormed) ReadRequestedMaxAge(RequestField
                     RequestedResource = ParseResourceIndicators(requestedResource),
                     Subject = subjectId,
                     EstablishedAcr = context.Acr,
-                    EstablishedAuthTime = context.AuthTime
+                    EstablishedAuthTime = context.AuthTime,
+                    //draft-ietf-oauth-client-id-metadata-document-02 §8.5 (CIMD-051/052/053) display
+                    //seam: the hostname is populated for any URL-shaped client_id regardless of
+                    //whether its document was fetched; the document-derived fields are populated
+                    //exactly when the materialized registration overlaid at least one of them.
+                    ClientIdHost = ResolveClientIdHost(registration.ClientId),
+                    HasFetchedClientMetadata = HasDocumentDerivedMetadata(registration),
+                    ClientName = registration.ClientName,
+                    ClientUri = registration.ClientUri,
+                    LogoUri = registration.LogoUri
                 },
                 registration, context, cancellationToken).ConfigureAwait(false);
 
@@ -5938,6 +6080,57 @@ private static (int? MaxAge, bool IsWellFormed) ReadRequestedMaxAge(RequestField
     }
 
 
+    /// <summary>
+    /// Returns the host component of <paramref name="clientId"/> when it parses as an absolute
+    /// <c>https</c> URI — draft-ietf-oauth-client-id-metadata-document-02 §8.5's hostname-display
+    /// SHOULD applies to any URL-shaped <c>client_id</c>, whether or not it carries a Client ID
+    /// Metadata Document (a vanity <c>https://</c> client_id per §7.1 still has a hostname worth
+    /// showing). Returns <see langword="null"/> for an opaque (non-URL) client_id.
+    /// </summary>
+    private static string? ResolveClientIdHost(string clientId) =>
+        Uri.TryCreate(clientId, UriKind.Absolute, out Uri? clientIdUri)
+            && clientIdUri.Scheme == Uri.UriSchemeHttps
+                ? clientIdUri.Host
+                : null;
+
+
+    /// <summary>
+    /// Returns whether <paramref name="registration"/> carries at least one client-display field a
+    /// Client ID Metadata Document overlays — draft-ietf-oauth-client-id-metadata-document-02 §5
+    /// materialization sets <see cref="ClientRecord.IsClientMetadataMaterialized"/> when it overlays a
+    /// successfully fetched document — true even for a minimal public-client document that declares only
+    /// <c>client_id</c> and <c>redirect_uris</c>. A CIMD-shaped registration whose overlay never ran
+    /// (fetch failure, policy denial, a pre-registered client whose document is not fetched at request
+    /// time, or a request that never triggered materialization) leaves the flag false — exactly the
+    /// §8.5 ¶2 "did not fetch" case.
+    /// </summary>
+    private static bool HasDocumentDerivedMetadata(ClientRecord registration) =>
+        registration.IsClientMetadataMaterialized;
+
+
+    /// <summary>
+    /// RFC 6749 §4.1.2.1 wire error value returned when a request's
+    /// <c>response_type</c> requests a grant this authorization server does not
+    /// implement. This server issues <see cref="WellKnownResponseTypes.Code"/>
+    /// only — the OIDC Core 1.0 §3 implicit (<c>id_token</c>, <c>token</c>,
+    /// <c>id_token token</c>) and hybrid (<c>code id_token</c>, <c>code token</c>,
+    /// <c>code id_token token</c>) response types are all unsupported.
+    /// </summary>
+    private const string UnsupportedResponseTypeError = "unsupported_response_type";
+
+
+    /// <summary>
+    /// Returns whether <paramref name="responseType"/> names an OAuth 2.0
+    /// <c>response_type</c> other than <see cref="WellKnownResponseTypes.Code"/>.
+    /// <see langword="false"/> for <see langword="null"/> — a request that omits
+    /// <c>response_type</c> falls through to this endpoint's implicit
+    /// <c>code</c> default rather than being rejected, matching the endpoint's
+    /// established behavior for the parameter.
+    /// </summary>
+    private static bool IsUnsupportedResponseType(string? responseType) =>
+        responseType is not null && !WellKnownResponseTypes.IsCode(responseType);
+
+
     /// <summary>
     /// Returns whether <paramref name="method"/> is an accepted PKCE
     /// <c>code_challenge_method</c> value under the deployment's policy. The
diff --git a/src/Verifiable.OAuth/AuthCode/AuthCodeFlowHandlers.cs b/src/Verifiable.OAuth/AuthCode/AuthCodeFlowHandlers.cs
index ac74705b..cd667111 100644
--- a/src/Verifiable.OAuth/AuthCode/AuthCodeFlowHandlers.cs
+++ b/src/Verifiable.OAuth/AuthCode/AuthCodeFlowHandlers.cs
@@ -161,9 +161,15 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleParAsync(
         ArgumentNullException.ThrowIfNull(registration);
         ArgumentNullException.ThrowIfNull(context);
 
-        AuthorizationServerMetadata metadata = await infrastructure
-            .ResolveAuthorizationServerMetadataAsync(registration.AuthorizationServerIssuer, context, cancellationToken)
-            .ConfigureAwait(false);
+        Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult> metadataResult =
+            await ResolveValidatedAuthorizationServerMetadataAsync(
+                infrastructure, registration, context, cancellationToken).ConfigureAwait(false);
+        if(!metadataResult.IsSuccess)
+        {
+            return metadataResult.Error!;
+        }
+
+        AuthorizationServerMetadata metadata = metadataResult.Value;
 
         DateTimeOffset now = infrastructure.TimeProvider.GetUtcNow();
         string state = GenerateEntropyHexString(infrastructure);
@@ -267,9 +273,25 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleCallbackAsync(
         ArgumentNullException.ThrowIfNull(registration);
         ArgumentNullException.ThrowIfNull(context);
 
-        AuthorizationServerMetadata metadata = await infrastructure
-            .ResolveAuthorizationServerMetadataAsync(registration.AuthorizationServerIssuer, context, cancellationToken)
-            .ConfigureAwait(false);
+        Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult> metadataResult =
+            await ResolveValidatedAuthorizationServerMetadataAsync(
+                infrastructure, registration, context, cancellationToken).ConfigureAwait(false);
+        if(!metadataResult.IsSuccess)
+        {
+            return metadataResult.Error!;
+        }
+
+        AuthorizationServerMetadata metadata = metadataResult.Value;
+
+        //RFC 6749 §4.1.2.1 Authorization Error Response — error is present instead of code.
+        //RFC 9207 §2.4/§4: "clients MUST NOT assume that the error originates from the
+        //intended authorization server," so a PRESENT iss on this branch is validated with
+        //the same mix-up-attack rule the success path applies before the error is trusted.
+        if(fields.TryGetValue(OAuthRequestParameterNames.Error, out string? errorCode))
+        {
+            return await BuildCallbackErrorResultAsync(
+                fields, infrastructure, context, errorCode, cancellationToken).ConfigureAwait(false);
+        }
 
         if(!fields.TryGetValue(OAuthRequestParameterNames.Code, out string? code) ||
            !fields.TryGetValue(OAuthRequestParameterNames.State, out string? state))
@@ -358,22 +380,42 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleCallbackAsync(
     }
 
 
+    /// <inheritdoc cref="HandleTokenAsync(IReadOnlyDictionary{string, string}, OAuthClientInfrastructure, ClientRegistration, ExchangeContext, ClientAssertionOptions?, CancellationToken)"/>
+    public static ValueTask<AuthCodeFlowEndpointResult> HandleTokenAsync(
+        IReadOnlyDictionary<string, string> fields,
+        OAuthClientInfrastructure infrastructure,
+        ClientRegistration registration,
+        ExchangeContext context,
+        CancellationToken cancellationToken) =>
+        HandleTokenAsync(fields, infrastructure, registration, context, clientAssertionOptions: null, cancellationToken);
+
+
     /// <summary>
     /// Handles a token exchange request. Loads the <see cref="AuthorizationCodeReceivedState"/>
-    /// state by <c>flow_id</c>, POSTs to the token endpoint with the code and PKCE
-    /// verifier, and persists <see cref="TokenReceivedState"/> state.
+    /// state by <c>flow_id</c>, POSTs to the token endpoint with the code, the PKCE verifier, and
+    /// the confidential-client authentication <see cref="ClientRegistration.AuthenticationMethod"/>
+    /// selects (RFC 6749 §3.2.1 / RFC 7523 §2.2), and persists <see cref="TokenReceivedState"/> state.
     /// </summary>
     /// <param name="fields">
     /// Inbound form fields. Must include <c>flow_id</c> to locate the pending state.
     /// </param>
     /// <param name="infrastructure">The long-lived infrastructure carrying transport, parsing, persistence, and time delegates.</param>
     /// <param name="registration">The registration identifying the authorization server this call targets.</param>
+    /// <param name="context">The per-operation exchange context threaded into the transport and flow-state delegates.</param>
+    /// <param name="clientAssertionOptions">
+    /// The <c>private_key_jwt</c> client-assertion signing inputs (RFC 7523 §2.2): the <c>kid</c>,
+    /// the header/payload serialisers, and the assertion lifetime. Required when
+    /// <see cref="ClientRegistration.AuthenticationMethod"/> is
+    /// <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/> — the signing key itself is read from
+    /// <see cref="ClientRegistration.AuthenticationKeyMaterial"/>. Ignored for every other method.
+    /// </param>
     /// <param name="cancellationToken">Cancellation token.</param>
     public static async ValueTask<AuthCodeFlowEndpointResult> HandleTokenAsync(
         IReadOnlyDictionary<string, string> fields,
         OAuthClientInfrastructure infrastructure,
         ClientRegistration registration,
         ExchangeContext context,
+        ClientAssertionOptions? clientAssertionOptions,
         CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(fields);
@@ -381,9 +423,15 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleTokenAsync(
         ArgumentNullException.ThrowIfNull(registration);
         ArgumentNullException.ThrowIfNull(context);
 
-        AuthorizationServerMetadata metadata = await infrastructure
-            .ResolveAuthorizationServerMetadataAsync(registration.AuthorizationServerIssuer, context, cancellationToken)
-            .ConfigureAwait(false);
+        Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult> metadataResult =
+            await ResolveValidatedAuthorizationServerMetadataAsync(
+                infrastructure, registration, context, cancellationToken).ConfigureAwait(false);
+        if(!metadataResult.IsSuccess)
+        {
+            return metadataResult.Error!;
+        }
+
+        AuthorizationServerMetadata metadata = metadataResult.Value;
 
         if(!fields.TryGetValue(AuthCodeFlowRoutes.FlowIdField, out string? flowId))
         {
@@ -425,8 +473,12 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleTokenAsync(
             codeState.RedirectUri,
             codeState.Pkce);
 
+        OutgoingHeaders authenticationHeaders = await AttachClientAuthenticationAsync(
+            tokenFields, registration, metadata.TokenEndpoint!, clientAssertionOptions,
+            infrastructure, now, context, cancellationToken).ConfigureAwait(false);
+
         HttpResponseData tokenHttpResponse = await SendTokenRequestWithDpopRetryAsync(
-            infrastructure, metadata.TokenEndpoint!, tokenFields, context, cancellationToken)
+            infrastructure, metadata.TokenEndpoint!, tokenFields, authenticationHeaders, context, cancellationToken)
             .ConfigureAwait(false);
 
         Result<TokenResponse, OAuthParseError> tokenResult =
@@ -510,9 +562,15 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleRevocationAsync(
         ArgumentNullException.ThrowIfNull(registration);
         ArgumentNullException.ThrowIfNull(context);
 
-        AuthorizationServerMetadata metadata = await infrastructure
-            .ResolveAuthorizationServerMetadataAsync(registration.AuthorizationServerIssuer, context, cancellationToken)
-            .ConfigureAwait(false);
+        Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult> metadataResult =
+            await ResolveValidatedAuthorizationServerMetadataAsync(
+                infrastructure, registration, context, cancellationToken).ConfigureAwait(false);
+        if(!metadataResult.IsSuccess)
+        {
+            return metadataResult.Error!;
+        }
+
+        AuthorizationServerMetadata metadata = metadataResult.Value;
 
         if(metadata.RevocationEndpoint is null)
         {
@@ -562,19 +620,42 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleRevocationAsync(
     }
 
 
+    /// <inheritdoc cref="RefreshAsync(RefreshTokenRequest, OAuthClientInfrastructure, ClientRegistration, ExchangeContext, ClientAssertionOptions?, CancellationToken)"/>
+    public static ValueTask<AuthCodeFlowEndpointResult> RefreshAsync(
+        RefreshTokenRequest request,
+        OAuthClientInfrastructure infrastructure,
+        ClientRegistration registration,
+        ExchangeContext context,
+        CancellationToken cancellationToken) =>
+        RefreshAsync(request, infrastructure, registration, context, clientAssertionOptions: null, cancellationToken);
+
+
     /// <summary>
     /// Refreshes an access token using a refresh token. Independent of the state
-    /// machine — call this when the stored access token has expired.
+    /// machine — call this when the stored access token has expired. Attaches
+    /// confidential-client authentication per <see cref="ClientRegistration.AuthenticationMethod"/>
+    /// the same way the code-exchange leg does (<see cref="AttachClientAuthenticationAsync"/>,
+    /// RFC 6749 §6, §3.2.1), and — the same way the code-exchange leg does — attaches a DPoP proof
+    /// and honours a <c>use_dpop_nonce</c> retry (<see cref="SendTokenRequestWithDpopRetryAsync"/>,
+    /// RFC 9449 §8.1) whenever <paramref name="infrastructure"/> is wired for DPoP, so a
+    /// DPoP-sender-constrained refresh token redeems the same way a fresh access token does.
     /// </summary>
     /// <param name="request">The refresh request parameters.</param>
     /// <param name="infrastructure">The long-lived infrastructure carrying transport, parsing, persistence, and time delegates.</param>
     /// <param name="registration">The registration identifying the authorization server this call targets.</param>
+    /// <param name="context">The per-operation exchange context threaded into the transport and flow-state delegates.</param>
+    /// <param name="clientAssertionOptions">
+    /// The <c>private_key_jwt</c> client-assertion signing inputs (RFC 7523 §2.2). Required when
+    /// <see cref="ClientRegistration.AuthenticationMethod"/> is
+    /// <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/>; ignored for every other method.
+    /// </param>
     /// <param name="cancellationToken">Cancellation token.</param>
     public static async ValueTask<AuthCodeFlowEndpointResult> RefreshAsync(
         RefreshTokenRequest request,
         OAuthClientInfrastructure infrastructure,
         ClientRegistration registration,
         ExchangeContext context,
+        ClientAssertionOptions? clientAssertionOptions,
         CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(request);
@@ -582,30 +663,27 @@ public static async ValueTask<AuthCodeFlowEndpointResult> RefreshAsync(
         ArgumentNullException.ThrowIfNull(registration);
         ArgumentNullException.ThrowIfNull(context);
 
-        AuthorizationServerMetadata metadata = await infrastructure
-            .ResolveAuthorizationServerMetadataAsync(registration.AuthorizationServerIssuer, context, cancellationToken)
-            .ConfigureAwait(false);
-
-        var fields = new Dictionary<string, string>
+        Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult> metadataResult =
+            await ResolveValidatedAuthorizationServerMetadataAsync(
+                infrastructure, registration, context, cancellationToken).ConfigureAwait(false);
+        if(!metadataResult.IsSuccess)
         {
-            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.RefreshToken,
-            [OAuthRequestParameterNames.ClientId] = registration.ClientId.Value,
-            [OAuthRequestParameterNames.RefreshToken] = request.RefreshToken
-        };
-
-        if(request.Scope is not null)
-        {
-            fields[OAuthRequestParameterNames.Scope] = request.Scope;
+            return metadataResult.Error!;
         }
 
-        HttpResponseData refreshHttpResponse = await infrastructure.SendFormPostAsync(
-            metadata.TokenEndpoint!,
-            fields,
-            OutgoingHeaders.Empty,
-            context,
-            cancellationToken).ConfigureAwait(false);
+        AuthorizationServerMetadata metadata = metadataResult.Value;
+
+        OutgoingFormFields refreshFields = EncodeRefreshRequest(registration.ClientId.Value, request);
 
         DateTimeOffset now = infrastructure.TimeProvider.GetUtcNow();
+        OutgoingHeaders authenticationHeaders = await AttachClientAuthenticationAsync(
+            refreshFields, registration, metadata.TokenEndpoint!, clientAssertionOptions,
+            infrastructure, now, context, cancellationToken).ConfigureAwait(false);
+
+        HttpResponseData refreshHttpResponse = await SendTokenRequestWithDpopRetryAsync(
+            infrastructure, metadata.TokenEndpoint!, refreshFields, authenticationHeaders, context, cancellationToken)
+            .ConfigureAwait(false);
+
         Result<TokenResponse, OAuthParseError> refreshResult =
             infrastructure.ParseTokenResponseAsync(refreshHttpResponse, now);
 
@@ -661,9 +739,15 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleJarParAsync(
         ArgumentNullException.ThrowIfNull(registration);
         ArgumentNullException.ThrowIfNull(context);
 
-        AuthorizationServerMetadata metadata = await infrastructure
-            .ResolveAuthorizationServerMetadataAsync(registration.AuthorizationServerIssuer, context, cancellationToken)
-            .ConfigureAwait(false);
+        Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult> metadataResult =
+            await ResolveValidatedAuthorizationServerMetadataAsync(
+                infrastructure, registration, context, cancellationToken).ConfigureAwait(false);
+        if(!metadataResult.IsSuccess)
+        {
+            return metadataResult.Error!;
+        }
+
+        AuthorizationServerMetadata metadata = metadataResult.Value;
 
         cancellationToken.ThrowIfCancellationRequested();
 
@@ -773,9 +857,15 @@ public static async ValueTask<AuthCodeFlowEndpointResult> HandleJarAuthorizeAsyn
         ArgumentNullException.ThrowIfNull(registration);
         ArgumentNullException.ThrowIfNull(context);
 
-        AuthorizationServerMetadata metadata = await infrastructure
-            .ResolveAuthorizationServerMetadataAsync(registration.AuthorizationServerIssuer, context, cancellationToken)
-            .ConfigureAwait(false);
+        Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult> metadataResult =
+            await ResolveValidatedAuthorizationServerMetadataAsync(
+                infrastructure, registration, context, cancellationToken).ConfigureAwait(false);
+        if(!metadataResult.IsSuccess)
+        {
+            return metadataResult.Error!;
+        }
+
+        AuthorizationServerMetadata metadata = metadataResult.Value;
 
         cancellationToken.ThrowIfCancellationRequested();
 
@@ -929,6 +1019,126 @@ private static OutgoingFormFields EncodeTokenRequest(
         };
     }
 
+    private static OutgoingFormFields EncodeRefreshRequest(string clientId, RefreshTokenRequest request)
+    {
+        var fields = new OutgoingFormFields
+        {
+            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.RefreshToken,
+            [OAuthRequestParameterNames.ClientId] = clientId,
+            [OAuthRequestParameterNames.RefreshToken] = request.RefreshToken
+        };
+
+        if(request.Scope is not null)
+        {
+            fields[OAuthRequestParameterNames.Scope] = request.Scope;
+        }
+
+        return fields;
+    }
+
+
+    /// <summary>
+    /// Attaches confidential-client authentication to <paramref name="form"/> (and, for
+    /// <c>client_secret_basic</c>, to the returned <see cref="OutgoingHeaders"/>) per
+    /// <see cref="ClientRegistration.AuthenticationMethod"/>: <see cref="ClientAuthenticationMethod.None"/>
+    /// attaches nothing (the request relies on PKCE alone, RFC 7636);
+    /// <see cref="ClientAuthenticationMethod.ClientSecretPost"/> and
+    /// <see cref="ClientAuthenticationMethod.ClientSecretBasic"/> present
+    /// <see cref="ClientRegistration.AuthenticationKeyMaterial"/>'s private-key bytes as the shared
+    /// secret (RFC 6749 §2.3.1); <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/> signs a
+    /// <c>client_assertion</c> from the same key material via
+    /// <see cref="ClientTokenEndpointAuthentication.AttachClientAssertionAsync"/> (RFC 7523 §2.2).
+    /// </summary>
+    private static ValueTask<OutgoingHeaders> AttachClientAuthenticationAsync(
+        OutgoingFormFields form,
+        ClientRegistration registration,
+        Uri tokenEndpoint,
+        ClientAssertionOptions? clientAssertionOptions,
+        OAuthClientInfrastructure infrastructure,
+        DateTimeOffset now,
+        ExchangeContext context,
+        CancellationToken cancellationToken)
+    {
+        static ValueTask<OutgoingHeaders> AttachNone() =>
+            ValueTask.FromResult(OutgoingHeaders.Empty);
+
+        static ValueTask<OutgoingHeaders> AttachClientSecretPost(OutgoingFormFields form, ClientRegistration registration)
+        {
+            PrivateKeyMemory secret = RequireAuthenticationKey(registration);
+            form.WithClientSecretPost(registration.ClientId.Value, secret.AsReadOnlySpan());
+
+            return ValueTask.FromResult(OutgoingHeaders.Empty);
+        }
+
+        static ValueTask<OutgoingHeaders> AttachClientSecretBasic(ClientRegistration registration)
+        {
+            PrivateKeyMemory secret = RequireAuthenticationKey(registration);
+            OutgoingHeaders headers = OutgoingHeaders.Empty.WithClientSecretBasic(registration.ClientId.Value, secret.AsReadOnlySpan());
+
+            return ValueTask.FromResult(headers);
+        }
+
+        static async ValueTask<OutgoingHeaders> AttachPrivateKeyJwt(
+            OutgoingFormFields form,
+            ClientRegistration registration,
+            Uri tokenEndpoint,
+            ClientAssertionOptions? clientAssertionOptions,
+            OAuthClientInfrastructure infrastructure,
+            DateTimeOffset now,
+            ExchangeContext context,
+            CancellationToken cancellationToken)
+        {
+            PrivateKeyMemory signingKey = RequireAuthenticationKey(registration);
+            if(clientAssertionOptions is null)
+            {
+                throw new InvalidOperationException(
+                    "ClientAuthenticationMethod.PrivateKeyJwt requires a ClientAssertionOptions instance to sign the client_assertion.");
+            }
+
+            await ClientTokenEndpointAuthentication.AttachClientAssertionAsync(
+                form,
+                registration,
+                tokenEndpoint,
+                signingKey,
+                clientAssertionOptions.SigningKeyId,
+                clientAssertionOptions.HeaderSerializer,
+                clientAssertionOptions.PayloadSerializer,
+                clientAssertionOptions.ClientAssertionLifetime,
+                infrastructure,
+                now,
+                context,
+                cancellationToken).ConfigureAwait(false);
+
+            return OutgoingHeaders.Empty;
+        }
+
+        return registration.AuthenticationMethod.Code switch
+        {
+            var c when c == ClientAuthenticationMethod.None.Code => AttachNone(),
+            var c when c == ClientAuthenticationMethod.ClientSecretPost.Code => AttachClientSecretPost(form, registration),
+            var c when c == ClientAuthenticationMethod.ClientSecretBasic.Code => AttachClientSecretBasic(registration),
+            var c when c == ClientAuthenticationMethod.PrivateKeyJwt.Code => AttachPrivateKeyJwt(
+                form, registration, tokenEndpoint, clientAssertionOptions, infrastructure, now, context, cancellationToken),
+            _ => throw new NotSupportedException(
+                $"Client authentication method '{ClientAuthenticationMethodNames.GetName(registration.AuthenticationMethod)}' " +
+                "is not supported on the authorization-code token or refresh leg.")
+        };
+    }
+
+
+    /// <summary>
+    /// Reads the confidential-client secret or signing key from
+    /// <see cref="ClientRegistration.AuthenticationKeyMaterial"/>, non-owning per its own remarks —
+    /// the caller reads the key's bytes via <see cref="SensitiveMemory.AsReadOnlySpan"/> for the
+    /// duration of the call and does not retain or copy them.
+    /// </summary>
+    private static PrivateKeyMemory RequireAuthenticationKey(ClientRegistration registration) =>
+        registration.AuthenticationKeyMaterial?.PrivateKey
+        ?? throw new InvalidOperationException(
+            $"ClientAuthenticationMethod.{ClientAuthenticationMethodNames.GetName(registration.AuthenticationMethod)} " +
+            "requires ClientRegistration.AuthenticationKeyMaterial to carry the client secret or signing key.");
+
+
     private static Uri BuildAuthorizationRedirectUri(
         Uri authorizationEndpoint,
         string clientId,
@@ -940,6 +1150,112 @@ private static Uri BuildAuthorizationRedirectUri(
     }
 
 
+    /// <summary>
+    /// Resolves the authorization server's metadata via
+    /// <see cref="OAuthClientInfrastructure.ResolveAuthorizationServerMetadataAsync"/> and
+    /// verifies its <see cref="AuthorizationServerMetadata.Issuer"/> against the pinned
+    /// <see cref="ClientRegistration.AuthorizationServerIssuer"/> via
+    /// <see cref="AuthorizationServerMetadataValidation.IsIssuerMatch"/> — RFC 8414 §3.3's
+    /// issuer-match requirement, which for a client relying on OAuth metadata is also RFC 9207
+    /// §2.4's "clients ... MUST compare the iss parameter value to the issuer value in the
+    /// server's metadata document" reduced to the metadata-consistency half (the
+    /// callback-<c>iss</c> half is <see cref="ValidationChecks.CheckCallbackIssuerMatches"/>).
+    /// Every flow handler resolves metadata through this one seam so the check applies
+    /// uniformly rather than needing to be repeated per call site.
+    /// </summary>
+    private static async ValueTask<Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult>> ResolveValidatedAuthorizationServerMetadataAsync(
+        OAuthClientInfrastructure infrastructure,
+        ClientRegistration registration,
+        ExchangeContext context,
+        CancellationToken cancellationToken)
+    {
+        AuthorizationServerMetadata metadata = await infrastructure
+            .ResolveAuthorizationServerMetadataAsync(registration.AuthorizationServerIssuer, context, cancellationToken)
+            .ConfigureAwait(false);
+
+        if(!AuthorizationServerMetadataValidation.IsIssuerMatch(metadata, registration.AuthorizationServerIssuer))
+        {
+            return Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult>.Failure(
+                new AuthCodeFlowEndpointResult
+                {
+                    Outcome = AuthCodeFlowEndpointOutcome.BadRequest,
+                    ErrorCode = "invalid_request",
+                    ErrorDescription =
+                        "The authorization server metadata issuer does not match this registration's " +
+                        "pinned AuthorizationServerIssuer (RFC 8414 §3.3 / RFC 9207 §2.4)."
+                });
+        }
+
+        return Result<AuthorizationServerMetadata, AuthCodeFlowEndpointResult>.Success(metadata);
+    }
+
+
+    /// <summary>
+    /// Builds the result for an OAuth 2.0 Authorization Error Response callback
+    /// (<paramref name="errorCode"/> present per RFC 6749 §4.1.2.1). Applies the RFC 9207
+    /// §2.4 / §4 mix-up defense to the error path: when <paramref name="fields"/>' <c>state</c>
+    /// correlates to a pending <see cref="ParCompletedState"/> flow and the callback carries a
+    /// PRESENT <c>iss</c> that does not match that flow's recorded issuer
+    /// (<see cref="ValidationChecks.CheckCallbackIssuerMatchesWhenPresent"/>), the response is
+    /// rejected as tampering — an attacker able to inject <c>iss</c> on a forged success
+    /// response is equally able to inject <c>error</c> and <c>iss</c> together, and RFC 9207 §4
+    /// draws no distinction between success and error responses for this defense. When
+    /// <c>state</c> does not correlate to a pending flow, or the callback carries no <c>iss</c>,
+    /// there is no expected-issuer value to validate against and the authorization server's
+    /// error is returned as received.
+    /// </summary>
+    private static async ValueTask<AuthCodeFlowEndpointResult> BuildCallbackErrorResultAsync(
+        IReadOnlyDictionary<string, string> fields,
+        OAuthClientInfrastructure infrastructure,
+        ExchangeContext context,
+        string errorCode,
+        CancellationToken cancellationToken)
+    {
+        fields.TryGetValue(OAuthRequestParameterNames.ErrorDescription, out string? errorDescription);
+
+        if(fields.TryGetValue(OAuthRequestParameterNames.State, out string? errorState))
+        {
+            FlowState? errorFlowState = await infrastructure.LoadStateAsync(
+                errorState, context, cancellationToken).ConfigureAwait(false);
+
+            if(errorFlowState is ParCompletedState errorParCompleted)
+            {
+                ValidationContext issuerCheckContext = new()
+                {
+                    Context = new ExchangeContext(),
+                    Fields = fields,
+                    FlowState = errorParCompleted,
+                    Now = infrastructure.TimeProvider.GetUtcNow()
+                };
+
+                List<Claim> issuerClaims = await ValidationChecks.CheckCallbackIssuerMatchesWhenPresent(
+                    issuerCheckContext, cancellationToken).ConfigureAwait(false);
+
+                if(issuerClaims.Exists(static c => c.Outcome != ClaimOutcome.Success))
+                {
+                    return new AuthCodeFlowEndpointResult
+                    {
+                        Outcome = AuthCodeFlowEndpointOutcome.BadRequest,
+                        ErrorCode = "invalid_request",
+                        ErrorDescription =
+                            "The iss parameter on the error callback does not match the recorded issuer; " +
+                            "the response is not trusted as originating from the intended authorization " +
+                            "server (RFC 9207 §2.4, RFC 9700 §4.4).",
+                        ValidationClaims = issuerClaims
+                    };
+                }
+            }
+        }
+
+        return new AuthCodeFlowEndpointResult
+        {
+            Outcome = AuthCodeFlowEndpointOutcome.BadRequest,
+            ErrorCode = errorCode,
+            ErrorDescription = errorDescription
+        };
+    }
+
+
     //Maps an OAuthParseError to an AuthCodeFlowEndpointResult, surfacing the
     //decision support summary as the error description so callers have actionable
     //information without needing to pattern-match the full error hierarchy.
@@ -1015,21 +1331,23 @@ private static async ValueTask<HttpResponseData> SendTokenRequestWithDpopRetryAs
         OAuthClientInfrastructure infrastructure,
         Uri tokenEndpoint,
         OutgoingFormFields tokenFields,
+        OutgoingHeaders authenticationHeaders,
         ExchangeContext context,
         CancellationToken cancellationToken)
     {
         if(infrastructure.ConstructDpopProofAsync is null || infrastructure.DpopKey is null)
         {
-            //DPoP not wired — send without DPoP, headers empty.
+            //DPoP not wired — send with only the client-authentication headers (e.g. client_secret_basic's
+            //Authorization header), or none for a method that authenticates via the form body or not at all.
             return await infrastructure.SendFormPostAsync(
-                tokenEndpoint, tokenFields, OutgoingHeaders.Empty, context, cancellationToken)
+                tokenEndpoint, tokenFields, authenticationHeaders, context, cancellationToken)
                 .ConfigureAwait(false);
         }
 
         string authority = InMemoryDpopNonceCache.AuthorityFor(tokenEndpoint);
 
         HttpResponseData response = await SendOnceWithDpopAsync(
-            infrastructure, tokenEndpoint, tokenFields, authority, context, cancellationToken)
+            infrastructure, tokenEndpoint, tokenFields, authenticationHeaders, authority, context, cancellationToken)
             .ConfigureAwait(false);
 
         if(response.StatusCode != 400)
@@ -1051,7 +1369,7 @@ private static async ValueTask<HttpResponseData> SendTokenRequestWithDpopRetryAs
         infrastructure.StoreDpopNonce?.Invoke(authority, freshNonce);
 
         return await SendOnceWithDpopAsync(
-            infrastructure, tokenEndpoint, tokenFields, authority, context, cancellationToken)
+            infrastructure, tokenEndpoint, tokenFields, authenticationHeaders, authority, context, cancellationToken)
             .ConfigureAwait(false);
     }
 
@@ -1060,6 +1378,7 @@ private static async ValueTask<HttpResponseData> SendOnceWithDpopAsync(
         OAuthClientInfrastructure infrastructure,
         Uri tokenEndpoint,
         OutgoingFormFields tokenFields,
+        OutgoingHeaders authenticationHeaders,
         string authority,
         ExchangeContext context,
         CancellationToken cancellationToken)
@@ -1082,7 +1401,7 @@ private static async ValueTask<HttpResponseData> SendOnceWithDpopAsync(
         string proof = await infrastructure.ConstructDpopProofAsync!(
             claims, infrastructure.DpopKey!, cancellationToken).ConfigureAwait(false);
 
-        OutgoingHeaders headers = OutgoingHeaders.Empty.WithDpop(proof);
+        OutgoingHeaders headers = authenticationHeaders.WithDpop(proof);
 
         return await infrastructure.SendFormPostAsync(
             tokenEndpoint, tokenFields, headers, context, cancellationToken).ConfigureAwait(false);
diff --git a/src/Verifiable.OAuth/AuthCode/Server/States/ServerRefreshTokenIssuedState.cs b/src/Verifiable.OAuth/AuthCode/Server/States/ServerRefreshTokenIssuedState.cs
index 728b84e6..4041e88c 100644
--- a/src/Verifiable.OAuth/AuthCode/Server/States/ServerRefreshTokenIssuedState.cs
+++ b/src/Verifiable.OAuth/AuthCode/Server/States/ServerRefreshTokenIssuedState.cs
@@ -35,9 +35,29 @@ public sealed record ServerRefreshTokenIssuedState: FlowState
     /// <summary>The opaque refresh-token string. Wire form.</summary>
     public required string RefreshToken { get; init; }
 
+    /// <summary>
+    /// The wire <c>grant_type</c> that first minted this refresh-token chain, carried
+    /// verbatim across rotation. Only <c>authorization_code</c> marks the chain as
+    /// continuing a genuine End-User authentication event; every other origin
+    /// (<c>client_credentials</c>, <c>token_exchange</c>, <c>jwt_bearer</c>,
+    /// <c>pre_authorized_code</c>) is non-End-User and MUST NOT yield a default
+    /// id_token on redemption. Values are the <see cref="WellKnownGrantTypes"/> constants.
+    /// </summary>
+    public required string OriginatingGrantType { get; init; }
+
     /// <summary>The UTC instant the refresh token was issued.</summary>
     public required DateTimeOffset IssuedAt { get; init; }
 
+    /// <summary>
+    /// The OP session identifier (<c>sid</c>) established at the original authentication,
+    /// carried verbatim across rotation so a refreshed ID Token keeps the same <c>sid</c> claim,
+    /// per
+    /// <see href="https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse">OIDC
+    /// Core §12.2</see>, which requires the same rules to apply as at original authentication.
+    /// <see langword="null"/> when no session was established.
+    /// </summary>
+    public string? SessionId { get; init; }
+
     /// <summary>
     /// The subject identifier the refresh token was issued for. Becomes
     /// the <c>sub</c> claim on the access token issued by the refresh
diff --git a/src/Verifiable.OAuth/AuthorizationServerMetadataParameterNames.cs b/src/Verifiable.OAuth/AuthorizationServerMetadataParameterNames.cs
index a2b95d06..b4923674 100644
--- a/src/Verifiable.OAuth/AuthorizationServerMetadataParameterNames.cs
+++ b/src/Verifiable.OAuth/AuthorizationServerMetadataParameterNames.cs
@@ -308,4 +308,20 @@ public static class AuthorizationServerMetadataParameterNames
     /// parameter is the matching ADVERTISEMENT.
     /// </summary>
     public static readonly string PreAuthorizedGrantAnonymousAccessSupported = Utf8Constants.ToInternedString(PreAuthorizedGrantAnonymousAccessSupportedUtf8);
+
+    /// <summary>The UTF-8 source literal of <see cref="ClientIdMetadataDocumentSupported"/>.</summary>
+    public static ReadOnlySpan<byte> ClientIdMetadataDocumentSupportedUtf8 => "client_id_metadata_document_supported"u8;
+
+    /// <summary>
+    /// Whether the authorization server supports retrieving client metadata from a
+    /// <c>client_id</c> URL, advertised as <c>client_id_metadata_document_supported</c> per
+    /// draft-ietf-oauth-client-id-metadata-document-02 §6: "Authorization servers that
+    /// publish Authorization Server Metadata [RFC8414] MUST include the following property
+    /// to signal support for Client ID Metadata Documents as described in this
+    /// specification." §6 defines the value itself as "OPTIONAL. Boolean value specifying
+    /// whether the authorization server supports retrieving client metadata from a
+    /// client_id URL as described in this specification." Registered in the IANA "OAuth
+    /// Authorization Server Metadata" registry per §10.1.
+    /// </summary>
+    public static readonly string ClientIdMetadataDocumentSupported = Utf8Constants.ToInternedString(ClientIdMetadataDocumentSupportedUtf8);
 }
diff --git a/src/Verifiable.OAuth/Client/AuthorizationServerMetadata.cs b/src/Verifiable.OAuth/Client/AuthorizationServerMetadata.cs
index 6d64153b..431f7570 100644
--- a/src/Verifiable.OAuth/Client/AuthorizationServerMetadata.cs
+++ b/src/Verifiable.OAuth/Client/AuthorizationServerMetadata.cs
@@ -149,4 +149,14 @@ public sealed record AuthorizationServerMetadata
     /// <c>require_signed_request_object</c> per RFC 9101 §10.6.
     /// </summary>
     public bool RequireSignedRequestObject { get; init; }
+
+    /// <summary>
+    /// Whether the AS supports retrieving client metadata from a <c>client_id</c> URL;
+    /// advertised as <c>client_id_metadata_document_supported</c> per
+    /// draft-ietf-oauth-client-id-metadata-document-02 §6. A client uses this to avoid
+    /// redirecting the user to an AS that cannot resolve its Client ID Metadata Document.
+    /// An omitted member leaves this <see langword="false"/>, matching §6's OPTIONAL
+    /// boolean's unstated default.
+    /// </summary>
+    public bool ClientIdMetadataDocumentSupported { get; init; }
 }
diff --git a/src/Verifiable.OAuth/Client/ClientMetadata.cs b/src/Verifiable.OAuth/Client/ClientMetadata.cs
index f085da0a..a9e96560 100644
--- a/src/Verifiable.OAuth/Client/ClientMetadata.cs
+++ b/src/Verifiable.OAuth/Client/ClientMetadata.cs
@@ -31,9 +31,9 @@ namespace Verifiable.OAuth.Client;
 /// </para>
 /// <para>
 /// Fields not yet modelled here (the human-facing localised fields like
-/// <c>logo_uri</c>, <c>tos_uri</c>, <c>policy_uri</c>, <c>contacts</c>,
-/// <c>client_name#xx</c> locale variants) land when their flows arrive.
-/// The fields below cover the protocol-significant set.
+/// <c>tos_uri</c>, <c>policy_uri</c>, <c>contacts</c>, <c>client_name#xx</c>
+/// locale variants) land when their flows arrive. The fields below cover
+/// the protocol-significant set.
 /// </para>
 /// </remarks>
 [DebuggerDisplay("ClientMetadata ClientName={ClientName}")]
@@ -49,6 +49,13 @@ public sealed record ClientMetadata
     /// </summary>
     public Uri? ClientUri { get; init; }
 
+    /// <summary>
+    /// URL that references a logo for the client. When present, the server
+    /// SHOULD display this image to the end user during authorization.
+    /// RFC 7591 §2 <c>logo_uri</c>.
+    /// </summary>
+    public Uri? LogoUri { get; init; }
+
     /// <summary>
     /// Redirect URIs registered for this client. RFC 7591 §2 <c>redirect_uris</c>.
     /// </summary>
@@ -124,6 +131,18 @@ public sealed record ClientMetadata
     /// </remarks>
     public string? Jwks { get; init; }
 
+    /// <summary>
+    /// A software statement containing client metadata values about the
+    /// client software as claims, carried as the entire signed JWT in
+    /// compact serialization. RFC 7591 §2.3 <c>software_statement</c>.
+    /// </summary>
+    /// <remarks>
+    /// Verifying the statement's signature and evaluating its claims is out
+    /// of scope for this type — it is carried opaque so callers that need a
+    /// trust decision from it validate the JWT separately.
+    /// </remarks>
+    public string? SoftwareStatement { get; init; }
+
 
     //OIDC Dynamic Registration 1.0 fields (extends RFC 7591).
 
diff --git a/src/Verifiable.OAuth/Client/ClientRegistration.cs b/src/Verifiable.OAuth/Client/ClientRegistration.cs
index d2d9257b..33b9072b 100644
--- a/src/Verifiable.OAuth/Client/ClientRegistration.cs
+++ b/src/Verifiable.OAuth/Client/ClientRegistration.cs
@@ -214,6 +214,15 @@ public sealed record ClientRegistration
     /// <see cref="ClientId"/>. <see langword="null"/> for non-CIMD
     /// lifecycles.
     /// </summary>
+    /// <remarks>
+    /// A short URL is RECOMMENDED, since the URI may be displayed to the end user in
+    /// authorization or management interfaces, and a stable URL that does not change
+    /// frequently is RECOMMENDED as well — authorization servers compare Client
+    /// Identifier URLs by simple string comparison, so a changed URL is an entirely
+    /// different client with no relationship to the previous one
+    /// (draft-ietf-oauth-client-id-metadata-document-02 §3, §8.3). See
+    /// <see cref="ClientIdentifierUrl"/> for the URL shape rules.
+    /// </remarks>
     public Uri? ClientMetadataUri { get; init; }
 
 
diff --git a/src/Verifiable.OAuth/Client/ClientTokenEndpointAuthentication.cs b/src/Verifiable.OAuth/Client/ClientTokenEndpointAuthentication.cs
new file mode 100644
index 00000000..3b7d8845
--- /dev/null
+++ b/src/Verifiable.OAuth/Client/ClientTokenEndpointAuthentication.cs
@@ -0,0 +1,95 @@
+using System.Diagnostics;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.OAuth.Server;
+
+namespace Verifiable.OAuth.Client;
+
+/// <summary>
+/// Per-call inputs for signing the <c>private_key_jwt</c> client assertion
+/// <see cref="ClientTokenEndpointAuthentication.AttachClientAssertionAsync"/> attaches to a
+/// token-endpoint request per
+/// <see href="https://www.rfc-editor.org/rfc/rfc7523#section-2.2">RFC 7523 §2.2</see>. The signing
+/// key itself is read from <see cref="ClientRegistration.AuthenticationKeyMaterial"/> — this record
+/// carries only the pieces that vary independently of the registration (the <c>kid</c>, the wire
+/// serialisers, and the assertion's validity window).
+/// </summary>
+[DebuggerDisplay("ClientAssertionOptions SigningKeyId={SigningKeyId}")]
+public sealed record ClientAssertionOptions
+{
+    /// <summary>
+    /// The <c>kid</c> header parameter value identifying
+    /// <see cref="ClientRegistration.AuthenticationKeyMaterial"/>'s private key to the authorization
+    /// server.
+    /// </summary>
+    public required string SigningKeyId { get; init; }
+
+    /// <summary>Serialises the client-assertion protected header to UTF-8 JSON bytes.</summary>
+    public required JwtHeaderSerializer HeaderSerializer { get; init; }
+
+    /// <summary>Serialises the client-assertion payload claims to UTF-8 JSON bytes.</summary>
+    public required JwtPayloadSerializer PayloadSerializer { get; init; }
+
+    /// <summary>The validity window of the signed client assertion (RFC 7523 §3). Defaults to one minute.</summary>
+    public TimeSpan ClientAssertionLifetime { get; init; } = TimeSpan.FromMinutes(1);
+}
+
+
+/// <summary>
+/// Composes the <c>private_key_jwt</c> confidential-client authentication assertion
+/// <see href="https://www.rfc-editor.org/rfc/rfc7523#section-2.2">RFC 7523 §2.2</see> defines,
+/// shared by every client-side flow that authenticates a confidential client at a token endpoint:
+/// the <see cref="Verifiable.OAuth.IdJag.IdJagFlowHandlers"/> mint (§4.3) and redeem (§4.4)
+/// exchanges, and the <see cref="Verifiable.OAuth.AuthCode.AuthCodeFlowHandlers"/> authorization-code
+/// token leg.
+/// </summary>
+[DebuggerDisplay("ClientTokenEndpointAuthentication")]
+public static class ClientTokenEndpointAuthentication
+{
+    /// <summary>
+    /// Adds the confidential-client authentication parameters — <c>client_id</c>,
+    /// <c>client_assertion_type</c>, and a freshly-signed <c>private_key_jwt</c> <c>client_assertion</c>
+    /// (RFC 7523 §2.2) bound to the token endpoint — to a token-endpoint request form.
+    /// </summary>
+    public static async ValueTask AttachClientAssertionAsync(
+        OutgoingFormFields form,
+        ClientRegistration registration,
+        Uri tokenEndpoint,
+        PrivateKeyMemory signingKey,
+        string signingKeyId,
+        JwtHeaderSerializer headerSerializer,
+        JwtPayloadSerializer payloadSerializer,
+        TimeSpan clientAssertionLifetime,
+        OAuthClientInfrastructure infrastructure,
+        DateTimeOffset now,
+        ExchangeContext context,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(form);
+        ArgumentNullException.ThrowIfNull(registration);
+        ArgumentNullException.ThrowIfNull(tokenEndpoint);
+        ArgumentNullException.ThrowIfNull(infrastructure);
+
+        string jti = await infrastructure.GenerateIdentifierAsync(
+            WellKnownIdentifierPurposes.OAuthJti, context, cancellationToken).ConfigureAwait(false);
+
+        string clientAssertion = await ClientAssertionSigning.SignAsync(
+            registration.ClientId.Value,
+            tokenEndpoint.OriginalString,
+            jti,
+            now,
+            now.Add(clientAssertionLifetime),
+            signingKey,
+            signingKeyId,
+            headerSerializer,
+            payloadSerializer,
+            infrastructure.Base64UrlEncoder,
+            infrastructure.MemoryPool,
+            cancellationToken).ConfigureAwait(false);
+
+        form[OAuthRequestParameterNames.ClientId] = registration.ClientId.Value;
+        form[OAuthRequestParameterNames.ClientAssertionType] = WellKnownClientAssertionTypes.JwtBearer;
+        form[OAuthRequestParameterNames.ClientAssertion] = clientAssertion;
+    }
+}
diff --git a/src/Verifiable.OAuth/Client/OutgoingFormFieldsClientAuthExtensions.cs b/src/Verifiable.OAuth/Client/OutgoingFormFieldsClientAuthExtensions.cs
index a6b0fd5c..1d33eb45 100644
--- a/src/Verifiable.OAuth/Client/OutgoingFormFieldsClientAuthExtensions.cs
+++ b/src/Verifiable.OAuth/Client/OutgoingFormFieldsClientAuthExtensions.cs
@@ -24,7 +24,12 @@ public static class OutgoingFormFieldsClientAuthExtensions
         /// wire-decoded strings; the transport's <see cref="Verifiable.OAuth.AuthCode.SendFormPostDelegate"/> owns
         /// <c>application/x-www-form-urlencoded</c> encoding (the builder-output ruling). This is
         /// unlike <see cref="OutgoingHeadersClientAuthExtensions.WithClientSecretBasic"/>, which
-        /// composes a header value the library must encode itself.
+        /// composes a header value the library must encode itself and so can Base64-encode straight
+        /// from a cleared scratch buffer. Here the single <see cref="Encoding.GetString(ReadOnlySpan{byte})"/>
+        /// call is the irreducible copy: <see cref="OutgoingFormFields"/> is a plain string-keyed
+        /// dictionary matching the RFC 6749 §2.3.1 body-parameter shape, so the <c>client_secret</c>
+        /// field value itself — not an extra intermediate — is where this method's copy of the secret
+        /// ends up, exactly as long as <paramref name="form"/> retains it.
         /// <paramref name="clientSecretUtf8"/> is read once during the call and not retained anywhere
         /// by this method — the caller owns clearing its own pooled backing buffer afterward.
         /// <see href="https://www.rfc-editor.org/rfc/rfc6749#section-2.3">RFC 6749 §2.3</see>: "The
diff --git a/src/Verifiable.OAuth/Client/OutgoingHeadersClientAuthExtensions.cs b/src/Verifiable.OAuth/Client/OutgoingHeadersClientAuthExtensions.cs
index aa2935aa..d91446bf 100644
--- a/src/Verifiable.OAuth/Client/OutgoingHeadersClientAuthExtensions.cs
+++ b/src/Verifiable.OAuth/Client/OutgoingHeadersClientAuthExtensions.cs
@@ -11,10 +11,11 @@ namespace Verifiable.OAuth.Client;
 public static class OutgoingHeadersClientAuthExtensions
 {
     /// <summary>
-    /// The largest <see cref="FormUrlEncodeUtf8"/> output, in <see langword="char"/>s, encoded on the
-    /// stack. <see cref="FormUrlEncodeUtf8"/> needs up to three output characters per input byte, so
-    /// this bounds stack-eligible input at 128 UTF-8 bytes — generous for any realistic client
-    /// identifier or shared secret. Longer inputs fall back to a pooled buffer.
+    /// The largest combined form-url-encoded <c>id:secret</c> credentials buffer, in bytes, encoded
+    /// on the stack. Each input octet expands to at most three encoded output bytes (a <c>%XX</c>
+    /// triplet), so this bounds the combined stack-eligible input (<c>client_id</c> plus the client
+    /// secret) at 128 UTF-8 bytes — generous for any realistic client identifier and shared secret.
+    /// Longer inputs fall back to a pooled buffer.
     /// </summary>
     private const int MaxStackEncodedLength = 384;
 
@@ -34,8 +35,11 @@ public static class OutgoingHeadersClientAuthExtensions
         /// <remarks>
         /// <paramref name="clientSecretUtf8"/> is read once during the call and not retained anywhere
         /// by this method — the caller owns clearing its own pooled backing buffer afterward. The
-        /// intermediate encode scratch this method itself allocates on the stack (or rents from
-        /// <see cref="ArrayPool{T}"/> for unusually long inputs) is cleared before return.
+        /// combined form-url-encoded <c>id:secret</c> scratch buffer this method writes directly into
+        /// (on the stack, or rented from <see cref="ArrayPool{T}"/> for unusually long inputs) is
+        /// cleared before return, and is Base64-encoded in place — the plaintext secret never
+        /// materializes as a managed <see cref="string"/> or an unpooled byte array anywhere in this
+        /// method; the returned Base64 credentials string is the only value that carries it onward.
         /// <see href="https://www.rfc-editor.org/rfc/rfc6749#section-2.3">RFC 6749 §2.3</see>: "The
         /// client MUST NOT use more than one authentication method in each request." A caller composing
         /// a token request MUST choose exactly one of this method or
@@ -50,63 +54,72 @@ public OutgoingHeaders WithClientSecretBasic(string clientId, ReadOnlySpan<byte>
             ArgumentNullException.ThrowIfNull(headers);
             ArgumentException.ThrowIfNullOrEmpty(clientId);
 
-            string encodedId = FormUrlEncodeUtf8(Encoding.UTF8.GetBytes(clientId));
-            string encodedSecret = FormUrlEncodeUtf8(clientSecretUtf8);
-            string credentials = string.Concat(encodedId, ":", encodedSecret);
-            string base64Credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes(credentials));
+            ReadOnlySpan<byte> clientIdUtf8 = Encoding.UTF8.GetBytes(clientId);
 
-            return headers.WithAuthorization(WellKnownAuthenticationSchemes.Basic, base64Credentials);
+            //Every octet of clientIdUtf8 and clientSecretUtf8 expands to at most 3 encoded bytes (a
+            //%XX triplet), plus one byte for the joining ':' — the upper bound for the combined
+            //credentials buffer this method Base64-encodes directly from, below.
+            int maxCombinedLength = (clientIdUtf8.Length * 3) + 1 + (clientSecretUtf8.Length * 3);
+            byte[]? rented = null;
+            Span<byte> combined = maxCombinedLength <= MaxStackEncodedLength
+                ? stackalloc byte[maxCombinedLength]
+                : (rented = ArrayPool<byte>.Shared.Rent(maxCombinedLength));
+
+            try
+            {
+                int written = FormUrlEncodeUtf8Into(clientIdUtf8, combined);
+                combined[written++] = (byte)':';
+                written += FormUrlEncodeUtf8Into(clientSecretUtf8, combined[written..]);
+
+                string base64Credentials = Convert.ToBase64String(combined[..written]);
+
+                return headers.WithAuthorization(WellKnownAuthenticationSchemes.Basic, base64Credentials);
+            }
+            finally
+            {
+                combined.Clear();
+                if(rented is not null)
+                {
+                    ArrayPool<byte>.Shared.Return(rented);
+                }
+            }
         }
     }
 
 
     /// <summary>
-    /// The RFC 6749 Appendix B <c>application/x-www-form-urlencoded</c> byte-level encoding: each
-    /// unreserved octet (ALPHA, DIGIT, <c>-</c>, <c>.</c>, <c>_</c>, <c>*</c>) is copied verbatim, the
-    /// space octet becomes <c>+</c>, and every other octet becomes an uppercase-hex <c>%XX</c> triplet
-    /// — the rule RFC 6749's own worked example applies to space, <c>%</c>, <c>&amp;</c>, <c>+</c>,
-    /// and non-ASCII octets alike (encoding UTF-8 bytes, not Unicode code points, so multi-byte
-    /// characters become one <c>%XX</c> triplet per octet).
+    /// The RFC 6749 Appendix B <c>application/x-www-form-urlencoded</c> byte-level encoding, written
+    /// directly into <paramref name="destination"/>: each unreserved octet (ALPHA, DIGIT, <c>-</c>,
+    /// <c>.</c>, <c>_</c>, <c>*</c>) is copied verbatim, the space octet becomes <c>+</c>, and every
+    /// other octet becomes an uppercase-hex <c>%XX</c> triplet — the rule RFC 6749's own worked
+    /// example applies to space, <c>%</c>, <c>&amp;</c>, <c>+</c>, and non-ASCII octets alike
+    /// (encoding UTF-8 bytes, not Unicode code points, so multi-byte characters become one
+    /// <c>%XX</c> triplet per octet). <paramref name="destination"/> must be large enough for the
+    /// worst case (three output bytes per input octet); the caller owns sizing and clearing it.
     /// </summary>
-    private static string FormUrlEncodeUtf8(ReadOnlySpan<byte> value)
+    /// <returns>The number of bytes written to <paramref name="destination"/>.</returns>
+    private static int FormUrlEncodeUtf8Into(ReadOnlySpan<byte> value, Span<byte> destination)
     {
-        int maxLength = value.Length * 3;
-        char[]? rented = null;
-        Span<char> buffer = maxLength <= MaxStackEncodedLength
-            ? stackalloc char[maxLength]
-            : (rented = ArrayPool<char>.Shared.Rent(maxLength));
-
-        try
+        int written = 0;
+        foreach(byte b in value)
         {
-            int written = 0;
-            foreach(byte b in value)
+            if(IsUnreservedOctet(b))
             {
-                if(IsUnreservedOctet(b))
-                {
-                    buffer[written++] = (char)b;
-                }
-                else if(b == (byte)' ')
-                {
-                    buffer[written++] = '+';
-                }
-                else
-                {
-                    buffer[written++] = '%';
-                    buffer[written++] = ToUpperHexDigit(b >> 4);
-                    buffer[written++] = ToUpperHexDigit(b & 0xF);
-                }
+                destination[written++] = b;
             }
-
-            return new string(buffer[..written]);
-        }
-        finally
-        {
-            buffer.Clear();
-            if(rented is not null)
+            else if(b == (byte)' ')
             {
-                ArrayPool<char>.Shared.Return(rented);
+                destination[written++] = (byte)'+';
+            }
+            else
+            {
+                destination[written++] = (byte)'%';
+                destination[written++] = ToUpperHexDigit(b >> 4);
+                destination[written++] = ToUpperHexDigit(b & 0xF);
             }
         }
+
+        return written;
     }
 
 
@@ -118,7 +131,7 @@ private static bool IsUnreservedOctet(byte b) =>
         || b == (byte)'-' || b == (byte)'.' || b == (byte)'_' || b == (byte)'*';
 
 
-    /// <summary>Renders <paramref name="nibble"/> (0-15) as an uppercase hex digit character.</summary>
-    private static char ToUpperHexDigit(int nibble) =>
-        (char)(nibble < 10 ? '0' + nibble : 'A' + (nibble - 10));
+    /// <summary>Renders <paramref name="nibble"/> (0-15) as an uppercase hex digit.</summary>
+    private static byte ToUpperHexDigit(int nibble) =>
+        (byte)(nibble < 10 ? '0' + nibble : 'A' + (nibble - 10));
 }
diff --git a/src/Verifiable.OAuth/ClientIdentifierUrl.cs b/src/Verifiable.OAuth/ClientIdentifierUrl.cs
new file mode 100644
index 00000000..43dd1b08
--- /dev/null
+++ b/src/Verifiable.OAuth/ClientIdentifierUrl.cs
@@ -0,0 +1,211 @@
+namespace Verifiable.OAuth;
+
+/// <summary>
+/// The outcome of validating a candidate Client Identifier URL against
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-3">
+/// draft-ietf-oauth-client-id-metadata-document-02 Section 3</see>. <see cref="IsValid"/> aggregates only
+/// the MUST/MUST NOT-tier rules (CIMD-001, CIMD-002, CIMD-004, CIMD-005, CIMD-007, plus the structural
+/// "is this even an absolute https URL" precondition); <see cref="HasQueryComponent"/> (CIMD-006) and
+/// <see cref="IsRootPath"/> (CIMD-011) are SHOULD/NOT RECOMMENDED-tier advisories that never affect it.
+/// </summary>
+public sealed record ClientIdentifierUrlValidationResult
+{
+    /// <summary>
+    /// Whether the candidate satisfies every MUST/MUST NOT-tier rule in Section 3: it has the
+    /// <c>scheme://authority/path</c> shape, the scheme is <c>https</c>, there is no userinfo
+    /// component, the path component is non-empty, no path segment is <c>.</c> or <c>..</c>, and there
+    /// is no fragment component. <see cref="HasQueryComponent"/> and <see cref="IsRootPath"/> do not
+    /// affect this value.
+    /// </summary>
+    public bool IsValid { get; init; }
+
+    /// <summary>
+    /// The candidate does not have the <c>scheme://authority/path</c> absolute-URL shape a Client
+    /// Identifier URL requires — for example a relative reference, an empty string, or a scheme that
+    /// uses the opaque (non-authority) form. When this is <see langword="true"/> every other flag on
+    /// this result stays at its default (structurally there is no authority or path to inspect).
+    /// </summary>
+    public bool NotAnAbsoluteUrl { get; init; }
+
+    /// <summary>
+    /// Section 3: "MUST use the https URL scheme" (CIMD-001). The scheme comparison is
+    /// case-insensitive per <see href="https://www.rfc-editor.org/rfc/rfc3986#section-3.1">RFC 3986
+    /// §3.1</see> — this is independent of the ordinal whole-URL comparison
+    /// <see cref="ClientIdentifierUrl.IsMatch(string, string)"/> performs.
+    /// </summary>
+    public bool NotHttpsScheme { get; init; }
+
+    /// <summary>
+    /// Section 3: "MUST NOT contain a userinfo component defined by [RFC3986]" (CIMD-002).
+    /// </summary>
+    public bool HasUserinfo { get; init; }
+
+    /// <summary>
+    /// Section 3: "MUST contain a path component" (CIMD-004) — the candidate has no path at all, e.g.
+    /// <c>https://example.com</c>. A path of exactly <c>/</c> satisfies this rule (see
+    /// <see cref="IsRootPath"/> for its separate advisory).
+    /// </summary>
+    public bool MissingPathComponent { get; init; }
+
+    /// <summary>
+    /// Section 3: "MUST NOT contain single-dot or double-dot path components" (CIMD-005) — a path
+    /// segment equal to exactly <c>.</c> or <c>..</c>, anywhere in the path.
+    /// </summary>
+    public bool HasDotSegments { get; init; }
+
+    /// <summary>
+    /// Section 3: "MUST NOT contain a fragment component" (CIMD-007).
+    /// </summary>
+    public bool HasFragment { get; init; }
+
+    /// <summary>
+    /// Section 3: "SHOULD NOT contain a query component" (CIMD-006). Advisory — does not affect
+    /// <see cref="IsValid"/>.
+    /// </summary>
+    public bool HasQueryComponent { get; init; }
+
+    /// <summary>
+    /// Section 3: "Using a path of / ... is NOT RECOMMENDED, since the Client ID Metadata Document
+    /// would then be served at the root of the domain" (CIMD-011). Advisory — does not affect
+    /// <see cref="IsValid"/>.
+    /// </summary>
+    public bool IsRootPath { get; init; }
+}
+
+
+/// <summary>
+/// Validates a candidate Client Identifier URL against
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-3">
+/// draft-ietf-oauth-client-id-metadata-document-02 Section 3</see>, and compares two Client Identifier
+/// URLs (or a URL against a document's <c>client_id</c> value) the way Section 3 (CIMD-008) and Section 4
+/// (CIMD-016) both require: simple string comparison per
+/// <see href="https://www.rfc-editor.org/rfc/rfc3986#section-6.2.1">RFC 3986 §6.2.1</see>.
+/// </summary>
+/// <remarks>
+/// <see cref="ClientIdentifierUrl.Validate(string)"/> operates on the raw candidate string, never on a parsed <see cref="Uri"/>:
+/// <see cref="Uri"/> normalization erases exactly the distinctions Section 3 depends on. Constructing a
+/// <see cref="Uri"/> from <c>https://example.com</c> invents a <c>/</c> path, masking the CIMD-004
+/// missing-path defect, and <see cref="Uri.Equals(object?)"/> treats <c>https://example.com:443/client</c>
+/// as equal to <c>https://example.com/client</c>, masking the CIMD-008 default-port non-equivalence the
+/// spec calls out by name. A short URL and a URL that stays stable for the client's lifetime (Section 3,
+/// RECOMMENDED — CIMD-009/CIMD-010; a changing URL "will appear to the authorization server to be an
+/// entirely different Client Identifier URL", Section 8.3) are qualitative deployment guidance with no
+/// machine-checkable shape: they are not represented as a flag on
+/// <see cref="ClientIdentifierUrlValidationResult"/>, and the same guidance governs
+/// <see cref="Verifiable.OAuth.Client.ClientRegistration.ClientMetadataUri"/>.
+/// </remarks>
+public static class ClientIdentifierUrl
+{
+    private const string SingleDotSegment = ".";
+    private const string DoubleDotSegment = "..";
+    private const string AuthorityMarker = "://";
+
+    /// <summary>
+    /// Validates <paramref name="candidate"/> against every Section 3 rule and returns the full defect
+    /// taxonomy — this never throws for a malformed candidate, since classifying malformed input is the
+    /// method's purpose.
+    /// </summary>
+    /// <param name="candidate">The raw, unparsed candidate Client Identifier URL string.</param>
+    public static ClientIdentifierUrlValidationResult Validate(string candidate)
+    {
+        ArgumentNullException.ThrowIfNull(candidate);
+
+        ReadOnlySpan<char> value = candidate.AsSpan();
+
+        int fragmentDelimiter = value.IndexOf('#');
+        bool hasFragment = fragmentDelimiter >= 0;
+        ReadOnlySpan<char> withoutFragment = hasFragment ? value[..fragmentDelimiter] : value;
+
+        int queryDelimiter = withoutFragment.IndexOf('?');
+        bool hasQuery = queryDelimiter >= 0;
+        ReadOnlySpan<char> withoutQuery = hasQuery ? withoutFragment[..queryDelimiter] : withoutFragment;
+
+        int authorityMarker = withoutQuery.IndexOf(AuthorityMarker, StringComparison.Ordinal);
+        if(authorityMarker <= 0)
+        {
+            return new ClientIdentifierUrlValidationResult
+            {
+                IsValid = false,
+                NotAnAbsoluteUrl = true
+            };
+        }
+
+        ReadOnlySpan<char> scheme = withoutQuery[..authorityMarker];
+        ReadOnlySpan<char> authorityAndPath = withoutQuery[(authorityMarker + AuthorityMarker.Length)..];
+
+        bool isNotHttpsScheme = !scheme.Equals(Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase);
+
+        int pathDelimiter = authorityAndPath.IndexOf('/');
+        bool isMissingPath = pathDelimiter < 0;
+        ReadOnlySpan<char> authority = isMissingPath ? authorityAndPath : authorityAndPath[..pathDelimiter];
+        ReadOnlySpan<char> path = isMissingPath ? ReadOnlySpan<char>.Empty : authorityAndPath[pathDelimiter..];
+
+        bool hasUserinfo = authority.IndexOf('@') >= 0;
+        bool isRootPath = !isMissingPath && path.Equals("/", StringComparison.Ordinal);
+        bool hasDotSegments = HasDotSegments(path);
+
+        bool isValid = !isNotHttpsScheme
+            && !hasUserinfo
+            && !isMissingPath
+            && !hasDotSegments
+            && !hasFragment;
+
+        return new ClientIdentifierUrlValidationResult
+        {
+            IsValid = isValid,
+            NotHttpsScheme = isNotHttpsScheme,
+            HasUserinfo = hasUserinfo,
+            MissingPathComponent = isMissingPath,
+            HasDotSegments = hasDotSegments,
+            HasFragment = hasFragment,
+            HasQueryComponent = hasQuery,
+            IsRootPath = isRootPath
+        };
+    }
+
+
+    /// <summary>
+    /// Whether <paramref name="first"/> and <paramref name="second"/> are the identical Client
+    /// Identifier URL, per the "simple string comparison" Section 3 (CIMD-008) requires for two Client
+    /// Identifier URLs and Section 4 (CIMD-016) requires for a document's <c>client_id</c> value against
+    /// the URL used to fetch it: ordinal, code-point-by-code-point equality with no scheme
+    /// case-folding, no percent-encoding case-folding, and no default-port elision. The spec's own
+    /// example: <c>https://example.com/client</c> and <c>https://example.com:443/client</c> are NOT
+    /// equivalent even though 443 is the default port for the https scheme.
+    /// </summary>
+    /// <param name="first">The first candidate Client Identifier URL string.</param>
+    /// <param name="second">The second candidate Client Identifier URL string.</param>
+    public static bool IsMatch(string first, string second)
+    {
+        ArgumentNullException.ThrowIfNull(first);
+        ArgumentNullException.ThrowIfNull(second);
+
+        return string.Equals(first, second, StringComparison.Ordinal);
+    }
+
+
+    /// <summary>
+    /// Whether <paramref name="path"/> — a leading-slash path component, or empty — contains a path
+    /// segment equal to exactly <c>.</c> or <c>..</c> (CIMD-005). A segment such as <c>a..b</c> or
+    /// <c>..b</c> is not a dot segment: the whole segment, delimited by <c>/</c>, must equal one of the
+    /// two literal forms.
+    /// </summary>
+    private static bool HasDotSegments(ReadOnlySpan<char> path)
+    {
+        while(path.Length > 0)
+        {
+            ReadOnlySpan<char> remainder = path[1..];
+            int nextSlash = remainder.IndexOf('/');
+            ReadOnlySpan<char> segment = nextSlash < 0 ? remainder : remainder[..nextSlash];
+
+            if(segment.Equals(SingleDotSegment, StringComparison.Ordinal) || segment.Equals(DoubleDotSegment, StringComparison.Ordinal))
+            {
+                return true;
+            }
+
+            path = nextSlash < 0 ? ReadOnlySpan<char>.Empty : remainder[nextSlash..];
+        }
+
+        return false;
+    }
+}
diff --git a/src/Verifiable.OAuth/Diagnostics/OAuthEventNames.cs b/src/Verifiable.OAuth/Diagnostics/OAuthEventNames.cs
index 0c9dc532..e6523bba 100644
--- a/src/Verifiable.OAuth/Diagnostics/OAuthEventNames.cs
+++ b/src/Verifiable.OAuth/Diagnostics/OAuthEventNames.cs
@@ -79,4 +79,29 @@ public static class OAuthEventNames
     /// </summary>
     public static readonly string Oid4VpClientIdMixUpRejected =
         Utf8Constants.ToInternedString(Oid4VpClientIdMixUpRejectedUtf8);
+
+    /// <summary>The UTF-8 source literal of <see cref="IdentityScopesDroppedForNonEndUserGrant"/>.</summary>
+    public static ReadOnlySpan<byte> IdentityScopesDroppedForNonEndUserGrantUtf8 =>
+        "oauth.token.identity_scopes_dropped_for_non_end_user_grant"u8;
+
+    /// <summary>
+    /// The token endpoint narrowed the granted scope for a non-end-user grant
+    /// (<c>client_credentials</c> or <c>pre_authorized_code</c>) by dropping <c>openid</c> and
+    /// the OIDC Core §5.4 identity scopes (<c>profile</c> / <c>email</c> / <c>address</c> /
+    /// <c>phone</c>) per <see href="https://www.rfc-editor.org/rfc/rfc6749#section-3.3">RFC
+    /// 6749 §3.3</see> narrowing. These grants have no authenticated End-User — the subject is
+    /// the client itself, or a Wallet with no established session — so a granted <c>openid</c>
+    /// scope would let an ID Token or UserInfo response misrepresent a machine as an
+    /// authenticated user. The dropped scope values ride under
+    /// <see cref="DroppedScopesTagName"/>.
+    /// </summary>
+    public static readonly string IdentityScopesDroppedForNonEndUserGrant =
+        Utf8Constants.ToInternedString(IdentityScopesDroppedForNonEndUserGrantUtf8);
+
+    /// <summary>
+    /// The <see cref="System.Diagnostics.ActivityTagsCollection"/> key carrying the
+    /// space-separated scope values dropped by an
+    /// <see cref="IdentityScopesDroppedForNonEndUserGrant"/> event.
+    /// </summary>
+    public static readonly string DroppedScopesTagName = "oauth.token.dropped_scopes";
 }
diff --git a/src/Verifiable.OAuth/IdJag/IdJagFlowHandlers.cs b/src/Verifiable.OAuth/IdJag/IdJagFlowHandlers.cs
index 2000f221..7172509b 100644
--- a/src/Verifiable.OAuth/IdJag/IdJagFlowHandlers.cs
+++ b/src/Verifiable.OAuth/IdJag/IdJagFlowHandlers.cs
@@ -1,10 +1,7 @@
 using System.Diagnostics;
 using Verifiable.Core;
-using Verifiable.Cryptography;
-using Verifiable.JCose;
 using Verifiable.OAuth.AuthCode;
 using Verifiable.OAuth.Client;
-using Verifiable.OAuth.Server;
 
 namespace Verifiable.OAuth.IdJag;
 
@@ -66,7 +63,7 @@ public static async ValueTask<Result<TokenResponse, OAuthParseError>> MintAsync(
             form[OAuthRequestParameterNames.AuthorizationDetails] = options.AuthorizationDetails;
         }
 
-        await AttachClientAssertionAsync(
+        await ClientTokenEndpointAuthentication.AttachClientAssertionAsync(
             form, registration, tokenEndpoint, options.SigningKey, options.SigningKeyId,
             options.HeaderSerializer, options.PayloadSerializer, options.ClientAssertionLifetime,
             infrastructure, now, context, cancellationToken).ConfigureAwait(false);
@@ -107,7 +104,7 @@ public static async ValueTask<Result<TokenResponse, OAuthParseError>> RedeemAsyn
             [OAuthRequestParameterNames.Assertion] = options.Assertion
         };
 
-        await AttachClientAssertionAsync(
+        await ClientTokenEndpointAuthentication.AttachClientAssertionAsync(
             form, registration, tokenEndpoint, options.SigningKey, options.SigningKeyId,
             options.HeaderSerializer, options.PayloadSerializer, options.ClientAssertionLifetime,
             infrastructure, now, context, cancellationToken).ConfigureAwait(false);
@@ -117,46 +114,4 @@ await AttachClientAssertionAsync(
 
         return infrastructure.ParseTokenResponseAsync(response, now);
     }
-
-
-    /// <summary>
-    /// Adds the confidential-client authentication parameters — <c>client_id</c>,
-    /// <c>client_assertion_type</c>, and a freshly-signed <c>private_key_jwt</c> <c>client_assertion</c>
-    /// (RFC 7523 §2.2) bound to the token endpoint — to a token-endpoint request form.
-    /// </summary>
-    private static async ValueTask AttachClientAssertionAsync(
-        OutgoingFormFields form,
-        ClientRegistration registration,
-        Uri tokenEndpoint,
-        PrivateKeyMemory signingKey,
-        string signingKeyId,
-        JwtHeaderSerializer headerSerializer,
-        JwtPayloadSerializer payloadSerializer,
-        TimeSpan clientAssertionLifetime,
-        OAuthClientInfrastructure infrastructure,
-        DateTimeOffset now,
-        ExchangeContext context,
-        CancellationToken cancellationToken)
-    {
-        string jti = await infrastructure.GenerateIdentifierAsync(
-            WellKnownIdentifierPurposes.OAuthJti, context, cancellationToken).ConfigureAwait(false);
-
-        string clientAssertion = await ClientAssertionSigning.SignAsync(
-            registration.ClientId.Value,
-            tokenEndpoint.OriginalString,
-            jti,
-            now,
-            now.Add(clientAssertionLifetime),
-            signingKey,
-            signingKeyId,
-            headerSerializer,
-            payloadSerializer,
-            infrastructure.Base64UrlEncoder,
-            infrastructure.MemoryPool,
-            cancellationToken).ConfigureAwait(false);
-
-        form[OAuthRequestParameterNames.ClientId] = registration.ClientId.Value;
-        form[OAuthRequestParameterNames.ClientAssertionType] = WellKnownClientAssertionTypes.JwtBearer;
-        form[OAuthRequestParameterNames.ClientAssertion] = clientAssertion;
-    }
 }
diff --git a/src/Verifiable.OAuth/IssuanceContext.cs b/src/Verifiable.OAuth/IssuanceContext.cs
index e910a182..94f6c4b5 100644
--- a/src/Verifiable.OAuth/IssuanceContext.cs
+++ b/src/Verifiable.OAuth/IssuanceContext.cs
@@ -90,6 +90,21 @@ public sealed record IssuanceContext
     /// </summary>
     public required string ClientId { get; init; }
 
+    /// <summary>
+    /// The wire <c>grant_type</c> value for this token-endpoint request — one of the
+    /// <see cref="WellKnownGrantTypes"/> constants (<c>authorization_code</c>,
+    /// <c>refresh_token</c>, <c>client_credentials</c>, the RFC 8693 token-exchange URN, the
+    /// RFC 7523 jwt-bearer URN, or the OID4VCI <c>pre-authorized_code</c> URN). Producers use
+    /// it for grant-identity decisions independent of scope — for example
+    /// <see cref="Server.Oidc10IdTokenProducer"/> issues an ID Token only when
+    /// <see cref="GrantType"/> is <c>authorization_code</c>, or <c>refresh_token</c> with
+    /// <see cref="RefreshTokenOriginatingGrantType"/> itself <c>authorization_code</c>, so a
+    /// defect that left <c>openid</c> on a <c>client_credentials</c> or <c>token_exchange</c>
+    /// token's scope — or on a refresh token minted alongside one — cannot alone produce an
+    /// identity assertion for a non-end-user subject.
+    /// </summary>
+    public required string GrantType { get; init; }
+
     /// <summary>
     /// The instant the request started processing. Used for <c>iat</c> claims on
     /// every token in this response and as the base for per-token <c>exp</c> values.
@@ -162,4 +177,15 @@ public sealed record IssuanceContext
     /// non-token-exchange issuance.
     /// </summary>
     public IReadOnlyList<string>? Audience { get; init; }
+
+    /// <summary>
+    /// On a <c>refresh_token</c> grant, the redeemed refresh token's
+    /// <see cref="AuthCode.Server.States.ServerRefreshTokenIssuedState.OriginatingGrantType"/> — the
+    /// wire <c>grant_type</c> that first minted the refresh-token chain. <see cref="Server.Oidc10IdTokenProducer"/>
+    /// requires this to be <c>authorization_code</c> before minting a default ID Token on redemption, so a
+    /// refresh token minted alongside a non-End-User grant (<c>client_credentials</c>, <c>token_exchange</c>,
+    /// <c>jwt_bearer</c>, <c>pre_authorized_code</c>) never yields one. <see langword="null"/> for every
+    /// non-refresh grant.
+    /// </summary>
+    public string? RefreshTokenOriginatingGrantType { get; init; }
 }
diff --git a/src/Verifiable.OAuth/JwsAccessTokenValidationFailureReason.cs b/src/Verifiable.OAuth/JwsAccessTokenValidationFailureReason.cs
index b2d141ca..be3057a4 100644
--- a/src/Verifiable.OAuth/JwsAccessTokenValidationFailureReason.cs
+++ b/src/Verifiable.OAuth/JwsAccessTokenValidationFailureReason.cs
@@ -1,10 +1,15 @@
 namespace Verifiable.OAuth;
 
 /// <summary>
-/// The discrete reasons a JWS-signed access token can be rejected per
-/// RFC 7519 (JWT), RFC 9068 (JWT Profile for OAuth Access Tokens), and
-/// RFC 8725 (JWT BCP). The set is closed; new reasons land as additional
-/// cases.
+/// The discrete reasons a signed JWT can be rejected by the shared validation core
+/// (<see cref="JwsAccessTokenValidator.ValidateSignedJwtCoreAsync"/>) per RFC 7519 (JWT), RFC 9068
+/// (JWT Profile for OAuth Access Tokens), RFC 8725 (JWT BCP), and OIDC Core §3.1.3.7. Both
+/// <see cref="JwsAccessTokenValidationResult"/> (the RFC 9068 access-token profile) and
+/// <see cref="Oidc10IdTokenValidationResult"/> (the OIDC Core §3.1.3.7 ID Token profile) surface
+/// values from this one set — some cases apply to only one profile (<see cref="InvalidType"/> from
+/// either direction, <see cref="NonceMismatch"/> and <see cref="UntrustedAudience"/> from the ID
+/// Token profile only) but a shared vocabulary keeps the two profiles' rejections directly
+/// comparable. The set is closed; new reasons land as additional cases.
 /// </summary>
 public enum JwsAccessTokenValidationFailureReason
 {
@@ -63,4 +68,26 @@ public enum JwsAccessTokenValidationFailureReason
     /// authorized party (its own client_id) — OIDC Core §3.1.3.7.
     /// </summary>
     AuthorizedPartyMismatch,
+
+    /// <summary>
+    /// The header's <c>typ</c> member is missing or is neither <c>at+jwt</c> nor
+    /// <c>application/at+jwt</c> — RFC 9068 §4 rejects a JWT access token carrying any other
+    /// value, distinguishing it from an ID Token or other JWT profile.
+    /// </summary>
+    InvalidType,
+
+    /// <summary>
+    /// The ID Token's <c>nonce</c> claim is missing or does not equal the caller's expected
+    /// nonce — OIDC Core §3.1.3.7's conditional-MUST, enforced when the caller supplies an
+    /// expected nonce to <see cref="Oidc10IdTokenValidator.ValidateAsync"/>.
+    /// </summary>
+    NonceMismatch,
+
+    /// <summary>
+    /// The ID Token's <c>aud</c> claim carries a member that is neither the expected audience nor
+    /// a member of the caller's trusted audience set — OIDC Core §3.1.3.7's MUST to reject an ID
+    /// Token containing an audience it does not trust, enforced when the caller supplies a trusted
+    /// audience set to <see cref="Oidc10IdTokenValidator.ValidateAsync"/>.
+    /// </summary>
+    UntrustedAudience,
 }
diff --git a/src/Verifiable.OAuth/JwsAccessTokenValidator.cs b/src/Verifiable.OAuth/JwsAccessTokenValidator.cs
index 5ca293bc..a11cca42 100644
--- a/src/Verifiable.OAuth/JwsAccessTokenValidator.cs
+++ b/src/Verifiable.OAuth/JwsAccessTokenValidator.cs
@@ -22,6 +22,7 @@ namespace Verifiable.OAuth;
 /// <list type="number">
 ///   <item><description>Structural parse — three base64url segments separated by <c>.</c>.</description></item>
 ///   <item><description>Header decode, alg check — reject <c>none</c> per RFC 8725 §3.1.</description></item>
+///   <item><description><c>typ</c> check — require <c>at+jwt</c> or <c>application/at+jwt</c> per RFC 9068 §4.</description></item>
 ///   <item><description><c>kid</c> resolution via the supplied resolver.</description></item>
 ///   <item><description>Signature verification via <see cref="Jws.VerifyAsync"/>.</description></item>
 ///   <item><description>Standard claim checks: <c>iss</c>, <c>aud</c>, <c>exp</c>, <c>nbf</c>, <c>iat</c>, <c>sub</c>.</description></item>
@@ -61,7 +62,10 @@ public static class JwsAccessTokenValidator
     /// The authorized party (the recipient's own <c>client_id</c>) to validate the <c>azp</c> claim
     /// against per OIDC Core §3.1.3.7. When <see langword="null"/>, <c>azp</c> is surfaced but not
     /// enforced. When supplied: a present <c>azp</c> must equal it, and a multi-valued <c>aud</c> must
-    /// carry <c>azp</c>.
+    /// carry <c>azp</c>. <c>azp</c> is an OIDC ID Token concept; leave this <see langword="null"/> for
+    /// an RFC 9068 access token that legitimately carries multiple RFC 8707 resource-indicator
+    /// audiences with no <c>azp</c>, since supplying it imposes that ID Token coordination and would
+    /// reject such a token.
     /// </param>
     /// <param name="cancellationToken">Cancellation token.</param>
     public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
@@ -79,6 +83,93 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
         ExchangeContext context,
         string? expectedAuthorizedParty,
         CancellationToken cancellationToken)
+    {
+        SignedJwtValidationOutcome outcome = await ValidateSignedJwtCoreAsync(
+            accessToken,
+            expectedIssuer,
+            expectedAudience,
+            resolveVerificationKey,
+            verifySignature,
+            parser,
+            base64UrlDecoder,
+            timeProvider,
+            memoryPool,
+            iatSkew,
+            tenantId,
+            context,
+            expectedAuthorizedParty,
+            JwtTypeEnforcement.RequireAtJwt,
+            cancellationToken).ConfigureAwait(false);
+
+        if(!outcome.IsSuccess)
+        {
+            return JwsAccessTokenValidationResult.Failure(outcome.FailureReason!.Value, outcome.FailureDescription);
+        }
+
+        //Optional access-token-specific claims, read from the shared core's verified payload.
+        TryReadString(outcome.Payload!, WellKnownJwtClaimNames.ClientId, out string? clientId);
+        TryReadString(outcome.Payload!, WellKnownJwtClaimNames.Scope, out string? scope);
+        TryReadString(outcome.Payload!, WellKnownJwtClaimNames.Jti, out string? jti);
+        ConfirmationMethod? confirmation = TryReadConfirmation(outcome.Payload!);
+
+        JwsAccessTokenClaims claims = new()
+        {
+            Subject = outcome.Subject!,
+            Issuer = outcome.Issuer!,
+            Audience = outcome.Audience!,
+            IssuedAt = outcome.IssuedAt!.Value,
+            Expiration = outcome.Expiration!.Value,
+            NotBefore = outcome.NotBefore,
+            ClientId = clientId,
+            AuthorizedParty = outcome.AuthorizedParty,
+            Scope = scope,
+            JwtId = jti,
+            Confirmation = confirmation
+        };
+
+        return JwsAccessTokenValidationResult.Success(claims);
+    }
+
+
+    /// <summary>
+    /// The shared signed-JWT validation core behind <see cref="ValidateAsync"/> (the OAuth 2.0
+    /// access-token profile, RFC 9068 §4 <c>typ</c> = <c>at+jwt</c> enforced) and
+    /// <see cref="Oidc10IdTokenValidator.ValidateAsync"/> (the OIDC Core §3.1.3.7 ID Token profile,
+    /// which refuses the <c>at+jwt</c> access-token type). Runs the structural parse, header
+    /// <c>alg</c>/<c>kid</c> checks, the
+    /// optional RFC 9068 <c>typ</c> check per <paramref name="typeEnforcement"/>, signature
+    /// verification, and the standard <c>iss</c>/<c>aud</c>/<c>azp</c>/<c>exp</c>/<c>iat</c>/
+    /// <c>nbf</c>/<c>sub</c> checks (including the OIDC Core §3.1.3.7 <c>azp</c> coordination shared
+    /// by both profiles). Returns a neutral <see cref="SignedJwtValidationOutcome"/> exposing the
+    /// verified payload rather than either profile's public result type, so neither caller
+    /// duplicates this parse: <see cref="ValidateAsync"/> maps the outcome to
+    /// <see cref="JwsAccessTokenClaims"/> (reading <c>client_id</c>/<c>scope</c>/<c>jti</c>/<c>cnf</c>),
+    /// while <see cref="Oidc10IdTokenValidator.ValidateAsync"/> maps it to
+    /// <see cref="Oidc10IdTokenClaims"/> (reading <c>nonce</c>/<c>auth_time</c>/<c>acr</c>/<c>amr</c>/
+    /// <c>sid</c>/<c>cnf</c>, plus its own nonce and trusted-audience checks).
+    /// </summary>
+    /// <param name="typeEnforcement">
+    /// The header <c>typ</c> policy: <see cref="JwtTypeEnforcement.RequireAtJwt"/> for access tokens
+    /// (RFC 9068 §4); <see cref="JwtTypeEnforcement.RejectAtJwt"/> for ID Tokens — which refuses
+    /// <c>at+jwt</c>/<c>application/at+jwt</c> so an access token is never accepted as an ID Token
+    /// (RFC 8725 §3.11). <see cref="JwtTypeEnforcement.None"/> is used by neither production caller.
+    /// </param>
+    internal static async ValueTask<SignedJwtValidationOutcome> ValidateSignedJwtCoreAsync(
+        string accessToken,
+        string expectedIssuer,
+        string expectedAudience,
+        ServerVerificationKeyResolverDelegate resolveVerificationKey,
+        VerificationDelegate verifySignature,
+        JwsAccessTokenJsonParser parser,
+        DecodeDelegate base64UrlDecoder,
+        TimeProvider timeProvider,
+        MemoryPool<byte> memoryPool,
+        TimeSpan iatSkew,
+        TenantId tenantId,
+        ExchangeContext context,
+        string? expectedAuthorizedParty,
+        JwtTypeEnforcement typeEnforcement,
+        CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(accessToken);
         ArgumentNullException.ThrowIfNull(expectedIssuer);
@@ -98,7 +189,7 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
             || string.IsNullOrEmpty(parts[1])
             || string.IsNullOrEmpty(parts[2]))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.Malformed,
                 "Access token is not a well-formed compact JWS.");
         }
@@ -113,7 +204,7 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
         }
         catch
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.InvalidHeader,
                 "Failed to parse JWS header.");
         }
@@ -122,14 +213,14 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
             || algValue is not string alg
             || string.IsNullOrEmpty(alg))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.InvalidHeader,
                 "JWS header is missing the alg member.");
         }
 
         if(WellKnownJwaValues.IsNone(alg))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.AlgorithmNotAllowed,
                 "JWS alg 'none' is rejected per RFC 8725 §3.1.");
         }
@@ -138,11 +229,43 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
             || kidValue is not string kid
             || string.IsNullOrEmpty(kid))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.InvalidHeader,
                 "JWS header is missing the kid member.");
         }
 
+        //RFC 9068 §4 requires the resource server to verify the header's typ is explicitly
+        //"at+jwt" or "application/at+jwt" and reject any other value — the discriminator that
+        //keeps an ID Token (typ "JWT") or another JWT profile from being confused for an access
+        //token. Comparison follows the existing WellKnownMediaTypes helpers, case-insensitive
+        //per RFC 7515 §4.1.9 (media type values are case insensitive per RFC 2045).
+        if(typeEnforcement is JwtTypeEnforcement.RequireAtJwt)
+        {
+            if(!header.TryGetValue(WellKnownJoseHeaderNames.Typ, out object? typValue)
+                || typValue is not string typ
+                || string.IsNullOrEmpty(typ)
+                || !(WellKnownMediaTypes.Jwt.IsAtJwt(typ) || WellKnownMediaTypes.Application.IsAtJwt(typ)))
+            {
+                return SignedJwtValidationOutcome.Failure(
+                    JwsAccessTokenValidationFailureReason.InvalidType,
+                    "JWS header typ must be 'at+jwt' or 'application/at+jwt' per RFC 9068 §4.");
+            }
+        }
+
+        //The ID Token profile does the reverse (RFC 8725 §3.11 explicit typing): it refuses the
+        //access-token type so a genuine RFC 9068 access token — which may carry a machine subject
+        //with no authentication event — can never be accepted as an ID Token, the relying party's
+        //proof of end-user authentication. Any other typ (or an absent one) is accepted.
+        if(typeEnforcement is JwtTypeEnforcement.RejectAtJwt
+            && header.TryGetValue(WellKnownJoseHeaderNames.Typ, out object? idTokenTypValue)
+            && idTokenTypValue is string idTokenTyp
+            && (WellKnownMediaTypes.Jwt.IsAtJwt(idTokenTyp) || WellKnownMediaTypes.Application.IsAtJwt(idTokenTyp)))
+        {
+            return SignedJwtValidationOutcome.Failure(
+                JwsAccessTokenValidationFailureReason.InvalidType,
+                "An ID Token must not carry the access-token type 'at+jwt' (RFC 8725 §3.11 explicit typing).");
+        }
+
         //3. Resolve verification key. The reference is owned by the resolver
         //(typically a shared keyset/HSM handle); the validator does not
         //dispose it.
@@ -150,7 +273,7 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
             new KeyId(kid), tenantId, context, cancellationToken).ConfigureAwait(false);
         if(publicKey is null)
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.UnknownKid,
                 "Verification key for the presented kid could not be resolved.");
         }
@@ -173,7 +296,7 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
 
         if(!signatureValid)
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.SignatureFailed,
                 "JWS signature did not verify against the resolved key.");
         }
@@ -187,7 +310,7 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
         }
         catch
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.Malformed,
                 "Failed to parse JWS payload.");
         }
@@ -195,28 +318,28 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
         //6. Standard claim checks.
         if(!TryReadString(payload, WellKnownJwtClaimNames.Iss, out string? iss))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.MissingRequiredClaim,
                 "Access token is missing the iss claim.");
         }
 
         if(!string.Equals(iss, expectedIssuer, StringComparison.Ordinal))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.IssuerMismatch,
                 "Access token iss does not match the expected issuer.");
         }
 
         if(!TryReadAudience(payload, out IReadOnlyList<string> audience))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.MissingRequiredClaim,
                 "Access token is missing the aud claim.");
         }
 
         if(!ContainsAudience(audience, expectedAudience))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.AudienceMismatch,
                 "Access token aud does not contain the expected audience.");
         }
@@ -231,14 +354,14 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
             {
                 if(audience.Count > 1)
                 {
-                    return JwsAccessTokenValidationResult.Failure(
+                    return SignedJwtValidationOutcome.Failure(
                         JwsAccessTokenValidationFailureReason.AuthorizedPartyMissing,
                         "Access token has multiple audiences but no azp claim (OIDC Core §3.1.3.7).");
                 }
             }
             else if(!string.Equals(azp, expectedAuthorizedParty, StringComparison.Ordinal))
             {
-                return JwsAccessTokenValidationResult.Failure(
+                return SignedJwtValidationOutcome.Failure(
                     JwsAccessTokenValidationFailureReason.AuthorizedPartyMismatch,
                     "Access token azp does not equal the expected authorized party.");
             }
@@ -246,14 +369,14 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
 
         if(!TryReadEpochSeconds(payload, WellKnownJwtClaimNames.Exp, out DateTimeOffset exp))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.MissingRequiredClaim,
                 "Access token is missing the exp claim.");
         }
 
         if(!TryReadEpochSeconds(payload, WellKnownJwtClaimNames.Iat, out DateTimeOffset iat))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.MissingRequiredClaim,
                 "Access token is missing the iat claim.");
         }
@@ -262,7 +385,7 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
         //before its iat has no positive lifetime and is nonsensical regardless of when it is checked.
         if(exp <= iat)
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.InconsistentTemporalClaims,
                 "Access token exp is at or before iat (non-positive lifetime).");
         }
@@ -270,14 +393,14 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
         DateTimeOffset now = timeProvider.GetUtcNow();
         if(exp <= now)
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.Expired,
                 "Access token has expired.");
         }
 
         if(iat > now + iatSkew)
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.IssuedInFuture,
                 "Access token iat is in the future beyond the skew tolerance.");
         }
@@ -287,7 +410,7 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
         {
             if(nbfValue > now + iatSkew)
             {
-                return JwsAccessTokenValidationResult.Failure(
+                return SignedJwtValidationOutcome.Failure(
                     JwsAccessTokenValidationFailureReason.NotYetValid,
                     "Access token nbf is in the future.");
             }
@@ -296,7 +419,7 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
             //never opens.
             if(exp <= nbfValue)
             {
-                return JwsAccessTokenValidationResult.Failure(
+                return SignedJwtValidationOutcome.Failure(
                     JwsAccessTokenValidationFailureReason.InconsistentTemporalClaims,
                     "Access token exp is at or before nbf (the validity window never opens).");
             }
@@ -306,37 +429,16 @@ public static async ValueTask<JwsAccessTokenValidationResult> ValidateAsync(
 
         if(!TryReadString(payload, WellKnownJwtClaimNames.Sub, out string? sub))
         {
-            return JwsAccessTokenValidationResult.Failure(
+            return SignedJwtValidationOutcome.Failure(
                 JwsAccessTokenValidationFailureReason.MissingRequiredClaim,
                 "Access token is missing the sub claim.");
         }
 
-        //7. Optional claims.
-        TryReadString(payload, WellKnownJwtClaimNames.ClientId, out string? clientId);
-        TryReadString(payload, WellKnownJwtClaimNames.Scope, out string? scope);
-        TryReadString(payload, WellKnownJwtClaimNames.Jti, out string? jti);
-        ConfirmationMethod? confirmation = TryReadConfirmation(payload);
-
-        JwsAccessTokenClaims claims = new()
-        {
-            Subject = sub!,
-            Issuer = iss!,
-            Audience = audience,
-            IssuedAt = iat,
-            Expiration = exp,
-            NotBefore = nbf,
-            ClientId = clientId,
-            AuthorizedParty = azp,
-            Scope = scope,
-            JwtId = jti,
-            Confirmation = confirmation
-        };
-
-        return JwsAccessTokenValidationResult.Success(claims);
+        return SignedJwtValidationOutcome.Success(payload, sub!, iss!, audience, azp, iat, exp, nbf);
     }
 
 
-    private static bool TryReadString(JwtPayload payload, string claimName, out string? value)
+    internal static bool TryReadString(JwtPayload payload, string claimName, out string? value)
     {
         if(payload.TryGetValue(claimName, out object? raw) && raw is string s && !string.IsNullOrEmpty(s))
         {
@@ -349,46 +451,57 @@ private static bool TryReadString(JwtPayload payload, string claimName, out stri
     }
 
 
-    private static bool TryReadAudience(JwtPayload payload, out IReadOnlyList<string> audience)
+    private static bool TryReadAudience(JwtPayload payload, out IReadOnlyList<string> audience) =>
+        TryReadStringList(payload, WellKnownJwtClaimNames.Aud, out audience);
+
+
+    /// <summary>
+    /// Reads a claim whose JSON value is either a single string or an array of strings — the
+    /// RFC 7519 §4.1.3 <c>aud</c> shape, also used by the OIDC Core §2 <c>amr</c> claim. Normalises
+    /// both wire shapes into a list; a single string becomes a one-element list. Returns
+    /// <see langword="false"/> (with <paramref name="list"/> empty) when the claim is absent or
+    /// resolves to an empty list.
+    /// </summary>
+    internal static bool TryReadStringList(JwtPayload payload, string claimName, out IReadOnlyList<string> list)
     {
-        if(payload.TryGetValue(WellKnownJwtClaimNames.Aud, out object? raw))
+        if(payload.TryGetValue(claimName, out object? raw))
         {
             if(raw is string single && !string.IsNullOrEmpty(single))
             {
-                audience = [single];
+                list = [single];
                 return true;
             }
 
             if(raw is IEnumerable<string> typed)
             {
-                List<string> list = [.. typed];
-                if(list.Count > 0)
+                List<string> typedList = [.. typed];
+                if(typedList.Count > 0)
                 {
-                    audience = list;
+                    list = typedList;
                     return true;
                 }
             }
 
             if(raw is IEnumerable<object> mixed)
             {
-                List<string> list = [];
+                List<string> mixedList = [];
                 foreach(object item in mixed)
                 {
                     if(item is string s && !string.IsNullOrEmpty(s))
                     {
-                        list.Add(s);
+                        mixedList.Add(s);
                     }
                 }
 
-                if(list.Count > 0)
+                if(mixedList.Count > 0)
                 {
-                    audience = list;
+                    list = mixedList;
                     return true;
                 }
             }
         }
 
-        audience = [];
+        list = [];
         return false;
     }
 
@@ -407,7 +520,7 @@ private static bool ContainsAudience(IReadOnlyList<string> audience, string expe
     }
 
 
-    private static bool TryReadEpochSeconds(JwtPayload payload, string claimName, out DateTimeOffset value)
+    internal static bool TryReadEpochSeconds(JwtPayload payload, string claimName, out DateTimeOffset value)
     {
         if(payload.TryGetValue(claimName, out object? raw))
         {
@@ -432,7 +545,7 @@ private static bool TryReadEpochSeconds(JwtPayload payload, string claimName, ou
     }
 
 
-    private static ConfirmationMethod? TryReadConfirmation(JwtPayload payload)
+    internal static ConfirmationMethod? TryReadConfirmation(JwtPayload payload)
     {
         if(!payload.TryGetValue(WellKnownJwtClaimNames.Cnf, out object? raw))
         {
diff --git a/src/Verifiable.OAuth/JwtTypeEnforcement.cs b/src/Verifiable.OAuth/JwtTypeEnforcement.cs
new file mode 100644
index 00000000..273c5987
--- /dev/null
+++ b/src/Verifiable.OAuth/JwtTypeEnforcement.cs
@@ -0,0 +1,33 @@
+namespace Verifiable.OAuth;
+
+/// <summary>
+/// Whether a signed-JWT validation pass enforces the RFC 9068 §4 <c>typ</c>
+/// discriminator (<c>at+jwt</c> / <c>application/at+jwt</c>). Selects the
+/// token profile the shared validation core validates against.
+/// </summary>
+internal enum JwtTypeEnforcement
+{
+    /// <summary>
+    /// Require the header <c>typ</c> to be <c>at+jwt</c> or
+    /// <c>application/at+jwt</c> — the OAuth 2.0 JWT access-token profile
+    /// (RFC 9068 §4), the discriminator that keeps an ID Token (<c>typ</c>
+    /// <c>JWT</c>) or another JWT profile from being accepted as an access token.
+    /// </summary>
+    RequireAtJwt,
+
+    /// <summary>
+    /// Do not constrain the header <c>typ</c> — for signed-JWT profiles that
+    /// do not mandate a specific <c>typ</c> and place no restriction on it.
+    /// </summary>
+    None,
+
+    /// <summary>
+    /// Reject the access-token type: a header <c>typ</c> of <c>at+jwt</c> or
+    /// <c>application/at+jwt</c> is refused while any other <c>typ</c> (or an
+    /// absent one) is accepted. The ID Token profile uses this so a genuine
+    /// RFC 9068 access token can never be validated as an ID Token per RFC 8725
+    /// §3.11 explicit typing — an ID Token is proof of end-user authentication,
+    /// which an access token (possibly a machine subject) is not.
+    /// </summary>
+    RejectAtJwt
+}
diff --git a/src/Verifiable.OAuth/OAuthRequestParameterNames.cs b/src/Verifiable.OAuth/OAuthRequestParameterNames.cs
index c7e810f8..400feb9f 100644
--- a/src/Verifiable.OAuth/OAuthRequestParameterNames.cs
+++ b/src/Verifiable.OAuth/OAuthRequestParameterNames.cs
@@ -189,6 +189,34 @@ public static class OAuthRequestParameterNames
     /// </summary>
     public static readonly string Iss = Utf8Constants.ToInternedString(IssUtf8);
 
+    /// <summary>The UTF-8 source literal of <see cref="Error"/>.</summary>
+    public static ReadOnlySpan<byte> ErrorUtf8 => "error"u8;
+
+    /// <summary>
+    /// The <c>error</c> parameter.
+    /// A single ASCII error code returned instead of <see cref="Code"/> when the
+    /// authorization request fails per
+    /// <see href="https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2.1">RFC 6749 §4.1.2.1</see>.
+    /// Its presence on a callback identifies an OAuth 2.0 Authorization Error Response;
+    /// per <see href="https://www.rfc-editor.org/rfc/rfc9207#section-2.4">RFC 9207 §2.4</see>
+    /// "clients MUST NOT assume that the error originates from the intended authorization
+    /// server," so a present <see cref="Iss"/> on an error response is validated exactly like
+    /// on a success response before the error is treated as authoritative.
+    /// </summary>
+    public static readonly string Error = Utf8Constants.ToInternedString(ErrorUtf8);
+
+    /// <summary>The UTF-8 source literal of <see cref="ErrorDescription"/>.</summary>
+    public static ReadOnlySpan<byte> ErrorDescriptionUtf8 => "error_description"u8;
+
+    /// <summary>
+    /// The <c>error_description</c> parameter.
+    /// A human-readable ASCII text providing additional information about the error, used
+    /// to assist the client developer in understanding the error that occurred per
+    /// <see href="https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2.1">RFC 6749 §4.1.2.1</see>.
+    /// OPTIONAL.
+    /// </summary>
+    public static readonly string ErrorDescription = Utf8Constants.ToInternedString(ErrorDescriptionUtf8);
+
     //Token request parameters — RFC 6749 §4.1.3.
 
     /// <summary>The UTF-8 source literal of <see cref="GrantType"/>.</summary>
diff --git a/src/Verifiable.OAuth/Oidc/UserInfoEndpoints.cs b/src/Verifiable.OAuth/Oidc/UserInfoEndpoints.cs
index 88c93f0c..1aeb7cee 100644
--- a/src/Verifiable.OAuth/Oidc/UserInfoEndpoints.cs
+++ b/src/Verifiable.OAuth/Oidc/UserInfoEndpoints.cs
@@ -58,6 +58,21 @@ namespace Verifiable.OAuth.Oidc;
 /// <see cref="UserInfoTarget"/>.
 /// </para>
 /// <para>
+/// <strong>The <c>openid</c> ⇒ authenticated-end-user invariant.</strong> This endpoint's
+/// <c>openid</c>-in-token-scope check is correct only because the token endpoint's scope
+/// source (<see cref="AuthCode.AuthCodeEndpoints"/>) guarantees that non-end-user grants —
+/// <c>client_credentials</c> (whose <c>sub</c> is the <c>client_id</c>, a machine, not an
+/// End-User) and <c>pre_authorized_code</c> — never carry <c>openid</c> in the granted scope
+/// that ends up on the access token: those grants drop it per
+/// <see href="https://www.rfc-editor.org/rfc/rfc6749#section-3.3">RFC 6749 §3.3</see> at
+/// issuance. A <c>token_exchange</c> or <c>jwt_bearer</c> token that legitimately carries
+/// <c>openid</c> is correctly served here — the app opted in by granting it, vouching that
+/// the exchanged/asserted subject is an End-User. Absent the source-side guarantee, this
+/// check alone would be the exact defect <see cref="WellKnownScopes"/> warns against: "An
+/// access token issued without <c>openid</c> does not identify the user — it only authorizes
+/// actions. Do not use the access token's presence as proof of identity."
+/// </para>
+/// <para>
 /// <strong>Serialization firewall.</strong> Response bodies are written
 /// as JSON via <see cref="System.Text.StringBuilder"/> rather than through
 /// a serializer; the project's banned-symbol analyzer enforces that
diff --git a/src/Verifiable.OAuth/Oidc10IdTokenClaims.cs b/src/Verifiable.OAuth/Oidc10IdTokenClaims.cs
new file mode 100644
index 00000000..d27215f0
--- /dev/null
+++ b/src/Verifiable.OAuth/Oidc10IdTokenClaims.cs
@@ -0,0 +1,91 @@
+using System.Diagnostics;
+using Verifiable.OAuth.Server;
+
+namespace Verifiable.OAuth;
+
+/// <summary>
+/// Typed view of the claims extracted from a successfully-validated OpenID Connect Core 1.0 ID
+/// Token per OIDC Core §3.1.3.7. Returned in <see cref="Oidc10IdTokenValidationResult.Claims"/> on
+/// success; the relying party reads these instead of re-parsing the JWT payload directly.
+/// </summary>
+/// <remarks>
+/// Mirrors <see cref="JwsAccessTokenClaims"/>'s standard signed-JWT members (<c>sub</c>/<c>iss</c>/
+/// <c>aud</c>/<c>azp</c>/<c>iat</c>/<c>exp</c>/<c>nbf</c>), replacing the access-token-specific
+/// <c>client_id</c>/<c>scope</c>/<c>jti</c> with the ID-Token-specific OIDC Core §2 authentication
+/// claims: <c>nonce</c>, <c>auth_time</c>, <c>acr</c>, <c>amr</c>, <c>sid</c>. Absent optional claims
+/// are surfaced as <see langword="null"/>. <see cref="Nonce"/>, <see cref="AuthTime"/>,
+/// <see cref="Acr"/>, and <see cref="Sid"/> are surfaced regardless of whether
+/// <see cref="Oidc10IdTokenValidator.ValidateAsync"/> was asked to enforce them, so a caller that
+/// requested <c>acr_values</c>/<c>max_age</c> can itself compare <see cref="Acr"/>/<see cref="AuthTime"/>
+/// against the request (the OIDC Core §3.1.3.7 SHOULDs the validator does not enforce).
+/// </remarks>
+[DebuggerDisplay("Oidc10IdTokenClaims Sub={Subject,nq} Iss={Issuer,nq}")]
+public sealed record Oidc10IdTokenClaims
+{
+    /// <summary>RFC 7519 §4.1.2 <c>sub</c> — the End-User identifier.</summary>
+    public required string Subject { get; init; }
+
+    /// <summary>RFC 7519 §4.1.1 <c>iss</c> — the issuer identifier. Compared by ordinal equality.</summary>
+    public required string Issuer { get; init; }
+
+    /// <summary>
+    /// RFC 7519 §4.1.3 <c>aud</c> — the audience values. OIDC Core §2 permits either a single
+    /// string or an array; the validator normalises both shapes into this list.
+    /// </summary>
+    public required IReadOnlyList<string> Audience { get; init; }
+
+    /// <summary>RFC 7519 §4.1.6 <c>iat</c> — issuance instant.</summary>
+    public required DateTimeOffset IssuedAt { get; init; }
+
+    /// <summary>RFC 7519 §4.1.4 <c>exp</c> — expiry instant.</summary>
+    public required DateTimeOffset Expiration { get; init; }
+
+    /// <summary>RFC 7519 §4.1.5 <c>nbf</c> — not-before instant. <see langword="null"/> when absent.</summary>
+    public DateTimeOffset? NotBefore { get; init; }
+
+    /// <summary>
+    /// OIDC Core §2 <c>azp</c> — the authorized party the ID Token was issued to.
+    /// <see langword="null"/> when absent. When present it must equal the relying party's own
+    /// client identifier (OIDC Core §3.1.3.7); the validator enforces that when the caller supplies
+    /// an expected authorized party.
+    /// </summary>
+    public string? AuthorizedParty { get; init; }
+
+    /// <summary>
+    /// OIDC Core §2 <c>nonce</c> — the value that binds this ID Token to the authentication request
+    /// that produced it, mitigating replay. <see langword="null"/> when absent. When the caller
+    /// supplied an expected nonce to <see cref="Oidc10IdTokenValidator.ValidateAsync"/>, this equals
+    /// it (OIDC Core §3.1.3.7's conditional-MUST); otherwise it is surfaced unchecked.
+    /// </summary>
+    public string? Nonce { get; init; }
+
+    /// <summary>
+    /// OIDC Core §2 <c>auth_time</c> — the instant the End-User authentication occurred.
+    /// <see langword="null"/> when absent.
+    /// </summary>
+    public DateTimeOffset? AuthTime { get; init; }
+
+    /// <summary>
+    /// OIDC Core §2 <c>acr</c> — the Authentication Context Class Reference. <see langword="null"/>
+    /// when absent.
+    /// </summary>
+    public string? Acr { get; init; }
+
+    /// <summary>
+    /// OIDC Core §2 <c>amr</c> — the Authentication Methods References. <see langword="null"/> when
+    /// absent.
+    /// </summary>
+    public IReadOnlyList<string>? Amr { get; init; }
+
+    /// <summary>
+    /// OIDC Core / OIDC Back-Channel Logout §2 <c>sid</c> — the End-User's authentication session
+    /// identifier at the OP. <see langword="null"/> when absent.
+    /// </summary>
+    public string? Sid { get; init; }
+
+    /// <summary>
+    /// RFC 7800 §3 <c>cnf</c> — the confirmation method binding the token to a proof of possession
+    /// key. <see langword="null"/> when the token is not sender-constrained.
+    /// </summary>
+    public ConfirmationMethod? Confirmation { get; init; }
+}
diff --git a/src/Verifiable.OAuth/Oidc10IdTokenValidationResult.cs b/src/Verifiable.OAuth/Oidc10IdTokenValidationResult.cs
new file mode 100644
index 00000000..b23f1b67
--- /dev/null
+++ b/src/Verifiable.OAuth/Oidc10IdTokenValidationResult.cs
@@ -0,0 +1,47 @@
+using System.Diagnostics;
+
+namespace Verifiable.OAuth;
+
+/// <summary>
+/// Outcome of <see cref="Oidc10IdTokenValidator.ValidateAsync"/>. Carries either the extracted
+/// <see cref="Oidc10IdTokenClaims"/> on success, or a typed
+/// <see cref="JwsAccessTokenValidationFailureReason"/> with an optional human-readable description
+/// on failure.
+/// </summary>
+/// <remarks>
+/// Mirrors the success/failure shape of <see cref="JwsAccessTokenValidationResult"/> — the
+/// RFC 9068 access-token counterpart — while carrying <see cref="Oidc10IdTokenClaims"/> instead of
+/// <see cref="JwsAccessTokenClaims"/>, since an ID Token and an access token surface different
+/// optional claims even though both validators share the same underlying signed-JWT validation core
+/// and the same closed failure-reason vocabulary.
+/// </remarks>
+[DebuggerDisplay("Oidc10IdTokenValidationResult Success={IsSuccess} Reason={FailureReason}")]
+public sealed record Oidc10IdTokenValidationResult
+{
+    /// <summary>The validated claims when validation succeeded; otherwise <see langword="null"/>.</summary>
+    public Oidc10IdTokenClaims? Claims { get; init; }
+
+    /// <summary>The failure reason when validation failed; otherwise <see langword="null"/>.</summary>
+    public JwsAccessTokenValidationFailureReason? FailureReason { get; init; }
+
+    /// <summary>Optional free-text description, useful for <c>WWW-Authenticate</c> error_description fields.</summary>
+    public string? FailureDescription { get; init; }
+
+    /// <summary><see langword="true"/> when validation succeeded.</summary>
+    public bool IsSuccess => FailureReason is null;
+
+
+    /// <summary>Builds a success result.</summary>
+    public static Oidc10IdTokenValidationResult Success(Oidc10IdTokenClaims claims)
+    {
+        ArgumentNullException.ThrowIfNull(claims);
+        return new() { Claims = claims };
+    }
+
+
+    /// <summary>Builds a failure result.</summary>
+    public static Oidc10IdTokenValidationResult Failure(
+        JwsAccessTokenValidationFailureReason reason,
+        string? description = null) =>
+        new() { FailureReason = reason, FailureDescription = description };
+}
diff --git a/src/Verifiable.OAuth/Oidc10IdTokenValidator.cs b/src/Verifiable.OAuth/Oidc10IdTokenValidator.cs
new file mode 100644
index 00000000..fc77644e
--- /dev/null
+++ b/src/Verifiable.OAuth/Oidc10IdTokenValidator.cs
@@ -0,0 +1,225 @@
+using System.Buffers;
+using System.Diagnostics;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.OAuth.Server;
+
+namespace Verifiable.OAuth;
+
+/// <summary>
+/// Validates an OpenID Connect Core 1.0 ID Token (OP-issued) per OIDC Core §3.1.3.7: signature,
+/// <c>iss</c>, <c>aud</c>, the multi-audience/<c>azp</c> coordination, the untrusted-audience
+/// rejection, the <c>nonce</c> conditional-MUST, and the <c>exp</c>/<c>iat</c>/<c>nbf</c>/<c>sub</c>
+/// checks. The relying-party counterpart to the OP's ID Token issuance; distinct from
+/// <see cref="Verifiable.OAuth.Siop.SelfIssuedIdTokenValidation"/> (SIOP §11.1 self-issued tokens).
+/// </summary>
+/// <remarks>
+/// <para>
+/// Shares its signature and claim validation with <see cref="JwsAccessTokenValidator"/> — both
+/// delegate to the one <see cref="JwsAccessTokenValidator.ValidateSignedJwtCoreAsync"/> core —
+/// passing <see cref="JwtTypeEnforcement.RejectAtJwt"/>: OIDC does not mandate a <c>typ</c> on ID
+/// Tokens (they carry <c>typ</c> <c>JWT</c> or omit it), but the access-token type <c>at+jwt</c> /
+/// <c>application/at+jwt</c> is refused (RFC 8725 §3.11 explicit typing) so a genuine RFC 9068
+/// access token can never be validated as an ID Token. The access-token path keeps the mirror
+/// requirement (<c>at+jwt</c> required), so the two token types are never interchangeable in either
+/// direction.
+/// </para>
+/// <para>
+/// The result is <see cref="Oidc10IdTokenValidationResult"/>, carrying <see cref="Oidc10IdTokenClaims"/>
+/// — the ID-Token-specific view of the shared core's verified payload, mirroring how
+/// <see cref="JwsAccessTokenValidator.ValidateAsync"/> maps the same core to
+/// <see cref="JwsAccessTokenClaims"/>.
+/// </para>
+/// <para>
+/// Coverage boundary — this validator performs every OIDC Core §3.1.3.7 check the shared core and its
+/// own post-processing can decide without application input: the signature, <c>iss</c>/<c>aud</c>/
+/// <c>azp</c>/<c>exp</c>/<c>iat</c>/<c>sub</c> checks; the untrusted-audience MUST when the caller
+/// supplies a <c>trustedAudiences</c> set; and the <c>nonce</c> conditional-MUST when the caller
+/// supplies an <c>expectedNonce</c>. It surfaces <see cref="Oidc10IdTokenClaims.Acr"/>,
+/// <see cref="Oidc10IdTokenClaims.AuthTime"/>, and <see cref="Oidc10IdTokenClaims.Sid"/> on every
+/// success but does not itself compare them against a requested <c>acr_values</c>/<c>max_age</c> or
+/// an active session — the <c>acr</c>/<c>auth_time</c>/<c>max_age</c> SHOULDs remain the caller's,
+/// since satisfying them requires the authentication request the validator never sees. Two
+/// §3.1.3.7 items are out of scope for this asymmetric validator: an encrypted (JWE, five-segment)
+/// ID Token fails the three-segment structural check as malformed, and a MAC-based (<c>HS*</c>)
+/// signature has no symmetric-key path here — a relying party that negotiated encryption or a
+/// symmetric signing algorithm decrypts or verifies before this call.
+/// </para>
+/// </remarks>
+[DebuggerDisplay("Oidc10IdTokenValidator")]
+public static class Oidc10IdTokenValidator
+{
+    /// <summary>
+    /// Validates an OP-issued ID Token against the relying party's
+    /// expectations per OIDC Core §3.1.3.7.
+    /// </summary>
+    /// <param name="idToken">The compact-serialised JWS ID Token.</param>
+    /// <param name="expectedIssuer">The expected <c>iss</c> value; compared by ordinal equality.</param>
+    /// <param name="expectedAudience">The expected <c>aud</c> value (the relying party's <c>client_id</c>); required to be present.</param>
+    /// <param name="resolveVerificationKey">Resolves the public verification key for the header's <c>kid</c>.</param>
+    /// <param name="verifySignature">The signature-verification primitive.</param>
+    /// <param name="parser">JSON parser for header and payload segments.</param>
+    /// <param name="base64UrlDecoder">Base64url decoder.</param>
+    /// <param name="timeProvider">Time provider for <c>exp</c>/<c>nbf</c>/<c>iat</c> checks.</param>
+    /// <param name="memoryPool">Memory pool for transient decoded buffers.</param>
+    /// <param name="iatSkew">Tolerance for an <c>iat</c> claim slightly in the future.</param>
+    /// <param name="tenantId">Tenant identifier threaded to the key resolver.</param>
+    /// <param name="context">Per-request context bag threaded to the key resolver.</param>
+    /// <param name="expectedAuthorizedParty">
+    /// The authorized party (the relying party's own <c>client_id</c>) to validate <c>azp</c> against
+    /// per OIDC Core §3.1.3.7. When <see langword="null"/>, <c>azp</c> is surfaced but not enforced;
+    /// when supplied, a present <c>azp</c> must equal it and a multi-valued <c>aud</c> must carry <c>azp</c>.
+    /// </param>
+    /// <param name="expectedNonce">
+    /// The nonce value the relying party sent in the authentication request. When non-
+    /// <see langword="null"/>, the ID Token's <c>nonce</c> claim must equal it, else the token is
+    /// rejected with <see cref="JwsAccessTokenValidationFailureReason.NonceMismatch"/> — OIDC Core
+    /// §3.1.3.7's conditional-MUST, conditioned on the relying party having sent a nonce. When
+    /// <see langword="null"/>, <c>nonce</c> is surfaced on <see cref="Oidc10IdTokenClaims.Nonce"/> but
+    /// not checked.
+    /// </param>
+    /// <param name="trustedAudiences">
+    /// The full set of audiences the relying party trusts, beyond <paramref name="expectedAudience"/>
+    /// itself. When non-<see langword="null"/>, every member of the ID Token's <c>aud</c> claim must be
+    /// either <paramref name="expectedAudience"/> or a member of this set, else the token is rejected
+    /// with <see cref="JwsAccessTokenValidationFailureReason.UntrustedAudience"/> — OIDC Core §3.1.3.7's
+    /// MUST to reject an ID Token whose <c>aud</c> contains an audience the relying party does not
+    /// trust. When <see langword="null"/>, no additional-audience check runs, so a legitimately
+    /// multi-audience ID Token (with <c>azp</c> coordination via <paramref name="expectedAuthorizedParty"/>)
+    /// still validates. A relying party that accepts tokens from a multi-audience OP MUST therefore
+    /// supply this set or <paramref name="expectedAuthorizedParty"/> (or both) to satisfy the
+    /// §3.1.3.7 additional-audience MUST: with both <see langword="null"/> a multi-audience token is
+    /// accepted unchecked.
+    /// </param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    public static async ValueTask<Oidc10IdTokenValidationResult> ValidateAsync(
+        string idToken,
+        string expectedIssuer,
+        string expectedAudience,
+        ServerVerificationKeyResolverDelegate resolveVerificationKey,
+        VerificationDelegate verifySignature,
+        JwsAccessTokenJsonParser parser,
+        DecodeDelegate base64UrlDecoder,
+        TimeProvider timeProvider,
+        MemoryPool<byte> memoryPool,
+        TimeSpan iatSkew,
+        TenantId tenantId,
+        ExchangeContext context,
+        string? expectedAuthorizedParty,
+        string? expectedNonce,
+        IReadOnlyCollection<string>? trustedAudiences,
+        CancellationToken cancellationToken)
+    {
+        SignedJwtValidationOutcome outcome = await JwsAccessTokenValidator.ValidateSignedJwtCoreAsync(
+            idToken,
+            expectedIssuer,
+            expectedAudience,
+            resolveVerificationKey,
+            verifySignature,
+            parser,
+            base64UrlDecoder,
+            timeProvider,
+            memoryPool,
+            iatSkew,
+            tenantId,
+            context,
+            expectedAuthorizedParty,
+            JwtTypeEnforcement.RejectAtJwt,
+            cancellationToken).ConfigureAwait(false);
+
+        if(!outcome.IsSuccess)
+        {
+            return Oidc10IdTokenValidationResult.Failure(outcome.FailureReason!.Value, outcome.FailureDescription);
+        }
+
+        JwtPayload payload = outcome.Payload!;
+
+        //OIDC Core §3.1.3.7: "The Client MUST validate that the aud Claim contains ... an array with
+        //more than one element ... only if the ID Token is issued from an Authorization Server that
+        //the Client trusts." Enforced only when the caller supplies its trust set; expectedAudience is
+        //always trusted since the aud-membership check in the shared core already required it present.
+        if(trustedAudiences is not null && HasUntrustedAudience(outcome.Audience!, expectedAudience, trustedAudiences))
+        {
+            return Oidc10IdTokenValidationResult.Failure(
+                JwsAccessTokenValidationFailureReason.UntrustedAudience,
+                "ID Token aud contains a member that is neither the expected audience nor in the caller's trusted audience set (OIDC Core §3.1.3.7).");
+        }
+
+        JwsAccessTokenValidator.TryReadString(payload, WellKnownJwtClaimNames.Nonce, out string? nonce);
+        if(expectedNonce is not null && !string.Equals(nonce, expectedNonce, StringComparison.Ordinal))
+        {
+            return Oidc10IdTokenValidationResult.Failure(
+                JwsAccessTokenValidationFailureReason.NonceMismatch,
+                "ID Token nonce is missing or does not equal the expected nonce (OIDC Core §3.1.3.7).");
+        }
+
+        DateTimeOffset? authTime = JwsAccessTokenValidator.TryReadEpochSeconds(
+            payload, WellKnownJwtClaimNames.AuthTime, out DateTimeOffset authTimeValue)
+            ? authTimeValue
+            : null;
+        JwsAccessTokenValidator.TryReadString(payload, WellKnownJwtClaimNames.Acr, out string? acr);
+        IReadOnlyList<string>? amr = JwsAccessTokenValidator.TryReadStringList(
+            payload, WellKnownJwtClaimNames.Amr, out IReadOnlyList<string> amrValues)
+            ? amrValues
+            : null;
+        JwsAccessTokenValidator.TryReadString(payload, WellKnownJwtClaimNames.Sid, out string? sid);
+        ConfirmationMethod? confirmation = JwsAccessTokenValidator.TryReadConfirmation(payload);
+
+        Oidc10IdTokenClaims claims = new()
+        {
+            Subject = outcome.Subject!,
+            Issuer = outcome.Issuer!,
+            Audience = outcome.Audience!,
+            IssuedAt = outcome.IssuedAt!.Value,
+            Expiration = outcome.Expiration!.Value,
+            NotBefore = outcome.NotBefore,
+            AuthorizedParty = outcome.AuthorizedParty,
+            Nonce = nonce,
+            AuthTime = authTime,
+            Acr = acr,
+            Amr = amr,
+            Sid = sid,
+            Confirmation = confirmation
+        };
+
+        return Oidc10IdTokenValidationResult.Success(claims);
+    }
+
+
+    /// <summary>
+    /// Whether <paramref name="audience"/> carries a member that is neither
+    /// <paramref name="expectedAudience"/> nor a member of <paramref name="trustedAudiences"/>.
+    /// </summary>
+    private static bool HasUntrustedAudience(
+        IReadOnlyList<string> audience,
+        string expectedAudience,
+        IReadOnlyCollection<string> trustedAudiences)
+    {
+        for(int i = 0; i < audience.Count; i++)
+        {
+            string candidate = audience[i];
+            if(string.Equals(candidate, expectedAudience, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            bool isTrusted = false;
+            foreach(string trusted in trustedAudiences)
+            {
+                if(string.Equals(candidate, trusted, StringComparison.Ordinal))
+                {
+                    isTrusted = true;
+                    break;
+                }
+            }
+
+            if(!isTrusted)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/src/Verifiable.OAuth/OidcDiscoveryDocument.cs b/src/Verifiable.OAuth/OidcDiscoveryDocument.cs
index a0261bbd..a75ad174 100644
--- a/src/Verifiable.OAuth/OidcDiscoveryDocument.cs
+++ b/src/Verifiable.OAuth/OidcDiscoveryDocument.cs
@@ -63,6 +63,13 @@ public sealed class OidcDiscoveryDocument: IEquatable<OidcDiscoveryDocument>
     /// <summary>Whether the AS supports the <c>iss</c> authorization response parameter (RFC 9207).</summary>
     public bool AuthorizationResponseIssParameterSupported { get; init; }
 
+    /// <summary>
+    /// Whether the AS supports retrieving client metadata from a <c>client_id</c> URL;
+    /// advertised as <c>client_id_metadata_document_supported</c> per
+    /// draft-ietf-oauth-client-id-metadata-document-02 §6.
+    /// </summary>
+    public bool ClientIdMetadataDocumentSupported { get; init; }
+
     /// <summary>The JWS algorithms the AS accepts on DPoP proofs (RFC 9449 §5.1).</summary>
     public string[] DpopSigningAlgValuesSupported { get; init; } = [];
 
@@ -88,6 +95,7 @@ public bool Equals(OidcDiscoveryDocument? other)
             && JwksUri == other.JwksUri
             && RequirePushedAuthorizationRequests == other.RequirePushedAuthorizationRequests
             && AuthorizationResponseIssParameterSupported == other.AuthorizationResponseIssParameterSupported
+            && ClientIdMetadataDocumentSupported == other.ClientIdMetadataDocumentSupported
             && DpopSigningAlgValuesSupported.SequenceEqual(other.DpopSigningAlgValuesSupported)
             && ResponseTypesSupported.SequenceEqual(other.ResponseTypesSupported)
             && SubjectTypesSupported.SequenceEqual(other.SubjectTypesSupported)
@@ -114,6 +122,7 @@ public override int GetHashCode()
         hash.Add(JwksUri);
         hash.Add(RequirePushedAuthorizationRequests);
         hash.Add(AuthorizationResponseIssParameterSupported);
+        hash.Add(ClientIdMetadataDocumentSupported);
         foreach(string s in DpopSigningAlgValuesSupported) { hash.Add(s); }
         foreach(string s in ResponseTypesSupported) { hash.Add(s); }
         foreach(string s in SubjectTypesSupported) { hash.Add(s); }
diff --git a/src/Verifiable.OAuth/ProtectedResource/BearerTokenChallenge.cs b/src/Verifiable.OAuth/ProtectedResource/BearerTokenChallenge.cs
new file mode 100644
index 00000000..34f947c9
--- /dev/null
+++ b/src/Verifiable.OAuth/ProtectedResource/BearerTokenChallenge.cs
@@ -0,0 +1,501 @@
+using System;
+using System.Text;
+using Verifiable.Cryptography.Text;
+
+namespace Verifiable.OAuth.ProtectedResource;
+
+/// <summary>
+/// The RFC 6750 §3 <c>WWW-Authenticate: Bearer</c> challenge: builds and parses
+/// the header value a protected resource returns when a request lacks a valid
+/// bearer token, over the RFC 9110 §11.2 <c>auth-param</c> grammar
+/// (<see href="https://www.rfc-editor.org/rfc/rfc6750#section-3">RFC 6750 §3</see>).
+/// </summary>
+/// <remarks>
+/// <para>
+/// Each attribute is optional but §3 requires at least one auth-param after the
+/// scheme: <c>realm</c> scopes the protection space, <c>error</c> and
+/// <c>error_description</c> report why the request was declined (§3.1),
+/// <c>scope</c> is the space-delimited list of scopes the resource requires
+/// (RFC 6749 §3.3), and <c>resource_metadata</c> composes the RFC 9728 §5.1
+/// metadata pointer into the same challenge — one header, one scheme, both
+/// parameters. Its value formatting is delegated to
+/// <see cref="ProtectedResourceChallenge"/>, and it reads back through both
+/// <see cref="TryParse"/> and
+/// <see cref="ProtectedResourceChallenge.TryReadResourceMetadata"/>.
+/// </para>
+/// <para>
+/// §3.1 pairs the error codes with HTTP status codes the caller chooses — this
+/// class owns the header value only, never the response status:
+/// <c>invalid_request</c> → 400 Bad Request, <c>invalid_token</c>
+/// (<see cref="OAuthErrors.InvalidToken"/>) → 401 Unauthorized, and
+/// <c>insufficient_scope</c> (<see cref="OAuthErrors.InsufficientScope"/>) →
+/// 403 Forbidden, where the challenge MAY carry the <c>scope</c> attribute
+/// naming the scopes needed. When the request carried no authentication
+/// information at all, §3.1 says the server SHOULD NOT include error
+/// information — omit <c>error</c> and <c>error_description</c> then.
+/// </para>
+/// <para>
+/// §3 restricts the representable values: <c>error</c> and
+/// <c>error_description</c> to %x20-21 / %x23-5B / %x5D-7E, and <c>scope</c>
+/// to space-delimited scope-tokens of %x21 / %x23-5B / %x5D-7E.
+/// <see cref="BuildChallenge"/> rejects values outside those sets rather than
+/// emit a non-conformant challenge.
+/// </para>
+/// </remarks>
+public static class BearerTokenChallenge
+{
+    /// <summary>The UTF-8 source literal of <see cref="RealmParameter"/>.</summary>
+    public static ReadOnlySpan<byte> RealmParameterUtf8 => "realm"u8;
+
+    /// <summary>The <c>realm</c> challenge attribute name (RFC 6750 §3).</summary>
+    public static readonly string RealmParameter = Utf8Constants.ToInternedString(RealmParameterUtf8);
+
+    /// <summary>The UTF-8 source literal of <see cref="ErrorParameter"/>.</summary>
+    public static ReadOnlySpan<byte> ErrorParameterUtf8 => "error"u8;
+
+    /// <summary>The <c>error</c> challenge attribute name (RFC 6750 §3).</summary>
+    public static readonly string ErrorParameter = Utf8Constants.ToInternedString(ErrorParameterUtf8);
+
+    /// <summary>The UTF-8 source literal of <see cref="ErrorDescriptionParameter"/>.</summary>
+    public static ReadOnlySpan<byte> ErrorDescriptionParameterUtf8 => "error_description"u8;
+
+    /// <summary>The <c>error_description</c> challenge attribute name (RFC 6750 §3).</summary>
+    public static readonly string ErrorDescriptionParameter = Utf8Constants.ToInternedString(ErrorDescriptionParameterUtf8);
+
+    /// <summary>The UTF-8 source literal of <see cref="ScopeParameter"/>.</summary>
+    public static ReadOnlySpan<byte> ScopeParameterUtf8 => "scope"u8;
+
+    /// <summary>The <c>scope</c> challenge attribute name (RFC 6750 §3).</summary>
+    public static readonly string ScopeParameter = Utf8Constants.ToInternedString(ScopeParameterUtf8);
+
+    /// <summary>The all-absent instance <see cref="TryParse"/> yields when parsing fails.</summary>
+    private static readonly BearerTokenChallengeParameters EmptyParameters = new(
+        Realm: null, Error: null, ErrorDescription: null, Scope: null, ResourceMetadata: null);
+
+
+    /// <summary>
+    /// Builds a <c>WWW-Authenticate</c> Bearer challenge value from the
+    /// supplied attributes, emitted in signature order:
+    /// <c>Bearer realm="…", error="…", error_description="…", scope="…", resource_metadata="…"</c>.
+    /// A <see langword="null"/> or empty string is treated as absent.
+    /// </summary>
+    /// <param name="realm">The protection-space identifier (§3); any content representable in an RFC 9110 §5.6.4 quoted-string.</param>
+    /// <param name="error">The §3.1 error code, e.g. <see cref="OAuthErrors.InvalidToken"/>; characters in %x20-21 / %x23-5B / %x5D-7E.</param>
+    /// <param name="errorDescription">The developer-readable explanation (§3); characters in %x20-21 / %x23-5B / %x5D-7E.</param>
+    /// <param name="scope">The space-delimited scopes the resource requires (§3, RFC 6749 §3.3); scope-tokens of %x21 / %x23-5B / %x5D-7E.</param>
+    /// <param name="resourceMetadata">The RFC 9728 §3 protected resource metadata URL, composed as the §5.1 <c>resource_metadata</c> auth-param.</param>
+    /// <returns>The <c>WWW-Authenticate</c> header value.</returns>
+    /// <exception cref="ArgumentException">
+    /// Every attribute is absent (§3: the scheme MUST be followed by one or
+    /// more auth-param values), or a value contains characters outside its §3
+    /// charset and cannot be represented.
+    /// </exception>
+    public static string BuildChallenge(
+        string? realm = null,
+        string? error = null,
+        string? errorDescription = null,
+        string? scope = null,
+        Uri? resourceMetadata = null)
+    {
+        bool hasRealm = !string.IsNullOrEmpty(realm);
+        bool hasError = !string.IsNullOrEmpty(error);
+        bool hasErrorDescription = !string.IsNullOrEmpty(errorDescription);
+        bool hasScope = !string.IsNullOrEmpty(scope);
+
+        if(!hasRealm && !hasError && !hasErrorDescription && !hasScope && resourceMetadata is null)
+        {
+            throw new ArgumentException(
+                "At least one attribute is required: the Bearer scheme MUST be followed by one or more auth-param values (RFC 6750 §3).");
+        }
+
+        if(hasRealm && !IsQuotedStringRepresentable(realm!))
+        {
+            throw new ArgumentException(
+                "realm contains characters that cannot be represented in an RFC 9110 §5.6.4 quoted-string.", nameof(realm));
+        }
+
+        if(hasError && !IsWithinNqsCharset(error!))
+        {
+            throw new ArgumentException(
+                "error contains characters outside %x20-21 / %x23-5B / %x5D-7E (RFC 6750 §3).", nameof(error));
+        }
+
+        if(hasErrorDescription && !IsWithinNqsCharset(errorDescription!))
+        {
+            throw new ArgumentException(
+                "error_description contains characters outside %x20-21 / %x23-5B / %x5D-7E (RFC 6750 §3).", nameof(errorDescription));
+        }
+
+        if(hasScope && !IsScopeList(scope!))
+        {
+            throw new ArgumentException(
+                "scope must be single-space-delimited scope-tokens of %x21 / %x23-5B / %x5D-7E characters (RFC 6750 §3).", nameof(scope));
+        }
+
+        StringBuilder builder = new();
+        builder.Append(WellKnownAuthenticationSchemes.Bearer);
+        bool isFirstParameter = true;
+
+        if(hasRealm)
+        {
+            AppendQuotedParameter(builder, RealmParameter, realm!, ref isFirstParameter);
+        }
+
+        if(hasError)
+        {
+            AppendQuotedParameter(builder, ErrorParameter, error!, ref isFirstParameter);
+        }
+
+        if(hasErrorDescription)
+        {
+            AppendQuotedParameter(builder, ErrorDescriptionParameter, errorDescription!, ref isFirstParameter);
+        }
+
+        if(hasScope)
+        {
+            AppendQuotedParameter(builder, ScopeParameter, scope!, ref isFirstParameter);
+        }
+
+        if(resourceMetadata is not null)
+        {
+            //The RFC 9728 §5.1 value formatting (quoted-string escaping of the
+            //URL) stays with ProtectedResourceChallenge — the scheme prefix its
+            //challenge carries is sliced off so the auth-param joins this
+            //challenge's list instead of duplicating the quoting rules here.
+            string composed = ProtectedResourceChallenge.BuildChallenge(
+                WellKnownAuthenticationSchemes.Bearer, resourceMetadata);
+            builder.Append(isFirstParameter ? " " : ", ");
+            builder.Append(composed.AsSpan(WellKnownAuthenticationSchemes.Bearer.Length + 1));
+        }
+
+        return builder.ToString();
+    }
+
+
+    /// <summary>
+    /// Parses a single <c>WWW-Authenticate</c> Bearer challenge value into its
+    /// §3 attributes. Attribute names compare case-insensitively and values may
+    /// be tokens or quoted strings per the RFC 9110 §11.2 <c>auth-param</c>
+    /// grammar; attributes beyond the five recognized here are ignored (§3
+    /// allows other auth-params).
+    /// </summary>
+    /// <param name="challengeValue">The header value, e.g. <c>Bearer realm="example", error="invalid_token"</c>.</param>
+    /// <param name="parameters">The parsed attributes; all absent when parsing fails.</param>
+    /// <returns>
+    /// <see langword="false"/> when the scheme is not <c>Bearer</c>, no
+    /// auth-param follows the scheme (§3: one or more required), the auth-param
+    /// grammar is violated, a recognized attribute repeats (§3: MUST NOT appear
+    /// more than once), or <c>resource_metadata</c> is not an absolute URI.
+    /// </returns>
+    public static bool TryParse(string challengeValue, out BearerTokenChallengeParameters parameters)
+    {
+        ArgumentNullException.ThrowIfNull(challengeValue);
+
+        parameters = EmptyParameters;
+
+        int position = SkipWhitespace(challengeValue, 0);
+        int schemeStart = position;
+        while(position < challengeValue.Length && challengeValue[position] != ' ' && challengeValue[position] != '\t')
+        {
+            position++;
+        }
+
+        if(!WellKnownAuthenticationSchemes.IsBearer(challengeValue[schemeStart..position]))
+        {
+            return false;
+        }
+
+        string? realm = null;
+        string? error = null;
+        string? errorDescription = null;
+        string? scope = null;
+        string? resourceMetadataValue = null;
+        bool hasParsedParameter = false;
+
+        while(position < challengeValue.Length)
+        {
+            //Element separators: OWS and commas — the RFC 9110 #rule permits
+            //empty list elements between commas.
+            while(position < challengeValue.Length
+                && (challengeValue[position] == ' ' || challengeValue[position] == '\t' || challengeValue[position] == ','))
+            {
+                position++;
+            }
+
+            if(position >= challengeValue.Length)
+            {
+                break;
+            }
+
+            int nameStart = position;
+            while(position < challengeValue.Length && IsTokenChar(challengeValue[position]))
+            {
+                position++;
+            }
+
+            if(position == nameStart)
+            {
+                return false;
+            }
+
+            string name = challengeValue[nameStart..position];
+
+            position = SkipWhitespace(challengeValue, position);
+            if(position >= challengeValue.Length || challengeValue[position] != '=')
+            {
+                return false;
+            }
+
+            position = SkipWhitespace(challengeValue, position + 1);
+            if(position >= challengeValue.Length)
+            {
+                return false;
+            }
+
+            string? value = challengeValue[position] == '"'
+                ? ReadQuotedString(challengeValue, position, out position)
+                : ReadToken(challengeValue, ref position);
+            if(value is null)
+            {
+                return false;
+            }
+
+            bool isStored = name switch
+            {
+                _ when IsParameterName(name, RealmParameter) => TryStore(ref realm, value),
+                _ when IsParameterName(name, ErrorParameter) => TryStore(ref error, value),
+                _ when IsParameterName(name, ErrorDescriptionParameter) => TryStore(ref errorDescription, value),
+                _ when IsParameterName(name, ScopeParameter) => TryStore(ref scope, value),
+                _ when IsParameterName(name, ProtectedResourceChallenge.ResourceMetadataParameter) => TryStore(ref resourceMetadataValue, value),
+                _ => true
+            };
+
+            if(!isStored)
+            {
+                return false;
+            }
+
+            hasParsedParameter = true;
+
+            position = SkipWhitespace(challengeValue, position);
+            if(position < challengeValue.Length && challengeValue[position] != ',')
+            {
+                return false;
+            }
+        }
+
+        if(!hasParsedParameter)
+        {
+            return false;
+        }
+
+        //resource_metadata must be an absolute http(s) URL (RFC 9728): both an absolute URI and an
+        //http or https scheme are required.
+        Uri? resourceMetadata = null;
+        if(resourceMetadataValue is not null
+            && (!Uri.TryCreate(resourceMetadataValue, UriKind.Absolute, out resourceMetadata)
+                || (resourceMetadata.Scheme != Uri.UriSchemeHttps && resourceMetadata.Scheme != Uri.UriSchemeHttp)))
+        {
+            return false;
+        }
+
+        parameters = new BearerTokenChallengeParameters(realm, error, errorDescription, scope, resourceMetadata);
+
+        return true;
+    }
+
+
+    /// <summary>
+    /// Appends <c>{name}="{value}"</c> preceded by the scheme separator or the
+    /// auth-param list separator, with RFC 9110 §5.6.4 quoted-string escaping
+    /// of <c>"</c> and <c>\</c> in <paramref name="value"/>.
+    /// </summary>
+    private static void AppendQuotedParameter(StringBuilder builder, string name, string value, ref bool isFirstParameter)
+    {
+        string escaped = value
+            .Replace("\\", "\\\\", StringComparison.Ordinal)
+            .Replace("\"", "\\\"", StringComparison.Ordinal);
+        builder.Append(isFirstParameter ? " " : ", ");
+        builder.Append(name).Append("=\"").Append(escaped).Append('"');
+        isFirstParameter = false;
+    }
+
+
+    /// <summary>
+    /// Stores <paramref name="value"/> into <paramref name="slot"/>, or returns
+    /// <see langword="false"/> when the attribute already appeared — §3: the
+    /// recognized attributes MUST NOT appear more than once.
+    /// </summary>
+    private static bool TryStore(ref string? slot, string value)
+    {
+        if(slot is not null)
+        {
+            return false;
+        }
+
+        slot = value;
+
+        return true;
+    }
+
+
+    /// <summary>
+    /// Compares auth-param names per RFC 9110 §11.2: case-insensitively.
+    /// </summary>
+    private static bool IsParameterName(string name, string parameterName) =>
+        string.Equals(name, parameterName, StringComparison.OrdinalIgnoreCase);
+
+
+    /// <summary>
+    /// The RFC 6749 Appendix A NQSCHAR set restated by RFC 6750 §3 for
+    /// <c>error</c> and <c>error_description</c>: %x20-21 / %x23-5B / %x5D-7E.
+    /// </summary>
+    private static bool IsNqsChar(char c) =>
+        c is (>= ' ' and <= '!') or (>= '#' and <= '[') or (>= ']' and <= '~');
+
+
+    /// <summary>
+    /// The RFC 6749 Appendix A NQCHAR set restated by RFC 6750 §3 for scope
+    /// values: %x21 / %x23-5B / %x5D-7E.
+    /// </summary>
+    private static bool IsNqChar(char c) =>
+        c is '!' or (>= '#' and <= '[') or (>= ']' and <= '~');
+
+
+    private static bool IsWithinNqsCharset(string value)
+    {
+        foreach(char c in value)
+        {
+            if(!IsNqsChar(c))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+
+    /// <summary>
+    /// Validates the RFC 6750 §3 scope shape restated from RFC 6749 §3.3:
+    /// scope-tokens of NQCHAR characters delimited by single %x20 spaces, with
+    /// no leading, trailing, or consecutive delimiters.
+    /// </summary>
+    private static bool IsScopeList(string value)
+    {
+        bool isPreviousDelimiter = true;
+        foreach(char c in value)
+        {
+            if(c == ' ')
+            {
+                if(isPreviousDelimiter)
+                {
+                    return false;
+                }
+
+                isPreviousDelimiter = true;
+                continue;
+            }
+
+            if(!IsNqChar(c))
+            {
+                return false;
+            }
+
+            isPreviousDelimiter = false;
+        }
+
+        return !isPreviousDelimiter;
+    }
+
+
+    /// <summary>
+    /// Whether every character is representable in an RFC 9110 §5.6.4
+    /// quoted-string: HTAB, SP, or a visible ASCII character — <c>"</c> and
+    /// <c>\</c> are representable through quoted-pair escaping.
+    /// </summary>
+    private static bool IsQuotedStringRepresentable(string value)
+    {
+        foreach(char c in value)
+        {
+            bool isRepresentable = c is '\t' or (>= ' ' and <= '~');
+            if(!isRepresentable)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+
+    /// <summary>
+    /// An RFC 9110 §5.6.2 tchar: visible ASCII except delimiters.
+    /// </summary>
+    private static bool IsTokenChar(char c) =>
+        c is (>= '0' and <= '9') or (>= 'a' and <= 'z') or (>= 'A' and <= 'Z')
+        or '!' or '#' or '$' or '%' or '&' or '\'' or '*' or '+' or '-' or '.'
+        or '^' or '_' or '`' or '|' or '~';
+
+
+    private static int SkipWhitespace(string value, int position)
+    {
+        while(position < value.Length && (value[position] == ' ' || value[position] == '\t'))
+        {
+            position++;
+        }
+
+        return position;
+    }
+
+
+    /// <summary>
+    /// Reads an RFC 9110 §5.6.4 quoted-string starting at
+    /// <paramref name="openingQuote"/>, unescaping quoted-pairs, and advances
+    /// <paramref name="position"/> past the closing quote. An unterminated
+    /// quoted-string yields <see langword="null"/>.
+    /// </summary>
+    private static string? ReadQuotedString(string value, int openingQuote, out int position)
+    {
+        StringBuilder builder = new();
+        for(int i = openingQuote + 1; i < value.Length; ++i)
+        {
+            char c = value[i];
+            if(c == '\\' && i + 1 < value.Length)
+            {
+                builder.Append(value[i + 1]);
+                ++i;
+                continue;
+            }
+
+            if(c == '"')
+            {
+                position = i + 1;
+
+                return builder.ToString();
+            }
+
+            builder.Append(c);
+        }
+
+        position = value.Length;
+
+        return null;
+    }
+
+
+    /// <summary>
+    /// Reads a token value and advances <paramref name="position"/> past it; an
+    /// empty token yields <see langword="null"/>.
+    /// </summary>
+    private static string? ReadToken(string value, ref int position)
+    {
+        int start = position;
+        while(position < value.Length && IsTokenChar(value[position]))
+        {
+            position++;
+        }
+
+        return position > start ? value[start..position] : null;
+    }
+}
diff --git a/src/Verifiable.OAuth/ProtectedResource/BearerTokenChallengeParameters.cs b/src/Verifiable.OAuth/ProtectedResource/BearerTokenChallengeParameters.cs
new file mode 100644
index 00000000..61813218
--- /dev/null
+++ b/src/Verifiable.OAuth/ProtectedResource/BearerTokenChallengeParameters.cs
@@ -0,0 +1,35 @@
+using System;
+using System.Diagnostics;
+
+namespace Verifiable.OAuth.ProtectedResource;
+
+/// <summary>
+/// The attributes read from an RFC 6750 §3 <c>WWW-Authenticate: Bearer</c>
+/// challenge by <see cref="BearerTokenChallenge.TryParse"/>. Every attribute is
+/// optional in the challenge, so any may be <see langword="null"/>.
+/// </summary>
+/// <remarks>
+/// The §3.1 error code carried in <see cref="Error"/> tells the client how to
+/// proceed: <c>invalid_token</c> means a new access token may be requested and
+/// the resource request retried; <c>insufficient_scope</c> means higher
+/// privileges are required, with <see cref="Scope"/> naming the scopes to
+/// request.
+/// </remarks>
+/// <param name="Realm">The protection-space identifier (RFC 6750 §3).</param>
+/// <param name="Error">The error code (RFC 6750 §3.1), e.g. <see cref="OAuthErrors.InvalidToken"/> or <see cref="OAuthErrors.InsufficientScope"/>.</param>
+/// <param name="ErrorDescription">The developer-readable explanation of the error (RFC 6750 §3).</param>
+/// <param name="Scope">The space-delimited scopes the resource requires (RFC 6750 §3, RFC 6749 §3.3).</param>
+/// <param name="ResourceMetadata">
+/// The RFC 9728 §5.1 <c>resource_metadata</c> URL. Per RFC 9728 §3.3, the
+/// fetched document's <c>resource</c> value MUST be identical to the URL the
+/// client used to make the resource request — verify with
+/// <see cref="ProtectedResourceMetadataValidation.IsResourceMatch"/> before
+/// using the document.
+/// </param>
+[DebuggerDisplay("BearerTokenChallengeParameters Error={Error} Scope={Scope}")]
+public sealed record BearerTokenChallengeParameters(
+    string? Realm,
+    string? Error,
+    string? ErrorDescription,
+    string? Scope,
+    Uri? ResourceMetadata);
diff --git a/src/Verifiable.OAuth/ProtectedResource/ProtectedResourceChallenge.cs b/src/Verifiable.OAuth/ProtectedResource/ProtectedResourceChallenge.cs
index 9ca3608a..00286ed4 100644
--- a/src/Verifiable.OAuth/ProtectedResource/ProtectedResourceChallenge.cs
+++ b/src/Verifiable.OAuth/ProtectedResource/ProtectedResourceChallenge.cs
@@ -42,11 +42,24 @@ public static class ProtectedResourceChallenge
     /// </summary>
     /// <param name="scheme">The authentication scheme, e.g. <see cref="WellKnownAuthenticationSchemes.Bearer"/>.</param>
     /// <param name="metadataUrl">The protected resource metadata URL (§3).</param>
+    /// <exception cref="ArgumentException">
+    /// The URL's <see cref="Uri.OriginalString"/> carries a control character
+    /// (a header-field-value MUST NOT contain CR, LF, or other CTLs per RFC 9110
+    /// §5.5) — a quoted-string cannot represent it, and emitting it verbatim
+    /// would split the header.
+    /// </exception>
     public static string BuildChallenge(string scheme, Uri metadataUrl)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(scheme);
         ArgumentNullException.ThrowIfNull(metadataUrl);
 
+        if(ContainsControlCharacter(metadataUrl.OriginalString))
+        {
+            throw new ArgumentException(
+                "The metadata URL carries a control character and cannot be represented in a header field value (RFC 9110 §5.5).",
+                nameof(metadataUrl));
+        }
+
         //Quoted-string per RFC 9110 §5.6.4 — URLs do not ordinarily carry
         //'"' or '\', but escape faithfully rather than assume.
         string url = metadataUrl.OriginalString
@@ -57,6 +70,24 @@ public static string BuildChallenge(string scheme, Uri metadataUrl)
     }
 
 
+    /// <summary>
+    /// Whether the value carries a C0 control character or DEL — RFC 9110 §5.5
+    /// forbids these in a field value, and CR/LF would split the header.
+    /// </summary>
+    private static bool ContainsControlCharacter(string value)
+    {
+        foreach(char c in value)
+        {
+            if(c is (< ' ') or '\x7f')
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+
     /// <summary>
     /// Reads the <c>resource_metadata</c> parameter out of a
     /// <c>WWW-Authenticate</c> header value, or <see langword="null"/> when
diff --git a/src/Verifiable.OAuth/Server/AuthorizationRequestDecision.cs b/src/Verifiable.OAuth/Server/AuthorizationRequestDecision.cs
index f3ba1834..a3aaa1f1 100644
--- a/src/Verifiable.OAuth/Server/AuthorizationRequestDecision.cs
+++ b/src/Verifiable.OAuth/Server/AuthorizationRequestDecision.cs
@@ -104,6 +104,46 @@ public sealed record AuthorizationRequestEvaluation
     /// application stamped no authentication time.
     /// </summary>
     public DateTimeOffset? EstablishedAuthTime { get; init; }
+
+    /// <summary>
+    /// The host component of the request's <c>client_id</c> when it is URL-shaped, or
+    /// <see langword="null"/> otherwise. Populated for every URL-shaped <c>client_id</c>
+    /// regardless of whether its Client ID Metadata Document was fetched — draft-ietf-oauth-client-id-metadata-document-02
+    /// §8.5: "The authorization server SHOULD display the hostname of the client_id on the
+    /// authorization interface, in addition to displaying the fetched client information if any."
+    /// </summary>
+    public string? ClientIdHost { get; init; }
+
+    /// <summary>
+    /// Whether this authorization request's registration carries document-derived client
+    /// metadata (<see cref="ClientName"/>, <see cref="ClientUri"/>, <see cref="LogoUri"/>) —
+    /// draft-ietf-oauth-client-id-metadata-document-02 §8.5: "Authorization servers SHOULD fetch
+    /// the client_id metadata document ... in order to provide users with additional
+    /// information about the request." <see langword="false"/> for a pre-registered client or a
+    /// CIMD client whose document fetch did not run or did not overlay any display field, in
+    /// which case §8.5 ¶2 calls for the application to "take additional measures to ensure the
+    /// user is provided with as much information as possible about the request" using
+    /// <see cref="ClientIdHost"/> alone.
+    /// </summary>
+    public bool HasFetchedClientMetadata { get; init; }
+
+    /// <summary>
+    /// The client's human-readable name from the materialized registration
+    /// (<see cref="ClientRecord.ClientName"/>), or <see langword="null"/> when none is known.
+    /// </summary>
+    public string? ClientName { get; init; }
+
+    /// <summary>
+    /// The client's web page from the materialized registration
+    /// (<see cref="ClientRecord.ClientUri"/>), or <see langword="null"/> when none is known.
+    /// </summary>
+    public Uri? ClientUri { get; init; }
+
+    /// <summary>
+    /// The client's logo image URL from the materialized registration
+    /// (<see cref="ClientRecord.LogoUri"/>), or <see langword="null"/> when none is known.
+    /// </summary>
+    public Uri? LogoUri { get; init; }
 }
 
 
diff --git a/src/Verifiable.OAuth/Server/AuthorizationServerDelegates.cs b/src/Verifiable.OAuth/Server/AuthorizationServerDelegates.cs
index 879e46f2..433533a6 100644
--- a/src/Verifiable.OAuth/Server/AuthorizationServerDelegates.cs
+++ b/src/Verifiable.OAuth/Server/AuthorizationServerDelegates.cs
@@ -3,6 +3,7 @@
 using Verifiable.JCose;
 
 using Verifiable.OAuth.Server.Metadata;
+using Verifiable.OAuth.Server.Pipeline;
 namespace Verifiable.OAuth.Server;
 
 /// <summary>
@@ -116,13 +117,32 @@ public delegate ValueTask<JwksDocument> BuildJwksDocumentDelegate(
 
 
 /// <summary>
-/// Fetches and validates a Client ID Metadata Document for CIMD clients.
+/// Resolves a Client ID Metadata Document (CIMD) for a Client Identifier URL per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-5">
+/// draft-ietf-oauth-client-id-metadata-document-02 Section 5</see>: fetches the document at
+/// <paramref name="clientMetadataUri"/> through the guarded outbound-fetch chokepoint,
+/// validates it, and reports a typed <see cref="ClientIdMetadataResolution"/> outcome. The
+/// resolver never throws for a fetch or validation failure — only cancellation propagates —
+/// so every caller-visible failure is a value the caller inspects, not an exception to catch.
 /// </summary>
 /// <remarks>
-/// Return <see langword="null"/> when the document cannot be fetched or fails
-/// validation. Caching with appropriate TTL is the responsibility of the implementation.
+/// The library default, <see cref="ClientIdMetadataDocuments.BuildResolving"/>, composes the
+/// Section 5 fetch-validate-cache pipeline: Section 3 URL validation, the guarded fetch,
+/// status/content-type/size checks, parsing via <see cref="ClientIdMetadataDocumentReader"/>,
+/// the <c>client_id</c> match (Section 4), the CIMD-020 additional-validation hook, optional
+/// logo prefetch (Section 8.8), and caching per Section 5.2.
+/// <see cref="ClientIdMetadataMaterialization"/> invokes this delegate from
+/// <see cref="AuthorizationServerIntegration.ResolveClientMetadataAsync"/> for a matched CIMD
+/// client and maps a non-<see cref="ClientIdMetadataResolutionOutcome.Resolved"/> outcome to a
+/// request failure.
 /// </remarks>
-public delegate ValueTask<ClientRecord?> ResolveClientMetadataDelegate(
+/// <param name="clientMetadataUri">The Client Identifier URL to fetch the document from.</param>
+/// <param name="context">
+/// The per-request context; the guarded fetch reads its
+/// <see cref="Verifiable.Core.OutboundFetch.OutboundFetchPolicy"/> from here.
+/// </param>
+/// <param name="cancellationToken">Cancellation token.</param>
+public delegate ValueTask<ClientIdMetadataResolution> ResolveClientMetadataDelegate(
     Uri clientMetadataUri,
     ExchangeContext context,
     CancellationToken cancellationToken);
diff --git a/src/Verifiable.OAuth/Server/BearerTokenValidation.cs b/src/Verifiable.OAuth/Server/BearerTokenValidation.cs
index 6959249a..1c0cd20c 100644
--- a/src/Verifiable.OAuth/Server/BearerTokenValidation.cs
+++ b/src/Verifiable.OAuth/Server/BearerTokenValidation.cs
@@ -17,10 +17,11 @@ namespace Verifiable.OAuth.Server;
 /// <para>
 /// Both the OIDC Core §5.3 UserInfo endpoint and the OID4VCI 1.0 §8 Credential Endpoint are
 /// protected resources that accept an AS-issued access token on the <c>Authorization</c>
-/// header; the structural-parse → <c>alg</c>/<c>kid</c> → key-resolve → signature-verify →
-/// <c>iss</c> → <c>exp</c> sequence is identical and lives here once so the security-critical
-/// validation cannot drift between call sites. Scope and subject-claim requirements are
-/// endpoint-specific and stay at the caller (UserInfo enforces <c>openid</c> per §5.3.1).
+/// header; the structural-parse → <c>alg</c>/<c>typ</c>/<c>kid</c> → key-resolve →
+/// signature-verify → <c>iss</c> → <c>exp</c> sequence is identical and lives here once so the
+/// security-critical validation cannot drift between call sites. Scope and subject-claim
+/// requirements are endpoint-specific and stay at the caller (UserInfo enforces <c>openid</c>
+/// per §5.3.1).
 /// </para>
 /// <para>
 /// Audience is deliberately not validated — a protected resource accepts any AS-issued access
@@ -201,6 +202,21 @@ public static bool TryExtractAccessToken(
                     "Access token header is missing kid."));
             }
 
+            //RFC 9068 §4 requires the resource server to verify the header's typ is explicitly
+            //"at+jwt" or "application/at+jwt" and reject any other value, distinguishing an
+            //access token from an ID Token or other JWT profile presented at this endpoint.
+            //Comparison is case-insensitive per RFC 7515 §4.1.9 (media type values are case
+            //insensitive per RFC 2045), matching the existing WellKnownMediaTypes helpers.
+            if(!header.TryGetValue(WellKnownJoseHeaderNames.Typ, out object? typObj)
+                || typObj is not string typ
+                || string.IsNullOrEmpty(typ)
+                || !(WellKnownMediaTypes.Jwt.IsAtJwt(typ) || WellKnownMediaTypes.Application.IsAtJwt(typ)))
+            {
+                return (null, ServerHttpResponse.Unauthorized(
+                    OAuthErrors.InvalidToken,
+                    "Access token header typ must be 'at+jwt' or 'application/at+jwt' per RFC 9068 §4."));
+            }
+
             //3. Resolve the verification key.
             PublicKeyMemory? publicKey = await oauth.Cryptography.VerificationKeyResolver(
                 new KeyId(kid), registration.TenantId, context, cancellationToken).ConfigureAwait(false);
diff --git a/src/Verifiable.OAuth/Server/ClientRecord.cs b/src/Verifiable.OAuth/Server/ClientRecord.cs
index e2842f09..2376410e 100644
--- a/src/Verifiable.OAuth/Server/ClientRecord.cs
+++ b/src/Verifiable.OAuth/Server/ClientRecord.cs
@@ -4,6 +4,7 @@
 using Verifiable.Core;
 using Verifiable.Cryptography;
 using Verifiable.Cryptography.Context;
+using Verifiable.OAuth.Client;
 using Verifiable.OAuth.Oid4Vp;
 
 namespace Verifiable.OAuth.Server;
@@ -211,6 +212,73 @@ public sealed record ClientRecord: IRegistrationRecord
     /// </summary>
     public Uri? ClientMetadataUri { get; init; }
 
+    /// <summary>
+    /// Whether this registration is the product of a request-time Client ID Metadata Document fetch —
+    /// set by <see cref="Pipeline.ClientIdMetadataMaterialization"/> when it overlays a successfully
+    /// fetched document onto the stub. Distinguishes a genuinely fetched CIMD client (even one whose
+    /// document declares only <c>client_id</c> and <c>redirect_uris</c>, leaving every display and
+    /// authentication field null) from a pre-registered CIMD client whose document is never fetched at
+    /// request time — the <c>SHOULD fetch</c> / <c>did not fetch</c> distinction of
+    /// draft-ietf-oauth-client-id-metadata-document-02 §8.5.
+    /// </summary>
+    public bool IsClientMetadataMaterialized { get; init; }
+
+    /// <summary>
+    /// The client authentication method this registration declared, the server-side mirror of
+    /// <see cref="Verifiable.OAuth.Client.ClientMetadata.TokenEndpointAuthMethod"/> (RFC 7591 §2
+    /// <c>token_endpoint_auth_method</c>). Carries RFC 7591 registry semantics — <see langword="null"/>
+    /// means the client declared none (public client behavior). For a client that uses a Client ID
+    /// Metadata Document this is populated from the fetched document by
+    /// <see cref="Pipeline.ClientIdMetadataDocumentReader"/>, which refuses to return a symmetric-secret
+    /// method (draft-ietf-oauth-client-id-metadata-document-02 §4.1).
+    /// </summary>
+    public ClientAuthenticationMethod? TokenEndpointAuthMethod { get; init; }
+
+    /// <summary>
+    /// The client's inline JSON Web Key Set as opaque JSON text, the server-side mirror of
+    /// <see cref="Verifiable.OAuth.Client.ClientMetadata.Jwks"/> (RFC 7591 §2 <c>jwks</c>). Kept opaque
+    /// because <c>System.Text.Json</c> is banned in this assembly; a caller resolving a client
+    /// authentication key parses it at the call site. Mutually exclusive with <see cref="ClientJwksUri"/>.
+    /// </summary>
+    public string? ClientJwks { get; init; }
+
+    /// <summary>
+    /// The URL of the client's JSON Web Key Set document, the server-side mirror of
+    /// <see cref="Verifiable.OAuth.Client.ClientMetadata.JwksUri"/> (RFC 7591 §2 <c>jwks_uri</c>).
+    /// Mutually exclusive with <see cref="ClientJwks"/>.
+    /// </summary>
+    public Uri? ClientJwksUri { get; init; }
+
+    /// <summary>
+    /// The client's human-readable name, the server-side mirror of
+    /// <see cref="Verifiable.OAuth.Client.ClientMetadata.ClientName"/> (RFC 7591 §2 <c>client_name</c>).
+    /// <see langword="null"/> when the client declared none.
+    /// </summary>
+    public string? ClientName { get; init; }
+
+    /// <summary>
+    /// The client's web page, the server-side mirror of
+    /// <see cref="Verifiable.OAuth.Client.ClientMetadata.ClientUri"/> (RFC 7591 §2 <c>client_uri</c>).
+    /// <see langword="null"/> when the client declared none.
+    /// </summary>
+    public Uri? ClientUri { get; init; }
+
+    /// <summary>
+    /// The client's logo image URL, the server-side mirror of
+    /// <see cref="Verifiable.OAuth.Client.ClientMetadata.LogoUri"/> (RFC 7591 §2 <c>logo_uri</c>).
+    /// draft-ietf-oauth-client-id-metadata-document-02 §8.5/§8.8 consult this field when presenting the
+    /// authorization request to the end user and when prefetching the client's logo image.
+    /// </summary>
+    public Uri? LogoUri { get; init; }
+
+    /// <summary>
+    /// The client's software statement, the server-side mirror of
+    /// <see cref="Verifiable.OAuth.Client.ClientMetadata.SoftwareStatement"/> (RFC 7591 §2.3
+    /// <c>software_statement</c>). Carried opaque and unverified; see
+    /// <see cref="Verifiable.OAuth.Client.ClientMetadata.SoftwareStatement"/> for the scope note.
+    /// </summary>
+    public string? SoftwareStatement { get; init; }
+
     /// <summary>
     /// The OpenID Federation entity identifier when this client participates in federation.
     /// <see langword="null"/> for clients that do not use federation.
diff --git a/src/Verifiable.OAuth/Server/ExchangeContextServerExtensions.cs b/src/Verifiable.OAuth/Server/ExchangeContextServerExtensions.cs
index e2263b80..954eeb5e 100644
--- a/src/Verifiable.OAuth/Server/ExchangeContextServerExtensions.cs
+++ b/src/Verifiable.OAuth/Server/ExchangeContextServerExtensions.cs
@@ -148,5 +148,26 @@ public void SetConfirmation(ConfirmationMethod confirmation)
             ArgumentNullException.ThrowIfNull(confirmation);
             context[Pipeline.AuthorizationServerHandlers.ConfirmationKey] = confirmation;
         }
+
+
+        /// <summary>
+        /// Gets the issuer URI resolved for the current Authorize request's RFC 9207 §2
+        /// <c>iss</c> redirect parameter, set by
+        /// <c>AuthCodeEndpoints.EvaluateAuthenticationRequirementsAsync</c> during
+        /// <c>BuildInputAsync</c> for consumption by <c>BuildResponse</c> and by the
+        /// authentication-requirements error redirect alike. <see langword="null"/> when
+        /// resolution has not run yet or no usable, shape-valid issuer was found.
+        /// </summary>
+        public Uri? ResolvedIssuer =>
+            context.TryGetValue(Pipeline.AuthorizationServerHandlers.ResolvedIssuerKey, out object? v)
+                && v is Uri issuer ? issuer : null;
+
+        /// <summary>Sets the issuer URI resolved for the current Authorize request's <c>iss</c> redirect parameter.</summary>
+        /// <param name="issuer">The resolved, shape-valid issuer URI.</param>
+        public void SetResolvedIssuer(Uri issuer)
+        {
+            ArgumentNullException.ThrowIfNull(issuer);
+            context[Pipeline.AuthorizationServerHandlers.ResolvedIssuerKey] = issuer;
+        }
     }
 }
diff --git a/src/Verifiable.OAuth/Server/IssuerIdentifierValidation.cs b/src/Verifiable.OAuth/Server/IssuerIdentifierValidation.cs
new file mode 100644
index 00000000..417fbb2b
--- /dev/null
+++ b/src/Verifiable.OAuth/Server/IssuerIdentifierValidation.cs
@@ -0,0 +1,34 @@
+namespace Verifiable.OAuth.Server;
+
+/// <summary>
+/// The server-side issuer-identifier shape validation applied wherever
+/// <see cref="ClientRecord.IssuerUri"/> or the request-scoped
+/// <see cref="ExchangeContextServerExtensions.Issuer"/> becomes the value emitted as
+/// the discovery <c>issuer</c> field or the Authorize-redirect <c>iss</c> parameter.
+/// The sibling of the client-side
+/// <see cref="Verifiable.OAuth.Client.AuthorizationServerMetadataValidation"/>.
+/// </summary>
+public static class IssuerIdentifierValidation
+{
+    /// <summary>
+    /// Whether <paramref name="issuer"/> satisfies
+    /// <see href="https://www.rfc-editor.org/rfc/rfc9207#section-2">RFC 9207 §2</see>:
+    /// "Its value MUST be a URL that uses the &quot;https&quot; scheme without any
+    /// query or fragment components" — the same issuer-identifier shape
+    /// <see href="https://www.rfc-editor.org/rfc/rfc8414#section-2">RFC 8414 §2</see>
+    /// requires of every authorization server issuer identifier.
+    /// </summary>
+    /// <param name="issuer">The candidate issuer identifier.</param>
+    public static bool IsValidIssuerShape(Uri issuer)
+    {
+        ArgumentNullException.ThrowIfNull(issuer);
+
+        //A relative URI has no scheme, query or fragment components to inspect
+        //(System.Uri throws on those accessors), and it cannot be "a URL that
+        //uses the https scheme" — it fails the shape rather than the caller.
+        return issuer.IsAbsoluteUri
+            && string.Equals(issuer.Scheme, Uri.UriSchemeHttps, StringComparison.Ordinal)
+            && issuer.Query.Length == 0
+            && issuer.Fragment.Length == 0;
+    }
+}
diff --git a/src/Verifiable.OAuth/Server/Metadata/MetadataEndpoints.cs b/src/Verifiable.OAuth/Server/Metadata/MetadataEndpoints.cs
index 2c452df1..5048d1e1 100644
--- a/src/Verifiable.OAuth/Server/Metadata/MetadataEndpoints.cs
+++ b/src/Verifiable.OAuth/Server/Metadata/MetadataEndpoints.cs
@@ -632,6 +632,21 @@ private static EndpointCandidate BuildDiscovery(string roleName) =>
                         true);
                 }
 
+                //draft-ietf-oauth-client-id-metadata-document-02 §6: advertise
+                //client_id_metadata_document_supported only when the capability is
+                //allowed AND the CIMD resolver seam is wired (fail-closed) — mirroring
+                //the back-channel-logout dual gate above. CIMD applies AS-wide (any
+                //grant a URL-shaped client_id can drive), so this is not gated on
+                //authorizationCodeOnChain.
+                if(((ClientRecord)registration).IsCapabilityAllowed(WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument)
+                    && oauth.ResolveClientMetadataAsync is not null)
+                {
+                    AppendBooleanField(
+                        sb,
+                        AuthorizationServerMetadataParameterNames.ClientIdMetadataDocumentSupported,
+                        true);
+                }
+
                 //token_endpoint_auth_methods_supported (RFC 8414 §2 OPTIONAL).
                 //The library's token endpoint accepts PKCE-only public clients
                 //per OAuth 2.1 — auth method "none". Deployments that add
diff --git a/src/Verifiable.OAuth/Server/Oidc10IdTokenProducer.cs b/src/Verifiable.OAuth/Server/Oidc10IdTokenProducer.cs
index efd3ab02..efcc8048 100644
--- a/src/Verifiable.OAuth/Server/Oidc10IdTokenProducer.cs
+++ b/src/Verifiable.OAuth/Server/Oidc10IdTokenProducer.cs
@@ -11,10 +11,24 @@ namespace Verifiable.OAuth.Server;
 /// </summary>
 /// <remarks>
 /// <para>
-/// The producer applies only when <c>openid</c> is in the granted scope.
-/// Signs with <see cref="KeyUsageContext.IdTokenIssuance"/>, allowing
-/// deployments to use different key material for ID Tokens than for access
-/// tokens via the per-usage <see cref="ClientRecord.SigningKeys"/> map.
+/// The producer applies only when <c>openid</c> is in the granted scope AND the request's
+/// <see cref="IssuanceContext.GrantType"/> is <c>authorization_code</c>, or <c>refresh_token</c>
+/// whose <see cref="IssuanceContext.RefreshTokenOriginatingGrantType"/> is itself
+/// <c>authorization_code</c> — the only shapes where the library knows an End-User was
+/// authenticated. A refresh token minted alongside a non-End-User grant
+/// (<c>client_credentials</c>, <c>token_exchange</c>, <c>jwt_bearer</c>,
+/// <c>pre_authorized_code</c>) carries that origin verbatim across rotation via
+/// <see cref="AuthCode.Server.States.ServerRefreshTokenIssuedState.OriginatingGrantType"/>, so its
+/// redemption never satisfies this gate. This is one of three defense-in-depth layers enforcing
+/// the <c>openid</c> ⇒ authenticated-end-user invariant, alongside the granted-scope narrowing in
+/// <see cref="AuthCode.AuthCodeEndpoints"/> for non-end-user grants and the consumer-side check in
+/// <see cref="Oidc.UserInfoEndpoints"/>: even if a defect ever left <c>openid</c> on a
+/// <c>client_credentials</c> or <c>token_exchange</c> token's scope — or on the refresh token
+/// minted alongside one — this grant-identity check independently keeps this producer from
+/// synthesizing an ID Token for that non-end-user subject. Signs with
+/// <see cref="KeyUsageContext.IdTokenIssuance"/>, allowing deployments to use different key
+/// material for ID Tokens than for access tokens via the per-usage
+/// <see cref="ClientRecord.SigningKeys"/> map.
 /// </para>
 /// <para>
 /// Composes the JWT structural baseline only: <c>iss</c>, <c>aud</c>,
@@ -56,7 +70,17 @@ private static ValueTask<bool> IsApplicableAsync(
         CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(context);
-        return ValueTask.FromResult(WellKnownScopes.ContainsOpenId(context.Scope));
+
+        static bool IsEndUserAuthenticatingGrant(IssuanceContext context) => context switch
+        {
+            _ when WellKnownGrantTypes.IsAuthorizationCode(context.GrantType) => true,
+            { RefreshTokenOriginatingGrantType: { } origin } when WellKnownGrantTypes.IsRefreshToken(context.GrantType) =>
+                WellKnownGrantTypes.IsAuthorizationCode(origin),
+            _ => false
+        };
+
+        return ValueTask.FromResult(
+            WellKnownScopes.ContainsOpenId(context.Scope) && IsEndUserAuthenticatingGrant(context));
     }
 
 
diff --git a/src/Verifiable.OAuth/Server/Pipeline/AuthorizationServerHandlers.cs b/src/Verifiable.OAuth/Server/Pipeline/AuthorizationServerHandlers.cs
index b4b4ff05..1da51c0e 100644
--- a/src/Verifiable.OAuth/Server/Pipeline/AuthorizationServerHandlers.cs
+++ b/src/Verifiable.OAuth/Server/Pipeline/AuthorizationServerHandlers.cs
@@ -58,4 +58,13 @@ internal static class AuthorizationServerHandlers
     /// for the current request (typically the DPoP <c>jkt</c> thumbprint per RFC 9449 §6.1).
     /// </summary>
     public const string ConfirmationKey = "server.confirmation";
+
+    /// <summary>
+    /// Context-bag key for the issuer URI resolved for the current Authorize request's
+    /// <c>iss</c> redirect parameter (RFC 9207 §2), computed once during
+    /// <c>BuildInputAsync</c>'s authentication-requirements evaluation so both the success
+    /// and error redirect paths read the identical value the discovery endpoint would
+    /// resolve. Transient — never persisted.
+    /// </summary>
+    public const string ResolvedIssuerKey = "server.resolvedIssuer";
 }
diff --git a/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocumentReader.cs b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocumentReader.cs
new file mode 100644
index 00000000..2905f784
--- /dev/null
+++ b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocumentReader.cs
@@ -0,0 +1,469 @@
+using System.Diagnostics;
+using System.Text;
+using Verifiable.JCose;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.WellKnown;
+
+namespace Verifiable.OAuth.Server.Pipeline;
+
+/// <summary>
+/// Conformance defects <see cref="ClientIdMetadataDocumentReader.Parse"/> detects in a fetched
+/// Client ID Metadata Document per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html">
+/// draft-ietf-oauth-client-id-metadata-document-02</see>. A non-<see cref="None"/> value means the
+/// document is not usable as client metadata; the resolver that owns network policy (
+/// <c>ClientIdMetadataDocuments.BuildResolving</c>) maps any set flag to the
+/// <c>ClientIdMetadataResolutionOutcome.InvalidDocument</c> outcome and never caches the result.
+/// </summary>
+[Flags]
+public enum ClientIdMetadataDocumentDefects
+{
+    /// <summary>No defect — the document parsed as a conformant Client ID Metadata Document.</summary>
+    None = 0,
+
+    /// <summary>
+    /// The document has no <c>client_id</c> property (draft-ietf-oauth-client-id-metadata-document-02
+    /// §4, CIMD-013 — "The Client ID Metadata Document MUST contain a client_id property").
+    /// </summary>
+    MissingClientId = 1 << 0,
+
+    /// <summary>
+    /// The document carries a <c>client_secret</c> or <c>client_secret_expires_at</c> property
+    /// (draft-ietf-oauth-client-id-metadata-document-02 §4.1, CIMD-022 — "the client_secret and
+    /// client_secret_expires_at properties MUST NOT be used"). There is no way to establish a shared
+    /// secret with a document served from a URL the client controls, so either property's presence is
+    /// itself a conformance defect.
+    /// </summary>
+    ClientSecretFieldsPresent = 1 << 1,
+
+    /// <summary>
+    /// The document's <c>token_endpoint_auth_method</c> names a method based around a shared symmetric
+    /// secret — <c>client_secret_post</c>, <c>client_secret_basic</c>, or <c>client_secret_jwt</c>
+    /// (draft-ietf-oauth-client-id-metadata-document-02 §4.1, CIMD-021).
+    /// </summary>
+    SymmetricAuthMethod = 1 << 2,
+
+    /// <summary>
+    /// The document's <c>token_endpoint_auth_method</c> names a method
+    /// <see cref="ClientAuthenticationMethodNames.TryParse"/> does not recognize. Rejected fail-closed:
+    /// the authorization server cannot enforce
+    /// draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-049/CIMD-050) client authentication
+    /// for a method it does not understand.
+    /// </summary>
+    UnknownAuthMethod = 1 << 3,
+
+    /// <summary>
+    /// The document's <c>jwks</c> contains a JWK carrying a private or symmetric member (<c>d</c>,
+    /// <c>p</c>, <c>q</c>, <c>dp</c>, <c>dq</c>, <c>qi</c>, <c>oth</c>, or <c>k</c>)
+    /// (draft-ietf-oauth-client-id-metadata-document-02 §4.1, CIMD-023 — "private key material MUST
+    /// NOT be included in the Client ID Metadata Document; only public keys ... are permitted").
+    /// </summary>
+    PrivateKeyMaterialInJwks = 1 << 4,
+
+    /// <summary>
+    /// The document's <c>jwks_uri</c> is present but does not parse as an absolute <c>https</c> URI
+    /// (draft-ietf-oauth-client-id-metadata-document-02 §8.6, CIMD-058).
+    /// </summary>
+    InvalidJwksUri = 1 << 5,
+
+    /// <summary>
+    /// The document's <c>logo_uri</c> is present but does not parse as an absolute <c>https</c> URI
+    /// (draft-ietf-oauth-client-id-metadata-document-02 §8.6, CIMD-058 — rejects schemes such as
+    /// <c>javascript:</c>).
+    /// </summary>
+    InvalidLogoUri = 1 << 6,
+
+    /// <summary>
+    /// The document's <c>client_uri</c> is present but does not parse as an absolute <c>https</c> URI
+    /// (draft-ietf-oauth-client-id-metadata-document-02 §8.6, CIMD-058).
+    /// </summary>
+    InvalidClientUri = 1 << 7,
+
+    /// <summary>
+    /// One or more entries of the document's <c>redirect_uris</c> array do not parse as an absolute
+    /// URI (draft-ietf-oauth-client-id-metadata-document-02 §4.2/§8.6, CIMD-058).
+    /// </summary>
+    InvalidRedirectUri = 1 << 8
+}
+
+
+/// <summary>
+/// The outcome of <see cref="ClientIdMetadataDocumentReader.Parse"/>: the extracted <c>client_id</c>,
+/// the best-effort parsed <see cref="ClientMetadata"/>, and every conformance defect found.
+/// </summary>
+/// <remarks>
+/// <see cref="Metadata"/> is populated from every field present in the document regardless of
+/// <see cref="Defects"/> — the reader never throws and never partially stops extraction on the first
+/// defect, so a caller doing diagnostics sees the whole document. The resolver that owns network and
+/// caching policy is the layer that decides a non-<see cref="ClientIdMetadataDocumentDefects.None"/>
+/// result must not be used or cached.
+/// </remarks>
+public sealed record ClientIdMetadataDocumentReadResult
+{
+    /// <summary>The document's <c>client_id</c> property value, or <see langword="null"/> if absent.</summary>
+    public string? ClientId { get; init; }
+
+    /// <summary>The client metadata extracted from the document.</summary>
+    public ClientMetadata? Metadata { get; init; }
+
+    /// <summary>Every conformance defect <see cref="ClientIdMetadataDocumentReader.Parse"/> found.</summary>
+    public ClientIdMetadataDocumentDefects Defects { get; init; }
+
+    /// <summary>Whether <see cref="Defects"/> carries any flag.</summary>
+    public bool HasDefects => Defects != ClientIdMetadataDocumentDefects.None;
+}
+
+
+/// <summary>
+/// Span-based reader for a fetched Client ID Metadata Document per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html">
+/// draft-ietf-oauth-client-id-metadata-document-02</see> §4.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Follows the <see cref="Oid4Vp.Server.WalletMetadataReader"/> precedent: UTF-8 span parsing on
+/// <see cref="JwkJsonReader"/> primitives, not <c>System.Text.Json</c>. The CIMD-013/021/022/023/058
+/// checks in <see cref="ClientIdMetadataDocumentDefects"/> are library obligations the resolver
+/// enforces on every fetched document regardless of which JSON library an application wires into
+/// <see cref="AuthorizationServerIntegration.ParseClientMetadataAsync"/> — that delegate parses RFC
+/// 7591 registration request bodies, a distinct trust boundary from a document fetched from a URL the
+/// client controls.
+/// </para>
+/// <para>
+/// Field extraction beyond the defect checks is best-effort: an array entry or scalar this reader does
+/// not recognize (an unknown <c>grant_types</c> or <c>response_types</c> wire value) is skipped rather
+/// than treated as a defect, since draft-ietf-oauth-client-id-metadata-document-02 places no
+/// conformance requirement on such fields.
+/// </para>
+/// </remarks>
+[DebuggerDisplay("ClientIdMetadataDocumentReader")]
+public static class ClientIdMetadataDocumentReader
+{
+    /// <summary>
+    /// Parses a fetched Client ID Metadata Document, extracting <c>client_id</c>, every field
+    /// <see cref="ClientMetadata"/> carries, and every conformance defect in
+    /// <see cref="ClientIdMetadataDocumentDefects"/>.
+    /// </summary>
+    /// <param name="document">The document body as fetched, UTF-8 encoded.</param>
+    public static ClientIdMetadataDocumentReadResult Parse(ReadOnlySpan<byte> document)
+    {
+        ClientIdMetadataDocumentDefects defects = ClientIdMetadataDocumentDefects.None;
+
+        string? clientId = JwkJsonReader.ExtractStringValue(document, "client_id"u8);
+        if(clientId is null)
+        {
+            defects |= ClientIdMetadataDocumentDefects.MissingClientId;
+        }
+
+        if(JwkJsonReader.ContainsKey(document, "client_secret"u8)
+            || JwkJsonReader.ContainsKey(document, "client_secret_expires_at"u8))
+        {
+            defects |= ClientIdMetadataDocumentDefects.ClientSecretFieldsPresent;
+        }
+
+        (ClientAuthenticationMethod? tokenEndpointAuthMethod, ClientIdMetadataDocumentDefects authMethodDefect) =
+            ExtractTokenEndpointAuthMethod(document);
+        defects |= authMethodDefect;
+
+        string? jwks = JwkJsonReader.ExtractObjectAsString(document, "jwks"u8);
+        if(jwks is not null && JwksContainsPrivateOrSymmetricMember(Encoding.UTF8.GetBytes(jwks)))
+        {
+            defects |= ClientIdMetadataDocumentDefects.PrivateKeyMaterialInJwks;
+        }
+
+        (Uri? jwksUri, ClientIdMetadataDocumentDefects jwksUriDefect) =
+            ExtractStrictHttpsUri(document, "jwks_uri"u8, ClientIdMetadataDocumentDefects.InvalidJwksUri);
+        (Uri? logoUri, ClientIdMetadataDocumentDefects logoUriDefect) =
+            ExtractStrictHttpsUri(document, "logo_uri"u8, ClientIdMetadataDocumentDefects.InvalidLogoUri);
+        (Uri? clientUri, ClientIdMetadataDocumentDefects clientUriDefect) =
+            ExtractStrictHttpsUri(document, "client_uri"u8, ClientIdMetadataDocumentDefects.InvalidClientUri);
+        (List<Uri> redirectUris, ClientIdMetadataDocumentDefects redirectUriDefect) =
+            ExtractAbsoluteUris(document, "redirect_uris"u8, ClientIdMetadataDocumentDefects.InvalidRedirectUri);
+        (List<Uri> postLogoutRedirectUris, _) =
+            ExtractAbsoluteUris(document, "post_logout_redirect_uris"u8, ClientIdMetadataDocumentDefects.None);
+
+        defects |= jwksUriDefect | logoUriDefect | clientUriDefect | redirectUriDefect;
+
+        ClientMetadata metadata = new()
+        {
+            ClientName = JwkJsonReader.ExtractStringValue(document, "client_name"u8),
+            ClientUri = clientUri,
+            LogoUri = logoUri,
+            RedirectUris = redirectUris,
+            GrantTypes = ExtractGrantTypes(document),
+            ResponseTypes = ExtractResponseTypes(document),
+            TokenEndpointAuthMethod = tokenEndpointAuthMethod,
+            TokenEndpointAuthSigningAlg = JwkJsonReader.ExtractStringValue(document, "token_endpoint_auth_signing_alg"u8),
+            Scope = JwkJsonReader.ExtractStringValue(document, "scope"u8),
+            AuthorizationDetailsTypes = JwkJsonReader.ExtractStringArrayProperty(
+                document, AuthorizationDetailsParameterNames.AuthorizationDetailsTypesUtf8),
+            AuthorizationGrantProfilesSupported = JwkJsonReader.ExtractStringArrayProperty(
+                document, AuthorizationServerMetadataParameterNames.AuthorizationGrantProfilesSupportedUtf8),
+            JwksUri = jwksUri,
+            Jwks = jwks,
+            ApplicationType = JwkJsonReader.ExtractStringValue(document, "application_type"u8),
+            IdTokenSignedResponseAlg = JwkJsonReader.ExtractStringValue(document, "id_token_signed_response_alg"u8),
+            RequestObjectSigningAlg = JwkJsonReader.ExtractStringValue(document, "request_object_signing_alg"u8),
+            RequestObjectEncryptionAlg = JwkJsonReader.ExtractStringValue(document, "request_object_encryption_alg"u8),
+            PostLogoutRedirectUris = postLogoutRedirectUris,
+            BackchannelLogoutUri = ExtractAbsoluteUri(document, "backchannel_logout_uri"u8),
+            BackchannelLogoutSessionRequired = ExtractBoolean(document, "backchannel_logout_session_required"u8),
+            FrontchannelLogoutUri = ExtractAbsoluteUri(document, "frontchannel_logout_uri"u8),
+            FrontchannelLogoutSessionRequired = ExtractBoolean(document, "frontchannel_logout_session_required"u8),
+            SoftwareStatement = JwkJsonReader.ExtractStringValue(document, "software_statement"u8)
+        };
+
+        return new ClientIdMetadataDocumentReadResult
+        {
+            ClientId = clientId,
+            Metadata = metadata,
+            Defects = defects
+        };
+    }
+
+
+    private static (ClientAuthenticationMethod? Method, ClientIdMetadataDocumentDefects Defect) ExtractTokenEndpointAuthMethod(
+        ReadOnlySpan<byte> document)
+    {
+        string? wireValue = JwkJsonReader.ExtractStringValue(document, "token_endpoint_auth_method"u8);
+        if(wireValue is null)
+        {
+            return (null, ClientIdMetadataDocumentDefects.None);
+        }
+
+        return wireValue switch
+        {
+            _ when IsSymmetricAuthMethod(wireValue) =>
+                (null, ClientIdMetadataDocumentDefects.SymmetricAuthMethod),
+            _ when ClientAuthenticationMethodNames.TryParse(wireValue, out ClientAuthenticationMethod parsed) =>
+                (parsed, ClientIdMetadataDocumentDefects.None),
+            _ => (null, ClientIdMetadataDocumentDefects.UnknownAuthMethod)
+        };
+    }
+
+
+    private static bool IsSymmetricAuthMethod(string wireValue) =>
+        WellKnownClientAuthenticationMethods.IsClientSecretPost(wireValue)
+        || WellKnownClientAuthenticationMethods.IsClientSecretBasic(wireValue)
+        || WellKnownClientAuthenticationMethods.IsClientSecretJwt(wireValue);
+
+
+    //Walks the "keys" array of a JWKS object's JSON text (braces included) and reports whether any
+    //element carries a private or symmetric JWK member. Mirrors the array-walking pattern
+    //JwkJsonReader.ExtractNestedStringValuesFromArray uses internally, composed here with
+    //JwkJsonReader.GetTopLevelKeyNames (a JwkJsonReader primitive) per element since JwkJsonReader has
+    //no existing primitive that returns member names for every element of an object array.
+    private static bool JwksContainsPrivateOrSymmetricMember(ReadOnlySpan<byte> jwksDocument)
+    {
+        int keysStart = JwkJsonReader.IndexOfKey(jwksDocument, WellKnownJwkMemberNames.KeysUtf8);
+        if(keysStart < 0)
+        {
+            return false;
+        }
+
+        int afterKeysKey = keysStart + WellKnownJwkMemberNames.KeysUtf8.Length + 1;
+        afterKeysKey = JwkJsonReader.SkipWhitespaceAndColon(jwksDocument, afterKeysKey);
+        if(afterKeysKey < 0 || afterKeysKey >= jwksDocument.Length || jwksDocument[afterKeysKey] != (byte)'[')
+        {
+            return false;
+        }
+
+        int cursor = afterKeysKey + 1;
+        while(cursor < jwksDocument.Length)
+        {
+            while(cursor < jwksDocument.Length && IsArraySeparator(jwksDocument[cursor]))
+            {
+                cursor++;
+            }
+
+            if(cursor >= jwksDocument.Length || jwksDocument[cursor] == (byte)']')
+            {
+                return false;
+            }
+
+            if(jwksDocument[cursor] != (byte)'{')
+            {
+                return false;
+            }
+
+            int objectStart = cursor;
+            int objectEnd = FindObjectEnd(jwksDocument, objectStart);
+            if(objectEnd < 0)
+            {
+                return false;
+            }
+
+            List<string> memberNames = JwkJsonReader.GetTopLevelKeyNames(
+                jwksDocument[(objectStart + 1)..(objectEnd - 1)]);
+            if(WellKnownJwkMemberNames.ContainsPrivateOrSymmetricMember(memberNames))
+            {
+                return true;
+            }
+
+            cursor = objectEnd;
+        }
+
+        return false;
+    }
+
+
+    //Returns the index one past the '}' that closes the object opening at objectStart, or -1 when the
+    //braces never balance. String content is skipped so a brace inside a quoted value never biases
+    //the depth counter.
+    private static int FindObjectEnd(ReadOnlySpan<byte> json, int objectStart)
+    {
+        int depth = 1;
+        int pos = objectStart + 1;
+
+        while(pos < json.Length && depth > 0)
+        {
+            byte current = json[pos];
+            if(current == (byte)'{')
+            {
+                depth++;
+            }
+            else if(current == (byte)'}')
+            {
+                depth--;
+            }
+            else if(current == (byte)'"')
+            {
+                pos++;
+                while(pos < json.Length && json[pos] != (byte)'"')
+                {
+                    if(json[pos] == (byte)'\\')
+                    {
+                        pos++;
+                    }
+
+                    pos++;
+                }
+            }
+
+            pos++;
+        }
+
+        return depth == 0 ? pos : -1;
+    }
+
+
+    private static bool IsArraySeparator(byte value) =>
+        value is (byte)' ' or (byte)'\t' or (byte)'\r' or (byte)'\n' or (byte)',';
+
+
+    //jwks_uri/logo_uri/client_uri (CIMD-058) are strict-https: a scheme mismatch — including
+    //javascript: and every non-https scheme — is the defect, not merely a malformed URI string.
+    private static (Uri? Value, ClientIdMetadataDocumentDefects Defect) ExtractStrictHttpsUri(
+        ReadOnlySpan<byte> document, ReadOnlySpan<byte> key, ClientIdMetadataDocumentDefects invalidDefect)
+    {
+        string? raw = JwkJsonReader.ExtractStringValue(document, key);
+        if(raw is null)
+        {
+            return (null, ClientIdMetadataDocumentDefects.None);
+        }
+
+        return Uri.TryCreate(raw, UriKind.Absolute, out Uri? uri) && uri.Scheme == Uri.UriSchemeHttps
+            ? (uri, ClientIdMetadataDocumentDefects.None)
+            : (null, invalidDefect);
+    }
+
+
+    //redirect_uris (CIMD-058) are shape-checked as absolute URIs, admitting https and the native custom
+    //invocation schemes general OAuth clients use, but rejecting the dangerous pseudo-schemes §8.6 names
+    //(javascript:) and their siblings (data:, vbscript:): those are never a legitimate redirect target and
+    //a fetched document that carries one — which would then pass the exact-match redirect check and be
+    //emitted as the authorization-response target — is treated as defective. post_logout_redirect_uris
+    //reuses this with ClientIdMetadataDocumentDefects.None since this wave's ledger scope gates only
+    //redirect_uris; a dangerous-scheme entry is still dropped rather than registered.
+    private static (List<Uri> Values, ClientIdMetadataDocumentDefects Defect) ExtractAbsoluteUris(
+        ReadOnlySpan<byte> document, ReadOnlySpan<byte> key, ClientIdMetadataDocumentDefects invalidEntryDefect)
+    {
+        List<string>? raw = JwkJsonReader.ExtractStringArrayProperty(document, key);
+        if(raw is null)
+        {
+            return ([], ClientIdMetadataDocumentDefects.None);
+        }
+
+        List<Uri> uris = [];
+        bool hasInvalidEntry = false;
+        foreach(string entry in raw)
+        {
+            if(Uri.TryCreate(entry, UriKind.Absolute, out Uri? uri) && !IsDangerousScheme(uri.Scheme))
+            {
+                uris.Add(uri);
+            }
+            else
+            {
+                hasInvalidEntry = true;
+            }
+        }
+
+        return (uris, hasInvalidEntry ? invalidEntryDefect : ClientIdMetadataDocumentDefects.None);
+    }
+
+
+    //draft-ietf-oauth-client-id-metadata-document-02 §8.6: the authorization server SHOULD only parse
+    //URLs with known and supported URI schemes, naming javascript: as the compromise vector. These
+    //script-bearing pseudo-schemes are rejected wherever a document URL could later be rendered or
+    //dereferenced.
+    private static bool IsDangerousScheme(string scheme) =>
+        scheme.Equals("javascript", StringComparison.OrdinalIgnoreCase)
+        || scheme.Equals("data", StringComparison.OrdinalIgnoreCase)
+        || scheme.Equals("vbscript", StringComparison.OrdinalIgnoreCase);
+
+
+    //Logout URIs carry no CIMD-058 defect gate in this wave's ledger scope; a malformed value is
+    //simply omitted from the extracted metadata.
+    private static Uri? ExtractAbsoluteUri(ReadOnlySpan<byte> document, ReadOnlySpan<byte> key)
+    {
+        string? raw = JwkJsonReader.ExtractStringValue(document, key);
+
+        return raw is not null && Uri.TryCreate(raw, UriKind.Absolute, out Uri? uri) ? uri : null;
+    }
+
+
+    private static bool ExtractBoolean(ReadOnlySpan<byte> document, ReadOnlySpan<byte> key) =>
+        JwkJsonReader.TryExtractBooleanValue(document, key, out bool value) && value;
+
+
+    private static List<GrantType> ExtractGrantTypes(ReadOnlySpan<byte> document)
+    {
+        List<string>? raw = JwkJsonReader.ExtractStringArrayProperty(document, "grant_types"u8);
+        if(raw is null)
+        {
+            return [];
+        }
+
+        List<GrantType> grantTypes = [];
+        foreach(string wireValue in raw)
+        {
+            if(GrantTypeNames.TryParse(wireValue, out GrantType grantType))
+            {
+                grantTypes.Add(grantType);
+            }
+        }
+
+        return grantTypes;
+    }
+
+
+    private static List<ResponseType> ExtractResponseTypes(ReadOnlySpan<byte> document)
+    {
+        List<string>? raw = JwkJsonReader.ExtractStringArrayProperty(document, "response_types"u8);
+        if(raw is null)
+        {
+            return [];
+        }
+
+        List<ResponseType> responseTypes = [];
+        foreach(string wireValue in raw)
+        {
+            if(ResponseTypeNames.TryParse(wireValue, out ResponseType responseType))
+            {
+                responseTypes.Add(responseType);
+            }
+        }
+
+        return responseTypes;
+    }
+}
diff --git a/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocumentResolverOptions.cs b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocumentResolverOptions.cs
new file mode 100644
index 00000000..1c51d2c6
--- /dev/null
+++ b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocumentResolverOptions.cs
@@ -0,0 +1,99 @@
+using Verifiable.Core;
+using Verifiable.OAuth.Client;
+
+namespace Verifiable.OAuth.Server.Pipeline;
+
+/// <summary>
+/// An application-supplied additional restriction on an otherwise-conformant Client ID
+/// Metadata Document, per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-4">
+/// draft-ietf-oauth-client-id-metadata-document-02 Section 4</see> — "Other specifications MAY
+/// place additional restrictions on the contents of the Client ID Metadata Document accepted
+/// by authorization servers implementing their specification. For example, requiring the
+/// <c>token_endpoint_auth_method</c> property be set to <c>private_key_jwt</c>". Returning
+/// <see langword="false"/> rejects the document with
+/// <see cref="ClientIdMetadataResolutionOutcome.InvalidDocument"/>.
+/// </summary>
+/// <param name="document">The library-parsed, already spec-conformant metadata.</param>
+/// <param name="clientMetadataUri">The Client Identifier URL the document was fetched from.</param>
+/// <param name="context">The per-request context.</param>
+/// <param name="cancellationToken">Cancellation token.</param>
+public delegate ValueTask<bool> AdditionalClientIdMetadataDocumentValidationDelegate(
+    ClientMetadata document,
+    Uri clientMetadataUri,
+    ExchangeContext context,
+    CancellationToken cancellationToken);
+
+
+/// <summary>
+/// Tunables for <see cref="ClientIdMetadataDocuments.BuildResolving"/>: byte caps, cache
+/// lifetime bounds, logo prefetch, the Section 4 additional-validation hook, and how Section 3
+/// SHOULD/NOT-RECOMMENDED-tier advisories are treated.
+/// </summary>
+public sealed record ClientIdMetadataDocumentResolverOptions
+{
+    /// <summary>
+    /// The maximum Client ID Metadata Document size, in bytes, the resolver reads before
+    /// treating the response as an error, per
+    /// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-8.7">
+    /// draft-ietf-oauth-client-id-metadata-document-02 Section 8.7</see> — "The recommended
+    /// maximum size to read is 5 kilobytes." Enforced both as a transport hint
+    /// (<see cref="Verifiable.Core.OutboundFetch.OutboundRequest.MaxResponseBytes"/>) and as an
+    /// authoritative post-read check, the repo's established double-application size-limit
+    /// pattern.
+    /// </summary>
+    public long MaximumDocumentBytes { get; init; } = 5120;
+
+    /// <summary>
+    /// The maximum <c>logo_uri</c> prefetch size, in bytes, per
+    /// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-8.8">
+    /// draft-ietf-oauth-client-id-metadata-document-02 Section 8.8</see>. The specification sets
+    /// no numeric bound for the logo; this default is a library-chosen ceiling against an
+    /// oversized or hostile logo response.
+    /// </summary>
+    public long MaximumLogoBytes { get; init; } = 51_200;
+
+    /// <summary>
+    /// The lower bound the resolver clamps a header-derived cache lifetime to, per
+    /// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-5.2">
+    /// draft-ietf-oauth-client-id-metadata-document-02 Section 5.2</see> — "MAY define its own
+    /// upper and/or lower bounds on an acceptable cache lifetime." <see langword="null"/> applies
+    /// no lower bound. Never overrides a <c>Cache-Control: no-store</c> response, which is never
+    /// cached regardless of this bound.
+    /// </summary>
+    public TimeSpan? MinimumCacheLifetime { get; init; }
+
+    /// <summary>
+    /// The upper bound the resolver clamps a header-derived cache lifetime to (Section 5.2, same
+    /// clause as <see cref="MinimumCacheLifetime"/>). <see langword="null"/> applies no upper
+    /// bound.
+    /// </summary>
+    public TimeSpan? MaximumCacheLifetime { get; init; }
+
+    /// <summary>
+    /// Whether the resolver prefetches the document's <c>logo_uri</c> through the same guarded
+    /// outbound-fetch policy and caches it alongside the document, per
+    /// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-8.8">
+    /// draft-ietf-oauth-client-id-metadata-document-02 Section 8.8</see>. Defaults to
+    /// <see langword="false"/> — logo prefetch is opt-in.
+    /// </summary>
+    public bool PrefetchLogo { get; init; }
+
+    /// <summary>
+    /// An application-supplied additional restriction on the document's contents (Section 4).
+    /// <see langword="null"/> applies no additional restriction beyond the library's own
+    /// conformance checks.
+    /// </summary>
+    public AdditionalClientIdMetadataDocumentValidationDelegate? AdditionalDocumentValidation { get; init; }
+
+    /// <summary>
+    /// Whether a Section 3 SHOULD-NOT/NOT-RECOMMENDED-tier advisory on the Client Identifier
+    /// URL — a query component
+    /// (<see cref="ClientIdentifierUrlValidationResult.HasQueryComponent"/>) or a root path
+    /// (<see cref="ClientIdentifierUrlValidationResult.IsRootPath"/>) — is treated as a
+    /// resolution failure rather than a tolerated advisory. Defaults to <see langword="false"/>:
+    /// both rules are SHOULD/NOT-RECOMMENDED-tier, not MUST-tier, so a candidate carrying either
+    /// is still resolved unless a deployment opts into the stricter posture.
+    /// </summary>
+    public bool TreatAdvisoriesAsErrors { get; init; }
+}
diff --git a/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocuments.cs b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocuments.cs
new file mode 100644
index 00000000..4f3c6208
--- /dev/null
+++ b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataDocuments.cs
@@ -0,0 +1,420 @@
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using System.Text;
+using Verifiable.Core;
+using Verifiable.Core.OutboundFetch;
+using Verifiable.JCose;
+using Verifiable.OAuth.Client;
+
+namespace Verifiable.OAuth.Server.Pipeline;
+
+/// <summary>
+/// Builds the library-default <see cref="ResolveClientMetadataDelegate"/>: the Client ID
+/// Metadata Document fetch-validate-cache pipeline per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-5">
+/// draft-ietf-oauth-client-id-metadata-document-02 Section 5</see>.
+/// </summary>
+/// <remarks>
+/// Mirrors the composition idiom of <see cref="Verifiable.WebFinger.WebFingerClient.BuildResolving"/>
+/// and <see cref="Verifiable.Core.Did.Methods.Web.WebDidResolver.BuildResolving"/>: the returned
+/// delegate closes over the injected transport and options, and every caller-visible failure is
+/// a typed <see cref="ClientIdMetadataResolutionOutcome"/> rather than a thrown exception —
+/// <see cref="OperationCanceledException"/> is the only exception that propagates.
+/// </remarks>
+[DebuggerDisplay("ClientIdMetadataDocuments")]
+public static class ClientIdMetadataDocuments
+{
+    private const string ContentTypeHeaderName = "Content-Type";
+    private const string JsonMediaType = "application/json";
+    private const string JsonStructuredSuffix = "+json";
+
+    /// <summary>
+    /// The span event name recorded on a non-fatal <c>logo_uri</c> prefetch failure
+    /// (draft-ietf-oauth-client-id-metadata-document-02 Section 8.8, CIMD-060).
+    /// </summary>
+    private const string LogoPrefetchFailedEventName = "oauth.cimd.resolve.logo_prefetch_failed";
+
+    /// <summary>
+    /// The span event name recorded when a private_key_jwt client's <c>jwks_uri</c> could not be
+    /// discovered (draft-ietf-oauth-client-id-metadata-document-02 Section 8.2, CIMD-048/050). The
+    /// resolution still succeeds; the token endpoint rejects the client for want of a key.
+    /// </summary>
+    private const string JwksDiscoveryFailedEventName = "oauth.cimd.resolve.jwks_discovery_failed";
+
+
+    /// <summary>
+    /// Builds a <see cref="ResolveClientMetadataDelegate"/> that fetches, validates, and caches
+    /// Client ID Metadata Documents through the guarded <see cref="OutboundFetch"/> chokepoint.
+    /// </summary>
+    /// <param name="transport">
+    /// The application-supplied single-hop transport the guarded fetch drives.
+    /// <see cref="Verifiable.OAuth"/> takes no <c>System.Net.Http</c> dependency, so the network
+    /// primitive is injected.
+    /// </param>
+    /// <param name="options">The resolver's byte caps, cache bounds, and validation hooks.</param>
+    /// <param name="timeProvider">
+    /// The clock the resolver's cache staleness decisions read. Never the wall clock in tests —
+    /// inject the pinned test clock.
+    /// </param>
+    /// <returns>A resolve delegate closing over an in-process cache keyed by client_id string.</returns>
+    public static ResolveClientMetadataDelegate BuildResolving(
+        OutboundTransportDelegate transport,
+        ClientIdMetadataDocumentResolverOptions options,
+        TimeProvider timeProvider)
+    {
+        ArgumentNullException.ThrowIfNull(transport);
+        ArgumentNullException.ThrowIfNull(options);
+        ArgumentNullException.ThrowIfNull(timeProvider);
+
+        ConcurrentDictionary<string, CacheEntry> cache = new(StringComparer.Ordinal);
+
+        return async (clientMetadataUri, context, cancellationToken) =>
+        {
+            ArgumentNullException.ThrowIfNull(clientMetadataUri);
+            ArgumentNullException.ThrowIfNull(context);
+
+            string cacheKey = clientMetadataUri.OriginalString;
+            DateTimeOffset now = timeProvider.GetUtcNow();
+
+            if(cache.TryGetValue(cacheKey, out CacheEntry? cached) && cached.FreshUntil > now)
+            {
+                return cached.Resolution;
+            }
+
+            //Step 1 (CIMD-001/002/004/005/006/007/011): Section 3 validation on the raw
+            //candidate string — System.Uri normalization would erase exactly the distinctions
+            //Section 3 depends on. A MUST-tier defect never contacts the network; a SHOULD/NOT-
+            //RECOMMENDED-tier advisory does the same only when the deployment opts in.
+            ClientIdentifierUrlValidationResult urlValidation =
+                ClientIdentifierUrl.Validate(clientMetadataUri.OriginalString);
+            bool hasAdvisory = urlValidation.HasQueryComponent || urlValidation.IsRootPath;
+            if(!urlValidation.IsValid || (options.TreatAdvisoriesAsErrors && hasAdvisory))
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = ClientIdMetadataResolutionOutcome.InvalidDocument,
+                    Defect = "The Client Identifier URL fails Section 3 validation."
+                };
+            }
+
+            OutboundRequest request = new()
+            {
+                Target = clientMetadataUri,
+                Method = "GET",
+                MaxResponseBytes = options.MaximumDocumentBytes
+            };
+
+            OutboundFetchResult fetch;
+            try
+            {
+                //Fully qualified: within Verifiable.* the bare name binds to the OutboundFetch
+                //namespace, not the static class of the same leaf name.
+                fetch = await Verifiable.Core.OutboundFetch.OutboundFetch.FetchAsync(
+                    request, context, transport, cancellationToken).ConfigureAwait(false);
+            }
+            catch(OperationCanceledException)
+            {
+                throw;
+            }
+            catch
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = ClientIdMetadataResolutionOutcome.FetchFailed,
+                    Defect = "Transport failure while fetching the Client ID Metadata Document."
+                };
+            }
+
+            //Step 2 (CIMD-001/034/054): a policy denial (special-use IP, disallowed scheme,
+            //host list) is distinct from an unfollowed or excessive redirect chain — both are
+            //non-fetched, but only the former is a policy denial for the caller's diagnostics.
+            if(!fetch.IsFetched || fetch.Response is null)
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = fetch.Outcome == OutboundFetchOutcome.DeniedByPolicy
+                        ? ClientIdMetadataResolutionOutcome.PolicyDenied
+                        : ClientIdMetadataResolutionOutcome.FetchFailed,
+                    Defect = fetch.DenyReason
+                };
+            }
+
+            OutboundResponse response = fetch.Response;
+
+            //Step 3 (CIMD-018/032/033): only exactly 200 is a successful fetch.
+            if(response.StatusCode != 200)
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = ClientIdMetadataResolutionOutcome.FetchFailed,
+                    Defect = $"The document fetch returned HTTP status {response.StatusCode}."
+                };
+            }
+
+            //Step 4 (CIMD-019): application/json or an application/<AS-defined>+json suffix.
+            response.TryGetHeader(ContentTypeHeaderName, out string? contentType);
+            if(!IsAcceptableContentType(contentType))
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = ClientIdMetadataResolutionOutcome.InvalidDocument,
+                    Defect = $"The document content type '{contentType}' is not application/json or a +json suffix."
+                };
+            }
+
+            //Step 5 (CIMD-059): the authoritative post-read size check — MaxResponseBytes above
+            //is only a transport hint a hostile or non-conforming transport may not honor.
+            if(response.Body.Length > options.MaximumDocumentBytes)
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = ClientIdMetadataResolutionOutcome.FetchFailed,
+                    Defect = "The document exceeds the configured maximum size."
+                };
+            }
+
+            //Step 6: library-owned span parsing (CIMD-013/021/022/023/058 conformance checks).
+            ClientIdMetadataDocumentReadResult parsed = ClientIdMetadataDocumentReader.Parse(response.Body.Span);
+            if(parsed.HasDefects || parsed.ClientId is null || parsed.Metadata is null)
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = ClientIdMetadataResolutionOutcome.InvalidDocument,
+                    DocumentClientId = parsed.ClientId,
+                    Defect = $"The document has conformance defects: {parsed.Defects}."
+                };
+            }
+
+            string documentClientId = parsed.ClientId;
+            ClientMetadata metadata = parsed.Metadata;
+
+            //Step 7 (CIMD-013/014/015/016): the document's client_id MUST ordinal-equal the URL
+            //used to fetch it — mirrors AuthorizationServerMetadataValidation.IsIssuerMatch's
+            //OriginalString-ordinal pattern.
+            if(!ClientIdentifierUrl.IsMatch(documentClientId, clientMetadataUri.OriginalString))
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = ClientIdMetadataResolutionOutcome.InvalidDocument,
+                    DocumentClientId = documentClientId,
+                    Defect = "The document's client_id does not match the URL it was fetched from."
+                };
+            }
+
+            //Step 8 (CIMD-020): an application-supplied additional restriction.
+            if(options.AdditionalDocumentValidation is not null
+                && !await options.AdditionalDocumentValidation(
+                    metadata, clientMetadataUri, context, cancellationToken).ConfigureAwait(false))
+            {
+                return new ClientIdMetadataResolution
+                {
+                    Outcome = ClientIdMetadataResolutionOutcome.InvalidDocument,
+                    DocumentClientId = documentClientId,
+                    Defect = "The document was rejected by an application-supplied additional restriction."
+                };
+            }
+
+            //Step 9a (CIMD-048/050, §8.2): a confidential client that advertises private_key_jwt with a
+            //jwks_uri instead of an inline jwks publishes its key material at that URL — the spec's own
+            //§8.2 example. Discover it through the SAME guarded fetch (CIMD-054 "URLs contained within a
+            //Client ID Metadata Document") and fold the JWKS inline so the token endpoint's client
+            //authentication has "the corresponding key discovered from the client's metadata document."
+            //A discovery failure is fail-closed but non-fatal to the resolution: the authorization front
+            //channel proceeds, and the token endpoint rejects the client for want of a key.
+            if(metadata.TokenEndpointAuthMethod == ClientAuthenticationMethod.PrivateKeyJwt
+                && metadata.Jwks is null
+                && metadata.JwksUri is not null)
+            {
+                string? discoveredJwks = await ResolveJwksUriAsync(
+                    metadata.JwksUri, options, context, transport, cancellationToken).ConfigureAwait(false);
+                if(discoveredJwks is not null)
+                {
+                    metadata = metadata with { Jwks = discoveredJwks };
+                }
+            }
+
+            //Step 9b (CIMD-060): logo prefetch through the same guarded policy; SHOULD-tier —
+            //failure never fails the resolution.
+            ReadOnlyMemory<byte>? logo = null;
+            string? logoContentType = null;
+            if(options.PrefetchLogo && metadata.LogoUri is not null)
+            {
+                (logo, logoContentType) = await PrefetchLogoAsync(
+                    metadata.LogoUri, options, context, transport, cancellationToken).ConfigureAwait(false);
+            }
+
+            ClientIdMetadataResolution resolution = new()
+            {
+                Outcome = ClientIdMetadataResolutionOutcome.Resolved,
+                Document = metadata,
+                DocumentClientId = documentClientId,
+                PrefetchedLogo = logo,
+                PrefetchedLogoContentType = logoContentType
+            };
+
+            //Step 10 (CIMD-030/036/037/038/039/040/061): only a Resolved outcome is cached, and
+            //only when the response is storable and not must-revalidate — a Cache-Control: no-store
+            //response is never cached, and a no-cache response is never served fresh (the options
+            //lower bound must not manufacture freshness the headers denied, per RFC 9111 §5.2.2.4).
+            HttpCacheFreshness freshness = HttpCacheFreshness.Compute(response);
+            TimeSpan lifetime = freshness.IsStorable && !freshness.MustRevalidate
+                ? ClampLifetime(freshness.FreshnessLifetime, options)
+                : TimeSpan.Zero;
+
+            if(lifetime > TimeSpan.Zero)
+            {
+                cache[cacheKey] = new CacheEntry(resolution, now + lifetime);
+            }
+            else
+            {
+                cache.TryRemove(cacheKey, out _);
+            }
+
+            return resolution;
+        };
+    }
+
+
+    //Fetches logo_uri through the same guarded policy path (CIMD-054 "URLs contained within"
+    //applies to it exactly as to the document URL itself); every failure mode collapses to
+    //(null, null) rather than a thrown exception, since a prefetch failure is SHOULD-tier and
+    //must never fail the surrounding document resolution.
+    private static async ValueTask<(ReadOnlyMemory<byte>? Logo, string? ContentType)> PrefetchLogoAsync(
+        Uri logoUri,
+        ClientIdMetadataDocumentResolverOptions options,
+        ExchangeContext context,
+        OutboundTransportDelegate transport,
+        CancellationToken cancellationToken)
+    {
+        OutboundRequest request = new()
+        {
+            Target = logoUri,
+            Method = "GET",
+            MaxResponseBytes = options.MaximumLogoBytes
+        };
+
+        OutboundFetchResult fetch;
+        try
+        {
+            fetch = await Verifiable.Core.OutboundFetch.OutboundFetch.FetchAsync(
+                request, context, transport, cancellationToken).ConfigureAwait(false);
+        }
+        catch(OperationCanceledException)
+        {
+            throw;
+        }
+        catch
+        {
+            Activity.Current?.AddEvent(new ActivityEvent(LogoPrefetchFailedEventName));
+
+            return (null, null);
+        }
+
+        if(!fetch.IsFetched || fetch.Response is null || fetch.Response.StatusCode != 200
+            || fetch.Response.Body.Length > options.MaximumLogoBytes)
+        {
+            Activity.Current?.AddEvent(new ActivityEvent(LogoPrefetchFailedEventName));
+
+            return (null, null);
+        }
+
+        fetch.Response.TryGetHeader(ContentTypeHeaderName, out string? contentType);
+
+        return (fetch.Response.Body.Memory, contentType);
+    }
+
+
+    //Discovers a private_key_jwt client's JWKS from its jwks_uri through the same guarded policy path
+    //(CIMD-054 applies to URLs contained within the document exactly as to the document URL); returns
+    //the JWKS JSON text on a 200 JSON response carrying a "keys" member, or null on any failure. Every
+    //failure mode collapses to null rather than a thrown exception — a discovery failure is fail-closed
+    //but non-fatal to the surrounding resolution.
+    private static async ValueTask<string?> ResolveJwksUriAsync(
+        Uri jwksUri,
+        ClientIdMetadataDocumentResolverOptions options,
+        ExchangeContext context,
+        OutboundTransportDelegate transport,
+        CancellationToken cancellationToken)
+    {
+        OutboundRequest request = new()
+        {
+            Target = jwksUri,
+            Method = "GET",
+            MaxResponseBytes = options.MaximumDocumentBytes
+        };
+
+        OutboundFetchResult fetch;
+        try
+        {
+            fetch = await Verifiable.Core.OutboundFetch.OutboundFetch.FetchAsync(
+                request, context, transport, cancellationToken).ConfigureAwait(false);
+        }
+        catch(OperationCanceledException)
+        {
+            throw;
+        }
+        catch
+        {
+            Activity.Current?.AddEvent(new ActivityEvent(JwksDiscoveryFailedEventName));
+
+            return null;
+        }
+
+        if(!fetch.IsFetched || fetch.Response is null || fetch.Response.StatusCode != 200
+            || fetch.Response.Body.Length > options.MaximumDocumentBytes)
+        {
+            Activity.Current?.AddEvent(new ActivityEvent(JwksDiscoveryFailedEventName));
+
+            return null;
+        }
+
+        OutboundResponse jwksResponse = fetch.Response;
+        jwksResponse.TryGetHeader(ContentTypeHeaderName, out string? contentType);
+        if(!IsAcceptableContentType(contentType)
+            || JwkJsonReader.IndexOfKey(jwksResponse.Body.Span, WellKnownJwkMemberNames.KeysUtf8) < 0)
+        {
+            Activity.Current?.AddEvent(new ActivityEvent(JwksDiscoveryFailedEventName));
+
+            return null;
+        }
+
+        return Encoding.UTF8.GetString(jwksResponse.Body.Span);
+    }
+
+
+    private static TimeSpan ClampLifetime(TimeSpan lifetime, ClientIdMetadataDocumentResolverOptions options)
+    {
+        if(options.MinimumCacheLifetime is TimeSpan minimum && lifetime < minimum)
+        {
+            lifetime = minimum;
+        }
+
+        if(options.MaximumCacheLifetime is TimeSpan maximum && lifetime > maximum)
+        {
+            lifetime = maximum;
+        }
+
+        return lifetime;
+    }
+
+
+    //application/json exactly, or any application/<AS-defined>+json structured suffix
+    //(CIMD-019); parameters (e.g. ;charset=utf-8) are stripped before comparison.
+    private static bool IsAcceptableContentType(string? contentType)
+    {
+        if(string.IsNullOrWhiteSpace(contentType))
+        {
+            return false;
+        }
+
+        ReadOnlySpan<char> value = contentType.AsSpan().Trim();
+        int parameterDelimiter = value.IndexOf(';');
+        ReadOnlySpan<char> mediaType = (parameterDelimiter >= 0 ? value[..parameterDelimiter] : value).Trim();
+
+        return mediaType.Equals(JsonMediaType, StringComparison.OrdinalIgnoreCase)
+            || mediaType.EndsWith(JsonStructuredSuffix, StringComparison.OrdinalIgnoreCase);
+    }
+
+
+    private sealed record CacheEntry(ClientIdMetadataResolution Resolution, DateTimeOffset FreshUntil);
+}
diff --git a/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataMaterialization.cs b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataMaterialization.cs
new file mode 100644
index 00000000..7f261452
--- /dev/null
+++ b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataMaterialization.cs
@@ -0,0 +1,154 @@
+using System.Collections.Frozen;
+using System.Diagnostics;
+using Verifiable.Core;
+using Verifiable.OAuth.Client;
+
+namespace Verifiable.OAuth.Server.Pipeline;
+
+/// <summary>
+/// The library-owned <see cref="MaterializeRegistrationDelegate"/> for Client ID Metadata
+/// Document (CIMD) clients: the dispatch-stage hook that resolves a matched client's document
+/// through <see cref="AuthorizationServerIntegration.ResolveClientMetadataAsync"/> and overlays
+/// the client-data-dependent fields onto the effective registration, per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-5">
+/// draft-ietf-oauth-client-id-metadata-document-02 Section 5</see> and
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-4">
+/// Section 4</see>.
+/// </summary>
+[DebuggerDisplay("ClientIdMetadataMaterialization")]
+public static class ClientIdMetadataMaterialization
+{
+    /// <summary>The span event name for a resolver-side policy denial.</summary>
+    public const string PolicyDeniedEventName = "oauth.cimd.materialize.policy_denied";
+
+    /// <summary>The span event name for a resolver-side fetch failure.</summary>
+    public const string FetchFailedEventName = "oauth.cimd.materialize.fetch_failed";
+
+    /// <summary>The span event name for a resolver-side invalid-document rejection.</summary>
+    public const string InvalidDocumentEventName = "oauth.cimd.materialize.invalid_document";
+
+    /// <summary>The span event name for a wire <c>client_id</c> that does not match the registered client.</summary>
+    public const string ClientIdMismatchEventName = "oauth.cimd.materialize.client_id_mismatch";
+
+    /// <summary>
+    /// Capabilities that identify a request as belonging to the token endpoint family
+    /// unambiguously by capability alone — <see cref="WellKnownCapabilityIdentifiers.OAuthAuthorizationCode"/>
+    /// is deliberately excluded here because the authorization-code grant shares that single
+    /// capability across both the front-channel authorize/PAR endpoints and the token/refresh
+    /// endpoints; <see cref="IsTokenEndpointRequest"/> distinguishes those by the wire shape
+    /// instead (the presence of <c>grant_type</c>).
+    /// </summary>
+    private static readonly FrozenSet<CapabilityIdentifier> UnambiguousTokenEndpointCapabilities = new[]
+    {
+        WellKnownCapabilityIdentifiers.OAuthClientCredentials,
+        WellKnownCapabilityIdentifiers.OAuthTokenExchange,
+        WellKnownCapabilityIdentifiers.OAuthJwtBearer,
+        WellKnownCapabilityIdentifiers.Oid4VciPreAuthorizedCodeGrant,
+        WellKnownCapabilityIdentifiers.OAuthTokenRevocation,
+        WellKnownCapabilityIdentifiers.OAuthTokenIntrospection
+    }.ToFrozenSet();
+
+
+    /// <summary>
+    /// Builds the CIMD <see cref="MaterializeRegistrationDelegate"/>. Assign the result to
+    /// <see cref="ServerIntegration.MaterializeRegistrationAsync"/> to activate CIMD
+    /// materialization for every registered protocol family sharing the host.
+    /// </summary>
+    public static MaterializeRegistrationDelegate Build() =>
+        async (registration, context, cancellationToken) =>
+        {
+            ArgumentNullException.ThrowIfNull(registration);
+            ArgumentNullException.ThrowIfNull(context);
+
+            if(registration is not ClientRecord record || record.ClientMetadataUri is null)
+            {
+                return Passthrough(registration);
+            }
+
+            if(!record.IsCapabilityAllowed(WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument))
+            {
+                return Passthrough(registration);
+            }
+
+            AuthorizationServerIntegration oauth = context.Server!.OAuth();
+            if(oauth.ResolveClientMetadataAsync is null)
+            {
+                return Passthrough(registration);
+            }
+
+            RequestFields? fields = context.IncomingRequest?.Fields;
+            if(fields is null || !fields.TryGetValue(OAuthRequestParameterNames.ClientId, out string? wireClientId))
+            {
+                return Passthrough(registration);
+            }
+
+            if(!ClientIdentifierUrl.IsMatch(wireClientId, record.ClientId))
+            {
+                Activity.Current?.AddEvent(new ActivityEvent(ClientIdMismatchEventName));
+
+                return Fail(context, fields);
+            }
+
+            ClientIdMetadataResolution resolution = await oauth.ResolveClientMetadataAsync(
+                record.ClientMetadataUri, context, cancellationToken).ConfigureAwait(false);
+
+            if(!resolution.IsResolved || resolution.Document is null)
+            {
+                Activity.Current?.AddEvent(new ActivityEvent(ResolutionFailureEventName(resolution.Outcome)));
+
+                return Fail(context, fields);
+            }
+
+            ClientMetadata document = resolution.Document;
+            ClientRecord materialized = record with
+            {
+                IsClientMetadataMaterialized = true,
+                AllowedRedirectUris = [.. document.RedirectUris],
+                TokenEndpointAuthMethod = document.TokenEndpointAuthMethod,
+                ClientJwks = document.Jwks,
+                ClientJwksUri = document.JwksUri,
+                ClientName = document.ClientName,
+                ClientUri = document.ClientUri,
+                LogoUri = document.LogoUri,
+                SoftwareStatement = document.SoftwareStatement
+            };
+
+            return new RegistrationMaterialization { Registration = materialized };
+        };
+
+
+    private static RegistrationMaterialization Passthrough(IRegistrationRecord registration) =>
+        new() { Registration = registration };
+
+
+    //CIMD-035 abort mapping: a direct 400 (no redirect is attempted before materialization has
+    //even established a usable registration) for the general case, and 401 invalid_client for
+    //the token endpoint family, mirroring how AuthCodeEndpoints answers client-authentication
+    //failures at the token endpoint. Neither the client_id-mismatch reason nor the resolver's
+    //internal Defect ever reaches the wire body.
+    private static RegistrationMaterialization Fail(ExchangeContext context, RequestFields fields) =>
+        new()
+        {
+            Failure = IsTokenEndpointRequest(context, fields)
+                ? ServerHttpResponse.Unauthorized(OAuthErrors.InvalidClient, "Client authentication failed.")
+                : ServerHttpResponse.BadRequest(OAuthErrors.InvalidRequest, "The request could not be processed.")
+        };
+
+
+    //A request is token-endpoint-shaped when it carries grant_type (every token/refresh/
+    //client_credentials/token_exchange/jwt_bearer/pre-authorized_code candidate requires it to
+    //match), or when the matched capability is one that is exclusively a token/management
+    //endpoint (see UnambiguousTokenEndpointCapabilities).
+    private static bool IsTokenEndpointRequest(ExchangeContext context, RequestFields fields) =>
+        fields.ContainsKey(OAuthRequestParameterNames.GrantType)
+            || (context.Capability is CapabilityIdentifier capability
+                && UnambiguousTokenEndpointCapabilities.Contains(capability));
+
+
+    private static string ResolutionFailureEventName(ClientIdMetadataResolutionOutcome outcome) => outcome switch
+    {
+        ClientIdMetadataResolutionOutcome.PolicyDenied => PolicyDeniedEventName,
+        ClientIdMetadataResolutionOutcome.FetchFailed => FetchFailedEventName,
+        _ => InvalidDocumentEventName
+    };
+}
diff --git a/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataResolution.cs b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataResolution.cs
new file mode 100644
index 00000000..fb1b0612
--- /dev/null
+++ b/src/Verifiable.OAuth/Server/Pipeline/ClientIdMetadataResolution.cs
@@ -0,0 +1,90 @@
+using Verifiable.OAuth.Client;
+
+namespace Verifiable.OAuth.Server.Pipeline;
+
+/// <summary>
+/// Why a <see cref="ResolveClientMetadataDelegate"/> call ended.
+/// </summary>
+public enum ClientIdMetadataResolutionOutcome
+{
+    /// <summary>
+    /// The document was fetched, parsed, and validated; <see cref="ClientIdMetadataResolution.Document"/>
+    /// is set.
+    /// </summary>
+    Resolved = 0,
+
+    /// <summary>
+    /// The outbound-fetch policy denied the target (or a redirect hop) before any terminal
+    /// response was obtained — an SSRF-relevant refusal, per
+    /// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-8.6">
+    /// draft-ietf-oauth-client-id-metadata-document-02 Section 8.6</see>.
+    /// </summary>
+    PolicyDenied,
+
+    /// <summary>
+    /// The document could not be fetched: a non-200 status, an unfollowed or excessive
+    /// redirect chain, an oversized response, or a transport failure.
+    /// </summary>
+    FetchFailed,
+
+    /// <summary>
+    /// The fetched response was not a usable Client ID Metadata Document: an unacceptable
+    /// content type, a parse or conformance defect, a <c>client_id</c> mismatch, or rejection
+    /// by <see cref="ClientIdMetadataDocumentResolverOptions.AdditionalDocumentValidation"/>.
+    /// </summary>
+    InvalidDocument
+}
+
+
+/// <summary>
+/// The result of a <see cref="ResolveClientMetadataDelegate"/> call.
+/// </summary>
+/// <remarks>
+/// Only a <see cref="ClientIdMetadataResolutionOutcome.Resolved"/> result carries
+/// <see cref="Document"/>; every other outcome leaves it <see langword="null"/> and
+/// <see cref="Defect"/> carries internal diagnostics for logs and traces — never surface it in
+/// a wire response, since the document is served from a URL the client itself controls.
+/// </remarks>
+public sealed record ClientIdMetadataResolution
+{
+    /// <summary>Why this resolution ended.</summary>
+    public required ClientIdMetadataResolutionOutcome Outcome { get; init; }
+
+    /// <summary>
+    /// The parsed, conformant client metadata when <see cref="Outcome"/> is
+    /// <see cref="ClientIdMetadataResolutionOutcome.Resolved"/>; otherwise <see langword="null"/>.
+    /// </summary>
+    public ClientMetadata? Document { get; init; }
+
+    /// <summary>
+    /// The document's <c>client_id</c> property value, when the document was parsed far enough
+    /// to extract one. Set even for some <see cref="ClientIdMetadataResolutionOutcome.InvalidDocument"/>
+    /// results (for example a <c>client_id</c> mismatch) so a caller can log which identity the
+    /// document claimed.
+    /// </summary>
+    public string? DocumentClientId { get; init; }
+
+    /// <summary>
+    /// Internal diagnostic detail for a non-<see cref="ClientIdMetadataResolutionOutcome.Resolved"/>
+    /// outcome. For logs and traces only — never surface this text in a wire response.
+    /// </summary>
+    public string? Defect { get; init; }
+
+    /// <summary>
+    /// The prefetched <c>logo_uri</c> bytes when
+    /// <see cref="ClientIdMetadataDocumentResolverOptions.PrefetchLogo"/> is enabled, the
+    /// document carries a <c>logo_uri</c>, and the prefetch succeeded. <see langword="null"/>
+    /// when prefetch is disabled, the document carries no <c>logo_uri</c>, or the prefetch
+    /// failed — a failed prefetch is non-fatal to <see cref="Outcome"/> per
+    /// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-8.8">
+    /// draft-ietf-oauth-client-id-metadata-document-02 Section 8.8</see>.
+    /// </summary>
+    public ReadOnlyMemory<byte>? PrefetchedLogo { get; init; }
+
+    /// <summary>The <c>Content-Type</c> the logo host reported, when <see cref="PrefetchedLogo"/> is set.</summary>
+    public string? PrefetchedLogoContentType { get; init; }
+
+
+    /// <summary>Whether <see cref="Outcome"/> is <see cref="ClientIdMetadataResolutionOutcome.Resolved"/>.</summary>
+    public bool IsResolved => Outcome == ClientIdMetadataResolutionOutcome.Resolved;
+}
diff --git a/src/Verifiable.OAuth/Server/Pipeline/DefaultIssuerResolver.cs b/src/Verifiable.OAuth/Server/Pipeline/DefaultIssuerResolver.cs
index 6582bdfe..3e1a5c8d 100644
--- a/src/Verifiable.OAuth/Server/Pipeline/DefaultIssuerResolver.cs
+++ b/src/Verifiable.OAuth/Server/Pipeline/DefaultIssuerResolver.cs
@@ -58,7 +58,10 @@ internal static class DefaultIssuerResolver
     /// <returns>The authoritative issuer URI for this request.</returns>
     /// <exception cref="InvalidOperationException">
     /// Thrown when neither <see cref="ClientRecord.IssuerUri"/> nor
-    /// <see cref="ExchangeContextServerExtensions.Issuer"/> is set.
+    /// <see cref="ExchangeContextServerExtensions.Issuer"/> is set, or when the
+    /// resolved value fails the RFC 9207 §2 / RFC 8414 §2 issuer-identifier shape
+    /// (<see cref="IssuerIdentifierValidation.IsValidIssuerShape"/>) — an https URL
+    /// with no query or fragment component.
     /// </exception>
     public static ValueTask<Uri> ResolveAsync(
         ClientRecord registration,
@@ -70,13 +73,13 @@ public static ValueTask<Uri> ResolveAsync(
 
         if(registration.IssuerUri is not null)
         {
-            return ValueTask.FromResult(registration.IssuerUri);
+            return ValueTask.FromResult(ValidatedIssuerShape(registration.IssuerUri, registration));
         }
 
         Uri? contextIssuer = context.Issuer;
         if(contextIssuer is not null)
         {
-            return ValueTask.FromResult(contextIssuer);
+            return ValueTask.FromResult(ValidatedIssuerShape(contextIssuer, registration));
         }
 
         throw new InvalidOperationException(
@@ -86,4 +89,26 @@ public static ValueTask<Uri> ResolveAsync(
             "have the ASP.NET skin populate the issuer on every request, or supply a custom " +
             $"{nameof(ResolveIssuerDelegate)} via {nameof(EndpointServer)}.{nameof(EndpointServer.Integration)}.{nameof(AuthorizationServerIntegration.ResolveIssuerAsync)}.");
     }
+
+
+    /// <summary>
+    /// Enforces <see cref="IssuerIdentifierValidation.IsValidIssuerShape"/> on a
+    /// candidate issuer before it becomes the value this resolver returns. Applied
+    /// to both the <see cref="ClientRecord.IssuerUri"/> and
+    /// <see cref="ExchangeContextServerExtensions.Issuer"/> sources so every caller
+    /// of this default resolver — discovery metadata and the RFC 9207 <c>iss</c>
+    /// redirect parameter alike — emits a conformant issuer identifier.
+    /// </summary>
+    private static Uri ValidatedIssuerShape(Uri issuer, ClientRecord registration)
+    {
+        if(!IssuerIdentifierValidation.IsValidIssuerShape(issuer))
+        {
+            throw new InvalidOperationException(
+                $"Issuer identifier '{issuer}' configured for registration '{registration.ClientId}' does " +
+                "not satisfy RFC 9207 §2 / RFC 8414 §2: it MUST be a URL using the https scheme with no " +
+                "query or fragment component.");
+        }
+
+        return issuer;
+    }
 }
diff --git a/src/Verifiable.OAuth/Server/PrivateKeyJwtClientAuthentication.cs b/src/Verifiable.OAuth/Server/PrivateKeyJwtClientAuthentication.cs
new file mode 100644
index 00000000..5060608a
--- /dev/null
+++ b/src/Verifiable.OAuth/Server/PrivateKeyJwtClientAuthentication.cs
@@ -0,0 +1,772 @@
+using System.Buffers;
+using System.Diagnostics;
+using System.Text;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.OAuth.Dpop;
+using Verifiable.OAuth.Federation;
+using Verifiable.OAuth.JwtBearer;
+using Verifiable.OAuth.Server.Pipeline;
+using Verifiable.OAuth.WellKnown;
+using Verifiable.Server;
+
+namespace Verifiable.OAuth.Server;
+
+/// <summary>
+/// Consults a <c>jti</c> replay store for a client-authentication assertion, governed by the
+/// same <see cref="JtiReplayPolicy"/>/<see cref="JtiReplayGuard"/> axis the JAR and DPoP paths
+/// use. Its parameter shape matches <see cref="JtiReplayGuard.ConsultAsync"/> exactly, so a
+/// caller wires that method directly as this delegate.
+/// </summary>
+/// <param name="server">The authorization server (its integration store and clock).</param>
+/// <param name="context">The exchange context carrying the resolved policy and tenant.</param>
+/// <param name="tenantId">The tenant the <c>jti</c> is scoped to.</param>
+/// <param name="issuer">The assertion's <c>iss</c> (the composite-key prefix).</param>
+/// <param name="jti">The presented <c>jti</c> value.</param>
+/// <param name="expiresAt">When the recorded entry should expire.</param>
+/// <param name="cancellationToken">Cancellation token.</param>
+public delegate ValueTask<JtiReplayOutcome> CheckClientAssertionJtiReplayDelegate(
+    EndpointServer server,
+    ExchangeContext context,
+    TenantId tenantId,
+    string issuer,
+    string jti,
+    DateTimeOffset expiresAt,
+    CancellationToken cancellationToken);
+
+
+/// <summary>
+/// Outcome of validating a <c>private_key_jwt</c> client-authentication assertion (RFC 7523 §2.2/§3.2)
+/// presented to the token endpoint. Carries the authenticated <c>client_id</c> and <c>jti</c> on
+/// success, or a typed failure reason on rejection.
+/// </summary>
+/// <remarks>
+/// Same sealed-record-with-nullable-fields shape as
+/// <see cref="FederationClientAuthenticationResult"/>; the token endpoint maps a
+/// rejection onto an HTTP 401 <c>invalid_client</c> response (RFC 7523 §3.2).
+/// </remarks>
+[DebuggerDisplay("PrivateKeyJwtClientAuthenticationResult Valid={IsValid} Reason={FailureReason,nq}")]
+public sealed record PrivateKeyJwtClientAuthenticationResult
+{
+    /// <summary>
+    /// The authenticated <c>client_id</c> (the assertion's <c>iss</c> == <c>sub</c> ==
+    /// <c>client_id</c>); <see langword="null"/> on failure.
+    /// </summary>
+    public string? ClientId { get; init; }
+
+    /// <summary>
+    /// The assertion's <c>jti</c>, surfaced so the caller can apply replay defense;
+    /// <see langword="null"/> on failure.
+    /// </summary>
+    public string? Jti { get; init; }
+
+    /// <summary>The assertion's expiry; <see langword="null"/> on failure.</summary>
+    public DateTimeOffset? Expiration { get; init; }
+
+    /// <summary>The reason validation failed; <see langword="null"/> on success.</summary>
+    public string? FailureReason { get; init; }
+
+    /// <summary><see langword="true"/> when the client assertion validated.</summary>
+    public bool IsValid => FailureReason is null;
+
+
+    /// <summary>Builds a success result.</summary>
+    public static PrivateKeyJwtClientAuthenticationResult Authenticated(
+        string clientId, string jti, DateTimeOffset expiration)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clientId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(jti);
+
+        return new PrivateKeyJwtClientAuthenticationResult
+        {
+            ClientId = clientId,
+            Jti = jti,
+            Expiration = expiration
+        };
+    }
+
+
+    /// <summary>Builds a failure result.</summary>
+    public static PrivateKeyJwtClientAuthenticationResult Rejected(string reason)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(reason);
+
+        return new PrivateKeyJwtClientAuthenticationResult { FailureReason = reason };
+    }
+}
+
+
+/// <summary>
+/// Validates the RFC 7523 §3/§3.2 <c>private_key_jwt</c> client-authentication claim rules — the
+/// method draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-047/048/049/050) requires an
+/// authorization server to enforce when a client declares <c>token_endpoint_auth_method</c> as
+/// <c>private_key_jwt</c>.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <see cref="Validate"/> is crypto-agnostic: it operates on the already signature-verified,
+/// decoded <see cref="JwtPayload"/>, mirroring <see cref="FederationClientAuthentication.Validate"/>'s
+/// shape. <see cref="BuildValidator(System.Collections.Generic.IReadOnlyCollection{string}?,CheckClientAssertionJtiReplayDelegate?)"/>
+/// and its explicit-<see cref="VerificationDelegate"/> overload compose the signature step around
+/// it: they parse the compact <c>client_assertion</c>, resolve the verification key from the
+/// registration's <see cref="ClientRecord.ClientJwks"/> via <see cref="JwkJsonReader"/> and
+/// <see cref="CryptoFormatConversions.DefaultJwkToAlgorithmConverter"/> (through
+/// <see cref="DpopJwkUtilities.PublicKeyFromJwk"/>), verify with <see cref="Jws.VerifyAsync(string,DecodeDelegate,MemoryPool{byte},PublicKeyMemory,CancellationToken)"/>,
+/// and only then apply <see cref="Validate"/>.
+/// </para>
+/// <para>
+/// The claim rules enforced by <see cref="Validate"/>:
+/// </para>
+/// <list type="bullet">
+///   <item><description>
+///     <c>iss</c> and <c>sub</c> both equal <c>client_id</c> — RFC 7523 §3 items 1 and 2.B: "For
+///     client authentication, the subject MUST be the client_id of the OAuth client."
+///   </description></item>
+///   <item><description>
+///     <c>aud</c> (string or array) contains only values the caller accepts as this authorization
+///     server's identity — its issuer identifier or token endpoint URL (RFC 7523 §3 item 3) — and
+///     at least one is present; an array carrying any other value is rejected outright, the same
+///     anti-audience-injection posture <see cref="FederationClientAuthentication"/> and
+///     <see cref="Rfc7523AssertionValidation"/> apply.
+///   </description></item>
+///   <item><description><c>jti</c> is present, surfaced for the caller's replay defense.</description></item>
+///   <item><description>
+///     <c>exp</c> is present and the assertion is neither expired nor internally inconsistent with
+///     <c>iat</c>/<c>nbf</c> (RFC 7523 §3 items 4–5); a present <c>iat</c> must not sit in the
+///     future beyond the clock-skew tolerance ("iat sanity").
+///   </description></item>
+/// </list>
+/// </remarks>
+[DebuggerDisplay("PrivateKeyJwtClientAuthentication")]
+public static class PrivateKeyJwtClientAuthentication
+{
+    /// <summary>
+    /// Validates a decoded (signature-verified) <c>private_key_jwt</c> client-authentication
+    /// assertion against the RFC 7523 §3/§3.2 claim rules.
+    /// </summary>
+    /// <param name="payload">The decoded, signature-verified assertion payload.</param>
+    /// <param name="clientId">
+    /// The client identifier the assertion authenticates — the value its <c>iss</c> and <c>sub</c>
+    /// must both equal (RFC 7523 §3 items 1, 2.B).
+    /// </param>
+    /// <param name="acceptedAudiences">
+    /// The values <c>aud</c> may name — this authorization server's issuer identifier and/or token
+    /// endpoint URL (RFC 7523 §3 item 3: "The token endpoint URL of the authorization server MAY be
+    /// used as a value for an aud element").
+    /// </param>
+    /// <param name="now">The instant expiry / not-before are evaluated against.</param>
+    /// <param name="clockSkew">Tolerance applied to the <c>exp</c>, <c>nbf</c>, and <c>iat</c> comparisons.</param>
+    /// <returns>
+    /// A successful result carrying the authenticated <c>client_id</c>, <c>jti</c>, and expiry, or a
+    /// failed result whose <see cref="PrivateKeyJwtClientAuthenticationResult.FailureReason"/> the
+    /// caller maps onto an HTTP 401 <c>invalid_client</c> response (RFC 7523 §3.2).
+    /// </returns>
+    public static PrivateKeyJwtClientAuthenticationResult Validate(
+        JwtPayload payload,
+        string clientId,
+        IReadOnlyCollection<string> acceptedAudiences,
+        DateTimeOffset now,
+        TimeSpan clockSkew)
+    {
+        ArgumentNullException.ThrowIfNull(payload);
+        ArgumentException.ThrowIfNullOrWhiteSpace(clientId);
+        ArgumentNullException.ThrowIfNull(acceptedAudiences);
+
+        //RFC 7523 §3 item 1 / item 2.B: iss and sub both identify the OAuth client for the
+        //private_key_jwt shape — the assertion's issuer and subject are the client_id.
+        if(!TryReadString(payload, WellKnownJwtClaimNames.Iss, out string? iss)
+            || !string.Equals(iss, clientId, StringComparison.Ordinal))
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion iss must equal the client_id (RFC 7523 §3 item 1).");
+        }
+
+        if(!TryReadString(payload, WellKnownJwtClaimNames.Sub, out string? sub)
+            || !string.Equals(sub, clientId, StringComparison.Ordinal))
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion sub must equal the client_id (RFC 7523 §3 item 2.B).");
+        }
+
+        //§3 item 3: aud MUST name this AS; every element present must be an accepted AS identity
+        //and at least one must be present. Rejecting any non-AS element (rather than accepting on a
+        //single match) prevents an assertion crafted to also be valid at another audience.
+        if(!payload.TryGetValue(WellKnownJwtClaimNames.Aud, out object? audienceRaw))
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion is missing the aud claim (RFC 7523 §3 item 3).");
+        }
+
+        if(!IsAudienceAccepted(audienceRaw, acceptedAudiences))
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion aud must name only this authorization server's issuer identifier "
+                + "or token endpoint (RFC 7523 §3 item 3).");
+        }
+
+        //jti presence: draft-ietf-oauth-client-id-metadata-document-02's confidential-client model
+        //needs a replayable identifier for every assertion, stricter than RFC 7523 §3 item 7's MAY.
+        if(!TryReadString(payload, WellKnownJwtClaimNames.Jti, out string? jti))
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion is missing the jti claim.");
+        }
+
+        if(!TryReadEpochSeconds(payload, WellKnownJwtClaimNames.Exp, out bool expPresent, out DateTimeOffset exp)
+            || !expPresent)
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion is missing or has a malformed exp claim (RFC 7523 §3 item 4).");
+        }
+
+        if(!TryReadEpochSeconds(payload, WellKnownJwtClaimNames.Iat, out bool iatPresent, out DateTimeOffset iat))
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion iat claim is malformed.");
+        }
+
+        if(iatPresent && exp <= iat)
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion exp is at or before iat (non-positive lifetime).");
+        }
+
+        //iat sanity: an assertion claiming to have been issued in the future is nonsensical
+        //regardless of its exp.
+        if(iatPresent && iat > now + clockSkew)
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion iat is in the future beyond the skew tolerance.");
+        }
+
+        if(!TryReadEpochSeconds(payload, WellKnownJwtClaimNames.Nbf, out bool nbfPresent, out DateTimeOffset nbf))
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion nbf claim is malformed.");
+        }
+
+        if(nbfPresent)
+        {
+            if(exp <= nbf)
+            {
+                return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                    "The client assertion exp is at or before nbf (the validity window never opens).");
+            }
+
+            if(nbf > now + clockSkew)
+            {
+                return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                    "The client assertion is not yet valid (nbf is in the future beyond the skew tolerance).");
+            }
+        }
+
+        if(exp + clockSkew <= now)
+        {
+            return PrivateKeyJwtClientAuthenticationResult.Rejected(
+                "The client assertion has expired (RFC 7523 §3 item 4).");
+        }
+
+        return PrivateKeyJwtClientAuthenticationResult.Authenticated(clientId, jti!, exp);
+    }
+
+
+    /// <summary>
+    /// Builds a <see cref="ValidateClientCredentialsDelegate"/> that parses the compact
+    /// <c>client_assertion</c>, resolves the verification key from the registration's
+    /// <see cref="ClientRecord.ClientJwks"/>, verifies the signature via
+    /// <see cref="Jws.VerifyAsync(string,DecodeDelegate,MemoryPool{byte},PublicKeyMemory,CancellationToken)"/>'s
+    /// registry-resolving overload, and applies <see cref="Validate"/>. Delegates the signature step
+    /// to <see cref="BuildValidator(VerificationDelegate,System.Collections.Generic.IReadOnlyCollection{string}?,CheckClientAssertionJtiReplayDelegate?)"/>'s
+    /// shared core once the key is resolved per request, so the verification logic is written once.
+    /// </summary>
+    /// <param name="additionalAcceptedAudiences">
+    /// Extra values <c>aud</c> may name beyond the resolved issuer identifier — for example the
+    /// token endpoint URL — or <see langword="null"/> to accept only the issuer.
+    /// </param>
+    /// <param name="checkJtiReplayAsync">
+    /// Replay-defense hook consulted after the claim rules pass, or <see langword="null"/> to skip
+    /// replay defense (the caller relies on a different mechanism). Pass
+    /// <see cref="JtiReplayGuard.ConsultAsync"/> directly to reuse the library's <c>(issuer, jti)</c>
+    /// store.
+    /// </param>
+    public static ValidateClientCredentialsDelegate BuildValidator(
+        IReadOnlyCollection<string>? additionalAcceptedAudiences = null,
+        CheckClientAssertionJtiReplayDelegate? checkJtiReplayAsync = null) =>
+        BuildValidatorCore(additionalAcceptedAudiences, checkJtiReplayAsync, verificationDelegate: null);
+
+
+    /// <summary>
+    /// Builds a <see cref="ValidateClientCredentialsDelegate"/> using an explicit
+    /// <see cref="VerificationDelegate"/> rather than resolving one from
+    /// <see cref="CryptoFunctionRegistry{TDiscriminator1,TDiscriminator2}"/>. The registry-resolving
+    /// overload above shares this method's validation core, supplying a
+    /// <see langword="null"/> function so the per-request signature step falls back to
+    /// <see cref="Jws.VerifyAsync(string,DecodeDelegate,MemoryPool{byte},PublicKeyMemory,CancellationToken)"/>'s
+    /// own registry resolution.
+    /// </summary>
+    /// <param name="verificationDelegate">The verification function to use.</param>
+    /// <param name="additionalAcceptedAudiences">
+    /// Extra values <c>aud</c> may name beyond the resolved issuer identifier — for example the
+    /// token endpoint URL — or <see langword="null"/> to accept only the issuer.
+    /// </param>
+    /// <param name="checkJtiReplayAsync">
+    /// Replay-defense hook consulted after the claim rules pass, or <see langword="null"/> to skip
+    /// replay defense.
+    /// </param>
+    public static ValidateClientCredentialsDelegate BuildValidator(
+        VerificationDelegate verificationDelegate,
+        IReadOnlyCollection<string>? additionalAcceptedAudiences = null,
+        CheckClientAssertionJtiReplayDelegate? checkJtiReplayAsync = null)
+    {
+        ArgumentNullException.ThrowIfNull(verificationDelegate);
+
+        return BuildValidatorCore(additionalAcceptedAudiences, checkJtiReplayAsync, verificationDelegate);
+    }
+
+
+    private static ValidateClientCredentialsDelegate BuildValidatorCore(
+        IReadOnlyCollection<string>? additionalAcceptedAudiences,
+        CheckClientAssertionJtiReplayDelegate? checkJtiReplayAsync,
+        VerificationDelegate? verificationDelegate)
+    {
+        return async (request, fields, registration, context, cancellationToken) =>
+        {
+            EndpointServer? server = context.Server;
+            if(server is null)
+            {
+                return false;
+            }
+
+            var oauth = server.OAuth();
+            if(oauth.Codecs.Decoder is null
+                || oauth.Codecs.JwtHeaderDeserializer is null
+                || oauth.Codecs.JwtPayloadDeserializer is null)
+            {
+                return false;
+            }
+
+            //RFC 7523 §2.2 / RFC 7521 §4.2: client_assertion_type MUST select the JWT Bearer client
+            //authentication profile before client_assertion is even attempted as this profile's
+            //assertion — an AS-side check no other seam in this library performs today.
+            if(!fields.TryGetValue(OAuthRequestParameterNames.ClientAssertionType, out string? assertionType)
+                || !WellKnownClientAssertionTypes.IsJwtBearer(assertionType))
+            {
+                return false;
+            }
+
+            //RFC 7523 §2.2: "the client_assertion parameter contains a single JWT. It MUST NOT
+            //contain more than one JWT" — satisfied structurally: RequestFields holds one string
+            //per key, so a second client_assertion value can never be represented here.
+            if(!fields.TryGetValue(OAuthRequestParameterNames.ClientAssertion, out string? clientAssertion)
+                || string.IsNullOrWhiteSpace(clientAssertion))
+            {
+                return false;
+            }
+
+            //draft-ietf-oauth-client-id-metadata-document-02 §8.2: no published key material means
+            //the assertion cannot be verified. Fail closed rather than treat the client as
+            //unauthenticated — the caller is responsible for populating ClientJwks (directly, or from
+            //ClientJwksUri content it fetched through its own OutboundFetch-policed call) before this
+            //validator runs.
+            if(registration.ClientJwks is null)
+            {
+                return false;
+            }
+
+            UnverifiedJwsMessage unverified;
+            try
+            {
+                unverified = JwsParsing.ParseCompact(
+                    clientAssertion,
+                    oauth.Codecs.Decoder,
+                    bytes => oauth.Codecs.JwtHeaderDeserializer(bytes),
+                    BaseMemoryPool.Shared);
+            }
+            catch(Exception ex) when(ex is FormatException or InvalidOperationException)
+            {
+                return false;
+            }
+
+            using(unverified)
+            {
+                UnverifiedJwtHeader header = unverified.Signatures[0].ProtectedHeader;
+
+                //RFC 8725 §3.1: alg=none is rejected unconditionally — an assertion with no
+                //signature algorithm cannot authenticate a confidential client.
+                if(!header.TryGetValue(WellKnownJwkMemberNames.Alg, out object? algObj)
+                    || algObj is not string alg
+                    || string.IsNullOrEmpty(alg)
+                    || string.Equals(alg, "none", StringComparison.OrdinalIgnoreCase))
+                {
+                    return false;
+                }
+
+                string? kid = header.TryGetValue(WellKnownJwkMemberNames.Kid, out object? kidObj)
+                    && kidObj is string kidValue
+                    ? kidValue
+                    : null;
+
+                Dictionary<string, string>? jwkMembers = FindJwkMembers(registration.ClientJwks, kid);
+
+                //A JWK carrying a private or symmetric member cannot be a verification key —
+                //draft-ietf-oauth-client-id-metadata-document-02 §4.1 (CIMD-023) already forbids this
+                //at the document-reader layer, so this is defense-in-depth for a directly-registered
+                //ClientJwks the reader never validated. Mirrors DpopJwkUtilities.ContainsPrivateKeyMaterial.
+                if(jwkMembers is null
+                    || WellKnownJwkMemberNames.ContainsPrivateOrSymmetricMember(jwkMembers.Keys))
+                {
+                    return false;
+                }
+
+                PublicKeyMemory publicKey;
+                try
+                {
+                    publicKey = DpopJwkUtilities.PublicKeyFromJwk(
+                        jwkMembers, alg, oauth.Codecs.Decoder, BaseMemoryPool.Shared);
+                }
+                catch(Exception ex) when(ex is FormatException or InvalidOperationException or ArgumentException or NotSupportedException)
+                {
+                    return false;
+                }
+
+                using(publicKey)
+                {
+                    bool signatureValid;
+                    try
+                    {
+                        signatureValid = verificationDelegate is not null
+                            ? await Jws.VerifyAsync(
+                                clientAssertion, oauth.Codecs.Decoder, BaseMemoryPool.Shared,
+                                publicKey, verificationDelegate, cancellationToken).ConfigureAwait(false)
+                            : await Jws.VerifyAsync(
+                                clientAssertion, oauth.Codecs.Decoder, BaseMemoryPool.Shared,
+                                publicKey, cancellationToken).ConfigureAwait(false);
+                    }
+                    catch(Exception ex) when(ex is FormatException or InvalidOperationException)
+                    {
+                        return false;
+                    }
+
+                    if(!signatureValid)
+                    {
+                        return false;
+                    }
+
+                    JwtPayload payload;
+                    try
+                    {
+                        payload = new JwtPayload(oauth.Codecs.JwtPayloadDeserializer(unverified.Payload.Span));
+                    }
+                    catch(Exception ex) when(ex is FormatException or InvalidOperationException)
+                    {
+                        return false;
+                    }
+
+                    Uri issuerUri;
+                    try
+                    {
+                        issuerUri = oauth.ResolveIssuerAsync is not null
+                            ? (await oauth.ResolveIssuerAsync(registration, context, cancellationToken)
+                                .ConfigureAwait(false))!
+                            : await DefaultIssuerResolver.ResolveAsync(registration, context, cancellationToken)
+                                .ConfigureAwait(false);
+                    }
+                    catch(InvalidOperationException)
+                    {
+                        return false;
+                    }
+
+                    List<string> acceptedAudiences = [issuerUri.OriginalString];
+                    if(additionalAcceptedAudiences is not null)
+                    {
+                        acceptedAudiences.AddRange(additionalAcceptedAudiences);
+                    }
+
+                    DateTimeOffset now = server.TimeProvider.GetUtcNow();
+                    PrivateKeyJwtClientAuthenticationResult result = Validate(
+                        payload, registration.ClientId, acceptedAudiences, now, context.ClockSkewTolerance);
+
+                    if(!result.IsValid)
+                    {
+                        return false;
+                    }
+
+                    if(checkJtiReplayAsync is not null)
+                    {
+                        JtiReplayOutcome outcome = await checkJtiReplayAsync(
+                            server, context, registration.TenantId, result.ClientId!, result.Jti!,
+                            result.Expiration!.Value, cancellationToken).ConfigureAwait(false);
+
+                        if(outcome != JtiReplayOutcome.FirstUse)
+                        {
+                            return false;
+                        }
+                    }
+
+                    return true;
+                }
+            }
+        };
+    }
+
+
+    /// <summary>
+    /// Reads a non-empty string claim, or returns <see langword="false"/> when it is absent or not a
+    /// non-empty string.
+    /// </summary>
+    private static bool TryReadString(JwtPayload payload, string claimName, out string? value)
+    {
+        if(payload.TryGetValue(claimName, out object? raw) && raw is string text && text.Length > 0)
+        {
+            value = text;
+
+            return true;
+        }
+
+        value = null;
+
+        return false;
+    }
+
+
+    /// <summary>
+    /// Reads an epoch-seconds temporal claim. Returns <see langword="false"/> when the claim is
+    /// present but not a numeric timestamp; sets <paramref name="present"/> to whether the claim was
+    /// there at all.
+    /// </summary>
+    private static bool TryReadEpochSeconds(
+        JwtPayload payload, string claimName, out bool present, out DateTimeOffset value)
+    {
+        value = default;
+        if(!payload.TryGetValue(claimName, out object? raw))
+        {
+            present = false;
+
+            return true;
+        }
+
+        present = true;
+        long? seconds = raw switch
+        {
+            long l => l,
+            int i => i,
+            short s => s,
+            byte b => b,
+            ulong u when u <= long.MaxValue => (long)u,
+            uint ui => ui,
+            double d when d >= long.MinValue && d <= long.MaxValue && d == Math.Floor(d) => (long)d,
+            float f when f >= long.MinValue && f <= long.MaxValue && f == Math.Floor(f) => (long)f,
+            string text when long.TryParse(text, System.Globalization.NumberStyles.Integer, System.Globalization.CultureInfo.InvariantCulture, out long parsed) => parsed,
+            _ => null,
+        };
+
+        if(seconds is null)
+        {
+            return false;
+        }
+
+        value = DateTimeOffset.FromUnixTimeSeconds(seconds.Value);
+
+        return true;
+    }
+
+
+    /// <summary>
+    /// Returns <see langword="true"/> when <paramref name="audienceRaw"/> (a string or an array of
+    /// strings) contains at least one entry and every entry ordinal-equals one of
+    /// <paramref name="acceptedAudiences"/> — RFC 7523 §3 item 3's "MUST reject any JWT that does not
+    /// contain its own identity as the intended audience," hardened so a mixed-in foreign audience
+    /// value rejects the whole assertion rather than being ignored.
+    /// </summary>
+    private static bool IsAudienceAccepted(object audienceRaw, IReadOnlyCollection<string> acceptedAudiences)
+    {
+        if(acceptedAudiences.Count == 0)
+        {
+            return false;
+        }
+
+        return audienceRaw switch
+        {
+            string single => single.Length > 0 && ContainsOrdinal(acceptedAudiences, single),
+            IEnumerable<string> typed => AreAllAccepted(typed, acceptedAudiences),
+            IEnumerable<object> mixed => AreAllAccepted(mixed, acceptedAudiences),
+            _ => false
+        };
+    }
+
+
+    private static bool AreAllAccepted(IEnumerable<string> values, IReadOnlyCollection<string> acceptedAudiences)
+    {
+        bool sawAny = false;
+        foreach(string value in values)
+        {
+            if(value.Length == 0 || !ContainsOrdinal(acceptedAudiences, value))
+            {
+                return false;
+            }
+
+            sawAny = true;
+        }
+
+        return sawAny;
+    }
+
+
+    private static bool AreAllAccepted(IEnumerable<object> values, IReadOnlyCollection<string> acceptedAudiences)
+    {
+        bool sawAny = false;
+        foreach(object value in values)
+        {
+            if(value is not string text || text.Length == 0 || !ContainsOrdinal(acceptedAudiences, text))
+            {
+                return false;
+            }
+
+            sawAny = true;
+        }
+
+        return sawAny;
+    }
+
+
+    private static bool ContainsOrdinal(IReadOnlyCollection<string> values, string candidate)
+    {
+        foreach(string value in values)
+        {
+            if(string.Equals(value, candidate, StringComparison.Ordinal))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+
+    /// <summary>
+    /// Locates the JWK matching <paramref name="kid"/> (or the first key when <paramref name="kid"/>
+    /// is <see langword="null"/>, mirroring <see cref="FederationKeyResolver"/>'s
+    /// absent-kid convention) inside a JWKS JSON document's <c>keys</c> array, and extracts its
+    /// string-valued members. Composes <see cref="JwkJsonReader"/> primitives the way
+    /// <see cref="ClientIdMetadataDocumentReader"/> already walks a <c>keys</c> array —
+    /// <see cref="JwkJsonReader"/> itself has no combinator for "the array element whose kid
+    /// matches."
+    /// </summary>
+    private static Dictionary<string, string>? FindJwkMembers(string jwksJson, string? kid)
+    {
+        ReadOnlySpan<byte> json = Encoding.UTF8.GetBytes(jwksJson);
+
+        int keysStart = JwkJsonReader.IndexOfKey(json, WellKnownJwkMemberNames.KeysUtf8);
+        if(keysStart < 0)
+        {
+            return null;
+        }
+
+        int afterKeysKey = keysStart + WellKnownJwkMemberNames.KeysUtf8.Length + 1;
+        afterKeysKey = JwkJsonReader.SkipWhitespaceAndColon(json, afterKeysKey);
+        if(afterKeysKey < 0 || afterKeysKey >= json.Length || json[afterKeysKey] != (byte)'[')
+        {
+            return null;
+        }
+
+        int cursor = afterKeysKey + 1;
+        while(cursor < json.Length)
+        {
+            while(cursor < json.Length && IsArraySeparator(json[cursor]))
+            {
+                cursor++;
+            }
+
+            if(cursor >= json.Length || json[cursor] == (byte)']')
+            {
+                return null;
+            }
+
+            if(json[cursor] != (byte)'{')
+            {
+                return null;
+            }
+
+            int objectStart = cursor;
+            int objectEnd = FindObjectEnd(json, objectStart);
+            if(objectEnd < 0)
+            {
+                return null;
+            }
+
+            ReadOnlySpan<byte> candidate = json[objectStart..objectEnd];
+            string? candidateKid = JwkJsonReader.ExtractStringValue(candidate, WellKnownJwkMemberNames.KidUtf8);
+
+            if(kid is null || string.Equals(candidateKid, kid, StringComparison.Ordinal))
+            {
+                return ExtractJwkStringMembers(candidate);
+            }
+
+            cursor = objectEnd;
+        }
+
+        return null;
+    }
+
+
+    //Returns the index one past the '}' that closes the object opening at objectStart, or -1 when
+    //the braces never balance. String content is skipped so a brace inside a quoted value never
+    //biases the depth counter. Mirrors ClientIdMetadataDocumentReader's identically-named helper.
+    private static int FindObjectEnd(ReadOnlySpan<byte> json, int objectStart)
+    {
+        int depth = 1;
+        int pos = objectStart + 1;
+
+        while(pos < json.Length && depth > 0)
+        {
+            byte current = json[pos];
+            if(current == (byte)'{')
+            {
+                depth++;
+            }
+            else if(current == (byte)'}')
+            {
+                depth--;
+            }
+            else if(current == (byte)'"')
+            {
+                pos++;
+                while(pos < json.Length && json[pos] != (byte)'"')
+                {
+                    if(json[pos] == (byte)'\\')
+                    {
+                        pos++;
+                    }
+
+                    pos++;
+                }
+            }
+
+            pos++;
+        }
+
+        return depth == 0 ? pos : -1;
+    }
+
+
+    private static bool IsArraySeparator(byte value) =>
+        value is (byte)' ' or (byte)'\t' or (byte)'\r' or (byte)'\n' or (byte)',';
+
+
+    private static Dictionary<string, string> ExtractJwkStringMembers(ReadOnlySpan<byte> jwkObject)
+    {
+        List<string> names = JwkJsonReader.GetTopLevelKeyNames(jwkObject);
+        Dictionary<string, string> members = new(names.Count, StringComparer.Ordinal);
+        foreach(string name in names)
+        {
+            string? value = JwkJsonReader.ExtractStringValue(jwkObject, Encoding.UTF8.GetBytes(name));
+            if(value is not null)
+            {
+                members[name] = value;
+            }
+        }
+
+        return members;
+    }
+}
diff --git a/src/Verifiable.OAuth/Server/RedirectUriMatching.cs b/src/Verifiable.OAuth/Server/RedirectUriMatching.cs
new file mode 100644
index 00000000..345f2979
--- /dev/null
+++ b/src/Verifiable.OAuth/Server/RedirectUriMatching.cs
@@ -0,0 +1,49 @@
+using System.Diagnostics;
+
+namespace Verifiable.OAuth.Server;
+
+/// <summary>
+/// Exact-match comparison of a requested <c>redirect_uri</c> against a client's registered set,
+/// per <see href="https://www.rfc-editor.org/rfc/rfc9700#section-2.1">RFC 9700 §2.1</see> and
+/// draft-ietf-oauth-client-id-metadata-document-02 §4.2: "the authorization server MUST ensure
+/// that the redirect URL in an authorization request is an exact match, using simple string
+/// comparison, of a registered redirect URL."
+/// </summary>
+/// <remarks>
+/// <see cref="Uri.Equals(object?)"/> (and the <c>ImmutableHashSet&lt;Uri&gt;.Contains</c> lookup a
+/// <c>Uri</c>-keyed set performs) is insufficient here: <see cref="Uri"/> normalizes a default port
+/// out of its equality and identity computation (<c>https://app.example/cb</c> and
+/// <c>https://app.example:443/cb</c> compare equal) and case-folds percent-encoded octets during
+/// parsing, so two redirect URIs that differ only in port elision or percent-encoding case collapse
+/// to the "same" <see cref="Uri"/> even though they are different octet sequences on the wire. RFC
+/// 3986 §6.2.1 simple string comparison — and this specification's exact-match requirement — treats
+/// them as distinct; an attacker registering (or a client presenting) the normalized-equivalent form
+/// must not bypass the registered-redirect-URI allowlist. Comparison is therefore on
+/// <see cref="Uri.OriginalString"/>, ordinally, never through <see cref="Uri"/> equality.
+/// </remarks>
+[DebuggerDisplay("RedirectUriMatching")]
+public static class RedirectUriMatching
+{
+    /// <summary>
+    /// Returns <see langword="true"/> when <paramref name="requested"/>'s original string is an
+    /// ordinal exact match of at least one entry in <paramref name="registered"/>'s original
+    /// strings.
+    /// </summary>
+    /// <param name="registered">The client's registered redirect URIs.</param>
+    /// <param name="requested">The redirect URI presented on the request.</param>
+    public static bool IsRegisteredExact(IReadOnlyCollection<Uri> registered, Uri requested)
+    {
+        ArgumentNullException.ThrowIfNull(registered);
+        ArgumentNullException.ThrowIfNull(requested);
+
+        foreach(Uri candidate in registered)
+        {
+            if(string.Equals(candidate.OriginalString, requested.OriginalString, StringComparison.Ordinal))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/src/Verifiable.OAuth/Server/Registration/RegistrationEndpoints.cs b/src/Verifiable.OAuth/Server/Registration/RegistrationEndpoints.cs
index 55e494f6..eff619db 100644
--- a/src/Verifiable.OAuth/Server/Registration/RegistrationEndpoints.cs
+++ b/src/Verifiable.OAuth/Server/Registration/RegistrationEndpoints.cs
@@ -185,6 +185,11 @@ private static ClientRecord BuildRecordFromMetadata(
             AllowedRedirectUris = redirectUris,
             AllowedScopes = scopes,
             AllowedAuthorizationDetailsTypes = ToAllowedAuthorizationDetailsTypes(metadata),
+            TokenEndpointAuthMethod = metadata.TokenEndpointAuthMethod,
+            ClientJwksUri = metadata.JwksUri,
+            ClientJwks = metadata.Jwks,
+            ClientName = metadata.ClientName,
+            ClientUri = metadata.ClientUri,
             TokenLifetimes = FrozenDictionary<string, TimeSpan>.Empty,
             SigningKeys = FrozenDictionary<Verifiable.Cryptography.Context.KeyUsageContext, SigningKeySet>.Empty
         };
@@ -445,7 +450,12 @@ private static ClientRecord BuildUpdatedRecord(ClientRecord previous, ClientMeta
             AllowedScopes = scopes,
             AllowedAuthorizationDetailsTypes = newMetadata.AuthorizationDetailsTypes is null
                 ? previous.AllowedAuthorizationDetailsTypes
-                : ToAllowedAuthorizationDetailsTypes(newMetadata)
+                : ToAllowedAuthorizationDetailsTypes(newMetadata),
+            TokenEndpointAuthMethod = newMetadata.TokenEndpointAuthMethod,
+            ClientJwksUri = newMetadata.JwksUri,
+            ClientJwks = newMetadata.Jwks,
+            ClientName = newMetadata.ClientName,
+            ClientUri = newMetadata.ClientUri
         };
     }
 
diff --git a/src/Verifiable.OAuth/Server/Rfc9068AccessTokenProducer.cs b/src/Verifiable.OAuth/Server/Rfc9068AccessTokenProducer.cs
index da127463..b10fc8ce 100644
--- a/src/Verifiable.OAuth/Server/Rfc9068AccessTokenProducer.cs
+++ b/src/Verifiable.OAuth/Server/Rfc9068AccessTokenProducer.cs
@@ -12,7 +12,11 @@ namespace Verifiable.OAuth.Server;
 /// <para>
 /// The producer always applies — every token-endpoint request emits an access
 /// token unless an application replaces the producer list with one that
-/// excludes it. Signs with <see cref="KeyUsageContext.AccessTokenIssuance"/>.
+/// excludes it. <see cref="TokenProducer.RequiredCapability"/> is
+/// <see langword="null"/>: the grant's own endpoint match (for example
+/// <see cref="WellKnownCapabilityIdentifiers.OAuthClientCredentials"/>) already gated the
+/// request before the producer walk runs, so this producer needs no separate tenant-feature
+/// gate. Signs with <see cref="KeyUsageContext.AccessTokenIssuance"/>.
 /// </para>
 /// <para>
 /// Consumed indirectly via <see cref="TokenProducer.Rfc9068AccessToken"/>.
@@ -59,7 +63,7 @@ internal static class Rfc9068AccessTokenProducer
     {
         Name = "rfc9068-access-token",
         ResponseField = WellKnownTokenTypes.AccessToken,
-        RequiredCapability = WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+        RequiredCapability = null,
         KeyUsage = KeyUsageContext.AccessTokenIssuance,
         IsApplicable = static (_, _) => ValueTask.FromResult(true),
         BuildAsync = BuildAsync
diff --git a/src/Verifiable.OAuth/Server/TokenProducerSet.cs b/src/Verifiable.OAuth/Server/TokenProducerSet.cs
index 1cff91f7..893204fd 100644
--- a/src/Verifiable.OAuth/Server/TokenProducerSet.cs
+++ b/src/Verifiable.OAuth/Server/TokenProducerSet.cs
@@ -9,9 +9,10 @@ namespace Verifiable.OAuth.Server;
 /// </summary>
 /// <remarks>
 /// <para>
-/// The library's token endpoint walks the set, filters by
-/// <see cref="TokenProducer.RequiredCapability"/> and
-/// <see cref="TokenProducer.IsApplicable"/>, calls each producer's
+/// The library's token endpoint walks the set, skips a producer only when its
+/// optional <see cref="TokenProducer.RequiredCapability"/> feature gate is set and the
+/// registration's resolved capability set does not allow it, filters the remainder by
+/// <see cref="TokenProducer.IsApplicable"/>, calls each applicable producer's
 /// <see cref="TokenProducer.BuildAsync"/>, and composes the JSON response from
 /// the collected tokens keyed by <see cref="TokenProducer.ResponseField"/>.
 /// </para>
diff --git a/src/Verifiable.OAuth/Server/WellKnownCapabilityIdentifiers.cs b/src/Verifiable.OAuth/Server/WellKnownCapabilityIdentifiers.cs
index 0fe169cc..9d02bda9 100644
--- a/src/Verifiable.OAuth/Server/WellKnownCapabilityIdentifiers.cs
+++ b/src/Verifiable.OAuth/Server/WellKnownCapabilityIdentifiers.cs
@@ -222,6 +222,17 @@ public static class WellKnownCapabilityIdentifiers
     public static CapabilityIdentifier OAuthDirectAuthorization { get; } =
         CapabilityIdentifier.Create("urn:verifiable:capability:oauth:direct_authorization");
 
+    /// <summary>
+    /// Client ID Metadata Documents (CIMD) per
+    /// <see href="https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/">draft-ietf-oauth-client-id-metadata-document-02</see> —
+    /// the authorization server resolves a client's registration data from a
+    /// <c>https://</c> URL used directly as the <c>client_id</c>, instead of from a
+    /// pre-registered record. Gates both the materialization dispatch hook and the
+    /// <c>client_id_metadata_document_supported</c> discovery advertisement (§6).
+    /// </summary>
+    public static CapabilityIdentifier OAuthClientIdMetadataDocument { get; } =
+        CapabilityIdentifier.Create("urn:verifiable:capability:oauth:client-id-metadata-document");
+
 
     //OpenID Connect.
 
diff --git a/src/Verifiable.OAuth/SignedJwtValidationOutcome.cs b/src/Verifiable.OAuth/SignedJwtValidationOutcome.cs
new file mode 100644
index 00000000..4c979d7b
--- /dev/null
+++ b/src/Verifiable.OAuth/SignedJwtValidationOutcome.cs
@@ -0,0 +1,97 @@
+using System.Diagnostics;
+using Verifiable.JCose;
+
+namespace Verifiable.OAuth;
+
+/// <summary>
+/// The neutral outcome of <see cref="JwsAccessTokenValidator.ValidateSignedJwtCoreAsync"/> — the
+/// shared parse / signature / <c>iss</c> / <c>aud</c> / <c>azp</c> / <c>exp</c> / <c>iat</c> /
+/// <c>nbf</c> / <c>sub</c> validation core behind both <see cref="JwsAccessTokenValidator.ValidateAsync"/>
+/// and <see cref="Oidc10IdTokenValidator.ValidateAsync"/>.
+/// </summary>
+/// <remarks>
+/// Each caller maps this into its own profile-specific result and claims type
+/// (<see cref="JwsAccessTokenValidationResult"/> / <see cref="JwsAccessTokenClaims"/> for the RFC 9068
+/// access-token profile, <see cref="Oidc10IdTokenValidationResult"/> / <see cref="Oidc10IdTokenClaims"/>
+/// for the OIDC Core §3.1.3.7 ID Token profile), reading any profile-specific optional claims
+/// (<c>client_id</c>/<c>scope</c>/<c>jti</c> for the access-token profile; <c>nonce</c>/<c>auth_time</c>/
+/// <c>acr</c>/<c>amr</c>/<c>sid</c> for the ID Token profile) from <see cref="Payload"/>. On success every
+/// member except <see cref="NotBefore"/> is populated; on failure only <see cref="FailureReason"/> and
+/// <see cref="FailureDescription"/> are.
+/// </remarks>
+[DebuggerDisplay("SignedJwtValidationOutcome Success={IsSuccess} Reason={FailureReason}")]
+internal sealed record SignedJwtValidationOutcome
+{
+    /// <summary>The verified payload when validation succeeded; otherwise <see langword="null"/>.</summary>
+    public JwtPayload? Payload { get; init; }
+
+    /// <summary>The <c>sub</c> claim when validation succeeded; otherwise <see langword="null"/>.</summary>
+    public string? Subject { get; init; }
+
+    /// <summary>The <c>iss</c> claim when validation succeeded; otherwise <see langword="null"/>.</summary>
+    public string? Issuer { get; init; }
+
+    /// <summary>The normalised <c>aud</c> claim when validation succeeded; otherwise <see langword="null"/>.</summary>
+    public IReadOnlyList<string>? Audience { get; init; }
+
+    /// <summary>
+    /// The <c>azp</c> claim when validation succeeded and the claim was present; <see langword="null"/>
+    /// when validation succeeded but no <c>azp</c> was carried, or when validation failed.
+    /// </summary>
+    public string? AuthorizedParty { get; init; }
+
+    /// <summary>The <c>iat</c> claim when validation succeeded; otherwise <see langword="null"/>.</summary>
+    public DateTimeOffset? IssuedAt { get; init; }
+
+    /// <summary>The <c>exp</c> claim when validation succeeded; otherwise <see langword="null"/>.</summary>
+    public DateTimeOffset? Expiration { get; init; }
+
+    /// <summary>The <c>nbf</c> claim when validation succeeded and present; otherwise <see langword="null"/>.</summary>
+    public DateTimeOffset? NotBefore { get; init; }
+
+    /// <summary>The failure reason when validation failed; otherwise <see langword="null"/>.</summary>
+    public JwsAccessTokenValidationFailureReason? FailureReason { get; init; }
+
+    /// <summary>Optional free-text description of the failure.</summary>
+    public string? FailureDescription { get; init; }
+
+    /// <summary><see langword="true"/> when validation succeeded.</summary>
+    public bool IsSuccess => FailureReason is null;
+
+
+    /// <summary>Builds a success outcome.</summary>
+    public static SignedJwtValidationOutcome Success(
+        JwtPayload payload,
+        string subject,
+        string issuer,
+        IReadOnlyList<string> audience,
+        string? authorizedParty,
+        DateTimeOffset issuedAt,
+        DateTimeOffset expiration,
+        DateTimeOffset? notBefore)
+    {
+        ArgumentNullException.ThrowIfNull(payload);
+        ArgumentNullException.ThrowIfNull(subject);
+        ArgumentNullException.ThrowIfNull(issuer);
+        ArgumentNullException.ThrowIfNull(audience);
+
+        return new()
+        {
+            Payload = payload,
+            Subject = subject,
+            Issuer = issuer,
+            Audience = audience,
+            AuthorizedParty = authorizedParty,
+            IssuedAt = issuedAt,
+            Expiration = expiration,
+            NotBefore = notBefore
+        };
+    }
+
+
+    /// <summary>Builds a failure outcome.</summary>
+    public static SignedJwtValidationOutcome Failure(
+        JwsAccessTokenValidationFailureReason reason,
+        string? description = null) =>
+        new() { FailureReason = reason, FailureDescription = description };
+}
diff --git a/src/Verifiable.OAuth/TokenProducer.cs b/src/Verifiable.OAuth/TokenProducer.cs
index ecf54202..a5af1af6 100644
--- a/src/Verifiable.OAuth/TokenProducer.cs
+++ b/src/Verifiable.OAuth/TokenProducer.cs
@@ -9,9 +9,9 @@ namespace Verifiable.OAuth;
 
 /// <summary>
 /// Emits one token type at a token endpoint. The Authorization Server's token
-/// endpoint walks <see cref="EndpointServer.TokenProducers"/>, filters
-/// by <see cref="RequiredCapability"/> and <see cref="IsApplicable"/>, and for
-/// each applicable producer runs the pipeline:
+/// endpoint walks <see cref="AuthorizationServerIntegration.TokenProducers"/>, filters
+/// by the optional <see cref="RequiredCapability"/> feature gate and by
+/// <see cref="IsApplicable"/>, and for each applicable producer runs the pipeline:
 /// resolve key (via <see cref="KeyUsage"/>) → producer's <see cref="BuildAsync"/>
 /// → claim contributors → request-claim filtering → sign.
 /// </summary>
@@ -70,11 +70,19 @@ public sealed record TokenProducer
     public required string ResponseField { get; init; }
 
     /// <summary>
-    /// The capability the registration must have for this producer to run. The
-    /// endpoint handler skips producers whose <see cref="RequiredCapability"/> is
-    /// not allowed by the active <see cref="ClientRecord"/>.
+    /// An optional coarse tenant-feature gate. When set, the endpoint handler skips this
+    /// producer unless the active <see cref="ClientRecord"/>'s resolved capability set
+    /// allows it; <see langword="null"/> means the producer is not feature-gated at all —
+    /// it may still decline per-request via <see cref="IsApplicable"/>.
+    /// <see cref="Server.Rfc9068AccessTokenProducer"/> leaves this <see langword="null"/>
+    /// because it applies to every token-issuing grant and the grant's own endpoint match
+    /// (for example <see cref="WellKnownCapabilityIdentifiers.OAuthClientCredentials"/>)
+    /// already gated the request before the producer walk begins;
+    /// <see cref="Server.Oidc10IdTokenProducer"/> sets
+    /// <see cref="WellKnownCapabilityIdentifiers.OidcOpenIdConnect"/> because OIDC is a
+    /// genuine opt-in tenant feature independent of which grant capability matched.
     /// </summary>
-    public required CapabilityIdentifier RequiredCapability { get; init; }
+    public CapabilityIdentifier? RequiredCapability { get; init; }
 
     /// <summary>
     /// The protocol-level usage context this producer signs with. The endpoint
diff --git a/src/Verifiable.OAuth/Validation/ValidationChecks.cs b/src/Verifiable.OAuth/Validation/ValidationChecks.cs
index cd390856..d760b90d 100644
--- a/src/Verifiable.OAuth/Validation/ValidationChecks.cs
+++ b/src/Verifiable.OAuth/Validation/ValidationChecks.cs
@@ -89,9 +89,7 @@ public static ValueTask<List<Claim>> CheckCallbackIssuerMatches(
         ArgumentNullException.ThrowIfNull(context);
         cancellationToken.ThrowIfCancellationRequested();
 
-        bool issPresent = context.Fields!.TryGetValue(OAuthRequestParameterNames.Iss, out string? iss);
-        ClaimOutcome outcome = issPresent
-            && string.Equals(iss, context.FlowState!.ExpectedIssuer, StringComparison.Ordinal)
+        ClaimOutcome outcome = IssuerMatchesWhenPresent(context, out bool issPresent) && issPresent
             ? ClaimOutcome.Success
             : ClaimOutcome.Failure;
 
@@ -100,6 +98,51 @@ public static ValueTask<List<Claim>> CheckCallbackIssuerMatches(
     }
 
 
+    /// <summary>
+    /// Checks that a PRESENT <c>iss</c> value matches the expected issuer; an absent
+    /// <c>iss</c> passes this check. The mix-up defense a profile applies when it does
+    /// not know whether the authorization server supports
+    /// <see href="https://www.rfc-editor.org/rfc/rfc9207">RFC 9207</see>: unlike
+    /// <see cref="CheckCallbackIssuerMatches"/> (paired with
+    /// <see cref="CheckCallbackIssPresent"/> under profiles that require the
+    /// parameter), this check alone lets a profile that does not assume RFC 9207
+    /// support still reject a callback whose <c>iss</c> was supplied but forged.
+    /// </summary>
+    public static ValueTask<List<Claim>> CheckCallbackIssuerMatchesWhenPresent(
+        ValidationContext context,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(context);
+        cancellationToken.ThrowIfCancellationRequested();
+
+        ClaimOutcome outcome = IssuerMatchesWhenPresent(context, out _)
+            ? ClaimOutcome.Success
+            : ClaimOutcome.Failure;
+
+        return ValueTask.FromResult<List<Claim>>(
+            [new Claim(ValidationClaimIds.IssuerMatchesExpectedWhenPresent, outcome)]);
+    }
+
+
+    /// <summary>
+    /// Shared comparison behind <see cref="CheckCallbackIssuerMatches"/> and
+    /// <see cref="CheckCallbackIssuerMatchesWhenPresent"/>: an absent <c>iss</c>
+    /// reports <see langword="true"/> (vacuously matched — the presence
+    /// requirement, if any, is a separate check) and <paramref name="issPresent"/>
+    /// distinguishes that case for callers that must additionally require presence.
+    /// A present <c>iss</c> is compared to <see cref="ValidationContext.FlowState"/>'s
+    /// <see cref="FlowState.ExpectedIssuer"/> by ordinal string comparison per
+    /// RFC 8414 §3.3.
+    /// </summary>
+    private static bool IssuerMatchesWhenPresent(ValidationContext context, out bool issPresent)
+    {
+        issPresent = context.Fields!.TryGetValue(OAuthRequestParameterNames.Iss, out string? iss);
+
+        return !issPresent
+            || string.Equals(iss, context.FlowState!.ExpectedIssuer, StringComparison.Ordinal);
+    }
+
+
     /// <summary>
     /// Checks that the <c>state</c> value matches the loaded flow state.
     /// </summary>
diff --git a/src/Verifiable.OAuth/Validation/ValidationClaimIds.cs b/src/Verifiable.OAuth/Validation/ValidationClaimIds.cs
index 95cae967..fb289192 100644
--- a/src/Verifiable.OAuth/Validation/ValidationClaimIds.cs
+++ b/src/Verifiable.OAuth/Validation/ValidationClaimIds.cs
@@ -61,6 +61,16 @@ public static class ValidationClaimIds
     /// </summary>
     public static ClaimId IssuerMatchesExpected { get; } = ClaimId.Create(720, "IssuerMatchesExpected");
 
+    /// <summary>
+    /// A PRESENT <c>iss</c> value in the callback matches the expected authorization server
+    /// issuer; an absent <c>iss</c> passes vacuously. The profile-independent half of the
+    /// mix-up defense per
+    /// <see href="https://www.rfc-editor.org/rfc/rfc9207">RFC 9207</see> — applied even by
+    /// profiles that do not require <c>iss</c> presence, so a forged-but-present value is
+    /// still caught.
+    /// </summary>
+    public static ClaimId IssuerMatchesExpectedWhenPresent { get; } = ClaimId.Create(723, "IssuerMatchesExpectedWhenPresent");
+
     /// <summary>
     /// The <c>state</c> value in the callback matches an active flow state.
     /// Failure indicates a CSRF attempt per
diff --git a/src/Verifiable.OAuth/Validation/ValidationProfiles.cs b/src/Verifiable.OAuth/Validation/ValidationProfiles.cs
index f25ee071..a1cf9ffc 100644
--- a/src/Verifiable.OAuth/Validation/ValidationProfiles.cs
+++ b/src/Verifiable.OAuth/Validation/ValidationProfiles.cs
@@ -28,7 +28,15 @@ namespace Verifiable.OAuth.Validation;
 public static class ValidationProfiles
 {
     /// <summary>
-    /// RFC 6749 with PKCE callback validation rules.
+    /// RFC 6749 with PKCE callback validation rules. Includes the
+    /// profile-independent <see cref="ValidationChecks.CheckCallbackIssuerMatchesWhenPresent"/>
+    /// mix-up defense per
+    /// <see href="https://www.rfc-editor.org/rfc/rfc9207">RFC 9207</see> §2.4: this
+    /// profile does not assume the authorization server supports the <c>iss</c>
+    /// parameter, so an absent value is accepted (unlike
+    /// <see cref="CallbackHaip10Rules"/>'s <c>CheckCallbackIssPresent</c>), but a
+    /// PRESENT value is still required to match the expected issuer — a present,
+    /// forged <c>iss</c> is rejected before the callback can persist state.
     /// </summary>
     /// <returns>A mutable list the application can extend.</returns>
     public static IList<ClaimDelegate<ValidationContext>> CallbackRfc6749WithPkceRules() =>
@@ -40,6 +48,9 @@ public static IList<ClaimDelegate<ValidationContext>> CallbackRfc6749WithPkceRul
             new(ValidationChecks.CheckCallbackStatePresent,
                 [ValidationClaimIds.CallbackStatePresent]),
 
+            new(ValidationChecks.CheckCallbackIssuerMatchesWhenPresent,
+                [ValidationClaimIds.IssuerMatchesExpectedWhenPresent]),
+
             new(ValidationChecks.CheckCallbackStateMatchesFlow,
                 [ValidationClaimIds.StateMatchesActiveFlow]),
 
diff --git a/src/Verifiable.OAuth/packages.lock.json b/src/Verifiable.OAuth/packages.lock.json
index c3114efb..dc37276e 100644
--- a/src/Verifiable.OAuth/packages.lock.json
+++ b/src/Verifiable.OAuth/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -201,9 +201,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Server/EndpointServer.cs b/src/Verifiable.Server/EndpointServer.cs
index 75a59bd4..afcd146d 100644
--- a/src/Verifiable.Server/EndpointServer.cs
+++ b/src/Verifiable.Server/EndpointServer.cs
@@ -258,7 +258,21 @@ public async ValueTask<ServerHttpResponse> DispatchAsync(
                 }
                 else
                 {
-                    response = await HandleCoreAsync(
+                    ServerHttpResponse? materializationFailure = null;
+                    if(Integration.MaterializeRegistrationAsync is not null)
+                    {
+                        RegistrationMaterialization materialization = await Integration.MaterializeRegistrationAsync(
+                            registration, context, cancellationToken).ConfigureAwait(false);
+
+                        materializationFailure = materialization.Failure;
+                        if(materializationFailure is null && materialization.Registration is not null)
+                        {
+                            registration = materialization.Registration;
+                            context.SetRegistration(registration);
+                        }
+                    }
+
+                    response = materializationFailure ?? await HandleCoreAsync(
                         matched.Endpoint, request.Fields, context, registration, activity, cancellationToken)
                         .ConfigureAwait(false);
                 }
diff --git a/src/Verifiable.Server/MaterializeRegistrationDelegate.cs b/src/Verifiable.Server/MaterializeRegistrationDelegate.cs
new file mode 100644
index 00000000..fa36aee4
--- /dev/null
+++ b/src/Verifiable.Server/MaterializeRegistrationDelegate.cs
@@ -0,0 +1,70 @@
+using Verifiable.Core;
+
+namespace Verifiable.Server;
+
+/// <summary>
+/// Materializes the client-data-dependent fields of a matched request's registration —
+/// for example fetching a client's self-published metadata document — after routing has
+/// matched an endpoint and before that endpoint runs. Wired through
+/// <see cref="ServerIntegration.MaterializeRegistrationAsync"/>.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Invoked by <see cref="EndpointServer.DispatchAsync"/> once a request has matched an
+/// endpoint and the match-decision inspection stage has run, before the endpoint's own
+/// <c>BuildInputAsync</c>. The registration <see cref="ServerIntegration.LoadRegistrationAsync"/>
+/// resolved already carries every AS-owned field — capabilities, policy profile, token
+/// lifetimes, signing keys — needed to drive tenant resolution, per-request policy, and
+/// chain matching; this seam supplies whatever remaining registration data instead depends
+/// on the client's own published data. Running it post-match, for the one matched endpoint
+/// only, keeps requests that never need that data (discovery, JWKS) from paying its cost.
+/// </para>
+/// <para>
+/// Optional: when left <see langword="null"/>, dispatch proceeds exactly as it does without
+/// this seam — the loaded registration reaches the endpoint unchanged.
+/// </para>
+/// </remarks>
+/// <param name="registration">
+/// The registration <see cref="ServerIntegration.LoadRegistrationAsync"/> resolved for the
+/// matched request.
+/// </param>
+/// <param name="context">
+/// The per-request context. The matched endpoint's capability and the typed
+/// <see cref="Routing.ExchangeContextIncomingRequestExtensions.IncomingRequest"/> are already
+/// set when this runs.
+/// </param>
+/// <param name="cancellationToken">Cancellation token.</param>
+/// <returns>
+/// The materialization outcome — either a registration to continue dispatch with, or a
+/// response that short-circuits it.
+/// </returns>
+public delegate ValueTask<RegistrationMaterialization> MaterializeRegistrationDelegate(
+    IRegistrationRecord registration,
+    ExchangeContext context,
+    CancellationToken cancellationToken);
+
+
+/// <summary>
+/// The outcome of a <see cref="MaterializeRegistrationDelegate"/> call.
+/// </summary>
+/// <remarks>
+/// A non-<see langword="null"/> <see cref="Failure"/> is authoritative:
+/// <see cref="EndpointServer.DispatchAsync"/> returns it as the response and never inspects
+/// <see cref="Registration"/> in that case. When <see cref="Failure"/> is <see langword="null"/>,
+/// a non-<see langword="null"/> <see cref="Registration"/> replaces the loaded registration via
+/// <see cref="ExchangeContextServerExtensions.SetRegistration"/> before the endpoint runs.
+/// </remarks>
+public sealed record RegistrationMaterialization
+{
+    /// <summary>
+    /// The registration to continue dispatch with, or <see langword="null"/> to leave the
+    /// currently loaded registration in place.
+    /// </summary>
+    public IRegistrationRecord? Registration { get; init; }
+
+    /// <summary>
+    /// The response that short-circuits dispatch, or <see langword="null"/> to continue with
+    /// <see cref="Registration"/>.
+    /// </summary>
+    public ServerHttpResponse? Failure { get; init; }
+}
diff --git a/src/Verifiable.Server/ServerIntegration.cs b/src/Verifiable.Server/ServerIntegration.cs
index 637c7c6c..ef605a55 100644
--- a/src/Verifiable.Server/ServerIntegration.cs
+++ b/src/Verifiable.Server/ServerIntegration.cs
@@ -105,6 +105,13 @@ public class ServerIntegration
     /// </summary>
     public ResolveServerPolicyDelegate? ResolvePolicyAsync { get; set; }
 
+    /// <summary>
+    /// Materializes the client-data-dependent fields of a matched request's registration
+    /// after routing has matched an endpoint, before that endpoint runs. Optional; when
+    /// <see langword="null"/> dispatch proceeds with the loaded registration unchanged.
+    /// </summary>
+    public MaterializeRegistrationDelegate? MaterializeRegistrationAsync { get; set; }
+
 
     /// <summary>
     /// Whether <see cref="Validate"/> has been called successfully on this group.
diff --git a/src/Verifiable.Server/packages.lock.json b/src/Verifiable.Server/packages.lock.json
index e3f4c023..a284ef29 100644
--- a/src/Verifiable.Server/packages.lock.json
+++ b/src/Verifiable.Server/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -193,9 +193,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Tpm/packages.lock.json b/src/Verifiable.Tpm/packages.lock.json
index 73457b53..53f38458 100644
--- a/src/Verifiable.Tpm/packages.lock.json
+++ b/src/Verifiable.Tpm/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -133,9 +133,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.Vcalm/packages.lock.json b/src/Verifiable.Vcalm/packages.lock.json
index c3114efb..dc37276e 100644
--- a/src/Verifiable.Vcalm/packages.lock.json
+++ b/src/Verifiable.Vcalm/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -201,9 +201,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable.WebFinger/packages.lock.json b/src/Verifiable.WebFinger/packages.lock.json
index c3114efb..dc37276e 100644
--- a/src/Verifiable.WebFinger/packages.lock.json
+++ b/src/Verifiable.WebFinger/packages.lock.json
@@ -10,9 +10,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -201,9 +201,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/src/Verifiable/packages.lock.json b/src/Verifiable/packages.lock.json
index 921bff55..55453ccc 100644
--- a/src/Verifiable/packages.lock.json
+++ b/src/Verifiable/packages.lock.json
@@ -30,45 +30,45 @@
       },
       "Microsoft.DotNet.ILCompiler": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4y+VsQOcs4EiTSINdCpCWi/aLRbIbGTxSezQXd8uGVhzbDRm1FNVTZDyCUQixE0+g9UFusvfxVcF68YYz7RzxA=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "tnG8ntt/Bk6odvHREnGLMo3PEiihy5iSlIFVp0JbIo00GKtNRt2k73eKZbPqR5yaJNIa3z8R86YLwbxfqpb17g=="
       },
       "Microsoft.Extensions.Hosting": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "HTgnvmK0ubesUFO16pLC+i9+RS8lEGd6TmDouuy75FsAgIFrSwUVhYCqG2IENzBJwgxGc/6Rsulfsvd9ZG/XkA==",
-        "dependencies": {
-          "Microsoft.Extensions.Configuration": "10.0.9",
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Configuration.Binder": "10.0.9",
-          "Microsoft.Extensions.Configuration.CommandLine": "10.0.9",
-          "Microsoft.Extensions.Configuration.EnvironmentVariables": "10.0.9",
-          "Microsoft.Extensions.Configuration.FileExtensions": "10.0.9",
-          "Microsoft.Extensions.Configuration.Json": "10.0.9",
-          "Microsoft.Extensions.Configuration.UserSecrets": "10.0.9",
-          "Microsoft.Extensions.DependencyInjection": "10.0.9",
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Diagnostics": "10.0.9",
-          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.9",
-          "Microsoft.Extensions.FileProviders.Physical": "10.0.9",
-          "Microsoft.Extensions.Hosting.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging": "10.0.9",
-          "Microsoft.Extensions.Logging.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging.Configuration": "10.0.9",
-          "Microsoft.Extensions.Logging.Console": "10.0.9",
-          "Microsoft.Extensions.Logging.Debug": "10.0.9",
-          "Microsoft.Extensions.Logging.EventLog": "10.0.9",
-          "Microsoft.Extensions.Logging.EventSource": "10.0.9",
-          "Microsoft.Extensions.Options": "10.0.9"
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "tL9FkfV64GPUDSPvwrgyw42LVzsnVAnyrqJEuZVJbODgrQ3eL63zmzEcVWoCHzfgqUhWggzbgAyUCnz/zfI3Pg==",
+        "dependencies": {
+          "Microsoft.Extensions.Configuration": "10.0.10",
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Configuration.Binder": "10.0.10",
+          "Microsoft.Extensions.Configuration.CommandLine": "10.0.10",
+          "Microsoft.Extensions.Configuration.EnvironmentVariables": "10.0.10",
+          "Microsoft.Extensions.Configuration.FileExtensions": "10.0.10",
+          "Microsoft.Extensions.Configuration.Json": "10.0.10",
+          "Microsoft.Extensions.Configuration.UserSecrets": "10.0.10",
+          "Microsoft.Extensions.DependencyInjection": "10.0.10",
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Diagnostics": "10.0.10",
+          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.10",
+          "Microsoft.Extensions.FileProviders.Physical": "10.0.10",
+          "Microsoft.Extensions.Hosting.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging": "10.0.10",
+          "Microsoft.Extensions.Logging.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging.Configuration": "10.0.10",
+          "Microsoft.Extensions.Logging.Console": "10.0.10",
+          "Microsoft.Extensions.Logging.Debug": "10.0.10",
+          "Microsoft.Extensions.Logging.EventLog": "10.0.10",
+          "Microsoft.Extensions.Logging.EventSource": "10.0.10",
+          "Microsoft.Extensions.Options": "10.0.10"
         }
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -78,13 +78,13 @@
       },
       "ModelContextProtocol": {
         "type": "Direct",
-        "requested": "[1.4.0, )",
-        "resolved": "1.4.0",
-        "contentHash": "CAmnAMQIMax2t9naUgyDAkVBj329EhQCiHcbfirMFNgP6ShQ8hJdJb0OLoaBpeGjkunH3IOjRXLdwXGKKwMlLA==",
+        "requested": "[1.4.1, )",
+        "resolved": "1.4.1",
+        "contentHash": "mP5hvBpoWe5EbWBqHWD09A4Dy6Pq+/vV2dumOV4uegCZcg+yqf8q8wrxtuZ3EQyXEJn9jzsnoiI/qyfJAihlZQ==",
         "dependencies": {
           "Microsoft.Extensions.Caching.Abstractions": "10.0.7",
           "Microsoft.Extensions.Hosting.Abstractions": "10.0.7",
-          "ModelContextProtocol.Core": "1.4.0"
+          "ModelContextProtocol.Core": "1.4.1"
         }
       },
       "SIL.ReleaseTasks": {
@@ -99,20 +99,15 @@
       },
       "SimpleBase": {
         "type": "Direct",
-        "requested": "[5.6.1, )",
-        "resolved": "5.6.1",
-        "contentHash": "gCexR8/Laso8JFm8myi3uJfo6NYyZElg5qgRyGHok6jFNY/wQwLJHr0D4tb6645SBV2D6L8e/xV2RMSSKXYd5Q=="
+        "requested": "[5.6.2, )",
+        "resolved": "5.6.2",
+        "contentHash": "xQFeRXI25LdFy+wGQ0HVCXw0wONI2GVDkgm9cmbNOQcr5XciryiDfPH1a3afaseTahD8ajIc8o7KIN9rcNPOdw=="
       },
       "System.CommandLine": {
         "type": "Direct",
-        "requested": "[2.0.9, )",
-        "resolved": "2.0.9",
-        "contentHash": "SW0WhEk4NFVZ4lOnsLrHQOV/7s0eTidezNybHQWXfqhuXWB17X3RXbrifeWBbUx1iu+NcYchVSufmW7svjUEnA=="
-      },
-      "AngleSharp": {
-        "type": "Transitive",
-        "resolved": "1.4.0",
-        "contentHash": "6ph8mpaQx0KL0COYRt0kI8MB9gSp1PtKijKMhJU//+aVFgKAJLKDesG/+26JSaVCOrHNgPf12wpfoyRcMYOeXg=="
+        "requested": "[2.0.10, )",
+        "resolved": "2.0.10",
+        "contentHash": "6i1D6/U3i1f/PiXTt9pDvbJwdXEe0F2DZPup6BHzeIu5yPk/lkFzgtrJnPbj54JWUh8Y9vJeKG/TZIT6MkF8TA=="
       },
       "dotNetRdf.Client": {
         "type": "Transitive",
@@ -329,253 +324,253 @@
       },
       "Microsoft.Extensions.Configuration": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "woZsWLhOQsASuxbmgiZJqiGUBNo3IjRdXC92xt8rRokza+P6/nIsnzq7sm9Or6ZYcRl2kL1ufj8HVzp1QlPTXw==",
+        "resolved": "10.0.10",
+        "contentHash": "plJWK2zpWuuyxI8F8s2scx6Je7N1Ajjs6HvYUGKwRnDMWIVIz9FHwAkiT7ASgrvAOd10T0FPVlh9BzAJJME+jg==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Primitives": "10.0.9"
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Primitives": "10.0.10"
         }
       },
       "Microsoft.Extensions.Configuration.Abstractions": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "qGhRPd3VxfLV9UqatVOiD9mAeUbj2KiMwGFYC5uXlzExiZQoe4X/hdmzGIU7BQjNLTqCnnbTHVyBglG3668/HA==",
+        "resolved": "10.0.10",
+        "contentHash": "5Vnd2I75DmZCVEjSynIdJ/0EGafgnLQwgR3t2C2/fkjx/nRG+cLwxLLdInoHeCEpkD5K4Ov/g9ZCRYrl4TRsaA==",
         "dependencies": {
-          "Microsoft.Extensions.Primitives": "10.0.9"
+          "Microsoft.Extensions.Primitives": "10.0.10"
         }
       },
       "Microsoft.Extensions.Configuration.Binder": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "Tp/+LPb70RyjjtLg9m5C959eP4KrUpJHThZfAegZVpsfmGvzfuNkuYbI/ft+LvXhMSyUcAeOPaN6rzTccwnZAg==",
+        "resolved": "10.0.10",
+        "contentHash": "GqmN2o1CkJvk7uWp+p4CwBYW0w/zfoEbvsiFDbO2G8l1Uz+mrDAbAcZiXhU2lufKPby1cjAUdd5GTWpebYOkOA==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration": "10.0.9",
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9"
+          "Microsoft.Extensions.Configuration": "10.0.10",
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Configuration.CommandLine": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "8D4HaqxWdm5M/nuhQffjPoR1ekhlpyKTXjFMAT5KlP0dvxkJe5JLAP6MAsuUEUxKWG09Bi5aAUaYMFKrMqWHqA==",
+        "resolved": "10.0.10",
+        "contentHash": "33cBeR2HRbzHUTtmcmLdNOApneNGcymwwL4arHuotgVK9Frba8kcDTrvVTj7cSCmF1R9OiSbZH0KxNOwab3HUg==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration": "10.0.9",
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9"
+          "Microsoft.Extensions.Configuration": "10.0.10",
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Configuration.EnvironmentVariables": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "JhKySWIL8+N4yFt4HPm1rGKCHooze+MBdTdpXc0bd/PGm31TrSUi2m0Nek1y441Wlv/RE6VH0W/DCv2xnmy8FA==",
+        "resolved": "10.0.10",
+        "contentHash": "KRfFSSCV58vEdU7mPED/YMzeovIWF5P0g8s9K8n9HEfy0/WzMq37SrPdXdFN5/dFT/rPMHpF7AvpoXHckbcBFg==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration": "10.0.9",
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9"
+          "Microsoft.Extensions.Configuration": "10.0.10",
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Configuration.FileExtensions": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "NgLB9cYnIb0/djSDcnqo4GIGGWooxGmr/gCUe3/CRXcKqLizOFui8MyW4EVkTB/KNJL+oXdMXnD6ZRm3Y+qkrQ==",
+        "resolved": "10.0.10",
+        "contentHash": "ZOhZYwvbXGTgGVRwswIirofEMVHuWdxjdh0JeUZXwaF9cgcjXdz/t0ELtgaevw7ezTyv47yPNCgGreWtLkn3IQ==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration": "10.0.9",
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9",
-          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.9",
-          "Microsoft.Extensions.FileProviders.Physical": "10.0.9",
-          "Microsoft.Extensions.Primitives": "10.0.9"
+          "Microsoft.Extensions.Configuration": "10.0.10",
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
+          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.10",
+          "Microsoft.Extensions.FileProviders.Physical": "10.0.10",
+          "Microsoft.Extensions.Primitives": "10.0.10"
         }
       },
       "Microsoft.Extensions.Configuration.Json": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "LiFKJgc9jZEW+7RhcSfsvCwoikt1lDdOqOn+whZC5zVHyg/gExftHl2QPtmfiHsEdDNg+Y+BDr6835tOfj8Y7A==",
+        "resolved": "10.0.10",
+        "contentHash": "uvJ6sHwjgrkMEJOgiC76G0mcZGXerwyyWkwX34EOjCbxKG6TCtfAoqDKAMsCvEBf9HxjlGQEgqsSMOGCmGBf+A==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration": "10.0.9",
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Configuration.FileExtensions": "10.0.9",
-          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.9"
+          "Microsoft.Extensions.Configuration": "10.0.10",
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Configuration.FileExtensions": "10.0.10",
+          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Configuration.UserSecrets": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "ockJRreRW/HbGwoyHzYOxMucFBimvAZ8lKNwQLMHrS6mwkDUaCJMWzzeE+Rm9vgFlv2o/xqk8fm+FpqrDCnkTA==",
+        "resolved": "10.0.10",
+        "contentHash": "1s1sKFTk/Foam64JY6+m/diH8drL3Wx6V3gtSd5v1IEZtszZYyc1pW8uRnMblzpNiR0l0t8gGk7tXj3xHzFgdg==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Configuration.Json": "10.0.9",
-          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.9",
-          "Microsoft.Extensions.FileProviders.Physical": "10.0.9"
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Configuration.Json": "10.0.10",
+          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.10",
+          "Microsoft.Extensions.FileProviders.Physical": "10.0.10"
         }
       },
       "Microsoft.Extensions.DependencyInjection": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "NijozhERJDIaJ4k5TSMy1jOi0cSC2HfkvRD/Sl+kGSSKgVbFnF4GxgtMN/MrzHB8D1JxIrD4xSer9Blh9v3axQ==",
+        "resolved": "10.0.10",
+        "contentHash": "ANyvsgkNBRvcJh2XLgn8veGmajf+8m0AbKK+HPWdRL1yraSNVVSmQhFntLtdz/C795jxqqup+k05cs/3jZQPOA==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10"
         }
       },
       "Microsoft.Extensions.DependencyInjection.Abstractions": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "g41l/30G3K4B/d/L8kjux0+30e27c8D0FVQ/PFCpbekgfDpj9mnDhieP67EqXWvl1EWNeZh2rpR4F5B/jcDOHA=="
+        "resolved": "10.0.10",
+        "contentHash": "z/2xXlFw2aLGjHyEm6E0tQ+In6VfzQzTrtArbQ2c0TQE16ZbyDCMGPvaUT9I0s8rgy9sRWlU2P9waW37qV04qA=="
       },
       "Microsoft.Extensions.Diagnostics": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "NLXI3PbTe39q6/sgs7JYhmfPf7bMzReUoAJ0q9Po6yhfM+0anZa7PrEva4W2SdiLWGyB9eKZS9THGt2BP40xJg==",
+        "resolved": "10.0.10",
+        "contentHash": "Kr/e7lUf4+N8tacbqJ2Ctwe/HarKdAc9ZkgKVVqvtJDBKbez+T/KnUwu82KSlnBp/SrpBcxc7u7xkE2oUZT/5Q==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration": "10.0.9",
-          "Microsoft.Extensions.Diagnostics.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Options.ConfigurationExtensions": "10.0.9"
+          "Microsoft.Extensions.Configuration": "10.0.10",
+          "Microsoft.Extensions.Diagnostics.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Options.ConfigurationExtensions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Diagnostics.Abstractions": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "86RgyFsmVslW4Nu28IXgt8tLglynGQrwjk/xhGZaTe8j6YIeR1Ywoc42hSHsBSl920CQdfqq2dBohZiGm3AkUA==",
+        "resolved": "10.0.10",
+        "contentHash": "9uWiKpeOVac355STyChWR/pliFX/5CeLqChW9kKsaxyDH4EUTZxMkT4Jwp/J/peLm0GBFmSX5c0WCse3yCnq1Q==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Options": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Options": "10.0.10"
         }
       },
       "Microsoft.Extensions.FileProviders.Abstractions": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "Oxn4vqDk+EwceTMpZxVm7L/UZEAM1qIQlNP1+7tBZckD+P4SKrm/5X4gMTPCTdpnau/xY8Sb4/0d6onomSg4ZA==",
+        "resolved": "10.0.10",
+        "contentHash": "c5zqFCY9DiIpMovLd7/d/CTiEtrMOuQ639dhv3PABtKQIKNQikSHwQt8+N679uii9q+B55lgK28Uv64FOwEu8w==",
         "dependencies": {
-          "Microsoft.Extensions.Primitives": "10.0.9"
+          "Microsoft.Extensions.Primitives": "10.0.10"
         }
       },
       "Microsoft.Extensions.FileProviders.Physical": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "zm8WVod4swgprGrkxkuSILlbXqdDRqF+3y6U0I7jlmj4PMyKN6d8pzXZHUn5lr/gZVULzk/+FeTYlTupt6akpg==",
+        "resolved": "10.0.10",
+        "contentHash": "jhJAyo38kSrH3ARvWUk0h8itogVnQu2DCZuPo+s0Z+tXes0ugTxMPaHYzap85785eHQmPFqD9TYERqBbtGxn/w==",
         "dependencies": {
-          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.9",
-          "Microsoft.Extensions.FileSystemGlobbing": "10.0.9",
-          "Microsoft.Extensions.Primitives": "10.0.9"
+          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.10",
+          "Microsoft.Extensions.FileSystemGlobbing": "10.0.10",
+          "Microsoft.Extensions.Primitives": "10.0.10"
         }
       },
       "Microsoft.Extensions.FileSystemGlobbing": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "mvRf9qOH/LslWIee/h+lsElnoUyKotEwoPL31soqScmO/eoxObaTCLCdx2DdqPdRi9LnB+7qKZ49jfyrLZuc+w=="
+        "resolved": "10.0.10",
+        "contentHash": "jSOCVxEwCd4Aq925kJVz1kSO1EpX2OHYKL04qVREXkDU7Ce3pVDdHPYm+fEy8y/th2kJf/DAstRHpJAqoNWP8w=="
       },
       "Microsoft.Extensions.Hosting.Abstractions": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "Xd/2F+uWblTiUp+ssaDZN2ea4vmnHmW6PXugmqBHumyhqVkyeh6RJ3S2Zo/F+1bXIL/KuGqe2pKv6UiGOc1KeQ==",
+        "resolved": "10.0.10",
+        "contentHash": "5LugpYGHk+mkn0a8IZgcyfBca8PCTAU9RQFoMrTdtOOidq88M2SI5f3px6ugnzgxC+eTkvYYJi8pzlUnG5xdAQ==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9",
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Diagnostics.Abstractions": "10.0.9",
-          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging.Abstractions": "10.0.9"
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Diagnostics.Abstractions": "10.0.10",
+          "Microsoft.Extensions.FileProviders.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging.Abstractions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Logging": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "N7Gm9SjugYjmmnhwbBKC9DFqGqjfJvh6YfOJgtwh0AW0Xpok3dIVors1ik050XmUxKAgAc7nNngDIJyFb06K2g==",
+        "resolved": "10.0.10",
+        "contentHash": "Tf6z5HsL0VDYRTfvsoNrTGHGheCwkTsZBA2FFh5ATJUbkAwug+FFNISJK2gjpUNemlAOoWllAK52HOWCjto3EQ==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection": "10.0.9",
-          "Microsoft.Extensions.Logging.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Options": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection": "10.0.10",
+          "Microsoft.Extensions.Logging.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Options": "10.0.10"
         }
       },
       "Microsoft.Extensions.Logging.Abstractions": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "9S/DFt4cohlMPpzIxjG6kk0L8MuN2vDm9pbMCulxtJzzk82oJHVLBd8vuQxaPskaYQwKqmFmbannf5eoChgjYg==",
+        "resolved": "10.0.10",
+        "contentHash": "zkFxGYUvdxAvIKTyXHrmW+Sux53D4SezD9dMyZ6hrwwzPQJNuwCRy1f5W7AvYTqacEGhWF2XderRQG1OvbV8og==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Logging.Configuration": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "bUth5ip7YsZMXWZS42IRTI0zDrPEqdE+xnsmcL0Pk784grWKApDvc5UoMi2tP2qYJ5ylFzeVDuDu08sFATq1bg==",
+        "resolved": "10.0.10",
+        "contentHash": "cLrqxkuEfcilZ8SjK+9KAnpLk9lOoMPaOokF+wRUYie+iUEcdX4/p/+gJkt0BYgWLthjpBUCkVTBI6Kxg0nsOw==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration": "10.0.9",
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Configuration.Binder": "10.0.9",
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging": "10.0.9",
-          "Microsoft.Extensions.Logging.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Options": "10.0.9",
-          "Microsoft.Extensions.Options.ConfigurationExtensions": "10.0.9"
+          "Microsoft.Extensions.Configuration": "10.0.10",
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Configuration.Binder": "10.0.10",
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging": "10.0.10",
+          "Microsoft.Extensions.Logging.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Options": "10.0.10",
+          "Microsoft.Extensions.Options.ConfigurationExtensions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Logging.Console": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "WyZEG/O8jKqBOBF6/M6IJqiEyWFBUv6PDyzNoXDA0mBZwKtkuf7GiZ/0/8eU8OpLKKQL0O95oPOY1szrWIKofQ==",
+        "resolved": "10.0.10",
+        "contentHash": "VIlNzPwPS0GeQVSmCqqo36ugryX3LpE9ul6gEkks5VLET3weH/XMLeWmclwfoGn4Nxi2mwVibB+OZBVJ9tDqvg==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging": "10.0.9",
-          "Microsoft.Extensions.Logging.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging.Configuration": "10.0.9",
-          "Microsoft.Extensions.Options": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging": "10.0.10",
+          "Microsoft.Extensions.Logging.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging.Configuration": "10.0.10",
+          "Microsoft.Extensions.Options": "10.0.10"
         }
       },
       "Microsoft.Extensions.Logging.Debug": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "r/A0ahpXmZH/8ltPjrFFWp12BIizK9cCVJXPcHyOad8e4eIX7P/geW+uBYdczkeCAaMebT4jEU7snOm4GnmKfA==",
+        "resolved": "10.0.10",
+        "contentHash": "8+TZBnV5fgBXoVNJ5ROSErUwYogk4hOgV7c2HWK1u5cqKGmiUTUn7+KqZ35iQu8e/B7Ykccyz5OTjdXcidNZ9g==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging": "10.0.9",
-          "Microsoft.Extensions.Logging.Abstractions": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging": "10.0.10",
+          "Microsoft.Extensions.Logging.Abstractions": "10.0.10"
         }
       },
       "Microsoft.Extensions.Logging.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "goAl30/WwmdnWDPRwATaDPIK0iuDBnQSMTH2XYGVB1SwReg7hglhvDNjjpNhT25US3GF4I5q6BhTNs6nFYzEfg==",
+        "resolved": "10.0.10",
+        "contentHash": "0RE4951AzQ+YD4gVrvbq0BhdsiBgSDo44yM7+QBZ2mrmMJeNjY+teCIYfUjqDPVYnKs0HR6SkkhgrX1YgXZq3Q==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging": "10.0.9",
-          "Microsoft.Extensions.Logging.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Options": "10.0.9",
-          "System.Diagnostics.EventLog": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging": "10.0.10",
+          "Microsoft.Extensions.Logging.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Options": "10.0.10",
+          "System.Diagnostics.EventLog": "10.0.10"
         }
       },
       "Microsoft.Extensions.Logging.EventSource": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "tHynPVHbTicuaDpS2JVTxX0qA5VTg15CXgVKTwWvvudb5BvW5aVew8MMyek6LrDGAom7UbON1jf1T5GhpTilFA==",
+        "resolved": "10.0.10",
+        "contentHash": "85SAPwXhJtdBInzN2k7SChiFiBGh3KOWay5AfoY+GREF6P7oZA98+ST2p7Z9384iLKYjkZSKIZ/FqIO5aojtNw==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Logging": "10.0.9",
-          "Microsoft.Extensions.Logging.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Options": "10.0.9",
-          "Microsoft.Extensions.Primitives": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Logging": "10.0.10",
+          "Microsoft.Extensions.Logging.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Options": "10.0.10",
+          "Microsoft.Extensions.Primitives": "10.0.10"
         }
       },
       "Microsoft.Extensions.Options": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "hyNdX4c2UwkRkzb9byw0H2DQkRzwBM3mzY2sCM9egwzTyg8dvQJmp5noQHGEaaCORQrNK3DD2gREBsc2DlXS4A==",
+        "resolved": "10.0.10",
+        "contentHash": "srnhnk7nE8krBiIXp71LvBmKBtraBONWSRzdjJgRv1Ko9Mp8IVNqv4vIS9hGeVteBig8aQkva9ZG+sC+o5sVcA==",
         "dependencies": {
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Primitives": "10.0.9"
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Primitives": "10.0.10"
         }
       },
       "Microsoft.Extensions.Options.ConfigurationExtensions": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "Y4E24zffF/aPS0igNvY6ZzAQfbxd6AYdC9L4brnH+uK0yYYHIR6FeGVQVVjAOo8wub1EQDl2B90lCcpqoTF7Yw==",
+        "resolved": "10.0.10",
+        "contentHash": "tnBmu/LwF25ZQK+HBNCu2xrwnkKoB/XEbJyooGGoYxHrhvxbSKi7eOFiJ4AXBy/QU4vtCvCJfoi8k9Ej72qzOQ==",
         "dependencies": {
-          "Microsoft.Extensions.Configuration.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Configuration.Binder": "10.0.9",
-          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.9",
-          "Microsoft.Extensions.Options": "10.0.9",
-          "Microsoft.Extensions.Primitives": "10.0.9"
+          "Microsoft.Extensions.Configuration.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Configuration.Binder": "10.0.10",
+          "Microsoft.Extensions.DependencyInjection.Abstractions": "10.0.10",
+          "Microsoft.Extensions.Options": "10.0.10",
+          "Microsoft.Extensions.Primitives": "10.0.10"
         }
       },
       "Microsoft.Extensions.Primitives": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "fmEbAUFsaIKirgLt/lYhuFRBwhcSJN31jjHgCdbQxJiWOum6EdLjkbgGuukSP9z/a+9LibaxII/kF+GwOXgC4g=="
+        "resolved": "10.0.10",
+        "contentHash": "5wu/GrYVd8mG2DVUw3vFJzF+O336TyTGg/Kmcgw9bfwYhCoFiV5lR5QeEmKecJyrW4W54nMfD3p3589E8a7czQ=="
       },
       "Microsoft.NET.StringTools": {
         "type": "Transitive",
@@ -584,8 +579,8 @@
       },
       "ModelContextProtocol.Core": {
         "type": "Transitive",
-        "resolved": "1.4.0",
-        "contentHash": "6ZJFQTgYwdu0IacUUTNExAY2Z+JFuTd10CPeORalQtuGPY4hdUqq0BXxTpNEP0n7ajruNsGXyCKQLP0erIZmog==",
+        "resolved": "1.4.1",
+        "contentHash": "G/hOBZkJsvF3MSy0sOvXdxca5uRe2Sb4xk7xRuTWNZI45khVBjOLo6nSzGilctIICavNVxbxUF908fLYI9RxkQ==",
         "dependencies": {
           "Microsoft.Extensions.AI.Abstractions": "10.5.2",
           "Microsoft.Extensions.Logging.Abstractions": "10.0.7"
@@ -622,8 +617,8 @@
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "s2PcxHK4IYQ6gmD3VSBkym9tWGkFisKjcjWBdl7a+n4Yy66ae4beJ1ZdjDp060SSll4W3Rt4H2LW87dWckv+QQ=="
+        "resolved": "10.0.10",
+        "contentHash": "OvGz3PrzuAI/Sj7LTcXcCe3FClRI1IyRMZjNONcZtFh+Ww7nAtSh4kh08r8KVe/xxkXJPjR0Y1jF7H+N42d4xQ=="
       },
       "System.Formats.Nrbf": {
         "type": "Transitive",
@@ -656,7 +651,7 @@
       "verifiable.cbor": {
         "type": "Project",
         "dependencies": {
-          "System.Formats.Cbor": "[10.0.9, )",
+          "System.Formats.Cbor": "[10.0.10, )",
           "Verifiable.Core": "[0.0.0, )",
           "Verifiable.Fido2": "[0.0.0, )",
           "Verifiable.Foundation": "[0.0.0, )",
@@ -733,7 +728,7 @@
       "verifiable.microsoft": {
         "type": "Project",
         "dependencies": {
-          "System.Security.Cryptography.ProtectedData": "[10.0.9, )",
+          "System.Security.Cryptography.ProtectedData": "[10.0.10, )",
           "Verifiable.Core": "[0.0.0, )",
           "Verifiable.Foundation": "[0.0.0, )"
         }
@@ -778,6 +773,12 @@
           "Verifiable.Server": "[0.0.0, )"
         }
       },
+      "AngleSharp": {
+        "type": "CentralTransitive",
+        "requested": "[1.5.2, )",
+        "resolved": "1.5.2",
+        "contentHash": "LVZ7rrr6GHbhERhTgVDarVygl1e6KwE96pronA90LBOMacDhxR4lB+xYLjn/vlnUu+xbOB2RM9fuCPEx5bdyWA=="
+      },
       "Lumoin.Base": {
         "type": "CentralTransitive",
         "requested": "[0.0.6, )",
@@ -826,15 +827,15 @@
       },
       "System.Formats.Cbor": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "1iRjljxTMvQ1EtArg6kkj+9PV5LthrtlH//GM+MLez5L9jmZFDXGoH9lNiUpOeYY3sB60CgFVRnGctcmHEKqRw=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "V8XZBZsORS+NMhM5hc7doU0wKgDe0lJaaUkZGlAgpbYqN5Pd11I3pxwoRQgEyUVbDri/+qm7YCp49gCTYcbqJQ=="
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
@@ -849,8 +850,8 @@
     "net10.0/any": {
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "s2PcxHK4IYQ6gmD3VSBkym9tWGkFisKjcjWBdl7a+n4Yy66ae4beJ1ZdjDp060SSll4W3Rt4H2LW87dWckv+QQ=="
+        "resolved": "10.0.10",
+        "contentHash": "OvGz3PrzuAI/Sj7LTcXcCe3FClRI1IyRMZjNONcZtFh+Ww7nAtSh4kh08r8KVe/xxkXJPjR0Y1jF7H+N42d4xQ=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
@@ -861,22 +862,22 @@
     "net10.0/linux-arm64": {
       "Microsoft.DotNet.ILCompiler": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4y+VsQOcs4EiTSINdCpCWi/aLRbIbGTxSezQXd8uGVhzbDRm1FNVTZDyCUQixE0+g9UFusvfxVcF68YYz7RzxA==",
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "tnG8ntt/Bk6odvHREnGLMo3PEiihy5iSlIFVp0JbIo00GKtNRt2k73eKZbPqR5yaJNIa3z8R86YLwbxfqpb17g==",
         "dependencies": {
-          "runtime.linux-arm64.Microsoft.DotNet.ILCompiler": "10.0.9"
+          "runtime.linux-arm64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
       "runtime.linux-arm64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "vWHjdp8AigWtntyPFjOeXYIWkFxWb8C+9+U0YTYFbS1hNsRBVeajaM+4FaVQ1rSAf+13BhA49iCnzIPdxfb/sg=="
+        "resolved": "10.0.10",
+        "contentHash": "FXDMdhzRF0cb0rBz3UTwE8yK7N/SGfleK7DSRpnqMdrJ5C05qoAtxvZoovZXzq2kqgPcE+6ryFcHq224HdOU0w=="
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "s2PcxHK4IYQ6gmD3VSBkym9tWGkFisKjcjWBdl7a+n4Yy66ae4beJ1ZdjDp060SSll4W3Rt4H2LW87dWckv+QQ=="
+        "resolved": "10.0.10",
+        "contentHash": "OvGz3PrzuAI/Sj7LTcXcCe3FClRI1IyRMZjNONcZtFh+Ww7nAtSh4kh08r8KVe/xxkXJPjR0Y1jF7H+N42d4xQ=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
@@ -887,22 +888,22 @@
     "net10.0/linux-x64": {
       "Microsoft.DotNet.ILCompiler": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4y+VsQOcs4EiTSINdCpCWi/aLRbIbGTxSezQXd8uGVhzbDRm1FNVTZDyCUQixE0+g9UFusvfxVcF68YYz7RzxA==",
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "tnG8ntt/Bk6odvHREnGLMo3PEiihy5iSlIFVp0JbIo00GKtNRt2k73eKZbPqR5yaJNIa3z8R86YLwbxfqpb17g==",
         "dependencies": {
-          "runtime.linux-x64.Microsoft.DotNet.ILCompiler": "10.0.9"
+          "runtime.linux-x64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
       "runtime.linux-x64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "45CVefG8S0eUKUJ4LBWOi8FOAgMJOP6exW9l5M9OjvQaGR7jvkokBK50XaZCsO66uLxABcuzvncV8A3YiJLUgw=="
+        "resolved": "10.0.10",
+        "contentHash": "WRjSRBfv6A6UjgjO8EQuLe9xqdICpkQx1hACUziCw4B2uGL+2jVhkFLq/G7rxRr3MGvqLo9B+nNdfIJ/5CYN7A=="
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "s2PcxHK4IYQ6gmD3VSBkym9tWGkFisKjcjWBdl7a+n4Yy66ae4beJ1ZdjDp060SSll4W3Rt4H2LW87dWckv+QQ=="
+        "resolved": "10.0.10",
+        "contentHash": "OvGz3PrzuAI/Sj7LTcXcCe3FClRI1IyRMZjNONcZtFh+Ww7nAtSh4kh08r8KVe/xxkXJPjR0Y1jF7H+N42d4xQ=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
@@ -913,22 +914,22 @@
     "net10.0/osx-arm64": {
       "Microsoft.DotNet.ILCompiler": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4y+VsQOcs4EiTSINdCpCWi/aLRbIbGTxSezQXd8uGVhzbDRm1FNVTZDyCUQixE0+g9UFusvfxVcF68YYz7RzxA==",
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "tnG8ntt/Bk6odvHREnGLMo3PEiihy5iSlIFVp0JbIo00GKtNRt2k73eKZbPqR5yaJNIa3z8R86YLwbxfqpb17g==",
         "dependencies": {
-          "runtime.osx-arm64.Microsoft.DotNet.ILCompiler": "10.0.9"
+          "runtime.osx-arm64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
       "runtime.osx-arm64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "iBYS9b/8OjTjD/5J9ljvme5AlWAY8+stxjdHXwwxD6ONMQezxqnqIJSl9+7z88PTBHzuyhtkIYPoXA/LzXX9oA=="
+        "resolved": "10.0.10",
+        "contentHash": "cY7edFqVviQMiSvPodJeLZhF6k56grh0QsvcR+2foAUgO0xXsMsVBQiHcZkeiIbhr+SPIklq90OZiJ7JVrc+Dg=="
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "s2PcxHK4IYQ6gmD3VSBkym9tWGkFisKjcjWBdl7a+n4Yy66ae4beJ1ZdjDp060SSll4W3Rt4H2LW87dWckv+QQ=="
+        "resolved": "10.0.10",
+        "contentHash": "OvGz3PrzuAI/Sj7LTcXcCe3FClRI1IyRMZjNONcZtFh+Ww7nAtSh4kh08r8KVe/xxkXJPjR0Y1jF7H+N42d4xQ=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
@@ -939,22 +940,22 @@
     "net10.0/osx-x64": {
       "Microsoft.DotNet.ILCompiler": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4y+VsQOcs4EiTSINdCpCWi/aLRbIbGTxSezQXd8uGVhzbDRm1FNVTZDyCUQixE0+g9UFusvfxVcF68YYz7RzxA==",
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "tnG8ntt/Bk6odvHREnGLMo3PEiihy5iSlIFVp0JbIo00GKtNRt2k73eKZbPqR5yaJNIa3z8R86YLwbxfqpb17g==",
         "dependencies": {
-          "runtime.osx-x64.Microsoft.DotNet.ILCompiler": "10.0.9"
+          "runtime.osx-x64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
       "runtime.osx-x64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "trOaxu3DDP07iuxaHd3FRSbgu7ecOd1X9uOQ9C1B0oc71I7UprwOVgDE11UiYTeupinaBRbD4c6X40K6CFzL0g=="
+        "resolved": "10.0.10",
+        "contentHash": "DXe6/ieqrY1WDme/Ilv+VaQoGqxFgT+oQgdJuP++pyGMtjx/o/mWIjk0OldcRve4KUoVylx9f6meNSsE28Obug=="
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "s2PcxHK4IYQ6gmD3VSBkym9tWGkFisKjcjWBdl7a+n4Yy66ae4beJ1ZdjDp060SSll4W3Rt4H2LW87dWckv+QQ=="
+        "resolved": "10.0.10",
+        "contentHash": "OvGz3PrzuAI/Sj7LTcXcCe3FClRI1IyRMZjNONcZtFh+Ww7nAtSh4kh08r8KVe/xxkXJPjR0Y1jF7H+N42d4xQ=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
@@ -965,22 +966,22 @@
     "net10.0/win-arm64": {
       "Microsoft.DotNet.ILCompiler": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4y+VsQOcs4EiTSINdCpCWi/aLRbIbGTxSezQXd8uGVhzbDRm1FNVTZDyCUQixE0+g9UFusvfxVcF68YYz7RzxA==",
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "tnG8ntt/Bk6odvHREnGLMo3PEiihy5iSlIFVp0JbIo00GKtNRt2k73eKZbPqR5yaJNIa3z8R86YLwbxfqpb17g==",
         "dependencies": {
-          "runtime.win-arm64.Microsoft.DotNet.ILCompiler": "10.0.9"
+          "runtime.win-arm64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
       "runtime.win-arm64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "izp7qOY/jJ7NDIDGiBcSyfNwglAPGWeW3F2Q9HxlLKvh65lZVSri+rol7mSjsFd6LQ5UNGhCeKZQkKoacTKSbw=="
+        "resolved": "10.0.10",
+        "contentHash": "d/QREDGqcO2gqWLL1V1oRpMXdp75yGZ1ULuJJXSaw7pn8/VTgkylM/7Vtkb0W/vrFe49Sq+yfoZQv8Bie5Tkww=="
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "s2PcxHK4IYQ6gmD3VSBkym9tWGkFisKjcjWBdl7a+n4Yy66ae4beJ1ZdjDp060SSll4W3Rt4H2LW87dWckv+QQ=="
+        "resolved": "10.0.10",
+        "contentHash": "OvGz3PrzuAI/Sj7LTcXcCe3FClRI1IyRMZjNONcZtFh+Ww7nAtSh4kh08r8KVe/xxkXJPjR0Y1jF7H+N42d4xQ=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
@@ -991,22 +992,22 @@
     "net10.0/win-x64": {
       "Microsoft.DotNet.ILCompiler": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4y+VsQOcs4EiTSINdCpCWi/aLRbIbGTxSezQXd8uGVhzbDRm1FNVTZDyCUQixE0+g9UFusvfxVcF68YYz7RzxA==",
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "tnG8ntt/Bk6odvHREnGLMo3PEiihy5iSlIFVp0JbIo00GKtNRt2k73eKZbPqR5yaJNIa3z8R86YLwbxfqpb17g==",
         "dependencies": {
-          "runtime.win-x64.Microsoft.DotNet.ILCompiler": "10.0.9"
+          "runtime.win-x64.Microsoft.DotNet.ILCompiler": "10.0.10"
         }
       },
       "runtime.win-x64.Microsoft.DotNet.ILCompiler": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "UEY5D3CvpctP5tcewYlnFS8JNReAEFTfAs//ZN733Oq9BXbTSZBCmBWnCs8JKgduHHa3u4oJ9ehfrZzV1xOFNA=="
+        "resolved": "10.0.10",
+        "contentHash": "e5P00ObvdmAl49KkvGvqDLE5+EXu/IdXCDsLghgKFXKrNybyxMmH12HuGrsO7LTIGjXI58tyN3Hwxwr/MR0d8A=="
       },
       "System.Diagnostics.EventLog": {
         "type": "Transitive",
-        "resolved": "10.0.9",
-        "contentHash": "s2PcxHK4IYQ6gmD3VSBkym9tWGkFisKjcjWBdl7a+n4Yy66ae4beJ1ZdjDp060SSll4W3Rt4H2LW87dWckv+QQ=="
+        "resolved": "10.0.10",
+        "contentHash": "OvGz3PrzuAI/Sj7LTcXcCe3FClRI1IyRMZjNONcZtFh+Ww7nAtSh4kh08r8KVe/xxkXJPjR0Y1jF7H+N42d4xQ=="
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Transitive",
diff --git a/test/Verifiable.Benchmarks/packages.lock.json b/test/Verifiable.Benchmarks/packages.lock.json
index cd8ab44d..54660990 100644
--- a/test/Verifiable.Benchmarks/packages.lock.json
+++ b/test/Verifiable.Benchmarks/packages.lock.json
@@ -28,9 +28,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Sbom.Targets": {
         "type": "Direct",
@@ -352,9 +352,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "CentralTransitive",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "System.Security.Cryptography.Xml": {
         "type": "CentralTransitive",
diff --git a/test/Verifiable.Tests/Acdc/AcdcAggregateDisclosureFlowTests.cs b/test/Verifiable.Tests/Acdc/AcdcAggregateDisclosureFlowTests.cs
index c12eb230..52c0efc6 100644
--- a/test/Verifiable.Tests/Acdc/AcdcAggregateDisclosureFlowTests.cs
+++ b/test/Verifiable.Tests/Acdc/AcdcAggregateDisclosureFlowTests.cs
@@ -55,7 +55,7 @@ public async Task SelectiveAggregateDisclosureVerifiesAcrossIssuerAndDiscloserSo
             issuer.Publish("/kel", AcdcFlowKit.SerializeKel(kel), "application/json");
             discloser.Publish("/acdc", acdc.Disclosed.Serialization, "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([issuer.Certificate, discloser.Certificate]);
 
             //Fetch the selective disclosure and fold it into a typed ACDC: the top-level reader now reads the
             //aggregate section 'A' as a first-class section into AcdcMessage.Aggregate.
@@ -124,7 +124,7 @@ public async Task TamperedRevealedBlockFailsSelectiveDisclosureAcrossWire()
             await using StaticContentHost discloser = await StaticContentHost.StartAsync(cancellationToken).ConfigureAwait(false);
             discloser.Publish("/acdc", Encoding.UTF8.GetBytes(tampered), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(discloser.Certificate);
             string json = await httpClient.GetStringAsync(new Uri(discloser.BaseAddress, "/acdc"), cancellationToken).ConfigureAwait(false);
             using AcdcTestSupport.EncodedSerialization credential = AcdcTestSupport.Encode(json);
             MessageFieldMap map = AcdcJson.DecodeFieldMap(credential.Memory);
diff --git a/test/Verifiable.Tests/Acdc/AcdcDi2iChainFlowTests.cs b/test/Verifiable.Tests/Acdc/AcdcDi2iChainFlowTests.cs
index 0791a1c4..926df9a1 100644
--- a/test/Verifiable.Tests/Acdc/AcdcDi2iChainFlowTests.cs
+++ b/test/Verifiable.Tests/Acdc/AcdcDi2iChainFlowTests.cs
@@ -90,7 +90,7 @@ private async Task<bool> RunDi2iChainAsync(bool brokenDelegation)
             delegatorHost.Publish("/acdc", delegator.Acdc.Serialization, "application/json");
             delegatorHost.Publish("/kel", AcdcFlowKit.SerializeKel(delegator.Kel), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([delegateHost.Certificate, delegatorHost.Certificate]);
 
             //Verify the far credential (the delegator's) and capture the delegator's verified KEL anchors. The
             //delegator self-issues, so its KEL carries no delegated event and needs no delegating-seal resolver.
diff --git a/test/Verifiable.Tests/Acdc/AcdcDisclosureFlowTests.cs b/test/Verifiable.Tests/Acdc/AcdcDisclosureFlowTests.cs
index 40bc0f65..f29cb8f4 100644
--- a/test/Verifiable.Tests/Acdc/AcdcDisclosureFlowTests.cs
+++ b/test/Verifiable.Tests/Acdc/AcdcDisclosureFlowTests.cs
@@ -58,7 +58,7 @@ public async Task DisclosedAcdcVerifiesAcrossIssuerAndDiscloserSockets()
             issuer.Publish("/kel", AcdcFlowKit.SerializeKel(kel), "application/json");
             discloser.Publish("/acdc", acdc.Serialization, "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([issuer.Certificate, discloser.Certificate]);
 
             //Proof of Disclosure: fetch the credential from the Discloser and verify its SAID over the received bytes.
             string credentialJson = await httpClient.GetStringAsync(new Uri(discloser.BaseAddress, "/acdc"), cancellationToken).ConfigureAwait(false);
@@ -107,7 +107,7 @@ public async Task TamperedCredentialFailsProofOfDisclosure()
             Assert.AreNotEqual(original, tampered, "The tamper must alter the served bytes.");
             discloser.Publish("/acdc", Encoding.UTF8.GetBytes(tampered), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(discloser.Certificate);
             string credentialJson = await httpClient.GetStringAsync(new Uri(discloser.BaseAddress, "/acdc"), cancellationToken).ConfigureAwait(false);
             using AcdcTestSupport.EncodedSerialization credential = AcdcTestSupport.Encode(credentialJson);
 
@@ -141,7 +141,7 @@ public async Task UnanchoredCredentialFailsProofOfIssuance()
             await using StaticContentHost issuer = await StaticContentHost.StartAsync(cancellationToken).ConfigureAwait(false);
             issuer.Publish("/kel", AcdcFlowKit.SerializeKel(otherKel), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(issuer.Certificate);
             AcdcMessage message = AcdcReader.Read(AcdcJson.DecodeFieldMap(acdc.Serialization));
 
             KeriDigestSeal? issuanceSeal = await VerifyIssuanceAsync(httpClient, issuer.BaseAddress, message, disposables, cancellationToken).ConfigureAwait(false);
diff --git a/test/Verifiable.Tests/Acdc/AcdcEdgeChainFlowTests.cs b/test/Verifiable.Tests/Acdc/AcdcEdgeChainFlowTests.cs
index 776cda39..ef1aa892 100644
--- a/test/Verifiable.Tests/Acdc/AcdcEdgeChainFlowTests.cs
+++ b/test/Verifiable.Tests/Acdc/AcdcEdgeChainFlowTests.cs
@@ -82,7 +82,7 @@ private async Task<bool> RunEdgeChainAsync(bool brokenChain)
             farIssuer.Publish("/acdc", far.Acdc.Serialization, "application/json");
             farIssuer.Publish("/kel", AcdcFlowKit.SerializeKel(far.Kel), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([nearIssuer.Certificate, farIssuer.Certificate]);
 
             //Verify the near credential and read its edge section.
             AcdcMessage? nearMessage = await VerifyAcdcAsync(httpClient, BaseOf(nearIssuer, "/acdc"), BaseOf(nearIssuer, "/kel"), disposables, cancellationToken).ConfigureAwait(false);
diff --git a/test/Verifiable.Tests/Acdc/AcdcGraduatedDisclosureFlowTests.cs b/test/Verifiable.Tests/Acdc/AcdcGraduatedDisclosureFlowTests.cs
index 2fea7afc..dcc6e510 100644
--- a/test/Verifiable.Tests/Acdc/AcdcGraduatedDisclosureFlowTests.cs
+++ b/test/Verifiable.Tests/Acdc/AcdcGraduatedDisclosureFlowTests.cs
@@ -59,7 +59,7 @@ public async Task GraduatedDisclosureVerifiesBothVariantsToOneCommittedSaidAcros
             discloser.Publish("/acdc/compact", graduated.Compact.Serialization, "application/json");
             discloser.Publish("/acdc/expanded", graduated.Expanded.Serialization, "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([issuer.Certificate, discloser.Certificate]);
 
             //Proof of Disclosure for each variant: the received form compacts to the top-level SAID it claims.
             (AcdcMessage compactMessage, string compactCompactedSaid) = await FetchAndCompactAsync(httpClient, new Uri(discloser.BaseAddress, "/acdc/compact"), cancellationToken).ConfigureAwait(false);
@@ -125,7 +125,7 @@ public async Task TamperedExpandedDisclosureFailsProofOfDisclosureAcrossWire()
             await using StaticContentHost discloser = await StaticContentHost.StartAsync(cancellationToken).ConfigureAwait(false);
             discloser.Publish("/acdc/expanded", Encoding.UTF8.GetBytes(tampered), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(discloser.Certificate);
             (AcdcMessage message, string compactedSaid) = await FetchAndCompactAsync(httpClient, new Uri(discloser.BaseAddress, "/acdc/expanded"), cancellationToken).ConfigureAwait(false);
 
             Assert.AreEqual(graduated.Said, message.Said, "The tamper leaves the claimed SAID in place; only the disclosed value changed.");
diff --git a/test/Verifiable.Tests/Acdc/AcdcIpexExchangeFlowTests.cs b/test/Verifiable.Tests/Acdc/AcdcIpexExchangeFlowTests.cs
index b9e90f31..3c213a2e 100644
--- a/test/Verifiable.Tests/Acdc/AcdcIpexExchangeFlowTests.cs
+++ b/test/Verifiable.Tests/Acdc/AcdcIpexExchangeFlowTests.cs
@@ -59,7 +59,7 @@ public async Task IpexGrantAdmitExchangeVerifiesAcrossDiscloserAndDdiscloseeSock
             discloser.Publish("/ipex/grant", grant.Serialization, "application/json");
             discloser.Publish("/kel", AcdcFlowKit.SerializeKel(kel), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([discloser.Certificate, disclosee.Certificate]);
 
             //The Disclosee fetches and verifies the grant envelope, then proves the credential it embeds.
             string grantSaid = await VerifyGrantAndProveCredentialAsync(httpClient, discloser.BaseAddress, credentialSaid, issuerAid, disposables, cancellationToken).ConfigureAwait(false);
@@ -115,7 +115,7 @@ public async Task TamperedGrantEnvelopeIsRejectedAcrossWire()
             await using StaticContentHost discloser = await StaticContentHost.StartAsync(cancellationToken).ConfigureAwait(false);
             discloser.Publish("/ipex/grant", Encoding.UTF8.GetBytes(tampered), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(discloser.Certificate);
             string fetched = await httpClient.GetStringAsync(new Uri(discloser.BaseAddress, "/ipex/grant"), cancellationToken).ConfigureAwait(false);
             using AcdcTestSupport.EncodedSerialization grantBytes = AcdcTestSupport.Encode(fetched);
 
diff --git a/test/Verifiable.Tests/Acdc/AcdcRegistryFlowTests.cs b/test/Verifiable.Tests/Acdc/AcdcRegistryFlowTests.cs
index cdceffc9..6e8b73e9 100644
--- a/test/Verifiable.Tests/Acdc/AcdcRegistryFlowTests.cs
+++ b/test/Verifiable.Tests/Acdc/AcdcRegistryFlowTests.cs
@@ -52,7 +52,7 @@ public async Task IssuedCredentialVerifiesWithRegistryStateAcrossWire()
             issuer.Publish("/registry", AcdcFlowKit.SerializeRegistry(registry), "application/json");
             discloser.Publish("/acdc", acdc.Serialization, "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([issuer.Certificate, discloser.Certificate]);
 
             //Proof of Disclosure, and the credential's registry reference.
             string credentialJson = await httpClient.GetStringAsync(new Uri(discloser.BaseAddress, "/acdc"), cancellationToken).ConfigureAwait(false);
@@ -101,7 +101,7 @@ public async Task RevokedCredentialIsRejectedByRegistryStateAcrossWire()
             await using StaticContentHost issuer = await StaticContentHost.StartAsync(cancellationToken).ConfigureAwait(false);
             issuer.Publish("/registry", AcdcFlowKit.SerializeRegistry(registry), "application/json");
 
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(issuer.Certificate);
             AcdcMessage message = AcdcReader.Read(AcdcJson.DecodeFieldMap(acdc.Serialization));
 
             (string registrySaid, string? state) = await VerifyRegistryStateAsync(httpClient, issuer.BaseAddress, message, cancellationToken).ConfigureAwait(false);
diff --git a/test/Verifiable.Tests/Core/HttpCacheFreshnessTests.cs b/test/Verifiable.Tests/Core/HttpCacheFreshnessTests.cs
new file mode 100644
index 00000000..7c7ecb7e
--- /dev/null
+++ b/test/Verifiable.Tests/Core/HttpCacheFreshnessTests.cs
@@ -0,0 +1,348 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using Verifiable.Core.OutboundFetch;
+
+namespace Verifiable.Tests.Core;
+
+/// <summary>
+/// Known-answer tests for <see cref="HttpCacheFreshness.Compute(OutboundResponse)"/> against
+/// the RFC 9111 subset it implements: <c>Cache-Control</c> <c>no-store</c>/<c>no-cache</c>/
+/// <c>max-age</c>/<c>s-maxage</c>, the <c>Age</c> header, and the <c>Expires</c>/<c>Date</c>
+/// fallback. Every case is header-only input to a pure function — no clock, no network.
+/// </summary>
+[TestClass]
+internal sealed class HttpCacheFreshnessTests
+{
+    [TestMethod]
+    public void NoStoreIsNotStorable()
+    {
+        OutboundResponse response = Response(("Cache-Control", "no-store"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsFalse(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void NoStoreWinsOverMaxAge()
+    {
+        OutboundResponse response = Response(("Cache-Control", "max-age=300, no-store"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsFalse(result.IsStorable, "no-store is the most restrictive directive present.");
+    }
+
+
+    [TestMethod]
+    public void NoCacheIsStorableWithZeroFreshnessAndMustRevalidate()
+    {
+        OutboundResponse response = Response(("Cache-Control", "no-cache"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable, "no-cache still allows the entry to be kept as a validation target.");
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+        Assert.IsTrue(result.MustRevalidate, "no-cache requires revalidation before every reuse (RFC 9111 §5.2.2.4).");
+    }
+
+
+    [TestMethod]
+    public void MustRevalidateIsFalseWithoutNoCache()
+    {
+        OutboundResponse response = Response(("Cache-Control", "max-age=300"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsFalse(result.MustRevalidate, "A positive header lifetime is not a must-revalidate response.");
+    }
+
+
+    [TestMethod]
+    public void MustRevalidateIsFalseWhenNoExpirationSignalIsPresent()
+    {
+        OutboundResponse response = Response(("Content-Type", "application/json"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsFalse(result.MustRevalidate,
+            "An absent expiration signal is heuristic-eligible, distinct from an explicit no-cache.");
+    }
+
+
+    [TestMethod]
+    public void NoCacheWinsOverMaxAge()
+    {
+        OutboundResponse response = Response(("Cache-Control", "max-age=300, no-cache"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime, "no-cache is the most restrictive directive present.");
+    }
+
+
+    [TestMethod]
+    public void MaxAgeAloneYieldsFreshnessLifetime()
+    {
+        OutboundResponse response = Response(("Cache-Control", "max-age=300"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.FromSeconds(300), result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void MaxAgeWithAgeHeaderSubtractsElapsedTime()
+    {
+        OutboundResponse response = Response(
+            ("Cache-Control", "max-age=300"),
+            ("Age", "100"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.AreEqual(TimeSpan.FromSeconds(200), result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void AgeGreaterThanMaxAgeClampsToZeroRatherThanNegative()
+    {
+        OutboundResponse response = Response(
+            ("Cache-Control", "max-age=60"),
+            ("Age", "9000"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void SharedMaxAgeOverridesMaxAge()
+    {
+        OutboundResponse response = Response(("Cache-Control", "max-age=300, s-maxage=60"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.AreEqual(TimeSpan.FromSeconds(60), result.FreshnessLifetime,
+            "s-maxage overrides max-age for a shared-cache consumer (RFC 9111 §5.2.2.10).");
+    }
+
+
+    [TestMethod]
+    public void SharedMaxAgeAppliesWhenMaxAgeAbsent()
+    {
+        OutboundResponse response = Response(("Cache-Control", "s-maxage=120"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.AreEqual(TimeSpan.FromSeconds(120), result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void ExpiresMinusDateFallbackAppliesWhenNoCacheControl()
+    {
+        DateTimeOffset date = new(2024, 1, 15, 10, 0, 0, TimeSpan.Zero);
+        DateTimeOffset expires = date.AddSeconds(300);
+        OutboundResponse response = Response(
+            ("Date", date.ToString("r", CultureInfo.InvariantCulture)),
+            ("Expires", expires.ToString("r", CultureInfo.InvariantCulture)));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.FromSeconds(300), result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void ExpiresBeforeDateYieldsZeroFreshness()
+    {
+        DateTimeOffset date = new(2024, 1, 15, 10, 0, 0, TimeSpan.Zero);
+        DateTimeOffset expires = date.AddSeconds(-300);
+        OutboundResponse response = Response(
+            ("Date", date.ToString("r", CultureInfo.InvariantCulture)),
+            ("Expires", expires.ToString("r", CultureInfo.InvariantCulture)));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void MaxAgeIsIgnoredWhenComputingFallbackAndTakesPrecedenceOverExpires()
+    {
+        DateTimeOffset date = new(2024, 1, 15, 10, 0, 0, TimeSpan.Zero);
+        DateTimeOffset expires = date.AddSeconds(9000);
+        OutboundResponse response = Response(
+            ("Cache-Control", "max-age=30"),
+            ("Date", date.ToString("r", CultureInfo.InvariantCulture)),
+            ("Expires", expires.ToString("r", CultureInfo.InvariantCulture)));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.AreEqual(TimeSpan.FromSeconds(30), result.FreshnessLifetime,
+            "RFC 9111 §4.2.1 evaluates max-age before falling back to Expires/Date.");
+    }
+
+
+    [TestMethod]
+    public void ExpiresWithoutDateYieldsZeroFreshness()
+    {
+        DateTimeOffset expires = new(2024, 1, 15, 10, 5, 0, TimeSpan.Zero);
+        OutboundResponse response = Response(("Expires", expires.ToString("r", CultureInfo.InvariantCulture)));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime, "No Date reference instant is available to measure Expires against.");
+    }
+
+
+    [TestMethod]
+    public void DateWithoutExpiresYieldsZeroFreshness()
+    {
+        DateTimeOffset date = new(2024, 1, 15, 10, 0, 0, TimeSpan.Zero);
+        OutboundResponse response = Response(("Date", date.ToString("r", CultureInfo.InvariantCulture)));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void MalformedExpiresIsTreatedAsAlreadyExpired()
+    {
+        DateTimeOffset date = new(2024, 1, 15, 10, 0, 0, TimeSpan.Zero);
+        OutboundResponse response = Response(
+            ("Date", date.ToString("r", CultureInfo.InvariantCulture)),
+            ("Expires", "not-a-date"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void MalformedMaxAgeIsTreatedAsStaleRatherThanFallingBackToExpires()
+    {
+        DateTimeOffset date = new(2024, 1, 15, 10, 0, 0, TimeSpan.Zero);
+        DateTimeOffset expires = date.AddSeconds(9000);
+        OutboundResponse response = Response(
+            ("Cache-Control", "max-age=not-a-number"),
+            ("Date", date.ToString("r", CultureInfo.InvariantCulture)),
+            ("Expires", expires.ToString("r", CultureInfo.InvariantCulture)));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void MalformedAgeHeaderIsIgnored()
+    {
+        OutboundResponse response = Response(
+            ("Cache-Control", "max-age=300"),
+            ("Age", "not-a-number"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.AreEqual(TimeSpan.FromSeconds(300), result.FreshnessLifetime,
+            "An invalid Age value is ignored (RFC 9111 §5.1): it contributes no elapsed time, so the full max-age lifetime remains.");
+    }
+
+
+    [TestMethod]
+    public void MalformedEverythingIsZeroFreshnessAndStorable()
+    {
+        OutboundResponse response = Response(
+            ("Cache-Control", "max-age=garbage, ,==,"),
+            ("Date", "definitely not a date"),
+            ("Expires", "also not a date"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable, "No no-store directive was present.");
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void MissingHeadersAreZeroFreshnessAndStorable()
+    {
+        OutboundResponse response = Response();
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.Zero, result.FreshnessLifetime);
+    }
+
+
+    [TestMethod]
+    public void QuotedWhitespaceAndMixedCaseDirectivesAreParsed()
+    {
+        OutboundResponse response = Response(("Cache-Control", "  Max-Age = \"300\" ,  S-MaxAge=\"60\"  "));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsTrue(result.IsStorable);
+        Assert.AreEqual(TimeSpan.FromSeconds(60), result.FreshnessLifetime,
+            "Directive names compare case-insensitively and both token and quoted-string argument forms are accepted (RFC 9111 §5.2).");
+    }
+
+
+    [TestMethod]
+    public void MixedCaseNoStoreDirectiveIsRecognized()
+    {
+        OutboundResponse response = Response(("Cache-Control", "NO-STORE"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.IsFalse(result.IsStorable);
+    }
+
+
+    [TestMethod]
+    public void DeltaSecondsOverflowClampsRatherThanRejects()
+    {
+        OutboundResponse response = Response(("Cache-Control", "max-age=99999999999999999999999999999999"));
+
+        HttpCacheFreshness result = HttpCacheFreshness.Compute(response);
+
+        Assert.AreEqual(TimeSpan.FromSeconds(2_147_483_648L), result.FreshnessLifetime,
+            "RFC 9111 §1.2.2: an unrepresentable delta-seconds value is clamped to 2^31, not treated as invalid.");
+    }
+
+
+    private static OutboundResponse Response(params (string Name, string Value)[] headers)
+    {
+        Dictionary<string, string> headerMap = new(StringComparer.OrdinalIgnoreCase);
+        foreach((string name, string value) in headers)
+        {
+            headerMap[name] = value;
+        }
+
+        return new OutboundResponse
+        {
+            StatusCode = 200,
+            Headers = headerMap,
+        };
+    }
+}
diff --git a/test/Verifiable.Tests/DidComm/DidCommHttpTransportRealWireFlowTests.cs b/test/Verifiable.Tests/DidComm/DidCommHttpTransportRealWireFlowTests.cs
index a329a124..68e0363e 100644
--- a/test/Verifiable.Tests/DidComm/DidCommHttpTransportRealWireFlowTests.cs
+++ b/test/Verifiable.Tests/DidComm/DidCommHttpTransportRealWireFlowTests.cs
@@ -110,7 +110,7 @@ public async Task AnoncryptMessageRoundTripsOverHttpsTransport()
             await PackAnoncryptForBobAsync(TestContext.CancellationToken).ConfigureAwait(false);
         try
         {
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(inbox.Certificate);
             DidCommTransmitResult transmit = await packed.TransmitAsync(
                 inbox.BaseAddress,
                 NewLoopbackContext(),
@@ -169,7 +169,7 @@ public async Task NonSuccessStatusYieldsExactRejectedShape()
             await PackAnoncryptForBobAsync(TestContext.CancellationToken).ConfigureAwait(false);
         try
         {
-            using HttpClient httpClient = new();
+            using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(inbox.Certificate);
             DidCommTransmitResult transmit = await packed.TransmitAsync(
                 inbox.BaseAddress,
                 NewLoopbackContext(),
@@ -232,7 +232,7 @@ public async Task NonSuccessStatusYieldsExactRejectedShape()
 
 
     /// <summary>
-    /// A fresh context whose policy permits http loopback so the genuine http://127.0.0.1:{port}/ inbox URL
+    /// A fresh context whose policy permits loopback so the genuine https://127.0.0.1:{port}/ inbox URL
     /// is allowed; production keeps <see cref="OutboundFetchPolicy.SecureDefault"/>, which denies a loopback
     /// target before any network contact.
     /// </summary>
@@ -241,7 +241,6 @@ private static ExchangeContext NewLoopbackContext()
         var context = new ExchangeContext();
         context.SetOutboundFetchPolicy(OutboundFetchPolicy.SecureDefault with
         {
-            AllowedSchemes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "http", "https" },
             BlockPrivateAndLoopback = false
         });
 
diff --git a/test/Verifiable.Tests/DidComm/DidCommRoutingForwardTests.cs b/test/Verifiable.Tests/DidComm/DidCommRoutingForwardTests.cs
index 9191b0d5..7202722f 100644
--- a/test/Verifiable.Tests/DidComm/DidCommRoutingForwardTests.cs
+++ b/test/Verifiable.Tests/DidComm/DidCommRoutingForwardTests.cs
@@ -597,10 +597,10 @@ private static DidCommEncryptedMessage ForwardedMessageOf(ReadOnlySpan<byte> byt
 
 
     /// <summary>
-    /// The §3 sender→receiver flow over a REAL HTTP socket: Alice packs an authcrypt message for Bob, transmits it as
-    /// an HTTPS-shaped POST (chunk H) over a genuine HttpClient/Kestrel hop to Bob's inbox, and Bob decrypts exactly
-    /// what crossed the wire — the message types, the encryption layer, the transport convention, and the Verified&lt;T&gt;
-    /// authenticity proof all exercised end to end on a real socket (loopback, plain HTTP — verification is over the
+    /// The §3 sender→receiver flow over a REAL HTTPS socket: Alice packs an authcrypt message for Bob, transmits it as
+    /// an HTTPS POST over a genuine HttpClient/Kestrel hop (pinned to the inbox's certificate) to Bob's inbox, and Bob
+    /// decrypts exactly what crossed the wire — the message types, the encryption layer, the transport convention, and
+    /// the Verified&lt;T&gt; authenticity proof all exercised end to end on a real socket (verification is over the
     /// envelope, not the transport).
     /// </summary>
     [TestMethod]
@@ -622,8 +622,8 @@ public async Task CrossWireAuthcryptDeliveryOverRealSocket()
         DidResolver resolver = CreateResolver(out PeerParty alice, out PeerParty bob, out _, out _, withService: false);
         using DidCommEncryptedMessage packed = await PackAuthcryptForBobAsync(resolver, alice, bob).ConfigureAwait(false);
 
-        //Transmit over a genuine socket to Bob's loopback inbox (the policy allows http loopback for the test host).
-        using HttpClient httpClient = new();
+        //Transmit over a genuine socket to Bob's loopback inbox (the policy allows loopback for the test host).
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(inbox.Certificate);
         ExchangeContext loopbackContext = NewLoopbackContext();
         DidCommTransmitResult transmit = await packed.TransmitAsync(
             inbox.BaseAddress, loopbackContext, DidCommHttpTransport.CreateSendDelegate(BuildPostTransport(httpClient)), TestContext.CancellationToken).ConfigureAwait(false);
@@ -649,14 +649,13 @@ public async Task CrossWireAuthcryptDeliveryOverRealSocket()
     }
 
 
-    //A fresh context whose policy permits http loopback so the genuine http://127.0.0.1:{port}/ inbox URL is allowed;
+    //A fresh context whose policy permits loopback so the genuine https://127.0.0.1:{port}/ inbox URL is allowed;
     //production keeps SecureDefault, which denies a loopback target before any network contact.
     private static ExchangeContext NewLoopbackContext()
     {
         var context = new ExchangeContext();
         context.SetOutboundFetchPolicy(OutboundFetchPolicy.SecureDefault with
         {
-            AllowedSchemes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "http", "https" },
             BlockPrivateAndLoopback = false
         });
 
diff --git a/test/Verifiable.Tests/DidComm/DidCommWebSocketTransportTests.cs b/test/Verifiable.Tests/DidComm/DidCommWebSocketTransportTests.cs
index 546bb639..c26313e3 100644
--- a/test/Verifiable.Tests/DidComm/DidCommWebSocketTransportTests.cs
+++ b/test/Verifiable.Tests/DidComm/DidCommWebSocketTransportTests.cs
@@ -33,7 +33,7 @@ internal sealed class DidCommWebSocketTransportTests
     private static readonly MemoryPool<byte> Pool = BaseMemoryPool.Shared;
 
     //A non-network resolution context; it only satisfies the SSRF-policy-carrying parameter (the WebSocket path
-    //does not route through OutboundFetch, so no scheme/host policy applies to the loopback ws:// endpoint).
+    //does not route through OutboundFetch, so no scheme/host policy applies to the loopback wss:// endpoint).
     private static readonly ExchangeContext Context = new();
 
     //A non-nested anoncrypt message never triggers nested-signature resolution; this satisfies the parameter.
@@ -99,7 +99,7 @@ public async Task AnoncryptRoundTripsOverWebSocketTransport()
         //Deliver over a real WebSocket through the transport-neutral send seam — the SAME message.TransmitAsync the
         //HTTPS path uses, handed a WebSocket DidCommSendDelegate instead of the HTTPS one.
         await using DidCommWebSocketInbox inbox = await DidCommWebSocketInbox.StartAsync(cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
-        DidCommSendDelegate send = DidCommWebSocketInbox.CreateSendDelegate();
+        DidCommSendDelegate send = DidCommWebSocketInbox.CreateSendDelegate(inbox.Certificate);
 
         DidCommTransmitResult transmit = await encrypted.TransmitAsync(inbox.Endpoint, Context, send, cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
 
diff --git a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyAlwaysUvTests.cs b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyAlwaysUvTests.cs
index 0bd91f64..d7eab766 100644
--- a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyAlwaysUvTests.cs
+++ b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyAlwaysUvTests.cs
@@ -67,7 +67,7 @@ public async Task RegistrationThenAssertionSucceedUnderDiscouragedWithAlwaysUvEn
             RpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xF2), "gerd", "Gerd Example", pool,
             userVerification: UserVerificationRequirement.Discouraged);
         await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false);
-        using HttpClient httpClient = new() { BaseAddress = host.BaseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate, host.BaseAddress);
 
         using CtapAuthenticatorSimulator simulator = CtapWave2AuthenticatorFixtures.CreateSimulator("webauthn-rp-http-alwaysuv-authenticator");
         using CtapWave2TransportHarness harness = await CtapWave2TransportHarness.CreateAsync(simulator, pool, cancellationToken).ConfigureAwait(false);
diff --git a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyCredentialManagementTests.cs b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyCredentialManagementTests.cs
index a42811ab..877697ca 100644
--- a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyCredentialManagementTests.cs
+++ b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyCredentialManagementTests.cs
@@ -67,7 +67,7 @@ public async Task DeleteCredentialOverTheWireMakesSubsequentAssertionCeremonyFai
             RpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xF5), "wavecm-user", "Wavecm User", pool,
             residentKey: ResidentKeyRequirement.Required);
         await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false);
-        using HttpClient httpClient = new() { BaseAddress = host.BaseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate, host.BaseAddress);
 
         using CtapAuthenticatorSimulator simulator = CtapWave2AuthenticatorFixtures.CreateSimulator("webauthn-rp-http-cm-authenticator");
         using CtapWave2TransportHarness harness = await CtapWave2TransportHarness.CreateAsync(simulator, pool, cancellationToken).ConfigureAwait(false);
diff --git a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyRequiredUserVerificationTests.cs b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyRequiredUserVerificationTests.cs
index a3d4e2e5..2c9bc961 100644
--- a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyRequiredUserVerificationTests.cs
+++ b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyRequiredUserVerificationTests.cs
@@ -68,7 +68,7 @@ public async Task RegistrationThenAssertionSucceedUnderRequiredUserVerificationW
             RpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xF0), "erin", "Erin Example", pool,
             userVerification: UserVerificationRequirement.Required);
         await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false);
-        using HttpClient httpClient = new() { BaseAddress = host.BaseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate, host.BaseAddress);
 
         using CtapAuthenticatorSimulator simulator = CtapWave2AuthenticatorFixtures.CreateSimulator("webauthn-rp-http-required-authenticator");
         using CtapWave2TransportHarness harness = await CtapWave2TransportHarness.CreateAsync(simulator, pool, cancellationToken).ConfigureAwait(false);
@@ -105,7 +105,7 @@ public async Task RegistrationAndAssertionWithoutAPinUvAuthTokenFailWithTheSkins
             NegativeRpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xF1), "frank", "Frank Example", pool,
             userVerification: UserVerificationRequirement.Required);
         await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false);
-        using HttpClient httpClient = new() { BaseAddress = host.BaseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate, host.BaseAddress);
 
         using CtapAuthenticatorSimulator simulator = CtapWave2AuthenticatorFixtures.CreateSimulator("webauthn-rp-http-required-negative-authenticator");
         using CtapWave2TransportHarness harness = await CtapWave2TransportHarness.CreateAsync(simulator, pool, cancellationToken).ConfigureAwait(false);
diff --git a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyResetTests.cs b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyResetTests.cs
index e503669d..985ea0ff 100644
--- a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyResetTests.cs
+++ b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyResetTests.cs
@@ -70,7 +70,7 @@ public async Task ResetOverTheWireMakesSubsequentAssertionCeremonyFailThenAFresh
             RpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xF6), "wavereset-user", "Wavereset User", pool,
             residentKey: ResidentKeyRequirement.Required);
         await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false);
-        using HttpClient httpClient = new() { BaseAddress = host.BaseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate, host.BaseAddress);
 
         using CtapAuthenticatorSimulator simulator = CtapWave2AuthenticatorFixtures.CreateSimulator("webauthn-rp-http-reset-authenticator");
         using CtapWave2TransportHarness harness = await CtapWave2TransportHarness.CreateAsync(simulator, pool, cancellationToken).ConfigureAwait(false);
diff --git a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyTests.cs b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyTests.cs
index f7026022..5ba48e36 100644
--- a/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyTests.cs
+++ b/test/Verifiable.Tests/Fido2/WebAuthnRpHttpCeremonyTests.cs
@@ -57,7 +57,7 @@ public async Task RegistrationThenAssertionSucceedOverRealHttpAndApduTransports(
         var skin = new WebAuthnRelyingPartyCeremonySkin(
             RpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xE0), "alice", "Alice Example", pool);
         await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false);
-        using HttpClient httpClient = new() { BaseAddress = host.BaseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate, host.BaseAddress);
 
         using CtapAuthenticatorSimulator simulator = CtapWave2AuthenticatorFixtures.CreateSimulator("webauthn-rp-http-authenticator");
         using CtapWave2TransportHarness harness = await CtapWave2TransportHarness.CreateAsync(simulator, pool, cancellationToken).ConfigureAwait(false);
@@ -87,7 +87,7 @@ public async Task TamperedAssertionSignatureFailsVerificationWithExactShape()
         var skin = new WebAuthnRelyingPartyCeremonySkin(
             RpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xE1), "bob", "Bob Example", pool);
         await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false);
-        using HttpClient httpClient = new() { BaseAddress = host.BaseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate, host.BaseAddress);
 
         using CtapAuthenticatorSimulator simulator = CtapWave2AuthenticatorFixtures.CreateSimulator("webauthn-rp-http-tamper-authenticator");
         using CtapWave2TransportHarness harness = await CtapWave2TransportHarness.CreateAsync(simulator, pool, cancellationToken).ConfigureAwait(false);
@@ -116,7 +116,7 @@ public async Task MalformedEnvelopeAtAssertionResultReturnsExactBadRequestShape(
         var skin = new WebAuthnRelyingPartyCeremonySkin(
             RpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xE2), "carol", "Carol Example", pool);
         await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false);
-        using HttpClient httpClient = new() { BaseAddress = host.BaseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate, host.BaseAddress);
 
         using CtapAuthenticatorSimulator simulator = CtapWave2AuthenticatorFixtures.CreateSimulator("webauthn-rp-http-malformed-authenticator");
         using CtapWave2TransportHarness harness = await CtapWave2TransportHarness.CreateAsync(simulator, pool, cancellationToken).ConfigureAwait(false);
@@ -152,15 +152,17 @@ public async Task RequestFailsStructurallyOnceTheHostStops()
             RpId, Origin, CtapWave2AuthenticatorFixtures.BuildFixedBytes(16, 0xE3), "dave", "Dave Example", pool);
 
         Uri baseAddress;
+        System.Security.Cryptography.X509Certificates.X509Certificate2 certificate;
         await using(MinimalHttpHost host = await MinimalHttpHost.StartAsync(skin.HandleAsync, cancellationToken).ConfigureAwait(false))
         {
             baseAddress = host.BaseAddress;
-            using HttpClient warmupClient = new() { BaseAddress = baseAddress };
+            certificate = host.Certificate;
+            using HttpClient warmupClient = LoopbackTls.CreatePinnedHttpClient(certificate, baseAddress);
             using HttpResponseMessage warmup = await PostAsync(warmupClient, WebAuthnRelyingPartyCeremonySkin.AttestationOptionsPath, jsonBody: null, cancellationToken).ConfigureAwait(false);
             Assert.AreEqual(HttpStatusCode.OK, warmup.StatusCode, "The endpoint MUST answer while the host is running.");
         }
 
-        using HttpClient httpClient = new() { BaseAddress = baseAddress };
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(certificate, baseAddress);
         await Assert.ThrowsExactlyAsync<HttpRequestException>(
             () => PostAsync(httpClient, WebAuthnRelyingPartyCeremonySkin.AttestationOptionsPath, jsonBody: null, cancellationToken));
     }
diff --git a/test/Verifiable.Tests/OAuth/AccessTokenIdentityMinimizationTests.cs b/test/Verifiable.Tests/OAuth/AccessTokenIdentityMinimizationTests.cs
new file mode 100644
index 00000000..7d2f8857
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/AccessTokenIdentityMinimizationTests.cs
@@ -0,0 +1,314 @@
+using System.Collections.Immutable;
+using System.Net.Http;
+using System.Text.Json;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.JCose;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Oidc;
+using Verifiable.OAuth.Pkce;
+using Verifiable.OAuth.Server;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Wave-4 D7 real-wire capstone for the <c>openid ⇒ end-user</c> data-minimization invariant on
+/// the access-token producer (contract §D4 consumer layer, <see cref="Rfc9068AccessTokenProducer"/>):
+/// a full PAR → authorize → callback → token authorization-code journey requesting
+/// <c>openid profile email address phone</c> must never carry end-user identity claims on the
+/// issued access token, even though every identity family is populated and the co-issued id_token
+/// legitimately carries them. Composed via the shared <see cref="AuthCodeFlowDriver"/>, the same
+/// real-wire drive <see cref="AuthCodeParPkceRealWireFlowTests"/> and the agentic-flow capstone use.
+/// </summary>
+[TestClass]
+internal sealed class AccessTokenIdentityMinimizationTests
+{
+    /// <summary>MSTest's per-test context, supplying the cancellation token every wire call runs under.</summary>
+    public TestContext TestContext { get; set; } = null!;
+
+    /// <summary>The clock the host and the client share.</summary>
+    private FakeTimeProvider TimeProvider { get; } = new(TestClock.CanonicalEpoch);
+
+    private const string ClientId = "https://minimization.client.test";
+
+    private const string SubjectId = "subject-identity-minimization-01";
+
+    private static Uri ClientBaseUri { get; } = new(ClientId);
+
+    private static Uri RedirectUri { get; } = new("https://client.example.com/callback");
+
+    /// <summary>
+    /// The scope requested on every leg — every OIDC Core §5.4 standard claim family alongside
+    /// <c>openid</c>, so every <see cref="OidcStandardClaimsContributor"/> rule is scope-eligible.
+    /// </summary>
+    private static string FullIdentityScope { get; } = string.Join(
+        ' ', WellKnownScopes.OpenId, WellKnownScopes.Profile, WellKnownScopes.Email,
+        WellKnownScopes.Address, WellKnownScopes.Phone);
+
+
+    /// <summary>
+    /// Requests the full identity scope set through a real-wire authorization_code journey, then
+    /// decodes the issued access token off the wire (no signature verification — the point is what
+    /// the AS emitted, per <see cref="JwtPayloadReader"/>) and asserts every OIDC identity claim is
+    /// absent while the RFC 9068 subject/scope/issuer/audience/client claims are present. A positive
+    /// control decodes the co-issued id_token and asserts the SAME identity data IS carried there —
+    /// proving the access token's absence is data minimization, not a broken claims resolver.
+    /// </summary>
+    [TestMethod]
+    public async Task AccessTokenOmitsIdentityClaimsWhileIdTokenCarriesThem()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SubjectClaims[SubjectId] = new OidcClaims
+        {
+            Subject = SubjectId,
+            Profile = new ProfileClaims
+            {
+                Name = "Ada Lovelace",
+                FamilyName = "Lovelace",
+                GivenName = "Ada"
+            },
+            Email = new EmailClaims
+            {
+                Email = "ada@example.test",
+                EmailVerified = true
+            },
+            Address = new AddressClaims
+            {
+                Locality = "London",
+                Country = "UK",
+                PostalCode = "SW1A 2AA"
+            },
+            Phone = new PhoneClaims
+            {
+                PhoneNumber = "+44 20 7946 0958",
+                PhoneNumberVerified = true
+            }
+        };
+
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+            await host.CreateOAuthClientAndRegistrationAsync(
+                material.Registration,
+                RedirectUri.OriginalString,
+                profile: PolicyProfile.Rfc6749WithPkce,
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+
+        using HttpClient browserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(host.ServerCertificate);
+
+        AuthCodeFlowDriveResult drive = await AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync(
+            hosted, client, registration, clientFlowStore, segment, RedirectUri, SubjectId, browserClient,
+            FullIdentityScope, cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+
+        string accessToken = (string)drive.TokenResult.Body![OAuthRequestParameterNames.AccessToken];
+        string idToken = (string)drive.TokenResult.Body[OAuthRequestParameterNames.IdToken];
+        Assert.IsFalse(string.IsNullOrEmpty(accessToken), "The AS must mint an access token.");
+        Assert.IsFalse(string.IsNullOrEmpty(idToken),
+            "openid in scope on authorization_code must mint an id_token (contract D3).");
+
+        using JsonDocument accessTokenPayload = JwtPayloadReader.ParsePayloadJson(accessToken);
+        JsonElement accessTokenClaims = accessTokenPayload.RootElement;
+
+        Assert.AreEqual(SubjectId, accessTokenClaims.GetProperty(WellKnownJwtClaimNames.Sub).GetString(),
+            "sub identifies the token holder per RFC 9068 §2.2 and must remain present.");
+        Assert.AreEqual(FullIdentityScope, accessTokenClaims.GetProperty(WellKnownJwtClaimNames.Scope).GetString());
+        Assert.IsTrue(accessTokenClaims.TryGetProperty(WellKnownJwtClaimNames.Iss, out _),
+            "iss is RFC 9068 §2.2 required.");
+        Assert.IsTrue(accessTokenClaims.TryGetProperty(WellKnownJwtClaimNames.Aud, out _),
+            "aud is RFC 9068 §2.2 required.");
+        Assert.AreEqual(ClientId, accessTokenClaims.GetProperty(WellKnownJwtClaimNames.ClientId).GetString());
+
+        AssertClaimAbsent(accessTokenClaims, WellKnownJwtClaimNames.Name);
+        AssertClaimAbsent(accessTokenClaims, WellKnownJwtClaimNames.FamilyName);
+        AssertClaimAbsent(accessTokenClaims, WellKnownJwtClaimNames.GivenName);
+        AssertClaimAbsent(accessTokenClaims, WellKnownJwtClaimNames.Email);
+        AssertClaimAbsent(accessTokenClaims, WellKnownJwtClaimNames.EmailVerified);
+        AssertClaimAbsent(accessTokenClaims, WellKnownJwtClaimNames.Address);
+        AssertClaimAbsent(accessTokenClaims, WellKnownJwtClaimNames.PhoneNumber);
+        AssertClaimAbsent(accessTokenClaims, WellKnownJwtClaimNames.PhoneNumberVerified);
+
+        using JsonDocument idTokenPayload = JwtPayloadReader.ParsePayloadJson(idToken);
+        JsonElement idTokenClaims = idTokenPayload.RootElement;
+        Assert.AreEqual("Ada Lovelace", idTokenClaims.GetProperty(WellKnownJwtClaimNames.Name).GetString(),
+            "Positive control: the same identity data the access token must omit belongs on the id_token.");
+        Assert.AreEqual("ada@example.test", idTokenClaims.GetProperty(WellKnownJwtClaimNames.Email).GetString());
+    }
+
+
+    private static void AssertClaimAbsent(JsonElement accessTokenClaims, string claimName)
+    {
+        Assert.IsFalse(accessTokenClaims.TryGetProperty(claimName, out _),
+            $"Access token must not carry '{claimName}' — {nameof(AccessTokenTarget)} has no field an "
+            + $"{nameof(OidcStandardClaimsContributor)} rule can populate (structural target-keying).");
+    }
+
+
+    /// <summary>
+    /// Contract D7 data-minimization gate: a real-wire authorization_code journey that never
+    /// requests <c>openid</c> must never invoke the application's
+    /// <see cref="AuthorizationServerIntegration.ResolveOidcClaimsAsync"/> — the app's OIDC-claims
+    /// resolver carries end-user identity data, and a request that never asked for identity must
+    /// not trigger it, independent of the fact that no producer would consume the result either way.
+    /// </summary>
+    [TestMethod]
+    public async Task ResolveOidcClaimsResolverIsSkippedWhenOpenidNotRequested()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SubjectClaims[SubjectId] = new OidcClaims
+        {
+            Subject = SubjectId,
+            Profile = new ProfileClaims { Name = "Ada Lovelace" }
+        };
+
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+            await host.CreateOAuthClientAndRegistrationAsync(
+                material.Registration,
+                RedirectUri.OriginalString,
+                profile: PolicyProfile.Rfc6749WithPkce,
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+        int resolverInvocationCount = 0;
+        ResolveOidcClaimsDelegate seededResolver = host.Server.OAuth().ResolveOidcClaimsAsync!;
+        host.Server.OAuth().ResolveOidcClaimsAsync = (subject, scope, tenantId, ctx, ct) =>
+        {
+            resolverInvocationCount++;
+
+            return seededResolver(subject, scope, tenantId, ctx, ct);
+        };
+
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+
+        using HttpClient browserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(host.ServerCertificate);
+
+        AuthCodeFlowDriveResult drive = await AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync(
+            hosted, client, registration, clientFlowStore, segment, RedirectUri, SubjectId, browserClient,
+            WellKnownScopes.Profile, cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(0, resolverInvocationCount,
+            "The app's OIDC-claims resolver must not run when the request never carried openid.");
+        Assert.IsFalse(drive.TokenResult.Body!.ContainsKey(OAuthRequestParameterNames.IdToken),
+            "No id_token is minted without openid in scope (contract D3), independent of the resolver gate.");
+    }
+
+
+    /// <summary>
+    /// Contract D7 response_type validation: this authorization server issues the Authorization
+    /// Code grant only (<see href="https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1">RFC 6749
+    /// §4.1.1</see>). A real-wire PAR POST whose <c>response_type</c> requests <c>id_token</c> or
+    /// <c>token</c> — the OIDC Core 1.0 §3 implicit response types this server does not implement —
+    /// is rejected with <c>unsupported_response_type</c>
+    /// (<see href="https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2.1">RFC 6749 §4.1.2.1</see>)
+    /// rather than silently answered as though <c>code</c> had been requested.
+    /// </summary>
+    [TestMethod]
+    public async Task ParRejectsUnsupportedResponseTypes()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        await host.StartHttpHostAsync(cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+        Uri parUri = new(
+            hosted.HttpBaseAddress!,
+            TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodePar, segment));
+
+        foreach(string unsupportedResponseType in new[] { WellKnownResponseTypes.IdToken, WellKnownResponseTypes.Token })
+        {
+            PkceParameters pkce = PkceGeneration.Generate(TestSetup.Base64UrlEncoder, BaseMemoryPool.Shared);
+            using FormUrlEncodedContent content = new(new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.ClientId] = ClientId,
+                [OAuthRequestParameterNames.CodeChallenge] = pkce.EncodedChallenge,
+                [OAuthRequestParameterNames.CodeChallengeMethod] = WellKnownCodeChallengeMethods.S256,
+                [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString,
+                [OAuthRequestParameterNames.Scope] = WellKnownScopes.OpenId,
+                [OAuthRequestParameterNames.ResponseType] = unsupportedResponseType
+            });
+
+            using HttpResponseMessage response = await hosted.SharedHttpClient!
+                .PostAsync(parUri, content, TestContext.CancellationToken).ConfigureAwait(false);
+            string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+            Assert.AreEqual(400, (int)response.StatusCode,
+                $"response_type '{unsupportedResponseType}' must be rejected at PAR. Body: {body}");
+
+            using JsonDocument errorBody = JsonDocument.Parse(body);
+            Assert.AreEqual("unsupported_response_type",
+                errorBody.RootElement.GetProperty("error").GetString(),
+                $"The wire error for response_type '{unsupportedResponseType}' must be unsupported_response_type. Body: {body}");
+        }
+    }
+
+
+    /// <summary>
+    /// Contract D7 response_type validation, the direct (non-PAR) Authorize entry point
+    /// (<c>AuthCodeEndpoints.BuildDirectAuthorize</c>): once <c>redirect_uri</c> has been parsed, RFC
+    /// 6749 §4.1.2.1 requires an unsupported <c>response_type</c> to surface as an Authorization Error
+    /// Response REDIRECT — <c>error=unsupported_response_type</c> on the registered <c>redirect_uri</c>
+    /// — rather than a bare HTTP error status, complementing
+    /// <see cref="ParRejectsUnsupportedResponseTypes"/>'s bare-PAR JSON-400 shape (PAR has no
+    /// redirect_uri to redirect to yet).
+    /// </summary>
+    [TestMethod]
+    public async Task DirectAuthorizeRejectsUnsupportedResponseTypesWithRedirectError()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId,
+            ClientBaseUri,
+            profile: PolicyProfile.Rfc6749WithPkce,
+            capabilities: ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                WellKnownCapabilityIdentifiers.OAuthDirectAuthorization));
+
+        await host.StartHttpHostAsync(cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+
+        foreach(string unsupportedResponseType in new[] { WellKnownResponseTypes.IdToken, WellKnownResponseTypes.Token })
+        {
+            PkceParameters pkce = PkceGeneration.Generate(TestSetup.Base64UrlEncoder, BaseMemoryPool.Shared);
+
+            Uri authorizeUrl = new(
+                hosted.HttpBaseAddress!,
+                $"{TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeDirectAuthorize, segment)}" +
+                $"?{OAuthRequestParameterNames.ClientId}={Uri.EscapeDataString(ClientId)}" +
+                $"&{OAuthRequestParameterNames.CodeChallenge}={Uri.EscapeDataString(pkce.EncodedChallenge)}" +
+                $"&{OAuthRequestParameterNames.CodeChallengeMethod}={WellKnownCodeChallengeMethods.S256}" +
+                $"&{OAuthRequestParameterNames.RedirectUri}={Uri.EscapeDataString(RedirectUri.OriginalString)}" +
+                $"&{OAuthRequestParameterNames.Scope}={Uri.EscapeDataString(WellKnownScopes.OpenId)}" +
+                $"&{OAuthRequestParameterNames.ResponseType}={Uri.EscapeDataString(unsupportedResponseType)}");
+
+            using HttpClient browserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(host.ServerCertificate);
+            using HttpRequestMessage authorizeRequest = new(HttpMethod.Get, authorizeUrl);
+            authorizeRequest.Headers.Add(AuthorizationServerHttpApplication.TestSubjectHeaderName, SubjectId);
+
+            using HttpResponseMessage response = await browserClient
+                .SendAsync(authorizeRequest, TestContext.CancellationToken).ConfigureAwait(false);
+
+            Assert.AreEqual(302, (int)response.StatusCode,
+                $"response_type '{unsupportedResponseType}' must be rejected as a redirect once redirect_uri "
+                + "is known (RFC 6749 §4.1.2.1), not a bare status.");
+
+            string location = response.Headers.Location!.ToString();
+            Assert.StartsWith(RedirectUri.ToString(), location, StringComparison.Ordinal,
+                $"The error redirect must target the registered redirect_uri. Got: {location}");
+            Assert.AreEqual(
+                "unsupported_response_type",
+                TestBrowser.ExtractQueryParam(location, OAuthRequestParameterNames.Error),
+                $"response_type '{unsupportedResponseType}' must redirect with error=unsupported_response_type. Got: {location}");
+        }
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/AccessTokenTypeValidationTests.cs b/test/Verifiable.Tests/OAuth/AccessTokenTypeValidationTests.cs
new file mode 100644
index 00000000..90e37515
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/AccessTokenTypeValidationTests.cs
@@ -0,0 +1,438 @@
+using System.Text;
+using System.Text.Json;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.Json;
+using Verifiable.Microsoft;
+using Verifiable.OAuth;
+using Verifiable.OAuth.Pkce;
+using Verifiable.OAuth.Server;
+using Verifiable.Server;
+using Verifiable.Tests.TestDataProviders;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// RFC 9068 §4 <c>typ</c> discriminator — the fix that closes a token-confusion gap where a JWT
+/// minted for a different purpose (most concretely, an OIDC ID Token, <c>typ</c> <c>JWT</c>) could be
+/// presented at a resource endpoint as if it were an access token. Both independent inbound
+/// validation paths carry the check: <see cref="JwsAccessTokenValidator"/> (used directly, e.g. by a
+/// resource server composing its own pipeline) and <see cref="BearerTokenValidation"/> (the AS's own
+/// protected-resource gate, exercised here through the real OIDC Core §5.3 UserInfo endpoint). Every
+/// confused token in this suite is minted by the REAL production issuance pipeline — a full
+/// PAR → Authorize → Token exchange — never a hand-literal fixture, so the assertions prove the
+/// running system rejects the confusion, not merely that the check exists in isolation.
+/// </summary>
+[TestClass]
+internal sealed class AccessTokenTypeValidationTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private const string ClientId = "https://typ-confusion.client.test";
+    private const string SubjectId = "subject-typ-confusion";
+    private const string ResourceServerAudience = "https://rs.example.com";
+
+    private static readonly Uri ClientBaseUri = new(ClientId);
+    private static readonly Uri RedirectUri = new("https://client.example.com/callback");
+    private static readonly TimeSpan IatSkew = TimeSpan.FromSeconds(60);
+
+    //Standalone (non-host) fixture constants for the hand-built-header tests, mirroring
+    //JwsAccessTokenValidatorTests' local fixture shape.
+    private const string StandaloneIssuer = "https://issuer.test/tenant-a";
+    private const string StandaloneAudience = "test-resource-server";
+    private const string StandaloneSubject = "user-1";
+    private const string StandaloneClientId = "client-1";
+    private const string StandaloneKid = "test-kid";
+    private const string StandaloneScope = "openid profile";
+
+    private FakeTimeProvider TimeProvider { get; } = new(TestClock.CanonicalEpoch);
+
+
+    /// <summary>
+    /// The genuine access token from a real issuance (typ <c>at+jwt</c>) validates; the SAME
+    /// issuance's id_token (typ <c>JWT</c>) — minted by the real OIDC ID Token producer, not a
+    /// fixture — must not validate as an access token.
+    /// </summary>
+    [TestMethod]
+    public async Task JwsAccessTokenValidatorRejectsRealIdTokenButAcceptsRealAccessToken()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        (string accessToken, string idToken) = await DriveCodeExchangeAsync(
+            host, material, WellKnownScopes.OpenId).ConfigureAwait(false);
+
+        JwsAccessTokenValidationResult accessResult = await ValidateAsAccessTokenAsync(
+            accessToken, material, ResourceServerAudience).ConfigureAwait(false);
+        Assert.IsTrue(accessResult.IsSuccess,
+            $"A genuine at+jwt access token must validate; got {accessResult.FailureReason}: {accessResult.FailureDescription}");
+
+        JwsAccessTokenValidationResult idTokenResult = await ValidateAsAccessTokenAsync(
+            idToken, material, ClientId).ConfigureAwait(false);
+        Assert.IsFalse(idTokenResult.IsSuccess,
+            "An ID Token (typ JWT) presented to the access-token validator must not succeed.");
+        Assert.AreEqual(JwsAccessTokenValidationFailureReason.InvalidType, idTokenResult.FailureReason,
+            "The rejection must be attributed to the typ discriminator (RFC 9068 §4), not some other check.");
+    }
+
+
+    /// <summary>A header with no <c>typ</c> member at all is rejected the same as a wrong one.</summary>
+    [TestMethod]
+    public async Task JwsAccessTokenValidatorRejectsAccessTokenMissingTypHeader()
+    {
+        string headerJson = JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["alg"] = "ES256",
+            ["kid"] = StandaloneKid
+            //typ deliberately omitted.
+        });
+        JwtPayload payload = OAuthAccessTokenFixtures.BuildAccessTokenPayload(
+            subject: StandaloneSubject,
+            scope: StandaloneScope,
+            clientId: StandaloneClientId,
+            issuedAt: TimeProvider.GetUtcNow() - TimeSpan.FromMinutes(1),
+            expiresAt: TimeProvider.GetUtcNow() + TimeSpan.FromHours(1),
+            issuer: StandaloneIssuer,
+            audience: [StandaloneAudience]);
+        string payloadJson = JsonSerializer.Serialize((Dictionary<string, object>)payload);
+        string token = string.Concat(
+            TestSetup.Base64UrlEncoder(Encoding.UTF8.GetBytes(headerJson)),
+            ".",
+            TestSetup.Base64UrlEncoder(Encoding.UTF8.GetBytes(payloadJson)),
+            ".",
+            TestSetup.Base64UrlEncoder([0x00]));
+
+        var keys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        using PublicKeyMemory publicKey = keys.PublicKey;
+        using PrivateKeyMemory privateKey = keys.PrivateKey;
+
+        JwsAccessTokenValidationResult result = await ValidateStandaloneAsync(token, publicKey).ConfigureAwait(false);
+
+        Assert.IsFalse(result.IsSuccess);
+        Assert.AreEqual(JwsAccessTokenValidationFailureReason.InvalidType, result.FailureReason);
+    }
+
+
+    /// <summary>
+    /// RFC 9068 §4 accepts EITHER <c>at+jwt</c> or the long-form <c>application/at+jwt</c> — the
+    /// producer only ever emits the short form, so this proves the validator's inbound tolerance for
+    /// the long form independently, by hand-constructing the header.
+    /// </summary>
+    [TestMethod]
+    public async Task JwsAccessTokenValidatorAcceptsApplicationAtJwtLongForm()
+    {
+        var keys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        using PublicKeyMemory publicKey = keys.PublicKey;
+        using PrivateKeyMemory privateKey = keys.PrivateKey;
+
+        JwtHeader header = JwtHeader.ForAccessToken(WellKnownJwaValues.Es256, StandaloneKid);
+        header[WellKnownJoseHeaderNames.Typ] = WellKnownMediaTypes.Application.AtJwt;
+
+        JwtPayload payload = OAuthAccessTokenFixtures.BuildAccessTokenPayload(
+            subject: StandaloneSubject,
+            scope: StandaloneScope,
+            clientId: StandaloneClientId,
+            issuedAt: TimeProvider.GetUtcNow() - TimeSpan.FromMinutes(1),
+            expiresAt: TimeProvider.GetUtcNow() + TimeSpan.FromHours(1),
+            issuer: StandaloneIssuer,
+            audience: [StandaloneAudience]);
+
+        UnsignedJwt unsignedJwt = new(header, payload);
+        using JwsMessage jws = await unsignedJwt.SignAsync(
+            privateKey,
+            HeaderSerializer,
+            PayloadSerializer,
+            TestSetup.Base64UrlEncoder,
+            BaseMemoryPool.Shared,
+            TestContext.CancellationToken).ConfigureAwait(false);
+        string token = JwsSerialization.SerializeCompact(jws, TestSetup.Base64UrlEncoder);
+
+        JwsAccessTokenValidationResult result = await ValidateStandaloneAsync(token, publicKey).ConfigureAwait(false);
+
+        Assert.IsTrue(result.IsSuccess,
+            $"typ 'application/at+jwt' (the long form) must be accepted per RFC 9068 §4; got {result.FailureReason}: {result.FailureDescription}");
+    }
+
+
+    /// <summary>
+    /// <see cref="BearerTokenValidation"/> is a structurally independent implementation (its own
+    /// parse/alg/kid/typ/key-resolve/signature/iss/exp sequence, not a delegation to
+    /// <see cref="JwsAccessTokenValidator"/>) that gates every protected resource endpoint — exercised
+    /// here through the real, HTTP-reachable OIDC Core §5.3 UserInfo endpoint. The genuine access
+    /// token from a real issuance succeeds; the SAME issuance's id_token is rejected by BearerTokenValidation's
+    /// own <c>typ</c> check before ever reaching key resolution or signature verification.
+    /// </summary>
+    [TestMethod]
+    public async Task BearerTokenValidationRejectsRealIdTokenButAcceptsRealAccessToken()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        (string accessToken, string idToken) = await DriveCodeExchangeAsync(
+            host, material, WellKnownScopes.OpenId).ConfigureAwait(false);
+
+        ServerHttpResponse accessResponse = await DispatchUserInfoAsync(
+            host, material, "Bearer " + accessToken).ConfigureAwait(false);
+        Assert.AreEqual(200, accessResponse.StatusCode,
+            $"A genuine at+jwt access token must be accepted at the protected endpoint. Body: {accessResponse.Body}");
+
+        ServerHttpResponse idTokenResponse = await DispatchUserInfoAsync(
+            host, material, "Bearer " + idToken).ConfigureAwait(false);
+        Assert.AreEqual(401, idTokenResponse.StatusCode,
+            $"An ID Token (typ JWT) presented as a Bearer access token must be rejected. Body: {idTokenResponse.Body}");
+        Assert.Contains(OAuthErrors.InvalidToken, idTokenResponse.Body, StringComparison.Ordinal);
+        Assert.Contains("typ", idTokenResponse.Body, StringComparison.OrdinalIgnoreCase);
+    }
+
+
+    /// <summary>
+    /// The reverse substitution: <see cref="Oidc10IdTokenValidator"/> (RFC 8725 §3.11 explicit typing)
+    /// must REFUSE a genuine <c>at+jwt</c> access token — accepting one as an ID Token would trust it as
+    /// proof of end-user authentication it never carried — while still accepting the real id_token
+    /// (typ <c>JWT</c>) from the same issuance.
+    /// </summary>
+    [TestMethod]
+    public async Task Oidc10IdTokenValidatorRejectsRealAccessTokenButAcceptsRealIdToken()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        (string accessToken, string idToken) = await DriveCodeExchangeAsync(
+            host, material, WellKnownScopes.OpenId).ConfigureAwait(false);
+
+        Oidc10IdTokenValidationResult accessAsIdResult = await ValidateAsIdTokenAsync(
+            accessToken, material, ClientId).ConfigureAwait(false);
+        Assert.IsFalse(accessAsIdResult.IsSuccess,
+            "A genuine at+jwt access token must not validate as an ID Token (RFC 8725 §3.11 explicit typing).");
+        Assert.AreEqual(JwsAccessTokenValidationFailureReason.InvalidType, accessAsIdResult.FailureReason,
+            "The rejection must be attributed to the access-token typ discriminator, not some other check.");
+
+        Oidc10IdTokenValidationResult idTokenResult = await ValidateAsIdTokenAsync(
+            idToken, material, ClientId).ConfigureAwait(false);
+        Assert.IsTrue(idTokenResult.IsSuccess,
+            $"The real id_token (typ JWT) must validate through the ID Token validator; got {idTokenResult.FailureReason}: {idTokenResult.FailureDescription}");
+    }
+
+
+    /// <summary>
+    /// Drives a real PAR → Authorize → Token exchange with <paramref name="scope"/> and returns the
+    /// issued <c>access_token</c> and <c>id_token</c> from the wire response body — both minted by the
+    /// production pipeline, never hand-built fixtures.
+    /// </summary>
+    private async Task<(string AccessToken, string IdToken)> DriveCodeExchangeAsync(
+        TestHostShell host, VerifierKeyMaterial material, string scope)
+    {
+        PkceParameters pkce = PkceGeneration.Generate(
+            TestSetup.Base64UrlEncoder, BaseMemoryPool.Shared);
+
+        RequestFields parFields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.CodeChallenge] = pkce.EncodedChallenge,
+            [OAuthRequestParameterNames.CodeChallengeMethod] = WellKnownCodeChallengeMethods.S256,
+            [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString,
+            [OAuthRequestParameterNames.Scope] = scope
+        };
+        ServerHttpResponse parResponse = await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value,
+            WellKnownEndpointNames.AuthCodePar, WellKnownHttpMethods.Post,
+            parFields, new ExchangeContext(),
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(201, parResponse.StatusCode, parResponse.Body);
+        string requestUri = ExtractFromBody(parResponse.Body!, "request_uri");
+
+        RequestFields authorizeFields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.RequestUri] = requestUri
+        };
+        ExchangeContext authorizeContext = new();
+        authorizeContext.SetSubjectId(SubjectId);
+        ServerHttpResponse authorizeResponse = await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value,
+            WellKnownEndpointNames.AuthCodeAuthorize, WellKnownHttpMethods.Get,
+            authorizeFields, authorizeContext,
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(302, authorizeResponse.StatusCode);
+        string code = ExtractCode(authorizeResponse.Location!);
+
+        RequestFields tokenFields = new()
+        {
+            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.AuthorizationCode,
+            [OAuthRequestParameterNames.Code] = code,
+            [OAuthRequestParameterNames.CodeVerifier] = pkce.EncodedVerifier,
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString
+        };
+        ServerHttpResponse tokenResponse = await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value,
+            WellKnownEndpointNames.AuthCodeToken, WellKnownHttpMethods.Post,
+            tokenFields, new ExchangeContext(),
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, tokenResponse.StatusCode, tokenResponse.Body);
+
+        return (
+            ExtractFromBody(tokenResponse.Body!, "access_token"),
+            ExtractFromBody(tokenResponse.Body!, "id_token"));
+    }
+
+
+    /// <summary>
+    /// Validates <paramref name="token"/> as an access token against the host's real issuer and
+    /// signing key — the relying-party side reconstructed from wire bytes only, the same shape
+    /// <see cref="AzpMultiAudienceScenarioTests"/> uses for the ID-Token azp scenarios.
+    /// </summary>
+    private async Task<JwsAccessTokenValidationResult> ValidateAsAccessTokenAsync(
+        string token, VerifierKeyMaterial material, string expectedAudience)
+    {
+        ServerVerificationKeyResolverDelegate resolveKey = (kid, tenant, ctx, ct) =>
+            ValueTask.FromResult<PublicKeyMemory?>(
+                string.Equals(kid.Value, material.SigningKeyId.Value, StringComparison.Ordinal)
+                    ? material.SigningPublicKey : null);
+
+        return await JwsAccessTokenValidator.ValidateAsync(
+            token,
+            material.Registration.IssuerUri!.OriginalString,
+            expectedAudience,
+            resolveKey,
+            MicrosoftCryptographicFunctions.VerifyP256Async,
+            JwsAccessTokenTestSupport.Parser,
+            TestSetup.Base64UrlDecoder,
+            TimeProvider,
+            BaseMemoryPool.Shared,
+            IatSkew,
+            tenantId: default,
+            new ExchangeContext(),
+            expectedAuthorizedParty: null,
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>
+    /// Validates <paramref name="token"/> through <see cref="Oidc10IdTokenValidator"/> (the OIDC
+    /// §3.1.3.7 ID Token path) against the host's real issuer and signing key.
+    /// </summary>
+    private async Task<Oidc10IdTokenValidationResult> ValidateAsIdTokenAsync(
+        string token, VerifierKeyMaterial material, string expectedAudience)
+    {
+        ServerVerificationKeyResolverDelegate resolveKey = (kid, tenant, ctx, ct) =>
+            ValueTask.FromResult<PublicKeyMemory?>(
+                string.Equals(kid.Value, material.SigningKeyId.Value, StringComparison.Ordinal)
+                    ? material.SigningPublicKey : null);
+
+        return await Oidc10IdTokenValidator.ValidateAsync(
+            token,
+            material.Registration.IssuerUri!.OriginalString,
+            expectedAudience,
+            resolveKey,
+            MicrosoftCryptographicFunctions.VerifyP256Async,
+            JwsAccessTokenTestSupport.Parser,
+            TestSetup.Base64UrlDecoder,
+            TimeProvider,
+            BaseMemoryPool.Shared,
+            IatSkew,
+            tenantId: default,
+            new ExchangeContext(),
+            expectedAuthorizedParty: null,
+            expectedNonce: null,
+            trustedAudiences: null,
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>Validates a hand-built token against a locally resolved (non-host) key, mirroring <see cref="JwsAccessTokenValidatorTests"/>.</summary>
+    private async Task<JwsAccessTokenValidationResult> ValidateStandaloneAsync(string token, PublicKeyMemory publicKey)
+    {
+        ServerVerificationKeyResolverDelegate resolver = (kid, tenant, ctx, ct) =>
+            ValueTask.FromResult<PublicKeyMemory?>(string.Equals(kid.Value, StandaloneKid, StringComparison.Ordinal)
+                ? publicKey : null);
+
+        return await JwsAccessTokenValidator.ValidateAsync(
+            token,
+            StandaloneIssuer,
+            StandaloneAudience,
+            resolver,
+            MicrosoftCryptographicFunctions.VerifyP256Async,
+            JwsAccessTokenTestSupport.Parser,
+            TestSetup.Base64UrlDecoder,
+            TimeProvider,
+            BaseMemoryPool.Shared,
+            IatSkew,
+            tenantId: default,
+            new ExchangeContext(),
+            expectedAuthorizedParty: null,
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    private async ValueTask<ServerHttpResponse> DispatchUserInfoAsync(
+        TestHostShell host, VerifierKeyMaterial material, string authorizationHeader)
+    {
+        string segment = material.Registration.TenantId.Value;
+        string path = TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.UserInfo, segment);
+
+        RequestHeaders headers = new(new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase)
+        {
+            [WellKnownHttpHeaderNames.Authorization] = [authorizationHeader]
+        });
+
+        IncomingRequest request = new(
+            Path: path,
+            Method: WellKnownHttpMethods.Post,
+            Fields: new RequestFields(),
+            Headers: headers,
+            RouteValues: RouteValues.Empty);
+
+        ExchangeContext context = new();
+        context.SetTenantId(segment);
+
+        return await host.Server.DispatchAsync(request, context, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+    }
+
+
+    private static ReadOnlySpan<byte> HeaderSerializer(JwtHeader header) =>
+        JsonSerializerExtensions.SerializeToUtf8Bytes(
+            (Dictionary<string, object>)header,
+            TestSetup.DefaultSerializationOptions);
+
+
+    private static ReadOnlySpan<byte> PayloadSerializer(JwtPayload payload) =>
+        JsonSerializerExtensions.SerializeToUtf8Bytes(
+            (Dictionary<string, object>)payload,
+            TestSetup.DefaultSerializationOptions);
+
+
+    private static string ExtractFromBody(string body, string property)
+    {
+        using JsonDocument doc = JsonDocument.Parse(body);
+
+        return doc.RootElement.GetProperty(property).GetString()!;
+    }
+
+
+    private static string ExtractCode(string location)
+    {
+        Uri uri = new(location);
+        string query = uri.Query.TrimStart('?');
+        foreach(string pair in query.Split('&'))
+        {
+            string[] parts = pair.Split('=', 2);
+            if(parts.Length == 2 && parts[0] == "code")
+            {
+                return Uri.UnescapeDataString(parts[1]);
+            }
+        }
+
+        throw new InvalidOperationException($"No code in redirect: {location}");
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/AgenticFlowCapstoneTests.cs b/test/Verifiable.Tests/OAuth/AgenticFlowCapstoneTests.cs
new file mode 100644
index 00000000..29af2992
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/AgenticFlowCapstoneTests.cs
@@ -0,0 +1,1764 @@
+using System;
+using System.Buffers;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Diagnostics;
+using System.Linq;
+using System.Net.Http;
+using System.Net.Http.Headers;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Core.OutboundFetch;
+using Verifiable.Cryptography;
+using Verifiable.Cryptography.Context;
+using Verifiable.JCose;
+using Verifiable.Json;
+using Verifiable.Microsoft;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Dpop;
+using Verifiable.OAuth.IdJag;
+using Verifiable.OAuth.JwtBearer;
+using Verifiable.OAuth.ProtectedResource;
+using Verifiable.OAuth.Server;
+using Verifiable.OAuth.Server.Pipeline;
+using Verifiable.OAuth.TokenExchange;
+using Verifiable.Server;
+using Verifiable.Server.Diagnostics;
+using Verifiable.Tests.TestDataProviders;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// The AIIM/Gartner interop event's composed agentic scenario as one real-wire E2E capstone:
+/// one OAuth client (the "MCP client" — no MCP JSON-RPC framing anywhere; that composition is
+/// app-side) drives RFC 9728 discovery at a resource server, RFC 8414 discovery and a CIMD
+/// (draft-ietf-oauth-client-id-metadata-document-02) authorization-code + PKCE + OIDC flow at
+/// one authorization server, an ID-JAG mint (draft-ietf-oauth-identity-assertion-authz-grant-04
+/// §4.3) whose subject token is the REAL step-3 <c>id_token</c>, a cross-trust-domain redeem
+/// (§4.4) at a second authorization server that knows the client ONLY through its Client ID
+/// Metadata Document, and finally both protected resources — across six simultaneous Kestrel
+/// hosts with six distinct TLS identities. The whole happy path runs under ONE root
+/// <see cref="Activity"/> and must form one connected W3C Trace Context span tree
+/// (<see cref="TraceTreeAssertions"/>).
+/// </summary>
+/// <remarks>
+/// <para>
+/// The six hosts: the CIMD document host and the client's <c>jwks_uri</c> host (the §8.2
+/// canonical confidential-client shape publishes the key set at a separate origin), AS1
+/// (auth-code + PKCE + OIDC id_token + token-exchange/ID-JAG mint, RFC 9207), RS1 (trusts AS1),
+/// AS2 (jwt-bearer redeem, materializes the client via CIMD on the redeem's wire
+/// <c>client_id</c>, <c>(issuer, jti)</c> replay-guarded), and RS2 (trusts AS2).
+/// </para>
+/// <para>
+/// <c>[DoNotParallelize]</c> because the broad <see cref="TraceTreeCapture"/>
+/// <see cref="ActivityListener"/> enables process-wide framework instrumentation
+/// (<c>Microsoft.AspNetCore</c>, <c>System.Net.Http</c>), which would inject <c>traceparent</c>
+/// headers into concurrently running tests' HTTP calls and capture their spans here;
+/// serialization plus root-TraceId filtering keeps the suite deterministic.
+/// </para>
+/// <para>
+/// DPoP is out of capstone scope (the event plan never mentions it; existing suites own it) —
+/// Bearer tokens throughout, matching the event flow.
+/// </para>
+/// </remarks>
+[TestClass]
+[DoNotParallelize]
+internal sealed class AgenticFlowCapstoneTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private const string SubjectId = "subject-agentic-capstone-01";
+    private const string ClientSigningKeyId = "agentic-client-signing-key-1";
+    private const string DocumentPath = "/agentic-client";
+    private const string JwksPath = "/agentic-client-keys";
+
+    /// <summary>The scope RS1 requires on every token reaching its protected resource (RFC 6750 §3.1).</summary>
+    private const string Rs1RequiredScope = "inventory.read";
+
+    /// <summary>The scope RS2 requires; also the scope the step-5 ID-JAG mint requests.</summary>
+    private const string Rs2RequiredScope = "reports.read";
+
+    /// <summary>A scope AS1 never grants at step 3, used to prove the ICHAIN-024 ceiling.</summary>
+    private const string ScopeBeyondGrant = "admin.write";
+
+    /// <summary>The RFC 9068 <c>aud</c> AS1 stamps and RS1 expects.</summary>
+    private const string Rs1Audience = "https://rs1.agentic.example";
+
+    /// <summary>The RFC 9068 <c>aud</c> AS2 stamps and RS2 expects.</summary>
+    private const string Rs2Audience = "https://rs2.agentic.example";
+
+    private static readonly Uri ClientRedirectUri = new("https://agentic-client.example/callback");
+
+    /// <summary>The step-3 scope request: <c>openid</c> for the id_token plus both resource scopes.</summary>
+    private static readonly string Step3ScopeRequest =
+        $"{WellKnownScopes.OpenId} {Rs1RequiredScope} {Rs2RequiredScope}";
+
+    private static MemoryPool<byte> Pool => BaseMemoryPool.Shared;
+
+    /// <summary>Serialises a JWT protected header to UTF-8 JSON bytes for client-side signing.</summary>
+    private static readonly JwtHeaderSerializer CapstoneHeaderSerializer =
+        static header => JsonSerializerExtensions.SerializeToUtf8Bytes(
+            (Dictionary<string, object>)header, TestSetup.DefaultSerializationOptions);
+
+    /// <summary>Serialises a JWT payload to UTF-8 JSON bytes for client-side signing.</summary>
+    private static readonly JwtPayloadSerializer CapstonePayloadSerializer =
+        static payload => JsonSerializerExtensions.SerializeToUtf8Bytes(
+            (Dictionary<string, object>)payload, TestSetup.DefaultSerializationOptions);
+
+
+    /// <summary>
+    /// Scenario steps 1–7 in one method under one root <see cref="Activity"/>: RS1 challenge →
+    /// RFC 9728 OPRM discovery → AS1 (and AS2) RFC 8414 discovery with the metadata-continuity
+    /// assertions → CIMD auth-code + PKCE with the RFC 9207 <c>iss</c> byte-exact and a REAL OIDC
+    /// <c>id_token</c> → RS1 200 → <c>OAuthClient.IdJag.MintAsync</c> with that id_token as the
+    /// subject token → cross-trust-domain <c>RedeemAsync</c> at AS2 (CIMD-materialized,
+    /// <c>private_key_jwt</c>-authenticated) → RS2 200 — finishing with the D7 span-tree
+    /// assertions over the six hosts.
+    /// </summary>
+    [TestMethod]
+    public async Task AgenticFlowHappyPathAcrossSixHostsFormsOneConnectedTrace()
+    {
+        using TraceTreeCapture capture = new();
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        //Six distinct TLS identities — every host in the topology presents its own leaf certificate.
+        string[] certificateThumbprints =
+        [
+            topology.DocumentHost.Certificate.Thumbprint,
+            topology.JwksHost.Certificate.Thumbprint,
+            topology.Shell.HostCertificate("default").Thumbprint,
+            topology.Shell.HostCertificate(CapstoneTopology.As2HostName).Thumbprint,
+            topology.Rs1.HttpCertificate!.Thumbprint,
+            topology.Rs2.HttpCertificate!.Thumbprint
+        ];
+        Assert.HasCount(6, certificateThumbprints.Distinct(StringComparer.Ordinal),
+            "The six hosts must present six distinct TLS identities.");
+
+        using Activity root = new("agentic-flow-capstone");
+        root.Start();
+
+        //Step 1 — unauthenticated probe at RS1: 401, RFC 6750 §3 Bearer challenge WITHOUT an error
+        //code, carrying the RFC 9728 §5.1 resource_metadata parameter that starts discovery.
+        using HttpResponseMessage probe = await topology.Rs1Http.GetAsync(
+            new Uri(topology.Rs1.HttpBaseAddress!, "/protected"), TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(401, (int)probe.StatusCode, "An unauthenticated request must be challenged.");
+        BearerTokenChallengeParameters probeChallenge = ParseBearerChallenge(probe);
+        Assert.IsNull(probeChallenge.Error,
+            "RFC 6750 §3: a request without authentication information gets a challenge without an error code.");
+        Assert.IsNotNull(probeChallenge.ResourceMetadata,
+            "The challenge must advertise the RFC 9728 §5.1 resource_metadata URL.");
+
+        //Fetch the advertised OPRM document and learn RS1's one trusted authorization server.
+        using HttpResponseMessage oprmResponse = await topology.Rs1Http.GetAsync(
+            probeChallenge.ResourceMetadata, TestContext.CancellationToken).ConfigureAwait(false);
+        string oprmBody = await oprmResponse.Content.ReadAsStringAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(200, (int)oprmResponse.StatusCode, oprmBody);
+        ProtectedResourceMetadata? oprm = ProtectedResourceMetadataJsonParsing.ParseProtectedResourceMetadata(oprmBody);
+        Assert.IsNotNull(oprm);
+        Assert.IsTrue(ProtectedResourceMetadataValidation.IsResourceMatch(
+            oprm!, topology.Rs1.ResourceIdentity!.OriginalString),
+            "RFC 9728 §3.3 (first paragraph): the document's resource value must equal the resource identifier RS1 represents.");
+        string discoveredAs1Issuer = oprm!.AuthorizationServers!.Single();
+        Assert.AreEqual(topology.As1Issuer.OriginalString, discoveredAs1Issuer,
+            "The OPRM document must name AS1 as RS1's one trusted authorization server.");
+
+        //Step 2 — AS1 discovery from the OPRM-discovered issuer, plus the metadata-continuity set:
+        //AS1 advertises CIMD support and the ID-JAG §7.1 identity-chaining token type; AS2
+        //advertises CIMD support, the jwt-bearer grant, and the §7.2 id-jag grant profile.
+        using JsonDocument as1Discovery = await FetchDiscoveryAsync(
+            topology.As1.SharedHttpClient!, discoveredAs1Issuer, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.IsTrue(as1Discovery.RootElement.GetProperty(
+            AuthorizationServerMetadataParameterNames.ClientIdMetadataDocumentSupported).GetBoolean(),
+            "AS1 must advertise client_id_metadata_document_supported: true.");
+        string[] as1ChainingTokenTypes = ReadStringArray(
+            as1Discovery.RootElement, AuthorizationServerMetadataParameterNames.IdentityChainingRequestedTokenTypesSupported);
+        Assert.Contains(TokenTypeNames.GetName(TokenType.IdJag), as1ChainingTokenTypes,
+            "ID-JAG §7.1 / ICHAIN-013: AS1 must advertise the id-jag requested token type.");
+        string[] as1GrantTypes = ReadStringArray(
+            as1Discovery.RootElement, AuthorizationServerMetadataParameterNames.GrantTypesSupported);
+        Assert.Contains(WellKnownGrantTypes.TokenExchange, as1GrantTypes);
+
+        using JsonDocument as2Discovery = await FetchDiscoveryAsync(
+            topology.As2.SharedHttpClient!, topology.As2Issuer.OriginalString, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.IsTrue(as2Discovery.RootElement.GetProperty(
+            AuthorizationServerMetadataParameterNames.ClientIdMetadataDocumentSupported).GetBoolean(),
+            "AS2 must advertise client_id_metadata_document_supported: true.");
+        string[] as2GrantTypes = ReadStringArray(
+            as2Discovery.RootElement, AuthorizationServerMetadataParameterNames.GrantTypesSupported);
+        Assert.Contains(WellKnownGrantTypes.JwtBearer, as2GrantTypes,
+            "ID-JAG §7.2: an AS advertising the id-jag grant profile must include the jwt-bearer grant type.");
+        string[] as2GrantProfiles = ReadStringArray(
+            as2Discovery.RootElement, AuthorizationServerMetadataParameterNames.AuthorizationGrantProfilesSupported);
+        Assert.Contains(WellKnownGrantProfiles.IdJag, as2GrantProfiles,
+            "ID-JAG §7.2: AS2 must advertise the id-jag authorization grant profile.");
+
+        //Step 3 — CIMD authorization-code + PKCE at AS1 with a REAL OIDC id_token in the response.
+        CapstoneStep3Result step3 = await topology.DriveStep3Async(Step3ScopeRequest, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Assert.IsTrue(topology.DocumentHost.WasRequested(DocumentPath),
+            "AS1 must have fetched the Client ID Metadata Document over the real wire (CIMD-029).");
+        Assert.IsTrue(topology.JwksHost.WasRequested(JwksPath),
+            "The §8.2 jwks_uri discovery must have fetched the client's key set over the real wire.");
+
+        string? issParameter = TestBrowser.ExtractQueryParam(step3.AuthorizeLocation, OAuthRequestParameterNames.Iss);
+        Assert.IsNotNull(issParameter, "RFC 9207: the authorization response must carry the iss parameter.");
+        Assert.AreEqual(topology.As1Issuer.OriginalString, issParameter,
+            "RFC 9207 §2: iss must byte-exactly equal the issuer identifier even though the client's "
+            + "identity came from a fetched CIMD document.");
+
+        using(JsonDocument accessClaims = DecodePayload(step3.AccessToken))
+        {
+            JsonElement claims = accessClaims.RootElement;
+            Assert.AreEqual(topology.As1Issuer.OriginalString, claims.GetProperty(WellKnownJwtClaimNames.Iss).GetString());
+            Assert.AreEqual(SubjectId, claims.GetProperty(WellKnownJwtClaimNames.Sub).GetString());
+            AssertAudienceClaim(claims, Rs1Audience);
+            string tokenScope = claims.GetProperty(WellKnownJwtClaimNames.Scope).GetString()!;
+            Assert.AreEqual(Step3ScopeRequest, tokenScope,
+                "AS1 must have granted the full requested scope set at step 3.");
+        }
+
+        using(JsonDocument idTokenClaims = DecodePayload(step3.IdToken))
+        {
+            JsonElement claims = idTokenClaims.RootElement;
+            Assert.AreEqual(topology.As1Issuer.OriginalString, claims.GetProperty(WellKnownJwtClaimNames.Iss).GetString());
+            Assert.AreEqual(SubjectId, claims.GetProperty(WellKnownJwtClaimNames.Sub).GetString());
+            AssertAudienceClaim(claims, topology.ClientIdentifierUrl.OriginalString);
+        }
+
+        //Step 4 — RS1 accepts the AS1 access token: signature / iss / aud / exp via
+        //JwsAccessTokenValidator plus required-scope enforcement.
+        using(JsonDocument rs1Claims = await GetProtectedResourceAsync(
+            topology.Rs1Http, topology.Rs1.HttpBaseAddress!, step3.AccessToken, TestContext.CancellationToken)
+            .ConfigureAwait(false))
+        {
+            Assert.AreEqual(SubjectId, rs1Claims.RootElement.GetProperty(WellKnownJwtClaimNames.Sub).GetString());
+            string rs1Scope = rs1Claims.RootElement.GetProperty(WellKnownJwtClaimNames.Scope).GetString()!;
+            Assert.Contains(Rs1RequiredScope, rs1Scope.Split(' '),
+                "The token reaching RS1 must carry RS1's required scope.");
+        }
+
+        //Step 5 — the client mints an ID-JAG at AS1 via OAuthClient.IdJag: the subject token is
+        //the REAL step-3 id_token, the audience names AS2's issuer, and the requested JAG scope
+        //sits inside the step-3 grant (ICHAIN-024 ceiling).
+        var mintResult = await topology.As1Client.IdJag.MintAsync(
+            topology.As1Registration,
+            topology.BuildMintOptions(step3.IdToken, Rs2RequiredScope),
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.IsTrue(mintResult.IsSuccess, mintResult.Error?.Support.Summary);
+        Assert.AreEqual("N_A", mintResult.Value.TokenType, "ID-JAG §4.3.4: the minted grant is not an access token.");
+
+        string jag = mintResult.Value.AccessToken;
+        using(JsonDocument jagHeader = DecodeHeader(jag))
+        {
+            Assert.AreEqual("oauth-id-jag+jwt", jagHeader.RootElement.GetProperty(WellKnownJoseHeaderNames.Typ).GetString());
+        }
+
+        using(JsonDocument jagClaims = DecodePayload(jag))
+        {
+            JsonElement claims = jagClaims.RootElement;
+            Assert.AreEqual(topology.As1Issuer.OriginalString, claims.GetProperty(WellKnownJwtClaimNames.Iss).GetString());
+            Assert.AreEqual(SubjectId, claims.GetProperty(WellKnownJwtClaimNames.Sub).GetString());
+            Assert.AreEqual(topology.As2Issuer.OriginalString, claims.GetProperty(WellKnownJwtClaimNames.Aud).GetString(),
+                "The JAG aud must name AS2's issuer identifier.");
+            Assert.AreEqual(topology.ClientIdentifierUrl.OriginalString,
+                claims.GetProperty(WellKnownJwtClaimNames.ClientId).GetString());
+            Assert.IsFalse(string.IsNullOrEmpty(claims.GetProperty(WellKnownJwtClaimNames.Jti).GetString()));
+            Assert.AreEqual(Rs2RequiredScope, claims.GetProperty(WellKnownJwtClaimNames.Scope).GetString());
+        }
+
+        //Step 6 — cross-trust-domain redeem at AS2: materialization triggers on the redeem's wire
+        //client_id (proven by the fetch-count delta), the private_key_jwt assertion validates
+        //against the materialized document jwks, and AS2 issues its OWN access token.
+        int documentFetchesBeforeRedeem = topology.DocumentHost.TotalRequests;
+        var redeemResult = await topology.As2Client.IdJag.RedeemAsync(
+            topology.As2Registration, topology.BuildRedeemOptions(jag), TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.IsTrue(redeemResult.IsSuccess, redeemResult.Error?.Support.Summary);
+        Assert.AreEqual(WellKnownAuthenticationSchemes.Bearer, redeemResult.Value.TokenType);
+        Assert.IsGreaterThan(documentFetchesBeforeRedeem, topology.DocumentHost.TotalRequests,
+            "AS2 must have materialized the client from its CIMD document on the redeem's wire client_id.");
+
+        string as2AccessToken = redeemResult.Value.AccessToken;
+        using(JsonDocument as2Claims = DecodePayload(as2AccessToken))
+        {
+            JsonElement claims = as2Claims.RootElement;
+            string as2TokenIssuer = claims.GetProperty(WellKnownJwtClaimNames.Iss).GetString()!;
+            Assert.AreEqual(topology.As2Issuer.OriginalString, as2TokenIssuer);
+            Assert.AreNotEqual(topology.As1Issuer.OriginalString, as2TokenIssuer,
+                "The redeemed access token's issuer must be AS2, a different trust domain than AS1.");
+            Assert.AreEqual(SubjectId, claims.GetProperty(WellKnownJwtClaimNames.Sub).GetString(),
+                "The subject must survive the whole id_token → JAG → access-token chain.");
+            Assert.AreEqual(Rs2RequiredScope, claims.GetProperty(WellKnownJwtClaimNames.Scope).GetString());
+            AssertAudienceClaim(claims, Rs2Audience);
+        }
+
+        //Step 7 — RS2 accepts the AS2 token.
+        using(JsonDocument rs2Claims = await GetProtectedResourceAsync(
+            topology.Rs2Http, topology.Rs2.HttpBaseAddress!, as2AccessToken, TestContext.CancellationToken)
+            .ConfigureAwait(false))
+        {
+            Assert.AreEqual(SubjectId, rs2Claims.RootElement.GetProperty(WellKnownJwtClaimNames.Sub).GetString());
+        }
+
+        Uri[] hostBaseAddresses =
+        [
+            topology.DocumentHost.BaseAddress,
+            topology.JwksHost.BaseAddress,
+            topology.As1.HttpBaseAddress!,
+            topology.As2.HttpBaseAddress!,
+            topology.Rs1.HttpBaseAddress!,
+            topology.Rs2.HttpBaseAddress!
+        ];
+
+        root.Stop();
+
+        //Stopping the hosts drains request processing, so every server span has stopped and is in
+        //the capture before the tree is asserted.
+        await topology.StopHostsAsync().ConfigureAwait(false);
+
+        IReadOnlyList<Activity> captured = capture.StoppedActivities;
+        TraceTreeAssertions.AssertSingleConnectedTree(captured, root);
+        TraceTreeAssertions.AssertSpanForEachHost(captured, root, hostBaseAddresses);
+
+        //The CIMD resolutions are wire fetches issued mid-dispatch: the client spans dialing the
+        //document (and jwks_uri) hosts must sit under the owning AS's server.handle dispatch span.
+        AssertWireFetchUnderDispatchSpan(captured, root, topology.DocumentHost.BaseAddress, topology.Segment1,
+            "AS1's CIMD document resolution must attach under AS1's dispatch span.");
+        AssertWireFetchUnderDispatchSpan(captured, root, topology.JwksHost.BaseAddress, topology.Segment1,
+            "AS1's §8.2 jwks_uri discovery must attach under AS1's dispatch span.");
+        AssertWireFetchUnderDispatchSpan(captured, root, topology.DocumentHost.BaseAddress, topology.Segment2,
+            "AS2's CIMD document resolution must attach under AS2's dispatch span.");
+    }
+
+
+    /// <summary>
+    /// Cross-domain confusion, first direction: the AS1 access token presented at RS2 is refused
+    /// 401 with an RFC 6750 §3 <c>invalid_token</c> challenge — RS2 trusts only AS2's issuer.
+    /// </summary>
+    [TestMethod]
+    public async Task As1AccessTokenAtRs2IsRefusedWithInvalidTokenChallenge()
+    {
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        CapstoneStep3Result step3 = await topology.DriveStep3Async(Step3ScopeRequest, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        using HttpResponseMessage response = await SendBearerAsync(
+            topology.Rs2Http, topology.Rs2.HttpBaseAddress!, step3.AccessToken, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(401, (int)response.StatusCode, "RS2 must refuse a token minted by AS1.");
+        BearerTokenChallengeParameters challenge = ParseBearerChallenge(response);
+        Assert.AreEqual(OAuthErrors.InvalidToken, challenge.Error);
+        Assert.AreEqual(topology.Rs2.MetadataUrl!.OriginalString, challenge.ResourceMetadata?.OriginalString,
+            "The refusal challenge must still advertise RS2's own metadata URL (RFC 9728 §5.1).");
+    }
+
+
+    /// <summary>
+    /// Cross-domain confusion, second direction: the AS2 access token obtained through the full
+    /// mint + redeem chain is refused 401 <c>invalid_token</c> at RS1 — RS1 trusts only AS1.
+    /// </summary>
+    [TestMethod]
+    public async Task As2AccessTokenAtRs1IsRefusedWithInvalidTokenChallenge()
+    {
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        CapstoneStep3Result step3 = await topology.DriveStep3Async(Step3ScopeRequest, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        string jag = await topology.MintJagAsync(step3.IdToken, Rs2RequiredScope, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        var redeemResult = await topology.As2Client.IdJag.RedeemAsync(
+            topology.As2Registration, topology.BuildRedeemOptions(jag), TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.IsTrue(redeemResult.IsSuccess, redeemResult.Error?.Support.Summary);
+
+        using HttpResponseMessage response = await SendBearerAsync(
+            topology.Rs1Http, topology.Rs1.HttpBaseAddress!, redeemResult.Value.AccessToken, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(401, (int)response.StatusCode, "RS1 must refuse a token minted by AS2.");
+        BearerTokenChallengeParameters challenge = ParseBearerChallenge(response);
+        Assert.AreEqual(OAuthErrors.InvalidToken, challenge.Error);
+        Assert.AreEqual(topology.Rs1.MetadataUrl!.OriginalString, challenge.ResourceMetadata?.OriginalString,
+            "The refusal challenge must still advertise RS1's own metadata URL (RFC 9728 §5.1).");
+    }
+
+
+    /// <summary>
+    /// Scope escalation at the resource: a fully valid AS1 token granted only <c>openid</c> is
+    /// refused 403 at RS1 with the RFC 6750 §3.1 <c>insufficient_scope</c> challenge whose
+    /// <c>scope</c> attribute names the needed scope.
+    /// </summary>
+    [TestMethod]
+    public async Task TokenWithoutRs1ScopeIsRefusedWithInsufficientScopeChallenge()
+    {
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        CapstoneStep3Result step3 = await topology.DriveStep3Async(WellKnownScopes.OpenId, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        using HttpResponseMessage response = await SendBearerAsync(
+            topology.Rs1Http, topology.Rs1.HttpBaseAddress!, step3.AccessToken, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(403, (int)response.StatusCode,
+            "RFC 6750 §3.1: insufficient_scope maps to 403, not 401.");
+        BearerTokenChallengeParameters challenge = ParseBearerChallenge(response);
+        Assert.AreEqual(OAuthErrors.InsufficientScope, challenge.Error);
+        Assert.AreEqual(Rs1RequiredScope, challenge.Scope,
+            "The challenge's scope attribute must name the scope necessary to access the resource.");
+    }
+
+
+    /// <summary>
+    /// The ICHAIN-024 ceiling: a mint requesting a JAG scope outside the scopes AS1 granted
+    /// alongside the id_token's issuance at step 3 is denied — the fixture's authorization seam
+    /// enforces requested ⊆ ceiling, and a denied id-jag exchange maps to <c>invalid_grant</c>
+    /// (ID-JAG §4.3.4.3).
+    /// </summary>
+    [TestMethod]
+    public async Task MintRequestingScopeBeyondStep3GrantIsDenied()
+    {
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        CapstoneStep3Result step3 = await topology.DriveStep3Async(Step3ScopeRequest, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        var mintResult = await topology.As1Client.IdJag.MintAsync(
+            topology.As1Registration,
+            topology.BuildMintOptions(step3.IdToken, ScopeBeyondGrant),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.IsFalse(mintResult.IsSuccess,
+            "A mint requesting scope beyond the step-3 grant must be denied (ICHAIN-024).");
+        OAuthProtocolError protocolError = Assert.IsInstanceOfType<OAuthProtocolError>(mintResult.Error);
+        Assert.AreEqual(OAuthErrors.InvalidGrant, protocolError.ErrorCode);
+    }
+
+
+    /// <summary>
+    /// Replay defense at AS2: the first redemption of a JAG succeeds and records its
+    /// <c>(issuer, jti)</c>; presenting the SAME grant again is refused <c>invalid_grant</c> by
+    /// the library's <see cref="JtiReplayGuard"/> over the host's shared store (RFC 7523 §3 rule 7).
+    /// </summary>
+    [TestMethod]
+    public async Task ReplayedJagAtAs2IsRefusedWithInvalidGrant()
+    {
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        CapstoneStep3Result step3 = await topology.DriveStep3Async(Step3ScopeRequest, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        string jag = await topology.MintJagAsync(step3.IdToken, Rs2RequiredScope, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        var firstRedeem = await topology.As2Client.IdJag.RedeemAsync(
+            topology.As2Registration, topology.BuildRedeemOptions(jag), TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.IsTrue(firstRedeem.IsSuccess, firstRedeem.Error?.Support.Summary);
+
+        var secondRedeem = await topology.As2Client.IdJag.RedeemAsync(
+            topology.As2Registration, topology.BuildRedeemOptions(jag), TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.IsFalse(secondRedeem.IsSuccess, "The second redemption of the same JAG must be refused.");
+        OAuthProtocolError protocolError = Assert.IsInstanceOfType<OAuthProtocolError>(secondRedeem.Error);
+        Assert.AreEqual(OAuthErrors.InvalidGrant, protocolError.ErrorCode);
+    }
+
+
+    /// <summary>
+    /// D2 on the redeem leg: the client's CIMD document declares
+    /// <c>token_endpoint_auth_method: private_key_jwt</c>, so a redeem carrying NO client
+    /// credentials at all is refused 401 <c>invalid_client</c> — CIMD-049's "any communication
+    /// with the authorization server MUST include client authentication of the registered type",
+    /// fail-closed against the materialized registration.
+    /// </summary>
+    [TestMethod]
+    public async Task RedeemWithoutClientAuthenticationIsRefused()
+    {
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        CapstoneStep3Result step3 = await topology.DriveStep3Async(Step3ScopeRequest, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        string jag = await topology.MintJagAsync(step3.IdToken, Rs2RequiredScope, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Dictionary<string, string> fields = new(StringComparer.Ordinal)
+        {
+            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.JwtBearer,
+            [OAuthRequestParameterNames.ClientId] = topology.ClientIdentifierUrl.OriginalString,
+            [OAuthRequestParameterNames.Assertion] = jag
+        };
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            topology.As2.SharedHttpClient!, topology.As2TokenEndpoint, fields, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(401, (int)response.StatusCode, body);
+        AssertWireErrorCode(OAuthErrors.InvalidClient, body);
+    }
+
+
+    /// <summary>
+    /// A tampered <c>private_key_jwt</c> client assertion on the redeem fails RFC 7523 §2.2
+    /// signature verification against the CIMD-materialized document jwks and is refused 401
+    /// <c>invalid_client</c>.
+    /// </summary>
+    [TestMethod]
+    public async Task RedeemWithTamperedClientAssertionIsRefused()
+    {
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        CapstoneStep3Result step3 = await topology.DriveStep3Async(Step3ScopeRequest, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        string jag = await topology.MintJagAsync(step3.IdToken, Rs2RequiredScope, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string validAssertion = await topology.SignClientAssertionForAs2Async(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Dictionary<string, string> fields = new(StringComparer.Ordinal)
+        {
+            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.JwtBearer,
+            [OAuthRequestParameterNames.ClientId] = topology.ClientIdentifierUrl.OriginalString,
+            [OAuthRequestParameterNames.Assertion] = jag,
+            [OAuthRequestParameterNames.ClientAssertionType] = WellKnownClientAssertionTypes.JwtBearer,
+            [OAuthRequestParameterNames.ClientAssertion] = TamperSignature(validAssertion)
+        };
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            topology.As2.SharedHttpClient!, topology.As2TokenEndpoint, fields, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(401, (int)response.StatusCode, body);
+        AssertWireErrorCode(OAuthErrors.InvalidClient, body);
+    }
+
+
+    /// <summary>
+    /// The §9.3 same-trust-domain rule: a JAG whose <c>iss</c> is AS2's own issuer — validly
+    /// signed with a key AS2 itself publishes, so signature trust alone would admit it — is
+    /// refused <c>invalid_grant</c> at AS2's redeem. Trust in the signing key must not permit
+    /// redeeming a grant minted in the Resource Authorization Server's own domain.
+    /// </summary>
+    [TestMethod]
+    public async Task SameTrustDomainJagIsRefusedWithInvalidGrant()
+    {
+        await using CapstoneTopology topology = await CapstoneTopology.BuildAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        DateTimeOffset now = topology.Time.GetUtcNow();
+        string sameDomainJag = await BuildForeignIdJagAsync(
+            topology.As2TokenSigningKey,
+            topology.As2TokenSigningKeyId.Value,
+            issuer: topology.As2Issuer.OriginalString,
+            subject: SubjectId,
+            audience: topology.As2Issuer.OriginalString,
+            clientId: topology.ClientIdentifierUrl.OriginalString,
+            scope: Rs2RequiredScope,
+            issuedAt: now,
+            expiresAt: now.AddMinutes(5),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        var redeemResult = await topology.As2Client.IdJag.RedeemAsync(
+            topology.As2Registration, topology.BuildRedeemOptions(sameDomainJag), TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Assert.IsFalse(redeemResult.IsSuccess,
+            "A JAG minted in AS2's own trust domain must not redeem at AS2 (§9.3).");
+        OAuthProtocolError protocolError = Assert.IsInstanceOfType<OAuthProtocolError>(redeemResult.Error);
+        Assert.AreEqual(OAuthErrors.InvalidGrant, protocolError.ErrorCode);
+    }
+
+
+    /// <summary>
+    /// Reads the single <c>WWW-Authenticate</c> value and parses it under the RFC 6750 §3 grammar,
+    /// failing the test when the header is absent or does not parse.
+    /// </summary>
+    private static BearerTokenChallengeParameters ParseBearerChallenge(HttpResponseMessage response)
+    {
+        Assert.IsTrue(response.Headers.TryGetValues("WWW-Authenticate", out IEnumerable<string>? challenges),
+            "The refusal must carry a WWW-Authenticate challenge.");
+        string challenge = challenges!.Single();
+        Assert.IsTrue(BearerTokenChallenge.TryParse(challenge, out BearerTokenChallengeParameters parameters),
+            $"The challenge must parse under the RFC 6750 §3 grammar. Header: {challenge}");
+
+        return parameters;
+    }
+
+
+    /// <summary>Asserts the RFC 6749 §5.2 JSON error body carries exactly <paramref name="expectedErrorCode"/>.</summary>
+    private static void AssertWireErrorCode(string expectedErrorCode, string responseBody)
+    {
+        using JsonDocument document = JsonDocument.Parse(responseBody);
+        Assert.AreEqual(expectedErrorCode, document.RootElement.GetProperty("error").GetString(),
+            $"The refusal body must carry the exact error code. Body: {responseBody}");
+    }
+
+
+    private static async Task<HttpResponseMessage> SendBearerAsync(
+        HttpClient client, Uri resourceServerBase, string accessToken, CancellationToken cancellationToken)
+    {
+        using HttpRequestMessage request = new(HttpMethod.Get, new Uri(resourceServerBase, "/protected"));
+        request.Headers.Authorization = new AuthenticationHeaderValue(WellKnownAuthenticationSchemes.Bearer, accessToken);
+
+        return await client.SendAsync(request, cancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>Sends the bearer token to <c>/protected</c>, asserts 200, and returns the echoed claims.</summary>
+    private static async Task<JsonDocument> GetProtectedResourceAsync(
+        HttpClient client, Uri resourceServerBase, string accessToken, CancellationToken cancellationToken)
+    {
+        using HttpResponseMessage response = await SendBearerAsync(
+            client, resourceServerBase, accessToken, cancellationToken).ConfigureAwait(false);
+        string body = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+
+        return JsonDocument.Parse(body);
+    }
+
+
+    /// <summary>
+    /// Fetches the RFC 8414 §3 default-location metadata document for <paramref name="issuer"/> —
+    /// the well-known suffix inserted between host and the issuer's path component — over the wire.
+    /// </summary>
+    private static async Task<JsonDocument> FetchDiscoveryAsync(
+        HttpClient client, string issuer, CancellationToken cancellationToken)
+    {
+        Uri discoveryUrl = WellKnownPaths.OAuthAuthorizationServer.ComputeUri(issuer);
+        using HttpResponseMessage response = await client.GetAsync(discoveryUrl, cancellationToken).ConfigureAwait(false);
+        string body = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+
+        return JsonDocument.Parse(body);
+    }
+
+
+    private static string[] ReadStringArray(JsonElement root, string propertyName) =>
+        [.. root.GetProperty(propertyName).EnumerateArray().Select(static element => element.GetString()!)];
+
+
+    /// <summary>
+    /// Asserts the <c>aud</c> claim equals <paramref name="expected"/>, accepting the RFC 7519
+    /// string shape and the single-element array shape.
+    /// </summary>
+    private static void AssertAudienceClaim(JsonElement claims, string expected)
+    {
+        JsonElement audience = claims.GetProperty(WellKnownJwtClaimNames.Aud);
+        string? actual = audience.ValueKind == JsonValueKind.Array
+            ? audience.EnumerateArray().Single().GetString()
+            : audience.GetString();
+        Assert.AreEqual(expected, actual);
+    }
+
+
+    private static JsonDocument DecodeHeader(string compactJws)
+    {
+        string[] segments = compactJws.Split('.');
+        Assert.HasCount(3, segments);
+
+        return JsonDocument.Parse(SecurityEventTestJson.DecodeSegment(segments[0], Pool));
+    }
+
+
+    private static JsonDocument DecodePayload(string compactJws)
+    {
+        string[] segments = compactJws.Split('.');
+        Assert.HasCount(3, segments);
+
+        return JsonDocument.Parse(SecurityEventTestJson.DecodeSegment(segments[1], Pool));
+    }
+
+
+    //Flips the FIRST character of the compact JWS's signature segment. The first base64url
+    //character contributes six full bits to the decoded bytes, so the mutated signature always
+    //decodes to different bytes — unlike the final character, whose low bits a lenient decoder
+    //can discard, yielding a no-op "tamper" that still verifies.
+    private static string TamperSignature(string compactJws)
+    {
+        int signatureStart = compactJws.LastIndexOf('.') + 1;
+        char first = compactJws[signatureStart];
+        char replacement = first == 'A' ? 'B' : 'A';
+
+        return string.Concat(
+            compactJws.AsSpan(0, signatureStart), replacement.ToString(), compactJws.AsSpan(signatureStart + 1));
+    }
+
+
+    /// <summary>
+    /// Builds and signs an ID-JAG entirely outside the mint pipeline — raw §3.1 claims under a
+    /// <c>typ=oauth-id-jag+jwt</c> header, signed with the supplied key — so the redeem path under
+    /// test receives foreign wire bytes shaped exactly like a grant minted elsewhere.
+    /// </summary>
+    private static async Task<string> BuildForeignIdJagAsync(
+        PrivateKeyMemory signingKey,
+        string keyId,
+        string issuer,
+        string subject,
+        string audience,
+        string clientId,
+        string scope,
+        DateTimeOffset issuedAt,
+        DateTimeOffset expiresAt,
+        CancellationToken cancellationToken)
+    {
+        string algorithm = CryptoFormatConversions.DefaultTagToJwaConverter(signingKey.Tag);
+        JwtHeader header = JwtHeader.ForSigning(algorithm, "oauth-id-jag+jwt", keyId);
+        JwtPayload payload = new(capacity: 8)
+        {
+            [WellKnownJwtClaimNames.Iss] = issuer,
+            [WellKnownJwtClaimNames.Sub] = subject,
+            [WellKnownJwtClaimNames.Aud] = audience,
+            [WellKnownJwtClaimNames.ClientId] = clientId,
+            [WellKnownJwtClaimNames.Jti] = Guid.NewGuid().ToString("N"),
+            [WellKnownJwtClaimNames.Iat] = issuedAt.ToUnixTimeSeconds(),
+            [WellKnownJwtClaimNames.Exp] = expiresAt.ToUnixTimeSeconds(),
+            [WellKnownJwtClaimNames.Scope] = scope
+        };
+
+        UnsignedJwt unsigned = new(header, payload);
+        using JwsMessage jws = await unsigned.SignAsync(
+            signingKey,
+            CapstoneHeaderSerializer,
+            CapstonePayloadSerializer,
+            TestSetup.Base64UrlEncoder,
+            Pool,
+            cancellationToken).ConfigureAwait(false);
+
+        return JwsSerialization.SerializeCompact(jws, TestSetup.Base64UrlEncoder);
+    }
+
+
+    /// <summary>
+    /// Asserts that at least one HTTP client span dialing <paramref name="contentHostBase"/> is a
+    /// descendant of a <c>server.handle</c> dispatch span whose <c>server.tenant.id</c> tag is
+    /// <paramref name="tenantSegment"/> — the structural proof that the fetch was issued
+    /// mid-dispatch by the owning authorization server, inside the same trace.
+    /// </summary>
+    private static void AssertWireFetchUnderDispatchSpan(
+        IReadOnlyList<Activity> capturedActivities,
+        Activity root,
+        Uri contentHostBase,
+        string tenantSegment,
+        string message)
+    {
+        IReadOnlyList<Activity> inTrace = TraceTreeAssertions.FilterByTrace(capturedActivities, root.TraceId);
+
+        Dictionary<ActivitySpanId, Activity> bySpanId = new(inTrace.Count);
+        foreach(Activity activity in inTrace)
+        {
+            bySpanId[activity.SpanId] = activity;
+        }
+
+        HashSet<ActivitySpanId> dispatchSpanIds = [.. inTrace
+            .Where(activity =>
+                string.Equals(activity.OperationName, ServerActivityNames.Handle, StringComparison.Ordinal)
+                && string.Equals(
+                    activity.GetTagItem(ServerTagNames.TenantId)?.ToString(), tenantSegment, StringComparison.Ordinal))
+            .Select(activity => activity.SpanId)];
+        Assert.IsGreaterThan(0, dispatchSpanIds.Count,
+            $"No server.handle dispatch span with tenant '{tenantSegment}' was captured in trace '{root.TraceId}'.");
+
+        bool isUnderDispatch = inTrace.Any(activity =>
+            activity.Kind == ActivityKind.Client
+            && IsClientSpanDialing(activity, contentHostBase)
+            && HasAncestorIn(activity, dispatchSpanIds, bySpanId));
+        Assert.IsTrue(isUnderDispatch, message);
+    }
+
+
+    private static bool IsClientSpanDialing(Activity activity, Uri hostBase)
+    {
+        string? urlFull = activity.GetTagItem("url.full")?.ToString();
+
+        return urlFull is not null
+            && Uri.TryCreate(urlFull, UriKind.Absolute, out Uri? url)
+            && string.Equals(url.Host, hostBase.Host, StringComparison.OrdinalIgnoreCase)
+            && url.Port == hostBase.Port;
+    }
+
+
+    private static bool HasAncestorIn(
+        Activity activity,
+        HashSet<ActivitySpanId> ancestorSpanIds,
+        Dictionary<ActivitySpanId, Activity> bySpanId)
+    {
+        HashSet<ActivitySpanId> visited = [activity.SpanId];
+        ActivitySpanId parentSpanId = activity.ParentSpanId;
+        while(visited.Add(parentSpanId))
+        {
+            if(ancestorSpanIds.Contains(parentSpanId))
+            {
+                return true;
+            }
+
+            if(!bySpanId.TryGetValue(parentSpanId, out Activity? parent))
+            {
+                return false;
+            }
+
+            parentSpanId = parent.ParentSpanId;
+        }
+
+        return false;
+    }
+
+
+    /// <summary>
+    /// Whether every space-separated scope token in <paramref name="requestedScope"/> appears in
+    /// <paramref name="grantedScope"/> — the ICHAIN-024 requested-⊆-ceiling comparison.
+    /// </summary>
+    private static bool IsScopeSubset(string requestedScope, string grantedScope)
+    {
+        HashSet<string> granted = new(
+            grantedScope.Split(' ', StringSplitOptions.RemoveEmptyEntries), StringComparer.Ordinal);
+        foreach(string requested in requestedScope.Split(' ', StringSplitOptions.RemoveEmptyEntries))
+        {
+            if(!granted.Contains(requested))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+
+    //Builds a conformant Client ID Metadata Document (§4): client_id always present; other
+    //members only when supplied, so an omitted property stays genuinely absent from the wire
+    //JSON. Mirrors ClientIdMetadataDocumentCrossWireFlowTests' builder; the capstone's document
+    //always takes the §8.2 canonical shape (private_key_jwt + jwks_uri at a separate origin).
+    private static string BuildCimdDocumentJson(
+        string clientId,
+        IReadOnlyList<Uri>? redirectUris,
+        string? tokenEndpointAuthMethod,
+        string? jwksUri)
+    {
+        List<string> members = [$"\"client_id\":\"{clientId}\""];
+
+        if(redirectUris is { Count: > 0 })
+        {
+            string uris = string.Join(',', redirectUris.Select(static uri => $"\"{uri.OriginalString}\""));
+            members.Add($"\"redirect_uris\":[{uris}]");
+        }
+
+        if(tokenEndpointAuthMethod is not null)
+        {
+            members.Add($"\"token_endpoint_auth_method\":\"{tokenEndpointAuthMethod}\"");
+        }
+
+        if(jwksUri is not null)
+        {
+            members.Add($"\"jwks_uri\":\"{jwksUri}\"");
+        }
+
+        return "{" + string.Join(',', members) + "}";
+    }
+
+
+    //Hand-built JWKS document text from a DpopJwkUtilities.ToJwk dictionary, mirroring
+    //PrivateKeyJwtClientAuthenticationTests.BuildJwksJson.
+    private static string BuildJwksJson(IReadOnlyDictionary<string, string> jwk, string kid)
+    {
+        StringBuilder sb = new();
+        sb.Append('{').Append('"').Append(WellKnownJwkMemberNames.Keys).Append("\":[{");
+        foreach(KeyValuePair<string, string> member in jwk)
+        {
+            sb.Append('"').Append(member.Key).Append("\":\"").Append(member.Value).Append("\",");
+        }
+
+        sb.Append('"').Append(WellKnownJwkMemberNames.Kid).Append("\":\"").Append(kid).Append("\"}]}");
+
+        return sb.ToString();
+    }
+
+
+    /// <summary>
+    /// The step-3 artifacts a test builds on: the client-side flow identifier, the raw authorize
+    /// redirect <c>Location</c> (for the RFC 9207 byte-exactness assertion), the AS1 access token,
+    /// the REAL OIDC <c>id_token</c>, and the scope AS1 granted (read from the access token's own
+    /// RFC 9068 <c>scope</c> claim — the value that becomes the ICHAIN-024 mint ceiling).
+    /// </summary>
+    private sealed record CapstoneStep3Result
+    {
+        public required string FlowId { get; init; }
+
+        public required string AuthorizeLocation { get; init; }
+
+        public required string AccessToken { get; init; }
+
+        public required string IdToken { get; init; }
+
+        public required string GrantedScope { get; init; }
+    }
+
+
+    /// <summary>
+    /// The capstone's six-host topology and its seam wiring, built once per test: the CIMD
+    /// document host and the client's <c>jwks_uri</c> host (two <see cref="StaticContentHost"/>s),
+    /// one <see cref="TestHostShell"/> carrying AS1 (the <c>default</c> host) and AS2 (a named
+    /// host with its own distinct certificate, <see cref="TestHostShell.AddHost(string, bool)"/>),
+    /// and the two upgraded <see cref="TestResourceServerShell"/>s. Every adversarial companion
+    /// runs against this same topology.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// AS1's seams: <c>ValidateTokenExchangeTokenAsync</c> VERIFIES the presented id_token —
+    /// signature against AS1's own JWKS fetched over the wire at validation time, <c>aud</c>
+    /// equal to the client_id (ID-JAG §4.3.3 / ICHAIN-017), issuer and expiry — never an
+    /// opaque-literal acceptance, and surfaces the step-3 granted scopes as
+    /// <see cref="ValidatedSecurityToken.Scope"/>; <c>AuthorizeTokenExchangeAsync</c> enforces the
+    /// ICHAIN-024 ceiling (requested JAG scope ⊆ that grant). The honest ICHAIN-024 mapping for
+    /// this profile is "ceiling = the scopes granted alongside that id_token's issuance", which
+    /// AS1 knows because it minted both — modelled here by the topology recording the step-3
+    /// grant from the access token AS1 itself issued.
+    /// </para>
+    /// <para>
+    /// AS2's redeem seam resolves the JAG's signing key from the ISSUING authorization servers'
+    /// published JWKS (fetched over the wire) and applies
+    /// <see cref="IdJagAssertionValidation.Validate"/> — §4.4.1 typ/aud/client_id/temporal rules
+    /// plus the §9.3 same-trust-domain rejection — surfacing <c>iss</c>/<c>jti</c>/<c>exp</c> so
+    /// the jwt-bearer endpoint's <see cref="JtiReplayGuard"/> applies the replay defense. AS2's
+    /// key set participates in the resolver precisely so the §9.3 test proves the rule does the
+    /// rejecting, not a key-resolution failure.
+    /// </para>
+    /// <para>
+    /// AS1 resolves policy as <see cref="PolicyProfile.Rfc6749WithPkce"/> with RFC 9207 emission
+    /// switched ON — the capstone must assert <c>iss</c> byte-exact while DPoP stays out of scope,
+    /// and the FAPI 2.0 / HAIP profiles that emit <c>iss</c> by default also mandate DPoP at the
+    /// token endpoint.
+    /// </para>
+    /// </remarks>
+    private sealed class CapstoneTopology: IAsyncDisposable
+    {
+        public const string As2HostName = "as2";
+
+        private bool hasStoppedHosts;
+        private bool isDisposed;
+
+        private PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> ClientKeys { get; set; } = null!;
+
+        private HttpClient ResolverHttpClient { get; set; } = null!;
+
+        private Dictionary<string, PublicKeyMemory> As1JwksKeys { get; set; } = null!;
+
+        private Dictionary<string, PublicKeyMemory> As2JwksKeys { get; set; } = null!;
+
+        public FakeTimeProvider Time { get; } = new(TestClock.CanonicalEpoch);
+
+        public StaticContentHost DocumentHost { get; private set; } = null!;
+
+        public StaticContentHost JwksHost { get; private set; } = null!;
+
+        public TestHostShell Shell { get; private set; } = null!;
+
+        public HostedAuthorizationServer As1 { get; private set; } = null!;
+
+        public HostedAuthorizationServer As2 { get; private set; } = null!;
+
+        public TestResourceServerShell Rs1 { get; private set; } = null!;
+
+        public TestResourceServerShell Rs2 { get; private set; } = null!;
+
+        public OAuthClient As1Client { get; private set; } = null!;
+
+        public ClientRegistration As1Registration { get; private set; } = null!;
+
+        public Dictionary<string, FlowState> As1FlowStore { get; private set; } = null!;
+
+        public OAuthClient As2Client { get; private set; } = null!;
+
+        public ClientRegistration As2Registration { get; private set; } = null!;
+
+        /// <summary>The client's https Client Identifier URL — the CIMD document's own location.</summary>
+        public Uri ClientIdentifierUrl { get; private set; } = null!;
+
+        public string Segment1 { get; private set; } = null!;
+
+        public string Segment2 { get; private set; } = null!;
+
+        public Uri As1Issuer { get; private set; } = null!;
+
+        public Uri As2Issuer { get; private set; } = null!;
+
+        public Uri As1TokenEndpoint { get; private set; } = null!;
+
+        public Uri As2TokenEndpoint { get; private set; } = null!;
+
+        /// <summary>The multi-pinned, auto-redirect-disabled browser stand-in for authorize hops.</summary>
+        public HttpClient BrowserClient { get; private set; } = null!;
+
+        public HttpClient Rs1Http { get; private set; } = null!;
+
+        public HttpClient Rs2Http { get; private set; } = null!;
+
+        /// <summary>AS2's own token-signing key identifier, published in AS2's JWKS.</summary>
+        public KeyId As2TokenSigningKeyId { get; private set; }
+
+        /// <summary>AS2's own token-signing private key (host-owned; never disposed here).</summary>
+        public PrivateKeyMemory As2TokenSigningKey => As2.SigningKeys[As2TokenSigningKeyId];
+
+        /// <summary>
+        /// The scopes AS1 granted at step 3 — AS1's record of the grant issued alongside the
+        /// id_token, read back from the access token it minted. The mint seams consult this as
+        /// the ICHAIN-024 ceiling; while no step-3 grant exists the mint fails closed.
+        /// </summary>
+        public string? Step3GrantedScope { get; private set; }
+
+
+        private CapstoneTopology()
+        {
+        }
+
+
+        public static async Task<CapstoneTopology> BuildAsync(CancellationToken cancellationToken)
+        {
+            CapstoneTopology topology = new();
+            await topology.InitializeAsync(cancellationToken).ConfigureAwait(false);
+
+            return topology;
+        }
+
+
+        private async Task InitializeAsync(CancellationToken cancellationToken)
+        {
+            DocumentHost = await StaticContentHost.StartAsync(cancellationToken).ConfigureAwait(false);
+            JwksHost = await StaticContentHost.StartAsync(cancellationToken).ConfigureAwait(false);
+
+            ClientKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+            string algorithm = CryptoFormatConversions.DefaultTagToJwaConverter(ClientKeys.PublicKey.Tag);
+            IReadOnlyDictionary<string, string> jwk = DpopJwkUtilities.ToJwk(
+                ClientKeys.PublicKey, algorithm, TestHostShell.Base64UrlEncoder);
+            JwksHost.Publish(
+                JwksPath, Encoding.UTF8.GetBytes(BuildJwksJson(jwk, ClientSigningKeyId)), "application/json");
+
+            ClientIdentifierUrl = new Uri(DocumentHost.BaseAddress, DocumentPath);
+            Uri jwksUrl = new(JwksHost.BaseAddress, JwksPath);
+            string documentJson = BuildCimdDocumentJson(
+                ClientIdentifierUrl.OriginalString,
+                redirectUris: [ClientRedirectUri],
+                tokenEndpointAuthMethod: WellKnownClientAuthenticationMethods.PrivateKeyJwt,
+                jwksUri: jwksUrl.OriginalString);
+            DocumentHost.Publish(DocumentPath, Encoding.UTF8.GetBytes(documentJson), "application/json");
+
+            Shell = new TestHostShell(Time);
+            As1 = Shell.Host("default");
+            As2 = Shell.AddHost(As2HostName, useDistinctCertificate: true);
+
+            ClientRecord stub1 = Shell.RegisterCimdStubClient(
+                ClientIdentifierUrl,
+                ImmutableHashSet.Create(
+                    WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                    WellKnownCapabilityIdentifiers.OAuthPushedAuthorization,
+                    WellKnownCapabilityIdentifiers.OAuthTokenExchange,
+                    WellKnownCapabilityIdentifiers.OAuthIdJag,
+                    WellKnownCapabilityIdentifiers.OidcOpenIdConnect,
+                    WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+                    WellKnownCapabilityIdentifiers.OAuthJwksEndpoint),
+                profile: PolicyProfile.Rfc6749WithPkce);
+            stub1 = ApplyStubUpdate(As1, stub1, AugmentAs1Stub(stub1));
+            Segment1 = stub1.TenantId.Value;
+
+            //AS2 is truly jwt-bearer-only: the RFC 9068 access-token producer's
+            //RequiredCapability is null (an optional feature gate, not a grant-capability
+            //proxy — see Rfc9068AccessTokenProducer's remarks), so the jwt-bearer redeem mints
+            //an access token without AS2 ever declaring OAuthAuthorizationCode.
+            ClientRecord stub2 = Shell.RegisterCimdStubClientOnHost(
+                As2HostName,
+                ClientIdentifierUrl,
+                ImmutableHashSet.Create(
+                    WellKnownCapabilityIdentifiers.OAuthJwtBearer,
+                    WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+                    WellKnownCapabilityIdentifiers.OAuthJwksEndpoint),
+                profile: PolicyProfile.Rfc6749WithPkce);
+            stub2 = ApplyStubUpdate(As2, stub2, AugmentAs2Stub(stub2));
+            Segment2 = stub2.TenantId.Value;
+            As2TokenSigningKeyId = stub2.SigningKeys[KeyUsageContext.AccessTokenIssuance].Current[0];
+
+            //RFC 9207 emission on the Rfc6749WithPkce baseline (see the class remarks for why the
+            //profiles that emit iss by default cannot be used here).
+            AuthorizationServerIntegration as1OAuth = As1.Server.OAuth();
+            as1OAuth.ResolvePolicyAsync = async (registration, context, ct) =>
+            {
+                await PolicyProfiles.DefaultResolvePolicyAsync((ClientRecord)registration, context, ct)
+                    .ConfigureAwait(false);
+                context.SetEmitIssOnRedirect(true);
+            };
+
+            (OAuthClient as1Client, ClientRegistration as1Registration, Dictionary<string, FlowState> as1FlowStore) =
+                await Shell.CreateOAuthClientAndRegistrationAsync(
+                    stub1, ClientRedirectUri.OriginalString, profile: PolicyProfile.Rfc6749WithPkce, cancellationToken)
+                    .ConfigureAwait(false);
+            As1Client = as1Client;
+            //The CIMD document declares private_key_jwt (see documentJson above); carrying the
+            //matching AuthenticationMethod + AuthenticationKeyMaterial on the client-side
+            //registration lets the real AuthCodeFlowHandlers.HandleTokenAsync (D6) attach the
+            //client_assertion itself, rather than DriveStep3Async hand-signing one.
+            As1Registration = as1Registration with
+            {
+                AuthenticationMethod = ClientAuthenticationMethod.PrivateKeyJwt,
+                AuthenticationKeyMaterial = ClientKeys
+            };
+            As1FlowStore = as1FlowStore;
+            As1Issuer = as1Registration.AuthorizationServerIssuer;
+
+            await Shell.StartHttpHostAsync(As2HostName, cancellationToken).ConfigureAwait(false);
+            ClientRecord alignedStub2 = Shell.AlignRegistrationToHostHttpBase(As2HostName, stub2);
+            As2Issuer = alignedStub2.IssuerUri!;
+            (As2Client, As2Registration) = BuildOAuthClientForHost(As2, alignedStub2, Time);
+
+            As1TokenEndpoint = new Uri(
+                As1.HttpBaseAddress!, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeToken, Segment1));
+            As2TokenEndpoint = new Uri(
+                As2.HttpBaseAddress!, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeToken, Segment2));
+
+            //CIMD materialization on BOTH AS hosts. TestHostShell.WireCimdMaterialization pins the
+            //resolver's transport to a SINGLE document-host certificate; the §8.2 topology needs
+            //the resolver to reach the document host AND the separate jwks_uri host, so the
+            //integration is wired directly over a two-certificate pinned, single-hop client —
+            //mirroring WireCimdMaterialization's own body, including the scoped loopback
+            //SSRF-policy relaxation on the live per-request ExchangeContext.
+            ResolverHttpClient = LoopbackTls.CreateSingleHopPinnedHttpClient(
+                [DocumentHost.Certificate, JwksHost.Certificate]);
+            OutboundTransportDelegate resolverTransport =
+                GuardedHttpClientTransport.BuildSingleHopTransport(ResolverHttpClient);
+            ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+                resolverTransport, new ClientIdMetadataDocumentResolverOptions(), Time);
+
+            foreach(HostedAuthorizationServer host in new[] { As1, As2 })
+            {
+                AuthorizationServerIntegration oauth = host.Server.OAuth();
+                oauth.MaterializeRegistrationAsync = ClientIdMetadataMaterialization.Build();
+                oauth.ResolveClientMetadataAsync = (clientMetadataUri, context, ct) =>
+                {
+                    context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
+
+                    return resolve(clientMetadataUri, context, ct);
+                };
+            }
+
+            //RFC 7523 §3 item 3 accepts the token endpoint URL as an aud value; the
+            //OAuthClient.IdJag flows sign their client assertions with exactly that audience.
+            as1OAuth.ValidateClientCredentialsAsync = PrivateKeyJwtClientAuthentication.BuildValidator(
+                additionalAcceptedAudiences: [As1TokenEndpoint.OriginalString]);
+            As2.Server.OAuth().ValidateClientCredentialsAsync = PrivateKeyJwtClientAuthentication.BuildValidator(
+                additionalAcceptedAudiences: [As2TokenEndpoint.OriginalString]);
+
+            As1JwksKeys = await FetchJwksKeysAsync(
+                As1.SharedHttpClient!, As1.HttpBaseAddress!, Segment1, cancellationToken).ConfigureAwait(false);
+            As2JwksKeys = await FetchJwksKeysAsync(
+                As2.SharedHttpClient!, As2.HttpBaseAddress!, Segment2, cancellationToken).ConfigureAwait(false);
+
+            as1OAuth.ValidateTokenExchangeTokenAsync = (token, tokenType, registration, context, ct) =>
+                ValidateStep3IdTokenAsync(token, tokenType, registration, ct);
+            as1OAuth.AuthorizeTokenExchangeAsync = (subject, actor, request, registration, context, ct) =>
+                AuthorizeMint(subject, request);
+
+            As2.Server.OAuth().ValidateJwtBearerAssertionAsync = (assertion, requestedScope, registration, context, ct) =>
+                ValidateJagForRedeemAsync(assertion, registration, ct);
+
+            Rs1 = new TestResourceServerShell(
+                trustedIssuer: As1Issuer,
+                expectedAudience: Rs1Audience,
+                resolveVerificationKey: BuildMapResolver(As1JwksKeys),
+                verifySignature: MicrosoftCryptographicFunctions.VerifyP256Async,
+                timeProvider: Time,
+                requiredScope: Rs1RequiredScope);
+            await Rs1.StartHttpHostAsync(cancellationToken).ConfigureAwait(false);
+
+            Rs2 = new TestResourceServerShell(
+                trustedIssuer: As2Issuer,
+                expectedAudience: Rs2Audience,
+                resolveVerificationKey: BuildMapResolver(As2JwksKeys),
+                verifySignature: MicrosoftCryptographicFunctions.VerifyP256Async,
+                timeProvider: Time,
+                requiredScope: Rs2RequiredScope);
+            await Rs2.StartHttpHostAsync(cancellationToken).ConfigureAwait(false);
+
+            BrowserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(
+                [Shell.HostCertificate("default"), Shell.HostCertificate(As2HostName)]);
+
+            Rs1Http = LoopbackTls.CreatePinnedHttpClient(Rs1.HttpCertificate!, Rs1.HttpBaseAddress);
+            Rs2Http = LoopbackTls.CreatePinnedHttpClient(Rs2.HttpCertificate!, Rs2.HttpBaseAddress);
+        }
+
+
+        /// <summary>
+        /// Drives scenario step 3 entirely through the real client surface: PAR → authorize →
+        /// callback → token exchange via the shared <see cref="AuthCodeFlowDriver"/>, whose token
+        /// leg runs the production <see cref="AuthCodeFlowHandlers.HandleTokenAsync(IReadOnlyDictionary{string, string}, OAuthClientInfrastructure, ClientRegistration, ExchangeContext, ClientAssertionOptions?, System.Threading.CancellationToken)"/>
+        /// path (D6) — the CIMD document declares <c>private_key_jwt</c>, so
+        /// <see cref="As1Registration"/> carries a matching <see cref="ClientAssertionOptions"/>
+        /// and the library itself signs and attaches the <c>client_assertion</c>; AS1's
+        /// fail-closed declared-client-auth invariant refuses an unauthenticated token request.
+        /// Records the granted scope from the minted access token as the ICHAIN-024 ceiling.
+        /// </summary>
+        public async Task<CapstoneStep3Result> DriveStep3Async(string scope, CancellationToken cancellationToken)
+        {
+            AuthCodeFlowDriveResult drive = await AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync(
+                As1, As1Client, As1Registration, As1FlowStore, Segment1, ClientRedirectUri, SubjectId,
+                BrowserClient, scope,
+                clientAssertionOptions: new ClientAssertionOptions
+                {
+                    SigningKeyId = ClientSigningKeyId,
+                    HeaderSerializer = CapstoneHeaderSerializer,
+                    PayloadSerializer = CapstonePayloadSerializer
+                },
+                cancellationToken: cancellationToken).ConfigureAwait(false);
+
+            IReadOnlyDictionary<string, object> body = drive.TokenResult.Body!;
+            Assert.AreEqual(WellKnownAuthenticationSchemes.Bearer, (string)body[OAuthRequestParameterNames.TokenType]);
+            string accessToken = (string)body[OAuthRequestParameterNames.AccessToken];
+
+            Assert.IsTrue(
+                body.TryGetValue(OAuthRequestParameterNames.IdToken, out object? idTokenObject)
+                    && idTokenObject is string { Length: > 0 },
+                "The step-3 token response must carry a REAL OIDC id_token.");
+            string idToken = (string)idTokenObject!;
+
+            string grantedScope;
+            using(JsonDocument accessClaims = DecodePayload(accessToken))
+            {
+                grantedScope = accessClaims.RootElement.GetProperty(WellKnownJwtClaimNames.Scope).GetString()!;
+            }
+
+            Step3GrantedScope = grantedScope;
+
+            return new CapstoneStep3Result
+            {
+                FlowId = drive.FlowId,
+                AuthorizeLocation = drive.AuthorizeLocation,
+                AccessToken = accessToken,
+                IdToken = idToken,
+                GrantedScope = grantedScope
+            };
+        }
+
+
+        /// <summary>Mints a JAG via <c>OAuthClient.IdJag</c>, asserting success, and returns it.</summary>
+        public async Task<string> MintJagAsync(string idToken, string scope, CancellationToken cancellationToken)
+        {
+            var mintResult = await As1Client.IdJag.MintAsync(
+                As1Registration, BuildMintOptions(idToken, scope), cancellationToken).ConfigureAwait(false);
+            Assert.IsTrue(mintResult.IsSuccess, mintResult.Error?.Support.Summary);
+
+            return mintResult.Value.AccessToken;
+        }
+
+
+        public IdJagMintOptions BuildMintOptions(string idToken, string scope) => new()
+        {
+            Audience = As2Issuer.OriginalString,
+            SubjectToken = idToken,
+            SubjectTokenType = TokenType.IdToken,
+            SigningKey = ClientKeys.PrivateKey,
+            SigningKeyId = ClientSigningKeyId,
+            HeaderSerializer = CapstoneHeaderSerializer,
+            PayloadSerializer = CapstonePayloadSerializer,
+            Scope = scope
+        };
+
+
+        public IdJagRedeemOptions BuildRedeemOptions(string jag) => new()
+        {
+            Assertion = jag,
+            SigningKey = ClientKeys.PrivateKey,
+            SigningKeyId = ClientSigningKeyId,
+            HeaderSerializer = CapstoneHeaderSerializer,
+            PayloadSerializer = CapstonePayloadSerializer
+        };
+
+
+        /// <summary>Signs a valid <c>private_key_jwt</c> client assertion addressed to AS2's token endpoint.</summary>
+        public ValueTask<string> SignClientAssertionForAs2Async(CancellationToken cancellationToken) =>
+            ClientAssertionSigning.SignAsync(
+                ClientIdentifierUrl.OriginalString,
+                As2TokenEndpoint.OriginalString,
+                Guid.NewGuid().ToString("N"),
+                Time.GetUtcNow(),
+                Time.GetUtcNow().AddMinutes(5),
+                ClientKeys.PrivateKey,
+                ClientSigningKeyId,
+                CapstoneHeaderSerializer,
+                CapstonePayloadSerializer,
+                TestSetup.Base64UrlEncoder,
+                TestHostShell.MemoryPool,
+                cancellationToken);
+
+
+        /// <summary>
+        /// Stops the six hosts (idempotent). The happy path calls this before the trace-tree
+        /// assertions so every server span has stopped and reached the capture.
+        /// </summary>
+        public async ValueTask StopHostsAsync()
+        {
+            if(hasStoppedHosts)
+            {
+                return;
+            }
+
+            hasStoppedHosts = true;
+
+            await Rs2.DisposeAsync().ConfigureAwait(false);
+            await Rs1.DisposeAsync().ConfigureAwait(false);
+            await Shell.DisposeAsync().ConfigureAwait(false);
+            await JwksHost.DisposeAsync().ConfigureAwait(false);
+            await DocumentHost.DisposeAsync().ConfigureAwait(false);
+        }
+
+
+        public async ValueTask DisposeAsync()
+        {
+            if(isDisposed)
+            {
+                return;
+            }
+
+            isDisposed = true;
+
+            await StopHostsAsync().ConfigureAwait(false);
+
+            BrowserClient.Dispose();
+            Rs1Http.Dispose();
+            Rs2Http.Dispose();
+            ResolverHttpClient.Dispose();
+
+            foreach(PublicKeyMemory key in As1JwksKeys.Values)
+            {
+                key.Dispose();
+            }
+
+            foreach(PublicKeyMemory key in As2JwksKeys.Values)
+            {
+                key.Dispose();
+            }
+
+            ClientKeys.PublicKey.Dispose();
+            ClientKeys.PrivateKey.Dispose();
+        }
+
+
+        /// <summary>
+        /// AS-owned facets the CIMD stub needs for this scenario, overlaid onto the registered
+        /// record: the OIDC id_token signing key (reusing the tenant's token-signing key under
+        /// <see cref="KeyUsageContext.IdTokenIssuance"/>), the resource scopes, and the
+        /// scope→audience map the RFC 9068 producer stamps <c>aud</c> from. Client-data facets
+        /// (redirect URIs, auth method, jwks) still arrive ONLY via materialization.
+        /// </summary>
+        private static ClientRecord AugmentAs1Stub(ClientRecord stub)
+        {
+            KeyId tokenSigningKeyId = stub.SigningKeys[KeyUsageContext.AccessTokenIssuance].Current[0];
+
+            return stub with
+            {
+                AllowedScopes = stub.AllowedScopes.Union([Rs1RequiredScope, Rs2RequiredScope]),
+                SigningKeys = stub.SigningKeys.ToImmutableDictionary().Add(
+                    KeyUsageContext.IdTokenIssuance, new SigningKeySet { Current = [tokenSigningKeyId] }),
+                ScopeToAudience = new Dictionary<string, IReadOnlyList<string>>(StringComparer.Ordinal)
+                {
+                    [WellKnownScopes.OpenId] = new[] { Rs1Audience },
+                    [Rs1RequiredScope] = new[] { Rs1Audience }
+                }
+            };
+        }
+
+
+        private static ClientRecord AugmentAs2Stub(ClientRecord stub) => stub with
+        {
+            AllowedScopes = stub.AllowedScopes.Union([Rs2RequiredScope]),
+            ScopeToAudience = new Dictionary<string, IReadOnlyList<string>>(StringComparer.Ordinal)
+            {
+                [Rs2RequiredScope] = new[] { Rs2Audience }
+            }
+        };
+
+
+        private static ClientRecord ApplyStubUpdate(
+            HostedAuthorizationServer host, ClientRecord original, ClientRecord updated)
+        {
+            host.Registrations[updated.TenantId.Value] = updated;
+            host.Registrations[updated.ClientId] = updated;
+            host.Server.UpdateClient(original, updated, new ExchangeContext());
+
+            return updated;
+        }
+
+
+        /// <summary>
+        /// The AS1 mint-side subject-token seam (ID-JAG §4.3.3 / ICHAIN-017): verifies the
+        /// presented id_token's signature against AS1's JWKS fetched over the wire at validation
+        /// time, checks <c>aud</c> equals the authenticated client_id, <c>iss</c> equals AS1's
+        /// issuer, and the expiry, then surfaces the subject and the step-3 grant as the scope
+        /// ceiling. Any failure — including an absent step-3 grant — returns
+        /// <see langword="null"/>, refusing the exchange.
+        /// </summary>
+        private async ValueTask<ValidatedSecurityToken?> ValidateStep3IdTokenAsync(
+            string token, TokenType tokenType, ClientRecord registration, CancellationToken cancellationToken)
+        {
+            if(tokenType != TokenType.IdToken)
+            {
+                return null;
+            }
+
+            string[] parts = token.Split('.');
+            if(parts.Length != 3)
+            {
+                return null;
+            }
+
+            JwtHeader header;
+            using(IMemoryOwner<byte> headerBytes = TestSetup.Base64UrlDecoder(parts[0], Pool))
+            {
+                header = JwsAccessTokenTestSupport.Parser.ParseHeader(headerBytes.Memory);
+            }
+
+            if(!header.TryGetValue(WellKnownJwkMemberNames.Kid, out object? kidValue) || kidValue is not string kid)
+            {
+                return null;
+            }
+
+            Dictionary<string, PublicKeyMemory> liveKeys = await FetchJwksKeysAsync(
+                As1.SharedHttpClient!, As1.HttpBaseAddress!, Segment1, cancellationToken).ConfigureAwait(false);
+            try
+            {
+                if(!liveKeys.TryGetValue(kid, out PublicKeyMemory? verificationKey))
+                {
+                    return null;
+                }
+
+                bool isSignatureValid = await Jws.VerifyAsync(
+                    token, TestSetup.Base64UrlDecoder, Pool, verificationKey,
+                    MicrosoftCryptographicFunctions.VerifyP256Async, cancellationToken).ConfigureAwait(false);
+                if(!isSignatureValid)
+                {
+                    return null;
+                }
+            }
+            finally
+            {
+                foreach(PublicKeyMemory key in liveKeys.Values)
+                {
+                    key.Dispose();
+                }
+            }
+
+            JwtPayload payload;
+            using(IMemoryOwner<byte> payloadBytes = TestSetup.Base64UrlDecoder(parts[1], Pool))
+            {
+                payload = JwsAccessTokenTestSupport.Parser.ParseClaims(payloadBytes.Memory);
+            }
+
+            //ID-JAG §4.3.3 / ICHAIN-017: the Identity Assertion's audience must be the
+            //authenticating client — the aud OIDC stamped is the client_id.
+            if(!payload.TryGetValue(WellKnownJwtClaimNames.Aud, out object? audienceRaw)
+                || !IsAudienceExactly(audienceRaw, registration.ClientId))
+            {
+                return null;
+            }
+
+            if(!TryReadStringClaim(payload, WellKnownJwtClaimNames.Iss, out string? issuer)
+                || !string.Equals(issuer, As1Issuer.OriginalString, StringComparison.Ordinal))
+            {
+                return null;
+            }
+
+            DateTimeOffset? expiresAt = ReadUnixSecondsClaim(payload, WellKnownJwtClaimNames.Exp);
+            if(expiresAt is null || expiresAt.Value <= Time.GetUtcNow())
+            {
+                return null;
+            }
+
+            if(!TryReadStringClaim(payload, WellKnownJwtClaimNames.Sub, out string? subject))
+            {
+                return null;
+            }
+
+            string? grantedScope = Step3GrantedScope;
+            if(grantedScope is null)
+            {
+                return null;
+            }
+
+            return new ValidatedSecurityToken
+            {
+                Subject = subject!,
+                Issuer = issuer,
+                Audience = [registration.ClientId],
+                Scope = grantedScope,
+                ExpiresAt = expiresAt
+            };
+        }
+
+
+        /// <summary>
+        /// The AS1 mint-side authorization seam: only id-jag exchanges are authorized, and only
+        /// when the requested JAG scope is a subset of the step-3 grant the validated subject
+        /// token carries (ICHAIN-024). A denial returns <see langword="null"/>, which the id-jag
+        /// path maps to <c>invalid_grant</c>.
+        /// </summary>
+        private static ValueTask<TokenExchangeAuthorization?> AuthorizeMint(
+            ValidatedSecurityToken subject, TokenExchangeRequest request)
+        {
+            if(request.RequestedTokenType != TokenType.IdJag)
+            {
+                return ValueTask.FromResult<TokenExchangeAuthorization?>(null);
+            }
+
+            string? requestedScope = request.Scope;
+            string? ceiling = subject.Scope;
+            if(requestedScope is null || ceiling is null || !IsScopeSubset(requestedScope, ceiling))
+            {
+                return ValueTask.FromResult<TokenExchangeAuthorization?>(null);
+            }
+
+            return ValueTask.FromResult<TokenExchangeAuthorization?>(new TokenExchangeAuthorization
+            {
+                Subject = subject.Subject,
+                Scope = requestedScope,
+                IssuedTokenType = TokenType.IdJag
+            });
+        }
+
+
+        /// <summary>
+        /// The AS2 redeem-side seam (ID-JAG §4.4.1 / §9.3): resolves the JAG's signing key by
+        /// <c>kid</c> from the issuing servers' wire-fetched JWKS, verifies the signature, applies
+        /// <see cref="IdJagAssertionValidation.Validate"/> with AS2's issuer and the authenticated
+        /// client, and surfaces <c>iss</c>/<c>jti</c>/<c>exp</c> so the endpoint's
+        /// <see cref="JtiReplayGuard"/> enforces the replay defense. Returns
+        /// <see langword="null"/> (→ <c>invalid_grant</c>) on any failure.
+        /// </summary>
+        private async ValueTask<JwtBearerGrant?> ValidateJagForRedeemAsync(
+            string assertion, ClientRecord registration, CancellationToken cancellationToken)
+        {
+            string[] parts = assertion.Split('.');
+            if(parts.Length != 3)
+            {
+                return null;
+            }
+
+            JwtHeader header;
+            using(IMemoryOwner<byte> headerBytes = TestSetup.Base64UrlDecoder(parts[0], Pool))
+            {
+                header = JwsAccessTokenTestSupport.Parser.ParseHeader(headerBytes.Memory);
+            }
+
+            if(!header.TryGetValue(WellKnownJwkMemberNames.Kid, out object? kidValue) || kidValue is not string kid)
+            {
+                return null;
+            }
+
+            JwtPayload payload;
+            using(IMemoryOwner<byte> payloadBytes = TestSetup.Base64UrlDecoder(parts[1], Pool))
+            {
+                payload = JwsAccessTokenTestSupport.Parser.ParseClaims(payloadBytes.Memory);
+            }
+
+            //ID-JAG §9.5: trust in the grant derives from its own iss, never from a
+            //pooled key set — the verification key MUST come from the JWKS the issuer
+            //named in iss publishes, so a JAG signed with any other trust domain's key
+            //(even one otherwise trusted) is rejected before claim validation.
+            if(!TryReadStringClaim(payload, WellKnownJwtClaimNames.Iss, out string? grantIssuer))
+            {
+                return null;
+            }
+
+            Dictionary<string, PublicKeyMemory>? issuerKeys =
+                string.Equals(grantIssuer, As1Issuer.OriginalString, StringComparison.Ordinal) ? As1JwksKeys
+                : string.Equals(grantIssuer, As2Issuer.OriginalString, StringComparison.Ordinal) ? As2JwksKeys
+                : null;
+            if(issuerKeys is null || !issuerKeys.TryGetValue(kid, out PublicKeyMemory? verificationKey))
+            {
+                return null;
+            }
+
+            bool isSignatureValid = await Jws.VerifyAsync(
+                assertion, TestSetup.Base64UrlDecoder, Pool, verificationKey,
+                MicrosoftCryptographicFunctions.VerifyP256Async, cancellationToken).ConfigureAwait(false);
+            if(!isSignatureValid)
+            {
+                return null;
+            }
+
+            IdJagAssertionValidationResult result = IdJagAssertionValidation.Validate(
+                header, payload, As2Issuer.OriginalString, registration.ClientId,
+                Time.GetUtcNow(), TimeSpan.FromSeconds(60));
+            if(!result.IsValid)
+            {
+                return null;
+            }
+
+            return new JwtBearerGrant
+            {
+                Subject = result.Subject!,
+                Scope = result.Scope ?? string.Empty,
+                Audience = result.Resource,
+                AuthorizationDetailsClaim = result.AuthorizationDetails,
+                RequiredKeyThumbprint = result.ConfirmationKeyThumbprint,
+                Issuer = result.Issuer,
+                Jti = result.Jti,
+                Expiration = result.Expiration
+            };
+        }
+
+
+        /// <summary>
+        /// Fetches a tenant's published JWKS over the real wire and materializes the keys into a
+        /// kid-indexed map the resolvers and the resource servers consult. The caller owns
+        /// disposing the returned <see cref="PublicKeyMemory"/> values.
+        /// </summary>
+        private static async Task<Dictionary<string, PublicKeyMemory>> FetchJwksKeysAsync(
+            HttpClient httpClient, Uri hostBaseAddress, string segment, CancellationToken cancellationToken)
+        {
+            Uri jwksUrl = new(
+                hostBaseAddress, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.MetadataJwks, segment));
+            using HttpResponseMessage response = await httpClient.GetAsync(jwksUrl, cancellationToken)
+                .ConfigureAwait(false);
+            string body = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+            Assert.AreEqual(200, (int)response.StatusCode, body);
+
+            Dictionary<string, PublicKeyMemory> keysByKid = new(StringComparer.Ordinal);
+            using JsonDocument document = JsonDocument.Parse(body);
+            foreach(JsonElement key in document.RootElement.GetProperty(WellKnownJwkMemberNames.Keys).EnumerateArray())
+            {
+                string kid = key.GetProperty(WellKnownJwkMemberNames.Kid).GetString()!;
+                Dictionary<string, string> jwk = new(StringComparer.Ordinal);
+                foreach(JsonProperty member in key.EnumerateObject())
+                {
+                    if(member.Value.ValueKind == JsonValueKind.String)
+                    {
+                        jwk[member.Name] = member.Value.GetString()!;
+                    }
+                }
+
+                keysByKid[kid] = DpopJwkUtilities.PublicKeyFromJwk(
+                    jwk, WellKnownJwaValues.Es256, TestSetup.Base64UrlDecoder, Pool);
+            }
+
+            return keysByKid;
+        }
+
+
+        private static ServerVerificationKeyResolverDelegate BuildMapResolver(
+            Dictionary<string, PublicKeyMemory> keysByKid) =>
+            (kid, tenantId, context, cancellationToken) =>
+                ValueTask.FromResult(keysByKid.GetValueOrDefault(kid.Value));
+
+
+        /// <summary>
+        /// Builds an HTTP-backed <see cref="OAuthClient"/> targeting a NAMED shell host —
+        /// <see cref="TestHostShell.CreateOAuthClientAndRegistrationAsync"/> is fixed to the
+        /// <c>default</c> host, and the capstone's redeem must dial AS2. Mirrors that factory's
+        /// wiring over the named host's pinned <see cref="HostedAuthorizationServer.SharedHttpClient"/>.
+        /// </summary>
+        private static (OAuthClient Client, ClientRegistration Registration) BuildOAuthClientForHost(
+            HostedAuthorizationServer host, ClientRecord alignedRecord, TimeProvider timeProvider)
+        {
+            Dictionary<string, FlowState> clientFlowStore = [];
+            string segment = alignedRecord.TenantId.Value;
+            Uri issuerUri = alignedRecord.IssuerUri!;
+
+            AuthorizationServerMetadata metadata = new()
+            {
+                Issuer = issuerUri,
+                TokenEndpoint = new Uri(
+                    host.HttpBaseAddress!,
+                    TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeToken, segment))
+            };
+
+            HttpClient httpClient = host.SharedHttpClient!;
+
+            OAuthClientInfrastructure infrastructure = OAuthClientInfrastructure.Create(
+                sendFormPostAsync: (endpoint, fields, headers, _, ct) =>
+                    HttpClientTransport.SendFormPostAsync(httpClient, endpoint, fields, headers, ct),
+                saveStateAsync: (state, _, ct) =>
+                {
+                    clientFlowStore[state.FlowId] = state;
+
+                    return ValueTask.CompletedTask;
+                },
+                loadStateAsync: (flowId, _, ct) =>
+                    ValueTask.FromResult(clientFlowStore.GetValueOrDefault(flowId)),
+                loadStateByRequestUriAsync: (requestUri, _, ct) =>
+                    ValueTask.FromResult<FlowState?>(null),
+                parseParResponseAsync: OAuthResponseParsers.ParseParResponse,
+                parseTokenResponseAsync: OAuthResponseParsers.ParseTokenResponse,
+                parseAuthorizationServerMetadataAsync: (body, ct) =>
+                    throw new NotImplementedException("The capstone pre-resolves metadata; the parser is not exercised."),
+                parseRegistrationResponseAsync: (body, ct) =>
+                    throw new NotImplementedException("The capstone does not exercise dynamic registration."),
+                resolveAuthorizationServerMetadataAsync: (issuer, context, ct) =>
+                    ValueTask.FromResult(metadata),
+                resolveCallbackValidator: ClientPolicyProfiles.DefaultResolveCallbackValidator,
+                base64UrlEncoder: TestSetup.Base64UrlEncoder,
+                timeProvider: timeProvider);
+
+            ClientRegistration registration = new()
+            {
+                ClientId = new ClientId(alignedRecord.ClientId),
+                AuthorizationServerIssuer = issuerUri,
+                RedirectUris = [ClientRedirectUri],
+                AuthenticationMethod = ClientAuthenticationMethod.PrivateKeyJwt,
+                Profile = PolicyProfile.Rfc6749WithPkce
+            };
+
+            return (new OAuthClient(infrastructure), registration);
+        }
+
+
+        private static bool IsAudienceExactly(object? audienceRaw, string expected) => audienceRaw switch
+        {
+            string single => string.Equals(single, expected, StringComparison.Ordinal),
+            IReadOnlyList<object> list when list.Count == 1 && list[0] is string only =>
+                string.Equals(only, expected, StringComparison.Ordinal),
+            _ => false
+        };
+
+
+        private static bool TryReadStringClaim(JwtPayload payload, string claimName, out string? value)
+        {
+            if(payload.TryGetValue(claimName, out object? raw) && raw is string text && text.Length > 0)
+            {
+                value = text;
+
+                return true;
+            }
+
+            value = null;
+
+            return false;
+        }
+
+
+        private static DateTimeOffset? ReadUnixSecondsClaim(JwtPayload payload, string claimName)
+        {
+            if(!payload.TryGetValue(claimName, out object? raw))
+            {
+                return null;
+            }
+
+            long? seconds = raw switch
+            {
+                long longValue => longValue,
+                int intValue => intValue,
+                double doubleValue when doubleValue == Math.Floor(doubleValue) => (long)doubleValue,
+                _ => null
+            };
+
+            return seconds is null ? null : DateTimeOffset.FromUnixTimeSeconds(seconds.Value);
+        }
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/AllCapabilitiesAuthorizationServerTests.cs b/test/Verifiable.Tests/OAuth/AllCapabilitiesAuthorizationServerTests.cs
index 9b37cf6e..19272583 100644
--- a/test/Verifiable.Tests/OAuth/AllCapabilitiesAuthorizationServerTests.cs
+++ b/test/Verifiable.Tests/OAuth/AllCapabilitiesAuthorizationServerTests.cs
@@ -90,7 +90,8 @@ internal sealed class AllCapabilitiesAuthorizationServerTests
             WellKnownCapabilityIdentifiers.OAuthGlobalTokenRevocation,
             WellKnownCapabilityIdentifiers.OidcRpInitiatedLogout,
             WellKnownCapabilityIdentifiers.OidcBackChannelLogout,
-            WellKnownCapabilityIdentifiers.OAuthProtectedResourceMetadata);
+            WellKnownCapabilityIdentifiers.OAuthProtectedResourceMetadata,
+            WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument);
 
     /// <summary>The token-AS capabilities plus the OID4VP-verifier and Federation roles, all co-registered.</summary>
     private static ImmutableHashSet<CapabilityIdentifier> TokenServerWithPresentationAndFederation { get; } =
@@ -137,6 +138,13 @@ public async Task EverythingEnabledDiscoveryDocumentIsCoherent()
         host.Server.OAuth().DeliverBackChannelLogoutAsync = static (_, _, _, _, _) =>
             ValueTask.CompletedTask;
 
+        //CIMD: capability + the resolver seam advertise client_id_metadata_document_supported.
+        //Discovery emission only checks the seam for non-null-ness (privacy §9.1 — discovery
+        //requests never trigger a client-document fetch), so a throwing lambda proves that.
+        host.Server.OAuth().ResolveClientMetadataAsync = (uri, context, ct) =>
+            throw new NotImplementedException(
+                "Discovery emission only checks ResolveClientMetadataAsync for non-null-ness; it must never invoke it.");
+
         ServerHttpResponse response = await host.DispatchAtEndpointAsync(
             material.Registration.TenantId.Value,
             WellKnownEndpointNames.MetadataDiscovery,
@@ -176,6 +184,7 @@ public async Task EverythingEnabledDiscoveryDocumentIsCoherent()
             "scopes_supported",
             "claims_supported",
             "claim_types_supported",
+            "client_id_metadata_document_supported",
         ];
         foreach(string field in expectedPresent)
         {
@@ -219,6 +228,7 @@ public async Task EverythingEnabledDiscoveryDocumentIsCoherent()
             "scopes_supported",
             "claims_supported",
             "claim_types_supported",
+            "client_id_metadata_document_supported",
         };
         foreach(JsonProperty prop in root.EnumerateObject())
         {
@@ -376,6 +386,18 @@ public async Task EverythingEnabledAuthorizationCodeFlowIssuesAndRefreshesTokens
         using JsonDocument refreshDoc = JsonDocument.Parse(refreshResponse.Body);
         Assert.IsTrue(refreshDoc.RootElement.TryGetProperty("access_token", out _),
             $"The refresh_token grant must return a fresh access_token. Body: {refreshResponse.Body}");
+
+        //Positive control for the wave-4 grant-identity invariant: this refresh token
+        //originates from the authorization_code grant (not token_exchange), so per
+        //Oidc10IdTokenProducer.IsApplicableAsync the redemption must still mint an
+        //id_token — contrast TokenExchangeGrantTests
+        //.RefreshTokenMintedByTokenExchangeNeverYieldsIdTokenOnRedemption, where a
+        //token_exchange-originated refresh must NOT. Without this assertion, a
+        //regression that drops id_token issuance from the authorization_code-origin
+        //refresh walk would go undetected.
+        Assert.IsTrue(refreshDoc.RootElement.TryGetProperty("id_token", out _),
+            $"The refresh token originates from the authorization_code grant and openid was requested, " +
+            $"so the refresh_token grant must still return an id_token. Body: {refreshResponse.Body}");
     }
 
 
diff --git a/test/Verifiable.Tests/OAuth/AuthCodeClientAuthenticationTests.cs b/test/Verifiable.Tests/OAuth/AuthCodeClientAuthenticationTests.cs
new file mode 100644
index 00000000..a9c629ca
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/AuthCodeClientAuthenticationTests.cs
@@ -0,0 +1,388 @@
+using System.Buffers;
+using System.Diagnostics.CodeAnalysis;
+using System.Net.Http;
+using System.Text;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Dpop;
+using Verifiable.OAuth.Server;
+using Verifiable.Tests.TestDataProviders;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Contract wave-4 D6 (item 2): the auth-code token leg attaches confidential-client
+/// authentication automatically per <see cref="ClientRegistration.AuthenticationMethod"/>, over the
+/// real wire, for every declared method — <c>client_secret_post</c>, <c>client_secret_basic</c>, and
+/// <c>private_key_jwt</c> — through <see cref="AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync"/>,
+/// the same shared drive <see cref="AuthCodeParPkceRealWireFlowTests"/> and the agentic-flow capstone
+/// use. <see cref="ClientRecord.TokenEndpointAuthMethod"/> is set server-side so the exchange fails
+/// closed (draft-ietf-oauth-client-id-metadata-document-02 §8.2, CIMD-049) without the attached
+/// credential — a passing exchange therefore proves the client attached it, not that the server never
+/// asked.
+/// </summary>
+[TestClass]
+internal sealed class AuthCodeClientAuthenticationTests
+{
+    /// <summary>MSTest's per-test context, supplying the cancellation token every wire call runs under.</summary>
+    public TestContext TestContext { get; set; } = null!;
+
+    /// <summary>The clock the host and the client share.</summary>
+    private FakeTimeProvider TimeProvider { get; } = new(TestClock.CanonicalEpoch);
+
+    private const string ClientId = "https://confidential.client.test";
+
+    private const string SubjectId = "subject-confidential-auth-code-01";
+
+    private const string ClientSecret = "s3cret-of-the-confidential-client";
+
+    private static Uri ClientBaseUri { get; } = new(ClientId);
+
+    private static Uri RedirectUri { get; } = new("https://client.example.com/callback");
+
+    private static MemoryPool<byte> Pool => BaseMemoryPool.Shared;
+
+
+    /// <summary>
+    /// <c>client_secret_post</c> (RFC 6749 §2.3.1): the real client attaches <c>client_id</c> +
+    /// <c>client_secret</c> to the token-request body — no explicit <see cref="ClientAssertionOptions"/>
+    /// needed, so the exchange drives through the plain <see cref="AuthCodeClient.ExchangeTokenAsync(ClientRegistration, string, System.Threading.CancellationToken)"/>
+    /// path via <see cref="AuthCodeFlowDriver"/> — and the server-side declared-method invariant
+    /// requires it.
+    /// </summary>
+    [TestMethod]
+    public async Task ClientSecretPostAuthenticatesOverRealWire()
+    {
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> secretMaterial = BuildSecretKeyMaterial(ClientSecret);
+        try
+        {
+            await using TestHostShell host = new(TimeProvider);
+            using VerifierKeyMaterial material = host.RegisterDpopClient(
+                ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+            DeclareServerSideAuthMethod(host, material, ClientAuthenticationMethod.ClientSecretPost);
+
+            host.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
+                ValueTask.FromResult(
+                    fields.TryGetValue(OAuthRequestParameterNames.ClientSecret, out string? secret)
+                    && string.Equals(secret, ClientSecret, StringComparison.Ordinal));
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+                await host.CreateOAuthClientAndRegistrationAsync(
+                    material.Registration,
+                    RedirectUri.OriginalString,
+                    profile: PolicyProfile.Rfc6749WithPkce,
+                    TestContext.CancellationToken).ConfigureAwait(false);
+            registration = registration with
+            {
+                AuthenticationMethod = ClientAuthenticationMethod.ClientSecretPost,
+                AuthenticationKeyMaterial = secretMaterial
+            };
+
+            await DriveAndAssertSucceedsAsync(
+                host, client, registration, clientFlowStore, material.Registration.TenantId.Value).ConfigureAwait(false);
+        }
+        finally
+        {
+            secretMaterial.PublicKey.Dispose();
+            secretMaterial.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// <c>client_secret_basic</c> (RFC 6749 §2.3.1): the real client attaches an HTTP Basic
+    /// <c>Authorization</c> header — again through the plain <c>ExchangeTokenAsync</c> path, since
+    /// this method needs no per-call <see cref="ClientAssertionOptions"/> either.
+    /// </summary>
+    [TestMethod]
+    public async Task ClientSecretBasicAuthenticatesOverRealWire()
+    {
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> secretMaterial = BuildSecretKeyMaterial(ClientSecret);
+        try
+        {
+            await using TestHostShell host = new(TimeProvider);
+            using VerifierKeyMaterial material = host.RegisterDpopClient(
+                ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+            DeclareServerSideAuthMethod(host, material, ClientAuthenticationMethod.ClientSecretBasic);
+
+            host.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
+                ValueTask.FromResult(DecodeAndMatchBasicHeader(request, registration.ClientId, ClientSecret));
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+                await host.CreateOAuthClientAndRegistrationAsync(
+                    material.Registration,
+                    RedirectUri.OriginalString,
+                    profile: PolicyProfile.Rfc6749WithPkce,
+                    TestContext.CancellationToken).ConfigureAwait(false);
+            registration = registration with
+            {
+                AuthenticationMethod = ClientAuthenticationMethod.ClientSecretBasic,
+                AuthenticationKeyMaterial = secretMaterial
+            };
+
+            await DriveAndAssertSucceedsAsync(
+                host, client, registration, clientFlowStore, material.Registration.TenantId.Value).ConfigureAwait(false);
+        }
+        finally
+        {
+            secretMaterial.PublicKey.Dispose();
+            secretMaterial.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// <c>private_key_jwt</c> (RFC 7523 §2.2): the real client signs and attaches a
+    /// <c>client_assertion</c> from <see cref="TestKeyMaterialProvider"/>-generated P-256 key material,
+    /// driven through <see cref="AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync"/>'s
+    /// <see cref="ClientAssertionOptions"/> overload, and the server verifies it with the real
+    /// <see cref="PrivateKeyJwtClientAuthentication.BuildValidator(System.Collections.Generic.IReadOnlyCollection{string}?,CheckClientAssertionJtiReplayDelegate?)"/>
+    /// pipeline over a published <c>ClientJwks</c> — the same production shape
+    /// <see cref="PrivateKeyJwtClientAuthenticationTests"/> exercises directly. The validator accepts
+    /// the resolved token endpoint URL as <c>aud</c> (RFC 7523 §3 item 3's permitted alternate),
+    /// matching what <see cref="ClientTokenEndpointAuthentication.AttachClientAssertionAsync"/> signs.
+    /// </summary>
+    [TestMethod]
+    public async Task PrivateKeyJwtAuthenticatesOverRealWire()
+    {
+        var clientKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            await using TestHostShell host = new(TimeProvider);
+            using VerifierKeyMaterial material = host.RegisterDpopClient(
+                ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+            //Start the listener before wiring the validator so the resolved token endpoint URL
+            //(the client-signed aud, per RFC 7523 §3 item 3) is known.
+            await host.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+            HostedAuthorizationServer hosted = host.Host("default");
+            string segment = material.Registration.TenantId.Value;
+            Uri tokenEndpoint = new(
+                hosted.HttpBaseAddress!, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeToken, segment));
+
+            string alg = CryptoFormatConversions.DefaultTagToJwaConverter(clientKeys.PublicKey.Tag);
+            const string SigningKeyId = "confidential-client-key-1";
+            IReadOnlyDictionary<string, string> jwk = DpopJwkUtilities.ToJwk(
+                clientKeys.PublicKey, alg, TestSetup.Base64UrlEncoder);
+            string jwksJson = BuildJwksJson(jwk, SigningKeyId);
+            DeclareServerSideAuthMethod(
+                host, material, ClientAuthenticationMethod.PrivateKeyJwt, clientJwks: jwksJson);
+
+            host.Server.OAuth().ValidateClientCredentialsAsync =
+                PrivateKeyJwtClientAuthentication.BuildValidator(
+                    additionalAcceptedAudiences: [tokenEndpoint.OriginalString]);
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+                await host.CreateOAuthClientAndRegistrationAsync(
+                    material.Registration,
+                    RedirectUri.OriginalString,
+                    profile: PolicyProfile.Rfc6749WithPkce,
+                    TestContext.CancellationToken).ConfigureAwait(false);
+            registration = registration with
+            {
+                AuthenticationMethod = ClientAuthenticationMethod.PrivateKeyJwt,
+                AuthenticationKeyMaterial = clientKeys
+            };
+
+            await DriveAndAssertSucceedsAsync(
+                host, client, registration, clientFlowStore, material.Registration.TenantId.Value,
+                clientAssertionOptions: new ClientAssertionOptions
+                {
+                    SigningKeyId = SigningKeyId,
+                    HeaderSerializer = host.Server.OAuth().Codecs.JwtHeaderSerializer!,
+                    PayloadSerializer = host.Server.OAuth().Codecs.JwtPayloadSerializer!
+                }).ConfigureAwait(false);
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// Every declared confidential method fails closed without the credential the client would
+    /// normally attach automatically — pinning that the positive tests above prove genuine
+    /// authentication rather than a server that never checks. Uses <c>client_secret_post</c>: a
+    /// declared confidential client whose <see cref="ClientRegistration.AuthenticationMethod"/> stays
+    /// <see cref="ClientAuthenticationMethod.None"/> presents no credential at all.
+    /// </summary>
+    [TestMethod]
+    public async Task DeclaredConfidentialClientWithoutAttachedCredentialFailsClosed()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+        DeclareServerSideAuthMethod(host, material, ClientAuthenticationMethod.ClientSecretPost);
+
+        host.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
+            ValueTask.FromResult(
+                fields.TryGetValue(OAuthRequestParameterNames.ClientSecret, out string? secret)
+                && string.Equals(secret, ClientSecret, StringComparison.Ordinal));
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+            await host.CreateOAuthClientAndRegistrationAsync(
+                material.Registration,
+                RedirectUri.OriginalString,
+                profile: PolicyProfile.Rfc6749WithPkce,
+                TestContext.CancellationToken).ConfigureAwait(false);
+        //AuthenticationMethod deliberately left at its None default — the client attaches nothing.
+
+        using HttpClient browserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(host.ServerCertificate);
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+
+        (string flowId, _) = await AuthCodeFlowDriver.DriveParAuthorizeAndCallbackAsync(
+            hosted, client, registration, clientFlowStore, segment, RedirectUri, SubjectId, browserClient,
+            cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult tokenResult = await client.AuthCode.ExchangeTokenAsync(
+            registration, flowId, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreNotEqual(AuthCodeFlowEndpointOutcome.Ok, tokenResult.Outcome,
+            "A declared confidential client presenting no credential must not be issued a token.");
+        Assert.AreEqual(OAuthErrors.InvalidClient, tokenResult.ErrorCode);
+    }
+
+
+    /// <summary>
+    /// Drives PAR → authorize → callback → token over the real wire and asserts every leg — including
+    /// the token exchange the confidential-auth attachment under test gates — succeeded.
+    /// </summary>
+    private async Task DriveAndAssertSucceedsAsync(
+        TestHostShell host,
+        OAuthClient client,
+        ClientRegistration registration,
+        Dictionary<string, FlowState> clientFlowStore,
+        string tenantSegment,
+        ClientAssertionOptions? clientAssertionOptions = null)
+    {
+        using HttpClient browserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(host.ServerCertificate);
+        HostedAuthorizationServer hosted = host.Host("default");
+
+        AuthCodeFlowDriveResult drive = await AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync(
+            hosted, client, registration, clientFlowStore, tenantSegment, RedirectUri, SubjectId, browserClient,
+            clientAssertionOptions: clientAssertionOptions, cancellationToken: TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, drive.TokenResult.Outcome,
+            $"Token exchange must succeed over the real wire. ErrorCode={drive.TokenResult.ErrorCode} ErrorDescription={drive.TokenResult.ErrorDescription}");
+        string accessToken = (string)drive.TokenResult.Body![OAuthRequestParameterNames.AccessToken];
+        Assert.IsFalse(string.IsNullOrEmpty(accessToken), "The AS must mint an access token.");
+    }
+
+
+    /// <summary>
+    /// Re-registers the server-side <see cref="ClientRecord"/> with
+    /// <see cref="ClientRecord.TokenEndpointAuthMethod"/> set to <paramref name="method"/> — the
+    /// declared-client shape draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-049) gates
+    /// on, so a passing exchange proves the client attached the credential the server actually
+    /// required. Uses the register-then-upgrade pattern the sibling grant suites use, because the
+    /// routing dictionaries are host-internal.
+    /// </summary>
+    private static void DeclareServerSideAuthMethod(
+        TestHostShell host, VerifierKeyMaterial material, ClientAuthenticationMethod method, string? clientJwks = null)
+    {
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+        ClientRecord previous = hosted.Registrations[segment];
+        ClientRecord updated = previous with
+        {
+            TokenEndpointAuthMethod = method,
+            ClientJwks = clientJwks
+        };
+
+        hosted.Registrations[segment] = updated;
+        hosted.Registrations[updated.ClientId] = updated;
+        hosted.Server.UpdateClient(previous, updated, new ExchangeContext());
+
+        material.Registration = updated;
+    }
+
+
+    /// <summary>
+    /// Wraps <paramref name="secret"/>'s UTF-8 bytes as a <see cref="PrivateKeyMemory"/> carrying no
+    /// crypto tag (<see cref="Tag.Empty"/>) — a bare RFC 6749 §2.3.1 shared secret is not an
+    /// asymmetric key, so none of the existing <see cref="CryptoTags"/> algorithm-specific entries
+    /// apply. The paired <see cref="PublicKeyMemory"/> is never read (only
+    /// <see cref="ClientRegistration.AuthenticationKeyMaterial"/>'s <c>PrivateKey</c> half is
+    /// consulted for <c>client_secret_post</c>/<c>client_secret_basic</c>).
+    /// </summary>
+    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope",
+        Justification = "Ownership transfers to the caller, which disposes both halves via secretMaterial.PublicKey/PrivateKey.")]
+    private static PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> BuildSecretKeyMaterial(string secret)
+    {
+        byte[] secretBytes = Encoding.UTF8.GetBytes(secret);
+        IMemoryOwner<byte> secretOwner = Pool.Rent(secretBytes.Length);
+        secretBytes.CopyTo(secretOwner.Memory.Span);
+        PrivateKeyMemory privateKey = new(secretOwner, Tag.Empty);
+
+        //Never read — client_secret_post/basic consult only the PrivateKey half — but a
+        //PublicPrivateKeyMaterial pair requires one regardless.
+        IMemoryOwner<byte> unusedPublicOwner = Pool.Rent(1);
+        PublicKeyMemory publicKey = new(unusedPublicOwner, Tag.Empty);
+
+        return new PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory>(publicKey, privateKey);
+    }
+
+
+    /// <summary>
+    /// The test-side reverse of <see cref="OutgoingHeadersClientAuthExtensions.WithClientSecretBasic"/>
+    /// (RFC 6749 §2.3.1): base64-decode the <c>Authorization: Basic</c> header, split the pair on the
+    /// first <c>:</c> (the join character the encoder never percent-encodes into either half), and
+    /// reverse <c>application/x-www-form-urlencoded</c> on each half — <see cref="ClientId"/> contains
+    /// <c>:</c> and <c>/</c>, both of which the encoder percent-escapes, so a naive raw comparison
+    /// would never match.
+    /// </summary>
+    private static bool DecodeAndMatchBasicHeader(
+        IncomingRequest? request, string expectedClientId, string expectedClientSecret)
+    {
+        if(request is null
+            || !request.Headers.TryGetSingle(WellKnownHttpHeaderNames.Authorization, out string? authorizationHeader)
+            || authorizationHeader is null
+            || !authorizationHeader.StartsWith("Basic ", StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        byte[] decoded = Convert.FromBase64String(authorizationHeader["Basic ".Length..]);
+        string pair = Encoding.UTF8.GetString(decoded);
+        int separatorIndex = pair.IndexOf(':', StringComparison.Ordinal);
+        if(separatorIndex < 0)
+        {
+            return false;
+        }
+
+        string decodedClientId = FormUrlDecode(pair[..separatorIndex]);
+        string decodedClientSecret = FormUrlDecode(pair[(separatorIndex + 1)..]);
+
+        return string.Equals(decodedClientId, expectedClientId, StringComparison.Ordinal)
+            && string.Equals(decodedClientSecret, expectedClientSecret, StringComparison.Ordinal);
+    }
+
+
+    /// <summary>Reverses <c>application/x-www-form-urlencoded</c> (RFC 6749 Appendix B): <c>+</c> becomes space, then <see cref="Uri.UnescapeDataString"/> resolves the remaining <c>%XX</c> triplets.</summary>
+    private static string FormUrlDecode(string value) => Uri.UnescapeDataString(value.Replace('+', ' '));
+
+
+    private static string BuildJwksJson(IReadOnlyDictionary<string, string> jwk, string kid)
+    {
+        StringBuilder sb = new();
+        sb.Append('{').Append('"').Append(WellKnownJwkMemberNames.Keys).Append("\":[{");
+        foreach(KeyValuePair<string, string> member in jwk)
+        {
+            sb.Append('"').Append(member.Key).Append("\":\"").Append(member.Value).Append("\",");
+        }
+
+        sb.Append('"').Append(WellKnownJwkMemberNames.Kid).Append("\":\"").Append(kid).Append("\"}]}");
+
+        return sb.ToString();
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/AuthCodeFlowTests.cs b/test/Verifiable.Tests/OAuth/AuthCodeFlowTests.cs
index a6955cac..7d9f5a3d 100644
--- a/test/Verifiable.Tests/OAuth/AuthCodeFlowTests.cs
+++ b/test/Verifiable.Tests/OAuth/AuthCodeFlowTests.cs
@@ -103,6 +103,69 @@ public async Task HandleParAsyncReturnsInternalErrorWhenResponseIsMalformed()
     }
 
 
+    //R9207-013 / RFC 8414 §3.3 — the client-side metadata-consumption seam
+    //(ResolveValidatedAuthorizationServerMetadataAsync) verifies a resolved
+    //AuthorizationServerMetadata.Issuer against the pinned ClientRegistration.
+    //AuthorizationServerIssuer before any flow handler uses the metadata's endpoints,
+    //so a resolver returning metadata for the wrong authorization server is caught before
+    //any request is sent to it.
+
+    [TestMethod]
+    public async Task HandleParAsyncRejectsWhenMetadataIssuerDoesNotMatchPinnedRegistration()
+    {
+        Uri pinnedIssuer = new("https://as.example.com");
+        Uri divergentMetadataIssuer = new("https://different-as.example.com");
+
+        AuthorizationServerMetadata metadata = new()
+        {
+            Issuer = divergentMetadataIssuer,
+            PushedAuthorizationRequestEndpoint = new Uri("https://as.example.com/par"),
+            AuthorizationEndpoint = new Uri("https://as.example.com/authorize"),
+            TokenEndpoint = new Uri("https://as.example.com/token")
+        };
+
+        OAuthClientInfrastructure infrastructure = OAuthClientInfrastructure.Create(
+            sendFormPostAsync: (_, _, _, _, _) =>
+                throw new InvalidOperationException(
+                    "Must not send a PAR request when the metadata issuer fails validation."),
+            saveStateAsync: (_, _, _) => ValueTask.CompletedTask,
+            loadStateAsync: (_, _, _) => ValueTask.FromResult<FlowState?>(null),
+            loadStateByRequestUriAsync: (_, _, _) => ValueTask.FromResult<FlowState?>(null),
+            parseParResponseAsync: OAuthResponseParsers.ParseParResponse,
+            parseTokenResponseAsync: OAuthResponseParsers.ParseTokenResponse,
+            parseAuthorizationServerMetadataAsync: (body, ct) =>
+                throw new NotImplementedException("Test pre-resolves metadata; the parser is not exercised."),
+            parseRegistrationResponseAsync: (body, ct) =>
+                throw new NotImplementedException("Test does not exercise dynamic registration."),
+            resolveAuthorizationServerMetadataAsync: (issuer, context, ct) =>
+                ValueTask.FromResult(metadata),
+            resolveCallbackValidator: ClientPolicyProfiles.DefaultResolveCallbackValidator,
+            base64UrlEncoder: TestSetup.Base64UrlEncoder,
+            timeProvider: TimeProvider);
+
+        ClientRegistration registration = new()
+        {
+            ClientId = new ClientId("test-client"),
+            AuthorizationServerIssuer = pinnedIssuer,
+            RedirectUris = [DefaultRedirectUri],
+            AuthenticationMethod = ClientAuthenticationMethod.None,
+            Profile = PolicyProfile.Haip10
+        };
+
+        AuthCodeFlowEndpointResult result = await AuthCodeFlowHandlers.HandleParAsync(
+            new Dictionary<string, string>(),
+            DefaultRedirectUri,
+            infrastructure,
+            registration,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "A metadata issuer diverging from the pinned AuthorizationServerIssuer must be rejected " +
+            "before any request is sent to the (potentially wrong) authorization server.");
+        Assert.AreEqual("invalid_request", result.ErrorCode);
+    }
+
+
     [TestMethod]
     public async Task HandleCallbackAsyncReturnsBadRequestWhenMissingParameters()
     {
diff --git a/test/Verifiable.Tests/OAuth/AuthCodeParPkceRealWireFlowTests.cs b/test/Verifiable.Tests/OAuth/AuthCodeParPkceRealWireFlowTests.cs
index 8e2c903e..4d2b801d 100644
--- a/test/Verifiable.Tests/OAuth/AuthCodeParPkceRealWireFlowTests.cs
+++ b/test/Verifiable.Tests/OAuth/AuthCodeParPkceRealWireFlowTests.cs
@@ -2,6 +2,7 @@
 using System.Collections.Immutable;
 using System.Linq;
 using System.Net.Http;
+using System.Security.Cryptography.X509Certificates;
 using Microsoft.Extensions.Time.Testing;
 using Verifiable.OAuth;
 using Verifiable.OAuth.AuthCode;
@@ -104,7 +105,7 @@ await host.CreateOAuthClientAndRegistrationAsync(
         string segment = material.Registration.TenantId.Value;
 
         string flowId = await DriveParAuthorizeAndCallbackAsync(
-            hosted, client, registration, clientFlowStore, segment, TestContext.CancellationToken)
+            hosted, client, registration, clientFlowStore, segment, host.ServerCertificate, TestContext.CancellationToken)
             .ConfigureAwait(false);
 
         AuthCodeFlowEndpointResult tokenResult = await client.AuthCode.ExchangeTokenAsync(
@@ -163,7 +164,7 @@ await host.CreateOAuthClientAndRegistrationAsync(
         string segment = material.Registration.TenantId.Value;
 
         string flowId = await DriveParAuthorizeAndCallbackAsync(
-            hosted, client, registration, clientFlowStore, segment, TestContext.CancellationToken)
+            hosted, client, registration, clientFlowStore, segment, host.ServerCertificate, TestContext.CancellationToken)
             .ConfigureAwait(false);
 
         //Tamper the persisted verifier so token exchange presents a code_verifier that does not hash
@@ -199,6 +200,7 @@ private static async Task<string> DriveParAuthorizeAndCallbackAsync(
         ClientRegistration registration,
         Dictionary<string, FlowState> clientFlowStore,
         string segment,
+        X509Certificate2 pinnedCertificate,
         CancellationToken cancellationToken)
     {
         AuthCodeFlowEndpointResult parResult = await client.AuthCode.StartParAsync(
@@ -216,13 +218,11 @@ private static async Task<string> DriveParAuthorizeAndCallbackAsync(
             $"?{OAuthRequestParameterNames.ClientId}={Uri.EscapeDataString(ClientId)}" +
             $"&{OAuthRequestParameterNames.RequestUri}={Uri.EscapeDataString(parState.Par.RequestUri.ToString())}");
 
-        //CheckCertificateRevocationList is set for CA5399, though this leg is plain HTTP to
-        //loopback — no certificate is ever presented, so the flag has no observable effect here.
-        using HttpClientHandler noRedirectHandler = new()
-        {
-            AllowAutoRedirect = false,
-            CheckCertificateRevocationList = true
-        };
+        //A fresh pinned, no-redirect client for the browser leg: the same certificate the shell's
+        //SharedHttpClient pins, so this genuine HTTPS GET succeeds without trusting a CA, and with
+        //auto-redirect disabled so the 302 Location is read off the wire instead of being followed.
+        using HttpClientHandler noRedirectHandler = LoopbackTls.CreatePinnedHandler(pinnedCertificate);
+        noRedirectHandler.AllowAutoRedirect = false;
         using HttpClient browserClient = new(noRedirectHandler) { BaseAddress = hosted.HttpBaseAddress };
         using HttpRequestMessage authorizeRequest = new(HttpMethod.Get, authorizeUrl);
         authorizeRequest.Headers.Add(AuthorizationServerHttpApplication.TestSubjectHeaderName, SubjectId);
diff --git a/test/Verifiable.Tests/OAuth/AuthorizationServerFeatureTests.cs b/test/Verifiable.Tests/OAuth/AuthorizationServerFeatureTests.cs
index e3d2f338..9c599ac1 100644
--- a/test/Verifiable.Tests/OAuth/AuthorizationServerFeatureTests.cs
+++ b/test/Verifiable.Tests/OAuth/AuthorizationServerFeatureTests.cs
@@ -2582,7 +2582,8 @@ private static ClientRecord MakeRegistrationForAud(
 
 
     //Builds the IssuanceContext the resolver consumes. Subject and ClientId are
-    //placeholder; only Scope is varied per test.
+    //placeholder; only Scope is varied per test. GrantType is fixed at
+    //authorization_code — audience resolution does not vary by grant.
     private static IssuanceContext MakeIssuanceContext(
         ClientRecord registration, string scope) =>
         new()
@@ -2593,6 +2594,7 @@ private static IssuanceContext MakeIssuanceContext(
             Subject = "alice",
             Scope = scope,
             ClientId = registration.ClientId,
+            GrantType = WellKnownGrantTypes.AuthorizationCode,
             IssuedAt = DateTimeOffset.UnixEpoch
         };
 }
diff --git a/test/Verifiable.Tests/OAuth/AuthorizationServerHttpApplication.cs b/test/Verifiable.Tests/OAuth/AuthorizationServerHttpApplication.cs
index ce0548d8..d6975b3a 100644
--- a/test/Verifiable.Tests/OAuth/AuthorizationServerHttpApplication.cs
+++ b/test/Verifiable.Tests/OAuth/AuthorizationServerHttpApplication.cs
@@ -2,9 +2,7 @@
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.IO.Pipelines;
-using Microsoft.AspNetCore.Hosting.Server;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Features;
 using StringValues = Microsoft.Extensions.Primitives.StringValues;
 using Verifiable.Core;
 using Verifiable.JCose;
@@ -15,18 +13,18 @@
 namespace Verifiable.Tests.OAuth;
 
 /// <summary>
-/// Bridges minimal Kestrel hosting to
-/// <see cref="EndpointServer.DispatchAsync"/>. Maps inbound HTTP
-/// requests to the library's <see cref="IncomingRequest"/> and
-/// <see cref="ExchangeContext"/>, and maps the outbound
-/// <see cref="ServerHttpResponse"/> back to HTTP response bytes.
+/// Bridges a <see cref="Microsoft.AspNetCore.Builder.WebApplication"/>'s HTTPS pipeline to
+/// <see cref="EndpointServer.DispatchAsync"/>. <see cref="ProcessRequestAsync"/> is mounted directly as
+/// the pipeline's <c>RequestDelegate</c> (<c>app.Run(application.ProcessRequestAsync)</c>): it maps
+/// inbound HTTP requests to the library's <see cref="IncomingRequest"/> and
+/// <see cref="ExchangeContext"/>, and maps the outbound <see cref="ServerHttpResponse"/> back to HTTP
+/// response bytes.
 /// </summary>
 /// <remarks>
 /// <para>
-/// Test-only construct. The library itself does not reference Kestrel.
-/// A production deployment writes its own host adapter; the shape of
-/// this mapping layer is a useful reference but not part of the
-/// library's public surface.
+/// Test-only construct. The library itself does not reference Kestrel or ASP.NET Core. A production
+/// deployment writes its own host adapter; the shape of this mapping layer is a useful reference but
+/// not part of the library's public surface.
 /// </para>
 /// <para>
 /// Three behaviours worth flagging for any reader:
@@ -55,7 +53,7 @@ namespace Verifiable.Tests.OAuth;
 /// </list>
 /// </remarks>
 [DebuggerDisplay("AuthorizationServerHttpApplication")]
-internal sealed class AuthorizationServerHttpApplication: IHttpApplication<HttpContext>
+internal sealed class AuthorizationServerHttpApplication
 {
     /// <summary>
     /// A request header carrying the authenticated end-user identifier for real-wire capstones that
@@ -79,11 +77,6 @@ public AuthorizationServerHttpApplication(EndpointServer server)
     }
 
 
-    /// <summary>Creates the per-request <see cref="HttpContext"/> Kestrel dispatches through.</summary>
-    public HttpContext CreateContext(IFeatureCollection contextFeatures) =>
-        new DefaultHttpContext(contextFeatures);
-
-
     /// <summary>
     /// Maps <paramref name="context"/>'s inbound HTTP request to an <see cref="IncomingRequest"/>,
     /// dispatches it through <see cref="server"/>, and maps the resulting <see cref="ServerHttpResponse"/>
@@ -137,10 +130,6 @@ await WriteResponseAsync(response, context.Response, context.RequestAborted)
     }
 
 
-    /// <summary>No per-request disposable state is held; this is a no-op.</summary>
-    public void DisposeContext(HttpContext context, Exception? exception) { }
-
-
     /// <summary>
     /// Parses the tenant segment from <c>/connect/{segment}/...</c>. Returns
     /// <see langword="null"/> when the path does not start with <c>/connect/</c>
diff --git a/test/Verifiable.Tests/OAuth/AzpMultiAudienceScenarioTests.cs b/test/Verifiable.Tests/OAuth/AzpMultiAudienceScenarioTests.cs
index 4e0498cc..6b4713e3 100644
--- a/test/Verifiable.Tests/OAuth/AzpMultiAudienceScenarioTests.cs
+++ b/test/Verifiable.Tests/OAuth/AzpMultiAudienceScenarioTests.cs
@@ -74,7 +74,7 @@ public async Task MultiAudienceIdTokenWithAzpValidatesEndToEnd()
 
         //The relying party validates from wire bytes only, supplying its own
         //client_id as the expected authorized party (rule 5).
-        JwsAccessTokenValidationResult result = await ValidateAsRelyingPartyAsync(
+        Oidc10IdTokenValidationResult result = await ValidateAsRelyingPartyAsync(
             idToken, material, expectedAuthorizedParty: ClientId).ConfigureAwait(false);
 
         Assert.IsTrue(result.IsSuccess,
@@ -85,7 +85,7 @@ public async Task MultiAudienceIdTokenWithAzpValidatesEndToEnd()
 
         //The same wire token presented to a DIFFERENT relying party fails
         //rule 5 — azp names the party the token was issued to, not them.
-        JwsAccessTokenValidationResult otherParty = await ValidateAsRelyingPartyAsync(
+        Oidc10IdTokenValidationResult otherParty = await ValidateAsRelyingPartyAsync(
             idToken, material, expectedAuthorizedParty: "https://other-client.example.com").ConfigureAwait(false);
 
         Assert.IsFalse(otherParty.IsSuccess);
@@ -108,7 +108,7 @@ public async Task MultiAudienceIdTokenWithoutAzpIsRejectedWhenEnforced()
         string idToken = await DriveCodeExchangeForIdTokenAsync(host, material).ConfigureAwait(false);
 
         //An enforcing relying party rejects the shape (rule 4)…
-        JwsAccessTokenValidationResult enforced = await ValidateAsRelyingPartyAsync(
+        Oidc10IdTokenValidationResult enforced = await ValidateAsRelyingPartyAsync(
             idToken, material, expectedAuthorizedParty: ClientId).ConfigureAwait(false);
 
         Assert.IsFalse(enforced.IsSuccess);
@@ -117,7 +117,7 @@ public async Task MultiAudienceIdTokenWithoutAzpIsRejectedWhenEnforced()
 
         //…and a non-enforcing one accepts it — the rules are SHOULDs, so
         //enforcement is the relying party's opt-in, not a hard issuance gate.
-        JwsAccessTokenValidationResult lenient = await ValidateAsRelyingPartyAsync(
+        Oidc10IdTokenValidationResult lenient = await ValidateAsRelyingPartyAsync(
             idToken, material, expectedAuthorizedParty: null).ConfigureAwait(false);
 
         Assert.IsTrue(lenient.IsSuccess,
@@ -139,7 +139,7 @@ public async Task SingleAudienceIdTokenNeedsNoAzpEvenWhenEnforced()
         //rule 4 conditions on MULTIPLE audiences).
         string idToken = await DriveCodeExchangeForIdTokenAsync(host, material).ConfigureAwait(false);
 
-        JwsAccessTokenValidationResult result = await ValidateAsRelyingPartyAsync(
+        Oidc10IdTokenValidationResult result = await ValidateAsRelyingPartyAsync(
             idToken, material, expectedAuthorizedParty: ClientId).ConfigureAwait(false);
 
         Assert.IsTrue(result.IsSuccess,
@@ -282,7 +282,7 @@ private async Task<string> DriveCodeExchangeForIdTokenAsync(
     /// verification key resolves by the token's kid, the way a deployment
     /// resolves against the fetched JWKS.
     /// </summary>
-    private async Task<JwsAccessTokenValidationResult> ValidateAsRelyingPartyAsync(
+    private async Task<Oidc10IdTokenValidationResult> ValidateAsRelyingPartyAsync(
         string idToken, VerifierKeyMaterial material, string? expectedAuthorizedParty)
     {
         ServerVerificationKeyResolverDelegate resolveKey = (kid, tenant, ctx, ct) =>
@@ -290,7 +290,7 @@ private async Task<JwsAccessTokenValidationResult> ValidateAsRelyingPartyAsync(
                 string.Equals(kid.Value, material.SigningKeyId.Value, StringComparison.Ordinal)
                     ? material.SigningPublicKey : null);
 
-        return await JwsAccessTokenValidator.ValidateAsync(
+        return await Oidc10IdTokenValidator.ValidateAsync(
             idToken,
             material.Registration.IssuerUri!.OriginalString,
             ClientId,
@@ -304,6 +304,8 @@ private async Task<JwsAccessTokenValidationResult> ValidateAsRelyingPartyAsync(
             tenantId: default,
             new ExchangeContext(),
             expectedAuthorizedParty,
+            expectedNonce: null,
+            trustedAudiences: null,
             TestContext.CancellationToken).ConfigureAwait(false);
     }
 
diff --git a/test/Verifiable.Tests/OAuth/BearerTokenChallengeTests.cs b/test/Verifiable.Tests/OAuth/BearerTokenChallengeTests.cs
new file mode 100644
index 00000000..a8eb18c4
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/BearerTokenChallengeTests.cs
@@ -0,0 +1,429 @@
+using System;
+using Verifiable.OAuth;
+using Verifiable.OAuth.ProtectedResource;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Spec tests for the RFC 6750 §3 <c>WWW-Authenticate: Bearer</c> challenge
+/// builder and parser (<see cref="BearerTokenChallenge"/>). The happy-path
+/// cases reproduce §3's own example values verbatim; the rest pin each
+/// attribute alone and combined, the round-trip through
+/// <see cref="BearerTokenChallenge.TryParse"/>, the §3 charset rejections, the
+/// RFC 9728 §5.1 <c>resource_metadata</c> composition, and the auth-param
+/// grammar edges (RFC 9110 §11.2).
+/// </summary>
+[TestClass]
+internal sealed class BearerTokenChallengeTests
+{
+    /// <summary>RFC 6750 §3, first example: a challenge carrying only <c>realm</c>.</summary>
+    [TestMethod]
+    public void RealmAloneMatchesRfc6750Section3Example()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(realm: "example");
+
+        Assert.AreEqual("Bearer realm=\"example\"", challenge);
+    }
+
+
+    /// <summary>
+    /// RFC 6750 §3, second example (as the logical single-line header value):
+    /// the expired-token challenge with <c>realm</c>, <c>error</c>, and
+    /// <c>error_description</c>.
+    /// </summary>
+    [TestMethod]
+    public void ExpiredTokenChallengeMatchesRfc6750Section3Example()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(
+            realm: "example",
+            error: OAuthErrors.InvalidToken,
+            errorDescription: "The access token expired");
+
+        Assert.AreEqual(
+            "Bearer realm=\"example\", error=\"invalid_token\", " +
+            "error_description=\"The access token expired\"",
+            challenge);
+    }
+
+
+    /// <summary>§3.1: the <c>error</c> attribute alone.</summary>
+    [TestMethod]
+    public void ErrorAloneIsEmitted()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(error: OAuthErrors.InvalidToken);
+
+        Assert.AreEqual("Bearer error=\"invalid_token\"", challenge);
+    }
+
+
+    /// <summary>§3: the <c>error_description</c> attribute alone.</summary>
+    [TestMethod]
+    public void ErrorDescriptionAloneIsEmitted()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(
+            errorDescription: "The access token expired");
+
+        Assert.AreEqual("Bearer error_description=\"The access token expired\"", challenge);
+    }
+
+
+    /// <summary>§3: the OpenID Connect example scope value, alone.</summary>
+    [TestMethod]
+    public void ScopeAloneMatchesRfc6750OpenIdExample()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(scope: "openid profile email");
+
+        Assert.AreEqual("Bearer scope=\"openid profile email\"", challenge);
+    }
+
+
+    /// <summary>
+    /// §3: the OMAP example scope value exercises the edge of the scope
+    /// charset — <c>=</c>, <c>&amp;</c>, and a comma inside the quoted-string —
+    /// and must survive the round-trip without splitting on the comma.
+    /// </summary>
+    [TestMethod]
+    public void OmapScopeExampleValueRoundTrips()
+    {
+        string omapScope = "urn:example:channel=HBO&urn:example:rating=G,PG-13";
+
+        string challenge = BearerTokenChallenge.BuildChallenge(scope: omapScope);
+
+        Assert.AreEqual(
+            "Bearer scope=\"urn:example:channel=HBO&urn:example:rating=G,PG-13\"", challenge);
+        Assert.IsTrue(BearerTokenChallenge.TryParse(challenge, out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual(omapScope, parameters.Scope);
+    }
+
+
+    /// <summary>
+    /// RFC 9728 §5.1: <c>resource_metadata</c> alone composes to the same
+    /// challenge <see cref="ProtectedResourceChallenge.BuildChallenge"/>
+    /// produces — the value formatting is delegated, not restated.
+    /// </summary>
+    [TestMethod]
+    public void ResourceMetadataAloneMatchesProtectedResourceChallenge()
+    {
+        Uri metadataUrl = new("https://resource.example.com/.well-known/oauth-protected-resource");
+
+        string challenge = BearerTokenChallenge.BuildChallenge(resourceMetadata: metadataUrl);
+
+        Assert.AreEqual(
+            "Bearer resource_metadata=\"https://resource.example.com/.well-known/oauth-protected-resource\"",
+            challenge);
+        Assert.AreEqual(
+            ProtectedResourceChallenge.BuildChallenge(WellKnownAuthenticationSchemes.Bearer, metadataUrl),
+            challenge);
+    }
+
+
+    /// <summary>All five attributes combine into one header, one scheme, in signature order.</summary>
+    [TestMethod]
+    public void AllParametersCombinedAppearInSignatureOrder()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(
+            realm: "example",
+            error: OAuthErrors.InvalidToken,
+            errorDescription: "The access token expired",
+            scope: "openid profile",
+            resourceMetadata: new Uri("https://resource.example.com/.well-known/oauth-protected-resource"));
+
+        Assert.AreEqual(
+            "Bearer realm=\"example\", error=\"invalid_token\", " +
+            "error_description=\"The access token expired\", scope=\"openid profile\", " +
+            "resource_metadata=\"https://resource.example.com/.well-known/oauth-protected-resource\"",
+            challenge);
+    }
+
+
+    /// <summary>
+    /// §3.1: the <c>insufficient_scope</c> challenge MAY carry the
+    /// <c>scope</c> attribute naming the scope necessary to access the
+    /// resource — the shape a 403 response uses.
+    /// </summary>
+    [TestMethod]
+    public void InsufficientScopeChallengeCarriesScopeAttribute()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(
+            error: OAuthErrors.InsufficientScope,
+            scope: "admin");
+
+        Assert.AreEqual("Bearer error=\"insufficient_scope\", scope=\"admin\"", challenge);
+    }
+
+
+    /// <summary>RFC 9110 §5.6.4: <c>"</c> and <c>\</c> in <c>realm</c> are backslash-escaped and unescape on parse.</summary>
+    [TestMethod]
+    public void RealmQuotedStringSpecialCharactersAreEscapedAndRoundTrip()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(realm: "say \"hi\" \\ bye");
+
+        Assert.AreEqual("Bearer realm=\"say \\\"hi\\\" \\\\ bye\"", challenge);
+        Assert.IsTrue(BearerTokenChallenge.TryParse(challenge, out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual("say \"hi\" \\ bye", parameters.Realm);
+    }
+
+
+    /// <summary>A round-trip through <see cref="BearerTokenChallenge.TryParse"/> preserves every attribute.</summary>
+    [TestMethod]
+    public void AllParametersRoundTripThroughTryParse()
+    {
+        Uri resourceMetadata = new("https://resource.example.com/.well-known/oauth-protected-resource");
+
+        string challenge = BearerTokenChallenge.BuildChallenge(
+            realm: "example",
+            error: OAuthErrors.InsufficientScope,
+            errorDescription: "Higher privileges are required",
+            scope: "purchase admin",
+            resourceMetadata: resourceMetadata);
+
+        Assert.IsTrue(BearerTokenChallenge.TryParse(challenge, out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual("example", parameters.Realm);
+        Assert.AreEqual(OAuthErrors.InsufficientScope, parameters.Error);
+        Assert.AreEqual("Higher privileges are required", parameters.ErrorDescription);
+        Assert.AreEqual("purchase admin", parameters.Scope);
+        Assert.AreEqual(resourceMetadata.AbsoluteUri, parameters.ResourceMetadata!.AbsoluteUri);
+    }
+
+
+    /// <summary>
+    /// The composed challenge stays readable through the RFC 9728 client-side
+    /// reader <see cref="ProtectedResourceChallenge.TryReadResourceMetadata"/>:
+    /// one header, one scheme, both the §3 error and the §5.1 pointer.
+    /// </summary>
+    [TestMethod]
+    public void ComposedChallengeIsReadableByProtectedResourceChallengeReader()
+    {
+        Uri metadataUrl = new("https://rs1.example/.well-known/oauth-protected-resource");
+
+        string challenge = BearerTokenChallenge.BuildChallenge(
+            error: OAuthErrors.InvalidToken,
+            resourceMetadata: metadataUrl);
+
+        Assert.AreEqual(
+            "Bearer error=\"invalid_token\", " +
+            "resource_metadata=\"https://rs1.example/.well-known/oauth-protected-resource\"",
+            challenge);
+        Assert.AreEqual(metadataUrl.OriginalString, ProtectedResourceChallenge.TryReadResourceMetadata(challenge));
+        Assert.IsTrue(BearerTokenChallenge.TryParse(challenge, out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual(OAuthErrors.InvalidToken, parameters.Error);
+        Assert.AreEqual(metadataUrl.AbsoluteUri, parameters.ResourceMetadata!.AbsoluteUri);
+    }
+
+
+    /// <summary>A null or empty string attribute is treated as absent, not emitted empty.</summary>
+    [TestMethod]
+    public void EmptyStringsAreTreatedAsAbsent()
+    {
+        string challenge = BearerTokenChallenge.BuildChallenge(
+            realm: "", error: OAuthErrors.InvalidToken, errorDescription: "", scope: "");
+
+        Assert.AreEqual("Bearer error=\"invalid_token\"", challenge);
+    }
+
+
+    /// <summary>§3: the scheme MUST be followed by one or more auth-param values — all-absent is rejected.</summary>
+    [TestMethod]
+    public void AllAbsentThrows()
+    {
+        Assert.ThrowsExactly<ArgumentException>(() => BearerTokenChallenge.BuildChallenge());
+    }
+
+
+    /// <summary>§3: <c>error</c> values MUST NOT include characters outside %x20-21 / %x23-5B / %x5D-7E — %x22 is outside.</summary>
+    [TestMethod]
+    public void ErrorWithDoubleQuoteThrows()
+    {
+        Assert.ThrowsExactly<ArgumentException>(
+            () => BearerTokenChallenge.BuildChallenge(error: "invalid\"token"));
+    }
+
+
+    /// <summary>§3: control characters are outside the <c>error_description</c> charset.</summary>
+    [TestMethod]
+    public void ErrorDescriptionWithControlCharacterThrows()
+    {
+        Assert.ThrowsExactly<ArgumentException>(
+            () => BearerTokenChallenge.BuildChallenge(errorDescription: "line one\nline two"));
+    }
+
+
+    /// <summary>§3: non-ASCII characters are outside the <c>error_description</c> charset.</summary>
+    [TestMethod]
+    public void ErrorDescriptionWithNonAsciiCharacterThrows()
+    {
+        Assert.ThrowsExactly<ArgumentException>(
+            () => BearerTokenChallenge.BuildChallenge(errorDescription: "accés refusé"));
+    }
+
+
+    /// <summary>§3: <c>\</c> (%x5C) is outside the scope charset.</summary>
+    [TestMethod]
+    public void ScopeWithBackslashThrows()
+    {
+        Assert.ThrowsExactly<ArgumentException>(
+            () => BearerTokenChallenge.BuildChallenge(scope: "read\\write"));
+    }
+
+
+    /// <summary>
+    /// §3 / RFC 6749 §3.3: the scope list is scope-tokens with single %x20
+    /// delimiters — leading, trailing, and consecutive spaces are malformed.
+    /// </summary>
+    [TestMethod]
+    public void ScopeDelimiterShapeIsEnforced()
+    {
+        Assert.ThrowsExactly<ArgumentException>(() => BearerTokenChallenge.BuildChallenge(scope: " openid"));
+        Assert.ThrowsExactly<ArgumentException>(() => BearerTokenChallenge.BuildChallenge(scope: "openid "));
+        Assert.ThrowsExactly<ArgumentException>(() => BearerTokenChallenge.BuildChallenge(scope: "openid  profile"));
+    }
+
+
+    /// <summary>Control characters cannot be represented in a quoted-string <c>realm</c>.</summary>
+    [TestMethod]
+    public void RealmWithControlCharacterThrows()
+    {
+        Assert.ThrowsExactly<ArgumentException>(
+            () => BearerTokenChallenge.BuildChallenge(realm: "example\u0007"));
+    }
+
+
+    /// <summary>RFC 9110 §11.2: auth-param values may be tokens, not only quoted-strings.</summary>
+    [TestMethod]
+    public void TokenFormValuesAreAccepted()
+    {
+        Assert.IsTrue(BearerTokenChallenge.TryParse(
+            "Bearer error=invalid_token", out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual(OAuthErrors.InvalidToken, parameters.Error);
+    }
+
+
+    /// <summary>RFC 9110 §11.2: auth-param names compare case-insensitively.</summary>
+    [TestMethod]
+    public void ParameterNamesCompareCaseInsensitively()
+    {
+        Assert.IsTrue(BearerTokenChallenge.TryParse(
+            "Bearer REALM=\"example\", Error=\"invalid_token\"", out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual("example", parameters.Realm);
+        Assert.AreEqual(OAuthErrors.InvalidToken, parameters.Error);
+    }
+
+
+    /// <summary>RFC 9110 §11.1: the auth-scheme compares case-insensitively.</summary>
+    [TestMethod]
+    public void SchemeComparesCaseInsensitively()
+    {
+        Assert.IsTrue(BearerTokenChallenge.TryParse(
+            "bearer realm=\"example\"", out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual("example", parameters.Realm);
+    }
+
+
+    /// <summary>RFC 9110 §11.2: bad whitespace around <c>=</c> is tolerated on parse.</summary>
+    [TestMethod]
+    public void WhitespaceAroundEqualsIsTolerated()
+    {
+        Assert.IsTrue(BearerTokenChallenge.TryParse(
+            "Bearer realm = \"example\"", out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual("example", parameters.Realm);
+    }
+
+
+    /// <summary>§3: other auth-param attributes MAY be used — unrecognized ones are ignored.</summary>
+    [TestMethod]
+    public void UnknownParametersAreIgnored()
+    {
+        Assert.IsTrue(BearerTokenChallenge.TryParse(
+            "Bearer realm=\"example\", nonce=\"n-42\"", out BearerTokenChallengeParameters parameters));
+        Assert.AreEqual("example", parameters.Realm);
+        Assert.IsNull(parameters.Error);
+    }
+
+
+    /// <summary>§3: all challenges defined by RFC 6750 use the auth-scheme value <c>Bearer</c>.</summary>
+    [TestMethod]
+    public void NonBearerSchemeIsRejected()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse("Basic realm=\"example\"", out _));
+    }
+
+
+    /// <summary>§3: the scheme MUST be followed by one or more auth-param values.</summary>
+    [TestMethod]
+    public void BareSchemeWithoutParametersIsRejected()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse("Bearer", out _));
+        Assert.IsFalse(BearerTokenChallenge.TryParse("Bearer   ", out _));
+    }
+
+
+    /// <summary>§3: the recognized attributes MUST NOT appear more than once.</summary>
+    [TestMethod]
+    public void DuplicateAttributeIsRejected()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse(
+            "Bearer realm=\"a\", realm=\"b\"", out _));
+    }
+
+
+    /// <summary>An unterminated quoted-string is a malformed challenge.</summary>
+    [TestMethod]
+    public void UnterminatedQuotedStringIsRejected()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse("Bearer realm=\"example", out _));
+    }
+
+
+    /// <summary>An attribute name without a value violates the auth-param grammar.</summary>
+    [TestMethod]
+    public void AttributeWithoutValueIsRejected()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse("Bearer realm", out _));
+        Assert.IsFalse(BearerTokenChallenge.TryParse("Bearer realm=", out _));
+    }
+
+
+    /// <summary>Auth-params are comma-separated — juxtaposed parameters are malformed.</summary>
+    [TestMethod]
+    public void MissingCommaBetweenParametersIsRejected()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse(
+            "Bearer realm=\"a\" error=\"b\"", out _));
+    }
+
+
+    /// <summary>RFC 9728 §3: the metadata URL is absolute — a relative <c>resource_metadata</c> is unusable.</summary>
+    [TestMethod]
+    public void RelativeResourceMetadataIsRejected()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse(
+            "Bearer resource_metadata=\"/metadata\"", out _));
+    }
+
+
+    /// <summary>
+    /// An absolute but non-http(s) <c>resource_metadata</c> is rejected on every platform. This
+    /// pins the scheme check independently of <see cref="RelativeResourceMetadataIsRejected"/>,
+    /// which only reaches it on Unix (where a rooted path parses as an absolute <c>file:</c> URI).
+    /// </summary>
+    [TestMethod]
+    public void NonHttpResourceMetadataSchemeIsRejected()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse(
+            "Bearer resource_metadata=\"file:///metadata\"", out _));
+    }
+
+
+    /// <summary>A failed parse yields the all-absent parameters instance.</summary>
+    [TestMethod]
+    public void FailedParseYieldsAllAbsentParameters()
+    {
+        Assert.IsFalse(BearerTokenChallenge.TryParse(
+            "Basic realm=\"example\"", out BearerTokenChallengeParameters parameters));
+        Assert.IsNull(parameters.Realm);
+        Assert.IsNull(parameters.Error);
+        Assert.IsNull(parameters.ErrorDescription);
+        Assert.IsNull(parameters.Scope);
+        Assert.IsNull(parameters.ResourceMetadata);
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/ClientCredentialsGrantTests.cs b/test/Verifiable.Tests/OAuth/ClientCredentialsGrantTests.cs
index 06c7b5c2..6e738288 100644
--- a/test/Verifiable.Tests/OAuth/ClientCredentialsGrantTests.cs
+++ b/test/Verifiable.Tests/OAuth/ClientCredentialsGrantTests.cs
@@ -1,13 +1,18 @@
 using System.Buffers;
+using System.Collections.Concurrent;
 using System.Collections.Immutable;
+using System.Diagnostics;
 using System.Net.Http;
 using System.Text;
 using System.Text.Json;
 using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
 using Verifiable.Cryptography;
 using Verifiable.Json;
 using Verifiable.OAuth;
+using Verifiable.OAuth.Diagnostics;
 using Verifiable.OAuth.Server;
+using Verifiable.Server.Diagnostics;
 using Verifiable.Tests.TestInfrastructure;
 
 namespace Verifiable.Tests.OAuth;
@@ -26,6 +31,12 @@ internal sealed class ClientCredentialsGrantTests
     private const string ClientId = "https://machine.example.com";
     private const string ClientSecret = "s3cret-of-the-machine";
 
+    //A non-identity scope, granted alongside RegisterDpopClient's fixed OIDC identity scope set
+    //(RegisterMachineClient patches it in) so a happy-path request has SOMETHING left to retain
+    //once RFC 6749 §3.3 narrowing (contract wave-4 D4) removes openid/profile/email/address/phone
+    //from every client_credentials grant.
+    private const string MachineScope = "telemetry.read";
+
     public TestContext TestContext { get; set; } = null!;
 
     private FakeTimeProvider TimeProvider { get; } = new FakeTimeProvider(TestClock.CanonicalEpoch);
@@ -49,7 +60,7 @@ public async Task IssuesBearerAccessTokenOverHttpWire()
             [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.ClientCredentials,
             [OAuthRequestParameterNames.ClientId] = ClientId,
             ["client_secret"] = ClientSecret,
-            [OAuthRequestParameterNames.Scope] = WellKnownScopes.OpenId
+            [OAuthRequestParameterNames.Scope] = MachineScope
         }, TestContext.CancellationToken).ConfigureAwait(false);
         string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
         Assert.AreEqual(200, (int)response.StatusCode, body);
@@ -59,7 +70,9 @@ public async Task IssuesBearerAccessTokenOverHttpWire()
         string accessToken = root.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
         Assert.AreEqual(WellKnownAuthenticationSchemes.Bearer, root.GetProperty("token_type").GetString());
         Assert.IsGreaterThan(0, root.GetProperty("expires_in").GetInt32(), "expires_in must reflect the token's exp-iat.");
-        Assert.AreEqual(WellKnownScopes.OpenId, root.GetProperty(OAuthRequestParameterNames.Scope).GetString());
+        Assert.AreEqual(MachineScope, root.GetProperty(OAuthRequestParameterNames.Scope).GetString(),
+            "A non-identity scope survives RFC 6749 §3.3 narrowing unchanged (contract wave-4 D4 "
+            + "narrows only openid and the OIDC identity scopes).");
 
         //RFC 9068 §3: with no end-user involved, the subject is the client itself.
         string[] segments = accessToken.Split('.');
@@ -129,9 +142,7 @@ public async Task GrantAdvertisesAndFailsClosedWithoutTheSeam()
         using VerifierKeyMaterial bareMaterial = bare.RegisterClient(
             ClientId,
             new Uri(ClientId),
-            ImmutableHashSet.Create(
-                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
-                WellKnownCapabilityIdentifiers.OAuthClientCredentials));
+            ImmutableHashSet.Create(WellKnownCapabilityIdentifiers.OAuthClientCredentials));
         await bare.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
         HostedAuthorizationServer bareHost = bare.Host("default");
         Uri bareTokenUrl = new(bareHost.HttpBaseAddress!, $"/connect/{bareMaterial.Registration.TenantId.Value}/token");
@@ -228,11 +239,14 @@ public async Task AuthorizationDetailsAreValidatedAndRefusedNotSilentlyDropped()
 
 
     /// <summary>
-    /// Registers a confidential machine client and wires a client_secret_post
-    /// validator. The registration carries OAuthAuthorizationCode alongside
-    /// OAuthClientCredentials because the shipped RFC 9068 access-token producer
-    /// is gated on it; a client-credentials-only deployment supplies its own
-    /// producer set.
+    /// Registers a truly client-credentials-only confidential machine client (no
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthAuthorizationCode"/>) and wires a
+    /// client_secret_post validator. Grant-only issuance works because
+    /// <see cref="Rfc9068AccessTokenProducer"/>'s <c>RequiredCapability</c> is
+    /// <see langword="null"/> — an optional tenant-feature gate, not a grant-capability proxy
+    /// (contract wave-4 D2) — so every token-issuing grant's own endpoint-match capability
+    /// (here <see cref="WellKnownCapabilityIdentifiers.OAuthClientCredentials"/>) is sufficient
+    /// on its own.
     /// </summary>
     private static VerifierKeyMaterial RegisterMachineClient(TestHostShell app)
     {
@@ -243,11 +257,25 @@ private static VerifierKeyMaterial RegisterMachineClient(TestHostShell app)
             new Uri(ClientId),
             profile: PolicyProfile.Rfc6749WithPkce,
             capabilities: ImmutableHashSet.Create(
-                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
                 WellKnownCapabilityIdentifiers.OAuthClientCredentials,
                 WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
                 WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
 
+        //RegisterDpopClient fixes AllowedScopes to the OIDC identity scope set; add MachineScope
+        //(the register-then-upgrade pattern — the routing dictionaries are host-internal) so a
+        //happy-path request retains something once the identity scopes are narrowed away.
+        HostedAuthorizationServer host = app.Host("default");
+        string segment = material.Registration.TenantId.Value;
+        ClientRecord previous = host.Registrations[segment];
+        ClientRecord updated = previous with
+        {
+            AllowedScopes = previous.AllowedScopes.Add(MachineScope)
+        };
+        host.Registrations[segment] = updated;
+        host.Registrations[updated.ClientId] = updated;
+        host.Server.UpdateClient(previous, updated, new ExchangeContext());
+        material.Registration = updated;
+
         //client_secret_post (RFC 6749 §2.3.1): the application owns the secret
         //store and the comparison; this test glue checks the form field.
         app.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
@@ -257,4 +285,141 @@ private static VerifierKeyMaterial RegisterMachineClient(TestHostShell app)
 
         return material;
     }
+
+
+    /// <summary>
+    /// Contract wave-4 D3/D4: even though this tenant is granted the
+    /// <see cref="WellKnownCapabilityIdentifiers.OidcOpenIdConnect"/> feature — ruling out D2's
+    /// capability gate as the explanation — a <c>client_credentials</c> token request carrying
+    /// <c>openid</c> never yields an id_token. <see cref="Oidc10IdTokenProducer"/>'s
+    /// <c>IsApplicable</c> independently requires <c>GrantType ∈ {authorization_code,
+    /// refresh_token}</c>, and the source-side <c>DropIdentityScopesForNonEndUserGrant</c> already
+    /// strips <c>openid</c> before the producer walk even runs — this test pins BOTH layers hold.
+    /// </summary>
+    [TestMethod]
+    public async Task NoIdTokenIsMintedForClientCredentialsEvenWithOpenidRequestedAndOidcFeatureGranted()
+    {
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId,
+            new Uri(ClientId),
+            profile: PolicyProfile.Rfc6749WithPkce,
+            capabilities: ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthClientCredentials,
+                WellKnownCapabilityIdentifiers.OidcOpenIdConnect,
+                WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+                WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
+        app.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
+            ValueTask.FromResult(
+                fields.TryGetValue("client_secret", out string? secret)
+                && string.Equals(secret, ClientSecret, StringComparison.Ordinal));
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{material.Registration.TenantId.Value}/token");
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(host.SharedHttpClient!, tokenUrl, new Dictionary<string, string>
+        {
+            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.ClientCredentials,
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            ["client_secret"] = ClientSecret,
+            [OAuthRequestParameterNames.Scope] = WellKnownScopes.OpenId
+        }, TestContext.CancellationToken).ConfigureAwait(false);
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+
+        using JsonDocument doc = JsonDocument.Parse(body);
+        Assert.IsTrue(doc.RootElement.TryGetProperty(WellKnownTokenTypes.AccessToken, out _),
+            "An access token must still be minted (D3 leaves the access-token producer unaffected).");
+        Assert.IsFalse(doc.RootElement.TryGetProperty(WellKnownTokenTypes.IdToken, out _),
+            "client_credentials must never carry an id_token even when openid was requested on a "
+            + "tenant with the OidcOpenIdConnect feature granted.");
+    }
+
+
+    /// <summary>
+    /// Contract wave-4 D4 source layer: <c>client_credentials</c> has no authenticated End-User (the
+    /// token's <c>sub</c> is the client itself), so a request carrying <c>openid</c> and every OIDC
+    /// Core §5.4 identity scope has them narrowed away (RFC 6749 §3.3) before the granted scope ever
+    /// reaches the token — the issued access token's <c>scope</c> claim carries none of them — and
+    /// the narrowing emits <see cref="OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant"/>
+    /// naming exactly the dropped values.
+    /// </summary>
+    [TestMethod]
+    public async Task OpenidAndIdentityScopesAreDroppedFromClientCredentialsGrantedScopeWithOtelEvent()
+    {
+        ConcurrentBag<Activity> captured = [];
+        using ActivityListener listener = new()
+        {
+            ShouldListenTo = static source =>
+                string.Equals(source.Name, ServerActivitySource.SourceName, StringComparison.Ordinal),
+            Sample = static (ref ActivityCreationOptions<ActivityContext> _) => ActivitySamplingResult.AllDataAndRecorded,
+            ActivityStopped = activity => captured.Add(activity)
+        };
+        ActivitySource.AddActivityListener(listener);
+
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = RegisterMachineClient(app);
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        string segment = material.Registration.TenantId.Value;
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{segment}/token");
+
+        //RegisterMachineClient's AllowedScopes (via RegisterDpopClient) is exactly the OIDC identity
+        //scope set — every token requested here is an identity scope, so the narrowed grant is empty.
+        string requestedScope = string.Join(' ',
+            WellKnownScopes.OpenId, WellKnownScopes.Profile, WellKnownScopes.Email,
+            WellKnownScopes.Address, WellKnownScopes.Phone);
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(host.SharedHttpClient!, tokenUrl, new Dictionary<string, string>
+        {
+            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.ClientCredentials,
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            ["client_secret"] = ClientSecret,
+            [OAuthRequestParameterNames.Scope] = requestedScope
+        }, TestContext.CancellationToken).ConfigureAwait(false);
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+
+        using JsonDocument doc = JsonDocument.Parse(body);
+        //client_credentials always writes the scope field (unlike pre_authorized_code, which omits
+        //it when empty) — every identity token was narrowed away, so it comes back empty.
+        Assert.AreEqual(string.Empty, doc.RootElement.GetProperty(OAuthRequestParameterNames.Scope).GetString(),
+            "The response scope must be empty once every requested token — all five are identity scopes — is narrowed away.");
+
+        string accessToken = doc.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+        string[] segments = accessToken.Split('.');
+        Assert.HasCount(3, segments);
+        byte[] payloadBytes = SecurityEventTestJson.DecodeSegment(segments[1], Pool);
+        using JsonDocument payload = JsonDocument.Parse(payloadBytes);
+        string issuedScope = payload.RootElement.GetProperty(OAuthRequestParameterNames.Scope).GetString()!;
+        Assert.AreEqual(string.Empty, issuedScope,
+            "The issued access token's scope claim must be empty — RFC 6749 §3.3 narrowing removed "
+            + "every identity token before IssuanceContext.Scope was set.");
+
+        //ActivityListener is process-wide (see the ActivityListener cross-contamination
+        //guidance): filter captured activities to this test's tenant before asserting.
+        List<ActivityEvent> dropEvents = captured
+            .Where(a => string.Equals(
+                a.GetTagItem(ServerTagNames.TenantId) as string, segment, StringComparison.Ordinal))
+            .SelectMany(a => a.Events)
+            .Where(e => string.Equals(e.Name, OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant, StringComparison.Ordinal))
+            .ToList();
+
+        Assert.IsGreaterThan(0, dropEvents.Count,
+            $"A '{OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant}' event tagged with tenant "
+            + $"'{segment}' must be emitted.");
+
+        string droppedScopesTagValue = dropEvents[0].Tags
+            .FirstOrDefault(t => string.Equals(t.Key, OAuthEventNames.DroppedScopesTagName, StringComparison.Ordinal))
+            .Value as string ?? string.Empty;
+        string[] droppedTokens = droppedScopesTagValue.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+        Assert.HasCount(5, droppedTokens, $"Dropped scopes tag was '{droppedScopesTagValue}'.");
+        Assert.Contains(WellKnownScopes.OpenId, droppedTokens);
+        Assert.Contains(WellKnownScopes.Profile, droppedTokens);
+        Assert.Contains(WellKnownScopes.Email, droppedTokens);
+        Assert.Contains(WellKnownScopes.Address, droppedTokens);
+        Assert.Contains(WellKnownScopes.Phone, droppedTokens);
+    }
 }
diff --git a/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentAdversarialFlowTests.cs b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentAdversarialFlowTests.cs
new file mode 100644
index 00000000..a1abb703
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentAdversarialFlowTests.cs
@@ -0,0 +1,1268 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Diagnostics;
+using System.Linq;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Core.OutboundFetch;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.AuthCode.States;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Server;
+using Verifiable.OAuth.Server.Pipeline;
+using Verifiable.OAuth.WellKnown;
+using Verifiable.Server;
+using Verifiable.Server.Diagnostics;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Adversarial, SSRF, discrimination, display-seam, and logo-prefetch real-wire suite for CIMD
+/// (slice E2, contract D12 second half): every scenario crosses a real
+/// <see cref="MinimalHttpHost"/> or <see cref="StaticContentHost"/> TLS loopback socket, mirroring
+/// <see cref="ClientIdMetadataDocumentCrossWireFlowTests"/>'s topology. Caching behavior lives in
+/// the sibling <see cref="ClientIdMetadataDocumentCachingFlowTests"/>.
+/// </summary>
+/// <remarks>
+/// Covers CIMD-02-clause-ledger rows 001-011 (wire), 008, 013-016, 019-023, 028, 030, 033-040,
+/// 043-044, 051-061 per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html">
+/// draft-ietf-oauth-client-id-metadata-document-02</see>. Every host uses the single explicit
+/// HTTPS <c>Listen</c> convention — no plaintext listener anywhere in this file — and every test
+/// builds its own hosts, so the suite is parallel-safe. The pinned <see cref="FakeTimeProvider"/>
+/// is the only clock consulted; production code never reads the wall clock here.
+/// </remarks>
+[TestClass]
+internal sealed class ClientIdMetadataDocumentAdversarialFlowTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private static Uri RedirectUri { get; } = new("https://client.example.com/callback");
+
+    private const string SubjectId = "subject-cimd-adversarial-01";
+
+    private static ImmutableHashSet<CapabilityIdentifier> AuthCodeCapabilities { get; } =
+        ImmutableHashSet.Create(
+            WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+            WellKnownCapabilityIdentifiers.OAuthPushedAuthorization);
+
+
+    //(a) Fetch-contract adversarials.
+
+    /// <summary>
+    /// CIMD-033/035: a 404 status is treated as a discovery error, and the authorization server
+    /// SHOULD abort the authorization request — proven here as a direct, non-redirecting 400
+    /// answer from the PAR endpoint (materialization runs before any redirect is possible).
+    /// </summary>
+    [TestMethod]
+    public async Task Fetch404AbortsAuthorizationDirectly()
+    {
+        RequestCounter counter = new();
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            (request, ct) =>
+            {
+                counter.Increment();
+
+                return Task.FromResult(new MinimalHttpResponse { StatusCode = 404 });
+            },
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult result = await RunSingleAdversarialParAttemptAsync(
+            documentHost, "/app", TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-035: a fetch failure must abort the authorization request directly, never redirect.");
+        AssertNoInternalDetailLeaked(result);
+        Assert.AreEqual(1, counter.Count);
+    }
+
+
+    /// <summary>CIMD-033/035: a 500 status is likewise a discovery error that aborts the authorization request.</summary>
+    [TestMethod]
+    public async Task Fetch500AbortsAuthorizationDirectly()
+    {
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            (request, ct) => Task.FromResult(new MinimalHttpResponse { StatusCode = 500 }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult result = await RunSingleAdversarialParAttemptAsync(
+            documentHost, "/app", TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-033: any non-200 status is an error response that must abort the authorization request.");
+        AssertNoInternalDetailLeaked(result);
+    }
+
+
+    /// <summary>
+    /// CIMD-034: the authorization server MUST NOT automatically follow an HTTP redirect when
+    /// fetching the Client ID Metadata Document. The 302 answer aborts the authorization request,
+    /// and the redirect target is never dialed at all — <see cref="OutboundFetch"/>'s
+    /// <see cref="RedirectMode.None"/> default stops the loop before the second hop is even
+    /// policy-evaluated.
+    /// </summary>
+    /// <remarks>
+    /// Wires the resolver's transport manually with <see cref="HttpClientHandler.AllowAutoRedirect"/>
+    /// explicitly <see langword="false"/> — <see cref="TestHostShell.WireCimdMaterialization"/>'s
+    /// pinned client leaves the framework default (<see langword="true"/>), which would let
+    /// <see cref="HttpClient"/> itself silently follow the 302 before the guarded
+    /// <see cref="OutboundFetch"/> chokepoint ever saw it, making this test's "never dialed"
+    /// assertion pass or fail for the wrong reason.
+    /// </remarks>
+    [TestMethod]
+    public async Task FetchRedirectAnswerAbortsAndRedirectTargetNeverDialed()
+    {
+        RequestCounter redirectTargetCounter = new();
+        await using MinimalHttpHost redirectTarget = await MinimalHttpHost.StartAsync(
+            (request, ct) =>
+            {
+                redirectTargetCounter.Increment();
+
+                return Task.FromResult(new MinimalHttpResponse { StatusCode = 200 });
+            },
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            (request, ct) => Task.FromResult(new MinimalHttpResponse
+            {
+                StatusCode = 302,
+                Headers = new Dictionary<string, string>
+                {
+                    ["Location"] = new Uri(redirectTarget.BaseAddress, "/elsewhere").OriginalString
+                }
+            }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+
+        using HttpClientHandler noAutoRedirectHandler = LoopbackTls.CreatePinnedHandler(documentHost.Certificate);
+        noAutoRedirectHandler.AllowAutoRedirect = false;
+        using HttpClient documentHttpClient = new(noAutoRedirectHandler);
+        OutboundTransportDelegate transport = GuardedHttpClientTransport.BuildSingleHopTransport(documentHttpClient);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport, new ClientIdMetadataDocumentResolverOptions(), app.Time);
+
+        HostedAuthorizationServer host = app.Host("default");
+        host.Server.OAuth().MaterializeRegistrationAsync = ClientIdMetadataMaterialization.Build();
+        host.Server.OAuth().ResolveClientMetadataAsync = (clientMetadataUri, context, cancellationToken) =>
+        {
+            context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
+
+            return resolve(clientMetadataUri, context, cancellationToken);
+        };
+
+        AuthCodeFlowEndpointResult result = await StartParAgainstStubAsync(
+            app, new Uri(documentHost.BaseAddress, "/app"), TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-034: a redirect answer must abort the authorization request, never be followed.");
+        Assert.AreEqual(0, redirectTargetCounter.Count,
+            "CIMD-034: the redirect target must never be dialed — not even policy-evaluated.");
+    }
+
+
+    /// <summary>
+    /// CIMD-059: a response larger than the configured maximum is treated as an error, even though
+    /// the transport itself reported 200 — the resolver's post-read size check runs before the
+    /// document is even parsed, so the body need not be well-formed JSON.
+    /// </summary>
+    [TestMethod]
+    public async Task FetchOversizedBodyAborts()
+    {
+        string oversizedBody = new('x', 4096);
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            (request, ct) => Task.FromResult(new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = "application/json",
+                Body = oversizedBody
+            }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult result = await RunSingleAdversarialParAttemptAsync(
+            documentHost, "/app",
+            options: new ClientIdMetadataDocumentResolverOptions { MaximumDocumentBytes = 64 },
+            cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-059: a document exceeding the configured maximum size must abort the authorization request.");
+    }
+
+
+    /// <summary>CIMD-019 (negative side): a <c>text/html</c> content type is not JSON and must abort.</summary>
+    [TestMethod]
+    public async Task FetchTextHtmlContentTypeAborts()
+    {
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            (request, ct) => Task.FromResult(new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = "text/html",
+                Body = "<html>not a Client ID Metadata Document</html>"
+            }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult result = await RunSingleAdversarialParAttemptAsync(
+            documentHost, "/app", TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-019: a non-JSON content type must abort the authorization request.");
+    }
+
+
+    /// <summary>
+    /// CIMD-018/032 (positive) and CIMD-019 (positive, the <c>+json</c> structured suffix branch):
+    /// a plain <c>application/json</c> 200 response proceeds to a redirect, and so does an
+    /// <c>application/oauth-client+json</c> response for a second, independent client.
+    /// </summary>
+    [TestMethod]
+    public async Task FetchStructuredJsonContentTypeAndPlainJsonBothProceed()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Uri plainDocumentUri = new(documentHost.BaseAddress, "/app-plain");
+        documentHost.Publish("/app-plain",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(plainDocumentUri.OriginalString, [RedirectUri])),
+            "application/json");
+
+        Uri structuredDocumentUri = new(documentHost.BaseAddress, "/app-structured");
+        documentHost.Publish("/app-structured",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(structuredDocumentUri.OriginalString, [RedirectUri])),
+            "application/oauth-client+json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        AuthCodeFlowEndpointResult plainResult = await StartParAgainstStubAsync(
+            app, plainDocumentUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, plainResult.Outcome,
+            $"CIMD-018/032: a plain application/json 200 response must proceed. ErrorDescription={plainResult.ErrorDescription}");
+
+        AuthCodeFlowEndpointResult structuredResult = await StartParAgainstStubAsync(
+            app, structuredDocumentUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, structuredResult.Outcome,
+            $"CIMD-019: an application/<AS-defined>+json content type must be accepted. ErrorDescription={structuredResult.ErrorDescription}");
+    }
+
+
+    //(b) Document-validity adversarials — each aborts and is never cached.
+
+    /// <summary>
+    /// CIMD-013 (missing <c>client_id</c>), CIMD-021 (symmetric <c>token_endpoint_auth_method</c>),
+    /// CIMD-022 (<c>client_secret</c> present), and CIMD-023 (private key material in <c>jwks</c>)
+    /// each independently abort the authorization request, and CIMD-040 holds for every one of
+    /// them: a second, fresh PAR attempt re-fetches rather than serving a cached invalid result.
+    /// </summary>
+    [TestMethod]
+    public async Task DocumentValidityDefectsAbortAndAreNeverCached()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Uri missingClientIdUri = new(documentHost.BaseAddress, "/missing-client-id");
+        documentHost.Publish("/missing-client-id",
+            Encoding.UTF8.GetBytes("""{"redirect_uris":["https://client.example.com/callback"]}"""),
+            "application/json");
+
+        Uri clientSecretUri = new(documentHost.BaseAddress, "/client-secret");
+        documentHost.Publish("/client-secret",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(clientSecretUri.OriginalString, includeClientSecret: true)),
+            "application/json");
+
+        Uri symmetricAuthUri = new(documentHost.BaseAddress, "/symmetric-auth");
+        documentHost.Publish("/symmetric-auth",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(
+                symmetricAuthUri.OriginalString, tokenEndpointAuthMethod: WellKnownClientAuthenticationMethods.ClientSecretBasic)),
+            "application/json");
+
+        Uri privateJwksUri = new(documentHost.BaseAddress, "/private-jwks");
+        documentHost.Publish("/private-jwks",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(privateJwksUri.OriginalString, jwksRawJson: PrivateEcJwkSetJson)),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        await AssertAbortsAndNeverCachedAsync(
+            app, documentHost, "/missing-client-id", missingClientIdUri,
+            "CIMD-013: a document with no client_id property must abort and never be cached.",
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        await AssertAbortsAndNeverCachedAsync(
+            app, documentHost, "/client-secret", clientSecretUri,
+            "CIMD-022: a document carrying client_secret must abort and never be cached.",
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        await AssertAbortsAndNeverCachedAsync(
+            app, documentHost, "/symmetric-auth", symmetricAuthUri,
+            "CIMD-021: a symmetric token_endpoint_auth_method must abort and never be cached.",
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        await AssertAbortsAndNeverCachedAsync(
+            app, documentHost, "/private-jwks", privateJwksUri,
+            "CIMD-023: private key material in jwks must abort and never be cached.",
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>
+    /// CIMD-008/014/015/016: the document's <c>client_id</c> MUST ordinal-equal the fetch URL. A
+    /// generic mismatch aborts, and so does a scheme-case variant — RFC 3986 §3.1 treats the
+    /// scheme as case-insensitive for URI equivalence, but CIMD-008/016 require literal ordinal
+    /// comparison, so <c>HTTPS://…</c> does not match a fetch URL dialed as <c>https://…</c>.
+    /// Neither result is cached (CIMD-040). The specification's own named example — an explicit
+    /// <c>:443</c> default-port suffix — is proven at the resolver-unit level in
+    /// <c>ClientIdMetadataDocumentsResolvingTests.DefaultPortSuffixIsNotEquivalentForClientIdMatch</c>,
+    /// since a real loopback listener never binds the literal default port 443.
+    /// </summary>
+    [TestMethod]
+    public async Task DocumentClientIdMismatchAndSchemeCaseVariantAbortAndAreNeverCached()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Uri genericMismatchUri = new(documentHost.BaseAddress, "/generic-mismatch");
+        documentHost.Publish("/generic-mismatch",
+            Encoding.UTF8.GetBytes(BuildDocumentJson("https://someone-else.example.com/app")),
+            "application/json");
+
+        Uri caseVariantUri = new(documentHost.BaseAddress, "/case-variant");
+        string caseVariantClientId = UppercaseScheme(caseVariantUri.OriginalString);
+        documentHost.Publish("/case-variant",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(caseVariantClientId)),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        await AssertAbortsAndNeverCachedAsync(
+            app, documentHost, "/generic-mismatch", genericMismatchUri,
+            "CIMD-008/014/015/016: a client_id naming a different URL entirely must abort and never be cached.",
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        await AssertAbortsAndNeverCachedAsync(
+            app, documentHost, "/case-variant", caseVariantUri,
+            "CIMD-008/016: a scheme-case variant is NOT equivalent under ordinal comparison and must abort.",
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    //(c) SSRF.
+
+    /// <summary>
+    /// CIMD-054/056: a Client Identifier URL resolving to a special-use (cloud metadata,
+    /// link-local) address is denied before any network contact under the production
+    /// <see cref="OutboundFetchPolicy.SecureDefault"/> — the transport spy records zero calls. The
+    /// same PAR call's <c>Handle</c> span carries the policy-denial event, and the wire response
+    /// never names the reason.
+    /// </summary>
+    [TestMethod]
+    public async Task SpecialUseAddressDeniedBeforeNetworkContactUnderProductionDefault()
+    {
+        ConcurrentBag<Activity> captured = [];
+        using ActivityListener listener = CreateListener(captured);
+        ActivitySource.AddActivityListener(listener);
+
+        TransportCallSpy spy = new();
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+
+        Uri maliciousUri = new("https://169.254.169.254/app");
+        ClientRecord stub = app.RegisterCimdStubClient(maliciousUri, AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+
+        HostedAuthorizationServer host = app.Host("default");
+        AuthorizationServerIntegration oauth = host.Server.OAuth();
+        oauth.MaterializeRegistrationAsync = ClientIdMetadataMaterialization.Build();
+        oauth.ResolveClientMetadataAsync = ClientIdMetadataDocuments.BuildResolving(
+            spy.Delegate, new ClientIdMetadataDocumentResolverOptions(), app.Time);
+
+        AuthCodeFlowEndpointResult result = await DriveParForStubAsync(
+            app, stub, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-054: a special-use-address client_id must be denied under production defaults.");
+        Assert.AreEqual(0, spy.CallCount,
+            "CIMD-054/056: the transport must never be dialed for a policy-denied target.");
+        AssertNoInternalDetailLeaked(result);
+
+        Activity[] handleActivities = captured
+            .Where(a => string.Equals(a.OperationName, ServerActivityNames.Handle, StringComparison.Ordinal))
+            .Where(a => a.Tags.Any(t =>
+                string.Equals(t.Key, ServerTagNames.TenantId, StringComparison.Ordinal)
+                && string.Equals(t.Value, stub.TenantId.Value, StringComparison.Ordinal)))
+            .ToArray();
+        Assert.IsGreaterThan(0, handleActivities.Length, "At least one Handle activity for this tenant must be captured.");
+        Assert.Contains(
+            (Activity a) => a.Events.Any(e => string.Equals(e.Name, PolicyDeniedEventName, StringComparison.Ordinal)),
+            handleActivities,
+            "A policy-denial span event must be recorded on the request's Handle activity.");
+    }
+
+
+    /// <summary>
+    /// CIMD-055/056: the development/testing loopback relaxation is an explicit, scoped opt-in —
+    /// the SAME loopback document host is denied under production <see cref="OutboundFetchPolicy.SecureDefault"/>
+    /// and succeeds only when the context explicitly carries <see cref="TestHostShell.LoopbackOutboundFetchPolicy"/>.
+    /// </summary>
+    [TestMethod]
+    public async Task LoopbackRelaxationIsExplicitAndScoped()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(documentUri.OriginalString, [RedirectUri])),
+            "application/json");
+
+        //Production default: no relaxation applied anywhere.
+        await using TestHostShell productionApp = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        HostedAuthorizationServer productionHost = productionApp.Host("default");
+        using HttpClient productionHttpClient = LoopbackTls.CreatePinnedHttpClient(documentHost.Certificate);
+        productionHost.Server.OAuth().MaterializeRegistrationAsync = ClientIdMetadataMaterialization.Build();
+        productionHost.Server.OAuth().ResolveClientMetadataAsync = ClientIdMetadataDocuments.BuildResolving(
+            GuardedHttpClientTransport.BuildSingleHopTransport(productionHttpClient),
+            new ClientIdMetadataDocumentResolverOptions(), productionApp.Time);
+
+        AuthCodeFlowEndpointResult productionResult = await StartParAgainstStubAsync(
+            productionApp, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, productionResult.Outcome,
+            "CIMD-056: production defaults must still deny a loopback target — the exception is never automatic.");
+
+        //Explicit, scoped test-context relaxation against the SAME document host.
+        await using TestHostShell relaxedApp = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        relaxedApp.WireCimdMaterialization("default", documentHost.Certificate);
+
+        AuthCodeFlowEndpointResult relaxedResult = await StartParAgainstStubAsync(
+            relaxedApp, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, relaxedResult.Outcome,
+            $"CIMD-055: the explicit test-context relaxation must permit the loopback fetch. ErrorDescription={relaxedResult.ErrorDescription}");
+    }
+
+
+    /// <summary>CIMD-057: a listed host is blocked even under an otherwise-loopback-permissive policy.</summary>
+    [TestMethod]
+    public async Task HostDenyListBlocksListedHost()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(documentUri.OriginalString, [RedirectUri])),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        HostedAuthorizationServer host = app.Host("default");
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(documentHost.Certificate);
+        OutboundTransportDelegate transport = GuardedHttpClientTransport.BuildSingleHopTransport(httpClient);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport, new ClientIdMetadataDocumentResolverOptions(), app.Time);
+
+        OutboundFetchPolicy denyListPolicy = TestHostShell.LoopbackOutboundFetchPolicy with
+        {
+            HostDenyList = [documentUri.Host]
+        };
+        host.Server.OAuth().MaterializeRegistrationAsync = ClientIdMetadataMaterialization.Build();
+        host.Server.OAuth().ResolveClientMetadataAsync = (clientMetadataUri, context, cancellationToken) =>
+        {
+            context.SetOutboundFetchPolicy(denyListPolicy);
+
+            return resolve(clientMetadataUri, context, cancellationToken);
+        };
+
+        AuthCodeFlowEndpointResult result = await StartParAgainstStubAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-057: a host on the deny list must be blocked even though loopback is otherwise permitted.");
+    }
+
+
+    /// <summary>CIMD-058: a <c>javascript:</c> scheme jwks_uri inside the document is rejected.</summary>
+    [TestMethod]
+    public async Task JavascriptSchemeJwksUriRejected()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(
+                documentUri.OriginalString, [RedirectUri], jwksUriRaw: "javascript:alert(1)")),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        AuthCodeFlowEndpointResult result = await StartParAgainstStubAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-058: a javascript: scheme jwks_uri must reject the document.");
+    }
+
+
+    //(e) Discrimination.
+
+    /// <summary>
+    /// CIMD-043/044: a vanity <c>https://</c> client_id whose registration carries no
+    /// <see cref="ClientRecord.ClientMetadataUri"/> is never fetched — the discrimination signal is
+    /// the field, not the string shape. The flow proceeds entirely from the stored registration.
+    /// </summary>
+    [TestMethod]
+    public async Task VanityHttpsClientIdWithNullMetadataUriGetsZeroFetches()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        const string vanityClientId = "https://vanity.example.com/my-app";
+        using VerifierKeyMaterial material = app.RegisterClient(
+            vanityClientId, new Uri(vanityClientId), AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+        ClientRecord stub = material.Registration;
+        Assert.IsNull(stub.ClientMetadataUri, "The vanity client must not carry a ClientMetadataUri.");
+
+        (OAuthClient client, ClientRegistration registration, _) = await app.CreateOAuthClientAndRegistrationAsync(
+            stub, RedirectUri.OriginalString, PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult result = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, result.Outcome,
+            $"CIMD-043/044: the vanity client must flow entirely from the stored registration. ErrorDescription={result.ErrorDescription}");
+        Assert.AreEqual(0, documentHost.TotalRequests,
+            "CIMD-043/044: a client with no ClientMetadataUri must never trigger a document fetch.");
+    }
+
+
+    /// <summary>
+    /// An authorization request against a URL segment that names no registration at all (no CIMD
+    /// stub, no pre-registered client) reaches the library's existing unknown-registration
+    /// behavior — a direct 404 from <c>EndpointServer.DispatchAsync</c>'s tenant-resolution step,
+    /// which runs before CIMD materialization is even reachable.
+    /// </summary>
+    [TestMethod]
+    public async Task UnknownTenantSegmentFollowsExistingNotFoundBehavior()
+    {
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = app.RegisterClient(
+            "opaque-client-1", new Uri("https://opaque.example.com"), AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer hosted = app.Host("default");
+
+        Uri parEndpoint = TestHostShell.ComposeEndpointUri(
+            hosted.HttpBaseAddress!, "never-registered-segment", WellKnownEndpointNames.AuthCodePar);
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            hosted.SharedHttpClient!, parEndpoint,
+            new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.ResponseType] = "code",
+                [OAuthRequestParameterNames.ClientId] = "https://unknown.example.com/app",
+                [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString,
+                [OAuthRequestParameterNames.CodeChallenge] = "adversarial-pkce-challenge-0123456789",
+                [OAuthRequestParameterNames.CodeChallengeMethod] = "S256"
+            },
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(404, (int)response.StatusCode,
+            "An unregistered tenant segment follows the repo's existing unknown-registration behavior: a direct 404.");
+    }
+
+
+    //(f) Display / phishing seam.
+
+    /// <summary>
+    /// CIMD-051/053: in fetched mode, the evaluation seam observes the client_id host AND the
+    /// fetched display fields (name, logo) — the application's phishing-mitigation SHOULDs are
+    /// implementable from data the library actually surfaces.
+    /// </summary>
+    [TestMethod]
+    public async Task FetchedModeEvaluationPopulatesHostAndDocumentFields()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        Uri logoUri = new("https://logo.example.com/mark.png");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(
+                documentUri.OriginalString, [RedirectUri], clientName: "Adversarial Test Client", logoUri: logoUri.OriginalString)),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        AuthorizationRequestEvaluation? captured = null;
+        app.Server.OAuth().EvaluateAuthorizationRequestAsync = (evaluation, registration, context, ct) =>
+        {
+            captured = evaluation;
+
+            return ValueTask.FromResult(AuthorizationRequestDecision.Permit);
+        };
+
+        ClientRecord stub = app.RegisterCimdStubClient(documentUri, AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> flowStore) =
+            await app.CreateOAuthClientAndRegistrationAsync(
+                stub, RedirectUri.OriginalString, PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+        HostedAuthorizationServer hosted = app.Host("default");
+
+        (string flowId, string location) = await DriveParAndAuthorizeAsync(
+            app, hosted, client, registration, flowStore, stub.TenantId.Value, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.IsFalse(string.IsNullOrEmpty(flowId));
+        Assert.IsFalse(string.IsNullOrEmpty(location));
+
+        Assert.IsNotNull(captured, "The evaluation seam must have been invoked.");
+        Assert.AreEqual(documentUri.Host, captured!.ClientIdHost,
+            "CIMD-053: the client_id hostname must be populated.");
+        Assert.IsTrue(captured.HasFetchedClientMetadata,
+            "CIMD-051: fetched mode must report that document-derived metadata is present.");
+        Assert.AreEqual("Adversarial Test Client", captured.ClientName);
+        Assert.AreEqual(logoUri, captured.LogoUri);
+    }
+
+
+    /// <summary>
+    /// CIMD-028: the <c>software_statement</c> parameter defined in RFC 7591, when included as a
+    /// property of the Client ID Metadata Document, is carried opaque through materialization onto
+    /// the effective registration — observed here via the <see cref="ClientRecord"/> the evaluation
+    /// seam receives, the materialized record itself rather than the display-only evaluation
+    /// snapshot.
+    /// </summary>
+    [TestMethod]
+    public async Task SoftwareStatementCarriedThroughToMaterializedRegistration()
+    {
+        const string softwareStatement = "eyJhbGciOiJub25lIn0.eyJzb2Z0d2FyZV9pZCI6InRlc3QifQ.";
+
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(
+                documentUri.OriginalString, [RedirectUri], softwareStatement: softwareStatement)),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        ClientRecord? materialized = null;
+        app.Server.OAuth().EvaluateAuthorizationRequestAsync = (evaluation, registration, context, ct) =>
+        {
+            materialized = registration;
+
+            return ValueTask.FromResult(AuthorizationRequestDecision.Permit);
+        };
+
+        ClientRecord stub = app.RegisterCimdStubClient(documentUri, AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> flowStore) =
+            await app.CreateOAuthClientAndRegistrationAsync(
+                stub, RedirectUri.OriginalString, PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+        HostedAuthorizationServer hosted = app.Host("default");
+
+        await DriveParAndAuthorizeAsync(
+            app, hosted, client, registration, flowStore, stub.TenantId.Value, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.IsNotNull(materialized, "The evaluation seam must have been invoked.");
+        Assert.AreEqual(softwareStatement, materialized!.SoftwareStatement,
+            "CIMD-028: the document's software_statement must reach the materialized registration.");
+    }
+
+
+    /// <summary>
+    /// CIMD-052/053: a pre-registered client whose document was never fetched at request time
+    /// still surfaces the client_id host, so the application can fall back to §8.5 ¶2's "as much
+    /// information as possible" using the hostname alone — <see cref="AuthorizationRequestEvaluation.HasFetchedClientMetadata"/>
+    /// is <see langword="false"/>.
+    /// </summary>
+    [TestMethod]
+    public async Task PreRegisteredNoFetchModeEvaluationPopulatesHostOnly()
+    {
+        const string clientId = "https://pre-registered.example.com/app";
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+
+        //No WireCimdMaterialization call — this host never fetches CIMD documents at request time.
+        //A vanity https:// client_id with a fully populated stored registration models §7.2's
+        //pre-registration deployment pattern.
+        using VerifierKeyMaterial material = app.RegisterClient(
+            clientId, new Uri(clientId), AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+        ClientRecord stub = material.Registration;
+
+        AuthorizationRequestEvaluation? captured = null;
+        app.Server.OAuth().EvaluateAuthorizationRequestAsync = (evaluation, registration, context, ct) =>
+        {
+            captured = evaluation;
+
+            return ValueTask.FromResult(AuthorizationRequestDecision.Permit);
+        };
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> flowStore) =
+            await app.CreateOAuthClientAndRegistrationAsync(
+                stub, RedirectUri.OriginalString, PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+        HostedAuthorizationServer hosted = app.Host("default");
+        await DriveParAndAuthorizeAsync(
+            app, hosted, client, registration, flowStore, stub.TenantId.Value, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.IsNotNull(captured, "The evaluation seam must have been invoked.");
+        Assert.AreEqual(new Uri(clientId).Host, captured!.ClientIdHost,
+            "CIMD-053: the client_id hostname must be populated regardless of fetch mode.");
+        Assert.IsFalse(captured.HasFetchedClientMetadata,
+            "CIMD-052: a pre-registered, never-fetched client must report no document-derived metadata.");
+    }
+
+
+    //(g) Logo prefetch.
+
+    /// <summary>
+    /// CIMD-060: with <see cref="ClientIdMetadataDocumentResolverOptions.PrefetchLogo"/> enabled,
+    /// the resolver dials the logo host exactly once and the bytes ride the resolution; a second
+    /// resolve call within the document's cache lifetime (an explicit <c>Cache-Control: max-age</c>
+    /// response) serves the cached resolution and does not re-dial the logo host.
+    /// </summary>
+    [TestMethod]
+    public async Task LogoPrefetchDialsOnceBytesReachResolutionAndSkipsOnCachedSecondFlow()
+    {
+        const string logoPayload = "not-a-real-png-but-deterministic-bytes";
+        RequestCounter logoCounter = new();
+        await using MinimalHttpHost logoHost = await MinimalHttpHost.StartAsync(
+            (request, ct) =>
+            {
+                logoCounter.Increment();
+
+                return Task.FromResult(new MinimalHttpResponse
+                {
+                    StatusCode = 200,
+                    ContentType = "image/png",
+                    Body = logoPayload
+                });
+            },
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri logoUri = new(logoHost.BaseAddress, "/logo.png");
+
+        //The handler closes over documentUri, assigned once BaseAddress is known below; the
+        //closure only runs once an actual request arrives, after the assignment completes.
+        Uri? documentUri = null;
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            (request, ct) => Task.FromResult(new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = "application/json",
+                Body = BuildDocumentJson(documentUri!.OriginalString, [RedirectUri], logoUri: logoUri.OriginalString),
+                Headers = new Dictionary<string, string> { ["Cache-Control"] = "max-age=300" }
+            }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+        documentUri = new Uri(documentHost.BaseAddress, "/app");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([documentHost.Certificate, logoHost.Certificate]);
+        OutboundTransportDelegate transport = GuardedHttpClientTransport.BuildSingleHopTransport(httpClient);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport, new ClientIdMetadataDocumentResolverOptions { PrefetchLogo = true }, timeProvider);
+
+        ExchangeContext context = new();
+        context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
+
+        ClientIdMetadataResolution first = await resolve(documentUri, context, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.IsTrue(first.IsResolved, $"Resolution must succeed. Defect={first.Defect}");
+        Assert.IsNotNull(first.PrefetchedLogo, "CIMD-060: the prefetched logo bytes must ride the resolution.");
+        Assert.AreEqual(logoPayload, Encoding.UTF8.GetString(first.PrefetchedLogo!.Value.Span));
+        Assert.AreEqual(1, logoCounter.Count, "The logo host must be dialed exactly once.");
+
+        ClientIdMetadataResolution second = await resolve(documentUri, context, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.IsTrue(second.IsResolved);
+        Assert.AreEqual(1, logoCounter.Count,
+            "CIMD-060: a second resolve within the document's cache lifetime must not re-dial the logo host.");
+    }
+
+
+    /// <summary>CIMD-060 (SHOULD-tier): a failed logo prefetch does not abort the authorization request.</summary>
+    [TestMethod]
+    public async Task LogoPrefetchFailureDoesNotAbortAuthorization()
+    {
+        await using MinimalHttpHost logoHost = await MinimalHttpHost.StartAsync(
+            (request, ct) => Task.FromResult(new MinimalHttpResponse { StatusCode = 500 }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        Uri logoUri = new(logoHost.BaseAddress, "/logo.png");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(documentUri.OriginalString, [RedirectUri], logoUri: logoUri.OriginalString)),
+            "application/json");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using TestHostShell app = new(timeProvider);
+        HostedAuthorizationServer host = app.Host("default");
+
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient([documentHost.Certificate, logoHost.Certificate]);
+        OutboundTransportDelegate transport = GuardedHttpClientTransport.BuildSingleHopTransport(httpClient);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport, new ClientIdMetadataDocumentResolverOptions { PrefetchLogo = true }, timeProvider);
+
+        host.Server.OAuth().MaterializeRegistrationAsync = ClientIdMetadataMaterialization.Build();
+        host.Server.OAuth().ResolveClientMetadataAsync = (clientMetadataUri, context, cancellationToken) =>
+        {
+            context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
+
+            return resolve(clientMetadataUri, context, cancellationToken);
+        };
+
+        AuthCodeFlowEndpointResult result = await StartParAgainstStubAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, result.Outcome,
+            $"CIMD-060: a failed logo prefetch must not abort the authorization request. ErrorDescription={result.ErrorDescription}");
+    }
+
+
+    //(h) CIMD-020 additional-validation hook.
+
+    /// <summary>CIMD-020: an application-supplied restriction requiring private_key_jwt rejects a public-client document.</summary>
+    [TestMethod]
+    public async Task AdditionalDocumentValidationRejectsPublicClientDocument()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(documentUri.OriginalString, [RedirectUri])),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate, RequirePrivateKeyJwtOptions);
+
+        AuthCodeFlowEndpointResult result = await StartParAgainstStubAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome,
+            "CIMD-020: the additional restriction must reject a public-client document.");
+    }
+
+
+    /// <summary>CIMD-020: the same restriction accepts a conforming private_key_jwt document.</summary>
+    [TestMethod]
+    public async Task AdditionalDocumentValidationAcceptsConformingPrivateKeyJwtDocument()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(
+                documentUri.OriginalString, [RedirectUri],
+                tokenEndpointAuthMethod: WellKnownClientAuthenticationMethods.PrivateKeyJwt,
+                jwksUriRaw: "https://client.example.com/jwks.json")),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate, RequirePrivateKeyJwtOptions);
+
+        AuthCodeFlowEndpointResult result = await StartParAgainstStubAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, result.Outcome,
+            $"CIMD-020: a conforming private_key_jwt document must be accepted. ErrorDescription={result.ErrorDescription}");
+    }
+
+
+    //(i) Advisory tier.
+
+    /// <summary>
+    /// CIMD-006: a client_id carrying a query component completes under the default (advisory,
+    /// non-fatal) options, and aborts when the deployment opts into
+    /// <see cref="ClientIdMetadataDocumentResolverOptions.TreatAdvisoriesAsErrors"/>.
+    /// </summary>
+    [TestMethod]
+    public async Task QueryComponentAdvisoryCompletesByDefaultAbortsWhenTreatedAsError()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app?tenant=adversarial");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(documentUri.OriginalString, [RedirectUri])),
+            "application/json");
+
+        ClientIdentifierUrlValidationResult validation = ClientIdentifierUrl.Validate(documentUri.OriginalString);
+        Assert.IsTrue(validation.HasQueryComponent, "The candidate must carry the advisory this test exercises.");
+        Assert.IsTrue(validation.IsValid, "CIMD-006 is advisory — it must not affect MUST-tier validity.");
+
+        await using TestHostShell tolerantApp = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        tolerantApp.WireCimdMaterialization("default", documentHost.Certificate);
+        AuthCodeFlowEndpointResult tolerantResult = await StartParAgainstStubAsync(
+            tolerantApp, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, tolerantResult.Outcome,
+            $"CIMD-006: a query component must be tolerated under default options. ErrorDescription={tolerantResult.ErrorDescription}");
+
+        await using TestHostShell strictApp = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        strictApp.WireCimdMaterialization(
+            "default", documentHost.Certificate, new ClientIdMetadataDocumentResolverOptions { TreatAdvisoriesAsErrors = true });
+        AuthCodeFlowEndpointResult strictResult = await StartParAgainstStubAsync(
+            strictApp, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, strictResult.Outcome,
+            "CIMD-006: TreatAdvisoriesAsErrors must abort a query-bearing client_id.");
+    }
+
+
+    /// <summary>CIMD-011: a client_id whose path is exactly <c>/</c> completes by default and aborts when treated as an error.</summary>
+    [TestMethod]
+    public async Task RootPathAdvisoryCompletesByDefaultAbortsWhenTreatedAsError()
+    {
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/");
+        documentHost.Publish("/",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(documentUri.OriginalString, [RedirectUri])),
+            "application/json");
+
+        ClientIdentifierUrlValidationResult validation = ClientIdentifierUrl.Validate(documentUri.OriginalString);
+        Assert.IsTrue(validation.IsRootPath, "The candidate must carry the advisory this test exercises.");
+        Assert.IsTrue(validation.IsValid, "CIMD-011 is advisory — it must not affect MUST-tier validity.");
+
+        await using TestHostShell tolerantApp = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        tolerantApp.WireCimdMaterialization("default", documentHost.Certificate);
+        AuthCodeFlowEndpointResult tolerantResult = await StartParAgainstStubAsync(
+            tolerantApp, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, tolerantResult.Outcome,
+            $"CIMD-011: a root-path client_id must be tolerated under default options. ErrorDescription={tolerantResult.ErrorDescription}");
+
+        await using TestHostShell strictApp = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        strictApp.WireCimdMaterialization(
+            "default", documentHost.Certificate, new ClientIdMetadataDocumentResolverOptions { TreatAdvisoriesAsErrors = true });
+        AuthCodeFlowEndpointResult strictResult = await StartParAgainstStubAsync(
+            strictApp, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, strictResult.Outcome,
+            "CIMD-011: TreatAdvisoriesAsErrors must abort a root-path client_id.");
+    }
+
+
+    //(j) Tamper / OTel.
+
+    /// <summary>
+    /// A wire <c>client_id</c> that does not ordinal-equal the matched registration's own
+    /// <c>client_id</c> aborts the request, records a client-id-mismatch span event on the
+    /// request's <c>Handle</c> activity, and the wire response never carries the mismatch detail —
+    /// only the library's fixed, generic description.
+    /// </summary>
+    [TestMethod]
+    public async Task ClientIdMismatchEmitsSpanEventAndWireBodyOmitsInternalDetail()
+    {
+        ConcurrentBag<Activity> captured = [];
+        using ActivityListener listener = CreateListener(captured);
+        ActivitySource.AddActivityListener(listener);
+
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Uri documentUri = new(documentHost.BaseAddress, "/app");
+        documentHost.Publish("/app",
+            Encoding.UTF8.GetBytes(BuildDocumentJson(documentUri.OriginalString, [RedirectUri])),
+            "application/json");
+
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+        ClientRecord stub = app.RegisterCimdStubClient(documentUri, AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer hosted = app.Host("default");
+        Uri parEndpoint = TestHostShell.ComposeEndpointUri(
+            hosted.HttpBaseAddress!, stub.TenantId.Value, WellKnownEndpointNames.AuthCodePar);
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            hosted.SharedHttpClient!, parEndpoint,
+            new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.ResponseType] = "code",
+                [OAuthRequestParameterNames.ClientId] = "https://attacker-supplied.example.com/impersonation",
+                [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString,
+                [OAuthRequestParameterNames.CodeChallenge] = "adversarial-pkce-challenge-0123456789",
+                [OAuthRequestParameterNames.CodeChallengeMethod] = "S256"
+            },
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(400, (int)response.StatusCode, body);
+
+        using JsonDocument doc = JsonDocument.Parse(body);
+        string? description = doc.RootElement.TryGetProperty("error_description", out JsonElement el) ? el.GetString() : null;
+        Assert.AreEqual("The request could not be processed.", description,
+            "The wire body must carry only the library's fixed generic description — never the mismatched " +
+            "client_id, the registration's real client_id, or any other internal diagnostic detail.");
+        Assert.DoesNotContain("attacker-supplied", body);
+        Assert.DoesNotContain(documentUri.OriginalString, body);
+
+        Activity[] handleActivities = captured
+            .Where(a => string.Equals(a.OperationName, ServerActivityNames.Handle, StringComparison.Ordinal))
+            .Where(a => a.Tags.Any(t =>
+                string.Equals(t.Key, ServerTagNames.TenantId, StringComparison.Ordinal)
+                && string.Equals(t.Value, stub.TenantId.Value, StringComparison.Ordinal)))
+            .ToArray();
+        Assert.IsGreaterThan(0, handleActivities.Length, "At least one Handle activity for this tenant must be captured.");
+        Assert.Contains(
+            (Activity a) => a.Events.Any(e => string.Equals(e.Name, ClientIdMismatchEventName, StringComparison.Ordinal)),
+            handleActivities,
+            "A client-id-mismatch span event must be recorded on the request's Handle activity.");
+    }
+
+
+    //Shared fixtures and helpers.
+
+    /// <summary>
+    /// The span event name <see cref="ClientIdMetadataMaterialization"/> records for a wire
+    /// <c>client_id</c> that does not match the registration.
+    /// </summary>
+    private const string ClientIdMismatchEventName = ClientIdMetadataMaterialization.ClientIdMismatchEventName;
+
+    /// <summary>The span event name for a resolver-side policy denial (see <see cref="ClientIdMismatchEventName"/>).</summary>
+    private const string PolicyDeniedEventName = ClientIdMetadataMaterialization.PolicyDeniedEventName;
+
+    private static readonly ClientIdMetadataDocumentResolverOptions RequirePrivateKeyJwtOptions = new()
+    {
+        AdditionalDocumentValidation = static (document, uri, context, ct) =>
+            ValueTask.FromResult(document.TokenEndpointAuthMethod == ClientAuthenticationMethod.PrivateKeyJwt)
+    };
+
+    /// <summary>A hand-built JWKS carrying an EC key with a private <c>d</c> member (CIMD-023).</summary>
+    private const string PrivateEcJwkSetJson =
+        """{"keys":[{"kty":"EC","crv":"P-256","x":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","y":"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB","d":"CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"}]}""";
+
+
+    /// <summary>
+    /// Registers a fresh CIMD stub for <paramref name="documentUri"/> on a fresh <see cref="TestHostShell"/>
+    /// already wired with <see cref="TestHostShell.WireCimdMaterialization"/>, drives one PAR attempt, and
+    /// returns the result — the one-shot shape most fetch-contract adversarials need.
+    /// </summary>
+    private static async Task<AuthCodeFlowEndpointResult> RunSingleAdversarialParAttemptAsync(
+        MinimalHttpHost documentHost,
+        string path,
+        CancellationToken cancellationToken,
+        ClientIdMetadataDocumentResolverOptions? options = null)
+    {
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        app.WireCimdMaterialization("default", documentHost.Certificate, options);
+
+        Uri documentUri = new(documentHost.BaseAddress, path);
+
+        return await StartParAgainstStubAsync(app, documentUri, cancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>Registers a CIMD stub for <paramref name="documentUri"/> on <paramref name="app"/> and drives one PAR attempt.</summary>
+    private static async Task<AuthCodeFlowEndpointResult> StartParAgainstStubAsync(
+        TestHostShell app, Uri documentUri, CancellationToken cancellationToken)
+    {
+        ClientRecord stub = app.RegisterCimdStubClient(documentUri, AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+
+        return await DriveParForStubAsync(app, stub, cancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>Drives one PAR attempt for an already-registered <paramref name="stub"/>.</summary>
+    private static async Task<AuthCodeFlowEndpointResult> DriveParForStubAsync(
+        TestHostShell app, ClientRecord stub, CancellationToken cancellationToken)
+    {
+        (OAuthClient client, ClientRegistration registration, _) = await app.CreateOAuthClientAndRegistrationAsync(
+            stub, RedirectUri.OriginalString, PolicyProfile.Rfc6749WithPkce, cancellationToken).ConfigureAwait(false);
+
+        return await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, cancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>
+    /// Runs <see cref="StartParAgainstStubAsync"/> twice against the same document path on
+    /// <paramref name="app"/>, asserting the first attempt aborts and the second, independent
+    /// attempt re-fetches (the document host's request count strictly increases) — CIMD-040's
+    /// "never cache an invalid document" proven by the second attempt not being served from cache.
+    /// </summary>
+    private static async Task AssertAbortsAndNeverCachedAsync(
+        TestHostShell app, StaticContentHost documentHost, string path, Uri documentUri, string message, CancellationToken cancellationToken)
+    {
+        AuthCodeFlowEndpointResult first = await StartParAgainstStubAsync(app, documentUri, cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, first.Outcome, message);
+        Assert.IsTrue(documentHost.WasRequested(path));
+        int requestsAfterFirst = documentHost.TotalRequests;
+
+        AuthCodeFlowEndpointResult second = await StartParAgainstStubAsync(app, documentUri, cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, second.Outcome, message);
+        Assert.IsGreaterThan(requestsAfterFirst, documentHost.TotalRequests,
+            $"{message} A second attempt must re-fetch rather than serve a cached invalid result.");
+    }
+
+
+    /// <summary>
+    /// Asserts <paramref name="result"/>'s <see cref="AuthCodeFlowEndpointResult.ErrorDescription"/>
+    /// equals the library's fixed, generic materialization-failure description — proving no
+    /// resolver <c>Defect</c> or <c>DenyReason</c> text ever reaches the wire.
+    /// </summary>
+    private static void AssertNoInternalDetailLeaked(AuthCodeFlowEndpointResult result)
+    {
+        Assert.AreEqual(OAuthErrors.InvalidRequest, result.ErrorCode);
+        Assert.AreEqual("The request could not be processed.", result.ErrorDescription,
+            "The wire response must carry only the fixed generic description, never internal diagnostics.");
+    }
+
+
+    /// <summary>
+    /// Drives PAR (real-wire POST via the client wrapper) then the browser's authorize GET (a real
+    /// wire GET with auto-redirect disabled and the test subject header standing in for an
+    /// authenticated session). Returns the flow id and the raw redirect Location.
+    /// </summary>
+    private static async Task<(string FlowId, string Location)> DriveParAndAuthorizeAsync(
+        TestHostShell app,
+        HostedAuthorizationServer hosted,
+        OAuthClient client,
+        ClientRegistration registration,
+        Dictionary<string, FlowState> clientFlowStore,
+        string segment,
+        CancellationToken cancellationToken)
+    {
+        AuthCodeFlowEndpointResult parResult = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, parResult.Outcome,
+            $"PAR must redirect over the real wire. ErrorCode={parResult.ErrorCode} ErrorDescription={parResult.ErrorDescription}");
+
+        string flowId = clientFlowStore.Keys.Single();
+        ParCompletedState parState = (ParCompletedState)clientFlowStore[flowId];
+
+        Uri authorizeUrl = new(
+            hosted.HttpBaseAddress!,
+            $"{TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeAuthorize, segment)}" +
+            $"?{OAuthRequestParameterNames.ClientId}={Uri.EscapeDataString(registration.ClientId.Value)}" +
+            $"&{OAuthRequestParameterNames.RequestUri}={Uri.EscapeDataString(parState.Par.RequestUri.ToString())}");
+
+        using HttpClientHandler noRedirectHandler = LoopbackTls.CreatePinnedHandler(app.ServerCertificate);
+        noRedirectHandler.AllowAutoRedirect = false;
+        using HttpClient browserClient = new(noRedirectHandler) { BaseAddress = hosted.HttpBaseAddress };
+        using HttpRequestMessage authorizeRequest = new(HttpMethod.Get, authorizeUrl);
+        authorizeRequest.Headers.Add(AuthorizationServerHttpApplication.TestSubjectHeaderName, SubjectId);
+
+        using HttpResponseMessage authorizeResponse = await browserClient
+            .SendAsync(authorizeRequest, cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(302, (int)authorizeResponse.StatusCode,
+            "The authorize endpoint must redirect.");
+
+        return (flowId, authorizeResponse.Headers.Location!.ToString());
+    }
+
+
+    //Builds a conformant-shaped Client ID Metadata Document (§4). client_id is included unless the
+    //caller wants to model CIMD-013's missing-property defect; every other member is included only
+    //when supplied, so an omitted property stays genuinely absent from the wire JSON.
+    private static string BuildDocumentJson(
+        string clientId,
+        IReadOnlyList<Uri>? redirectUris = null,
+        string? tokenEndpointAuthMethod = null,
+        bool includeClientSecret = false,
+        string? jwksRawJson = null,
+        string? jwksUriRaw = null,
+        string? logoUri = null,
+        string? clientName = null,
+        string? softwareStatement = null)
+    {
+        List<string> members = [$"\"client_id\":\"{clientId}\""];
+
+        if(redirectUris is { Count: > 0 })
+        {
+            string uris = string.Join(',', redirectUris.Select(static uri => $"\"{uri.OriginalString}\""));
+            members.Add($"\"redirect_uris\":[{uris}]");
+        }
+
+        if(tokenEndpointAuthMethod is not null)
+        {
+            members.Add($"\"token_endpoint_auth_method\":\"{tokenEndpointAuthMethod}\"");
+        }
+
+        if(includeClientSecret)
+        {
+            members.Add("\"client_secret\":\"leaked-secret-value\"");
+        }
+
+        if(jwksRawJson is not null)
+        {
+            members.Add($"\"jwks\":{jwksRawJson}");
+        }
+
+        if(jwksUriRaw is not null)
+        {
+            members.Add($"\"jwks_uri\":\"{jwksUriRaw}\"");
+        }
+
+        if(logoUri is not null)
+        {
+            members.Add($"\"logo_uri\":\"{logoUri}\"");
+        }
+
+        if(clientName is not null)
+        {
+            members.Add($"\"client_name\":\"{clientName}\"");
+        }
+
+        if(softwareStatement is not null)
+        {
+            members.Add($"\"software_statement\":\"{softwareStatement}\"");
+        }
+
+        return "{" + string.Join(',', members) + "}";
+    }
+
+
+    //RFC 3986 §3.1: the scheme is case-insensitive for URI equivalence purposes, but CIMD-008/016
+    //require literal ordinal comparison — this produces a client_id that URI-normalization would
+    //consider the same origin as originalString but that ordinal comparison correctly rejects.
+    private static string UppercaseScheme(string originalString) =>
+        "HTTPS" + originalString[Uri.UriSchemeHttps.Length..];
+
+
+    private static ActivityListener CreateListener(ConcurrentBag<Activity> captured) =>
+        new()
+        {
+            ShouldListenTo = source =>
+                string.Equals(source.Name, ServerActivitySource.SourceName, StringComparison.Ordinal),
+            Sample = static (ref ActivityCreationOptions<ActivityContext> _) =>
+                ActivitySamplingResult.AllDataAndRecorded,
+            ActivityStopped = activity => captured.Add(activity)
+        };
+
+
+    /// <summary>Thread-safe request counter a <see cref="MinimalHttpHandlerDelegate"/> closure increments.</summary>
+    private sealed class RequestCounter
+    {
+        private int count;
+
+        public int Count => Volatile.Read(ref count);
+
+        public void Increment() => Interlocked.Increment(ref count);
+    }
+
+
+    /// <summary>
+    /// A single-hop transport that counts every call and always answers with a bare 200 — used to
+    /// prove a policy-denied resolve never dials the transport at all (<see cref="CallCount"/> stays
+    /// 0); answering 200 rather than throwing means an accidental dial surfaces as a wrong
+    /// resolution outcome rather than being swallowed by exception handling.
+    /// </summary>
+    private sealed class TransportCallSpy
+    {
+        private int callCount;
+
+        public int CallCount => Volatile.Read(ref callCount);
+
+        public OutboundTransportDelegate Delegate => (request, context, cancellationToken) =>
+        {
+            Interlocked.Increment(ref callCount);
+
+            return ValueTask.FromResult(new OutboundResponse { StatusCode = 200 });
+        };
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentCachingFlowTests.cs b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentCachingFlowTests.cs
new file mode 100644
index 00000000..1f7d9324
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentCachingFlowTests.cs
@@ -0,0 +1,342 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Server;
+using Verifiable.OAuth.Server.Pipeline;
+using Verifiable.Server;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// CIMD §5.2 metadata-caching real-wire suite (slice E2, contract D12 second half, item (d)):
+/// every scenario drives two independent PAR flows against the same registered CIMD client over a
+/// real <see cref="MinimalHttpHost"/> TLS loopback socket, scripting the <c>Cache-Control</c>
+/// response header (or the response sequence) the second flow's fetch decision depends on. The
+/// pinned <see cref="FakeTimeProvider"/> is the only clock the resolver's freshness decisions ever
+/// read — production code never consults the wall clock here.
+/// </summary>
+/// <remarks>
+/// Covers CIMD-02-clause-ledger rows 030, 036-040, 061 per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-5.2">
+/// draft-ietf-oauth-client-id-metadata-document-02 §5.2</see> and §9.1. Adversarial, SSRF,
+/// discrimination, display-seam, and logo-prefetch coverage lives in the sibling
+/// <see cref="ClientIdMetadataDocumentAdversarialFlowTests"/>. Every test builds its own hosts, so
+/// the suite is parallel-safe.
+/// </remarks>
+[TestClass]
+internal sealed class ClientIdMetadataDocumentCachingFlowTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private static Uri RedirectUri { get; } = new("https://client.example.com/callback");
+
+    private static ImmutableHashSet<CapabilityIdentifier> AuthCodeCapabilities { get; } =
+        ImmutableHashSet.Create(
+            WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+            WellKnownCapabilityIdentifiers.OAuthPushedAuthorization);
+
+
+    /// <summary>
+    /// CIMD-036/061: a <c>max-age</c> response is still fresh at the second flow, so the second PAR
+    /// attempt makes zero extra fetches — the cached resolution is served without touching the
+    /// document host again.
+    /// </summary>
+    [TestMethod]
+    public async Task MaxAgeFreshSecondFlowMakesZeroExtraFetches()
+    {
+        Uri? documentUri = null;
+        SequencedResponseHandler handler = new(_ => FreshDocumentResponse(() => documentUri!, maxAgeSeconds: 300));
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            handler.HandleAsync, TestContext.CancellationToken).ConfigureAwait(false);
+        documentUri = new Uri(documentHost.BaseAddress, "/app");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using TestHostShell app = new(timeProvider);
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        (OAuthClient client, ClientRegistration registration) = await RegisterCimdClientAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult firstFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, firstFlow.Outcome,
+            $"The first flow must fetch and succeed. ErrorDescription={firstFlow.ErrorDescription}");
+        Assert.AreEqual(1, handler.CallCount);
+
+        AuthCodeFlowEndpointResult secondFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, secondFlow.Outcome,
+            $"The second flow must also succeed, from the cache. ErrorDescription={secondFlow.ErrorDescription}");
+        Assert.AreEqual(1, handler.CallCount,
+            "CIMD-036/061: a fresh cache entry must serve the second flow with zero extra fetches.");
+    }
+
+
+    /// <summary>CIMD-030: once the clock advances past the cached freshness lifetime, the next flow re-fetches.</summary>
+    [TestMethod]
+    public async Task ClockPastTtlSecondFlowRefetches()
+    {
+        Uri? documentUri = null;
+        SequencedResponseHandler handler = new(_ => FreshDocumentResponse(() => documentUri!, maxAgeSeconds: 300));
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            handler.HandleAsync, TestContext.CancellationToken).ConfigureAwait(false);
+        documentUri = new Uri(documentHost.BaseAddress, "/app");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using TestHostShell app = new(timeProvider);
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        (OAuthClient client, ClientRegistration registration) = await RegisterCimdClientAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult firstFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, firstFlow.Outcome,
+            $"ErrorDescription={firstFlow.ErrorDescription}");
+        Assert.AreEqual(1, handler.CallCount);
+
+        timeProvider.Advance(TimeSpan.FromSeconds(301));
+
+        AuthCodeFlowEndpointResult secondFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, secondFlow.Outcome,
+            $"ErrorDescription={secondFlow.ErrorDescription}");
+        Assert.AreEqual(2, handler.CallCount,
+            "CIMD-030: a flow after the cached lifetime elapses must re-fetch the document.");
+    }
+
+
+    /// <summary>CIMD-037 (respect cache headers): a <c>no-store</c> response is never cached, so every flow re-fetches.</summary>
+    [TestMethod]
+    public async Task NoStoreRefetchesEveryFlow()
+    {
+        Uri? documentUri = null;
+        SequencedResponseHandler handler = new(_ => new MinimalHttpResponse
+        {
+            StatusCode = 200,
+            ContentType = "application/json",
+            Body = BuildDocumentJson(documentUri!.OriginalString, [RedirectUri]),
+            Headers = new Dictionary<string, string> { ["Cache-Control"] = "no-store" }
+        });
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            handler.HandleAsync, TestContext.CancellationToken).ConfigureAwait(false);
+        documentUri = new Uri(documentHost.BaseAddress, "/app");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using TestHostShell app = new(timeProvider);
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        (OAuthClient client, ClientRegistration registration) = await RegisterCimdClientAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult firstFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, firstFlow.Outcome,
+            $"ErrorDescription={firstFlow.ErrorDescription}");
+        Assert.AreEqual(1, handler.CallCount);
+
+        AuthCodeFlowEndpointResult secondFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, secondFlow.Outcome,
+            $"ErrorDescription={secondFlow.ErrorDescription}");
+        Assert.AreEqual(2, handler.CallCount,
+            "CIMD-037: Cache-Control: no-store must never be cached — every flow re-fetches.");
+    }
+
+
+    /// <summary>
+    /// CIMD-038: a huge <c>max-age</c> is clamped by <see cref="ClientIdMetadataDocumentResolverOptions.MaximumCacheLifetime"/>
+    /// rather than honored literally — a clock advance well within the huge max-age but past the
+    /// clamp still triggers a re-fetch.
+    /// </summary>
+    [TestMethod]
+    public async Task HugeMaxAgeClampedByMaximumCacheLifetimeOption()
+    {
+        Uri? documentUri = null;
+        SequencedResponseHandler handler = new(_ => FreshDocumentResponse(() => documentUri!, maxAgeSeconds: 999_999));
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            handler.HandleAsync, TestContext.CancellationToken).ConfigureAwait(false);
+        documentUri = new Uri(documentHost.BaseAddress, "/app");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using TestHostShell app = new(timeProvider);
+        app.WireCimdMaterialization(
+            "default", documentHost.Certificate,
+            new ClientIdMetadataDocumentResolverOptions { MaximumCacheLifetime = TimeSpan.FromSeconds(60) });
+
+        (OAuthClient client, ClientRegistration registration) = await RegisterCimdClientAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult firstFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, firstFlow.Outcome,
+            $"ErrorDescription={firstFlow.ErrorDescription}");
+        Assert.AreEqual(1, handler.CallCount);
+
+        timeProvider.Advance(TimeSpan.FromSeconds(61));
+
+        AuthCodeFlowEndpointResult secondFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, secondFlow.Outcome,
+            $"ErrorDescription={secondFlow.ErrorDescription}");
+        Assert.AreEqual(2, handler.CallCount,
+            "CIMD-038: a max-age far beyond MaximumCacheLifetime must be clamped down, not honored literally.");
+    }
+
+
+    /// <summary>CIMD-039: an error response is never cached — the second flow re-fetches and succeeds.</summary>
+    [TestMethod]
+    public async Task ErrorThenValidSecondFlowSucceeds()
+    {
+        Uri? documentUri = null;
+        SequencedResponseHandler handler = new(index => index switch
+        {
+            0 => new MinimalHttpResponse { StatusCode = 500 },
+            _ => new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = "application/json",
+                Body = BuildDocumentJson(documentUri!.OriginalString, [RedirectUri])
+            }
+        });
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            handler.HandleAsync, TestContext.CancellationToken).ConfigureAwait(false);
+        documentUri = new Uri(documentHost.BaseAddress, "/app");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using TestHostShell app = new(timeProvider);
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        (OAuthClient client, ClientRegistration registration) = await RegisterCimdClientAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult firstFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, firstFlow.Outcome,
+            "CIMD-033: the first flow must abort on the 500 response.");
+
+        AuthCodeFlowEndpointResult secondFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, secondFlow.Outcome,
+            $"CIMD-039: the error must not have been cached — the second flow must re-fetch and succeed. " +
+            $"ErrorDescription={secondFlow.ErrorDescription}");
+        Assert.AreEqual(2, handler.CallCount);
+    }
+
+
+    /// <summary>CIMD-040: an invalid document is never cached — the second flow re-fetches and succeeds.</summary>
+    [TestMethod]
+    public async Task InvalidDocumentThenValidSecondFlowSucceeds()
+    {
+        Uri? documentUri = null;
+        SequencedResponseHandler handler = new(index => index switch
+        {
+            0 => new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = "application/json",
+                Body = """{"client_secret":"leaked"}"""
+            },
+            _ => new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = "application/json",
+                Body = BuildDocumentJson(documentUri!.OriginalString, [RedirectUri])
+            }
+        });
+        await using MinimalHttpHost documentHost = await MinimalHttpHost.StartAsync(
+            handler.HandleAsync, TestContext.CancellationToken).ConfigureAwait(false);
+        documentUri = new Uri(documentHost.BaseAddress, "/app");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using TestHostShell app = new(timeProvider);
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        (OAuthClient client, ClientRegistration registration) = await RegisterCimdClientAsync(
+            app, documentUri, TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult firstFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, firstFlow.Outcome,
+            "CIMD-022: the first flow must abort — the document carries a client_secret.");
+
+        AuthCodeFlowEndpointResult secondFlow = await client.AuthCode.StartParAsync(
+            registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, secondFlow.Outcome,
+            $"CIMD-040: the invalid document must not have been cached — the second flow must re-fetch and " +
+            $"succeed. ErrorDescription={secondFlow.ErrorDescription}");
+        Assert.AreEqual(2, handler.CallCount);
+    }
+
+
+    /// <summary>Registers a fresh CIMD stub for <paramref name="documentUri"/> and the matching OAuth client wrapper.</summary>
+    private static async Task<(OAuthClient Client, ClientRegistration Registration)> RegisterCimdClientAsync(
+        TestHostShell app, Uri documentUri, CancellationToken cancellationToken)
+    {
+        ClientRecord stub = app.RegisterCimdStubClient(documentUri, AuthCodeCapabilities, PolicyProfile.Rfc6749WithPkce);
+        (OAuthClient client, ClientRegistration registration, _) = await app.CreateOAuthClientAndRegistrationAsync(
+            stub, RedirectUri.OriginalString, PolicyProfile.Rfc6749WithPkce, cancellationToken).ConfigureAwait(false);
+
+        return (client, registration);
+    }
+
+
+    //A conformant document served with a max-age Cache-Control directive. documentUriAccessor is
+    //a deferred accessor because the client_id must equal the document host's own bound address,
+    //known only after MinimalHttpHost.StartAsync returns — later than the handler closure captures.
+    private static MinimalHttpResponse FreshDocumentResponse(Func<Uri> documentUriAccessor, int maxAgeSeconds) =>
+        new()
+        {
+            StatusCode = 200,
+            ContentType = "application/json",
+            Body = BuildDocumentJson(documentUriAccessor().OriginalString, [RedirectUri]),
+            Headers = new Dictionary<string, string> { ["Cache-Control"] = $"max-age={maxAgeSeconds}" }
+        };
+
+
+    //Builds a conformant-shaped Client ID Metadata Document (§4) — the same shape the sibling
+    //adversarial suite's BuildDocumentJson produces, kept as its own copy per this file's narrower
+    //needs (client_id and redirect_uris only).
+    private static string BuildDocumentJson(string clientId, IReadOnlyList<Uri> redirectUris)
+    {
+        string uris = string.Join(',', redirectUris.Select(static uri => $"\"{uri.OriginalString}\""));
+
+        return $$"""{"client_id":"{{clientId}}","redirect_uris":[{{uris}}]}""";
+    }
+
+
+    /// <summary>
+    /// A single-hop <see cref="MinimalHttpHandlerDelegate"/> that plays back a sequence of
+    /// responses by call index (sticking to the last factory result once the caller's switch
+    /// expression falls through to its default arm), counting every call. The factory is invoked
+    /// lazily per call so it can reference state (the document host's own bound address) not yet
+    /// known when the handler is constructed.
+    /// </summary>
+    private sealed class SequencedResponseHandler
+    {
+        private readonly Func<int, MinimalHttpResponse> responseFactory;
+        private int callIndex;
+
+        public SequencedResponseHandler(Func<int, MinimalHttpResponse> responseFactory)
+        {
+            this.responseFactory = responseFactory;
+        }
+
+        public int CallCount => Volatile.Read(ref callIndex);
+
+        public Task<MinimalHttpResponse> HandleAsync(MinimalHttpRequest request, CancellationToken cancellationToken)
+        {
+            int index = Interlocked.Increment(ref callIndex) - 1;
+
+            return Task.FromResult(responseFactory(index));
+        }
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentCrossWireFlowTests.cs b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentCrossWireFlowTests.cs
new file mode 100644
index 00000000..c8437420
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentCrossWireFlowTests.cs
@@ -0,0 +1,929 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Linq;
+using System.Net.Http;
+using System.Security.Cryptography.X509Certificates;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Core.OutboundFetch;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.AuthCode.States;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Dpop;
+using Verifiable.OAuth.Server;
+using Verifiable.OAuth.Server.Pipeline;
+using Verifiable.OAuth.WellKnown;
+using Verifiable.Server;
+using Verifiable.Tests.TestDataProviders;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// The flagship real-wire CIMD suite (template: <c>WebFingerCrossWireFlowTests</c>): a genuine
+/// Client ID Metadata Document host (<see cref="StaticContentHost"/> or <see cref="CimdServiceHost"/>,
+/// both TLS) beside the real <see cref="EndpointServer.DispatchAsync"/> authorization-server path
+/// (through <see cref="TestHostShell"/>'s Kestrel host, also TLS, both pinned) — every clause this
+/// class proves is exercised by bytes that crossed a real loopback socket, per
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html">
+/// draft-ietf-oauth-client-id-metadata-document-02</see>.
+/// </summary>
+/// <remarks>
+/// Covers CIMD-02-clause-ledger rows 003, 012, 018, 026, 027, 029, 031, 032, 041, 042, 045, 046, 047,
+/// 048, 049, 050, 062, 063, 064, 065, 066, 067 (slice E1 — the happy-path half of the D12 flagship
+/// suite; SSRF/cache/negative-fetch rows belong to the companion slice). Every host uses
+/// <see cref="TestHostShell.StartHttpHostAsync(CancellationToken)"/>'s or
+/// <see cref="StaticContentHost.StartAsync"/>'s single explicit HTTPS <c>Listen</c> convention — there
+/// is no plaintext listener anywhere in this file — and every test builds its own hosts, so the suite
+/// is parallel-safe.
+/// </remarks>
+[TestClass]
+internal sealed class ClientIdMetadataDocumentCrossWireFlowTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private const string SubjectId = "subject-cimd-cross-wire-01";
+    private const string ClientSigningKeyId = "cimd-client-signing-key-1";
+
+
+    /// <summary>
+    /// The public-client happy path (CIMD-003/012/018/029/032): an unregistered
+    /// <c>https://…:{port}/…</c> Client Identifier URL (CIMD-003 — the port is not elided) resolves to
+    /// a document served by a real TLS host; the AS fetches it (proving the wire was hit) and the
+    /// materialized registration's <c>redirect_uri</c> comes ONLY from that document — a redirect_uri
+    /// the document never declared is rejected BEFORE the one it did declare is accepted. PAR →
+    /// authorize → callback → token completes over the real wire. A second, HAIP 1.0 client on the
+    /// same document host proves RFC 9207 <c>iss</c> continuity survives the CIMD materialization
+    /// overlay, byte-exact.
+    /// </summary>
+    [TestMethod]
+    public async Task HappyPath_PublicClient_DocumentSuppliesRedirectUriAndDrivesFullFlow()
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Uri redirectUri = new("https://client.example.com/callback");
+        const string path = "/app";
+        Uri documentUri = new(documentHost.BaseAddress, path);
+        PublishCimdDocument(documentHost, path, documentUri, [redirectUri]);
+
+        await using TestHostShell app = new(timeProvider);
+        ClientRecord stub = app.RegisterCimdStubClient(
+            documentUri,
+            ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                WellKnownCapabilityIdentifiers.OAuthPushedAuthorization),
+            profile: PolicyProfile.Rfc6749WithPkce);
+
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> flowStore) =
+            await app.CreateOAuthClientAndRegistrationAsync(
+                stub, redirectUri.OriginalString, profile: PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+        HostedAuthorizationServer hosted = app.Host("default");
+        string segment = stub.TenantId.Value;
+
+        //CIMD-012/D6: a redirect_uri the document never declared is rejected — proving the accepted
+        //redirect_uri below comes from the fetched document, not a blanket allow.
+        AuthCodeFlowEndpointResult wrongRedirect = await client.AuthCode.StartParAsync(
+            registration, new Uri("https://not-in-the-document.example/cb"), OAuthFormEncodedFields.Empty,
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreNotEqual(AuthCodeFlowEndpointOutcome.Redirect, wrongRedirect.Outcome,
+            "A redirect_uri the CIMD document never declared must not be accepted.");
+
+        string flowId = await DriveParAuthorizeAndCallbackAsync(
+            hosted, client, registration, flowStore, segment, redirectUri, SubjectId, app.ServerCertificate,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult tokenResult = await client.AuthCode.ExchangeTokenAsync(
+            registration, flowId, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, tokenResult.Outcome,
+            $"Token exchange must succeed over the real wire. ErrorCode={tokenResult.ErrorCode} ErrorDescription={tokenResult.ErrorDescription}");
+        Assert.IsFalse(string.IsNullOrEmpty((string)tokenResult.Body![OAuthRequestParameterNames.AccessToken]));
+
+        Assert.IsTrue(documentHost.WasRequested(path),
+            "CIMD-029: the authorization server must have fetched the Client ID Metadata Document over the real wire.");
+
+        //CIMD-041/CIMD-003 note: documentUri carries a port (StaticContentHost's ephemeral Kestrel
+        //port), and the fetch above succeeded — the port is not a defect.
+
+        //RFC 9207 continuity under HAIP 1.0 (FAPI 2.0 baseline): the redirect's iss must be byte-exact
+        //even though the client identity AND redirect_uri came from a fetched CIMD document.
+        const string haip10Path = "/app-haip10";
+        Uri haip10Redirect = new("https://client.example.com/haip10-callback");
+        Uri haip10DocumentUri = new(documentHost.BaseAddress, haip10Path);
+        PublishCimdDocument(documentHost, haip10Path, haip10DocumentUri, [haip10Redirect]);
+
+        ClientRecord haip10Stub = app.RegisterCimdStubClient(
+            haip10DocumentUri,
+            ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                WellKnownCapabilityIdentifiers.OAuthPushedAuthorization),
+            profile: PolicyProfile.Haip10);
+
+        (OAuthClient haip10Client, ClientRegistration haip10Registration, Dictionary<string, FlowState> haip10FlowStore) =
+            await app.CreateOAuthClientAndRegistrationAsync(
+                haip10Stub, haip10Redirect.OriginalString, profile: PolicyProfile.Haip10, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+        (_, string haip10Location) = await DriveParAndAuthorizeAsync(
+            hosted, haip10Client, haip10Registration, haip10FlowStore, haip10Stub.TenantId.Value, haip10Redirect,
+            new OAuthFormEncodedFields(new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.Scope] = WellKnownScopes.OpenId
+            }),
+            SubjectId, app.ServerCertificate, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string? iss = TestBrowser.ExtractQueryParam(haip10Location, OAuthRequestParameterNames.Iss);
+        Assert.IsNotNull(iss, "HAIP 1.0 (FAPI 2.0 baseline) must emit iss on the authorize redirect (RFC 9207).");
+        Assert.AreEqual(haip10Registration.AuthorizationServerIssuer.OriginalString, iss,
+            "RFC 9207 §2 continuity: iss must be byte-exact even though the client's identity and redirect_uri came from the fetched CIMD document.");
+    }
+
+
+    /// <summary>
+    /// Confidential-client authentication (CIMD-047/048/049/050): the document declares
+    /// <c>token_endpoint_auth_method: private_key_jwt</c> plus an inline <c>jwks</c> (CIMD-048). Token
+    /// exchange with NO client authentication fails 401 (CIMD-049 "MUST include client authentication
+    /// of the registered type"); a TAMPERED assertion signature fails 401 (RFC 7523 §2.2 verification,
+    /// CIMD-050); a VALID <c>private_key_jwt</c> assertion authenticates and the exchange completes.
+    /// Both failing attempts leave the authorization code unconsumed — client-authentication failure is
+    /// checked before the code-redemption PDA transition — so all three attempts share one flow.
+    /// </summary>
+    [TestMethod]
+    public async Task ConfidentialClient_TokenExchangeRequiresAndValidatesPrivateKeyJwtAssertion()
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Uri redirectUri = new("https://client.example.com/callback");
+        const string path = "/app-confidential";
+        Uri documentUri = new(documentHost.BaseAddress, path);
+
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> clientKeys =
+            TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            string alg = CryptoFormatConversions.DefaultTagToJwaConverter(clientKeys.PublicKey.Tag);
+            IReadOnlyDictionary<string, string> jwk = DpopJwkUtilities.ToJwk(
+                clientKeys.PublicKey, alg, TestHostShell.Base64UrlEncoder);
+            string jwksJson = BuildJwksJson(jwk, ClientSigningKeyId);
+
+            string documentJson = BuildCimdDocumentJson(
+                documentUri.OriginalString,
+                redirectUris: [redirectUri],
+                tokenEndpointAuthMethod: WellKnownClientAuthenticationMethods.PrivateKeyJwt,
+                jwksJson: jwksJson);
+            documentHost.Publish(path, Encoding.UTF8.GetBytes(documentJson), "application/json");
+
+            await using TestHostShell app = new(timeProvider);
+            ClientRecord stub = app.RegisterCimdStubClient(
+                documentUri,
+                ImmutableHashSet.Create(
+                    WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                    WellKnownCapabilityIdentifiers.OAuthPushedAuthorization),
+                profile: PolicyProfile.Rfc6749WithPkce);
+
+            app.WireCimdMaterialization("default", documentHost.Certificate);
+            app.Server.OAuth().ValidateClientCredentialsAsync = PrivateKeyJwtClientAuthentication.BuildValidator();
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> flowStore) =
+                await app.CreateOAuthClientAndRegistrationAsync(
+                    stub, redirectUri.OriginalString, profile: PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+                    .ConfigureAwait(false);
+
+            HostedAuthorizationServer hosted = app.Host("default");
+            string segment = stub.TenantId.Value;
+
+            string flowId = await DriveParAuthorizeAndCallbackAsync(
+                hosted, client, registration, flowStore, segment, redirectUri, SubjectId, app.ServerCertificate,
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+            AuthorizationCodeReceivedState codeState = (AuthorizationCodeReceivedState)flowStore[flowId];
+            Uri tokenEndpoint = new(
+                hosted.HttpBaseAddress!, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeToken, segment));
+
+            Dictionary<string, string> baseFields = new(StringComparer.Ordinal)
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.AuthorizationCode,
+                [OAuthRequestParameterNames.ClientId] = registration.ClientId.Value,
+                [OAuthRequestParameterNames.Code] = codeState.Code,
+                [OAuthRequestParameterNames.RedirectUri] = codeState.RedirectUri.ToString(),
+                [OAuthRequestParameterNames.CodeVerifier] = codeState.Pkce.EncodedVerifier
+            };
+
+            //CIMD-049: no client authentication at all.
+            using HttpResponseMessage noAssertion = await OAuthTestTransport.PostFormAsync(
+                hosted.SharedHttpClient!, tokenEndpoint, baseFields, TestContext.CancellationToken).ConfigureAwait(false);
+            string noAssertionBody = await noAssertion.Content.ReadAsStringAsync(TestContext.CancellationToken)
+                .ConfigureAwait(false);
+            Assert.AreEqual(401, (int)noAssertion.StatusCode, noAssertionBody);
+            Assert.Contains(OAuthErrors.InvalidClient, noAssertionBody);
+
+            string validAssertion = await ClientAssertionSigning.SignAsync(
+                registration.ClientId.Value,
+                registration.AuthorizationServerIssuer.OriginalString,
+                Guid.NewGuid().ToString("N"),
+                timeProvider.GetUtcNow(),
+                timeProvider.GetUtcNow().AddMinutes(5),
+                clientKeys.PrivateKey,
+                ClientSigningKeyId,
+                app.Server.OAuth().Codecs.JwtHeaderSerializer!,
+                app.Server.OAuth().Codecs.JwtPayloadSerializer!,
+                app.Server.OAuth().Codecs.Encoder!,
+                TestHostShell.MemoryPool,
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+            //CIMD-050: a tampered assertion signature fails RFC 7523 §2.2 verification.
+            Dictionary<string, string> tamperedFields = new(baseFields, StringComparer.Ordinal)
+            {
+                [OAuthRequestParameterNames.ClientAssertionType] = WellKnownClientAssertionTypes.JwtBearer,
+                [OAuthRequestParameterNames.ClientAssertion] = TamperSignature(validAssertion)
+            };
+            using HttpResponseMessage tampered = await OAuthTestTransport.PostFormAsync(
+                hosted.SharedHttpClient!, tokenEndpoint, tamperedFields, TestContext.CancellationToken).ConfigureAwait(false);
+            string tamperedBody = await tampered.Content.ReadAsStringAsync(TestContext.CancellationToken)
+                .ConfigureAwait(false);
+            Assert.AreEqual(401, (int)tampered.StatusCode, tamperedBody);
+
+            //CIMD-047/048/050: a valid private_key_jwt assertion authenticates and the exchange completes.
+            Dictionary<string, string> validFields = new(baseFields, StringComparer.Ordinal)
+            {
+                [OAuthRequestParameterNames.ClientAssertionType] = WellKnownClientAssertionTypes.JwtBearer,
+                [OAuthRequestParameterNames.ClientAssertion] = validAssertion
+            };
+            using HttpResponseMessage ok = await OAuthTestTransport.PostFormAsync(
+                hosted.SharedHttpClient!, tokenEndpoint, validFields, TestContext.CancellationToken).ConfigureAwait(false);
+            string okBody = await ok.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+            Assert.AreEqual(200, (int)ok.StatusCode, okBody);
+
+            using JsonDocument tokenDoc = JsonDocument.Parse(okBody);
+            Assert.IsFalse(string.IsNullOrEmpty(tokenDoc.RootElement.GetProperty(OAuthRequestParameterNames.AccessToken).GetString()));
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// The §8.2 canonical confidential-client shape (CIMD-048/050): the document declares
+    /// <c>token_endpoint_auth_method: private_key_jwt</c> plus a <c>jwks_uri</c> — NOT an inline
+    /// <c>jwks</c> — pointing at a SECOND loopback host distinct from the one serving the CIMD
+    /// document itself, exactly the shape
+    /// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-8.2">
+    /// §8.2</see>'s own example advertises. The resolver's Step 9a
+    /// (<see cref="ClientIdMetadataDocuments.BuildResolving"/>) fetches the key set through that
+    /// second host over the real wire and folds it into the resolved document's <c>jwks</c>, so
+    /// <see cref="PrivateKeyJwtClientAuthentication"/>'s validator resolves the client's key and a
+    /// VALID <c>private_key_jwt</c> assertion completes the exchange.
+    /// </summary>
+    [TestMethod]
+    public async Task ConfidentialClientWithJwksUriAuthenticatesOverTheRealWire()
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        await using StaticContentHost jwksHost = await StaticContentHost.StartAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Uri redirectUri = new("https://client.example.com/callback");
+        const string documentPath = "/app-jwks-uri";
+        const string jwksPath = "/jwks";
+        Uri documentUri = new(documentHost.BaseAddress, documentPath);
+        Uri jwksUri = new(jwksHost.BaseAddress, jwksPath);
+
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> clientKeys =
+            TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            string alg = CryptoFormatConversions.DefaultTagToJwaConverter(clientKeys.PublicKey.Tag);
+            IReadOnlyDictionary<string, string> jwk = DpopJwkUtilities.ToJwk(
+                clientKeys.PublicKey, alg, TestHostShell.Base64UrlEncoder);
+            string jwksJson = BuildJwksJson(jwk, ClientSigningKeyId);
+            jwksHost.Publish(jwksPath, Encoding.UTF8.GetBytes(jwksJson), "application/json");
+
+            string documentJson = BuildCimdDocumentJson(
+                documentUri.OriginalString,
+                redirectUris: [redirectUri],
+                tokenEndpointAuthMethod: WellKnownClientAuthenticationMethods.PrivateKeyJwt,
+                jwksJson: null,
+                jwksUri: jwksUri.OriginalString);
+            documentHost.Publish(documentPath, Encoding.UTF8.GetBytes(documentJson), "application/json");
+
+            await using TestHostShell app = new(timeProvider);
+            ClientRecord stub = app.RegisterCimdStubClient(
+                documentUri,
+                ImmutableHashSet.Create(
+                    WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                    WellKnownCapabilityIdentifiers.OAuthPushedAuthorization),
+                profile: PolicyProfile.Rfc6749WithPkce);
+
+            //WireCimdMaterialization pins the resolver's transport to a SINGLE document host
+            //certificate; here the resolver must reach both the CIMD document host and the separate
+            //jwks_uri host, so the integration is wired directly, mirroring WireCimdMaterialization's
+            //own body over a two-certificate pinned, single-hop client.
+            using HttpClientHandler resolverHandler =
+                LoopbackTls.CreatePinnedHandler([documentHost.Certificate, jwksHost.Certificate]);
+            resolverHandler.AllowAutoRedirect = false;
+            using HttpClient resolverHttpClient = new(resolverHandler);
+            OutboundTransportDelegate resolverTransport =
+                GuardedHttpClientTransport.BuildSingleHopTransport(resolverHttpClient);
+            ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+                resolverTransport, new ClientIdMetadataDocumentResolverOptions(), timeProvider);
+
+            AuthorizationServerIntegration oauth = app.Server.OAuth();
+            oauth.MaterializeRegistrationAsync = ClientIdMetadataMaterialization.Build();
+            oauth.ResolveClientMetadataAsync = (clientMetadataUri, context, cancellationToken) =>
+            {
+                context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
+
+                return resolve(clientMetadataUri, context, cancellationToken);
+            };
+            oauth.ValidateClientCredentialsAsync = PrivateKeyJwtClientAuthentication.BuildValidator();
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> flowStore) =
+                await app.CreateOAuthClientAndRegistrationAsync(
+                    stub, redirectUri.OriginalString, profile: PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+                    .ConfigureAwait(false);
+
+            HostedAuthorizationServer hosted = app.Host("default");
+            string segment = stub.TenantId.Value;
+
+            string flowId = await DriveParAuthorizeAndCallbackAsync(
+                hosted, client, registration, flowStore, segment, redirectUri, SubjectId, app.ServerCertificate,
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+            AuthorizationCodeReceivedState codeState = (AuthorizationCodeReceivedState)flowStore[flowId];
+            Uri tokenEndpoint = new(
+                hosted.HttpBaseAddress!, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeToken, segment));
+
+            string validAssertion = await ClientAssertionSigning.SignAsync(
+                registration.ClientId.Value,
+                registration.AuthorizationServerIssuer.OriginalString,
+                Guid.NewGuid().ToString("N"),
+                timeProvider.GetUtcNow(),
+                timeProvider.GetUtcNow().AddMinutes(5),
+                clientKeys.PrivateKey,
+                ClientSigningKeyId,
+                app.Server.OAuth().Codecs.JwtHeaderSerializer!,
+                app.Server.OAuth().Codecs.JwtPayloadSerializer!,
+                app.Server.OAuth().Codecs.Encoder!,
+                TestHostShell.MemoryPool,
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+            //CIMD-047/048/050: a valid private_key_jwt assertion, authenticated against the key set
+            //discovered from the SEPARATE jwks_uri host, completes the exchange.
+            Dictionary<string, string> tokenFields = new(StringComparer.Ordinal)
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.AuthorizationCode,
+                [OAuthRequestParameterNames.ClientId] = registration.ClientId.Value,
+                [OAuthRequestParameterNames.Code] = codeState.Code,
+                [OAuthRequestParameterNames.RedirectUri] = codeState.RedirectUri.ToString(),
+                [OAuthRequestParameterNames.CodeVerifier] = codeState.Pkce.EncodedVerifier,
+                [OAuthRequestParameterNames.ClientAssertionType] = WellKnownClientAssertionTypes.JwtBearer,
+                [OAuthRequestParameterNames.ClientAssertion] = validAssertion
+            };
+            using HttpResponseMessage ok = await OAuthTestTransport.PostFormAsync(
+                hosted.SharedHttpClient!, tokenEndpoint, tokenFields, TestContext.CancellationToken).ConfigureAwait(false);
+            string okBody = await ok.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+            Assert.AreEqual(200, (int)ok.StatusCode, okBody);
+
+            using JsonDocument tokenDoc = JsonDocument.Parse(okBody);
+            Assert.IsFalse(string.IsNullOrEmpty(tokenDoc.RootElement.GetProperty(OAuthRequestParameterNames.AccessToken).GetString()));
+
+            Assert.IsTrue(jwksHost.WasRequested(jwksPath),
+                "CIMD-048/050, §8.2: the jwks_uri host must have been fetched over the real wire to discover the client's key set.");
+            Assert.IsGreaterThanOrEqualTo(1, jwksHost.TotalRequests,
+                "CIMD-048/050: the jwks_uri host must have served at least one request.");
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// The grant-type carve-out (CIMD-026/027): a redirect-less document (no <c>redirect_uris</c> at
+    /// all) still identifies its client and still gets its metadata fetched for the
+    /// <c>client_credentials</c> grant, which involves no redirect URL at all — the §4.2 redirect
+    /// registration requirement simply does not apply to it. The SAME docless client's PAR fails the
+    /// redirect check (D6, already shipped) because the fetched document supplied no registered
+    /// redirect URIs whatsoever.
+    /// </summary>
+    [TestMethod]
+    public async Task ClientCredentials_RedirectlessDocumentGrantsTokens_AuthorizeFlowFailsRedirectCheck()
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        const string path = "/app-machine";
+        Uri documentUri = new(documentHost.BaseAddress, path);
+        PublishCimdDocument(documentHost, path, documentUri, redirectUris: null);
+
+        await using TestHostShell app = new(timeProvider);
+        ClientRecord stub = app.RegisterCimdStubClient(
+            documentUri,
+            ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                WellKnownCapabilityIdentifiers.OAuthPushedAuthorization,
+                WellKnownCapabilityIdentifiers.OAuthClientCredentials),
+            profile: PolicyProfile.Rfc6749WithPkce);
+
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+        app.Server.OAuth().ValidateClientCredentialsAsync = static (_, _, _, _, _) => ValueTask.FromResult(true);
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer hosted = app.Host("default");
+        string segment = stub.TenantId.Value;
+
+        Uri tokenEndpoint = new(
+            hosted.HttpBaseAddress!, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeToken, segment));
+        using HttpResponseMessage tokenResponse = await OAuthTestTransport.PostFormAsync(
+            hosted.SharedHttpClient!, tokenEndpoint, new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.ClientCredentials,
+                [OAuthRequestParameterNames.ClientId] = documentUri.OriginalString
+            }, TestContext.CancellationToken).ConfigureAwait(false);
+        string tokenBody = await tokenResponse.Content.ReadAsStringAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(200, (int)tokenResponse.StatusCode, tokenBody);
+        Assert.IsTrue(documentHost.WasRequested(path),
+            "CIMD-027: client identification and metadata discovery apply regardless of grant type.");
+
+        Uri parEndpoint = new(
+            hosted.HttpBaseAddress!, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodePar, segment));
+        using HttpResponseMessage parResponse = await OAuthTestTransport.PostFormAsync(
+            hosted.SharedHttpClient!, parEndpoint, new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.ResponseType] = "code",
+                [OAuthRequestParameterNames.ClientId] = documentUri.OriginalString,
+                [OAuthRequestParameterNames.RedirectUri] = "https://developer.example/callback",
+                [OAuthRequestParameterNames.CodeChallenge] = "an-arbitrary-pkce-challenge-value-1234567890",
+                [OAuthRequestParameterNames.CodeChallengeMethod] = "S256"
+            }, TestContext.CancellationToken).ConfigureAwait(false);
+        string parBody = await parResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(400, (int)parResponse.StatusCode, parBody);
+        Assert.Contains("redirect_uri", parBody);
+    }
+
+
+    /// <summary>
+    /// Pre-registration (CIMD-031/045/046): the resolver runs ONCE, at the time the Client Identifier
+    /// URL is pre-registered — not the request-time <see cref="ClientIdMetadataMaterialization"/> hook,
+    /// which is never wired on this host at all. The flow still succeeds, and the document host sees
+    /// EXACTLY the one pre-registration-time fetch — zero request-time fetches.
+    /// </summary>
+    [TestMethod]
+    public async Task PreRegistration_ResolvedOnceAtRegistrationTime_FlowSucceedsWithZeroRequestTimeFetches()
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Uri redirectUri = new("https://client.example.com/callback");
+        const string path = "/app-prereg";
+        Uri documentUri = new(documentHost.BaseAddress, path);
+        PublishCimdDocument(documentHost, path, documentUri, [redirectUri]);
+
+        using HttpClient pinnedHttpClient = LoopbackTls.CreatePinnedHttpClient(documentHost.Certificate);
+        OutboundTransportDelegate transport = GuardedHttpClientTransport.BuildSingleHopTransport(pinnedHttpClient);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport, new ClientIdMetadataDocumentResolverOptions(), timeProvider);
+
+        ClientIdMetadataResolution resolution = await resolve(
+            documentUri, NewLoopbackContext(), TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.IsTrue(resolution.IsResolved,
+            $"CIMD-046: the document must resolve at pre-registration time. Defect={resolution.Defect}");
+
+        await using TestHostShell app = new(timeProvider);
+        ClientRecord stub = app.RegisterCimdStubClient(
+            documentUri,
+            ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                WellKnownCapabilityIdentifiers.OAuthPushedAuthorization),
+            profile: PolicyProfile.Rfc6749WithPkce);
+
+        //CIMD-031: the AS associates the Client Identifier URL with client metadata "through other
+        //means" — the pre-registration overlay below, applied once — rather than automatically
+        //fetching at request time. WireCimdMaterialization is deliberately never called on this host.
+        ClientRecord preRegistered = stub with
+        {
+            AllowedRedirectUris = [.. resolution.Document!.RedirectUris]
+        };
+        HostedAuthorizationServer host = app.Host("default");
+        host.Registrations[preRegistered.TenantId.Value] = preRegistered;
+        host.Registrations[preRegistered.ClientId] = preRegistered;
+        host.Server.UpdateClient(stub, preRegistered, new ExchangeContext());
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> flowStore) =
+            await app.CreateOAuthClientAndRegistrationAsync(
+                preRegistered, redirectUri.OriginalString, profile: PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+        HostedAuthorizationServer hosted = app.Host("default");
+        string segment = preRegistered.TenantId.Value;
+
+        string flowId = await DriveParAuthorizeAndCallbackAsync(
+            hosted, client, registration, flowStore, segment, redirectUri, SubjectId, app.ServerCertificate,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult tokenResult = await client.AuthCode.ExchangeTokenAsync(
+            registration, flowId, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, tokenResult.Outcome,
+            $"The pre-registered flow must succeed without any request-time CIMD fetch. ErrorCode={tokenResult.ErrorCode}");
+
+        Assert.AreEqual(1, documentHost.TotalRequests,
+            "Exactly the pre-registration-time fetch must have crossed the wire — zero request-time fetches.");
+    }
+
+
+    /// <summary>
+    /// AS metadata advertisement over the real wire (CIMD-041/042): the RFC 8414 default discovery
+    /// location carries <c>client_id_metadata_document_supported: true</c> under the dual gate
+    /// (capability allowed AND the resolver wired) — and discovery emission never itself triggers a
+    /// document fetch (privacy §9.1).
+    /// </summary>
+    [TestMethod]
+    public async Task Discovery_AdvertisesClientIdMetadataDocumentSupportedOverRealWire()
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using StaticContentHost documentHost = await StaticContentHost.StartAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        const string path = "/app-discovery";
+        Uri documentUri = new(documentHost.BaseAddress, path);
+        PublishCimdDocument(documentHost, path, documentUri, redirectUris: null);
+
+        await using TestHostShell app = new(timeProvider);
+        ClientRecord stub = app.RegisterCimdStubClient(
+            documentUri,
+            ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint),
+            profile: PolicyProfile.Rfc6749WithPkce);
+
+        app.WireCimdMaterialization("default", documentHost.Certificate);
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer hosted = app.Host("default");
+        string segment = stub.TenantId.Value;
+
+        Uri discoveryUrl = new(
+            hosted.HttpBaseAddress!,
+            TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.MetadataOAuthAuthorizationServer, segment));
+        using HttpResponseMessage discoveryResponse = await hosted.SharedHttpClient!
+            .GetAsync(discoveryUrl, TestContext.CancellationToken).ConfigureAwait(false);
+        string discoveryBody = await discoveryResponse.Content.ReadAsStringAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(200, (int)discoveryResponse.StatusCode, discoveryBody);
+
+        using JsonDocument doc = JsonDocument.Parse(discoveryBody);
+        Assert.IsTrue(
+            doc.RootElement.TryGetProperty(
+                AuthorizationServerMetadataParameterNames.ClientIdMetadataDocumentSupported, out JsonElement flag),
+            $"client_id_metadata_document_supported must be present over the real wire. Body={discoveryBody}");
+        Assert.IsTrue(flag.GetBoolean());
+
+        Assert.AreEqual(0, documentHost.TotalRequests,
+            "Discovery emission must never itself trigger a CIMD document fetch (privacy §9.1).");
+    }
+
+
+    /// <summary>
+    /// Appendix A CIMD Service, positive half (CIMD-062/064/066/067): a client provisioned through a
+    /// <see cref="CimdServiceHost"/> drives a full auth-code flow exactly like a self-hosted document
+    /// would, developer-supplied information is recorded, and — negative half (CIMD-065/067/035
+    /// interplay) — once the pinned clock advances past the provision's lifetime, the service answers
+    /// 404 and a FRESH authorization request aborts rather than proceeding on stale data.
+    /// </summary>
+    [TestMethod]
+    public async Task CimdService_ProvisionedClientDrivesFullFlow_DeveloperInfoRecorded_ExpiryAbortsFreshRequest()
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using CimdServiceHost cimdService = await CimdServiceHost.StartAsync(
+            timeProvider, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Uri redirectUri = new("https://developer.example/cb");
+        Uri clientIdentifierUrl = cimdService.ProvisionClient(
+            redirectUris: [redirectUri],
+            lifetime: TimeSpan.FromMinutes(10),
+            developerInfo: "team-mobile");
+
+        await using TestHostShell app = new(timeProvider);
+        ClientRecord stub = app.RegisterCimdStubClient(
+            clientIdentifierUrl,
+            ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                WellKnownCapabilityIdentifiers.OAuthPushedAuthorization),
+            profile: PolicyProfile.Rfc6749WithPkce);
+
+        app.WireCimdMaterialization("default", cimdService.Certificate);
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> flowStore) =
+            await app.CreateOAuthClientAndRegistrationAsync(
+                stub, redirectUri.OriginalString, profile: PolicyProfile.Rfc6749WithPkce, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+        HostedAuthorizationServer hosted = app.Host("default");
+        string segment = stub.TenantId.Value;
+
+        string flowId = await DriveParAuthorizeAndCallbackAsync(
+            hosted, client, registration, flowStore, segment, redirectUri, SubjectId, app.ServerCertificate,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult tokenResult = await client.AuthCode.ExchangeTokenAsync(
+            registration, flowId, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, tokenResult.Outcome,
+            $"A CIMD Service-provisioned client must drive a full auth-code flow. ErrorCode={tokenResult.ErrorCode}");
+
+        Assert.IsTrue(cimdService.WasRequested(clientIdentifierUrl),
+            "The CIMD Service document must have been fetched over the real wire.");
+        Assert.AreEqual("team-mobile", cimdService.DeveloperInfo(clientIdentifierUrl),
+            "CIMD-066: developer-supplied information about the client under development must be recorded.");
+
+        //CIMD-065: the service expires the provision, measured against the injected TimeProvider.
+        timeProvider.Advance(TimeSpan.FromMinutes(11));
+
+        //CIMD-035/067 interplay: a fresh authorization request against an expired provision aborts —
+        //the document now 404s, so materialization's resolver call fails and the request never redirects.
+        AuthCodeFlowEndpointResult secondPar = await client.AuthCode.StartParAsync(
+            registration, redirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, secondPar.Outcome,
+            "A fresh authorization request against an expired CIMD Service provision must abort, not redirect.");
+        Assert.AreEqual(OAuthErrors.InvalidRequest, secondPar.ErrorCode);
+    }
+
+
+    /// <summary>
+    /// Appendix A CIMD Service, the redirect-restriction exemption (CIMD-063): an AS that layers an
+    /// additional same-origin-with-<c>client_id</c> restriction on <c>redirect_uris</c> (via the §4
+    /// <see cref="ClientIdMetadataDocumentResolverOptions.AdditionalDocumentValidation"/> extension
+    /// point, CIMD-020) exempts documents served from a CIMD Service's own origin — proven by
+    /// contrasting the SAME cross-origin redirect_uri accepted from the service origin and rejected
+    /// from an ordinary (non-service) document host under the identical policy.
+    /// </summary>
+    [TestMethod]
+    public async Task CimdService_AdditionalDocumentValidationExemptsServiceOriginFromRedirectOriginRestriction()
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        await using CimdServiceHost cimdService = await CimdServiceHost.StartAsync(
+            timeProvider, TestContext.CancellationToken).ConfigureAwait(false);
+        await using StaticContentHost foreignHost = await StaticContentHost.StartAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        //Neither host's own origin — a hypothetical AS policy requiring redirect_uris to share the
+        //client_id's origin (§8.1) would reject this for an ordinary document.
+        Uri crossOriginRedirect = new("https://developer.example/cb");
+
+        Uri serviceClientIdentifierUrl = cimdService.ProvisionClient(redirectUris: [crossOriginRedirect]);
+
+        const string foreignPath = "/app-foreign";
+        Uri foreignClientIdentifierUrl = new(foreignHost.BaseAddress, foreignPath);
+        PublishCimdDocument(foreignHost, foreignPath, foreignClientIdentifierUrl, [crossOriginRedirect]);
+
+        Uri serviceOrigin = cimdService.BaseAddress;
+        AdditionalClientIdMetadataDocumentValidationDelegate sameOriginUnlessServiceOrigin =
+            (document, clientMetadataUri, context, cancellationToken) =>
+            {
+                bool isServiceOrigin = string.Equals(
+                    clientMetadataUri.Authority, serviceOrigin.Authority, StringComparison.OrdinalIgnoreCase);
+                if(isServiceOrigin)
+                {
+                    //CIMD-063: at least one CIMD Service is exempt from the AS's redirect_uri origin
+                    //restriction, so developers are not blocked by it.
+                    return ValueTask.FromResult(true);
+                }
+
+                bool allSameOrigin = document.RedirectUris.All(uri =>
+                    string.Equals(uri.Authority, clientMetadataUri.Authority, StringComparison.OrdinalIgnoreCase));
+
+                return ValueTask.FromResult(allSameOrigin);
+            };
+
+        using HttpClient pinnedHttpClient =
+            LoopbackTls.CreatePinnedHttpClient([cimdService.Certificate, foreignHost.Certificate]);
+        OutboundTransportDelegate transport = GuardedHttpClientTransport.BuildSingleHopTransport(pinnedHttpClient);
+        ClientIdMetadataDocumentResolverOptions options = new()
+        {
+            AdditionalDocumentValidation = sameOriginUnlessServiceOrigin
+        };
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(transport, options, timeProvider);
+
+        ClientIdMetadataResolution serviceResolution = await resolve(
+            serviceClientIdentifierUrl, NewLoopbackContext(), TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.IsTrue(serviceResolution.IsResolved,
+            $"CIMD-063: the CIMD Service origin must be exempt from the redirect_uri origin restriction. Defect={serviceResolution.Defect}");
+
+        ClientIdMetadataResolution foreignResolution = await resolve(
+            foreignClientIdentifierUrl, NewLoopbackContext(), TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.InvalidDocument, foreignResolution.Outcome,
+            "A non-service document with the SAME cross-origin redirect_uri must still be rejected by the " +
+            "restriction — proving the CIMD-063 exemption is doing real work, not a no-op policy.");
+    }
+
+
+    /// <summary>
+    /// Drives PAR (a real wire POST) and the browser's authorize GET (a real wire GET with
+    /// auto-redirect disabled and the test subject header standing in for an authenticated session),
+    /// returning the flow identifier and the raw redirect <c>Location</c> for the caller to inspect.
+    /// </summary>
+    private static async Task<(string FlowId, string Location)> DriveParAndAuthorizeAsync(
+        HostedAuthorizationServer hosted,
+        OAuthClient client,
+        ClientRegistration registration,
+        Dictionary<string, FlowState> clientFlowStore,
+        string segment,
+        Uri redirectUri,
+        OAuthFormEncodedFields additionalParFields,
+        string subjectId,
+        X509Certificate2 pinnedCertificate,
+        CancellationToken cancellationToken)
+    {
+        AuthCodeFlowEndpointResult parResult = await client.AuthCode.StartParAsync(
+            registration, redirectUri, additionalParFields, cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, parResult.Outcome,
+            $"PAR must redirect over the real wire. ErrorCode={parResult.ErrorCode} ErrorDescription={parResult.ErrorDescription}");
+
+        string flowId = clientFlowStore.Keys.Single();
+        ParCompletedState parState = (ParCompletedState)clientFlowStore[flowId];
+
+        Uri authorizeUrl = new(
+            hosted.HttpBaseAddress!,
+            $"{TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeAuthorize, segment)}" +
+            $"?{OAuthRequestParameterNames.ClientId}={Uri.EscapeDataString(registration.ClientId.Value)}" +
+            $"&{OAuthRequestParameterNames.RequestUri}={Uri.EscapeDataString(parState.Par.RequestUri.ToString())}");
+
+        using HttpClientHandler noRedirectHandler = LoopbackTls.CreatePinnedHandler(pinnedCertificate);
+        noRedirectHandler.AllowAutoRedirect = false;
+        using HttpClient browserClient = new(noRedirectHandler) { BaseAddress = hosted.HttpBaseAddress };
+        using HttpRequestMessage authorizeRequest = new(HttpMethod.Get, authorizeUrl);
+        authorizeRequest.Headers.Add(AuthorizationServerHttpApplication.TestSubjectHeaderName, subjectId);
+
+        using HttpResponseMessage authorizeResponse = await browserClient
+            .SendAsync(authorizeRequest, cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(302, (int)authorizeResponse.StatusCode,
+            "The authorize endpoint must redirect with the authorization code.");
+
+        return (flowId, authorizeResponse.Headers.Location!.ToString());
+    }
+
+
+    /// <summary>
+    /// <see cref="DriveParAndAuthorizeAsync"/> plus the client-local callback state transition,
+    /// returning the flow identifier ready for token exchange.
+    /// </summary>
+    private static async Task<string> DriveParAuthorizeAndCallbackAsync(
+        HostedAuthorizationServer hosted,
+        OAuthClient client,
+        ClientRegistration registration,
+        Dictionary<string, FlowState> clientFlowStore,
+        string segment,
+        Uri redirectUri,
+        string subjectId,
+        X509Certificate2 pinnedCertificate,
+        CancellationToken cancellationToken)
+    {
+        (string flowId, string location) = await DriveParAndAuthorizeAsync(
+            hosted, client, registration, clientFlowStore, segment, redirectUri, OAuthFormEncodedFields.Empty,
+            subjectId, pinnedCertificate, cancellationToken).ConfigureAwait(false);
+
+        string code = TestBrowser.ExtractQueryParam(location, OAuthRequestParameterNames.Code)
+            ?? throw new InvalidOperationException("Authorize redirect Location missing code.");
+        string? iss = TestBrowser.ExtractQueryParam(location, OAuthRequestParameterNames.Iss);
+
+        Dictionary<string, string> callbackFields = new(StringComparer.Ordinal)
+        {
+            [OAuthRequestParameterNames.Code] = code,
+            [OAuthRequestParameterNames.State] = flowId
+        };
+        if(iss is not null)
+        {
+            callbackFields[OAuthRequestParameterNames.Iss] = iss;
+        }
+
+        AuthCodeFlowEndpointResult callbackResult = await client.AuthCode.HandleCallbackAsync(
+            registration, new OAuthFormEncodedFields(callbackFields), cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, callbackResult.Outcome,
+            $"Callback must succeed. ErrorCode={callbackResult.ErrorCode} ErrorDescription={callbackResult.ErrorDescription}");
+
+        return flowId;
+    }
+
+
+    /// <summary>
+    /// Publishes a Client ID Metadata Document at <paramref name="host"/>'s <paramref name="path"/>
+    /// whose <c>client_id</c> is <paramref name="documentUri"/>'s own <see cref="Uri.OriginalString"/>.
+    /// </summary>
+    private static void PublishCimdDocument(
+        StaticContentHost host, string path, Uri documentUri, IReadOnlyList<Uri>? redirectUris)
+    {
+        string json = BuildCimdDocumentJson(
+            documentUri.OriginalString, redirectUris, tokenEndpointAuthMethod: null, jwksJson: null);
+        host.Publish(path, Encoding.UTF8.GetBytes(json), "application/json");
+    }
+
+
+    //Builds a conformant Client ID Metadata Document (§4): client_id is REQUIRED (CIMD-013) and
+    //always present; every other member is included only when supplied, so an omitted property stays
+    //genuinely absent from the wire JSON. jwksJson is embedded UNQUOTED — it is already a JSON
+    //object's text, mirroring PrivateKeyJwtClientAuthenticationTests' BuildJwksJson convention.
+    //jwksUri is the §8.2 alternative to jwksJson — a confidential client publishes ONE of the two,
+    //never both, so callers pass at most one non-null.
+    private static string BuildCimdDocumentJson(
+        string clientId,
+        IReadOnlyList<Uri>? redirectUris,
+        string? tokenEndpointAuthMethod,
+        string? jwksJson,
+        string? jwksUri = null)
+    {
+        List<string> members = [$"\"client_id\":\"{clientId}\""];
+
+        if(redirectUris is { Count: > 0 })
+        {
+            string uris = string.Join(',', redirectUris.Select(static uri => $"\"{uri.OriginalString}\""));
+            members.Add($"\"redirect_uris\":[{uris}]");
+        }
+
+        if(tokenEndpointAuthMethod is not null)
+        {
+            members.Add($"\"token_endpoint_auth_method\":\"{tokenEndpointAuthMethod}\"");
+        }
+
+        if(jwksJson is not null)
+        {
+            members.Add($"\"jwks\":{jwksJson}");
+        }
+
+        if(jwksUri is not null)
+        {
+            members.Add($"\"jwks_uri\":\"{jwksUri}\"");
+        }
+
+        return "{" + string.Join(',', members) + "}";
+    }
+
+
+    //Hand-built JWKS document text from a DpopJwkUtilities.ToJwk dictionary, mirroring
+    //PrivateKeyJwtClientAuthenticationTests.BuildJwksJson.
+    private static string BuildJwksJson(IReadOnlyDictionary<string, string> jwk, string kid)
+    {
+        StringBuilder sb = new();
+        sb.Append('{').Append('"').Append(WellKnownJwkMemberNames.Keys).Append("\":[{");
+        foreach(KeyValuePair<string, string> member in jwk)
+        {
+            sb.Append('"').Append(member.Key).Append("\":\"").Append(member.Value).Append("\",");
+        }
+
+        sb.Append('"').Append(WellKnownJwkMemberNames.Kid).Append("\":\"").Append(kid).Append("\"}]}");
+
+        return sb.ToString();
+    }
+
+
+    //Flips the FIRST character of the compact JWS's signature segment (the part after the final '.').
+    //The first base64url character of the signature contributes six full bits to the decoded bytes, so
+    //the mutated signature always decodes to a different byte array — unlike flipping the final
+    //character, whose two significant bits a lenient base64url decoder can discard, yielding a no-op
+    //"tamper" that still verifies. The assertion keeps its header.payload.signature shape but no longer
+    //verifies against the client's key.
+    private static string TamperSignature(string compactJws)
+    {
+        int signatureStart = compactJws.LastIndexOf('.') + 1;
+        char first = compactJws[signatureStart];
+        char replacement = first == 'A' ? 'B' : 'A';
+
+        return string.Concat(compactJws.AsSpan(0, signatureStart), replacement.ToString(), compactJws.AsSpan(signatureStart + 1));
+    }
+
+
+    /// <summary>
+    /// A fresh <see cref="ExchangeContext"/> under <see cref="TestHostShell.LoopbackOutboundFetchPolicy"/>
+    /// — mirrors <c>WebFingerCrossWireFlowTests.NewLoopbackContext</c> — for standalone resolver calls
+    /// this suite drives outside a full AS dispatch (pre-registration, the CIMD-063 demonstration).
+    /// </summary>
+    private static ExchangeContext NewLoopbackContext()
+    {
+        ExchangeContext context = new();
+        context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
+
+        return context;
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentReaderTests.cs b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentReaderTests.cs
new file mode 100644
index 00000000..26f973a2
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentReaderTests.cs
@@ -0,0 +1,324 @@
+using System.Linq;
+using System.Text;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Server.Pipeline;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Defect-taxonomy example-based tests for <see cref="ClientIdMetadataDocumentReader.Parse"/> —
+/// draft-ietf-oauth-client-id-metadata-document-02 §4/§4.1/§8.6 (CIMD-013/019/021/022/023/028/058).
+/// </summary>
+[TestClass]
+internal sealed class ClientIdMetadataDocumentReaderTests
+{
+    [TestMethod]
+    public void ParseReturnsNoDefectsForValidFullDocument()
+    {
+        string document = """
+            {
+              "client_id": "https://client.example.com/app",
+              "client_name": "Example Client",
+              "client_uri": "https://client.example.com/",
+              "logo_uri": "https://client.example.com/logo.png",
+              "redirect_uris": ["https://client.example.com/cb"],
+              "grant_types": ["authorization_code", "refresh_token"],
+              "response_types": ["code"],
+              "token_endpoint_auth_method": "private_key_jwt",
+              "scope": "openid profile",
+              "jwks": {"keys": [{"kty":"EC","crv":"P-256",
+                "x":"f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
+                "y":"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"}]},
+              "software_statement": "eyJhbGciOiJSUzI1NiJ9.payload.sig"
+            }
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.AreEqual(ClientIdMetadataDocumentDefects.None, result.Defects);
+        Assert.IsFalse(result.HasDefects);
+        Assert.AreEqual("https://client.example.com/app", result.ClientId);
+        Assert.IsNotNull(result.Metadata);
+        Assert.AreEqual("Example Client", result.Metadata.ClientName);
+        Assert.AreEqual(new Uri("https://client.example.com/"), result.Metadata.ClientUri);
+        Assert.AreEqual(new Uri("https://client.example.com/logo.png"), result.Metadata.LogoUri);
+        Assert.HasCount(1, result.Metadata.RedirectUris);
+        Assert.AreEqual(new Uri("https://client.example.com/cb"), result.Metadata.RedirectUris[0]);
+        Assert.HasCount(2, result.Metadata.GrantTypes);
+        Assert.Contains(GrantType.AuthorizationCode, result.Metadata.GrantTypes);
+        Assert.Contains(GrantType.RefreshToken, result.Metadata.GrantTypes);
+        Assert.HasCount(1, result.Metadata.ResponseTypes);
+        Assert.AreEqual(ResponseType.AuthorizationCode, result.Metadata.ResponseTypes[0]);
+        Assert.AreEqual(ClientAuthenticationMethod.PrivateKeyJwt, result.Metadata.TokenEndpointAuthMethod!.Value);
+        Assert.AreEqual("openid profile", result.Metadata.Scope);
+        Assert.IsNotNull(result.Metadata.Jwks);
+        Assert.Contains("\"keys\"", result.Metadata.Jwks, StringComparison.Ordinal);
+        Assert.AreEqual("eyJhbGciOiJSUzI1NiJ9.payload.sig", result.Metadata.SoftwareStatement);
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsMissingClientId()
+    {
+        ClientIdMetadataDocumentReadResult result = Parse("""{"client_name":"No Id Client"}""");
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.MissingClientId));
+        Assert.IsNull(result.ClientId);
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsClientSecretPresent()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app","client_secret":"s3cr3t"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.ClientSecretFieldsPresent));
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsClientSecretExpiresAtPresent()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app","client_secret_expires_at":1735689600}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.ClientSecretFieldsPresent));
+    }
+
+
+    [TestMethod]
+    [DataRow("client_secret_post")]
+    [DataRow("client_secret_basic")]
+    [DataRow("client_secret_jwt")]
+    public void ParseFlagsEachSymmetricAuthMethod(string wireValue)
+    {
+        string document = $$"""
+            {"client_id":"https://client.example.com/app","token_endpoint_auth_method":"{{wireValue}}"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.SymmetricAuthMethod));
+        Assert.IsNull(result.Metadata!.TokenEndpointAuthMethod);
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsUnknownAuthMethod()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app","token_endpoint_auth_method":"quantum_signed_jwt"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.UnknownAuthMethod));
+        Assert.IsFalse(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.SymmetricAuthMethod));
+        Assert.IsNull(result.Metadata!.TokenEndpointAuthMethod);
+    }
+
+
+    [TestMethod]
+    [DataRow("none", 0)]
+    [DataRow("private_key_jwt", 4)]
+    [DataRow("tls_client_auth", 5)]
+    [DataRow("self_signed_tls_client_auth", 6)]
+    [DataRow("attest_jwt_client_auth", 7)]
+    [DataRow("spiffe_jwt", 8)]
+    public void ParseAcceptsKnownNonSymmetricAuthMethods(string wireValue, int expectedCode)
+    {
+        string document = $$"""
+            {"client_id":"https://client.example.com/app","token_endpoint_auth_method":"{{wireValue}}"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.AreEqual(ClientIdMetadataDocumentDefects.None, result.Defects);
+        Assert.IsNotNull(result.Metadata!.TokenEndpointAuthMethod);
+        Assert.AreEqual(expectedCode, result.Metadata.TokenEndpointAuthMethod!.Value.Code);
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsPrivateKeyMaterialForOctJwkWithK()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app",
+             "jwks":{"keys":[{"kty":"oct","k":"c2VjcmV0LXZhbHVl"}]}}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.PrivateKeyMaterialInJwks));
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsPrivateKeyMaterialForEcJwkWithD()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app",
+             "jwks":{"keys":[{"kty":"EC","crv":"P-256",
+               "x":"f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
+               "y":"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
+               "d":"jpsQnnGQmL-YBIffH1136cspYG6-0iY7X1fCE9-E9LI"}]}}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.PrivateKeyMaterialInJwks));
+    }
+
+
+    [TestMethod]
+    public void ParseAcceptsPublicOnlyJwks()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app",
+             "jwks":{"keys":[{"kty":"EC","crv":"P-256",
+               "x":"f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
+               "y":"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"}]}}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsFalse(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.PrivateKeyMaterialInJwks));
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsJavascriptSchemeJwksUri()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app","jwks_uri":"javascript:alert(1)"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.InvalidJwksUri));
+        Assert.IsNull(result.Metadata!.JwksUri);
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsRelativeLogoUri()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app","logo_uri":"/relative/logo.png"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.InvalidLogoUri));
+        Assert.IsNull(result.Metadata!.LogoUri);
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsNonHttpsClientUri()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app","client_uri":"http://client.example.com/"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.InvalidClientUri));
+        Assert.IsNull(result.Metadata!.ClientUri);
+    }
+
+
+    [TestMethod]
+    public void ParseFlagsUnparsableRedirectUriEntry()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app",
+             "redirect_uris":["https://client.example.com/cb","not-a-uri"]}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.InvalidRedirectUri));
+        Assert.HasCount(1, result.Metadata!.RedirectUris);
+        Assert.AreEqual(new Uri("https://client.example.com/cb"), result.Metadata.RedirectUris[0]);
+    }
+
+
+    [TestMethod]
+    [DataRow("javascript:alert(document.cookie)")]
+    [DataRow("data:text/html,<script>alert(1)</script>")]
+    [DataRow("vbscript:msgbox(1)")]
+    public void ParseFlagsDangerousSchemeRedirectUri(string dangerousRedirectUri)
+    {
+        string document = $$"""
+            {"client_id":"https://client.example.com/app",
+             "redirect_uris":["https://client.example.com/cb",{{System.Text.Json.JsonSerializer.Serialize(dangerousRedirectUri)}}]}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.InvalidRedirectUri));
+        Assert.HasCount(1, result.Metadata!.RedirectUris);
+        Assert.AreEqual(new Uri("https://client.example.com/cb"), result.Metadata.RedirectUris[0]);
+    }
+
+
+    [TestMethod]
+    public void ParseAcceptsNativeCustomSchemeRedirectUri()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app",
+             "redirect_uris":["com.example.app:/oauth/callback"]}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsFalse(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.InvalidRedirectUri));
+        Assert.HasCount(1, result.Metadata!.RedirectUris);
+        Assert.AreEqual(new Uri("com.example.app:/oauth/callback"), result.Metadata.RedirectUris[0]);
+    }
+
+
+    [TestMethod]
+    public void ParseCarriesSoftwareStatementAndLogoUriThrough()
+    {
+        string document = """
+            {"client_id":"https://client.example.com/app",
+             "logo_uri":"https://client.example.com/logo.png",
+             "software_statement":"eyJhbGciOiJFUzI1NiJ9.claims.sig"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.AreEqual(ClientIdMetadataDocumentDefects.None, result.Defects);
+        Assert.AreEqual(new Uri("https://client.example.com/logo.png"), result.Metadata!.LogoUri);
+        Assert.AreEqual("eyJhbGciOiJFUzI1NiJ9.claims.sig", result.Metadata.SoftwareStatement);
+    }
+
+
+    [TestMethod]
+    public void ParseAccumulatesMultipleDefectsOnOneDocument()
+    {
+        string document = """
+            {"client_secret":"s3cr3t","token_endpoint_auth_method":"client_secret_basic"}
+            """;
+
+        ClientIdMetadataDocumentReadResult result = Parse(document);
+
+        Assert.IsTrue(result.HasDefects);
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.MissingClientId));
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.ClientSecretFieldsPresent));
+        Assert.IsTrue(result.Defects.HasFlag(ClientIdMetadataDocumentDefects.SymmetricAuthMethod));
+    }
+
+
+    private static ClientIdMetadataDocumentReadResult Parse(string document) =>
+        ClientIdMetadataDocumentReader.Parse(Encoding.UTF8.GetBytes(document));
+}
diff --git a/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentsResolvingTests.cs b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentsResolvingTests.cs
new file mode 100644
index 00000000..0a7518f3
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/ClientIdMetadataDocumentsResolvingTests.cs
@@ -0,0 +1,595 @@
+using System.Collections.Generic;
+using System.Text;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Core.OutboundFetch;
+using Verifiable.Foundation;
+using Verifiable.OAuth.Server;
+using Verifiable.OAuth.Server.Pipeline;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Tests for <see cref="ClientIdMetadataDocuments.BuildResolving"/> — the Client ID Metadata
+/// Document fetch-validate-cache pipeline (draft-ietf-oauth-client-id-metadata-document-02
+/// §5). The single-hop transport is scripted (the established outbound-fetch-consumer test
+/// pattern, mirroring <c>WebDidResolverResolvingTests</c>), so the guarded fetch, the
+/// conformance checks, the client_id match, the additional-validation hook, logo prefetch, and
+/// caching are all exercised deterministically without a live network.
+/// </summary>
+[TestClass]
+internal sealed class ClientIdMetadataDocumentsResolvingTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private const string ClientMetadataUrl = "https://client.example.com/app";
+    private const string LogoUrl = "https://client.example.com/logo.png";
+    private const string JwksUrl = "https://client.example.com/jwks.json";
+
+
+    /// <summary>An SSRF-blocked target (a loopback IP literal) is denied before any transport call.</summary>
+    [TestMethod]
+    public async Task PolicyDenialHappensBeforeAnyTransportCall()
+    {
+        ScriptedTransport transport = new();
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(
+            "https://127.0.0.1/app", transport).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.PolicyDenied, resolution.Outcome);
+        Assert.IsEmpty(transport.Calls, "SecureDefault MUST deny a loopback target before any transport call.");
+    }
+
+
+    /// <summary>Any status other than exactly 200 is a fetch failure (CIMD-018/032/033).</summary>
+    [TestMethod]
+    public async Task NonTwoHundredStatusIsFetchFailed()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 404);
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.FetchFailed, resolution.Outcome);
+    }
+
+
+    /// <summary>
+    /// A redirect answer is refused rather than followed (CIMD-034: SecureDefault's
+    /// <see cref="RedirectMode.None"/> never follows a 3xx).
+    /// </summary>
+    [TestMethod]
+    public async Task RedirectAnswerIsRefused()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 302, headers: Headers(("Location", "https://client.example.com/elsewhere")));
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.FetchFailed, resolution.Outcome);
+        Assert.HasCount(1, transport.Calls, "The redirect response itself required one transport call; it must not be followed with a second.");
+    }
+
+
+    /// <summary>A response larger than the configured cap is a fetch failure (CIMD-059), regardless of what the transport reports.</summary>
+    [TestMethod]
+    public async Task OversizedBodyIsFetchFailed()
+    {
+        ScriptedTransport transport = new();
+        string oversizedBody = $$"""{"client_id":"{{ClientMetadataUrl}}","client_name":"{{new string('x', 200)}}"}""";
+        transport.Enqueue(ClientMetadataUrl, 200, oversizedBody, contentType: "application/json");
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(
+            ClientMetadataUrl, transport, options: new ClientIdMetadataDocumentResolverOptions { MaximumDocumentBytes = 32 })
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.FetchFailed, resolution.Outcome);
+    }
+
+
+    /// <summary>A content type that is neither application/json nor a +json suffix is an invalid document (CIMD-019).</summary>
+    [TestMethod]
+    public async Task WrongContentTypeIsInvalidDocument()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl), contentType: "text/html");
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.InvalidDocument, resolution.Outcome);
+    }
+
+
+    /// <summary>An application/&lt;AS-defined&gt;+json structured suffix is accepted (CIMD-019).</summary>
+    [TestMethod]
+    public async Task StructuredPlusJsonContentTypeIsAccepted()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl), contentType: "application/example+json");
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.IsTrue(resolution.IsResolved, $"A +json structured suffix MUST be accepted. Defect: {resolution.Defect}");
+    }
+
+
+    /// <summary>The document's client_id MUST ordinal-equal the URL it was fetched from (CIMD-013/014/015/016).</summary>
+    [TestMethod]
+    public async Task ClientIdMismatchIsInvalidDocument()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson("https://someone-else.example.com/app"), contentType: "application/json");
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.InvalidDocument, resolution.Outcome);
+        Assert.AreEqual("https://someone-else.example.com/app", resolution.DocumentClientId);
+    }
+
+
+    /// <summary>
+    /// The ordinal client_id comparison is exact — a default-port suffix the spec's own example
+    /// calls non-equivalent (CIMD-008/016) is rejected, not silently normalized away.
+    /// </summary>
+    [TestMethod]
+    public async Task DefaultPortSuffixIsNotEquivalentForClientIdMatch()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson("https://client.example.com:443/app"), contentType: "application/json");
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.InvalidDocument, resolution.Outcome);
+    }
+
+
+    /// <summary>A CIMD-020 application-supplied additional restriction can reject an otherwise-conformant document.</summary>
+    [TestMethod]
+    public async Task AdditionalDocumentValidationRejectionIsInvalidDocument()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl), contentType: "application/json");
+
+        ClientIdMetadataDocumentResolverOptions options = new()
+        {
+            AdditionalDocumentValidation = static (document, uri, context, ct) => ValueTask.FromResult(false)
+        };
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport, options).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.InvalidDocument, resolution.Outcome);
+    }
+
+
+    /// <summary>A CIMD-020 additional restriction that accepts the document lets resolution proceed to Resolved.</summary>
+    [TestMethod]
+    public async Task AdditionalDocumentValidationAcceptanceResolves()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl), contentType: "application/json");
+
+        ClientIdMetadataDocumentResolverOptions options = new()
+        {
+            AdditionalDocumentValidation = static (document, uri, context, ct) =>
+                ValueTask.FromResult(string.Equals(uri.OriginalString, ClientMetadataUrl, StringComparison.Ordinal))
+        };
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport, options).ConfigureAwait(false);
+
+        Assert.IsTrue(resolution.IsResolved);
+    }
+
+
+    /// <summary>A fresh cache hit answers without dialing the transport again (CIMD-036/061).</summary>
+    [TestMethod]
+    public async Task FreshCacheHitDoesNotRedial()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl),
+            contentType: "application/json", headers: Headers(("Cache-Control", "max-age=300")));
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport.Delegate, new ClientIdMetadataDocumentResolverOptions(), timeProvider);
+
+        ClientIdMetadataResolution first = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+        ClientIdMetadataResolution second = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+
+        Assert.IsTrue(first.IsResolved);
+        Assert.IsTrue(second.IsResolved);
+        Assert.HasCount(1, transport.Calls, "A fresh cache hit must not re-dial the transport.");
+    }
+
+
+    /// <summary>A stale cache entry re-fetches after the freshness lifetime elapses (CIMD-030).</summary>
+    [TestMethod]
+    public async Task StaleCacheEntryReFetches()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl),
+            contentType: "application/json", headers: Headers(("Cache-Control", "max-age=300")));
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl),
+            contentType: "application/json", headers: Headers(("Cache-Control", "max-age=300")));
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport.Delegate, new ClientIdMetadataDocumentResolverOptions(), timeProvider);
+
+        ClientIdMetadataResolution first = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+        timeProvider.Advance(TimeSpan.FromSeconds(301));
+        ClientIdMetadataResolution second = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+
+        Assert.IsTrue(first.IsResolved);
+        Assert.IsTrue(second.IsResolved);
+        Assert.HasCount(2, transport.Calls, "A stale cache entry must trigger a re-fetch.");
+    }
+
+
+    /// <summary>
+    /// A huge <c>max-age</c> is clamped to <see cref="ClientIdMetadataDocumentResolverOptions.MaximumCacheLifetime"/>
+    /// rather than honored literally (CIMD-038).
+    /// </summary>
+    [TestMethod]
+    public async Task MaxAgeIsClampedByMaximumCacheLifetimeOption()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl),
+            contentType: "application/json", headers: Headers(("Cache-Control", "max-age=999999")));
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl),
+            contentType: "application/json", headers: Headers(("Cache-Control", "max-age=999999")));
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        ClientIdMetadataDocumentResolverOptions options = new() { MaximumCacheLifetime = TimeSpan.FromSeconds(60) };
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport.Delegate, options, timeProvider);
+
+        ClientIdMetadataResolution first = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+        timeProvider.Advance(TimeSpan.FromSeconds(61));
+        ClientIdMetadataResolution second = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+
+        Assert.IsTrue(first.IsResolved);
+        Assert.IsTrue(second.IsResolved);
+        Assert.HasCount(2, transport.Calls,
+            "A max-age far beyond MaximumCacheLifetime must be clamped down, not honored literally.");
+    }
+
+
+    /// <summary>A 500-then-200 sequence proves an error response was never cached (CIMD-039).</summary>
+    [TestMethod]
+    public async Task ErrorResponseIsNeverCached()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 500);
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl), contentType: "application/json");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport.Delegate, new ClientIdMetadataDocumentResolverOptions(), timeProvider);
+
+        ClientIdMetadataResolution first = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+        ClientIdMetadataResolution second = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.FetchFailed, first.Outcome);
+        Assert.IsTrue(second.IsResolved, $"The second call must re-fetch and succeed. Defect: {second.Defect}");
+        Assert.HasCount(2, transport.Calls);
+    }
+
+
+    /// <summary>An invalid-then-valid sequence proves an invalid document was never cached (CIMD-040).</summary>
+    [TestMethod]
+    public async Task InvalidDocumentIsNeverCached()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, """{"client_secret":"leaked"}""", contentType: "application/json");
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl), contentType: "application/json");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport.Delegate, new ClientIdMetadataDocumentResolverOptions(), timeProvider);
+
+        ClientIdMetadataResolution first = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+        ClientIdMetadataResolution second = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+
+        Assert.AreEqual(ClientIdMetadataResolutionOutcome.InvalidDocument, first.Outcome);
+        Assert.IsTrue(second.IsResolved, $"The second call must re-fetch and succeed. Defect: {second.Defect}");
+        Assert.HasCount(2, transport.Calls);
+    }
+
+
+    /// <summary>Logo prefetch (CIMD-060) fetches logo_uri through the same guarded policy and returns its bytes.</summary>
+    [TestMethod]
+    public async Task LogoPrefetchSucceedsWhenEnabled()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, DocumentWithLogoJson(ClientMetadataUrl, LogoUrl), contentType: "application/json");
+        byte[] logoBytes = [0x89, 0x50, 0x4E, 0x47];
+        transport.Enqueue(LogoUrl, 200, logoBytes, contentType: "image/png");
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(
+            ClientMetadataUrl, transport, options: new ClientIdMetadataDocumentResolverOptions { PrefetchLogo = true })
+            .ConfigureAwait(false);
+
+        Assert.IsTrue(resolution.IsResolved);
+        Assert.IsNotNull(resolution.PrefetchedLogo);
+        CollectionAssert.AreEqual(logoBytes, resolution.PrefetchedLogo!.Value.ToArray());
+        Assert.AreEqual("image/png", resolution.PrefetchedLogoContentType);
+        Assert.Contains(LogoUrl, transport.Calls.ConvertAll(static c => c.Target.AbsoluteUri));
+    }
+
+
+    /// <summary>A failed logo prefetch is SHOULD-tier and never fails the surrounding document resolution.</summary>
+    [TestMethod]
+    public async Task LogoPrefetchFailureIsNonFatal()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, DocumentWithLogoJson(ClientMetadataUrl, LogoUrl), contentType: "application/json");
+        transport.Enqueue(LogoUrl, 500);
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(
+            ClientMetadataUrl, transport, options: new ClientIdMetadataDocumentResolverOptions { PrefetchLogo = true })
+            .ConfigureAwait(false);
+
+        Assert.IsTrue(resolution.IsResolved, $"A failed logo prefetch must not fail document resolution. Defect: {resolution.Defect}");
+        Assert.IsNull(resolution.PrefetchedLogo);
+    }
+
+
+    /// <summary>Logo prefetch is opt-in: disabled by default, no logo fetch happens even when logo_uri is present.</summary>
+    [TestMethod]
+    public async Task LogoIsNotPrefetchedWhenDisabled()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, DocumentWithLogoJson(ClientMetadataUrl, LogoUrl), contentType: "application/json");
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.IsTrue(resolution.IsResolved);
+        Assert.IsNull(resolution.PrefetchedLogo);
+        Assert.DoesNotContain(LogoUrl, transport.Calls.ConvertAll(static c => c.Target.AbsoluteUri));
+    }
+
+
+    /// <summary>
+    /// A <c>Cache-Control: no-cache</c> response is never served fresh even when the deployment
+    /// configures a <see cref="ClientIdMetadataDocumentResolverOptions.MinimumCacheLifetime"/> floor:
+    /// the floor must not manufacture freshness the headers denied (RFC 9111 §5.2.2.4), so the second
+    /// flow re-fetches (CIMD-030/037).
+    /// </summary>
+    [TestMethod]
+    public async Task NoCacheIsNotCachedEvenWithAMinimumCacheLifetimeFloor()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl),
+            contentType: "application/json", headers: Headers(("Cache-Control", "no-cache")));
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl),
+            contentType: "application/json", headers: Headers(("Cache-Control", "no-cache")));
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        ClientIdMetadataDocumentResolverOptions options = new() { MinimumCacheLifetime = TimeSpan.FromMinutes(5) };
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport.Delegate, options, timeProvider);
+
+        ClientIdMetadataResolution first = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+        ClientIdMetadataResolution second = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+
+        Assert.IsTrue(first.IsResolved);
+        Assert.IsTrue(second.IsResolved);
+        Assert.HasCount(2, transport.Calls,
+            "A no-cache response must revalidate before reuse; a MinimumCacheLifetime floor must not cache it.");
+    }
+
+
+    /// <summary>
+    /// A document with no cache headers IS eligible for a
+    /// <see cref="ClientIdMetadataDocumentResolverOptions.MinimumCacheLifetime"/> floor (CIMD-038): the
+    /// second flow within the floor is a cache hit — distinguishing an absent expiration signal from an
+    /// explicit no-cache.
+    /// </summary>
+    [TestMethod]
+    public async Task NoCacheHeadersAreEligibleForTheMinimumCacheLifetimeFloor()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, ValidDocumentJson(ClientMetadataUrl), contentType: "application/json");
+
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        ClientIdMetadataDocumentResolverOptions options = new() { MinimumCacheLifetime = TimeSpan.FromMinutes(5) };
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport.Delegate, options, timeProvider);
+
+        ClientIdMetadataResolution first = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+        timeProvider.Advance(TimeSpan.FromMinutes(1));
+        ClientIdMetadataResolution second = await Resolve(resolve, ClientMetadataUrl).ConfigureAwait(false);
+
+        Assert.IsTrue(first.IsResolved);
+        Assert.IsTrue(second.IsResolved);
+        Assert.HasCount(1, transport.Calls,
+            "A document with no cache directives is heuristic-eligible for the configured floor.");
+    }
+
+
+    /// <summary>
+    /// A private_key_jwt client that advertises a <c>jwks_uri</c> instead of an inline <c>jwks</c> — the
+    /// spec's own §8.2 example — has its key set discovered through the same guarded fetch and folded
+    /// inline so the token endpoint can authenticate it (CIMD-048/050).
+    /// </summary>
+    [TestMethod]
+    public async Task JwksUriConfidentialClientHasItsKeySetDiscoveredInline()
+    {
+        const string jwksJson = """{"keys":[{"kty":"EC","crv":"P-256","kid":"k1","x":"f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU","y":"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"}]}""";
+
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, PrivateKeyJwtWithJwksUriDocument(ClientMetadataUrl, JwksUrl),
+            contentType: "application/json");
+        transport.Enqueue(JwksUrl, 200, jwksJson, contentType: "application/json");
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.IsTrue(resolution.IsResolved, $"Resolution must succeed. Defect: {resolution.Defect}");
+        Assert.IsNotNull(resolution.Document!.Jwks, "The jwks_uri key set must be discovered and folded inline.");
+        Assert.Contains("f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU", resolution.Document.Jwks!, StringComparison.Ordinal);
+        Assert.Contains(JwksUrl, transport.Calls.ConvertAll(static c => c.Target.AbsoluteUri));
+    }
+
+
+    /// <summary>
+    /// A jwks_uri discovery failure is fail-closed but non-fatal to the resolution: the document still
+    /// resolves (the authorization front channel proceeds) with no inline key, so the token endpoint
+    /// later rejects the client for want of a key (CIMD-050).
+    /// </summary>
+    [TestMethod]
+    public async Task JwksUriDiscoveryFailureLeavesTheKeySetUnsetButResolves()
+    {
+        ScriptedTransport transport = new();
+        transport.Enqueue(ClientMetadataUrl, 200, PrivateKeyJwtWithJwksUriDocument(ClientMetadataUrl, JwksUrl),
+            contentType: "application/json");
+        transport.Enqueue(JwksUrl, 500);
+
+        ClientIdMetadataResolution resolution = await ResolveAsync(ClientMetadataUrl, transport).ConfigureAwait(false);
+
+        Assert.IsTrue(resolution.IsResolved, $"A jwks_uri discovery failure must not fail resolution. Defect: {resolution.Defect}");
+        Assert.IsNull(resolution.Document!.Jwks, "A failed jwks_uri discovery must leave the inline key set unset.");
+    }
+
+
+    //Runs the resolving delegate once against a freshly built resolver over the scripted transport.
+    private async Task<ClientIdMetadataResolution> ResolveAsync(
+        string clientMetadataUri,
+        ScriptedTransport transport,
+        ClientIdMetadataDocumentResolverOptions? options = null)
+    {
+        FakeTimeProvider timeProvider = new(TestClock.CanonicalEpoch);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport.Delegate, options ?? new ClientIdMetadataDocumentResolverOptions(), timeProvider);
+
+        return await Resolve(resolve, clientMetadataUri).ConfigureAwait(false);
+    }
+
+
+    private async Task<ClientIdMetadataResolution> Resolve(ResolveClientMetadataDelegate resolve, string clientMetadataUri)
+    {
+        ExchangeContext context = new();
+        context.SetOutboundFetchPolicy(OutboundFetchPolicy.SecureDefault);
+
+        return await resolve(new Uri(clientMetadataUri, UriKind.Absolute), context, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+    }
+
+
+    private static string ValidDocumentJson(string clientId) =>
+        $$"""{"client_id":"{{clientId}}"}""";
+
+
+    private static string DocumentWithLogoJson(string clientId, string logoUri) =>
+        $$"""{"client_id":"{{clientId}}","logo_uri":"{{logoUri}}"}""";
+
+
+    private static string PrivateKeyJwtWithJwksUriDocument(string clientId, string jwksUri) =>
+        $$"""{"client_id":"{{clientId}}","token_endpoint_auth_method":"private_key_jwt","jwks_uri":"{{jwksUri}}"}""";
+
+
+    private static Dictionary<string, string> Headers(params (string Name, string Value)[] headers)
+    {
+        Dictionary<string, string> result = new(StringComparer.OrdinalIgnoreCase);
+        foreach((string name, string value) in headers)
+        {
+            result[name] = value;
+        }
+
+        return result;
+    }
+
+
+    //A single-hop transport that plays back a scripted sequence of (status, body, headers) per
+    //absolute URL — each call to a routed URL dequeues the next scripted response, sticking to
+    //the last one once the sequence is exhausted; an unrouted URL is a 404. Bodies are carried as
+    //TaggedMemory<byte>, mirroring the production OutboundResponse shape.
+    private sealed class ScriptedTransport
+    {
+        private readonly Dictionary<string, List<ScriptedResponse>> routes = new(StringComparer.Ordinal);
+        private readonly Dictionary<string, int> callIndex = new(StringComparer.Ordinal);
+
+
+        public List<OutboundRequest> Calls { get; } = [];
+
+
+        public void Enqueue(
+            string url, int status, string? body = null, string? contentType = null,
+            IReadOnlyDictionary<string, string>? headers = null)
+        {
+            Dictionary<string, string> merged = headers is null
+                ? new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+                : new Dictionary<string, string>(headers, StringComparer.OrdinalIgnoreCase);
+
+            if(contentType is not null)
+            {
+                merged["Content-Type"] = contentType;
+            }
+
+            byte[]? bodyBytes = body is null ? null : Encoding.UTF8.GetBytes(body);
+            EnqueueRoute(url, status, bodyBytes, merged);
+        }
+
+
+        public void Enqueue(
+            string url, int status, byte[] body, string? contentType = null,
+            IReadOnlyDictionary<string, string>? headers = null)
+        {
+            Dictionary<string, string> merged = headers is null
+                ? new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+                : new Dictionary<string, string>(headers, StringComparer.OrdinalIgnoreCase);
+
+            if(contentType is not null)
+            {
+                merged["Content-Type"] = contentType;
+            }
+
+            EnqueueRoute(url, status, body, merged);
+        }
+
+
+        private void EnqueueRoute(string url, int status, byte[]? body, IReadOnlyDictionary<string, string> headers)
+        {
+            if(!routes.TryGetValue(url, out List<ScriptedResponse>? list))
+            {
+                list = [];
+                routes[url] = list;
+            }
+
+            list.Add(new ScriptedResponse(status, body, headers));
+        }
+
+
+        public OutboundTransportDelegate Delegate => (request, context, cancellationToken) =>
+        {
+            Calls.Add(request);
+
+            string url = request.Target.AbsoluteUri;
+            ScriptedResponse response;
+            if(routes.TryGetValue(url, out List<ScriptedResponse>? list) && list.Count > 0)
+            {
+                int index = callIndex.TryGetValue(url, out int current) ? current : 0;
+                response = list[Math.Min(index, list.Count - 1)];
+                callIndex[url] = index + 1;
+            }
+            else
+            {
+                response = new ScriptedResponse(404, null, new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase));
+            }
+
+            TaggedMemory<byte> responseBody = response.Body is null
+                ? TaggedMemory<byte>.Empty
+                : new TaggedMemory<byte>(response.Body, BufferTags.Json);
+
+            return ValueTask.FromResult(new OutboundResponse
+            {
+                StatusCode = response.Status,
+                Headers = response.Headers,
+                Body = responseBody
+            });
+        };
+
+
+        private sealed record ScriptedResponse(int Status, byte[]? Body, IReadOnlyDictionary<string, string> Headers);
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/ClientIdentifierUrlTests.cs b/test/Verifiable.Tests/OAuth/ClientIdentifierUrlTests.cs
new file mode 100644
index 00000000..f31955fd
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/ClientIdentifierUrlTests.cs
@@ -0,0 +1,337 @@
+using Verifiable.OAuth;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Vector-table coverage for <see cref="ClientIdentifierUrl"/> against
+/// <see href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-3">
+/// draft-ietf-oauth-client-id-metadata-document-02 Section 3</see>. Every CIMD-001..011 row gets at least
+/// one accepting and one rejecting/flagging vector; CIMD-008/CIMD-016 (RFC 3986 §6.2.1 simple string
+/// comparison) get their own ordinal-comparison vectors. CIMD-009/CIMD-010 (short/stable URL RECOMMENDED)
+/// have no machine-checkable shape and are covered only by the doc-comment guidance on
+/// <see cref="ClientIdentifierUrl"/> itself — no test represents them.
+/// </summary>
+[TestClass]
+internal sealed class ClientIdentifierUrlTests
+{
+    [TestMethod]
+    //Baseline: every Section 3 MUST/MUST NOT rule satisfied.
+    [DataRow("https://example.com/client", true)]
+    [DataRow("https://example.com/path/to/client", true)]
+
+    //CIMD-003: a port MAY be present, default or otherwise, without becoming a defect.
+    [DataRow("https://example.com:8443/client", true)]
+    [DataRow("https://example.com:443/client", true)]
+
+    //CIMD-011: a root path is valid; the NOT RECOMMENDED guidance is advisory only.
+    [DataRow("https://example.com/", true)]
+
+    //CIMD-006: a query component is valid; the SHOULD NOT guidance is advisory only.
+    [DataRow("https://example.com/client?q=1", true)]
+    [DataRow("https://example.com/client?", true)]
+
+    //CIMD-001: the https scheme is required; scheme comparison itself is case-insensitive (RFC 3986 §3.1).
+    [DataRow("http://example.com/client", false)]
+    [DataRow("HTTPS://example.com/client", true)]
+
+    //CIMD-002: no userinfo component, with or without a password subcomponent.
+    [DataRow("https://user@example.com/client", false)]
+    [DataRow("https://user:pass@example.com/client", false)]
+
+    //CIMD-004: a path component is required — an authority-only URL fails.
+    [DataRow("https://example.com", false)]
+
+    //CIMD-005: no single-dot or double-dot path segment, wherever it appears.
+    [DataRow("https://example.com/./client", false)]
+    [DataRow("https://example.com/../client", false)]
+    [DataRow("https://example.com/a/../b", false)]
+    [DataRow("https://example.com/a/./b", false)]
+    [DataRow("https://example.com/..", false)]
+    [DataRow("https://example.com/a..b/c", true)]
+
+    //CIMD-007: no fragment component.
+    [DataRow("https://example.com/client#frag", false)]
+    [DataRow("https://example.com/client?q=1#frag", false)]
+
+    //Not even an absolute https URL: no MUST/MUST NOT-tier flag other than NotAnAbsoluteUrl applies.
+    [DataRow("", false)]
+    [DataRow("not-a-url", false)]
+    [DataRow("https:example.com/client", false)]
+    [DataRow("//example.com/client", false)]
+    [DataRow("://example.com/client", false)]
+    public void ValidateProducesTheExpectedIsValidAcrossTheVectorTable(string candidate, bool expectedIsValid)
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate(candidate);
+
+        Assert.AreEqual(expectedIsValid, result.IsValid, candidate);
+    }
+
+
+    /// <summary>CIMD-001: the https scheme is accepted with no scheme-related defect.</summary>
+    [TestMethod]
+    public void HttpsSchemeIsAccepted()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client");
+
+        Assert.IsFalse(result.NotHttpsScheme);
+        Assert.IsTrue(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-001: a non-https scheme is flagged and fails the MUST-tier aggregate.</summary>
+    [TestMethod]
+    public void NonHttpsSchemeIsRejected()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("http://example.com/client");
+
+        Assert.IsTrue(result.NotHttpsScheme);
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-002: no userinfo component is accepted with no userinfo defect.</summary>
+    [TestMethod]
+    public void AbsentUserinfoIsAccepted()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client");
+
+        Assert.IsFalse(result.HasUserinfo);
+        Assert.IsTrue(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-002: a userinfo component is flagged and fails the MUST-tier aggregate.</summary>
+    [TestMethod]
+    public void PresentUserinfoIsRejected()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://user@example.com/client");
+
+        Assert.IsTrue(result.HasUserinfo);
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-003: a port, default or otherwise, is accepted — MAY never becomes a defect.</summary>
+    [TestMethod]
+    public void PortIsAcceptedWithAndWithoutAnExplicitValue()
+    {
+        ClientIdentifierUrlValidationResult withPort = ClientIdentifierUrl.Validate("https://example.com:8443/client");
+        ClientIdentifierUrlValidationResult withoutPort = ClientIdentifierUrl.Validate("https://example.com/client");
+
+        Assert.IsTrue(withPort.IsValid);
+        Assert.IsTrue(withoutPort.IsValid);
+    }
+
+
+    /// <summary>CIMD-004: a non-empty path is accepted with no missing-path defect.</summary>
+    [TestMethod]
+    public void PresentPathIsAccepted()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client");
+
+        Assert.IsFalse(result.MissingPathComponent);
+        Assert.IsTrue(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-004: an authority-only URL — no path at all — is flagged and rejected.</summary>
+    [TestMethod]
+    public void AbsentPathIsRejected()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com");
+
+        Assert.IsTrue(result.MissingPathComponent);
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-005: a path with no dot segment is accepted with no dot-segment defect.</summary>
+    [TestMethod]
+    public void PathWithoutDotSegmentsIsAccepted()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client");
+
+        Assert.IsFalse(result.HasDotSegments);
+        Assert.IsTrue(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-005: a single-dot path segment is flagged and rejected.</summary>
+    [TestMethod]
+    public void SingleDotSegmentIsRejected()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/./client");
+
+        Assert.IsTrue(result.HasDotSegments);
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-005: a double-dot path segment is flagged and rejected.</summary>
+    [TestMethod]
+    public void DoubleDotSegmentIsRejected()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/../client");
+
+        Assert.IsTrue(result.HasDotSegments);
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>
+    /// CIMD-005 negative control: a segment that merely contains dots, such as <c>a..b</c>, is not a
+    /// dot segment — only a segment that IS exactly <c>.</c> or <c>..</c> counts.
+    /// </summary>
+    [TestMethod]
+    public void SegmentContainingDotsWithoutBeingADotSegmentIsAccepted()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/a..b/c");
+
+        Assert.IsFalse(result.HasDotSegments);
+        Assert.IsTrue(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-006: the query component is absent; the advisory flag stays clear.</summary>
+    [TestMethod]
+    public void AbsentQueryHasNoAdvisory()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client");
+
+        Assert.IsFalse(result.HasQueryComponent);
+    }
+
+
+    /// <summary>CIMD-006: a query component is SHOULD NOT-tier — flagged, but does not fail <see cref="ClientIdentifierUrlValidationResult.IsValid"/>.</summary>
+    [TestMethod]
+    public void PresentQueryIsAdvisoryOnlyAndStaysValid()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client?q=1");
+
+        Assert.IsTrue(result.HasQueryComponent);
+        Assert.IsTrue(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-007: no fragment component is accepted with no fragment defect.</summary>
+    [TestMethod]
+    public void AbsentFragmentIsAccepted()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client");
+
+        Assert.IsFalse(result.HasFragment);
+        Assert.IsTrue(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-007: a fragment component is flagged and fails the MUST-tier aggregate.</summary>
+    [TestMethod]
+    public void PresentFragmentIsRejected()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client#frag");
+
+        Assert.IsTrue(result.HasFragment);
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-011: a path of exactly <c>/</c> is valid; the NOT RECOMMENDED guidance is advisory only.</summary>
+    [TestMethod]
+    public void RootPathIsValidWithTheAdvisoryFlagSet()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/");
+
+        Assert.IsTrue(result.IsRootPath);
+        Assert.IsFalse(result.MissingPathComponent);
+        Assert.IsTrue(result.IsValid);
+    }
+
+
+    /// <summary>CIMD-011 negative control: a non-root path never sets the root-path advisory.</summary>
+    [TestMethod]
+    public void NonRootPathHasNoRootAdvisory()
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate("https://example.com/client");
+
+        Assert.IsFalse(result.IsRootPath);
+    }
+
+
+    /// <summary>
+    /// A candidate lacking the <c>scheme://authority/path</c> shape entirely is flagged
+    /// <see cref="ClientIdentifierUrlValidationResult.NotAnAbsoluteUrl"/>, with every other defect flag
+    /// left at its default since there is no authority or path to inspect.
+    /// </summary>
+    [TestMethod]
+    [DataRow("")]
+    [DataRow("not-a-url")]
+    [DataRow("https:example.com/client")]
+    [DataRow("//example.com/client")]
+    public void CandidateWithoutAbsoluteUrlShapeIsRejected(string candidate)
+    {
+        ClientIdentifierUrlValidationResult result = ClientIdentifierUrl.Validate(candidate);
+
+        Assert.IsTrue(result.NotAnAbsoluteUrl);
+        Assert.IsFalse(result.IsValid);
+        Assert.IsFalse(result.NotHttpsScheme);
+        Assert.IsFalse(result.HasUserinfo);
+        Assert.IsFalse(result.MissingPathComponent);
+        Assert.IsFalse(result.HasDotSegments);
+        Assert.IsFalse(result.HasFragment);
+    }
+
+
+    /// <summary>
+    /// CIMD-008: identical Client Identifier URL strings match — the positive control for
+    /// <see cref="ClientIdentifierUrl.IsMatch"/>.
+    /// </summary>
+    [TestMethod]
+    public void IsMatchAcceptsIdenticalStrings()
+    {
+        Assert.IsTrue(ClientIdentifierUrl.IsMatch("https://example.com/client", "https://example.com/client"));
+    }
+
+
+    /// <summary>
+    /// CIMD-008: the spec's own non-equivalence example — a default-port URL and its portless
+    /// equivalent are NOT the same Client Identifier URL under simple string comparison, even though
+    /// 443 is the https default port.
+    /// </summary>
+    [TestMethod]
+    public void IsMatchRejectsDefaultPortElision()
+    {
+        Assert.IsFalse(ClientIdentifierUrl.IsMatch("https://example.com/client", "https://example.com:443/client"));
+    }
+
+
+    /// <summary>CIMD-008: a trailing-slash variant is a different string under ordinal comparison.</summary>
+    [TestMethod]
+    public void IsMatchRejectsTrailingSlashVariant()
+    {
+        Assert.IsFalse(ClientIdentifierUrl.IsMatch("https://example.com/client", "https://example.com/client/"));
+    }
+
+
+    /// <summary>
+    /// CIMD-008: percent-encoding hex-digit case is not folded — <c>%2F</c> and <c>%2f</c> encode the
+    /// same octet but are different strings under simple string comparison.
+    /// </summary>
+    [TestMethod]
+    public void IsMatchRejectsPercentEncodingCaseVariant()
+    {
+        Assert.IsFalse(ClientIdentifierUrl.IsMatch("https://example.com/a%2Fb", "https://example.com/a%2fb"));
+    }
+
+
+    /// <summary>
+    /// CIMD-016 reuses the same simple-string-comparison rule to match a fetched document's
+    /// <c>client_id</c> value against the URL used to fetch it; scheme-case is not folded here either,
+    /// since <see cref="ClientIdentifierUrl.IsMatch"/> is the whole-string ordinal comparison, distinct
+    /// from <see cref="ClientIdentifierUrl.Validate"/>'s case-insensitive scheme check.
+    /// </summary>
+    [TestMethod]
+    public void IsMatchRejectsSchemeCaseVariant()
+    {
+        Assert.IsFalse(ClientIdentifierUrl.IsMatch("https://example.com/client", "HTTPS://example.com/client"));
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/Contributors/ContributorChainRegressionTests.cs b/test/Verifiable.Tests/OAuth/Contributors/ContributorChainRegressionTests.cs
index 597dc874..3afbd491 100644
--- a/test/Verifiable.Tests/OAuth/Contributors/ContributorChainRegressionTests.cs
+++ b/test/Verifiable.Tests/OAuth/Contributors/ContributorChainRegressionTests.cs
@@ -179,6 +179,7 @@ public async Task StandardClaimIssuerEmitsBaselineForRichOidcClaims()
             Subject = "subject-baseline",
             Scope = "openid profile email address phone",
             ClientId = "client-baseline",
+            GrantType = WellKnownGrantTypes.AuthorizationCode,
             IssuedAt = fixedIssuedAt,
             Confirmation = new ConfirmationMethod { JwkThumbprint = FixedThumbprint }
         };
diff --git a/test/Verifiable.Tests/OAuth/Contributors/ContributorTestFixtures.cs b/test/Verifiable.Tests/OAuth/Contributors/ContributorTestFixtures.cs
index b3315894..92cdc282 100644
--- a/test/Verifiable.Tests/OAuth/Contributors/ContributorTestFixtures.cs
+++ b/test/Verifiable.Tests/OAuth/Contributors/ContributorTestFixtures.cs
@@ -58,6 +58,12 @@ public static IssuanceContext BuildIssuance(
             Subject = "subject-contributor-test",
             Scope = scope,
             ClientId = "client-contributor-test",
+            //The end-user-authenticating grant every contributor fixture assumes: the id_token
+            //target's contributor rules (AcrAmrClaimContributor, OidcStandardClaimsContributor)
+            //model a genuine authorization_code session, and the access-token/UserInfo/
+            //introspection targets built alongside it never read GrantType, so this default is
+            //harmless for every current caller.
+            GrantType = WellKnownGrantTypes.AuthorizationCode,
             IssuedAt = FixedIssuedAt,
             Nonce = null,
             AuthTime = authTime,
diff --git a/test/Verifiable.Tests/OAuth/Contributors/OidcStandardClaimsContributorTests.cs b/test/Verifiable.Tests/OAuth/Contributors/OidcStandardClaimsContributorTests.cs
index 55a89028..53a13066 100644
--- a/test/Verifiable.Tests/OAuth/Contributors/OidcStandardClaimsContributorTests.cs
+++ b/test/Verifiable.Tests/OAuth/Contributors/OidcStandardClaimsContributorTests.cs
@@ -174,6 +174,19 @@ public async Task EmailReturnsNotApplicableForUserInfoTargetWithoutScope()
     }
 
 
+    [TestMethod]
+    public async Task EmailReturnsNotApplicableForAccessTokenTarget()
+    {
+        AccessTokenTarget target = ContributorTestFixtures.BuildAccessTokenTarget("openid email");
+
+        List<Claim> claims = await OidcStandardClaimsContributor.GenerateEmailClaims(
+            target, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.HasCount(1, claims);
+        Assert.AreEqual(ClaimOutcome.NotApplicable, claims[0].Outcome);
+    }
+
+
     //AddressClaims contributor.
 
     [TestMethod]
@@ -231,6 +244,19 @@ public async Task AddressReturnsNotApplicableWhenAllFieldsAreNull()
     }
 
 
+    [TestMethod]
+    public async Task AddressReturnsNotApplicableForAccessTokenTarget()
+    {
+        AccessTokenTarget target = ContributorTestFixtures.BuildAccessTokenTarget("openid address");
+
+        List<Claim> claims = await OidcStandardClaimsContributor.GenerateAddressClaims(
+            target, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.HasCount(1, claims);
+        Assert.AreEqual(ClaimOutcome.NotApplicable, claims[0].Outcome);
+    }
+
+
     //PhoneClaims contributor.
 
     [TestMethod]
@@ -270,6 +296,19 @@ public async Task PhoneReturnsNotApplicableForIntrospectionTarget()
     }
 
 
+    [TestMethod]
+    public async Task PhoneReturnsNotApplicableForAccessTokenTarget()
+    {
+        AccessTokenTarget target = ContributorTestFixtures.BuildAccessTokenTarget("openid phone");
+
+        List<Claim> claims = await OidcStandardClaimsContributor.GeneratePhoneClaims(
+            target, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.HasCount(1, claims);
+        Assert.AreEqual(ClaimOutcome.NotApplicable, claims[0].Outcome);
+    }
+
+
     //UserInfo target wiring.
 
     [TestMethod]
diff --git a/test/Verifiable.Tests/OAuth/Contributors/SubjectIdentifierContributorTests.cs b/test/Verifiable.Tests/OAuth/Contributors/SubjectIdentifierContributorTests.cs
index f894fc7b..7dfdb8e2 100644
--- a/test/Verifiable.Tests/OAuth/Contributors/SubjectIdentifierContributorTests.cs
+++ b/test/Verifiable.Tests/OAuth/Contributors/SubjectIdentifierContributorTests.cs
@@ -104,6 +104,7 @@ private static IdTokenTarget BuildIdTokenTargetWithServer(
             Subject = subject,
             Scope = WellKnownScopes.OpenId,
             ClientId = registration.ClientId,
+            GrantType = WellKnownGrantTypes.AuthorizationCode,
             IssuedAt = ContributorTestFixtures.FixedIssuedAt,
             Nonce = null,
             AuthTime = null
diff --git a/test/Verifiable.Tests/OAuth/CredentialDiVpProofTests.cs b/test/Verifiable.Tests/OAuth/CredentialDiVpProofTests.cs
index 08939b33..db651c25 100644
--- a/test/Verifiable.Tests/OAuth/CredentialDiVpProofTests.cs
+++ b/test/Verifiable.Tests/OAuth/CredentialDiVpProofTests.cs
@@ -488,8 +488,9 @@ public async Task RemoteDidWebHolderResolvesOverRealLoopbackSocketUnderBothPolic
             holderDidDocument, holderPrivate, CredentialNonce, issuerIdentifier).ConfigureAwait(false);
 
         //The did:web method handler dereferences the holder document through the genuine OutboundFetch
-        //chokepoint, driving a real-HttpClient single-hop transport bound to the loopback Kestrel.
-        using HttpClient httpClient = new();
+        //chokepoint, driving a real-HttpClient single-hop transport bound to the loopback Kestrel,
+        //pinned to its certificate rather than a CA — there is no CA in this loopback topology.
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(didWebHost.Certificate);
         DidResolver webResolver = BuildLoopbackFetchingWebDidResolver(httpClient, didWebHost.BaseAddress);
 
         WireDiVpExpectationSeam(host, webResolver);
@@ -718,23 +719,25 @@ private static MinimalHttpResponse ServeDidJson(MinimalHttpRequest request, stri
 
 
     //Builds a DidResolver whose did:web handler dereferences the holder did.json through the genuine
-    //OutboundFetch chokepoint over a REAL HTTP socket. WebDidResolver.Resolve computes the canonical
+    //OutboundFetch chokepoint over a REAL HTTPS socket. WebDidResolver.Resolve computes the canonical
     //https://<authority>/.well-known/did.json URL; the policy on the threaded ExchangeContext gates
-    //that genuine URL (so SecureDefault's loopback block fires honestly). The single-hop transport
-    //then dials the in-process loopback Kestrel, which serves plain http — the same reason
-    //TestHostShell.LoopbackOutboundFetchPolicy exists — so it rewrites the scheme to the listener's
-    //before hitting the socket. The fetch + parse — the work a network DID method does — lives in
-    //test/application code per the library's transport-agnostic discipline.
+    //that genuine URL (so SecureDefault's loopback block fires honestly). The single-hop transport then
+    //dials the in-process loopback Kestrel over HTTPS with the pinned handler carried on httpClient
+    //(LoopbackTls.CreatePinnedHttpClient) — the resolved did:web authority is 'localhost:{port}', which
+    //already matches the listener's own https scheme, so no scheme rewrite is needed. The fetch + parse —
+    //the work a network DID method does — lives in test/application code per the library's
+    //transport-agnostic discipline.
     private static DidResolver BuildLoopbackFetchingWebDidResolver(HttpClient httpClient, Uri loopbackBase)
     {
         OutboundTransportDelegate singleHop = GuardedHttpClientTransport.BuildSingleHopTransport(httpClient);
 
-        //The resolved did:web URL is https://localhost:<port>/...; the loopback Kestrel listens on plain
-        //http. Because the host is a DNS name (localhost), the SecureDefault SSRF block is the connection-time
-        //half: resolve the host and reject if any resolved address is loopback/private. Pinning runs first, so
-        //a SecureDefault policy refuses the loopback fetch before the socket dial; under the explicit permit it
-        //passes. After pinning, rebind the scheme (and only the scheme) to the listener's so the real socket
-        //dial reaches the in-process host. The chokepoint has already evaluated the genuine https URL.
+        //The resolved did:web URL is https://localhost:<port>/..., matching the loopback Kestrel's own
+        //https listener. Because the host is a DNS name (localhost), the SecureDefault SSRF block is the
+        //connection-time half: resolve the host and reject if any resolved address is loopback/private.
+        //Pinning runs first, so a SecureDefault policy refuses the loopback fetch before the socket dial;
+        //under the explicit permit it passes. The scheme rebind below is now a no-op (both sides are
+        //https) but stays, since the chokepoint evaluates the resolved URL's scheme independently of
+        //whatever the transport ultimately dials.
         OutboundTransportDelegate transport = async (request, context, ct) =>
         {
             _ = await SsrfHardenedTransport.ResolveAndPinAsync(
diff --git a/test/Verifiable.Tests/OAuth/DiscoveryEndpointTests.cs b/test/Verifiable.Tests/OAuth/DiscoveryEndpointTests.cs
index fafddebc..2d767cc8 100644
--- a/test/Verifiable.Tests/OAuth/DiscoveryEndpointTests.cs
+++ b/test/Verifiable.Tests/OAuth/DiscoveryEndpointTests.cs
@@ -115,6 +115,48 @@ public async Task DiscoveryIssuerMatchEnforcesSection33ConsumerSide()
     }
 
 
+    /// <summary>
+    /// RFC 9207 §3: "<c>authorization_response_iss_parameter_supported</c> ... If omitted,
+    /// the default value is <c>false</c>." A parsed metadata document that carries no
+    /// <c>authorization_response_iss_parameter_supported</c> member leaves
+    /// <see cref="AuthorizationServerMetadata.AuthorizationResponseIssParameterSupported"/>
+    /// unset, and the type's own default — <c>bool</c>'s C# default — is <see langword="false"/>,
+    /// matching the wire default without any parser-side special-casing.
+    /// </summary>
+    [TestMethod]
+    public void AuthorizationResponseIssParameterSupportedDefaultsToFalseWhenOmitted()
+    {
+        AuthorizationServerMetadata metadataWithoutTheField = new()
+        {
+            Issuer = new Uri("https://as.example.com")
+        };
+
+        Assert.IsFalse(metadataWithoutTheField.AuthorizationResponseIssParameterSupported,
+            "RFC 9207 §3: an omitted authorization_response_iss_parameter_supported must default to false.");
+    }
+
+
+    /// <summary>
+    /// draft-ietf-oauth-client-id-metadata-document-02 §6: <c>client_id_metadata_document_supported</c>
+    /// is "OPTIONAL. Boolean value ...". A parsed metadata document that carries no
+    /// <c>client_id_metadata_document_supported</c> member leaves
+    /// <see cref="AuthorizationServerMetadata.ClientIdMetadataDocumentSupported"/> unset, and the
+    /// type's own default — <c>bool</c>'s C# default — is <see langword="false"/>, matching the
+    /// wire default without any parser-side special-casing.
+    /// </summary>
+    [TestMethod]
+    public void ClientIdMetadataDocumentSupportedDefaultsToFalseWhenOmitted()
+    {
+        AuthorizationServerMetadata metadataWithoutTheField = new()
+        {
+            Issuer = new Uri("https://as.example.com")
+        };
+
+        Assert.IsFalse(metadataWithoutTheField.ClientIdMetadataDocumentSupported,
+            "draft-ietf-oauth-client-id-metadata-document-02 §6: an omitted client_id_metadata_document_supported must default to false.");
+    }
+
+
     [TestMethod]
     public async Task DiscoveryEmitsSubjectTypesSupportedAsPublic()
     {
@@ -416,6 +458,113 @@ public async Task DiscoveryAdvertisesRequireParFalseUnderRfc6749WithPkce()
     }
 
 
+    /// <summary>
+    /// draft-ietf-oauth-client-id-metadata-document-02 §6 dual gate: the flag is emitted
+    /// <see langword="true"/> only when the <see cref="WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument"/>
+    /// capability is allowed AND <see cref="AuthorizationServerIntegration.ResolveClientMetadataAsync"/>
+    /// is wired. The resolver is never invoked by discovery emission (privacy §9.1: discovery/JWKS
+    /// requests must not trigger client-document fetches), so a throwing lambda proves the seam is
+    /// consulted only for its non-null-ness.
+    /// </summary>
+    [TestMethod]
+    public async Task DiscoveryEmitsClientIdMetadataDocumentSupportedWhenCapabilityAllowedAndResolverWired()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        ImmutableHashSet<CapabilityIdentifier> capabilities = ImmutableHashSet.Create(
+            WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+            WellKnownCapabilityIdentifiers.OAuthPushedAuthorization,
+            WellKnownCapabilityIdentifiers.OidcOpenIdConnect,
+            WellKnownCapabilityIdentifiers.OidcUserInfo,
+            WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+            WellKnownCapabilityIdentifiers.OAuthJwksEndpoint,
+            WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce, capabilities: capabilities);
+
+        host.Server.OAuth().ResolveClientMetadataAsync = (uri, context, ct) =>
+            throw new NotImplementedException(
+                "Discovery emission only checks ResolveClientMetadataAsync for non-null-ness; it must never invoke it.");
+
+        ServerHttpResponse response = await DispatchDiscoveryAsync(host, material)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(200, response.StatusCode, response.Body);
+
+        using JsonDocument body = JsonDocument.Parse(response.Body);
+        Assert.IsTrue(
+            body.RootElement.TryGetProperty(
+                AuthorizationServerMetadataParameterNames.ClientIdMetadataDocumentSupported,
+                out JsonElement flag),
+            $"client_id_metadata_document_supported must be present when the capability is allowed " +
+            $"and the resolver is wired. Body: {response.Body}");
+        Assert.IsTrue(flag.GetBoolean(),
+            "draft-ietf-oauth-client-id-metadata-document-02 §6 advertises true under the dual gate.");
+    }
+
+
+    /// <summary>
+    /// Fail-closed half of the §6 dual gate: the capability is allowed but
+    /// <see cref="AuthorizationServerIntegration.ResolveClientMetadataAsync"/> is left unwired, so
+    /// the flag must be omitted rather than advertised as <see langword="false"/> — an AS that
+    /// cannot resolve CIMD documents at all does not claim the capability on the wire.
+    /// </summary>
+    [TestMethod]
+    public async Task DiscoveryOmitsClientIdMetadataDocumentSupportedWhenResolverUnwired()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        ImmutableHashSet<CapabilityIdentifier> capabilities = ImmutableHashSet.Create(
+            WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+            WellKnownCapabilityIdentifiers.OAuthPushedAuthorization,
+            WellKnownCapabilityIdentifiers.OidcOpenIdConnect,
+            WellKnownCapabilityIdentifiers.OidcUserInfo,
+            WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+            WellKnownCapabilityIdentifiers.OAuthJwksEndpoint,
+            WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce, capabilities: capabilities);
+
+        ServerHttpResponse response = await DispatchDiscoveryAsync(host, material)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(200, response.StatusCode, response.Body);
+
+        using JsonDocument body = JsonDocument.Parse(response.Body);
+        Assert.IsFalse(
+            body.RootElement.TryGetProperty(
+                AuthorizationServerMetadataParameterNames.ClientIdMetadataDocumentSupported, out _),
+            $"client_id_metadata_document_supported must be omitted when the resolver seam is unwired. Body: {response.Body}");
+    }
+
+
+    /// <summary>
+    /// Fail-closed half of the §6 dual gate: the resolver is wired but the registration does not
+    /// carry <see cref="WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument"/> (the default
+    /// <see cref="TestHostShell.RegisterDpopClient"/> capability set), so the flag must be omitted.
+    /// </summary>
+    [TestMethod]
+    public async Task DiscoveryOmitsClientIdMetadataDocumentSupportedWhenCapabilityMissing()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        host.Server.OAuth().ResolveClientMetadataAsync = (uri, context, ct) =>
+            throw new NotImplementedException(
+                "Discovery emission only checks ResolveClientMetadataAsync for non-null-ness; it must never invoke it.");
+
+        ServerHttpResponse response = await DispatchDiscoveryAsync(host, material)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(200, response.StatusCode, response.Body);
+
+        using JsonDocument body = JsonDocument.Parse(response.Body);
+        Assert.IsFalse(
+            body.RootElement.TryGetProperty(
+                AuthorizationServerMetadataParameterNames.ClientIdMetadataDocumentSupported, out _),
+            $"client_id_metadata_document_supported must be omitted when the capability is not allowed. Body: {response.Body}");
+    }
+
+
     [TestMethod]
     public async Task DiscoveryAdvertisesDpopSigningAlgValuesWhenDpopIsWired()
     {
diff --git a/test/Verifiable.Tests/OAuth/DpopBoundRefreshTests.cs b/test/Verifiable.Tests/OAuth/DpopBoundRefreshTests.cs
new file mode 100644
index 00000000..e851bbc5
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/DpopBoundRefreshTests.cs
@@ -0,0 +1,202 @@
+using System.Linq;
+using System.Net.Http;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.AuthCode.States;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Server;
+using Verifiable.Server;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Real-wire proof that <see cref="AuthCodeFlowHandlers.RefreshAsync(RefreshTokenRequest, OAuthClientInfrastructure, ClientRegistration, ExchangeContext, ClientAssertionOptions?, System.Threading.CancellationToken)"/>
+/// carries a DPoP-sender-constrained refresh token through the SAME internal DPoP-retry path the
+/// code-exchange leg uses: a fresh proof for <see cref="OAuthClientInfrastructure.DpopKey"/> is attached to the refresh
+/// POST and a <c>use_dpop_nonce</c> challenge (RFC 9449 §8.1) is honoured. Before this fix the refresh
+/// leg posted through <see cref="OAuthClientInfrastructure.SendFormPostAsync"/> directly, carrying no
+/// <c>DPoP</c> header at all, so a DPoP-bound refresh token always drew <c>invalid_dpop_proof</c> from
+/// <see cref="Verifiable.OAuth.AuthCode.Server.DpopTokenEndpointValidation"/> (which requires DPoP on
+/// the refresh grant whenever the stored <see cref="Verifiable.OAuth.AuthCode.Server.States.ServerRefreshTokenIssuedState.Confirmation"/>
+/// is non-empty) — a passing refresh here therefore proves the proof was attached, not that the
+/// server never checked.
+/// </summary>
+[TestClass]
+internal sealed class DpopBoundRefreshTests
+{
+    /// <summary>MSTest's per-test context, supplying the cancellation token every wire call runs under.</summary>
+    public TestContext TestContext { get; set; } = null!;
+
+    /// <summary>The clock the host and the client share.</summary>
+    private FakeTimeProvider TimeProvider { get; } = new(TestClock.CanonicalEpoch);
+
+    private const string ClientId = "https://dpop-refresh.client.test";
+
+    private const string SubjectId = "subject-dpop-refresh-01";
+
+    private static Uri ClientBaseUri { get; } = new(ClientId);
+
+    private static Uri RedirectUri { get; } = new("https://client.example.com/callback");
+
+
+    /// <summary>
+    /// A client whose access AND refresh tokens are DPoP-sender-constrained (HAIP 1.0, the profile
+    /// <see cref="TestHostShell.RegisterDpopClient"/> requires by default) refreshes THROUGH the real
+    /// <see cref="AuthCodeClient.RefreshAsync(ClientRegistration, RefreshTokenRequest, System.Threading.CancellationToken)"/>
+    /// entry point and the AS accepts it — no <c>invalid_dpop_proof</c>. The refreshed access token
+    /// still carries <c>token_type=DPoP</c> and the SAME <c>cnf.jkt</c> binding the original issuance
+    /// established, proving the proof presented on refresh is for the same key.
+    /// </summary>
+    [TestMethod]
+    public async Task DpopSenderConstrainedRefreshTokenRefreshesThroughRealClientAsync()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(ClientId, ClientBaseUri);
+        host.EnableDpop();
+
+        using DpopClientFixture fixture = await host.CreateDpopEnabledOAuthClientAsync(
+            material.Registration, RedirectUri.OriginalString, TestContext.CancellationToken).ConfigureAwait(false);
+
+        //Step 1 — PAR, over the real wire through the DPoP-wired client.
+        AuthCodeFlowEndpointResult parResult = await fixture.Client.AuthCode.StartParAsync(
+            fixture.Registration, RedirectUri, OAuthFormEncodedFields.Empty, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, parResult.Outcome,
+            $"Expected PAR to yield a redirect. ErrorCode={parResult.ErrorCode} ErrorDescription={parResult.ErrorDescription}");
+
+        string flowId = fixture.ClientFlowStore.Keys.Single();
+        ParCompletedState parCompleted = (ParCompletedState)fixture.ClientFlowStore[flowId];
+
+        //Step 2 — Authorize, dispatched in-process on the same EndpointServer instance the Kestrel
+        //host serves (mirrors DpopEndToEndTests / EndSessionLogoutTests) — the user-agent stand-in
+        //authenticates via a pre-set subject on the context rather than a real login UI.
+        RequestFields authorizeFields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.RequestUri] = parCompleted.Par.RequestUri.ToString()
+        };
+        ExchangeContext authorizeContext = new();
+        authorizeContext.SetSubjectId(SubjectId);
+
+        ServerHttpResponse authorizeResponse = await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value, WellKnownEndpointNames.AuthCodeAuthorize,
+            WellKnownHttpMethods.Get, authorizeFields, authorizeContext, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(302, authorizeResponse.StatusCode,
+            $"Expected redirect from authorize. Body: {authorizeResponse.Body}");
+
+        string code = TestBrowser.ExtractQueryParam(authorizeResponse.Location!, OAuthRequestParameterNames.Code)
+            ?? throw new AssertFailedException($"Authorize redirect missing code. Location: {authorizeResponse.Location}");
+        string? iss = TestBrowser.ExtractQueryParam(authorizeResponse.Location!, OAuthRequestParameterNames.Iss);
+
+        //Step 3 — Callback: client-side state transition ready for token exchange.
+        Dictionary<string, string> callbackFields = new(StringComparer.Ordinal)
+        {
+            [OAuthRequestParameterNames.Code] = code,
+            [OAuthRequestParameterNames.State] = flowId
+        };
+        if(iss is not null)
+        {
+            callbackFields[OAuthRequestParameterNames.Iss] = iss;
+        }
+
+        AuthCodeFlowEndpointResult callbackResult = await fixture.Client.AuthCode.HandleCallbackAsync(
+            fixture.Registration, new OAuthFormEncodedFields(callbackFields), TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, callbackResult.Outcome,
+            $"Callback must succeed. ErrorCode={callbackResult.ErrorCode} ErrorDescription={callbackResult.ErrorDescription}");
+
+        //Step 4 — Token, over the real wire. The client has no cached DPoP nonce yet, so the AS
+        //challenges once (RFC 9449 §8.1) and the client retries with the echoed nonce.
+        AuthCodeFlowEndpointResult tokenResult = await fixture.Client.AuthCode.ExchangeTokenAsync(
+            fixture.Registration, flowId, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, tokenResult.Outcome,
+            $"Expected token issuance success. ErrorCode={tokenResult.ErrorCode} ErrorDescription={tokenResult.ErrorDescription}");
+
+        string originalAccessToken = (string)tokenResult.Body![OAuthRequestParameterNames.AccessToken];
+        string originalRefreshToken = (string)tokenResult.Body![OAuthRequestParameterNames.RefreshToken];
+        Assert.IsFalse(string.IsNullOrEmpty(originalRefreshToken), "The initial DPoP-bound issuance must include a refresh_token.");
+        Assert.AreEqual(WellKnownAuthenticationSchemes.DPoP, (string)tokenResult.Body[OAuthRequestParameterNames.TokenType]!,
+            "The initial issuance must be DPoP-bound (token_type=DPoP) for this test to prove anything.");
+
+        //Step 5 — Refresh, over the real wire, through the same real client entry point. Before this
+        //fix RefreshAsync posted with no DPoP header at all, and the AS — requiring DPoP on the
+        //refresh grant because the stored binding is non-empty — rejected with invalid_dpop_proof.
+        RefreshTokenRequest refreshRequest = new()
+        {
+            ClientId = fixture.Registration.ClientId.Value,
+            RefreshToken = originalRefreshToken
+        };
+        AuthCodeFlowEndpointResult refreshResult = await fixture.Client.AuthCode.RefreshAsync(
+            fixture.Registration, refreshRequest, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, refreshResult.Outcome,
+            $"Refresh must succeed over the real wire. ErrorCode={refreshResult.ErrorCode} ErrorDescription={refreshResult.ErrorDescription}");
+
+        string newAccessToken = (string)refreshResult.Body![OAuthRequestParameterNames.AccessToken];
+        Assert.IsFalse(string.IsNullOrEmpty(newAccessToken), "The AS must mint a fresh access token on refresh.");
+        Assert.AreNotEqual(originalAccessToken, newAccessToken,
+            "Refresh must issue a fresh access token, not return the original.");
+        Assert.AreEqual(WellKnownAuthenticationSchemes.DPoP, (string)refreshResult.Body[OAuthRequestParameterNames.TokenType]!,
+            "The refreshed access token must remain DPoP-bound (token_type=DPoP).");
+
+        string expectedThumbprint = fixture.DpopKey.GetThumbprint(TestHostShell.Base64UrlEncoder, TestHostShell.MemoryPool);
+        string wireJkt = JwtPayloadReader.ReadCnfJkt(newAccessToken)
+            ?? throw new AssertFailedException("The refreshed access-token JWT must carry cnf.jkt under DPoP issuance.");
+        Assert.AreEqual(expectedThumbprint, wireJkt,
+            "The refreshed access token's cnf.jkt must equal the SAME DPoP key's RFC 7638 thumbprint the refresh proof was built for.");
+    }
+
+
+    /// <summary>
+    /// A public client with no DPoP wiring at all (<see cref="OAuthClientInfrastructure.DpopKey"/> and
+    /// <see cref="OAuthClientInfrastructure.ConstructDpopProofAsync"/> both <see langword="null"/>)
+    /// still refreshes unchanged through the same <see cref="AuthCodeClient.RefreshAsync(ClientRegistration, RefreshTokenRequest, System.Threading.CancellationToken)"/>
+    /// entry point — the internal DPoP-retry path falls back to a plain
+    /// <see cref="OAuthClientInfrastructure.SendFormPostAsync"/> with no <c>DPoP</c> header when DPoP is
+    /// not wired, so routing the refresh leg through it must not regress the Bearer-only path.
+    /// </summary>
+    [TestMethod]
+    public async Task NonDpopClientStillRefreshesThroughRealClientAsync()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+            await host.CreateOAuthClientAndRegistrationAsync(
+                material.Registration, RedirectUri.OriginalString, profile: PolicyProfile.Rfc6749WithPkce,
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+        using HttpClient browserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(host.ServerCertificate);
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+
+        AuthCodeFlowDriveResult drive = await AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync(
+            hosted, client, registration, clientFlowStore, segment, RedirectUri, SubjectId,
+            browserClient, scope: WellKnownScopes.OpenId, cancellationToken: TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string originalAccessToken = (string)drive.TokenResult.Body![OAuthRequestParameterNames.AccessToken];
+        string originalRefreshToken = (string)drive.TokenResult.Body![OAuthRequestParameterNames.RefreshToken];
+        Assert.AreEqual(WellKnownAuthenticationSchemes.Bearer, (string)drive.TokenResult.Body![OAuthRequestParameterNames.TokenType]!,
+            "This client is not DPoP-wired — the initial issuance must be a plain Bearer token.");
+
+        RefreshTokenRequest refreshRequest = new()
+        {
+            ClientId = registration.ClientId.Value,
+            RefreshToken = originalRefreshToken
+        };
+        AuthCodeFlowEndpointResult refreshResult = await AuthCodeFlowDriver.DriveRefreshAsync(
+            client, registration, refreshRequest, clientAssertionOptions: null, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string newAccessToken = (string)refreshResult.Body![OAuthRequestParameterNames.AccessToken];
+        Assert.AreNotEqual(originalAccessToken, newAccessToken,
+            "Refresh must issue a fresh access token, not return the original.");
+        Assert.AreEqual(WellKnownAuthenticationSchemes.Bearer, (string)refreshResult.Body[OAuthRequestParameterNames.TokenType]!,
+            "Routing the refresh leg through SendTokenRequestWithDpopRetryAsync must not attach a DPoP header for a non-DPoP client.");
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/DpopEndToEndTests.cs b/test/Verifiable.Tests/OAuth/DpopEndToEndTests.cs
index 3e517a99..25e8431d 100644
--- a/test/Verifiable.Tests/OAuth/DpopEndToEndTests.cs
+++ b/test/Verifiable.Tests/OAuth/DpopEndToEndTests.cs
@@ -158,10 +158,10 @@ public async Task TokenIssuanceAndResourceCallValidateUnderDpopProtocol()
 
         //Audit follow-up — RFC 9068 §2 / RFC 8414 §3: the access token's iss
         //claim preserves the full issuer URL including any path component.
-        //Under HTTP, the issuer URI is aligned to the Kestrel base address
-        //(carrying the tenant segment as the path component); read the
-        //live value from the client-side registration that the factory
-        //wired with the aligned URI.
+        //On the real-wire host, the issuer URI is aligned to the https
+        //base address (carrying the tenant segment as the path component);
+        //read the live value from the client-side registration that the
+        //factory wired with the aligned URI.
         string wireIss = JwtPayloadReader.ReadIssuer(accessToken)
             ?? throw new AssertFailedException("Access-token JWT must carry iss claim.");
         Assert.AreEqual(fixture.Registration.AuthorizationServerIssuer.OriginalString, wireIss,
diff --git a/test/Verifiable.Tests/OAuth/FederatedBackChannelLogoutHttpTests.cs b/test/Verifiable.Tests/OAuth/FederatedBackChannelLogoutHttpTests.cs
index cbad6eb1..1602fab4 100644
--- a/test/Verifiable.Tests/OAuth/FederatedBackChannelLogoutHttpTests.cs
+++ b/test/Verifiable.Tests/OAuth/FederatedBackChannelLogoutHttpTests.cs
@@ -4,6 +4,7 @@
 using System.Collections.Immutable;
 using System.Diagnostics.CodeAnalysis;
 using System.Net.Http;
+using System.Security.Cryptography.X509Certificates;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
@@ -124,10 +125,10 @@ public async Task FederatedLogoutPropagatesLogoutTokenToEveryRegisteredRpOverHtt
         List<RegisteredRelyingParty> session = [];
         string rp1IdToken = await IssueIdTokenAsync(op, rp1Material, SsoSessionId).ConfigureAwait(false);
         session.Add(new RegisteredRelyingParty(
-            rp1Material.Registration.ClientId, rp1Material.Registration.BackchannelLogoutUri!));
+            rp1Material.Registration.ClientId, rp1Material.Registration.BackchannelLogoutUri!, rp1.Certificate));
         _ = await IssueIdTokenAsync(op, rp2Material, SsoSessionId).ConfigureAwait(false);
         session.Add(new RegisteredRelyingParty(
-            rp2Material.Registration.ClientId, rp2Material.Registration.BackchannelLogoutUri!));
+            rp2Material.Registration.ClientId, rp2Material.Registration.BackchannelLogoutUri!, rp2.Certificate));
 
         //Each RP now holds a live session keyed by the OP sid.
         rp1.SeedSession(SsoSessionId);
@@ -135,7 +136,6 @@ public async Task FederatedLogoutPropagatesLogoutTokenToEveryRegisteredRpOverHtt
 
         //Wire the OP seams: terminate the local session, then build and POST a Logout
         //Token (aud = that RP's client_id) to every RP in the session over real HTTP.
-        using HttpClient deliveryClient = new();
         op.Server.OAuth().TerminateSessionAsync = (_, _, _, _, _) => ValueTask.CompletedTask;
         op.Server.OAuth().DeliverBackChannelLogoutAsync = async (subject, sessionId, _, _, ct) =>
         {
@@ -158,6 +158,7 @@ public async Task FederatedLogoutPropagatesLogoutTokenToEveryRegisteredRpOverHtt
 
                 using FormUrlEncodedContent content = new(
                     [new KeyValuePair<string, string>(WellKnownTokenTypes.LogoutToken, logoutToken)]);
+                using HttpClient deliveryClient = LoopbackTls.CreatePinnedHttpClient(relyingParty.Certificate);
                 using HttpResponseMessage delivery = await deliveryClient.PostAsync(
                     relyingParty.BackChannelLogoutUri, content, cancellationToken: ct).ConfigureAwait(false);
 
@@ -279,7 +280,8 @@ private static string ExtractCode(string location)
 /// </summary>
 /// <param name="ClientId">The RP's OAuth client identifier.</param>
 /// <param name="BackChannelLogoutUri">The RP's back-channel logout receiver URL.</param>
-internal readonly record struct RegisteredRelyingParty(string ClientId, Uri BackChannelLogoutUri);
+/// <param name="Certificate">The self-signed leaf certificate this RP's HTTPS listener presents; the OP-side delivery client pins to this exact certificate (<see cref="LoopbackTls.CreatePinnedHttpClient"/>) rather than trusting a CA — each RP mints its own certificate, so a single shared delivery client cannot pin across RPs.</param>
+internal readonly record struct RegisteredRelyingParty(string ClientId, Uri BackChannelLogoutUri, X509Certificate2 Certificate);
 
 
 /// <summary>
@@ -318,6 +320,9 @@ private RelyingPartyReceiver(
     /// <summary>The absolute receiver URL the OP delivers this RP's <c>logout_token</c> to.</summary>
     public Uri BackChannelLogoutUri { get; }
 
+    /// <summary>The self-signed leaf certificate this RP's HTTPS listener presents; the OP-side delivery client pins to this exact certificate rather than trusting a CA.</summary>
+    public X509Certificate2 Certificate => host.Certificate;
+
     /// <summary>The <c>sid</c> values this RP has verified and dropped, in arrival order.</summary>
     public IReadOnlyList<string> VerifiedSessionIds => verifiedSessionIds;
 
diff --git a/test/Verifiable.Tests/OAuth/GlobalLogoutCaepEmitHttpTests.cs b/test/Verifiable.Tests/OAuth/GlobalLogoutCaepEmitHttpTests.cs
index 41ccf754..fe74f81b 100644
--- a/test/Verifiable.Tests/OAuth/GlobalLogoutCaepEmitHttpTests.cs
+++ b/test/Verifiable.Tests/OAuth/GlobalLogoutCaepEmitHttpTests.cs
@@ -137,7 +137,7 @@ async Task<MinimalHttpResponse> ReceiverPushHandler(MinimalHttpRequest request,
         await using TestHostShell op = new(TimeProvider);
         using VerifierKeyMaterial material = op.RegisterClient(GtrClientId, GtrClientBaseUri, GtrCapabilities);
 
-        using HttpClient transmitterClient = new();
+        using HttpClient transmitterClient = LoopbackTls.CreatePinnedHttpClient(receiver.Certificate);
         op.Server.OAuth().ValidateClientCredentialsAsync = static (_, _, _, _, _) => ValueTask.FromResult(true);
         op.Server.OAuth().UseDefaultGlobalTokenRevocationJsonParsing();
         op.Server.OAuth().RevokeSubjectTokensAsync = async (subId, _, _, ct) =>
diff --git a/test/Verifiable.Tests/OAuth/GlobalLogoutDualChannelHttpTests.cs b/test/Verifiable.Tests/OAuth/GlobalLogoutDualChannelHttpTests.cs
index fe777bf1..eb4c4176 100644
--- a/test/Verifiable.Tests/OAuth/GlobalLogoutDualChannelHttpTests.cs
+++ b/test/Verifiable.Tests/OAuth/GlobalLogoutDualChannelHttpTests.cs
@@ -140,8 +140,8 @@ async Task<MinimalHttpResponse> ReceiverPushHandler(MinimalHttpRequest request,
         //The application's session→RP registry the fan-out walks (what a deployment maintains).
         List<RegisteredRelyingParty> sessionRelyingParties =
         [
-            new RegisteredRelyingParty(rp1.ClientId, rp1.BackChannelLogoutUri),
-            new RegisteredRelyingParty(rp2.ClientId, rp2.BackChannelLogoutUri)
+            new RegisteredRelyingParty(rp1.ClientId, rp1.BackChannelLogoutUri, rp1.Certificate),
+            new RegisteredRelyingParty(rp2.ClientId, rp2.BackChannelLogoutUri, rp2.Certificate)
         ];
 
         //The OP: a Global Token Revocation endpoint whose revoke-subject seam composes BOTH
@@ -149,8 +149,7 @@ async Task<MinimalHttpResponse> ReceiverPushHandler(MinimalHttpRequest request,
         await using TestHostShell op = new(TimeProvider);
         using VerifierKeyMaterial gtrMaterial = op.RegisterClient(GtrClientId, GtrClientBaseUri, GtrCapabilities);
 
-        using HttpClient deliveryClient = new();
-        using HttpClient transmitterClient = new();
+        using HttpClient transmitterClient = LoopbackTls.CreatePinnedHttpClient(ssfReceiver.Certificate);
         op.Server.OAuth().ValidateClientCredentialsAsync = static (_, _, _, _, _) => ValueTask.FromResult(true);
         op.Server.OAuth().UseDefaultGlobalTokenRevocationJsonParsing();
         op.Server.OAuth().RevokeSubjectTokensAsync = async (subId, _, _, ct) =>
@@ -176,6 +175,7 @@ async Task<MinimalHttpResponse> ReceiverPushHandler(MinimalHttpRequest request,
 
                 using FormUrlEncodedContent content = new(
                     [new KeyValuePair<string, string>(WellKnownTokenTypes.LogoutToken, logoutToken)]);
+                using HttpClient deliveryClient = LoopbackTls.CreatePinnedHttpClient(relyingParty.Certificate);
                 using HttpResponseMessage delivery = await deliveryClient.PostAsync(
                     relyingParty.BackChannelLogoutUri, content, cancellationToken: ct).ConfigureAwait(false);
                 Assert.AreEqual(200, (int)delivery.StatusCode,
diff --git a/test/Verifiable.Tests/OAuth/GuardedHttpClientTransportTests.cs b/test/Verifiable.Tests/OAuth/GuardedHttpClientTransportTests.cs
index 96668783..268605aa 100644
--- a/test/Verifiable.Tests/OAuth/GuardedHttpClientTransportTests.cs
+++ b/test/Verifiable.Tests/OAuth/GuardedHttpClientTransportTests.cs
@@ -85,14 +85,14 @@ public async Task RelaxedLoopbackPolicyAllowsTheConfiguredLocalListener()
         using HttpClient httpClient = new(handler, disposeHandler: false);
         SendFormPostDelegate send = GuardedHttpClientTransport.BuildGuardedFormPost(httpClient);
 
-        //The deployment's transport endpoint genuinely is a loopback listener, so
+        //The deployment's transport endpoint genuinely is a loopback HTTPS listener, so
         //the policy is relaxed for exactly that — the same principled choice the
         //HTTP-backed flow tests make. The fetch now proceeds to the stub.
         ExchangeContext context = new();
         context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
 
         HttpResponseData response = await send(
-            new Uri("http://127.0.0.1:8080/cb"),
+            new Uri("https://127.0.0.1:8080/cb"),
             Form, NoHeaders, context, TestContext.CancellationToken).ConfigureAwait(false);
 
         Assert.AreEqual(200, response.StatusCode,
@@ -100,6 +100,32 @@ public async Task RelaxedLoopbackPolicyAllowsTheConfiguredLocalListener()
     }
 
 
+    [TestMethod]
+    public async Task RelaxedLoopbackPolicyStillDeniesPlainHttp()
+    {
+        using ThrowingHandler handler = new();
+        using HttpClient httpClient = new(handler, disposeHandler: false);
+        SendFormPostDelegate send = GuardedHttpClientTransport.BuildGuardedFormPost(httpClient);
+
+        //Every loopback test host now serves HTTPS; the loopback policy relaxes only
+        //BlockPrivateAndLoopback, never the https-only scheme gate. A plain-http target
+        //must still be denied before any network contact — the throwing handler is never hit.
+        ExchangeContext context = new();
+        context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
+
+        HttpResponseData response = await send(
+            new Uri("http://127.0.0.1:8080/cb"),
+            Form, NoHeaders, context, TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(0, response.StatusCode,
+            "Plain http must remain denied even under the relaxed loopback policy.");
+        Assert.AreEqual(
+            nameof(OutboundFetchOutcome.DeniedByPolicy),
+            response.TransportMetadata?[GuardedHttpClientTransport.OutcomeMetadataKey],
+            "The deny outcome must be carried in the transport metadata.");
+    }
+
+
     /// <summary>An inner transport that must never be invoked on a denied target.</summary>
     private sealed class ThrowingHandler: HttpMessageHandler
     {
diff --git a/test/Verifiable.Tests/OAuth/HostedAuthorizationServer.cs b/test/Verifiable.Tests/OAuth/HostedAuthorizationServer.cs
index 2165adfb..fbd5d4e9 100644
--- a/test/Verifiable.Tests/OAuth/HostedAuthorizationServer.cs
+++ b/test/Verifiable.Tests/OAuth/HostedAuthorizationServer.cs
@@ -46,7 +46,7 @@ namespace Verifiable.Tests.OAuth;
 /// <summary>
 /// Per-host state for a single test-fixture <see cref="AuthorizationServer"/>
 /// deployment: registrations, key stores, flow-handle indexes, and the
-/// associated Kestrel + HttpClient when the host is serving HTTP.
+/// associated HTTPS host + HttpClient when the host is serving requests.
 /// </summary>
 /// <remarks>
 /// <para>
@@ -63,7 +63,7 @@ namespace Verifiable.Tests.OAuth;
 /// <see cref="AuthorizationServer"/> instance.
 /// </para>
 /// </remarks>
-[DebuggerDisplay("HostedAuthorizationServer Name={Name} Clients={Registrations.Count} HasHttp={KestrelServer != null}")]
+[DebuggerDisplay("HostedAuthorizationServer Name={Name} Clients={Registrations.Count} HasHttp={HttpHost != null}")]
 internal sealed class HostedAuthorizationServer
 {
     /// <summary>The host's role name (e.g. "verifier", "anchor", "resource-server").</summary>
@@ -98,9 +98,9 @@ internal sealed class HostedAuthorizationServer
     public ConcurrentDictionary<string, string> RegistrationAccessTokens { get; } = new();
 
 
-    //Kestrel state — populated when StartHttpHostAsync runs against this host.
+    //HTTPS host state — populated when StartHttpHostAsync runs against this host.
 
-    public global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer? KestrelServer { get; set; }
+    public global::Microsoft.AspNetCore.Builder.WebApplication? HttpHost { get; set; }
     public Uri? HttpBaseAddress { get; set; }
     public System.Net.Http.HttpClient? SharedHttpClient { get; set; }
 
diff --git a/test/Verifiable.Tests/OAuth/HttpClientTransport.cs b/test/Verifiable.Tests/OAuth/HttpClientTransport.cs
index 0bdd1152..e1cbd202 100644
--- a/test/Verifiable.Tests/OAuth/HttpClientTransport.cs
+++ b/test/Verifiable.Tests/OAuth/HttpClientTransport.cs
@@ -33,6 +33,21 @@ namespace Verifiable.Tests.OAuth;
 /// </remarks>
 internal static class HttpClientTransport
 {
+    /// <summary>
+    /// The W3C Trace Context response header whose value is copied into
+    /// <see cref="HttpResponseData.TransportMetadata"/> under
+    /// <see cref="HttpResponseDataKeys.TraceParent"/>.
+    /// </summary>
+    private const string TraceParentHeaderName = "traceparent";
+
+    /// <summary>
+    /// The W3C Trace Context response header whose value is copied into
+    /// <see cref="HttpResponseData.TransportMetadata"/> under
+    /// <see cref="HttpResponseDataKeys.TraceState"/>.
+    /// </summary>
+    private const string TraceStateHeaderName = "tracestate";
+
+
     public static async ValueTask<HttpResponseData> SendFormPostAsync(
         HttpClient httpClient,
         Uri endpoint,
@@ -202,10 +217,32 @@ private static async ValueTask<HttpResponseData> BuildHttpResponseDataAsync(
             headerBuilder[header.Key] = string.Join(", ", header.Value);
         }
 
+        //W3C Trace Context response headers are lifted into TransportMetadata under
+        //the documented HttpResponseDataKeys constants so that
+        //OAuthParseError.WithTransportMetadata can surface the server's trace
+        //identity as the DecisionSupport correlation id. A server sends these
+        //headers only when its deployment chooses to echo trace context on
+        //responses; when absent, TransportMetadata stays null.
+        Dictionary<string, string>? transportMetadata = null;
+        if(headerBuilder.TryGetValue(TraceParentHeaderName, out string? traceParent))
+        {
+            transportMetadata = new Dictionary<string, string>(StringComparer.Ordinal)
+            {
+                [HttpResponseDataKeys.TraceParent] = traceParent
+            };
+        }
+
+        if(headerBuilder.TryGetValue(TraceStateHeaderName, out string? traceState))
+        {
+            transportMetadata ??= new Dictionary<string, string>(StringComparer.Ordinal);
+            transportMetadata[HttpResponseDataKeys.TraceState] = traceState;
+        }
+
         return new HttpResponseData
         {
             Body = body,
             StatusCode = (int)response.StatusCode,
+            TransportMetadata = transportMetadata,
             Headers = new ResponseHeaders { Values = headerBuilder.ToImmutable() }
         };
     }
diff --git a/test/Verifiable.Tests/OAuth/JwtBearerGrantTests.cs b/test/Verifiable.Tests/OAuth/JwtBearerGrantTests.cs
index c1adc2f1..21a4bcb7 100644
--- a/test/Verifiable.Tests/OAuth/JwtBearerGrantTests.cs
+++ b/test/Verifiable.Tests/OAuth/JwtBearerGrantTests.cs
@@ -32,8 +32,11 @@ namespace Verifiable.Tests.OAuth;
 /// <see cref="WellKnownCapabilityIdentifiers.OAuthJwtBearer"/> capability AND the assertion-validation
 /// seam is wired; client AUTHENTICATION is OPTIONAL (§2.1/§3.1), so the client-authentication seam is
 /// NOT required for the grant to exist — but when the request carries client credentials they MUST be
-/// validated (§3.1). A host with the capability but no validation seam fails closed: the grant
-/// endpoint does not exist and a well-formed request never reaches 200.
+/// validated (§3.1), and when the effective registration declares a non-<c>none</c>
+/// <c>token_endpoint_auth_method</c> a credential-less request is refused with <c>401 invalid_client</c>
+/// (draft-ietf-oauth-client-id-metadata-document-02 §8.2, CIMD-049). A host with the capability but no
+/// validation seam fails closed: the grant endpoint does not exist and a well-formed request never
+/// reaches 200.
 /// </remarks>
 [TestClass]
 internal sealed class JwtBearerGrantTests
@@ -43,10 +46,16 @@ internal sealed class JwtBearerGrantTests
     private const string AssertionSubject = "https://user.example/alice";
     private const string GrantedScope = "read";
 
-    //The openid scope maps to this resource-server identifier on every client RegisterDpopClient
-    //registers (ScopeToAudience[openid]); a real AS-issued client_credentials token carries it as
-    //aud, so the end-to-end test has a concrete audience to perform the §3 rule-3 aud == this AS
-    //check against, and the exchanged jwt-bearer access token carries it too.
+    //A non-identity scope RegisterJwtBearerClient maps onto ResourceServerAudience: contract
+    //wave-4 D4 narrows openid away from every client_credentials grant (client_credentials has no
+    //authenticated End-User), so the end-to-end tests mint their real assertion under this scope
+    //instead, to still reach a concrete audience for the §3 rule-3 aud == this AS check.
+    private const string MachineScope = "machine.telemetry.read";
+
+    //The resource-server identifier RegisterJwtBearerClient maps MachineScope onto; a real
+    //AS-issued client_credentials token carries it as aud, so the end-to-end test has a concrete
+    //audience to perform the §3 rule-3 aud == this AS check against, and the exchanged jwt-bearer
+    //access token carries it too.
     private const string ResourceServerAudience = "https://rs.example.com";
 
     public TestContext TestContext { get; set; } = null!;
@@ -412,10 +421,12 @@ public async Task EndToEndRealAssertionIsValidatedExchangedAndUsed()
             await BuildJwksKeyResolverAsync(http, host.HttpBaseAddress!, segment).ConfigureAwait(false);
 
         //STEP 1 — Mint a REAL signed JWT to serve as the assertion (client_credentials, RFC 6749 §4.4).
-        //iss == asIssuer; openid scope embeds aud == ResourceServerAudience (the AS's audience identity
-        //for the §3 rule-3 check). The project's signing surface mints it — no hand-rolled crypto.
+        //iss == asIssuer; MachineScope embeds aud == ResourceServerAudience (the AS's audience identity
+        //for the §3 rule-3 check) — contract wave-4 D4 narrows openid away from every
+        //client_credentials grant, so RegisterJwtBearerClient maps this non-identity scope instead.
+        //The project's signing surface mints it — no hand-rolled crypto.
         string assertion = await ObtainClientCredentialsAccessTokenAsync(
-            http, tokenUrl, ClientId, ClientSecret, WellKnownScopes.OpenId).ConfigureAwait(false);
+            http, tokenUrl, ClientId, ClientSecret, MachineScope).ConfigureAwait(false);
 
         //Pin "real": the assertion is itself a valid AS-issued, correctly-audienced token before we
         //present it as the grant — the same check the validation seam performs below.
@@ -572,6 +583,171 @@ public async Task PresentCredentialsWithNoClientAuthSeamAreRejectedAsInvalidClie
     }
 
 
+    /// <summary>
+    /// RFC 7523 §3.1 composed with draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-049): a
+    /// registration that declares a non-<c>none</c> <c>token_endpoint_auth_method</c> is a confidential
+    /// client, and "any communication with the authorization server MUST include client authentication
+    /// of the registered type." A jwt-bearer request carrying a valid assertion but NO client
+    /// credentials at all is refused with <c>401 invalid_client</c> — the §3.1 anonymous path is open
+    /// only to clients that declared no authentication method.
+    /// </summary>
+    [TestMethod]
+    public async Task DeclaredConfidentialClientWithoutCredentialsIsRejectedAsInvalidClient()
+    {
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = RegisterJwtBearerClient(app);
+        DeclareTokenEndpointAuthMethod(app, material, ClientAuthenticationMethod.ClientSecretPost);
+        WireClientAuthentication(app);
+        WireAcceptingValidator(app);
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{material.Registration.TenantId.Value}/token");
+
+        //client_id identifies the client but NO client_secret and NO Authorization header — the same
+        //credential-less wire shape the anonymous test uses, now against a DECLARED confidential client.
+        OutgoingFormFields form = BuildRequest(new JwtBearerBuilderOptions
+        {
+            Assertion = "eyJhbGciOiJFUzI1NiJ9.opaque-assertion-blob.signature"
+        }).WithClientSecretPost(ClientId, ReadOnlySpan<byte>.Empty);
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            host.SharedHttpClient!, tokenUrl, form, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(401, (int)response.StatusCode, body);
+        Assert.Contains(OAuthErrors.InvalidClient, body, StringComparison.Ordinal);
+    }
+
+
+    /// <summary>
+    /// CIMD-049 fail-closed: a registration that declares a non-<c>none</c>
+    /// <c>token_endpoint_auth_method</c> on an authorization server whose
+    /// <see cref="AuthorizationServerIntegration.ValidateClientCredentialsAsync"/> seam is NOT wired
+    /// cannot authenticate anything, so a credential-less jwt-bearer request is refused with
+    /// <c>401 invalid_client</c> — never silently passed through as anonymous.
+    /// </summary>
+    [TestMethod]
+    public async Task DeclaredConfidentialClientWithUnwiredAuthSeamFailsClosed()
+    {
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = RegisterJwtBearerClient(app);
+        DeclareTokenEndpointAuthMethod(app, material, ClientAuthenticationMethod.ClientSecretPost);
+
+        //Only the assertion validator is wired — the client-authentication seam is deliberately absent.
+        WireAcceptingValidator(app);
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{material.Registration.TenantId.Value}/token");
+
+        OutgoingFormFields form = BuildRequest(new JwtBearerBuilderOptions
+        {
+            Assertion = "eyJhbGciOiJFUzI1NiJ9.opaque.signature"
+        }).WithClientSecretPost(ClientId, ReadOnlySpan<byte>.Empty);
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            host.SharedHttpClient!, tokenUrl, form, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(401, (int)response.StatusCode, body);
+        Assert.Contains(OAuthErrors.InvalidClient, body, StringComparison.Ordinal);
+    }
+
+
+    /// <summary>
+    /// RFC 7523 §3.1 + CIMD-049 composition, the credential-bearing leg: a declared confidential
+    /// client that presents its valid <c>client_secret</c> is authenticated on the §3.1
+    /// validate-if-present path and the grant proceeds to a token. The seam invocation count proves the
+    /// two enforcement branches are disjoint — the credentials are validated exactly ONCE, never a
+    /// second time by the declared-method requirement.
+    /// </summary>
+    [TestMethod]
+    public async Task DeclaredConfidentialClientWithValidCredentialsIsIssuedTokenWithoutDoubleValidation()
+    {
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = RegisterJwtBearerClient(app);
+        DeclareTokenEndpointAuthMethod(app, material, ClientAuthenticationMethod.ClientSecretPost);
+        WireAcceptingValidator(app);
+
+        int validationCallCount = 0;
+        app.Server.OAuth().ValidateClientCredentialsAsync = (request, fields, registration, context, ct) =>
+        {
+            validationCallCount++;
+
+            return ValueTask.FromResult(
+                fields.TryGetValue(OAuthRequestParameterNames.ClientSecret, out string? secret)
+                && string.Equals(secret, ClientSecret, StringComparison.Ordinal));
+        };
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{material.Registration.TenantId.Value}/token");
+
+        OutgoingFormFields form = BuildRequest(new JwtBearerBuilderOptions
+        {
+            Assertion = "eyJhbGciOiJFUzI1NiJ9.opaque-assertion-blob.signature"
+        }).WithClientSecretPost(ClientId, Encoding.UTF8.GetBytes(ClientSecret));
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            host.SharedHttpClient!, tokenUrl, form, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+        Assert.AreEqual(1, validationCallCount,
+            "The presented credentials must be validated exactly once — the declared-method requirement (CIMD-049) must not re-run the §3.1 validate-if-present check.");
+
+        using JsonDocument doc = JsonDocument.Parse(body);
+        string accessToken = doc.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+
+        //RFC 7523 §3 rule 2.A: the issued token's subject is the assertion's subject.
+        using JsonDocument payload = DecodePayload(accessToken);
+        Assert.AreEqual(AssertionSubject, payload.RootElement.GetProperty("sub").GetString());
+    }
+
+
+    /// <summary>
+    /// The declared PUBLIC-client shape: a registration whose <c>token_endpoint_auth_method</c> is
+    /// explicitly <c>none</c> keeps the RFC 7523 §2.1/§3.1 anonymous path open — a credential-less
+    /// request with an accepted assertion is issued a token, with no client-authentication seam wired
+    /// at all. Together with <see cref="AnonymousRequestWithoutClientCredentialsIssuesToken"/> (the
+    /// UNDECLARED shape) this pins that only a non-<c>none</c> declaration closes the anonymous path
+    /// (CIMD-049 gates on confidential declarations, nothing else).
+    /// </summary>
+    [TestMethod]
+    public async Task DeclaredNoneClientWithoutCredentialsIssuesToken()
+    {
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = RegisterJwtBearerClient(app);
+        DeclareTokenEndpointAuthMethod(app, material, ClientAuthenticationMethod.None);
+
+        //No WireClientAuthentication — a declared-none public client must not require the seam.
+        WireAcceptingValidator(app);
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{material.Registration.TenantId.Value}/token");
+
+        OutgoingFormFields form = BuildRequest(new JwtBearerBuilderOptions
+        {
+            Assertion = "eyJhbGciOiJFUzI1NiJ9.opaque-assertion-blob.signature"
+        }).WithClientSecretPost(ClientId, ReadOnlySpan<byte>.Empty);
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            host.SharedHttpClient!, tokenUrl, form, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+
+        using JsonDocument doc = JsonDocument.Parse(body);
+        string accessToken = doc.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+
+        //RFC 7523 §3 rule 2.A: the issued token's subject is the assertion's subject.
+        using JsonDocument payload = DecodePayload(accessToken);
+        Assert.AreEqual(AssertionSubject, payload.RootElement.GetProperty("sub").GetString());
+    }
+
+
     /// <summary>
     /// A real, stub-free negative end-to-end: a genuine AS-issued assertion is TAMPERED (its signature
     /// segment is corrupted) and presented. The wired validator runs the project's real
@@ -598,9 +774,10 @@ public async Task RealTamperedOrExpiredAssertionIsRejectedAsInvalidGrant()
             await BuildJwksKeyResolverAsync(http, host.HttpBaseAddress!, segment).ConfigureAwait(false);
 
         //Mint a REAL signed JWT (client_credentials) to serve as the assertion — same as the positive
-        //end-to-end. iss == asIssuer; openid scope embeds aud == ResourceServerAudience.
+        //end-to-end. iss == asIssuer; MachineScope embeds aud == ResourceServerAudience (contract
+        //wave-4 D4 narrows openid away from every client_credentials grant).
         string realAssertion = await ObtainClientCredentialsAccessTokenAsync(
-            http, tokenUrl, ClientId, ClientSecret, WellKnownScopes.OpenId).ConfigureAwait(false);
+            http, tokenUrl, ClientId, ClientSecret, MachineScope).ConfigureAwait(false);
 
         //Wire the REAL assertion validator — it runs JwsAccessTokenValidator (signature §3 rule 9, iss
         //§3 rule 1, timing §3 rules 4–5, and aud == this AS §3 rule 3). A forgery or expired window
@@ -874,14 +1051,14 @@ public async Task JwtBearerGrantTypeIsNotServedWhenCapabilityIsNotAllowed()
     {
         await using TestHostShell app = new(TimeProvider);
 
-        //Register a client allowed every grant EXCEPT jwt-bearer — the capability that materializes the
-        //grant. The seam is wired so the only reason a token could not issue is the missing capability.
+        //Register a client allowed the client_credentials grant capability (plus discovery/jwks, neither
+        //a grant capability) but NOT jwt-bearer — the capability that materializes the grant. The seam
+        //is wired so the only reason a token could not issue is the missing capability.
         using VerifierKeyMaterial material = app.RegisterDpopClient(
             ClientId,
             new Uri(ClientId),
             profile: PolicyProfile.Rfc6749WithPkce,
             capabilities: ImmutableHashSet.Create(
-                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
                 WellKnownCapabilityIdentifiers.OAuthClientCredentials,
                 WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
                 WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
@@ -907,25 +1084,121 @@ public async Task JwtBearerGrantTypeIsNotServedWhenCapabilityIsNotAllowed()
 
 
     /// <summary>
-    /// Registers the confidential client allowed the
-    /// <see cref="WellKnownCapabilityIdentifiers.OAuthJwtBearer"/> capability. The registration also
-    /// carries OAuthAuthorizationCode and OAuthClientCredentials: the shipped RFC 9068 access-token
-    /// producer is gated on those capabilities (and the end-to-end test obtains a real assertion via
-    /// the client_credentials grant), and the RegisterDpopClient helper supplies the AccessTokenIssuance
-    /// signing keys the producers resolve. The discovery/jwks capabilities round out the standard surface.
+    /// Registers a truly grant-only confidential client — no
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthAuthorizationCode"/> — allowed
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthJwtBearer"/> plus
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthClientCredentials"/> (the end-to-end test
+    /// obtains a real assertion via the client_credentials grant). Grant-only jwt-bearer issuance
+    /// works because <see cref="Rfc9068AccessTokenProducer"/>'s <c>RequiredCapability</c> is
+    /// <see langword="null"/> — an optional tenant-feature gate, not a grant-capability proxy
+    /// (contract wave-4 D2) — so the endpoint-match capability alone is sufficient. RegisterDpopClient
+    /// supplies the AccessTokenIssuance signing keys the producers resolve; the discovery/jwks
+    /// capabilities round out the standard surface. <see cref="MachineScope"/> is added to
+    /// <c>AllowedScopes</c> and mapped onto <see cref="ResourceServerAudience"/> in
+    /// <c>ScopeToAudience</c> (the register-then-upgrade pattern — the routing dictionaries are
+    /// host-internal) so <see cref="ObtainClientCredentialsAccessTokenAsync"/> can mint a correctly
+    /// audienced real assertion without requesting <c>openid</c> — contract wave-4 D4 narrows
+    /// <c>openid</c> away from every <c>client_credentials</c> grant, so such a grant cannot carry the
+    /// audience mapping the end-to-end tests rely on.
     /// </summary>
-    private static VerifierKeyMaterial RegisterJwtBearerClient(TestHostShell app) =>
-        app.RegisterDpopClient(
+    private static VerifierKeyMaterial RegisterJwtBearerClient(TestHostShell app)
+    {
+        VerifierKeyMaterial material = app.RegisterDpopClient(
             ClientId,
             new Uri(ClientId),
             profile: PolicyProfile.Rfc6749WithPkce,
             capabilities: ImmutableHashSet.Create(
-                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
                 WellKnownCapabilityIdentifiers.OAuthClientCredentials,
                 WellKnownCapabilityIdentifiers.OAuthJwtBearer,
                 WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
                 WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
 
+        HostedAuthorizationServer host = app.Host("default");
+        string segment = material.Registration.TenantId.Value;
+        ClientRecord previous = host.Registrations[segment];
+        Dictionary<string, IReadOnlyList<string>> scopeToAudience = previous.ScopeToAudience is null
+            ? new Dictionary<string, IReadOnlyList<string>>(StringComparer.Ordinal)
+            : new Dictionary<string, IReadOnlyList<string>>(previous.ScopeToAudience, StringComparer.Ordinal);
+        scopeToAudience[MachineScope] = [ResourceServerAudience];
+
+        ClientRecord updated = previous with
+        {
+            AllowedScopes = previous.AllowedScopes.Add(MachineScope),
+            ScopeToAudience = scopeToAudience
+        };
+        host.Registrations[segment] = updated;
+        host.Registrations[updated.ClientId] = updated;
+        host.Server.UpdateClient(previous, updated, new ExchangeContext());
+        material.Registration = updated;
+
+        return material;
+    }
+
+
+    /// <summary>
+    /// Contract wave-4 D3/D4: on a tenant granted the
+    /// <see cref="WellKnownCapabilityIdentifiers.OidcOpenIdConnect"/> feature — ruling out D2's
+    /// capability gate as the explanation — a jwt-bearer grant whose seam legitimately grants
+    /// <c>openid</c> (the app opting in per the source-layer contract: <c>jwt_bearer</c> honors the
+    /// app-granted scope, unlike <c>client_credentials</c>) still never yields an id_token.
+    /// <see cref="Oidc10IdTokenProducer"/>'s <c>IsApplicable</c> independently requires
+    /// <c>GrantType ∈ {authorization_code, refresh_token}</c> — this test proves that gate holds even
+    /// when <c>openid</c> survives all the way to the issued access token's <c>scope</c> claim,
+    /// which is the non-vacuous case (nothing upstream removed <c>openid</c> here).
+    /// </summary>
+    [TestMethod]
+    public async Task NoIdTokenIsMintedForJwtBearerEvenWithOpenidGrantedAndOidcFeatureEnabled()
+    {
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId,
+            new Uri(ClientId),
+            profile: PolicyProfile.Rfc6749WithPkce,
+            capabilities: ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthJwtBearer,
+                WellKnownCapabilityIdentifiers.OidcOpenIdConnect,
+                WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+                WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
+        WireClientAuthentication(app);
+
+        //The seam grants openid — an app opting in to vouch that the exchanged subject is an
+        //End-User (contract wave-4 D4: jwt_bearer honors whatever scope the app's authorization
+        //seam decides, unlike client_credentials' source-layer narrowing).
+        app.Server.OAuth().ValidateJwtBearerAssertionAsync =
+            static (assertion, requestedScope, registration, context, ct) =>
+                ValueTask.FromResult<JwtBearerGrant?>(
+                    new JwtBearerGrant { Subject = AssertionSubject, Scope = WellKnownScopes.OpenId });
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{material.Registration.TenantId.Value}/token");
+
+        OutgoingFormFields form = BuildRequest(new JwtBearerBuilderOptions
+        {
+            Assertion = "eyJhbGciOiJFUzI1NiJ9.opaque-assertion-blob.signature",
+            Scope = WellKnownScopes.OpenId
+        }).WithClientSecretPost(ClientId, Encoding.UTF8.GetBytes(ClientSecret));
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            host.SharedHttpClient!, tokenUrl, form, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+
+        using JsonDocument doc = JsonDocument.Parse(body);
+        Assert.AreEqual(WellKnownScopes.OpenId, doc.RootElement.GetProperty(OAuthRequestParameterNames.Scope).GetString(),
+            "Sanity: openid must have actually reached the response scope — otherwise the id_token's "
+            + "absence would be trivially explained by scope, not by the grant-type gate under test.");
+        Assert.IsFalse(doc.RootElement.TryGetProperty(WellKnownTokenTypes.IdToken, out _),
+            "jwt_bearer must never carry an id_token even when openid survived to the granted scope "
+            + "on a tenant with the OidcOpenIdConnect feature granted.");
+
+        string accessToken = doc.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+        using JsonDocument payload = DecodePayload(accessToken);
+        Assert.AreEqual(WellKnownScopes.OpenId, payload.RootElement.GetProperty(OAuthRequestParameterNames.Scope).GetString(),
+            "The issued access token's own scope claim must also carry openid unchanged.");
+    }
+
 
     /// <summary>
     /// Wires the client_secret_post authentication seam (RFC 6749 §2.3.1): the application owns the
@@ -952,6 +1225,34 @@ private static void WireAcceptingValidator(TestHostShell app) =>
                     new JwtBearerGrant { Subject = AssertionSubject, Scope = GrantedScope });
 
 
+    /// <summary>
+    /// Re-registers <paramref name="material"/>'s client with
+    /// <see cref="ClientRecord.TokenEndpointAuthMethod"/> set to <paramref name="method"/> — the
+    /// declared-client shape draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-049) gates on.
+    /// Uses the same register-then-upgrade pattern as
+    /// <see cref="TestHostShell.SetAccessTokenLifetime"/>, because the routing dictionaries are
+    /// host-internal.
+    /// </summary>
+    private static void DeclareTokenEndpointAuthMethod(
+        TestHostShell app, VerifierKeyMaterial material, ClientAuthenticationMethod method)
+    {
+        HostedAuthorizationServer host = app.Host("default");
+        string segment = material.Registration.TenantId.Value;
+        ClientRecord previous = host.Registrations[segment];
+        ClientRecord updated = previous with
+        {
+            TokenEndpointAuthMethod = method
+        };
+
+        host.Registrations[segment] = updated;
+        host.Registrations[updated.ClientId] = updated;
+
+        host.Server.UpdateClient(previous, updated, new ExchangeContext());
+
+        material.Registration = updated;
+    }
+
+
     /// <summary>
     /// Obtains a real signed access token from the AS over the wire via the <c>client_credentials</c>
     /// grant (RFC 6749 §4.4). The returned compact JWS is a genuine RFC 9068 token: <c>sub</c> is the
diff --git a/test/Verifiable.Tests/OAuth/OAuthAttackMitigationTests.cs b/test/Verifiable.Tests/OAuth/OAuthAttackMitigationTests.cs
index cb43cdd4..443e2852 100644
--- a/test/Verifiable.Tests/OAuth/OAuthAttackMitigationTests.cs
+++ b/test/Verifiable.Tests/OAuth/OAuthAttackMitigationTests.cs
@@ -137,6 +137,82 @@ await AuthCodeFlowHandlers.HandleParAsync(new Dictionary<string, string>(), Defa
     }
 
 
+    //R9207-017 / R9207-020 / M2 (MCP 2026-07-28 overlay) — a PRESENT iss must still be
+    //validated under Rfc6749WithPkce even though this profile does not require iss to be
+    //present at all. The overlay's M2 phrasing ("client MUST validate a present iss ...
+    //before redeeming the authorization code") is unconditional, independent of R9207's
+    //own profile-relative MUSTs.
+
+    [TestMethod]
+    public async Task Rfc9207Section2Point4PresentWrongIssuerIsRejectedUnderRfc6749()
+    {
+        var store = new Dictionary<string, FlowState>();
+
+        //The token endpoint is wired to redeem successfully so the chained
+        //HandleTokenAsync assertion discriminates: BadRequest can only mean the
+        //rejected callback persisted no AuthorizationCodeReceivedState — a
+        //wrongly-persisted state would redeem Ok and fail the test.
+        (OAuthClientInfrastructure infrastructure, ClientRegistration registration) = CreateInfrastructureAndRegistration(
+            store,
+            PolicyProfile.Rfc6749WithPkce,
+            tokenResponse: BuildTokenJson("at.123", "Bearer", 3600, null));
+        await AuthCodeFlowHandlers.HandleParAsync(new Dictionary<string, string>(), DefaultRedirectUri, infrastructure, registration, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string flowId = GetSingleFlowId(store);
+        AuthCodeFlowEndpointResult callbackResult = await AuthCodeFlowHandlers.HandleCallbackAsync(
+            new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.Code] = "auth-code",
+                [OAuthRequestParameterNames.State] = flowId,
+                [OAuthRequestParameterNames.Iss] = "https://attacker.example.com"
+            },
+            infrastructure,
+            registration,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, callbackResult.Outcome,
+            "A present, mismatched iss must be rejected even under Rfc6749WithPkce.");
+        AssertClaimFailed(callbackResult.ValidationClaims, ValidationClaimIds.IssuerMatchesExpectedWhenPresent,
+            "Issuer mismatch must produce a failed IssuerMatchesExpectedWhenPresent claim.");
+
+        AuthCodeFlowEndpointResult tokenResult = await AuthCodeFlowHandlers.HandleTokenAsync(
+            new Dictionary<string, string> { [AuthCodeFlowRoutes.FlowIdField] = flowId },
+            infrastructure,
+            registration,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, tokenResult.Outcome,
+            "A rejected callback must never persist state the token endpoint can redeem.");
+    }
+
+
+    [TestMethod]
+    public async Task Rfc9207Section2Point4PresentCorrectIssuerSucceedsUnderRfc6749()
+    {
+        var store = new Dictionary<string, FlowState>();
+        (OAuthClientInfrastructure infrastructure, ClientRegistration registration) = CreateInfrastructureAndRegistration(store, PolicyProfile.Rfc6749WithPkce);
+        await AuthCodeFlowHandlers.HandleParAsync(new Dictionary<string, string>(), DefaultRedirectUri, infrastructure, registration, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string flowId = GetSingleFlowId(store);
+        AuthCodeFlowEndpointResult result = await AuthCodeFlowHandlers.HandleCallbackAsync(
+            new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.Code] = "auth-code",
+                [OAuthRequestParameterNames.State] = flowId,
+                [OAuthRequestParameterNames.Iss] = "https://as.example.com"
+            },
+            infrastructure,
+            registration,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, result.Outcome,
+            "A present iss that matches the expected issuer must proceed under Rfc6749WithPkce.");
+        AssertAllClaimsSucceeded(result.ValidationClaims);
+    }
+
+
     [TestMethod]
     public async Task Rfc9700Section4Point4MixUpAttackCallbackWithCorrectIssuerSucceeds()
     {
@@ -162,6 +238,75 @@ await AuthCodeFlowHandlers.HandleParAsync(new Dictionary<string, string>(), Defa
     }
 
 
+    //RFC 9207 §2.4 / §4 + R9207-012 — error responses are not exempt from mix-up defense.
+    //
+    //Attacker capability: a network attacker able to forge a callback carrying error/
+    //error_description (RFC 6749 §4.1.2.1) together with a forged iss, attempting to make
+    //the client attribute an attacker-manufactured denial to the intended authorization
+    //server (or otherwise process a forged error as authoritative).
+    //
+    //Mitigation: a PRESENT iss on an error callback is validated against the flow's
+    //recorded issuer exactly like on a success callback; a mismatch is rejected as
+    //tampering rather than surfaced as the authorization server's error.
+
+    [TestMethod]
+    public async Task Rfc9207Section4ErrorCallbackWithWrongIssuerIsRejectedAsTampering()
+    {
+        var store = new Dictionary<string, FlowState>();
+        (OAuthClientInfrastructure infrastructure, ClientRegistration registration) = CreateInfrastructureAndRegistration(store, PolicyProfile.Haip10);
+        await AuthCodeFlowHandlers.HandleParAsync(new Dictionary<string, string>(), DefaultRedirectUri, infrastructure, registration, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string flowId = GetSingleFlowId(store);
+        AuthCodeFlowEndpointResult result = await AuthCodeFlowHandlers.HandleCallbackAsync(
+            new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.Error] = "access_denied",
+                [OAuthRequestParameterNames.ErrorDescription] = "User declined consent.",
+                [OAuthRequestParameterNames.State] = flowId,
+                [OAuthRequestParameterNames.Iss] = "https://attacker.example.com"
+            },
+            infrastructure,
+            registration,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome);
+        Assert.AreEqual("invalid_request", result.ErrorCode,
+            "A mismatched iss on an error callback must be surfaced as tampering (invalid_request), " +
+            "not passed through as the authorization server's access_denied error.");
+        AssertClaimFailed(result.ValidationClaims, ValidationClaimIds.IssuerMatchesExpectedWhenPresent,
+            "Issuer mismatch on the error callback must produce a failed IssuerMatchesExpectedWhenPresent claim.");
+    }
+
+
+    [TestMethod]
+    public async Task Rfc9207Section4ErrorCallbackWithCorrectIssuerSurfacesAsErrorResponse()
+    {
+        var store = new Dictionary<string, FlowState>();
+        (OAuthClientInfrastructure infrastructure, ClientRegistration registration) = CreateInfrastructureAndRegistration(store, PolicyProfile.Haip10);
+        await AuthCodeFlowHandlers.HandleParAsync(new Dictionary<string, string>(), DefaultRedirectUri, infrastructure, registration, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string flowId = GetSingleFlowId(store);
+        AuthCodeFlowEndpointResult result = await AuthCodeFlowHandlers.HandleCallbackAsync(
+            new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.Error] = "access_denied",
+                [OAuthRequestParameterNames.ErrorDescription] = "User declined consent.",
+                [OAuthRequestParameterNames.State] = flowId,
+                [OAuthRequestParameterNames.Iss] = "https://as.example.com"
+            },
+            infrastructure,
+            registration,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.BadRequest, result.Outcome);
+        Assert.AreEqual("access_denied", result.ErrorCode,
+            "A correctly-issued error callback must surface the authorization server's own error code.");
+        Assert.AreEqual("User declined consent.", result.ErrorDescription);
+    }
+
+
     //RFC 9700 §4.7 — Cross-Site Request Forgery (CSRF)
     //
     //Attacker capability: A web attacker (A1 in RFC 9700 §3) that can cause the
diff --git a/test/Verifiable.Tests/OAuth/Oid4VciPreAuthorizedCodeGrantTests.cs b/test/Verifiable.Tests/OAuth/Oid4VciPreAuthorizedCodeGrantTests.cs
index 6fef46a9..4e4d1e8c 100644
--- a/test/Verifiable.Tests/OAuth/Oid4VciPreAuthorizedCodeGrantTests.cs
+++ b/test/Verifiable.Tests/OAuth/Oid4VciPreAuthorizedCodeGrantTests.cs
@@ -1,13 +1,17 @@
 using System.Buffers;
+using System.Collections.Concurrent;
 using System.Collections.Immutable;
+using System.Diagnostics;
 using System.Text.Json;
 using Microsoft.Extensions.Time.Testing;
 using Verifiable.Core;
 using Verifiable.Cryptography;
 using Verifiable.OAuth;
+using Verifiable.OAuth.Diagnostics;
 using Verifiable.OAuth.Oid4Vci;
 using Verifiable.OAuth.Server;
 using Verifiable.Server;
+using Verifiable.Server.Diagnostics;
 using Verifiable.Tests.TestInfrastructure;
 
 namespace Verifiable.Tests.OAuth;
@@ -41,14 +45,15 @@ internal sealed class Oid4VciPreAuthorizedCodeGrantTests
     private static MemoryPool<byte> Pool => BaseMemoryPool.Shared;
 
     /// <summary>
-    /// The capabilities the grant needs: the grant capability itself, plus
-    /// <see cref="WellKnownCapabilityIdentifiers.OAuthAuthorizationCode"/> the shipped
-    /// RFC 9068 access-token producer is gated on, plus discovery so the
-    /// <c>grant_types_supported</c> advertisement can be asserted.
+    /// The capabilities a truly grant-only tenant needs: the grant capability itself, plus discovery
+    /// so the <c>grant_types_supported</c> advertisement can be asserted. No
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthAuthorizationCode"/> — grant-only issuance works
+    /// because <see cref="Rfc9068AccessTokenProducer"/>'s <c>RequiredCapability</c> is
+    /// <see langword="null"/>, an optional tenant-feature gate rather than a grant-capability proxy
+    /// (contract wave-4 D2).
     /// </summary>
     private static readonly ImmutableHashSet<CapabilityIdentifier> GrantCapabilities =
         ImmutableHashSet.Create(
-            WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
             WellKnownCapabilityIdentifiers.Oid4VciPreAuthorizedCodeGrant,
             WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
             WellKnownCapabilityIdentifiers.OAuthJwksEndpoint);
@@ -58,11 +63,17 @@ internal sealed class Oid4VciPreAuthorizedCodeGrantTests
     /// A wired grant exchanges a valid <c>pre-authorized_code</c> + <c>tx_code</c> for a Bearer
     /// access token bound to the offer's subject, echoes the granted scope, carries the §6.2
     /// <c>Cache-Control: no-store</c>, and omits the <c>c_nonce</c> the 1.0 token response no
-    /// longer carries.
+    /// longer carries. The granted scope is a Credential-issuance scope, not <c>openid</c> — the
+    /// Pre-Authorized Code grant establishes no authenticated End-User session, so contract wave-4
+    /// D4 narrows <c>openid</c> and the OIDC identity scopes away (see
+    /// <see cref="OpenidAndIdentityScopesAreDroppedFromPreAuthorizedCodeGrantedScopeWithOtelEvent"/>
+    /// for that narrowing proven directly).
     /// </summary>
     [TestMethod]
     public async Task IssuesBearerAccessTokenBoundToTheOfferSubjectWithoutCNonce()
     {
+        const string CredentialScope = "UniversityDegree_dc_sd_jwt";
+
         await using TestHostShell host = new(TimeProvider);
         using VerifierKeyMaterial material = host.RegisterDpopClient(
             ClientId, ClientBaseUri, PolicyProfile.Rfc6749WithPkce, GrantCapabilities);
@@ -82,7 +93,7 @@ public async Task IssuesBearerAccessTokenBoundToTheOfferSubjectWithoutCNonce()
                 seenTxCode = txCode;
 
                 return ValueTask.FromResult(
-                    PreAuthorizedCodeDecision.Grant(OfferSubject, WellKnownScopes.OpenId));
+                    PreAuthorizedCodeDecision.Grant(OfferSubject, CredentialScope));
             };
 
         ServerHttpResponse response = await host.DispatchAtEndpointAsync(
@@ -115,7 +126,7 @@ public async Task IssuesBearerAccessTokenBoundToTheOfferSubjectWithoutCNonce()
         string accessToken = root.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
         Assert.AreEqual(WellKnownAuthenticationSchemes.Bearer, root.GetProperty("token_type").GetString());
         Assert.IsGreaterThan(0, root.GetProperty("expires_in").GetInt32(), "expires_in must reflect the token's exp-iat.");
-        Assert.AreEqual(WellKnownScopes.OpenId, root.GetProperty(OAuthRequestParameterNames.Scope).GetString());
+        Assert.AreEqual(CredentialScope, root.GetProperty(OAuthRequestParameterNames.Scope).GetString());
 
         //OID4VCI 1.0 §6.2 + §7: the c_nonce moved to the Nonce Endpoint and MUST NOT be in
         //the token response.
@@ -345,6 +356,95 @@ public async Task DiscoveryOmitsAnonymousPreAuthorizedAccessWhenNotEnabled()
     }
 
 
+    /// <summary>
+    /// Contract wave-4 D4 source layer: the Pre-Authorized Code grant establishes no authenticated
+    /// End-User session (there is no prior Authorization Request), so a seam-granted scope carrying
+    /// <c>openid</c> and every OIDC Core §5.4 identity scope has them narrowed away (RFC 6749 §3.3)
+    /// before the granted scope ever reaches the token — the issued access token's <c>scope</c> claim
+    /// carries none of them — and the narrowing emits
+    /// <see cref="OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant"/> naming exactly the
+    /// dropped values.
+    /// </summary>
+    [TestMethod]
+    public async Task OpenidAndIdentityScopesAreDroppedFromPreAuthorizedCodeGrantedScopeWithOtelEvent()
+    {
+        ConcurrentBag<Activity> captured = [];
+        using ActivityListener listener = new()
+        {
+            ShouldListenTo = static source =>
+                string.Equals(source.Name, ServerActivitySource.SourceName, StringComparison.Ordinal),
+            Sample = static (ref ActivityCreationOptions<ActivityContext> _) => ActivitySamplingResult.AllDataAndRecorded,
+            ActivityStopped = activity => captured.Add(activity)
+        };
+        ActivitySource.AddActivityListener(listener);
+
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, PolicyProfile.Rfc6749WithPkce, GrantCapabilities);
+        host.SetAccessTokenLifetime(material, TimeSpan.FromMinutes(5));
+
+        string grantedScope = string.Join(' ',
+            WellKnownScopes.OpenId, WellKnownScopes.Profile, WellKnownScopes.Email,
+            WellKnownScopes.Address, WellKnownScopes.Phone);
+        host.Server.OAuth().ValidatePreAuthorizedCodeAsync =
+            (code, txCode, clientId, registration, context, ct) =>
+                ValueTask.FromResult(PreAuthorizedCodeDecision.Grant(OfferSubject, grantedScope));
+
+        string segment = material.Registration.TenantId.Value;
+        ServerHttpResponse response = await host.DispatchAtEndpointAsync(
+            segment,
+            WellKnownEndpointNames.Oid4VciPreAuthorizedToken,
+            "POST",
+            new RequestFields
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.PreAuthorizedCode,
+                [OAuthRequestParameterNames.PreAuthorizedCode] = "SplxlOBeZQQYbYS6WxSbIA",
+                [OAuthRequestParameterNames.TxCode] = "493536"
+            },
+            new ExchangeContext(),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(200, response.StatusCode, response.Body);
+
+        using JsonDocument doc = JsonDocument.Parse(response.Body);
+        //§6.2 omits the scope field entirely once every requested token — all five are identity
+        //scopes — is narrowed away to nothing.
+        Assert.IsFalse(doc.RootElement.TryGetProperty(OAuthRequestParameterNames.Scope, out _),
+            "The response must omit scope once every requested token is narrowed away.");
+
+        string accessToken = doc.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+        byte[] payloadBytes = SecurityEventTestJson.DecodeSegment(accessToken.Split('.')[1], Pool);
+        using JsonDocument payload = JsonDocument.Parse(payloadBytes);
+        Assert.AreEqual(string.Empty, payload.RootElement.GetProperty(OAuthRequestParameterNames.Scope).GetString(),
+            "The issued access token's scope claim must be empty — RFC 6749 §3.3 narrowing removed "
+            + "every identity token before IssuanceContext.Scope was set.");
+
+        //ActivityListener is process-wide (see the ActivityListener cross-contamination guidance):
+        //filter captured activities to this test's tenant before asserting.
+        List<ActivityEvent> dropEvents = captured
+            .Where(a => string.Equals(
+                a.GetTagItem(ServerTagNames.TenantId) as string, segment, StringComparison.Ordinal))
+            .SelectMany(a => a.Events)
+            .Where(e => string.Equals(e.Name, OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant, StringComparison.Ordinal))
+            .ToList();
+
+        Assert.IsGreaterThan(0, dropEvents.Count,
+            $"A '{OAuthEventNames.IdentityScopesDroppedForNonEndUserGrant}' event tagged with tenant "
+            + $"'{segment}' must be emitted.");
+
+        string droppedScopesTagValue = dropEvents[0].Tags
+            .FirstOrDefault(t => string.Equals(t.Key, OAuthEventNames.DroppedScopesTagName, StringComparison.Ordinal))
+            .Value as string ?? string.Empty;
+        string[] droppedTokens = droppedScopesTagValue.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+        Assert.HasCount(5, droppedTokens, $"Dropped scopes tag was '{droppedScopesTagValue}'.");
+        Assert.Contains(WellKnownScopes.OpenId, droppedTokens);
+        Assert.Contains(WellKnownScopes.Profile, droppedTokens);
+        Assert.Contains(WellKnownScopes.Email, droppedTokens);
+        Assert.Contains(WellKnownScopes.Address, droppedTokens);
+        Assert.Contains(WellKnownScopes.Phone, droppedTokens);
+    }
+
+
     /// <summary>
     /// Wires the seam to the given <paramref name="decision"/>, dispatches a well-formed token
     /// request, and asserts the response status and error code the library mapped it to.
diff --git a/test/Verifiable.Tests/OAuth/Oid4VpFlowIntegrationTests.cs b/test/Verifiable.Tests/OAuth/Oid4VpFlowIntegrationTests.cs
index 6fb6733f..79900a5a 100644
--- a/test/Verifiable.Tests/OAuth/Oid4VpFlowIntegrationTests.cs
+++ b/test/Verifiable.Tests/OAuth/Oid4VpFlowIntegrationTests.cs
@@ -2510,9 +2510,9 @@ await app.CreateHttpBackedOid4VpWalletClientAsync(
     //The interim test scope (full §3c gets two real Kestrels once §3e ships
     //the /.well-known/openid-federation endpoint):
     //  - TestHostShell owns two HostedAuthorizationServers via AddHost; only
-    //    the Verifier serves HTTP for now. The anchor host scaffolds the
+    //    the Verifier serves HTTPS for now. The anchor host scaffolds the
     //    multi-host shape for §3e.
-    //  - PAR + JAR-fetch + direct_post all over real HTTP via the Kestrel
+    //  - PAR + JAR-fetch + direct_post all over real HTTPS via the Kestrel
     //    listener.
     //  - The Wallet validates the inline trust_chain via
     //    FederationBoundJarKeyResolver and asserts the chain-resolved key
@@ -2527,7 +2527,7 @@ public async Task FederationTrustChainInlineInJarHeaderOverHttpReachesAccept()
         await using TestHostShell app = new(TimeProvider);
 
         //Scaffolding-only for §3c-interim — the anchor host has its own
-        //per-host state container but does not serve HTTP yet (its Kestrel
+        //per-host state container but does not serve HTTPS yet (its listener
         //starts once §3e wires /.well-known/openid-federation). Adding the
         //host here proves the multi-host orchestration extracted in §3a.
         HostedAuthorizationServer anchorHost = app.AddHost("anchor");
diff --git a/test/Verifiable.Tests/OAuth/Oid4VpX509RequestUriPostFlowTests.cs b/test/Verifiable.Tests/OAuth/Oid4VpX509RequestUriPostFlowTests.cs
index 258f53fd..db4d70fe 100644
--- a/test/Verifiable.Tests/OAuth/Oid4VpX509RequestUriPostFlowTests.cs
+++ b/test/Verifiable.Tests/OAuth/Oid4VpX509RequestUriPostFlowTests.cs
@@ -109,7 +109,7 @@ await SdJwtVpFixture.IssuePidCredentialAsync(
         scheme.PlaceTrustMaterial(exchangeContext);
 
         //The wallet's sends route through the guarded chokepoint; the test
-        //deployment's listener is loopback http, so the policy is relaxed for
+        //deployment's listener is loopback https, so the policy is relaxed for
         //exactly that — the deployment's explicit per-call choice.
         exchangeContext.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
 
@@ -133,6 +133,6 @@ await SdJwtVpFixture.IssuePidCredentialAsync(
         PresentationVerifiedState verified = (PresentationVerifiedState)app.GetFlowState(parHandle).State;
         Assert.IsTrue(verified.Claims.ContainsKey("pid"),
             "Verifier must reach PresentationVerified for the x509 + request_uri_method=post + " +
-            "encrypted-JAR flow driven entirely over HTTP.");
+            "encrypted-JAR flow driven entirely over HTTPS.");
     }
 }
diff --git a/test/Verifiable.Tests/OAuth/Oidc10IdTokenNonceAudienceScenarioTests.cs b/test/Verifiable.Tests/OAuth/Oidc10IdTokenNonceAudienceScenarioTests.cs
new file mode 100644
index 00000000..663a5a98
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/Oidc10IdTokenNonceAudienceScenarioTests.cs
@@ -0,0 +1,346 @@
+using Microsoft.Extensions.Time.Testing;
+using System.Text.Json;
+using Verifiable.Core;
+using Verifiable.Core.Assessment;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.Microsoft;
+using Verifiable.OAuth;
+using Verifiable.OAuth.Oidc;
+using Verifiable.OAuth.Pkce;
+using Verifiable.OAuth.Server;
+using Verifiable.Server;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Firewalled end-to-end scenario for the OIDC Core §3.1.3.7 checks
+/// <see cref="Oidc10IdTokenValidator.ValidateAsync"/> enforces only when the caller opts in: the
+/// <c>nonce</c> conditional-MUST and the untrusted-audience rejection MUST. Also proves that
+/// <c>auth_time</c>/<c>acr</c>/<c>sid</c> are surfaced on every successful validation regardless of
+/// whether the caller enforces them, so a caller that requested <c>acr_values</c>/<c>max_age</c> can
+/// apply those §3.1.3.7 SHOULDs itself. Every id_token is minted through the REAL pipeline — a full
+/// PAR → Authorize → Token exchange over the library's production issuance path; the relying party
+/// reconstructs from the wire body alone and runs the full validation including the signature, the
+/// same shape <see cref="AzpMultiAudienceScenarioTests"/> uses for the azp scenarios.
+/// </summary>
+[TestClass]
+internal sealed class Oidc10IdTokenNonceAudienceScenarioTests
+{
+    private const string ClientId = "https://oidc-nonce-aud.client.test";
+    private const string SubjectId = "subject-oidc-nonce-aud-1";
+    private const string SecondAudience = "https://second-audience.example.com";
+    private const string EstablishedAcr = "urn:example:acr:established-loa";
+    private const string EstablishedSessionId = "session-oidc-nonce-aud-01";
+
+    private static readonly Uri ClientBaseUri = new(ClientId);
+    private static readonly Uri RedirectUri = new("https://client.example.com/callback");
+    private static readonly TimeSpan IatSkew = TimeSpan.FromSeconds(60);
+
+    //Test-local claim id for the deployment contributor adding a second audience; the
+    //WellKnownClaimIds registry holds the library-shipped ones.
+    private static readonly ClaimId SecondAudienceClaimId = ClaimId.Create(9110, "TestSecondAudience");
+
+    public TestContext TestContext { get; set; } = null!;
+
+    private FakeTimeProvider TimeProvider { get; } = new(TestClock.CanonicalEpoch);
+
+
+    /// <summary>An id_token whose nonce equals the expected value validates, and the authentication-context claims arrive on the result.</summary>
+    [TestMethod]
+    public async Task MatchingNonceValidatesAndSurfacesAuthenticationContext()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        //acr is emitted on the original-authentication id_token exclusively from the application's
+        //OIDC-claims resolver (AcrAmrClaimContributor's documented behaviour); sid comes from the
+        //authorize-time ExchangeContext stamp instead, wired below via SetSessionId.
+        host.Server.OAuth().ResolveOidcClaimsAsync = (subject, grantedScope, tenantId, ctx, cancellationToken) =>
+            ValueTask.FromResult<OidcClaims?>(new OidcClaims
+            {
+                Subject = subject,
+                AuthContext = new AuthenticationContext { Acr = EstablishedAcr }
+            });
+
+        const string RequestNonce = "nonce-match-01";
+        string idToken = await DriveCodeExchangeForIdTokenAsync(
+            host, material, nonce: RequestNonce, stampSessionId: true).ConfigureAwait(false);
+
+        Oidc10IdTokenValidationResult result = await ValidateAsRelyingPartyAsync(
+            idToken, material, expectedNonce: RequestNonce, trustedAudiences: null).ConfigureAwait(false);
+
+        Assert.IsTrue(result.IsSuccess,
+            $"An id_token whose nonce matches the expected nonce must validate; got {result.FailureReason}: {result.FailureDescription}");
+        Assert.AreEqual(RequestNonce, result.Claims!.Nonce);
+        Assert.IsNotNull(result.Claims.AuthTime, "auth_time must be surfaced — the AS always establishes it at authorize time.");
+        Assert.AreEqual(EstablishedAcr, result.Claims.Acr);
+        Assert.AreEqual(EstablishedSessionId, result.Claims.Sid);
+    }
+
+
+    /// <summary>An id_token whose nonce differs from the expected value is rejected with <see cref="JwsAccessTokenValidationFailureReason.NonceMismatch"/>.</summary>
+    [TestMethod]
+    public async Task MismatchedNonceIsRejected()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        string idToken = await DriveCodeExchangeForIdTokenAsync(
+            host, material, nonce: "nonce-actual-01", stampSessionId: false).ConfigureAwait(false);
+
+        Oidc10IdTokenValidationResult result = await ValidateAsRelyingPartyAsync(
+            idToken, material, expectedNonce: "nonce-expected-different-01", trustedAudiences: null).ConfigureAwait(false);
+
+        Assert.IsFalse(result.IsSuccess);
+        Assert.AreEqual(JwsAccessTokenValidationFailureReason.NonceMismatch, result.FailureReason,
+            "A nonce that does not equal the expected value must be rejected (OIDC Core §3.1.3.7).");
+    }
+
+
+    /// <summary>An id_token carrying no nonce is rejected when a nonce is expected, but validates when the caller checks none.</summary>
+    [TestMethod]
+    public async Task AbsentNonceIsRejectedOnlyWhenExpected()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        //No nonce sent in the authentication request — the id_token carries none.
+        string idToken = await DriveCodeExchangeForIdTokenAsync(
+            host, material, nonce: null, stampSessionId: false).ConfigureAwait(false);
+
+        Oidc10IdTokenValidationResult enforced = await ValidateAsRelyingPartyAsync(
+            idToken, material, expectedNonce: "nonce-expected-01", trustedAudiences: null).ConfigureAwait(false);
+
+        Assert.IsFalse(enforced.IsSuccess);
+        Assert.AreEqual(JwsAccessTokenValidationFailureReason.NonceMismatch, enforced.FailureReason,
+            "An id_token with no nonce must be rejected when the relying party expects one (OIDC Core §3.1.3.7).");
+
+        //A relying party that sent no nonce does not check it — the same wire token validates.
+        Oidc10IdTokenValidationResult lenient = await ValidateAsRelyingPartyAsync(
+            idToken, material, expectedNonce: null, trustedAudiences: null).ConfigureAwait(false);
+
+        Assert.IsTrue(lenient.IsSuccess,
+            $"Without an expected nonce, nonce is surfaced but not enforced; got {lenient.FailureReason}: {lenient.FailureDescription}");
+        Assert.IsNull(lenient.Claims!.Nonce);
+    }
+
+
+    /// <summary>
+    /// A multi-audience id_token is rejected when the extra audience is outside the relying party's
+    /// trust set, accepted when the relying party explicitly trusts it, and accepted when the relying
+    /// party supplies no trust set at all (the MUST is opt-in).
+    /// </summary>
+    [TestMethod]
+    public async Task UntrustedAudienceIsRejectedButAcceptedWhenTrustedOrUnchecked()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        ApplySecondAudienceContributor(host);
+
+        string idToken = await DriveCodeExchangeForIdTokenAsync(
+            host, material, nonce: null, stampSessionId: false).ConfigureAwait(false);
+
+        //A relying party that trusts only the expected audience rejects the extra untrusted one.
+        Oidc10IdTokenValidationResult untrusted = await ValidateAsRelyingPartyAsync(
+            idToken, material, expectedNonce: null, trustedAudiences: []).ConfigureAwait(false);
+
+        Assert.IsFalse(untrusted.IsSuccess);
+        Assert.AreEqual(JwsAccessTokenValidationFailureReason.UntrustedAudience, untrusted.FailureReason,
+            "An aud member outside the caller's trust set must be rejected (OIDC Core §3.1.3.7).");
+
+        //A relying party that explicitly trusts the extra audience accepts the same wire token.
+        Oidc10IdTokenValidationResult trusted = await ValidateAsRelyingPartyAsync(
+            idToken, material, expectedNonce: null, trustedAudiences: [SecondAudience]).ConfigureAwait(false);
+
+        Assert.IsTrue(trusted.IsSuccess,
+            $"An aud member inside the caller's trust set must validate; got {trusted.FailureReason}: {trusted.FailureDescription}");
+        Assert.HasCount(2, trusted.Claims!.Audience);
+        Assert.Contains(SecondAudience, trusted.Claims.Audience);
+
+        //With no trust set supplied at all, the additional-audience MUST is not enforced.
+        Oidc10IdTokenValidationResult noTrustSetSupplied = await ValidateAsRelyingPartyAsync(
+            idToken, material, expectedNonce: null, trustedAudiences: null).ConfigureAwait(false);
+
+        Assert.IsTrue(noTrustSetSupplied.IsSuccess,
+            $"Without a trusted-audience set, the additional-audience MUST is not enforced; got {noTrustSetSupplied.FailureReason}: {noTrustSetSupplied.FailureDescription}");
+    }
+
+
+    /// <summary>
+    /// Replaces the host's claim issuer with the standard rules plus a deployment contributor that
+    /// adds a second, application-chosen audience to the ID Token — the shape the untrusted-audience
+    /// scenarios validate against.
+    /// </summary>
+    private void ApplySecondAudienceContributor(TestHostShell host)
+    {
+        List<ClaimDelegate<ClaimContributionTarget>> rules = ContributionProfiles.StandardRules();
+        rules.Add(new ClaimDelegate<ClaimContributionTarget>(
+            new(ContributeSecondAudience), [SecondAudienceClaimId]));
+
+        host.Server.OAuth().ClaimIssuer = new ClaimIssuer<ClaimContributionTarget>(
+            WellKnownAssessorIds.ClaimContributors, rules, TimeProvider);
+    }
+
+
+    private static ValueTask<List<Claim>> ContributeSecondAudience(
+        ClaimContributionTarget target, CancellationToken cancellationToken)
+    {
+        if(target is not IdTokenTarget)
+        {
+            return ValueTask.FromResult<List<Claim>>(
+                [new Claim(SecondAudienceClaimId, ClaimOutcome.NotApplicable)]);
+        }
+
+        return ValueTask.FromResult<List<Claim>>(
+        [
+            new Claim(SecondAudienceClaimId, ClaimOutcome.Success,
+                new ClaimContributionContext(WellKnownJwtClaimNames.Aud, new[] { ClientId, SecondAudience }),
+                Claim.NoSubClaims)
+        ]);
+    }
+
+
+    /// <summary>
+    /// Drives the full PAR → Authorize → Token exchange with the <c>openid</c> scope, optionally
+    /// carrying <paramref name="nonce"/> on the authentication request and optionally stamping the
+    /// authorize-time <c>sid</c> via <paramref name="stampSessionId"/>, and returns the <c>id_token</c>
+    /// from the wire body.
+    /// </summary>
+    private async Task<string> DriveCodeExchangeForIdTokenAsync(
+        TestHostShell host, VerifierKeyMaterial material, string? nonce, bool stampSessionId)
+    {
+        PkceParameters pkce = PkceGeneration.Generate(
+            TestSetup.Base64UrlEncoder, BaseMemoryPool.Shared);
+
+        RequestFields parFields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.CodeChallenge] = pkce.EncodedChallenge,
+            [OAuthRequestParameterNames.CodeChallengeMethod] = WellKnownCodeChallengeMethods.S256,
+            [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString,
+            [OAuthRequestParameterNames.Scope] = WellKnownScopes.OpenId
+        };
+        if(nonce is not null)
+        {
+            parFields[WellKnownJwtClaimNames.Nonce] = nonce;
+        }
+
+        ServerHttpResponse parResponse = await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value,
+            WellKnownEndpointNames.AuthCodePar, WellKnownHttpMethods.Post,
+            parFields, new ExchangeContext(),
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(201, parResponse.StatusCode, parResponse.Body);
+        string requestUri = ExtractFromBody(parResponse.Body!, "request_uri");
+
+        RequestFields authorizeFields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.RequestUri] = requestUri
+        };
+        ExchangeContext authorizeContext = new();
+        authorizeContext.SetSubjectId(SubjectId);
+        if(stampSessionId)
+        {
+            authorizeContext.SetSessionId(EstablishedSessionId);
+        }
+
+        ServerHttpResponse authorizeResponse = await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value,
+            WellKnownEndpointNames.AuthCodeAuthorize, WellKnownHttpMethods.Get,
+            authorizeFields, authorizeContext,
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(302, authorizeResponse.StatusCode);
+        string code = ExtractCode(authorizeResponse.Location!);
+
+        RequestFields tokenFields = new()
+        {
+            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.AuthorizationCode,
+            [OAuthRequestParameterNames.Code] = code,
+            [OAuthRequestParameterNames.CodeVerifier] = pkce.EncodedVerifier,
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString
+        };
+        ServerHttpResponse tokenResponse = await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value,
+            WellKnownEndpointNames.AuthCodeToken, WellKnownHttpMethods.Post,
+            tokenFields, new ExchangeContext(),
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, tokenResponse.StatusCode, tokenResponse.Body);
+
+        return ExtractFromBody(tokenResponse.Body!, "id_token");
+    }
+
+
+    /// <summary>
+    /// The relying party's validation from wire bytes only: full signature verification plus the
+    /// §3.1.3.7 issuer/audience checks, with the caller-supplied nonce and trusted-audience
+    /// expectations under test. The verification key resolves by the token's kid, the way a
+    /// deployment resolves against the fetched JWKS.
+    /// </summary>
+    private async Task<Oidc10IdTokenValidationResult> ValidateAsRelyingPartyAsync(
+        string idToken,
+        VerifierKeyMaterial material,
+        string? expectedNonce,
+        IReadOnlyCollection<string>? trustedAudiences)
+    {
+        ServerVerificationKeyResolverDelegate resolveKey = (kid, tenant, ctx, ct) =>
+            ValueTask.FromResult<PublicKeyMemory?>(
+                string.Equals(kid.Value, material.SigningKeyId.Value, StringComparison.Ordinal)
+                    ? material.SigningPublicKey : null);
+
+        return await Oidc10IdTokenValidator.ValidateAsync(
+            idToken,
+            material.Registration.IssuerUri!.OriginalString,
+            ClientId,
+            resolveKey,
+            MicrosoftCryptographicFunctions.VerifyP256Async,
+            JwsAccessTokenTestSupport.Parser,
+            TestSetup.Base64UrlDecoder,
+            TimeProvider,
+            BaseMemoryPool.Shared,
+            IatSkew,
+            tenantId: default,
+            new ExchangeContext(),
+            expectedAuthorizedParty: null,
+            expectedNonce,
+            trustedAudiences,
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    private static string ExtractFromBody(string body, string property)
+    {
+        using JsonDocument doc = JsonDocument.Parse(body);
+
+        return doc.RootElement.GetProperty(property).GetString()!;
+    }
+
+
+    private static string ExtractCode(string location)
+    {
+        Uri uri = new(location);
+        string query = uri.Query.TrimStart('?');
+        foreach(string pair in query.Split('&'))
+        {
+            string[] parts = pair.Split('=', 2);
+            if(parts.Length == 2 && parts[0] == "code")
+            {
+                return Uri.UnescapeDataString(parts[1]);
+            }
+        }
+
+        throw new InvalidOperationException($"No code in redirect: {location}");
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/PrivateKeyJwtClientAuthenticationTests.cs b/test/Verifiable.Tests/OAuth/PrivateKeyJwtClientAuthenticationTests.cs
new file mode 100644
index 00000000..bfc3034b
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/PrivateKeyJwtClientAuthenticationTests.cs
@@ -0,0 +1,525 @@
+using System.Text;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.OAuth;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Dpop;
+using Verifiable.OAuth.Server;
+using Verifiable.OAuth.WellKnown;
+using Verifiable.Server;
+using Verifiable.Tests.TestDataProviders;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Claim-rule matrix for <see cref="PrivateKeyJwtClientAuthentication"/> — the RFC 7523 §2.2/§3/§3.2
+/// <c>private_key_jwt</c> client-authentication seam draft-ietf-oauth-client-id-metadata-document-02
+/// §8.2 (CIMD-047/048/049/050) requires. Part A exercises the pure
+/// <see cref="PrivateKeyJwtClientAuthentication.Validate"/> claim rules directly, mirroring
+/// <c>Rfc7523AssertionValidationTests</c>'s style. Part B exercises the full
+/// <see cref="PrivateKeyJwtClientAuthentication.BuildValidator(System.Collections.Generic.IReadOnlyCollection{string}?,CheckClientAssertionJtiReplayDelegate?)"/>
+/// pipeline — parse, key resolution from a JWKS, real signature verification, then the claim rules —
+/// against a project-crypto-generated P-256 key pair via <see cref="TestKeyMaterialProvider"/> and
+/// <see cref="ClientAssertionSigning"/>, never <c>System.Security.Cryptography</c> directly.
+/// </summary>
+[TestClass]
+internal sealed class PrivateKeyJwtClientAuthenticationTests
+{
+    private const string ClientId = "https://client.example/app";
+    private const string Issuer = "https://issuer.test/tenant-a";
+    private const string SigningKeyId = "test-client-key-1";
+
+    private static readonly DateTimeOffset Now = DateTimeOffset.FromUnixTimeSeconds(1_311_280_970);
+    private static readonly TimeSpan Skew = TimeSpan.FromSeconds(60);
+
+    public TestContext TestContext { get; set; } = null!;
+
+
+    //Part A — the pure claim-rule checker. No crypto, no host: JwtPayload is constructed directly,
+    //exactly as an already-signature-verified assertion payload would arrive.
+
+    private static JwtPayload ValidPayload() =>
+        new(capacity: 6)
+        {
+            [WellKnownJwtClaimNames.Iss] = ClientId,
+            [WellKnownJwtClaimNames.Sub] = ClientId,
+            [WellKnownJwtClaimNames.Aud] = Issuer,
+            [WellKnownJwtClaimNames.Iat] = Now.AddMinutes(-1).ToUnixTimeSeconds(),
+            [WellKnownJwtClaimNames.Exp] = Now.AddMinutes(5).ToUnixTimeSeconds(),
+            [WellKnownJwtClaimNames.Jti] = "assertion-jti-1"
+        };
+
+
+    private static PrivateKeyJwtClientAuthenticationResult Validate(JwtPayload payload) =>
+        PrivateKeyJwtClientAuthentication.Validate(payload, ClientId, [Issuer], Now, Skew);
+
+
+    [TestMethod]
+    public void ValidAssertionPassesAndSurfacesClaims()
+    {
+        PrivateKeyJwtClientAuthenticationResult result = Validate(ValidPayload());
+
+        Assert.IsTrue(result.IsValid, result.FailureReason);
+        Assert.AreEqual(ClientId, result.ClientId);
+        Assert.AreEqual("assertion-jti-1", result.Jti);
+        Assert.IsNotNull(result.Expiration);
+    }
+
+
+    /// <summary>RFC 7523 §3 item 1: a wrong <c>iss</c> (not the client_id) is rejected.</summary>
+    [TestMethod]
+    public void WrongIssuerIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Iss] = "https://impostor.example/app";
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+        Assert.IsNull(result.ClientId);
+    }
+
+
+    /// <summary>RFC 7523 §3 item 2.B: a wrong <c>sub</c> (not the client_id) is rejected.</summary>
+    [TestMethod]
+    public void WrongSubjectIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Sub] = "https://impostor.example/app";
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>RFC 7523 §3 item 3: an <c>aud</c> naming a foreign authorization server is rejected.</summary>
+    [TestMethod]
+    public void ForeignAudienceIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Aud] = "https://other-as.example/";
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>
+    /// An <c>aud</c> array carrying the accepted issuer ALONGSIDE a foreign value is rejected outright
+    /// — every element must be an accepted AS identity, not merely one of them.
+    /// </summary>
+    [TestMethod]
+    public void ForeignAudienceMixedIntoArrayIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Aud] = new object[] { Issuer, "https://evil.example/" };
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>Missing <c>aud</c> is rejected (RFC 7523 §3 item 3).</summary>
+    [TestMethod]
+    public void MissingAudienceIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload.Remove(WellKnownJwtClaimNames.Aud);
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>
+    /// RFC 7523 §3 item 3: "The token endpoint URL of the authorization server MAY be used as a
+    /// value for an aud element" — a caller that additionally accepts the token endpoint URL sees an
+    /// assertion audienced to it validate.
+    /// </summary>
+    [TestMethod]
+    public void TokenEndpointUrlIsAnAcceptedAlternateAudience()
+    {
+        const string TokenEndpoint = "https://issuer.test/tenant-a/token";
+
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Aud] = TokenEndpoint;
+
+        PrivateKeyJwtClientAuthenticationResult result = PrivateKeyJwtClientAuthentication.Validate(
+            payload, ClientId, [Issuer, TokenEndpoint], Now, Skew);
+
+        Assert.IsTrue(result.IsValid, result.FailureReason);
+    }
+
+
+    /// <summary>RFC 7523 §3 item 4: an expired assertion (subject to skew) is rejected.</summary>
+    [TestMethod]
+    public void ExpiredAssertionIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Iat] = Now.AddMinutes(-10).ToUnixTimeSeconds();
+        payload[WellKnownJwtClaimNames.Exp] = Now.AddMinutes(-5).ToUnixTimeSeconds();
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>"iat sanity": an <c>iat</c> claiming issuance far in the future is rejected.</summary>
+    [TestMethod]
+    public void AbsurdFutureIssuedAtIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Iat] = Now.AddYears(10).ToUnixTimeSeconds();
+        payload[WellKnownJwtClaimNames.Exp] = Now.AddYears(10).AddMinutes(5).ToUnixTimeSeconds();
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>A missing <c>jti</c> is rejected — required for this profile's replay defense.</summary>
+    [TestMethod]
+    public void MissingJtiIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload.Remove(WellKnownJwtClaimNames.Jti);
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary>RFC 7523 §3 item 5: a future <c>nbf</c> (beyond skew) makes the assertion not yet valid.</summary>
+    [TestMethod]
+    public void FutureNotBeforeIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Nbf] = Now.AddMinutes(2).ToUnixTimeSeconds();
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    /// <summary><c>exp</c> at or before <c>iat</c> is an internally inconsistent, non-positive lifetime.</summary>
+    [TestMethod]
+    public void ExpiryAtOrBeforeIssuedAtIsRejected()
+    {
+        JwtPayload payload = ValidPayload();
+        payload[WellKnownJwtClaimNames.Iat] = Now.ToUnixTimeSeconds();
+        payload[WellKnownJwtClaimNames.Exp] = Now.AddMinutes(-1).ToUnixTimeSeconds();
+
+        PrivateKeyJwtClientAuthenticationResult result = Validate(payload);
+
+        Assert.IsFalse(result.IsValid);
+    }
+
+
+    //Part B — the full BuildValidator() pipeline: real compact-JWS parsing, key resolution from a
+    //ClientJwks JSON document, real P-256 signature verification, then Validate. TestHostShell supplies
+    //a fully-wired EndpointServer (codecs, crypto); the ClientRecord under test is a local `with` copy
+    //that is never re-registered with the dispatcher — the delegate is invoked directly, which is the
+    //seam this test targets.
+
+    [TestMethod]
+    public async Task HappyPathWithProjectCryptoGeneratedKeyAuthenticates()
+    {
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId, new Uri(ClientId), profile: PolicyProfile.Rfc6749WithPkce);
+
+        var clientKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            ClientRecord registration = BuildConfidentialRegistration(material.Registration, clientKeys.PublicKey);
+            ValidateClientCredentialsDelegate validator = PrivateKeyJwtClientAuthentication.BuildValidator();
+
+            string assertion = await SignAssertionAsync(
+                app.Server, registration.ClientId, registration.IssuerUri!.OriginalString, clientKeys.PrivateKey)
+                .ConfigureAwait(false);
+
+            RequestFields fields = BuildFields(assertion);
+            ExchangeContext context = BuildContext(app.Server);
+
+            bool authenticated = await validator(null, fields, registration, context, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+            Assert.IsTrue(authenticated);
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    [TestMethod]
+    public async Task TamperedSignatureIsRejected()
+    {
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId, new Uri(ClientId), profile: PolicyProfile.Rfc6749WithPkce);
+
+        var clientKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            ClientRecord registration = BuildConfidentialRegistration(material.Registration, clientKeys.PublicKey);
+            ValidateClientCredentialsDelegate validator = PrivateKeyJwtClientAuthentication.BuildValidator();
+
+            string assertion = await SignAssertionAsync(
+                app.Server, registration.ClientId, registration.IssuerUri!.OriginalString, clientKeys.PrivateKey)
+                .ConfigureAwait(false);
+
+            string[] segments = assertion.Split('.');
+            Assert.HasCount(3, segments);
+            char firstSignatureChar = segments[2][0];
+            char flipped = firstSignatureChar == 'A' ? 'B' : 'A';
+            string tampered = string.Join('.', segments[0], segments[1], flipped + segments[2][1..]);
+
+            RequestFields fields = BuildFields(tampered);
+            ExchangeContext context = BuildContext(app.Server);
+
+            bool authenticated = await validator(null, fields, registration, context, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+            Assert.IsFalse(authenticated);
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// An assertion signed by a DIFFERENT key than the one published in <c>ClientJwks</c> is rejected —
+    /// proves the signature check verifies against the REGISTERED key, not merely that some signature
+    /// is present.
+    /// </summary>
+    [TestMethod]
+    public async Task AssertionSignedByAnUnregisteredKeyIsRejected()
+    {
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId, new Uri(ClientId), profile: PolicyProfile.Rfc6749WithPkce);
+
+        var registeredKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        var attackerKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            //The published JWKS carries the REGISTERED public key; the assertion is signed with the
+            //ATTACKER's distinct private key.
+            ClientRecord registration = BuildConfidentialRegistration(material.Registration, registeredKeys.PublicKey);
+            ValidateClientCredentialsDelegate validator = PrivateKeyJwtClientAuthentication.BuildValidator();
+
+            string assertion = await SignAssertionAsync(
+                app.Server, registration.ClientId, registration.IssuerUri!.OriginalString, attackerKeys.PrivateKey)
+                .ConfigureAwait(false);
+
+            RequestFields fields = BuildFields(assertion);
+            ExchangeContext context = BuildContext(app.Server);
+
+            bool authenticated = await validator(null, fields, registration, context, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+            Assert.IsFalse(authenticated);
+        }
+        finally
+        {
+            registeredKeys.PublicKey.Dispose();
+            registeredKeys.PrivateKey.Dispose();
+            attackerKeys.PublicKey.Dispose();
+            attackerKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    [TestMethod]
+    public async Task MissingClientAssertionTypeIsRejected()
+    {
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId, new Uri(ClientId), profile: PolicyProfile.Rfc6749WithPkce);
+
+        var clientKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            ClientRecord registration = BuildConfidentialRegistration(material.Registration, clientKeys.PublicKey);
+            ValidateClientCredentialsDelegate validator = PrivateKeyJwtClientAuthentication.BuildValidator();
+
+            string assertion = await SignAssertionAsync(
+                app.Server, registration.ClientId, registration.IssuerUri!.OriginalString, clientKeys.PrivateKey)
+                .ConfigureAwait(false);
+
+            RequestFields fields = new();
+            fields[OAuthRequestParameterNames.ClientAssertion] = assertion;
+            //client_assertion_type deliberately omitted.
+            ExchangeContext context = BuildContext(app.Server);
+
+            bool authenticated = await validator(null, fields, registration, context, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+            Assert.IsFalse(authenticated);
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    [TestMethod]
+    public async Task WrongClientAssertionTypeIsRejected()
+    {
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId, new Uri(ClientId), profile: PolicyProfile.Rfc6749WithPkce);
+
+        var clientKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            ClientRecord registration = BuildConfidentialRegistration(material.Registration, clientKeys.PublicKey);
+            ValidateClientCredentialsDelegate validator = PrivateKeyJwtClientAuthentication.BuildValidator();
+
+            string assertion = await SignAssertionAsync(
+                app.Server, registration.ClientId, registration.IssuerUri!.OriginalString, clientKeys.PrivateKey)
+                .ConfigureAwait(false);
+
+            RequestFields fields = new();
+            fields[OAuthRequestParameterNames.ClientAssertionType] = "urn:ietf:params:oauth:client-assertion-type:saml2-bearer";
+            fields[OAuthRequestParameterNames.ClientAssertion] = assertion;
+            ExchangeContext context = BuildContext(app.Server);
+
+            bool authenticated = await validator(null, fields, registration, context, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+            Assert.IsFalse(authenticated);
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    [TestMethod]
+    public async Task MissingClientJwksFailsClosed()
+    {
+        await using TestHostShell app = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId, new Uri(ClientId), profile: PolicyProfile.Rfc6749WithPkce);
+
+        var clientKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            //A confidential-looking registration with no published key material at all.
+            ClientRecord registration = material.Registration with
+            {
+                TokenEndpointAuthMethod = ClientAuthenticationMethod.PrivateKeyJwt
+            };
+            ValidateClientCredentialsDelegate validator = PrivateKeyJwtClientAuthentication.BuildValidator();
+
+            string assertion = await SignAssertionAsync(
+                app.Server, registration.ClientId, registration.IssuerUri!.OriginalString, clientKeys.PrivateKey)
+                .ConfigureAwait(false);
+
+            RequestFields fields = BuildFields(assertion);
+            ExchangeContext context = BuildContext(app.Server);
+
+            bool authenticated = await validator(null, fields, registration, context, TestContext.CancellationToken)
+                .ConfigureAwait(false);
+
+            Assert.IsFalse(authenticated);
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    private static ClientRecord BuildConfidentialRegistration(ClientRecord baseline, PublicKeyMemory clientPublicKey)
+    {
+        string alg = CryptoFormatConversions.DefaultTagToJwaConverter(clientPublicKey.Tag);
+        IReadOnlyDictionary<string, string> jwk = DpopJwkUtilities.ToJwk(
+            clientPublicKey, alg, TestSetup.Base64UrlEncoder);
+
+        return baseline with
+        {
+            TokenEndpointAuthMethod = ClientAuthenticationMethod.PrivateKeyJwt,
+            ClientJwks = BuildJwksJson(jwk, SigningKeyId)
+        };
+    }
+
+
+    private static string BuildJwksJson(IReadOnlyDictionary<string, string> jwk, string kid)
+    {
+        StringBuilder sb = new();
+        sb.Append('{').Append('"').Append(WellKnownJwkMemberNames.Keys).Append("\":[{");
+        foreach(KeyValuePair<string, string> member in jwk)
+        {
+            sb.Append('"').Append(member.Key).Append("\":\"").Append(member.Value).Append("\",");
+        }
+
+        sb.Append('"').Append(WellKnownJwkMemberNames.Kid).Append("\":\"").Append(kid).Append("\"}]}");
+
+        return sb.ToString();
+    }
+
+
+    private async Task<string> SignAssertionAsync(
+        EndpointServer server, string clientId, string audience, PrivateKeyMemory clientPrivateKey)
+    {
+        var oauth = server.OAuth();
+        DateTimeOffset now = server.TimeProvider.GetUtcNow();
+
+        return await ClientAssertionSigning.SignAsync(
+            clientId,
+            audience,
+            Guid.NewGuid().ToString("N"),
+            now.AddMinutes(-1),
+            now.AddMinutes(5),
+            clientPrivateKey,
+            SigningKeyId,
+            oauth.Codecs.JwtHeaderSerializer!,
+            oauth.Codecs.JwtPayloadSerializer!,
+            oauth.Codecs.Encoder!,
+            BaseMemoryPool.Shared,
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    private static RequestFields BuildFields(string clientAssertion)
+    {
+        RequestFields fields = new();
+        fields[OAuthRequestParameterNames.ClientAssertionType] = WellKnownClientAssertionTypes.JwtBearer;
+        fields[OAuthRequestParameterNames.ClientAssertion] = clientAssertion;
+
+        return fields;
+    }
+
+
+    private static ExchangeContext BuildContext(EndpointServer server)
+    {
+        ExchangeContext context = new();
+        context.SetServer(server);
+
+        return context;
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/RedirectUriMatchingTests.cs b/test/Verifiable.Tests/OAuth/RedirectUriMatchingTests.cs
new file mode 100644
index 00000000..f2478e26
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/RedirectUriMatchingTests.cs
@@ -0,0 +1,175 @@
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.OAuth;
+using Verifiable.OAuth.Pkce;
+using Verifiable.OAuth.Server;
+using Verifiable.Server;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Adversarial vectors for <see cref="RedirectUriMatching.IsRegisteredExact"/> — RFC 9700 §2.1 /
+/// draft-ietf-oauth-client-id-metadata-document-02 §4.2 exact-match, simple-string-comparison
+/// redirect_uri enforcement. Part A drives the pure matcher directly; Part B proves the PAR
+/// endpoint (<see cref="WellKnownEndpointNames.AuthCodePar"/>) rejects a
+/// <see cref="Uri"/>-equal-but-string-different <c>redirect_uri</c> end-to-end via the real
+/// dispatcher (<c>TestHostShell.DispatchAtEndpointAsync</c>), never <see cref="Uri.Equals(object?)"/>.
+/// </summary>
+[TestClass]
+internal sealed class RedirectUriMatchingTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private const string ClientId = "https://client.example.com";
+    private static readonly Uri ClientBaseUri = new(ClientId);
+
+    //The redirect URI TestHostShell.RegisterDpopClient registers by default.
+    private static readonly Uri RegisteredRedirectUri = new("https://client.example.com/callback");
+
+
+    //Part A — the pure matcher, no host.
+
+    [TestMethod]
+    public void ExactStringMatchIsAccepted()
+    {
+        Uri registered = new("https://app.example/cb");
+        Uri requested = new("https://app.example/cb");
+
+        bool isMatch = RedirectUriMatching.IsRegisteredExact([registered], requested);
+
+        Assert.IsTrue(isMatch);
+    }
+
+
+    /// <summary>
+    /// draft-ietf-oauth-client-id-metadata-document-02 §3's own example: a registered URL with no
+    /// explicit port and a requested URL carrying the DEFAULT https port (:443) are NOT equivalent
+    /// under simple string comparison, even though <see cref="Uri"/> equality treats them as the
+    /// same authority.
+    /// </summary>
+    [TestMethod]
+    public void DefaultPortVariantIsRejected()
+    {
+        Uri registered = new("https://app.example/cb");
+        Uri requested = new("https://app.example:443/cb");
+
+        //Sanity: Uri equality DOES consider these the same — this is exactly the laxity
+        //RedirectUriMatching exists to avoid.
+        Assert.AreEqual(registered, requested);
+
+        bool isMatch = RedirectUriMatching.IsRegisteredExact([registered], requested);
+
+        Assert.IsFalse(isMatch);
+    }
+
+
+    /// <summary>
+    /// A percent-encoding case variant (<c>%2F</c> vs <c>%2f</c>) is a different octet sequence on
+    /// the wire per RFC 3986 §6.2.1 simple string comparison, even though some URI parsers
+    /// case-normalize percent-encoded triplets.
+    /// </summary>
+    [TestMethod]
+    public void PercentEncodingCaseVariantIsRejected()
+    {
+        Uri registered = new("https://app.example/a%2Fb");
+        Uri requested = new("https://app.example/a%2fb");
+
+        bool isMatch = RedirectUriMatching.IsRegisteredExact([registered], requested);
+
+        Assert.IsFalse(isMatch);
+    }
+
+
+    [TestMethod]
+    public void NoRegisteredUrisNeverMatch()
+    {
+        Uri requested = new("https://app.example/cb");
+
+        bool isMatch = RedirectUriMatching.IsRegisteredExact([], requested);
+
+        Assert.IsFalse(isMatch);
+    }
+
+
+    [TestMethod]
+    public void MatchesOneOfSeveralRegisteredUris()
+    {
+        Uri[] registered =
+        [
+            new Uri("https://app.example/a"),
+            new Uri("https://app.example/cb"),
+            new Uri("https://app.example/c")
+        ];
+        Uri requested = new("https://app.example/cb");
+
+        bool isMatch = RedirectUriMatching.IsRegisteredExact(registered, requested);
+
+        Assert.IsTrue(isMatch);
+    }
+
+
+    //Part B — the PAR endpoint end-to-end, via the real dispatcher (TestHostShell.DispatchAtEndpointAsync).
+
+    /// <summary>
+    /// The PAR endpoint rejects a <c>redirect_uri</c> that differs from the registered value only
+    /// by an explicit default port — proving <see cref="RedirectUriMatching"/>, not
+    /// <see cref="Uri.Equals(object?)"/>, governs the wire enforcement (RFC 9700 §2.1 /
+    /// draft-ietf-oauth-client-id-metadata-document-02 §4.2).
+    /// </summary>
+    [TestMethod]
+    public async Task ParRejectsDefaultPortVariantOfRegisteredRedirectUri()
+    {
+        await using TestHostShell host = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        //Same authority under Uri equality, different octets under simple string comparison.
+        string portVariant = "https://client.example.com:443/callback";
+        Assert.AreEqual(RegisteredRedirectUri, new Uri(portVariant),
+            "Sanity: the :443 variant must be Uri-equal to the registered redirect_uri for this to be a meaningful adversarial vector.");
+
+        ServerHttpResponse response = await PushAsync(
+            host, material, redirectUri: portVariant).ConfigureAwait(false);
+
+        Assert.AreEqual(400, response.StatusCode, response.Body);
+        Assert.Contains(OAuthErrors.InvalidRequest, response.Body, StringComparison.Ordinal);
+    }
+
+
+    /// <summary>Sanity: the exact registered redirect_uri string is accepted by the same PAR path.</summary>
+    [TestMethod]
+    public async Task ParAcceptsExactRegisteredRedirectUri()
+    {
+        await using TestHostShell host = new(new FakeTimeProvider(TestClock.CanonicalEpoch));
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+        ServerHttpResponse response = await PushAsync(
+            host, material, redirectUri: RegisteredRedirectUri.OriginalString).ConfigureAwait(false);
+
+        Assert.AreEqual(201, response.StatusCode, response.Body);
+    }
+
+
+    private async Task<ServerHttpResponse> PushAsync(
+        TestHostShell host, VerifierKeyMaterial material, string redirectUri)
+    {
+        PkceParameters pkce = PkceGeneration.Generate(TestSetup.Base64UrlEncoder, BaseMemoryPool.Shared);
+
+        RequestFields fields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.CodeChallenge] = pkce.EncodedChallenge,
+            [OAuthRequestParameterNames.CodeChallengeMethod] = WellKnownCodeChallengeMethods.S256,
+            [OAuthRequestParameterNames.RedirectUri] = redirectUri,
+            [OAuthRequestParameterNames.Scope] = WellKnownScopes.OpenId
+        };
+
+        return await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value,
+            WellKnownEndpointNames.AuthCodePar, "POST",
+            fields, new ExchangeContext(),
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/RefreshConfidentialClientAuthenticationTests.cs b/test/Verifiable.Tests/OAuth/RefreshConfidentialClientAuthenticationTests.cs
new file mode 100644
index 00000000..a2b38a48
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/RefreshConfidentialClientAuthenticationTests.cs
@@ -0,0 +1,457 @@
+using System.Buffers;
+using System.Diagnostics.CodeAnalysis;
+using System.Net.Http;
+using System.Text;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Dpop;
+using Verifiable.OAuth.Server;
+using Verifiable.Tests.TestDataProviders;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Mirrors <see cref="AuthCodeClientAuthenticationTests"/> for the REFRESH leg: the real
+/// <see cref="AuthCodeClient.RefreshAsync(ClientRegistration, RefreshTokenRequest, ExchangeContext, ClientAssertionOptions?, System.Threading.CancellationToken)"/>
+/// attaches confidential-client authentication automatically per
+/// <see cref="ClientRegistration.AuthenticationMethod"/>, over the real wire, for every declared
+/// method — <c>client_secret_post</c>, <c>client_secret_basic</c>, and <c>private_key_jwt</c> — as
+/// well as leaving a <see cref="ClientAuthenticationMethod.None"/> public client's refresh untouched.
+/// Before this fix the refresh leg posted <see cref="Verifiable.OAuth.OutgoingHeaders.Empty"/>
+/// regardless of the declared method, so a confidential client's refresh always 401'd
+/// <c>invalid_client</c>; <see cref="ClientRecord.TokenEndpointAuthMethod"/> is set server-side so
+/// the refresh fails closed (draft-ietf-oauth-client-id-metadata-document-02 §8.2, CIMD-049/050)
+/// without the attached credential — a passing refresh therefore proves the client attached it, not
+/// that the server never asked.
+/// </summary>
+[TestClass]
+internal sealed class RefreshConfidentialClientAuthenticationTests
+{
+    /// <summary>MSTest's per-test context, supplying the cancellation token every wire call runs under.</summary>
+    public TestContext TestContext { get; set; } = null!;
+
+    /// <summary>The clock the host and the client share.</summary>
+    private FakeTimeProvider TimeProvider { get; } = new(TestClock.CanonicalEpoch);
+
+    private const string ClientId = "https://confidential-refresh.client.test";
+
+    private const string SubjectId = "subject-confidential-refresh-01";
+
+    private const string ClientSecret = "s3cret-of-the-confidential-refreshing-client";
+
+    private static Uri ClientBaseUri { get; } = new(ClientId);
+
+    private static Uri RedirectUri { get; } = new("https://client.example.com/callback");
+
+    private static MemoryPool<byte> Pool => BaseMemoryPool.Shared;
+
+
+    /// <summary>
+    /// <c>client_secret_post</c> (RFC 6749 §2.3.1): the real client attaches <c>client_id</c> +
+    /// <c>client_secret</c> to the REFRESH request body — no explicit <see cref="ClientAssertionOptions"/>
+    /// needed, driven through the plain <see cref="AuthCodeClient.RefreshAsync(ClientRegistration, RefreshTokenRequest, System.Threading.CancellationToken)"/>
+    /// path — and the server-side declared-method invariant requires it on the refresh leg too.
+    /// </summary>
+    [TestMethod]
+    public async Task ClientSecretPostRefreshesOverRealWire()
+    {
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> secretMaterial = BuildSecretKeyMaterial(ClientSecret);
+        try
+        {
+            await using TestHostShell host = new(TimeProvider);
+            using VerifierKeyMaterial material = host.RegisterDpopClient(
+                ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+            DeclareServerSideAuthMethod(host, material, ClientAuthenticationMethod.ClientSecretPost);
+
+            host.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
+                ValueTask.FromResult(
+                    fields.TryGetValue(OAuthRequestParameterNames.ClientSecret, out string? secret)
+                    && string.Equals(secret, ClientSecret, StringComparison.Ordinal));
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+                await host.CreateOAuthClientAndRegistrationAsync(
+                    material.Registration,
+                    RedirectUri.OriginalString,
+                    profile: PolicyProfile.Rfc6749WithPkce,
+                    TestContext.CancellationToken).ConfigureAwait(false);
+            registration = registration with
+            {
+                AuthenticationMethod = ClientAuthenticationMethod.ClientSecretPost,
+                AuthenticationKeyMaterial = secretMaterial
+            };
+
+            await DriveInitialIssuanceAndAssertRefreshSucceedsAsync(
+                host, client, registration, clientFlowStore, material.Registration.TenantId.Value).ConfigureAwait(false);
+        }
+        finally
+        {
+            secretMaterial.PublicKey.Dispose();
+            secretMaterial.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// <c>client_secret_basic</c> (RFC 6749 §2.3.1): the real client attaches an HTTP Basic
+    /// <c>Authorization</c> header to the refresh POST — again through the plain <c>RefreshAsync</c>
+    /// path, since this method needs no per-call <see cref="ClientAssertionOptions"/> either.
+    /// </summary>
+    [TestMethod]
+    public async Task ClientSecretBasicRefreshesOverRealWire()
+    {
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> secretMaterial = BuildSecretKeyMaterial(ClientSecret);
+        try
+        {
+            await using TestHostShell host = new(TimeProvider);
+            using VerifierKeyMaterial material = host.RegisterDpopClient(
+                ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+            DeclareServerSideAuthMethod(host, material, ClientAuthenticationMethod.ClientSecretBasic);
+
+            host.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
+                ValueTask.FromResult(DecodeAndMatchBasicHeader(request, registration.ClientId, ClientSecret));
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+                await host.CreateOAuthClientAndRegistrationAsync(
+                    material.Registration,
+                    RedirectUri.OriginalString,
+                    profile: PolicyProfile.Rfc6749WithPkce,
+                    TestContext.CancellationToken).ConfigureAwait(false);
+            registration = registration with
+            {
+                AuthenticationMethod = ClientAuthenticationMethod.ClientSecretBasic,
+                AuthenticationKeyMaterial = secretMaterial
+            };
+
+            await DriveInitialIssuanceAndAssertRefreshSucceedsAsync(
+                host, client, registration, clientFlowStore, material.Registration.TenantId.Value).ConfigureAwait(false);
+        }
+        finally
+        {
+            secretMaterial.PublicKey.Dispose();
+            secretMaterial.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// <c>private_key_jwt</c> (RFC 7523 §2.2): the real client signs and attaches a fresh
+    /// <c>client_assertion</c> to the refresh POST from <see cref="TestKeyMaterialProvider"/>-generated
+    /// P-256 key material, driven through <see cref="AuthCodeFlowDriver.DriveRefreshAsync"/>'s
+    /// <see cref="ClientAssertionOptions"/> overload, verified server-side by the real
+    /// <see cref="PrivateKeyJwtClientAuthentication.BuildValidator(System.Collections.Generic.IReadOnlyCollection{string}?,CheckClientAssertionJtiReplayDelegate?)"/>
+    /// pipeline over a published <c>ClientJwks</c> — the same production shape
+    /// <see cref="PrivateKeyJwtClientAuthenticationTests"/> exercises directly.
+    /// </summary>
+    [TestMethod]
+    public async Task PrivateKeyJwtRefreshesOverRealWire()
+    {
+        var clientKeys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            await using TestHostShell host = new(TimeProvider);
+            using VerifierKeyMaterial material = host.RegisterDpopClient(
+                ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+
+            //Start the listener before wiring the validator so the resolved token endpoint URL
+            //(the client-signed aud, per RFC 7523 §3 item 3) is known.
+            await host.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+            HostedAuthorizationServer hosted = host.Host("default");
+            string segment = material.Registration.TenantId.Value;
+            Uri tokenEndpoint = new(
+                hosted.HttpBaseAddress!, TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeToken, segment));
+
+            string alg = CryptoFormatConversions.DefaultTagToJwaConverter(clientKeys.PublicKey.Tag);
+            const string SigningKeyId = "confidential-refresh-client-key-1";
+            IReadOnlyDictionary<string, string> jwk = DpopJwkUtilities.ToJwk(
+                clientKeys.PublicKey, alg, TestSetup.Base64UrlEncoder);
+            string jwksJson = BuildJwksJson(jwk, SigningKeyId);
+            DeclareServerSideAuthMethod(
+                host, material, ClientAuthenticationMethod.PrivateKeyJwt, clientJwks: jwksJson);
+
+            host.Server.OAuth().ValidateClientCredentialsAsync =
+                PrivateKeyJwtClientAuthentication.BuildValidator(
+                    additionalAcceptedAudiences: [tokenEndpoint.OriginalString]);
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+                await host.CreateOAuthClientAndRegistrationAsync(
+                    material.Registration,
+                    RedirectUri.OriginalString,
+                    profile: PolicyProfile.Rfc6749WithPkce,
+                    TestContext.CancellationToken).ConfigureAwait(false);
+            registration = registration with
+            {
+                AuthenticationMethod = ClientAuthenticationMethod.PrivateKeyJwt,
+                AuthenticationKeyMaterial = clientKeys
+            };
+
+            ClientAssertionOptions assertionOptions = new()
+            {
+                SigningKeyId = SigningKeyId,
+                HeaderSerializer = host.Server.OAuth().Codecs.JwtHeaderSerializer!,
+                PayloadSerializer = host.Server.OAuth().Codecs.JwtPayloadSerializer!
+            };
+
+            await DriveInitialIssuanceAndAssertRefreshSucceedsAsync(
+                host, client, registration, clientFlowStore, segment,
+                clientAssertionOptions: assertionOptions).ConfigureAwait(false);
+        }
+        finally
+        {
+            clientKeys.PublicKey.Dispose();
+            clientKeys.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// A public client (<see cref="ClientAuthenticationMethod.None"/>, the default) attaches no
+    /// credential at either leg and relies on PKCE alone (RFC 6749 §6, §3.2.1) — the refresh leg's
+    /// new authentication attachment must not regress this baseline, unauthenticated case.
+    /// </summary>
+    [TestMethod]
+    public async Task NoneAuthPublicClientStillRefreshesOverRealWire()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+        //TokenEndpointAuthMethod deliberately left unset (null) — a public client presents no
+        //credential and the server does not require one.
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+            await host.CreateOAuthClientAndRegistrationAsync(
+                material.Registration,
+                RedirectUri.OriginalString,
+                profile: PolicyProfile.Rfc6749WithPkce,
+                TestContext.CancellationToken).ConfigureAwait(false);
+        //AuthenticationMethod deliberately left at its None default.
+
+        await DriveInitialIssuanceAndAssertRefreshSucceedsAsync(
+            host, client, registration, clientFlowStore, material.Registration.TenantId.Value).ConfigureAwait(false);
+    }
+
+
+    /// <summary>
+    /// Pins that the positive tests above prove genuine authentication rather than a server that
+    /// never checks: a declared confidential client whose refresh request carries no credential at
+    /// all (the registration's <see cref="ClientRegistration.AuthenticationMethod"/> stays
+    /// <see cref="ClientAuthenticationMethod.None"/> even though the server declared
+    /// <c>client_secret_post</c>) still gets refused — the exact 401 <c>invalid_client</c> behavior
+    /// this fix corrects FOR an attached credential, preserved for a MISSING one.
+    /// </summary>
+    [TestMethod]
+    public async Task DeclaredConfidentialClientRefreshWithoutAttachedCredentialFailsClosed()
+    {
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> secretMaterial = BuildSecretKeyMaterial(ClientSecret);
+        try
+        {
+            await using TestHostShell host = new(TimeProvider);
+            using VerifierKeyMaterial material = host.RegisterDpopClient(
+                ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+            DeclareServerSideAuthMethod(host, material, ClientAuthenticationMethod.ClientSecretPost);
+
+            host.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
+                ValueTask.FromResult(
+                    fields.TryGetValue(OAuthRequestParameterNames.ClientSecret, out string? secret)
+                    && string.Equals(secret, ClientSecret, StringComparison.Ordinal));
+
+            (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+                await host.CreateOAuthClientAndRegistrationAsync(
+                    material.Registration,
+                    RedirectUri.OriginalString,
+                    profile: PolicyProfile.Rfc6749WithPkce,
+                    TestContext.CancellationToken).ConfigureAwait(false);
+
+            //The AUTHENTICATED registration mints the initial tokens (the code-exchange leg is not
+            //under test here and must succeed to obtain a refresh token to attempt refreshing with).
+            ClientRegistration authenticated = registration with
+            {
+                AuthenticationMethod = ClientAuthenticationMethod.ClientSecretPost,
+                AuthenticationKeyMaterial = secretMaterial
+            };
+
+            using HttpClient browserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(host.ServerCertificate);
+            HostedAuthorizationServer hosted = host.Host("default");
+            string segment = material.Registration.TenantId.Value;
+
+            AuthCodeFlowDriveResult drive = await AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync(
+                hosted, client, authenticated, clientFlowStore, segment, RedirectUri, SubjectId, browserClient,
+                scope: WellKnownScopes.OpenId, cancellationToken: TestContext.CancellationToken)
+                .ConfigureAwait(false);
+            string originalRefreshToken = (string)drive.TokenResult.Body![OAuthRequestParameterNames.RefreshToken];
+
+            //The refresh attempt itself uses the UNAUTHENTICATED registration — None stays the
+            //client's declared method even though the server requires client_secret_post.
+            RefreshTokenRequest refreshRequest = new()
+            {
+                ClientId = registration.ClientId.Value,
+                RefreshToken = originalRefreshToken
+            };
+            AuthCodeFlowEndpointResult refreshResult = await client.AuthCode.RefreshAsync(
+                registration, refreshRequest, TestContext.CancellationToken).ConfigureAwait(false);
+
+            Assert.AreNotEqual(AuthCodeFlowEndpointOutcome.Ok, refreshResult.Outcome,
+                "A declared confidential client refreshing without an attached credential must not be issued new tokens.");
+            Assert.AreEqual(OAuthErrors.InvalidClient, refreshResult.ErrorCode);
+        }
+        finally
+        {
+            secretMaterial.PublicKey.Dispose();
+            secretMaterial.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// Drives PAR → authorize → callback → token over the real wire to obtain an initial refresh
+    /// token, then refreshes through <see cref="AuthCodeFlowDriver.DriveRefreshAsync"/> — asserting
+    /// both legs, including the refresh the confidential-auth attachment under test gates, succeeded
+    /// and rotated in a fresh access token.
+    /// </summary>
+    private async Task DriveInitialIssuanceAndAssertRefreshSucceedsAsync(
+        TestHostShell host,
+        OAuthClient client,
+        ClientRegistration registration,
+        Dictionary<string, FlowState> clientFlowStore,
+        string tenantSegment,
+        ClientAssertionOptions? clientAssertionOptions = null)
+    {
+        using HttpClient browserClient = LoopbackTls.CreateSingleHopPinnedHttpClient(host.ServerCertificate);
+        HostedAuthorizationServer hosted = host.Host("default");
+
+        AuthCodeFlowDriveResult drive = await AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync(
+            hosted, client, registration, clientFlowStore, tenantSegment, RedirectUri, SubjectId, browserClient,
+            scope: WellKnownScopes.OpenId, clientAssertionOptions: clientAssertionOptions,
+            cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+        string originalAccessToken = (string)drive.TokenResult.Body![OAuthRequestParameterNames.AccessToken];
+        string originalRefreshToken = (string)drive.TokenResult.Body![OAuthRequestParameterNames.RefreshToken];
+        Assert.IsFalse(string.IsNullOrEmpty(originalRefreshToken), "The initial issuance must include a refresh_token.");
+
+        RefreshTokenRequest refreshRequest = new()
+        {
+            ClientId = registration.ClientId.Value,
+            RefreshToken = originalRefreshToken
+        };
+        AuthCodeFlowEndpointResult refreshResult = await AuthCodeFlowDriver.DriveRefreshAsync(
+            client, registration, refreshRequest, clientAssertionOptions, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string newAccessToken = (string)refreshResult.Body![OAuthRequestParameterNames.AccessToken];
+        Assert.IsFalse(string.IsNullOrEmpty(newAccessToken), "The AS must mint a fresh access token on refresh.");
+        Assert.AreNotEqual(originalAccessToken, newAccessToken,
+            "Refresh must issue a fresh access token, not return the original.");
+    }
+
+
+    /// <summary>
+    /// Re-registers the server-side <see cref="ClientRecord"/> with
+    /// <see cref="ClientRecord.TokenEndpointAuthMethod"/> set to <paramref name="method"/> — the
+    /// declared-client shape draft-ietf-oauth-client-id-metadata-document-02 §8.2 (CIMD-049/050) gates
+    /// on, so a passing refresh proves the client attached the credential the server actually
+    /// required. Uses the register-then-upgrade pattern the sibling grant suites use, because the
+    /// routing dictionaries are host-internal.
+    /// </summary>
+    private static void DeclareServerSideAuthMethod(
+        TestHostShell host, VerifierKeyMaterial material, ClientAuthenticationMethod method, string? clientJwks = null)
+    {
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+        ClientRecord previous = hosted.Registrations[segment];
+        ClientRecord updated = previous with
+        {
+            TokenEndpointAuthMethod = method,
+            ClientJwks = clientJwks
+        };
+
+        hosted.Registrations[segment] = updated;
+        hosted.Registrations[updated.ClientId] = updated;
+        hosted.Server.UpdateClient(previous, updated, new ExchangeContext());
+
+        material.Registration = updated;
+    }
+
+
+    /// <summary>
+    /// Wraps <paramref name="secret"/>'s UTF-8 bytes as a <see cref="PrivateKeyMemory"/> carrying no
+    /// crypto tag (<see cref="Tag.Empty"/>) — a bare RFC 6749 §2.3.1 shared secret is not an
+    /// asymmetric key, so none of the existing <see cref="CryptoTags"/> algorithm-specific entries
+    /// apply. The paired <see cref="PublicKeyMemory"/> is never read (only
+    /// <see cref="ClientRegistration.AuthenticationKeyMaterial"/>'s <c>PrivateKey</c> half is
+    /// consulted for <c>client_secret_post</c>/<c>client_secret_basic</c>).
+    /// </summary>
+    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope",
+        Justification = "Ownership transfers to the caller, which disposes both halves via secretMaterial.PublicKey/PrivateKey.")]
+    private static PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> BuildSecretKeyMaterial(string secret)
+    {
+        byte[] secretBytes = Encoding.UTF8.GetBytes(secret);
+        IMemoryOwner<byte> secretOwner = Pool.Rent(secretBytes.Length);
+        secretBytes.CopyTo(secretOwner.Memory.Span);
+        PrivateKeyMemory privateKey = new(secretOwner, Tag.Empty);
+
+        //Never read — client_secret_post/basic consult only the PrivateKey half — but a
+        //PublicPrivateKeyMaterial pair requires one regardless.
+        IMemoryOwner<byte> unusedPublicOwner = Pool.Rent(1);
+        PublicKeyMemory publicKey = new(unusedPublicOwner, Tag.Empty);
+
+        return new PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory>(publicKey, privateKey);
+    }
+
+
+    /// <summary>
+    /// The test-side reverse of <see cref="OutgoingHeadersClientAuthExtensions.WithClientSecretBasic"/>
+    /// (RFC 6749 §2.3.1): base64-decode the <c>Authorization: Basic</c> header, split the pair on the
+    /// first <c>:</c> (the join character the encoder never percent-encodes into either half), and
+    /// reverse <c>application/x-www-form-urlencoded</c> on each half — <see cref="ClientId"/> contains
+    /// <c>:</c> and <c>/</c>, both of which the encoder percent-escapes, so a naive raw comparison
+    /// would never match.
+    /// </summary>
+    private static bool DecodeAndMatchBasicHeader(
+        IncomingRequest? request, string expectedClientId, string expectedClientSecret)
+    {
+        if(request is null
+            || !request.Headers.TryGetSingle(WellKnownHttpHeaderNames.Authorization, out string? authorizationHeader)
+            || authorizationHeader is null
+            || !authorizationHeader.StartsWith("Basic ", StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        byte[] decoded = Convert.FromBase64String(authorizationHeader["Basic ".Length..]);
+        string pair = Encoding.UTF8.GetString(decoded);
+        int separatorIndex = pair.IndexOf(':', StringComparison.Ordinal);
+        if(separatorIndex < 0)
+        {
+            return false;
+        }
+
+        string decodedClientId = FormUrlDecode(pair[..separatorIndex]);
+        string decodedClientSecret = FormUrlDecode(pair[(separatorIndex + 1)..]);
+
+        return string.Equals(decodedClientId, expectedClientId, StringComparison.Ordinal)
+            && string.Equals(decodedClientSecret, expectedClientSecret, StringComparison.Ordinal);
+    }
+
+
+    /// <summary>Reverses <c>application/x-www-form-urlencoded</c> (RFC 6749 Appendix B): <c>+</c> becomes space, then <see cref="Uri.UnescapeDataString"/> resolves the remaining <c>%XX</c> triplets.</summary>
+    private static string FormUrlDecode(string value) => Uri.UnescapeDataString(value.Replace('+', ' '));
+
+
+    private static string BuildJwksJson(IReadOnlyDictionary<string, string> jwk, string kid)
+    {
+        StringBuilder sb = new();
+        sb.Append('{').Append('"').Append(WellKnownJwkMemberNames.Keys).Append("\":[{");
+        foreach(KeyValuePair<string, string> member in jwk)
+        {
+            sb.Append('"').Append(member.Key).Append("\":\"").Append(member.Value).Append("\",");
+        }
+
+        sb.Append('"').Append(WellKnownJwkMemberNames.Kid).Append("\":\"").Append(kid).Append("\"}]}");
+
+        return sb.ToString();
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/RefreshedIdTokenAuthContextTests.cs b/test/Verifiable.Tests/OAuth/RefreshedIdTokenAuthContextTests.cs
new file mode 100644
index 00000000..812363b4
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/RefreshedIdTokenAuthContextTests.cs
@@ -0,0 +1,254 @@
+using System.Text.Json;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.OAuth;
+using Verifiable.OAuth.Oidc;
+using Verifiable.OAuth.Pkce;
+using Verifiable.OAuth.Server;
+using Verifiable.Server;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// OpenID Connect Core 1.0 §12.2 real-wire proving test: a REFRESHED id_token must pin
+/// <c>auth_time</c> and <c>acr</c> to the values established at the original End-User
+/// authentication — carried across refresh-token rotation via
+/// <see cref="Verifiable.OAuth.AuthCode.Server.States.ServerRefreshTokenIssuedState"/> — rather than
+/// to whatever the application's <see cref="AuthorizationServerIntegration.ResolveOidcClaimsAsync"/>
+/// seam reports at the moment of the refresh call. <see cref="AcrAmrClaimContributor"/> is the seam
+/// under test.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Drives PAR → Authorize → Token → Refresh against a real Kestrel <see cref="LoopbackTls"/> host.
+/// The PAR, token, and refresh legs run over the genuine TLS wire
+/// (<see cref="OAuthTestTransport.PostFormAsync(System.Net.Http.HttpClient, Uri, IReadOnlyDictionary{string, string}, System.Threading.CancellationToken)"/>);
+/// the authorize leg dispatches in-process on the SAME <see cref="EndpointServer"/> instance the
+/// Kestrel host serves (<see cref="TestHostShell.DispatchAtEndpointAsync(string, string, string, RequestFields, ExchangeContext, System.Threading.CancellationToken)"/>)
+/// because stamping the authorize-time authentication context (<c>SetAuthTime</c> / <c>SetAcr</c>)
+/// has no HTTP-header carrier in <see cref="AuthorizationServerHttpApplication"/> — mirroring the
+/// authorize-time stamping pattern <see cref="StepUpAccessTokenClaimsTests"/> uses for the
+/// access-token analogue of this same invariant.
+/// </para>
+/// <para>
+/// Non-vacuity: the wired <see cref="AuthorizationServerIntegration.ResolveOidcClaimsAsync"/> returns
+/// a DIFFERENT <see cref="AuthenticationContext"/> depending on which call it answers — at the
+/// initial authorization_code mint it echoes the established <c>acr</c> and leaves <c>auth_time</c>
+/// unpopulated (so the established, stamped values are what the initial id_token actually shows,
+/// regardless of which side of the fallback chain the initial mint resolves through); at the refresh
+/// redemption it returns a genuinely later <c>auth_time</c>, a different <c>acr</c>, and a populated
+/// <c>amr</c> — exactly the values a regression that re-reads the resolver on refresh would stamp
+/// onto the refreshed id_token, violating §12.2. The test captures the initial id_token's claims off
+/// the wire and asserts the refreshed id_token repeats them exactly.
+/// </para>
+/// </remarks>
+[TestClass]
+internal sealed class RefreshedIdTokenAuthContextTests
+{
+    /// <summary>MSTest's per-test context, supplying the cancellation token every wire call runs under.</summary>
+    public TestContext TestContext { get; set; } = null!;
+
+    /// <summary>The clock the host and the client share.</summary>
+    private FakeTimeProvider TimeProvider { get; } = new(TestClock.CanonicalEpoch);
+
+    private const string ClientId = "https://refreshed-id-token.client.test";
+
+    private const string SubjectId = "subject-refreshed-id-token-01";
+
+    private static Uri ClientBaseUri { get; } = new(ClientId);
+
+    private static Uri RedirectUri { get; } = new("https://client.example.com/callback");
+
+    /// <summary>
+    /// The <c>acr</c>/<c>auth_time</c> the application establishes at the original authorize-time
+    /// authentication (<c>SetAuthTime</c>/<c>SetAcr</c>) — the §12.2 "original" the refreshed
+    /// id_token must carry.
+    /// </summary>
+    private static readonly DateTimeOffset EstablishedAuthTime = TestClock.CanonicalEpoch.AddMinutes(-5);
+
+    private const string EstablishedAcr = "urn:example:acr:established-loa";
+
+    /// <summary>
+    /// The DIVERGENT authentication context the app's OIDC-claims resolver reports specifically at
+    /// refresh-redemption time — genuinely later and differently valued than the established
+    /// original, so a regression that re-reads it on refresh produces an observably wrong id_token.
+    /// </summary>
+    private static readonly DateTimeOffset ResolverRefreshAuthTime = TestClock.CanonicalEpoch.AddHours(3);
+
+    private const string ResolverRefreshAcr = "urn:example:acr:resolver-divergent-loa";
+
+    private static readonly IReadOnlyList<string> ResolverRefreshAmr = ["mfa", "hwk"];
+
+
+    /// <summary>
+    /// Drives authorization_code + PKCE + PAR with <c>openid</c>, decodes the initial id_token,
+    /// redeems the refresh token, and asserts the refreshed id_token's <c>auth_time</c> and
+    /// <c>acr</c> equal the initial id_token's values — never the resolver's refresh-time divergent
+    /// answer — with no <c>nonce</c> and no <c>amr</c> on the refreshed token.
+    /// </summary>
+    [TestMethod]
+    public async Task RefreshedIdTokenPinsAuthTimeAndAcrToOriginalAuthentication()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+        string segment = material.Registration.TenantId.Value;
+
+        //The resolver answers differently depending on which call it is — see the remarks above for
+        //why this is what makes the refresh assertions non-vacuous.
+        bool isRefreshCall = false;
+        host.Server.OAuth().ResolveOidcClaimsAsync = (subject, grantedScope, tenantId, context, cancellationToken) =>
+        {
+            AuthenticationContext resolvedAuthContext = isRefreshCall
+                ? new AuthenticationContext
+                {
+                    AuthTime = ResolverRefreshAuthTime,
+                    Acr = ResolverRefreshAcr,
+                    Amr = ResolverRefreshAmr
+                }
+                : new AuthenticationContext { Acr = EstablishedAcr };
+
+            return ValueTask.FromResult<OidcClaims?>(new OidcClaims
+            {
+                Subject = subject,
+                AuthContext = resolvedAuthContext
+            });
+        };
+
+        await host.StartHttpHostAsync(cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer hosted = host.Host("default");
+
+        //1. PAR over the real wire.
+        PkceParameters pkce = PkceGeneration.Generate(TestSetup.Base64UrlEncoder, BaseMemoryPool.Shared);
+        Uri parUrl = new(
+            hosted.HttpBaseAddress!,
+            TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodePar, segment));
+        using HttpResponseMessage parResponse = await OAuthTestTransport.PostFormAsync(
+            hosted.SharedHttpClient!, parUrl, new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.ClientId] = ClientId,
+                [OAuthRequestParameterNames.CodeChallenge] = pkce.EncodedChallenge,
+                [OAuthRequestParameterNames.CodeChallengeMethod] = WellKnownCodeChallengeMethods.S256,
+                [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString,
+                [OAuthRequestParameterNames.Scope] = WellKnownScopes.OpenId
+            }, TestContext.CancellationToken).ConfigureAwait(false);
+        string parBody = await parResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(201, (int)parResponse.StatusCode, parBody);
+        string requestUri = ExtractRequestUri(parBody);
+
+        //2. Authorize — in-process on the SAME EndpointServer the Kestrel host serves; the wire skin
+        //   (AuthorizationServerHttpApplication) carries only the test subject header, not
+        //   SetAuthTime/SetAcr, over HTTP.
+        ExchangeContext authorizeContext = new();
+        authorizeContext.SetSubjectId(SubjectId);
+        authorizeContext.SetAuthTime(EstablishedAuthTime);
+        authorizeContext.SetAcr(EstablishedAcr);
+        RequestFields authorizeFields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = ClientId,
+            [OAuthRequestParameterNames.RequestUri] = requestUri
+        };
+        ServerHttpResponse authorizeResponse = await host.DispatchAtEndpointAsync(
+            segment, WellKnownEndpointNames.AuthCodeAuthorize, WellKnownHttpMethods.Get,
+            authorizeFields, authorizeContext, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(302, authorizeResponse.StatusCode, authorizeResponse.Body);
+        string code = TestBrowser.ExtractQueryParam(authorizeResponse.Location!, OAuthRequestParameterNames.Code)
+            ?? throw new InvalidOperationException("Authorize redirect Location missing code.");
+
+        //3. Token exchange over the real wire.
+        Uri tokenUrl = new(hosted.HttpBaseAddress!, $"/connect/{segment}/token");
+        using HttpResponseMessage tokenResponse = await OAuthTestTransport.PostFormAsync(
+            hosted.SharedHttpClient!, tokenUrl, new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.AuthorizationCode,
+                [OAuthRequestParameterNames.Code] = code,
+                [OAuthRequestParameterNames.CodeVerifier] = pkce.EncodedVerifier,
+                [OAuthRequestParameterNames.ClientId] = ClientId,
+                [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString
+            }, TestContext.CancellationToken).ConfigureAwait(false);
+        string tokenBody = await tokenResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)tokenResponse.StatusCode, tokenBody);
+
+        using JsonDocument tokenDoc = JsonDocument.Parse(tokenBody);
+        Assert.IsTrue(tokenDoc.RootElement.TryGetProperty(WellKnownTokenTypes.IdToken, out JsonElement initialIdTokenElement),
+            $"openid in scope on authorization_code must mint an id_token. Body: {tokenBody}");
+        string initialIdToken = initialIdTokenElement.GetString()!;
+        string refreshToken = tokenDoc.RootElement.GetProperty(WellKnownTokenTypes.RefreshToken).GetString()!;
+
+        using JsonDocument initialPayload = JwtPayloadDecoding.DecodePayload(initialIdToken, BaseMemoryPool.Shared);
+        long tOrig = initialPayload.RootElement.GetProperty(WellKnownJwtClaimNames.AuthTime).GetInt64();
+        string subOrig = initialPayload.RootElement.GetProperty(WellKnownJwtClaimNames.Sub).GetString()!;
+        string issOrig = initialPayload.RootElement.GetProperty(WellKnownJwtClaimNames.Iss).GetString()!;
+        string audOrig = initialPayload.RootElement.GetProperty(WellKnownJwtClaimNames.Aud).GetString()!;
+        string acrOrig = initialPayload.RootElement.GetProperty(WellKnownJwtClaimNames.Acr).GetString()!;
+
+        //Sanity: the initial mint actually carried the ESTABLISHED authentication context, not a
+        //resolver-supplied one — otherwise the refresh assertions below would be comparing against a
+        //value the fix has no obligation to reproduce, and this test would not be proving §12.2.
+        Assert.AreEqual(EstablishedAuthTime.ToUnixTimeSeconds(), tOrig,
+            "Sanity: the initial id_token's auth_time must be the established authentication instant.");
+        Assert.AreEqual(EstablishedAcr, acrOrig,
+            "Sanity: the initial id_token's acr must be the established authentication-context reference.");
+
+        //4. Advance the clock and flip the resolver to its refresh-time (divergent) answer — a
+        //   regression that re-reads the resolver on refresh would now produce an observably WRONG
+        //   id_token.
+        TimeProvider.Advance(TimeSpan.FromMinutes(30));
+        isRefreshCall = true;
+
+        //5. Refresh over the real wire.
+        using HttpResponseMessage refreshResponse = await OAuthTestTransport.PostFormAsync(
+            hosted.SharedHttpClient!, tokenUrl, new Dictionary<string, string>
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.RefreshToken,
+                [OAuthRequestParameterNames.RefreshToken] = refreshToken,
+                [OAuthRequestParameterNames.ClientId] = ClientId
+            }, TestContext.CancellationToken).ConfigureAwait(false);
+        string refreshBody = await refreshResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)refreshResponse.StatusCode, refreshBody);
+
+        using JsonDocument refreshDoc = JsonDocument.Parse(refreshBody);
+        Assert.IsTrue(refreshDoc.RootElement.TryGetProperty(WellKnownTokenTypes.IdToken, out JsonElement refreshedIdTokenElement),
+            $"A refresh token minted alongside an authorization_code grant must still yield an id_token on redemption. Body: {refreshBody}");
+        string refreshedIdToken = refreshedIdTokenElement.GetString()!;
+
+        using JsonDocument refreshedPayload = JwtPayloadDecoding.DecodePayload(refreshedIdToken, BaseMemoryPool.Shared);
+        JsonElement refreshedClaims = refreshedPayload.RootElement;
+
+        //THE LOAD-BEARING §12.2 ASSERTION: auth_time is pinned to the original authentication, not
+        //re-derived from the resolver's later value.
+        Assert.AreEqual(tOrig, refreshedClaims.GetProperty(WellKnownJwtClaimNames.AuthTime).GetInt64(),
+            "OIDC Core §12.2: a refreshed id_token's auth_time must equal the original authentication "
+            + "instant, not the app resolver's value at refresh time.");
+
+        Assert.AreEqual(subOrig, refreshedClaims.GetProperty(WellKnownJwtClaimNames.Sub).GetString(),
+            "OIDC Core §12.2: sub must match the original id_token's sub.");
+        Assert.AreEqual(issOrig, refreshedClaims.GetProperty(WellKnownJwtClaimNames.Iss).GetString(),
+            "OIDC Core §12.2: iss must match the original id_token's iss.");
+        Assert.AreEqual(audOrig, refreshedClaims.GetProperty(WellKnownJwtClaimNames.Aud).GetString(),
+            "OIDC Core §12.2: aud must include the original id_token's aud.");
+
+        Assert.IsFalse(refreshedClaims.TryGetProperty(WellKnownJwtClaimNames.Nonce, out _),
+            "A refresh_token request carries no nonce; the refreshed id_token must not carry one either.");
+
+        Assert.AreEqual(acrOrig, refreshedClaims.GetProperty(WellKnownJwtClaimNames.Acr).GetString(),
+            "The refreshed id_token's acr must equal the original (carried) acr, not the resolver's "
+            + "divergent refresh-time value.");
+
+        Assert.IsFalse(refreshedClaims.TryGetProperty(WellKnownJwtClaimNames.Amr, out _),
+            "amr has no carried representation across refresh rotation; the refreshed id_token must "
+            + "not carry the resolver's refresh-time amr.");
+    }
+
+
+    /// <summary>Reads the <c>request_uri</c> from a PAR response body.</summary>
+    private static string ExtractRequestUri(string body)
+    {
+        using JsonDocument doc = JsonDocument.Parse(body);
+
+        return doc.RootElement.GetProperty("request_uri").GetString()!;
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/RefreshedIdTokenParityTests.cs b/test/Verifiable.Tests/OAuth/RefreshedIdTokenParityTests.cs
new file mode 100644
index 00000000..b05cfd60
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/RefreshedIdTokenParityTests.cs
@@ -0,0 +1,332 @@
+using System.Linq;
+using System.Text.Json;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Core;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.Microsoft;
+using Verifiable.OAuth;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Dpop;
+using Verifiable.OAuth.Pkce;
+using Verifiable.OAuth.Server;
+using Verifiable.Server;
+using Verifiable.Tests.TestDataProviders;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// OpenID Connect Core 1.0 §12.2 real-wire proving test: a REFRESHED id_token must carry a fresh
+/// <c>iat</c> (OIDC-099), the SAME <c>sid</c> the original End-User session established (OIDC-103),
+/// the SAME <c>cnf.jkt</c> DPoP binding (RFC 9449 §6), and must still release the §5.4 standard
+/// claims the granted <c>profile</c>/<c>email</c> scopes authorize.
+/// <see cref="Verifiable.OAuth.AuthCode.Server.States.ServerRefreshTokenIssuedState"/> is the state
+/// that carries <c>SessionId</c>/<c>Confirmation</c> across rotation;
+/// <see cref="Verifiable.OAuth.SidClaimContributor"/>, <see cref="Verifiable.OAuth.CnfClaimContributor"/>,
+/// and <see cref="Verifiable.OAuth.OidcStandardClaimsContributor"/> are the emission seams under test.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Drives PAR → Authorize → Token → Refresh against a real Kestrel <see cref="LoopbackTls"/> host. PAR,
+/// token, and refresh all run over the genuine TLS wire
+/// (<see cref="OAuthTestTransport.PostFormAsync(System.Net.Http.HttpClient, Uri, IReadOnlyDictionary{string, string}, OutgoingHeaders?, System.Threading.CancellationToken)"/>);
+/// the authorize leg dispatches in-process on the SAME <see cref="EndpointServer"/> instance the Kestrel
+/// host serves, mirroring <see cref="RefreshedIdTokenAuthContextTests"/> and <see cref="SessionIdClaimTests"/>.
+/// </para>
+/// <para>
+/// The token and refresh legs each present a real RFC 9449 DPoP proof for the SAME key, built directly
+/// (not through <see cref="Verifiable.OAuth.AuthCode.AuthCodeClient.RefreshAsync(Verifiable.OAuth.Client.ClientRegistration, Verifiable.OAuth.AuthCode.RefreshTokenRequest, System.Threading.CancellationToken)"/>,
+/// whose current wiring does not attach a DPoP proof — see the integrator notes on this wave). The
+/// refresh leg's bound thumbprint forces <c>dpopRequired=true</c> server-side
+/// (<see cref="Verifiable.OAuth.AuthCode.Server.DpopTokenEndpointValidation"/>), so a nonce-less proof
+/// there deterministically draws one RFC 9449 §8.1 <c>use_dpop_nonce</c> challenge; the helper retries
+/// once with the echoed nonce, mirroring the production client's own retry shape.
+/// </para>
+/// <para>
+/// Non-vacuity: <c>iat</c> is asserted STRICTLY greater after advancing the shared
+/// <see cref="FakeTimeProvider"/> between issuance and refresh — a producer that stamped a stale or
+/// constant value would fail this, not merely pass coincidentally. <c>sid</c>/<c>cnf.jkt</c> are
+/// asserted equal to values captured off the ORIGINAL id_token's wire bytes — a regression that fails
+/// to carry <see cref="Verifiable.OAuth.AuthCode.Server.States.ServerRefreshTokenIssuedState.SessionId"/>
+/// or <see cref="Verifiable.OAuth.AuthCode.Server.States.ServerRefreshTokenIssuedState.Confirmation"/>
+/// across rotation drops or changes the claim, which fails the equality. The standard claims are
+/// asserted present by name AND by value on the
+/// refreshed token — a regression that gated the standard-claims contributors off the refresh grant
+/// type would omit them entirely, which fails the presence check.
+/// </para>
+/// </remarks>
+[TestClass]
+internal sealed class RefreshedIdTokenParityTests
+{
+    /// <summary>MSTest's per-test context, supplying the cancellation token every wire call runs under.</summary>
+    public TestContext TestContext { get; set; } = null!;
+
+    /// <summary>The clock the host and the DPoP proofs share.</summary>
+    private FakeTimeProvider TimeProvider { get; } = new(TestClock.CanonicalEpoch);
+
+    private const string ClientId = "https://refreshed-id-token-parity.client.test";
+
+    private const string SubjectId = "subject-refreshed-parity-01";
+
+    /// <summary>The authenticate-time session identifier — the §12.2 "original" the refreshed id_token must repeat.</summary>
+    private const string SessionId = "session-refreshed-parity-01";
+
+    private const string ExpectedName = "Parity Test Subject";
+
+    private const string ExpectedEmail = "parity-subject@example.test";
+
+    private static readonly Uri ClientBaseUri = new(ClientId);
+
+    private static readonly Uri RedirectUri = new("https://client.example.com/callback");
+
+    private static readonly string Scope =
+        $"{WellKnownScopes.OpenId} {WellKnownScopes.Profile} {WellKnownScopes.Email}";
+
+
+    /// <summary>
+    /// Drives authorization_code + PKCE + PAR under a DPoP-bound, session-established client with
+    /// <c>openid profile email</c>, decodes the initial id_token, redeems the refresh token under the
+    /// SAME DPoP key, decodes the refreshed id_token, and asserts iat freshness, sid parity, §5.4
+    /// standard-claim parity, and cnf.jkt parity.
+    /// </summary>
+    [TestMethod]
+    public async Task RefreshedIdTokenCarriesFreshIatAndParitySidClaimsAndCnf()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId, name: ExpectedName, email: ExpectedEmail, emailVerified: true);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Rfc6749WithPkce);
+        host.EnableDpop();
+
+        await host.StartHttpHostAsync(cancellationToken: TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer hosted = host.Host("default");
+        string segment = material.Registration.TenantId.Value;
+
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> dpopMaterial =
+            TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        try
+        {
+            DpopKey dpopKey = new(dpopMaterial, WellKnownJwaValues.Es256);
+            string expectedThumbprint = dpopKey.GetThumbprint(TestHostShell.Base64UrlEncoder, TestHostShell.MemoryPool);
+
+            //1. PAR over the real wire.
+            PkceParameters pkce = PkceGeneration.Generate(TestSetup.Base64UrlEncoder, BaseMemoryPool.Shared);
+            Uri parUrl = new(
+                hosted.HttpBaseAddress!,
+                TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodePar, segment));
+            using HttpResponseMessage parResponse = await OAuthTestTransport.PostFormAsync(
+                hosted.SharedHttpClient!, parUrl, new Dictionary<string, string>
+                {
+                    [OAuthRequestParameterNames.ClientId] = ClientId,
+                    [OAuthRequestParameterNames.CodeChallenge] = pkce.EncodedChallenge,
+                    [OAuthRequestParameterNames.CodeChallengeMethod] = WellKnownCodeChallengeMethods.S256,
+                    [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString,
+                    [OAuthRequestParameterNames.Scope] = Scope
+                }, TestContext.CancellationToken).ConfigureAwait(false);
+            string parBody = await parResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+            Assert.AreEqual(201, (int)parResponse.StatusCode, parBody);
+            string requestUri = ExtractRequestUri(parBody);
+
+            //2. Authorize — in-process on the SAME EndpointServer the Kestrel host serves, establishing
+            //   the End-User session (SetSessionId) the refreshed id_token's sid must repeat.
+            ExchangeContext authorizeContext = new();
+            authorizeContext.SetSubjectId(SubjectId);
+            authorizeContext.SetSessionId(SessionId);
+            RequestFields authorizeFields = new()
+            {
+                [OAuthRequestParameterNames.ClientId] = ClientId,
+                [OAuthRequestParameterNames.RequestUri] = requestUri
+            };
+            ServerHttpResponse authorizeResponse = await host.DispatchAtEndpointAsync(
+                segment, WellKnownEndpointNames.AuthCodeAuthorize, WellKnownHttpMethods.Get,
+                authorizeFields, authorizeContext, TestContext.CancellationToken).ConfigureAwait(false);
+            Assert.AreEqual(302, authorizeResponse.StatusCode, authorizeResponse.Body);
+            string code = TestBrowser.ExtractQueryParam(authorizeResponse.Location!, OAuthRequestParameterNames.Code)
+                ?? throw new InvalidOperationException("Authorize redirect Location missing code.");
+
+            //3. Token exchange over the real wire, presenting a DPoP proof for the key the confirmation
+            //   binding will carry. Rfc6749WithPkce does not REQUIRE DPoP, so this leg needs no nonce
+            //   round-trip — a well-formed proof is accepted and bound on the first attempt.
+            Uri tokenUrl = new(hosted.HttpBaseAddress!, $"/connect/{segment}/token");
+            Dictionary<string, string> tokenFields = new()
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.AuthorizationCode,
+                [OAuthRequestParameterNames.Code] = code,
+                [OAuthRequestParameterNames.CodeVerifier] = pkce.EncodedVerifier,
+                [OAuthRequestParameterNames.ClientId] = ClientId,
+                [OAuthRequestParameterNames.RedirectUri] = RedirectUri.OriginalString
+            };
+            using HttpResponseMessage tokenResponse = await PostTokenEndpointWithDpopAsync(
+                hosted.SharedHttpClient!, tokenUrl, tokenFields, dpopKey, material.Registration, segment)
+                .ConfigureAwait(false);
+            string tokenBody = await tokenResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+            Assert.AreEqual(200, (int)tokenResponse.StatusCode, tokenBody);
+
+            using JsonDocument tokenDoc = JsonDocument.Parse(tokenBody);
+            Assert.IsTrue(tokenDoc.RootElement.TryGetProperty(WellKnownTokenTypes.IdToken, out JsonElement initialIdTokenElement),
+                $"openid in scope on authorization_code must mint an id_token. Body: {tokenBody}");
+            string initialIdToken = initialIdTokenElement.GetString()!;
+            string refreshToken = tokenDoc.RootElement.GetProperty(WellKnownTokenTypes.RefreshToken).GetString()!;
+
+            using JsonDocument initialPayload = JwtPayloadDecoding.DecodePayload(initialIdToken, BaseMemoryPool.Shared);
+            JsonElement initialClaims = initialPayload.RootElement;
+            long tOrig = initialClaims.GetProperty(WellKnownJwtClaimNames.Iat).GetInt64();
+            string sidOrig = initialClaims.GetProperty(WellKnownJwtClaimNames.Sid).GetString()!;
+            string nameOrig = initialClaims.GetProperty(WellKnownJwtClaimNames.Name).GetString()!;
+            string emailOrig = initialClaims.GetProperty(WellKnownJwtClaimNames.Email).GetString()!;
+            bool emailVerifiedOrig = initialClaims.GetProperty(WellKnownJwtClaimNames.EmailVerified).GetBoolean();
+            string jktOrig = initialClaims.GetProperty(WellKnownJwtClaimNames.Cnf)
+                .GetProperty(WellKnownJwtClaimNames.JwkThumbprint).GetString()!;
+
+            //Sanity: the initial mint actually carried the established session and DPoP binding, and
+            //released the granted profile/email claims — otherwise the parity assertions below would be
+            //comparing against values the fix has no obligation to reproduce.
+            Assert.AreEqual(SessionId, sidOrig, "Sanity: the initial id_token's sid must be the established session identifier.");
+            Assert.AreEqual(ExpectedName, nameOrig, "Sanity: the initial id_token must release the profile-scope name claim.");
+            Assert.AreEqual(ExpectedEmail, emailOrig, "Sanity: the initial id_token must release the email-scope email claim.");
+            Assert.IsTrue(emailVerifiedOrig, "Sanity: the initial id_token must release email_verified.");
+            Assert.AreEqual(expectedThumbprint, jktOrig, "Sanity: the initial id_token's cnf.jkt must equal the DPoP key's RFC 7638 thumbprint.");
+
+            //4. Advance the clock — a regression stamping a stale/constant iat on refresh would now
+            //   produce an observably WRONG (non-fresh) id_token.
+            TimeProvider.Advance(TimeSpan.FromMinutes(15));
+
+            //5. Refresh over the real wire, presenting a DPoP proof for the SAME key. The bound
+            //   confirmation forces dpopRequired=true server-side, so the first (nonce-less) proof
+            //   deterministically draws a use_dpop_nonce challenge; the helper retries with the
+            //   echoed nonce.
+            Dictionary<string, string> refreshFields = new()
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.RefreshToken,
+                [OAuthRequestParameterNames.RefreshToken] = refreshToken,
+                [OAuthRequestParameterNames.ClientId] = ClientId
+            };
+            using HttpResponseMessage refreshResponse = await PostTokenEndpointWithDpopAsync(
+                hosted.SharedHttpClient!, tokenUrl, refreshFields, dpopKey, material.Registration, segment)
+                .ConfigureAwait(false);
+            string refreshBody = await refreshResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+            Assert.AreEqual(200, (int)refreshResponse.StatusCode, refreshBody);
+
+            using JsonDocument refreshDoc = JsonDocument.Parse(refreshBody);
+            Assert.IsTrue(refreshDoc.RootElement.TryGetProperty(WellKnownTokenTypes.IdToken, out JsonElement refreshedIdTokenElement),
+                $"A DPoP-bound refresh token minted alongside an authorization_code grant must still yield an id_token on redemption. Body: {refreshBody}");
+            string refreshedIdToken = refreshedIdTokenElement.GetString()!;
+
+            using JsonDocument refreshedPayload = JwtPayloadDecoding.DecodePayload(refreshedIdToken, BaseMemoryPool.Shared);
+            JsonElement refreshedClaims = refreshedPayload.RootElement;
+
+            //THE LOAD-BEARING OIDC-099 ASSERTION: iat is a fresh issuance time, strictly later than the
+            //original — not a stale or carried-over value.
+            long tRefreshed = refreshedClaims.GetProperty(WellKnownJwtClaimNames.Iat).GetInt64();
+            Assert.IsGreaterThan(tOrig, tRefreshed,
+                "OIDC-099: a refreshed id_token's iat must be strictly later than the original id_token's iat.");
+
+            //THE LOAD-BEARING OIDC-103 §12.2/sid ASSERTION: sid is carried, not dropped or re-derived.
+            Assert.IsTrue(refreshedClaims.TryGetProperty(WellKnownJwtClaimNames.Sid, out JsonElement sidRefreshedElement),
+                "OIDC-103: the refreshed id_token must still carry sid.");
+            Assert.AreEqual(sidOrig, sidRefreshedElement.GetString(),
+                "OIDC-103 §12.2: the refreshed id_token's sid must equal the original id_token's sid.");
+
+            //THE LOAD-BEARING §5.4 ASSERTION: per-scope standard-claim release survives refresh.
+            Assert.IsTrue(refreshedClaims.TryGetProperty(WellKnownJwtClaimNames.Name, out JsonElement nameRefreshedElement),
+                "OIDC Core §5.4: the refreshed id_token must still release the profile-scope name claim.");
+            Assert.AreEqual(nameOrig, nameRefreshedElement.GetString(),
+                "OIDC Core §5.4: the refreshed id_token's name claim must equal the original's.");
+            Assert.IsTrue(refreshedClaims.TryGetProperty(WellKnownJwtClaimNames.Email, out JsonElement emailRefreshedElement),
+                "OIDC Core §5.4: the refreshed id_token must still release the email-scope email claim.");
+            Assert.AreEqual(emailOrig, emailRefreshedElement.GetString(),
+                "OIDC Core §5.4: the refreshed id_token's email claim must equal the original's.");
+            Assert.IsTrue(refreshedClaims.TryGetProperty(WellKnownJwtClaimNames.EmailVerified, out JsonElement emailVerifiedRefreshedElement),
+                "OIDC Core §5.4: the refreshed id_token must still release email_verified.");
+            Assert.AreEqual(emailVerifiedOrig, emailVerifiedRefreshedElement.GetBoolean(),
+                "OIDC Core §5.4: the refreshed id_token's email_verified must equal the original's.");
+
+            //THE LOAD-BEARING RFC 9449 §6/cnf ASSERTION: the DPoP binding is carried, not dropped.
+            Assert.IsTrue(refreshedClaims.TryGetProperty(WellKnownJwtClaimNames.Cnf, out JsonElement cnfRefreshedElement),
+                "RFC 9449 §6: the refreshed id_token must still carry cnf when the refresh was DPoP-bound.");
+            string jktRefreshed = cnfRefreshedElement.GetProperty(WellKnownJwtClaimNames.JwkThumbprint).GetString()!;
+            Assert.AreEqual(jktOrig, jktRefreshed,
+                "RFC 9449 §6: the refreshed id_token's cnf.jkt must equal the original id_token's cnf.jkt.");
+            Assert.AreEqual(expectedThumbprint, jktRefreshed,
+                "RFC 9449 §6: the refreshed id_token's cnf.jkt must equal the DPoP key's RFC 7638 thumbprint.");
+        }
+        finally
+        {
+            dpopMaterial.PublicKey.Dispose();
+            dpopMaterial.PrivateKey.Dispose();
+        }
+    }
+
+
+    /// <summary>
+    /// Posts <paramref name="formFields"/> to the token endpoint with a DPoP proof for
+    /// <paramref name="dpopKey"/>. When the first (nonce-less) attempt draws an RFC 9449 §8.1
+    /// <c>use_dpop_nonce</c> challenge (400 + a <c>DPoP-Nonce</c> response header — the ONLY failure
+    /// path in <see cref="Verifiable.OAuth.AuthCode.Server.DpopTokenEndpointValidation"/> that sets that
+    /// header), retries once with the echoed nonce.
+    /// </summary>
+    private async Task<HttpResponseMessage> PostTokenEndpointWithDpopAsync(
+        HttpClient httpClient,
+        Uri tokenUrl,
+        Dictionary<string, string> formFields,
+        DpopKey dpopKey,
+        ClientRecord clientRegistration,
+        string segment)
+    {
+        string firstProof = await BuildTokenEndpointDpopProofAsync(dpopKey, clientRegistration, segment, nonce: null)
+            .ConfigureAwait(false);
+        HttpResponseMessage firstResponse = await OAuthTestTransport.PostFormAsync(
+            httpClient, tokenUrl, formFields, OutgoingHeaders.Empty.WithDpop(firstProof),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        if((int)firstResponse.StatusCode != 400
+            || !firstResponse.Headers.TryGetValues(WellKnownHttpHeaderNames.DPoPNonce, out IEnumerable<string>? nonceValues))
+        {
+            return firstResponse;
+        }
+
+        string freshNonce = nonceValues!.First();
+        firstResponse.Dispose();
+
+        string retryProof = await BuildTokenEndpointDpopProofAsync(dpopKey, clientRegistration, segment, freshNonce)
+            .ConfigureAwait(false);
+
+        return await OAuthTestTransport.PostFormAsync(
+            httpClient, tokenUrl, formFields, OutgoingHeaders.Empty.WithDpop(retryProof),
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>
+    /// Builds a token-endpoint DPoP proof (<c>htm=POST</c>, <c>htu=</c> the issuer-authority + token
+    /// path the server validates against per RFC 9449 §4.2) for <paramref name="dpopKey"/>.
+    /// </summary>
+    private async Task<string> BuildTokenEndpointDpopProofAsync(
+        DpopKey dpopKey, ClientRecord clientRegistration, string segment, string? nonce)
+    {
+        string htu = $"{clientRegistration.IssuerUri!.GetLeftPart(UriPartial.Authority)}/connect/{segment}/token";
+        DpopProofClaims claims = new()
+        {
+            Htm = WellKnownHttpMethods.Post,
+            Htu = htu,
+            Iat = TimeProvider.GetUtcNow(),
+            Jti = Guid.NewGuid().ToString("N"),
+            Nonce = nonce
+        };
+
+        return await DpopProofConstruction.BuildAsync(
+            claims, dpopKey, TestHostShell.Base64UrlEncoder, DpopTestSupport.Serializer,
+            MicrosoftCryptographicFunctions.SignP256Async, TestHostShell.MemoryPool,
+            TestContext.CancellationToken).ConfigureAwait(false);
+    }
+
+
+    /// <summary>Reads the <c>request_uri</c> from a PAR response body.</summary>
+    private static string ExtractRequestUri(string body)
+    {
+        using JsonDocument doc = JsonDocument.Parse(body);
+
+        return doc.RootElement.GetProperty("request_uri").GetString()!;
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/ResolveIssuerDelegateTests.cs b/test/Verifiable.Tests/OAuth/ResolveIssuerDelegateTests.cs
index 8a78394b..aaf6326a 100644
--- a/test/Verifiable.Tests/OAuth/ResolveIssuerDelegateTests.cs
+++ b/test/Verifiable.Tests/OAuth/ResolveIssuerDelegateTests.cs
@@ -1,5 +1,6 @@
 using Microsoft.Extensions.Time.Testing;
 using System.Collections.Immutable;
+using System.Net.Http;
 using System.Text.Json;
 using Verifiable.Core;
 using Verifiable.Core.Model.Did;
@@ -8,6 +9,10 @@
 using Verifiable.JCose;
 using Verifiable.Json;
 using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.AuthCode.States;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Pkce;
 using Verifiable.OAuth.Server;
 using Verifiable.Tests.TestDataProviders;
 using Verifiable.Tests.TestInfrastructure;
@@ -89,6 +94,60 @@ public async Task DefaultIssuerResolverThrowsWhenBothAreUnset()
     }
 
 
+    //R9207-002 — RFC 9207 §2: "Its value MUST be a URL that uses the https scheme
+    //without any query or fragment components." IssuerIdentifierValidation is the
+    //pure shape check; DefaultIssuerResolver wires it in below so every default-path
+    //consumer (discovery issuer, Authorize-redirect iss) enforces it.
+
+    [TestMethod]
+    public void IssuerIdentifierValidationRejectsHttpsWithQuery()
+    {
+        Assert.IsFalse(IssuerIdentifierValidation.IsValidIssuerShape(new Uri("https://as.example.com?tenant=a")),
+            "An issuer identifier with a query component must be rejected per RFC 9207 §2.");
+    }
+
+
+    [TestMethod]
+    public void IssuerIdentifierValidationRejectsFragment()
+    {
+        Assert.IsFalse(IssuerIdentifierValidation.IsValidIssuerShape(new Uri("https://as.example.com/tenant#frag")),
+            "An issuer identifier with a fragment component must be rejected per RFC 9207 §2.");
+    }
+
+
+    [TestMethod]
+    public void IssuerIdentifierValidationRejectsHttp()
+    {
+        Assert.IsFalse(IssuerIdentifierValidation.IsValidIssuerShape(new Uri("http://as.example.com")),
+            "An issuer identifier that does not use the https scheme must be rejected per RFC 9207 §2.");
+    }
+
+
+    [TestMethod]
+    public void IssuerIdentifierValidationAcceptsCleanHttps()
+    {
+        Assert.IsTrue(IssuerIdentifierValidation.IsValidIssuerShape(new Uri("https://as.example.com/tenant-a")),
+            "A clean https URL with no query or fragment must be accepted.");
+    }
+
+
+    [TestMethod]
+    public async Task DefaultIssuerResolverThrowsWhenRegistrationIssuerHasQueryComponent()
+    {
+        ClientRecord registration = BuildRegistration(issuerUri: new Uri("https://as.example.com?tenant=a"));
+        ExchangeContext context = new();
+
+        InvalidOperationException thrown = await Assert.ThrowsExactlyAsync<InvalidOperationException>(
+            async () => await DefaultIssuerResolver.ResolveAsync(
+                registration, context, TestContext.CancellationToken).ConfigureAwait(false))
+            .ConfigureAwait(false);
+
+        Assert.Contains("RFC 9207", thrown.Message,
+            "A shape-invalid configured issuer must fail with an RFC 9207-attributed message, " +
+            "distinct from the not-configured case.");
+    }
+
+
     [TestMethod]
     public async Task ApplicationResolverOverridesDefault()
     {
@@ -110,6 +169,184 @@ public async Task ApplicationResolverOverridesDefault()
     }
 
 
+    //R9207-004 — RFC 9207 §2.3: "The issuer identifier included in the server's metadata
+    //value issuer MUST be identical to the iss parameter's value." Drives a custom
+    //AuthorizationServerIntegration.ResolveIssuerAsync through both the discovery endpoint
+    //and a live Authorize redirect and asserts the two emitted issuer values agree
+    //byte-for-byte — proving the redirect builder routes through the same resolution path
+    //as discovery rather than its own independent ClientRegistration?.IssuerUri fallback.
+
+    [TestMethod]
+    public async Task CustomResolverProducesByteIdenticalIssuerOnMetadataAndRedirect()
+    {
+        FakeTimeProvider timeProvider = new(DateTimeOffset.Parse(
+            "2026-04-22T10:00:00Z", System.Globalization.CultureInfo.InvariantCulture));
+
+        await using TestHostShell app = new(timeProvider);
+        app.SeedTestSubject(subject: "subject-r9207-004");
+
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            "client-r9207-004", new Uri("https://client.example.com"));
+
+        Uri customIssuer = new("https://custom-resolver.example.com/tenant-x");
+        app.Server.OAuth().ResolveIssuerAsync = (_, _, _) =>
+            ValueTask.FromResult<Uri?>(customIssuer);
+
+        string segment = material.Registration.TenantId.Value;
+
+        ServerHttpResponse discoveryResponse = await app.DispatchAtEndpointAsync(
+            segment, WellKnownEndpointNames.MetadataDiscovery, "GET",
+            new RequestFields(), new ExchangeContext(), TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, discoveryResponse.StatusCode, discoveryResponse.Body);
+
+        using JsonDocument discoveryBody = JsonDocument.Parse(discoveryResponse.Body);
+        string metadataIssuer = discoveryBody.RootElement.GetProperty("issuer").GetString()!;
+        Assert.AreEqual(customIssuer.OriginalString, metadataIssuer,
+            "The discovery issuer must equal the custom-resolved issuer.");
+
+        PkceParameters pkce = PkceGeneration.Generate(TestSetup.Base64UrlEncoder, BaseMemoryPool.Shared);
+        RequestFields parFields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = material.Registration.ClientId,
+            [OAuthRequestParameterNames.CodeChallenge] = pkce.EncodedChallenge,
+            [OAuthRequestParameterNames.CodeChallengeMethod] = WellKnownCodeChallengeMethods.S256,
+            [OAuthRequestParameterNames.RedirectUri] = "https://client.example.com/callback",
+            [OAuthRequestParameterNames.Scope] = WellKnownScopes.OpenId
+        };
+        ServerHttpResponse parResponse = await app.DispatchAtEndpointAsync(
+            segment, WellKnownEndpointNames.AuthCodePar, "POST",
+            parFields, new ExchangeContext(), TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(201, parResponse.StatusCode, parResponse.Body);
+
+        using JsonDocument parBody = JsonDocument.Parse(parResponse.Body);
+        string requestUri = parBody.RootElement.GetProperty("request_uri").GetString()!;
+
+        RequestFields authorizeFields = new()
+        {
+            [OAuthRequestParameterNames.ClientId] = material.Registration.ClientId,
+            [OAuthRequestParameterNames.RequestUri] = requestUri
+        };
+        ExchangeContext authorizeContext = new();
+        authorizeContext.SetSubjectId("subject-r9207-004");
+
+        ServerHttpResponse authorizeResponse = await app.DispatchAtEndpointAsync(
+            segment, WellKnownEndpointNames.AuthCodeAuthorize, WellKnownHttpMethods.Get,
+            authorizeFields, authorizeContext, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(302, authorizeResponse.StatusCode, authorizeResponse.Body);
+
+        string location = authorizeResponse.Location!;
+        int issIndex = location.IndexOf("iss=", StringComparison.Ordinal);
+        Assert.IsGreaterThanOrEqualTo(0, issIndex, $"Redirect must carry iss. Location: {location}");
+        int ampIndex = location.IndexOf('&', issIndex);
+        string issRaw = ampIndex < 0 ? location[(issIndex + 4)..] : location[(issIndex + 4)..ampIndex];
+        string redirectIssuer = Uri.UnescapeDataString(issRaw);
+
+        Assert.AreEqual(metadataIssuer, redirectIssuer,
+            "R9207-004: the redirect iss and the discovery issuer must be byte-identical under a custom resolver.");
+    }
+
+
+    //R9207-002 — RFC 9207 §2's https-only issuer shape, proven over the real wire rather than the
+    //in-process dispatch <see cref="CustomResolverProducesByteIdenticalIssuerOnMetadataAndRedirect"/>
+    //uses: every loopback test host now serves genuine HTTPS on an ephemeral pinned certificate, so the
+    //DEFAULT resolver (no application override) already produces an issuer whose scheme, authority, and
+    //shape satisfy the library's own RFC 9207 §2 / RFC 8414 §2 gate — closing the http-align bypass this
+    //fixture used to carry.
+
+    [TestMethod]
+    public async Task DefaultResolverServesHttpsIssuerOverRealWireEndToEnd()
+    {
+        FakeTimeProvider timeProvider = new(DateTimeOffset.Parse(
+            "2026-04-22T10:00:00Z", System.Globalization.CultureInfo.InvariantCulture));
+
+        await using TestHostShell host = new(timeProvider);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            "client-r9207-002-real-wire",
+            new Uri("https://client.example.com"),
+            profile: PolicyProfile.Haip10);
+
+        (OAuthClient client, ClientRegistration registration, Dictionary<string, FlowState> clientFlowStore) =
+            await host.CreateOAuthClientAndRegistrationAsync(
+                material.Registration,
+                "https://client.example.com/callback",
+                profile: PolicyProfile.Haip10,
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+        HostedAuthorizationServer hosted = host.Host("default");
+
+        //Guards against a bypass reintroduction: the DEFAULT resolver — no application-supplied
+        //ResolveIssuerAsync — is what serves this real-wire flow.
+        Assert.IsNull(hosted.Server.OAuth().ResolveIssuerAsync,
+            "The default resolver must be in play; no application override should be wired for this host.");
+
+        string segment = material.Registration.TenantId.Value;
+        Uri discoveryUri = new(
+            hosted.HttpBaseAddress!,
+            TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.MetadataDiscovery, segment));
+
+        using HttpResponseMessage discoveryResponse = await hosted.SharedHttpClient!
+            .GetAsync(discoveryUri, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)discoveryResponse.StatusCode,
+            "The discovery document must be reachable over the pinned real-wire HTTPS client.");
+
+        string discoveryBody = await discoveryResponse.Content
+            .ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        using JsonDocument discoveryDocument = JsonDocument.Parse(discoveryBody);
+        string metadataIssuer = discoveryDocument.RootElement.GetProperty("issuer").GetString()!;
+
+        Uri issuerUri = new(metadataIssuer);
+        Assert.AreEqual("https", issuerUri.Scheme,
+            "RFC 9207 §2: the issuer identifier must use the https scheme.");
+        Assert.AreEqual(string.Empty, issuerUri.Query,
+            "RFC 9207 §2: the issuer identifier must carry no query component.");
+        Assert.AreEqual(string.Empty, issuerUri.Fragment,
+            "RFC 9207 §2: the issuer identifier must carry no fragment component.");
+        Assert.AreEqual(hosted.HttpBaseAddress!.Authority, issuerUri.Authority,
+            "The issuer authority must equal the wire authority the discovery document was actually served from.");
+
+        AuthCodeFlowEndpointResult parResult = await client.AuthCode.StartParAsync(
+            registration,
+            new Uri("https://client.example.com/callback"),
+            OAuthFormEncodedFields.Empty,
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, parResult.Outcome,
+            $"PAR must redirect over the real wire. ErrorCode={parResult.ErrorCode} ErrorDescription={parResult.ErrorDescription}");
+
+        string flowId = clientFlowStore.Keys.Single();
+        ParCompletedState parState = (ParCompletedState)clientFlowStore[flowId];
+
+        Uri authorizeUrl = new(
+            hosted.HttpBaseAddress!,
+            $"{TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeAuthorize, segment)}" +
+            $"?{OAuthRequestParameterNames.ClientId}={Uri.EscapeDataString(material.Registration.ClientId)}" +
+            $"&{OAuthRequestParameterNames.RequestUri}={Uri.EscapeDataString(parState.Par.RequestUri.ToString())}");
+
+        //A fresh pinned, no-redirect client for the browser leg: the same certificate the shell's
+        //SharedHttpClient pins, so the real-wire GET succeeds without trusting a CA, and with
+        //auto-redirect disabled so the 302 Location is read off the wire directly.
+        using HttpClientHandler noRedirectHandler = LoopbackTls.CreatePinnedHandler(host.ServerCertificate);
+        noRedirectHandler.AllowAutoRedirect = false;
+        using HttpClient browserClient = new(noRedirectHandler) { BaseAddress = hosted.HttpBaseAddress };
+        using HttpRequestMessage authorizeRequest = new(HttpMethod.Get, authorizeUrl);
+        authorizeRequest.Headers.Add(AuthorizationServerHttpApplication.TestSubjectHeaderName, "subject-r9207-002-real-wire");
+
+        using HttpResponseMessage authorizeResponse = await browserClient
+            .SendAsync(authorizeRequest, TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(302, (int)authorizeResponse.StatusCode,
+            "The authorize endpoint must redirect with the iss parameter over the real wire.");
+
+        string location = authorizeResponse.Headers.Location!.ToString();
+        int issIndex = location.IndexOf("iss=", StringComparison.Ordinal);
+        Assert.IsGreaterThanOrEqualTo(0, issIndex, $"Redirect must carry iss. Location: {location}");
+        int ampIndex = location.IndexOf('&', issIndex);
+        string issRaw = ampIndex < 0 ? location[(issIndex + 4)..] : location[(issIndex + 4)..ampIndex];
+        string redirectIssuer = Uri.UnescapeDataString(issRaw);
+
+        Assert.AreEqual(metadataIssuer, redirectIssuer,
+            "R9207-002: the real-wire redirect iss and the real-wire discovery issuer must be byte-identical.");
+    }
+
+
     [TestMethod]
     public async Task DiscoveryEndpointUsesResolvedIssuerFromRegistration()
     {
diff --git a/test/Verifiable.Tests/OAuth/ResourceServerChallengeTests.cs b/test/Verifiable.Tests/OAuth/ResourceServerChallengeTests.cs
new file mode 100644
index 00000000..38bdf8f0
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/ResourceServerChallengeTests.cs
@@ -0,0 +1,334 @@
+using System.Linq;
+using System.Net;
+using System.Net.Http.Headers;
+using System.Text.Json;
+using Microsoft.Extensions.Time.Testing;
+using Verifiable.Cryptography;
+using Verifiable.JCose;
+using Verifiable.Json;
+using Verifiable.Microsoft;
+using Verifiable.OAuth;
+using Verifiable.OAuth.ProtectedResource;
+using Verifiable.OAuth.Server;
+using Verifiable.Tests.TestDataProviders;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Wire-level tests for the standalone resource-server role of RFC 9728 +
+/// RFC 6750 on <see cref="TestResourceServerShell"/>: the
+/// <c>/.well-known/oauth-protected-resource</c> document is produced by the
+/// library's <see cref="ProtectedResourceMetadataEndpoints"/> builder and
+/// survives the consumer's §3.3 resource-match validation; every <c>401</c>
+/// carries a <c>WWW-Authenticate</c> challenge built by
+/// <see cref="BearerTokenChallenge"/> whose <c>resource_metadata</c>
+/// parameter (§5.1) completes the discovery loop over the real wire; a valid
+/// token lacking the required scope is refused <c>403</c>
+/// <c>insufficient_scope</c> with the <c>scope</c> attribute naming the
+/// needed scope (RFC 6750 §3.1); and the OPRM-coherence invariant — the
+/// trusted issuer must be among the advertised <c>authorization_servers</c> —
+/// is enforced at construction.
+/// </summary>
+[TestClass]
+internal sealed class ResourceServerChallengeTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private const string Issuer = "https://as1.test/tenant-a";
+    private const string Audience = "test-resource-server";
+    private const string Subject = "user-1";
+    private const string ClientId = "client-1";
+    private const string Kid = "test-kid";
+    private const string RequiredScope = "mcp:tools";
+
+    private static readonly DateTimeOffset NowInstant = TestClock.CanonicalEpoch.AddDays(-15);
+
+
+    [TestMethod]
+    public async Task MetadataDocumentComesFromTheLibraryBuilderAndSurvivesResourceMatch()
+    {
+        var keys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        FakeTimeProvider time = new(NowInstant);
+
+        await using TestResourceServerShell rs = new(
+            trustedIssuer: new Uri(Issuer),
+            expectedAudience: Audience,
+            resolveVerificationKey: BuildResolver(keys.PublicKey),
+            verifySignature: MicrosoftCryptographicFunctions.VerifyP256Async,
+            timeProvider: time,
+            requiredScope: RequiredScope);
+        await rs.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
+        using HttpResponseMessage response = await client.GetAsync(
+            new Uri(rs.MetadataUrl!.AbsolutePath, UriKind.Relative), TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+        //§3.2: 200 OK, application/json.
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+        Assert.AreEqual(WellKnownMediaTypes.Application.Json, response.Content.Headers.ContentType?.MediaType);
+
+        //The consumer-side strict parser reads the wire bytes alone.
+        ProtectedResourceMetadata? metadata =
+            ProtectedResourceMetadataJsonParsing.ParseProtectedResourceMetadata(body);
+        Assert.IsNotNull(metadata);
+
+        //§3.3: the resource value is identical to the identifier the metadata
+        //URL derives from; any other identifier must fail the match.
+        Assert.IsTrue(ProtectedResourceMetadataValidation.IsResourceMatch(
+            metadata!, rs.ResourceIdentity!.OriginalString));
+        Assert.IsFalse(ProtectedResourceMetadataValidation.IsResourceMatch(
+            metadata!, "https://attacker.example.com"));
+
+        //The event's MCP-Server row: the document names the RS's one trusted
+        //AS, and advertises the scope the RS enforces.
+        Assert.IsNotNull(metadata!.AuthorizationServers);
+        Assert.AreEqual(Issuer, metadata.AuthorizationServers!.Single());
+        Assert.IsNotNull(metadata.ScopesSupported);
+        Assert.Contains(RequiredScope, metadata.ScopesSupported!);
+        Assert.IsNotNull(metadata.BearerMethodsSupported);
+        Assert.IsTrue(BearerMethodValues.IsDefined(metadata.BearerMethodsSupported![0]));
+    }
+
+
+    [TestMethod]
+    public async Task UnauthenticatedRequestChallengeCompletesMetadataDiscovery()
+    {
+        var keys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        FakeTimeProvider time = new(NowInstant);
+
+        await using TestResourceServerShell rs = new(
+            trustedIssuer: new Uri(Issuer),
+            expectedAudience: Audience,
+            resolveVerificationKey: BuildResolver(keys.PublicKey),
+            verifySignature: MicrosoftCryptographicFunctions.VerifyP256Async,
+            timeProvider: time);
+        await rs.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
+        using HttpResponseMessage denied = await client.GetAsync(
+            new Uri("/protected", UriKind.Relative), TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(HttpStatusCode.Unauthorized, denied.StatusCode);
+        Assert.IsTrue(denied.Headers.TryGetValues("WWW-Authenticate", out IEnumerable<string>? challenges));
+        string challenge = challenges!.Single();
+
+        //RFC 6750 §3 grammar, asserted through the challenge parser.
+        Assert.StartsWith(WellKnownAuthenticationSchemes.Bearer, challenge);
+        Assert.IsTrue(BearerTokenChallenge.TryParse(challenge, out BearerTokenChallengeParameters parameters),
+            $"The 401 challenge must parse under the RFC 6750 §3 grammar. Header: {challenge}");
+        Assert.IsNull(parameters.Error,
+            "RFC 6750 §3: a request without authentication information gets a challenge without an error code.");
+
+        //§5.1: the challenge advertises the metadata URL...
+        string? advertised = ProtectedResourceChallenge.TryReadResourceMetadata(challenge);
+        Assert.AreEqual(rs.MetadataUrl!.OriginalString, advertised);
+
+        //...and fetching it over the wire completes the §5 discovery loop:
+        //parse strictly, then validate §3.3 against the RS identity.
+        Uri advertisedUrl = new(advertised!);
+        using HttpResponseMessage metadataResponse = await client.GetAsync(
+            new Uri(advertisedUrl.AbsolutePath, UriKind.Relative), TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        string metadataBody = await metadataResponse.Content.ReadAsStringAsync(TestContext.CancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(200, (int)metadataResponse.StatusCode, metadataBody);
+
+        ProtectedResourceMetadata? metadata =
+            ProtectedResourceMetadataJsonParsing.ParseProtectedResourceMetadata(metadataBody);
+        Assert.IsNotNull(metadata);
+        Assert.IsTrue(ProtectedResourceMetadataValidation.IsResourceMatch(
+            metadata!, rs.ResourceIdentity!.OriginalString));
+        Assert.AreEqual(Issuer, metadata!.AuthorizationServers!.Single(),
+            "Discovery lands on the AS the resource server trusts.");
+    }
+
+
+    [TestMethod]
+    public async Task RejectedTokenChallengeCarriesInvalidTokenErrorCode()
+    {
+        var keys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        FakeTimeProvider time = new(NowInstant);
+
+        await using TestResourceServerShell rs = new(
+            trustedIssuer: new Uri(Issuer),
+            expectedAudience: Audience,
+            resolveVerificationKey: BuildResolver(keys.PublicKey),
+            verifySignature: MicrosoftCryptographicFunctions.VerifyP256Async,
+            timeProvider: time);
+        await rs.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+        //Signed by the trusted key but addressed to another resource — the
+        //validator refuses it and the challenge must say invalid_token.
+        JwtPayload payload = OAuthAccessTokenFixtures.BuildAccessTokenPayload(
+            subject: Subject,
+            scope: "openid profile",
+            clientId: ClientId,
+            issuedAt: NowInstant - TimeSpan.FromMinutes(1),
+            expiresAt: NowInstant + TimeSpan.FromHours(1),
+            issuer: Issuer,
+            audience: ["other-rs"]);
+        string token = await BuildAccessTokenAsync(keys.PrivateKey, payload).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
+        using HttpRequestMessage request = new(HttpMethod.Get, "/protected");
+        request.Headers.Authorization = new AuthenticationHeaderValue(WellKnownAuthenticationSchemes.Bearer, token);
+        using HttpResponseMessage response = await client.SendAsync(request, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(HttpStatusCode.Unauthorized, response.StatusCode);
+        Assert.IsTrue(response.Headers.TryGetValues("WWW-Authenticate", out IEnumerable<string>? challenges));
+        string challenge = challenges!.Single();
+
+        //RFC 6750 §3.1: invalid_token → 401 with the error code on the
+        //challenge; the §5.1 resource_metadata parameter still rides it.
+        Assert.IsTrue(BearerTokenChallenge.TryParse(challenge, out BearerTokenChallengeParameters parameters),
+            $"The 401 challenge must parse under the RFC 6750 §3 grammar. Header: {challenge}");
+        Assert.AreEqual(OAuthErrors.InvalidToken, parameters.Error);
+        Assert.AreEqual(rs.MetadataUrl!.OriginalString,
+            ProtectedResourceChallenge.TryReadResourceMetadata(challenge));
+    }
+
+
+    [TestMethod]
+    public async Task TokenWithoutRequiredScopeIsRefusedWithInsufficientScopeChallenge()
+    {
+        var keys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        FakeTimeProvider time = new(NowInstant);
+
+        await using TestResourceServerShell rs = new(
+            trustedIssuer: new Uri(Issuer),
+            expectedAudience: Audience,
+            resolveVerificationKey: BuildResolver(keys.PublicKey),
+            verifySignature: MicrosoftCryptographicFunctions.VerifyP256Async,
+            timeProvider: time,
+            requiredScope: RequiredScope);
+        await rs.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+        //A fully valid token — signature, issuer, audience, lifetime — whose
+        //scope list lacks the resource's required scope.
+        JwtPayload payload = OAuthAccessTokenFixtures.BuildAccessTokenPayload(
+            subject: Subject,
+            scope: "openid profile",
+            clientId: ClientId,
+            issuedAt: NowInstant - TimeSpan.FromMinutes(1),
+            expiresAt: NowInstant + TimeSpan.FromHours(1),
+            issuer: Issuer,
+            audience: [Audience]);
+        string token = await BuildAccessTokenAsync(keys.PrivateKey, payload).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
+        using HttpRequestMessage request = new(HttpMethod.Get, "/protected");
+        request.Headers.Authorization = new AuthenticationHeaderValue(WellKnownAuthenticationSchemes.Bearer, token);
+        using HttpResponseMessage response = await client.SendAsync(request, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        //RFC 6750 §3.1: insufficient_scope → 403; the scope attribute names
+        //the scope necessary to access the resource.
+        Assert.AreEqual(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.IsTrue(response.Headers.TryGetValues("WWW-Authenticate", out IEnumerable<string>? challenges));
+        string challenge = challenges!.Single();
+
+        Assert.IsTrue(BearerTokenChallenge.TryParse(challenge, out BearerTokenChallengeParameters parameters),
+            $"The 403 challenge must parse under the RFC 6750 §3 grammar. Header: {challenge}");
+        Assert.AreEqual(OAuthErrors.InsufficientScope, parameters.Error);
+        Assert.AreEqual(RequiredScope, parameters.Scope);
+    }
+
+
+    [TestMethod]
+    public async Task TokenWithRequiredScopeReachesTheProtectedResource()
+    {
+        var keys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        FakeTimeProvider time = new(NowInstant);
+
+        await using TestResourceServerShell rs = new(
+            trustedIssuer: new Uri(Issuer),
+            expectedAudience: Audience,
+            resolveVerificationKey: BuildResolver(keys.PublicKey),
+            verifySignature: MicrosoftCryptographicFunctions.VerifyP256Async,
+            timeProvider: time,
+            requiredScope: RequiredScope);
+        await rs.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+
+        JwtPayload payload = OAuthAccessTokenFixtures.BuildAccessTokenPayload(
+            subject: Subject,
+            scope: $"openid {RequiredScope}",
+            clientId: ClientId,
+            issuedAt: NowInstant - TimeSpan.FromMinutes(1),
+            expiresAt: NowInstant + TimeSpan.FromHours(1),
+            issuer: Issuer,
+            audience: [Audience]);
+        string token = await BuildAccessTokenAsync(keys.PrivateKey, payload).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
+        using HttpRequestMessage request = new(HttpMethod.Get, "/protected");
+        request.Headers.Authorization = new AuthenticationHeaderValue(WellKnownAuthenticationSchemes.Bearer, token);
+        using HttpResponseMessage response = await client.SendAsync(request, TestContext.CancellationToken)
+            .ConfigureAwait(false);
+
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(HttpStatusCode.OK, response.StatusCode, body);
+
+        using JsonDocument doc = JsonDocument.Parse(body);
+        Assert.AreEqual(Subject, doc.RootElement.GetProperty("sub").GetString());
+        string grantedScopes = doc.RootElement.GetProperty("scope").GetString()!;
+        Assert.IsTrue(grantedScopes.Split(' ').Contains(RequiredScope, StringComparer.Ordinal),
+            $"The echoed scope claim must contain the required scope. Scopes: {grantedScopes}");
+    }
+
+
+    [TestMethod]
+    public void ConstructionFailsWhenTrustedIssuerIsNotAmongAdvertisedAuthorizationServers()
+    {
+        var keys = TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+        FakeTimeProvider time = new(NowInstant);
+
+        //The event's MCP-Server OPRM-coherence invariant: the RS's trusted AS
+        //must be one of the authorization_servers its own document advertises.
+        Assert.ThrowsExactly<ArgumentException>(() => new TestResourceServerShell(
+            trustedIssuer: new Uri(Issuer),
+            expectedAudience: Audience,
+            resolveVerificationKey: BuildResolver(keys.PublicKey),
+            verifySignature: MicrosoftCryptographicFunctions.VerifyP256Async,
+            timeProvider: time,
+            requiredScope: null,
+            advertisedAuthorizationServers: ["https://other-as.example.com"]));
+    }
+
+
+    private static ServerVerificationKeyResolverDelegate BuildResolver(PublicKeyMemory publicKey) =>
+        (kid, tenant, ctx, ct) => ValueTask.FromResult<PublicKeyMemory?>(
+            string.Equals(kid.Value, Kid, StringComparison.Ordinal) ? publicKey : null);
+
+
+    private async Task<string> BuildAccessTokenAsync(PrivateKeyMemory privateKey, JwtPayload payload)
+    {
+        JwtHeader header = JwtHeaderExtensions.ForAccessToken(WellKnownJwaValues.Es256, Kid);
+        UnsignedJwt unsignedJwt = new(header, payload);
+
+        using JwsMessage jws = await unsignedJwt.SignAsync(
+            privateKey,
+            HeaderSerializer,
+            PayloadSerializer,
+            TestSetup.Base64UrlEncoder,
+            BaseMemoryPool.Shared,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        return JwsSerialization.SerializeCompact(jws, TestSetup.Base64UrlEncoder);
+    }
+
+
+    private static ReadOnlySpan<byte> HeaderSerializer(JwtHeader header) =>
+        JsonSerializerExtensions.SerializeToUtf8Bytes(
+            (Dictionary<string, object>)header,
+            TestSetup.DefaultSerializationOptions);
+
+
+    private static ReadOnlySpan<byte> PayloadSerializer(JwtPayload payload) =>
+        JsonSerializerExtensions.SerializeToUtf8Bytes(
+            (Dictionary<string, object>)payload,
+            TestSetup.DefaultSerializationOptions);
+}
diff --git a/test/Verifiable.Tests/OAuth/ResourceServerEndToEndTests.cs b/test/Verifiable.Tests/OAuth/ResourceServerEndToEndTests.cs
index 84c95716..698d1daa 100644
--- a/test/Verifiable.Tests/OAuth/ResourceServerEndToEndTests.cs
+++ b/test/Verifiable.Tests/OAuth/ResourceServerEndToEndTests.cs
@@ -60,7 +60,7 @@ public async Task BearerProtectedRequestReturnsClaimsJson()
             audience: [Audience]);
         string token = await BuildAccessTokenAsync(keys.PrivateKey, payload).ConfigureAwait(false);
 
-        using HttpClient client = new() { BaseAddress = rs.HttpBaseAddress };
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
         using HttpRequestMessage request = new(HttpMethod.Get, "/protected");
         request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
 
@@ -92,7 +92,7 @@ public async Task MissingAuthorizationHeaderReturns401WithBearerChallenge()
             timeProvider: time);
         await rs.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
 
-        using HttpClient client = new() { BaseAddress = rs.HttpBaseAddress };
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
         using HttpResponseMessage response = await client.GetAsync(new Uri("/protected", UriKind.Relative), TestContext.CancellationToken)
             .ConfigureAwait(false);
 
@@ -129,7 +129,7 @@ public async Task AudienceMismatchReturns401()
             audience: ["other-rs"]);
         string token = await BuildAccessTokenAsync(keys.PrivateKey, payload).ConfigureAwait(false);
 
-        using HttpClient client = new() { BaseAddress = rs.HttpBaseAddress };
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
         using HttpRequestMessage request = new(HttpMethod.Get, "/protected");
         request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
 
@@ -169,7 +169,7 @@ public async Task DpopBoundTokenPresentedUnderBearerSchemeReturns401()
         };
         string token = await BuildAccessTokenAsync(keys.PrivateKey, payload).ConfigureAwait(false);
 
-        using HttpClient client = new() { BaseAddress = rs.HttpBaseAddress };
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
         using HttpRequestMessage request = new(HttpMethod.Get, "/protected");
         request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
 
@@ -242,7 +242,7 @@ public async Task DpopBoundProtectedRequestWithMatchingProofReturns200()
             BaseMemoryPool.Shared,
             TestContext.CancellationToken).ConfigureAwait(false);
 
-        using HttpClient client = new() { BaseAddress = rs.HttpBaseAddress };
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
         using HttpRequestMessage request = new(HttpMethod.Get, "/protected");
         request.Headers.Authorization = new AuthenticationHeaderValue("DPoP", token);
         request.Headers.Add("DPoP", proof);
@@ -314,7 +314,7 @@ public async Task DpopBoundProofReplayedReturns401()
             DpopTestSupport.Serializer, MicrosoftCryptographicFunctions.SignP256Async,
             BaseMemoryPool.Shared, TestContext.CancellationToken).ConfigureAwait(false);
 
-        using HttpClient client = new() { BaseAddress = rs.HttpBaseAddress };
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(rs.HttpCertificate!, rs.HttpBaseAddress);
 
         //First call: should succeed and seed the replay tracker.
         using HttpRequestMessage firstRequest = new(HttpMethod.Get, "/protected");
diff --git a/test/Verifiable.Tests/OAuth/ResourceServerHttpApplication.cs b/test/Verifiable.Tests/OAuth/ResourceServerHttpApplication.cs
index 03157fd4..439cb961 100644
--- a/test/Verifiable.Tests/OAuth/ResourceServerHttpApplication.cs
+++ b/test/Verifiable.Tests/OAuth/ResourceServerHttpApplication.cs
@@ -8,7 +8,9 @@
 using Verifiable.Cryptography;
 using Verifiable.OAuth;
 using Verifiable.OAuth.Dpop;
+using Verifiable.OAuth.ProtectedResource;
 using Verifiable.OAuth.Server;
+using Verifiable.Server;
 using Verifiable.Tests.TestInfrastructure;
 
 namespace Verifiable.Tests.OAuth;
@@ -17,29 +19,72 @@ namespace Verifiable.Tests.OAuth;
 /// Maps inbound HTTP requests for the test resource server to the
 /// validator composition. Parallel of
 /// <see cref="AuthorizationServerHttpApplication"/>; minimal mapping
-/// layer, no DI container, no middleware pipeline. Hosts a single
+/// layer, no DI container, no middleware pipeline. Hosts the
 /// <c>/protected</c> endpoint that exercises
 /// <see cref="JwsAccessTokenValidator"/> and (for DPoP-bound tokens)
-/// <see cref="DpopProofValidator"/>.
+/// <see cref="DpopProofValidator"/>, plus the RFC 9728 §3
+/// <c>/.well-known/oauth-protected-resource</c> location whose document
+/// bytes come from the library's
+/// <see cref="ProtectedResourceMetadataEndpoints"/> builder through
+/// <see cref="EndpointServer.DispatchAsync"/>.
 /// </summary>
+/// <remarks>
+/// <para>
+/// Challenge surfaces: every Bearer-scheme <c>401</c> and the
+/// <c>403</c> <c>insufficient_scope</c> refusal carry a
+/// <c>WWW-Authenticate</c> value built by
+/// <see cref="BearerTokenChallenge.BuildChallenge"/> (RFC 6750 §3) with the
+/// RFC 9728 §5.1 <c>resource_metadata</c> parameter pointing at this
+/// resource server's own metadata URL. DPoP-scheme challenges (RFC 9449 §7.1)
+/// cannot ride that builder — its scheme is <c>Bearer</c> by definition — so
+/// they compose <see cref="ProtectedResourceChallenge.BuildChallenge"/> for
+/// the <c>resource_metadata</c> parameter and format their own auth-params
+/// over values restricted to the RFC 6750 §3 charset.
+/// </para>
+/// <para>
+/// Span decoration: token-validated and scope-checked outcomes are attached
+/// to <see cref="Activity.Current"/> via
+/// <see cref="ResourceServerTagNames"/>/<see cref="ResourceServerEventNames"/>
+/// so a trace listener observing the hosting spans sees the resource server's
+/// decisions inside the request span.
+/// </para>
+/// </remarks>
 [DebuggerDisplay("ResourceServerHttpApplication")]
 internal sealed class ResourceServerHttpApplication: IHttpApplication<HttpContext>
 {
     private const string BearerScheme = "Bearer";
     private const string DpopScheme = "DPoP";
 
+    /// <summary>The RFC 6750 §3 <c>realm</c> value every Bearer challenge from this host carries.</summary>
+    private const string ProtectedRealm = "protected";
+
     private readonly ResourceServerIntegration integration;
     private readonly VerificationDelegate verifySignature;
+    private readonly string? requiredScope;
+
+    /// <summary>
+    /// The RFC 9728 serving surface, assigned by
+    /// <see cref="TestResourceServerShell.StartHttpHostAsync"/> once the
+    /// listener is bound and the resource identity (scheme://host:port) is
+    /// known. While unset — only possible before the shell returns from
+    /// startup — the metadata path is unrouted and challenges omit the
+    /// <c>resource_metadata</c> parameter, the same fail-closed posture the
+    /// co-located SSF transmitter takes when the metadata capability is
+    /// inactive.
+    /// </summary>
+    public ResourceServerMetadataEndpoint? MetadataEndpoint { get; set; }
 
 
     public ResourceServerHttpApplication(
         ResourceServerIntegration integration,
-        VerificationDelegate verifySignature)
+        VerificationDelegate verifySignature,
+        string? requiredScope = null)
     {
         ArgumentNullException.ThrowIfNull(integration);
         ArgumentNullException.ThrowIfNull(verifySignature);
         this.integration = integration;
         this.verifySignature = verifySignature;
+        this.requiredScope = requiredScope;
     }
 
 
@@ -57,31 +102,53 @@ public async Task ProcessRequestAsync(HttpContext context)
         {
             //Tests rely on seeing the failure reason; production hosts would
             //surface this through telemetry rather than the response body.
-            context.Response.StatusCode = 500;
+            context.Response.StatusCode = StatusCodes.Status500InternalServerError;
             context.Response.ContentType = "text/plain";
-            byte[] body = System.Text.Encoding.UTF8.GetBytes(
-                $"Handler threw: {ex.GetType().FullName}: {ex.Message}\n{ex.StackTrace}");
-            await context.Response.Body.WriteAsync(body).ConfigureAwait(false);
+            await WriteBodyAsync(
+                context,
+                $"Handler threw: {ex.GetType().FullName}: {ex.Message}\n{ex.StackTrace}").ConfigureAwait(false);
         }
     }
 
 
     private async Task ProcessRequestCoreAsync(HttpContext context)
     {
+        if(MetadataEndpoint is { } metadataEndpoint
+            && string.Equals(context.Request.Path, metadataEndpoint.MetadataUrl.AbsolutePath, StringComparison.Ordinal))
+        {
+            await ServeProtectedResourceMetadataAsync(context, metadataEndpoint).ConfigureAwait(false);
+            return;
+        }
+
         if(!string.Equals(context.Request.Path, "/protected", StringComparison.Ordinal))
         {
-            context.Response.StatusCode = 404;
+            context.Response.StatusCode = StatusCodes.Status404NotFound;
+            return;
+        }
+
+        if(!context.Request.Headers.ContainsKey("Authorization"))
+        {
+            //RFC 6750 §3: a request without any authentication information is
+            //challenged WITHOUT an error code; the RFC 9728 §5.1
+            //resource_metadata parameter still rides the challenge so the
+            //client can start metadata discovery from this response alone.
+            await WriteBearerChallengeAsync(
+                context, StatusCodes.Status401Unauthorized,
+                error: null, errorDescription: null, scope: null).ConfigureAwait(false);
             return;
         }
 
         if(!TryExtractAuthorization(context.Request, out string scheme, out string? accessToken))
         {
-            await Write401Async(context, BearerScheme, "invalid_token",
-                "Authorization header is missing or malformed.").ConfigureAwait(false);
+            await WriteBearerChallengeAsync(
+                context, StatusCodes.Status401Unauthorized,
+                OAuthErrors.InvalidToken,
+                "Authorization header is malformed or uses an unsupported scheme.",
+                scope: null).ConfigureAwait(false);
             return;
         }
 
-        ExchangeContext ExchangeContext = new();
+        ExchangeContext exchangeContext = new();
 
         JwsAccessTokenValidationResult tokenResult = await JwsAccessTokenValidator.ValidateAsync(
             accessToken!,
@@ -95,24 +162,32 @@ await Write401Async(context, BearerScheme, "invalid_token",
             BaseMemoryPool.Shared,
             integration.AccessTokenIatSkew,
             tenantId: default,
-            ExchangeContext,
+            exchangeContext,
             expectedAuthorizedParty: null,
             context.RequestAborted).ConfigureAwait(false);
 
         if(!tokenResult.IsSuccess)
         {
-            await Write401Async(context, BearerScheme, "invalid_token",
-                tokenResult.FailureDescription ?? "Access token validation failed.").ConfigureAwait(false);
+            Activity.Current?.SetTag(ResourceServerTagNames.TokenValidated, false);
+            Activity.Current?.AddEvent(new ActivityEvent(ResourceServerEventNames.TokenRejected));
+            await WriteBearerChallengeAsync(
+                context, StatusCodes.Status401Unauthorized,
+                OAuthErrors.InvalidToken,
+                tokenResult.FailureDescription ?? "Access token validation failed.",
+                scope: null).ConfigureAwait(false);
             return;
         }
 
+        Activity.Current?.SetTag(ResourceServerTagNames.TokenValidated, true);
+        Activity.Current?.AddEvent(new ActivityEvent(ResourceServerEventNames.TokenValidated));
+
         JwsAccessTokenClaims claims = tokenResult.Claims!;
 
         if(claims.Confirmation is { JwkThumbprint: not null } confirmation)
         {
             if(!string.Equals(scheme, DpopScheme, StringComparison.Ordinal))
             {
-                await Write401Async(context, DpopScheme, "invalid_token",
+                await WriteDpopChallengeAsync(context, OAuthErrors.InvalidToken,
                     "Access token is DPoP-bound but was presented under Bearer scheme.")
                     .ConfigureAwait(false);
                 return;
@@ -120,7 +195,7 @@ await Write401Async(context, DpopScheme, "invalid_token",
 
             if(!TryExtractDpopProof(context.Request, out string? proofJwt))
             {
-                await Write401Async(context, DpopScheme, "invalid_dpop_proof",
+                await WriteDpopChallengeAsync(context, OAuthErrors.InvalidDpopProof,
                     "DPoP header is missing.").ConfigureAwait(false);
                 return;
             }
@@ -149,7 +224,7 @@ await Write401Async(context, DpopScheme, "invalid_dpop_proof",
 
             if(!proofResult.IsSuccess)
             {
-                await Write401Async(context, DpopScheme, "invalid_dpop_proof",
+                await WriteDpopChallengeAsync(context, OAuthErrors.InvalidDpopProof,
                     $"DPoP proof validation failed: {proofResult.FailureReason}.")
                     .ConfigureAwait(false);
                 return;
@@ -157,7 +232,7 @@ await Write401Async(context, DpopScheme, "invalid_dpop_proof",
 
             if(!string.Equals(proofResult.JwkThumbprint, confirmation.JwkThumbprint, StringComparison.Ordinal))
             {
-                await Write401Async(context, DpopScheme, "invalid_dpop_proof",
+                await WriteDpopChallengeAsync(context, OAuthErrors.InvalidDpopProof,
                     "DPoP proof thumbprint does not match the access token's cnf.jkt binding.")
                     .ConfigureAwait(false);
                 return;
@@ -167,11 +242,11 @@ await Write401Async(context, DpopScheme, "invalid_dpop_proof",
                 && integration.PersistDpopProofJtiAsync is not null)
             {
                 string jti = proofResult.Claims!.Jti;
-                bool replayed = await integration.IsDpopProofJtiSeenAsync(
-                    jti, ExchangeContext, context.RequestAborted).ConfigureAwait(false);
-                if(replayed)
+                bool isReplayed = await integration.IsDpopProofJtiSeenAsync(
+                    jti, exchangeContext, context.RequestAborted).ConfigureAwait(false);
+                if(isReplayed)
                 {
-                    await Write401Async(context, DpopScheme, "invalid_dpop_proof",
+                    await WriteDpopChallengeAsync(context, OAuthErrors.InvalidDpopProof,
                         "DPoP proof jti has been seen previously.").ConfigureAwait(false);
                     return;
                 }
@@ -179,7 +254,28 @@ await Write401Async(context, DpopScheme, "invalid_dpop_proof",
                 DateTimeOffset expiresAt = integration.TimeProvider.GetUtcNow()
                     + integration.DpopFreshnessWindow;
                 await integration.PersistDpopProofJtiAsync(
-                    jti, expiresAt, ExchangeContext, context.RequestAborted).ConfigureAwait(false);
+                    jti, expiresAt, exchangeContext, context.RequestAborted).ConfigureAwait(false);
+            }
+        }
+
+        if(requiredScope is not null)
+        {
+            bool isScopeSatisfied = HasScope(claims.Scope, requiredScope);
+            Activity.Current?.SetTag(ResourceServerTagNames.ScopeRequired, requiredScope);
+            Activity.Current?.SetTag(ResourceServerTagNames.ScopeSatisfied, isScopeSatisfied);
+            Activity.Current?.AddEvent(new ActivityEvent(ResourceServerEventNames.ScopeChecked));
+
+            if(!isScopeSatisfied)
+            {
+                //RFC 6750 §3.1: insufficient_scope maps to 403 and the
+                //challenge's scope attribute names the scope necessary to
+                //access the resource.
+                await WriteBearerChallengeAsync(
+                    context, StatusCodes.Status403Forbidden,
+                    OAuthErrors.InsufficientScope,
+                    "The access token does not carry the scope this resource requires.",
+                    scope: requiredScope).ConfigureAwait(false);
+                return;
             }
         }
 
@@ -190,6 +286,51 @@ await integration.PersistDpopProofJtiAsync(
     public void DisposeContext(HttpContext context, Exception? exception) { }
 
 
+    /// <summary>
+    /// Serves the RFC 9728 §3 metadata document by dispatching the request
+    /// through <see cref="ResourceServerMetadataEndpoint.Server"/> — the
+    /// document bytes are produced by
+    /// <see cref="ProtectedResourceMetadataEndpoints"/> exactly as a
+    /// co-located deployment would produce them: capability gate, path/method
+    /// matcher, §3.2 emission. This skin only maps the wire envelope in and
+    /// the <see cref="ServerHttpResponse"/> out.
+    /// </summary>
+    private static async Task ServeProtectedResourceMetadataAsync(
+        HttpContext context, ResourceServerMetadataEndpoint metadataEndpoint)
+    {
+        IncomingRequest incomingRequest = new(
+            Path: context.Request.Path.HasValue ? context.Request.Path.Value! : string.Empty,
+            Method: context.Request.Method,
+            Fields: new RequestFields(),
+            Headers: RequestHeaders.Empty,
+            RouteValues: RouteValues.Empty);
+
+        ServerHttpResponse response = await metadataEndpoint.Server.DispatchAsync(
+            incomingRequest, new ExchangeContext(), context.RequestAborted).ConfigureAwait(false);
+
+        context.Response.StatusCode = response.StatusCode;
+        if(!string.IsNullOrEmpty(response.ContentType))
+        {
+            context.Response.ContentType = response.ContentType;
+        }
+
+        if(!string.IsNullOrEmpty(response.Location))
+        {
+            context.Response.Headers.Location = response.Location;
+        }
+
+        foreach(KeyValuePair<string, string> header in response.Headers)
+        {
+            context.Response.Headers.Append(header.Key, header.Value);
+        }
+
+        if(!string.IsNullOrEmpty(response.Body))
+        {
+            await WriteBodyAsync(context, response.Body).ConfigureAwait(false);
+        }
+    }
+
+
     private static bool TryExtractAuthorization(
         HttpRequest request, out string scheme, out string? token)
     {
@@ -210,6 +351,7 @@ private static bool TryExtractAuthorization(
 
         scheme = header[..sep];
         token = header[(sep + 1)..];
+
         return !string.IsNullOrEmpty(token)
             && (string.Equals(scheme, BearerScheme, StringComparison.Ordinal)
                 || string.Equals(scheme, DpopScheme, StringComparison.Ordinal));
@@ -223,9 +365,12 @@ private static bool TryExtractDpopProof(HttpRequest request, out string? proof)
             && !string.IsNullOrEmpty(values[0]))
         {
             proof = values[0];
+
             return true;
         }
+
         proof = null;
+
         return false;
     }
 
@@ -234,16 +379,123 @@ private static string BuildRequestUrl(HttpRequest request) =>
         $"{request.Scheme}://{request.Host}{request.Path}";
 
 
-    private static Task Write401Async(
-        HttpContext context, string scheme, string error, string description)
+    /// <summary>
+    /// Whether the RFC 6749 §3.3 space-delimited <paramref name="grantedScopes"/>
+    /// list contains <paramref name="requiredScope"/> as a whole scope token,
+    /// compared ordinally.
+    /// </summary>
+    private static bool HasScope(string? grantedScopes, string requiredScope)
+    {
+        if(string.IsNullOrEmpty(grantedScopes))
+        {
+            return false;
+        }
+
+        ReadOnlySpan<char> granted = grantedScopes.AsSpan();
+        foreach(Range segmentRange in granted.Split(' '))
+        {
+            if(granted[segmentRange].SequenceEqual(requiredScope))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+
+    /// <summary>
+    /// Writes a Bearer-scheme refusal whose <c>WWW-Authenticate</c> value is
+    /// built by <see cref="BearerTokenChallenge.BuildChallenge"/> (RFC 6750 §3)
+    /// and carries the RFC 9728 §5.1 <c>resource_metadata</c> parameter when
+    /// the metadata surface is live. The caller owns the 401-vs-403 mapping;
+    /// this writer owns only the header value.
+    /// </summary>
+    private Task WriteBearerChallengeAsync(
+        HttpContext context, int statusCode, string? error, string? errorDescription, string? scope)
     {
-        context.Response.StatusCode = 401;
-        string challenge = $"{scheme} realm=\"protected\", error=\"{error}\", error_description=\"{description}\"";
-        context.Response.Headers.Append("WWW-Authenticate", challenge);
+        string challenge = BearerTokenChallenge.BuildChallenge(
+            realm: ProtectedRealm,
+            error: error,
+            errorDescription: SanitizeErrorDescription(errorDescription),
+            scope: scope,
+            resourceMetadata: MetadataEndpoint?.MetadataUrl);
+
+        context.Response.StatusCode = statusCode;
+        context.Response.Headers.Append(WellKnownHttpHeaderNames.WwwAuthenticate, challenge);
+        if(error is not null)
+        {
+            Activity.Current?.SetTag(ResourceServerTagNames.ChallengeError, error);
+        }
+
+        return Task.CompletedTask;
+    }
+
+
+    /// <summary>
+    /// Writes a DPoP-scheme <c>401</c> (RFC 9449 §7.1).
+    /// <see cref="BearerTokenChallenge"/> is Bearer-scheme by definition, so
+    /// this challenge composes
+    /// <see cref="ProtectedResourceChallenge.BuildChallenge"/> for the
+    /// RFC 9728 §5.1 <c>resource_metadata</c> parameter and appends its own
+    /// <c>error</c>/<c>error_description</c> auth-params over values
+    /// restricted to the RFC 6750 §3 charset, which needs no quoted-pair
+    /// escaping.
+    /// </summary>
+    private Task WriteDpopChallengeAsync(HttpContext context, string error, string? errorDescription)
+    {
+        StringBuilder sb = new();
+        if(MetadataEndpoint is { } metadataEndpoint)
+        {
+            sb.Append(ProtectedResourceChallenge.BuildChallenge(
+                WellKnownAuthenticationSchemes.DPoP, metadataEndpoint.MetadataUrl));
+            sb.Append(", ");
+        }
+        else
+        {
+            sb.Append(DpopScheme);
+            sb.Append(' ');
+        }
+
+        sb.Append("error=\"").Append(error).Append('"');
+        if(SanitizeErrorDescription(errorDescription) is { Length: > 0 } sanitizedDescription)
+        {
+            sb.Append(", error_description=\"").Append(sanitizedDescription).Append('"');
+        }
+
+        context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+        context.Response.Headers.Append(WellKnownHttpHeaderNames.WwwAuthenticate, sb.ToString());
+        Activity.Current?.SetTag(ResourceServerTagNames.ChallengeError, error);
+
         return Task.CompletedTask;
     }
 
 
+    /// <summary>
+    /// Restricts a challenge description to the RFC 6750 §3
+    /// <c>error_description</c> charset (<c>%x20-21 / %x23-5B / %x5D-7E</c>)
+    /// by replacing every other character with a space, so diagnostic text
+    /// from validators can ride the challenge without ever producing a value
+    /// <see cref="BearerTokenChallenge.BuildChallenge"/> would reject.
+    /// </summary>
+    private static string? SanitizeErrorDescription(string? description)
+    {
+        if(string.IsNullOrEmpty(description))
+        {
+            return null;
+        }
+
+        StringBuilder sb = new(description.Length);
+        foreach(char c in description)
+        {
+            bool isAllowed = c is ' ' or '!' or (>= '#' and <= '[') or (>= ']' and <= '~');
+            sb.Append(isAllowed ? c : ' ');
+        }
+
+        return sb.ToString();
+    }
+
+
     private static async Task WriteClaimsAsync(HttpContext context, JwsAccessTokenClaims claims)
     {
         Dictionary<string, object?> body = new(StringComparer.Ordinal)
@@ -267,9 +519,78 @@ private static async Task WriteClaimsAsync(HttpContext context, JwsAccessTokenCl
         }
 
         byte[] json = JsonSerializer.SerializeToUtf8Bytes(body);
-        context.Response.StatusCode = 200;
+        context.Response.StatusCode = StatusCodes.Status200OK;
         context.Response.ContentType = "application/json";
         context.Response.Headers.CacheControl = "no-store";
-        await context.Response.Body.WriteAsync(json, context.RequestAborted).ConfigureAwait(false);
+        await context.Response.BodyWriter.WriteAsync(json, context.RequestAborted).ConfigureAwait(false);
     }
+
+
+    /// <summary>
+    /// Writes <paramref name="body"/> UTF-8-encoded through the pipe-based
+    /// <see cref="HttpResponse.BodyWriter"/> — encoded directly into the
+    /// writer's buffer, no intermediate array.
+    /// </summary>
+    private static async Task WriteBodyAsync(HttpContext context, string body)
+    {
+        int maxByteCount = Encoding.UTF8.GetMaxByteCount(body.Length);
+        Memory<byte> destination = context.Response.BodyWriter.GetMemory(maxByteCount);
+        int written = Encoding.UTF8.GetBytes(body, destination.Span);
+        context.Response.BodyWriter.Advance(written);
+        await context.Response.BodyWriter.FlushAsync(context.RequestAborted).ConfigureAwait(false);
+    }
+}
+
+
+/// <summary>
+/// The resource server's RFC 9728 serving surface: the minimal
+/// <see cref="EndpointServer"/> whose only endpoint builder is
+/// <see cref="ProtectedResourceMetadataEndpoints.Builder"/>, and the §3
+/// path-inserted metadata URL the document is served at — the same URL every
+/// challenge advertises through the §5.1 <c>resource_metadata</c> parameter,
+/// so the location a client discovers and the location that answers are one
+/// value by construction.
+/// </summary>
+[DebuggerDisplay("ResourceServerMetadataEndpoint MetadataUrl={MetadataUrl}")]
+internal sealed record ResourceServerMetadataEndpoint(EndpointServer Server, Uri MetadataUrl);
+
+
+/// <summary>
+/// Tag names for the test resource server's span decoration, following the
+/// <see cref="Verifiable.Server.Diagnostics.ServerTagNames"/> conventions
+/// with an <c>rs.</c> domain prefix. Test infrastructure only — the library
+/// attaches its events to <see cref="Activity.Current"/> and owns no
+/// resource-server host.
+/// </summary>
+internal static class ResourceServerTagNames
+{
+    /// <summary>Whether access-token validation succeeded for the request.</summary>
+    public const string TokenValidated = "rs.token.validated";
+
+    /// <summary>The scope this resource requires, when scope enforcement is configured.</summary>
+    public const string ScopeRequired = "rs.scope.required";
+
+    /// <summary>Whether the validated token's scope list contains the required scope.</summary>
+    public const string ScopeSatisfied = "rs.scope.satisfied";
+
+    /// <summary>The RFC 6750 §3.1 error code the emitted challenge carries.</summary>
+    public const string ChallengeError = "rs.challenge.error";
+}
+
+
+/// <summary>
+/// Span event names for the test resource server's decision points,
+/// following the <see cref="Verifiable.Server.Diagnostics.ServerEventNames"/>
+/// conventions with an <c>rs.</c> domain prefix.
+/// </summary>
+internal static class ResourceServerEventNames
+{
+    /// <summary>Access-token validation succeeded.</summary>
+    public const string TokenValidated = "rs.token.validated";
+
+    /// <summary>Access-token validation failed and a challenge was emitted.</summary>
+    public const string TokenRejected = "rs.token.rejected";
+
+    /// <summary>The required-scope decision was evaluated for a validated token.</summary>
+    public const string ScopeChecked = "rs.scope.checked";
 }
diff --git a/test/Verifiable.Tests/OAuth/TestHostShell.cs b/test/Verifiable.Tests/OAuth/TestHostShell.cs
index d4e224a3..412d2a90 100644
--- a/test/Verifiable.Tests/OAuth/TestHostShell.cs
+++ b/test/Verifiable.Tests/OAuth/TestHostShell.cs
@@ -3,14 +3,20 @@
 using System.Collections.Immutable;
 using System.Diagnostics;
 using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using System.Text.Json;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Verifiable.BouncyCastle;
 using Verifiable.Core;
 using Verifiable.Core.Dcql;
 using Verifiable.Core.Model.Dcql;
 using Verifiable.Core.Model.SelectiveDisclosure;
 using Verifiable.Core.Model.SelectiveDisclosure.Strategy;
+using Verifiable.Core.OutboundFetch;
 using Verifiable.Cryptography;
 using Verifiable.Cryptography.Aead;
 using Verifiable.Cryptography.Context;
@@ -128,20 +134,26 @@ internal sealed class TestHostShell: IAsyncDisposable
     /// <summary>Disposable DPoP-related resources owned by this shell, released on <see cref="DisposeAsync"/>.</summary>
     private List<IDisposable> DpopOwnedDisposables { get; } = [];
 
+    /// <summary>
+    /// Disposable transport resources (pinned <see cref="System.Net.Http.HttpClient"/> instances)
+    /// <see cref="WireCimdMaterialization"/> owns, released on <see cref="DisposeAsync"/>.
+    /// </summary>
+    private List<IDisposable> TransportOwnedDisposables { get; } = [];
+
     /// <summary>The DPoP HMAC confirmation key set shared by tests that need symmetric DPoP proofs.</summary>
     private InProcessKeySet? DpopHmacKeySet { get; set; }
 
     /// <summary>Guards <see cref="DisposeAsync"/> against running its teardown more than once.</summary>
     private bool Disposed { get; set; }
 
-    /// <summary>The <see cref="Default"/> host's Kestrel server instance, set once <see cref="StartHttpHostAsync"/> runs.</summary>
-    private global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer? KestrelServer
+    /// <summary>The <see cref="Default"/> host's HTTPS <see cref="WebApplication"/> instance, set once <see cref="StartHttpHostAsync"/> runs.</summary>
+    private global::Microsoft.AspNetCore.Builder.WebApplication? HttpHost
     {
-        get => Default.KestrelServer;
-        set => Default.KestrelServer = value;
+        get => Default.HttpHost;
+        set => Default.HttpHost = value;
     }
 
-    /// <summary>The <see cref="Default"/> host's loopback base address once it is serving HTTP.</summary>
+    /// <summary>The <see cref="Default"/> host's loopback base address once it is serving HTTPS.</summary>
     private Uri? HttpBaseAddress
     {
         get => Default.HttpBaseAddress;
@@ -155,6 +167,52 @@ private System.Net.Http.HttpClient? SharedHttpClient
         set => Default.SharedHttpClient = value;
     }
 
+    /// <summary>
+    /// The shared self-signed leaf certificate an HTTPS host this shell starts presents unless the
+    /// host was added with its own distinct certificate (<see cref="AddHost(string, bool)"/>) — minted
+    /// lazily on first use via <see cref="LoopbackTls.CreateServerCertificate"/> and shared
+    /// thereafter, since its SAN covers both <c>127.0.0.1</c> and <c>localhost</c> and every host
+    /// binds loopback. Wire-level tests that build their own <see cref="System.Net.Http.HttpClient"/>
+    /// pin to this exact certificate via <see cref="LoopbackTls.CreatePinnedHandler"/> rather than
+    /// trusting a CA. <see cref="HostCertificate"/> answers which certificate a NAMED host actually
+    /// presents, covering both the shared and the distinct-certificate cases.
+    /// </summary>
+    internal X509Certificate2 ServerCertificate => serverCertificate ??= LoopbackTls.CreateServerCertificate("oauth-loopback-test-host");
+
+    private X509Certificate2? serverCertificate;
+
+    /// <summary>
+    /// The per-host certificates for hosts added with <c>useDistinctCertificate: true</c> on
+    /// <see cref="AddHost(string, bool)"/>, keyed by host name. Hosts absent from this map present
+    /// the shared <see cref="ServerCertificate"/>; <see cref="HostCertificate"/> is the one
+    /// selection authority both listener bootstrap and client pinning read.
+    /// </summary>
+    private Dictionary<string, X509Certificate2> DistinctHostCertificates { get; } =
+        new(StringComparer.Ordinal);
+
+
+    /// <summary>
+    /// The certificate the named host's HTTPS listener presents: the host's own distinct
+    /// certificate when it was added with <c>useDistinctCertificate: true</c> on
+    /// <see cref="AddHost(string, bool)"/>, otherwise the shared <see cref="ServerCertificate"/>.
+    /// A test-side client dialing several hosts with distinct TLS identities pins each host's
+    /// exact certificate via
+    /// <see cref="LoopbackTls.CreatePinnedHandler(IReadOnlyCollection{X509Certificate2})"/>.
+    /// </summary>
+    /// <param name="hostName">The host's role name as registered via <see cref="AddHost(string, bool)"/>.</param>
+    internal X509Certificate2 HostCertificate(string hostName)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(hostName);
+
+        //Validates the host exists so a mistyped name fails with the host-lookup
+        //error instead of silently answering the shared certificate.
+        _ = Host(hostName);
+
+        return DistinctHostCertificates.TryGetValue(hostName, out X509Certificate2? certificate)
+            ? certificate
+            : ServerCertificate;
+    }
+
     /// <summary>Base64Url encoder shared by tests with the host's own wiring.</summary>
     public static EncodeDelegate Base64UrlEncoder => TestSetup.Base64UrlEncoder;
 
@@ -467,7 +525,15 @@ public HostedAuthorizationServer Host(string name)
     /// validator with the Default host so trust and claim seeding stay
     /// centralised on the orchestrator.
     /// </summary>
-    public HostedAuthorizationServer AddHost(string name)
+    /// <param name="name">The host's role name (e.g. "anchor", "as2").</param>
+    /// <param name="useDistinctCertificate">
+    /// When <see langword="true"/>, mints the host its own leaf certificate via
+    /// <see cref="LoopbackTls.CreateServerCertificate"/> so the host is a distinct TLS identity —
+    /// distinct trust domains in a multi-party topology present distinct certificates. When
+    /// <see langword="false"/>, the host presents the shared <see cref="ServerCertificate"/>.
+    /// <see cref="HostCertificate"/> answers the effective certificate either way.
+    /// </param>
+    public HostedAuthorizationServer AddHost(string name, bool useDistinctCertificate = false)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(name);
 
@@ -477,6 +543,11 @@ public HostedAuthorizationServer AddHost(string name)
                 $"A host named '{name}' is already registered.");
         }
 
+        if(useDistinctCertificate)
+        {
+            DistinctHostCertificates[name] = LoopbackTls.CreateServerCertificate($"oauth-loopback-{name}");
+        }
+
         HostedAuthorizationServer host = HostedAuthorizationServer.Build(
             name: name,
             timeProvider: Time,
@@ -732,6 +803,138 @@ public ClientRecord RegisterSigningClient(
     }
 
 
+    /// <summary>
+    /// Registers a Client ID Metadata Document (CIMD) stub client on the <c>"default"</c> host: a
+    /// <see cref="ClientRecord"/> whose <see cref="ClientRecord.ClientId"/> equals
+    /// <paramref name="documentUri"/>'s <see cref="Uri.OriginalString"/> and whose
+    /// <see cref="ClientRecord.ClientMetadataUri"/> is <paramref name="documentUri"/> itself, per
+    /// draft-ietf-oauth-client-id-metadata-document-02 §4 (CIMD-013/014/015/016 — the document's
+    /// <c>client_id</c> must match the Client Identifier URL, which must match the URL fetched).
+    /// Carries <see cref="WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument"/> among
+    /// <paramref name="capabilities"/> (added when the caller omits it) and an EMPTY
+    /// <see cref="ClientRecord.AllowedRedirectUris"/> — the fetched document supplies redirect URIs
+    /// at materialization time (§4.2), never the stub. AS-owned facets (capabilities, scopes,
+    /// signing keys, profile) mirror <see cref="RegisterSigningClient"/>; client-data-dependent
+    /// facets (redirect URIs, auth method, JWKS, display) are left for
+    /// <see cref="ClientIdMetadataMaterialization"/> to overlay from the fetched document.
+    /// </summary>
+    public ClientRecord RegisterCimdStubClient(
+        Uri documentUri,
+        ImmutableHashSet<CapabilityIdentifier> capabilities,
+        PolicyProfile? profile = null) =>
+        RegisterCimdStubClientOnHost("default", documentUri, capabilities, profile);
+
+
+    /// <summary>
+    /// Host-aware variant of <see cref="RegisterCimdStubClient"/>, for multi-host CIMD topologies
+    /// (a document host distinct from the AS host is the common case; a multi-AS-host topology also
+    /// reaches this overload directly).
+    /// </summary>
+    public ClientRecord RegisterCimdStubClientOnHost(
+        string hostName,
+        Uri documentUri,
+        ImmutableHashSet<CapabilityIdentifier> capabilities,
+        PolicyProfile? profile = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(hostName);
+        ArgumentNullException.ThrowIfNull(documentUri);
+        ArgumentNullException.ThrowIfNull(capabilities);
+
+        HostedAuthorizationServer host = Host(hostName);
+
+        if(!capabilities.Contains(WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument))
+        {
+            capabilities = capabilities.Add(WellKnownCapabilityIdentifiers.OAuthClientIdMetadataDocument);
+        }
+
+        string segment = Guid.NewGuid().ToString("N")[..8];
+        KeyId signingKeyId = new($"urn:uuid:{Guid.NewGuid()}");
+
+        PublicPrivateKeyMaterial<PublicKeyMemory, PrivateKeyMemory> signingKeyPair =
+            TestKeyMaterialProvider.CreateFreshP256KeyMaterial();
+
+        host.SigningKeys[signingKeyId] = signingKeyPair.PrivateKey;
+        host.VerificationKeys[signingKeyId] = signingKeyPair.PublicKey;
+
+        ClientRecord registration = new()
+        {
+            ClientId = documentUri.OriginalString,
+            TenantId = segment,
+            IssuerUri = new Uri($"https://issuer.test/{segment}"),
+            Profile = profile,
+            AllowedCapabilities = capabilities,
+            AllowedRedirectUris = ImmutableHashSet<Uri>.Empty,
+            AllowedScopes = ImmutableHashSet.Create(WellKnownScopes.OpenId),
+            SigningKeys = ImmutableDictionary<KeyUsageContext, SigningKeySet>.Empty
+                .Add(KeyUsageContext.AccessTokenIssuance, new SigningKeySet { Current = [signingKeyId] }),
+            TokenLifetimes = ImmutableDictionary<string, TimeSpan>.Empty,
+            ClientMetadataUri = documentUri
+        };
+
+        host.Registrations[segment] = registration;
+        host.Registrations[registration.ClientId] = registration;
+
+        host.Server.RegisterClient(
+            registration,
+            new RegistrationAccessToken(Guid.NewGuid().ToString("N")),
+            new ExchangeContext());
+
+        return registration;
+    }
+
+
+    /// <summary>
+    /// Wires CIMD materialization onto the named host:
+    /// <see cref="AuthorizationServerIntegration.MaterializeRegistrationAsync"/> to
+    /// <see cref="ClientIdMetadataMaterialization.Build"/>'s factory output, and
+    /// <see cref="AuthorizationServerIntegration.ResolveClientMetadataAsync"/> to
+    /// <see cref="ClientIdMetadataDocuments.BuildResolving"/> over a transport built from
+    /// <see cref="LoopbackTls.CreateSingleHopPinnedHttpClient(X509Certificate2)"/> (auto-redirect
+    /// disabled per the <see cref="Verifiable.Core.OutboundFetch.OutboundTransportDelegate"/>
+    /// contract) and <see cref="GuardedHttpClientTransport.BuildSingleHopTransport"/>, pinned to
+    /// <paramref name="documentHostCertificate"/> — the CIMD document host's OWN certificate,
+    /// distinct from this AS host's <see cref="ServerCertificate"/> when the document is served by a
+    /// separate loopback listener.
+    /// </summary>
+    /// <remarks>
+    /// The resolved delegate sets <see cref="LoopbackOutboundFetchPolicy"/> on the live per-request
+    /// <see cref="ExchangeContext"/> immediately before delegating to the built resolver — the same
+    /// context <see cref="AuthorizationServerHttpApplication.ProcessRequestAsync"/> constructs fresh
+    /// per inbound request, so the guarded fetch the resolver drives is permitted to dial another
+    /// loopback listener exactly as <see cref="LoopbackOutboundFetchPolicy"/>'s own remarks describe
+    /// (the test deployment's document host genuinely is another loopback listener). Owns the pinned
+    /// <see cref="System.Net.Http.HttpClient"/>, released on <see cref="DisposeAsync"/>.
+    /// </remarks>
+    public void WireCimdMaterialization(
+        string hostName,
+        X509Certificate2 documentHostCertificate,
+        ClientIdMetadataDocumentResolverOptions? options = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(hostName);
+        ArgumentNullException.ThrowIfNull(documentHostCertificate);
+
+        HostedAuthorizationServer host = Host(hostName);
+
+        System.Net.Http.HttpClient documentHttpClient =
+            LoopbackTls.CreateSingleHopPinnedHttpClient(documentHostCertificate);
+        TransportOwnedDisposables.Add(documentHttpClient);
+
+        Verifiable.Core.OutboundFetch.OutboundTransportDelegate transport =
+            GuardedHttpClientTransport.BuildSingleHopTransport(documentHttpClient);
+        ResolveClientMetadataDelegate resolve = ClientIdMetadataDocuments.BuildResolving(
+            transport, options ?? new ClientIdMetadataDocumentResolverOptions(), Time);
+
+        AuthorizationServerIntegration oauth = host.Server.OAuth();
+        oauth.MaterializeRegistrationAsync = ClientIdMetadataMaterialization.Build();
+        oauth.ResolveClientMetadataAsync = (clientMetadataUri, context, cancellationToken) =>
+        {
+            context.SetOutboundFetchPolicy(LoopbackOutboundFetchPolicy);
+
+            return resolve(clientMetadataUri, context, cancellationToken);
+        };
+    }
+
+
     /// <summary>
     /// Registers a federation-participating client. Builds the baseline
     /// OID4VP / OAuth registration via <see cref="RegisterClient"/>, then
@@ -1152,18 +1355,18 @@ private async ValueTask<OAuthClientInfrastructure> BuildHttpBackedOAuthClientInf
 
     /// <summary>
     /// The outbound-fetch policy for wallet sends against this fixture's loopback
-    /// Kestrel listener: the secure default relaxed for plain-<c>http</c> loopback
-    /// targets, because the test deployment's transport endpoint genuinely is a
-    /// local listener. The relaxation is the deployment's explicit, principled
-    /// per-call choice — production wallets keep
-    /// <see cref="Verifiable.Core.OutboundFetch.OutboundFetchPolicy.SecureDefault"/>,
+    /// HTTPS listener: the secure default relaxed for loopback targets, because
+    /// the test deployment's transport endpoint genuinely is a local listener.
+    /// The scheme stays <c>https</c>-only — every loopback test host serves TLS —
+    /// so only <see cref="Verifiable.Core.OutboundFetch.OutboundFetchPolicy.BlockPrivateAndLoopback"/>
+    /// is relaxed, a deployment's explicit, principled per-call choice. Production
+    /// wallets keep <see cref="Verifiable.Core.OutboundFetch.OutboundFetchPolicy.SecureDefault"/>,
     /// under which an authorization request pointing the wallet at a private or
     /// loopback address is denied before any network contact.
     /// </summary>
     public static Verifiable.Core.OutboundFetch.OutboundFetchPolicy LoopbackOutboundFetchPolicy { get; } =
         Verifiable.Core.OutboundFetch.OutboundFetchPolicy.SecureDefault with
         {
-            AllowedSchemes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "http", "https" },
             BlockPrivateAndLoopback = false
         };
 
@@ -1395,14 +1598,14 @@ private static ProduceVpTokenPresentationsDelegate BuildSdJwtProduceDelegateCore
     /// Re-issues the supplied <see cref="ClientRecord"/> with its external
     /// URLs (<see cref="ClientRecord.IssuerUri"/> and, when set,
     /// <see cref="ClientRecord.ResponseUri"/>) swapped to point at the
-    /// Kestrel base address while preserving each URL's path. The in-memory
-    /// registration dictionary is updated to match so the AS resolves the
-    /// same record on subsequent dispatch.
+    /// HTTPS host's base address while preserving each URL's path. The
+    /// in-memory registration dictionary is updated to match so the AS
+    /// resolves the same record on subsequent dispatch.
     /// </summary>
     /// <remarks>
     /// OID4VP JAR signing reads <c>response_uri</c> directly off
     /// <see cref="ClientRecord.ResponseUri"/>, so wallet HTTP POSTs miss the
-    /// Kestrel unless ResponseUri is aligned as well. AuthCode-only flows do
+    /// host unless ResponseUri is aligned as well. AuthCode-only flows do
     /// not consult ResponseUri; the alignment is a no-op for those.
     /// </remarks>
     private ClientRecord AlignRegistrationIssuerToHttpBase(ClientRecord record) =>
@@ -1411,11 +1614,18 @@ private ClientRecord AlignRegistrationIssuerToHttpBase(ClientRecord record) =>
 
     /// <summary>
     /// Host-aware variant: aligns the registration's external URLs to the
-    /// named host's Kestrel base. Used for multi-host federation
+    /// named host's HTTPS base. Used for multi-host federation
     /// topologies where each entity lives on its own listener — the
     /// anchor's registration aligns to anchor.HttpBaseAddress, the
     /// verifier's to default.HttpBaseAddress.
     /// </summary>
+    /// <remarks>
+    /// The registration's issuer authority now equals the wire authority — both are the same
+    /// <c>https://127.0.0.1:{port}</c> host — so <see cref="DefaultIssuerResolver"/>'s RFC 9207 §2 /
+    /// RFC 8414 §2 https-shape gate and the RFC 9449 §4.2 <c>htu</c> comparison are satisfied by
+    /// construction, with no application-supplied <see cref="AuthorizationServerIntegration.ResolveIssuerAsync"/>
+    /// override needed.
+    /// </remarks>
     internal ClientRecord AlignRegistrationToHostHttpBase(string hostName, ClientRecord record)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(hostName);
@@ -1427,6 +1637,7 @@ internal ClientRecord AlignRegistrationToHostHttpBase(string hostName, ClientRec
             throw new InvalidOperationException(
                 $"HTTP host '{hostName}' must be started before aligning registration issuer.");
         }
+
         if(record.IssuerUri is null)
         {
             return record;
@@ -3641,8 +3852,8 @@ public async ValueTask<DpopClientFixture> CreateDpopEnabledOAuthClientAsync(
 
 
     /// <summary>
-    /// Starts an in-process Kestrel listener bound to localhost on an
-    /// OS-assigned ephemeral port and maps inbound HTTP requests to
+    /// Starts an in-process HTTPS listener bound to loopback on an
+    /// OS-assigned ephemeral port and maps inbound requests to
     /// <see cref="AuthorizationServer.DispatchAsync"/> via
     /// <see cref="AuthorizationServerHttpApplication"/>.
     /// Idempotent — repeat calls return without re-binding.
@@ -3659,7 +3870,7 @@ public Task StartHttpHostAsync(CancellationToken cancellationToken = default) =>
 
 
     /// <summary>
-    /// Starts an in-process Kestrel listener for the named host. Multi-host
+    /// Starts an in-process HTTPS listener for the named host. Multi-host
     /// federation topologies (verifier + anchor) start each host's listener
     /// independently so each gets its own ephemeral port and authority.
     /// Idempotent per host — repeat calls return without re-binding.
@@ -3669,52 +3880,55 @@ public async Task StartHttpHostAsync(string hostName, CancellationToken cancella
         ArgumentException.ThrowIfNullOrWhiteSpace(hostName);
 
         HostedAuthorizationServer host = Host(hostName);
-        if(host.KestrelServer is not null)
+        if(host.HttpHost is not null)
         {
             return;
         }
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerOptions kestrelOptions = new();
-        //Kestrel's ListenLocalhost(0) rejects dynamic port (it binds both
-        //IPv4 + IPv6 loopback and can't reconcile a single OS-assigned port
-        //across two sockets). Listen on IPv4 loopback with an ephemeral
-        //port; the dispatched URL uses 127.0.0.1 explicitly.
-        kestrelOptions.Listen(System.Net.IPAddress.Loopback, port: 0);
-
-        global::Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportOptions socketOptions = new();
-        global::Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportFactory socketFactory = new(
-            global::Microsoft.Extensions.Options.Options.Create(socketOptions),
-            global::Microsoft.Extensions.Logging.Abstractions.NullLoggerFactory.Instance);
-
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer kestrel = new(
-            global::Microsoft.Extensions.Options.Options.Create(kestrelOptions),
-            socketFactory,
-            global::Microsoft.Extensions.Logging.Abstractions.NullLoggerFactory.Instance);
-
-        AuthorizationServerHttpApplication app = new(host.Server);
-        await kestrel.StartAsync(app, cancellationToken: cancellationToken).ConfigureAwait(false);
-
-        global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature? addresses =
-            kestrel.Features.Get<global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>();
-        if(addresses is null || addresses.Addresses.Count == 0)
-        {
-            throw new InvalidOperationException(
-                $"Kestrel for host '{hostName}' started but no server addresses were exposed via IServerAddressesFeature.");
-        }
+        X509Certificate2 hostCertificate = HostCertificate(hostName);
+
+        global::Microsoft.AspNetCore.Builder.WebApplicationBuilder builder =
+            global::Microsoft.AspNetCore.Builder.WebApplication.CreateSlimBuilder();
+        builder.Logging.ClearProviders();
+
+        //Kestrel's ListenLocalhost(0) rejects dynamic port (it binds both IPv4 + IPv6 loopback and
+        //can't reconcile a single OS-assigned port across two sockets). Listen on IPv4 loopback with
+        //an ephemeral port, presenting the host's certificate (its own distinct one when added with
+        //useDistinctCertificate: true, the shell's shared one otherwise); the dispatched URL uses
+        //127.0.0.1 explicitly. A single explicit HTTPS Listen call — no UseUrls — so there is no
+        //plaintext fallback on this host at all.
+        builder.WebHost.ConfigureKestrel(options =>
+            options.Listen(System.Net.IPAddress.Loopback, port: 0,
+                listenOptions => listenOptions.UseHttps(hostCertificate)));
+
+        global::Microsoft.AspNetCore.Builder.WebApplication app = builder.Build();
+
+        AuthorizationServerHttpApplication application = new(host.Server);
+        app.Run(application.ProcessRequestAsync);
+
+        await app.StartAsync(cancellationToken).ConfigureAwait(false);
+
+        global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature addresses =
+            app.Services.GetRequiredService<global::Microsoft.AspNetCore.Hosting.Server.IServer>()
+                .Features.Get<global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>()
+            ?? throw new InvalidOperationException(
+                $"HTTPS host '{hostName}' started but no server addresses were exposed via IServerAddressesFeature.");
+        string boundAddress = addresses.Addresses.FirstOrDefault()
+            ?? throw new InvalidOperationException($"HTTPS host '{hostName}' bound no address.");
 
-        host.KestrelServer = kestrel;
-        host.HttpBaseAddress = new Uri(addresses.Addresses.First());
-        host.SharedHttpClient = new System.Net.Http.HttpClient { BaseAddress = host.HttpBaseAddress };
+        host.HttpHost = app;
+        host.HttpBaseAddress = new Uri(boundAddress);
+        host.SharedHttpClient = LoopbackTls.CreatePinnedHttpClient(hostCertificate, host.HttpBaseAddress);
     }
 
 
     /// <summary>
-    /// Starts an in-process Kestrel listener for the W3C VCALM 1.0 conformance bridge (chunk V-6a):
+    /// Starts an in-process HTTPS listener for the W3C VCALM 1.0 conformance bridge (chunk V-6a):
     /// the same ephemeral-port loopback bootstrap as <see cref="StartHttpHostAsync(string, CancellationToken)"/>,
     /// but mounting <see cref="Verifiable.Tests.Vcalm.VcalmConformanceHttpApplication"/> so the VCALM
     /// issuer / verifier interfaces are served at the STABLE, suite-expected flat paths
     /// (<c>/credentials/issue</c>, <c>/credentials/verify</c>, <c>/presentations/verify</c>) over real
-    /// HTTP behind an OAuth2 client-credentials bearer gate, with the AS token endpoint reachable at
+    /// HTTPS behind an OAuth2 client-credentials bearer gate, with the AS token endpoint reachable at
     /// <c>/token</c>. The external <c>vc-api-issuer-test-suite</c> / <c>vc-api-verifier-test-suite</c>
     /// JS suites POST to those flat paths; this is the in-repo bridge the suites would later be pointed
     /// at (V-6b). Idempotent per host. The supplied <paramref name="registration"/> is the conformance
@@ -3727,38 +3941,40 @@ public async Task StartVcalmConformanceHostAsync(
         ArgumentNullException.ThrowIfNull(registration);
 
         HostedAuthorizationServer host = Host(hostName);
-        if(host.KestrelServer is not null)
+        if(host.HttpHost is not null)
         {
             return;
         }
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerOptions kestrelOptions = new();
-        kestrelOptions.Listen(System.Net.IPAddress.Loopback, port: 0);
+        X509Certificate2 hostCertificate = HostCertificate(hostName);
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportOptions socketOptions = new();
-        global::Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportFactory socketFactory = new(
-            global::Microsoft.Extensions.Options.Options.Create(socketOptions),
-            global::Microsoft.Extensions.Logging.Abstractions.NullLoggerFactory.Instance);
+        global::Microsoft.AspNetCore.Builder.WebApplicationBuilder builder =
+            global::Microsoft.AspNetCore.Builder.WebApplication.CreateSlimBuilder();
+        builder.Logging.ClearProviders();
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer kestrel = new(
-            global::Microsoft.Extensions.Options.Options.Create(kestrelOptions),
-            socketFactory,
-            global::Microsoft.Extensions.Logging.Abstractions.NullLoggerFactory.Instance);
+        builder.WebHost.ConfigureKestrel(options =>
+            options.Listen(System.Net.IPAddress.Loopback, port: 0,
+                listenOptions => listenOptions.UseHttps(hostCertificate)));
 
-        Verifiable.Tests.Vcalm.VcalmConformanceHttpApplication app = new(host.Server, registration);
-        await kestrel.StartAsync(app, cancellationToken: cancellationToken).ConfigureAwait(false);
+        global::Microsoft.AspNetCore.Builder.WebApplication app = builder.Build();
 
-        global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature? addresses =
-            kestrel.Features.Get<global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>();
-        if(addresses is null || addresses.Addresses.Count == 0)
-        {
-            throw new InvalidOperationException(
-                $"Kestrel for VCALM conformance host '{hostName}' started but no server addresses were exposed.");
-        }
+        Verifiable.Tests.Vcalm.VcalmConformanceHttpApplication application = new(host.Server, registration);
+        app.Run(application.ProcessRequestAsync);
+
+        await app.StartAsync(cancellationToken).ConfigureAwait(false);
 
-        host.KestrelServer = kestrel;
-        host.HttpBaseAddress = new Uri(addresses.Addresses.First());
-        host.SharedHttpClient = new System.Net.Http.HttpClient { BaseAddress = host.HttpBaseAddress };
+        global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature addresses =
+            app.Services.GetRequiredService<global::Microsoft.AspNetCore.Hosting.Server.IServer>()
+                .Features.Get<global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>()
+            ?? throw new InvalidOperationException(
+                $"HTTPS host for VCALM conformance host '{hostName}' started but no server addresses were exposed.");
+        string boundAddress = addresses.Addresses.FirstOrDefault()
+            ?? throw new InvalidOperationException(
+                $"HTTPS host for VCALM conformance host '{hostName}' bound no address.");
+
+        host.HttpHost = app;
+        host.HttpBaseAddress = new Uri(boundAddress);
+        host.SharedHttpClient = LoopbackTls.CreatePinnedHttpClient(hostCertificate, host.HttpBaseAddress);
     }
 
 
@@ -3781,11 +3997,11 @@ public async ValueTask DisposeAsync()
             host.SharedHttpClient?.Dispose();
             host.SharedHttpClient = null;
 
-            if(host.KestrelServer is not null)
+            if(host.HttpHost is not null)
             {
-                await host.KestrelServer.StopAsync(cancellationToken: CancellationToken.None).ConfigureAwait(false);
-                host.KestrelServer.Dispose();
-                host.KestrelServer = null;
+                await host.HttpHost.StopAsync(CancellationToken.None).ConfigureAwait(false);
+                await host.HttpHost.DisposeAsync().ConfigureAwait(false);
+                host.HttpHost = null;
             }
 
             host.Server.Dispose();
@@ -3810,6 +4026,18 @@ public async ValueTask DisposeAsync()
         {
             owned.Dispose();
         }
+
+        foreach(IDisposable owned in TransportOwnedDisposables)
+        {
+            owned.Dispose();
+        }
+
+        foreach(X509Certificate2 certificate in DistinctHostCertificates.Values)
+        {
+            certificate.Dispose();
+        }
+
+        serverCertificate?.Dispose();
     }
 
 
diff --git a/test/Verifiable.Tests/OAuth/TestResourceServerShell.cs b/test/Verifiable.Tests/OAuth/TestResourceServerShell.cs
index 49f64e1c..c22eb549 100644
--- a/test/Verifiable.Tests/OAuth/TestResourceServerShell.cs
+++ b/test/Verifiable.Tests/OAuth/TestResourceServerShell.cs
@@ -1,31 +1,101 @@
 using System.Collections.Concurrent;
+using System.Collections.Immutable;
 using System.Diagnostics;
+using System.Linq;
 using System.Net;
+using System.Security.Cryptography.X509Certificates;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Verifiable.Core;
 using Verifiable.Cryptography;
+using Verifiable.Cryptography.Context;
 using Verifiable.OAuth;
+using Verifiable.OAuth.ProtectedResource;
 using Verifiable.OAuth.Server;
+using Verifiable.OAuth.Server.Pipeline;
+using Verifiable.Server;
+using Verifiable.Server.Pipeline;
+using Verifiable.Tests.TestInfrastructure;
 
 namespace Verifiable.Tests.OAuth;
 
 /// <summary>
 /// Test-side resource server host. Parallel of
-/// <see cref="Verifiable.Tests.OAuth.TestHostShell"/>; hosts a single
-/// <c>/protected</c> endpoint via minimal Kestrel +
-/// <see cref="ResourceServerHttpApplication"/>. Tests bring up this host
-/// alongside <see cref="Verifiable.Tests.OAuth.TestHostShell"/> (AS) to
-/// exercise the full AS → token → RS flow over real HTTP.
+/// <see cref="Verifiable.Tests.OAuth.TestHostShell"/>; hosts a
+/// <c>/protected</c> endpoint and the RFC 9728 §3
+/// <c>/.well-known/oauth-protected-resource</c> location via a slim-builder
+/// HTTPS listener + <see cref="ResourceServerHttpApplication"/>. Tests bring
+/// up this host alongside <see cref="Verifiable.Tests.OAuth.TestHostShell"/>
+/// (AS) to exercise the full AS → token → RS flow over real HTTP.
 /// </summary>
+/// <remarks>
+/// <para>
+/// The RFC 9728 document is never hand-formatted: the shell composes a
+/// minimal <see cref="EndpointServer"/> whose only endpoint builder is
+/// <see cref="ProtectedResourceMetadataEndpoints.Builder"/>, so the served
+/// bytes traverse the identical library path — capability gate, §3 path
+/// matcher, §3.2 emission — a co-located production deployment uses.
+/// </para>
+/// <para>
+/// OPRM coherence (the interop event's MCP-Server invariant): a resource
+/// server must accept tokens only from an authorization server its own
+/// metadata document names. The constructor therefore asserts
+/// <see cref="ResourceServerIntegration.TrustedIssuer"/> is one of the
+/// advertised <c>authorization_servers</c> values, so the document and the
+/// validator can never disagree about who mints acceptable tokens.
+/// </para>
+/// </remarks>
 [DebuggerDisplay("TestResourceServerShell BaseAddress={HttpBaseAddress}")]
 internal sealed class TestResourceServerShell: IAsyncDisposable
 {
-    private global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer? KestrelServer { get; set; }
+    private global::Microsoft.AspNetCore.Builder.WebApplication? webApplication;
+    private EndpointServer? metadataServer;
     private bool Disposed { get; set; }
 
     public ResourceServerIntegration Integration { get; }
     public VerificationDelegate VerifySignature { get; }
 
+    /// <summary>
+    /// The scope a token must carry to reach <c>/protected</c>, or
+    /// <see langword="null"/> when the host performs no scope enforcement.
+    /// A valid token without it is refused <c>403</c>
+    /// <c>insufficient_scope</c> per RFC 6750 §3.1, with the challenge's
+    /// <c>scope</c> attribute naming this value.
+    /// </summary>
+    public string? RequiredScope { get; }
+
+    /// <summary>
+    /// The <c>authorization_servers</c> issuer identifiers the RFC 9728
+    /// document advertises. Defaults to exactly the trusted issuer; a caller
+    /// supplying its own list must include the trusted issuer or construction
+    /// throws (the OPRM-coherence invariant).
+    /// </summary>
+    public IReadOnlyList<string> AdvertisedAuthorizationServers { get; }
+
     public Uri? HttpBaseAddress { get; private set; }
 
+    /// <summary>
+    /// The resource server's own identity — the RFC 9728 §1.2 <c>resource</c>
+    /// identifier the metadata document carries and the §3.3 resource-match
+    /// validation compares against. Derived from the bound listener address
+    /// once <see cref="StartHttpHostAsync"/> has run.
+    /// </summary>
+    public Uri? ResourceIdentity { get; private set; }
+
+    /// <summary>
+    /// The §3 path-inserted metadata URL derived from
+    /// <see cref="ResourceIdentity"/> via
+    /// <see cref="WellKnownPaths.OAuthProtectedResource"/>; the document is
+    /// served here and every challenge advertises it through the §5.1
+    /// <c>resource_metadata</c> parameter.
+    /// </summary>
+    public Uri? MetadataUrl { get; private set; }
+
+    /// <summary>The self-signed leaf certificate the HTTPS listener presents once <see cref="StartHttpHostAsync"/> has run; callers pin to this via <see cref="LoopbackTls.CreatePinnedHttpClient"/>.</summary>
+    public X509Certificate2? HttpCertificate { get; private set; }
+
     /// <summary>
     /// Per-request DPoP proof JTI tracker. Maps jti → expiry instant. Tests inspect
     /// this directly to verify replay-defense behaviour.
@@ -39,7 +109,9 @@ public TestResourceServerShell(
         string expectedAudience,
         ServerVerificationKeyResolverDelegate resolveVerificationKey,
         VerificationDelegate verifySignature,
-        TimeProvider timeProvider)
+        TimeProvider timeProvider,
+        string? requiredScope = null,
+        IReadOnlyList<string>? advertisedAuthorizationServers = null)
     {
         ArgumentNullException.ThrowIfNull(trustedIssuer);
         ArgumentException.ThrowIfNullOrWhiteSpace(expectedAudience);
@@ -47,7 +119,20 @@ public TestResourceServerShell(
         ArgumentNullException.ThrowIfNull(verifySignature);
         ArgumentNullException.ThrowIfNull(timeProvider);
 
+        IReadOnlyList<string> advertised = advertisedAuthorizationServers ?? [trustedIssuer.OriginalString];
+        if(!advertised.Contains(trustedIssuer.OriginalString, StringComparer.Ordinal))
+        {
+            throw new ArgumentException(
+                "OPRM coherence violated: the trusted issuer "
+                + $"'{trustedIssuer.OriginalString}' is not among the advertised "
+                + "authorization_servers. A resource server must accept tokens only "
+                + "from an authorization server its RFC 9728 metadata document names.",
+                nameof(advertisedAuthorizationServers));
+        }
+
         VerifySignature = verifySignature;
+        RequiredScope = requiredScope;
+        AdvertisedAuthorizationServers = advertised;
 
         Integration = new ResourceServerIntegration
         {
@@ -68,37 +153,145 @@ public TestResourceServerShell(
 
     public async Task StartHttpHostAsync(CancellationToken cancellationToken = default)
     {
-        if(KestrelServer is not null)
+        if(webApplication is not null)
         {
             return;
         }
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerOptions kestrelOptions = new();
-        kestrelOptions.Listen(IPAddress.Loopback, port: 0);
+        X509Certificate2 certificate = LoopbackTls.CreateServerCertificate("resource-server-loopback-test-host");
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportOptions socketOptions = new();
-        global::Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportFactory socketFactory = new(
-            global::Microsoft.Extensions.Options.Options.Create(socketOptions),
-            global::Microsoft.Extensions.Logging.Abstractions.NullLoggerFactory.Instance);
+        global::Microsoft.AspNetCore.Builder.WebApplicationBuilder builder =
+            global::Microsoft.AspNetCore.Builder.WebApplication.CreateSlimBuilder();
+        builder.Logging.ClearProviders();
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer kestrel = new(
-            global::Microsoft.Extensions.Options.Options.Create(kestrelOptions),
-            socketFactory,
-            global::Microsoft.Extensions.Logging.Abstractions.NullLoggerFactory.Instance);
+        //A single explicit HTTPS Listen call — no UseUrls — so there is no plaintext fallback on
+        //this host at all.
+        builder.WebHost.ConfigureKestrel(options =>
+            options.Listen(IPAddress.Loopback, port: 0, listenOptions => listenOptions.UseHttps(certificate)));
 
-        ResourceServerHttpApplication app = new(Integration, VerifySignature);
-        await kestrel.StartAsync(app, cancellationToken).ConfigureAwait(false);
+        global::Microsoft.AspNetCore.Builder.WebApplication app = builder.Build();
 
-        global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature? addresses =
-            kestrel.Features.Get<global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>();
-        if(addresses is null || addresses.Addresses.Count == 0)
-        {
-            throw new InvalidOperationException(
+        ResourceServerHttpApplication application = new(Integration, VerifySignature, RequiredScope);
+        app.Run(application.ProcessRequestAsync);
+
+        await app.StartAsync(cancellationToken).ConfigureAwait(false);
+
+        global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature addresses =
+            app.Services.GetRequiredService<global::Microsoft.AspNetCore.Hosting.Server.IServer>()
+                .Features.Get<global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>()
+            ?? throw new InvalidOperationException(
                 "Kestrel started but no server addresses were exposed via IServerAddressesFeature.");
-        }
+        string boundAddress = addresses.Addresses.FirstOrDefault()
+            ?? throw new InvalidOperationException("Kestrel bound no address.");
+
+        //The resource identity is the bound listener's origin: the same value
+        //becomes the document's §1.2 resource identifier and the base the §3
+        //well-known URL is inserted into, keeping the consumer's §3.3
+        //resource-match validation true by construction.
+        Uri baseAddress = new(boundAddress);
+        Uri resourceIdentity = new(baseAddress.GetLeftPart(UriPartial.Authority));
+        Uri metadataUrl = WellKnownPaths.OAuthProtectedResource.ComputeUri(resourceIdentity.OriginalString);
+
+        metadataServer = BuildMetadataServer(resourceIdentity);
+        application.MetadataEndpoint = new ResourceServerMetadataEndpoint(metadataServer, metadataUrl);
+
+        webApplication = app;
+        HttpCertificate = certificate;
+        HttpBaseAddress = baseAddress;
+        ResourceIdentity = resourceIdentity;
+        MetadataUrl = metadataUrl;
+    }
 
-        KestrelServer = kestrel;
-        HttpBaseAddress = new Uri(addresses.Addresses.First());
+
+    /// <summary>
+    /// Composes the minimal <see cref="EndpointServer"/> that serves the
+    /// RFC 9728 document: a single-tenant registration carrying only the
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthProtectedResourceMetadata"/>
+    /// capability, default pipeline seams, and
+    /// <see cref="ProtectedResourceMetadataEndpoints.Builder"/> as the sole
+    /// endpoint builder. <c>resource</c> resolves from the registration's
+    /// issuer (= <paramref name="resourceIdentity"/>) through the library's
+    /// default issuer resolver; <c>authorization_servers</c>,
+    /// <c>scopes_supported</c>, and <c>bearer_methods_supported</c> arrive
+    /// through the
+    /// <see cref="AuthorizationServerIntegration.ContributeProtectedResourceMetadataAsync"/>
+    /// seam, exactly as an application would supply them.
+    /// </summary>
+    private EndpointServer BuildMetadataServer(Uri resourceIdentity)
+    {
+        ClientRecord registration = new()
+        {
+            ClientId = resourceIdentity.OriginalString,
+            TenantId = new TenantId("resource-server"),
+            IssuerUri = resourceIdentity,
+            AllowedCapabilities = ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthProtectedResourceMetadata),
+            AllowedRedirectUris = ImmutableHashSet<Uri>.Empty,
+            AllowedScopes = ImmutableHashSet<string>.Empty,
+            SigningKeys = ImmutableDictionary<KeyUsageContext, SigningKeySet>.Empty,
+            TokenLifetimes = ImmutableDictionary<string, TimeSpan>.Empty
+        };
+
+        IReadOnlyList<string> advertisedAuthorizationServers = AdvertisedAuthorizationServers;
+        string? requiredScope = RequiredScope;
+
+        AuthorizationServerIntegration integration = new()
+        {
+            ExtractTenantIdAsync = (ctx, ct) =>
+                ValueTask.FromResult<TenantId?>(registration.TenantId),
+
+            LoadClientRegistrationAsync = (tenantId, ctx, ct) =>
+                ValueTask.FromResult<IRegistrationRecord?>(registration),
+
+            //Stateless metadata dispatch never persists flow state; the seams
+            //are wired because Validate requires them for any host.
+            SaveFlowStateAsync = (tenantId, flowId, state, stepCount, ctx, ct) =>
+                ValueTask.CompletedTask,
+            LoadFlowStateAsync = (tenantId, flowId, ctx, ct) =>
+                ValueTask.FromResult(((FlowState?)null, 0)),
+
+            ResolvePolicyAsync = (reg, ctx, ct) =>
+                PolicyProfiles.DefaultResolvePolicyAsync((ClientRecord)reg, ctx, ct),
+            ResolveCapabilitiesAsync = DefaultCapabilityResolver.ResolveAsync,
+            InspectAsync = DefaultInspector.NoOpAsync,
+            GenerateIdentifierAsync = DefaultIdentifierGenerator.ForTimeProvider(Integration.TimeProvider),
+            ResolveSubjectIdentifierAsync = DefaultSubjectIdentifierResolver.PublicAsync,
+
+            //RFC 9728 §3: the metadata URL is formed by inserting the
+            //well-known suffix into the resource identifier; WellKnownPaths
+            //owns that computation for the one endpoint this host serves.
+            ResolveEndpointUriAsync = (endpointKey, reg, ctx, ct) =>
+                ValueTask.FromResult<Uri?>(
+                    string.Equals(endpointKey, WellKnownEndpointNames.ProtectedResourceMetadata, StringComparison.Ordinal)
+                        ? WellKnownPaths.OAuthProtectedResource.ComputeUri(resourceIdentity.OriginalString)
+                        : null),
+
+            ContributeProtectedResourceMetadataAsync = (reg, ctx, ct) =>
+                ValueTask.FromResult(new ProtectedResourceMetadataContribution
+                {
+                    AuthorizationServers = advertisedAuthorizationServers,
+                    ScopesSupported = requiredScope is not null ? [requiredScope] : null,
+                    BearerMethodsSupported = [BearerMethodValues.Header]
+                })
+        };
+
+        EndpointServer server = new()
+        {
+            Integration = integration,
+            TimeProvider = Integration.TimeProvider,
+            Configuration = new ServerConfiguration
+            {
+                EndpointBuilders = new EndpointBuilderSet(
+                [
+                    ProtectedResourceMetadataEndpoints.Builder
+                ])
+            }
+        };
+
+        server.AddIntegration(integration);
+        server.Validate();
+
+        return server;
     }
 
 
@@ -111,11 +304,16 @@ public async ValueTask DisposeAsync()
 
         Disposed = true;
 
-        if(KestrelServer is not null)
+        if(webApplication is not null)
         {
-            await KestrelServer.StopAsync(CancellationToken.None).ConfigureAwait(false);
-            KestrelServer.Dispose();
-            KestrelServer = null;
+            await webApplication.StopAsync(CancellationToken.None).ConfigureAwait(false);
+            await webApplication.DisposeAsync().ConfigureAwait(false);
+            webApplication = null;
         }
+
+        metadataServer?.Dispose();
+        metadataServer = null;
+
+        HttpCertificate?.Dispose();
     }
 }
diff --git a/test/Verifiable.Tests/OAuth/TokenExchangeGrantTests.cs b/test/Verifiable.Tests/OAuth/TokenExchangeGrantTests.cs
index c01c9650..caa2be3f 100644
--- a/test/Verifiable.Tests/OAuth/TokenExchangeGrantTests.cs
+++ b/test/Verifiable.Tests/OAuth/TokenExchangeGrantTests.cs
@@ -55,10 +55,15 @@ internal sealed class TokenExchangeGrantTests
     private const string ActorClientId = "https://agent.example.com";
     private const string ActorClientSecret = "s3cret-of-the-agent";
 
-    //The openid scope maps to this resource-server identifier on every client
-    //RegisterDpopClient registers (ScopeToAudience[openid]); both the
-    //client_credentials subject token and the exchanged token carry it as aud,
-    //so the real resource-server validator has a concrete audience to match.
+    //A non-identity scope AddMachineScopeAudienceMapping maps onto ResourceServerAudience: contract
+    //wave-4 D4 narrows openid away from every client_credentials grant (client_credentials has no
+    //authenticated End-User), so the end-to-end tests mint their real subject/actor tokens under
+    //this scope instead, to still reach a concrete audience.
+    private const string MachineScope = "machine.telemetry.read";
+
+    //The resource-server identifier AddMachineScopeAudienceMapping maps MachineScope onto; both the
+    //client_credentials subject token and the exchanged token carry it as aud, so the real
+    //resource-server validator has a concrete audience to match.
     private const string ResourceServerAudience = "https://rs.example.com";
 
     public TestContext TestContext { get; set; } = null!;
@@ -673,9 +678,9 @@ public async Task EndToEndRealTokenIsValidatedExchangedAndUsed()
             await BuildJwksKeyResolverAsync(http, host.HttpBaseAddress!, segment).ConfigureAwait(false);
 
         //STEP 1 — Issue a real subject token over the wire (client_credentials, RFC 6749 §4.4).
-        //sub == ClientId (RFC 9068 §3); openid scope embeds aud == ResourceServerAudience.
+        //sub == ClientId (RFC 9068 §3); MachineScope embeds aud == ResourceServerAudience.
         string subjectToken = await ObtainClientCredentialsAccessTokenAsync(
-            http, tokenUrl, ClientId, ClientSecret, WellKnownScopes.OpenId).ConfigureAwait(false);
+            http, tokenUrl, ClientId, ClientSecret, MachineScope).ConfigureAwait(false);
 
         //Prove, before exchanging, that the subject token is itself a real, valid AS token —
         //the same check the validation seam performs below. This pins what "real" means here.
@@ -826,9 +831,9 @@ public async Task DelegationEndToEndBothTokensRealDistinctSubjectsExchangedAndUs
 
         //STEP 1 — Mint TWO real client_credentials tokens with DISTINCT real subjects.
         string subjectToken = await ObtainClientCredentialsAccessTokenAsync(
-            http, subjectTokenUrl, ClientId, ClientSecret, WellKnownScopes.OpenId).ConfigureAwait(false);
+            http, subjectTokenUrl, ClientId, ClientSecret, MachineScope).ConfigureAwait(false);
         string actorToken = await ObtainClientCredentialsAccessTokenAsync(
-            http, actorTokenUrl, ActorClientId, ActorClientSecret, WellKnownScopes.OpenId).ConfigureAwait(false);
+            http, actorTokenUrl, ActorClientId, ActorClientSecret, MachineScope).ConfigureAwait(false);
 
         //Pin "real": both tokens verify against their own AS and carry their own distinct subject.
         JwsAccessTokenValidationResult subjectCheck = await VerifyAgainstAsAsync(subjectToken, subjectIssuer, subjectJwks).ConfigureAwait(false);
@@ -1224,7 +1229,7 @@ public async Task EndToEndRealTamperedOrExpiredSubjectTokenIsRejectedAsInvalidRe
         //Mint a real subject token (client_credentials, RFC 6749 §4.4) — sub == ClientId, P-256-signed
         //by the AS. It is, before tampering, a genuinely valid AS-issued token.
         string subjectToken = await ObtainClientCredentialsAccessTokenAsync(
-            http, tokenUrl, ClientId, ClientSecret, WellKnownScopes.OpenId).ConfigureAwait(false);
+            http, tokenUrl, ClientId, ClientSecret, MachineScope).ConfigureAwait(false);
 
         //The compact JWS splits into header.payload.signature. Both tamper cases below leave the
         //header and payload intact and corrupt only the signature segment, deterministically — never
@@ -1430,8 +1435,8 @@ public async Task ErrorBodyDoesNotLeakTheSubject()
 
 
     /// <summary>
-    /// Grant-type disjointness. A client allowed the OTHER grant capabilities
-    /// (authorization_code, client_credentials) but NOT
+    /// Grant-type disjointness. A client allowed the OTHER grant capability
+    /// (client_credentials) but NOT
     /// <see cref="WellKnownCapabilityIdentifiers.OAuthTokenExchange"/> — with all three
     /// token-exchange seams wired — does not have its well-formed <c>token-exchange</c> request served
     /// as a successful exchange. The grant materializes only on its own capability; it never falls
@@ -1442,13 +1447,12 @@ public async Task TokenExchangeGrantTypeDoesNotFallThroughWithoutItsCapability()
     {
         await using TestHostShell app = new(TimeProvider);
 
-        //Register a client allowed the other grants' capabilities but NOT OAuthTokenExchange.
+        //Register a client allowed the other grant's capability (client_credentials) but NOT OAuthTokenExchange.
         using VerifierKeyMaterial material = app.RegisterDpopClient(
             ClientId,
             new Uri(ClientId),
             profile: PolicyProfile.Rfc6749WithPkce,
             capabilities: ImmutableHashSet.Create(
-                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
                 WellKnownCapabilityIdentifiers.OAuthClientCredentials,
                 WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
                 WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
@@ -1476,25 +1480,217 @@ public async Task TokenExchangeGrantTypeDoesNotFallThroughWithoutItsCapability()
 
 
     /// <summary>
-    /// Registers the confidential client allowed the
-    /// <see cref="WellKnownCapabilityIdentifiers.OAuthTokenExchange"/> capability.
-    /// The registration also carries OAuthAuthorizationCode and OAuthClientCredentials:
-    /// the shipped RFC 9068 access-token producer is gated on those capabilities, and the
-    /// RegisterDpopClient helper supplies the AccessTokenIssuance signing keys the
-    /// producers resolve. The discovery/jwks capabilities round out the standard surface.
+    /// Contract wave-4 D3/D4: on a tenant granted the
+    /// <see cref="WellKnownCapabilityIdentifiers.OidcOpenIdConnect"/> feature — ruling out D2's
+    /// capability gate as the explanation — a token-exchange grant whose authorization seam
+    /// legitimately grants <c>openid</c> (the app opting in, per the source-layer contract:
+    /// <c>token_exchange</c> honors the app-granted scope, unlike <c>client_credentials</c>) still
+    /// never yields an id_token. <see cref="Oidc10IdTokenProducer"/>'s <c>IsApplicable</c>
+    /// independently requires <c>GrantType ∈ {authorization_code, refresh_token}</c> — this test
+    /// proves that gate holds even when <c>openid</c> survives all the way to the issued access
+    /// token's <c>scope</c> claim, which is the non-vacuous case (nothing upstream removed
+    /// <c>openid</c> here).
     /// </summary>
-    private static VerifierKeyMaterial RegisterTokenExchangeClient(TestHostShell app) =>
-        app.RegisterDpopClient(
+    [TestMethod]
+    public async Task NoIdTokenIsMintedForTokenExchangeEvenWithOpenidGrantedAndOidcFeatureEnabled()
+    {
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
             ClientId,
             new Uri(ClientId),
             profile: PolicyProfile.Rfc6749WithPkce,
             capabilities: ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthTokenExchange,
+                WellKnownCapabilityIdentifiers.OidcOpenIdConnect,
+                WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+                WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
+        WireClientAuthentication(app);
+
+        app.Server.OAuth().ValidateTokenExchangeTokenAsync =
+            static (token, tokenType, registration, context, ct) =>
+                ValueTask.FromResult<ValidatedSecurityToken?>(
+                    new ValidatedSecurityToken { Subject = SubjectIdentity, Scope = WellKnownScopes.OpenId });
+
+        //The policy seam grants openid — an app opting in to vouch that the exchanged subject is an
+        //End-User (contract wave-4 D4: token_exchange honors whatever scope the app's authorization
+        //seam decides, unlike client_credentials' source-layer narrowing).
+        app.Server.OAuth().AuthorizeTokenExchangeAsync =
+            static (subject, actor, request, registration, context, ct) =>
+                ValueTask.FromResult<TokenExchangeAuthorization?>(
+                    new TokenExchangeAuthorization
+                    {
+                        Subject = subject.Subject,
+                        Scope = WellKnownScopes.OpenId,
+                        IssuedTokenType = TokenType.AccessToken
+                    });
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{material.Registration.TenantId.Value}/token");
+
+        OutgoingFormFields form = BuildRequest(new TokenExchangeBuilderOptions
+        {
+            SubjectToken = SubjectTokenValue,
+            SubjectTokenType = TokenType.AccessToken
+        }).WithClientSecretPost(ClientId, Encoding.UTF8.GetBytes(ClientSecret));
+
+        using HttpResponseMessage response = await OAuthTestTransport.PostFormAsync(
+            host.SharedHttpClient!, tokenUrl, form, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string body = await response.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)response.StatusCode, body);
+
+        using JsonDocument doc = JsonDocument.Parse(body);
+        Assert.AreEqual(WellKnownScopes.OpenId, doc.RootElement.GetProperty(OAuthRequestParameterNames.Scope).GetString(),
+            "Sanity: openid must have actually reached the response scope — otherwise the id_token's "
+            + "absence would be trivially explained by scope, not by the grant-type gate under test.");
+        Assert.IsFalse(doc.RootElement.TryGetProperty(WellKnownTokenTypes.IdToken, out _),
+            "token_exchange must never carry an id_token even when openid survived to the granted "
+            + "scope on a tenant with the OidcOpenIdConnect feature granted.");
+
+        string accessToken = doc.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+        using JsonDocument payload = DecodePayload(accessToken);
+        Assert.AreEqual(WellKnownScopes.OpenId, payload.RootElement.GetProperty(OAuthRequestParameterNames.Scope).GetString(),
+            "The issued access token's own scope claim must also carry openid unchanged.");
+    }
+
+
+    /// <summary>
+    /// Contract wave-4 D3/D4 refresh-ladder: a refresh token minted by a token-exchange grant
+    /// (draft-ietf-oauth-identity-assertion-authz-grant-04 §4.5's SAML-to-OAuth transition shape —
+    /// the authorization seam sets <see cref="TokenExchangeAuthorization.IssuedTokenType"/> to
+    /// <see cref="TokenType.RefreshToken"/>) never yields an id_token on redemption via
+    /// <c>grant_type=refresh_token</c>, even on a tenant granted
+    /// <see cref="WellKnownCapabilityIdentifiers.OidcOpenIdConnect"/> — ruling out D2's capability
+    /// gate as the explanation — and even though <c>openid</c> genuinely rode both the exchange
+    /// response and the redeemed access token's own <c>scope</c> claim. <see cref="Oidc10IdTokenProducer"/>'s
+    /// <c>IsApplicable</c> reads <see cref="IssuanceContext.RefreshTokenOriginatingGrantType"/> — carried
+    /// verbatim off <see cref="Verifiable.OAuth.AuthCode.Server.States.ServerRefreshTokenIssuedState.OriginatingGrantType"/>
+    /// — which is <c>token_exchange</c> here, not <c>authorization_code</c>, so the absence proves the
+    /// origin-grant gate rather than a scope that never reached the refreshed token.
+    /// </summary>
+    [TestMethod]
+    public async Task RefreshTokenMintedByTokenExchangeNeverYieldsIdTokenOnRedemption()
+    {
+        await using TestHostShell app = new(TimeProvider);
+        using VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId,
+            new Uri(ClientId),
+            profile: PolicyProfile.Rfc6749WithPkce,
+            capabilities: ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthTokenExchange,
+
+                //The refresh_token grant's own endpoint match requires this capability
+                //(AuthCodeEndpoints.BuildRefreshToken), independent of the D2 tenant-feature gate under
+                //test here — without it the redemption leg below would 404 before ever reaching the
+                //id_token producer walk.
                 WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
+                WellKnownCapabilityIdentifiers.OidcOpenIdConnect,
+                WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+                WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
+        WireClientAuthentication(app);
+
+        app.Server.OAuth().ValidateTokenExchangeTokenAsync =
+            static (token, tokenType, registration, context, ct) =>
+                ValueTask.FromResult<ValidatedSecurityToken?>(
+                    new ValidatedSecurityToken { Subject = SubjectIdentity, Scope = WellKnownScopes.OpenId });
+
+        //The app opts the exchanged subject into a refresh-token issuance carrying openid — the §4.5
+        //SAML-to-OAuth transition shape, where the mint runs through BuildRefreshTokenExchangeResponseAsync
+        //and stamps OriginatingGrantType = token_exchange on the stored refresh state.
+        app.Server.OAuth().AuthorizeTokenExchangeAsync =
+            static (subject, actor, request, registration, context, ct) =>
+                ValueTask.FromResult<TokenExchangeAuthorization?>(
+                    new TokenExchangeAuthorization
+                    {
+                        Subject = subject.Subject,
+                        Scope = WellKnownScopes.OpenId,
+                        IssuedTokenType = TokenType.RefreshToken
+                    });
+
+        await app.StartHttpHostAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        HostedAuthorizationServer host = app.Host("default");
+        Uri tokenUrl = new(host.HttpBaseAddress!, $"/connect/{material.Registration.TenantId.Value}/token");
+
+        OutgoingFormFields exchangeForm = BuildRequest(new TokenExchangeBuilderOptions
+        {
+            SubjectToken = SubjectTokenValue,
+            SubjectTokenType = TokenType.AccessToken
+        }).WithClientSecretPost(ClientId, Encoding.UTF8.GetBytes(ClientSecret));
+
+        using HttpResponseMessage exchangeResponse = await OAuthTestTransport.PostFormAsync(
+            host.SharedHttpClient!, tokenUrl, exchangeForm, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string exchangeBody = await exchangeResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)exchangeResponse.StatusCode, exchangeBody);
+
+        using JsonDocument exchangeDoc = JsonDocument.Parse(exchangeBody);
+        Assert.AreEqual(
+            TokenTypeNames.GetName(TokenType.RefreshToken),
+            exchangeDoc.RootElement.GetProperty(OAuthRequestParameterNames.IssuedTokenType).GetString(),
+            "Sanity: the exchange must have actually minted a refresh token (§4.5), not an access token.");
+        Assert.AreEqual(WellKnownScopes.OpenId, exchangeDoc.RootElement.GetProperty(OAuthRequestParameterNames.Scope).GetString(),
+            "Sanity: openid must have actually reached the token-exchange response scope.");
+        string refreshToken = exchangeDoc.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+
+        //Redeem the token-exchange-minted refresh token through the ordinary grant_type=refresh_token
+        //leg — the same endpoint an authorization_code-originated refresh token redeems through.
+        using HttpResponseMessage refreshResponse = await OAuthTestTransport.PostFormAsync(host.SharedHttpClient!, tokenUrl, new Dictionary<string, string>
+        {
+            [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.RefreshToken,
+            [OAuthRequestParameterNames.RefreshToken] = refreshToken,
+            [OAuthRequestParameterNames.ClientId] = ClientId
+        }, TestContext.CancellationToken).ConfigureAwait(false);
+
+        string refreshBody = await refreshResponse.Content.ReadAsStringAsync(TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, (int)refreshResponse.StatusCode, refreshBody);
+
+        using JsonDocument refreshDoc = JsonDocument.Parse(refreshBody);
+        Assert.IsFalse(refreshDoc.RootElement.TryGetProperty(WellKnownTokenTypes.IdToken, out _),
+            "A refresh token minted by token_exchange must never yield an id_token on redemption, even "
+            + "with openid granted and OidcOpenIdConnect enabled — RefreshTokenOriginatingGrantType gates it.");
+
+        string refreshedAccessToken = refreshDoc.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+        using JsonDocument refreshedPayload = DecodePayload(refreshedAccessToken);
+        Assert.AreEqual(WellKnownScopes.OpenId, refreshedPayload.RootElement.GetProperty(WellKnownJwtClaimNames.Scope).GetString(),
+            "openid must have ridden the refresh redemption onto the refreshed access token's own scope "
+            + "claim — proving the id_token's absence is the origin-grant gate, not a scope that never "
+            + "reached the redeemed token.");
+    }
+
+
+    /// <summary>
+    /// Registers a truly grant-only confidential client — no
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthAuthorizationCode"/> — allowed the
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthTokenExchange"/> capability plus
+    /// <see cref="WellKnownCapabilityIdentifiers.OAuthClientCredentials"/> (some end-to-end tests
+    /// obtain a real subject/actor token via the client_credentials grant). Grant-only token-exchange
+    /// issuance works because <see cref="Rfc9068AccessTokenProducer"/>'s <c>RequiredCapability</c> is
+    /// <see langword="null"/> — an optional tenant-feature gate, not a grant-capability proxy
+    /// (contract wave-4 D2) — so the endpoint-match capability alone is sufficient. RegisterDpopClient
+    /// supplies the AccessTokenIssuance signing keys the producers resolve. The discovery/jwks
+    /// capabilities round out the standard surface. <see cref="AddMachineScopeAudienceMapping"/> maps
+    /// <see cref="MachineScope"/> onto <see cref="ResourceServerAudience"/> so the real
+    /// client_credentials subject/actor tokens minted below still reach a concrete audience —
+    /// contract wave-4 D4 narrows <c>openid</c> away from every <c>client_credentials</c> grant.
+    /// </summary>
+    private static VerifierKeyMaterial RegisterTokenExchangeClient(TestHostShell app)
+    {
+        VerifierKeyMaterial material = app.RegisterDpopClient(
+            ClientId,
+            new Uri(ClientId),
+            profile: PolicyProfile.Rfc6749WithPkce,
+            capabilities: ImmutableHashSet.Create(
                 WellKnownCapabilityIdentifiers.OAuthClientCredentials,
                 WellKnownCapabilityIdentifiers.OAuthTokenExchange,
                 WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
                 WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
 
+        AddMachineScopeAudienceMapping(app, material);
+
+        return material;
+    }
+
 
     /// <summary>
     /// Registers the second confidential client — the acting party — used by the delegation
@@ -1502,18 +1698,51 @@ private static VerifierKeyMaterial RegisterTokenExchangeClient(TestHostShell app
     /// <c>client_credentials</c> token's subject (itself) is a distinct real subject, verified
     /// against its own published JWKS.
     /// </summary>
-    private static VerifierKeyMaterial RegisterActorClient(TestHostShell app) =>
-        app.RegisterDpopClient(
+    private static VerifierKeyMaterial RegisterActorClient(TestHostShell app)
+    {
+        VerifierKeyMaterial material = app.RegisterDpopClient(
             ActorClientId,
             new Uri(ActorClientId),
             profile: PolicyProfile.Rfc6749WithPkce,
             capabilities: ImmutableHashSet.Create(
-                WellKnownCapabilityIdentifiers.OAuthAuthorizationCode,
                 WellKnownCapabilityIdentifiers.OAuthClientCredentials,
                 WellKnownCapabilityIdentifiers.OAuthTokenExchange,
                 WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
                 WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
 
+        AddMachineScopeAudienceMapping(app, material);
+
+        return material;
+    }
+
+
+    /// <summary>
+    /// Adds <see cref="MachineScope"/> to <paramref name="material"/>'s <c>AllowedScopes</c> and maps
+    /// it onto <see cref="ResourceServerAudience"/> in <c>ScopeToAudience</c> — the register-then-
+    /// upgrade pattern the sibling grant suites use, because the routing dictionaries are
+    /// host-internal.
+    /// </summary>
+    private static void AddMachineScopeAudienceMapping(TestHostShell app, VerifierKeyMaterial material)
+    {
+        HostedAuthorizationServer host = app.Host("default");
+        string segment = material.Registration.TenantId.Value;
+        ClientRecord previous = host.Registrations[segment];
+        Dictionary<string, IReadOnlyList<string>> scopeToAudience = previous.ScopeToAudience is null
+            ? new Dictionary<string, IReadOnlyList<string>>(StringComparer.Ordinal)
+            : new Dictionary<string, IReadOnlyList<string>>(previous.ScopeToAudience, StringComparer.Ordinal);
+        scopeToAudience[MachineScope] = [ResourceServerAudience];
+
+        ClientRecord updated = previous with
+        {
+            AllowedScopes = previous.AllowedScopes.Add(MachineScope),
+            ScopeToAudience = scopeToAudience
+        };
+        host.Registrations[segment] = updated;
+        host.Registrations[updated.ClientId] = updated;
+        host.Server.UpdateClient(previous, updated, new ExchangeContext());
+        material.Registration = updated;
+    }
+
 
     /// <summary>
     /// Wires the client_secret_post authentication seam (RFC 6749 §2.3.1): the application
diff --git a/test/Verifiable.Tests/OAuth/TransportTraceMetadataTests.cs b/test/Verifiable.Tests/OAuth/TransportTraceMetadataTests.cs
new file mode 100644
index 00000000..5b53c89e
--- /dev/null
+++ b/test/Verifiable.Tests/OAuth/TransportTraceMetadataTests.cs
@@ -0,0 +1,244 @@
+using System.Diagnostics;
+using System.Net.Http;
+using Verifiable.Core;
+using Verifiable.Core.OutboundFetch;
+using Verifiable.JCose;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.Client;
+using Verifiable.Tests.TestInfrastructure;
+
+namespace Verifiable.Tests.OAuth;
+
+/// <summary>
+/// Proves over a real loopback wire that W3C Trace Context response headers land in
+/// <see cref="HttpResponseData.TransportMetadata"/> under the documented
+/// <see cref="HttpResponseDataKeys"/> constants — in both the plain
+/// <see cref="HttpClientTransport"/> and the policy-guarded
+/// <see cref="GuardedHttpClientTransport"/> — and that
+/// <see cref="OAuthParseError.WithTransportMetadata"/> enrichment surfaces the
+/// captured <c>traceparent</c> as the <see cref="DecisionSupport.CorrelationId"/>
+/// through the real <see cref="OAuthResponseParsers"/> parse pipeline. Also proves
+/// that <see cref="TraceTreeCapture"/> + <see cref="TraceTreeAssertions"/>
+/// reconstruct one connected span tree from the runtime's own instrumentation
+/// across a real HTTPS round-trip.
+/// </summary>
+/// <remarks>
+/// Not parallelized: <see cref="TraceTreeCapture"/> is a process-wide
+/// <see cref="ActivityListener"/> that enables the framework instrumentation
+/// sources (<c>Microsoft.AspNetCore</c>, <c>System.Net.Http</c>), which injects
+/// <c>traceparent</c> headers into concurrently running tests' HTTP calls and
+/// captures their spans here. Serialization plus root-TraceId filtering keeps
+/// these assertions deterministic.
+/// </remarks>
+[TestClass]
+[DoNotParallelize]
+internal sealed class TransportTraceMetadataTests
+{
+    public TestContext TestContext { get; set; } = null!;
+
+    private const string TraceParentHeaderName = "traceparent";
+
+    private const string TraceStateHeaderName = "tracestate";
+
+    /// <summary>The W3C Trace Context specification's own <c>traceparent</c> example value.</summary>
+    private const string ResponseTraceParent = "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01";
+
+    /// <summary>The W3C Trace Context specification's own <c>tracestate</c> example value.</summary>
+    private const string ResponseTraceState = "congo=t61rcWkgMzE";
+
+
+    [TestMethod]
+    public async Task ResponseTraceContextHeadersLandInTransportMetadata()
+    {
+        await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(
+            (request, cancellationToken) => Task.FromResult(new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = WellKnownMediaTypes.Application.Json,
+                Body = /*lang=json,strict*/ """{"ok":true}""",
+                Headers = new Dictionary<string, string>
+                {
+                    [TraceParentHeaderName] = ResponseTraceParent,
+                    [TraceStateHeaderName] = ResponseTraceState
+                }
+            }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(host.Certificate);
+
+        HttpResponseData response = await HttpClientTransport.SendJsonGetAsync(
+            client, host.BaseAddress, OutgoingHeaders.Empty,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(200, response.StatusCode);
+        Assert.AreEqual(ResponseTraceParent, response.GetMetadata(HttpResponseDataKeys.TraceParent),
+            $"The response 'traceparent' header must land in TransportMetadata under " +
+            $"'{HttpResponseDataKeys.TraceParent}'.");
+        Assert.AreEqual(ResponseTraceState, response.GetMetadata(HttpResponseDataKeys.TraceState),
+            $"The response 'tracestate' header must land in TransportMetadata under " +
+            $"'{HttpResponseDataKeys.TraceState}'.");
+    }
+
+
+    [TestMethod]
+    public async Task TransportMetadataIsNullWithoutTraceContextResponseHeaders()
+    {
+        await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(
+            (request, cancellationToken) => Task.FromResult(new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = WellKnownMediaTypes.Application.Json,
+                Body = /*lang=json,strict*/ """{"ok":true}"""
+            }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(host.Certificate);
+
+        HttpResponseData response = await HttpClientTransport.SendJsonGetAsync(
+            client, host.BaseAddress, OutgoingHeaders.Empty,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.IsNull(response.TransportMetadata,
+            "Without trace-context response headers there is no transport metadata to capture.");
+    }
+
+
+    [TestMethod]
+    public async Task GuardedTransportCopiesResponseTraceContextIntoTransportMetadata()
+    {
+        await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(
+            (request, cancellationToken) => Task.FromResult(new MinimalHttpResponse
+            {
+                StatusCode = 200,
+                ContentType = WellKnownMediaTypes.Application.Json,
+                Body = /*lang=json,strict*/ """{"ok":true}""",
+                Headers = new Dictionary<string, string>
+                {
+                    [TraceParentHeaderName] = ResponseTraceParent,
+                    [TraceStateHeaderName] = ResponseTraceState
+                }
+            }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreateSingleHopPinnedHttpClient(host.Certificate);
+        SendFormPostDelegate guardedFormPost = GuardedHttpClientTransport.BuildGuardedFormPost(client);
+
+        ExchangeContext context = new();
+        context.SetOutboundFetchPolicy(TestHostShell.LoopbackOutboundFetchPolicy);
+
+        HttpResponseData response = await guardedFormPost(
+            host.BaseAddress,
+            new Dictionary<string, string> { ["probe"] = "trace-metadata" },
+            OutgoingHeaders.Empty,
+            context,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Assert.AreEqual(200, response.StatusCode);
+        Assert.AreEqual(ResponseTraceParent, response.GetMetadata(HttpResponseDataKeys.TraceParent),
+            "The guarded transport must copy the response 'traceparent' header into " +
+            "TransportMetadata exactly like the plain transport.");
+        Assert.AreEqual(ResponseTraceState, response.GetMetadata(HttpResponseDataKeys.TraceState),
+            "The guarded transport must copy the response 'tracestate' header into " +
+            "TransportMetadata exactly like the plain transport.");
+    }
+
+
+    [TestMethod]
+    public async Task ParseErrorEnrichmentCarriesWireTraceParentAsCorrelationId()
+    {
+        await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(
+            (request, cancellationToken) => Task.FromResult(new MinimalHttpResponse
+            {
+                StatusCode = 400,
+                ContentType = WellKnownMediaTypes.Application.Json,
+                Body = /*lang=json,strict*/ """{"error":"invalid_request","error_description":"code_challenge missing"}""",
+                Headers = new Dictionary<string, string>
+                {
+                    [TraceParentHeaderName] = ResponseTraceParent
+                }
+            }),
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        using HttpClient client = LoopbackTls.CreatePinnedHttpClient(host.Certificate);
+
+        HttpResponseData response = await HttpClientTransport.SendFormPostAsync(
+            client,
+            host.BaseAddress,
+            new Dictionary<string, string> { ["client_id"] = "trace-metadata-test-client" },
+            OutgoingHeaders.Empty,
+            TestContext.CancellationToken).ConfigureAwait(false);
+
+        Result<ParResponse, OAuthParseError> result = OAuthResponseParsers.ParseParResponse(response);
+
+        Assert.IsFalse(result.IsSuccess);
+        OAuthProtocolError protocolError = Assert.IsInstanceOfType<OAuthProtocolError>(result.Error);
+        Assert.AreEqual("invalid_request", protocolError.ErrorCode);
+        Assert.AreEqual(ResponseTraceParent, protocolError.Support.CorrelationId,
+            "The wire response's traceparent must surface as the DecisionSupport correlation id " +
+            "through the real parse pipeline.");
+        Assert.AreEqual("400", protocolError.Support.Context?[HttpResponseDataKeys.StatusCode],
+            "The wire status code must surface in the DecisionSupport context.");
+    }
+
+
+    [TestMethod]
+    public async Task CapturedSpansFormOneConnectedTreeWithHostAttributionAndEvent()
+    {
+        const string HandlerEventName = "test.trace.handler";
+
+        using TraceTreeCapture capture = new();
+        using Activity root = new(nameof(CapturedSpansFormOneConnectedTreeWithHostAttributionAndEvent));
+        root.Start();
+
+        Uri hostBaseAddress;
+        HttpResponseData response;
+        {
+            await using MinimalHttpHost host = await MinimalHttpHost.StartAsync(
+                (request, cancellationToken) =>
+                {
+                    //Runs inside the ASP.NET Core request pipeline, so Activity.Current is
+                    //the Microsoft.AspNetCore.Hosting.HttpRequestIn server span the capture
+                    //enabled. The event proves attachment under the server span; the echoed
+                    //Activity.Id (W3C traceparent format) proves the server processed the
+                    //request inside the client root's trace.
+                    Activity.Current?.AddEvent(new ActivityEvent(HandlerEventName));
+                    string? serverTraceParent = Activity.Current?.Id;
+
+                    return Task.FromResult(new MinimalHttpResponse
+                    {
+                        StatusCode = 200,
+                        Headers = serverTraceParent is null
+                            ? null
+                            : new Dictionary<string, string> { [TraceParentHeaderName] = serverTraceParent }
+                    });
+                },
+                TestContext.CancellationToken).ConfigureAwait(false);
+
+            hostBaseAddress = host.BaseAddress;
+            using HttpClient client = LoopbackTls.CreatePinnedHttpClient(host.Certificate);
+
+            response = await HttpClientTransport.SendJsonGetAsync(
+                client, host.BaseAddress, OutgoingHeaders.Empty,
+                TestContext.CancellationToken).ConfigureAwait(false);
+        }
+        //Leaving the block disposed the host; Kestrel's stop drains request processing,
+        //so the server span has stopped and is in the capture before assertions run.
+
+        root.Stop();
+
+        IReadOnlyList<Activity> captured = capture.StoppedActivities;
+        TraceTreeAssertions.AssertSingleConnectedTree(captured, root);
+        TraceTreeAssertions.AssertSpanForEachHost(captured, root, [hostBaseAddress]);
+        TraceTreeAssertions.AssertEventUnderAncestor(captured, root, HandlerEventName, root.SpanId);
+        TraceTreeAssertions.AssertEventUnderAncestor(captured, root, HandlerEventName,
+            activity => activity.Kind == ActivityKind.Server);
+
+        string? echoedTraceParent = response.GetMetadata(HttpResponseDataKeys.TraceParent);
+        Assert.IsNotNull(echoedTraceParent,
+            "The server-echoed traceparent must land in TransportMetadata.");
+        Assert.Contains(root.TraceId.ToHexString(), echoedTraceParent,
+            "The server span's traceparent must belong to the client root's trace, proving " +
+            "W3C trace-context propagation across the real wire.");
+    }
+}
diff --git a/test/Verifiable.Tests/OAuth/UnmetAuthenticationRequirementsTests.cs b/test/Verifiable.Tests/OAuth/UnmetAuthenticationRequirementsTests.cs
index 8510d026..0c74f824 100644
--- a/test/Verifiable.Tests/OAuth/UnmetAuthenticationRequirementsTests.cs
+++ b/test/Verifiable.Tests/OAuth/UnmetAuthenticationRequirementsTests.cs
@@ -62,6 +62,37 @@ public async Task StaleAuthenticationBeyondMaxAgeFailsWithUnmetRequirement()
     }
 
 
+    /// <summary>
+    /// RFC 9207 §2 / R9207-001 / R9207-012: "an authorization server supporting this
+    /// specification MUST indicate its identity by including the iss parameter in the
+    /// response" applies to error responses too, not only the success redirect. Drives
+    /// the same stale-authentication failure as
+    /// <see cref="StaleAuthenticationBeyondMaxAgeFailsWithUnmetRequirement"/> under a
+    /// profile that emits <c>iss</c> (<see cref="PolicyProfile.Haip10"/>, unlike that
+    /// test's <see cref="PolicyProfile.Rfc6749WithPkce"/>) and asserts <c>iss</c> is
+    /// present on the resulting <c>error=unmet_authentication_requirements</c> redirect.
+    /// </summary>
+    [TestMethod]
+    public async Task ErrorRedirectCarriesIssParameter()
+    {
+        await using TestHostShell host = new(TimeProvider);
+        host.SeedTestSubject(subject: SubjectId);
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId, ClientBaseUri, profile: PolicyProfile.Haip10);
+
+        ServerHttpResponse authorizeResponse = await DriveToAuthorizeAsync(
+            host, material, maxAge: "300",
+            authTime: TimeProvider.GetUtcNow() - TimeSpan.FromSeconds(600)).ConfigureAwait(false);
+
+        Assert.AreEqual(302, authorizeResponse.StatusCode, authorizeResponse.Body);
+        Assert.Contains(
+            $"error={OAuthErrors.UnmetAuthenticationRequirements}", authorizeResponse.Location!,
+            StringComparison.Ordinal);
+        Assert.Contains("iss=", authorizeResponse.Location!, StringComparison.Ordinal,
+            $"RFC 9207 §2 requires iss on an Authorization Error Response, not only on success. Location: {authorizeResponse.Location}");
+    }
+
+
     /// <summary>
     /// <c>max_age=300</c> with an authentication 60 s old satisfies the requirement: the
     /// authorize response redirects with a <c>code</c> and no error.
diff --git a/test/Verifiable.Tests/OAuth/UserInfoEndpointTests.cs b/test/Verifiable.Tests/OAuth/UserInfoEndpointTests.cs
index 65a60a72..54b72863 100644
--- a/test/Verifiable.Tests/OAuth/UserInfoEndpointTests.cs
+++ b/test/Verifiable.Tests/OAuth/UserInfoEndpointTests.cs
@@ -304,6 +304,81 @@ public async Task ResolveSubjectIdentifierIsConsultedOnUserInfo()
     }
 
 
+    /// <summary>
+    /// Contract wave-4 D4: <see cref="UserInfoEndpoints"/>'s <c>openid</c>-in-token-scope check
+    /// (OIDC Core §5.3.1) is correct only because the token endpoint's scope source guarantees a
+    /// <c>client_credentials</c> token — whose <c>sub</c> is the client itself, a machine, not an
+    /// End-User — never carries <c>openid</c>: <c>DropIdentityScopesForNonEndUserGrant</c> narrows it
+    /// away at issuance (RFC 6749 §3.3) even though the request explicitly asked for it and the
+    /// tenant has the <see cref="WellKnownCapabilityIdentifiers.OidcOpenIdConnect"/> feature granted.
+    /// UserInfo therefore refuses the resulting token an identity body — proving the refusal follows
+    /// from the source-side guarantee, not from UserInfo second-guessing the grant type itself.
+    /// </summary>
+    [TestMethod]
+    public async Task ClientCredentialsAccessTokenIsRefusedIdentityBodyAtUserInfo()
+    {
+        await using TestHostShell host = new(TimeProvider);
+
+        using VerifierKeyMaterial material = host.RegisterDpopClient(
+            ClientId,
+            ClientBaseUri,
+            profile: PolicyProfile.Rfc6749WithPkce,
+            capabilities: ImmutableHashSet.Create(
+                WellKnownCapabilityIdentifiers.OAuthClientCredentials,
+                WellKnownCapabilityIdentifiers.OidcOpenIdConnect,
+                WellKnownCapabilityIdentifiers.OidcUserInfo,
+                WellKnownCapabilityIdentifiers.OAuthDiscoveryEndpoint,
+                WellKnownCapabilityIdentifiers.OAuthJwksEndpoint));
+        const string ClientSecret = "s3cret-of-the-machine";
+        host.Server.OAuth().ValidateClientCredentialsAsync = static (request, fields, registration, context, ct) =>
+            ValueTask.FromResult(
+                fields.TryGetValue(OAuthRequestParameterNames.ClientSecret, out string? secret)
+                && string.Equals(secret, ClientSecret, StringComparison.Ordinal));
+
+        string accessToken = await IssueClientCredentialsAccessTokenAsync(
+            host, material, ClientSecret, WellKnownScopes.OpenId).ConfigureAwait(false);
+
+        ServerHttpResponse response = await DispatchUserInfoAsync(
+            host, material, WellKnownHttpMethods.Post,
+            authorizationHeader: "Bearer " + accessToken)
+            .ConfigureAwait(false);
+
+        Assert.AreEqual(403, response.StatusCode,
+            "OIDC Core §5.3.1 refuses UserInfo (insufficient_scope) to a token whose scope never "
+            + "carries openid — guaranteed here because client_credentials narrows it away at issuance.");
+        Assert.Contains(OAuthErrors.InsufficientScope, response.Body);
+    }
+
+
+    /// <summary>
+    /// Dispatches a real <c>client_credentials</c> token request (RFC 6749 §4.4) and returns the
+    /// issued access token — the machine-subject counterpart to <see cref="IssueAccessTokenAsync"/>'s
+    /// authorization_code drive.
+    /// </summary>
+    private async ValueTask<string> IssueClientCredentialsAccessTokenAsync(
+        TestHostShell host, VerifierKeyMaterial material, string clientSecret, string scope)
+    {
+        ServerHttpResponse tokenResponse = await host.DispatchAtEndpointAsync(
+            material.Registration.TenantId.Value,
+            WellKnownEndpointNames.ClientCredentialsToken,
+            WellKnownHttpMethods.Post,
+            new RequestFields
+            {
+                [OAuthRequestParameterNames.GrantType] = WellKnownGrantTypes.ClientCredentials,
+                [OAuthRequestParameterNames.ClientId] = material.Registration.ClientId,
+                [OAuthRequestParameterNames.ClientSecret] = clientSecret,
+                [OAuthRequestParameterNames.Scope] = scope
+            },
+            new ExchangeContext(),
+            TestContext.CancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(200, tokenResponse.StatusCode, tokenResponse.Body);
+
+        using JsonDocument body = JsonDocument.Parse(tokenResponse.Body);
+
+        return body.RootElement.GetProperty(WellKnownTokenTypes.AccessToken).GetString()!;
+    }
+
+
     [TestMethod]
     public async Task ExpiredAccessTokenReturnsUnauthorized()
     {
diff --git a/test/Verifiable.Tests/Resolver/DidResolutionHttpApplication.cs b/test/Verifiable.Tests/Resolver/DidResolutionHttpApplication.cs
index b53fc4d2..9e18bc09 100644
--- a/test/Verifiable.Tests/Resolver/DidResolutionHttpApplication.cs
+++ b/test/Verifiable.Tests/Resolver/DidResolutionHttpApplication.cs
@@ -2,9 +2,7 @@
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Hosting.Server;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Features;
 using Verifiable.Core;
 using Verifiable.Core.Model.Did;
 using Verifiable.Core.OutboundFetch;
@@ -26,13 +24,13 @@ namespace Verifiable.Tests.Resolver;
 /// lives in the test project.
 /// </para>
 /// <para>
-/// The binding handler is transport-agnostic. The spec's "All HTTPS bindings MUST use TLS" is a
-/// deployment transport requirement satisfied by terminating TLS in front of the handler; this test
-/// drives it over the plain http loopback socket (the repo convention for real-socket binding tests),
-/// so no certificate or TLS plumbing is wired here.
+/// The binding handler itself is transport-agnostic — it knows nothing of TLS or certificates. The
+/// spec's "All HTTPS bindings MUST use TLS" is satisfied by the enclosing
+/// <see cref="Verifiable.Tests.Resolver.DidResolutionHttpBindingTests"/> host, which terminates a real
+/// loopback HTTPS listener with a pinned ephemeral certificate in front of this handler.
 /// </para>
 /// </remarks>
-internal sealed class DidResolutionHttpApplication: IHttpApplication<HttpContext>
+internal sealed class DidResolutionHttpApplication
 {
     private readonly DidResolver resolver;
     private readonly DidResolutionResultSerializer serializeResolution;
@@ -65,10 +63,6 @@ public DidResolutionHttpApplication(
     }
 
 
-    public HttpContext CreateContext(IFeatureCollection contextFeatures) =>
-        new DefaultHttpContext(contextFeatures);
-
-
     public async Task ProcessRequestAsync(HttpContext context)
     {
         HttpResponse httpResponse = context.Response;
@@ -103,9 +97,6 @@ public async Task ProcessRequestAsync(HttpContext context)
     }
 
 
-    public void DisposeContext(HttpContext context, Exception? exception) { }
-
-
     private async ValueTask<BindingResponse> HandleAsync(
         string didOrUrl,
         string accept,
diff --git a/test/Verifiable.Tests/Resolver/DidResolutionHttpBindingTests.cs b/test/Verifiable.Tests/Resolver/DidResolutionHttpBindingTests.cs
index 2bfdf4a7..06d19fe1 100644
--- a/test/Verifiable.Tests/Resolver/DidResolutionHttpBindingTests.cs
+++ b/test/Verifiable.Tests/Resolver/DidResolutionHttpBindingTests.cs
@@ -5,14 +5,17 @@
 using System.Net.Http;
 using System.Net.Http.Headers;
 using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Nodes;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Server.Kestrel.Core;
-using Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets;
-using Microsoft.Extensions.Logging.Abstractions;
-using Microsoft.Extensions.Options;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Time.Testing;
 using Verifiable.Core;
 using Verifiable.Core.Did.Methods;
@@ -41,10 +44,9 @@ namespace Verifiable.Tests.Resolver;
 /// content-negotiation and error-to-status rules.
 /// </summary>
 /// <remarks>
-/// TLS is the deployment transport's responsibility (the spec's "All HTTPS bindings MUST use TLS" is a
-/// transport requirement satisfied by terminating TLS in front of the handler); the handler is
-/// transport-agnostic, so this test drives it over the plain http loopback socket — the repo convention
-/// for real-socket binding tests.
+/// The handler itself is transport-agnostic; this test drives it over a genuine loopback HTTPS socket
+/// with a pinned ephemeral certificate (<see cref="LoopbackTls"/>) — the repo convention for real-socket
+/// binding tests — so the spec's "All HTTPS bindings MUST use TLS" is exercised rather than assumed.
 /// </remarks>
 [TestClass]
 internal sealed class DidResolutionHttpBindingTests
@@ -573,16 +575,19 @@ public RoutingTransport(Dictionary<string, (int Status, byte[]? Body, string? Co
     }
 
 
-    //An in-process Kestrel listener bound to the http loopback socket on an OS-assigned ephemeral port,
-    //mounting the DID-resolution skin. The same bootstrap as TestHostShell.StartHttpHostAsync, kept
-    //standalone here so the resolution binding test owns its lifecycle.
+    //An in-process HTTPS listener bound to the loopback socket on an OS-assigned ephemeral port, mounting
+    //the DID-resolution skin behind a pinned ephemeral certificate. The same slim-builder bootstrap as
+    //TestHostShell.StartHttpHostAsync, kept standalone here so the resolution binding test owns its
+    //lifecycle.
     private sealed class DidResolutionHttpHost: IAsyncDisposable
     {
-        private readonly KestrelServer server;
+        private readonly WebApplication app;
+        private readonly X509Certificate2 certificate;
 
-        private DidResolutionHttpHost(KestrelServer server, Uri baseAddress, HttpClient client)
+        private DidResolutionHttpHost(WebApplication app, X509Certificate2 certificate, Uri baseAddress, HttpClient client)
         {
-            this.server = server;
+            this.app = app;
+            this.certificate = certificate;
             BaseAddress = baseAddress;
             Client = client;
         }
@@ -594,32 +599,39 @@ private DidResolutionHttpHost(KestrelServer server, Uri baseAddress, HttpClient
         public static async Task<DidResolutionHttpHost> StartAsync(
             DidResolutionHttpApplication application, System.Threading.CancellationToken cancellationToken)
         {
-            KestrelServerOptions kestrelOptions = new();
-            kestrelOptions.Listen(IPAddress.Loopback, port: 0);
+            X509Certificate2 certificate = LoopbackTls.CreateServerCertificate("did-resolution-loopback-test-host");
 
-            SocketTransportOptions socketOptions = new();
-            SocketTransportFactory socketFactory = new(Options.Create(socketOptions), NullLoggerFactory.Instance);
+            WebApplicationBuilder builder = WebApplication.CreateSlimBuilder();
+            builder.Logging.ClearProviders();
 
-            KestrelServer kestrel = new(Options.Create(kestrelOptions), socketFactory, NullLoggerFactory.Instance);
-            await kestrel.StartAsync(application, cancellationToken).ConfigureAwait(false);
+            //A single explicit HTTPS Listen call — no UseUrls — so there is no plaintext fallback on
+            //this host at all.
+            builder.WebHost.ConfigureKestrel(options =>
+                options.Listen(IPAddress.Loopback, port: 0, listenOptions => listenOptions.UseHttps(certificate)));
 
-            var addresses = kestrel.Features.Get<global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>();
-            if(addresses is null || addresses.Addresses.Count == 0)
-            {
-                throw new InvalidOperationException("Kestrel started but exposed no server address.");
-            }
+            WebApplication app = builder.Build();
+            app.Run(application.ProcessRequestAsync);
+
+            await app.StartAsync(cancellationToken).ConfigureAwait(false);
+
+            IServerAddressesFeature addresses = app.Services.GetRequiredService<IServer>()
+                .Features.Get<IServerAddressesFeature>()
+                ?? throw new InvalidOperationException("Kestrel exposed no server addresses feature.");
+            string boundAddress = addresses.Addresses.FirstOrDefault()
+                ?? throw new InvalidOperationException("Kestrel bound no address.");
 
-            Uri baseAddress = new(addresses.Addresses.First());
-            HttpClient client = new() { BaseAddress = baseAddress };
+            Uri baseAddress = new(boundAddress);
+            HttpClient client = LoopbackTls.CreatePinnedHttpClient(certificate, baseAddress);
 
-            return new DidResolutionHttpHost(kestrel, baseAddress, client);
+            return new DidResolutionHttpHost(app, certificate, baseAddress, client);
         }
 
         public async ValueTask DisposeAsync()
         {
             Client.Dispose();
-            await server.StopAsync(System.Threading.CancellationToken.None).ConfigureAwait(false);
-            server.Dispose();
+            await app.StopAsync(System.Threading.CancellationToken.None).ConfigureAwait(false);
+            await app.DisposeAsync().ConfigureAwait(false);
+            certificate.Dispose();
         }
     }
 }
diff --git a/test/Verifiable.Tests/Resolver/WebVhCrossWireFlowTests.cs b/test/Verifiable.Tests/Resolver/WebVhCrossWireFlowTests.cs
index a937497c..7acf96fb 100644
--- a/test/Verifiable.Tests/Resolver/WebVhCrossWireFlowTests.cs
+++ b/test/Verifiable.Tests/Resolver/WebVhCrossWireFlowTests.cs
@@ -6,20 +6,20 @@
 using System.Linq;
 using System.Net;
 using System.Net.Http;
-using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Nodes;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Hosting.Server;
 using Microsoft.AspNetCore.Hosting.Server.Features;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Features;
-using Microsoft.AspNetCore.Server.Kestrel.Core;
-using Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets;
-using Microsoft.Extensions.Logging.Abstractions;
-using Microsoft.Extensions.Options;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Time.Testing;
 using Verifiable.Core;
 using Verifiable.Core.Did.Methods;
@@ -39,13 +39,14 @@
 namespace Verifiable.Tests.Resolver;
 
 /// <summary>
-/// A REAL two-node cross-wire did:webvh flow: node A is an in-process Kestrel host that PUBLISHES a minted
+/// A REAL two-node cross-wire did:webvh flow: node A is an in-process HTTPS host that PUBLISHES a minted
 /// did:webvh log (the <c>did.jsonl</c>, the <c>did-witness.json</c>, the <c>whois.vp</c> and a path file) over
-/// a plain-http loopback socket, and node B is a composed <see cref="DidResolver"/> that RESOLVES the DID and
-/// DEREFERENCES its <c>/whois</c> and <c>/governance/issuers.json</c> URLs over that same socket through a real
-/// <see cref="HttpClient"/>. The cross-node hops are genuine socket traffic — node A's request log is asserted
-/// to prove every fetch (the log, the witness file, the whois.vp, the path file) crossed the wire, so no hop is
-/// secretly served by an in-memory transport.
+/// a genuine loopback socket with a pinned ephemeral certificate, and node B is a composed
+/// <see cref="DidResolver"/> that RESOLVES the DID and DEREFERENCES its <c>/whois</c> and
+/// <c>/governance/issuers.json</c> URLs over that same socket through a real <see cref="HttpClient"/>. The
+/// cross-node hops are genuine socket traffic — node A's request log is asserted to prove every fetch (the log,
+/// the witness file, the whois.vp, the path file) crossed the wire, so no hop is secretly served by an
+/// in-memory transport.
 /// </summary>
 /// <remarks>
 /// <para>
@@ -57,13 +58,13 @@ namespace Verifiable.Tests.Resolver;
 /// <c>https://localhost:{port}/governance/issuers.json</c>).
 /// </para>
 /// <para>
-/// Node A listens on plain http (the repo convention for real-socket binding tests; TLS is the deployment
-/// transport's responsibility). Node B's resolver computes the genuine <c>https://localhost:{port}/...</c> URL,
-/// the policy on the threaded <see cref="ExchangeContext"/> gates it (loopback explicitly allowed, exactly like
-/// <c>TestHostShell.LoopbackOutboundFetchPolicy</c>), and the single-hop transport rebases that URL's authority
-/// (scheme, host and port) onto node A's real loopback socket before dialing, standing in for the DNS + network
-/// hop a deployment would make. A raw IP-literal host is rejected by the transform (the shared did:web-family host
-/// rule), so the DID uses the <c>localhost</c> registered name.
+/// Node A listens on HTTPS with a fresh self-signed leaf certificate (<see cref="LoopbackTls"/>); node B's
+/// <see cref="HttpClient"/> pins to that exact certificate rather than trusting a CA. Node B's resolver computes
+/// the genuine <c>https://localhost:{port}/...</c> URL, the policy on the threaded <see cref="ExchangeContext"/>
+/// gates it (loopback explicitly allowed, exactly like <c>TestHostShell.LoopbackOutboundFetchPolicy</c>), and the
+/// single-hop transport rebases that URL's authority (host and port) onto node A's real loopback socket before
+/// dialing, standing in for the DNS + network hop a deployment would make. A raw IP-literal host is rejected by
+/// the transform (the shared did:web-family host rule), so the DID uses the <c>localhost</c> registered name.
 /// </para>
 /// </remarks>
 [TestClass]
@@ -138,7 +139,7 @@ public async Task ResolvesAndDereferencesDidWebVhAcrossTheWire()
         nodeA.Publish("/whois.vp", Encoding.UTF8.GetBytes(whois), WellKnownWebVhValues.WhoisMediaType);
         nodeA.Publish("/governance/issuers.json", issuersFile, "application/json");
 
-        using HttpClient httpClient = new();
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(nodeA.Certificate);
         DidResolver composed = BuildCrossWireResolver(httpClient, nodeA.BaseAddress);
 
         //OTel double-check: each log entry's eddsa-jcs-2022 proof is verified through the registered Ed25519
@@ -225,7 +226,7 @@ public async Task UnservedDidIsNotFoundAcrossTheWire()
         using WebVhController controller = WebVhController.Create();
         WebVhMintedLog log = await WebVhTestLog.MintGenesisAsync(domain, controller, GenesisTime).ConfigureAwait(false);
 
-        using HttpClient httpClient = new();
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(nodeA.Certificate);
         DidResolver composed = BuildCrossWireResolver(httpClient, nodeA.BaseAddress);
 
         ExchangeContext context = NewLoopbackContext();
@@ -271,7 +272,7 @@ public async Task ResolvesMovedPortableDidAcrossTheWire()
 
         nodeA.Publish("/moved/did.jsonl", Encoding.UTF8.GetBytes(string.Join('\n', log.Lines)), "application/jsonl");
 
-        using HttpClient httpClient = new();
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(nodeA.Certificate);
         DidResolver composed = BuildCrossWireResolver(httpClient, nodeA.BaseAddress);
 
         ExchangeContext context = NewLoopbackContext();
@@ -293,7 +294,6 @@ private static ExchangeContext NewLoopbackContext()
         ExchangeContext context = new();
         context.SetOutboundFetchPolicy(OutboundFetchPolicy.SecureDefault with
         {
-            AllowedSchemes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "http", "https" },
             BlockPrivateAndLoopback = false
         });
 
@@ -302,8 +302,8 @@ private static ExchangeContext NewLoopbackContext()
 
 
     //Composes node B's resolver: the did:webvh resolver + dereferencer backed by a REAL HttpClient single-hop
-    //transport, wrapped to rewrite only the scheme (https -> http) so the genuine https URL the resolver computes
-    //dials node A's plain-http loopback socket. The chokepoint has already evaluated the genuine https URL.
+    //transport (pinned to node A's certificate), wrapped to rebase the resolved URL's host and port onto node A's
+    //real loopback socket. The chokepoint has already evaluated the genuine https URL.
     private static DidResolver BuildCrossWireResolver(HttpClient httpClient, Uri loopbackBase)
     {
         OutboundTransportDelegate singleHop = GuardedHttpClientTransport.BuildSingleHopTransport(httpClient);
@@ -311,10 +311,10 @@ private static DidResolver BuildCrossWireResolver(HttpClient httpClient, Uri loo
         OutboundTransportDelegate transport = async (request, context, cancellationToken) =>
         {
             //The DID's domain is a registered name (localhost), which the transform maps to a genuine https URL;
-            //this transport plays DNS + network by rebasing that URL's authority (scheme, host and port) onto node
-            //A's real loopback socket, preserving the path and query. The dial is deterministic (it does not depend
-            //on how 'localhost' resolves across the IPv4/IPv6 loopback stacks) and still crosses the real socket —
-            //node A's request-path log proves each hop.
+            //this transport plays DNS + network by rebasing that URL's authority (host and port; the scheme is
+            //already https on both sides) onto node A's real loopback socket, preserving the path and query. The
+            //dial is deterministic (it does not depend on how 'localhost' resolves across the IPv4/IPv6 loopback
+            //stacks) and still crosses the real socket — node A's request-path log proves each hop.
             UriBuilder rebased = new(request.Target)
             {
                 Scheme = loopbackBase.Scheme,
@@ -380,22 +380,27 @@ private static DidResolver BuildCrossWireResolver(HttpClient httpClient, Uri loo
     }
 
 
-    //An in-process Kestrel listener bound to the http loopback socket on an OS-assigned ephemeral port, serving
-    //published static content by path and recording every requested path so the test can prove a hop crossed the
-    //wire. This is node A — the publisher half of the cross-wire flow.
+    //An in-process HTTPS listener bound to the loopback socket on an OS-assigned ephemeral port with a fresh
+    //self-signed leaf certificate, serving published static content by path and recording every requested path
+    //so the test can prove a hop crossed the wire. This is node A — the publisher half of the cross-wire flow.
     private sealed class StaticContentHttpHost: IAsyncDisposable
     {
-        private readonly KestrelServer server;
+        private readonly WebApplication app;
 
-        private StaticContentHttpHost(KestrelServer server, Uri baseAddress, StaticContentApplication application)
+        private StaticContentHttpHost(WebApplication app, X509Certificate2 certificate, Uri baseAddress, StaticContentApplication application)
         {
-            this.server = server;
+            this.app = app;
+            Certificate = certificate;
             BaseAddress = baseAddress;
             Application = application;
         }
 
         public Uri BaseAddress { get; }
 
+        //The self-signed leaf certificate this node's HTTPS listener presents; node B pins to this exact
+        //certificate via LoopbackTls.CreatePinnedHttpClient rather than trusting a CA.
+        public X509Certificate2 Certificate { get; }
+
         private StaticContentApplication Application { get; }
 
         public int TotalRequests => Application.TotalRequests;
@@ -406,31 +411,37 @@ private StaticContentHttpHost(KestrelServer server, Uri baseAddress, StaticConte
 
         public static async Task<StaticContentHttpHost> StartAsync(CancellationToken cancellationToken)
         {
-            KestrelServerOptions kestrelOptions = new();
-            kestrelOptions.Listen(IPAddress.Loopback, port: 0);
+            X509Certificate2 certificate = LoopbackTls.CreateServerCertificate("webvh-cross-wire-loopback-test-host");
+
+            WebApplicationBuilder builder = WebApplication.CreateSlimBuilder();
+            builder.Logging.ClearProviders();
+
+            //A single explicit HTTPS Listen call — no UseUrls — so there is no plaintext fallback on
+            //this host at all.
+            builder.WebHost.ConfigureKestrel(options =>
+                options.Listen(IPAddress.Loopback, port: 0, listenOptions => listenOptions.UseHttps(certificate)));
 
-            SocketTransportOptions socketOptions = new();
-            SocketTransportFactory socketFactory = new(Options.Create(socketOptions), NullLoggerFactory.Instance);
+            WebApplication app = builder.Build();
 
-            KestrelServer kestrel = new(Options.Create(kestrelOptions), socketFactory, NullLoggerFactory.Instance);
             StaticContentApplication application = new();
-            await kestrel.StartAsync(application, cancellationToken).ConfigureAwait(false);
+            app.Run(application.ProcessRequestAsync);
 
-            IServerAddressesFeature? addresses = kestrel.Features.Get<IServerAddressesFeature>();
-            if(addresses is null || addresses.Addresses.Count == 0)
-            {
-                throw new InvalidOperationException("Kestrel started but exposed no server address.");
-            }
+            await app.StartAsync(cancellationToken).ConfigureAwait(false);
 
-            Uri baseAddress = new(addresses.Addresses.First());
+            IServerAddressesFeature addresses = app.Services.GetRequiredService<IServer>()
+                .Features.Get<IServerAddressesFeature>()
+                ?? throw new InvalidOperationException("Kestrel exposed no server addresses feature.");
+            string boundAddress = addresses.Addresses.FirstOrDefault()
+                ?? throw new InvalidOperationException("Kestrel bound no address.");
 
-            return new StaticContentHttpHost(kestrel, baseAddress, application);
+            return new StaticContentHttpHost(app, certificate, new Uri(boundAddress), application);
         }
 
         public async ValueTask DisposeAsync()
         {
-            await server.StopAsync(CancellationToken.None).ConfigureAwait(false);
-            server.Dispose();
+            await app.StopAsync(CancellationToken.None).ConfigureAwait(false);
+            await app.DisposeAsync().ConfigureAwait(false);
+            Certificate.Dispose();
         }
     }
 
diff --git a/test/Verifiable.Tests/SecurityEvents/SsfHttpFlowTests.cs b/test/Verifiable.Tests/SecurityEvents/SsfHttpFlowTests.cs
index 0af9d103..25b38711 100644
--- a/test/Verifiable.Tests/SecurityEvents/SsfHttpFlowTests.cs
+++ b/test/Verifiable.Tests/SecurityEvents/SsfHttpFlowTests.cs
@@ -129,7 +129,7 @@ async Task<MinimalHttpResponse> ReceiverPushHandler(MinimalHttpRequest request,
 
         string compact = await IssueAsync(transmitterPrivate, jwtId: Guid.NewGuid().ToString("N")).ConfigureAwait(false);
 
-        using HttpClient transmitterClient = new();
+        using HttpClient transmitterClient = LoopbackTls.CreatePinnedHttpClient(receiver.Certificate);
         Uri pushUrl = new(receiver.BaseAddress, "/ssf/push");
 
         //First delivery: verified end to end over the socket and acknowledged.
@@ -212,7 +212,7 @@ Task<MinimalHttpResponse> TransmitterPollHandler(MinimalHttpRequest request, Can
         await using MinimalHttpHost transmitter = await MinimalHttpHost.StartAsync(
             TransmitterPollHandler, TestContext.CancellationToken).ConfigureAwait(false);
 
-        using HttpClient receiverClient = new();
+        using HttpClient receiverClient = LoopbackTls.CreatePinnedHttpClient(transmitter.Certificate);
         Uri pollUrl = new(transmitter.BaseAddress, "/ssf/poll");
 
         //Poll 1: fetch pending SETs.
diff --git a/test/Verifiable.Tests/StatusList/BitstringStatusListRevocationDualChannelHttpTests.cs b/test/Verifiable.Tests/StatusList/BitstringStatusListRevocationDualChannelHttpTests.cs
index f9a61faf..db2b3b8c 100644
--- a/test/Verifiable.Tests/StatusList/BitstringStatusListRevocationDualChannelHttpTests.cs
+++ b/test/Verifiable.Tests/StatusList/BitstringStatusListRevocationDualChannelHttpTests.cs
@@ -146,8 +146,8 @@ async Task<MinimalHttpResponse> ReceiverPushHandler(MinimalHttpRequest request,
 
         await using MinimalHttpHost ssfReceiver = await MinimalHttpHost.StartAsync(ReceiverPushHandler, ct).ConfigureAwait(false);
 
-        using HttpClient verifierClient = new();
-        using HttpClient transmitterClient = new();
+        using HttpClient verifierClient = LoopbackTls.CreatePinnedHttpClient(statusListHost.Certificate);
+        using HttpClient transmitterClient = LoopbackTls.CreatePinnedHttpClient(ssfReceiver.Certificate);
 
         async Task<BitstringStatusListStatus> CheckStatusAsync(int index, CancellationToken token)
         {
diff --git a/test/Verifiable.Tests/StatusList/StatusListAggregationHttpFlowTests.cs b/test/Verifiable.Tests/StatusList/StatusListAggregationHttpFlowTests.cs
index d3d36f56..932abf81 100644
--- a/test/Verifiable.Tests/StatusList/StatusListAggregationHttpFlowTests.cs
+++ b/test/Verifiable.Tests/StatusList/StatusListAggregationHttpFlowTests.cs
@@ -80,7 +80,7 @@ public async Task WalksAggregationToListsToPerCredentialStatusOverRealSockets()
         ReadOnlyMemory<byte> aggregationBytes = JsonSerializerExtensions.SerializeToUtf8Bytes(aggregation, TestSetup.DefaultSerializationOptions);
         host.Publish("/aggregation", aggregationBytes, "application/json");
 
-        using HttpClient httpClient = new();
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate);
         Uri aggregationUri = new(host.BaseAddress, "/aggregation");
 
         using HttpResponseMessage aggregationResponse = await httpClient.GetAsync(aggregationUri, TestContext.CancellationToken).ConfigureAwait(false);
diff --git a/test/Verifiable.Tests/StatusList/StatusListTokenHttpFlowTests.cs b/test/Verifiable.Tests/StatusList/StatusListTokenHttpFlowTests.cs
index 3b67b477..bf85541b 100644
--- a/test/Verifiable.Tests/StatusList/StatusListTokenHttpFlowTests.cs
+++ b/test/Verifiable.Tests/StatusList/StatusListTokenHttpFlowTests.cs
@@ -69,7 +69,7 @@ public async Task EvaluatesReferencedTokenStatusFromRealHttpFetchOverJwt()
         string compactJwt = await StatusListTokenJwtFixtures.IssueJwtAsync(token, issuerPrivate, KeyId, TestContext.CancellationToken).ConfigureAwait(false);
         host.Publish("/statuslist/1", Encoding.ASCII.GetBytes(compactJwt), StatusListMediaTypes.StatusListJwtContentType);
 
-        using HttpClient httpClient = new();
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate);
         var fetchedTokens = new List<StatusListToken>();
 
         ResolveVerifiedStatusListTokenDelegate resolve = async (uri, cancellationToken) =>
@@ -129,7 +129,7 @@ public async Task EvaluatesReferencedTokenStatusFromRealHttpFetchOverCwt()
         ReadOnlyMemory<byte> cwtBytes = await StatusListTokenCwtFixtures.IssueCwtAsync(token, issuerPrivate, TestContext.CancellationToken).ConfigureAwait(false);
         host.Publish("/statuslist/1", cwtBytes, StatusListMediaTypes.StatusListCwt);
 
-        using HttpClient httpClient = new();
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(host.Certificate);
         StatusListToken? fetchedToken = null;
 
         try
diff --git a/test/Verifiable.Tests/TestInfrastructure/AuthCodeFlowDriver.cs b/test/Verifiable.Tests/TestInfrastructure/AuthCodeFlowDriver.cs
new file mode 100644
index 00000000..a55d4f32
--- /dev/null
+++ b/test/Verifiable.Tests/TestInfrastructure/AuthCodeFlowDriver.cs
@@ -0,0 +1,294 @@
+using System.Net.Http;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Verifiable.Core;
+using Verifiable.OAuth;
+using Verifiable.OAuth.AuthCode;
+using Verifiable.OAuth.AuthCode.States;
+using Verifiable.OAuth.Client;
+using Verifiable.OAuth.Server;
+using Verifiable.Server;
+using Verifiable.Tests.OAuth;
+
+namespace Verifiable.Tests.TestInfrastructure;
+
+/// <summary>
+/// The outcome of a full <see cref="AuthCodeFlowDriver.DriveParAuthorizeCallbackAndTokenAsync"/>
+/// drive: the client-side flow identifier, the raw authorize redirect <c>Location</c> (so callers
+/// can assert RFC 9207 <c>iss</c> byte-exactness and other redirect parameters), and the
+/// token-endpoint result whose <see cref="AuthCodeFlowEndpointResult.Body"/> carries the issued
+/// tokens.
+/// </summary>
+internal sealed record AuthCodeFlowDriveResult
+{
+    /// <summary>The client-side flow identifier the drive created.</summary>
+    public required string FlowId { get; init; }
+
+    /// <summary>The raw authorize redirect <c>Location</c> header value.</summary>
+    public required string AuthorizeLocation { get; init; }
+
+    /// <summary>
+    /// The token-endpoint result; <see cref="AuthCodeFlowEndpointResult.Body"/> carries the
+    /// issued tokens (access token, and the OIDC <c>id_token</c> when the granted scopes
+    /// include <c>openid</c>).
+    /// </summary>
+    public required AuthCodeFlowEndpointResult TokenResult { get; init; }
+}
+
+
+/// <summary>
+/// The one shared real-wire authorization-code drive every suite can compose:
+/// PAR → authorize → callback → token against a <see cref="TestHostShell"/>-hosted
+/// <see cref="HostedAuthorizationServer"/>. The PAR, callback, and token legs go through the real
+/// <see cref="OAuthClient"/> surface (<see cref="AuthCodeClient.StartParAsync(ClientRegistration, Uri, OAuthFormEncodedFields, System.Threading.CancellationToken)"/>,
+/// <see cref="AuthCodeClient.HandleCallbackAsync(ClientRegistration, OAuthFormEncodedFields, System.Threading.CancellationToken)"/>,
+/// <see cref="AuthCodeClient.ExchangeTokenAsync(ClientRegistration, string, System.Threading.CancellationToken)"/>);
+/// the authorize hop is a raw pinned GET carrying
+/// <see cref="AuthorizationServerHttpApplication.TestSubjectHeaderName"/> as the
+/// authenticated-session stand-in, with the redirect read via
+/// <see cref="TestBrowser.ExtractQueryParam"/> rather than followed.
+/// </summary>
+/// <remarks>
+/// The supplied browser <see cref="HttpClient"/> must pin the target host's exact certificate and
+/// must have auto-redirect DISABLED (for example
+/// <see cref="LoopbackTls.CreateSingleHopPinnedHttpClient"/>, or a handler from
+/// <see cref="LoopbackTls.CreatePinnedHandler(IReadOnlyCollection{System.Security.Cryptography.X509Certificates.X509Certificate2})"/>
+/// with <see cref="HttpClientHandler.AllowAutoRedirect"/> set to <see langword="false"/>): the
+/// driver asserts the authorize 302 itself, so the framework must never silently follow the
+/// <c>Location</c> to the client's (non-resolvable) redirect URI. A single multi-pinned client can
+/// drive flows against several hosts with distinct TLS identities
+/// (<see cref="TestHostShell.AddHost(string, bool)"/>) because the authorize URL is composed
+/// absolute from the target host's <see cref="HostedAuthorizationServer.HttpBaseAddress"/>.
+/// </remarks>
+internal static class AuthCodeFlowDriver
+{
+    /// <summary>
+    /// Drives PAR (a real wire POST through <paramref name="client"/>) and the browser's authorize
+    /// GET (a real wire GET on <paramref name="pinnedBrowserClient"/> with the test subject header
+    /// standing in for an authenticated session), returning the flow identifier and the raw
+    /// redirect <c>Location</c> for the caller to inspect.
+    /// </summary>
+    /// <param name="host">The target host; its HTTPS listener must already be started.</param>
+    /// <param name="client">The OAuth client whose infrastructure posts to the host's real wire.</param>
+    /// <param name="registration">The client-side registration the flow runs under.</param>
+    /// <param name="clientFlowStore">The client-side flow store the <paramref name="client"/>'s infrastructure saves state into.</param>
+    /// <param name="tenantSegment">The server-side tenant segment routing the authorize URL (<see cref="TestHostShell.ComposeEndpointPath"/>).</param>
+    /// <param name="redirectUri">The redirect URI the PAR request declares.</param>
+    /// <param name="subjectId">The authenticated subject the authorize hop asserts via <see cref="AuthorizationServerHttpApplication.TestSubjectHeaderName"/>.</param>
+    /// <param name="pinnedBrowserClient">The pinned, auto-redirect-disabled client the authorize GET rides on.</param>
+    /// <param name="scope">The space-separated scope list to request, or <see langword="null"/> to request none.</param>
+    /// <param name="additionalParFields">Further PAR form fields (resource indicators, authorization_details, ...).</param>
+    /// <param name="cancellationToken">Cancels the drive.</param>
+    public static async Task<(string FlowId, string AuthorizeLocation)> DriveParAndAuthorizeAsync(
+        HostedAuthorizationServer host,
+        OAuthClient client,
+        ClientRegistration registration,
+        Dictionary<string, FlowState> clientFlowStore,
+        string tenantSegment,
+        Uri redirectUri,
+        string subjectId,
+        HttpClient pinnedBrowserClient,
+        string? scope = null,
+        OAuthFormEncodedFields additionalParFields = default,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(host);
+        ArgumentNullException.ThrowIfNull(client);
+        ArgumentNullException.ThrowIfNull(registration);
+        ArgumentNullException.ThrowIfNull(clientFlowStore);
+        ArgumentException.ThrowIfNullOrWhiteSpace(tenantSegment);
+        ArgumentNullException.ThrowIfNull(redirectUri);
+        ArgumentException.ThrowIfNullOrWhiteSpace(subjectId);
+        ArgumentNullException.ThrowIfNull(pinnedBrowserClient);
+
+        if(host.HttpBaseAddress is null)
+        {
+            throw new InvalidOperationException(
+                $"Host '{host.Name}' has no HTTPS listener. Start it via TestHostShell.StartHttpHostAsync before driving a flow.");
+        }
+
+        //Snapshot before PAR so the newly created flow is identified by set difference —
+        //this keeps the driver reusable when the same client flow store already carries
+        //flows from earlier drives in the same test.
+        HashSet<string> preexistingFlowIds = [.. clientFlowStore.Keys];
+
+        OAuthFormEncodedFields parFields = ComposeParFields(scope, additionalParFields);
+        AuthCodeFlowEndpointResult parResult = await client.AuthCode.StartParAsync(
+            registration, redirectUri, parFields, cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Redirect, parResult.Outcome,
+            $"PAR must redirect over the real wire. ErrorCode={parResult.ErrorCode} ErrorDescription={parResult.ErrorDescription}");
+
+        string flowId = clientFlowStore.Keys.Single(key => !preexistingFlowIds.Contains(key));
+        ParCompletedState parState = (ParCompletedState)clientFlowStore[flowId];
+
+        Uri authorizeUrl = new(
+            host.HttpBaseAddress,
+            $"{TestHostShell.ComposeEndpointPath(WellKnownEndpointNames.AuthCodeAuthorize, tenantSegment)}" +
+            $"?{OAuthRequestParameterNames.ClientId}={Uri.EscapeDataString(registration.ClientId.Value)}" +
+            $"&{OAuthRequestParameterNames.RequestUri}={Uri.EscapeDataString(parState.Par.RequestUri.ToString())}");
+
+        using HttpRequestMessage authorizeRequest = new(HttpMethod.Get, authorizeUrl);
+        authorizeRequest.Headers.Add(AuthorizationServerHttpApplication.TestSubjectHeaderName, subjectId);
+
+        using HttpResponseMessage authorizeResponse = await pinnedBrowserClient
+            .SendAsync(authorizeRequest, cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(302, (int)authorizeResponse.StatusCode,
+            "The authorize endpoint must redirect with the authorization code.");
+
+        return (flowId, authorizeResponse.Headers.Location!.ToString());
+    }
+
+
+    /// <summary>
+    /// <see cref="DriveParAndAuthorizeAsync"/> plus the client-local callback state transition
+    /// (echoing <c>code</c>, <c>state</c>, and — when present — the RFC 9207 <c>iss</c> parameter
+    /// back through <see cref="AuthCodeClient.HandleCallbackAsync(ClientRegistration, OAuthFormEncodedFields, System.Threading.CancellationToken)"/>),
+    /// returning the flow identifier ready for token exchange together with the raw authorize
+    /// redirect <c>Location</c>.
+    /// </summary>
+    public static async Task<(string FlowId, string AuthorizeLocation)> DriveParAuthorizeAndCallbackAsync(
+        HostedAuthorizationServer host,
+        OAuthClient client,
+        ClientRegistration registration,
+        Dictionary<string, FlowState> clientFlowStore,
+        string tenantSegment,
+        Uri redirectUri,
+        string subjectId,
+        HttpClient pinnedBrowserClient,
+        string? scope = null,
+        OAuthFormEncodedFields additionalParFields = default,
+        CancellationToken cancellationToken = default)
+    {
+        (string flowId, string authorizeLocation) = await DriveParAndAuthorizeAsync(
+            host, client, registration, clientFlowStore, tenantSegment, redirectUri, subjectId,
+            pinnedBrowserClient, scope, additionalParFields, cancellationToken).ConfigureAwait(false);
+
+        string code = TestBrowser.ExtractQueryParam(authorizeLocation, OAuthRequestParameterNames.Code)
+            ?? throw new InvalidOperationException("Authorize redirect Location missing code.");
+        string? issuerParameter = TestBrowser.ExtractQueryParam(authorizeLocation, OAuthRequestParameterNames.Iss);
+
+        Dictionary<string, string> callbackFields = new(StringComparer.Ordinal)
+        {
+            [OAuthRequestParameterNames.Code] = code,
+            [OAuthRequestParameterNames.State] = flowId
+        };
+        if(issuerParameter is not null)
+        {
+            callbackFields[OAuthRequestParameterNames.Iss] = issuerParameter;
+        }
+
+        AuthCodeFlowEndpointResult callbackResult = await client.AuthCode.HandleCallbackAsync(
+            registration, new OAuthFormEncodedFields(callbackFields), cancellationToken).ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, callbackResult.Outcome,
+            $"Callback must succeed. ErrorCode={callbackResult.ErrorCode} ErrorDescription={callbackResult.ErrorDescription}");
+
+        return (flowId, authorizeLocation);
+    }
+
+
+    /// <summary>
+    /// The complete PAR → authorize → callback → token drive:
+    /// <see cref="DriveParAuthorizeAndCallbackAsync"/> followed by the token exchange through
+    /// <see cref="AuthCodeClient.ExchangeTokenAsync(ClientRegistration, string, ExchangeContext, ClientAssertionOptions?, System.Threading.CancellationToken)"/>
+    /// — the one real-client entry point for every declared
+    /// <see cref="ClientRegistration.AuthenticationMethod"/>, since the client itself dispatches on
+    /// the method (contract wave-4 D6) — asserting every leg succeeded. The returned
+    /// <see cref="AuthCodeFlowDriveResult"/> carries the issued tokens and the raw authorize
+    /// redirect for the caller's own assertions.
+    /// </summary>
+    /// <param name="clientAssertionOptions">
+    /// The <c>private_key_jwt</c> client-assertion signing inputs (RFC 7523 §2.2), required when
+    /// <paramref name="registration"/>'s <see cref="ClientRegistration.AuthenticationMethod"/> is
+    /// <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/>; ignored (<see langword="null"/> is
+    /// the default) for every other method, none of which need a signed assertion.
+    /// </param>
+    public static async Task<AuthCodeFlowDriveResult> DriveParAuthorizeCallbackAndTokenAsync(
+        HostedAuthorizationServer host,
+        OAuthClient client,
+        ClientRegistration registration,
+        Dictionary<string, FlowState> clientFlowStore,
+        string tenantSegment,
+        Uri redirectUri,
+        string subjectId,
+        HttpClient pinnedBrowserClient,
+        string? scope = null,
+        OAuthFormEncodedFields additionalParFields = default,
+        ClientAssertionOptions? clientAssertionOptions = null,
+        CancellationToken cancellationToken = default)
+    {
+        (string flowId, string authorizeLocation) = await DriveParAuthorizeAndCallbackAsync(
+            host, client, registration, clientFlowStore, tenantSegment, redirectUri, subjectId,
+            pinnedBrowserClient, scope, additionalParFields, cancellationToken).ConfigureAwait(false);
+
+        AuthCodeFlowEndpointResult tokenResult = await client.AuthCode.ExchangeTokenAsync(
+            registration, flowId, new ExchangeContext(), clientAssertionOptions, cancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, tokenResult.Outcome,
+            $"Token exchange must succeed over the real wire. ErrorCode={tokenResult.ErrorCode} ErrorDescription={tokenResult.ErrorDescription}");
+
+        return new AuthCodeFlowDriveResult
+        {
+            FlowId = flowId,
+            AuthorizeLocation = authorizeLocation,
+            TokenResult = tokenResult
+        };
+    }
+
+
+    /// <summary>
+    /// Refreshes an access token through the real <see cref="AuthCodeClient.RefreshAsync(ClientRegistration, RefreshTokenRequest, ExchangeContext, ClientAssertionOptions?, System.Threading.CancellationToken)"/>
+    /// entry point — the one real-client path for every declared
+    /// <see cref="ClientRegistration.AuthenticationMethod"/>, since the client itself dispatches on the
+    /// method the same way the code-exchange leg does (contract wave-4 D6, item 2's refresh mirror) —
+    /// asserting the refresh succeeded over the real wire.
+    /// </summary>
+    /// <param name="client">The OAuth client whose infrastructure posts to the host's real wire.</param>
+    /// <param name="registration">The client-side registration the refresh runs under.</param>
+    /// <param name="request">The refresh token request.</param>
+    /// <param name="clientAssertionOptions">
+    /// The <c>private_key_jwt</c> client-assertion signing inputs (RFC 7523 §2.2), required when
+    /// <paramref name="registration"/>'s <see cref="ClientRegistration.AuthenticationMethod"/> is
+    /// <see cref="ClientAuthenticationMethod.PrivateKeyJwt"/>; ignored (<see langword="null"/> is the
+    /// default) for every other method, none of which need a signed assertion.
+    /// </param>
+    /// <param name="cancellationToken">Cancels the drive.</param>
+    public static async Task<AuthCodeFlowEndpointResult> DriveRefreshAsync(
+        OAuthClient client,
+        ClientRegistration registration,
+        RefreshTokenRequest request,
+        ClientAssertionOptions? clientAssertionOptions = null,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(client);
+        ArgumentNullException.ThrowIfNull(registration);
+        ArgumentNullException.ThrowIfNull(request);
+
+        AuthCodeFlowEndpointResult refreshResult = await client.AuthCode.RefreshAsync(
+            registration, request, new ExchangeContext(), clientAssertionOptions, cancellationToken)
+            .ConfigureAwait(false);
+        Assert.AreEqual(AuthCodeFlowEndpointOutcome.Ok, refreshResult.Outcome,
+            $"Refresh must succeed over the real wire. ErrorCode={refreshResult.ErrorCode} ErrorDescription={refreshResult.ErrorDescription}");
+
+        return refreshResult;
+    }
+
+
+    /// <summary>
+    /// Composes the effective PAR form fields: <paramref name="additionalParFields"/> with the
+    /// <c>scope</c> parameter merged in when <paramref name="scope"/> is non-null. An explicit
+    /// <c>scope</c> argument wins over a <c>scope</c> entry in the additional fields.
+    /// </summary>
+    private static OAuthFormEncodedFields ComposeParFields(string? scope, OAuthFormEncodedFields additionalParFields)
+    {
+        if(scope is null)
+        {
+            return additionalParFields;
+        }
+
+        Dictionary<string, string> merged = new(additionalParFields.Fields, StringComparer.Ordinal)
+        {
+            [OAuthRequestParameterNames.Scope] = scope
+        };
+
+        return new OAuthFormEncodedFields(merged);
+    }
+}
diff --git a/test/Verifiable.Tests/TestInfrastructure/CimdServiceHost.cs b/test/Verifiable.Tests/TestInfrastructure/CimdServiceHost.cs
new file mode 100644
index 00000000..ac5b66a0
--- /dev/null
+++ b/test/Verifiable.Tests/TestInfrastructure/CimdServiceHost.cs
@@ -0,0 +1,277 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Security.Cryptography.X509Certificates;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+
+namespace Verifiable.Tests.TestInfrastructure;
+
+/// <summary>
+/// A test host for the non-normative Appendix A "CIMD Service" pattern
+/// (draft-ietf-oauth-client-id-metadata-document-02 Appendix A, CIMD-062/063/064/065/066/067): a web
+/// service through which developers acquire a stable Client Identifier URL that resolves to a Client
+/// ID Metadata Document, without hosting one themselves.
+/// </summary>
+/// <remarks>
+/// Same <see cref="LoopbackTls"/> + <see cref="WebApplication.CreateSlimBuilder()"/> + single
+/// <c>Listen(...UseHttps(cert))</c> convention as <see cref="StaticContentHost"/>, specialised for CIMD
+/// provisioning: <see cref="ProvisionClient"/> mints a fresh path under this host's base address, serves
+/// a conformant Client ID Metadata Document there (200, <c>application/json</c>) whose <c>client_id</c>
+/// is the minted URL's own <see cref="Uri.OriginalString"/> (CIMD-013/014/015), and expires the
+/// provision at the injected <see cref="TimeProvider"/>'s instant (CIMD-065) — an expired or unknown
+/// path answers 404, the minimal form of CIMD-067's "MUST return valid ... or a status code indicating
+/// an error response". <paramref name="developerInfo"/> on <see cref="ProvisionClient"/> models
+/// "MAY require developers to provide additional information about the client being developed"
+/// (CIMD-066) and is merely recorded, readable back via <see cref="DeveloperInfo"/>.
+/// </remarks>
+internal sealed class CimdServiceHost: IAsyncDisposable
+{
+    private readonly WebApplication app;
+
+
+    private CimdServiceHost(
+        WebApplication app, X509Certificate2 certificate, Uri baseAddress, CimdServiceApplication application)
+    {
+        this.app = app;
+        Certificate = certificate;
+        BaseAddress = baseAddress;
+        Application = application;
+    }
+
+
+    /// <summary>The loopback base address Kestrel bound (ephemeral port).</summary>
+    public Uri BaseAddress { get; }
+
+    /// <summary>The self-signed leaf certificate this host's HTTPS listener presents; callers pin to this via <see cref="LoopbackTls.CreatePinnedHttpClient(X509Certificate2, Uri?)"/>.</summary>
+    public X509Certificate2 Certificate { get; }
+
+    private CimdServiceApplication Application { get; }
+
+    /// <summary>The total number of requests the host has served.</summary>
+    public int TotalRequests => Application.TotalRequests;
+
+
+    /// <summary>
+    /// Whether the host has been asked for <paramref name="clientIdentifierUrl"/>'s path, proving the
+    /// fetch crossed the socket.
+    /// </summary>
+    public bool WasRequested(Uri clientIdentifierUrl) => Application.WasRequested(clientIdentifierUrl.AbsolutePath);
+
+
+    /// <summary>
+    /// The developer-supplied information recorded for a prior <see cref="ProvisionClient"/> call
+    /// (CIMD-066), or <see langword="null"/> when <paramref name="clientIdentifierUrl"/> was never
+    /// provisioned or was provisioned with none.
+    /// </summary>
+    public string? DeveloperInfo(Uri clientIdentifierUrl) => Application.DeveloperInfo(clientIdentifierUrl.AbsolutePath);
+
+
+    /// <summary>
+    /// Provisions a fresh Client Identifier URL under this host and serves a conformant Client ID
+    /// Metadata Document there — <c>client_id</c> is the minted URL itself (CIMD-013/014/015),
+    /// <c>redirect_uris</c>/<c>token_endpoint_auth_method</c>/<c>jwks</c>/<c>client_name</c> are carried
+    /// when supplied. The document is served only until <paramref name="lifetime"/> elapses, measured
+    /// from this host's injected <see cref="TimeProvider"/> at call time; <see langword="null"/> never
+    /// expires it (CIMD-065's "MAY expire clients from time to time" — expiry is opt-in per provision).
+    /// </summary>
+    /// <param name="redirectUris">The document's <c>redirect_uris</c>, or <see langword="null"/>/empty to omit the property.</param>
+    /// <param name="tokenEndpointAuthMethod">The document's <c>token_endpoint_auth_method</c> wire value, or <see langword="null"/> to omit it.</param>
+    /// <param name="jwksJson">The document's <c>jwks</c> value as raw JSON object text (embedded unquoted), or <see langword="null"/> to omit it.</param>
+    /// <param name="clientName">The document's <c>client_name</c>, or <see langword="null"/> to omit it.</param>
+    /// <param name="lifetime">How long the document remains servable from now, or <see langword="null"/> for no expiry.</param>
+    /// <param name="developerInfo">Developer-supplied information about the client under development (CIMD-066), or <see langword="null"/> for none.</param>
+    /// <returns>The minted Client Identifier URL, at which the document is now served.</returns>
+    public Uri ProvisionClient(
+        IReadOnlyList<Uri>? redirectUris = null,
+        string? tokenEndpointAuthMethod = null,
+        string? jwksJson = null,
+        string? clientName = null,
+        TimeSpan? lifetime = null,
+        string? developerInfo = null)
+    {
+        string path = $"/cimd/{Guid.NewGuid():N}";
+        Uri clientIdentifierUrl = new(BaseAddress, path);
+
+        string documentJson = BuildDocumentJson(
+            clientIdentifierUrl.OriginalString, redirectUris, tokenEndpointAuthMethod, jwksJson, clientName);
+        DateTimeOffset? expiresAt = lifetime is { } ttl ? Application.TimeProvider.GetUtcNow() + ttl : null;
+
+        Application.Provision(path, documentJson, expiresAt, developerInfo);
+
+        return clientIdentifierUrl;
+    }
+
+
+    /// <summary>
+    /// Starts a CIMD Service host on the IPv4 loopback socket with an OS-assigned ephemeral port.
+    /// </summary>
+    /// <param name="timeProvider">The clock <see cref="ProvisionClient"/> expiry is measured against — the pinned test clock, never the wall clock.</param>
+    /// <param name="cancellationToken">A token to cancel the start.</param>
+    public static async Task<CimdServiceHost> StartAsync(TimeProvider timeProvider, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(timeProvider);
+
+        X509Certificate2 certificate = LoopbackTls.CreateServerCertificate("cimd-service-loopback-test-host");
+
+        WebApplicationBuilder builder = WebApplication.CreateSlimBuilder();
+        builder.Logging.ClearProviders();
+
+        //A single explicit HTTPS Listen call — no UseUrls — so there is no plaintext fallback on
+        //this host at all.
+        builder.WebHost.ConfigureKestrel(options =>
+            options.Listen(IPAddress.Loopback, port: 0, listenOptions => listenOptions.UseHttps(certificate)));
+
+        WebApplication app = builder.Build();
+
+        CimdServiceApplication application = new(timeProvider);
+        app.Run(application.ProcessRequestAsync);
+
+        await app.StartAsync(cancellationToken).ConfigureAwait(false);
+
+        IServerAddressesFeature addresses = app.Services.GetRequiredService<IServer>()
+            .Features.Get<IServerAddressesFeature>()
+            ?? throw new InvalidOperationException("Kestrel exposed no server addresses feature.");
+        string boundAddress = addresses.Addresses.FirstOrDefault()
+            ?? throw new InvalidOperationException("Kestrel bound no address.");
+
+        return new CimdServiceHost(app, certificate, new Uri(boundAddress), application);
+    }
+
+
+    /// <summary>Stops and disposes the host.</summary>
+    public async ValueTask DisposeAsync()
+    {
+        await app.StopAsync(CancellationToken.None).ConfigureAwait(false);
+        await app.DisposeAsync().ConfigureAwait(false);
+        Certificate.Dispose();
+    }
+
+
+    //Builds a conformant Client ID Metadata Document (§4): client_id is REQUIRED (CIMD-013) and always
+    //present; every other member is included only when the caller supplied it, so an omitted property
+    //stays genuinely absent from the wire JSON rather than present as null. jwksJson is embedded
+    //UNQUOTED — it is already a JSON object's text, mirroring PrivateKeyJwtClientAuthenticationTests'
+    //BuildJwksJson convention for hand-built JWKS documents in this test suite.
+    private static string BuildDocumentJson(
+        string clientId,
+        IReadOnlyList<Uri>? redirectUris,
+        string? tokenEndpointAuthMethod,
+        string? jwksJson,
+        string? clientName)
+    {
+        List<string> members = [$"\"client_id\":\"{clientId}\""];
+
+        if(redirectUris is { Count: > 0 })
+        {
+            string uris = string.Join(',', redirectUris.Select(static uri => $"\"{uri.OriginalString}\""));
+            members.Add($"\"redirect_uris\":[{uris}]");
+        }
+
+        if(tokenEndpointAuthMethod is not null)
+        {
+            members.Add($"\"token_endpoint_auth_method\":\"{tokenEndpointAuthMethod}\"");
+        }
+
+        if(jwksJson is not null)
+        {
+            members.Add($"\"jwks\":{jwksJson}");
+        }
+
+        if(clientName is not null)
+        {
+            members.Add($"\"client_name\":\"{clientName}\"");
+        }
+
+        return "{" + string.Join(',', members) + "}";
+    }
+
+
+    /// <summary>
+    /// The request-handler skin serving GET <c>{path}</c> from the provisioned-document map — mounted
+    /// as the host pipeline's <c>RequestDelegate</c> via <c>app.Run(application.ProcessRequestAsync)</c>:
+    /// 404 for an unknown or expired path (CIMD-065/067), 405 for a non-GET method. Every requested path
+    /// is recorded so the cross-wire assertions can prove the socket was hit.
+    /// </summary>
+    private sealed class CimdServiceApplication
+    {
+        private readonly ConcurrentDictionary<string, ProvisionedDocument> provisions = new(StringComparer.Ordinal);
+        private readonly ConcurrentDictionary<string, int> requestCounts = new(StringComparer.Ordinal);
+        private int totalRequests;
+
+
+        public CimdServiceApplication(TimeProvider timeProvider)
+        {
+            TimeProvider = timeProvider;
+        }
+
+
+        /// <summary>The clock provision expiry is measured against.</summary>
+        public TimeProvider TimeProvider { get; }
+
+        /// <summary>The total number of requests served.</summary>
+        public int TotalRequests => Volatile.Read(ref totalRequests);
+
+
+        /// <summary>Records a provisioned document, replacing any prior provision at the same path.</summary>
+        public void Provision(string path, string documentJson, DateTimeOffset? expiresAt, string? developerInfo) =>
+            provisions[path] = new ProvisionedDocument(documentJson, expiresAt, developerInfo);
+
+
+        /// <summary>Whether a path was requested at least once.</summary>
+        public bool WasRequested(string path) => requestCounts.ContainsKey(path);
+
+
+        /// <summary>The developer-supplied information recorded for a provisioned path, or <see langword="null"/>.</summary>
+        public string? DeveloperInfo(string path) =>
+            provisions.TryGetValue(path, out ProvisionedDocument? provision) ? provision.DeveloperInfo : null;
+
+
+        /// <summary>Serves a GET request from the provisioned-document map, recording the requested path.</summary>
+        public async Task ProcessRequestAsync(HttpContext context)
+        {
+            HttpResponse httpResponse = context.Response;
+            string path = context.Request.Path.HasValue ? context.Request.Path.Value! : string.Empty;
+
+            Interlocked.Increment(ref totalRequests);
+            requestCounts.AddOrUpdate(path, 1, static (_, count) => count + 1);
+
+            if(!HttpMethods.IsGet(context.Request.Method))
+            {
+                httpResponse.StatusCode = StatusCodes.Status405MethodNotAllowed;
+
+                return;
+            }
+
+            //Unknown path, OR a provision whose lifetime has elapsed per TimeProvider — both answer 404,
+            //the CIMD-067 "or return a status code indicating an error response" branch. CIMD-065: this
+            //service MAY expire clients from time to time; expiry is decided against the injected clock,
+            //never DateTimeOffset.UtcNow.
+            if(!provisions.TryGetValue(path, out ProvisionedDocument? provision)
+                || (provision.ExpiresAt is { } expiresAt && TimeProvider.GetUtcNow() >= expiresAt))
+            {
+                httpResponse.StatusCode = StatusCodes.Status404NotFound;
+
+                return;
+            }
+
+            httpResponse.StatusCode = StatusCodes.Status200OK;
+            httpResponse.ContentType = "application/json";
+            byte[] bodyBytes = Encoding.UTF8.GetBytes(provision.DocumentJson);
+            await httpResponse.Body.WriteAsync(bodyBytes, context.RequestAborted).ConfigureAwait(false);
+        }
+
+
+        private sealed record ProvisionedDocument(string DocumentJson, DateTimeOffset? ExpiresAt, string? DeveloperInfo);
+    }
+}
diff --git a/test/Verifiable.Tests/TestInfrastructure/DidCommWebSocketInbox.cs b/test/Verifiable.Tests/TestInfrastructure/DidCommWebSocketInbox.cs
index 5eab1b53..a7417780 100644
--- a/test/Verifiable.Tests/TestInfrastructure/DidCommWebSocketInbox.cs
+++ b/test/Verifiable.Tests/TestInfrastructure/DidCommWebSocketInbox.cs
@@ -1,7 +1,10 @@
 using System;
 using System.Buffers;
 using System.Linq;
+using System.Net;
 using System.Net.WebSockets;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -38,44 +41,59 @@ internal sealed record DidCommWebSocketDelivery(string MediaType, byte[] Bytes);
 /// split is this channel's own convention, not a spec requirement.
 /// </para>
 /// <para>
-/// SSRF: this loopback test channel connects the <c>ClientWebSocket</c> directly, with no policy check, because
-/// the endpoint is a trusted loopback inbox. A PRODUCTION socket transport cannot reuse the HTTP path's
-/// <c>OutboundFetch</c> (its URL + redirect loop is HTTP-only), so it MUST itself resolve the endpoint host and
-/// call <c>OutboundFetchPolicy.EvaluateResolvedAddress</c> on each resolved address — connecting only to a
-/// permitted, pinned address — BEFORE <c>ClientWebSocket.ConnectAsync</c>, mirroring the connection-time pinning
-/// the HTTP path gets for free from <c>OutboundFetch</c>.
+/// The listener binds <c>wss://</c> with a fresh self-signed leaf certificate (<see cref="LoopbackTls"/>);
+/// <see cref="CreateSendDelegate"/>'s <see cref="ClientWebSocket"/> pins to that exact certificate via
+/// <see cref="System.Net.WebSockets.ClientWebSocketOptions.RemoteCertificateValidationCallback"/> rather than
+/// trusting a CA — there is no CA in this loopback test topology. This is orthogonal to the SSRF concern below:
+/// a PRODUCTION socket transport cannot reuse the HTTP path's <c>OutboundFetch</c> (its URL + redirect loop is
+/// HTTP-only), so it MUST itself resolve the endpoint host and call
+/// <c>OutboundFetchPolicy.EvaluateResolvedAddress</c> on each resolved address — connecting only to a permitted,
+/// pinned address — BEFORE <c>ClientWebSocket.ConnectAsync</c>, mirroring the connection-time pinning the HTTP
+/// path gets for free from <c>OutboundFetch</c>. This loopback test channel skips that policy check because the
+/// endpoint is a trusted loopback inbox.
 /// </para>
 /// </remarks>
 internal sealed class DidCommWebSocketInbox: IAsyncDisposable
 {
     private readonly WebApplication app;
+    private readonly X509Certificate2 certificate;
     private readonly TaskCompletionSource<DidCommWebSocketDelivery> received =
         new(TaskCreationOptions.RunContinuationsAsynchronously);
 
 
-    private DidCommWebSocketInbox(WebApplication app)
+    private DidCommWebSocketInbox(WebApplication app, X509Certificate2 certificate)
     {
         this.app = app;
+        this.certificate = certificate;
     }
 
 
-    /// <summary>The <c>ws://127.0.0.1:{port}/</c> endpoint a sender delivers to.</summary>
+    /// <summary>The <c>wss://127.0.0.1:{port}/</c> endpoint a sender delivers to.</summary>
     public Uri Endpoint { get; private set; } = null!;
 
+    /// <summary>The self-signed leaf certificate this inbox's WebSocket listener presents; <see cref="CreateSendDelegate"/> pins to this exact certificate rather than trusting a CA.</summary>
+    public X509Certificate2 Certificate => certificate;
+
 
     /// <summary>Starts a loopback WebSocket inbox on an ephemeral port.</summary>
     /// <param name="cancellationToken">Cancellation token.</param>
     /// <returns>The started inbox.</returns>
     public static async Task<DidCommWebSocketInbox> StartAsync(CancellationToken cancellationToken)
     {
+        X509Certificate2 certificate = LoopbackTls.CreateServerCertificate("didcomm-loopback-test-inbox");
+
         WebApplicationBuilder builder = WebApplication.CreateSlimBuilder();
         builder.Logging.ClearProviders();
-        builder.WebHost.UseUrls("http://127.0.0.1:0");
+
+        //A single explicit HTTPS Listen call — no UseUrls — so there is no plaintext fallback on
+        //this host at all.
+        builder.WebHost.ConfigureKestrel(options =>
+            options.Listen(IPAddress.Loopback, port: 0, listenOptions => listenOptions.UseHttps(certificate)));
 
         WebApplication app = builder.Build();
         app.UseWebSockets();
 
-        var inbox = new DidCommWebSocketInbox(app);
+        var inbox = new DidCommWebSocketInbox(app, certificate);
         app.Run(context => inbox.HandleAsync(context));
 
         await app.StartAsync(cancellationToken).ConfigureAwait(false);
@@ -85,7 +103,7 @@ public static async Task<DidCommWebSocketInbox> StartAsync(CancellationToken can
         string boundAddress = addresses.Addresses.FirstOrDefault()
             ?? throw new InvalidOperationException("Kestrel bound no address.");
 
-        inbox.Endpoint = new UriBuilder(boundAddress) { Scheme = "ws", Path = "/" }.Uri;
+        inbox.Endpoint = new UriBuilder(boundAddress) { Scheme = "wss", Path = "/" }.Uri;
 
         return inbox;
     }
@@ -104,16 +122,24 @@ public Task<DidCommWebSocketDelivery> ReceivedAsync(CancellationToken cancellati
     /// The client-side transport: a <see cref="DidCommSendDelegate"/> that opens a <see cref="ClientWebSocket"/> to the
     /// endpoint, sends the media type as a leading text frame and the packed envelope as one binary frame, and reports
     /// a clean delivery as accepted (a WebSocket has no numeric status, so <see cref="DidCommTransmitResult.TransportStatusCode"/>
-    /// stays <see langword="null"/>).
+    /// stays <see langword="null"/>). The TLS validation pins to <paramref name="pinnedCertificate"/> byte-for-byte
+    /// rather than trusting a CA — there is no CA in this loopback test topology.
     /// </summary>
+    /// <param name="pinnedCertificate">The exact certificate the loopback WebSocket listener presents.</param>
     /// <returns>A send delegate that delivers over a WebSocket.</returns>
-    public static DidCommSendDelegate CreateSendDelegate()
+    public static DidCommSendDelegate CreateSendDelegate(X509Certificate2 pinnedCertificate)
     {
+        ArgumentNullException.ThrowIfNull(pinnedCertificate);
+
         return async (message, mediaType, endpoint, context, cancellationToken) =>
         {
             try
             {
                 using var client = new ClientWebSocket();
+                client.Options.RemoteCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) =>
+                    certificate is not null
+                    && CryptographicOperations.FixedTimeEquals(certificate.GetRawCertData(), pinnedCertificate.RawData);
+
                 await client.ConnectAsync(endpoint, cancellationToken).ConfigureAwait(false);
 
                 //One DIDComm message is one unit of transmission (DIDComm v2.1 §WebSockets L1134); the media type the
@@ -143,6 +169,7 @@ public async ValueTask DisposeAsync()
     {
         await app.StopAsync(CancellationToken.None).ConfigureAwait(false);
         await app.DisposeAsync().ConfigureAwait(false);
+        certificate.Dispose();
     }
 
 
diff --git a/test/Verifiable.Tests/TestInfrastructure/GuardedHttpClientTransport.cs b/test/Verifiable.Tests/TestInfrastructure/GuardedHttpClientTransport.cs
index fef76766..a126631a 100644
--- a/test/Verifiable.Tests/TestInfrastructure/GuardedHttpClientTransport.cs
+++ b/test/Verifiable.Tests/TestInfrastructure/GuardedHttpClientTransport.cs
@@ -42,6 +42,20 @@ internal static class GuardedHttpClientTransport
     /// <summary>The transport-metadata key carrying the policy deny reason.</summary>
     public const string DenyReasonMetadataKey = "outboundFetchDenyReason";
 
+    /// <summary>
+    /// The W3C Trace Context response header whose value is copied into
+    /// <see cref="HttpResponseData.TransportMetadata"/> under
+    /// <see cref="HttpResponseDataKeys.TraceParent"/>.
+    /// </summary>
+    private const string TraceParentHeaderName = "traceparent";
+
+    /// <summary>
+    /// The W3C Trace Context response header whose value is copied into
+    /// <see cref="HttpResponseData.TransportMetadata"/> under
+    /// <see cref="HttpResponseDataKeys.TraceState"/>.
+    /// </summary>
+    private const string TraceStateHeaderName = "tracestate";
+
 
     /// <summary>
     /// Builds a <see cref="SendFormPostDelegate"/> that routes the POST through
@@ -114,10 +128,33 @@ public static SendFormPostDelegate BuildGuardedFormPost(HttpClient httpClient)
                 headerBuilder[header.Key] = header.Value;
             }
 
+            //W3C Trace Context response headers are lifted into TransportMetadata under
+            //the documented HttpResponseDataKeys constants so that
+            //OAuthParseError.WithTransportMetadata can surface the server's trace
+            //identity as the DecisionSupport correlation id — the same mapping the
+            //plain OAuth.HttpClientTransport performs. A server sends these headers
+            //only when its deployment chooses to echo trace context on responses;
+            //when absent, TransportMetadata stays null.
+            Dictionary<string, string>? transportMetadata = null;
+            if(headerBuilder.TryGetValue(TraceParentHeaderName, out string? traceParent))
+            {
+                transportMetadata = new Dictionary<string, string>(StringComparer.Ordinal)
+                {
+                    [HttpResponseDataKeys.TraceParent] = traceParent
+                };
+            }
+
+            if(headerBuilder.TryGetValue(TraceStateHeaderName, out string? traceState))
+            {
+                transportMetadata ??= new Dictionary<string, string>(StringComparer.Ordinal);
+                transportMetadata[HttpResponseDataKeys.TraceState] = traceState;
+            }
+
             return new HttpResponseData
             {
                 Body = Encoding.UTF8.GetString(response.Body.Span),
                 StatusCode = response.StatusCode,
+                TransportMetadata = transportMetadata,
                 Headers = new ResponseHeaders { Values = headerBuilder.ToImmutable() }
             };
         };
diff --git a/test/Verifiable.Tests/TestInfrastructure/JwtPayloadDecoding.cs b/test/Verifiable.Tests/TestInfrastructure/JwtPayloadDecoding.cs
new file mode 100644
index 00000000..1081be63
--- /dev/null
+++ b/test/Verifiable.Tests/TestInfrastructure/JwtPayloadDecoding.cs
@@ -0,0 +1,32 @@
+using System.Buffers;
+using System.Text.Json;
+
+namespace Verifiable.Tests.TestInfrastructure;
+
+/// <summary>
+/// The shared JWT-payload decode helper every OAuth test category uses instead of reinventing a
+/// private per-file copy — the shared-fixture counterpart of <see cref="SecurityEventTestJson"/>
+/// for tests that only need the middle compact-JWS segment as parsed JSON claims.
+/// </summary>
+internal static class JwtPayloadDecoding
+{
+    /// <summary>
+    /// Splits <paramref name="compactJws"/> into its three dot-separated segments,
+    /// base64url-decodes the middle (payload) segment via <paramref name="pool"/>, and parses the
+    /// decoded bytes as JSON. Caller owns the returned <see cref="JsonDocument"/> and must dispose
+    /// it. Does not verify the signature — this is a wire-inspection helper for asserting what the
+    /// AS actually emitted, not a validator.
+    /// </summary>
+    public static JsonDocument DecodePayload(string compactJws, MemoryPool<byte> pool)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(compactJws);
+        ArgumentNullException.ThrowIfNull(pool);
+
+        string[] segments = compactJws.Split('.');
+        Assert.HasCount(3, segments);
+
+        byte[] payloadBytes = SecurityEventTestJson.DecodeSegment(segments[1], pool);
+
+        return JsonDocument.Parse(payloadBytes);
+    }
+}
diff --git a/test/Verifiable.Tests/TestInfrastructure/LoopbackTls.cs b/test/Verifiable.Tests/TestInfrastructure/LoopbackTls.cs
new file mode 100644
index 00000000..51837389
--- /dev/null
+++ b/test/Verifiable.Tests/TestInfrastructure/LoopbackTls.cs
@@ -0,0 +1,192 @@
+using System.Collections.Generic;
+using System.Diagnostics.CodeAnalysis;
+using System.Net;
+using System.Net.Http;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+
+namespace Verifiable.Tests.TestInfrastructure;
+
+/// <summary>
+/// The one home for the loopback HTTPS machinery every Kestrel-hosted test fixture in this repository
+/// shares: minting an ephemeral, in-memory self-signed server certificate for an
+/// <c>https://127.0.0.1:{port}</c> listener (<see cref="CreateServerCertificate"/>), and building the
+/// byte-exact pinned <see cref="HttpClient"/> that dials it (<see cref="CreatePinnedHandler"/>,
+/// <see cref="CreatePinnedHttpClient"/>). <see cref="X509Certificate2"/> here is TLS transport
+/// infrastructure for test hosts, not project cryptography — it never touches the
+/// <c>Verifiable.Cryptography</c> key-material surface.
+/// </summary>
+internal static class LoopbackTls
+{
+    /// <summary>
+    /// Mints a fresh, minimal self-signed leaf certificate for a loopback HTTPS listener, subject
+    /// <c>CN={commonName}</c>, covering both SAN forms a loopback client may dial (the <c>localhost</c>
+    /// DNS name and the <c>127.0.0.1</c> IP address). No CA chain is minted: every client in this
+    /// topology pins the leaf certificate's bytes directly (<see cref="CreatePinnedHandler"/>) rather
+    /// than validating a chain to a trust anchor — there is no CA in a loopback test topology.
+    /// </summary>
+    /// <param name="commonName">The certificate subject's common name, e.g. <c>oauth-loopback-test-host</c>.</param>
+    /// <remarks>
+    /// <see cref="CertificateRequest.CreateSelfSigned"/> returns a certificate backed by an EPHEMERAL,
+    /// in-memory CNG key; the platform TLS stack refuses to use an ephemeral key as a SERVER credential
+    /// ("the platform does not support ephemeral keys"). Round-tripping the certificate through a
+    /// PKCS#12 export/reload gives it a persisted key container Kestrel's
+    /// <see cref="System.Net.Security.SslStream"/> server authentication can actually use.
+    /// </remarks>
+    internal static X509Certificate2 CreateServerCertificate(string commonName)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(commonName);
+
+        //Cert-factory carve-out: CertificateRequest requires a framework AsymmetricAlgorithm
+        //to sign the self-signed leaf certificate; this key is never converted to library
+        //PrivateKeyMemory, so it stays framework-native for its whole lifetime.
+        using ECDsa key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        CertificateRequest request = new($"CN={commonName}", key, HashAlgorithmName.SHA256);
+
+        SubjectAlternativeNameBuilder sanBuilder = new();
+        sanBuilder.AddDnsName("localhost");
+        sanBuilder.AddIpAddress(IPAddress.Loopback);
+        request.CertificateExtensions.Add(sanBuilder.Build(critical: false));
+
+        request.CertificateExtensions.Add(
+            new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment, critical: true));
+
+        OidCollection serverAuthEku = new() { new Oid("1.3.6.1.5.5.7.3.1") };
+        request.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(serverAuthEku, critical: false));
+
+        DateTimeOffset now = TestClock.CanonicalEpoch;
+
+        using X509Certificate2 ephemeral = request.CreateSelfSigned(now.AddMinutes(-5), now.AddDays(1));
+        byte[] pfxBytes = ephemeral.Export(X509ContentType.Pfx);
+
+        return X509CertificateLoader.LoadPkcs12(pfxBytes, password: null, X509KeyStorageFlags.Exportable);
+    }
+
+
+    /// <summary>
+    /// Builds an <see cref="HttpClientHandler"/> whose TLS validation pins to
+    /// <paramref name="pinnedCertificate"/> byte-for-byte rather than trusting a certificate authority.
+    /// There is no CA in this loopback test topology, and validation is never disabled: the callback
+    /// always runs and answers strictly from the pinned certificate's raw bytes
+    /// (<see cref="CryptographicOperations.FixedTimeEquals(ReadOnlySpan{byte}, ReadOnlySpan{byte})"/>),
+    /// never from <c>sslPolicyErrors</c>.
+    /// </summary>
+    /// <param name="pinnedCertificate">The exact certificate the loopback listener presents.</param>
+    internal static HttpClientHandler CreatePinnedHandler(X509Certificate2 pinnedCertificate)
+    {
+        ArgumentNullException.ThrowIfNull(pinnedCertificate);
+
+        return CreatePinnedHandler([pinnedCertificate]);
+    }
+
+
+    /// <summary>
+    /// Builds an <see cref="HttpClientHandler"/> whose TLS validation pins to any ONE of
+    /// <paramref name="pinnedCertificates"/> byte-for-byte — the multi-party counterpart to
+    /// <see cref="CreatePinnedHandler(X509Certificate2)"/> for a single test-side client that dials
+    /// several distinct loopback listeners, each presenting its own leaf certificate. Every candidate
+    /// is still checked by exact byte comparison; no CA and no disabled validation, exactly like the
+    /// single-certificate overload.
+    /// </summary>
+    /// <param name="pinnedCertificates">The exact certificates the loopback listeners present.</param>
+    internal static HttpClientHandler CreatePinnedHandler(IReadOnlyCollection<X509Certificate2> pinnedCertificates)
+    {
+        ArgumentNullException.ThrowIfNull(pinnedCertificates);
+
+        return new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback = (requestMessage, certificate, chain, sslPolicyErrors) =>
+            {
+                if(certificate is null)
+                {
+                    return false;
+                }
+
+                foreach(X509Certificate2 pinnedCertificate in pinnedCertificates)
+                {
+                    if(CryptographicOperations.FixedTimeEquals(certificate.RawData, pinnedCertificate.RawData))
+                    {
+                        return true;
+                    }
+                }
+
+                return false;
+            }
+        };
+    }
+
+
+    /// <summary>
+    /// Builds an <see cref="HttpClient"/> pinned to <paramref name="pinnedCertificate"/> via
+    /// <see cref="CreatePinnedHandler(X509Certificate2)"/>. When <paramref name="baseAddress"/> is supplied it
+    /// becomes the client's <see cref="HttpClient.BaseAddress"/>, so callers can issue relative-URI requests
+    /// against the loopback host.
+    /// </summary>
+    /// <param name="pinnedCertificate">The exact certificate the loopback listener presents.</param>
+    /// <param name="baseAddress">The loopback host's base address, or <see langword="null"/> to leave it unset.</param>
+    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope",
+        Justification = "HttpClient takes ownership of the handler (default disposeHandler: true) and disposes it when the returned client is disposed.")]
+    internal static HttpClient CreatePinnedHttpClient(X509Certificate2 pinnedCertificate, Uri? baseAddress = null)
+    {
+        HttpClient client = new(CreatePinnedHandler(pinnedCertificate));
+        if(baseAddress is not null)
+        {
+            client.BaseAddress = baseAddress;
+        }
+
+        return client;
+    }
+
+
+    /// <summary>
+    /// Builds an <see cref="HttpClient"/> pinned to <paramref name="pinnedCertificate"/> with
+    /// auto-redirect disabled, satisfying the single-hop contract on
+    /// <see cref="Verifiable.Core.OutboundFetch.OutboundTransportDelegate"/>: the guarded
+    /// <c>OutboundFetch</c> chokepoint must be the only redirect authority, so the framework must
+    /// never silently follow a 3xx before the policy sees it. Use this for clients wrapped by
+    /// <c>GuardedHttpClientTransport.BuildSingleHopTransport</c>.
+    /// </summary>
+    /// <param name="pinnedCertificate">The exact certificate the loopback listener presents.</param>
+    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope",
+        Justification = "HttpClient takes ownership of the handler (default disposeHandler: true) and disposes it when the returned client is disposed.")]
+    internal static HttpClient CreateSingleHopPinnedHttpClient(X509Certificate2 pinnedCertificate)
+    {
+        HttpClientHandler handler = CreatePinnedHandler(pinnedCertificate);
+        handler.AllowAutoRedirect = false;
+
+        return new HttpClient(handler);
+    }
+
+
+    /// <summary>
+    /// Builds an <see cref="HttpClient"/> pinned to any ONE of <paramref name="pinnedCertificates"/> via
+    /// <see cref="CreatePinnedHandler(IReadOnlyCollection{X509Certificate2})"/> — for a single test-side client
+    /// that dials several distinct loopback listeners (for example an Issuer and a Discloser party in the same
+    /// multi-server flow), each presenting its own leaf certificate.
+    /// </summary>
+    /// <param name="pinnedCertificates">The exact certificates the loopback listeners present.</param>
+    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope",
+        Justification = "HttpClient takes ownership of the handler (default disposeHandler: true) and disposes it when the returned client is disposed.")]
+    internal static HttpClient CreatePinnedHttpClient(IReadOnlyCollection<X509Certificate2> pinnedCertificates) =>
+        new(CreatePinnedHandler(pinnedCertificates));
+
+
+    /// <summary>
+    /// Builds an <see cref="HttpClient"/> pinned to any ONE of <paramref name="pinnedCertificates"/> with
+    /// auto-redirect disabled — the multi-listener counterpart to
+    /// <see cref="CreateSingleHopPinnedHttpClient(X509Certificate2)"/>, for a client that dials several
+    /// distinct loopback listeners while every 3xx must surface to the caller: a guarded
+    /// <c>OutboundFetch</c> transport whose policy is the only redirect authority, or a browser stand-in
+    /// whose test parses the redirect <c>Location</c> itself.
+    /// </summary>
+    /// <param name="pinnedCertificates">The exact certificates the loopback listeners present.</param>
+    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope",
+        Justification = "HttpClient takes ownership of the handler (default disposeHandler: true) and disposes it when the returned client is disposed.")]
+    internal static HttpClient CreateSingleHopPinnedHttpClient(IReadOnlyCollection<X509Certificate2> pinnedCertificates)
+    {
+        HttpClientHandler handler = CreatePinnedHandler(pinnedCertificates);
+        handler.AllowAutoRedirect = false;
+
+        return new HttpClient(handler);
+    }
+}
diff --git a/test/Verifiable.Tests/TestInfrastructure/MinimalHttpHost.cs b/test/Verifiable.Tests/TestInfrastructure/MinimalHttpHost.cs
index 7800902a..7fe20377 100644
--- a/test/Verifiable.Tests/TestInfrastructure/MinimalHttpHost.cs
+++ b/test/Verifiable.Tests/TestInfrastructure/MinimalHttpHost.cs
@@ -1,13 +1,21 @@
 using System;
+using System.Collections.Generic;
 using System.Diagnostics.CodeAnalysis;
 using System.IO;
 using System.Linq;
+using System.Net;
+using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Features;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 
 namespace Verifiable.Tests.TestInfrastructure;
 
@@ -39,6 +47,12 @@ internal sealed record MinimalHttpResponse
 
     /// <summary>The UTF-8 response body, or <see langword="null"/> for an empty response.</summary>
     public string? Body { get; init; }
+
+    /// <summary>
+    /// Additional response headers (for example <c>Cache-Control</c> or <c>Location</c>), written
+    /// before the body. <see langword="null"/> or empty adds no headers beyond <see cref="ContentType"/>.
+    /// </summary>
+    public IReadOnlyDictionary<string, string>? Headers { get; init; }
 }
 
 
@@ -48,73 +62,82 @@ internal delegate Task<MinimalHttpResponse> MinimalHttpHandlerDelegate(
 
 
 /// <summary>
-/// A minimal in-process Kestrel host that routes every request to one
-/// caller-supplied handler. Test glue for the protocol parties that are NOT the
-/// authorization server — for example a Shared Signals Receiver's push endpoint
-/// or a test Transmitter's poll endpoint — so end-to-end tests move real bytes
-/// over a real socket without standing up a full server skin.
+/// A minimal in-process HTTPS host that routes every request to one caller-supplied handler over a
+/// real loopback socket. Test glue for the protocol parties that are NOT the authorization server —
+/// for example a Shared Signals Receiver's push endpoint or a test Transmitter's poll endpoint — so
+/// end-to-end tests move real bytes over a real socket without standing up a full server skin. Binds
+/// through <see cref="WebApplication.CreateSlimBuilder()"/> with a single explicit
+/// <see cref="Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.UseHttps(Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions, X509Certificate2)"/>
+/// listen call presenting <see cref="Certificate"/> — the generic-host bootstrap a raw
+/// <c>KestrelServer</c> cannot reach, since enabling HTTPS resolves an internal
+/// <c>IHttpsConfigurationService</c> only that bootstrap wires up — so there is no plaintext fallback
+/// on this host at all. Callers pin their <see cref="System.Net.Http.HttpClient"/> to
+/// <see cref="Certificate"/> via <see cref="LoopbackTls.CreatePinnedHttpClient"/>.
 /// </summary>
 internal sealed class MinimalHttpHost: IAsyncDisposable
 {
-    private readonly global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer kestrel;
+    private readonly WebApplication app;
 
     /// <summary>The loopback base address Kestrel bound (ephemeral port).</summary>
     public Uri BaseAddress { get; }
 
+    /// <summary>The self-signed leaf certificate this host's HTTPS listener presents; callers pin to this via <see cref="LoopbackTls.CreatePinnedHttpClient"/>.</summary>
+    internal X509Certificate2 Certificate { get; }
+
 
-    private MinimalHttpHost(
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer kestrel, Uri baseAddress)
+    private MinimalHttpHost(WebApplication app, Uri baseAddress, X509Certificate2 certificate)
     {
-        this.kestrel = kestrel;
+        this.app = app;
         BaseAddress = baseAddress;
+        Certificate = certificate;
     }
 
 
-    /// <summary>Starts a host on IPv4 loopback with an ephemeral port.</summary>
-    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope", Justification = "The returned MinimalHttpHost owns the Kestrel server and disposes it in DisposeAsync.")]
+    /// <summary>Starts a host on IPv4 loopback HTTPS with an ephemeral port.</summary>
+    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope", Justification = "The returned MinimalHttpHost owns the WebApplication and certificate and disposes both in DisposeAsync.")]
     public static async Task<MinimalHttpHost> StartAsync(
         MinimalHttpHandlerDelegate handler, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(handler);
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerOptions kestrelOptions = new();
-        kestrelOptions.Listen(System.Net.IPAddress.Loopback, port: 0);
+        X509Certificate2 certificate = LoopbackTls.CreateServerCertificate("minimal-loopback-test-host");
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportOptions socketOptions = new();
-        global::Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.SocketTransportFactory socketFactory = new(
-            global::Microsoft.Extensions.Options.Options.Create(socketOptions),
-            global::Microsoft.Extensions.Logging.Abstractions.NullLoggerFactory.Instance);
+        WebApplicationBuilder builder = WebApplication.CreateSlimBuilder();
+        builder.Logging.ClearProviders();
 
-        global::Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer kestrel = new(
-            global::Microsoft.Extensions.Options.Options.Create(kestrelOptions),
-            socketFactory,
-            global::Microsoft.Extensions.Logging.Abstractions.NullLoggerFactory.Instance);
+        //A single explicit HTTPS Listen call — no UseUrls — so there is no plaintext fallback on
+        //this host at all.
+        builder.WebHost.ConfigureKestrel(options =>
+            options.Listen(IPAddress.Loopback, port: 0, listenOptions => listenOptions.UseHttps(certificate)));
+
+        WebApplication app = builder.Build();
 
         DelegatedApplication application = new(handler);
-        await kestrel.StartAsync(application, cancellationToken).ConfigureAwait(false);
+        app.Run(application.ProcessRequestAsync);
 
-        global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature? addresses =
-            kestrel.Features.Get<global::Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>();
-        if(addresses is null || addresses.Addresses.Count == 0)
-        {
-            kestrel.Dispose();
-            throw new InvalidOperationException("Kestrel started but exposed no server addresses.");
-        }
+        await app.StartAsync(cancellationToken).ConfigureAwait(false);
+
+        IServerAddressesFeature addresses = app.Services.GetRequiredService<IServer>()
+            .Features.Get<IServerAddressesFeature>()
+            ?? throw new InvalidOperationException("Kestrel exposed no server addresses feature.");
+        string boundAddress = addresses.Addresses.FirstOrDefault()
+            ?? throw new InvalidOperationException("Kestrel bound no address.");
 
-        return new MinimalHttpHost(kestrel, new Uri(addresses.Addresses.First()));
+        return new MinimalHttpHost(app, new Uri(boundAddress), certificate);
     }
 
 
     public async ValueTask DisposeAsync()
     {
-        await kestrel.StopAsync(CancellationToken.None).ConfigureAwait(false);
-        kestrel.Dispose();
+        await app.StopAsync(CancellationToken.None).ConfigureAwait(false);
+        await app.DisposeAsync().ConfigureAwait(false);
+        Certificate.Dispose();
     }
 
 
     //Buffers each request and bridges it to the handler delegate; mirrors the
     //shape of AuthorizationServerHttpApplication without the dispatcher.
-    private sealed class DelegatedApplication: IHttpApplication<HttpContext>
+    private sealed class DelegatedApplication
     {
         private readonly MinimalHttpHandlerDelegate handler;
 
@@ -125,10 +148,6 @@ public DelegatedApplication(MinimalHttpHandlerDelegate handler)
         }
 
 
-        public HttpContext CreateContext(IFeatureCollection contextFeatures) =>
-            new DefaultHttpContext(contextFeatures);
-
-
         public async Task ProcessRequestAsync(HttpContext context)
         {
             string body;
@@ -149,6 +168,14 @@ public async Task ProcessRequestAsync(HttpContext context)
                 context.RequestAborted).ConfigureAwait(false);
 
             context.Response.StatusCode = response.StatusCode;
+            if(response.Headers is not null)
+            {
+                foreach(KeyValuePair<string, string> header in response.Headers)
+                {
+                    context.Response.Headers[header.Key] = header.Value;
+                }
+            }
+
             if(!string.IsNullOrEmpty(response.Body))
             {
                 if(!string.IsNullOrEmpty(response.ContentType))
@@ -160,8 +187,5 @@ public async Task ProcessRequestAsync(HttpContext context)
                 await context.Response.Body.WriteAsync(bytes, context.RequestAborted).ConfigureAwait(false);
             }
         }
-
-
-        public void DisposeContext(HttpContext context, Exception? exception) { }
     }
 }
diff --git a/test/Verifiable.Tests/TestInfrastructure/StaticContentHost.cs b/test/Verifiable.Tests/TestInfrastructure/StaticContentHost.cs
index e47db1c2..98dc7f82 100644
--- a/test/Verifiable.Tests/TestInfrastructure/StaticContentHost.cs
+++ b/test/Verifiable.Tests/TestInfrastructure/StaticContentHost.cs
@@ -2,40 +2,43 @@
 using System.Collections.Concurrent;
 using System.Linq;
 using System.Net;
+using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Hosting.Server;
 using Microsoft.AspNetCore.Hosting.Server.Features;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Features;
-using Microsoft.AspNetCore.Server.Kestrel.Core;
-using Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets;
-using Microsoft.Extensions.Logging.Abstractions;
-using Microsoft.Extensions.Options;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 
 namespace Verifiable.Tests.TestInfrastructure;
 
 /// <summary>
-/// A reusable in-process Kestrel listener bound to the IPv4 loopback socket on an OS-assigned ephemeral port that
+/// A reusable in-process HTTPS listener bound to the IPv4 loopback socket on an OS-assigned ephemeral port that
 /// serves published static content by path and records every requested path, so an end-to-end test can prove a hop
 /// crossed the wire. This is the party-server primitive a multi-server, over-the-wire flow test stands up for each
 /// firewalled party (for example an ACDC Issuer that publishes its KEL, its credential, and its registry, or a DID
 /// publisher node) — bytes move over a real socket, and the verifier reconstructs only from what it fetched.
 /// </summary>
 /// <remarks>
-/// Modeled on the proven publisher-node shape used by the did:webvh cross-wire flow test: a raw
-/// <see cref="KestrelServer"/> plus a hand-written <see cref="IHttpApplication{TContext}"/> skin (the test projects
-/// never use a full server stack), serving GET requests from a published-content map, 404 for an unknown path and
-/// 405 for a non-GET method, with per-path request counts the firewall assertions read.
+/// Binds through <see cref="WebApplication.CreateSlimBuilder()"/> with a single explicit HTTPS
+/// <c>Listen</c> call presenting <see cref="Certificate"/> — there is no plaintext fallback — serving GET
+/// requests from a published-content map, 404 for an unknown path and 405 for a non-GET method, with
+/// per-path request counts the firewall assertions read. Callers pin their
+/// <see cref="System.Net.Http.HttpClient"/> to <see cref="Certificate"/> via
+/// <see cref="LoopbackTls.CreatePinnedHttpClient"/>.
 /// </remarks>
 internal sealed class StaticContentHost: IAsyncDisposable
 {
-    private readonly KestrelServer server;
+    private readonly WebApplication app;
 
 
-    private StaticContentHost(KestrelServer server, Uri baseAddress, StaticContentApplication application)
+    private StaticContentHost(WebApplication app, X509Certificate2 certificate, Uri baseAddress, StaticContentApplication application)
     {
-        this.server = server;
+        this.app = app;
+        Certificate = certificate;
         BaseAddress = baseAddress;
         Application = application;
     }
@@ -44,6 +47,9 @@ private StaticContentHost(KestrelServer server, Uri baseAddress, StaticContentAp
     /// <summary>The loopback base address Kestrel bound (ephemeral port).</summary>
     public Uri BaseAddress { get; }
 
+    /// <summary>The self-signed leaf certificate this host's HTTPS listener presents; callers pin to this via <see cref="LoopbackTls.CreatePinnedHttpClient"/>.</summary>
+    public X509Certificate2 Certificate { get; }
+
     private StaticContentApplication Application { get; }
 
     /// <summary>The total number of requests the host has served.</summary>
@@ -75,41 +81,49 @@ private StaticContentHost(KestrelServer server, Uri baseAddress, StaticContentAp
     /// <returns>The started host.</returns>
     public static async Task<StaticContentHost> StartAsync(CancellationToken cancellationToken)
     {
-        KestrelServerOptions kestrelOptions = new();
-        kestrelOptions.Listen(IPAddress.Loopback, port: 0);
+        X509Certificate2 certificate = LoopbackTls.CreateServerCertificate("static-content-loopback-test-host");
+
+        WebApplicationBuilder builder = WebApplication.CreateSlimBuilder();
+        builder.Logging.ClearProviders();
+
+        //A single explicit HTTPS Listen call — no UseUrls — so there is no plaintext fallback on
+        //this host at all.
+        builder.WebHost.ConfigureKestrel(options =>
+            options.Listen(IPAddress.Loopback, port: 0, listenOptions => listenOptions.UseHttps(certificate)));
 
-        SocketTransportOptions socketOptions = new();
-        SocketTransportFactory socketFactory = new(Options.Create(socketOptions), NullLoggerFactory.Instance);
+        WebApplication app = builder.Build();
 
-        KestrelServer kestrel = new(Options.Create(kestrelOptions), socketFactory, NullLoggerFactory.Instance);
         StaticContentApplication application = new();
-        await kestrel.StartAsync(application, cancellationToken).ConfigureAwait(false);
+        app.Run(application.ProcessRequestAsync);
 
-        IServerAddressesFeature? addresses = kestrel.Features.Get<IServerAddressesFeature>();
-        if(addresses is null || addresses.Addresses.Count == 0)
-        {
-            kestrel.Dispose();
-            throw new InvalidOperationException("Kestrel started but exposed no server address.");
-        }
+        await app.StartAsync(cancellationToken).ConfigureAwait(false);
+
+        IServerAddressesFeature addresses = app.Services.GetRequiredService<IServer>()
+            .Features.Get<IServerAddressesFeature>()
+            ?? throw new InvalidOperationException("Kestrel exposed no server addresses feature.");
+        string boundAddress = addresses.Addresses.FirstOrDefault()
+            ?? throw new InvalidOperationException("Kestrel bound no address.");
 
-        return new StaticContentHost(kestrel, new Uri(addresses.Addresses.First()), application);
+        return new StaticContentHost(app, certificate, new Uri(boundAddress), application);
     }
 
 
     /// <summary>Stops and disposes the host.</summary>
     public async ValueTask DisposeAsync()
     {
-        await server.StopAsync(CancellationToken.None).ConfigureAwait(false);
-        server.Dispose();
+        await app.StopAsync(CancellationToken.None).ConfigureAwait(false);
+        await app.DisposeAsync().ConfigureAwait(false);
+        Certificate.Dispose();
     }
 
 
     /// <summary>
-    /// The <see cref="IHttpApplication{TContext}"/> skin serving GET <c>{path}</c> from a published-content map: 404
+    /// The request-handler skin serving GET <c>{path}</c> from a published-content map — mounted as the
+    /// host pipeline's <c>RequestDelegate</c> via <c>app.Run(application.ProcessRequestAsync)</c>: 404
     /// for an unknown path, 405 for a non-GET method. Every requested path is recorded so the cross-wire assertions
     /// can prove the socket was hit.
     /// </summary>
-    private sealed class StaticContentApplication: IHttpApplication<HttpContext>
+    private sealed class StaticContentApplication
     {
         private readonly ConcurrentDictionary<string, (byte[] Body, string ContentType)> content = new(StringComparer.Ordinal);
         private readonly ConcurrentDictionary<string, int> requestCounts = new(StringComparer.Ordinal);
@@ -136,12 +150,6 @@ public void Publish(string path, ReadOnlyMemory<byte> body, string contentType)
         public bool WasRequested(string path) => requestCounts.ContainsKey(path);
 
 
-        /// <summary>Creates the per-request context.</summary>
-        /// <param name="contextFeatures">The request features.</param>
-        /// <returns>The HTTP context.</returns>
-        public HttpContext CreateContext(IFeatureCollection contextFeatures) => new DefaultHttpContext(contextFeatures);
-
-
         /// <summary>Serves a GET request from the published-content map, recording the requested path.</summary>
         /// <param name="context">The HTTP context.</param>
         /// <returns>A task that completes when the response is written.</returns>
@@ -171,11 +179,5 @@ public async Task ProcessRequestAsync(HttpContext context)
             httpResponse.ContentType = served.ContentType;
             await httpResponse.Body.WriteAsync(served.Body, context.RequestAborted).ConfigureAwait(false);
         }
-
-
-        /// <summary>Disposes the per-request context.</summary>
-        /// <param name="context">The HTTP context.</param>
-        /// <param name="exception">The exception that aborted the request, if any.</param>
-        public void DisposeContext(HttpContext context, Exception? exception) { }
     }
 }
diff --git a/test/Verifiable.Tests/TestInfrastructure/TraceTreeAssertions.cs b/test/Verifiable.Tests/TestInfrastructure/TraceTreeAssertions.cs
new file mode 100644
index 00000000..8e8b2cce
--- /dev/null
+++ b/test/Verifiable.Tests/TestInfrastructure/TraceTreeAssertions.cs
@@ -0,0 +1,408 @@
+using System.Diagnostics;
+using System.Globalization;
+
+namespace Verifiable.Tests.TestInfrastructure;
+
+/// <summary>
+/// Assertions over a set of captured <see cref="Activity"/> spans (see
+/// <see cref="TraceTreeCapture"/>) that prove a flow produced ONE connected
+/// W3C Trace Context span tree: every span reachable from the test's root via
+/// <see cref="Activity.ParentSpanId"/> links, at least one span attributable to
+/// each participating host, and named events attached under their owning span.
+/// </summary>
+/// <remarks>
+/// <para>
+/// All assertions first filter the captured set by the root's
+/// <see cref="Activity.TraceId"/> (<see cref="FilterByTrace"/>), because an
+/// <see cref="ActivityListener"/> is process-wide and captures foreign tests'
+/// spans while it is alive.
+/// </para>
+/// <para>
+/// <strong>Host attribution keys.</strong> Attribution is keyed on what the .NET
+/// runtime's own instrumentation emits when a listener requests all data:
+/// </para>
+/// <list type="bullet">
+///   <item>
+///     <description>
+///       <c>System.Net.Http.HttpRequestOut</c> client spans carry the OTel HTTP
+///       client semantic-convention tags <c>url.full</c>, <c>server.address</c>, and
+///       <c>server.port</c>. A client span is attributed directly: first from
+///       <c>url.full</c>, then from <c>server.address</c> + <c>server.port</c>.
+///     </description>
+///   </item>
+///   <item>
+///     <description>
+///       <c>Microsoft.AspNetCore.Hosting.HttpRequestIn</c> server spans carry
+///       <c>http.request.method</c>, <c>url.scheme</c>, <c>url.path</c>,
+///       <c>url.query</c>, and <c>network.protocol.version</c> — no request-authority
+///       tag, so a server span is generally not host-attributable from its own tags.
+///       It inherits the host of its nearest attributable ancestor: its W3C parent is
+///       the very <c>HttpRequestOut</c> span that dialed the host, so the inherited
+///       attribution is exact. The same inheritance covers library spans (for example
+///       <c>server.handle</c>) nested inside a server span. Should a runtime add
+///       <c>server.address</c>/<c>server.port</c> to server spans, the direct path
+///       already honors them.
+///     </description>
+///   </item>
+/// </list>
+/// <para>
+/// Host names compare ordinal-ignore-case, with <c>localhost</c>, <c>127.0.0.1</c>,
+/// and <c>::1</c> treated as equivalent loopback designators; ports must match
+/// exactly. When a span carries a host but no port, it is attributed only if exactly
+/// one expected host matches — in a loopback topology every host shares the loopback
+/// address and only the port discriminates, so an ambiguous portless match proves
+/// nothing.
+/// </para>
+/// </remarks>
+internal static class TraceTreeAssertions
+{
+    private const string UrlFullTagName = "url.full";
+    private const string ServerAddressTagName = "server.address";
+    private const string ServerPortTagName = "server.port";
+
+
+    /// <summary>
+    /// Returns the activities whose <see cref="Activity.TraceId"/> equals
+    /// <paramref name="traceId"/> — the per-test isolation step that discards spans
+    /// emitted by concurrently running tests into the same process-wide listener.
+    /// </summary>
+    public static IReadOnlyList<Activity> FilterByTrace(IEnumerable<Activity> activities, ActivityTraceId traceId)
+    {
+        ArgumentNullException.ThrowIfNull(activities);
+
+        return [.. activities.Where(activity => activity.TraceId == traceId)];
+    }
+
+
+    /// <summary>
+    /// Asserts that every captured span carrying <paramref name="root"/>'s
+    /// <see cref="Activity.TraceId"/> is reachable from <paramref name="root"/> via
+    /// <see cref="Activity.ParentSpanId"/> links — a single connected component with
+    /// the root at its top. A span whose ancestor chain dead-ends outside the captured
+    /// set (a broken or missing parent link) fails the assertion and is named in the
+    /// failure message.
+    /// </summary>
+    /// <param name="capturedActivities">The captured spans, typically <see cref="TraceTreeCapture.StoppedActivities"/>.</param>
+    /// <param name="root">The test's root activity; it need not itself be captured.</param>
+    public static void AssertSingleConnectedTree(IEnumerable<Activity> capturedActivities, Activity root)
+    {
+        ArgumentNullException.ThrowIfNull(capturedActivities);
+        ArgumentNullException.ThrowIfNull(root);
+
+        IReadOnlyList<Activity> inTrace = FilterByTrace(capturedActivities, root.TraceId);
+        Assert.IsGreaterThan(0, inTrace.Count,
+            $"No captured span carries the root TraceId '{root.TraceId}'; the trace tree is empty.");
+
+        Dictionary<ActivitySpanId, Activity> bySpanId = BuildSpanIndex(inTrace);
+
+        string[] disconnectedSpans = [.. inTrace
+            .Where(activity => !IsSelfOrDescendantOf(activity, root.SpanId, bySpanId))
+            .Select(activity =>
+                $"'{activity.OperationName}' (SpanId {activity.SpanId}, ParentSpanId {activity.ParentSpanId})")];
+
+        Assert.IsEmpty(disconnectedSpans,
+            $"Every span with TraceId '{root.TraceId}' must be reachable from the root span " +
+            $"'{root.SpanId}' via ParentSpanId links; {disconnectedSpans.Length} of {inTrace.Count} " +
+            $"are not: {string.Join("; ", disconnectedSpans)}.");
+    }
+
+
+    /// <summary>
+    /// Asserts that for each base address in <paramref name="hostBaseAddresses"/> the
+    /// trace contains at least one span attributable to that host — by default a
+    /// server-side span (<see cref="ActivityKind.Server"/>), proving the request was
+    /// processed at the host inside the same trace rather than merely dialed. See the
+    /// class remarks for the attribution keys and the ancestor-inheritance rule.
+    /// </summary>
+    /// <param name="capturedActivities">The captured spans, typically <see cref="TraceTreeCapture.StoppedActivities"/>.</param>
+    /// <param name="root">The test's root activity; only spans in its trace participate.</param>
+    /// <param name="hostBaseAddresses">The base address of every host the flow must have touched.</param>
+    /// <param name="isServerSpanRequired">
+    /// When <see langword="true"/>, only spans of <see cref="ActivityKind.Server"/>
+    /// satisfy a host; when <see langword="false"/>, any attributable span does.
+    /// </param>
+    public static void AssertSpanForEachHost(
+        IEnumerable<Activity> capturedActivities,
+        Activity root,
+        IReadOnlyCollection<Uri> hostBaseAddresses,
+        bool isServerSpanRequired = true)
+    {
+        ArgumentNullException.ThrowIfNull(capturedActivities);
+        ArgumentNullException.ThrowIfNull(root);
+        ArgumentNullException.ThrowIfNull(hostBaseAddresses);
+        Assert.IsGreaterThan(0, hostBaseAddresses.Count,
+            "At least one expected host base address is required.");
+
+        IReadOnlyList<Activity> inTrace = FilterByTrace(capturedActivities, root.TraceId);
+        Dictionary<ActivitySpanId, Activity> bySpanId = BuildSpanIndex(inTrace);
+
+        Dictionary<ActivitySpanId, Uri?> attributionsBySpanId = new(inTrace.Count);
+        foreach(Activity activity in inTrace)
+        {
+            attributionsBySpanId[activity.SpanId] = AttributeToHost(activity, hostBaseAddresses, bySpanId);
+        }
+
+        List<string> missingHosts = [];
+        foreach(Uri hostBaseAddress in hostBaseAddresses)
+        {
+            bool hasSpanAtHost = inTrace.Any(activity =>
+                hostBaseAddress.Equals(attributionsBySpanId[activity.SpanId])
+                && (!isServerSpanRequired || activity.Kind == ActivityKind.Server));
+
+            if(!hasSpanAtHost)
+            {
+                missingHosts.Add(hostBaseAddress.ToString());
+            }
+        }
+
+        if(missingHosts.Count > 0)
+        {
+            string observedAttributions = string.Join("; ", inTrace.Select(activity =>
+                $"'{activity.OperationName}' ({activity.Kind}) -> " +
+                $"{attributionsBySpanId[activity.SpanId]?.ToString() ?? "unattributed"}"));
+
+            Assert.Fail(
+                $"Trace '{root.TraceId}' has no {(isServerSpanRequired ? "server-side " : string.Empty)}span " +
+                $"attributable to: {string.Join(", ", missingHosts)}. Observed spans: {observedAttributions}.");
+        }
+    }
+
+
+    /// <summary>
+    /// Asserts that an event named <paramref name="eventName"/> exists in the trace
+    /// and is attached on the span identified by <paramref name="ancestorSpanId"/> or
+    /// on one of its descendants. The ancestor itself need not be captured — the
+    /// ancestor-chain walk compares span identifiers, so the test's own root span
+    /// qualifies as an ancestor.
+    /// </summary>
+    /// <param name="capturedActivities">The captured spans, typically <see cref="TraceTreeCapture.StoppedActivities"/>.</param>
+    /// <param name="root">The test's root activity; only spans in its trace participate.</param>
+    /// <param name="eventName">The exact (ordinal) <see cref="ActivityEvent.Name"/>.</param>
+    /// <param name="ancestorSpanId">The span the event must sit on or under.</param>
+    public static void AssertEventUnderAncestor(
+        IEnumerable<Activity> capturedActivities,
+        Activity root,
+        string eventName,
+        ActivitySpanId ancestorSpanId)
+    {
+        ArgumentNullException.ThrowIfNull(capturedActivities);
+        ArgumentNullException.ThrowIfNull(root);
+        ArgumentException.ThrowIfNullOrWhiteSpace(eventName);
+
+        IReadOnlyList<Activity> inTrace = FilterByTrace(capturedActivities, root.TraceId);
+        AssertEventUnderAncestorCore(inTrace, root, eventName, [ancestorSpanId], $"span '{ancestorSpanId}'");
+    }
+
+
+    /// <summary>
+    /// Asserts that an event named <paramref name="eventName"/> exists in the trace
+    /// and is attached on a captured span matching <paramref name="isAncestorMatch"/>
+    /// or on one of that span's descendants. Use this form to name the ancestor
+    /// structurally — for example the owning dispatch span by operation name and
+    /// tenant tag — instead of by span identifier.
+    /// </summary>
+    /// <param name="capturedActivities">The captured spans, typically <see cref="TraceTreeCapture.StoppedActivities"/>.</param>
+    /// <param name="root">The test's root activity; only spans in its trace participate.</param>
+    /// <param name="eventName">The exact (ordinal) <see cref="ActivityEvent.Name"/>.</param>
+    /// <param name="isAncestorMatch">Selects the captured span(s) that qualify as the ancestor.</param>
+    public static void AssertEventUnderAncestor(
+        IEnumerable<Activity> capturedActivities,
+        Activity root,
+        string eventName,
+        Func<Activity, bool> isAncestorMatch)
+    {
+        ArgumentNullException.ThrowIfNull(capturedActivities);
+        ArgumentNullException.ThrowIfNull(root);
+        ArgumentException.ThrowIfNullOrWhiteSpace(eventName);
+        ArgumentNullException.ThrowIfNull(isAncestorMatch);
+
+        IReadOnlyList<Activity> inTrace = FilterByTrace(capturedActivities, root.TraceId);
+
+        ActivitySpanId[] ancestorSpanIds = [.. inTrace
+            .Where(isAncestorMatch)
+            .Select(activity => activity.SpanId)];
+        Assert.IsGreaterThan(0, ancestorSpanIds.Length,
+            $"No captured span in trace '{root.TraceId}' matches the ancestor predicate.");
+
+        AssertEventUnderAncestorCore(inTrace, root, eventName, ancestorSpanIds,
+            $"{ancestorSpanIds.Length} predicate-matched span(s)");
+    }
+
+
+    private static void AssertEventUnderAncestorCore(
+        IReadOnlyList<Activity> inTrace,
+        Activity root,
+        string eventName,
+        IReadOnlyCollection<ActivitySpanId> ancestorSpanIds,
+        string ancestorDescription)
+    {
+        Dictionary<ActivitySpanId, Activity> bySpanId = BuildSpanIndex(inTrace);
+
+        Activity[] eventCarriers = [.. inTrace.Where(activity =>
+            activity.Events.Any(activityEvent =>
+                string.Equals(activityEvent.Name, eventName, StringComparison.Ordinal)))];
+        Assert.IsGreaterThan(0, eventCarriers.Length,
+            $"No span in trace '{root.TraceId}' carries an event named '{eventName}'.");
+
+        bool isAttachedUnderAncestor = eventCarriers.Any(carrier =>
+            ancestorSpanIds.Any(ancestorSpanId => IsSelfOrDescendantOf(carrier, ancestorSpanId, bySpanId)));
+        Assert.IsTrue(isAttachedUnderAncestor,
+            $"Event '{eventName}' occurs on {eventCarriers.Length} span(s) in trace '{root.TraceId}', " +
+            $"but none of those spans is under {ancestorDescription}.");
+    }
+
+
+    /// <summary>
+    /// Returns whether <paramref name="activity"/> is the span identified by
+    /// <paramref name="ancestorSpanId"/> or one of its descendants, walking
+    /// <see cref="Activity.ParentSpanId"/> links through the captured index. The walk
+    /// compares span identifiers, so an uncaptured ancestor (the test's root) still
+    /// terminates it; a visited-set guards against malformed parent cycles.
+    /// </summary>
+    private static bool IsSelfOrDescendantOf(
+        Activity activity,
+        ActivitySpanId ancestorSpanId,
+        Dictionary<ActivitySpanId, Activity> bySpanId)
+    {
+        if(activity.SpanId == ancestorSpanId)
+        {
+            return true;
+        }
+
+        HashSet<ActivitySpanId> visited = [activity.SpanId];
+        ActivitySpanId parentSpanId = activity.ParentSpanId;
+        while(visited.Add(parentSpanId))
+        {
+            if(parentSpanId == ancestorSpanId)
+            {
+                return true;
+            }
+
+            if(!bySpanId.TryGetValue(parentSpanId, out Activity? parent))
+            {
+                return false;
+            }
+
+            parentSpanId = parent.ParentSpanId;
+        }
+
+        return false;
+    }
+
+
+    /// <summary>
+    /// Attributes <paramref name="activity"/> to one of
+    /// <paramref name="hostBaseAddresses"/>: directly from its own url/server tags
+    /// when present, otherwise inherited from the nearest directly-attributable
+    /// ancestor (see the class remarks for why server spans rely on inheritance).
+    /// Returns <see langword="null"/> when neither the span nor any ancestor is
+    /// attributable.
+    /// </summary>
+    private static Uri? AttributeToHost(
+        Activity activity,
+        IReadOnlyCollection<Uri> hostBaseAddresses,
+        Dictionary<ActivitySpanId, Activity> bySpanId)
+    {
+        Activity? current = activity;
+        HashSet<ActivitySpanId> visited = [];
+        while(current is not null && visited.Add(current.SpanId))
+        {
+            Uri? directAttribution = AttributeDirectly(current, hostBaseAddresses);
+            if(directAttribution is not null)
+            {
+                return directAttribution;
+            }
+
+            current = bySpanId.TryGetValue(current.ParentSpanId, out Activity? parent) ? parent : null;
+        }
+
+        return null;
+    }
+
+
+    private static Uri? AttributeDirectly(Activity activity, IReadOnlyCollection<Uri> hostBaseAddresses)
+    {
+        string? urlFull = activity.GetTagItem(UrlFullTagName)?.ToString();
+        if(urlFull is not null && Uri.TryCreate(urlFull, UriKind.Absolute, out Uri? url))
+        {
+            Uri? urlMatch = MatchHostAndPort(hostBaseAddresses, url.Host, url.Port);
+            if(urlMatch is not null)
+            {
+                return urlMatch;
+            }
+        }
+
+        string? serverAddress = activity.GetTagItem(ServerAddressTagName)?.ToString();
+        if(serverAddress is not null)
+        {
+            string? serverPortText = activity.GetTagItem(ServerPortTagName)?.ToString();
+            int? serverPort =
+                int.TryParse(serverPortText, NumberStyles.None, CultureInfo.InvariantCulture, out int parsedPort)
+                    ? parsedPort
+                    : null;
+
+            return MatchHostAndPort(hostBaseAddresses, serverAddress, serverPort);
+        }
+
+        return null;
+    }
+
+
+    /// <summary>
+    /// Matches a host name (loopback designators equivalent, otherwise
+    /// ordinal-ignore-case) and port against the expected base addresses. With a port
+    /// the match is exact; without one the match holds only when a single candidate
+    /// host name matches, because in a loopback topology only the port discriminates
+    /// between hosts.
+    /// </summary>
+    private static Uri? MatchHostAndPort(IReadOnlyCollection<Uri> hostBaseAddresses, string host, int? port)
+    {
+        Uri? uniqueHostNameMatch = null;
+        foreach(Uri candidate in hostBaseAddresses)
+        {
+            bool isHostMatch = string.Equals(candidate.Host, host, StringComparison.OrdinalIgnoreCase)
+                || (IsLoopbackHostName(candidate.Host) && IsLoopbackHostName(host));
+            if(!isHostMatch)
+            {
+                continue;
+            }
+
+            if(port is not null)
+            {
+                if(candidate.Port == port.Value)
+                {
+                    return candidate;
+                }
+
+                continue;
+            }
+
+            if(uniqueHostNameMatch is not null)
+            {
+                return null;
+            }
+
+            uniqueHostNameMatch = candidate;
+        }
+
+        return uniqueHostNameMatch;
+    }
+
+
+    private static bool IsLoopbackHostName(string host) =>
+        string.Equals(host, "localhost", StringComparison.OrdinalIgnoreCase)
+            || string.Equals(host, "127.0.0.1", StringComparison.Ordinal)
+            || string.Equals(host, "::1", StringComparison.Ordinal);
+
+
+    private static Dictionary<ActivitySpanId, Activity> BuildSpanIndex(IReadOnlyList<Activity> activities)
+    {
+        Dictionary<ActivitySpanId, Activity> bySpanId = new(activities.Count);
+        foreach(Activity activity in activities)
+        {
+            bySpanId[activity.SpanId] = activity;
+        }
+
+        return bySpanId;
+    }
+}
diff --git a/test/Verifiable.Tests/TestInfrastructure/TraceTreeCapture.cs b/test/Verifiable.Tests/TestInfrastructure/TraceTreeCapture.cs
new file mode 100644
index 00000000..bed59c7b
--- /dev/null
+++ b/test/Verifiable.Tests/TestInfrastructure/TraceTreeCapture.cs
@@ -0,0 +1,122 @@
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using Verifiable.Cryptography;
+using Verifiable.Server.Diagnostics;
+
+namespace Verifiable.Tests.TestInfrastructure;
+
+/// <summary>
+/// An <see cref="ActivityListener"/> wrapper that captures every stopped
+/// <see cref="Activity"/> from an explicit, closed set of <see cref="ActivitySource"/>
+/// names so a test can reconstruct and assert one connected W3C Trace Context span
+/// tree with <see cref="TraceTreeAssertions"/>.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The source-name set is the documentation of what the captured tree covers: the
+/// ASP.NET Core server spans (<see cref="AspNetCoreSourceName"/>), the
+/// <see cref="System.Net.Http.HttpClient"/> client spans (<see cref="HttpClientSourceName"/>),
+/// the library's dispatch spans (<see cref="ServerActivitySource.SourceName"/>), and the
+/// cryptographic lifetime spans (<see cref="CryptoActivitySource.Name"/>). There is
+/// deliberately no wildcard subscription — a capture that listens to "everything"
+/// documents nothing about which instrumentation layers a connected trace must include.
+/// </para>
+/// <para>
+/// Sampling is <see cref="ActivitySamplingResult.AllDataAndRecorded"/> on both the
+/// <see cref="ActivityListener.Sample"/> and <see cref="ActivityListener.SampleUsingParentId"/>
+/// paths, so framework instrumentation populates its full tag set and marks spans
+/// recorded, which propagates the sampled flag in the <c>traceparent</c> headers the
+/// runtime injects across process-internal wire hops.
+/// </para>
+/// <para>
+/// An <see cref="ActivityListener"/> is process-wide: while an instance is alive,
+/// every concurrently running test's HTTP traffic gains framework activities and
+/// <c>traceparent</c> header injection, and those foreign spans land in this capture.
+/// Consumers therefore mark their test classes <c>[DoNotParallelize]</c> and assert
+/// only over spans filtered by their own root <see cref="Activity.TraceId"/>
+/// (<see cref="TraceTreeAssertions.FilterByTrace"/>).
+/// </para>
+/// </remarks>
+internal sealed class TraceTreeCapture: IDisposable
+{
+    private readonly ConcurrentQueue<Activity> stoppedActivities = new();
+    private readonly ActivityListener listener;
+
+    /// <summary>
+    /// The ASP.NET Core hosting <see cref="ActivitySource"/> name. It emits the
+    /// <c>Microsoft.AspNetCore.Hosting.HttpRequestIn</c> span
+    /// (<see cref="ActivityKind.Server"/>) for every request a Kestrel host processes.
+    /// </summary>
+    public static string AspNetCoreSourceName => "Microsoft.AspNetCore";
+
+    /// <summary>
+    /// The <see cref="System.Net.Http.HttpClient"/> <see cref="ActivitySource"/> name.
+    /// It emits the <c>System.Net.Http.HttpRequestOut</c> span
+    /// (<see cref="ActivityKind.Client"/>) for every outbound request, and injects the
+    /// current trace context as the <c>traceparent</c> request header.
+    /// </summary>
+    public static string HttpClientSourceName => "System.Net.Http";
+
+    /// <summary>
+    /// The default source-name set: <see cref="AspNetCoreSourceName"/>,
+    /// <see cref="HttpClientSourceName"/>, <see cref="ServerActivitySource.SourceName"/>,
+    /// and <see cref="CryptoActivitySource.Name"/>.
+    /// </summary>
+    public static IReadOnlyList<string> DefaultSourceNames { get; } =
+    [
+        AspNetCoreSourceName,
+        HttpClientSourceName,
+        ServerActivitySource.SourceName,
+        CryptoActivitySource.Name
+    ];
+
+
+    /// <summary>
+    /// Starts capturing stopped activities from <paramref name="sourceNames"/>, or from
+    /// <see cref="DefaultSourceNames"/> when <see langword="null"/>. Source names match
+    /// by ordinal equality — never by prefix or wildcard.
+    /// </summary>
+    /// <param name="sourceNames">The exact <see cref="ActivitySource"/> names to listen to.</param>
+    /// <exception cref="ArgumentException">
+    /// Thrown when <paramref name="sourceNames"/> is empty: a capture over no sources
+    /// records nothing and would silently weaken every assertion built on it.
+    /// </exception>
+    public TraceTreeCapture(IReadOnlyCollection<string>? sourceNames = null)
+    {
+        HashSet<string> subscribedSourceNames = new(sourceNames ?? DefaultSourceNames, StringComparer.Ordinal);
+        if(subscribedSourceNames.Count == 0)
+        {
+            throw new ArgumentException(
+                "At least one activity source name is required; an empty set captures nothing.",
+                nameof(sourceNames));
+        }
+
+        listener = new ActivityListener
+        {
+            ShouldListenTo = source => subscribedSourceNames.Contains(source.Name),
+            Sample = static (ref ActivityCreationOptions<ActivityContext> _) =>
+                ActivitySamplingResult.AllDataAndRecorded,
+            SampleUsingParentId = static (ref ActivityCreationOptions<string> _) =>
+                ActivitySamplingResult.AllDataAndRecorded,
+            ActivityStopped = stoppedActivities.Enqueue
+        };
+
+        ActivitySource.AddActivityListener(listener);
+    }
+
+
+    /// <summary>
+    /// A snapshot of every activity that has stopped since the capture started, in
+    /// stop order. Safe to read while requests are still in flight; spans that have
+    /// not stopped yet are absent from the snapshot, so read after the traffic under
+    /// assertion has fully completed (for example after the loopback host has drained).
+    /// </summary>
+    public IReadOnlyList<Activity> StoppedActivities => [.. stoppedActivities];
+
+
+    /// <inheritdoc/>
+    public void Dispose()
+    {
+        listener.Dispose();
+    }
+}
diff --git a/test/Verifiable.Tests/Vcalm/VcalmConformanceBridgeTests.cs b/test/Verifiable.Tests/Vcalm/VcalmConformanceBridgeTests.cs
index 60518951..3b008cc3 100644
--- a/test/Verifiable.Tests/Vcalm/VcalmConformanceBridgeTests.cs
+++ b/test/Verifiable.Tests/Vcalm/VcalmConformanceBridgeTests.cs
@@ -32,7 +32,7 @@ namespace Verifiable.Tests.Vcalm;
 
 /// <summary>
 /// The W3C VCALM 1.0 conformance bridge end-to-end test (chunk V-6a): the in-repo proof that the
-/// §3.2.1 issue and §3.3.1 verify interfaces serve over REAL Kestrel HTTP at the stable,
+/// §3.2.1 issue and §3.3.1 verify interfaces serve over REAL Kestrel HTTPS at the stable,
 /// suite-expected flat paths behind an OAuth2 client-credentials bearer gate — the exact path the
 /// external <c>vc-api-issuer-test-suite</c> / <c>vc-api-verifier-test-suite</c> JS suites would drive
 /// when pointed at this host (V-6b). The flow over the wire is:
@@ -59,7 +59,7 @@ namespace Verifiable.Tests.Vcalm;
 /// The Kestrel listener contends for sockets with the other HTTP lifecycle tests under Workers=4; it
 /// passes in isolation like <see cref="Verifiable.Tests.OAuth.MultiHostHttpLifecycleTests"/>. The
 /// VCALM signing / verification seams are the same library primitives the dispatch-level
-/// <see cref="VcalmIssuerEndpointTests"/> uses — the bridge COMPOSES them over real HTTP, it does not
+/// <see cref="VcalmIssuerEndpointTests"/> uses — the bridge COMPOSES them over real HTTPS, it does not
 /// re-roll cryptography.
 /// </para>
 /// </remarks>
@@ -132,7 +132,7 @@ public void DisposeOwnedKeys()
 
 
     /// <summary>
-    /// The bridge's money shot over real HTTP: client-credentials token → §3.2.1 issue (201) →
+    /// The bridge's money shot over real HTTPS: client-credentials token → §3.2.1 issue (201) →
     /// §3.3.1 verify (200, verified:true), every exchange across the Kestrel socket with the Bearer
     /// token; and a 401 on each protected endpoint when the token is absent or invalid.
     /// </summary>
@@ -144,7 +144,7 @@ public async Task IssueThenVerifyOverHttpWithClientCredentialsToken()
         HttpClient http = app.Host("default").SharedHttpClient!;
         Uri baseAddress = app.Host("default").HttpBaseAddress!;
 
-        //=== Step 1: obtain the client-credentials Bearer access token over HTTP. ===
+        //=== Step 1: obtain the client-credentials Bearer access token over HTTPS. ===
         string accessToken = await ObtainClientCredentialsTokenAsync(http, baseAddress).ConfigureAwait(false);
 
         //=== Step 2: POST a credential to /credentials/issue WITH the token → 201 secured VC. ===
@@ -162,7 +162,7 @@ public async Task IssueThenVerifyOverHttpWithClientCredentialsToken()
         JsonElement securedCredential = issued.RootElement.GetProperty(VcalmParameterNames.VerifiableCredential);
         Assert.AreEqual("DataIntegrityProof",
             FirstProof(securedCredential).GetProperty("type").GetString(),
-            "The §3.2.1 issue response over HTTP carries a Data Integrity proof.");
+            "The §3.2.1 issue response over HTTPS carries a Data Integrity proof.");
 
         //=== Step 3: POST that VC to /credentials/verify WITH the token → 200 verified:true. ===
         string verifyBody = "{\"verifiableCredential\":" + securedCredential.GetRawText()
@@ -177,7 +177,7 @@ public async Task IssueThenVerifyOverHttpWithClientCredentialsToken()
 
         using JsonDocument verifyDoc = JsonDocument.Parse(verifyResponseBody);
         Assert.IsTrue(verifyDoc.RootElement.GetProperty(VcalmParameterNames.Verified).GetBoolean(),
-            "A credential issued by the bridge's issuer endpoint must verify TRUE at its verifier endpoint over HTTP.");
+            "A credential issued by the bridge's issuer endpoint must verify TRUE at its verifier endpoint over HTTPS.");
     }
 
 
diff --git a/test/Verifiable.Tests/Vcalm/VcalmConformanceHttpApplication.cs b/test/Verifiable.Tests/Vcalm/VcalmConformanceHttpApplication.cs
index eac07249..cd709800 100644
--- a/test/Verifiable.Tests/Vcalm/VcalmConformanceHttpApplication.cs
+++ b/test/Verifiable.Tests/Vcalm/VcalmConformanceHttpApplication.cs
@@ -1,9 +1,7 @@
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.IO;
-using Microsoft.AspNetCore.Hosting.Server;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Features;
 using StringValues = Microsoft.Extensions.Primitives.StringValues;
 using Verifiable.Core;
 using Verifiable.JCose;
@@ -15,19 +13,21 @@
 namespace Verifiable.Tests.Vcalm;
 
 /// <summary>
-/// The Kestrel host skin for the W3C VCALM 1.0 conformance bridge (chunk V-6a). It is the analogue of
+/// The <see cref="Microsoft.AspNetCore.Builder.WebApplication"/> host skin for the W3C VCALM 1.0
+/// conformance bridge (chunk V-6a), mounted directly as its HTTPS pipeline's <c>RequestDelegate</c>
+/// (<c>app.Run(application.ProcessRequestAsync)</c>). It is the analogue of
 /// <see cref="Verifiable.Tests.OAuth.AuthorizationServerHttpApplication"/>, specialised for the
 /// external W3C <c>vc-api-issuer-test-suite</c> / <c>vc-api-verifier-test-suite</c> JS suites: it
 /// serves the §3.2.1 <c>POST /credentials/issue</c>, §3.3.1 <c>POST /credentials/verify</c>, and
 /// §3.3.2 <c>POST /presentations/verify</c> interfaces at STABLE, suite-expected URL paths over real
-/// HTTP, protected by an OAuth2 client-credentials bearer token, and exposes the AS token endpoint
+/// HTTPS, protected by an OAuth2 client-credentials bearer token, and exposes the AS token endpoint
 /// the suites obtain that token from.
 /// </summary>
 /// <remarks>
 /// <para>
-/// Test-only construct. The library does not reference Kestrel; a production VCALM deployment writes
-/// its own host adapter. The body-buffering, header-mapping, and <see cref="ServerHttpResponse"/> →
-/// HTTP behaviours are identical to
+/// Test-only construct. The library does not reference Kestrel or ASP.NET Core; a production VCALM
+/// deployment writes its own host adapter. The body-buffering, header-mapping, and
+/// <see cref="ServerHttpResponse"/> → HTTP behaviours are identical to
 /// <see cref="Verifiable.Tests.OAuth.AuthorizationServerHttpApplication"/>; this skin adds two
 /// conformance-bridge concerns on top of plain dispatch:
 /// </para>
@@ -52,7 +52,7 @@ namespace Verifiable.Tests.Vcalm;
 /// </list>
 /// </remarks>
 [DebuggerDisplay("VcalmConformanceHttpApplication Tenant={tenantSegment}")]
-internal sealed class VcalmConformanceHttpApplication: IHttpApplication<HttpContext>
+internal sealed class VcalmConformanceHttpApplication
 {
     private readonly EndpointServer server;
     private readonly string tenantSegment;
@@ -85,10 +85,6 @@ public VcalmConformanceHttpApplication(EndpointServer server, ClientRecord regis
     }
 
 
-    public HttpContext CreateContext(IFeatureCollection contextFeatures) =>
-        new DefaultHttpContext(contextFeatures);
-
-
     public async Task ProcessRequestAsync(HttpContext context)
     {
         IncomingRequest incomingRequest = await BuildIncomingRequestAsync(
@@ -129,9 +125,6 @@ await WriteResponseAsync(response, context.Response, context.RequestAborted)
     }
 
 
-    public void DisposeContext(HttpContext context, Exception? exception) { }
-
-
     /// <summary>
     /// Whether the inbound flat path addresses a protected VCALM endpoint (the issue / verify
     /// interfaces). The token endpoint is NOT protected — it mints the very token the others require.
diff --git a/test/Verifiable.Tests/WebFinger/WebFingerCrossWireFlowTests.cs b/test/Verifiable.Tests/WebFinger/WebFingerCrossWireFlowTests.cs
index 42c1275d..92a61ad0 100644
--- a/test/Verifiable.Tests/WebFinger/WebFingerCrossWireFlowTests.cs
+++ b/test/Verifiable.Tests/WebFinger/WebFingerCrossWireFlowTests.cs
@@ -1,7 +1,5 @@
-using System.Diagnostics.CodeAnalysis;
 using System.Net;
 using System.Security.Cryptography;
-using System.Security.Cryptography.X509Certificates;
 using Verifiable.Core;
 using Verifiable.Core.OutboundFetch;
 using Verifiable.DidWebs;
@@ -77,7 +75,7 @@ public async Task ResolvesAWebsHrefAcrossTheWireAndClosesTheLoopIntoDidWebsResol
         await using WebFingerHttpApplication.Host nodeA = await WebFingerHttpApplication.Host.StartAsync(
             server, TestContext.CancellationToken).ConfigureAwait(false);
 
-        using HttpClient httpClient = CreatePinnedHttpClient(nodeA.Certificate);
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(nodeA.Certificate);
         TransportSpy spy = new(GuardedHttpClientTransport.BuildSingleHopTransport(httpClient));
         WebFingerResolveDelegate resolve = WebFingerClient.BuildResolving(spy.Delegate, WebFingerJrdJsonParsing.ParseJrd);
 
@@ -139,7 +137,7 @@ public async Task WF13_ResolverReturningNullYieldsARealNotFoundOverTheSocket()
         await using WebFingerHttpApplication.Host nodeA = await WebFingerHttpApplication.Host.StartAsync(
             server, TestContext.CancellationToken).ConfigureAwait(false);
 
-        using HttpClient httpClient = CreatePinnedHttpClient(nodeA.Certificate);
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(nodeA.Certificate);
         OutboundTransportDelegate transport = GuardedHttpClientTransport.BuildSingleHopTransport(httpClient);
         WebFingerResolveDelegate resolve = WebFingerClient.BuildResolving(transport, WebFingerJrdJsonParsing.ParseJrd);
 
@@ -169,7 +167,7 @@ public async Task WF11_ARepeatedResourceParameterYieldsARealBadRequestOverTheSoc
         await using WebFingerHttpApplication.Host nodeA = await WebFingerHttpApplication.Host.StartAsync(
             server, TestContext.CancellationToken).ConfigureAwait(false);
 
-        using HttpClient httpClient = CreatePinnedHttpClient(nodeA.Certificate);
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(nodeA.Certificate);
 
         Uri target = new(
             $"{nodeA.BaseAddress.Scheme}://{nodeA.BaseAddress.Host}:{nodeA.BaseAddress.Port}{WellKnownWebFingerValues.WellKnownPath}"
@@ -205,7 +203,7 @@ public async Task WF66_AnUntrustedCertificateIsNeverAcceptedAndResolutionFails()
 
         //Pin to the TRUSTED node's certificate, then dial the IMPOSTOR node, which presents a different
         //self-signed leaf.
-        using HttpClient httpClient = CreatePinnedHttpClient(trustedNode.Certificate);
+        using HttpClient httpClient = LoopbackTls.CreatePinnedHttpClient(trustedNode.Certificate);
         OutboundTransportDelegate transport = GuardedHttpClientTransport.BuildSingleHopTransport(httpClient);
         WebFingerResolveDelegate resolve = WebFingerClient.BuildResolving(transport, WebFingerJrdJsonParsing.ParseJrd);
 
@@ -236,22 +234,6 @@ private static ExchangeContext NewLoopbackContext()
     }
 
 
-    /// <summary>
-    /// Builds an <see cref="HttpClient"/> whose TLS validation pins to <paramref name="pinnedCertificate"/>
-    /// byte-for-byte — RFC 7033 §9.1's "verify the certificate is valid" MUST, satisfied by explicit
-    /// pinning (there is no CA in this loopback topology) rather than by disabling validation.
-    /// </summary>
-    [SuppressMessage("Reliability", "CA2000:Dispose objects before losing scope",
-        Justification = "HttpClient takes ownership of the handler (default disposeHandler: true) and disposes it when the returned client is disposed via the caller's using declaration.")]
-    private static HttpClient CreatePinnedHttpClient(X509Certificate2 pinnedCertificate) =>
-        new(new HttpClientHandler
-        {
-            ServerCertificateCustomValidationCallback = (requestMessage, certificate, chain, sslPolicyErrors) =>
-                certificate is not null
-                && CryptographicOperations.FixedTimeEquals(certificate.RawData, pinnedCertificate.RawData)
-        });
-
-
     /// <summary>
     /// Wraps a single-hop <see cref="OutboundTransportDelegate"/> to record the last request/response
     /// pair the guarded fetch drove through it, without altering the exchange — used to assert wire-level
diff --git a/test/Verifiable.Tests/WebFinger/WebFingerHttpApplication.cs b/test/Verifiable.Tests/WebFinger/WebFingerHttpApplication.cs
index 3089d7c2..ee62d137 100644
--- a/test/Verifiable.Tests/WebFinger/WebFingerHttpApplication.cs
+++ b/test/Verifiable.Tests/WebFinger/WebFingerHttpApplication.cs
@@ -1,7 +1,6 @@
 using System.Collections.Concurrent;
 using System.Diagnostics;
 using System.Net;
-using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using Microsoft.AspNetCore.Builder;
@@ -303,7 +302,7 @@ public static async Task<Host> StartAsync(EndpointServer server, CancellationTok
         {
             ArgumentNullException.ThrowIfNull(server);
 
-            X509Certificate2 certificate = CreateLoopbackTestCertificate();
+            X509Certificate2 certificate = LoopbackTls.CreateServerCertificate("webfinger-loopback-test-node");
 
             WebApplicationBuilder builder = WebApplication.CreateSlimBuilder();
             builder.Logging.ClearProviders();
@@ -330,47 +329,6 @@ public static async Task<Host> StartAsync(EndpointServer server, CancellationTok
         }
 
 
-        /// <summary>
-        /// Mints a fresh, minimal self-signed leaf certificate for the loopback TLS listener. No CA
-        /// chain is minted because this topology's client pins the leaf directly (RFC 7033 §9.1) rather
-        /// than validating a chain to a trust anchor.
-        /// </summary>
-        /// <remarks>
-        /// <see cref="CertificateRequest.CreateSelfSigned"/> returns a certificate whose private key is
-        /// an EPHEMERAL, in-memory CNG key — sufficient for chain/PKI assertions elsewhere in this
-        /// repository, but the platform TLS stack refuses to use an ephemeral key as a SERVER
-        /// credential ("the platform does not support ephemeral keys"). Round-tripping through a
-        /// PKCS#12 export/reload gives the certificate a persisted key container Kestrel's
-        /// <c>SslStream</c> server authentication can actually use.
-        /// </remarks>
-        private static X509Certificate2 CreateLoopbackTestCertificate()
-        {
-            //Cert-factory carve-out: CertificateRequest requires a framework AsymmetricAlgorithm
-            //to sign the self-signed leaf certificate; this key is never converted to library
-            //PrivateKeyMemory, so it stays framework-native for its whole lifetime.
-            using ECDsa key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
-            CertificateRequest request = new("CN=webfinger-loopback-test-node", key, HashAlgorithmName.SHA256);
-
-            SubjectAlternativeNameBuilder sanBuilder = new();
-            sanBuilder.AddDnsName("localhost");
-            sanBuilder.AddIpAddress(IPAddress.Loopback);
-            request.CertificateExtensions.Add(sanBuilder.Build(critical: false));
-
-            request.CertificateExtensions.Add(
-                new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment, critical: true));
-
-            OidCollection serverAuthEku = new() { new Oid("1.3.6.1.5.5.7.3.1") };
-            request.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(serverAuthEku, critical: false));
-
-            DateTimeOffset now = TestClock.CanonicalEpoch;
-
-            using X509Certificate2 ephemeral = request.CreateSelfSigned(now.AddMinutes(-5), now.AddDays(1));
-            byte[] pfxBytes = ephemeral.Export(X509ContentType.Pfx);
-
-            return X509CertificateLoader.LoadPkcs12(pfxBytes, password: null, X509KeyStorageFlags.Exportable);
-        }
-
-
         /// <inheritdoc/>
         public async ValueTask DisposeAsync()
         {
diff --git a/test/Verifiable.Tests/packages.lock.json b/test/Verifiable.Tests/packages.lock.json
index acbfa571..6477f787 100644
--- a/test/Verifiable.Tests/packages.lock.json
+++ b/test/Verifiable.Tests/packages.lock.json
@@ -40,12 +40,12 @@
       },
       "MessagePack": {
         "type": "Direct",
-        "requested": "[3.1.4, )",
-        "resolved": "3.1.4",
-        "contentHash": "BH0wlHWmVoZpbAPyyt2Awbq30C+ZsS3eHSkYdnyUAbqVJ22fAJDzn2xTieBeoT5QlcBzp61vHcv878YJGfi3mg==",
+        "requested": "[3.1.8, )",
+        "resolved": "3.1.8",
+        "contentHash": "Qk2q+9FVxnMSp+NQ9y3SLz3HqWe7Rg3KRMHhBX28FkKUoOeP9YIU86mA4pFOxDDjUIRA9e7Ssbxs/LwWUcAzPw==",
         "dependencies": {
-          "MessagePack.Annotations": "3.1.4",
-          "MessagePackAnalyzer": "3.1.4",
+          "MessagePack.Annotations": "3.1.8",
+          "MessagePackAnalyzer": "3.1.8",
           "Microsoft.NET.StringTools": "17.11.4"
         }
       },
@@ -57,25 +57,25 @@
       },
       "Microsoft.Extensions.TimeProvider.Testing": {
         "type": "Direct",
-        "requested": "[10.7.0, )",
-        "resolved": "10.7.0",
-        "contentHash": "THd3CJ9e/ftm/3+Z69E51MQy4n46so4Zs/vUevMCYR5tjZsP+INqD4npXARVQwB2nnG+eQ8SI6ERLe/tn6gwSA=="
+        "requested": "[10.8.0, )",
+        "resolved": "10.8.0",
+        "contentHash": "xXcxGfXSO/8o7IfYK36r3eZTl9RMKAl5K6x3x6o/QQBolI0t8vsLIGmhc3HJBTd11u1uPLHz61VnOTSTmY7ZVA=="
       },
       "Microsoft.IdentityModel.Tokens": {
         "type": "Direct",
-        "requested": "[8.19.1, )",
-        "resolved": "8.19.1",
-        "contentHash": "KDiuSLXud2AFVNAOottd8ztVysfPeHyr4r8gofU3/VKUXlI7oytzGTnPsNJ/B3nui17rgz8wAdWNJOtzPjkUxw==",
+        "requested": "[8.19.2, )",
+        "resolved": "8.19.2",
+        "contentHash": "GtPC1S02uH1gOO4fQ+zRysIicKmEXaYFP8PIkdJYXqMyruYhopre4ozVHp0XiDSA0+GJvOZH9prxCPvgBMg4Ww==",
         "dependencies": {
           "Microsoft.Bcl.Cryptography": "10.0.2",
-          "Microsoft.IdentityModel.Logging": "8.19.1"
+          "Microsoft.IdentityModel.Logging": "8.19.2"
         }
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "4Iw41e2h7I4t70SJcX2GCmbyKJIlA273Cfm9RJMM050/3VBejGAG1KcthP5Z2L6SQcbfbf6BhNWO26+ZG+GzMg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "f5VCIE7AJpd5YvzNTeMGVzQIgyE9tX+AreTYwQF+REbu+DZo/2Ae+jNSwhPEYrVz6RRkd7y8ubXjk6Nn6Ka+Cg=="
       },
       "Microsoft.Reactive.Testing": {
         "type": "Direct",
@@ -172,11 +172,11 @@
       },
       "ModelContextProtocol": {
         "type": "Direct",
-        "requested": "[1.4.0, )",
-        "resolved": "1.4.0",
-        "contentHash": "CAmnAMQIMax2t9naUgyDAkVBj329EhQCiHcbfirMFNgP6ShQ8hJdJb0OLoaBpeGjkunH3IOjRXLdwXGKKwMlLA==",
+        "requested": "[1.4.1, )",
+        "resolved": "1.4.1",
+        "contentHash": "mP5hvBpoWe5EbWBqHWD09A4Dy6Pq+/vV2dumOV4uegCZcg+yqf8q8wrxtuZ3EQyXEJn9jzsnoiI/qyfJAihlZQ==",
         "dependencies": {
-          "ModelContextProtocol.Core": "1.4.0"
+          "ModelContextProtocol.Core": "1.4.1"
         }
       },
       "MSTest.TestAdapter": {
@@ -211,15 +211,15 @@
       },
       "SimpleBase": {
         "type": "Direct",
-        "requested": "[5.6.1, )",
-        "resolved": "5.6.1",
-        "contentHash": "gCexR8/Laso8JFm8myi3uJfo6NYyZElg5qgRyGHok6jFNY/wQwLJHr0D4tb6645SBV2D6L8e/xV2RMSSKXYd5Q=="
+        "requested": "[5.6.2, )",
+        "resolved": "5.6.2",
+        "contentHash": "xQFeRXI25LdFy+wGQ0HVCXw0wONI2GVDkgm9cmbNOQcr5XciryiDfPH1a3afaseTahD8ajIc8o7KIN9rcNPOdw=="
       },
       "System.CommandLine": {
         "type": "Direct",
-        "requested": "[2.0.9, )",
-        "resolved": "2.0.9",
-        "contentHash": "SW0WhEk4NFVZ4lOnsLrHQOV/7s0eTidezNybHQWXfqhuXWB17X3RXbrifeWBbUx1iu+NcYchVSufmW7svjUEnA=="
+        "requested": "[2.0.10, )",
+        "resolved": "2.0.10",
+        "contentHash": "6i1D6/U3i1f/PiXTt9pDvbJwdXEe0F2DZPup6BHzeIu5yPk/lkFzgtrJnPbj54JWUh8Y9vJeKG/TZIT6MkF8TA=="
       },
       "System.Reactive": {
         "type": "Direct",
@@ -229,14 +229,9 @@
       },
       "System.Security.Cryptography.ProtectedData": {
         "type": "Direct",
-        "requested": "[10.0.9, )",
-        "resolved": "10.0.9",
-        "contentHash": "vXp+vBQbTkMrDzUiPCxo1KvzfaAvZWuSRS2P7e5orhtV7ZuePKAB3Cqc9dH2YHUavRJyA2uWd2yrL6hl2VoJ5g=="
-      },
-      "AngleSharp": {
-        "type": "Transitive",
-        "resolved": "1.4.0",
-        "contentHash": "6ph8mpaQx0KL0COYRt0kI8MB9gSp1PtKijKMhJU//+aVFgKAJLKDesG/+26JSaVCOrHNgPf12wpfoyRcMYOeXg=="
+        "requested": "[10.0.10, )",
+        "resolved": "10.0.10",
+        "contentHash": "BKt0SQgq2lq3ESE68jkeLwv95ypANrPDtkTOIFGcnhg2aRUeUUBDrQlkVDZctrg1WenVcvn5P5XZnuYI7q6rFQ=="
       },
       "DotLiquid": {
         "type": "Transitive",
@@ -423,13 +418,13 @@
       },
       "MessagePack.Annotations": {
         "type": "Transitive",
-        "resolved": "3.1.4",
-        "contentHash": "aVWrDAkCdqxwQsz/q0ldPh2EFn48M99YUzE9OvZjMq2RNLKz4o2z88iGFvSvbMqOWRweRvKPHBJZe22PRqzslQ=="
+        "resolved": "3.1.8",
+        "contentHash": "SitOtZ4tOlAZZPF7p52M7143F+Cuz7o/aU0MrtAXX0+ZkPXzDNroOFhzzE2ogMFThsoEW/E6akXVVcBFM9ZKaw=="
       },
       "MessagePackAnalyzer": {
         "type": "Transitive",
-        "resolved": "3.1.4",
-        "contentHash": "CTaSsN/liJ7MhLCAB7Z4ZLBNuVGCq9lt2BT/cbrc9vzGv89yK3CqIA+z9T19a11eQYl9etZHL6MQJgCqECRVpg=="
+        "resolved": "3.1.8",
+        "contentHash": "Vm4g0cR4YRKRchEOmMJ0uVFU6yxdg7cJa2KHv3SUAHEsdYKvMpHMF5A1hZfsix89ymD5cmuzRnw9a6dKMcvq+Q=="
       },
       "Microsoft.ApplicationInsights": {
         "type": "Transitive",
@@ -495,15 +490,15 @@
       },
       "Microsoft.IdentityModel.Abstractions": {
         "type": "Transitive",
-        "resolved": "8.19.1",
-        "contentHash": "gFA8THIk23uNF/vMdOHnjIdXD1LyA2g12cHzMJ+Xag6WpgWLw6E/6uCXxvA0gp9d2yAvkRt3xzFzMUiO/hofnQ=="
+        "resolved": "8.19.2",
+        "contentHash": "HJbo/lnSfNHUfphPRT910poQc4T2/9+8svFLvzuaYHGAOJ2Tu+oEDqpX0BVP3BJ4OuUM1kylEKyaiX2fCAK3Cw=="
       },
       "Microsoft.IdentityModel.Logging": {
         "type": "Transitive",
-        "resolved": "8.19.1",
-        "contentHash": "H+sMrMpdbWnwkQnpb/ESkQovtOgdefmj0ecGCcP40mDKzE5i4dUYkH6599M9mWYFNGNJnTp92l/9wLubYXWimw==",
+        "resolved": "8.19.2",
+        "contentHash": "r5YLDIxGOnkVJHrqXv/iD1FM1CgGrQOdriXuvuWvTPmKbnGANhEysq9XKmN6IHjf2a+9bAGEpnoRBsAQlvJU5w==",
         "dependencies": {
-          "Microsoft.IdentityModel.Abstractions": "8.19.1"
+          "Microsoft.IdentityModel.Abstractions": "8.19.2"
         }
       },
       "Microsoft.NET.StringTools": {
@@ -567,8 +562,8 @@
       },
       "ModelContextProtocol.Core": {
         "type": "Transitive",
-        "resolved": "1.4.0",
-        "contentHash": "6ZJFQTgYwdu0IacUUTNExAY2Z+JFuTd10CPeORalQtuGPY4hdUqq0BXxTpNEP0n7ajruNsGXyCKQLP0erIZmog==",
+        "resolved": "1.4.1",
+        "contentHash": "G/hOBZkJsvF3MSy0sOvXdxca5uRe2Sb4xk7xRuTWNZI45khVBjOLo6nSzGilctIICavNVxbxUF908fLYI9RxkQ==",
         "dependencies": {
           "Microsoft.Extensions.AI.Abstractions": "10.5.2"
         }
@@ -655,9 +650,9 @@
       "verifiable": {
         "type": "Project",
         "dependencies": {
-          "ModelContextProtocol": "[1.4.0, )",
-          "SimpleBase": "[5.6.1, )",
-          "System.CommandLine": "[2.0.9, )",
+          "ModelContextProtocol": "[1.4.1, )",
+          "SimpleBase": "[5.6.2, )",
+          "System.CommandLine": "[2.0.10, )",
           "Verifiable.Cbor": "[0.0.0, )",
           "Verifiable.Core": "[0.0.0, )",
           "Verifiable.Fido2": "[0.0.0, )",
@@ -792,7 +787,7 @@
       "verifiable.microsoft": {
         "type": "Project",
         "dependencies": {
-          "System.Security.Cryptography.ProtectedData": "[10.0.9, )",
+          "System.Security.Cryptography.ProtectedData": "[10.0.10, )",
           "Verifiable.Core": "[0.0.0, )",
           "Verifiable.Foundation": "[0.0.0, )"
         }
@@ -822,12 +817,6 @@
           "Verifiable.JCose": "[0.0.0, )"
         }
       },
-      "verifiable.sidetree": {
-        "type": "Project",
-        "dependencies": {
-          "Verifiable.Core": "[0.0.0, )"
-        }
-      },
       "verifiable.tpm": {
         "type": "Project",
         "dependencies": {
@@ -851,6 +840,12 @@
           "Verifiable.Server": "[0.0.0, )"
         }
       },
+      "AngleSharp": {
+        "type": "CentralTransitive",
+        "requested": "[1.5.2, )",
+        "resolved": "1.5.2",
+        "contentHash": "LVZ7rrr6GHbhERhTgVDarVygl1e6KwE96pronA90LBOMacDhxR4lB+xYLjn/vlnUu+xbOB2RM9fuCPEx5bdyWA=="
+      },
       "BouncyCastle.Cryptography": {
         "type": "CentralTransitive",
         "requested": "[2.6.2, )",