diff --git a/docs/AI.md b/docs/AI.md
index b71f47d0..5251853e 100644
--- a/docs/AI.md
+++ b/docs/AI.md
@@ -175,9 +175,11 @@ stdout); on error it prints `{"error": "..."}`. It prints **config only, never m
 ## IDE gating behavior
 
 The IDE assistant ([ide/src/chat.ts](../ide/src/chat.ts)) resolves the policy **before** every
-request: it first calls `GET /ai/policy` (authoritative); on any error it falls back to the local
-`messagefoundry ai-policy` CLI; if that also fails it uses a conservative built-in default
-(`byo` / `code_only` / `prod`, `assist_permitted: null`) so the safe assistant still works offline.
+request: it first calls `GET /ai/policy` (authoritative, and cached on success); on any error it falls
+back to that cached authoritative policy, then to the local `messagefoundry ai-policy` CLI; if none of
+those can positively confirm a policy it uses a fail-closed built-in default (`mode: unverified`),
+which **disables** assistance rather than re-enabling BYO — a central *off* must not be bypassable by
+taking the engine offline (SEC-022).
 
 Then it applies the effective policy:
 
@@ -186,14 +188,33 @@ Then it applies the effective policy:
 | `mode == off` | **Disabled.** "AI assistance is turned off by your MessageFoundry policy." |
 | `mode == managed_claude` / `managed_claude_baa` | **Disabled.** This IDE version can't service a managed provider; it does **not** silently fall back to BYO (that would violate operator intent). |
 | `mode == byo` and `assist_permitted == false` | **Disabled.** "Your role does not include the `ai:assist` permission." |
-| `mode == byo` and `assist_permitted` is `true` **or** `null` | **Enabled** (proceeds as today). |
+| `mode == byo` and `assist_permitted` is `true` **or** `null` | **Enabled** — *unless* an authoritative `false` was previously observed; see the sticky-deny rule below. |
+| `mode == unverified` (nothing could confirm a policy) | **Disabled.** Fail-closed; see above. |
 
-**The tokenless-IDE / `assist_permitted == null` trust note.** Under BYO, `null` (RBAC not evaluable
-offline) is **allowed**. This is safe by construction: BYO sends only **code-only** context to the
-developer's own provider — it never sees the engine or any message data, so there is no PHI to
-protect with RBAC at this stage. The central *off* switch is still honored because `mode` is read
+**The `assist_permitted == null` trust note.** Under BYO, `null` (RBAC not evaluable) is **allowed**.
+This is safe by construction: BYO sends only **code-only** context to the developer's own provider —
+it never sees the engine or any message data, so there is no PHI to protect with RBAC at this stage.
+The central *off* switch is honored regardless, because `mode` is identity-independent and is read
 straight from the policy, token or not.
 
+**The IDE's gate read is authenticated (BACKLOG #330).** `assist_permitted` is computed from the
+acting identity, so a tokenless caller can only ever be told `null` and the deny row above could never
+fire. `resolveAiPolicy` therefore attaches the cached bearer — never prompting for one, and never over
+plain `http://` to a non-loopback host. Two things this does **not** change: the engine endpoint stays
+tokenless-*readable* (the `GET /ai/policy` section above is unchanged and still true), and the status
+bar's **separate**, timer-driven read of the same route stays **tokenless** — it wants only the
+identity-independent `environment`, and a bearer on that timer would keep refreshing the session's
+idle clock and make the engine's 30-minute idle timeout unreachable (CWE-613).
+
+**The sticky-deny rule (ADR 0035 AC-7).** Because `null` means "could not be evaluated" rather than
+"permitted", a fresh `null` must not *upgrade* assistance a central policy switched off: an
+authoritative `assist_permitted: false` the IDE has already observed is **retained** over a later
+`null`, so under BYO that combination resolves to **Disabled**. The rule is deliberately one-way — a
+cached `true` is *not* sticky, since fabricating a permit from stale state is the fail-open direction
+— and any evaluable `true`/`false` replaces the cached value outright, so signing in is the escape
+hatch. Anything that is not the literal `true`/`false`, **including a response that omits the field**,
+counts as "not evaluated" and never as a permit.
+
 `messagefoundry.showAiPolicy` (command **"MessageFoundry: Show AI Policy"**) displays the current
 resolved policy in the IDE.
 
diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md
index 59a79d9d..8ecc7b56 100644
--- a/docs/BACKLOG.md
+++ b/docs/BACKLOG.md
@@ -2433,7 +2433,7 @@ def route_demo_oru(msg):
 
 ## 233. Steps view move-drop logic implemented twice (model + webview)
 
-> 🔢 **Filed 2026-07-30 — not started.** Value **6/10** · Difficulty **3/10** · _quick win_. Prerequisite for #237; option (c), a differential test across both implementations, can land first on its own.
+> ✅ **SHIPPED 2026-08-04 — option (c) ONLY, by owner ruling: the divergence class is now GATED by a differential test, not eliminated.** Value **6/10** · Difficulty **3/10** · _quick win_. `ide/src/test/suite/steps-mirror.test.ts` loads the real `ide/media/stepsWebview.js` under jsdom (a new `ide/` devDependency, lock re-locked in the same commit) and asserts all ten mirrors against their `stepsModel` counterparts on **every** `ide` CI leg — 2,000 seeded generated row sets for the five pure row-array mirrors, and four hand-authored adversarial cases across all ordered (drag, target) pairs and five pointer fractions for the four DOM-bound ones. It found exactly **one** live divergence and closed it: `canDropRow` accepted a read-only `code` row as a drop target while the webview refused it, contradicting the model's own stated contract. **NOT built: options (a) and (b).** Both implementations still exist, so what closes is the *silent* half of the divergence class, not the duplication; #237's "sequenced behind #233" dependency is met by the gate rather than by de-duplication. **Stale anchors:** the `stepsModel.ts:1767` / `:1861` / `:1531` and `stepsView.ts:917` line numbers in the table and prose below are as-filed on 2026-07-30 and have since moved to `:1779` / `:1873` / `:1540` and `:957`.
 
 **Cluster:** IDE & Authoring. **Priority:** P2. **Verdict:** build (de-duplicate). **Severity:** medium — a silent-divergence class, not a visible bug.
 
@@ -2457,7 +2457,7 @@ The webview cannot import from `src/` (it is loaded as a plain script into a `de
 
 ## 234. Steps view projection refreshes on save only
 
-> 🔢 **Filed 2026-07-30 — not started. Re-framed 2026-07-30 to match the instruction that filed it.** Value **4/10** · Difficulty **3/10** · _fill-in_. This was originally recorded as "revisit — do not treat as a bug", which contradicted the owner's actual words: *"Put that fix on the backlog too."* It is a **fix**, gated on an ADR amendment — not a question about whether to act. The engineering caveat that motivated the softer framing is preserved below and is unchanged.
+> 🔢 **Filed 2026-07-30. PARTLY LANDED 2026-08-04 — the race half is fixed; the save-gate relaxation this item was filed for is STILL OPEN. Re-framed 2026-07-30 to match the instruction that filed it.** Value **4/10** · Difficulty **3/10** · _fill-in_. This was originally recorded as "revisit — do not treat as a bug", which contradicted the owner's actual words: *"Put that fix on the backlog too."* It is a **fix**, gated on an ADR amendment — not a question about whether to act. **Landed:** a user save arriving while a `lens rewrite` held the single edit slot was **discarded**, leaving the view on a pre-save projection with no signal until the next save; it is now deferred to slot release and re-projected exactly once ([ADR 0076](adr/0076-typed-action-vocabulary-action-list-lens.md) Amendment C — written **PROPOSED, not ratified**; owner ratification still needed). **Still open:** whether a *bounded relaxation* of the save gate is safe. Argue it against the corrected premise, not the old one: `render()` pipes `document.getText()` to `lens parse -` over stdin, so rows are projected from the **live buffer**, not from disk — the "stale disk content" justification the gate's own comment carried was false. The surviving reasons are re-shelling Python per keystroke and the fact that a re-projection replaces the entire webview HTML. `RERENDER_DEBOUNCE_MS` is now at `stepsView.ts:91`, not `:89` as the text below says. The engineering caveat that motivated the softer framing is preserved below and is unchanged.
 
 **Cluster:** IDE & Authoring. **Priority:** P3. **Verdict:** **build (ADR-first)** — owner asked for the fix; the save-gate it touches is a deliberate ADR 0076 §5 guardrail, so the amendment lands before the change. **Severity:** low (UX latency).
 
@@ -3095,7 +3095,7 @@ That distinction matters concretely for the ASVS record. The scorecard's absence
 
 ## 330. The IDE's `ai:assist` gate can never fire
 
-> 🔢 **Filed 2026-08-01 — not started.** Value **5/10** · Difficulty **3/10** · _fill-in_. ADR 0035's SEC-022 `ai:assist` half was never wired — `resolveAiPolicy` omits `getJson`'s token argument (`ide/src/aiPolicy.ts:78`, against the header-when-present at `ide/src/engineClient.ts:141`) so the engine can only ever answer `null` and `docs/AI.md:188` publishes a deny row no code path produces — but no PHI is at risk, the brokered path is server-gated, and the `mode` half still covers the central-off case; TypeScript in one module, ordered so the unconditional cache write at `aiPolicy.ts:79` is guarded before the bearer lands, with the status-bar reader left tokenless or the CWE-613 idle clock becomes unreachable.
+> ✅ **FIXED 2026-08-04 — ADR 0035 AC-7/AC-8 added, ADR 0110 amended.** Both defects are closed, in the load-bearing order. **(1) The guard landed first:** the write to `LAST_POLICY_KEY` now goes through a pure `mergeAuthoritativePolicy` (`ide/src/aiPolicyModel.ts`, zero imports so it is asserted node-side on every CI leg), so an answer that does not carry an evaluable `assist_permitted` can no longer overwrite a cached `false`. "Not evaluable" is deliberately wider than the literal `null`: `AiPolicyWire` is a compile-time claim `JSON.parse` does not enforce, so a 200 that OMITS the field arrives as `undefined` — which a `=== null` guard would let through, and which is not `false` either, so the cache would be poisoned past recovery. The bit is narrowed at the boundary (`evaluatedPermission`) on both authoritative paths, the engine read and the CLI fallback. The retention is one-way by design — a cached `true` is **not** sticky (fabricating a permit is the fail-open direction), an evaluable `true`/`false` always wins outright, and `mode` always comes fresh so a central `off`→`byo` re-enable still propagates. **(2) Then the bearer:** `resolveAiPolicy` attaches the cached token via `peekToken` (never `ensureToken` — a chat turn must not pop a sign-in modal) behind the SEC-005 `assertTargetAllowed` gate, so the engine can resolve the identity-dependent `assist_permitted` and the `ai:assist` deny branch can fire at all. The two orderings are not equivalent: attaching the bearer first would open a window in which an authenticated-but-degrading read poisons the cache. **`statusBar.ts`'s `/ai/policy` read stays TOKENLESS** — the two readers are now the named constants `ENVIRONMENT_PLAN` (`authenticated: false`, timer-driven, wants the identity-independent `environment`) and `ASSIST_GATE_PLAN` (`authenticated: true`, user-initiated only), same route and opposite answer, both asserted in CI so a later reader cannot "unify" them into the CWE-613 bug. 20 new tests (`ai-policy-model.test.ts`, `ai-policy.test.ts`, `engine-doctor.test.ts`, `engine-client.test.ts`), each falsified against a planted defect. **Residuals, deliberately not closed here:** (a) nothing constructs `EngineStatusBar`, so the status bar's tokenlessness is asserted on the plan CONSTANT, not on `readEnvironment`'s use of it — rewiring that call site would type-check and stay green (recorded in ADR 0035 AC-8); (b) the cache is one global key while the bearer is keyed per engine URL, so a deny observed against one engine also suppresses assistance against another (fail-closed, recorded in AC-7); and (c) the bearer is looked up under `engineUrl()`, but sign-in happens against the status-bar/promote target, which is `environments()[0].url` whenever `messagefoundry.environments` is configured — so for a user whose only session is against a named environment URL the read is still unattributed and the gate still cannot fire for them. Retargeting `resolveAiPolicy` changes WHICH engine the policy is read from, a behaviour change this item does not ask for; it needs its own number.
 
 **Cluster:** Security & Compliance / IDE & Authoring. **Priority:** P2. **Verdict:** build. **Severity:** medium.
 
@@ -3612,7 +3612,7 @@ What is NOT settled is the mechanism. Two independent passes reached different a
 ---
 ## 341. Handler returning a tuple or set of Sends delivers nothing, silently
 
-> 🚧 **Status OPEN (filed 2026-08-01).** Value **9/10** · Difficulty **3/10** · _quick win_. `_partition` ([pipeline/dryrun.py:112](../messagefoundry/pipeline/dryrun.py)) narrows with `items = result if isinstance(result, list) else [result]`. A **`list`** of `Send`s works; a **tuple** or **set** does not — the container itself becomes the single item, matches none of the three `isinstance` filters, and yields `([], [], [])`. **Verified live:** `_partition((send, send))[0] == []`. The Handler ran, returned deliveries, and **nothing is delivered and nothing errors** — the message finalizes `FILTERED` (every handler ran but delivered nothing), which is indistinguishable from a handler deliberately declining it. That is an **accept-and-drop**, the one thing CLAUDE.md §12 forbids outright.
+> ✅ **Status CLOSED (built 2026-08-04) — WIDEN, not raise.** `_partition` no longer narrows on `isinstance(result, list)`: a Handler may return **any non-`str` iterable** of `Send`/`SetState`/`SetMeta` — list, tuple, set or generator — and it partitions element-wise. **The body's "Fix direction (not yet decided) … failing loud is probably right" is settled the other way**, by owner ruling. THE acceptance criterion holds: `return []` and `return ()` still **filter** (deliver nothing, raise nothing), and a value that is not a container — a bare `int`, a `Message` returned by mistake — still drops silently rather than newly raising, because the gate is `isinstance(…, Iterable)` and never a duck-typed `list(result)` (`Message` has `__getitem__(path: str)` and no `__iter__`, so `list()` would raise out of the handler). **The body's "Fixing `_partition` fixes both modes at once" is FALSE and was the most dangerous sentence in this item** — acting on it would have shipped a MODE-DEPENDENT disposition (in-process delivers, `[sandbox].mode=subprocess` still drops), worse than the bug it closes. One shared rule (`wiring.handler_result_items`) is now applied in three places: the parent's `_partition`, `_sandbox_codec.enc_result`, and `_sandbox_worker` **inside** `with run_contexts(…)` — the last because a generator Handler's body runs lazily, and materialising it at describe time would execute it with no run context, so a `code_set(…)` inside one would raise under subprocess while working under off. **Two author-visible facts the body does not carry.** (1) A **`set` delivers but has no defined fan-out order** — `Send` is hashed on its fields and `str` hashing is seeded per process, so order differs between processes (parent vs sandbox child) and across a crash re-run, i.e. a set gives up FIFO order between sibling `Send`s to one outbound; mode parity is over the delivered **multiset** plus an *ordered* container's order, and the docs steer authors to a list/tuple. (2) A **generator Handler is not execution-traced** — its body runs after the ADR 0072 tracer detaches, so that invocation reports no lines and no sends, now declared as `"lazy_result": true` rather than left to read as an inert handler; **this change opened that gap** (before it, a generator delivered nothing, so the trace's `[]` was exact). ADR 0072 §6 gate 1 is split by level and amended accordingly; ADR 0087's parity bullet + AC-11 rescoped; ADR 0108's §2 invariant and §7 tuple rationale corrected (its refusal **stands**, on conservative scope — nothing 0108 built changed); `checks.py`'s `accepts=` advisory widened to recognize `return ()`, which `lens.py` already did. **`pipeline/dryrun.py:112`, the anchor cited below, no longer holds that line.**
 
 > **OWNER RULING 2026-08-04 — WIDEN. Supersedes an earlier ruling on this item that said RAISE.**
 > A Handler returning a tuple, set or generator of `Send`s is **accepted**, like a list. It does not raise.
diff --git a/docs/CONNECTIONS.md b/docs/CONNECTIONS.md
index 0342d437..cd4219f8 100644
--- a/docs/CONNECTIONS.md
+++ b/docs/CONNECTIONS.md
@@ -202,10 +202,27 @@ real transform) is also fine as a **single module** — the shipped `IB_ACME_ADT
 non-trivial transform logic.
 
 A **router fans out** by returning multiple handler names (`return ["to_a", "to_b"]`); a **single
-handler fans out** by returning multiple `Send`s (`return [Send("OB_A", msg), Send("OB_B", msg)]`).
+handler fans out** by returning multiple `Send`s (`return [Send("OB_A", msg), Send("OB_B", msg)]`) —
+a list is the idiom shown throughout these docs, but **any non-`str` iterable** delivers the same
+`Send`s (a tuple, a set, or a generator that `yield`s them). An **empty** one (`return []` /
+`return ()`) is the filter: nothing is delivered and the message is logged `FILTERED`.
 Namespace router/handler names uniquely (e.g. by site/partner) — `messagefoundry check` flags a
 duplicate name (across **any** of these files) and an inbound that binds a router that doesn't exist.
 
+> **Prefer a list, tuple or generator — they have an order; a `set` does not.** Fan-out is delivered
+> in iteration order, and a `set`'s iteration order is not defined: it varies from process to process
+> (`Send` hashes on its fields, and string hashing is seeded per process). Two `Send`s to the **same**
+> outbound therefore queue in an arbitrary relative order, and a re-run after a crash — a different
+> process — can queue them in a different one, so a `set` gives up both FIFO order between siblings and
+> the identical-output-on-re-run property the staged pipeline leans on (CLAUDE.md §2). Which `Send`s
+> are delivered is unaffected. **Use an ordered container whenever order matters.**
+>
+> A **generator** Handler delivers exactly like a list, but its body runs *after* the execution tracer
+> behind `dryrun --trace` (and the Test Bench that reads it) has detached. That invocation's trace
+> record therefore carries no executed lines and no sends, marked `"lazy_result": true` so the omission
+> is declared rather than read as a handler that did nothing; the run's message-level `sends` are still
+> exact. Return a list or tuple if you want the handler's body traced line-by-line.
+
 > **Transforms & HL7 escaping.** Writing a **component/subcomponent** (`msg["PID-5.1"] = value`)
 > stores `value` as a literal: HL7 delimiters in it (`^ ~ & |`) are **escaped** so they stay data
 > (`"O^Brien"` remains one component, not two). To build *multiple* components, write the whole
diff --git a/docs/USER-GUIDE.md b/docs/USER-GUIDE.md
index 0906c9a1..a755c92c 100644
--- a/docs/USER-GUIDE.md
+++ b/docs/USER-GUIDE.md
@@ -377,7 +377,7 @@ The Router name (`"adt_router"`) is what an inbound Connection binds to: `inboun
 
 ### 2. Write a Handler (`@handler`)
 
-A Handler receives the message from a Router, then **filters → transforms → returns `Send`(s)**. Return `None` to filter the message out (logged `FILTERED`); return one `Send` or a list to fan out to multiple outbound connections.
+A Handler receives the message from a Router, then **filters → transforms → returns `Send`(s)**. Return `None` to filter the message out (logged `FILTERED`); return one `Send`, or any non-`str` iterable of them, to fan out to multiple outbound connections.
 
 From [samples/config/adt.py](../samples/config/adt.py):
 
@@ -392,7 +392,9 @@ def archive(msg):
     return Send("FILE-OUT_Test_ADT", msg)
 ```
 
-The `Send` target (`"FILE-OUT_Test_ADT"`) names an `outbound(...)` Connection declared in the same config. To fan out, return a list — e.g. [samples/results_relay/results_relay.py](../samples/results_relay/results_relay.py) ends with `return [Send(OB_EHR, msg), Send(FILE_ARCHIVE, msg)]`.
+The `Send` target (`"FILE-OUT_Test_ADT"`) names an `outbound(...)` Connection declared in the same config. To fan out, return a container of `Send`s — e.g. [samples/results_relay/results_relay.py](../samples/results_relay/results_relay.py) ends with `return [Send(OB_EHR, msg), Send(FILE_ARCHIVE, msg)]`. A **list** is the idiom used throughout these docs, but a tuple, a set, or a generator that `yield`s its `Send`s all deliver the same `Send`s; an **empty** container (`return []` / `return ()`) is the filter, exactly like `return None`.
+
+> **Two caveats on the less common shapes.** Fan-out is delivered in iteration order, and a **`set`** has no defined iteration order — it varies per process, so sibling `Send`s to the same outbound queue in an arbitrary order that a crash re-run can change. Use a list or tuple when order matters. And a **generator** Handler's body runs after the `dryrun --trace` execution tracer has detached, so its trace record shows no executed lines and no sends and is marked `"lazy_result": true` (the run's message-level `sends` are still exact) — return a list or tuple if you want it traced line-by-line. Both are documented in full in [CONNECTIONS.md](CONNECTIONS.md).
 
 ### 3. The `Message` operations you'll use
 
diff --git a/docs/adr/0035-ide-extension-workspace-trust-and-scope.md b/docs/adr/0035-ide-extension-workspace-trust-and-scope.md
index 65b2fbca..5240bae1 100644
--- a/docs/adr/0035-ide-extension-workspace-trust-and-scope.md
+++ b/docs/adr/0035-ide-extension-workspace-trust-and-scope.md
@@ -2,7 +2,7 @@
 
 - **Status:** Accepted  <!-- Proposed (no code yet) → Accepted (build may start) → Superseded by NNNN / Rejected -->
 - **Date:** 2026-06-26
-- **Related:** ADR 0007 (GUI-manageable connections.toml) · ADR 0024 (AI policy) · CLAUDE.md §9 (PHI/HIPAA), §10 (Console) · SEC-004, SEC-005, SEC-022
+- **Related:** ADR 0007 (GUI-manageable connections.toml) · docs/AI.md (the AI policy model) · ADR 0135 (the engine-brokered path) · CLAUDE.md §9 (PHI/HIPAA), §10 (Console) · SEC-004, SEC-005, SEC-022
 
 ---
 
@@ -74,6 +74,48 @@ online-permitted BYO assistant all keep working.
 - **AC-6** — WHEN the engine policy is read successfully, THE EXTENSION SHALL cache it so a
   previously-seen central "off" is not overridable by going offline.
   → `ide/src/test/suite/ai-policy.test.ts` (`pickOfflinePolicy` cached-wins case)
+- **AC-7** — WHEN the engine's answer to `GET /ai/policy` does NOT carry an evaluable
+  `assist_permitted` (the literal `true` or `false`) AND a cached authoritative policy holds
+  `assist_permitted: false`, THE EXTENSION SHALL retain the `false` in both the returned and the cached
+  policy, and SHALL NOT retain a cached `true` the same way.
+  → `ide/src/test/suite/ai-policy-model.test.ts` (the pure rule, node-side on every leg) +
+  `ide/src/test/suite/ai-policy.test.ts` (the cache write)
+  <br>The asymmetry is the decision: `assist_permitted` is identity-dependent, so a non-answer means
+  "could not be evaluated", and a degraded read must not *upgrade* assistance a central policy switched
+  off. A cached `true` is deliberately **not** sticky — a non-answer under BYO is allowed by design
+  (docs/AI.md, *"the `assist_permitted == null` trust note"*), so carrying a permit forward would
+  fabricate one, which is the fail-open direction.
+  <br>**"Not evaluable" is wider than `null` on purpose.** `AiPolicyWire` is a compile-time claim about
+  a response and `JSON.parse` does not enforce it, so a 200 that merely OMITS the field arrives as
+  `undefined`. A guard keyed on the literal `null` would let that through — and because `undefined` is
+  not `false` either, the cache would be poisoned so no later answer could restore the deny. The bit is
+  therefore narrowed at the boundary (`evaluatedPermission`), and only `true`/`false` count as answers.
+  <br>**Accepted consequences**, stated as decisions rather than surprises: (a) the deny is one-way
+  until an evaluable answer replaces it, so a user granted `ai:assist` later, who holds no valid
+  session, sees assistance disabled until the engine answers `true` for them — the escape hatch is
+  signing in, as there is no "clear cached policy" command; and (b) the cache is a **single global
+  key**, not keyed per engine URL as the bearer is, so a deny observed against one engine also
+  suppresses assistance against another until an evaluable answer arrives from it. Both are the
+  fail-CLOSED direction, which is why they are accepted here rather than treated as defects.
+- **AC-8** — WHEN `resolveAiPolicy` reads the authoritative policy, THE EXTENSION SHALL attach the
+  cached bearer (never prompting for one) so `assist_permitted` is resolvable for the acting user, and
+  SHALL NOT attach it to a non-loopback plain-`http://` target. The status bar's periodic `/ai/policy`
+  environment read SHALL be expressed as an `authenticated: false` plan constant.
+  → `ide/src/test/suite/ai-policy.test.ts` (the bearer reaches the request; `peekToken` by identity) +
+  `ide/src/test/suite/engine-client.test.ts` (the `Authorization` header, both polarities) +
+  `ide/src/test/suite/engine-doctor.test.ts` (`ASSIST_GATE_PLAN` / `ENVIRONMENT_PLAN`)
+  <br>The two `/ai/policy` readers give opposite answers about the bearer *on purpose*: the status
+  bar's read is timer-driven and wants the identity-independent `environment`, where a bearer would
+  defeat the engine's idle timeout (CWE-613, ADR 0110 §2); this one is user-initiated and wants the
+  identity-dependent `assist_permitted`, which no tokenless caller can ever receive. Both are expressed
+  as CI-asserted plan constants rather than call-site arguments.
+  <br>**Known gap in the evidence, recorded rather than papered over.** The third clause is deliberately
+  written about the CONSTANT, because that is all the tests pin. No suite constructs `EngineStatusBar`,
+  so nothing asserts that `readEnvironment` actually *uses* `ENVIRONMENT_PLAN` — rewiring that call site
+  to send a bearer would type-check and leave every test green. The constant is load-bearing only given
+  the call site reads it (`runProbe` attaches a bearer iff `entry.authenticated`), which is verified by
+  reading. Closing it needs an injectable-fetch seam on `EngineStatusBar` asserting `token === undefined`;
+  that is a test-infrastructure change beyond BACKLOG #330 and wants its own item.
 
 ## Options considered
 
diff --git a/docs/adr/0072-traced-dryrun-mode.md b/docs/adr/0072-traced-dryrun-mode.md
index 037f12de..165e1dbd 100644
--- a/docs/adr/0072-traced-dryrun-mode.md
+++ b/docs/adr/0072-traced-dryrun-mode.md
@@ -1,6 +1,6 @@
 # ADR 0072 — Traced dry-run mode: `dryrun --trace json` for the interactive live-debug loop
 
-**Status:** Accepted (2026-07-06). Ratified by the owner — the engine lane (MULTISESSION-PLAN-7 **L5**) may build. The traced mode is **additive + opt-in**; nothing here changes the shipped `dryrun` default. The §6 test gates are the acceptance criteria (byte-identical run · live-lookup identical · coverage-intact · redacted-by-default).
+**Status:** Accepted (2026-07-06). Ratified by the owner — the engine lane (MULTISESSION-PLAN-7 **L5**) may build. The traced mode is **additive + opt-in**; nothing here changes the shipped `dryrun` default. The §6 test gates are the acceptance criteria (byte-identical run · live-lookup identical · coverage-intact · redacted-by-default). **Amended 2026-08-04 (BACKLOG #341)** — gate 1 stated a single byte-identical equality; the repo reads it at two levels (message-level and per-invocation), and widening `_partition` to fan out any non-`str` iterable made a **generator Handler** deliver where it previously delivered nothing, which the per-invocation mirror cannot observe. Gate 1 in §6 is split by level and given an explicit generator carve-out, and §3 gains the `lazy_result` field that declares it. The message-level guarantee — the one the ADR exists to make — is **unchanged and still absolute**.
 **Deciders:** owner + IDE/DX working group
 **Related:** BACKLOG **#92** (interactive live-debug loop — the primary consumer, v2), BACKLOG **#84** (Test Bench profiling/coverage — the second consumer), BACKLOG **#48** (Insert Element palette — sibling DX lane), ADR 0004 (payload-agnostic ingress — `RawMessage` vs `Message` in a handler), ADR 0010/0043 (`db_lookup`/`fhir_lookup` — the sanctioned non-pure reads that raise in dry-run), CLAUDE.md §9 (PHI handling — `dryrun` output can contain full bodies). Plan: [`docs/releases/MULTISESSION-PLAN-7.md`](../releases/MULTISESSION-PLAN-7.md) (L5 builds this; L6/L7 consume it).
 **Code references** are `origin/main @ 0f0ba08`; line numbers are approximate — locate exactly at implementation time.
@@ -43,6 +43,7 @@ Emitted as JSON (streamed — see §5). One object per Router/Handler invocation
   "disposition": "PROCESSED" | "ROUTED" | "UNROUTED" | "FILTERED" | "ERROR",
   "sends": [ { "outbound": "<name>" }, ... ],   // handler only
   "routed_to": [ "<handler name>", ... ],       // router only
+  "lazy_result": true,                          // OPTIONAL, absent unless true — see below
   "annotations": [
     { "line": <int>, "kind": "live_lookup_skipped",
       "call": "db_lookup" | "fhir_lookup" }
@@ -50,6 +51,8 @@ Emitted as JSON (streamed — see §5). One object per Router/Handler invocation
 }
 ```
 
+- **`lazy_result` (added 2026-08-04, BACKLOG #341).** A **generator** Router/Handler returns without running its body; the body runs when the engine materialises the generator, which is *after* this tracer has restored `sys.settrace`. Such an invocation therefore has **no line events** and its `sends`/`routed_to` are **not measurable** — the tracer must not drain a one-shot iterator to find out, because that would leave the real run nothing to materialise and turn the traced run into a 0-delivery run (gate 1, §6). The invocation is flagged `"lazy_result": true` so a consumer renders *"this body was not traced"* rather than an apparently inert handler; the **message-level** `sends`/`handlers` are computed by the real run and stay exact. Return a list or tuple to get a line-by-line trace.
+
 - **Value-capture timing.** `sys.settrace` `"line"` events fire on line *entry*, so a value assigned on line *N* is only observable once the tracer reaches line *N+1*. The tracer therefore reports a **locals-diff per line** (`assigned` = locals that changed since the previous line event), and attributes each change to the line that produced it. This is deterministic and needs no AST rewrite; an AST-assisted refinement is a possible v2 (§7), out of scope here.
 - **`msg` mutations.** Field writes (`msg[...] = …` / `msg.set(...)`) surface as a change to the `msg` object; the tracer records the **path + new value** written on that line (not the whole message), so the IDE can annotate `msg["PID-5.1"] ▸ "SMITH"`. Whole-payload before/after stays the Test Bench's job (L4), not the trace's.
 - **Scope.** Events are captured **only** for frames inside the config module's Router/Handler (by `co_filename` + the def's line range); calls into engine/library code return `None` from the trace function (not traced) — the annotation surface is the author's own code, nothing else.
@@ -79,7 +82,10 @@ The sanctioned non-pure reads (ADR 0010/0043) are **unavailable in dry-run and r
 **Costs / risks:** a `sys.settrace` pass slows the traced handler (acceptable — dry-run is a dev-time preview, not the hot path). The trace function is correctness-sensitive (prior-tracer restore, thread-locality) — hence the mandatory §5 rules and the §6 test gates.
 
 **Test gates (L5 `tests/`):**
-1. **Byte-identical:** a `--trace` run's `disposition` + `sends`/`routed_to` equal the non-traced run's for the same sample.
+1. **Byte-identical (amended 2026-08-04 — stated by level):**
+   - **1a — message level (absolute, no exceptions).** A `--trace` run's top-level `disposition` + `sends` + `handlers` equal the non-traced run's for the same sample. This is the guarantee the ADR exists to make: installing the tracer must never change what the engine would do. It holds for **every** Router/Handler shape, generators included.
+   - **1b — per-invocation mirror (best-effort, degradation declared).** Each invocation's `sends`/`routed_to` mirror what that Router/Handler returned. **Carve-out:** where the Router/Handler is a **generator**, its body has not run at record time and the tracer refuses to consume the one-shot iterator (draining it is what would break 1a), so its `sends`/`routed_to` are `[]` and its `events` are `[]`. That invocation SHALL carry `"lazy_result": true` (§3), and 1a SHALL still hold — the under-report is **declared, bounded, and never a mis-report**: the trace may say less than the run did, never something different. → `tests/test_dryrun_trace.py::test_gate_1a_a_generator_handler_traces_byte_identically_at_message_level`, `tests/test_dryrun_trace.py::test_gate_1b_a_generator_invocation_declares_lazy_result` — the pair pins both halves, so the documented under-report cannot silently become a mis-report, and deleting the `_sends_from` iterator guard reddens 1a.
+   - *Why this is an amendment and not a discovered bug:* before BACKLOG #341 a generator Handler delivered **nothing**, so reporting no sends was exact and 1a and 1b agreed trivially. Widening `_partition` to fan out any non-`str` iterable made a generator Handler deliver — a change to the engine, made by that item, which opened the gap on the Handler half. The Router half has had it since this ADR shipped.
 2. **Live-lookup identical:** a handler hitting an unstubbed `db_lookup` yields identical disposition/Sends **with and without** `--trace`, plus a `live_lookup_skipped` annotation.
 3. **Coverage-intact:** a traced run executed **under `pytest-cov`** leaves the outer coverage data intact (proves the prior tracer was restored).
 4. **PHI-redacted-by-default:** values are `REDACTED` without the show-PHI opt-in.
diff --git a/docs/adr/0076-typed-action-vocabulary-action-list-lens.md b/docs/adr/0076-typed-action-vocabulary-action-list-lens.md
index fbfdd3d4..2ac018dc 100644
--- a/docs/adr/0076-typed-action-vocabulary-action-list-lens.md
+++ b/docs/adr/0076-typed-action-vocabulary-action-list-lens.md
@@ -290,8 +290,10 @@ the comment merged into an unrelated row. **The build lands failing tests for (1
   `delete_row` would begin failing with "internal: could not locate the statement" on **every** action
   that has a leading comment. Attachment ("a statement travels with its leading comment block") is a
   separate, larger item and is gated on BACKLOG #233 — `blockExtent` / `walkMove` / `resolveDrop` are
-  implemented twice (`ide/src/stepsModel.ts:1767` vs `ide/media/stepsWebview.js:68`) with no
-  differential test.
+  implemented twice (`blockExtent` in `ide/src/stepsModel.ts` vs `ide/media/stepsWebview.js:68`) with no
+  differential test. *(2026-08-04: the "no differential test" half is closed —
+  `ide/src/test/suite/steps-mirror.test.ts` is that test. The duplication itself stands; the owner chose
+  the differential gate over de-duplication.)*
 - **No inline/trailing-comment extraction.** Verified working today: `set_params` on
   `msg.set("PID-3.1", "X")  # noqa: E501` preserves the pragma exactly, and interior comments in a
   multi-line call are absorbed into the action row's span. A note kind must not touch either.
@@ -539,3 +541,116 @@ Acceptance Criteria bucket. Promote to the block above if and when the owner acc
 - **AC-D5** — Descended rows SHALL either carry live values (requiring an accepted ADR 0072 amendment
   widening the tracer's frame scope) or SHALL render an explicit "not traced" state distinguishable from
   PHI redaction — never a redacted placeholder that can never resolve.
+
+## Amendment C (2026-08-04) — the update-loop guard DEFERS a save-triggered re-projection instead of dropping it (BACKLOG #234)
+
+> **Status of this amendment: PROPOSED — not ratified.** It is written and built because BACKLOG #234
+> requires the guardrail it touches to be re-argued in a dated amendment in the same change, not because
+> the owner has ruled on it; ratification is an owner decision, and until it lands this section follows
+> Amendment B's convention (its acceptance criteria sit under a distinct heading, outside this ADR's
+> counted Acceptance Criteria bucket).
+>
+> **What it claims:** it **strengthens** the §5 "sync on save only" guardrail and does **not** relax it.
+> The projection still syncs on save and on save only. What changes is what happens to a save that
+> arrives while a `lens rewrite` holds the single edit slot: it is now **deferred to slot release**
+> instead of being **silently discarded**. Nothing here widens the sync trigger, adds a keystroke path,
+> or touches the #225 live-value save gate.
+
+### C.1 The defect
+
+`EditLoopGuard.shouldReactToDocumentChange()` returns `false` while an edit is in flight — the correct
+answer for the `WorkspaceEdit` the provider itself is applying, which must not feed back into a re-render
+that fights the webview (the update loop §5's guardrail set exists to break).
+
+The provider's save subscription consumed that answer as an unconditional **return**. But the guard
+cannot distinguish *our own* `WorkspaceEdit` from a *user* save that merely happened to land inside an
+in-flight rewrite — and on that second case the early return **dropped the save**. The view would then
+keep rendering a projection of the pre-save buffer with no signal, until the user saved again. On the
+shipped code this would surface on first deployment as "I saved and the Steps view did not update";
+there are no deployments today, which is why there is still time to fix it properly rather than
+document it.
+
+### C.2 The change
+
+- `EditLoopGuard` gains `noteSuppressedChange()` / `takeSuppressedChange()` — a single clear-on-read
+  boolean, mirroring the existing `queue()` / `takePending()` shape. One boolean, not a queue: a
+  re-projection reads the whole buffer, so any number of suppressed saves owe exactly **one** refresh.
+- A new pure `releaseEdit(guard, onRefreshOwed?)` is **the only sanctioned way to release the slot**:
+  it calls `endEdit()` and then, only if a change was suppressed, invokes the callback. `drainEdits`
+  releases through it in its `finally`, including on the unexpected-rejection path.
+- The provider records the debt in the save subscription's guard-rejected branch and pays it through the
+  **same 250 ms debounced `render()`** a real save uses — so a deferred refresh coalesces with a
+  subsequent save exactly like two rapid saves do, rather than adding a second, differently-timed render.
+- That channel is a pure `RerenderDebouncer` (in `stepsModel.ts`, timer functions injected) with two
+  operations: `schedule()` and **`cancel()`**. **A re-projection DISCHARGES an owed refresh** — it reads
+  the whole current buffer, so the run starting now already satisfies whatever was owed — and `render()`
+  therefore begins by discharging both routes, synchronously, before its `lens parse` await (so a save
+  landing mid-render is recorded afresh and still honoured):
+  - `rerender.cancel()`, for the release-then-force order. Three of the four release sites
+    (`applyStructural`, `applyPickedEdit`, `applyUndoRedo`) release the slot and then FORCE a full
+    re-projection a few lines later; without the cancel a suppressed save produces **two** — the forced
+    one, then the armed one ~250 ms afterwards, replacing the whole webview HTML again.
+  - `guard.takeSuppressedChange()`, for the force-then-release order. `drainEdits`' unexpected-rejection
+    handler renders to revert the optimistic webview change *inside* the drain, and only then does the
+    `finally` release; nothing is armed yet, so a cancel cannot reach that path.
+  The paths that return BEFORE any render (a `lens rewrite` refusal, a disposed panel) reach neither
+  discharge, which is exactly where the deferral is the only route.
+- A source-scan test asserts `ide/src/stepsView.ts` contains no bare `guard.endEdit()`, so a future
+  fourth release site cannot silently reintroduce the drop, and that `render()` opens with both
+  discharges.
+
+### C.3 Guardrail accounting (what is NOT changed)
+
+- **"Sync on save only" stands.** No keystroke, `onDidChangeTextDocument`, or timer path is added. The
+  deferred refresh is a *save* that already happened; it is being honoured late, not invented.
+- **"One editor at a time" stands.** The slot semantics are untouched; `releaseEdit` releases exactly
+  when `endEdit()` did.
+- **The update-loop guard stands.** `shouldReactToDocumentChange()` still returns `false` in flight, so
+  our own `WorkspaceEdit` still cannot trigger a re-render. The deferral fires *after* the slot frees,
+  which is precisely when a re-render is safe.
+- **`clearPending()` is unchanged and NOT folded in.** Dropping a queued *param edit* on a structural op
+  (the orphaned-queue rule, §5 v2) and deferring a *document refresh* are different rules with different
+  reasons; both release sites keep their existing `clearPending()` / `takePending()` behaviour.
+- **The #225 live-value save gate is untouched** — an explicit non-goal of BACKLOG #234.
+
+### C.4 A correction this amendment depends on
+
+The comment in `ide/src/stepsView.ts` that justified the save gate claimed "`lens parse` reads the file
+from disk, so re-projecting on every keystroke would slice the current (dirty) buffer against line ranges
+computed from stale disk content". **That premise is false**, and is corrected in the same change:
+`render()` pipes `document.getText()` to `lens parse -` over stdin and slices that same snapshot for the
+view models, exactly as this ADR's 2026-07-10 addendum states ("the rows are projected from the **live
+buffer**"). The disk read belongs to the live-value **trace**, which is separately save-gated by #225.
+
+This matters beyond tidiness: BACKLOG #234's *other* half asks whether a bounded relaxation of the save
+gate is safe, and that question was about to be argued against a premise that does not hold. A
+compensating control must not rest on a false premise (CLAUDE.md §11). The real, surviving reasons for
+the gate are re-shelling Python per keystroke and the fact that each re-projection replaces the entire
+webview HTML — which would destroy focus, selection and any half-typed input mid-word.
+
+**Deliberately not decided here.** Whether to relax the gate to a debounced re-projection on *change* is
+BACKLOG #234's remaining half. It stays open, and it should be decided against the corrected premise
+above rather than the false one. This amendment lands the race fix **first**, on purpose: the dropped
+refresh is a defect under the current gate and would widen materially under any relaxation.
+
+## Acceptance Criteria (Amendment C — proposed, not ratified; deliberately outside the counted block)
+
+*(Same convention as Amendment B: kept under a distinct heading so unratified criteria do not merge into
+this ADR's accepted Acceptance Criteria bucket. Promote to the block above if and when the owner
+accepts. The criteria are nonetheless **built and tested** — the amendment lands with its gate.)*
+
+- **AC-C1** — WHILE an edit holds the single edit slot, WHEN a document save for the projected document
+  is observed, THE SYSTEM SHALL record it and SHALL NOT re-project immediately → guard unit test refs.
+- **AC-C2** — WHEN the edit slot is released after one or more suppressed saves, THE SYSTEM SHALL run
+  exactly ONE re-projection, in EITHER order relative to a forced one: the deferred run goes through the
+  same debounced channel a direct save uses, and any `render()` discharges the owed refresh on entry —
+  cancelling the armed channel (release-then-force) and taking the guard's debt (force-then-release)
+  → `releaseEdit` / `drainEdits` / `RerenderDebouncer` test refs, including a kept-in-tree falsification
+  showing a render that does not discharge yields two.
+- **AC-C3** — WHERE no save was suppressed, releasing the slot SHALL NOT trigger any additional
+  re-projection → negative test ref.
+- **AC-C4** — WHEN `apply` rejects unexpectedly during a drain, THE SYSTEM SHALL still release the slot
+  AND still run an owed re-projection → rejected-apply test ref.
+- **AC-C5** — THE SYSTEM SHALL release the edit slot only through `releaseEdit`; a bare `endEdit()` call
+  in the provider SHALL fail a source-scan test, as SHALL a `render()` whose first statement is not the
+  debounce cancel → inventory test refs.
diff --git a/docs/adr/0087-sandbox-subprocess-isolation.md b/docs/adr/0087-sandbox-subprocess-isolation.md
index f691f23c..af098ebd 100644
--- a/docs/adr/0087-sandbox-subprocess-isolation.md
+++ b/docs/adr/0087-sandbox-subprocess-isolation.md
@@ -1,6 +1,6 @@
 # 0087 — Router/Handler subprocess isolation
 
-- **Status:** Accepted  <!-- opt-in subprocess isolation built (#197, 2026-07-10) -->
+- **Status:** Accepted; **Amended (2026-08-04)** — the transform-result parity rule changed shape. The child now materialises a container return with `_partition`'s **own** rule instead of reproducing its exact input container, so a tuple/set/generator **delivers** in both modes (BACKLOG #341). AC-11 and the "Result parity" bullet below are rewritten accordingly; the isolation boundary and the codec grammar are untouched.  <!-- opt-in subprocess isolation built (#197, 2026-07-10) -->
 - **Date:** 2026-07-10
 - **Related:** [ADR 0009](0009-run-scoped-context-providers.md) (RunContext providers) · [ADR 0010](0010-handler-callable-db-lookup.md) / [ADR 0043](0043-fhir-read-lookup.md) (`db_lookup`/`fhir_lookup`) · [ADR 0072](0072-traced-dryrun-mode.md) (tracer seam it composes with) · [ADR 0036](0036-windows-config-source-trust.md) / [ADR 0041](0041-load-path-attestation-and-change-attribution.md) (config-source trust) · CLAUDE.md §2 (reliability/purity, count-and-log) · CLAUDE.md §4 (layering) · BACKLOG #197 · ASVS 15.2.5 / `docs/security/ASVS-L3-REMEDIATION-PLAN.md` WP-L3-17
 
@@ -146,9 +146,29 @@ target, no `pickle` import left to mis-suppress:
   registry. `mode=off` draws no such line either — see the residuals.
 - **Result parity.** The child materialises a router result with `_handler_names`' own logic (so a
   documented-supported **generator Router**, which is unpicklable, now works under `mode=subprocess`)
-  and reproduces `_partition`'s *exact* input container for a transform result — including describing
-  an item `_partition` would ignore rather than omitting it, so a tuple/set/int return still drops and
-  a `Send` **subclass** still delivers, byte-identically to `mode=off`.
+  and — since the 2026-08-04 amendment — a transform result with `_partition`'s own logic, the shared
+  `wiring.handler_result_items` rule. A **container** return (list, tuple, set, generator) is described
+  element-wise, so both modes deliver the **same `Send`s, into the same three partitions**; anything
+  that rule does not recognise as a container stays a single item, and an item `_partition` would ignore
+  is **described rather than omitted**, so it still drops and a `Send` **subclass** still delivers,
+  byte-identically to `mode=off`. The materialization runs inside the child's `with run_contexts(...)`,
+  so a **generator Handler's** lazily-executed body sees the same run-scoped providers (`code_set`,
+  `state_get`, …) it sees under `mode=off` — materialising it later, at describe time, would make those
+  raise under `mode=subprocess` only.
+  - **CAUTION — parity is over the delivered set, not the order, for an unordered container.** An *ordered*
+    container (list, tuple, generator) delivers in its own order under either mode. A **`set`** has no
+    defined iteration order — `Send` is a frozen dataclass hashed on its fields and `str` hashing is
+    seeded per process — so the child, being a **different process**, materialises it in a different
+    order than the parent would (measured: a six-element set iterated in a different order in **all
+    four** independent process pairs probed). Fan-out order from a
+    `set` is therefore unspecified in *both* modes and is **not** a mode-parity obligation; only the
+    multiset is. This is a property of `set`, not of the sandbox: the same non-reproducibility appears
+    across a crash re-run at `mode=off`. See `wiring.handler_result_items` for the full statement and
+    `docs/CONNECTIONS.md` for the author-facing steer toward ordered containers.
+  - **Residual (mode-independent, recorded in [ADR 0072](0072-traced-dryrun-mode.md) §6 gate 1 —
+    do not restate it here):** a generator Handler is not execution-traced and its per-invocation
+    `sends` are empty. It reproduces at `mode=off`, so it is not a sandbox residual; it is noted here
+    only because this bullet is where a reader meets generator Handlers.
 - **`Send` carries encoded text, never a live `Message`.** The sole parent-side consumer already
   reduces it to a `str`, so the parent's `Send(...)` rebuild is a provable no-op for ADR 0104's
   copy-on-Send choke point instead of taking a second snapshot.
@@ -231,10 +251,19 @@ target, no `pickle` import left to mis-suppress:
   `tests/test_sandbox_codec.py::test_hostile_frames_fail_closed[name_mismatch]`
 - **AC-11** — WHERE `[sandbox].mode=subprocess`, THE SYSTEM SHALL route a **generator** Router
   identically to `mode=off` (it previously dead-lettered every message), and SHALL preserve
-  `_partition` parity for every other return shape — a `Send` subclass still delivers, a tuple/set/int
-  still drops.
+  `_partition` parity for **every** return shape — where, since the 2026-08-04 amendment, a
+  tuple/set/generator of `Send`s **delivers** in both modes (BACKLOG #341), a `Send` subclass still
+  delivers, and a non-iterable unrecognized value (a bare `int`, a `__reduce__` gadget) still drops.
+  Parity is over the **multiset** of items in each of the three partitions, plus their **order for an
+  ordered container**; a `set` return has no defined iteration order in either mode, so its fan-out
+  order is explicitly **not** covered by this SHALL (see the Result-parity bullet).
+  WHERE the Handler is a **generator**, its body SHALL execute inside the child's run context, so a
+  run-scoped accessor within it resolves as it does under `mode=off` rather than raising.
   → `tests/test_sandbox.py::test_generator_router_routes_under_mode_subprocess`,
-  `tests/test_sandbox_codec.py::test_partition_parity_table`
+  `tests/test_sandbox_codec.py::test_partition_parity_table`,
+  `tests/test_sandbox.py::test_a_generator_handler_delivers_under_mode_subprocess`,
+  `tests/test_sandbox.py::test_a_generator_handlers_body_runs_inside_the_childs_run_context`,
+  `tests/test_sandbox_codec.py::test_handler_result_items_treats_a_str_as_a_single_value`
 - **AC-12** — WHERE the engine publishes code-set tables, THE SYSTEM SHALL serve **those** tables to a
   sandboxed Router/Handler — including after a transparent respawn that follows a `codesets/` edit
   made without a `/config/reload` — and the per-dispatch frame SHALL carry no code-set bytes.
diff --git a/docs/adr/0108-steps-view-accumulator-send-fan-out-copy-on-send-authoring.md b/docs/adr/0108-steps-view-accumulator-send-fan-out-copy-on-send-authoring.md
index c78bedda..379c6d31 100644
--- a/docs/adr/0108-steps-view-accumulator-send-fan-out-copy-on-send-authoring.md
+++ b/docs/adr/0108-steps-view-accumulator-send-fan-out-copy-on-send-authoring.md
@@ -1,6 +1,6 @@
 # ADR 0108 — Steps-view accumulator Send fan-out (copy-on-Send authoring)
 
-**Status:** Accepted (2026-07-14) — owner-directed ("do it") after two model iterations; built + adversarially verified this session (engine `lens.py` + `ide/`).
+**Status:** Accepted (2026-07-14) — owner-directed ("do it") after two model iterations; built + adversarially verified this session (engine `lens.py` + `ide/`). **Amended 2026-08-04** — §2's "no engine runtime change" invariant and one §7 rationale both rested on `_partition` narrowing on `isinstance(result, list)`. BACKLOG #341 changed that function: it now accepts any non-`str` iterable. Both statements are corrected in place below. **Nothing this ADR built changed** — the recognizer, the rewrites, the byte-stability contract and every §6 acceptance criterion stand as written.
 **Deciders:** owner + IDE/DX
 **Related:** [ADR 0076](0076-typed-action-vocabulary-action-list-lens.md) (the action-list lens + row-scoped-splice contract §5/§6 this extends), [ADR 0089](0089-recognition-first-lens-native-idioms.md) (recognition-first / honest degradation §4), [ADR 0104](0104-copy-on-send-outbound-message-model-recognition-first-handler-message-type-and-hl7-field-picker.md) (copy-on-Send — the snapshot-at-construction model this lets an analyst *author*), [ADR 0106](0106-steps-view-add-dropdown-vocabulary-expansion-adr-0076-phase-b.md) (the Add palette this repoints the **Send** item within; §6 byte-scoping exceptions), [ADR 0103](0103-steps-view-row-context-menu.md) (the insert-after-on-send suppression rule this refines), BACKLOG **#222** (Steps view), **#26** (the declined visual-authoring line + its structured-Steps-view carve-out — native `.py` stays the only artifact).
 **Code references** are this branch (`send-fanout`); locate by symbol, not absolute line.
@@ -34,7 +34,7 @@ def route_adt(msg):
 - Deleting every append leaves `sends = []; return sends` — an empty accumulator = **FILTERED** at runtime, honest, with **no coupled name-scrub**.
 - The three legacy returned forms (`return Send(...)`, `return [Send, ...]`, `return []`) stay **byte-identically** recognized for the estate; the palette simply stops *authoring* the return form.
 
-**Invariant (unchanged, #26).** Native `.py` is the only artifact and execution path. Every op emits Python the lens re-recognizes (byte-stable codegen), never a declarative logic engine. **No engine runtime change** — `dryrun.py::_partition` already delivers a NAME-built list identically to a returned list (it keys on `isinstance(result, list)` and never inspects the collector name); this is a pure recognizer + rewrite + view change.
+**Invariant (unchanged, #26).** Native `.py` is the only artifact and execution path. Every op emits Python the lens re-recognizes (byte-stable codegen), never a declarative logic engine. **No engine runtime change *for this ADR*** — `dryrun.py::_partition` already delivers a NAME-built list identically to a returned list, because it materialises whatever container it is handed and never inspects the collector name; this is a pure recognizer + rewrite + view change. *(Amended 2026-08-04: as originally written this sentence attributed that behaviour to `_partition` keying on `isinstance(result, list)`. BACKLOG #341 replaced that narrowing with a shared any-non-`str`-iterable rule — an engine runtime change to `_partition`, made by that item, not this one. The accumulator claim is unaffected: a `list` was and remains delivered element-wise.)*
 
 ## 3. Recognizer
 
@@ -69,6 +69,8 @@ def route_adt(msg):
 
 A multi-agent review (10 confirmed findings, 0 refuted) hardened the build before commit: the `Send` import was injected at a stale index when a top-level import trailed the edited handler (→ `_leading_import_end`); a destination containing `"` emitted a non-canonical escaped literal ruff reflows (→ `_str_lit` honors ruff's single-quote escape-avoidance); syntactic recognition mis-showed an append into a non-returned/rebound/closure list as a delivering send and mis-tagged its scaffold (→ the delivering-accumulator gate + demotion); the convert gate keyed on return **count** not top-level terminality (→ would move a nested guard's fan-out branch); a non-empty tuple return would flip 0→N deliveries on convert (→ refused); and a nested anchor could place an append inside a loop/if at the wrong indent (→ top-level placement). Each fix carries a regression test.
 
+*Amended 2026-08-04:* the tuple item's **premise** is gone — since BACKLOG #341 a non-empty tuple return **delivers**, so converting one up would be delivery-neutral, not a 0→N flip. **The refusal stands** on conservative scope: the palette never authors that form, and enabling the rewrite carries its own byte-stability obligations that belong to a Steps-view item. The §6 SHALL and its regression test are unchanged; only this rationale is corrected.
+
 ## 8. Declined / out of scope (v1)
 
 - **Nested per-iteration authored fan-out** (an append the ops place *inside* a loop): recognized when hand-written, never authored by the ops (they place top-level, one delivery per message); reorder via move, or hand-edit.
diff --git a/docs/adr/0110-ide-engine-link-doctor-the-status-bar-tells-the-truth-about-the-promote-target.md b/docs/adr/0110-ide-engine-link-doctor-the-status-bar-tells-the-truth-about-the-promote-target.md
index e766f1ad..f3f2618d 100644
--- a/docs/adr/0110-ide-engine-link-doctor-the-status-bar-tells-the-truth-about-the-promote-target.md
+++ b/docs/adr/0110-ide-engine-link-doctor-the-status-bar-tells-the-truth-about-the-promote-target.md
@@ -221,6 +221,41 @@ then it cannot warn about the states that do block an action: `unreachable`/`for
 - **#26 (no visual/declarative authoring) is untouched — #26-clean:** this surface authors nothing, projects to no `.py`,
   and executes no logic. No PySide6. No "channel"/"route" element.
 
+## Amendment — 2026-08-04 (BACKLOG #330)
+
+`/ai/policy` now has **two readers, with deliberately opposite probe plans**. This ADR is the record of
+authority for the probe-plan vocabulary (`ProbePlanEntry`, `PROBE_ENDPOINTS`, `POLICY_ROUTE`,
+`POLL_PLAN`, `VERIFY_PLAN`), so the second reader is recorded here rather than only in ADR 0035.
+
+- **`ENVIRONMENT_PLAN` (`authenticated: false`)** — the status bar's environment read, unchanged in
+  behaviour. It was previously a literal `undefined` token argument at the `readEnvironment` call site;
+  it is now driven by a named constant, so its tokenlessness is data CI asserts rather than an argument
+  a later tidy-up could "fix".
+- **`ASSIST_GATE_PLAN` (`authenticated: true`)** — `aiPolicy.ts`'s gate read of the same route. It wants
+  `assist_permitted`, which the engine computes from the acting identity and answers as `null` to any
+  caller it cannot attribute, so a tokenless read left ADR 0035's `ai:assist` half unable to fire at all.
+
+**Nothing in §2 or §5 is relaxed.** §2's prohibition on a bearer from the timer stands verbatim and
+still governs the status bar; §5's *"the environment is **read** (tokenless `/ai/policy`) and displayed,
+never set"* bullet is unchanged and describes `ENVIRONMENT_PLAN` exactly. The new reader is **not** on a
+timer: its only callers are user-initiated (a chat turn, and the *Show AI Policy* command), so it sits
+under **`VERIFY_PLAN`'s** rationale — a click or an activation is real user activity, so refreshing the
+idle clock there is honest rather than a forgery — and not under `POLL_PLAN`'s.
+
+Consequences for the acceptance criteria above, both verified rather than assumed:
+
+- **AC-3 still holds verbatim.** It quantifies over `POLL_PLAN`, which is untouched; and
+  `ENVIRONMENT_PLAN`, the other constant on the timer path, is `authenticated: false` and is now
+  asserted to be, which it was not before.
+- **AC-6 still holds as written.** `PROBE_ENDPOINTS` is unchanged — `/ai/policy` was already on the
+  allowlist — so no new route is probed by anything.
+
+The vocabulary itself is now **shared** rather than private to the status bar: `engineStatusModel.ts`
+is the IDE's probe-plan module, and `aiPolicy.ts` imports from it. That is the point of recording this
+here — without it, the next reader finds an `authenticated: true` plan for `/ai/policy` inside a module
+whose header forbids a bearer on the poll, and reasonably reads it as the exact bug this ADR exists to
+prevent.
+
 ## Alternatives considered
 
 - **A webview "Engine Doctor" panel** — rejected: opens from the same command dispatch (fixes a missed click no better);
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 4b8f91f2..f19f8ee5 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -104,11 +104,11 @@ what is withheld and what you can request.
 | [0069](0069-durable-write-throughput-lever.md) | Durable-write is not the throughput wall — engine feed concurrency is — the store absorbs ~27k commits/s (measured commit-storm) while the pipeline feeds only ~750/s (~36× gap); rejects every durable-write-tier lever (app-side group-commit, faster log storage, bigger pool — each ~0) and reaffirms ADR 0055's `DELAYED_DURABILITY`/`commit_delay` rulings; directs effort to engine-side feed concurrency (pooled claiming + higher stage concurrency + engine per-message CPU); commit-depth reduction is secondary and largely invariant-blocked | Proposed (2026-07-03) |
 | [0070](0070-t17-infra-fault-bound.md) | Bounding a persistent pooled T17 infra fault. The `StageDispatcher`'s machinery-fault branch released the head and returned a fixed-backoff RETRY, while `release_claimed` *undid* the claim's poison-guard increment (`attempts = MAX(attempts-1, 0)`) and left `next_attempt_at` past-due — so a persistent infra fault re-claimed at the ~0.25 s sweep cadence forever (an escalation-less ~4×/s spin; the G6 ceiling never fires; the head silently head-of-line-blocks its lane). **Fix A:** re-pend the head with exponential-capped backoff, releasing `items[i:]` (never `items[1:]`, which strands the head INFLIGHT and breaks FIFO). **Fix B:** `[pipeline].infra_fault_policy`, default `stop` — count consecutive zero-progress infra faults and STOP the lane with an alert (`retry_forever` opt-in). A T17 head is **never** auto-dead-lettered: the message is not at fault, and the signal cannot distinguish a long outage from a deterministic bug — a human makes that call | Accepted (2026-07-04; implemented) |
 | [0071](0071-cut-executor-round-trips-b5.md) | Cutting per-message executor round-trips: the async-marshaling feed wall (build-plan B5) — the concrete lever ADR 0069 deferred. The 2026-07-04 py-spy profile names the ~107 msg/s pooled ceiling as **per-completion executor→loop marshaling + the Windows Proactor self-pipe wakeup**, and (adversarially adjudicated + micro-benched 2026-07-04) it is a **blocking-driver (SQL Server / aioodbc per-statement) wall** — Postgres (asyncpg loop-native, ~2 crossings/msg) and SQLite (loop-affine handoff lock) keep the async path **by construction**. Decision: on SQL Server, **thread-hop fusion** — run each off-loop CPU stage + its handoff on one dedicated-executor hop via a dedicated *synchronous* pyodbc source, so a multi-statement handoff marshals back once (micro-bench: 12→2 crossings/msg, commits/msg identical ⇒ no transaction fusion, so 0069's fence is not hit). Cheaper/coalesced wakeup secondary (deferred); free-threading (ADR 0053) tertiary. **Throughput GO/NO-GO is the SQL-Server leg** (SQLite proved mechanism-only, throughput sign-unstable); null ⇒ escalate to ADR 0053 | Proposed (2026-07-04) |
-| [0072](0072-traced-dryrun-mode.md) | Traced dry-run mode — `dryrun --trace json`: a `sys.settrace` pass around the Router/Handler call emits a line-addressable `(line, event, value)` sequence + disposition + Sends, the data source for the **#92** interactive live-debug loop (v2 inline values) and **#84** profiling/coverage. Additive + **preview-only** (a traced run is byte-identical to a non-traced one — no dispatch/logic change); values are **PHI-redacted by default** + streamed-never-persisted (reuse the `--show-phi` gate); `db_lookup`/`fhir_lookup` stay `ERROR` (annotated `live_lookup_skipped`, handler does **not** resume); prior tracer restored in `finally` (coverage.py-safe), frame-scoped, thread-local. Stdlib-only, no runtime dep | Accepted (2026-07-06) — building (L5) |
+| [0072](0072-traced-dryrun-mode.md) | Traced dry-run mode — `dryrun --trace json`: a `sys.settrace` pass around the Router/Handler call emits a line-addressable `(line, event, value)` sequence + disposition + Sends, the data source for the **#92** interactive live-debug loop (v2 inline values) and **#84** profiling/coverage. Additive + **preview-only** (a traced run is byte-identical to a non-traced one — no dispatch/logic change); values are **PHI-redacted by default** + streamed-never-persisted (reuse the `--show-phi` gate); `db_lookup`/`fhir_lookup` stay `ERROR` (annotated `live_lookup_skipped`, handler does **not** resume); prior tracer restored in `finally` (coverage.py-safe), frame-scoped, thread-local. Stdlib-only, no runtime dep | Accepted (2026-07-06) — building (L5); **amended 2026-08-04** (BACKLOG #341 — the byte-identical gate is now stated by level: message-level absolute, per-invocation best-effort with a declared `lazy_result` carve-out for a generator Router/Handler) |
 | [0073](0073-ownership-scoped-recovery-single-consumer-lanes.md) | Ownership-scoped recovery + single delivery consumer per outbound lane — the N-active-shards-on-one-unified-store reliability runtime (builds ADR 0063's deferred primitive): `reset_stale_inflight(owned=OwnedLanes)` scopes startup/DR crash recovery to a shard's config-graph lanes (channel_id for ingress/routed/response, destination_name for outbound; empty set matches nothing; residual-`IN`/`ANY` predicate keeps the WS-B ready-index seek); deterministic rendezvous (sha256 HRW) outbound-lane ownership over the pinned shard universe, gated at the wake boundary + pooled lane provider + per-lane spawn (predicate, not set — a reload-dropped lane keeps exactly its owner); `--shard`+`[cluster]` refused fail-closed; shard-set-changing reloads refused (fleet restart required); owner-only outbound controls/purge (409 names the owner; `/connections` rows carry `owner_shard`); sharded-only non-owned-lane buildup/stall watchdog (hung-owner paging). N-active stays gated on the clean 4-engine no-loss bench before SYSTEM-REQUIREMENTS calls it supported | Accepted (2026-07-06) — built |
 | [0074](0074-adopter-capacity-estimator.md) | Adopter-run capacity estimator (BACKLOG #96) — productize the **built** `harness/load/` rate-walk + zero-loss reconcile as a supported `messagefoundry capacity` command an adopter points at *their* box/store/config to answer "does this carry my ~36 msg/s hospital with headroom?"; reports the **per-interface** no-loss ceiling + engine-wide aggregate + a **backend-aware limiting-factor** label + provision-at-≤50%-of-ceiling guidance. Hard requirements: **isolated throwaway store** (refuse to run against a non-isolated/production store — count-and-log intact), **synthetic PHI-free** payloads only (ADR 0030), backend-aware labels (SQLite knob rankings do **not** transfer to server backends — the B12 lesson), explicit harness-ceiling caveats (~450/s ACK per driver, ~135–144/s delivered per sink, poller-zero ⇒ sub-ceiling knee). v1 = rate-walk + limiting-factor labels; deeper per-stage diagnostics deferred. A productization of throughput-campaign evidence (PR #768), not a new measurement effort | Accepted (2026-07-07) — ratified. ⛔ **BUILD GATED (2026-07-14)**: a validity re-check vs STEP-4 Arm 0 found **14 confirmed blockers** in the *measurement* method (the named "only success gate" over-reports by **3–5.5×**; the poller-zero failure mode *satisfies* it; the estimand is intake not delivery; the aggregate-is-the-sum rule is measured-false; the ceiling is instant-partner). **Premise + hard requirements + the fail-closed guard layer still hold and remain buildable.** See the ADR's 2026-07-14 Amendment |
 | [0075](0075-per-hop-sql-statement-batching.md) | Per-hop SQL statement batching (`[pipeline].batch_handoff_statements`, default-ON (emergency off-switch), fail-closed, SQL-Server-only) — the last [ADR 0069](0069-durable-write-throughput-lever.md)-named feed lever ("batching SQL statements per executor hop"): fold a multi-statement handoff **body** (guard-DELETE + inserts + finalize applock + `messages.status` UPDATE + event, from the SAME shared `(sql,params)` builders that keep the async/sync twins in lockstep) into 1–2 `pyodbc.execute()` batches, cutting **network round-trips + aioodbc executor crossings — NOT transactions** (`commits/msg` stays 2.000; the ADR 0069 cross-lane/commit fence is not hit). Attacks the serial-RT co-bottleneck the [ADR 0071](0071-cut-executor-round-trips-b5.md) B5 fusion NO-GO could not (the ~11 ms inter-box store RTT × ~4–5 RT/msg) and works on the **default async path**. Microbench (adversarially re-reviewed, counts VERIFIED honest): per-hop drop 27–50%, but the **≥40% figure is CONDITIONAL on the applock-rc-fold** — under the strict interpretation 27–33% clears nothing, so the microbench JUSTIFIES a live-rig e2e A/B, it does not substitute for it. Content-vs-infra error attribution + a golden-SQL/living RT-count CI gate are load-bearing. **Promoted default-ON 2026-07-08** (Bench B distance-insurance A/B: harmless-near + helps-far, green SS correctness precondition) — flag retained only as an emergency off-switch | Accepted (2026-07-07) — promoted default-ON 2026-07-08 |
-| [0076](0076-typed-action-vocabulary-action-list-lens.md) | Typed action vocabulary + structured action-list lens over Python Handlers (BACKLOG #222, under the #26 amendment) — phase 1: `messagefoundry/actions.py`, pure typed helpers mirroring Corepoint's action classes over the existing `Message` API (control flow stays native Python; no flow wrappers); phase 2: static-only `lens parse --json` (stdlib `ast`, never imports/executes config) + a VS Code `CustomTextEditorProvider` rendering any *parseable* Handler as a Corepoint-style action-list view — typed rows for the bounded structural grammar, in-place read-only `code` rows for anything else (coverage invariant: rows exactly partition the def body — never drop/reorder/synthesize) and whole-file refusal only on parse failure; phase 3 (bake + owner-go gated): row-scoped line-splice rewrites (byte-stable outside the edited row). The `.py` stays the **only artifact and execution path** — no interpreter, no declarative artifact, no canvas; InterSystems guardrails adopted (sync-on-save, one-editor-at-a-time, degrade-to-text-editor); live values reuse the ADR 0072 stream + `--show-phi` gate unchanged; stdlib-only, no new runtime dep (libcst deferred) | Accepted (2026-07-10) — **Amendment A ACCEPTED 2026-07-30 (owner-ratified, in force):** a `note` row kind so comment-only rows stop projecting as opaque `code`, **superseding ADR 0106 §5 (L)**, and reconciling the §3 enum to the kinds the parser already emits; build = BACKLOG #248. **Amendment B ⛔ DECLINED 2026-07-30 (owner ruling — too risky):** ADR 0089 Phase D "helper descent" is **not adopted and not to be built** — duplicate-call-site aliasing is unsolved in any ADR, and the yield is unmeasured and possibly negative; spec retained for auditability, reopening needs a new amendment. Better lever, not declined: recognize `msg["X"] = v` |
+| [0076](0076-typed-action-vocabulary-action-list-lens.md) | Typed action vocabulary + structured action-list lens over Python Handlers (BACKLOG #222, under the #26 amendment) — phase 1: `messagefoundry/actions.py`, pure typed helpers mirroring Corepoint's action classes over the existing `Message` API (control flow stays native Python; no flow wrappers); phase 2: static-only `lens parse --json` (stdlib `ast`, never imports/executes config) + a VS Code `CustomTextEditorProvider` rendering any *parseable* Handler as a Corepoint-style action-list view — typed rows for the bounded structural grammar, in-place read-only `code` rows for anything else (coverage invariant: rows exactly partition the def body — never drop/reorder/synthesize) and whole-file refusal only on parse failure; phase 3 (bake + owner-go gated): row-scoped line-splice rewrites (byte-stable outside the edited row). The `.py` stays the **only artifact and execution path** — no interpreter, no declarative artifact, no canvas; InterSystems guardrails adopted (sync-on-save, one-editor-at-a-time, degrade-to-text-editor); live values reuse the ADR 0072 stream + `--show-phi` gate unchanged; stdlib-only, no new runtime dep (libcst deferred) | Accepted (2026-07-10) — **Amendment A ACCEPTED 2026-07-30 (owner-ratified, in force):** a `note` row kind so comment-only rows stop projecting as opaque `code`, **superseding ADR 0106 §5 (L)**, and reconciling the §3 enum to the kinds the parser already emits; build = BACKLOG #248. **Amendment B ⛔ DECLINED 2026-07-30 (owner ruling — too risky):** ADR 0089 Phase D "helper descent" is **not adopted and not to be built** — duplicate-call-site aliasing is unsolved in any ADR, and the yield is unmeasured and possibly negative; spec retained for auditability, reopening needs a new amendment. Better lever, not declined: recognize `msg["X"] = v`. **Amendment C PROPOSED 2026-08-04 (built, awaiting owner ratification):** the update-loop guard DEFERS a save-triggered re-projection to slot release instead of dropping it (BACKLOG #234) — claims to STRENGTHEN the §5 "sync on save only" guardrail, not relax it; also corrects the false premise the save gate's own comment rested on (`lens parse` reads the LIVE buffer over stdin, not disk). Whether to relax the gate itself is #234's other half and is explicitly not decided |
 | [0077](0077-action-bound-step-up.md) | Action-bound step-up re-verification for durable-takeover operations (ASVS 2.2.4 / BACKLOG #187) — a fresh re-authentication bound to the *specific* privileged action, not merely to a recent login, so a hijacked live session cannot silently perform a durable takeover | Accepted |
 | [0078](0078-certificate-revocation-posture.md) | Certificate revocation posture (OCSP/CRL, ASVS 12.1.4, BACKLOG #201) — **enforced start-time refusal + delegated proxy**, NOT in-engine OCSP (stdlib `ssl` has no OCSP/CRL fetch; a hand-rolled responder fetch fights on-prem offline-by-default). Refines [ADR 0002](0002-phase2-transport-security-and-strong-auth.md)'s *documented* revocation residual into an **enforced** control: `serve` REFUSES to start an in-process, off-loopback `[api]` TLS bind (`tls_cert_file` set + non-loopback `host`) UNLESS revocation is *proven in front* — a declared TLS-terminating proxy (`tls_terminated_upstream` + `trusted_proxies`, which does its own OCSP-must-staple/CRL) OR the operator opt-out `MEFOR_TLS_REVOCATION_ATTESTED=1`. Secure default = refuse; the loopback default + proxy-terminated paths start **byte-identically** (the pure `config/tls_policy.py:in_process_tls_revocation_refused` predicate short-circuits). Compensating controls: the SQL-Server SChannel path already does OS-managed revocation, and `pipeline/cert_expiry.py` alerts on expiring certs (steering short-lived certs). **Amendment 2026-07-12 (BACKLOG #201 residual):** extends the SAME posture-keyed refusal to the OUTBOUND verifying-TLS connectors — pure `revocation_hop_disposition(*, is_phi, production, is_loopback_hop, proxy_proven, attested)` + `RevocationHopGuard` in `config/tls_policy.py`, wired into MLLP-over-TLS egress, the REST/SOAP/FHIR https paths (`refuse_unrevoked_verified_hop`), and the Postgres asyncpg store hop (`_refuse_store_revocation`); per-connection `tls_revocation_attested` + the blanket `MEFOR_TLS_REVOCATION_ATTESTED` env are the opt-outs. Composes with #200 (fires only on a VERIFYING hop — no double-refusal). Still out of scope: SQL-Server/SChannel (already OS-managed), DICOM-SCU/FTPS, the FhirLookup read path. Flips the ASVS 12.1.4 row from documented-residual to enforced-delegation | Accepted (2026-07-10; amended 2026-07-12) — built |
 | [0079](0079-kerberos-idp-session-coordination.md) | Kerberos/AD engine-session lifetime coordinated with the directory (IdP) — terminate engine sessions when the directory revokes or disables the account, rather than letting a local session outlive its AD principal. **Amendment 2026-07-21:** mechanism 1's preferred input — the Kerberos ticket `endtime` — is **unobtainable** via pyspnego 0.12.1 (no expiry on the public `ContextProxy`; `SSPIProxy.step()` discards sspilib's `AcceptContextResult.expiry`), so on the Kerberos/LDAPS path it would degrade to a second local constant dressed as directory data. ASVS 7.1.3 therefore **closed by ACCEPTANCE** (signed register row, theme 3) and this ADR's Proposed→Accepted trigger is **NOT fired**; mechanism 1 ships only where the datum genuinely exists — the federated `id_token.exp` session cap. Mechanism 2 (background re-validation loop) stays deferred. **Amendment 2026-07-22: mechanism 2 is BUILT.** The deferral's stated cost was void — the candidate set derives from the existing `list_users()` + `list_sessions()`, so **no `sessions` schema change on any backend** (provenance columns were only ever mechanism 1's need). Recorded narrowing: `require_step_up` performs **no** directory bind (it compares the stored `reauth_at`), so the step-up surface is protected by inability to REFRESH — leaving a ≤`step_up_max_age_seconds` residual — while **bulk/raw PHI reads** (`require_phi_read`, 120/min) and **connection start/stop** (`require_paced`) survived to the 12 h cap. Adds three properties the design did not name: **two-strike** before revoking (the lookup returns one `None` for disabled ∪ deleted ∪ wrong-search-base), **all-or-nothing passes** (planned in `auth/reconcile.py` before any write), and a **mass-revoke circuit breaker** — a bad search base answers "not found" for everyone, so a pass exceeding **both** `ad_session_revoke_max` (5) **and** `ad_session_revoke_max_fraction` (0.34) aborts + alerts. AND, not OR: the floor alone signs out a 5-person site, the proportion alone fires on a 3-of-3 offboarding. Group re-diff rides the pass free (demotions no longer wait for a login); channel scope deliberately excluded. Default OFF (`ad_session_recheck_seconds = 0`) | Accepted (mechanism 2 built 2026-07-22; mech 1 Kerberos path closed by acceptance, federated path shipped in ADR 0142) |
@@ -118,7 +118,7 @@ what is withheld and what you can request.
 | [0083](0083-mtls-client-certificate-identity.md) | mTLS client-certificate identity (BACKLOG #200) — a **verified** peer cert's subject/SAN maps to a MessageFoundry principal via an explicit deny-by-default allow-list (`[api].tls_client_cert_identities`), rooted in `CERT_REQUIRED` and namespace-qualified against spoofing. An **attested service-to-service** identity (no MFA/session/step-up). **Activated** (PLAN-9 Wave 3): a fork-free scope-populating shim (`api/tls_client_cert.py`) surfaces the verified peer cert post-handshake, and a fenced cert-only dependency `require_service_cert` gates one non-interactive route (`GET /service/identity`) — never a bearer/PHI/step-up route (refuses PHI-view perms at build), so a cert-identity can never bypass step-up | Accepted (2026-07-10) — owner ratified; model+resolver built (#200), **activated** PLAN-9 Wave 3 |
 | [0084](0084-accepts-router-seam.md) | `accepts=` Router-stage seam — let a Handler declare a **pure** router-time applicability predicate (`Callable[[Message \| RawMessage], bool]`) so the Router declines it **before** a routed row is materialized, recovering the `2` transactions per self-filtering handler the ADR 0051 `txn/msg = 3 + 2H + 2N` model charges (the ADT hub's `wasted == 32`, ~63% of its durable writes). Purity enforced by construction (router stage already makes `db_lookup`/`fhir_lookup` raise — ADR 0010/0043); additive + default-identical (`accepts=None` = today). **Crux:** an all-declined message finalizes **`UNROUTED`** not `FILTERED` — count-and-log intact (still `RECEIVED` at ingress, still a final logged disposition, never accept-and-drop), only per-destination FILTERED granularity lost (optional `message_events` declined-handler mitigation). Ships an **advisory** `accepts-candidate` lint (flags a `@handler` opening with a guard-filter `if …: return []`). Spec + lint stub only, no engine build (build = BACKLOG #213) | **Accepted (2026-07-11, owner-ratified)** — `FILTERED → UNROUTED` accepted; `message_events` declined-handler mitigation deferred from v1, gated behind the #63 verbosity gate when built |
 | [0085](0085-direct-hisp-smime-connector.md) | Direct-Project S/MIME-over-SMTP outbound connector (DIRECT-HISP, BACKLOG #157) — PR1 **outbound send only**: a new `ConnectorType.DIRECT` + `DirectDestination` that **SIGNs then ENCRYPTs** the Handler body via core `cryptography` `serialization.pkcs7` (no new dep — `endesive` rejected, `dnspython` deferred) and submits it as `application/pkcs7-mime; smime-type=enveloped-data` over the reused EMAIL STARTTLS/`refuse_cleartext_credentials` posture. All signing key+cert / per-partner recipient cert / trust anchor loaded + cross-validated at construction (fail loud): key↔cert public-key match + one-level `verify_directly_issued_by` chain check. New fail-closed `[egress].allowed_direct` host gate (kept separate from `allowed_smtp`). Inbound Direct mail / MDN / DNS-CERT discovery / IHE XDR **deferred** to later phases | Accepted (2026-07-10) — PR1 outbound-only, later phases deferred |
-| [0087](0087-sandbox-subprocess-isolation.md) | Router/Handler subprocess isolation (SANDBOX, BACKLOG #197, ASVS 15.2.5 / WP-L3-17) — an **opt-in** `[sandbox]` section: `mode=off` (default) runs Routers/Handlers in-process **byte-identically, zero overhead**; `mode=subprocess` runs each inbound's Router/Handler in a **persistent per-inbound worker child** (`pipeline/sandbox.py` + `_sandbox_worker.py` + `_sandbox_codec.py`; stdlib-only, no new dep — RestrictedPython rejected), never a per-message fork. The OS-process boundary denies admin code reach to the parent's DEK/audit-chain/sockets (the child loads only the message *graph*); on top: a forbidden-import guard (socket/store/crypto), a parent-enforced wall-clock cap (+ POSIX `RLIMIT_CPU`/`RLIMIT_AS`), and a **fail-closed** refusal of the live `db_lookup`/`fhir_lookup` bridges. Interposed at the `route_only`/`transform_one` seam (the in-process `mode=off` path composes with the ADR 0072 tracer; `mode=subprocess` bypasses it); engine-side handler/outbound-name validation stays engine-side; a denial → `ERROR`/dead-letter **post-ACK** (no NAK, never dropped). **MFW2 amendment (BACKLOG #339):** the IPC pipe originally pickled, so a Handler's `__reduce__` executed in the engine parent and the boundary was bypassable outright; both legs now use a closed-tag, non-executing codec. Consistent with the [0144](0144-security-lint-gate-over-admin-authored-router-handler-config.md) row below, **15.2.5 stays Partial** — this is the *address-space* half (the child still reaches `os`/`subprocess` and the host); OS-level default-deny confinement is [ADR 0147](0147-hardened-runtime-isolation-for-router-handler-code-ipc-brokered-sandbox-extends-adr-0087.md), still Proposed. **Residuals:** default-off; live-lookup forward-over-IPC deferred; load-time top-level exec not sandboxed (unchanged safe-source DACL gate); confinement is address-space only; worker kill does not reap a grandchild (#342) | Accepted (2026-07-10) — opt-in subprocess isolation built (#197) |
+| [0087](0087-sandbox-subprocess-isolation.md) | Router/Handler subprocess isolation (SANDBOX, BACKLOG #197, ASVS 15.2.5 / WP-L3-17) — an **opt-in** `[sandbox]` section: `mode=off` (default) runs Routers/Handlers in-process **byte-identically, zero overhead**; `mode=subprocess` runs each inbound's Router/Handler in a **persistent per-inbound worker child** (`pipeline/sandbox.py` + `_sandbox_worker.py` + `_sandbox_codec.py`; stdlib-only, no new dep — RestrictedPython rejected), never a per-message fork. The OS-process boundary denies admin code reach to the parent's DEK/audit-chain/sockets (the child loads only the message *graph*); on top: a forbidden-import guard (socket/store/crypto), a parent-enforced wall-clock cap (+ POSIX `RLIMIT_CPU`/`RLIMIT_AS`), and a **fail-closed** refusal of the live `db_lookup`/`fhir_lookup` bridges. Interposed at the `route_only`/`transform_one` seam (the in-process `mode=off` path composes with the ADR 0072 tracer; `mode=subprocess` bypasses it); engine-side handler/outbound-name validation stays engine-side; a denial → `ERROR`/dead-letter **post-ACK** (no NAK, never dropped). **MFW2 amendment (BACKLOG #339):** the IPC pipe originally pickled, so a Handler's `__reduce__` executed in the engine parent and the boundary was bypassable outright; both legs now use a closed-tag, non-executing codec. Consistent with the [0144](0144-security-lint-gate-over-admin-authored-router-handler-config.md) row below, **15.2.5 stays Partial** — this is the *address-space* half (the child still reaches `os`/`subprocess` and the host); OS-level default-deny confinement is [ADR 0147](0147-hardened-runtime-isolation-for-router-handler-code-ipc-brokered-sandbox-extends-adr-0087.md), still Proposed. **Residuals:** default-off; live-lookup forward-over-IPC deferred; load-time top-level exec not sandboxed (unchanged safe-source DACL gate); confinement is address-space only; worker kill does not reap a grandchild (#342) | Accepted (2026-07-10) — opt-in subprocess isolation built (#197); **amended 2026-08-04** (BACKLOG #341 changed the transform-result parity rule's shape: the child materialises a container return with `_partition`'s own rule, and parity is scoped to the delivered set + an *ordered* container's order — a `set` has no defined order in either mode) |
 | [0088](0088-apiclient-service-cli-extraction.md) | Extract a Qt-free / FastAPI-free `apiclient/` engine-client library + a `messagefoundry service {install,start,stop,status}` CLI (BACKLOG #103, reusable-core half) — `apiclient/client.py` is the verbatim former `console/client.py` body (deps: `httpx` + lazy `truststore` + the pure `api/` pydantic models), the canonical client shared by the console, the headless load/acceptance harness, and future clients; `service.py` is the verbatim former `console/service_control.py` (stdlib-only Windows SCM control), surfaced on the CLI. `console/client.py` + `console/service_control.py` become thin re-export shims (no behaviour change); harness client imports repoint to `messagefoundry.apiclient`, Qt-widget imports stay on `console/`. Explicitly the reusable-core half of #103 — the console is **kept**; deleting `console/`, rehoming the Qt widgets, and dropping the `[console]` extra remain **deferred**. Does **not** supersede [ADR 0032](0032-console-desktop-launch.md); no new dependency | Accepted (2026-07-10) — built (PLAN-9 Wave 3) |
 | [0086](0086-deterministic-corepoint-import.md) | Deterministic Corepoint action-list import → code-first Handlers (BACKLOG #105) — the **inverse** of ADR 0076's typed vocabulary + lens: a pure, stdlib-only engine importer (`messagefoundry/corepoint_import.py`) + a `messagefoundry import corepoint <export> --out <dir>` CLI that parses a Corepoint action-list export and emits one code-first `@router`/`@handler` module per channel, calling the ADR 0076 vocabulary + `Send`. The `.py` stays the only artifact/execution path (#26). **Amended 2026-07-24 (§2(a′)/(b′)/(c′)): the input schema is VALIDATED and it is XML** — root `<Package>`, logic at `<ActionList>/<List>`, a recursive control-flow tree whose `@Data` is rich-text markup that must be stripped before any statement classifies; `<Block>` is a section label (never an action) and `@Disabled` is preserved as a comment, never live. Parsed through defusedxml (`forbid_dtd`/`forbid_entities`/`forbid_external`); `parse_any()` sniffs XML vs. the superseded synthetic JSON model. The mapping is the inverse of ADR 0076 §2 and deliberately narrow — a field path is never guessed, and control flow is emitted as real Python with inert placeholder conditions. Unmapped verbs emit in-place `# TODO: Corepoint …` + best-effort `msg.set` stub (count-and-log — never dropped). Untrusted export values ride across as `json.dumps`-escaped literals (no code injection). Correctness gate: emitted modules pass `messagefoundry check` + round-trip through `lens parse`. Optional `ide/` wrapper deferred | Accepted (2026-07-10), amended 2026-07-24 — owner ratified; engine importer + CLI built, schema validated (#105) |
 | [0089](0089-recognition-first-lens-native-idioms.md) | Recognition-first lens (Phase A, BACKLOG #222) -- recognize the native Message API (msg.set / msg.field-copy / msg.delete_segments) as editable set_field/copy_field/delete_segment rows, so a Handler authored in the native API (not the ADR 0076 actions.py wrappers) renders as editable Steps without being rewritten. Extends the byte-stable rewrite to EDIT and INSERT those native forms import-free (insert_row exempt from the editable-kind guard; inserts indent to the anchor code line). Roadmap phases A-E; a production-estate scan measured ~66% opaque rows before, ~42% editable after Phase A | Accepted (2026-07-13) — owner-ratified; Phase A built + adopted |
@@ -139,7 +139,7 @@ what is withheld and what you can request.
 | [0105](0105-streaming-very-large-hl7-attachments-detach-the-opaque-document-from-the-transformable-skeleton.md) | Streaming very-large HL7 attachments — **detach the opaque document from the transformable skeleton** (BACKLOG #149, Phase 0 substrate). A base64 PDF in `OBX-5.5` that pushes the frame past the 16 MiB cap is lifted at ingress into a **content-addressed, chunked, in-store attachment** (each chunk `mfenc` AES-GCM-sealed — bounded plaintext window per seal), leaving a small `mfdoc:v1:ref:<sha256>:<content_type>` **live handle** (a live sibling of the `mfdoc:v1:pruned:` tombstone, unified with #94's opaque-pointer contract); the small skeleton rides the existing ingress→routed→outbound stages unchanged, and delivery **re-attaches** the handle — splicing the verbatim value back into `OBX-5.5` (no decode/re-encode) — and streams the frame inline MLLP MDM. **Owner rulings:** (1) Epic's MLLP does not cap frame size → inline MLLP, no FHIR-Binary; (2) pure pass-through, **doc-mutating transforms a non-goal** on streaming feeds; (3) **Approach B — store the `OBX-5.5` value VERBATIM** (byte-for-byte, no decode/re-encode → trivially re-run-pure); (4) 3-backend parity before go-live. **Substrate generalizes the `shared_body` refcount+GC** (`attachment`/`attachment_chunk` tables, `put_attachment`/`read_attachment`/`attachment_incref`/`attachment_decref`, content-addressed + dedup) + a NEW startup **orphan/incomplete-attachment sweep** (reclaims refcount-0 AND orphaned chunks so no PHI at rest, wired where `reset_stale_inflight` runs) + the key-rotation re-encrypt sweep extended to **re-seal chunks** + a `supports_streaming_attachments` capability flag (SQLite True; SS/PG raise until Phase 4). **Ingress detach (Phase 1a) + delivery re-attach (Phase 1b) now built** — the full round-trip: an over-threshold `OBX-5.5` is detached VERBATIM at ingress and re-materialized (spliced back byte-for-byte) at the terminal egress via the pure `reattach_documents_in_hl7` (injected async reader) on both the single-item and batch delivery paths; hydration is fail-loud (a missing/GC'd attachment → retryable `DeliveryError`, never a handle on the wire) and a **pure read** (never decref — retry-idempotent, fan-out-safe). The outbound MLLP send is uncapped so the large frame streams inline. **Phase 3a (retention) now built:** a `message_attachment` join table persists the message→attachment linkage (populated atomically with the ingress incref) and `purge_message_bodies` **decrefs + deletes** those rows in the body-purge transaction — ordered so a crash-re-run is a no-op (no double-decref / underflow / premature GC of a shared attachment), **closing the Phase-1b over-retention gap** (a purged-but-referenced document is now reclaimed at its last referrer). **Phase 4 (SQL Server + Postgres substrate parity) now built** — the whole Phase-0→3a substrate (schema, put/read/incref/decref/sweep, ingress two-object commit, retention decref + dead-row split, key-rotation re-seal) is implemented on both server backends at byte-for-byte behavioral parity with the SQLite reference (dialect + txn-model adapted only), `supports_streaming_attachments` flipped True, with SS/PG parity tests on the CI legs — **go-live parity met (the production store is SQL Server)**. **Remaining:** Phase 3b (read-surface migration — raw view / content search / retention strip made attachment-aware) is the only phase left. Extends [ADR 0001](0001-staged-pipeline-architecture.md)/[ADR 0028](0028-base64-binary-carriage-codec.md) | Accepted (2026-07-12) — Phase 0 substrate + Phase 1a ingress detach + Phase 1b delivery re-attach + Phase 3a linkage/retention decref + Phase 4 SS+PG parity built (`stream_threshold_bytes`/`max_message_bytes`/in-flight budget, deferred-ACK, two-object commit, verbatim splice-back, inline MLLP, `message_attachment` decref, streaming on all three backends); Phase 3b (operator read surfaces) the only remainder |
 | [0106](0106-steps-view-add-dropdown-vocabulary-expansion-adr-0076-phase-b.md) | Steps-view **authoring palette** (ADR 0076 Phase B) — grow the Steps view's **Add** menu from 3 items to a grouped **~22-item palette** across four groups: **Transform** (16, incl. new pure helpers `trim_field`/`substring_field`/`pad_field`/`replace_literal`/`date_diff_field`/`arith_field`), **Translate & lookup** (Code Lookup via a **named code-set picker** — ADR 0033 data, not an inline dict — + live `db_lookup`/`fhir_lookup`), **Structure & flow** (If/Else If/Else, For Each, **Send**, **Filter**, **Raise Error**, Comment — making control/send rows *insertable*, not just recognized), **Diagnostics** (`log_note`/`checkpoint` in a separate `diagnostics.py`, `logger.debug`-only + **redact-by-default**). Core engine work: idempotent **import injection** + a multi-line **statement-template insert** through the audited paste machinery, with two sanctioned byte-scoping exceptions (import injection, clause-append). The adversarial pass caught + fixed real bugs (For Each would emit crashing `msg.segments("OBX")` and read it back false-green → arity-hardened; Filter's `return []` collides with a dynamic-destination Send → distinct `filtered:true` discriminant; regex `matches` → `test:{expr}` escape-hatch only; `code_lookup` `assign_to` dead-bind gate). **Block deferred → #231.** OUT: Loop/Call/ChooseFrom/Try-Catch, regex ops, inline-dict lookups, DB/web writes, clock reads. 3 phases: engine helpers + recognizer-safety → lens insert/recognize → IDE surface (owner lane). Extends [ADR 0076](0076-typed-action-vocabulary-action-list-lens.md)/[ADR 0089](0089-recognition-first-lens-native-idioms.md); sibling to [ADR 0103](0103-steps-view-row-context-menu.md) | Accepted (2026-07-12; palette shipped #1013/#1022) — the Steps-view Add palette is built (owner's `ide/` lane, #222) |
 | [0107](0107-phase-4-is-closed-transaction-reduction-is-a-measured-dead-end.md) | **Phase 4 is CLOSED — transaction reduction is a measured dead end.** The P0 falsifier [ADR 0099](0099-phase-4-group-commit-amortize-the-per-event-transaction-cost.md) pre-registered has run and returned **ABANDON**. Inline stage-fusion ([ADR 0057](0057-inline-step-a-fast-path.md)) **works** — it cut `committed_txns/msg` **10.47 → 7.49** (−28.5%; manipulation check passed, disarmed-arm trap avoided at `H=D=dests=1`) — and **buys nothing**: throughput moved **−0.56%**, inside the pre-registered NULL band and below either arm's replicate spread. **That null IS the verdict** (pre-registered primary A/B). **Arm E** adds the number worth remembering: sweeping H∈{1,2,4,8} on the unmodified split path, a **~3× swing in committed transactions (9.89→29.20/msg) moves throughput only −11.7%** → **elasticity −0.115** — the txn→throughput coupling is real but **far too weak to be a lever**. ⚠️ **CORRECTION (same-day, adversarial verify):** an earlier draft claimed arm E proves *"F2 cannot clear the bar at any shape"* and that F2's ceiling *"lands inside B5's rejected band"* — **both FALSE.** F2's arm-E ceiling at H=8 is **+13.2%**, which is **ABOVE** the +8% PROCEED bar and above B5's +6.5…+10% band; even net of the *measured* H=1 give-back (−4.49 pts) it is **+8.75%**. **The data does NOT exclude F2 clearing the bar at high H** — and **F2 cannot be measured without being built** (the fusion gate is `len(names)==1`, so inline fusion is H=1-only *by construction*). We therefore **decline on cost/risk/evidence, NOT on a proof of impossibility**: fusion buys nothing at the only measurable shape; the deratings that would sink it are argued, not measured; ADR 0071 B5 is the precedent (6× fewer round-trips → +6.5…+10%, NO-GO); and F2 is a large permanent 3-backend surface. Decisions: no F2/F3; **ADR 0057 ⛔ DO NOT PROMOTE, default-OFF permanently**; state the conclusion precisely (**NOT** "the wall is per-message" — transactions *do* matter, just far too weakly); **F1 survives on latency/cleanliness merit only, never a throughput claim**; **do NOT open a fifth store-side falsifier** (four negative: C5/C6/C7/P0). **Frontier: the ENGINE side has never been ATTRIBUTED** — note shardcert already publishes per-shard PIDs for an external per-PID CPU capture that nobody has ever taken | Accepted (2026-07-13) — closes options; authorizes no build |
-| [0108](0108-steps-view-accumulator-send-fan-out-copy-on-send-authoring.md) | **Steps-view accumulator Send fan-out** — author multi-destination, copy-on-Send fan-out ([ADR 0104](0104-copy-on-send-outbound-message-model-recognition-first-handler-message-type-and-hl7-field-picker.md)) as first-class mid-body **actions**, never a `Send`-in-a-`return`. The owner rejected both `return Send(...)` and the named-sends `return [a, b]` form: a send should read as an action, not the function's return. **Decision:** recognize + author the **accumulator idiom** `sends = []; sends.append(Send("OB", msg)); ...transform...; sends.append(Send("OB2", msg)); return sends` — each `sends.append(Send(...))` is an editable `send` row (additive `appended:true`) positioned AT the append; the `sends = []` init + bare `return sends` footer are managed **read-only scaffold** (`scaffold:"collector_init"/"return_collector"`, kind stays `code`); deleting every append leaves an empty accumulator = **FILTERED**, no name-scrub. The three legacy returned forms stay **byte-identical**; the palette's **Send** item repoints `template:"send"` → `op:"insert_send"`, plus a per-row **＋ dest** `add_destination` button. **No engine runtime change** — `dryrun._partition` already delivers a NAME-built list identically (keys on `isinstance(result, list)`); pure recognizer + rewrite + view. **Honesty gate:** an append is a send row only where its collector is a *clean delivering accumulator* (single top-level `[]` init, top-level `return NAME`, bound nowhere else); a discarded/aliased/rebound/closure-local append degrades to a read-only `code` row. IDE keys insert-after suppression on a new `isReturnRow` (append allows after; return/footer suppresses) across the six position sites + the CSP mirror. Adversarial pass folded in 10 fixes (stale import index → `_leading_import_end`; ruff quote escape; delivering-accumulator gate; nested-guard convert; tuple 0→N; nested-anchor placement). Extends [ADR 0076](0076-typed-action-vocabulary-action-list-lens.md)/[ADR 0089](0089-recognition-first-lens-native-idioms.md); repoints the [ADR 0106](0106-steps-view-add-dropdown-vocabulary-expansion-adr-0076-phase-b.md) Send item; #26-clean | Accepted (2026-07-14) — owner-directed; engine + IDE built, adversarially verified |
+| [0108](0108-steps-view-accumulator-send-fan-out-copy-on-send-authoring.md) | **Steps-view accumulator Send fan-out** — author multi-destination, copy-on-Send fan-out ([ADR 0104](0104-copy-on-send-outbound-message-model-recognition-first-handler-message-type-and-hl7-field-picker.md)) as first-class mid-body **actions**, never a `Send`-in-a-`return`. The owner rejected both `return Send(...)` and the named-sends `return [a, b]` form: a send should read as an action, not the function's return. **Decision:** recognize + author the **accumulator idiom** `sends = []; sends.append(Send("OB", msg)); ...transform...; sends.append(Send("OB2", msg)); return sends` — each `sends.append(Send(...))` is an editable `send` row (additive `appended:true`) positioned AT the append; the `sends = []` init + bare `return sends` footer are managed **read-only scaffold** (`scaffold:"collector_init"/"return_collector"`, kind stays `code`); deleting every append leaves an empty accumulator = **FILTERED**, no name-scrub. The three legacy returned forms stay **byte-identical**; the palette's **Send** item repoints `template:"send"` → `op:"insert_send"`, plus a per-row **＋ dest** `add_destination` button. **No engine runtime change** for this ADR — pure recognizer + rewrite + view (see the ADR's §2 invariant for the `_partition` behaviour it rests on, amended 2026-08-04 by BACKLOG #341; do not restate it here). **Honesty gate:** an append is a send row only where its collector is a *clean delivering accumulator* (single top-level `[]` init, top-level `return NAME`, bound nowhere else); a discarded/aliased/rebound/closure-local append degrades to a read-only `code` row. IDE keys insert-after suppression on a new `isReturnRow` (append allows after; return/footer suppresses) across the six position sites + the CSP mirror. Adversarial pass folded in 10 fixes (stale import index → `_leading_import_end`; ruff quote escape; delivering-accumulator gate; nested-guard convert; non-empty-tuple convert refused; nested-anchor placement) — see the ADR's §7 for each rationale. Extends [ADR 0076](0076-typed-action-vocabulary-action-list-lens.md)/[ADR 0089](0089-recognition-first-lens-native-idioms.md); repoints the [ADR 0106](0106-steps-view-add-dropdown-vocabulary-expansion-adr-0076-phase-b.md) Send item; #26-clean | Accepted (2026-07-14) — owner-directed; engine + IDE built, adversarially verified; **amended 2026-08-04** (two `_partition` rationales corrected by BACKLOG #341 — nothing built changed) |
 | [0109](0109-at-rest-encryption-fail-closed-on-an-undeclared-phi-posture.md) | At-rest encryption fail-closed on an **undeclared PHI posture** — default an undeclared/underived `[ai].data_class` to **PHI** so a keyless store refuses to start (reusing the built `__main__.py:980-1004` PHI serve gate) unless the operator declares `data_class=synthetic`, configures a key, or sets the audited `[store].allow_unencrypted_phi`. Makes cleartext-at-rest an explicit, audited opt-out at every posture (prod is already fail-closed); keyless→keyed reads stay back-compat. Closes [Secure Build Scorecard](../Secure_Build_Scorecard_MEFOR.md) gap #4 (→ B+ → A−). Layer-2 first-run auto-key deferred to a follow-on ADR. **Tier S2×P2 ⇒ T3.** Extends [ADR 0002](0002-phase2-transport-security-and-strong-auth.md); audited-escape precedent [ADR 0036](0036-windows-config-source-trust.md) | **Rejected (2026-07-14)** — premise refuted on code review: `serve` already fails closed for every PHI posture via `require_posture()` (env mandatory; `staging`/`prod`→PHI; custom-env-undeclared raises); cleartext only for declared/derived synthetic (no real PHI). No code shipped; scorecard gap #4 corrected |
 | [0110](0110-ide-engine-link-doctor-the-status-bar-tells-the-truth-about-the-promote-target.md) | **IDE engine-link doctor — the status bar tells the truth about the promote target** (BACKLOG #232). The `MEFOR: <host>` item painted a green check whenever *anything* answered `GET /health`: `classifyProbe` folded **every** HTTP status — **including a 401** — into `"reachable"`, and the probe **discarded the body**. `AuthSettings.enabled` defaults True, so a plain `serve` = engine up + IDE holding **no session** + every authenticated call 401ing + **a confident green check** (a live probe of the owner's engine returned `{"status":"ok","version":null}` — `/health` discloses `version` only to an authenticated caller, WP-L3-07). The click's menu diagnosed nothing, and its `Open engine URL in browser` opened the **bare** engine URL — a live **404** (there is no `/` route). **Decision:** green means *"the IDE can USE this engine"*, not *"a socket answered"* — a closed link-state union (`unreachable{code}`/`foreign`/`signedOut`/`unverified`/`blocked{reason}`/`drifted`/`ok`) in the vscode-free model; the tokenless poll reads the `/health` body (`version: null` ⇒ **signedOut**; a version present ⇒ **`unverified`, NEVER green** — `optional_identity` applies no RBAC and no must-change gate, and `/auth/me` is must-change-**exempt**, so neither endpoint can prove a session is usable); a green check is **EARNED** only by a **user-initiated** deep probe of a non-exempt protected route (`GET /config/provenance` — `monitoring:read`, no step-up, yields `drift` free) and it **DECAYS**. **The periodic poll MUST stay TOKENLESS** — `identity_for_token(..., activity=True)` refreshes the session idle clock, so a bearer on a 15s timer would make the engine's 30-min idle timeout unreachable forever (CWE-613). Surface is **native chrome, NOT a webview**: a `MarkdownString` hover (the primary diagnosis — renders at the item, needs no command dispatch), a state-gated QuickPick (`title:`, never a `placeHolder:`), a `$(sync~spin)` flip at the click site, and the extension's **first engine `LogOutputChannel`** (URLs/status/errno/duration/verdict — **never a body, never a token**). **Boundary made executable:** the IDE renders and repairs the **LINK**, never the **WORKLOAD** — container poverty + the model emitting **command ids, never data** + **two frozen CI allowlists** (an `EngineLink` field list with no connection/message/queue/count/rate field, and a probe-endpoint list of only `/health`, `/ai/policy`, `/config/provenance`; `/messages`/`/connections`/`/stats` break the build). Exposes `engineSignIn`/`engineSignOut` (already-written flows that were unreachable; `signIn()` inherits ADR 0035's pre-prompt `assertTargetAllowed()` refusal). **Declined:** a webview panel; a bearer on the poll; a "Reload config" button (`require_step_up` + 300s window while `withAuth` never retries a 403); inline change-password/MFA (deep-link to `/ui/login` — the Console owns credentials); "Start local engine" (a terminal cwd'd at a worktree forks a brand-new store + bootstrap admin). Extends [ADR 0100](0100-ide-native-surface-polish-and-open-to-messagefoundry-startup-experience-backlog-221.md) (supersedes its "opens engine settings" record) / [ADR 0035](0035-ide-extension-workspace-trust-and-scope.md); bounded by [ADR 0065](0065-web-ops-dashboard.md); #26-clean | Accepted (2026-07-14) — owner-directed; built + verified against the live engine (IDE v0.0.28) |
 | [0111](0111-not-deployed-connections.md) | **Connection present but not deployed** (BACKLOG #233) — a first-class `deployed: bool = True` on **both** connection models so a config can carry a real, reviewed, dark connection (retired partner, superseded duplicate send, a relay pulled from prod) that is **never wired, never started, never queued to, and whose `env()` is never resolved**. Removes DEGRADED-on-**every**-boot, which is indistinguishable from a real regression — a permanent alarm is a disabled alarm. **Key finding:** `auto_start=False` already dodges `resolve_env_settings` on the *cold serve* path (both boot gates return before `_source_config`/`_dest_config`), **but `_build_check_connectors` (`wiring_runner.py:5181`/`:5186`) loops EVERY inbound and EVERY outbound with NO gate** — so `messagefoundry check` (the **required** commit gate), every reload, every promote and every `connection upsert` still explode, and one unresolvable connection blocks edits to *every other* connection in the file. **Honoring the flag there IS the feature.** `deployed=False` **WINS over `auto_start`** (deploying is a *config* change, not a runtime action → `start`/`restart` 409). **Three-way distinction that must never be conflated:** **SIMULATED** (#15 — built, receives rows, suppresses egress, finalizes `PROCESSED`) vs **PARKED** ([ADR 0048](0048-third-tier-disaster-recovery-standby.md)/[ADR 0095](0095-connection-lifecycle-scheduler-and-credential-fault-stop.md) — rows **RETAINED**, queued, retried) vs **NOT DEPLOYED** (no row is ever created). Enforced at the **`transform_one` Send-materialization seam** (`pipeline/dryrun.py:403-416`) — structurally mirroring [ADR 0084](0084-accepts-router-seam.md)'s `accepts=` seam for the router half — which covers the split, [ADR 0057](0057-inline-step-a-fast-path.md) inline and [ADR 0071](0071-cut-executor-round-trips-b5.md) fused paths plus dry-run/`check`/Test Bench in **one** edit; plus a **separate** 409 guard on the [ADR 0090](0090-resend-a-stored-message-to-an-alternate-outbound-connection.md) resend/edit-resend path, which inserts an outbound row directly and bypasses `transform_one` entirely. **Count-and-log (CLAUDE.md §12) preserved** by a per-destination `message_events` row **added to `_AUDIT_FLOOR_EVENTS`** (else the #63 verbosity gate evaporates it at `errors`/`off`, re-creating the accept-and-drop) + a **7th `MessageStatus.NOT_DEPLOYED`** used only when **every** selected destination was declined — because the finalizer decides `FILTERED` **by absence**, merely dropping the target would silently report "the handler filtered this" with **zero code changes and zero test failures** (the trap). **At-least-once ([ADR 0001](0001-staged-pipeline-architecture.md)) preserved:** the decline is keyed on the **REGISTRY FLAG** (a property of the graph), never on live runner state, so a re-run re-derives an identical delivery set. Connection **stays in `Registry.outbound`** (the orphan sweep keys on the registry — removing it would dead-letter already-queued rows). No DDL, no migration, no schema-hash change. **Not built here:** the `ide/` form controls (three TS field enumerations — deferred to avoid colliding with in-flight [ADR 0106](0106-steps-view-add-dropdown-vocabulary-expansion-adr-0076-phase-b.md) work; the flag works via hand-edited TOML + code-first without them) and **BACKLOG #234** (`_SCALAR_FIELDS` is a 12-key whitelist with no passthrough → a GUI save silently strips `priority`/`schedule`/`shard`/`metadata`/`batch`/`stall`/`dead_letter_days`; a **pre-existing** data-loss bug, filed only). Extends [ADR 0007](0007-gui-manageable-connections-toml.md) | Accepted (2026-07-14) — owner-directed; built (#233) |
diff --git a/docs/testing/master-test-plan/12-vs-code-ide-extension.md b/docs/testing/master-test-plan/12-vs-code-ide-extension.md
index 4785507b..daa0734d 100644
--- a/docs/testing/master-test-plan/12-vs-code-ide-extension.md
+++ b/docs/testing/master-test-plan/12-vs-code-ide-extension.md
@@ -62,15 +62,16 @@ actually fail a merge.
 | Evidence | What it proves |
 |---|---|
 | `.github/workflows/ci.yml:263-317` — `ide build (ubuntu-latest \| windows-latest)` | `npm ci` from `ide/package-lock.json`, `tsc --noEmit` strict type-check, esbuild bundle on both OSes; `npm run test:unit` on every leg; `npm test` (headless VS Code) on the Windows leg only |
-| `ide/package.json:822` `test:unit` | 474 of 560 tests run with no Extension Host; a hand-maintained `--ignore` list excludes 8 files (86 tests) whose module-under-test transitively imports `vscode` |
+| `ide/package.json:822` `test:unit` | 487 of 580 tests run with no Extension Host; a hand-maintained `--ignore` list excludes 8 files (93 tests) whose module-under-test transitively imports `vscode` |
 | `src/test/suite/extension.test.ts` | The extension activates with no workspace; every contributed command is registered; one non-interactive command (`showAiPolicy`) executes end to end |
 | `src/test/suite/settings-scope.test.ts:23-90` | ADR 0035 AC-2/AC-3 as a **family invariant**: every declared setting is classified, anything whose name matches `/url\|endpoint\|host\|python\|exec\|command\|token\|credential/i` must be `scope: "machine"`, and `capabilities.untrustedWorkspaces.supported === "limited"` |
 | `src/test/suite/pythonpath.test.ts` | ADR 0035 AC-1 — `resolvePythonPath` (`cli.ts:25-46`) never prefers a workspace `.venv` when untrusted; an explicit `pythonPath` is honoured verbatim; win32 + posix layouts |
 | `src/test/suite/engine-target.test.ts` | ADR 0035 AC-4 — `assertTargetAllowed` (`engineTarget.ts:29-44`) refuses plain `http://` to a non-loopback host; loopback http allowed; unparseable URL fails safe |
-| `src/test/suite/ai-policy.test.ts` | ADR 0035 AC-5/AC-6 — no cache + no CLI policy ⇒ disabled `"unverified"`; a cached authoritative `off` survives going offline (`aiPolicy.ts:60-68`) |
-| `src/test/suite/engine-doctor.test.ts` | ADR 0110 AC-3/AC-6/AC-8 — the `EngineLink` field allowlist and `PROBE_ENDPOINTS = ["/ai/policy","/config/provenance","/health"]` (`engineStatusModel.ts:124`) are frozen; every `POLL_PLAN` entry is `authenticated:false`; a command link planted in a 403 detail cannot reach the trusted hover |
+| `src/test/suite/ai-policy.test.ts` | ADR 0035 AC-5/AC-6 — no cache + no CLI policy ⇒ disabled `"unverified"`; a cached authoritative `off` survives going offline (`aiPolicy.ts:78-86`). ADR 0035 AC-7/AC-8 — `resolveAiPolicy`'s fetch-and-cache path via an injected `AiPolicyIo`: the bearer reaches the request, `DEFAULT_AI_POLICY_IO.readToken` **is** `peekToken` by identity (never `ensureToken`), SEC-005 withholds it from a non-loopback `http://` target, and a degraded answer does not overwrite a cached deny in the STORE |
+| `src/test/suite/ai-policy-model.test.ts` | ADR 0035 AC-7 — `mergeAuthoritativePolicy`, the only assertion of the merge rule that runs **node-side on every leg** (zero-import module, so not on the `--ignore` list). The deny is sticky over a non-evaluable answer and reaches `assistantState`; a cached permit is **not** sticky; `mode` always comes fresh; "non-evaluable" covers an omitted/non-boolean field, not just `null` |
+| `src/test/suite/engine-doctor.test.ts` | ADR 0110 AC-3/AC-6/AC-8 — the `EngineLink` field allowlist and `PROBE_ENDPOINTS = ["/ai/policy","/config/provenance","/health"]` (`engineStatusModel.ts:131`) are frozen; every `POLL_PLAN` entry is `authenticated:false`; `ENVIRONMENT_PLAN` is `authenticated:false` and `ASSIST_GATE_PLAN` is `authenticated:true` on the **same** route (BACKLOG #330 — asserted so the two cannot be "unified"); a command link planted in a 403 detail cannot reach the trusted hover |
 | `src/test/suite/engine-status.test.ts` | ADR 0110 AC-1/AC-2/AC-5 — `classifyHealth` can never return `ok`; `version:null` vs version-present verdicts; an earned verdict decays; glyph/hover rendering |
-| `src/test/suite/engine-client.test.ts` | ADR 0110 AC-4 — an unanswered request rejects tagged `MF_TIMEOUT`; `ECONNREFUSED` is distinct; hung vs dead render differently |
+| `src/test/suite/engine-client.test.ts` | ADR 0110 AC-4 — an unanswered request rejects tagged `MF_TIMEOUT`; `ECONNREFUSED` is distinct; hung vs dead render differently. ADR 0035 AC-8 — against a real loopback server, a token becomes `Authorization: Bearer <token>` and a tokenless call sends **no** `Authorization` header at all (the status bar's read depends on the latter) |
 | `src/test/suite/engine-control.test.ts` | ADR 0112 AC-3/AC-6 — the serve argv is `serve --config <dir>` with no `--db`/`--env`/`--port`; the preflight classifier picks the right remedy; `runDirHasEngine` fork guard; `planActions` gating |
 | `src/test/suite/engine-setup.test.ts` | Every button on the guided setup page resolves to a known `CMD` id (the webview cannot smuggle an arbitrary command id), ids are unique, `CMD.startEngine` only in the dev-tone section |
 | `src/test/suite/connection-merge.test.ts` | Non-rendered `connections.toml` keys survive an edit; a cleared rendered field deletes the key; retry merges field-wise; clone direction-flip drops inapplicable keys; name-collision refusal; `planSave` is the single merge policy for both writers |
diff --git a/docs/testing/master-test-plan/13-steps-editor.md b/docs/testing/master-test-plan/13-steps-editor.md
index 1a20ec10..ad4025d1 100644
--- a/docs/testing/master-test-plan/13-steps-editor.md
+++ b/docs/testing/master-test-plan/13-steps-editor.md
@@ -49,8 +49,9 @@
 | `tests/test_actions.py` (44 tests) | All 15 vocabulary verbs incl. every `ValueError` guard; ADR 0076 gate 5 purity — `actions.py` top-level imports do no I/O (`:369`), `actions.py` + `lens.py` add no runtime dependency (`:375`) |
 | `tests/test_diagnostics.py` (3 tests) | `log_note` redacts operands unless the dev `_reveal` flag is set; a bad template never raises; `checkpoint` logs segment ids only |
 | `ide/src/test/suite/steps.test.ts` (~20 cases) | Row→view-model kind/title/params mapping; `code`-row verbatim passthrough; parse-error/no-handler/null-parse → text fallback; HTML escaping of HL7-derived params; `buildLensTraceArgs` never emits `--show-phi`; `traceRowValues` redacted by default; live-value line-containment mapping; the BACKLOG #225 dirty-buffer skip incl. a pre-fix regression demo |
-| `ide/src/test/suite/steps-edit.test.ts` (1,842 lines, ~95 cases) | Edit→`lens rewrite` spec mapping; editable vs read-only rows; literal-only param editing; field-picker button placement; rewrite-result parsing; one-edit-at-a-time + queue/coalesce + orphaned-queue discard; F7 `expect_src` wiring from the *projected* source; every structural op spec; toolbar Add defaults; ADR 0103 before/after + `contextMenuEnablement` matrix + the server-rendered menu template; `canDropRow`/`resolveDrop`/`insertionBarAnchor`/`walkMove`/`blockExtent`/`captureBlock`/`blockLabel` |
+| `ide/src/test/suite/steps-edit.test.ts` (2,186 lines, 121 cases) | Edit→`lens rewrite` spec mapping; editable vs read-only rows; literal-only param editing; field-picker button placement; rewrite-result parsing; one-edit-at-a-time + queue/coalesce + orphaned-queue discard; F7 `expect_src` wiring from the *projected* source; every structural op spec; toolbar Add defaults; ADR 0103 before/after + `contextMenuEnablement` matrix + the server-rendered menu template; `canDropRow`/`resolveDrop`/`insertionBarAnchor`/`walkMove`/`blockExtent`/`captureBlock`/`blockLabel`; the BACKLOG #234 suppressed-save deferral (guard debt, `releaseEdit`, `drainEdits`) and the `RerenderDebouncer` one-re-projection-per-release property with a fake clock |
 | `ide/src/test/suite/steps-addmenu.test.ts` (295 lines, ~20 cases) | `ADD_MENU_CATALOG` spans the four ADR 0106 groups; every item op is a supported lens op; Add→Send emits `insert_send`; `ADD_MENU_BY_ID` allowlist; `STRUCTURAL_OPS` forces re-projection; `buildAddMenuRequest` mappings; ADR 0108 `isReturnRow` + `add_destination` |
+| `ide/src/test/suite/steps-mirror.test.ts` (1,492 lines, 50 cases; BACKLOG #233) | The webview↔model MIRROR parity gate. Loads the real `ide/media/stepsWebview.js` under **jsdom** with a recording `acquireVsCodeApi` double and reaches its mirrors through the opt-in `window.__mfStepsTestExports` hook, then asserts each against its `stepsModel` counterpart. **Two populations, deliberately, because the nine computation mirrors split in two** (the tenth, `stepsCtxRows`, IS the serialization boundary and is pinned directly). (i) The five that take a plain ROW ARRAY (`blockExtent`, `captureBlock`+`clipLabel`, `buildDropSlots`, `walkMove`) are swept over **2,000 seeded generated row sets** (`mulberry32`, seed printed on any failure so it reproduces) against ONE loaded page — they never touch the DOM, so a document per set would buy nothing. (ii) The four that are DOM-bound (`canDrop`, `resolveDrop`, `barAnchor`, and `scopeLabel`, which reads `.textContent` off the rendered header) take `<li>` elements and a `getBoundingClientRect`, so they run over **four hand-authored adversarial cases** (nesting 0–4, if/elif/else, nested `for`, an empty-bodied header, `raise`, code rows, the ADR 0108 scaffold pair, an appended send, a `return []` filter, a multi-line row, titles carrying `& < > " '`) × ALL ordered (drag, target) pairs × pointer fractions **0.1/0.4/0.5/0.6/0.9**. 0.4 and 0.6 are the load-bearing ones: they straddle the 1/3 and 2/3 tri-zone thresholds, and 0.1/0.5/0.9 alone cannot see a threshold moving to 1/2 (verified by falsification — every failure landed at 0.4). Covers **at least** STEPS-06 (script loads under jsdom, one `alive` ping, no error diagnostic; its second clause stays manual), STEPS-07/08 (population i), STEPS-09 (population ii), STEPS-10 (context-menu enablement read back off the real server-rendered template) and STEPS-12 (the top-level-function inventory guard). It ALSO pins the row serialization boundary itself (`renderRowHtml` → dataset → `stepsCtxRows`), the code-row drag interception, and the hook's inertness when the opt-in flag is unset. Node-side, imports no `vscode`, so it runs on **every** `ide` leg — not only the Windows Extension Host one. STEPS-11 is satisfied by the seeded-divergence falsifications recorded in the PR, not by a permanently mutated copy in the tree |
 | `ide/src/test/suite/hl7scope.test.ts` + `completion-scope.test.ts` | ADR 0104 AC-9 — trigger→structure resolution, Z-segment + sample union, rank-never-remove, visibly distinct scope miss; decorator/type extraction; `occurrence=`/`repetition=` kwarg context |
 | `.github/workflows/ci.yml` `test` job (`:41`, matrix at `:374-376`) | The full **413-case** `lens`/`actions`/`diagnostics` pytest suite (verified by collection on this checkout) runs on `ubuntu-latest`, `windows-2022`, `windows-2025` (py3.14) as a **required** check — so CRLF, BOM and Windows-path behaviour of the engine half are genuinely exercised on a required leg |
 | `.github/workflows/ci.yml` `ide` job (`:263-320`) | `tsc --noEmit`, esbuild bundle, `npm run test:unit` (the Steps model suites) on both legs, and `npm test` (`@vscode/test-electron`, headless VS Code) on the Windows leg |
@@ -62,15 +63,15 @@
 | Risk | Failure mode | Blast radius | Detected today? | Priority |
 |---|---|---|---|---|
 | Row-contract drift Python→TypeScript | `lens.py` renames a field or changes the partition; the IDE keeps parsing the *frozen* fixture snapshot, so every `ide` test stays green while the live view mis-projects rows. A mis-projected line range means a byte-stable edit splices into the **wrong statement** | Silent wrong transform → wrong clinical data on every message through that Handler | **No.** Verified on this checkout: all 7 committed fixtures are stale — `suite` is missing from all of them, `label`/`operand` from `adt.json` and `IB_RADIOLOGY_SR.json`. `suite` is load-bearing for drag/drop scoping (`stepsModel.ts:29-32`) | P0 |
-| Webview mirror divergence | `ide/media/stepsWebview.js` re-implements 10 pure model functions (`blockExtent:68`, `captureBlock:83`, `buildDropSlots:100`, `walkMove:126`, `clipLabel:309` — the `blockLabel` mirror, `canDrop:384`, `scopeLabel:397`, `resolveDrop:404`, `barAnchor:433`, menu enablement ~`:590`) and is explicitly **not** unit-tested (`steps-edit.test.ts:954-956`: "verified manually"). A diverged mirror computes a wrong move/drop target; the engine then applies it byte-stably and it re-parses clean | Moving a `msg.set` out of an `if` guard, or into the wrong branch, is a semantic change the byte-stability gates structurally cannot see | **No.** ADR 0108's acceptance requires "the model and the CSP-isolated mirror in agreement" with nothing enforcing it. `buildDropSlots` is not even exported from `stepsModel.ts` (`:1672`), so no test *could* compare it today | P0 |
+| Webview mirror divergence | `ide/media/stepsWebview.js` re-implements 10 pure model functions (`blockExtent:68`, `captureBlock:83`, `buildDropSlots:100`, `walkMove:126`, `clipLabel:309` — the `blockLabel` mirror, `canDrop:384`, `scopeLabel:397`, `resolveDrop:404`, `barAnchor:433`, menu enablement ~`:590`) and, until BACKLOG #233, **was** explicitly not unit-tested (`steps-edit.test.ts` said so in as many words: "verified manually"). A diverged mirror computes a wrong move/drop target; the engine then applies it byte-stably and it re-parses clean | Moving a `msg.set` out of an `if` guard, or into the wrong branch, is a semantic change the byte-stability gates structurally cannot see | **Yes, as of BACKLOG #233** — `ide/src/test/suite/steps-mirror.test.ts` loads the webview script under jsdom and asserts every mirror against its model counterpart on every `ide` leg. Both of this row's original grounds are now spent: `buildDropSlots` **is** exported from `stepsModel.ts`, and the drop/clipboard mirrors are **no longer** "verified manually" (`steps-edit.test.ts` now points at the parity suite; what genuinely stays manual is the menu's positioning/dismissal/keyboard wiring, STEPS-76). The suite found exactly **one** live divergence — the model's `canDropRow` accepted a read-only `code` row as a drop target while the webview refused it, contradicting the model's own stated contract — and it is now closed. ADR 0108's "model and mirror in agreement" acceptance line is a gate rather than a claim | P0 |
 | Engine change never triggers the IDE tests | The `ide` job's PR path filter is `^(ide/\|\.github/workflows/ci\.yml)` (`ci.yml:448`). A PR touching `messagefoundry/lens.py` — the exact contract the Steps view consumes — does not run it at all. And `ci-gate` deliberately does **not** `needs: ide` (`ci.yml:265`), so even a red `ide` leg cannot block a merge | The whole analyst-facing surface can regress green. (It does re-run on push-to-main, `ci.yml:410` — after the merge, when it can no longer block anything) | **No** | P0 |
 | Zero action rows in the tested corpus | Census on this checkout: `lens parse` over all 12 `samples/config` handlers yields **12 code rows, 12 send rows, 4 control rows and 0 action/lookup/diagnostic rows**. ADR 0076 gate 1's named corpus therefore proves nothing about the action-row, param-edit or Add-palette surface — the part an analyst actually uses. The IDE fixtures inherit the same hole | Every projection/edit path for the editable surface is only ever tested against ad-hoc inline strings written by whoever wrote the test — no shared, reviewed adversarial corpus | Partially (inline strings in `test_lens_native/palette/fanout`) — but no corpus-level partition/byte-stability/ruff/`check` sweep over action rows | P1 |
 | `{"expr": …}` splice writes arbitrary, unnormalized Python | `_validated_expr` (`lens.py:1869`) checks only "parses as one expression" and "is exactly one call argument". **Verified on this checkout:** `set_field(msg, "PID-3", __import__("os").popen("whoami").read())` is accepted and written into the Handler body. **Also newly verified:** an expr is spliced **verbatim**, so `foo( 1,2 )` produces output that **fails `ruff format --check`** and **fails `ruff check --select F` (F821 undefined name)** — a direct breach of ADR 0076 gate 3 ("emitted code is first-class") that no existing test covers | Handlers execute in the engine process. ADR 0144's lint runs only inside `messagefoundry check`, never on the rewrite path, and the Steps view gives no in-editor signal — while pitching a form field at an analyst who does not know Python. It also silently breaks the purity invariant the at-least-once contract depends on | **No** on all three counts | P1 |
 | False completeness: helper-body writes invisible and unmarked | ADR 0089 Phase D (helper descent) is unbuilt — `_msh(msg)` renders as an opaque `code` row. ADR 0104 AC-10's **"unmodeled code present"** marker does not exist: grep for `unmodeled` across `ide/`, `messagefoundry/`, `tests/` returns only the ADR and `docs/research/message-model-eval.md`; the named test is absent | An analyst edits a PID mapping in the Steps view, sees no other write to that field, saves — and a helper's later write silently overrides it. Wrong clinical data, no failing test, no operator signal | **No** | P1 |
-| The provider is entirely untested | No test file references `stepsView.ts`, `StepsEditorProvider` or `registerSteps`. Untested: save-only re-projection + 250 ms debounce (`stepsView.ts:839-856`, `:89`), fallback-to-text on refusal (`:281`), the 3-second script handshake toast (`:340-349`), exec-gate degradation (`:216`), `applyUndoRedo` (`:499`), `applyPickedEdit`'s drain-not-clear rule (`:472-483`), `applyStructural`'s `clearPending`-before-`endEdit` (`:452`), `retainContextWhenHidden` + `supportsMultipleEditorsPerDocument:false` (`:1127`) | Every ADR 0076 §6 IDE guardrail lives in this one file. A regression means the view writes on a keystroke, races itself, or shows a stale projection | **No** | P1 |
-| Undo/redo not asserted end to end | Each op is one `WorkspaceEdit` (`stepsView.ts:380-386`, `:433-439`), so N Steps ops should be exactly N undo steps returning the file byte-for-byte | A coalesced or partial undo leaves a half-edited Handler that still parses and still passes every byte-stability gate. The operator believes they reverted; they shipped a partial transform | **No** | P1 |
-| Steps view ↔ split text editor race | The engine F7 guard (`lens.py:1533`, tested at `test_lens_rewrite_v2.py:822`) and the IDE `expect_src` wiring (`steps-edit.test.ts:515-595`) are each tested **in isolation**, never interleaved. The code comment at `stepsView.ts:355-358` records the exact defect class: if `expect_src` is ever recomputed from the same buffer sent as stdin, the guard becomes a tautology | The named ADR 0076 §6 failure mode: a stale-coordinate edit splices into the wrong statement | **No** | P1 |
-| Steps-authored destination never validated against the graph | `insert_send`/`add_destination` reject only an **empty** string (`lens.py:2294` — verified: `Send("OB_TYPO_DOES_NOT_EXIST", msg)` is accepted). The IDE destination picker degrades to free text when the graph can't be read (`stepsView.ts:98-106`) | An analyst ships a fan-out leg that silently never delivers. `checks.py:_check_send_target` (`:235-262`) would flag it as *advisory, non-blocking* — and no test proves the Steps path surfaces a Problems entry | **No** | P1 |
+| The provider is entirely untested | No test file references `stepsView.ts`, `StepsEditorProvider` or `registerSteps`. Untested: save-only re-projection + 250 ms debounce (`stepsView.ts:884-898`, `:91`), fallback-to-text on refusal (`:300`), the 3-second script handshake toast (`:364-373`), exec-gate degradation (`:218`), `applyUndoRedo` (`:533`), `applyPickedEdit`'s drain-not-clear rule (`:505-516`), `applyStructural`'s `clearPending`-before-`releaseEdit` (`:482`), `retainContextWhenHidden` + `supportsMultipleEditorsPerDocument:false` (`:1167`) | Every ADR 0076 §6 IDE guardrail lives in this one file. A regression means the view writes on a keystroke, races itself, or shows a stale projection | **No** | P1 |
+| Undo/redo not asserted end to end | Each op is one `WorkspaceEdit` (`stepsView.ts:404-410`, `:463-469`), so N Steps ops should be exactly N undo steps returning the file byte-for-byte | A coalesced or partial undo leaves a half-edited Handler that still parses and still passes every byte-stability gate. The operator believes they reverted; they shipped a partial transform | **No** | P1 |
+| Steps view ↔ split text editor race | The engine F7 guard (`lens.py:1533`, tested at `test_lens_rewrite_v2.py:822`) and the IDE `expect_src` wiring (`steps-edit.test.ts:515-595`) are each tested **in isolation**, never interleaved. The code comment at `stepsView.ts:379-382` records the exact defect class: if `expect_src` is ever recomputed from the same buffer sent as stdin, the guard becomes a tautology | The named ADR 0076 §6 failure mode: a stale-coordinate edit splices into the wrong statement | **No** | P1 |
+| Steps-authored destination never validated against the graph | `insert_send`/`add_destination` reject only an **empty** string (`lens.py:2294` — verified: `Send("OB_TYPO_DOES_NOT_EXIST", msg)` is accepted). The IDE destination picker degrades to free text when the graph can't be read (`stepsView.ts:100-108`) | An analyst ships a fan-out leg that silently never delivers. `checks.py:_check_send_target` (`:235-262`) would flag it as *advisory, non-blocking* — and no test proves the Steps path surfaces a Problems entry | **No** | P1 |
 | Doc↔code drift on the palette | Nothing in code or CI references `docs/STEPS-PALETTE.md`. It is already wrong at line 3 ("The **Steps view** (`/ui`, …)") — grep over `messagefoundry_webconsole/` for `steps`/`lens` returns nothing, and FEATURE-COVERAGE-PLAN.md `:1517` states outright "the web console has no Steps view" | The only user-facing description of the 27-item vocabulary misdirects analysts and reviewers about what code a step actually writes | **No** | P1 |
 | `docs/FEATURE-MAP.md` omits the whole subsystem | §11 "Surfaces — VS Code IDE" (`:175-186`) lists no Steps view, no action vocabulary, no `lens` CLI, no #222/ADR 0076 — while BACKLOG #222 (`:6689`) marks all three phases SHIPPED | A shipped analyst-facing subsystem is invisible in the project's status source of truth, so it is never scoped into release gates, coverage audits or support policy | **No** | P1 |
 | Architectural guardrail is a convention, not a gate | Nothing asserts that no engine package imports `messagefoundry/lens.py`. Today it holds — grep confirms only `__main__.py:2777` and `:2801` (both lazy) plus `tests/` | A declarative logic **execution** path would begin exactly by importing the row contract into `pipeline/`. If it is ever crossed, no test fires | **No** | P1 |
@@ -78,8 +79,8 @@
 | ADR 0104 AC-8 field-picker round-trip unproven | `ide/src/hl7Picker.ts` (171 lines, `pickHl7Path` at `:163`) has **no test file** — grep for `hl7Picker`/`pickHl7Path` across `ide/src/test/` returns nothing. AC-8's named test does not exist | An offered path that does not round-trip byte-identically silently corrupts a field write the moment the analyst clicks it | **No** | P1 |
 | Gate-3 claim overstated | ADR 0076 gate 3 claims rewritten files pass `mypy --strict` and `messagefoundry check` on the samples corpus. No test runs mypy on rewritten output; the sole `check` spot-check is `test_lens_rewrite_v2.py:852` on `adt.py` only, and it relies on that file's `# type: ignore`. The ruff gates `pytest.skip` when ruff is absent (`test_lens_rewrite_v2.py:85-91`) | An emitted form that re-parses but fails strict typing (the class the bare-tuple refusal exists to catch) ships as "first-class output" with the gate asserting nothing — and the gate can silently vanish | **No** | P2 |
 | PHI into the general log via a form field | `log_note` redacts operands but emits the **template verbatim** (`diagnostics.py:43`); the palette inserts an empty template the analyst fills in place (`stepsModel.ts:1001`). `diagnostics._reveal` (`:33`) has no environment clamp — the module docstring calls clamping "a wiring concern for the caller" and no caller does it | PHI at DEBUG in the general application log, authored through a form field by a non-programmer, with CLAUDE.md §9 unenforced on this path | **No** | P2 |
-| Live-value sample picker offers "All files" | `stepsView.ts:251` filters `{ "HL7 messages": ["hl7"], "All files": ["*"] }`; `scopeFor` then reads the pick with `fs.readFileSync` (`:193`). Redaction bounds exposure to segment ids and `buildLensTraceArgs` structurally cannot emit `--show-phi`, but no test exercises the "operator picked a non-synthetic file" path | The PHI posture rests on "the picker defaults to `messageSetsDir`". Nothing enforces or warns | **No** | P2 |
-| No projection budget for large Handlers | Measured on this checkout: a 5,000-statement Handler parses in **0.081 s** and rewrites in **0.155 s** (fine) but yields **5,001 rows / 965,409 bytes** of row JSON, and `buildHandlerViewModels`/`renderHandlersHtml` render every row of every handler with no virtualization (`stepsView.ts:311`, `:339`). `ide/src/cli.ts:162`/`:194` cap child stdout at 64 MB | A large ported Handler makes the view unusable or silently truncated with no notice — on exactly the migrated estates ADR 0089 targets | **No** | P2 |
+| Live-value sample picker offers "All files" | `stepsView.ts:253` filters `{ "HL7 messages": ["hl7"], "All files": ["*"] }`; `scopeFor` then reads the pick with `fs.readFileSync` (`:195`). Redaction bounds exposure to segment ids and `buildLensTraceArgs` structurally cannot emit `--show-phi`, but no test exercises the "operator picked a non-synthetic file" path | The PHI posture rests on "the picker defaults to `messageSetsDir`". Nothing enforces or warns | **No** | P2 |
+| No projection budget for large Handlers | Measured on this checkout: a 5,000-statement Handler parses in **0.081 s** and rewrites in **0.155 s** (fine) but yields **5,001 rows / 965,409 bytes** of row JSON, and `buildHandlerViewModels`/`renderHandlersHtml` render every row of every handler with no virtualization (`stepsView.ts:335`, `:363`). `ide/src/cli.ts:162`/`:194` cap child stdout at 64 MB | A large ported Handler makes the view unusable or silently truncated with no notice — on exactly the migrated estates ADR 0089 targets | **No** | P2 |
 | No git-diff-cleanliness assertion on a working-tree file | Byte-stability is proven against in-memory oracles only; nothing performs a Steps edit on a checked-in file and asserts `git diff` is exactly the intended hunk | Diffable, reviewable config is the stated rationale for the whole #26 decline. One stray whitespace/EOL flip per edit destroys review value on every Steps-authored PR | **No** | P2 |
 | No VSIX build/signature/attestation/publish | grep for `vsce`/`vsix`/`marketplace` over `.github/workflows/` returns nothing; the only path is manual `npm run package` (`ide/README.md:123`, which still names `messagefoundry-0.0.1.vsix` while `ide/package.json:5` says `0.0.34`) | The Steps editor reaches users only through a hand-built, unsigned, unattested VSIX. A missing `media/` asset ships with no gate — and no provenance for a surface that writes executable Handler code | **No** | P1 |
 | Dead coordinate-critical near-duplicate | `stepsModel.ts:261 splitLines` (splits on `\r?\n` only) sits beside `:272 physicalLines` (the correct `\r\n\|\r\|\n` mirror of `lens._physical_lines`, `lens.py:3490`). Only `physicalLines` is used in the build path (`:482`) | A future caller reaching for the wrong one desyncs IDE line slicing from AST coordinates on a CR-only file; F7 then compares mismatched text and either refuses everything or mis-splices | **No** | P2 |
@@ -99,10 +100,10 @@
 | STEPS-03 | `suite` id semantics hold for every row | Functional | pytest | container-CI | n/a | T | P0 | For every row of every corpus handler: `suite` equals the enclosing block header's line number as a string (the `def` line at nesting 0); two rows share a `suite` iff they are AST siblings in the same statement list; no row omits `suite` |
 | STEPS-04 | A single CI job carries both Python 3.14 and Node 24 | Functional | CI-leg | container-CI | n/a | T | P0 | A named job (`steps-contract`) installs both toolchains and runs STEPS-01/02/03/05..12; it appears in `ci-gate`'s `needs:` list (`ci.yml:1386`) and is configured as a required context in branch protection |
 | STEPS-05 | Older/partial contract degrades safely in the view model | Negative/Security | ide-mocha | container-CI | n/a | T | P1 | With `suite`, `label`, `operand`, `literal_params`, `appended` and `scaffold` each individually absent, `buildHandlerViewModels` returns the same row count and order, throws nothing, and (for absent `suite`) `canDropRow` returns `false` for every pair — never an unscoped drop |
-| STEPS-06 | `stepsWebview.js` loads under jsdom and completes its handshake | Functional | ide-mocha | container-CI | n/a | T | P0 | Loaded under jsdom with a stub `acquireVsCodeApi`, the script runs to completion with no thrown error and posts exactly one `{command:"stepsDiag", level:"ping", text:"alive"}`; a second load against the retained `window.__mfStepsVscode` does not re-acquire |
-| STEPS-07 | Mirror parity — `blockExtent` / `captureBlock` / `blockLabel` | Functional | ide-mocha | container-CI | n/a | T | P0 | Over ≥2,000 generated row sets (nesting 0–4, mixed kinds, control headers, returns, scaffold rows), the jsdom-loaded webview functions return values deep-equal to `stepsModel.blockExtent` (`:1767`), `captureBlock` (`:1803`), `blockLabel` (`:1839`) for identical inputs — noting the webview's `blockLabel` mirror is named `clipLabel` (`stepsWebview.js:309`). Any divergence fails |
-| STEPS-08 | Mirror parity — `buildDropSlots` / `walkMove` | Functional | ide-mocha | container-CI | n/a | T | P0 | Same corpus; webview `buildDropSlots` (`:100`) and `walkMove` (`:126`) deep-equal `stepsModel` `buildDropSlots` (`:1672`) and `walkMove` (`:1861`). Requires `buildDropSlots` to be exported from `stepsModel.ts` — the export is part of the deliverable |
-| STEPS-09 | Mirror parity — `canDrop` / `scopeLabel` / `resolveDrop` / `barAnchor` | Functional | ide-mocha | container-CI | n/a | T | P0 | Same corpus, all ordered (drag, target) pairs; webview `canDrop` (`:384`), `scopeLabel` (`:397`), `resolveDrop` (`:404`), `barAnchor` (`:433`) deep-equal `canDropRow` (`:1509`), `scopeLabel` (`:1594`), `resolveDrop` (`:1531`), `insertionBarAnchor` (`:1629`) |
+| STEPS-06 | `stepsWebview.js` loads under jsdom and completes its handshake | Functional | ide-mocha | container-CI | n/a | T | P0 | Loaded under jsdom with a stub `acquireVsCodeApi`, the script runs to completion with no thrown error and posts exactly one `{command:"stepsDiag", level:"ping", text:"alive"}`. **The second clause — a second load against the retained `window.__mfStepsVscode` does not re-acquire — is NOT automated and is covered by STEPS-76's checklist instead** (recorded 2026-08-04): VS Code's retain-context reload gives the script a fresh realm holding a retained `window`, which one jsdom document cannot reproduce — re-running a classic script in the SAME global throws on its own top-level `const`, testing the harness rather than the product |
+| STEPS-07 | Mirror parity — `blockExtent` / `captureBlock` / `blockLabel` | Functional | ide-mocha | container-CI | n/a | T | P0 | Over ≥2,000 **seeded generated** row sets (nesting 0–4, mixed kinds, control headers with and without bodies, elif/else continuations, returns, appended sends, scaffold rows, multi-line rows), the jsdom-loaded webview functions return values deep-equal to `stepsModel.blockExtent`, `captureBlock`, `blockLabel` for identical inputs — noting the webview's `blockLabel` mirror is named `clipLabel` (`stepsWebview.js:309`). The generator is deterministic and the seed is printed with any divergence, so a failure reproduces exactly. Any divergence fails |
+| STEPS-08 | Mirror parity — `buildDropSlots` / `walkMove` | Functional | ide-mocha | container-CI | n/a | T | P0 | Same ≥2,000 generated row sets; webview `buildDropSlots` (`:100`) and `walkMove` (`:126`) deep-equal `stepsModel` `buildDropSlots` and `walkMove`. Requires `buildDropSlots` to be exported from `stepsModel.ts` — the export is part of the deliverable |
+| STEPS-09 | Mirror parity — `canDrop` / `scopeLabel` / `resolveDrop` / `barAnchor` | Functional | ide-mocha | container-CI | n/a | T | P0 | These four are **DOM-bound** — they take `<li>` elements and a `getBoundingClientRect`, so they cannot be driven from a generated row array and are swept over the four hand-authored adversarial cases instead, at **all ordered (drag, target) pairs × pointer fractions 0.1/0.4/0.5/0.6/0.9** (0.4 and 0.6 straddle the 1/3 and 2/3 tri-zone thresholds; without them a threshold drift to 1/2 is invisible). Webview `canDrop` (`:384`), `scopeLabel` (`:397`), `resolveDrop` (`:404`), `barAnchor` (`:433`) deep-equal `canDropRow`, `scopeLabel`, `resolveDrop`, `insertionBarAnchor`. A per-row `getBoundingClientRect` stub is mandatory (jsdom has no layout, and the webview falls back to a constant 0.5 fraction on a zero-height box) and the suite asserts the stub is what makes the fractions discriminate |
 | STEPS-10 | Mirror parity — context-menu enablement | Functional | ide-mocha | container-CI | n/a | T | P0 | For every row context in the corpus, the webview's enablement computation (~`:590`) yields the same enabled/disabled set as `contextMenuEnablement` (`stepsModel.ts:1178`) |
 | STEPS-11 | Seeded divergence is caught | Negative/Security | ide-mocha | container-CI | n/a | T | P0 | A deliberately mutated copy of one mirrored function (e.g. `blockExtent` returning `mj-1`) makes STEPS-07..10 fail with a diff naming the function and the failing input. Demonstrated once in the test suite as a self-check, then reverted |
 | STEPS-12 | Mirror inventory guard | Negative/Security | ide-mocha | container-CI | n/a | T | P1 | A source scan of `ide/media/stepsWebview.js` enumerates every top-level `function <name>(` and asserts each name is either in an explicit "not-a-mirror" allowlist (DOM/wiring helpers) or has a parity assertion in STEPS-07..10. Adding an 11th mirror without a parity test fails |
@@ -129,15 +130,15 @@
 | STEPS-33 | Unparseable module → whole-file refusal → text fallback | Functional | ide-mocha + ide-electron | dev-PC | n/a | T | P1 | `lens parse` on a `SyntaxError` module exits non-zero with a `{"error": …}` body; `shouldFallBackToText` (`stepsModel.ts:500`) returns `fallback:true`; opening it as Steps in a real Extension Host reopens it as the default text editor and shows the notice, leaving the file unmodified |
 | STEPS-34 | Read-only rows refuse every op, including the newer ones | Negative/Security | pytest | container-CI | n/a | T | P1 | For a `code` row, a `control` row, a `collector_init` scaffold row and a `return_collector` scaffold row: each of the 11 `_SUPPORTED_OPS` targeting it is refused with `LensRewriteError` and zero source change |
 | STEPS-35 | Re-projection happens on save only, debounced | Functional | ide-electron | dev-PC | n/a | T | P1 | Typing 20 characters into the underlying document triggers **zero** `lens parse` invocations (counted through a stubbed CLI boundary); one save triggers exactly one after ~250 ms; three saves within 250 ms coalesce to one |
-| STEPS-36 | One Steps editor per document | Functional | ide-electron | dev-PC | n/a | T | P1 | `vscode.openWith` twice on the same URI yields one Steps webview (`supportsMultipleEditorsPerDocument:false`, `stepsView.ts:1127`); the second call focuses the existing one |
+| STEPS-36 | One Steps editor per document | Functional | ide-electron | dev-PC | n/a | T | P1 | `vscode.openWith` twice on the same URI yields one Steps webview (`supportsMultipleEditorsPerDocument:false`, `stepsView.ts:1167`); the second call focuses the existing one |
 | STEPS-37 | Every write is a `WorkspaceEdit`; no out-of-band file write | Negative/Security | ide-mocha + ide-electron | container-CI | n/a | T | P1 | A source scan finds no `fs.write*`/`writeFile`/`appendFile` in `ide/src/stepsView.ts` or `ide/media/stepsWebview.js`; in the Extension Host, an unsaved Steps edit leaves the on-disk mtime and bytes unchanged while `document.isDirty` is true |
 | STEPS-38 | Undo/redo fidelity across a mixed op sequence | Functional | ide-electron | dev-PC | n/a | T | P1 | Apply insert → move → delete → param-edit (4 ops). Four `undo` commands return `document.getText()` **byte-identical** to the original; four `redo` return it byte-identical to the post-edit form. Not 3, not 5 |
 | STEPS-39 | Concurrent Steps + split text editor is refused, not mis-spliced | Functional | ide-electron | dev-PC | n/a | T | P1 | Open Steps + a split text editor on the same file; insert a line above the target row in the text view; then trigger a Steps row edit. `lens rewrite` refuses on `expect_src` mismatch, an error toast appears, the view re-projects, and the file's target statement is unchanged. Repeat with the edit *below* the target row (must still succeed) |
 | STEPS-40 | Live values are skipped while the buffer is dirty | PHI | ide-electron | dev-PC | n/a | T | P1 | With a dirty buffer, no `dryrun --trace` child is spawned and no row shows a live-value marker; after save, markers reattach to the correct rows (line-containment verified against the saved text) |
 | STEPS-41 | Untrusted workspace degrades legibly | Negative/Security | ide-electron | dev-PC | n/a | T | P1 | With workspace trust off, `isExecGated()` is true, no child process is spawned for `lens parse`/`rewrite`/`graph`/`dryrun`, and the Steps view shows an explicit "workspace not trusted" state — not a blank page, not a silent empty row list |
-| STEPS-42 | Script-handshake failure surfaces | Functional | ide-electron | dev-PC | n/a | T | P2 | With the webview script deliberately blocked, the 3-second timer (`stepsView.ts:340-349`) fires exactly one error message naming "View as Code"; with the script loading normally, it never fires |
+| STEPS-42 | Script-handshake failure surfaces | Functional | ide-electron | dev-PC | n/a | T | P2 | With the webview script deliberately blocked, the 3-second timer (`stepsView.ts:364-373`) fires exactly one error message naming "View as Code"; with the script loading normally, it never fires |
 | STEPS-43 | Closing and reopening re-derives rows solely from the `.py` | Negative/Security | ide-electron | dev-PC | n/a | T | P1 | Close the Steps editor, mutate the `.py` on disk out of band, reopen as Steps: the projection reflects the on-disk file exactly. No `globalState`/`workspaceState` key holds rows (asserted by enumerating both stores) |
-| STEPS-44 | A raced typed edit is drained, never dropped | Functional | ide-mocha | container-CI | n/a | T | P1 | With a field-picker edit in flight, a queued typed edit is applied after it settles (`applyPickedEdit` calls `takePending`, not `clearPending` — `stepsView.ts:472-483`); with a structural op in flight, the pending queue is cleared before `endEdit` (`:452`) and nothing drains in between |
+| STEPS-44 | A raced typed edit is drained, never dropped | Functional | ide-mocha | container-CI | n/a | T | P1 | With a field-picker edit in flight, a queued typed edit is applied after it settles (`applyPickedEdit` calls `takePending`, not `clearPending` — `stepsView.ts:505-516`); with a structural op in flight, the pending queue is cleared before the slot is released (`guard.clearPending()` at `:482`, then `releaseEdit`) and nothing drains in between |
 | STEPS-45 | A Steps-authored bad destination reaches the Problems panel | Functional | pytest + ide-electron | dev-PC | n/a | T | P1 | pytest: `messagefoundry validate --json` over a config dir whose Handler sends to `OB_TYPO_DOES_NOT_EXIST` reports a dangling literal target (`checks.py:226 _check_send_target`). ide-electron: after Add→Send with a typed free-text destination and a save, a Problems diagnostic naming the unknown outbound appears within one validate cycle |
 | STEPS-46 | Steps is opt-in, never the default `.py` editor | Negative/Security | ide-mocha + ide-electron | dev-PC | n/a | T | P1 | `ide/package.json:549-556` declares `messagefoundry.stepsEditor` with `"priority": "option"` (asserted as a manifest test); opening a Handler `.py` normally yields the text editor; the "View as Steps" CodeLens appears only on a `@handler` in a config file; "Reopen With → Python" is always reachable from a Steps editor |
 | STEPS-47 | Import-graph guardrail: `lens.py` is CLI-only | Negative/Security | pytest | container-CI | n/a | T | P1 | An AST scan of `messagefoundry/**/*.py` finds `messagefoundry.lens` imported **only** from `messagefoundry/__main__.py` (lazily, inside `_lens_parse`/`_lens_rewrite`). Any import from `pipeline/`, `store/`, `transports/`, `config/`, `api/` or `messagefoundry/__init__.py` fails the test with an explicit "#26 carve-out breach" message |
@@ -146,7 +147,7 @@
 | STEPS-50 | The Steps view is never the artifact of record | Negative/Security | ide-mocha | container-CI | n/a | T | P1 | A source assertion over `ide/src/stepsView.ts` + `ide/media/stepsWebview.js`: no `fs` write API, and every `vscode.setState`/`getState` payload is confined to a declared shape of `{clipboard, selection}` (no `rows`, no `handlers`, no projection). A new persisted field fails the test |
 | STEPS-51 | The palette contains nothing non-executable (BACKLOG #231 line) | Negative/Security | ide-mocha + pytest | container-CI | n/a | T | P1 | Every `ADD_MENU_CATALOG` item's `op` ∈ `lens._SUPPORTED_OPS` (asserted against the engine's real set, exported to a manifest — not the hardcoded copy in `steps-addmenu.test.ts`), **and** every item's generated form re-parses to a non-`code`, non-decorative row. A decorative/grouping item with no executable projection fails |
 | STEPS-52 | Routers have no Steps view, at the provider level too | Negative/Security | pytest + ide-electron | dev-PC | n/a | T | P1 | pytest (extends `test_lens_parse.py:435`): a module containing only `@router` defs parses to `[]` handlers. ide-electron: opening that module as Steps falls back to text with the "no handler" notice; no router row, no router palette |
-| STEPS-53 | No declarative field-mapping surface | Negative/Security | ide-mocha | container-CI | n/a | T | P1 | No catalog item, message command or persisted structure represents a source→destination mapping table; the HL7 field picker's only effect is to splice a **path string argument** into an existing call (`stepsView.ts:619-630` → `applyPickedEdit` → `set_params`). A commit adding a mapping-table message type or artifact fails the message-command allowlist assertion |
+| STEPS-53 | No declarative field-mapping surface | Negative/Security | ide-mocha | container-CI | n/a | T | P1 | No catalog item, message command or persisted structure represents a source→destination mapping table; the HL7 field picker's only effect is to splice a **path string argument** into an existing call (`stepsView.ts:654-665` → `applyPickedEdit` → `set_params`). A commit adding a mapping-table message type or artifact fails the message-command allowlist assertion |
 | STEPS-54 | `docs/STEPS-PALETTE.md` ↔ `ADD_MENU_CATALOG` are 1:1 | Functional | ide-mocha | container-CI | n/a | T | P1 | A node test parses the four markdown tables and asserts: 27 rows total, group counts 14/3/8/2 matching the headings, and every row's **Item** label maps to exactly one catalog id with the same `group`. An added/renamed/removed catalog item fails |
 | STEPS-55 | Every documented "Generates" form round-trips | Functional | pytest | container-CI | n/a | T | P1 | For each of the 27 documented generated forms, inserting that literal source into a handler and re-parsing yields the row kind/action the doc implies (e.g. `msg.add_repetition("<path>", "<value>")` → `action`/`add_repetition`). A doc form the lens does not recognise fails |
 | STEPS-56 | `STEPS-PALETTE.md` names the correct surface | Functional | ide-mocha | container-CI | n/a | T | P1 | Line 3 no longer claims the Steps view is at `/ui`; a doc assertion requires the phrase identifying it as the VS Code custom editor `messagefoundry.stepsEditor`. Corroborated by: grep for `steps`/`lens` over `messagefoundry_webconsole/` returns nothing, and FEATURE-COVERAGE-PLAN.md `:1517` states "the web console has no Steps view" |
@@ -155,7 +156,7 @@
 | STEPS-59 | `diagnostics._reveal` is environment-clamped | PHI | pytest | container-CI | n/a | T | P2 | With `active_environment` resolving to `staging` or `prod`, enabling `diagnostics._reveal` either raises or is a no-op (operands stay `TRACE_REDACTED`). Today `diagnostics.py:33` documents clamping as "a wiring concern for the caller" and no caller does it |
 | STEPS-60 | Live-value trace never carries `--show-phi`, in the real argv | PHI | ide-electron | dev-PC | n/a | T | P1 | The argv of the spawned child in a real Extension Host run contains `dryrun`, `--trace`, `json` and never `--show-phi` (complements the pure assertion in `steps.test.ts` on `buildLensTraceArgs`, `stepsModel.ts:674`); every rendered live value is the redacted placeholder |
 | STEPS-61 | Live-value output is never persisted | PHI | ide-electron | dev-PC | n/a | T | P1 | After a live-value run, no new file appears under the workspace, the extension storage path, or the global storage path; `globalState`/`workspaceState` gain no key containing trace data. Verified by directory + state snapshot diff |
-| STEPS-62 | A sample picked outside `messageSetsDir` still leaks nothing | PHI | ide-electron | dev-PC | n/a | T | P2 | With the "All files" filter used to pick a **synthetic** `.hl7` outside `messageSetsDir`, `scopeFor` (`stepsView.ts:185-204`) contributes only segment ids to the picker scope — no field value reaches the scope, the rows, the HTML, or any persisted state (asserted by scanning the rendered HTML for every field value in the file) |
+| STEPS-62 | A sample picked outside `messageSetsDir` still leaks nothing | PHI | ide-electron | dev-PC | n/a | T | P2 | With the "All files" filter used to pick a **synthetic** `.hl7` outside `messageSetsDir`, `scopeFor` (`stepsView.ts:187-206`) contributes only segment ids to the picker scope — no field value reaches the scope, the rows, the HTML, or any persisted state (asserted by scanning the rendered HTML for every field value in the file) |
 | STEPS-63 | Steps test evidence carries no message bodies | PHI | CI-leg | container-CI | n/a | T | P1 | The Steps legs never redirect `lens parse`/`lens rewrite`/`dryrun`/`generate` stdout into a CI log line, a job summary, or an uploaded artifact; all corpus data is synthetic and committed as such. A grep of the job log for `PID\|` / `MSH\|` finds no message body |
 | STEPS-64 | Projection performance budget on a large Handler | Performance | pytest | container-CI | n/a | T | P2 | A generated 5,000-statement Handler: `lens parse` ≤ 0.5 s and `lens rewrite` ≤ 1.0 s wall clock on the CI runner (measured baseline on this checkout: 0.081 s / 0.155 s), and the emitted JSON is ≤ 2 MB (measured baseline: 965,409 bytes for 5,001 rows) |
 | STEPS-65 | Large projections are capped or virtualized with an explicit notice | Performance | ide-mocha | container-CI | n/a | T | P2 | Above a declared row threshold, `renderHandlersHtml` either virtualizes or emits an explicit "too large to project — open as code" notice; the rendered HTML for a 5,001-row contract is bounded and the notice text is present. Silent truncation fails |
@@ -169,11 +170,11 @@
 | STEPS-73 | Field-picker splice is byte-stable and scope-correct | Functional | ide-electron | dev-PC | n/a | T | P2 | Picking a path on an `action` row produces exactly one `set_params` edit changing only that argument; a scoped pick on a handler with `accepts_types` ranks the declared type's segments first and never removes the All-segments escape |
 | STEPS-74 | Deep nesting and wide fan-out survive every op | Functional | pytest | container-CI | n/a | T | P2 | A corpus handler nested 6 levels deep with a 5-destination accumulator fan-out: every op at every nesting level is either applied byte-stably (verified against the independent oracle) or refused with zero change; `suite` ids remain unique and correct after each |
 | STEPS-75 | Analyst comprehension trial on a representative Handler | Usability | manual | dev-PC | n/a | C | P1 | A non-Python HL7 interface analyst, given an unfamiliar anonymized ported Handler, correctly states what it does and makes one correct field-mapping edit that passes `messagefoundry check` — without opening the text editor. Recorded as pass/fail with the analyst's stated confusions. **C — the outcome is recorded, not gated:** exit criterion 14 blocks on the trial being *run*, not on its result, so it cannot fail a release. It becomes a **T** row the day the owner records a pass threshold. The core product claim; no automated proxy exists |
-| STEPS-76 | Drag-and-drop and context-menu behaviour in a live webview | Usability | manual | dev-PC | n/a | T | P1 | A human confirms: the insertion bar lands where the statement lands; the tri-zone control-header drop (before / into body / after block) matches the resulting code; the cross-suite scope label is correct; a drop on a read-only `code` row is refused; the context menu clamps to the viewport, flips submenus at the right edge, reveals submenus mutually exclusively, and dismisses on Escape/outside-click/scroll/resize/blur |
+| STEPS-76 | Drag-and-drop and context-menu behaviour in a live webview | Usability | manual | dev-PC | n/a | T | P1 | A human confirms: the insertion bar lands where the statement lands; the tri-zone control-header drop (before / into body / after block) matches the resulting code; the cross-suite scope label is correct; a drop on a read-only `code` row is refused; the context menu clamps to the viewport, flips submenus at the right edge, reveals submenus mutually exclusively, and dismisses on Escape/outside-click/scroll/resize/blur; **and (added 2026-08-04, from STEPS-06's un-automatable second clause) that a retain-context reload of the Steps panel does not re-acquire the VS Code API — one `alive` ping, no double-acquire error, the toolbar still live** |
 | STEPS-77 | Visual states an eyeball must confirm | Usability | manual | dev-PC | n/a | T | P2 | Muted read-only scaffold rows (`sends = []` / `return sends`), the `[blank]` placeholder on an empty editable input, greyed ↑/↓ at suite edges, the row selection focus ring, and the redacted `▸ ⋯` live-value placeholder all render as specified |
 | STEPS-78 | Clean-machine VSIX install and first Steps open | Compat | manual | dev-PC | n/a | T | P2 | On a machine with no prior extension state: `code --install-extension <vsix>`, open a Handler, "View as Steps" — rows render, the toolbar enables, and one edit applies. No missing-asset error in the webview console |
 | STEPS-79 | Coverage-lift scan on the external estate | Usability | external | dev-PC | n/a | C | P2 | Re-running ADR 0089 §5's repeatable AST scan over the external 87-file / 486-function config repository reports the recognized-statement percentage and the residual `code`-row percentage per handler. **C — it publishes a number, and no threshold exists to fail against**; it becomes a **T** row when the owner records a minimum recognized-statement percentage. Needs a corpus that is not in this repo |
-| STEPS-80 | Multi-author: a `git pull` rewrites the `.py` under an open Steps editor | Functional | ide-electron | dev-PC | n/a | T | P1 | With Steps open on a corpus Handler and the buffer **clean**, a second author's commit is applied to the working tree out of band (`git pull` / `git checkout <branch>`) so statements shift and one target statement changes text. Then: (a) the view re-projects from the new on-disk text within one 250 ms debounce (`stepsView.ts:89`, `:839-856`) and no row keeps a pre-pull coordinate; (b) a row edit posted from the **pre-pull** projection is refused on `expect_src` mismatch (`lens.py:1533`) with the file byte-unchanged — never spliced into the pulled text; (c) with the buffer **dirty** at pull time, the on-disk change does not silently overwrite the projection: the view either re-projects from the buffer or shows the stale-projection notice, and no `WorkspaceEdit` is applied against stale coordinates. Complements STEPS-39 (same-machine split editor) and STEPS-43 (out-of-band change while the editor is *closed*) — neither covers a live editor under a concurrent author |
+| STEPS-80 | Multi-author: a `git pull` rewrites the `.py` under an open Steps editor | Functional | ide-electron | dev-PC | n/a | T | P1 | With Steps open on a corpus Handler and the buffer **clean**, a second author's commit is applied to the working tree out of band (`git pull` / `git checkout <branch>`) so statements shift and one target statement changes text. Then: (a) the view re-projects from the new on-disk text within one 250 ms debounce (`stepsView.ts:91`, `:884-898`) and no row keeps a pre-pull coordinate; (b) a row edit posted from the **pre-pull** projection is refused on `expect_src` mismatch (`lens.py:1533`) with the file byte-unchanged — never spliced into the pulled text; (c) with the buffer **dirty** at pull time, the on-disk change does not silently overwrite the projection: the view either re-projects from the buffer or shows the stale-projection notice, and no `WorkspaceEdit` is applied against stale coordinates. Complements STEPS-39 (same-machine split editor) and STEPS-43 (out-of-band change while the editor is *closed*) — neither covers a live editor under a concurrent author |
 
 **Row count: 80 (STEPS-01 … STEPS-80). Class: T 78, C 2 (STEPS-75, STEPS-79), A 0. P0: 12 (all T). P1: 51. P2: 17.**
 
@@ -197,20 +198,20 @@
 
 #### S2 — STEPS-06..12: the jsdom mirror-parity suite
 
-**Preconditions.** `jsdom` added to `ide/package.json` devDependencies and `ide/package-lock.json` re-locked (DEP-1 applies to the lockfile). `buildDropSlots` exported from `ide/src/stepsModel.ts:1672`.
+**Preconditions.** `jsdom` added to `ide/package.json` devDependencies and `ide/package-lock.json` re-locked (DEP-1 applies to the lockfile). `buildDropSlots` exported from `ide/src/stepsModel.ts`.
 
 **Steps.**
-1. Build a row-set generator producing `RowDropContext[]` with: nesting 0–4, kinds `action`/`lookup`/`control`/`send`/`code`/`diagnostic`, control headers with and without bodies, `appended` sends, `collector_init`/`return_collector` scaffold rows, and `suite` ids consistent with the nesting.
-2. Load `ide/media/stepsWebview.js` under jsdom with `window.acquireVsCodeApi` stubbed to a recording double and `document.querySelectorAll('li.row')` backed by a synthetic DOM built from the generated rows.
-3. Extract the webview's mirrored functions from the loaded script's scope (expose them behind a test-only `window.__mfStepsTestExports` hook set inside the existing IIFE — a hook, not a second implementation).
-4. For each generated row set, call each mirrored function and its `stepsModel` counterpart with identical inputs and `assert.deepStrictEqual`.
-5. Repeat over all ordered (drag, target) pairs for `canDrop`/`resolveDrop`/`barAnchor`.
+1. Build a **seeded** row-set generator producing `RowDropContext[]` with: nesting 0–4, kinds `action`/`lookup`/`control`/`send`/`code`/`diagnostic`, control headers with and without bodies, elif/else continuations, `appended` sends, `collector_init`/`return_collector` scaffold rows, and `suite` ids consistent with the nesting. Deterministic (`mulberry32`) so the seed alone reproduces a failing set.
+2. Load `ide/media/stepsWebview.js` under jsdom with `window.acquireVsCodeApi` stubbed to a recording double and `document.querySelectorAll('li.row')` backed by a synthetic DOM built from the rendered rows. **Note (recorded 2026-08-04):** only the DOM-bound mirrors need this per case. The five row-array mirrors are pure, so the ≥2,000-set sweep runs against ONE loaded page; the render → DOM → read-back boundary they skip is pinned separately by the `stepsCtxRows`-vs-view-models comparison over the hand-authored cases.
+3. Extract the webview's mirrored functions from the loaded script's scope behind a test-only `window.__mfStepsTestExports` hook — a hook handing out the SAME function objects the page uses, never a second implementation. **Placement (corrected 2026-08-04):** there is no enclosing IIFE to put it in. `ide/media/stepsWebview.js` is a standalone CLASSIC script loaded via the `<script nonce src>` tag `pageHtml` emits in `stepsView.ts`, from an `asWebviewUri` of `media/`; its body is merely indented four spaces, and the only IIFEs are the local `disableArrowsAtWalkEnds` (`:246-256`) and `wireContextMenu` (`:635-806`). The hook therefore sits at **end of file**, after every declaration and after the wiring that populates `dragSrc`/`rows`, and is **opt-in**: it is published only when the loader sets `window.__mfStepsTestExportsEnabled = true` first. Honest scope — because this is a classic script, its mirrored functions are ALREADY page globals; the gate adds a named, greppable contract and keeps the shipped surface unchanged, it does not newly hide behaviour.
+4. For each generated row set, call each row-array mirror and its `stepsModel` counterpart with identical inputs and `assert.deepStrictEqual`.
+5. For the DOM-bound mirrors, repeat over all ordered (drag, target) pairs × pointer fractions 0.1/0.4/0.5/0.6/0.9 for `canDrop`/`resolveDrop`/`barAnchor`/`scopeLabel`, with a per-row `getBoundingClientRect` stub so the fractions mean something.
 
 **Observation point.** The first `deepStrictEqual` failure, printed with the seed and the failing row set so it reproduces.
 
 **Expected result.** Zero divergences. Because `stepsModel`'s versions are already covered by `steps-edit.test.ts`, parity transitively pins the webview's mirrored functions to verified behaviour. ADR 0108's "model and mirror in agreement" acceptance line becomes a gate rather than a claim.
 
-**Cleanup/rollback.** The `__mfStepsTestExports` hook must be inert outside jsdom — assert in STEPS-06 that it is absent when `acquireVsCodeApi` is the real one, so nothing new is exposed in the shipped webview.
+**Cleanup/rollback.** The `__mfStepsTestExports` hook must be inert outside jsdom — assert in STEPS-06 that it is absent when the loader has **not** set `window.__mfStepsTestExportsEnabled = true` (the actual gate; nothing in the extension sets it), so nothing new is exposed in the shipped webview.
 
 #### S3 — STEPS-39: the Steps-view / split-text-editor race (the named ADR 0076 §6 failure mode)
 
@@ -226,7 +227,7 @@
 
 **Observation point.** `document.getText()` after the edit settles, plus the presence/absence of an error notification.
 
-**Expected result.** In the *above* case, `lens rewrite` refuses on the `expect_src` mismatch (`lens.py:1533`), an error toast appears, the view re-projects, and the target statement — and every other statement — is unchanged. In the *below* case the edit applies to the correct statement. Critically: the test must drive the **projection-time** `expect_src`, not one recomputed from the live buffer — the tautology defect the comment at `stepsView.ts:355-358` records. Assert that the `expect_src` sent differs from the current buffer's text at that line range, or the test proves nothing.
+**Expected result.** In the *above* case, `lens rewrite` refuses on the `expect_src` mismatch (`lens.py:1533`), an error toast appears, the view re-projects, and the target statement — and every other statement — is unchanged. In the *below* case the edit applies to the correct statement. Critically: the test must drive the **projection-time** `expect_src`, not one recomputed from the live buffer — the tautology defect the comment at `stepsView.ts:379-382` records. Assert that the `expect_src` sent differs from the current buffer's text at that line range, or the test proves nothing.
 
 **Cleanup/rollback.** `vscode.commands.executeCommand("workbench.action.revertAndCloseActiveEditor")`; the fixture lives in a temp workspace copied per test.
 
@@ -291,7 +292,7 @@
 
 **Steps.**
 1. Open a corpus Handler as Steps.
-2. Invoke the sample picker; stub `vscode.window.showOpenDialog` to return the `outside/` file (simulating the "All files" filter at `stepsView.ts:251`).
+2. Invoke the sample picker; stub `vscode.window.showOpenDialog` to return the `outside/` file (simulating the "All files" filter at `stepsView.ts:253`).
 3. Let `scopeFor` (`:185-204`) and `liveValuesFor` (`:215-230`) run.
 4. Capture the rendered `panel.webview.html`, the child-process argv, and a snapshot of `globalState`/`workspaceState` and the extension storage directory.
 
@@ -356,8 +357,8 @@
 2. **`jsdom`** as an `ide/` devDependency, with `ide/package-lock.json` re-locked. DEP-1 applies: verify the package, add it to `package.json`, re-lock — never an ad-hoc install.
 3. **A synthetic, PHI-free Steps corpus** (`tests/data/steps_corpus/`) exercising all 27 palette items, all 15 vocabulary verbs, both diagnostics, all three lookups, every ADR 0089 Phase A native form and every Phase C control label. Today `samples/config` yields **zero** action/lookup/diagnostic rows (verified census: 12 code, 12 send, 4 control). Generate the HL7 side with `python -m messagefoundry generate adt --count N` into a git-ignored directory and hand-author the Handler modules; commit the modules, not generator stdout.
 4. **A synthetic `messageSetsDir`** for live-value and field-picker scope tests, plus a sibling `outside/` directory for STEPS-62.
-5. **A `__mfStepsTestExports` hook** inside `ide/media/stepsWebview.js`'s IIFE, inert outside jsdom — the only way to reach the webview's mirrored functions without duplicating them a third time.
-6. **`buildDropSlots` exported** from `ide/src/stepsModel.ts:1672`.
+5. **A `__mfStepsTestExports` hook** at the **end of** `ide/media/stepsWebview.js` (corrected 2026-08-04 — the file is a classic script with no enclosing IIFE; see §S2 step 3), published only when the loader sets `window.__mfStepsTestExportsEnabled = true`, so it is inert in the shipped webview — the only way to reach the webview's mirrored functions by name without duplicating them a third time.
+6. **`buildDropSlots` exported** from `ide/src/stepsModel.ts`.
 7. **A temp-git-repo fixture helper** for STEPS-67 (with `core.autocrlf=false` and `* -text`).
 8. **A VS Code Marketplace publisher account + signing/attestation identity**, if VSIX publishing is to be gated in `release.yml` (owner decision — Q7).
 9. **An untrusted-workspace VS Code profile** (workspace trust off) for STEPS-41.
@@ -373,7 +374,7 @@
 1. **All 12 P0 rows pass** on the required CI path, and each has been demonstrated to fail against a deliberately seeded defect (STEPS-11 is the template; the same demonstration is required for STEPS-01, STEPS-13 and STEPS-14).
 2. **The `steps-contract` job is a required context** in branch protection and appears in `ci-gate`'s `needs:` list. A PR touching only `messagefoundry/lens.py` runs it; a red leg blocks the merge.
 3. **All 7 committed lens fixtures regenerate with an empty `git diff`**, and at least one fixture contains action, lookup, diagnostic, control and send rows.
-4. **Zero mirror divergences** across ≥2,000 generated row sets for all 10 mirrored functions in `ide/media/stepsWebview.js`, with the inventory guard (STEPS-12) green.
+4. **Zero mirror divergences** for all 10 mirrored functions in `ide/media/stepsWebview.js`, with the inventory guard (STEPS-12) green — across ≥2,000 seeded generated row sets for the five row-array mirrors, and across the four hand-authored adversarial cases × all ordered (drag, target) pairs × five pointer fractions for the four DOM-bound ones plus the `stepsCtxRows` serialization boundary. *(Amended 2026-08-04: the criterion originally said ≥2,000 generated row sets for all ten. The DOM-bound four take `<li>` elements, so a "row set" for them is a rendered jsdom document — ~30 ms each, which is not a unit-leg budget at that volume and buys nothing the ordered-pair × fraction sweep does not already reach. The volume requirement stands where it is meaningful and is stated honestly where it is not.)*
 5. **The Steps corpus census reports zero gaps**: 27/27 palette items, 15/15 verbs, 2/2 diagnostics, 3/3 lookups, 5/5 Phase A forms, 4/4 Phase C labels — each with ≥1 row.
 6. **Gate 3 is real**: `ruff format --check`, `ruff check --select F`, `mypy --strict` and `messagefoundry check` all pass over the *whole rewritten corpus* for *every* op, and none of those gates can `skip` — a missing tool is a CI failure.
 7. **The `{"expr": …}` disposition is decided and enforced** (Q4): every expression in the STEPS-23..26 matrix has a single documented, tested disposition, and no accepted expression produces ruff-format-dirty or F821-dirty output.
diff --git a/docs/testing/master-test-plan/19-execution-phasing-and-sign-off.md b/docs/testing/master-test-plan/19-execution-phasing-and-sign-off.md
index c528e31c..041f2c65 100644
--- a/docs/testing/master-test-plan/19-execution-phasing-and-sign-off.md
+++ b/docs/testing/master-test-plan/19-execution-phasing-and-sign-off.md
@@ -315,7 +315,10 @@ set: `app.js` is 1,506 lines carrying the ASVS 14.3.1 watchdog, both WebAuthn ce
 cookie jar anywhere; dual-control dead-ends in the sole operator console); `WEB-56` (the exposure
 runbook printed to operators six times that ships nowhere); `STEPS-01`..`STEPS-05` (all seven
 committed lens fixtures are stale) and `STEPS-06`..`STEPS-12` (the webview mirror re-implements ten
-model functions, "verified manually"); `STEPS-23`..`STEPS-27` (the verbatim `expr` splice that
+model functions which, when this phasing was written, were "verified manually" — **that half closed
+2026-08-04 with BACKLOG #233**: `ide/src/test/suite/steps-mirror.test.ts` gates all ten on every `ide`
+leg, leaving only the STEPS-01..05 fixture half of this P0 group open);
+`STEPS-23`..`STEPS-27` (the verbatim `expr` splice that
 produces output failing both `ruff format --check` and `ruff check --select F`);
 `IDE-09`..`IDE-22` (every credential and PHI path lives in a zero-test shell);
 `IDE-41`..`IDE-44` (the delivery vehicle — `vsce package` exists but appears in no workflow);
diff --git a/harness/config/estate/graph.py b/harness/config/estate/graph.py
index 2de5ab95..d0e8c838 100644
--- a/harness/config/estate/graph.py
+++ b/harness/config/estate/graph.py
@@ -66,8 +66,9 @@ def _make_hub(dests: list[str], shape: EstateShape, index: int) -> HandlerFn:
 
     def handle(msg: Message | RawMessage) -> list[Send | SetState | SetMeta]:
         transformed = _apply_transform(msg, shape, index)
-        # Typed to the Handler's list element union (not bare ``list[Send]``) so the fan-out is
-        # assignable to HandlerFn — a ``list`` is invariant, so ``list[Send]`` would not be.
+        # Typed to the Handler's element union (not bare ``list[Send]``) so the annotation states the
+        # full contract. It is no longer required for assignability: since BACKLOG #341 ``HandlerFn``
+        # returns an ``Iterable``, which is covariant, so a plain ``list[Send]`` would assign too.
         sends: list[Send | SetState | SetMeta] = [Send(dest, transformed) for dest in dests]
         return sends
 
diff --git a/ide/media/stepsWebview.js b/ide/media/stepsWebview.js
index 65b5f8e8..38446a92 100644
--- a/ide/media/stepsWebview.js
+++ b/ide/media/stepsWebview.js
@@ -808,3 +808,35 @@
       vscode.postMessage({ command: 'stepsDiag', level: 'error', text: 'context-menu wiring failed: ' + e });
     }
 
+    // ---- TEST-ONLY EXPORT HOOK (BACKLOG #233; master test plan 13-steps-editor.md §S2 step 3) --------
+    // The ten functions above MIRROR pure, unit-tested helpers in ide/src/stepsModel.ts (the declared
+    // source of truth) because this script is loaded into a `default-src 'none'` webview and cannot
+    // import across that boundary. The differential suite (ide/src/test/suite/steps-mirror.test.ts) loads
+    // THIS FILE under jsdom and asserts every mirror agrees with its model counterpart, so a drift shows
+    // up as a red test instead of "the drop landed somewhere other than the indicator said".
+    //
+    // This is a HOOK, never a second implementation — it hands out the SAME function objects the page
+    // itself uses. It must be assigned LAST: `dragSrc` and the `rows` list are top-level bindings the
+    // closures read, so the hook has to sit after every declaration and after the wiring that populates
+    // them. Deliberately NO `setDragSrc` mutator — the suite drives `dragSrc` by dispatching a real
+    // `dragstart`, which also exercises the code-row drag interception above.
+    //
+    // Opt-in ONLY: the loader must set `window.__mfStepsTestExportsEnabled = true` BEFORE this script
+    // runs. Nothing in the extension sets it, so the shipped webview never publishes the hook. (Honest
+    // scope: this file is a CLASSIC script, so its top-level `function` declarations are already globals
+    // in the page — the gate adds a NAMED, greppable contract and keeps the shipped surface unchanged,
+    // it does not newly hide behaviour that was previously exposed.)
+    if (window.__mfStepsTestExportsEnabled === true) {
+      window.__mfStepsTestExports = {
+        stepsCtxRows: stepsCtxRows,
+        blockExtent: blockExtent,
+        captureBlock: captureBlock,
+        clipLabel: clipLabel,
+        buildDropSlots: buildDropSlots,
+        walkMove: walkMove,
+        canDrop: canDrop,
+        scopeLabel: scopeLabel,
+        resolveDrop: resolveDrop,
+        barAnchor: barAnchor,
+      };
+    }
diff --git a/ide/package-lock.json b/ide/package-lock.json
index 70b06c87..21623b73 100644
--- a/ide/package-lock.json
+++ b/ide/package-lock.json
@@ -16,6 +16,7 @@
         "@vscode/vsce": "^3.0.0",
         "esbuild": "^0.28.1",
         "glob": "^13.0.6",
+        "jsdom": "^29.1.1",
         "mocha": "^11.7.6",
         "typescript": "^5.4.5"
       },
@@ -23,6 +24,57 @@
         "vscode": "^1.95.0"
       }
     },
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "5.1.11",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-5.1.11.tgz",
+      "integrity": "sha512-KVw6qIiCTUQhByfTd78h2yD1/00waTmm9uy/R7Ck/ctUyAPj+AEDLkQIdJW0T8+qGgj3j5bpNKK7Q3G+LedJWg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/generational-cache": "^1.0.1",
+        "@csstools/css-calc": "^3.2.0",
+        "@csstools/css-color-parser": "^4.1.0",
+        "@csstools/css-parser-algorithms": "^4.0.0",
+        "@csstools/css-tokenizer": "^4.0.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@asamuzakjp/dom-selector": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-7.1.1.tgz",
+      "integrity": "sha512-67RZDnYRc8H/8MLDgQCDE//zoqVFwajkepHZgmXrbwybzXOEwOWGPYGmALYl9J2DOLfFPPs6kKCqmbzV895hTQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/generational-cache": "^1.0.1",
+        "@asamuzakjp/nwsapi": "^2.3.9",
+        "bidi-js": "^1.0.3",
+        "css-tree": "^3.2.1",
+        "is-potential-custom-element-name": "^1.0.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@asamuzakjp/generational-cache": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/generational-cache/-/generational-cache-1.0.1.tgz",
+      "integrity": "sha512-wajfB8KqzMCN2KGNFdLkReeHncd0AslUSrvHVvvYWuU8ghncRJoA50kT3zP9MVL0+9g4/67H+cdvBskj9THPzg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@asamuzakjp/nwsapi": {
+      "version": "2.3.9",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/nwsapi/-/nwsapi-2.3.9.tgz",
+      "integrity": "sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@azu/format-text": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@azu/format-text/-/format-text-1.0.2.tgz",
@@ -233,6 +285,159 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@bramus/specificity": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/@bramus/specificity/-/specificity-2.4.2.tgz",
+      "integrity": "sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "css-tree": "^3.0.0"
+      },
+      "bin": {
+        "specificity": "bin/cli.js"
+      }
+    },
+    "node_modules/@csstools/color-helpers": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.0.tgz",
+      "integrity": "sha512-064IFJdjTfUqnjpCVpMOdbr8FLQBhinbZj6yRv2An2E41O/pLEXqfFRWqGq/SxlE5PEUYTlvWsG2r8MswAVvkg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=20.19.0"
+      }
+    },
+    "node_modules/@csstools/css-calc": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-3.3.0.tgz",
+      "integrity": "sha512-c5ihYsPkdG6JCkU2zTMm4+k6r7RXuGxtWYhu5DHMIiF1FHzrfmHL5so11AoFpUv/tu61xfcmT4AmKoFfMPoqdQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^4.0.0",
+        "@csstools/css-tokenizer": "^4.0.0"
+      }
+    },
+    "node_modules/@csstools/css-color-parser": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.10.tgz",
+      "integrity": "sha512-UZhQLIUyJaaMepqehrCODwCg2KW25vFvLWBmqYFaPclYvvxzj/sG8LBOhBFCp11i9uE7t1EyS+RAoV9tztPFyw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^6.1.0",
+        "@csstools/css-calc": "^3.3.0"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^4.0.0",
+        "@csstools/css-tokenizer": "^4.0.0"
+      }
+    },
+    "node_modules/@csstools/css-parser-algorithms": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-4.0.0.tgz",
+      "integrity": "sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^4.0.0"
+      }
+    },
+    "node_modules/@csstools/css-syntax-patches-for-csstree": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.7.tgz",
+      "integrity": "sha512-fQ+05118eQS1cofO3aJpB5efgpBZMvIzwr/sbC8kDLVA5XLG8q1kJV5yzrUAI1f7lvhPnm8fgIjzFB8/O/5Dig==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "peerDependencies": {
+        "css-tree": "^3.2.1"
+      },
+      "peerDependenciesMeta": {
+        "css-tree": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@csstools/css-tokenizer": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.0.tgz",
+      "integrity": "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.19.0"
+      }
+    },
     "node_modules/@esbuild/aix-ppc64": {
       "version": "0.28.1",
       "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
@@ -675,6 +880,24 @@
         "node": ">=18"
       }
     },
+    "node_modules/@exodus/bytes": {
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/@exodus/bytes/-/bytes-1.15.1.tgz",
+      "integrity": "sha512-S6mL0yNB/Abt9Ei4tq8gDhcczc4S3+vQ4ra7vxnAf+YHC02srtqxKKZghx2Dq6p0e66THKwR6r8N6P95wEty7Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "@noble/hashes": "^1.8.0 || ^2.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@noble/hashes": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@isaacs/cliui": {
       "version": "8.0.2",
       "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
@@ -1492,6 +1715,16 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/bidi-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/bidi-js/-/bidi-js-1.0.3.tgz",
+      "integrity": "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "require-from-string": "^2.0.2"
+      }
+    },
     "node_modules/binaryextensions": {
       "version": "6.11.0",
       "resolved": "https://registry.npmjs.org/binaryextensions/-/binaryextensions-6.11.0.tgz",
@@ -1966,6 +2199,20 @@
         "url": "https://github.com/sponsors/fb55"
       }
     },
+    "node_modules/css-tree": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.2.1.tgz",
+      "integrity": "sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mdn-data": "2.27.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
+      }
+    },
     "node_modules/css-what": {
       "version": "6.2.2",
       "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.2.2.tgz",
@@ -1979,6 +2226,30 @@
         "url": "https://github.com/sponsors/fb55"
       }
     },
+    "node_modules/data-urls": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-7.0.0.tgz",
+      "integrity": "sha512-23XHcCF+coGYevirZceTVD7NdJOqVn+49IHyxgszm+JIiHLoB2TkmPtsYkNWT1pvRSGkc35L6NHs0yHkN2SumA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-mimetype": "^5.0.0",
+        "whatwg-url": "^16.0.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+      }
+    },
+    "node_modules/data-urls/node_modules/whatwg-mimetype": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-5.0.0.tgz",
+      "integrity": "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -2010,6 +2281,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/decimal.js": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/decompress-response": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
@@ -2791,6 +3069,19 @@
         "node": ">=10"
       }
     },
+    "node_modules/html-encoding-sniffer": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-6.0.0.tgz",
+      "integrity": "sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@exodus/bytes": "^1.6.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+      }
+    },
     "node_modules/htmlparser2": {
       "version": "10.1.0",
       "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-10.1.0.tgz",
@@ -3043,6 +3334,13 @@
         "node": ">=8"
       }
     },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/is-unicode-supported": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
@@ -3150,6 +3448,83 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/jsdom": {
+      "version": "29.1.1",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-29.1.1.tgz",
+      "integrity": "sha512-ECi4Fi2f7BdJtUKTflYRTiaMxIB0O6zfR1fX0GXpUrf6flp8QIYn1UT20YQqdSOfk2dfkCwS8LAFoJDEppNK5Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/css-color": "^5.1.11",
+        "@asamuzakjp/dom-selector": "^7.1.1",
+        "@bramus/specificity": "^2.4.2",
+        "@csstools/css-syntax-patches-for-csstree": "^1.1.3",
+        "@exodus/bytes": "^1.15.0",
+        "css-tree": "^3.2.1",
+        "data-urls": "^7.0.0",
+        "decimal.js": "^10.6.0",
+        "html-encoding-sniffer": "^6.0.0",
+        "is-potential-custom-element-name": "^1.0.1",
+        "lru-cache": "^11.3.5",
+        "parse5": "^8.0.1",
+        "saxes": "^6.0.0",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^6.0.1",
+        "undici": "^7.25.0",
+        "w3c-xmlserializer": "^5.0.0",
+        "webidl-conversions": "^8.0.1",
+        "whatwg-mimetype": "^5.0.0",
+        "whatwg-url": "^16.0.1",
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jsdom/node_modules/entities": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-8.0.0.tgz",
+      "integrity": "sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/jsdom/node_modules/parse5": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
+      "integrity": "sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^8.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/jsdom/node_modules/whatwg-mimetype": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-5.0.0.tgz",
+      "integrity": "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/json-schema-traverse": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
@@ -3446,6 +3821,13 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/mdn-data": {
+      "version": "2.27.1",
+      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
+      "integrity": "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==",
+      "dev": true,
+      "license": "CC0-1.0"
+    },
     "node_modules/mdurl": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.0.0.tgz",
@@ -4198,6 +4580,16 @@
         "once": "^1.3.1"
       }
     },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/punycode.js": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/punycode.js/-/punycode.js-2.3.1.tgz",
@@ -4472,6 +4864,19 @@
         "node": ">=11.0.0"
       }
     },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
     "node_modules/secretlint": {
       "version": "10.2.2",
       "resolved": "https://registry.npmjs.org/secretlint/-/secretlint-10.2.2.tgz",
@@ -4716,6 +5121,16 @@
         "url": "https://github.com/chalk/slice-ansi?sponsor=1"
       }
     },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/spdx-correct": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
@@ -4948,6 +5363,13 @@
         "node": ">=8"
       }
     },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/table": {
       "version": "6.9.0",
       "resolved": "https://registry.npmjs.org/table/-/table-6.9.0.tgz",
@@ -5098,6 +5520,26 @@
         "url": "https://bevry.me/fund"
       }
     },
+    "node_modules/tldts": {
+      "version": "7.4.10",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.10.tgz",
+      "integrity": "sha512-GgouD1B+sWwvkaEq8vXC15DjQitxbvs12oIXELpconwm+Tg3zfcEv4jgzq3vtKverDXsg3VI8aRgNL2Nra0Iog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tldts-core": "^7.4.10"
+      },
+      "bin": {
+        "tldts": "bin/cli.js"
+      }
+    },
+    "node_modules/tldts-core": {
+      "version": "7.4.10",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.10.tgz",
+      "integrity": "sha512-KnQjp53ZekKgm/r3l+u8kJGGzYgrWdP8+Mql7a4vijh2WE0IrZWspQj/TpTxDho/YxO+AnOZnIjQcCD+q6iJsw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/tmp": {
       "version": "0.2.7",
       "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
@@ -5121,6 +5563,32 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/tough-cookie": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz",
+      "integrity": "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tldts": "^7.0.5"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-6.0.0.tgz",
+      "integrity": "sha512-bLVMLPtstlZ4iMQHpFHTR7GAGj2jxi8Dg0s2h2MafAE4uSWF98FC/3MomU51iQAMf8/qDUbKWf5GxuvvVcXEhw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
@@ -5283,6 +5751,29 @@
         "url": "https://bevry.me/fund"
       }
     },
+    "node_modules/w3c-xmlserializer": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
+      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-8.0.1.tgz",
+      "integrity": "sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/whatwg-encoding": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
@@ -5307,6 +5798,21 @@
         "node": ">=18"
       }
     },
+    "node_modules/whatwg-url": {
+      "version": "16.0.1",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-16.0.1.tgz",
+      "integrity": "sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@exodus/bytes": "^1.11.0",
+        "tr46": "^6.0.0",
+        "webidl-conversions": "^8.0.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -5481,6 +5987,16 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/xml-name-validator": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
+      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/xml2js": {
       "version": "0.5.0",
       "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.5.0.tgz",
@@ -5505,6 +6021,13 @@
         "node": ">=4.0"
       }
     },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
diff --git a/ide/package.json b/ide/package.json
index b088cf2c..db2060e9 100644
--- a/ide/package.json
+++ b/ide/package.json
@@ -829,6 +829,7 @@
     "@vscode/vsce": "^3.0.0",
     "esbuild": "^0.28.1",
     "glob": "^13.0.6",
+    "jsdom": "^29.1.1",
     "mocha": "^11.7.6",
     "typescript": "^5.4.5"
   },
diff --git a/ide/src/aiPolicy.ts b/ide/src/aiPolicy.ts
index becf7fba..d42254dd 100644
--- a/ide/src/aiPolicy.ts
+++ b/ide/src/aiPolicy.ts
@@ -1,22 +1,34 @@
 // AI-assistance policy resolution for the IDE. The policy is centrally governed by the engine; the
 // IDE reads it (never sets it) and gates the @messagefoundry chat assistant accordingly. Resolution
-// is authoritative-engine-first so a central "off" is honored even by a tokenless client, falling
-// back to the local CLI (which reads messagefoundry.toml) when the engine is unreachable.
+// is authoritative-engine-first, falling back to the local CLI (which reads messagefoundry.toml) when
+// the engine is unreachable.
+//
+// The policy has TWO halves and they are answered differently:
+//   - `mode` is identity-INDEPENDENT, so a central "off" is honored even by a tokenless client;
+//   - `assist_permitted` is identity-DEPENDENT — the engine answers `null` to anyone it cannot
+//     attribute — so this read attaches the cached bearer (BACKLOG #330). A degraded/unattributed
+//     answer must not overwrite a cached deny; that is mergeAuthoritativePolicy's job.
 import * as vscode from "vscode";
+import { peekToken } from "./auth";
+import { type AiPolicy, evaluatedPermission, mergeAuthoritativePolicy } from "./aiPolicyModel";
 import { engineUrl, runJson, workspaceDir } from "./cli";
 import { getJson } from "./engineClient";
+import { ASSIST_GATE_PLAN } from "./engineStatusModel";
+import { assertTargetAllowed } from "./engineTarget";
 
-export interface AiPolicy {
-  mode: string;
-  dataScope: string;
-  environment: string | null;
-  // null = RBAC could not be evaluated (no/invalid token under enabled auth, or resolved offline).
-  assistPermitted: boolean | null;
-  reason: string | null;
-}
+// The policy shape lives in the zero-import aiPolicyModel so the merge rule below it can be asserted
+// by the node-side runner that executes on every CI leg (this module imports vscode, so its own test
+// file is `--ignore`d by `test:unit`). Re-exported in TYPE form: esbuild bundles with isolatedModules
+// semantics, where a value-form re-export of a type-only symbol fails at BUNDLE time while
+// `tsc --noEmit` stays green. Existing importers (chat.ts, extension.ts, the tests) are unchanged.
+export type { AiPolicy } from "./aiPolicyModel";
+// `assistantState` moved there too: it is the predicate the merge rule feeds, and the two are only
+// meaningful asserted together. Value-form re-export (it IS a value), so chat.ts and the existing
+// ai-policy.test.ts import sites are untouched — ADR 0035 AC-5's test pointer stays valid.
+export { assistantState } from "./aiPolicyModel";
 
 // Snake_case wire shape shared by GET /ai/policy and `messagefoundry ai-policy --json`.
-interface AiPolicyWire {
+export interface AiPolicyWire {
   mode: string;
   data_scope: string;
   environment: string | null;
@@ -40,12 +52,18 @@ const UNVERIFIED_POLICY: AiPolicy = {
   reason: null,
 };
 
+/**
+ * Wire → resolved policy. `AiPolicyWire` is a claim about a response, not a guarantee: `JSON.parse`
+ * validates nothing, so `assist_permitted` is NARROWED here rather than copied. This is the boundary
+ * for BOTH authoritative sources — the engine read and the CLI fallback — and only the former also
+ * passes through {@link mergeAuthoritativePolicy}, so the narrowing has to happen here to cover both.
+ */
 function fromWire(w: AiPolicyWire): AiPolicy {
   return {
     mode: w.mode,
     dataScope: w.data_scope,
     environment: w.environment,
-    assistPermitted: w.assist_permitted,
+    assistPermitted: evaluatedPermission(w.assist_permitted),
     reason: w.reason,
   };
 }
@@ -67,71 +85,82 @@ export function pickOfflinePolicy(cached: AiPolicy | null, cli: AiPolicy | null)
   return UNVERIFIED_POLICY;
 }
 
+/**
+ * The injectable IO seam for {@link resolveAiPolicy}. It exists so the fetch-and-cache path — where
+ * both of BACKLOG #330's defects lived — is testable at all: it was previously unreachable from a test
+ * because every dependency was a direct module-level call.
+ */
+export interface AiPolicyIo {
+  url: () => string;
+  readToken: (ctx: vscode.ExtensionContext, url: string) => Promise<string | undefined>;
+  getPolicy: (url: string, route: string, token: string | undefined) => Promise<AiPolicyWire>;
+  getCliPolicy: () => Promise<AiPolicyWire>;
+}
+
+/**
+ * Production wiring.
+ *
+ * `readToken` is {@link peekToken} and must NEVER become `ensureToken`: a chat turn resolves the policy
+ * before every request, and `ensureToken` would pop an interactive sign-in modal out of it. The two
+ * functions are structurally identical, so the type system cannot tell them apart — the control is the
+ * test that asserts this field IS `peekToken` by identity, not this comment.
+ */
+export const DEFAULT_AI_POLICY_IO: AiPolicyIo = {
+  url: engineUrl,
+  readToken: peekToken,
+  getPolicy: (url, route, token) => getJson<AiPolicyWire>(url, route, token),
+  getCliPolicy: () => runJson<AiPolicyWire>(["ai-policy"], workspaceDir()),
+};
+
 /**
  * Resolve the effective AI policy. Order: (a) the running engine [authoritative — includes the
  * identity-dependent `assist_permitted`; cached on success]; (b) when the engine is unreachable, the
  * last cached authoritative policy; (c) the local CLI [reads messagefoundry.toml]; (d) a fail-closed
  * "unverified" policy (assistance disabled) so a central "off" can't be bypassed by going offline.
+ *
+ * The read is AUTHENTICATED (BACKLOG #330). `assist_permitted` is computed from the acting identity, so
+ * a tokenless read can only ever answer `null` and the `ai:assist` deny branch could never fire — half
+ * of ADR 0035's SEC-022 control was inert in the shipped code. The bearer is driven by
+ * {@link ASSIST_GATE_PLAN}, the same mechanism that keeps the status bar's read of this very route
+ * tokenless, so "who authenticates" is CI-asserted data rather than an argument at a call site.
  */
-export async function resolveAiPolicy(ctx: vscode.ExtensionContext): Promise<AiPolicy> {
+export async function resolveAiPolicy(
+  ctx: vscode.ExtensionContext,
+  io: AiPolicyIo = DEFAULT_AI_POLICY_IO,
+): Promise<AiPolicy> {
   try {
-    const policy = fromWire(await getJson<AiPolicyWire>(engineUrl(), "/ai/policy"));
-    await ctx.globalState.update(LAST_POLICY_KEY, policy); // remember the authoritative answer
-    return policy;
+    const url = io.url();
+    const plan = ASSIST_GATE_PLAN[0];
+    // SEC-005 (ADR 0035 / engineTarget.ts): never send a bearer in clear to a non-loopback http://
+    // target. Same shape as the liveStatus poll's guard. peekToken, never ensureToken — see
+    // DEFAULT_AI_POLICY_IO. Driving the send off `plan.authenticated` is what makes the constant a
+    // control on this side too: flipping it to false actually turns the bearer off.
+    const token =
+      plan.authenticated && assertTargetAllowed(url).ok ? await io.readToken(ctx, url) : undefined;
+    const fresh = fromWire(await io.getPolicy(url, plan.route, token));
+    // GUARDED write. An answer the engine could not attribute to an identity carries
+    // `assist_permitted: null`, and writing that raw would overwrite a cached, authoritatively-observed
+    // deny — a degraded read UPGRADING assistance a central policy had switched off. The merge keeps
+    // the deny and nothing else; see mergeAuthoritativePolicy for why it is one-way.
+    const merged = mergeAuthoritativePolicy(
+      ctx.globalState.get<AiPolicy>(LAST_POLICY_KEY) ?? null,
+      fresh,
+    );
+    await ctx.globalState.update(LAST_POLICY_KEY, merged); // remember the authoritative answer
+    return merged;
   } catch {
     // Engine unreachable or errored — fall back to the cached authoritative / CLI / fail-closed view.
   }
   const cached = ctx.globalState.get<AiPolicy>(LAST_POLICY_KEY) ?? null;
   let cli: AiPolicy | null = null;
   try {
-    cli = fromWire(await runJson<AiPolicyWire>(["ai-policy"], workspaceDir()));
+    cli = fromWire(await io.getCliPolicy());
   } catch {
     // CLI unavailable too (no Python / no workspace / untrusted) — leave cli null.
   }
   return pickOfflinePolicy(cached, cli);
 }
 
-/**
- * Apply the gating rules to a resolved policy. `enabled` false means the chat handler must not call
- * the model and should stream `message` instead. The only ENABLED case is BYO with the permission
- * granted or unknown (null) — BYO is PHI-safe by construction (code-only context).
- */
-export function assistantState(p: AiPolicy): { enabled: boolean; message?: string } {
-  if (p.mode === "off") {
-    return { enabled: false, message: "AI assistance is turned off by your MessageFoundry policy." };
-  }
-  if (p.mode === "unverified") {
-    // Engine unreachable + no cached policy + no positive local CLI policy: fail closed so a central
-    // "off" / ai:assist deny can't be bypassed by going offline (SEC-022).
-    return {
-      enabled: false,
-      message:
-        "MessageFoundry AI policy could not be verified (engine unreachable) — assistance is disabled until it can be confirmed.",
-    };
-  }
-  if (p.mode === "managed_endpoint") {
-    // Engine-brokered path (ADR 0135): the ENGINE brokers the call to the customer-managed / self-hosted
-    // LLM under central per-use audit. Enabled when the caller holds ai:assist (or it is unknown offline);
-    // chat.ts routes this mode to the engine broker instead of the local vscode.lm model.
-    if (p.assistPermitted === false) {
-      return { enabled: false, message: "Your role does not include the ai:assist permission." };
-    }
-    return { enabled: true };
-  }
-  if (p.mode === "managed_claude" || p.mode === "managed_claude_baa") {
-    return {
-      enabled: false,
-      message:
-        "Your MessageFoundry policy uses a managed AI provider, which this extension version does not yet support. Assistance is unavailable.",
-    };
-  }
-  if (p.mode === "byo" && p.assistPermitted === false) {
-    return { enabled: false, message: "Your role does not include the ai:assist permission." };
-  }
-  // BYO with assistPermitted true OR null (RBAC not evaluable offline) — allowed.
-  return { enabled: true };
-}
-
 /** Fetch the current policy and surface it to the user (command: messagefoundry.showAiPolicy). */
 export async function showAiPolicy(ctx: vscode.ExtensionContext): Promise<void> {
   const p = await resolveAiPolicy(ctx);
diff --git a/ide/src/aiPolicyModel.ts b/ide/src/aiPolicyModel.ts
new file mode 100644
index 00000000..25967b9e
--- /dev/null
+++ b/ide/src/aiPolicyModel.ts
@@ -0,0 +1,125 @@
+// The pure, vscode-free half of the IDE's AI-policy handling: the resolved policy shape, and the
+// authoritative-merge rule that decides what a FRESH engine answer may and may not overwrite.
+//
+// THIS MODULE MUST KEEP ZERO IMPORTS. It is separated from aiPolicy.ts (which imports `vscode`)
+// for one measured reason: `ide/package.json`'s `test:unit` script explicitly `--ignore`s
+// `out/test/suite/ai-policy.test.js`, so anything asserted only there runs solely in the
+// Windows-only `npm test` leg. A zero-import module is assertable in the node-side runner that
+// executes on EVERY ide CI leg — which is where a security invariant belongs. Adding a value
+// import of any vscode-touching module kills `ai-policy-model.test.ts` in that runner with
+// "Cannot find module 'vscode'".
+
+/** The resolved AI policy, as the IDE uses it (camelCase; see aiPolicy.ts's `fromWire`). */
+export interface AiPolicy {
+  mode: string;
+  dataScope: string;
+  environment: string | null;
+  // null = RBAC could not be evaluated (no/invalid token under enabled auth, or resolved offline).
+  assistPermitted: boolean | null;
+  reason: string | null;
+}
+
+/**
+ * Narrow a permission bit to the EVALUABLE domain. Only the literals `true` and `false` are answers;
+ * everything else means "not evaluated", NEVER "permitted".
+ *
+ * This exists because {@link AiPolicy} is a COMPILE-TIME claim about a network response and
+ * `JSON.parse` does not honour it. The engine ships `assist_permitted: bool | None`, but a 200 from
+ * anything else on that URL — a proxy, a mistyped target, an engine build predating the field — can
+ * omit it, and an absent property reads as `undefined`. Without this narrowing `undefined` slips past
+ * the `=== null` guard below (`undefined !== null`), overwrites a cached deny, and — not being `false`
+ * either — POISONS the cache so no later answer can restore the deny. That is the fail-OPEN direction,
+ * reached by exactly the degraded answer this control exists to survive, so the narrowing is part of
+ * the control rather than defensive tidying. Takes `unknown` because at runtime it genuinely is.
+ */
+export function evaluatedPermission(v: unknown): boolean | null {
+  return v === true || v === false ? v : null;
+}
+
+/**
+ * Merge a FRESH authoritative (engine) policy over the last cached one, retaining an
+ * `assistPermitted: false` that the fresh answer could not re-evaluate.
+ *
+ * The engine computes `assist_permitted` from the ACTING IDENTITY, so it is `null` for any read the
+ * engine could not attribute to a user (no bearer, an expired session, auth disabled mid-flight).
+ * Without this rule such a read silently overwrites a cached, authoritatively-observed deny — i.e. a
+ * degraded answer would UPGRADE assistance that a central policy had switched off (SEC-022 is the
+ * control this completes; ADR 0035).
+ *
+ * Four properties, each of which is a test — change one and a named test goes red:
+ *
+ *  1. **Asymmetric on purpose — only a DENY is sticky.** A cached `true` is NOT carried over a fresh
+ *     `null`, because `null` under BYO is *allowed by design* (docs/AI.md's tokenless-IDE trust note:
+ *     BYO sends code-only context to the developer's own provider, so there is no PHI for RBAC to
+ *     protect at that stage). Carrying a `true` forward would fabricate a permit from stale state,
+ *     which is the fail-OPEN direction.
+ *  2. **Only `assistPermitted` is retained.** `mode` / `dataScope` / `environment` / `reason` always
+ *     come fresh, because `mode` is identity-INDEPENDENT: a central `off` → `byo` re-enable must
+ *     propagate on the very next read, and a frozen policy would defeat that.
+ *  3. **Any EVALUABLE fresh answer wins outright.** `true` and `false` both replace the cache, so an
+ *     administrator granting `ai:assist` un-sticks the deny the moment that user's next authenticated
+ *     read returns `true`. The escape hatch is signing in, not clearing extension state.
+ *  4. **`cached === null` (the first ever read) is a plain pass-through.**
+ *  5. **The fresh bit is NARROWED before anything is decided** ({@link evaluatedPermission}). Any
+ *     non-boolean — `null`, or the `undefined` a 200 that OMITS the field produces — is treated as
+ *     "not evaluated" and normalized to `null` on the way out, so a degraded answer can neither slip
+ *     past the guard nor be written to the cache in a shape no later comparison can match.
+ *
+ * Consequence, stated so it is a decision and not a surprise: once a `false` is cached, every later
+ * `null` preserves it. A user whose permission is granted later but who holds no valid session sees
+ * assistance disabled until the engine answers `true` for them. That is the fail-CLOSED direction and
+ * matches SEC-022's intent, but there is no "clear cached policy" affordance in the extension.
+ */
+export function mergeAuthoritativePolicy(cached: AiPolicy | null, fresh: AiPolicy): AiPolicy {
+  const permitted = evaluatedPermission(fresh.assistPermitted);
+  if (permitted === null && cached?.assistPermitted === false) {
+    return { ...fresh, assistPermitted: false };
+  }
+  return { ...fresh, assistPermitted: permitted };
+}
+
+/**
+ * Apply the gating rules to a resolved policy. `enabled` false means the chat handler must not call
+ * the model and should stream `message` instead. The only ENABLED case is BYO with the permission
+ * granted or unknown (null) — BYO is PHI-safe by construction (code-only context).
+ *
+ * It lives here rather than in aiPolicy.ts (it is re-exported from there, so every caller is unchanged)
+ * because it is the PREDICATE {@link mergeAuthoritativePolicy} feeds. Asserting the merge rule without
+ * asserting that the retained bit actually reaches this gate would prove only that a field survived in
+ * a struct — and that coupling has to be provable in the node-side runner that runs on every CI leg.
+ */
+export function assistantState(p: AiPolicy): { enabled: boolean; message?: string } {
+  if (p.mode === "off") {
+    return { enabled: false, message: "AI assistance is turned off by your MessageFoundry policy." };
+  }
+  if (p.mode === "unverified") {
+    // Engine unreachable + no cached policy + no positive local CLI policy: fail closed so a central
+    // "off" / ai:assist deny can't be bypassed by going offline (SEC-022).
+    return {
+      enabled: false,
+      message:
+        "MessageFoundry AI policy could not be verified (engine unreachable) — assistance is disabled until it can be confirmed.",
+    };
+  }
+  if (p.mode === "managed_endpoint") {
+    // Engine-brokered path (ADR 0135): the ENGINE brokers the call to the customer-managed / self-hosted
+    // LLM under central per-use audit. Enabled when the caller holds ai:assist (or it is unknown offline);
+    // chat.ts routes this mode to the engine broker instead of the local vscode.lm model.
+    if (p.assistPermitted === false) {
+      return { enabled: false, message: "Your role does not include the ai:assist permission." };
+    }
+    return { enabled: true };
+  }
+  if (p.mode === "managed_claude" || p.mode === "managed_claude_baa") {
+    return {
+      enabled: false,
+      message:
+        "Your MessageFoundry policy uses a managed AI provider, which this extension version does not yet support. Assistance is unavailable.",
+    };
+  }
+  if (p.mode === "byo" && p.assistPermitted === false) {
+    return { enabled: false, message: "Your role does not include the ai:assist permission." };
+  }
+  // BYO with assistPermitted true OR null (RBAC not evaluable offline) — allowed.
+  return { enabled: true };
+}
diff --git a/ide/src/engineStatusModel.ts b/ide/src/engineStatusModel.ts
index 0717c42b..ddefcf35 100644
--- a/ide/src/engineStatusModel.ts
+++ b/ide/src/engineStatusModel.ts
@@ -3,6 +3,13 @@
 // MEAN?", "what may the user do about it?", "what does the item say?") is unit-testable node-side
 // without launching an Extension Host (mirrors promoteTarget.ts / engineTarget.ts). No vscode, no I/O.
 //
+// It also holds the IDE's SHARED PROBE-PLAN VOCABULARY — `ProbePlanEntry`, `PROBE_ENDPOINTS`, and the
+// named plans below (ADR 0110, amended by BACKLOG #330). Those are no longer private to the status
+// bar: `aiPolicy.ts` drives its own read of `/ai/policy` off `ASSIST_GATE_PLAN`. The plans are the
+// place where "does this caller attach a bearer?" is DATA that CI asserts, rather than a literal
+// argument at a call site that a later tidy-up could silently flip. Read the two /ai/policy plans
+// together — they name the same route and give opposite answers, deliberately.
+//
 // THE RULE THIS MODULE EXISTS TO ENFORCE (ADR — engine-link doctor):
 //   Green means "the IDE can USE this engine", not "a socket answered".
 // The previous model folded EVERY http answer — including a 401 — into "reachable" and painted it
@@ -126,6 +133,11 @@ export const PROBE_ENDPOINTS = ["/ai/policy", "/config/provenance", "/health"] a
 /** The tokenless liveness probe. Cheap, and safe on a timer precisely BECAUSE it is tokenless. */
 export const HEALTH_ROUTE = "/health";
 
+/** The policy read that names the engine's active environment (ADR 0017 owns `[ai].environment`).
+ *  Declared here, beside HEALTH_ROUTE, because the probe plans below reference it — a `const` read
+ *  before its declaration is a TDZ ReferenceError at module load, not a compile error. */
+export const POLICY_ROUTE = "/ai/policy";
+
 /** One planned HTTP probe. `authenticated` decides whether a bearer is attached — and it is the whole
  *  ballgame, so it is DATA (asserted in CI) rather than a decision buried in the shell. */
 export interface ProbePlanEntry {
@@ -154,9 +166,32 @@ export const VERIFY_PLAN: readonly ProbePlanEntry[] = [
   { route: HEALTH_ROUTE, authenticated: true }, // learns the version, which a tokenless probe never sees
 ];
 
-/** The tokenless policy read that names the engine's active environment (ADR 0017). Best-effort: any
- *  failure just means the hover omits the environment line. */
-export const POLICY_ROUTE = "/ai/policy";
+/**
+ * The status bar's environment read. **TOKENLESS** — it wants `environment`, which is
+ * identity-INDEPENDENT, and it runs off the 15s timer, where a bearer would refresh the session's idle
+ * clock and make the engine's 30-minute idle timeout unreachable (CWE-613; see the file header and
+ * ADR 0110 §2). Best-effort: any failure just means the hover omits the environment line.
+ *
+ * Same route as {@link ASSIST_GATE_PLAN}, opposite answer. That is not an oversight — it IS the
+ * distinction, and both halves are asserted in CI so a later reader cannot "unify" them.
+ */
+export const ENVIRONMENT_PLAN: readonly ProbePlanEntry[] = [
+  { route: POLICY_ROUTE, authenticated: false },
+];
+
+/**
+ * `aiPolicy.ts`'s gate read of the same route. **AUTHENTICATED** — it wants `assist_permitted`, which
+ * is identity-DEPENDENT and is `null` for every tokenless caller (`api/app.py`: `permitted = None if
+ * identity is None else identity.has(Permission.AI_ASSIST)`), so without a bearer the deny branch can
+ * never fire at all.
+ *
+ * Safe here for exactly the reason {@link VERIFY_PLAN} is: its only callers are user-initiated — a chat
+ * turn (`chat.ts`) and the "Show AI Policy" command (`aiPolicy.ts`) — never a timer, so refreshing the
+ * idle clock is honest activity rather than a forgery.
+ */
+export const ASSIST_GATE_PLAN: readonly ProbePlanEntry[] = [
+  { route: POLICY_ROUTE, authenticated: true },
+];
 
 /**
  * The route that EARNS a green check. It must be (a) authenticated, (b) permission-gated, and (c) NOT
diff --git a/ide/src/statusBar.ts b/ide/src/statusBar.ts
index 65b8682e..f1cd4024 100644
--- a/ide/src/statusBar.ts
+++ b/ide/src/statusBar.ts
@@ -36,7 +36,7 @@ import { logAction, logProbe, logState, showEngineLog } from "./engineLog";
 import { assertTargetAllowed, isLocalEngine } from "./engineTarget";
 import {
   CMD,
-  POLICY_ROUTE,
+  ENVIRONMENT_PLAN,
   POLL_PLAN,
   VERIFY_PLAN,
   classifyDeep,
@@ -297,7 +297,15 @@ export class EngineStatusBar implements vscode.Disposable {
     }
   }
 
-  /** Best-effort, tokenless: name the engine's active environment in the hover. Never fails the probe. */
+  /**
+   * Best-effort, TOKENLESS: name the engine's active environment in the hover. Never fails the probe.
+   *
+   * It runs off the 15s poll, so it must never carry a bearer (CWE-613 — see the file header). That is
+   * driven by {@link ENVIRONMENT_PLAN}'s `authenticated: false` rather than a literal `undefined` token
+   * argument, so the tokenlessness is DATA that CI asserts. `aiPolicy.ts` reads the SAME route WITH a
+   * bearer under `ASSIST_GATE_PLAN`, because it wants the identity-dependent `assist_permitted` and is
+   * user-initiated; the difference between the two is deliberate (ADR 0110 amendment, BACKLOG #330).
+   */
   private async readEnvironment(): Promise<void> {
     if (
       this.link.environment ||
@@ -309,7 +317,7 @@ export class EngineStatusBar implements vscode.Disposable {
     }
     const gen = this.targetGen;
     const target = this.link.target;
-    const outcome = await this.fetch(target.url, POLICY_ROUTE, undefined, PROBE_TIMEOUT_MS);
+    const outcome = (await this.runProbe(ENVIRONMENT_PLAN[0], target.url, PROBE_TIMEOUT_MS)).outcome;
     if (outcome.kind !== "ok" || gen !== this.targetGen) {
       return;
     }
diff --git a/ide/src/stepsModel.ts b/ide/src/stepsModel.ts
index f33d0ca3..f219fa8c 100644
--- a/ide/src/stepsModel.ts
+++ b/ide/src/stepsModel.ts
@@ -1503,13 +1503,22 @@ export interface DropResolution {
 
 /**
  * Whether `target` can accept a drop of `drag` (pure). Widened from the same-suite rule to: same handler,
- * not itself, target draggable, and target is NOT inside the dragged block's own [start, end] span (so a
- * block can't be dropped into itself). NO same-suite requirement — the headline cross-suite move.
+ * not itself, target draggable, target is NOT a read-only `code` row, and target is NOT inside the
+ * dragged block's own [start, end] span (so a block can't be dropped into itself). NO same-suite
+ * requirement — the headline cross-suite move.
+ *
+ * The `code`-row rule is NOT redundant with `target.draggable`: {@link renderRowHtml} marks a `code` row
+ * draggable ON PURPOSE, purely so a drag ATTEMPT can be intercepted and answered with "edit it in the
+ * code editor" (see the comment at renderRowHtml, "never treats a code row as a drop target"). Without
+ * this line the model contradicted that stated contract while the webview mirror (`canDrop` in
+ * `media/stepsWebview.js`) honoured it — the one divergence `src/test/suite/steps-mirror.test.ts`
+ * found (BACKLOG #233).
  */
 export function canDropRow(drag: RowDropContext, target: RowDropContext): boolean {
   return (
     target !== drag &&
     target.draggable &&
+    target.kind !== "code" &&
     target.handler === drag.handler &&
     !(drag.lineStart <= target.lineStart && target.lineStart <= drag.lineEnd)
   );
@@ -1668,8 +1677,11 @@ export function insertionBarAnchor(res: DropResolution, rows: readonly RowDropCo
  * its elif/else continuation bodies, gets an "after the whole block" slot at the outer level; a
  * send/return contributes no "after" slot (a block never lands after the return). elif/else headers are
  * CONTINUATIONS (consumed with their `if`), never standalone slots.
+ *
+ * Exported (BACKLOG #233) so a parity suite can compare it against the CSP-isolated copy of
+ * `buildDropSlots` in `media/stepsWebview.js`; it has no production caller outside {@link walkMove}.
  */
-function buildDropSlots(rows: readonly RowDropContext[]): DropResolution[] {
+export function buildDropSlots(rows: readonly RowDropContext[]): DropResolution[] {
   const childrenBySuite = new Map<string, RowDropContext[]>();
   for (const r of rows) {
     const list = childrenBySuite.get(r.suite);
@@ -1973,9 +1985,19 @@ export function buildPasteRequest(
  * `shouldReactToDocumentChange()` is false, so the `WorkspaceEdit` we apply does NOT feed back into a
  * re-render that would fight the webview (the loop). `endEdit()` releases the slot. Pure + synchronous,
  * so the provider's flow is unit-testable without the Extension Host.
+ *
+ * A suppressed change is DEFERRED, not dropped (BACKLOG #234). `shouldReactToDocumentChange()` returning
+ * false is the right answer for OUR OWN `WorkspaceEdit`, but the provider cannot tell that apart from a
+ * USER save that happened to land while a `lens rewrite` held the slot — and returning false made the
+ * caller return early, discarding the save outright. The view would then keep showing a projection of
+ * the pre-save buffer until the next save. So a caller that declines to react calls
+ * {@link EditLoopGuard.noteSuppressedChange}, and the release path ({@link releaseEdit}) runs the owed
+ * refresh once the slot frees. The debt is recorded as a single boolean (a re-projection is idempotent —
+ * ten suppressed saves owe exactly one refresh), mirroring the queue/take shape of the pending edits.
  */
 export class EditLoopGuard {
   private inFlight = false;
+  private suppressedChange = false;
   private readonly pending = new Map<string, EditMessage>();
 
   beginEdit(): boolean {
@@ -2023,10 +2045,33 @@ export class EditLoopGuard {
     this.inFlight = false;
   }
 
+  /**
+   * Record that a document change arrived while the slot was held and was therefore NOT acted on, so the
+   * re-projection it owes can run when the slot frees (BACKLOG #234). Idempotent: a re-projection reads
+   * the whole buffer, so any number of suppressed changes owe exactly one refresh. Prefer
+   * {@link releaseEdit} over calling {@link EditLoopGuard.endEdit} directly so the debt is always paid.
+   */
+  noteSuppressedChange(): void {
+    this.suppressedChange = true;
+  }
+
+  /** Take (and CLEAR) the owed-refresh flag — the same clear-on-read contract {@link takePending} has,
+   * so a refresh can never be run twice for one suppressed change. */
+  takeSuppressedChange(): boolean {
+    const owed = this.suppressedChange;
+    this.suppressedChange = false;
+    return owed;
+  }
+
   get isEditing(): boolean {
     return this.inFlight;
   }
 
+  /** Whether a document change was suppressed and still owes a re-projection (diagnostics/tests). */
+  get hasSuppressedChange(): boolean {
+    return this.suppressedChange;
+  }
+
   /** How many distinct-field edits are waiting to be applied after the in-flight one (F5). */
   get pendingCount(): number {
     return this.pending.size;
@@ -2038,6 +2083,80 @@ export class EditLoopGuard {
   }
 }
 
+/**
+ * Release the single edit slot, then run any re-projection a document change owed while the slot was
+ * held (BACKLOG #234). THE ONLY sanctioned way to release: calling {@link EditLoopGuard.endEdit}
+ * directly frees the slot without paying the debt, which is exactly the dropped-save defect — a save
+ * that landed mid-rewrite would leave the view showing a stale projection until the user saved again.
+ *
+ * `onRefreshOwed` is invoked at most once per suppressed run (the flag is clear-on-read) and NOT AT ALL
+ * when nothing was suppressed, so the ordinary path is unchanged. Synchronous and never throwing on its
+ * own; the callback is the caller's (the provider schedules its debounced `render()`).
+ */
+export function releaseEdit(guard: EditLoopGuard, onRefreshOwed?: () => void): void {
+  guard.endEdit();
+  if (guard.takeSuppressedChange()) {
+    onRefreshOwed?.();
+  }
+}
+
+/**
+ * The ONE debounced re-projection channel (ADR 0076 §5 "sync on save", Amendment C / BACKLOG #234).
+ *
+ * Two callers ask for a re-projection and they must not stack: the save subscription, and
+ * {@link releaseEdit} paying the refresh a suppressed save owed. Both go through {@link schedule}, so
+ * they coalesce into one run exactly like two rapid saves do.
+ *
+ * {@link cancel} is the half that stops a suppressed save from producing TWO re-projections. Three of
+ * the provider's release sites (`applyStructural`, `applyPickedEdit`, `applyUndoRedo`) release the slot
+ * and then FORCE a full re-projection a few lines later. Without cancellation the forced run and the
+ * armed debounced run both fire — a second `lens parse` child process and a second whole-webview HTML
+ * replacement ~250 ms later, which lands on the user as a flicker that eats focus and any half-typed
+ * input. A re-projection reads the whole current buffer, so the run starting NOW already satisfies
+ * whatever the armed one owed: cancelling is a discharge, not a drop.
+ *
+ * `cancel` covers the release-THEN-force order only. The provider's `render()` therefore ALSO calls
+ * {@link EditLoopGuard.takeSuppressedChange} for the force-THEN-release order (`drainEdits`' rejection
+ * handler renders INSIDE the drain, before the `finally` releases, so nothing is armed yet to cancel).
+ * Paths that return before ANY render — a `lens rewrite` refusal, a disposed panel — reach neither
+ * discharge, so the deferral stays load-bearing exactly where it is the only route.
+ *
+ * Timer functions are injected rather than closed over so the whole channel is unit-testable node-side
+ * with a fake clock, the same reason {@link drainEdits} lives here instead of in the provider.
+ */
+export class RerenderDebouncer<H = unknown> {
+  private handle: H | undefined;
+
+  constructor(
+    private readonly run: () => void,
+    private readonly delayMs: number,
+    private readonly setTimer: (fn: () => void, ms: number) => H,
+    private readonly clearTimer: (handle: H) => void,
+  ) {}
+
+  /** Arm (or RE-arm) the debounce. Repeated calls before it fires collapse to one run. */
+  schedule(): void {
+    this.cancel();
+    this.handle = this.setTimer(() => {
+      this.handle = undefined;
+      this.run();
+    }, this.delayMs);
+  }
+
+  /** Discharge any armed run. Called at the TOP of a re-projection, and on panel dispose. */
+  cancel(): void {
+    if (this.handle !== undefined) {
+      this.clearTimer(this.handle);
+      this.handle = undefined;
+    }
+  }
+
+  /** Whether a run is currently armed (tests + diagnostics). */
+  get armed(): boolean {
+    return this.handle !== undefined;
+  }
+}
+
 /**
  * Drain one edit + any queued follow-ups through `apply`, one at a time, under the loop guard (ADR 0076
  * §5). Extracted from the provider (which imports vscode) so the whole drain — including the guarantee
@@ -2048,13 +2167,16 @@ export class EditLoopGuard {
  * yields. `apply` performs the actual `lens rewrite` + `WorkspaceEdit`; its OWN handled outcomes (a CLI
  * refusal) never throw, but an unexpected `WorkspaceEdit` rejection (or a spawn failure) would — that is
  * caught, routed to `onError`, and the loop KEEPS DRAINING so a pending second edit is not wedged until
- * the user types again. The slot is always released in `finally`. Never throws.
+ * the user types again. The slot is always released in `finally` — through {@link releaseEdit}, so a
+ * document change suppressed during the drain still gets its re-projection (BACKLOG #234), including on
+ * the rejected-apply path above. Never throws.
  */
 export async function drainEdits(
   guard: EditLoopGuard,
   first: EditMessage,
   apply: (msg: EditMessage) => Promise<void>,
   onError?: (err: unknown, msg: EditMessage) => void,
+  onRefreshOwed?: () => void,
 ): Promise<void> {
   if (!guard.beginEdit()) {
     guard.queue(first);
@@ -2071,7 +2193,7 @@ export async function drainEdits(
       current = guard.takePending();
     }
   } finally {
-    guard.endEdit();
+    releaseEdit(guard, onRefreshOwed);
   }
 }
 
diff --git a/ide/src/stepsView.ts b/ide/src/stepsView.ts
index dab4036f..85e4e524 100644
--- a/ide/src/stepsView.ts
+++ b/ide/src/stepsView.ts
@@ -46,6 +46,7 @@ import {
   ADD_MENU_BY_ID,
   EditLoopGuard,
   REDACTED_LIVE_VALUE,
+  RerenderDebouncer,
   TOOLBAR_INSERT_DEFAULTS,
   addMenuGroups,
   buildAddDestinationRequest,
@@ -62,6 +63,7 @@ import {
   escapeHtml,
   mergeLiveValues,
   parseRewriteResult,
+  releaseEdit,
   renderHandlersHtml,
   renderStepsContextMenuHtml,
   shouldAttachLiveValues,
@@ -268,7 +270,6 @@ export class StepsEditorProvider implements vscode.CustomTextEditorProvider {
       enableScripts: true,
       localResourceRoots: [vscode.Uri.joinPath(this.extensionUri, "media")],
     };
-    let debounce: ReturnType<typeof setTimeout> | undefined;
     let disposed = false;
     // Handshake: the webview posts a `ping` the instant its script starts. If a render sets the html but no
     // ping arrives, the script never initialized (blocked / threw at load, e.g. a double acquireVsCodeApi) —
@@ -277,6 +278,24 @@ export class StepsEditorProvider implements vscode.CustomTextEditorProvider {
     // One edit at a time + the webview↔document update-loop guard (ADR 0076 §5).
     const guard = new EditLoopGuard();
 
+    // The ONE debounced re-projection channel (ADR 0076 §5 "sync on save"). Both a save and a refresh
+    // the guard deferred (BACKLOG #234) go through it, so an owed refresh coalesces with a real save
+    // exactly like two rapid saves do instead of adding a second, differently-timed render. `render()`
+    // CANCELS it on entry, so a release site that forces a full re-projection discharges the debt
+    // rather than racing it into a second one (ADR 0076 Amendment C, AC-C2).
+    const rerender = new RerenderDebouncer<ReturnType<typeof setTimeout>>(
+      () => void render(),
+      RERENDER_DEBOUNCE_MS,
+      (fn, ms) => setTimeout(fn, ms),
+      (handle) => clearTimeout(handle),
+    );
+    const scheduleRerender = (): void => {
+      if (disposed) {
+        return;
+      }
+      rerender.schedule();
+    };
+
     // Reopen the same resource with the built-in text editor (the §4 degradation fallback).
     const fallBackToText = (reason: string): void => {
       void vscode.window.showInformationMessage(reason);
@@ -285,6 +304,17 @@ export class StepsEditorProvider implements vscode.CustomTextEditorProvider {
     };
 
     const render = async (): Promise<void> => {
+      // A re-projection reads the WHOLE current buffer below, so it SATISFIES any refresh still owed —
+      // by either route (ADR 0076 Amendment C, AC-C2: "exactly ONE re-projection"). Both discharges run
+      // FIRST and synchronously, before the `lens parse` await, so a save landing mid-render is recorded
+      // afresh and still honoured:
+      //   * the armed debounce, or it would replace the whole webview HTML a second time ~250 ms later
+      //     (the three release sites that force a render immediately after releasing the slot);
+      //   * the guard's owed-refresh debt, for the one path where the forced render happens BEFORE the
+      //     release rather than after it — `drainEdits`' unexpected-rejection handler renders inside the
+      //     drain, and its `finally` would otherwise arm a redundant second pass on the way out.
+      rerender.cancel();
+      guard.takeSuppressedChange();
       const ws = workspaceDir();
       // Project the LIVE buffer (piped over stdin as `lens parse -`), NOT the on-disk file: after a
       // structural edit's WorkspaceEdit the buffer is dirty (buffer != disk), and the row coordinates
@@ -392,12 +422,18 @@ export class StepsEditorProvider implements vscode.CustomTextEditorProvider {
     // CLI-refusal path, which `applyOne` handles inline) releases the slot AND keeps draining the queue
     // rather than stranding a pending second edit until the user types again.
     const applyEdit = (msg: EditMessage): Promise<void> =>
-      drainEdits(guard, msg, applyOne, (err) => {
-        void vscode.window.showErrorMessage(
-          `MessageFoundry: could not apply the edit — ${err instanceof Error ? err.message : String(err)}`,
-        );
-        void render(); // revert the optimistic webview change to the true projection
-      });
+      drainEdits(
+        guard,
+        msg,
+        applyOne,
+        (err) => {
+          void vscode.window.showErrorMessage(
+            `MessageFoundry: could not apply the edit — ${err instanceof Error ? err.message : String(err)}`,
+          );
+          void render(); // revert the optimistic webview change to the true projection
+        },
+        scheduleRerender, // a save the guard suppressed mid-drain is deferred, not dropped (#234)
+      );
 
     // Apply a STRUCTURAL op (insert/delete/move). Unlike a param edit these change the file's line count,
     // so every row coordinate the webview holds becomes stale — the op must run ALONE (never batched with
@@ -448,9 +484,12 @@ export class StepsEditorProvider implements vscode.CustomTextEditorProvider {
         // queued while it held the slot references stale PRE-op coordinates. DROP that queue before
         // releasing the slot — never let the next drain apply it against shifted rows (the orphaned-queue
         // hazard; without this the queued edit survives re-projection and is later applied on stale coords,
-        // ADR 0076 §5 v2). clearPending precedes endEdit so nothing can drain in between.
+        // ADR 0076 §5 v2). clearPending precedes the release so nothing can drain in between.
         guard.clearPending();
-        guard.endEdit();
+        // releaseEdit, never a bare endEdit: a save that landed while this op held the slot still owes a
+        // re-projection (#234). Its `clearPending` semantics are unchanged — a DROPPED param edit and a
+        // DEFERRED document refresh are different rules and must not be folded together.
+        releaseEdit(guard, scheduleRerender);
       }
       if (disposed) {
         return applied;
@@ -483,7 +522,8 @@ export class StepsEditorProvider implements vscode.CustomTextEditorProvider {
           current = guard.takePending(); // drain a raced typed edit (F5) — NEVER clearPending (that drops it)
         }
       } finally {
-        guard.endEdit();
+        // releaseEdit, never a bare endEdit — a save suppressed during the pick is deferred (#234).
+        releaseEdit(guard, scheduleRerender);
       }
       if (disposed) {
         return;
@@ -511,7 +551,8 @@ export class StepsEditorProvider implements vscode.CustomTextEditorProvider {
         );
       } finally {
         guard.clearPending();
-        guard.endEdit();
+        // releaseEdit, never a bare endEdit — a save suppressed during the undo/redo is deferred (#234).
+        releaseEdit(guard, scheduleRerender);
       }
       if (disposed) {
         return;
@@ -832,34 +873,39 @@ export class StepsEditorProvider implements vscode.CustomTextEditorProvider {
       },
     );
 
-    // The lens is READ-ONLY and refreshes ON SAVE only (ADR 0076 §5 "sync on save" guardrail): `lens parse`
-    // reads the file from disk, so re-projecting on every keystroke would slice the current (dirty) buffer
-    // against line ranges computed from stale disk content, and re-shell Python per keystroke. Saving makes
-    // disk == buffer, so the projection stays aligned. Debounced to coalesce rapid saves.
+    // The lens is READ-ONLY and refreshes ON SAVE only (ADR 0076 §5 "sync on save" guardrail, adopted
+    // wholesale from the verified InterSystems/VS Code set). Re-projecting per keystroke would re-shell
+    // Python on every character, and each re-projection replaces the whole webview HTML — which would
+    // destroy focus, selection and any half-typed param input mid-word. A save is the natural,
+    // user-chosen commit point. Debounced to coalesce rapid saves.
+    //
+    // NB (BACKLOG #234, corrected 2026-08-04): this comment used to justify the gate by claiming
+    // "`lens parse` reads the file from disk, so re-projecting on every keystroke would slice the current
+    // (dirty) buffer against line ranges computed from stale disk content". That is FALSE — `render()`
+    // above pipes `document.getText()` as `lens parse -` over stdin and slices that SAME snapshot for the
+    // view models, and ADR 0076's addendum says so too ("the rows are projected from the live buffer").
+    // The disk read belongs to the live-value TRACE (`dryrun --trace`), which is separately save-gated by
+    // #225 and is a different rule. A compensating control must not rest on a false premise
+    // (CLAUDE.md §11); whether to relax the gate is #234's other half and is not decided here.
     const sub = vscode.workspace.onDidSaveTextDocument((saved) => {
       if (saved.uri.toString() !== document.uri.toString()) {
         return;
       }
       // Don't re-project while our own edit's WorkspaceEdit is still applying — that is the webview↔
-      // document update loop the guard exists to break (ADR 0076 §5). A save after the edit settles
-      // re-renders normally.
+      // document update loop the guard exists to break (ADR 0076 §5). But the guard cannot tell OUR
+      // WorkspaceEdit apart from a USER save that merely landed mid-rewrite, and returning here used to
+      // DISCARD that save outright, leaving the view on a stale projection until the next one. Record the
+      // debt instead; `releaseEdit` runs it through this same debounced path when the slot frees (#234).
       if (!guard.shouldReactToDocumentChange()) {
+        guard.noteSuppressedChange();
         return;
       }
-      if (debounce) {
-        clearTimeout(debounce);
-      }
-      debounce = setTimeout(() => {
-        debounce = undefined;
-        void render();
-      }, RERENDER_DEBOUNCE_MS);
+      scheduleRerender();
     });
     panel.onDidDispose(() => {
       disposed = true;
       sub.dispose();
-      if (debounce) {
-        clearTimeout(debounce);
-      }
+      rerender.cancel();
     });
 
     void render();
diff --git a/ide/src/test/suite/ai-policy-model.test.ts b/ide/src/test/suite/ai-policy-model.test.ts
new file mode 100644
index 00000000..8c8fb2e7
--- /dev/null
+++ b/ide/src/test/suite/ai-policy-model.test.ts
@@ -0,0 +1,126 @@
+import * as assert from "assert";
+
+import { assistantState, mergeAuthoritativePolicy, type AiPolicy } from "../../aiPolicyModel";
+
+// BACKLOG #330, defect 1 — the authoritative-merge guard, and its coupling to the gate it feeds.
+//
+// WHY THIS FILE EXISTS SEPARATELY FROM ai-policy.test.ts: `ide/package.json`'s `test:unit` script
+// `--ignore`s `out/test/suite/ai-policy.test.js` (aiPolicy.ts imports vscode), so anything asserted
+// only there runs solely in the Windows-only `npm test` leg. These import the zero-import
+// aiPolicyModel, so they execute in the node-side runner on EVERY ide CI leg — which is where the
+// security invariant belongs.
+//
+// The rule under test is ASYMMETRIC, and the asymmetry is the whole design: a cached DENY survives a
+// fresh `null`; a cached PERMIT does not. Tests T1 and T3 are the two poles, and neither alone can
+// tell a correct guard from a broken one.
+function policy(p: Partial<AiPolicy>): AiPolicy {
+  return {
+    mode: "byo",
+    dataScope: "code_only",
+    environment: null,
+    assistPermitted: null,
+    reason: null,
+    ...p,
+  };
+}
+
+suite("mergeAuthoritativePolicy (BACKLOG #330 — a degraded read must not upgrade assistance)", () => {
+  test("T1: a fresh null does NOT overwrite a cached ai:assist deny", () => {
+    // The exact defect-1 regression. `assist_permitted` is identity-dependent, so an unattributed read
+    // answers null; writing that raw would re-enable assistance a central policy had switched off.
+    const merged = mergeAuthoritativePolicy(
+      policy({ assistPermitted: false }),
+      policy({ assistPermitted: null }),
+    );
+    assert.strictEqual(merged.assistPermitted, false);
+  });
+
+  test("T2: an evaluable GRANT un-sticks the deny (the escape hatch is signing in)", () => {
+    // Without this, the guard would be a permanent lockout: once false was cached, nothing could clear
+    // it. T1 alone passes for a guard that never lets go — this is what distinguishes the two.
+    const merged = mergeAuthoritativePolicy(
+      policy({ assistPermitted: false }),
+      policy({ assistPermitted: true }),
+    );
+    assert.strictEqual(merged.assistPermitted, true);
+  });
+
+  test("T3: a cached PERMIT is NOT sticky — null wins, and stays enabled", () => {
+    // The fail-OPEN direction, pinned. Carrying a cached `true` over a fresh `null` would fabricate a
+    // permit from stale state; `null` under BYO is allowed by design (docs/AI.md's trust note), so the
+    // correct behaviour is to take the null and remain enabled — not to invent a grant.
+    const merged = mergeAuthoritativePolicy(
+      policy({ assistPermitted: true }),
+      policy({ assistPermitted: null }),
+    );
+    assert.strictEqual(merged.assistPermitted, null);
+    assert.strictEqual(assistantState(merged).enabled, true);
+  });
+
+  test("T4: `mode` is never resurrected from the cache — a central re-enable propagates", () => {
+    // Only assistPermitted is retained. mode is identity-INDEPENDENT, so an admin flipping off → byo
+    // must take effect on the very next read; a guard that froze the whole policy would pass T1.
+    const merged = mergeAuthoritativePolicy(
+      policy({ mode: "off", assistPermitted: false }),
+      policy({ mode: "byo", assistPermitted: null }),
+    );
+    assert.strictEqual(merged.mode, "byo");
+    assert.strictEqual(merged.assistPermitted, false, "the deny is still retained");
+  });
+
+  test("T5: the first ever read (no cache) is a plain pass-through and does not throw", () => {
+    const fresh = policy({ mode: "byo", assistPermitted: null });
+    assert.deepStrictEqual(mergeAuthoritativePolicy(null, fresh), fresh);
+  });
+
+  test("T6: the retained deny actually reaches the GATE, not just the struct", () => {
+    // The item's real claim. A field that survives a merge but never changes assistantState's verdict
+    // would be a fix in name only.
+    const merged = mergeAuthoritativePolicy(
+      policy({ mode: "byo", assistPermitted: false }),
+      policy({ mode: "byo", assistPermitted: null }),
+    );
+    const state = assistantState(merged);
+    assert.strictEqual(state.enabled, false);
+    assert.ok(/ai:assist/i.test(state.message ?? ""), "the message names the missing permission");
+  });
+
+  // T7-T9: the guard must key on "is this an EVALUABLE answer", not on the single literal `null`.
+  // T1-T6 all construct `assistPermitted: null`, so none of them can see a value that is merely
+  // not-null — and `undefined !== null`, so a `=== null` guard lets one straight through.
+  test("T7: a fresh answer that OMITS the permission does not overwrite a cached deny", () => {
+    // The reachable degraded case: a 200 whose body has no `assist_permitted` at all parses to
+    // `undefined`. `AiPolicyWire` is a compile-time claim and JSON.parse does not honour it, so this
+    // reaches the merge as a real value. Unguarded it is the fail-OPEN direction — and worse than a
+    // one-off, because `undefined` is not `false` either, so the cache is poisoned permanently.
+    const merged = mergeAuthoritativePolicy(policy({ assistPermitted: false }), {
+      ...policy({}),
+      assistPermitted: undefined as unknown as boolean | null,
+    });
+    assert.strictEqual(merged.assistPermitted, false, "the deny survives an absent field");
+    assert.strictEqual(assistantState(merged).enabled, false, "and it still reaches the gate");
+  });
+
+  test("T8: a non-boolean answer is not a permit either", () => {
+    // Same rule, other shape: a proxy or a mistyped target answering a string must not read as
+    // "permitted". Anything that is not the literal true/false means "not evaluated".
+    const merged = mergeAuthoritativePolicy(policy({ assistPermitted: false }), {
+      ...policy({}),
+      assistPermitted: "yes" as unknown as boolean | null,
+    });
+    assert.strictEqual(merged.assistPermitted, false);
+    assert.strictEqual(assistantState(merged).enabled, false);
+  });
+
+  test("T9: a non-evaluable answer is NORMALIZED to null, so the cache stays comparable", () => {
+    // With no cache there is no deny to retain — but the value written must still be `null`, not the
+    // `undefined` that came in. Storing `undefined` would make every later `cached?.assistPermitted
+    // === false` test false, i.e. a single degraded read would disarm the guard for good.
+    const merged = mergeAuthoritativePolicy(null, {
+      ...policy({}),
+      assistPermitted: undefined as unknown as boolean | null,
+    });
+    assert.strictEqual(merged.assistPermitted, null);
+    assert.ok("assistPermitted" in merged, "the key is present, not dropped");
+  });
+});
diff --git a/ide/src/test/suite/ai-policy.test.ts b/ide/src/test/suite/ai-policy.test.ts
index 2bf30db3..76d0b4ac 100644
--- a/ide/src/test/suite/ai-policy.test.ts
+++ b/ide/src/test/suite/ai-policy.test.ts
@@ -1,6 +1,17 @@
 import * as assert from "assert";
 
-import { assistantState, pickOfflinePolicy, type AiPolicy } from "../../aiPolicy";
+import type * as vscode from "vscode";
+
+import {
+  DEFAULT_AI_POLICY_IO,
+  assistantState,
+  pickOfflinePolicy,
+  resolveAiPolicy,
+  type AiPolicy,
+  type AiPolicyIo,
+  type AiPolicyWire,
+} from "../../aiPolicy";
+import { peekToken } from "../../auth";
 
 // SEC-022 regression. The offline AI-policy resolution must FAIL CLOSED: when the engine is
 // unreachable and nothing can positively confirm a policy, assistance is disabled (an org-set central
@@ -63,3 +74,178 @@ suite("pickOfflinePolicy (SEC-022)", () => {
     assert.strictEqual(assistantState(fallback).enabled, false);
   });
 });
+
+// BACKLOG #330 — resolveAiPolicy's fetch-and-cache path, where BOTH defects lived and which had no
+// test at all. It needs the vscode-importing module, so these run only under `npm test` (the
+// Extension-Host leg); the pure merge rule they depend on is asserted node-side on every leg in
+// ai-policy-model.test.ts. That split is deliberate — see R4 in the plan.
+
+/** A fake globalState that records what was written, so a guard cannot pass by not writing. */
+function fakeCtx(seed?: AiPolicy): {
+  ctx: vscode.ExtensionContext;
+  stored: () => AiPolicy | undefined;
+  updates: () => number;
+} {
+  let value = seed;
+  let updates = 0;
+  const ctx = {
+    globalState: {
+      get: (_key: string): AiPolicy | undefined => value,
+      update: async (_key: string, v: AiPolicy): Promise<void> => {
+        value = v;
+        updates++;
+      },
+    },
+  } as unknown as vscode.ExtensionContext;
+  return { ctx, stored: () => value, updates: () => updates };
+}
+
+function wire(w: Partial<AiPolicyWire>): AiPolicyWire {
+  return {
+    mode: "byo",
+    data_scope: "code_only",
+    environment: null,
+    assist_permitted: null,
+    reason: null,
+    ...w,
+  };
+}
+
+/** An io whose calls are recorded. `url` defaults to loopback, which SEC-005 permits over http. */
+function fakeIo(opts: {
+  url?: string;
+  token?: string;
+  answer: AiPolicyWire;
+}): AiPolicyIo & { calls: { url: string; route: string; token: string | undefined }[] } {
+  const calls: { url: string; route: string; token: string | undefined }[] = [];
+  return {
+    calls,
+    url: () => opts.url ?? "http://127.0.0.1:8765",
+    readToken: async () => opts.token,
+    getPolicy: async (url, route, token) => {
+      calls.push({ url, route, token });
+      return opts.answer;
+    },
+    getCliPolicy: async () => {
+      throw new Error("the CLI must not be consulted when the engine answered");
+    },
+  };
+}
+
+suite("resolveAiPolicy — the bearer (BACKLOG #330, defect 2)", () => {
+  test("T10: the cached bearer is attached to the /ai/policy read", async () => {
+    const { ctx } = fakeCtx();
+    const io = fakeIo({ token: "tok-abc", answer: wire({ assist_permitted: false }) });
+    const p = await resolveAiPolicy(ctx, io);
+    assert.strictEqual(io.calls.length, 1);
+    assert.strictEqual(io.calls[0].token, "tok-abc", "the bearer must reach the request");
+    assert.strictEqual(io.calls[0].route, "/ai/policy");
+    // And the whole point: with an identity attached, the engine's `false` now arrives and gates.
+    assert.strictEqual(p.assistPermitted, false);
+    assert.strictEqual(assistantState(p).enabled, false);
+  });
+
+  test("T11: the production io reads the token PASSIVELY — peekToken, never ensureToken", async () => {
+    // `ensureToken` has an identical signature, so the type system cannot rule it out; this identity
+    // check is the actual control. A chat turn resolves the policy before every request — an
+    // ensureToken here would pop a sign-in modal out of typing a question.
+    assert.strictEqual(DEFAULT_AI_POLICY_IO.readToken, peekToken);
+  });
+
+  test("T12: SEC-005 — no bearer to a non-loopback plain-http target, but yes to loopback", async () => {
+    const offBox = fakeIo({
+      url: "http://engine.example.test:8765",
+      token: "tok-abc",
+      answer: wire({}),
+    });
+    await resolveAiPolicy(fakeCtx().ctx, offBox);
+    assert.strictEqual(
+      offBox.calls[0].token,
+      undefined,
+      "a bearer must never go in clear to a non-loopback http:// host",
+    );
+
+    // The other polarity, so the guard cannot pass by refusing everything.
+    const loopback = fakeIo({ url: "http://127.0.0.1:8765", token: "tok-abc", answer: wire({}) });
+    await resolveAiPolicy(fakeCtx().ctx, loopback);
+    assert.strictEqual(loopback.calls[0].token, "tok-abc", "loopback over http is the dev default");
+  });
+});
+
+suite("resolveAiPolicy — the guarded cache write (BACKLOG #330, defect 1)", () => {
+  test("T13: a null answer does not overwrite a cached deny, in the RETURN or the STORE", async () => {
+    const seeded = {
+      mode: "byo",
+      dataScope: "code_only",
+      environment: null,
+      assistPermitted: false,
+      reason: null,
+    } satisfies AiPolicy;
+    const f = fakeCtx(seeded);
+    const io = fakeIo({ token: "tok-abc", answer: wire({ assist_permitted: null }) });
+    const p = await resolveAiPolicy(f.ctx, io);
+    // Assert BOTH: a half-fix that returns the merged policy while storing the raw one would leave the
+    // deny to be lost on the next read.
+    assert.strictEqual(p.assistPermitted, false, "the returned policy keeps the deny");
+    assert.strictEqual(f.stored()?.assistPermitted, false, "the STORED policy keeps the deny");
+    assert.strictEqual(assistantState(p).enabled, false);
+  });
+
+  test("T13b: a 200 that OMITS assist_permitted cannot launder the deny either", async () => {
+    // The COMPOSED behaviour, end to end: `AiPolicyWire` is a compile-time claim that JSON.parse does
+    // not enforce, so a body with no `assist_permitted` key arrives as `undefined` — which is NOT
+    // `null`. Two independent lines stop it (the `fromWire` narrowing and the merge's), so this test
+    // stays green if either survives; T7 in ai-policy-model.test.ts is what pins the merge's line
+    // specifically, and T13c below pins `fromWire`'s. Kept because it is the only assertion that the
+    // whole path — wire → narrow → merge → store → gate — holds together.
+    const seeded = {
+      mode: "byo",
+      dataScope: "code_only",
+      environment: null,
+      assistPermitted: false,
+      reason: null,
+    } satisfies AiPolicy;
+    const f = fakeCtx(seeded);
+    const degraded = {
+      mode: "byo",
+      data_scope: "code_only",
+      environment: null,
+      reason: null,
+    } as unknown as AiPolicyWire; // a proxy, or an engine build predating the field
+    const p = await resolveAiPolicy(f.ctx, fakeIo({ token: "tok-abc", answer: degraded }));
+    assert.strictEqual(p.assistPermitted, false, "the returned policy keeps the deny");
+    assert.strictEqual(f.stored()?.assistPermitted, false, "the STORED policy keeps the deny");
+    assert.strictEqual(assistantState(p).enabled, false);
+  });
+
+  test("T13c: the CLI fallback narrows too — it never reaches the merge, so fromWire must", async () => {
+    // The path that proves `fromWire`'s narrowing is not redundant with the merge's: when the engine
+    // is unreachable, `resolveAiPolicy` runs `fromWire(await io.getCliPolicy())` and hands the result
+    // to `pickOfflinePolicy` WITHOUT ever calling mergeAuthoritativePolicy (aiPolicy.ts). So an
+    // unnarrowed copy survives to the caller as `undefined`, and `showAiPolicy` renders that with
+    // `assistPermitted === null ? "unknown" : p.assistPermitted ? "yes" : "no"` — i.e. it would tell a
+    // user "assist_permitted=no", asserting a deny the engine never issued.
+    const io: AiPolicyIo = {
+      url: () => "http://127.0.0.1:8765",
+      readToken: async () => "tok-abc",
+      getPolicy: async () => {
+        throw new Error("engine unreachable");
+      },
+      getCliPolicy: async () =>
+        ({ mode: "byo", data_scope: "code_only", environment: "dev", reason: null }) as unknown as AiPolicyWire,
+    };
+    const p = await resolveAiPolicy(fakeCtx().ctx, io);
+    assert.strictEqual(p.assistPermitted, null, "an absent CLI field is 'unknown', never a deny");
+    assert.notStrictEqual(p.assistPermitted, undefined, "and never the raw undefined");
+  });
+
+  test("T14: AC-6 still holds — a successful read is still CACHED (the guard is not a skip)", async () => {
+    // The obvious wrong turn is to "fix" an unguarded write by removing it. That would break ADR 0035
+    // AC-6: the cache is what makes a central "off" survive the engine going offline.
+    const f = fakeCtx();
+    const io = fakeIo({ token: "tok-abc", answer: wire({ mode: "off" }) });
+    await resolveAiPolicy(f.ctx, io);
+    assert.strictEqual(f.updates(), 1, "the authoritative answer must be written exactly once");
+    assert.strictEqual(f.stored()?.mode, "off");
+  });
+});
diff --git a/ide/src/test/suite/engine-client.test.ts b/ide/src/test/suite/engine-client.test.ts
index 2349ddfe..6af52369 100644
--- a/ide/src/test/suite/engine-client.test.ts
+++ b/ide/src/test/suite/engine-client.test.ts
@@ -83,3 +83,46 @@ suite("engineClient — getJson timeout (F2)", () => {
     assert.ok(/nothing is listening/i.test(dead.reason ?? ""));
   });
 });
+
+// BACKLOG #330 — the LAST HOP of the chain. Every other test in this change stops at a call boundary
+// (a recorded argument, a plan constant); this one puts a real request on a real socket and reads the
+// header the engine would see. Without it the item's headline claim — "the read is authenticated" —
+// rests on a header nobody has observed. Both polarities are asserted: that a token becomes a Bearer
+// header, AND that a tokenless call really sends nothing (the status bar's read depends on the latter).
+suite("engineClient — getJson sends the bearer only when given one (BACKLOG #330)", () => {
+  let server: http.Server;
+  let url: string;
+  let seen: string | undefined;
+  let sawHeader = false;
+
+  setup(async () => {
+    seen = undefined;
+    sawHeader = false;
+    server = http.createServer((req, res) => {
+      seen = req.headers.authorization;
+      sawHeader = "authorization" in req.headers;
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: true }));
+    });
+    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const addr = server.address() as AddressInfo;
+    url = `http://127.0.0.1:${addr.port}`;
+  });
+
+  teardown(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  });
+
+  test("T15a: a token is sent as `Authorization: Bearer <token>`", async () => {
+    await getJson(url, "/ai/policy", "tok-abc");
+    assert.strictEqual(seen, "Bearer tok-abc");
+  });
+
+  test("T15b: a tokenless call sends NO Authorization header at all", async () => {
+    // Not merely "not a valid token" — the header must be absent. `Bearer undefined` would be a string
+    // the engine tries to resolve, and on the status bar's 15s path any bearer at all is the CWE-613 bug.
+    await getJson(url, "/ai/policy");
+    assert.strictEqual(seen, undefined);
+    assert.strictEqual(sawHeader, false, "the header key must not be present");
+  });
+});
diff --git a/ide/src/test/suite/engine-doctor.test.ts b/ide/src/test/suite/engine-doctor.test.ts
index 5c86e647..0f2ffdc6 100644
--- a/ide/src/test/suite/engine-doctor.test.ts
+++ b/ide/src/test/suite/engine-doctor.test.ts
@@ -1,9 +1,12 @@
 import * as assert from "assert";
 
 import {
+  ASSIST_GATE_PLAN,
   CMD,
   DEEP_PROBE_ROUTE,
   ENGINE_LINK_FIELDS,
+  ENVIRONMENT_PLAN,
+  POLICY_ROUTE,
   POLL_PLAN,
   PROBE_ENDPOINTS,
   VERIFY_PLAN,
@@ -107,6 +110,54 @@ suite("engine doctor — the boundary, as CI", () => {
     }
   });
 
+  test("T7: the status bar's /ai/policy environment read stays TOKENLESS (CWE-613)", () => {
+    // statusBar.readEnvironment runs off the same 15s timer as the poll, via runProbe — which attaches a
+    // bearer IFF the plan entry says `authenticated`. Flipping this to true would put a bearer on the
+    // timer and make the engine's 30-minute idle timeout unreachable, on the exact client the
+    // automatic-logoff control exists for. It wants `environment`, which is identity-INDEPENDENT, so it
+    // has nothing to gain from a token in the first place.
+    assert.ok(ENVIRONMENT_PLAN.length > 0);
+    for (const entry of ENVIRONMENT_PLAN) {
+      assert.strictEqual(
+        entry.authenticated,
+        false,
+        `the status bar's environment read must not authenticate (${entry.route}) — it is on a timer`,
+      );
+      assert.ok(
+        (PROBE_ENDPOINTS as readonly string[]).includes(entry.route),
+        `${entry.route} is not an allowed probe endpoint`,
+      );
+    }
+    assert.strictEqual(ENVIRONMENT_PLAN[0].route, POLICY_ROUTE);
+  });
+
+  test("T8: aiPolicy's gate read DOES authenticate — same route, opposite answer, on purpose", () => {
+    // BACKLOG #330. `assist_permitted` is computed from the acting identity (api/app.py), so a tokenless
+    // read can only ever answer null and the ai:assist deny branch can never fire. Unlike the status
+    // bar's read, this one is user-initiated only (a chat turn / the Show AI Policy command), so it sits
+    // under VERIFY_PLAN's rationale rather than POLL_PLAN's: refreshing the idle clock there is honest
+    // activity, not a forgery.
+    assert.strictEqual(ASSIST_GATE_PLAN.length, 1);
+    assert.strictEqual(ASSIST_GATE_PLAN[0].authenticated, true);
+    assert.ok(
+      (PROBE_ENDPOINTS as readonly string[]).includes(ASSIST_GATE_PLAN[0].route),
+      `${ASSIST_GATE_PLAN[0].route} is not an allowed probe endpoint`,
+    );
+    // The distinction itself, asserted — so a later reader who finds two plans for one route cannot
+    // "unify" them without turning this red. Same route; the ANSWER is what differs, and it differs
+    // because the two callers want different FIELDS of the same document.
+    assert.strictEqual(
+      ENVIRONMENT_PLAN[0].route,
+      ASSIST_GATE_PLAN[0].route,
+      "both plans read the same route",
+    );
+    assert.notStrictEqual(
+      ENVIRONMENT_PLAN[0].authenticated,
+      ASSIST_GATE_PLAN[0].authenticated,
+      "the timer-driven read and the user-initiated read must NOT agree about the bearer",
+    );
+  });
+
   test("the user-initiated deep check MAY authenticate — and only it may", () => {
     // A click / activation / promote IS real user activity, so refreshing the idle clock there is honest.
     assert.ok(VERIFY_PLAN.some((e) => e.authenticated));
diff --git a/ide/src/test/suite/steps-edit.test.ts b/ide/src/test/suite/steps-edit.test.ts
index f1f23ef9..c0ea87eb 100644
--- a/ide/src/test/suite/steps-edit.test.ts
+++ b/ide/src/test/suite/steps-edit.test.ts
@@ -7,6 +7,7 @@ import {
   EditLoopGuard,
   INSERTABLE_ACTIONS,
   INSERT_ACTION_LABELS,
+  RerenderDebouncer,
   STRUCTURAL_OPS,
   TOOLBAR_INSERT_DEFAULTS,
   blockExtent,
@@ -30,6 +31,7 @@ import {
   opForcesReprojection,
   parseRewriteResult,
   physicalLines,
+  releaseEdit,
   renderRowHtml,
   renderStepsContextMenuHtml,
   resolveDrop,
@@ -464,6 +466,321 @@ suite("Steps edit — one-edit-at-a-time + update-loop guard", () => {
   });
 });
 
+// BACKLOG #234 — a document change the guard SUPPRESSES is deferred, not dropped. The provider's save
+// subscription returns early when `shouldReactToDocumentChange()` is false; before this, a user save that
+// landed inside an in-flight `lens rewrite` was discarded outright and the view would keep showing a
+// projection of the pre-save buffer until the next save. The guard now records the debt and
+// `releaseEdit` pays it when the slot frees.
+suite("Steps update-loop guard — a suppressed document change is DEFERRED, not dropped (#234)", () => {
+  test("noteSuppressedChange → releaseEdit runs the owed refresh exactly once (clear-on-read)", () => {
+    const guard = new EditLoopGuard();
+    let refreshes = 0;
+    assert.strictEqual(guard.beginEdit(), true);
+    assert.strictEqual(
+      guard.shouldReactToDocumentChange(),
+      false,
+      "the provider declines to re-project while our own WorkspaceEdit applies",
+    );
+    guard.noteSuppressedChange();
+    assert.strictEqual(guard.hasSuppressedChange, true, "the save is REMEMBERED, not discarded");
+
+    releaseEdit(guard, () => {
+      refreshes += 1;
+    });
+    assert.strictEqual(refreshes, 1, "the deferred re-projection runs when the slot frees");
+    assert.strictEqual(guard.isEditing, false, "releaseEdit still releases the slot");
+    assert.strictEqual(
+      guard.takeSuppressedChange(),
+      false,
+      "clear-on-read: the same suppressed save can never owe a second refresh",
+    );
+
+    // …and a SECOND release with nothing suppressed must not fire the callback again.
+    guard.beginEdit();
+    releaseEdit(guard, () => {
+      refreshes += 1;
+    });
+    assert.strictEqual(refreshes, 1, "no suppressed change → no refresh (the ordinary path is unchanged)");
+  });
+
+  test("many suppressed saves owe exactly ONE refresh (a re-projection is idempotent)", () => {
+    const guard = new EditLoopGuard();
+    let refreshes = 0;
+    guard.beginEdit();
+    guard.noteSuppressedChange();
+    guard.noteSuppressedChange();
+    guard.noteSuppressedChange();
+    releaseEdit(guard, () => {
+      refreshes += 1;
+    });
+    assert.strictEqual(refreshes, 1);
+  });
+
+  test("releaseEdit without a callback still clears the debt (no wedged flag)", () => {
+    const guard = new EditLoopGuard();
+    guard.beginEdit();
+    guard.noteSuppressedChange();
+    releaseEdit(guard);
+    assert.strictEqual(guard.hasSuppressedChange, false, "the flag is consumed even with no callback");
+  });
+
+  test("drainEdits pays the debt in its finally — including when apply REJECTS", async () => {
+    // The unexpected-rejection path already had to release the slot and keep draining; it must not
+    // swallow the owed refresh on the way out.
+    const guard = new EditLoopGuard();
+    const applied: string[] = [];
+    const errors: unknown[] = [];
+    let refreshes = 0;
+    const first: EditMessage = {
+      command: "edit",
+      handler: "h",
+      lineStart: 6,
+      lineEnd: 6,
+      name: "dst",
+      value: "A",
+    };
+    const second: EditMessage = { ...first, name: "src", value: "B" };
+
+    const apply = async (msg: EditMessage): Promise<void> => {
+      applied.push(msg.name);
+      if (msg.name === "dst") {
+        // A user save lands while the rewrite is in flight → the provider's subscription records it.
+        guard.noteSuppressedChange();
+        guard.queue(second);
+        throw new Error("applyEdit rejected");
+      }
+    };
+
+    await drainEdits(
+      guard,
+      first,
+      apply,
+      (e) => errors.push(e),
+      () => {
+        refreshes += 1;
+      },
+    );
+
+    assert.deepStrictEqual(applied, ["dst", "src"], "the queued edit still drains after the rejection");
+    assert.strictEqual(errors.length, 1, "the rejection is still surfaced");
+    assert.strictEqual(guard.isEditing, false, "the slot is still released");
+    assert.strictEqual(refreshes, 1, "the save suppressed mid-drain is re-projected, not lost");
+  });
+
+  test("drainEdits with NO suppressed change never schedules a refresh", async () => {
+    const guard = new EditLoopGuard();
+    let refreshes = 0;
+    await drainEdits(
+      guard,
+      { command: "edit", handler: "h", lineStart: 1, lineEnd: 1, name: "v", value: "x" },
+      async () => {
+        /* applies cleanly */
+      },
+      undefined,
+      () => {
+        refreshes += 1;
+      },
+    );
+    assert.strictEqual(refreshes, 0, "an edit that races nothing must not trigger an extra re-projection");
+  });
+});
+
+/** A deterministic stand-in for setTimeout/clearTimeout so the debounce can be driven without waiting
+ * 250 ms of wall clock (and without a timing-sensitive test). `advance` fires everything due. */
+class FakeClock {
+  private nextId = 1;
+  private now = 0;
+  private readonly timers = new Map<number, { fn: () => void; at: number }>();
+
+  readonly set = (fn: () => void, ms: number): number => {
+    const id = this.nextId++;
+    this.timers.set(id, { fn, at: this.now + ms });
+    return id;
+  };
+
+  readonly clear = (id: number): void => {
+    this.timers.delete(id);
+  };
+
+  advance(ms: number): void {
+    this.now += ms;
+    for (const [id, t] of [...this.timers]) {
+      if (t.at <= this.now) {
+        this.timers.delete(id);
+        t.fn();
+      }
+    }
+  }
+
+  get pending(): number {
+    return this.timers.size;
+  }
+}
+
+// BACKLOG #234 / ADR 0076 Amendment C AC-C2 — releasing the slot after a suppressed save must yield
+// EXACTLY ONE re-projection. That is a property of the guard and the debounce COMPOSED: three of the
+// provider's release sites force a full re-projection immediately after releasing, so without the
+// cancel-on-render half the deferred run fires 250 ms later as a SECOND whole-webview replacement.
+suite("Steps re-render debouncer — one re-projection per release (#234, AC-C2)", () => {
+  const DELAY = 250;
+
+  test("rapid schedules coalesce into ONE run", () => {
+    const clock = new FakeClock();
+    let runs = 0;
+    const d = new RerenderDebouncer<number>(() => (runs += 1), DELAY, clock.set, clock.clear);
+    d.schedule();
+    clock.advance(100);
+    d.schedule(); // a second save inside the window re-arms rather than stacking
+    assert.strictEqual(runs, 0, "nothing runs until the window closes");
+    clock.advance(DELAY);
+    assert.strictEqual(runs, 1, "two saves 100 ms apart coalesce to one re-projection");
+    assert.strictEqual(d.armed, false, "the channel disarms itself when it fires");
+  });
+
+  test("cancel() discharges an armed run instead of dropping it on the floor", () => {
+    const clock = new FakeClock();
+    let runs = 0;
+    const d = new RerenderDebouncer<number>(() => (runs += 1), DELAY, clock.set, clock.clear);
+    d.schedule();
+    assert.strictEqual(d.armed, true);
+    d.cancel();
+    assert.strictEqual(d.armed, false);
+    clock.advance(10_000);
+    assert.strictEqual(runs, 0, "a cancelled run must not fire later");
+    assert.strictEqual(clock.pending, 0, "and the underlying timer is really cleared, not just orphaned");
+  });
+
+  test("a save that lands DURING a re-projection still re-arms and is honoured", () => {
+    // render() cancels on entry, then awaits `lens parse`. A save arriving inside that await must not
+    // be swallowed by the cancel that already happened.
+    const clock = new FakeClock();
+    let runs = 0;
+    const d = new RerenderDebouncer<number>(() => (runs += 1), DELAY, clock.set, clock.clear);
+    d.cancel(); // render() enters
+    d.schedule(); // the user saves while `lens parse` is in flight
+    clock.advance(DELAY);
+    assert.strictEqual(runs, 1, "the mid-render save is still re-projected");
+  });
+
+  test("suppressed save → releaseEdit → forced render yields EXACTLY ONE re-projection", () => {
+    // The provider's applyStructural/applyPickedEdit/applyUndoRedo shape, modelled end to end:
+    // release the slot (which pays the deferred refresh through `scheduleRerender`), then force a full
+    // re-projection — and `render()` cancels the debounce on entry.
+    const clock = new FakeClock();
+    let reprojections = 0;
+    const d = new RerenderDebouncer<number>(
+      () => {
+        reprojections += 1;
+      },
+      DELAY,
+      clock.set,
+      clock.clear,
+    );
+    const render = (): void => {
+      d.cancel(); // ← the AC-C2 half under test
+      reprojections += 1;
+    };
+    const guard = new EditLoopGuard();
+
+    assert.strictEqual(guard.beginEdit(), true);
+    assert.strictEqual(guard.shouldReactToDocumentChange(), false);
+    guard.noteSuppressedChange(); // a user save lands mid-`lens rewrite`
+    releaseEdit(guard, () => d.schedule());
+    assert.strictEqual(d.armed, true, "the release armed the deferred refresh");
+    render(); // the structural op's forced re-projection, a few lines later
+    clock.advance(10_000);
+
+    assert.strictEqual(
+      reprojections,
+      1,
+      "AC-C2: a suppressed save around a forced re-projection owes ONE render, not two",
+    );
+  });
+
+  test("…and the assertion above is DISCRIMINATING: a render that does not cancel yields two", () => {
+    // Kept in the tree as the falsification of the test above. Before #234's cancel-on-render half,
+    // the provider's render() looked exactly like `bareRender` here: the forced pass ran, and the
+    // armed debounce then replaced the whole webview HTML a second time ~250 ms later.
+    const clock = new FakeClock();
+    let reprojections = 0;
+    const d = new RerenderDebouncer<number>(
+      () => {
+        reprojections += 1;
+      },
+      DELAY,
+      clock.set,
+      clock.clear,
+    );
+    const bareRender = (): void => {
+      reprojections += 1; // no d.cancel()
+    };
+    const guard = new EditLoopGuard();
+    guard.beginEdit();
+    guard.noteSuppressedChange();
+    releaseEdit(guard, () => d.schedule());
+    bareRender();
+    clock.advance(10_000);
+    assert.strictEqual(reprojections, 2, "without the cancel the deferred run is a SECOND re-projection");
+  });
+
+  test("a render INSIDE the drain discharges the debt, so the finally arms nothing (AC-C2 + AC-C4)", async () => {
+    // The one path where the forced render happens BEFORE the release: `drainEdits`' unexpected-
+    // rejection handler renders to revert the optimistic webview change, and only THEN does the
+    // `finally` release the slot. Cancelling the debounce cannot help there (nothing is armed yet), so
+    // `render()` also takes the guard's debt — otherwise the finally would arm a redundant second pass.
+    const clock = new FakeClock();
+    let reprojections = 0;
+    const d = new RerenderDebouncer<number>(
+      () => {
+        reprojections += 1;
+      },
+      DELAY,
+      clock.set,
+      clock.clear,
+    );
+    const guard = new EditLoopGuard();
+    const render = (): void => {
+      d.cancel();
+      guard.takeSuppressedChange(); // ← the second discharge route under test
+      reprojections += 1;
+    };
+    const errors: unknown[] = [];
+
+    await drainEdits(
+      guard,
+      { command: "edit", handler: "h", lineStart: 4, lineEnd: 4, name: "v", value: "x" },
+      async () => {
+        guard.noteSuppressedChange(); // a user save lands mid-rewrite
+        throw new Error("applyEdit rejected");
+      },
+      (e) => {
+        errors.push(e);
+        render(); // the provider's revert-to-true-projection render
+      },
+      () => d.schedule(),
+    );
+    clock.advance(10_000);
+
+    assert.strictEqual(errors.length, 1, "the rejection is still surfaced");
+    assert.strictEqual(guard.isEditing, false, "the slot is still released");
+    assert.strictEqual(
+      reprojections,
+      1,
+      "the revert render IS the owed re-projection — the finally must not arm a second one",
+    );
+  });
+
+  test("no suppressed change → the release arms nothing at all (AC-C3)", () => {
+    const clock = new FakeClock();
+    const d = new RerenderDebouncer<number>(() => undefined, DELAY, clock.set, clock.clear);
+    const guard = new EditLoopGuard();
+    guard.beginEdit();
+    releaseEdit(guard, () => d.schedule());
+    assert.strictEqual(d.armed, false, "the ordinary path schedules nothing");
+    assert.strictEqual(clock.pending, 0);
+  });
+});
+
 suite("Steps edit — the stale-coordinate guard (F7)", () => {
   test("buildEditRequest carries the row's live-buffer source as expect_src when supplied", () => {
     const msg: EditMessage = {
@@ -950,10 +1267,14 @@ suite("Steps toolbar — the top-of-lens INSERT toolbar (Corepoint-style Add)",
 });
 
 // The right-click ROW CONTEXT MENU (ADR 0103) — the pure half: the explicit before/after insert mapping,
-// the item-enablement matrix, the server-rendered menu template, and the [blank] placeholder. The webview
-// WIRING (positioning, dismissal, keyboard) lives in media/stepsWebview.js and is NOT unit-tested here —
-// like the file's other webview mirrors (walkMove/captureBlock DnD), it is verified manually; these
+// the item-enablement matrix, the server-rendered menu template, and the [blank] placeholder. These
 // node-side tests cover the pure model + the rendered markup it consumes.
+//
+// The webview's MIRRORS of these pure functions — menu enablement, walkMove/blockExtent/captureBlock,
+// canDrop/resolveDrop/barAnchor/scopeLabel — are no longer "verified manually": `steps-mirror.test.ts`
+// (BACKLOG #233) loads media/stepsWebview.js under jsdom and asserts each one against its model
+// counterpart. What genuinely REMAINS manual is the menu's positioning/viewport clamping, submenu
+// flipping, dismissal and keyboard navigation (STEPS-76) — DOM behaviour with no pure counterpart.
 suite("Steps context menu — explicit before/after insert (right-click, ADR 0103)", () => {
   const anchor = {
     handler: "enrich",
@@ -1339,6 +1660,29 @@ suite("Steps cross-suite — canDropRow / resolveDrop / scopeLabel (the pure dro
     assert.strictEqual(canDropRow(block, bodyA), false, "a block can't be dropped into its own body");
   });
 
+  test("canDropRow: a read-only CODE row is never a drop target, even though it is DRAGGABLE (#233)", () => {
+    // renderRowHtml marks a `code` row draggable="true" ON PURPOSE — solely so a drag ATTEMPT can be
+    // intercepted and answered with "edit it in the code editor" (stepsWebview.js:469-473). So
+    // `target.draggable` does NOT already exclude it, and the model's own contract ("never treats a code
+    // row as a drop target") needs an explicit rule. Before #233 the model returned true here while the
+    // CSP-isolated mirror (stepsWebview.js:388) returned false — a deploying site would have seen the
+    // insertion indicator refuse a code row while the model-side resolution accepted it.
+    const codeTarget = ctx({ lineStart: 3, lineEnd: 3, kind: "code", draggable: true });
+    assert.strictEqual(canDropRow(leafB, codeTarget), false, "a code row is not a drop target");
+    assert.strictEqual(
+      canDropRow(ifHeader, codeTarget),
+      false,
+      "dragging a whole block onto a code row is refused too",
+    );
+    // …and the refusal propagates through resolveDrop, which is what actually feeds `move_row`.
+    assert.strictEqual(resolveDrop(leafB, codeTarget, 0.1, [...ROWS, codeTarget]), null);
+    assert.strictEqual(resolveDrop(leafB, codeTarget, 0.9, [...ROWS, codeTarget]), null);
+    // A code row remains a legal drag SOURCE at this pure layer (the webview cancels the gesture at
+    // dragstart, which has no model counterpart) — so the rule is about the TARGET only.
+    const codeSource = ctx({ lineStart: 3, lineEnd: 3, kind: "code", draggable: true });
+    assert.strictEqual(canDropRow(codeSource, leafB), true, "the rule gates the target, not the source");
+  });
+
   test("resolveDrop leaf: pointer half picks before/after; anchor = target, suite/depth = target's", () => {
     const before = resolveDrop(leafB, bodyA, 0.2, ROWS);
     assert.deepStrictEqual(before, {
diff --git a/ide/src/test/suite/steps-mirror.test.ts b/ide/src/test/suite/steps-mirror.test.ts
new file mode 100644
index 00000000..d726f8d8
--- /dev/null
+++ b/ide/src/test/suite/steps-mirror.test.ts
@@ -0,0 +1,1494 @@
+import * as assert from "assert";
+import * as fs from "fs";
+import * as path from "path";
+
+import {
+  addMenuGroups,
+  blockExtent,
+  blockLabel,
+  buildDropSlots,
+  buildHandlerViewModels,
+  canDropRow,
+  captureBlock,
+  contextMenuEnablement,
+  insertionBarAnchor,
+  isReturnRow,
+  renderHandlersHtml,
+  renderStepsContextMenuHtml,
+  resolveDrop,
+  scopeLabel,
+  walkMove,
+  type BlockCaptureRow,
+  type DropResolution,
+  type LensHandler,
+  type LensParseResult,
+  type LensRow,
+  type RowDropContext,
+  type RowKind,
+  type RowViewModel,
+} from "../../stepsModel";
+
+// ---------------------------------------------------------------------------------------------------
+// BACKLOG #233 — the webview↔model MIRROR-PARITY differential suite (master test plan
+// docs/testing/master-test-plan/13-steps-editor.md §S2, STEPS-06..12).
+//
+// `ide/media/stepsWebview.js` is loaded as a plain script into a `default-src 'none'` webview (the
+// `<script nonce src>` tag `pageHtml` emits in `stepsView.ts`, from an `asWebviewUri` of `media/`), so
+// it CANNOT import `ide/src/stepsModel.ts`. It therefore re-implements ten pure
+// model functions by hand. The drag/drop PREVIEW the user sees comes from the webview copy while the
+// COMMITTED splice coordinates come from the model copy — a divergence would land a statement somewhere
+// other than where the indicator said, byte-stably, re-parsing clean, with every existing test green.
+//
+// This suite closes that hole WITHOUT de-duplicating the code (owner ruling: option (c)): it loads the
+// real webview script under jsdom, reaches its mirrors through an opt-in test hook, and asserts they
+// agree with `stepsModel`'s versions over TWO populations — four hand-authored adversarial cases that
+// go through the real render → DOM → read-back boundary, and 2,000 seeded generated row sets for the
+// mirrors that are pure array functions. See the note above `generateRowSet` for why the split exists.
+//
+// ADAPTER DISCIPLINE — the one thing that could make this suite vacuous is a generous adapter that
+// reshapes one side until parity is trivially true. So:
+//   * the WEBVIEW side is always sourced from the RENDERED DOM (renderRowHtml → dataset → stepsCtxRows),
+//     never from the fixtures directly;
+//   * the MODEL side is always sourced from the VIEW MODELS (buildHandlerViewModels), never from the DOM;
+//   * every adapter below is a one-line field read and is commented as such.
+// The comparison therefore spans the real serialization boundary, which is where `suite`,
+// `isControlHeader`, `draggable` and `data-is-return` are actually decided. T1's falsification (deleting
+// the `data-suite` emission from renderRowHtml) is the specific check that the adapter did not paper
+// over that boundary.
+//
+// Node-side only: this file must NOT import `vscode`, so it runs on EVERY `ide` CI leg (the ubuntu one
+// included), not only the Windows-only Extension Host leg.
+// ---------------------------------------------------------------------------------------------------
+
+// jsdom is loaded through a CommonJS `require` behind a narrow local shape ON PURPOSE: `ide/tsconfig.json`
+// sets `lib: ["ES2022"]` with NO "DOM" (a deliberate guardrail for an extension that must not reach for
+// browser globals), and `npm run typecheck` covers `src/test` too. Pulling in `@types/jsdom` — or typing
+// any local as a DOM interface — would reference `lib.dom` and break the type-check for the whole
+// extension. DOM values therefore stay loosely typed inside this file only.
+interface JsdomWindow {
+  document: DomNode;
+  MouseEvent: new (type: string, init?: Record<string, unknown>) => unknown;
+  Event: new (type: string, init?: Record<string, unknown>) => unknown;
+  [key: string]: unknown;
+}
+interface DomNode {
+  // Deliberately `any`: the base tsconfig has no DOM lib (see the note above), so DOM values are
+  // untyped here rather than dragging lib.dom into the extension's own type-check.
+  [key: string]: any;
+}
+interface JsdomVirtualConsole {
+  on(event: string, handler: (err: unknown) => void): void;
+}
+interface JsdomModule {
+  JSDOM: new (html: string, options?: Record<string, unknown>) => { window: JsdomWindow };
+  VirtualConsole: new () => JsdomVirtualConsole;
+}
+const { JSDOM, VirtualConsole } = require("jsdom") as JsdomModule;
+
+const IDE_ROOT = path.join(__dirname, "..", "..", "..");
+const WEBVIEW_JS = path.join(IDE_ROOT, "media", "stepsWebview.js");
+const STEPS_VIEW_TS = path.join(IDE_ROOT, "src", "stepsView.ts");
+
+/** Row height (px) used by the per-row `getBoundingClientRect` stub — see {@link stubRowRects}. */
+const ROW_H = 20;
+
+// ---- the corpus ------------------------------------------------------------------------------------
+
+/** One generated corpus case: a `lens parse` payload plus the module source its rows index into. */
+interface CorpusCase {
+  name: string;
+  parse: LensParseResult;
+  source: string;
+}
+
+/**
+ * A module source of `lineCount` lines, each distinctive AND carrying `&`, `<`, `>`, `"` and `'` — so a
+ * row's `expectSrc` round-trip through `escapeHtml` → `data-expect-src` → `dataset.expectSrc` is
+ * exercised by every single row of every case rather than by one bespoke test.
+ */
+function sourceOf(lineCount: number): string {
+  return Array.from(
+    { length: lineCount },
+    (_v, i) => `    stmt_${i + 1}(a & b, "<x>", '\\''); # line ${i + 1}`,
+  ).join("\n");
+}
+
+function handlerOf(name: string, defLine: number, rows: LensRow[]): LensHandler {
+  return { handler: name, module: "corpus", def_line: defLine, rows };
+}
+
+/** Nesting 0–4, an if/elif/else chain, nested `for` headers, an EMPTY-bodied `if`, a `raise`, code rows,
+ * the accumulator scaffold pair and a mid-body append send. The structural workhorse of the suite. */
+function caseDeepNesting(): CorpusCase {
+  const rows: LensRow[] = [
+    { kind: "code", line_start: 2, line_end: 2, nesting: 0, suite: "1", scaffold: "collector_init" },
+    {
+      kind: "action",
+      action: "set_field",
+      line_start: 3,
+      line_end: 3,
+      nesting: 0,
+      suite: "1",
+      params: { path: "PID-3", value: "X" },
+      literal_params: ["path", "value"],
+    },
+    {
+      kind: "control",
+      control: "for",
+      line_start: 4,
+      line_end: 4,
+      nesting: 0,
+      suite: "1",
+      label: 'For each & <OBX> "segment"',
+      test_src: "seg in msg.groups()",
+      recognized: true,
+    },
+    { kind: "action", action: "copy_field", line_start: 5, line_end: 5, nesting: 1, suite: "4", params: { src: "A", dst: "B" }, literal_params: ["src", "dst"] },
+    { kind: "control", control: "if", line_start: 6, line_end: 6, nesting: 1, suite: "4", test_src: 'msg["PID-3"] == "X"', recognized: true },
+    { kind: "lookup", call: "code_lookup", assign_to: "v", line_start: 7, line_end: 7, nesting: 2, suite: "6", params: { path: "PID-8" }, literal_params: ["path"] },
+    { kind: "control", control: "for", line_start: 8, line_end: 8, nesting: 2, suite: "6", test_src: "obx in segs", recognized: false },
+    { kind: "diagnostic", call: "log_note", line_start: 9, line_end: 9, nesting: 3, suite: "8", params: { template: "note" }, literal_params: ["template"] },
+    { kind: "control", control: "if", line_start: 10, line_end: 10, nesting: 3, suite: "8", test_src: "v", recognized: true },
+    { kind: "action", action: "append_to_field", line_start: 11, line_end: 11, nesting: 4, suite: "10", params: { path: "OBX-5", value: "!" }, literal_params: ["path", "value"] },
+    { kind: "control", control: "elif", line_start: 12, line_end: 12, nesting: 1, suite: "4", test_src: "other", recognized: true },
+    { kind: "code", line_start: 13, line_end: 13, nesting: 2, suite: "12" },
+    { kind: "control", control: "else", line_start: 14, line_end: 14, nesting: 1, suite: "4", test_src: null, recognized: true },
+    { kind: "action", action: "convert_case", line_start: 15, line_end: 15, nesting: 2, suite: "14", params: { path: "PID-5", mode: "upper" }, literal_params: ["path", "mode"] },
+    { kind: "send", line_start: 16, line_end: 16, nesting: 1, suite: "4", appended: true, outbounds: ["OB_A"] },
+    { kind: "code", line_start: 17, line_end: 17, nesting: 0, suite: "1" },
+    // An `if` whose body has NO row in this list — the "into the body" gesture has nothing to anchor to.
+    { kind: "control", control: "if", line_start: 18, line_end: 18, nesting: 0, suite: "1", test_src: "flag", recognized: true },
+    { kind: "control", control: "raise", line_start: 19, line_end: 19, nesting: 0, suite: "1", test_src: null, recognized: true },
+    { kind: "send", line_start: 20, line_end: 20, nesting: 0, suite: "1", appended: true, outbounds: ["OB_B"] },
+    { kind: "code", line_start: 21, line_end: 21, nesting: 0, suite: "1", scaffold: "return_collector" },
+  ];
+  return {
+    name: "deep-nesting",
+    parse: { module: "corpus", handlers: [handlerOf("deep", 1, rows)] },
+    source: sourceOf(21),
+  };
+}
+
+/** The ADR 0104/0108 fan-out shapes: a `return []` FILTER inside a guard, the accumulator init, two
+ * appended sends and the `return sends` footer. */
+function caseFanout(): CorpusCase {
+  const rows: LensRow[] = [
+    { kind: "action", action: "set_field", line_start: 2, line_end: 2, nesting: 0, suite: "1", params: { path: "MSH-3", value: "MF" }, literal_params: ["path", "value"] },
+    { kind: "control", control: "if", line_start: 3, line_end: 3, nesting: 0, suite: "1", test_src: 'msg["MSH-9.1"] != "ADT"', recognized: true },
+    { kind: "send", line_start: 4, line_end: 4, nesting: 1, suite: "3", filtered: true, outbounds: [] },
+    { kind: "code", line_start: 5, line_end: 5, nesting: 0, suite: "1", scaffold: "collector_init" },
+    { kind: "send", line_start: 6, line_end: 6, nesting: 0, suite: "1", appended: true, outbounds: ["OB_X"] },
+    { kind: "send", line_start: 7, line_end: 7, nesting: 0, suite: "1", appended: true, outbounds: ["OB_Y"] },
+    { kind: "code", line_start: 8, line_end: 8, nesting: 0, suite: "1", scaffold: "return_collector" },
+  ];
+  return {
+    name: "fanout-and-filter",
+    parse: { module: "corpus", handlers: [handlerOf("fanout", 1, rows)] },
+    source: sourceOf(8),
+  };
+}
+
+/** A flat handler whose def is NOT on line 1, containing a MULTI-LINE row (a call split over two lines)
+ * and a terminal returned send. */
+function caseFlat(): CorpusCase {
+  const rows: LensRow[] = [
+    { kind: "action", action: "delete_segment", line_start: 3, line_end: 3, nesting: 0, suite: "2", params: { segment_id: "ZZZ" }, literal_params: ["segment_id"] },
+    { kind: "lookup", call: "db_lookup", assign_to: "row", line_start: 4, line_end: 5, nesting: 0, suite: "2", params: { statement: "SELECT 1" }, literal_params: ["statement"] },
+    { kind: "diagnostic", call: "checkpoint", line_start: 6, line_end: 6, nesting: 0, suite: "2", params: { label: "after-lookup" }, literal_params: ["label"] },
+    { kind: "code", line_start: 7, line_end: 7, nesting: 0, suite: "2" },
+    { kind: "send", line_start: 8, line_end: 8, nesting: 0, suite: "2", outbounds: ["OB_Z"] },
+  ];
+  return {
+    name: "flat-multiline",
+    parse: { module: "corpus", handlers: [handlerOf("flat", 2, rows)] },
+    source: sourceOf(8),
+  };
+}
+
+/** Control headers whose titles carry `&`, `<`, `>`, `"` and `'` — the HTML-escaping boundary the
+ * webview's `scopeLabel` crosses (it reads `.textContent` off escaped markup; the model takes the raw
+ * title). */
+function caseEscaping(): CorpusCase {
+  const rows: LensRow[] = [
+    {
+      kind: "control",
+      control: "for",
+      line_start: 2,
+      line_end: 2,
+      nesting: 0,
+      suite: "1",
+      label: `For each & <OBX>-5 "rep" 'x' > 1`,
+      test_src: "obx in segs",
+      recognized: true,
+    },
+    { kind: "action", action: "set_field", line_start: 3, line_end: 3, nesting: 1, suite: "2", params: { path: "OBX-5", value: "1" }, literal_params: ["path", "value"] },
+    {
+      kind: "control",
+      control: "if",
+      line_start: 4,
+      line_end: 4,
+      nesting: 1,
+      suite: "2",
+      label: `If <PID>-3 & "MRN" isn't blank`,
+      test_src: 'msg["PID-3"]',
+      recognized: true,
+    },
+    { kind: "action", action: "format_date", line_start: 5, line_end: 5, nesting: 2, suite: "4", params: { path: "PID-7", format: "%Y" }, literal_params: ["path", "format"] },
+    { kind: "action", action: "split_field", line_start: 6, line_end: 6, nesting: 0, suite: "1", params: { path: "PID-5" }, literal_params: ["path"] },
+  ];
+  return {
+    name: "escaping",
+    parse: { module: "corpus", handlers: [handlerOf("escapes", 1, rows)] },
+    source: sourceOf(6),
+  };
+}
+
+/** TWO handlers in one document — the only shape that can exercise `canDrop`'s cross-handler refusal
+ * (the DOM carries `data-handler`; a single-handler page can never disagree about it). */
+function caseTwoHandlers(): CorpusCase {
+  const a: LensRow[] = [
+    { kind: "action", action: "set_field", line_start: 2, line_end: 2, nesting: 0, suite: "1", params: { path: "PID-3", value: "A" }, literal_params: ["path", "value"] },
+    { kind: "action", action: "copy_field", line_start: 3, line_end: 3, nesting: 0, suite: "1", params: { src: "A", dst: "B" }, literal_params: ["src", "dst"] },
+  ];
+  const b: LensRow[] = [
+    { kind: "action", action: "set_field", line_start: 6, line_end: 6, nesting: 0, suite: "5", params: { path: "PID-4", value: "B" }, literal_params: ["path", "value"] },
+    { kind: "send", line_start: 7, line_end: 7, nesting: 0, suite: "5", outbounds: ["OB_Q"] },
+  ];
+  return {
+    name: "two-handlers",
+    parse: { module: "corpus", handlers: [handlerOf("first", 1, a), handlerOf("second", 5, b)] },
+    source: sourceOf(7),
+  };
+}
+
+const CORPUS: CorpusCase[] = [caseDeepNesting(), caseFanout(), caseFlat(), caseEscaping()];
+
+// ---- the seeded ROW-SET GENERATOR (master test plan §S2 step 1, STEPS-07/08) -----------------------
+//
+// The four cases above are hand-authored and adversarial, but finite: they only cover shapes somebody
+// thought of. The generator covers the ones nobody did. It drives ONLY those mirrors that take a plain
+// ROW ARRAY (`blockExtent`, `captureBlock` + `clipLabel`, `buildDropSlots`, `walkMove`) — which is what
+// makes ≥2,000 sets affordable: those five are pure array-in/value-out on both sides, so the whole
+// sweep runs against ONE loaded page instead of one jsdom document per set.
+//
+// The DOM-bound four (`canDrop`, `resolveDrop`, `barAnchor`, and `scopeLabel`, which reads
+// `.textContent` off the rendered header) take `<li>` ELEMENTS and a `getBoundingClientRect`, so they
+// cannot be driven this way at all. They stay on the rendered corpus, where each case is a real
+// render → DOM → read-back round trip (T1/T2/T5) — a smaller population, but the only one that can
+// exercise them. Neither half subsumes the other, and §12.2 of the test plan says so.
+//
+// `raise` headers are deliberately NOT generated: `RowDropContext.control` omits `"raise"` because no
+// drop helper tests for anything but `elif`/`else`, and the hand-authored corpus already carries one.
+
+/** How many row sets the sweep generates (the test plan's ≥2,000). */
+const GENERATED_SETS = 2000;
+/** The reproduction handle. Set `i`'s seed is `GENERATOR_SEED + i`, printed on any failure. */
+const GENERATOR_SEED = 0x5713_2026;
+/** Row budget per generated set — enough for nesting 0–4 with continuations, small enough to stay fast. */
+const MAX_GENERATED_ROWS = 16;
+
+/** mulberry32 — a tiny, well-known deterministic PRNG. Same seed ⇒ byte-identical row set, on every
+ * platform and every Node version, which is what makes a failure reproducible from the printed seed. */
+function mulberry32(seed: number): () => number {
+  let a = seed >>> 0;
+  return (): number => {
+    a = (a + 0x6d2b79f5) >>> 0;
+    let t = a;
+    t = Math.imul(t ^ (t >>> 15), t | 1);
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+/** One generated row set, in BOTH sides' shapes — built from the SAME draw, so any divergence the sweep
+ * reports is the two IMPLEMENTATIONS disagreeing, never the two inputs differing. */
+interface GeneratedRowSet {
+  seed: number;
+  web: CtxRow[];
+  model: BlockCaptureRow[];
+}
+
+function generateRowSet(seed: number): GeneratedRowSet {
+  const rnd = mulberry32(seed);
+  const web: CtxRow[] = [];
+  const model: BlockCaptureRow[] = [];
+  let line = 2;
+
+  interface Draw {
+    kind: RowKind;
+    nesting: number;
+    suite: string;
+    control?: RowDropContext["control"];
+    appended?: boolean;
+    scaffold?: string;
+    draggable: boolean;
+    isControlHeader: boolean;
+    multiLine?: boolean;
+  }
+
+  /** Append one row to both sides. `isReturn` is derived with the SHIPPED {@link isReturnRow}, so the
+   * DOM flag the webview reads and the `appended`/`scaffold` pair the model reads can never disagree
+   * about it by construction — the same derivation `buildRowViewModel` performs. */
+  const push = (d: Draw): number => {
+    const lineStart = line;
+    const lineEnd = line + (d.multiLine ? 1 : 0);
+    line = lineEnd + 1;
+    const expectSrc = `${"    ".repeat(d.nesting + 1)}stmt_${lineStart}(a & b, "<x>", 'y')`;
+    const isReturn = isReturnRow({ kind: d.kind, appended: d.appended, scaffold: d.scaffold });
+    web.push({
+      lineStart,
+      lineEnd,
+      nesting: d.nesting,
+      suite: d.suite,
+      kind: d.kind,
+      control: d.control,
+      expectSrc,
+      draggable: d.draggable,
+      isControlHeader: d.isControlHeader,
+      isReturn,
+    });
+    model.push({
+      handler: "gen",
+      lineStart,
+      lineEnd,
+      nesting: d.nesting,
+      suite: d.suite,
+      kind: d.kind,
+      draggable: d.draggable,
+      appended: d.appended,
+      scaffold: d.scaffold,
+      isControlHeader: d.isControlHeader,
+      control: d.control,
+      expectSrc,
+    });
+    return lineStart;
+  };
+
+  const leaf = (nesting: number, suite: string): void => {
+    const roll = rnd();
+    if (roll < 0.18) {
+      // A `code` row: read-only, yet marked draggable so the webview can INTERCEPT the gesture — the
+      // exact combination the one real divergence hid in. Sometimes a scaffold row.
+      const s = rnd();
+      push({
+        kind: "code",
+        nesting,
+        suite,
+        scaffold: s < 0.2 ? "collector_init" : s < 0.4 ? "return_collector" : undefined,
+        draggable: true,
+        isControlHeader: false,
+      });
+      return;
+    }
+    if (roll < 0.4) {
+      // A send: `appended` (a mid-body step, a normal two-zone target) vs a terminal return.
+      push({
+        kind: "send",
+        nesting,
+        suite,
+        appended: rnd() < 0.5 ? true : undefined,
+        draggable: true,
+        isControlHeader: false,
+      });
+      return;
+    }
+    push({
+      kind: rnd() < 0.5 ? "action" : rnd() < 0.5 ? "lookup" : "diagnostic",
+      nesting,
+      suite,
+      // Adversarial: a non-draggable editable leaf does not occur in today's projection, but both
+      // mirrors must still agree about it, and pinning that keeps the gate honest if the rule moves.
+      draggable: rnd() < 0.9,
+      isControlHeader: false,
+      multiLine: rnd() < 0.15,
+    });
+  };
+
+  const emitSuite = (suite: string, nesting: number, count: number): void => {
+    for (let i = 0; i < count && web.length < MAX_GENERATED_ROWS; i++) {
+      if (nesting < 4 && rnd() < 0.4) {
+        const kw = rnd() < 0.5 ? "if" : "for";
+        const header = push({
+          kind: "control",
+          nesting,
+          suite,
+          control: kw,
+          draggable: true,
+          isControlHeader: true,
+        });
+        // 0 body rows is a real shape (an `if` whose only statement is unrecognized and filtered out of
+        // this list) and is the one that has no "into the body" anchor.
+        emitSuite(String(header), nesting + 1, Math.floor(rnd() * 3));
+        if (kw === "if") {
+          const conts = Math.floor(rnd() * 3);
+          for (let k = 0; k < conts && web.length < MAX_GENERATED_ROWS; k++) {
+            // A CONTINUATION sits at the header's nesting, in the header's OWN suite, and is neither
+            // draggable nor a control header — it is consumed with its `if`.
+            const cont = push({
+              kind: "control",
+              nesting,
+              suite,
+              control: k === conts - 1 && rnd() < 0.5 ? "else" : "elif",
+              draggable: false,
+              isControlHeader: false,
+            });
+            emitSuite(String(cont), nesting + 1, Math.floor(rnd() * 3));
+          }
+        }
+      } else {
+        leaf(nesting, suite);
+      }
+    }
+  };
+
+  // The root suite is the handler's `def` line, exactly as `lens parse` numbers it. At least one row.
+  emitSuite("1", 0, 1 + Math.floor(rnd() * 5));
+  if (web.length === 0) {
+    leaf(0, "1");
+  }
+  return { seed, web, model };
+}
+
+// ---- the jsdom harness -----------------------------------------------------------------------------
+
+/** What one loaded page gives the assertions. */
+interface Harness {
+  window: JsdomWindow;
+  /** The webview's own mirrors, handed out by the opt-in `__mfStepsTestExports` hook. */
+  hook: Record<string, (...args: any[]) => any>;
+  /** Every `postMessage` the script made, in order (the recording `acquireVsCodeApi` double). */
+  posted: Record<string, unknown>[];
+  /** Uncaught script errors jsdom reported while the page ran (empty on a healthy load). */
+  scriptErrors: unknown[];
+  /** How many times the script called `acquireVsCodeApi()`. */
+  acquireCount: number;
+  /** The `<li class="row">` elements, in document order. */
+  rowEls: DomNode[];
+}
+
+/** The CSP/nonce page shell reduced to exactly the elements `stepsWebview.js` reads. The five ids below
+ * are read UNGUARDED (`document.getElementById('x').addEventListener(...)` at :151-153, and the
+ * `addAction`/`insertAction` consts at :263-264 that `updateAddState` dereferences), so omitting any one
+ * of them makes the script throw at load — which is exactly what T9's inventory guard pins. */
+function pageShell(bodyHtml: string): string {
+  const insertOptions = [`<option value="">[select item]</option>`]
+    .concat(
+      addMenuGroups().map(
+        ({ group, items }) =>
+          `<optgroup label="${group}">` +
+          items
+            .map(
+              (item) =>
+                `<option value="${item.id}"` +
+                (item.anchorConstraint ? ` data-anchor="${item.anchorConstraint}"` : "") +
+                `>${item.label}</option>`,
+            )
+            .join("") +
+          `</optgroup>`,
+      ),
+    )
+    .join("");
+  return (
+    `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>steps</title></head><body>` +
+    `<div class="bar">` +
+    `<input id="stepsFilter" type="search" />` +
+    `<select id="insertAction">${insertOptions}</select>` +
+    `<button id="addAction" disabled>Add</button>` +
+    `<button id="pickSample">Pick Sample</button>` +
+    `<button id="test">Test</button>` +
+    `<button id="openText">View as Code</button>` +
+    `</div>` +
+    bodyHtml +
+    renderStepsContextMenuHtml() +
+    `</body></html>`
+  );
+}
+
+/**
+ * jsdom has no layout engine, so EVERY `getBoundingClientRect()` returns an all-zero rect. The webview's
+ * `resolveDrop` computes `frac = (ev.clientY - box.top) / box.height` and falls back to a CONSTANT 0.5
+ * when `box.height <= 0` — which would silently collapse every tri-zone assertion in this file into the
+ * same middle-zone case and make them vacuous. Give each row a deterministic 20 px band so a pointer
+ * fraction actually means something. (T5's second falsification removes this and proves the assertions
+ * stop discriminating without it.)
+ */
+function stubRowRects(rowEls: DomNode[]): void {
+  rowEls.forEach((el, i) => {
+    const top = i * ROW_H;
+    el.getBoundingClientRect = (): Record<string, number> => ({
+      top,
+      bottom: top + ROW_H,
+      left: 0,
+      right: 400,
+      width: 400,
+      height: ROW_H,
+      x: 0,
+      y: top,
+    });
+  });
+}
+
+/** The clientY that lands `fraction` of the way down row `index`, given {@link stubRowRects}. */
+function clientYFor(index: number, fraction: number): number {
+  return index * ROW_H + fraction * ROW_H;
+}
+
+interface LoadOptions {
+  /** Set `window.__mfStepsTestExportsEnabled` before the script runs (default true). */
+  exposeHook?: boolean;
+  /** Skip the per-row rect stub (T5's harness falsification only). */
+  skipRectStub?: boolean;
+  /** Require the hook to be present afterwards (default: mirrors `exposeHook`). */
+  requireHook?: boolean;
+}
+
+/** Load the REAL `media/stepsWebview.js` into a jsdom page built from `bodyHtml`. */
+function loadWebview(bodyHtml: string, opts: LoadOptions = {}): Harness {
+  const exposeHook = opts.exposeHook !== false;
+  const scriptErrors: unknown[] = [];
+  const virtualConsole = new VirtualConsole();
+  virtualConsole.on("jsdomError", (e: unknown) => scriptErrors.push(e));
+
+  const dom = new JSDOM(pageShell(bodyHtml), {
+    runScripts: "dangerously",
+    virtualConsole,
+    url: "https://localhost/",
+  });
+  const window = dom.window;
+  const posted: Record<string, unknown>[] = [];
+  let acquireCount = 0;
+  let webviewState: unknown = undefined;
+  // The recording double: captures EVERY postMessage so a test can assert what the page told the
+  // provider (the ping handshake, `codeLocked`, a moveTo, …). `getState`/`setState` are the webview's
+  // own clipboard/selection store (stepsWebview.js:297-303) — an in-memory object is faithful enough.
+  window.acquireVsCodeApi = (): Record<string, unknown> => {
+    acquireCount += 1;
+    return {
+      postMessage: (m: Record<string, unknown>): void => {
+        posted.push(m);
+      },
+      getState: (): unknown => webviewState,
+      setState: (v: unknown): void => {
+        webviewState = v;
+      },
+    };
+  };
+  if (exposeHook) {
+    window.__mfStepsTestExportsEnabled = true;
+  }
+
+  const rowEls: DomNode[] = Array.from(
+    window.document.querySelectorAll("li.row"),
+  ) as DomNode[];
+  if (!opts.skipRectStub) {
+    stubRowRects(rowEls);
+  }
+
+  const script = window.document.createElement("script");
+  script.textContent = fs.readFileSync(WEBVIEW_JS, "utf8");
+  window.document.body.appendChild(script);
+
+  const hook = window.__mfStepsTestExports as
+    | Record<string, (...args: any[]) => any>
+    | undefined;
+  const requireHook = opts.requireHook ?? exposeHook;
+  if (requireHook && !hook) {
+    assert.fail(
+      `stepsWebview.js did not publish __mfStepsTestExports — the script most likely threw at load. ` +
+        `jsdom errors: ${scriptErrors.map((e) => String(e)).join(" | ") || "(none)"}; ` +
+        `posted: ${JSON.stringify(posted)}`,
+    );
+  }
+  return {
+    window,
+    hook: hook ?? {},
+    posted,
+    scriptErrors,
+    acquireCount,
+    rowEls,
+  };
+}
+
+// ---- the two sides, and the one-line adapters between them -----------------------------------------
+
+/**
+ * Rebuild a plain value that came out of the jsdom realm using THIS realm's Object/Array prototypes.
+ *
+ * `assert.deepStrictEqual` compares prototypes, and every object the webview script creates is built
+ * inside jsdom's realm — so a byte-for-byte identical row object fails with an EMPTY diff ("actual" and
+ * "expected" print the same). This is a cross-realm artifact of loading the script under jsdom, NOT a
+ * divergence, so it is normalised away here rather than by weakening the comparison to `deepEqual`.
+ * `undefined`-valued keys are preserved (they are load-bearing: `deepStrictEqual` distinguishes
+ * `{control: undefined}` from `{}`), which is why this is not `JSON.parse(JSON.stringify(...))`.
+ * Only ever applied to PLAIN data — DOM elements are converted by the one-line adapters instead.
+ */
+function plain<T>(value: T): T {
+  if (Array.isArray(value)) {
+    // NOT `.map()`: Array.prototype.map builds its result through the SOURCE array's species
+    // constructor, so mapping a jsdom array yields another jsdom array and the prototype mismatch
+    // survives. Push into a literal array declared in this realm instead.
+    const out: unknown[] = [];
+    for (const item of value as unknown[]) {
+      out.push(plain(item));
+    }
+    return out as unknown as T;
+  }
+  if (value !== null && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const key of Object.keys(value as Record<string, unknown>)) {
+      out[key] = plain((value as Record<string, unknown>)[key]);
+    }
+    return out as unknown as T;
+  }
+  return value;
+}
+
+/** The row shape `stepsCtxRows()` yields — i.e. a row AFTER the renderRowHtml → dataset → read-back
+ * round trip. The model side is built into the SAME shape from the view models, never from the DOM. */
+interface CtxRow {
+  lineStart: number;
+  lineEnd: number;
+  nesting: number;
+  suite: string;
+  kind: string;
+  control: string | undefined;
+  expectSrc: string;
+  draggable: boolean;
+  isControlHeader: boolean;
+  isReturn: boolean;
+}
+
+/** The MODEL side of a row context, derived from the view model only. Every line is a direct field read:
+ *  `draggable` is the model's own rule (`isRowMovable` → `RowViewModel.movable`, plus the `code`-row
+ *  drag-interception marker documented in `renderRowHtml`); `isReturn` is recomputed with the
+ *  exported {@link isReturnRow} rather than trusting the precomputed `RowViewModel.isReturn`, so the
+ *  comparison also pins `buildRowViewModel`'s emission of it. */
+function modelCtxRows(vms: RowViewModel[]): CtxRow[] {
+  return vms.map((vm) => {
+    const draggable = vm.movable === true || vm.kind === "code";
+    return {
+      lineStart: vm.lineStart,
+      lineEnd: vm.lineEnd,
+      nesting: vm.nesting,
+      suite: vm.suite ?? "",
+      kind: vm.kind,
+      control: vm.control,
+      expectSrc: vm.expectSrc ?? "",
+      draggable,
+      isControlHeader: vm.kind === "control" && draggable,
+      isReturn: isReturnRow(vm),
+    };
+  });
+}
+
+/** The model functions' input type. `control` is narrowed because `RowDropContext.control` deliberately
+ * omits `"raise"` (a `raise` header is neither an `elif` nor an `else`, the only two values any of the
+ * drop helpers test for, so the narrowing is behaviour-preserving). */
+function modelDropRows(vms: RowViewModel[], handler: string): BlockCaptureRow[] {
+  const ctx = modelCtxRows(vms);
+  return vms.map((vm, i) => ({
+    handler,
+    lineStart: ctx[i].lineStart,
+    lineEnd: ctx[i].lineEnd,
+    nesting: ctx[i].nesting,
+    suite: ctx[i].suite,
+    kind: ctx[i].kind as RowKind,
+    draggable: ctx[i].draggable,
+    isControlHeader: ctx[i].isControlHeader,
+    control: vm.control as RowDropContext["control"],
+    appended: vm.appended,
+    scaffold: vm.scaffold,
+    expectSrc: ctx[i].expectSrc,
+  }));
+}
+
+/** The webview's `resolveDrop` returns a DOM ELEMENT as its anchor; the model returns line numbers. The
+ * single adapter line is the `dataset` read below — nothing else is reshaped. */
+function normalizeWebviewDrop(res: DomNode | null): DropResolution | null {
+  if (!res) {
+    return null;
+  }
+  return {
+    anchorLineStart: Number(res.anchorEl.dataset.lineStart),
+    anchorLineEnd: Number(res.anchorEl.dataset.lineEnd),
+    toPosition: res.position,
+    toSuite: res.toSuite,
+    landingDepth: res.landingDepth,
+  };
+}
+
+/** Same one-line-adapter rule for `barAnchor` (element → its line start). */
+function normalizeWebviewBar(a: DomNode): { anchorLineStart: number; edge: string } {
+  return { anchorLineStart: Number(a.el.dataset.lineStart), edge: a.edge };
+}
+
+/** One loaded corpus case: both sides, plus the view models the model side comes from. */
+interface Loaded {
+  name: string;
+  harness: Harness;
+  vms: RowViewModel[];
+  handlerName: string;
+  webviewRows: CtxRow[];
+  modelRows: BlockCaptureRow[];
+  /** `{lineStart, title}` for EVERY row — the webview's `scopeLabel` searches all rows, not just the
+   * control headers, so the model side is given the same population. */
+  titles: { lineStart: number; title: string }[];
+}
+
+function loadCase(c: CorpusCase, opts: LoadOptions = {}): Loaded {
+  const handlers = buildHandlerViewModels(c.parse, c.source);
+  const harness = loadWebview(renderHandlersHtml(handlers), opts);
+  const vms = handlers.flatMap((h) => h.rows);
+  return {
+    name: c.name,
+    harness,
+    vms,
+    handlerName: handlers[0].handler,
+    webviewRows: plain(harness.hook.stepsCtxRows()) as CtxRow[],
+    modelRows: modelDropRows(vms, handlers[0].handler),
+    titles: vms.map((vm) => ({ lineStart: vm.lineStart, title: vm.title })),
+  };
+}
+
+/** Rows the webview will actually START a drag from: `draggable`, and not a `code` row (a code row's
+ * `dragstart` is INTERCEPTED at stepsWebview.js:469-473 and never sets `dragSrc`). The model's
+ * `canDropRow` is a pure (drag, target) predicate with no notion of an event-layer source gate, so the
+ * pair sweep is scoped to sources the webview can actually drag; the code-row SOURCE half of the
+ * contract is asserted separately in T11. */
+function dragStartableIndexes(rows: CtxRow[]): number[] {
+  const out: number[] = [];
+  rows.forEach((r, i) => {
+    if (r.draggable && r.kind !== "code") {
+      out.push(i);
+    }
+  });
+  return out;
+}
+
+/** Set the webview's `dragSrc` by dispatching a REAL `dragstart` (no test-only mutator exists, on
+ * purpose — this drives the same listener production uses). Returns the event so a caller can inspect
+ * `defaultPrevented`. */
+function beginDrag(h: Harness, el: DomNode): DomNode {
+  const ev = new h.window.Event("dragstart", { bubbles: true, cancelable: true }) as DomNode;
+  el.dispatchEvent(ev);
+  return ev;
+}
+
+function endDrag(h: Harness, el: DomNode): void {
+  el.dispatchEvent(new h.window.Event("dragend", { bubbles: true, cancelable: true }));
+}
+
+// ---- T1: row-context parity ------------------------------------------------------------------------
+
+suite("Steps mirror — row context parity (stepsCtxRows vs the view models)", () => {
+  for (const c of CORPUS) {
+    test(`${c.name}: every row survives renderRowHtml → dataset → stepsCtxRows unchanged`, () => {
+      const L = loadCase(c);
+      assert.strictEqual(
+        L.webviewRows.length,
+        L.modelRows.length,
+        `${c.name}: the DOM and the view models disagree on the ROW COUNT`,
+      );
+      const expected = modelCtxRows(L.vms);
+      for (let i = 0; i < expected.length; i++) {
+        assert.deepStrictEqual(
+          L.webviewRows[i],
+          expected[i],
+          `${c.name}: row ${i} (line ${expected[i].lineStart}) diverges between the rendered DOM and the model`,
+        );
+      }
+    });
+  }
+});
+
+// ---- T2: canDrop / canDropRow parity, including the code-row target --------------------------------
+
+suite("Steps mirror — canDrop parity (webview canDrop vs model canDropRow)", () => {
+  for (const c of CORPUS) {
+    test(`${c.name}: every ordered (drag, target) pair agrees`, () => {
+      const L = loadCase(c);
+      for (const di of dragStartableIndexes(L.webviewRows)) {
+        beginDrag(L.harness, L.harness.rowEls[di]);
+        for (let ti = 0; ti < L.webviewRows.length; ti++) {
+          const web = L.harness.hook.canDrop(L.harness.rowEls[ti]) as boolean;
+          const mdl = canDropRow(L.modelRows[di], L.modelRows[ti]);
+          assert.strictEqual(
+            web,
+            mdl,
+            `${c.name}: canDrop disagreed — drag line ${L.webviewRows[di].lineStart} ` +
+              `(${L.webviewRows[di].kind}) onto line ${L.webviewRows[ti].lineStart} ` +
+              `(${L.webviewRows[ti].kind}): webview=${web} model=${mdl}`,
+          );
+        }
+        endDrag(L.harness, L.harness.rowEls[di]);
+      }
+    });
+
+    test(`${c.name}: a CODE row is never a drop target on either side`, () => {
+      const L = loadCase(c);
+      const codeTargets = L.webviewRows
+        .map((r, i) => (r.kind === "code" ? i : -1))
+        .filter((i) => i >= 0);
+      if (codeTargets.length === 0) {
+        return; // this case carries no code rows
+      }
+      for (const di of dragStartableIndexes(L.webviewRows)) {
+        beginDrag(L.harness, L.harness.rowEls[di]);
+        for (const ti of codeTargets) {
+          assert.strictEqual(
+            L.harness.hook.canDrop(L.harness.rowEls[ti]),
+            false,
+            `${c.name}: the webview must refuse a code-row drop target (line ${L.webviewRows[ti].lineStart})`,
+          );
+          assert.strictEqual(
+            canDropRow(L.modelRows[di], L.modelRows[ti]),
+            false,
+            `${c.name}: the MODEL must also refuse a code-row drop target (line ` +
+              `${L.webviewRows[ti].lineStart}) — its own contract in renderRowHtml says it ` +
+              `"never treats a code row as a drop target"`,
+          );
+        }
+        endDrag(L.harness, L.harness.rowEls[di]);
+      }
+    });
+  }
+
+  test("two handlers: a cross-handler drop is refused on both sides", () => {
+    const c = caseTwoHandlers();
+    const handlers = buildHandlerViewModels(c.parse, c.source);
+    const harness = loadWebview(renderHandlersHtml(handlers), {});
+    const web = harness.hook.stepsCtxRows() as CtxRow[];
+    // Model contexts carry the handler each row actually belongs to (the DOM carries it as data-handler).
+    const model: BlockCaptureRow[] = handlers.flatMap((h) => modelDropRows(h.rows, h.handler));
+    assert.strictEqual(web.length, model.length);
+    const firstIdx = 0; // handler "first"
+    const secondIdx = handlers[0].rows.length; // first row of handler "second"
+    beginDrag(harness, harness.rowEls[firstIdx]);
+    assert.strictEqual(
+      harness.hook.canDrop(harness.rowEls[secondIdx]),
+      false,
+      "the webview refuses a drop into a DIFFERENT handler",
+    );
+    assert.strictEqual(
+      canDropRow(model[firstIdx], model[secondIdx]),
+      false,
+      "the model refuses a drop into a DIFFERENT handler",
+    );
+    endDrag(harness, harness.rowEls[firstIdx]);
+  });
+});
+
+// ---- T3: blockExtent / captureBlock / clipLabel-vs-blockLabel ---------------------------------------
+
+suite("Steps mirror — blockExtent / captureBlock / clipLabel parity", () => {
+  for (const c of CORPUS) {
+    test(`${c.name}: blockExtent agrees for every row (and for an absent line)`, () => {
+      const L = loadCase(c);
+      for (const r of L.webviewRows) {
+        assert.deepStrictEqual(
+          plain(L.harness.hook.blockExtent(L.webviewRows, r.lineStart)),
+          blockExtent(L.modelRows, r.lineStart),
+          `${c.name}: blockExtent diverged at block-start line ${r.lineStart} (${r.kind})`,
+        );
+      }
+      assert.deepStrictEqual(
+        plain(L.harness.hook.blockExtent(L.webviewRows, 9999)),
+        blockExtent(L.modelRows, 9999),
+        `${c.name}: blockExtent diverged for a line that is not a row`,
+      );
+    });
+
+    test(`${c.name}: captureBlock + clipLabel/blockLabel agree for every row`, () => {
+      const L = loadCase(c);
+      for (const r of L.webviewRows) {
+        const web = L.harness.hook.captureBlock(L.webviewRows, r.lineStart) as DomNode | null;
+        const mdl = captureBlock(L.modelRows, r.lineStart);
+        // The webview's capture carries ONE extra key, `control`, because its `clipLabel` mirror takes
+        // the whole capture object while the model's `blockLabel` takes the keyword as a separate
+        // argument (a deliberate signature difference, not drift). Compare the six shared keys, then
+        // assert the extra key separately rather than silently dropping it.
+        const webShared =
+          web === null
+            ? null
+            : {
+                source: web.source,
+                nesting: web.nesting,
+                kind: web.kind,
+                lineStart: web.lineStart,
+                lineEnd: web.lineEnd,
+                lineCount: web.lineCount,
+              };
+        assert.deepStrictEqual(
+          webShared,
+          mdl,
+          `${c.name}: captureBlock diverged at line ${r.lineStart} (${r.kind})`,
+        );
+        if (mdl && web) {
+          const control = L.modelRows.find((m) => m.lineStart === r.lineStart)?.control;
+          assert.strictEqual(
+            web.control,
+            control,
+            `${c.name}: the capture's control keyword diverged at line ${r.lineStart}`,
+          );
+          assert.strictEqual(
+            L.harness.hook.clipLabel(web),
+            blockLabel(mdl.kind, mdl.lineCount, control),
+            `${c.name}: the clipboard label diverged at line ${r.lineStart}`,
+          );
+        }
+      }
+    });
+  }
+});
+
+// ---- T4: buildDropSlots / walkMove ------------------------------------------------------------------
+
+suite("Steps mirror — buildDropSlots / walkMove parity", () => {
+  for (const c of CORPUS) {
+    test(`${c.name}: buildDropSlots enumerates the same slots, in the same order`, () => {
+      const L = loadCase(c);
+      assert.deepStrictEqual(
+        plain(L.harness.hook.buildDropSlots(L.webviewRows)),
+        buildDropSlots(L.modelRows),
+        `${c.name}: the insertion-slot enumeration diverged`,
+      );
+      // …and again with each block removed, which is the shape walkMove actually feeds it.
+      for (const r of L.webviewRows) {
+        const ext = blockExtent(L.modelRows, r.lineStart);
+        if (!ext) {
+          continue;
+        }
+        const keep = (_v: unknown, i: number): boolean => i < ext.startIndex || i > ext.endIndex;
+        assert.deepStrictEqual(
+          plain(L.harness.hook.buildDropSlots(L.webviewRows.filter(keep))),
+          buildDropSlots(L.modelRows.filter(keep)),
+          `${c.name}: the slot enumeration diverged with the block at line ${r.lineStart} removed`,
+        );
+      }
+    });
+
+    test(`${c.name}: walkMove agrees up AND down for every row`, () => {
+      const L = loadCase(c);
+      for (const r of L.webviewRows) {
+        for (const dir of ["up", "down"] as const) {
+          assert.deepStrictEqual(
+            plain(L.harness.hook.walkMove(L.webviewRows, r.lineStart, dir)),
+            walkMove(L.modelRows, r.lineStart, dir),
+            `${c.name}: walkMove('${dir}') diverged at line ${r.lineStart} (${r.kind})`,
+          );
+        }
+      }
+    });
+  }
+});
+
+// ---- T4b: the generated row-set sweep (STEPS-07/08, ≥2,000 sets) ------------------------------------
+
+suite("Steps mirror — generated row sets (STEPS-07/08)", () => {
+  test(`the row-array mirrors agree over ${GENERATED_SETS} generated row sets`, function (this: Mocha.Context) {
+    this.timeout(120_000);
+    // ONE page load for the whole sweep: these five mirrors never touch the DOM, so re-rendering a
+    // document per set would buy nothing and cost ~30 ms each. The render → DOM → read-back boundary is
+    // pinned separately, over the hand-authored corpus, by T1.
+    const hook = loadCase(caseFlat()).harness.hook;
+    let comparisons = 0;
+    let nonNullExtents = 0;
+    let nonNullWalks = 0;
+    let slots = 0;
+
+    for (let i = 0; i < GENERATED_SETS; i++) {
+      const g = generateRowSet(GENERATOR_SEED + i);
+      const where = (what: string, line: number): string =>
+        `${what} diverged (generated set ${i}, line ${line}).\n` +
+        `  reproduce: generateRowSet(${g.seed})\n` +
+        `  row set: ${JSON.stringify(g.web)}`;
+
+      const webSlots = plain(hook.buildDropSlots(g.web)) as DropResolution[];
+      assert.deepStrictEqual(webSlots, buildDropSlots(g.model), where("buildDropSlots", 0));
+      slots += webSlots.length;
+      comparisons += 1;
+
+      for (const r of g.web) {
+        const ext = plain(hook.blockExtent(g.web, r.lineStart));
+        assert.deepStrictEqual(ext, blockExtent(g.model, r.lineStart), where("blockExtent", r.lineStart));
+        if (ext) {
+          nonNullExtents += 1;
+        }
+
+        const webCap = hook.captureBlock(g.web, r.lineStart) as DomNode | null;
+        const mdlCap = captureBlock(g.model, r.lineStart);
+        // Same six-shared-keys comparison T3 makes: the webview's capture carries an extra `control`
+        // because its `clipLabel` takes the whole capture while `blockLabel` takes the keyword apart.
+        assert.deepStrictEqual(
+          webCap === null
+            ? null
+            : {
+                source: webCap.source,
+                nesting: webCap.nesting,
+                kind: webCap.kind,
+                lineStart: webCap.lineStart,
+                lineEnd: webCap.lineEnd,
+                lineCount: webCap.lineCount,
+              },
+          mdlCap,
+          where("captureBlock", r.lineStart),
+        );
+        if (mdlCap && webCap) {
+          const control = g.model.find((m) => m.lineStart === r.lineStart)?.control;
+          assert.strictEqual(webCap.control, control, where("captureBlock.control", r.lineStart));
+          assert.strictEqual(
+            hook.clipLabel(webCap),
+            blockLabel(mdlCap.kind, mdlCap.lineCount, control),
+            where("clipLabel/blockLabel", r.lineStart),
+          );
+        }
+
+        for (const dir of ["up", "down"] as const) {
+          const walk = plain(hook.walkMove(g.web, r.lineStart, dir));
+          assert.deepStrictEqual(walk, walkMove(g.model, r.lineStart, dir), where(`walkMove('${dir}')`, r.lineStart));
+          if (walk) {
+            nonNullWalks += 1;
+          }
+        }
+        comparisons += 4;
+      }
+    }
+
+    // A sweep that compared only nulls would pass for the wrong reason. Report the volume AND prove the
+    // interesting branches were actually reached, the way the plan's "print what you scanned" rule asks.
+    assert.ok(comparisons > 10_000, `the generated sweep made only ${comparisons} comparisons`);
+    assert.ok(nonNullExtents > 1_000, `only ${nonNullExtents} generated rows had a block extent at all`);
+    assert.ok(nonNullWalks > 1_000, `only ${nonNullWalks} generated walks resolved to a move`);
+    assert.ok(slots > 5_000, `the generated sets enumerated only ${slots} drop slots in total`);
+  });
+});
+
+// ---- T5/T6/T7: resolveDrop tri-zone, barAnchor, scopeLabel ------------------------------------------
+
+// Pointer fractions swept over every (drag, target) pair. 0.1 / 0.5 / 0.9 alone are NOT enough: they
+// sit either side of BOTH tri-zone thresholds, so moving `frac < 1/3` to `frac < 1/2` changes no
+// outcome among them (0.5 is not `< 0.5`) and a real threshold drift would slip through. 0.4 and 0.6
+// straddle the 1/3 and 2/3 boundaries and are what actually pins them — verified by falsification.
+// With ROW_H = 20 every one of these lands on an exact pixel, so the fraction arithmetic is exact.
+const FRACTIONS = [0.1, 0.4, 0.5, 0.6, 0.9];
+
+suite("Steps mirror — resolveDrop / barAnchor / scopeLabel parity", () => {
+  for (const c of CORPUS) {
+    test(`${c.name}: resolveDrop + barAnchor + scopeLabel agree over all ordered pairs × ${JSON.stringify(FRACTIONS)}`, () => {
+      const L = loadCase(c);
+      let compared = 0;
+      let nonNull = 0;
+      for (const di of dragStartableIndexes(L.webviewRows)) {
+        beginDrag(L.harness, L.harness.rowEls[di]);
+        for (let ti = 0; ti < L.webviewRows.length; ti++) {
+          for (const f of FRACTIONS) {
+            const ev = { clientY: clientYFor(ti, f), clientX: 0 };
+            const web = normalizeWebviewDrop(
+              L.harness.hook.resolveDrop(L.harness.rowEls[ti], ev) as DomNode | null,
+            );
+            const mdl = resolveDrop(L.modelRows[di], L.modelRows[ti], f, L.modelRows);
+            compared += 1;
+            const where =
+              `${c.name}: drag line ${L.webviewRows[di].lineStart} onto line ` +
+              `${L.webviewRows[ti].lineStart} (${L.webviewRows[ti].kind}) at fraction ${f}`;
+            assert.deepStrictEqual(web, mdl, `${where}: resolveDrop diverged`);
+            if (!mdl) {
+              continue;
+            }
+            nonNull += 1;
+            assert.deepStrictEqual(
+              normalizeWebviewBar(
+                L.harness.hook.barAnchor(L.harness.hook.resolveDrop(L.harness.rowEls[ti], ev)),
+              ),
+              insertionBarAnchor(mdl, L.modelRows),
+              `${where}: barAnchor diverged`,
+            );
+            assert.strictEqual(
+              L.harness.hook.scopeLabel(mdl.landingDepth, mdl.toSuite),
+              scopeLabel(mdl.landingDepth, mdl.toSuite, L.titles),
+              `${where}: scopeLabel diverged`,
+            );
+          }
+        }
+        endDrag(L.harness, L.harness.rowEls[di]);
+      }
+      assert.ok(compared > 0, `${c.name}: the pair sweep compared nothing`);
+      assert.ok(nonNull > 0, `${c.name}: every resolveDrop was null — the sweep proved nothing`);
+    });
+
+    test(`${c.name}: the three ZONES are DISCRIMINATING (the tri-zone is not collapsed)`, () => {
+      // Guards the harness itself: jsdom returns all-zero rects, and the webview's `resolveDrop` falls
+      // back to a constant 0.5 when height <= 0. Without stubRowRects() every fraction would resolve
+      // identically and every tri-zone assertion above would be vacuous. Assert that the five swept
+      // fractions really do land in the control header's three DISTINCT zones (before / into / after).
+      const L = loadCase(c);
+      const headerIdx = L.webviewRows.findIndex((r) => r.isControlHeader);
+      if (headerIdx < 0) {
+        return; // this case has no control header
+      }
+      const di = dragStartableIndexes(L.webviewRows).find((i) => {
+        const drag = L.modelRows[i];
+        const tgt = L.modelRows[headerIdx];
+        return resolveDrop(drag, tgt, 0.1, L.modelRows) !== null;
+      });
+      if (di === undefined) {
+        throw new Error(`${c.name}: no legal drag onto the first control header`);
+      }
+      beginDrag(L.harness, L.harness.rowEls[di]);
+      const seen = FRACTIONS.map((f) =>
+        JSON.stringify(
+          normalizeWebviewDrop(
+            L.harness.hook.resolveDrop(L.harness.rowEls[headerIdx], {
+              clientY: clientYFor(headerIdx, f),
+              clientX: 0,
+            }) as DomNode | null,
+          ),
+        ),
+      );
+      endDrag(L.harness, L.harness.rowEls[di]);
+      // …and prove the STUB is what makes them discriminate: without it jsdom's all-zero rects send
+      // the webview's `resolveDrop` down its `height <= 0` fallback and every fraction collapses to one
+      // resolution. This is T5's harness falsification kept in the tree, so nobody can quietly delete
+      // stubRowRects() and leave the tri-zone assertions passing vacuously.
+      const bare = loadCase(c, { skipRectStub: true });
+      const bareHeaderIdx = bare.webviewRows.findIndex((r) => r.isControlHeader);
+      beginDrag(bare.harness, bare.harness.rowEls[di]);
+      const bareSeen = FRACTIONS.map((f) =>
+        JSON.stringify(
+          normalizeWebviewDrop(
+            bare.harness.hook.resolveDrop(bare.harness.rowEls[bareHeaderIdx], {
+              clientY: clientYFor(bareHeaderIdx, f),
+              clientX: 0,
+            }) as DomNode | null,
+          ),
+        ),
+      );
+      endDrag(bare.harness, bare.harness.rowEls[di]);
+      assert.strictEqual(
+        new Set(bareSeen).size,
+        1,
+        `${c.name}: with no rect stub the fractions were expected to COLLAPSE to one resolution; they ` +
+          `did not, so this test is no longer proving that the stub is what makes them discriminate`,
+      );
+      assert.strictEqual(
+        new Set(seen).size,
+        3,
+        `${c.name}: the control-header tri-zone collapsed — every fraction resolved to ${seen[0]}. ` +
+          `The per-row getBoundingClientRect stub is missing or wrong, so the fraction assertions are vacuous.`,
+      );
+    });
+  }
+
+  test("escaping: a title carrying & < > \" ' produces the SAME scope label on both sides", () => {
+    const c = caseEscaping();
+    const L = loadCase(c);
+    const headers = L.vms.filter((vm) => vm.kind === "control");
+    assert.ok(headers.length >= 2, "the escaping case must carry control headers");
+    for (const h of headers) {
+      assert.ok(
+        /[&<>"']/.test(h.title),
+        `the escaping corpus must actually carry markup characters (got ${JSON.stringify(h.title)})`,
+      );
+      const suiteId = String(h.lineStart);
+      assert.strictEqual(
+        L.harness.hook.scopeLabel(1, suiteId),
+        scopeLabel(1, suiteId, L.titles),
+        `scopeLabel diverged across the HTML-escaping boundary for title ${JSON.stringify(h.title)}`,
+      );
+      assert.strictEqual(
+        L.harness.hook.scopeLabel(1, suiteId),
+        `inside ${h.title}`,
+        "the webview reads .textContent off escaped markup — it must recover the RAW title",
+      );
+    }
+  });
+});
+
+// ---- T8/T9/T10/T11: the script itself ---------------------------------------------------------------
+
+suite("Steps mirror — the webview script under jsdom (STEPS-06)", () => {
+  test("loads to completion: one 'alive' ping, no error diagnostics, no uncaught throw", () => {
+    const c = caseDeepNesting();
+    const handlers = buildHandlerViewModels(c.parse, c.source);
+    const h = loadWebview(renderHandlersHtml(handlers));
+    assert.deepStrictEqual(
+      h.scriptErrors.map((e) => String(e)),
+      [],
+      "the script threw while loading under jsdom",
+    );
+    const pings = plain(h.posted.filter((m) => m.command === "stepsDiag" && m.level === "ping"));
+    assert.deepStrictEqual(
+      pings,
+      [{ command: "stepsDiag", level: "ping", text: "alive" }],
+      "exactly one provider handshake ping",
+    );
+    assert.deepStrictEqual(
+      plain(h.posted.filter((m) => m.command === "stepsDiag" && m.level === "error")),
+      [],
+      "no stepsDiag error — the arrow-greying and context-menu wiring both completed",
+    );
+    assert.strictEqual(h.acquireCount, 1, "acquireVsCodeApi is called exactly once per page");
+    // NOTE: STEPS-06's second clause ("a second load against the RETAINED window does not re-acquire")
+    // is deliberately NOT asserted here. VS Code's retain-context reload gives the script a fresh
+    // realm-with-retained-window that a single jsdom document cannot reproduce — re-running a classic
+    // script in the SAME global would fail on its own top-level `const`, which would test the harness,
+    // not the product. That clause stays manual (STEPS-76).
+  });
+
+  test("element inventory: every id the script reads UNGUARDED exists in the page shell", () => {
+    // Without this, the "loads to completion" test above only proves the shell matches TODAY's script.
+    const src = fs.readFileSync(WEBVIEW_JS, "utf8");
+    const ids = new Set<string>();
+    const re = /document\.getElementById\(\s*(['"])([^'"]+)\1\s*\)/g;
+    let m: RegExpExecArray | null = re.exec(src);
+    while (m) {
+      ids.add(m[2]);
+      m = re.exec(src);
+    }
+    assert.ok(ids.size >= 5, `expected at least 5 getElementById ids, found ${ids.size}`);
+    const c = caseFlat();
+    const handlers = buildHandlerViewModels(c.parse, c.source);
+    const h = loadWebview(renderHandlersHtml(handlers));
+    for (const id of ids) {
+      assert.ok(
+        h.window.document.getElementById(id),
+        `stepsWebview.js reads #${id}, but the jsdom page shell does not provide it — either add it to ` +
+          `pageShell() or confirm stepsView.ts's real shell still renders it`,
+      );
+    }
+  });
+
+  test("the export hook is INERT unless the loader opts in", () => {
+    // Honest scope: stepsWebview.js is a CLASSIC script, so its top-level `function` declarations are
+    // ALREADY globals on the page — this gate does not newly hide behaviour that was previously
+    // exposed. What it does is keep the shipped webview free of a NAMED, greppable test contract that a
+    // future reader could mistake for a supported API, and make the test surface opt-in.
+    const c = caseFlat();
+    const handlers = buildHandlerViewModels(c.parse, c.source);
+    const h = loadWebview(renderHandlersHtml(handlers), { exposeHook: false });
+    assert.strictEqual(
+      h.window.__mfStepsTestExports,
+      undefined,
+      "__mfStepsTestExports must be absent when __mfStepsTestExportsEnabled was never set",
+    );
+    assert.deepStrictEqual(h.scriptErrors.map((e) => String(e)), [], "the gate must not break the load");
+  });
+
+  test("a CODE row's dragstart is intercepted: codeLocked, preventDefault, and no drop target follows", () => {
+    // The other half of the contract `renderRowHtml` declares: a code row is marked draggable
+    // ONLY so the attempt can be answered with "edit it in the code editor".
+    const c = caseDeepNesting();
+    const L = loadCase(c);
+    const codeIdx = L.webviewRows.findIndex((r) => r.kind === "code");
+    assert.ok(codeIdx >= 0, "the corpus must carry a code row");
+    assert.strictEqual(L.webviewRows[codeIdx].draggable, true, "a code row IS marked draggable");
+    const before = L.harness.posted.length;
+    const ev = beginDrag(L.harness, L.harness.rowEls[codeIdx]);
+    assert.strictEqual(ev.defaultPrevented, true, "the code-row drag is cancelled");
+    assert.deepStrictEqual(
+      plain(L.harness.posted.slice(before)),
+      [{ command: "codeLocked" }],
+      "the interception tells the provider to point at the code editor",
+    );
+    for (let ti = 0; ti < L.webviewRows.length; ti++) {
+      assert.strictEqual(
+        L.harness.hook.canDrop(L.harness.rowEls[ti]),
+        false,
+        `no drop target may follow an intercepted code-row drag (line ${L.webviewRows[ti].lineStart})`,
+      );
+    }
+  });
+});
+
+// ---- T12: mirror inventory guard --------------------------------------------------------------------
+
+/** Every top-level `function <name>(` in stepsWebview.js that is a MIRROR of a stepsModel function and
+ * therefore has a parity assertion above. */
+const MIRRORED = new Set([
+  "stepsCtxRows",
+  "blockExtent",
+  "captureBlock",
+  "buildDropSlots",
+  "walkMove",
+  "clipLabel",
+  "canDrop",
+  "scopeLabel",
+  "resolveDrop",
+  "barAnchor",
+]);
+
+/** Top-level functions that are NOT mirrors — DOM/wiring helpers with no pure model counterpart. Each
+ * entry carries the reason it is exempt. Adding an 11th mirror without a parity test must fail. */
+const NOT_A_MIRROR: Record<string, string> = {
+  selectRow: "DOM: applies the .selected class and records the toolbar's insert anchor",
+  updateAddState: "DOM: greys the toolbar Add button from the <select> + selection",
+  getClipboard: "storage: reads the webview's vscode.getState() clipboard slot",
+  setClipboard: "storage: writes the webview's vscode.setState() clipboard slot",
+  selectedIsMovable: "DOM: reads draggable/kind off the currently selected <li>",
+  copySelected: "wiring: captureBlock + setClipboard + a toast postMessage",
+  cutSelected: "wiring: copySelected then a deleteRow postMessage",
+  pasteSelected: "wiring: a paste postMessage from the clipboard slot",
+  ensureIndicators: "DOM: creates the insertion bar + scope pill elements",
+  clearIndicators: "DOM: removes the insertion bar + scope pill and the scope tint",
+  rowByLineStart: "DOM: finds an <li> by data-line-start",
+  showIndicators: "DOM: positions the bar/pill from getBoundingClientRect (layout, not logic)",
+  menuInsert: "wiring: posts the same insertItem message the toolbar Add posts",
+  menuDelete: "wiring: posts the same deleteRow message the row button posts",
+  menuMove: "wiring: walkMove + the same moveTo message the row arrows post",
+  menuAddDestination: "wiring: posts the same addDestination message the row button posts",
+};
+
+suite("Steps mirror — inventory guard (STEPS-12)", () => {
+  test("every top-level webview function is either mirrored-and-tested or explicitly not a mirror", () => {
+    const src = fs.readFileSync(WEBVIEW_JS, "utf8");
+    // The file's body is indented four spaces; nested helpers (inside the two IIFEs) are indented more,
+    // and the IIFEs themselves start with `(function`. So exactly-four-space `function` == top level.
+    const re = /^ {4}function ([A-Za-z0-9_$]+)\s*\(/gm;
+    const found: string[] = [];
+    let m: RegExpExecArray | null = re.exec(src);
+    while (m) {
+      found.push(m[1]);
+      m = re.exec(src);
+    }
+    assert.ok(found.length >= 20, `expected the full top-level function list, found ${found.length}`);
+    const unaccounted = found.filter((n) => !MIRRORED.has(n) && NOT_A_MIRROR[n] === undefined);
+    assert.deepStrictEqual(
+      unaccounted,
+      [],
+      `new top-level function(s) in media/stepsWebview.js with no parity test and no "not a mirror" ` +
+        `allowlist entry: ${unaccounted.join(", ")}. Add a parity assertion in this file, or an entry ` +
+        `in NOT_A_MIRROR with a one-line reason.`,
+    );
+    for (const name of MIRRORED) {
+      assert.ok(found.includes(name), `mirrored ${name}() vanished from media/stepsWebview.js`);
+    }
+    // Stale allowlist entries are a slower rot, but still rot.
+    for (const name of Object.keys(NOT_A_MIRROR)) {
+      assert.ok(found.includes(name), `NOT_A_MIRROR names ${name}(), which no longer exists`);
+    }
+  });
+});
+
+// ---- T13: context-menu enablement parity (STEPS-10) -------------------------------------------------
+
+interface MenuState {
+  insertBefore: boolean;
+  insertAfter: boolean;
+  deleteRow: boolean;
+  moveUp: boolean;
+  moveDown: boolean;
+  addDestination: boolean;
+}
+
+/** Right-click a row and read the REAL server-rendered menu's enabled/disabled state back off the DOM. */
+function openMenuFor(h: Harness, el: DomNode): MenuState {
+  const ev = new h.window.MouseEvent("contextmenu", {
+    bubbles: true,
+    cancelable: true,
+    clientX: 4,
+    clientY: 4,
+  });
+  el.dispatchEvent(ev);
+  const menu = h.window.document.getElementById("stepsCtxMenu");
+  assert.ok(menu, "the server-rendered context menu template is in the page");
+  const enabled = (sel: string): boolean => {
+    const node = menu.querySelector(sel);
+    assert.ok(node, `the context menu has no ${sel}`);
+    return node.disabled !== true;
+  };
+  return {
+    insertBefore: enabled('.ctx-parent[data-sub="before"]'),
+    insertAfter: enabled('.ctx-parent[data-sub="after"]'),
+    deleteRow: enabled('.ctx-item[data-cmd="deleteRow"]'),
+    moveUp: enabled('.ctx-item[data-cmd="moveUp"]'),
+    moveDown: enabled('.ctx-item[data-cmd="moveDown"]'),
+    addDestination: enabled('.ctx-item[data-cmd="addDestination"]'),
+  };
+}
+
+suite("Steps mirror — context-menu enablement parity (STEPS-10)", () => {
+  for (const c of CORPUS) {
+    test(`${c.name}: the webview's greying equals contextMenuEnablement for every row`, () => {
+      const L = loadCase(c);
+      for (let i = 0; i < L.vms.length; i++) {
+        const vm = L.vms[i];
+        // The webview gates ↑/↓ on isRowMovable AND the walk (stepsWebview.js:699-703); the model takes
+        // the walk result as an INPUT, so the model side composes the same two facts from its own data.
+        const movable = vm.movable === true;
+        const expected = contextMenuEnablement(
+          { kind: vm.kind, appended: vm.appended, scaffold: vm.scaffold, filtered: vm.filtered },
+          {
+            canMoveUp: movable && walkMove(L.modelRows, vm.lineStart, "up") !== null,
+            canMoveDown: movable && walkMove(L.modelRows, vm.lineStart, "down") !== null,
+          },
+        );
+        assert.deepStrictEqual(
+          openMenuFor(L.harness, L.harness.rowEls[i]),
+          expected,
+          `${c.name}: context-menu enablement diverged on row ${i} (line ${vm.lineStart}, ${vm.kind})`,
+        );
+      }
+    });
+  }
+});
+
+// ---- #234: the provider never releases the edit slot outside releaseEdit ---------------------------
+
+suite("Steps update-loop guard — every release site goes through releaseEdit (#234)", () => {
+  test("ide/src/stepsView.ts contains no bare guard.endEdit() call", () => {
+    // A FOURTH release site added later would silently reintroduce the dropped-save defect: endEdit()
+    // frees the slot without draining the refresh a save owed while the slot was held. releaseEdit is
+    // the only sanctioned release.
+    const src = fs.readFileSync(STEPS_VIEW_TS, "utf8");
+    const offenders = src
+      .split(/\r?\n/)
+      .map((line, i) => ({ line, n: i + 1 }))
+      .filter(({ line }) => /\bguard\s*\.\s*endEdit\s*\(/.test(line));
+    assert.deepStrictEqual(
+      offenders.map(({ n, line }) => `${n}: ${line.trim()}`),
+      [],
+      "every edit-slot release in stepsView.ts must go through releaseEdit(guard, scheduleRerender) so " +
+        "a save suppressed by the guard is DEFERRED, not dropped",
+    );
+    assert.ok(
+      /releaseEdit\(/.test(src),
+      "stepsView.ts must actually call releaseEdit — a file with neither call would pass vacuously",
+    );
+  });
+
+  test("render() cancels the debounce on entry, so a forced re-projection is not doubled (AC-C2)", () => {
+    // The composed behaviour is unit-tested in steps-edit.test.ts against RerenderDebouncer + a fake
+    // clock; what no node-side test can reach is the PROVIDER's wiring, because stepsView.ts imports
+    // vscode. This scan pins the one line that connects them: three release sites arm the debounce and
+    // then force `await render()` a few lines later, so a render that does not cancel first replaces
+    // the whole webview HTML a second time 250 ms afterwards.
+    const src = fs.readFileSync(STEPS_VIEW_TS, "utf8");
+    const start = src.indexOf("const render = async (): Promise<void> => {");
+    assert.ok(start >= 0, "stepsView.ts no longer declares `const render = async (): Promise<void> =>`");
+    const end = src.indexOf("\n    };", start);
+    assert.ok(end > start, "could not find the end of the render() body (4-space `};`)");
+    const body = src.slice(start, end);
+    assert.ok(
+      /rerender\.cancel\(\)/.test(body),
+      "render() must cancel the armed re-projection debounce on entry (ADR 0076 Amendment C, AC-C2) — " +
+        "otherwise a save suppressed while the edit slot was held is re-projected TWICE: once by the " +
+        "forced render and again when the deferred timer fires",
+    );
+    assert.ok(
+      /guard\.takeSuppressedChange\(\)/.test(body),
+      "render() must also take the guard's owed-refresh debt (AC-C2) — that covers the one path where " +
+        "the render happens BEFORE the release rather than after it (drainEdits' rejection handler), " +
+        "which the debounce cancel alone cannot reach",
+    );
+    // …and it must be the FIRST statement, before the `lens parse` await — a cancel after the await
+    // would swallow a save that legitimately arrived mid-render.
+    const firstStatement = body
+      .split(/\r?\n/)
+      .slice(1) // [0] is the `const render = …` declaration line itself
+      .find((l) => l.trim() !== "" && !l.trim().startsWith("//"));
+    assert.ok(
+      firstStatement !== undefined && /rerender\.cancel\(\);/.test(firstStatement),
+      `render()'s first statement must be rerender.cancel(); got: ${JSON.stringify(firstStatement)}`,
+    );
+  });
+});
diff --git a/messagefoundry/checks.py b/messagefoundry/checks.py
index 2a1c084f..d1d8c120 100644
--- a/messagefoundry/checks.py
+++ b/messagefoundry/checks.py
@@ -374,10 +374,10 @@ def _opens_with_guard_filter(body: list[ast.stmt]) -> bool:
     """True when the def's first executable statement is a bare guard-filter ``if <cond>: return []``.
 
     "Bare filter" = an ``if`` with no ``else``/``elif`` whose body is a single filter-return (``return``,
-    ``return None``, or ``return []`` — the empty list). A leading docstring is skipped. This is
-    deliberately conservative: a filter buried after real transform work is a genuine handler concern
-    (not an applicability rule) and is not flagged — the advisory only targets the leading guard that
-    belongs in ``accepts=``.
+    ``return None``, ``return []`` or ``return ()`` — either empty container). A leading docstring is
+    skipped. This is deliberately conservative: a filter buried after real transform work is a genuine
+    handler concern (not an applicability rule) and is not flagged — the advisory only targets the
+    leading guard that belongs in ``accepts=``.
     """
     stmts = list(body)
     # Skip a docstring first statement.
@@ -392,12 +392,18 @@ def _opens_with_guard_filter(body: list[ast.stmt]) -> bool:
     if not isinstance(inner, ast.Return):
         return False
     val = inner.value
-    # bare ``return`` / ``return None`` / ``return []`` are all filter-drops.
+    # bare ``return`` / ``return None`` / ``return []`` / ``return ()`` are all filter-drops. The tuple
+    # half matters as much as the list half: an EMPTY container of either kind partitions to no
+    # deliveries (``dryrun._partition`` materialises any non-``str`` iterable — BACKLOG #341), and
+    # ``return ()`` is a documented filter idiom the Steps lens already recognizes alongside ``return []``
+    # (``lens.py::_is_send_return`` / ``_is_collector_init``'s sibling gate, ADR 0108 §6). Recognizing
+    # only the list form made this advisory the sole place in the codebase that treated the two
+    # differently — it under-flagged a `return ()` guard rather than mis-flagging, but silently.
     if val is None:
         return True
     if isinstance(val, ast.Constant) and val.value is None:
         return True
-    return isinstance(val, ast.List) and not val.elts
+    return isinstance(val, ast.List | ast.Tuple) and not val.elts
 
 
 def _check_accepts_candidate(config_dir: str | Path) -> CheckResult:
diff --git a/messagefoundry/config/graph.py b/messagefoundry/config/graph.py
index cdfff454..fd85b0e9 100644
--- a/messagefoundry/config/graph.py
+++ b/messagefoundry/config/graph.py
@@ -1088,8 +1088,8 @@ def _handler_sends(
     (``from messagefoundry import Send as _S``). The walk is call-site-name-based while the
     runtime partitions by ``isinstance``, so every ``return`` expression must additionally be
     provably Send-free (:func:`_send_free_return`) or the handler is dynamic; a generator handler
-    is dynamic too (its yields are collected but never delivered by ``transform_one``, so its
-    static story is uncertain either way)."""
+    is dynamic too (its yields ARE delivered — ``_partition`` accepts any non-``str`` iterable,
+    BACKLOG #341 — but a call-site-name scan cannot prove WHICH of them a lazy body produces)."""
     located = _locate(fn, cache)
     if located is None:
         return None
diff --git a/messagefoundry/config/wiring.py b/messagefoundry/config/wiring.py
index 15e0f3f1..d23f892d 100644
--- a/messagefoundry/config/wiring.py
+++ b/messagefoundry/config/wiring.py
@@ -38,7 +38,7 @@ def handle(msg):
 import re
 import sys
 import threading
-from collections.abc import Callable, Iterator, Mapping, Sequence
+from collections.abc import Callable, Iterable, Iterator, Mapping, Sequence
 from contextlib import contextmanager, suppress
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -2631,12 +2631,59 @@ def __post_init__(self) -> None:
 #: non-HL7 inbound (ADR 0004). The author knows which — a Router/Handler is bound to one inbound.
 Payload = Message | RawMessage
 RouterFn = Callable[[Payload], "list[str] | str | None"]
-#: A Handler returns deliveries and/or writes (ADR 0005 state, ADR 0081 metadata): a single
-#: :class:`Send`/:class:`SetState`/:class:`SetMeta`, a mixed list, or ``None`` (filtered). ``Send``-only
-#: returns are unchanged — backward compatible.
-HandlerFn = Callable[
-    [Payload], "Send | SetState | SetMeta | list[Send | SetState | SetMeta] | None"
-]
+#: What a Handler returns: deliveries and/or writes (ADR 0005 state, ADR 0081 metadata) — a single
+#: :class:`Send`/:class:`SetState`/:class:`SetMeta`, **any non-``str`` iterable** of them (list, tuple,
+#: set, generator — BACKLOG #341), or ``None`` (filtered). ``Send``-only returns are unchanged —
+#: backward compatible. ``Iterable`` is covariant, so a plain ``list[Send]`` is assignable here where
+#: the invariant ``list[Send | SetState | SetMeta]`` used to be required.
+HandlerResult = Send | SetState | SetMeta | Iterable[Send | SetState | SetMeta] | None
+HandlerFn = Callable[[Payload], HandlerResult]
+
+
+def handler_result_items(result: object) -> list[object] | None:
+    """The elements of a Handler's returned **container**, or ``None`` — "this is a single value".
+
+    The ONE materialization rule for a Handler return (BACKLOG #341). It lives here, beside
+    :class:`Send`/:class:`SetState`/:class:`SetMeta`, because **both** consumers already import this
+    module and neither gains a dependency: the in-process partitioner
+    (:func:`messagefoundry.pipeline.dryrun._partition`) and the sandbox child
+    (:mod:`messagefoundry.pipeline._sandbox_codec` / ``_sandbox_worker``). Sharing the rule is what
+    keeps ``[sandbox].mode`` from ever changing WHICH ``Send``\\ s a Handler delivers (ADR 0087).
+
+    A ``list``/``tuple``/``set``/generator of :class:`Send`\\ s all deliver the same ``Send``\\ s. The
+    Router half (``dryrun._handler_names``) has always accepted any iterable; narrowing the Handler half
+    to ``list`` made a returned tuple an **accept-and-drop** — the one thing CLAUDE.md §12 forbids
+    outright. An EMPTY container yields ``[]``, so the documented ``return []`` / ``return ()`` filter
+    idiom keeps filtering rather than delivering or raising.
+
+    **Order is the container's, and a ``set`` has none.** The returned order is preserved verbatim and
+    becomes the order the outbound rows are inserted in (``store.transform_handoff``) — i.e. the FIFO
+    order of two ``Send``\\ s to the SAME outbound. A ``set``'s iteration order is unspecified:
+    :class:`Send` is a frozen dataclass hashed on its fields and ``str`` hashing is seeded per process,
+    so it differs between processes — which means between ``[sandbox].mode=off`` and ``mode=subprocess``
+    (the child is a separate process) AND between a first pass and a **crash re-run**. Purity (CLAUDE.md
+    §2) survives in the sense that carries the reliability invariant — a re-run re-derives the identical
+    *multiset* of outbound rows, and each delivery is independent and idempotent — but their relative
+    order is not reproducible. Ordered containers carry no such caveat, and the user-facing docs steer
+    authors to them; a ``set`` is accepted so that the widen has no arbitrary hole, not recommended.
+
+    Two deliberate carve-outs:
+
+    * ``str``/``bytes``/``bytearray`` are iterable but are **not** containers of ``Send``\\ s —
+      iterating one would partition its characters/bytes. They are single values.
+    * The gate is ``isinstance(result, Iterable)`` — an explicit ``__iter__`` — **not** a duck-typed
+      ``try: list(result)``. A :class:`~messagefoundry.parsing.message.Message` defines
+      ``__getitem__(path: str)`` and no ``__iter__``, so ``list()`` would drive the legacy sequence
+      protocol with an *int* index and raise out of a Handler that merely returned its message by
+      mistake. That slip drops silently today, and this fix must not convert it into a new raise.
+    """
+    if isinstance(result, str | bytes | bytearray):
+        return None
+    if isinstance(result, Iterable):
+        return list(result)
+    return None
+
+
 #: An optional **router-stage** applicability predicate a Handler may declare (``@handler(name,
 #: accepts=...)``; ADR 0084). It is evaluated while the Router's selection is still being computed —
 #: *before* any routed row is materialized — so a handler that declines costs **0** transactions
@@ -4064,10 +4111,10 @@ def decorate(fn: RouterFn) -> RouterFn:
 def handler(
     name: str, *, accepts: HandlerAccepts | None = None
 ) -> Callable[[HandlerFn], HandlerFn]:
-    """Register a Handler: ``def handle(msg) -> Send | SetState | SetMeta | list[...] | None``
-    (``None`` => filtered; :class:`SetState` declares a cross-message state write, ADR 0005;
-    :class:`SetMeta` attaches a per-message metadata key/value, ADR 0081 — both applied exactly-once in
-    the handoff).
+    """Register a Handler: ``def handle(msg) -> Send | SetState | SetMeta | Iterable[...] | None``
+    (``None`` => filtered; any non-``str`` iterable — list, tuple, set, generator — fans out, BACKLOG
+    #341; :class:`SetState` declares a cross-message state write, ADR 0005; :class:`SetMeta` attaches a
+    per-message metadata key/value, ADR 0081 — both applied exactly-once in the handoff).
 
     ``accepts`` (ADR 0084) is an optional **pure** router-stage predicate — ``(msg) -> bool`` — that
     lets this handler decline a message at *routing* time, before a routed row is materialized: a
diff --git a/messagefoundry/lens.py b/messagefoundry/lens.py
index 5f870d9f..356eacbf 100644
--- a/messagefoundry/lens.py
+++ b/messagefoundry/lens.py
@@ -1269,9 +1269,10 @@ def _merge_code_rows(rows: list[dict[str, Any]]) -> list[dict[str, Any]]:
 def _is_collector_init(s: ast.stmt, collectors: set[str]) -> bool:
     """Whether ``s`` is a ``NAME = []`` accumulator init for a NAME in ``collectors``.
 
-    A LIST only (never ``()``): a tuple has no ``.append`` and the runtime's ``_partition`` keys on
-    ``isinstance(result, list)``, so a tuple collector is not a valid accumulator — it stays a plain
-    code row."""
+    A LIST only (never ``()``): a tuple has no ``.append``, so a tuple collector cannot be an
+    accumulator — it stays a plain code row. (The runtime no longer narrows on ``list`` at all —
+    ``_partition`` accepts any non-``str`` iterable, BACKLOG #341 — but ``.append`` is the reason that
+    governs here, and it is unchanged.)"""
     return (
         isinstance(s, ast.Assign)
         and len(s.targets) == 1
@@ -2234,9 +2235,11 @@ def _is_send_return(s: ast.Return) -> bool:
     if isinstance(v, ast.List | ast.Tuple) and not v.elts:
         return True  # `return []` / `return ()` — the filter, converts to an accumulator with just the new send
     if isinstance(v, ast.Tuple):
-        # A NON-empty tuple return is dropped by the runtime ``_partition`` (it keys on
-        # ``isinstance(result, list)``), so it already delivers nothing; converting it to a list-building
-        # accumulator would silently flip 0→N deliveries. Refuse it — leave it a code row / edit-as-text.
+        # A NON-empty tuple return DELIVERS at runtime (``_partition`` accepts any non-``str`` iterable,
+        # BACKLOG #341), so converting it to a list-building accumulator would now be delivery-neutral
+        # rather than a silent 0→N flip. It is refused anyway, on CONSERVATIVE SCOPE: the palette never
+        # authors this form, and enabling the rewrite carries its own byte-stability obligations
+        # (ADR 0108 §6/§7) that belong to a Steps-view item, not here. Leave it a code row / edit-as-text.
         return False
     return _send_outbounds(v) is not None
 
diff --git a/messagefoundry/pipeline/_sandbox_codec.py b/messagefoundry/pipeline/_sandbox_codec.py
index 5fccae07..5abdaa9b 100644
--- a/messagefoundry/pipeline/_sandbox_codec.py
+++ b/messagefoundry/pipeline/_sandbox_codec.py
@@ -58,7 +58,13 @@
 from messagefoundry.config.models import ContentType
 from messagefoundry.config.response import CapturedResponse
 from messagefoundry.config.run_context import RunContext
-from messagefoundry.config.wiring import Send, SetMeta, SetState, WiringError
+from messagefoundry.config.wiring import (
+    Send,
+    SetMeta,
+    SetState,
+    WiringError,
+    handler_result_items,
+)
 from messagefoundry.parsing.message import Message, RawMessage
 
 __all__ = [
@@ -725,8 +731,9 @@ class Ignored:
 
     The encoder never silently drops an item it does not recognise — a silent omission would be an
     accept-and-drop (CLAUDE.md §12). Rebuilding the ignored slot keeps ``_partition`` the SOLE filter,
-    so a tuple/set/int Handler return still resolves to ``([], [], [])`` byte-identically to
-    ``mode=off``."""
+    so an unrecognised Handler return (a bare ``int``, a ``__reduce__`` gadget) still resolves to
+    ``([], [], [])`` byte-identically to ``mode=off`` — as does an unrecognised ELEMENT inside a
+    container the child materialised."""
 
     __slots__ = ()
 
@@ -762,13 +769,18 @@ def enc_result(phase: str, result: object, blobs: _Blobs) -> dict[str, Any]:
                 )
         return {"r": "names", "n": names}
     if phase == "transform":
-        # `shape` reproduces _partition's EXACT input container so the parent hands the unmodified
-        # _partition the same thing mode=off would. Do NOT normalise an iterable into a list: that
-        # would start delivering Sends mode=off drops.
+        # Materialise with _partition's OWN rule HERE, in the child — exactly what the router branch
+        # above does with `_handler_names`' logic. `handler_result_items` (config.wiring) is that
+        # single shared rule, so a tuple/set/generator fan-out delivers under mode=subprocess exactly
+        # as it does under mode=off (BACKLOG #341); fixing only the parent's _partition would make the
+        # disposition MODE-DEPENDENT, which is worse than the original accept-and-drop. A value the
+        # rule does not recognise as a container stays a "one" item — the parent's unmodified
+        # _partition still filters it out (and `dec_result` still returns the ITEM, not a 1-list).
         if result is None:
             return {"r": "items", "shape": "none"}
-        if isinstance(result, list):
-            return {"r": "items", "shape": "list", "i": [_enc_item(it, blobs) for it in result]}
+        items = handler_result_items(result)
+        if items is not None:
+            return {"r": "items", "shape": "list", "i": [_enc_item(it, blobs) for it in items]}
         return {"r": "items", "shape": "one", "i": _enc_item(result, blobs)}
     raise SandboxCodecError(f"unknown sandbox phase {phase!r}")
 
diff --git a/messagefoundry/pipeline/_sandbox_worker.py b/messagefoundry/pipeline/_sandbox_worker.py
index 6af42b12..93c8668a 100644
--- a/messagefoundry/pipeline/_sandbox_worker.py
+++ b/messagefoundry/pipeline/_sandbox_worker.py
@@ -98,6 +98,7 @@ def _run_one(registry: Any, req: Any, code_sets: Any) -> tuple[bool, object, str
     from messagefoundry.config.db_lookup import DbLookupError
     from messagefoundry.config.fhir_lookup import FhirLookupError
     from messagefoundry.config.run_context import run_contexts
+    from messagefoundry.config.wiring import handler_result_items
     from messagefoundry.pipeline._sandbox_codec import SandboxError
 
     phase = req.phase
@@ -133,6 +134,19 @@ def _run_one(registry: Any, req: Any, code_sets: Any) -> tuple[bool, object, str
     try:
         with run_contexts(run_context, phase=phase_key):
             result = fn(req.payload)
+            if phase == "transform":
+                # Materialise a CONTAINER return here, INSIDE the run context (BACKLOG #341). A
+                # generator Handler's body runs lazily, at whatever point something iterates it — and
+                # the codec's `enc_result`, which is where that would otherwise happen, is called from
+                # `_respond`, OUTSIDE this `with`. Materialising there would execute the Handler body
+                # with no active run context, so a `code_set(...)` inside a generator Handler would
+                # raise CodeSetError under mode=subprocess while working under mode=off: a
+                # mode-dependent disposition, exactly what ADR 0087's parity rule forbids. Applying the
+                # same rule again in `enc_result` is deliberate and free — list(list) is an idempotent
+                # shallow copy, and the codec is also exercised directly (parity table), bypassing this.
+                items = handler_result_items(result)
+                if items is not None:
+                    result = items
         if phase == "accepts":
             # HandlerAccepts is contractually ``(msg) -> bool`` and the PARENT coerces the verdict with
             # ``bool(...)`` (dryrun._accepted). Coerce HERE too, BEFORE the result is described back: a
diff --git a/messagefoundry/pipeline/dryrun.py b/messagefoundry/pipeline/dryrun.py
index 9e2bd5de..f4f7e41a 100644
--- a/messagefoundry/pipeline/dryrun.py
+++ b/messagefoundry/pipeline/dryrun.py
@@ -26,6 +26,7 @@
     META_MAX_KEYS,
     HandlerAccepts,
     HandlerFn,
+    HandlerResult,
     InboundConnection,
     Registry,
     RouterFn,
@@ -33,6 +34,7 @@
     SetMeta,
     SetState,
     StateValue,
+    handler_result_items,
 )
 from messagefoundry.parsing import (
     HL7PeekError,
@@ -86,7 +88,7 @@ def trace_router(
 
     def trace_handler(
         self, fn: HandlerFn, name: str, payload: Message | RawMessage
-    ) -> Send | SetState | SetMeta | list[Send | SetState | SetMeta] | None: ...
+    ) -> HandlerResult: ...
 
     def trace_accepts(
         self, pred: HandlerAccepts, name: str, payload: Message | RawMessage
@@ -100,16 +102,26 @@ def _handler_names(result: list[str] | str | None) -> list[str]:
 
 
 def _partition(
-    result: Send | SetState | SetMeta | list[Send | SetState | SetMeta] | None,
+    result: HandlerResult,
 ) -> tuple[list[Send], list[SetState], list[SetMeta]]:
     """Split a Handler's return into (deliveries, state writes, metadata writes) — ADR 0005 + ADR 0081.
 
-    A Handler may return :class:`Send`\\ s, :class:`SetState`\\ s and/or :class:`SetMeta`\\ s (a single
-    value, a mixed list, or ``None``). ``Send``-only returns yield ``([...], [], [])`` — backward
-    compatible."""
+    A Handler may return :class:`Send`\\ s, :class:`SetState`\\ s and/or :class:`SetMeta`\\ s — a single
+    value, **any non-``str`` iterable** of them (list, tuple, set, generator — BACKLOG #341), or
+    ``None``. ``Send``-only returns yield ``([...], [], [])`` — backward compatible. An EMPTY container
+    (``[]`` / ``()`` / ``set()``) partitions to ``([], [], [])``, so the documented ``return []`` /
+    ``return ()`` filter idiom keeps **filtering** — it neither delivers nor raises.
+
+    :func:`~messagefoundry.config.wiring.handler_result_items` is the single materialization rule, and
+    the sandbox child applies the SAME one, so ``[sandbox].mode`` never changes **which** ``Send``\\ s a
+    Handler delivers. Order is the container's: an ordered one delivers in its order under either mode,
+    while a ``set`` has no defined iteration order at all — see that function for why, and why the docs
+    steer authors away from it. A value the rule does not recognise as a container is a single item,
+    matches none of the three ``isinstance`` filters below, and still drops."""
     if result is None:
         return [], [], []
-    items = result if isinstance(result, list) else [result]
+    materialized = handler_result_items(result)
+    items: list[object] = [result] if materialized is None else materialized
     sends = [it for it in items if isinstance(it, Send)]
     state_ops = [it for it in items if isinstance(it, SetState)]
     meta_ops = [it for it in items if isinstance(it, SetMeta)]
@@ -430,10 +442,10 @@ def transform_one(
     derived = payload is None
     if payload is None:
         payload = _payload(raw, content_type)
-    raw_result: Send | SetState | SetMeta | list[Send | SetState | SetMeta] | None
+    raw_result: HandlerResult
     if sandbox is not None and sandbox.mode is SandboxMode.SUBPROCESS:
         raw_result = cast(
-            "Send | SetState | SetMeta | list[Send | SetState | SetMeta] | None",
+            "HandlerResult",
             run_sandboxed(
                 handle,
                 payload,
diff --git a/messagefoundry/pipeline/dryrun_trace.py b/messagefoundry/pipeline/dryrun_trace.py
index 4465cfbe..e26db7b2 100644
--- a/messagefoundry/pipeline/dryrun_trace.py
+++ b/messagefoundry/pipeline/dryrun_trace.py
@@ -40,6 +40,16 @@
 * *Thread-locality.* ``sys.settrace`` is per-thread. The pure dry-run runs the Router/Handler
   **synchronously on the calling thread**, so the tracer is installed on that same thread; ``trace_ok``
   in the result verifies a non-empty trace was actually captured.
+* *Lazy (generator) Router/Handler — declared, not silently under-reported.* A generator function's
+  body does not run when it is called; it runs when something iterates the returned generator, which
+  happens in ``_partition`` **after** this tracer has restored ``sys.settrace``. So that invocation
+  legitimately records **no line events**, and ``_sends_from``/``_routed_from`` decline to consume the
+  one-shot iterator (draining it here would leave ``_partition`` nothing to partition, making the
+  *traced* run deliver 0 where the untraced run delivers N — a tracer that changed the disposition).
+  The invocation therefore carries ``"lazy_result": true``: message-level ``sends``/``handlers`` stay
+  byte-identical to the untraced run, and the consumer can say *"this body was not traced"* instead of
+  rendering an apparently inert handler beside ``trace_ok: true`` (ADR 0072 §6 gate 1; the honest-
+  degradation rule of ADR 0089 §4).
 * *Python 3.14.* The tracer only touches ``sys.settrace`` — it never installs a ``sys.monitoring`` tool
   — so it coexists with coverage tooling on either mechanism.
 
@@ -62,7 +72,14 @@
 
 from messagefoundry.config.db_lookup import DbLookupError
 from messagefoundry.config.fhir_lookup import FhirLookupError
-from messagefoundry.config.wiring import HandlerAccepts, HandlerFn, Payload, RouterFn, Send
+from messagefoundry.config.wiring import (
+    HandlerAccepts,
+    HandlerFn,
+    Payload,
+    RouterFn,
+    Send,
+    handler_result_items,
+)
 from messagefoundry.parsing.message import Message
 from messagefoundry.pipeline.dryrun import dry_run
 
@@ -118,16 +135,36 @@ def _safe_snapshot(frame: FrameType) -> dict[str, Any]:
 
 
 def _sends_from(result: object) -> list[str]:
-    """Outbound names in a Handler's raw return (``Send``/``SetState``/list/``None``) — mirrors the
-    ``Send`` half of :func:`messagefoundry.pipeline.dryrun._partition`, name-only (no payload = no PHI)."""
+    """Outbound names in a Handler's raw return (``Send``/``SetState``/an iterable/``None``) — mirrors
+    the ``Send`` half of :func:`messagefoundry.pipeline.dryrun._partition`, name-only (no payload = no
+    PHI). It shares that function's materialization rule so the trace does not drift from what actually
+    delivers now that any non-``str`` iterable fans out (BACKLOG #341).
+
+    **One deliberate divergence: a one-shot iterator is never consumed.** A generator Handler is
+    reported as no sends rather than drained here, because this hook is a *pure observer* — exhausting
+    the generator would leave ``_partition`` nothing to partition, so the traced run would deliver 0
+    where the untraced run delivers N. Under-reporting is the only safe option; it is symmetric with
+    :func:`_routed_from`'s long-standing gap for a generator Router, but on the Handler half **this
+    change opened it**: before BACKLOG #341 a generator Handler delivered nothing at all, so reporting
+    no sends was exact rather than a degradation. The caller marks the invocation ``lazy_result`` so
+    the gap is declared to the consumer instead of read as an inert handler (ADR 0072 §6 gate 1)."""
     if result is None:
         return []
-    items = result if isinstance(result, list) else [result]
+    if isinstance(result, Iterator):
+        return []
+    items = handler_result_items(result)
+    if items is None:
+        items = [result]
     return [it.to for it in items if isinstance(it, Send)]
 
 
 def _routed_from(result: object) -> list[str]:
-    """Handler names in a Router's raw return (``list``/``str``/``None``)."""
+    """Handler names in a Router's raw return (``list``/``str``/``None``).
+
+    A **generator** Router routes fine (``dryrun._handler_names`` materialises any non-``str``
+    iterable) but is reported as no ``routed_to`` here, for the same pure-observer reason as
+    :func:`_sends_from`: draining the one-shot iterator would leave the real routing nothing to
+    materialise. The invocation carries ``lazy_result`` so the omission is declared."""
     if isinstance(result, str):
         return [result]
     if isinstance(result, list):
@@ -159,6 +196,9 @@ def __init__(
         self.sends: list[str] = []
         self.routed_to: list[str] = []
         self.truncated = False
+        # The invocation returned a one-shot iterator (a generator Router/Handler): its body has not
+        # run yet, so this record has no line events and its sends/routed_to are not measurable here.
+        self.lazy_result = False
         # trace state
         self.frame: FrameType | None = None
         self._last_line: int | None = None
@@ -223,6 +263,13 @@ def record_write(self, path: str, value: object) -> None:
     # terminal classification --------------------------------------------------
 
     def record_return(self, result: object) -> None:
+        if self.kind in ("router", "handler"):
+            # A generator function returns WITHOUT running its body, so this record is structurally
+            # incomplete (no line events, no measurable sends/routed_to) — declare that rather than
+            # let a consumer read an empty record as "this handler did nothing". Set for BOTH halves:
+            # the Router gap is long-standing, the Handler gap was opened by BACKLOG #341 widening
+            # `_partition` so a generator Handler now delivers.
+            self.lazy_result = isinstance(result, Iterator)
         if self.kind == "router":
             self.routed_to = _routed_from(result)
         elif self.kind == "handler":
@@ -271,6 +318,8 @@ def to_dict(self, disposition: str) -> dict[str, Any]:
         }
         if self.truncated:
             out["truncated"] = True
+        if self.lazy_result:
+            out["lazy_result"] = True
         return out
 
 
diff --git a/tests/test_checks.py b/tests/test_checks.py
index a33477d7..ee386c01 100644
--- a/tests/test_checks.py
+++ b/tests/test_checks.py
@@ -299,6 +299,37 @@ def test_accepts_candidate_flags_leading_guard_filter_and_is_advisory(tmp_path:
     assert "0084" in res.detail
 
 
+def test_accepts_candidate_flags_an_empty_tuple_guard_exactly_like_an_empty_list(
+    tmp_path: Path,
+) -> None:
+    """``return ()`` is the same filter as ``return []`` and must be flagged the same (BACKLOG #341).
+
+    Both empty containers partition to no deliveries, and the Steps lens has always recognized the pair
+    together (ADR 0108 §6). This advisory recognized only the list form, making it the one place in the
+    codebase that treated the two idioms differently — it silently under-flagged the tuple guard. The
+    two handlers below are byte-identical apart from ``[]`` vs ``()``, so the assertion cannot pass by
+    the flagger being inert: ``H_list`` must appear for the same reason ``H_tuple`` must."""
+    cfg = tmp_path / "config"
+    cfg.mkdir()
+    (cfg / "feed.py").write_text(
+        "from messagefoundry import handler, Send\n\n"
+        "@handler('H_tuple')\n"
+        "def h_tuple(msg):\n"
+        "    if msg.field('MSH-9') != 'ADT':\n"
+        "        return ()\n"
+        "    return [Send('OB_X', msg)]\n\n"
+        "@handler('H_list')\n"
+        "def h_list(msg):\n"
+        "    if msg.field('MSH-9') != 'ADT':\n"
+        "        return []\n"
+        "    return [Send('OB_X', msg)]\n",
+        encoding="utf-8",
+    )
+    res = checks._check_accepts_candidate(cfg)
+    assert "h_tuple" in res.detail and "h_list" in res.detail
+    assert res.required is False and res.skipped is False  # still advisory, still fired
+
+
 def test_accepts_candidate_inert_without_leading_guard(tmp_path: Path) -> None:
     """A handler that does NOT open with a guard-filter yields a skipped no-op, still advisory."""
     cfg = tmp_path / "config"
diff --git a/tests/test_dryrun.py b/tests/test_dryrun.py
index 84301855..3939527e 100644
--- a/tests/test_dryrun.py
+++ b/tests/test_dryrun.py
@@ -4,6 +4,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Iterator
 from typing import Any
 
 import pytest
@@ -15,10 +16,13 @@
     OutboundConnection,
     Registry,
     Send,
+    SetMeta,
+    SetState,
 )
 from messagefoundry.parsing.message import Message, RawMessage
 from messagefoundry.pipeline.dryrun import (
     DeliveryPreview,
+    disposition_for,
     dry_run,
     route_message,
     route_only,
@@ -334,3 +338,103 @@ def route(msg: Message) -> list[str]:
     prebuilt = Message.parse(ADT_A01)
     assert route_only(reg, reg.inbound["in"], ADT_A01, payload=prebuilt) == []
     assert seen == [id(prebuilt)]  # the router received the exact prebuilt object
+
+
+# --- a Handler may return ANY non-str iterable of Sends (BACKLOG #341) --------
+
+
+def _fanout_registry(handle: Any) -> Registry:
+    """One inbound → one handler → TWO outbounds, so a fan-out has somewhere to go."""
+    reg = Registry()
+    reg.add_inbound(
+        InboundConnection(
+            "in",
+            ConnectionSpec(ConnectorType.MLLP, {"host": "0.0.0.0", "port": 2575}),
+            router="r",
+        )
+    )
+    reg.add_outbound(
+        OutboundConnection("OB_A", ConnectionSpec(ConnectorType.FILE, {"directory": "./a"}))
+    )
+    reg.add_outbound(
+        OutboundConnection("OB_B", ConnectionSpec(ConnectorType.FILE, {"directory": "./b"}))
+    )
+    reg.add_router("r", lambda m: ["h"])
+    reg.add_handler("h", handle)
+    return reg
+
+
+def test_handler_returning_a_tuple_of_sends_delivers_both() -> None:
+    """The headline defect (#341). ``_partition`` narrowed with ``isinstance(result, list)``, so a
+    returned TUPLE became the single item, matched none of the three isinstance filters, and the
+    message finalized FILTERED — delivering nothing and erroring nothing, indistinguishable from a
+    handler deliberately declining it. That is the accept-and-drop CLAUDE.md §12 forbids outright."""
+
+    def handle(msg: Message) -> tuple[Send, Send]:
+        return (Send("OB_A", msg), Send("OB_B", msg))
+
+    deliveries, _, _, _ = transform_one(_fanout_registry(handle), "h", ADT_A01)
+    assert [d.to for d in deliveries] == ["OB_A", "OB_B"]  # both delivered, order preserved
+
+
+def test_handler_returning_a_set_of_sends_delivers_all() -> None:
+    """A ``set`` fans out too. Asserted as a SET: set iteration order is unspecified, so pinning a
+    list here would be a flake rather than a contract."""
+
+    def handle(msg: Message) -> set[Send]:
+        return {Send("OB_A", msg), Send("OB_B", msg)}
+
+    deliveries, _, _, _ = transform_one(_fanout_registry(handle), "h", ADT_A01)
+    assert {d.to for d in deliveries} == {"OB_A", "OB_B"}
+
+
+def test_handler_returning_a_generator_of_sends_delivers_all() -> None:
+    """A generator Handler fans out — the Router half (``_handler_names``) has always accepted one, so
+    this closes the internal inconsistency rather than inventing a new contract."""
+
+    def handle(msg: Message) -> Iterator[Send]:
+        yield Send("OB_A", msg)
+        yield Send("OB_B", msg)
+
+    deliveries, _, _, _ = transform_one(_fanout_registry(handle), "h", ADT_A01)
+    assert [d.to for d in deliveries] == ["OB_A", "OB_B"]
+
+
+@pytest.mark.parametrize("empty", [[], (), set(), None], ids=["list", "tuple", "set", "none"])
+def test_empty_container_returns_still_filter(empty: Any) -> None:
+    """THE acceptance criterion for #341. ``return []`` and ``return ()`` are the documented filter
+    idiom (recognized by the Steps lens, SHALL'd at ADR 0108 §6). Widening must turn neither into a
+    delivery NOR into an error: every empty container delivers nothing, raises nothing, and keeps the
+    honest FILTERED disposition."""
+    reg = _fanout_registry(lambda msg: empty)
+    outcome = route_message(reg, reg.inbound["in"], ADT_A01)
+    assert outcome.deliveries == []
+    assert outcome.routed  # a handler DID run — so this is FILTERED, not UNROUTED
+    assert disposition_for(outcome) is MessageStatus.FILTERED
+
+
+def test_a_mixed_tuple_partitions_exactly_like_the_equivalent_list() -> None:
+    """A tuple is partitioned by the SAME rule as a list — ``Send``\\ s, ``SetState``\\ s and
+    ``SetMeta``\\ s each land in their own bucket. The outcomes are compared to each other so the test
+    cannot drift from ``_partition``'s own definition of the buckets, and the counts are pinned so the
+    comparison cannot pass by both sides being empty."""
+
+    def _items(msg: Message) -> list[Any]:
+        return [Send("OB_A", msg), SetState("ns", "k", 1), SetMeta("mk", "mv")]
+
+    tup = transform_one(_fanout_registry(lambda m: tuple(_items(m))), "h", ADT_A01)
+    lst = transform_one(_fanout_registry(_items), "h", ADT_A01)
+    assert tup == lst
+    assert (len(tup.deliveries), len(tup.state_ops), len(tup.meta_ops)) == (1, 1, 1)
+
+
+def test_a_bare_message_return_still_drops_and_never_raises() -> None:
+    """A Handler that returns its ``Message`` by mistake still drops silently — the widen must not turn
+    that slip into a raise. This pins the ``isinstance(..., Iterable)`` GATE, not merely the outcome: a
+    duck-typed ``list(result)`` would drive ``Message.__getitem__`` (declared ``(path: str)``) through
+    the legacy sequence protocol with an *int* index and raise ``TypeError`` out of the handler."""
+
+    def handle(msg: Message) -> Any:
+        return msg
+
+    assert transform_one(_fanout_registry(handle), "h", ADT_A01) == ([], [], [], [])
diff --git a/tests/test_dryrun_trace.py b/tests/test_dryrun_trace.py
index f1805167..190267b9 100644
--- a/tests/test_dryrun_trace.py
+++ b/tests/test_dryrun_trace.py
@@ -3,7 +3,10 @@
 """Traced dry-run (ADR 0072): the ADR gate tests + capture-semantics coverage.
 
 Gates asserted here (ADR 0072):
-  1. Byte-identical — a traced run's disposition + sends/routed_to equal the untraced run's.
+  1. Byte-identical — a traced run's disposition + sends/routed_to equal the untraced run's. Since the
+     2026-08-04 amendment the gate is stated by level: 1a (message level) is absolute; 1b (the
+     per-invocation mirror) carves out a generator Router/Handler, whose body has not run at record
+     time, and requires that invocation to declare `lazy_result` rather than look inert.
   2. Live-lookup identical — a handler hitting an unstubbed db_lookup/fhir_lookup yields the identical
      ERROR disposition with and without the tracer, plus a `live_lookup_skipped` annotation.
   3. Coverage-intact — a traced run restores the prior tracer (prev-tracer, not None), so a surrounding
@@ -15,6 +18,7 @@
 
 import json
 import sys
+from collections.abc import Iterator
 from pathlib import Path
 
 from messagefoundry.__main__ import main
@@ -126,6 +130,64 @@ def test_gate_byte_identical_disposition_and_routing() -> None:
     assert _handler_invocation(traced)["sends"] == [{"outbound": "out"}]
 
 
+def _two_out_registry(handle) -> Registry:  # type: ignore[no-untyped-def]
+    """``_registry`` plus a second outbound, so a fan-out has two distinguishable destinations."""
+    reg = _registry(route_to_h, {"h": handle})
+    reg.add_outbound(
+        OutboundConnection("out2", ConnectionSpec(ConnectorType.FILE, {"directory": "./out2"}))
+    )
+    return reg
+
+
+def handle_generator(msg: Message) -> Iterator[Send]:
+    """A generator Handler: it delivers (BACKLOG #341) but its body runs *after* the tracer detaches."""
+    yield Send("out", msg)
+    yield Send("out2", msg)
+
+
+def test_gate_1a_a_generator_handler_traces_byte_identically_at_message_level() -> None:
+    """ADR 0072 gate 1a for the shape that most nearly broke it.
+
+    ``_sends_from`` mirrors ``_partition`` — but ``_partition``'s rule now materialises **any**
+    non-``str`` iterable, and materialising a generator CONSUMES it. Mirroring that rule literally
+    would leave the real ``_partition`` an exhausted iterator, so the *traced* run would deliver 0
+    where the untraced run delivers 2: a tracer that changes the disposition, which is the one thing
+    ADR 0072 forbids. The two-line ``isinstance(result, Iterator)`` guard in ``_sends_from`` is what
+    prevents it, and before this test nothing covered it — deleting the guard left the whole tracer
+    suite green while turning a traced generator Handler into an accept-and-drop.
+
+    The untraced side is asserted non-empty first, so this cannot pass by both runs delivering nothing
+    (which is exactly how it would have "passed" before #341 widened ``_partition``)."""
+    reg = _two_out_registry(handle_generator)
+    plain = dry_run(reg, ADT_A01)
+    traced = trace_dry_run(reg, ADT_A01)
+
+    assert [d.to for d in plain.deliveries] == ["out", "out2"]  # the untraced run really delivers
+    assert [s["outbound"] for s in traced["sends"]] == [d.to for d in plain.deliveries]
+    assert traced["disposition"] == plain.disposition.value
+    assert traced["handlers"] == plain.handlers == ["h"]
+
+
+def test_gate_1b_a_generator_invocation_declares_lazy_result() -> None:
+    """ADR 0072 gate 1b: the per-invocation mirror's declared carve-out.
+
+    A generator function returns without running its body, so this record legitimately has no line
+    events and no measurable sends. That under-report is honest only if it is *declared* — otherwise
+    the payload contradicts itself (top level: two sends; invocation: nothing ran) while ``trace_ok``
+    asserts the trace is trustworthy. The ``lazy_result`` flag is the declaration; the list Handler
+    below is the control, proving the flag is not simply always set."""
+    traced = trace_dry_run(_two_out_registry(handle_generator), ADT_A01)
+    inv = _handler_invocation(traced)
+    assert inv["lazy_result"] is True
+    assert inv["sends"] == [] and inv["events"] == []  # the documented under-report, pinned
+    assert traced["sends"] == [{"outbound": "out"}, {"outbound": "out2"}]  # 1a still holds
+
+    control = trace_dry_run(_registry(route_to_h, {"h": handle_transform}), ADT_A01)
+    control_inv = _handler_invocation(control)
+    assert "lazy_result" not in control_inv  # absent, not False — an eagerly-returning handler
+    assert control_inv["sends"] == [{"outbound": "out"}] and control_inv["events"]
+
+
 def test_gate_byte_identical_unrouted_and_filtered() -> None:
     unrouted = trace_dry_run(_registry(lambda m: [], {}), ADT_A01)
     assert unrouted["disposition"] == MessageStatus.UNROUTED.value
diff --git a/tests/test_lens_fanout.py b/tests/test_lens_fanout.py
index 8152a84c..fa6cf7af 100644
--- a/tests/test_lens_fanout.py
+++ b/tests/test_lens_fanout.py
@@ -192,6 +192,9 @@ def test_nested_append_inside_for_is_send_row() -> None:
         ('    return Send("OB", msg)\n', ("send", ["OB"])),
         ('    return [Send("A", msg), Send("B", msg)]\n', ("send", ["A", "B"])),
         ("    return []\n", ("send", [])),
+        # ADR 0108 §6 SHALLs `return ()` alongside `return []`, and lens.py recognizes both, but only
+        # `return []` was pinned — the tuple half had no regression coverage at all (BACKLOG #341).
+        ("    return ()\n", ("send", [])),
     ],
 )
 def test_legacy_return_forms_recognized_and_byte_identical(body: str, expect: tuple) -> None:
@@ -659,7 +662,7 @@ def _two_ob_registry(handler) -> Registry:  # type: ignore[no-untyped-def]
 
 def test_accumulator_delivers_identically_to_returned_list() -> None:
     """An append-built accumulator delivers the SAME destinations/order as the equivalent returned list —
-    ``_partition`` keys on ``isinstance(result, list)`` and never inspects the collector name."""
+    ``_partition`` materialises whatever container it is handed and never inspects the collector name."""
 
     def _accumulator(msg):  # type: ignore[no-untyped-def]
         sends = []
@@ -763,8 +766,10 @@ def test_orphan_append_not_returned_degrades_to_code() -> None:
 
 
 def test_convert_refuses_nonempty_tuple_return() -> None:
-    """A non-empty tuple return is dropped by the runtime `_partition`, so converting it would flip 0→N
-    deliveries — refuse it."""
+    """A non-empty tuple return DELIVERS at runtime since BACKLOG #341, so converting it up would be
+    delivery-neutral rather than the 0→N flip ADR 0108 §7 refused it for. The refusal stands on
+    conservative scope — the palette never authors this form, and enabling the rewrite carries its own
+    byte-stability obligations — so this pins the refusal, not the superseded reason."""
     src = _wrap('    return (Send("A", msg), Send("B", msg))\n')
     row = next(r for r in _rows(src) if r["kind"] == "send")
     with pytest.raises(LensRewriteError, match="can't be extended"):
diff --git a/tests/test_sandbox.py b/tests/test_sandbox.py
index 783a3a62..c1b1489a 100644
--- a/tests/test_sandbox.py
+++ b/tests/test_sandbox.py
@@ -102,6 +102,22 @@ def h_gadget(msg):
     return _Gadget()
 
 
+@handler("h_gen_fanout")
+def h_gen_fanout(msg):
+    # A GENERATOR handler (BACKLOG #341). Its yields are lazy, so this also pins WHERE the child
+    # materialises them, not just that it does.
+    yield Send("OB_T", "GEN_A")
+    yield Send("OB_T", "GEN_B")
+
+
+@handler("h_set_fanout")
+def h_set_fanout(msg):
+    # A SET handler (BACKLOG #341). Six elements, because the contract this probes is the delivered
+    # MULTISET: the child is a different PROCESS with its own hash seed, so the order it materialises
+    # a set in is not the parent's.
+    return {Send("OB_T", f"SET_{c}") for c in "ABCDEF"}
+
+
 @handler("h_state")
 def h_state(msg):
     return [SetState("ns", "tup", (1, 2)), SetState("ns", "nan", float("nan"))]
@@ -458,6 +474,48 @@ def test_a_handler_returning_a_reduce_gadget_does_not_execute_in_the_engine(
     assert not sentinel.exists(), "a Handler's __reduce__ executed in the engine parent"
 
 
+def test_a_generator_handler_delivers_under_mode_subprocess(graph: tuple[Registry, str]) -> None:
+    """BACKLOG #341 across the process boundary. Before the shared materialization rule the child
+    described a generator/tuple/set return as ``{"o": "other"}`` and the parent rebuilt an inert
+    ``Ignored()``, so a fan-out that delivers N in-process delivered 0 under ``mode=subprocess``.
+    Fixing only the parent's ``_partition`` would leave exactly that mode-dependent disposition."""
+    registry, config_dir = graph
+    session = _session(config_dir)
+    try:
+        sandboxed = _deliveries(registry, "h_gen_fanout", sandbox=session, run_context=RunContext())
+    finally:
+        session.close()
+    assert sandboxed == [("OB_T", "GEN_A"), ("OB_T", "GEN_B")]
+    assert sandboxed == _deliveries(registry, "h_gen_fanout")  # identical to mode=off
+
+
+def test_a_set_handler_delivers_the_same_multiset_under_mode_subprocess(
+    graph: tuple[Registry, str],
+) -> None:
+    """A ``set`` return crosses the boundary with every ``Send`` intact — and with its ORDER unpinned,
+    deliberately (ADR 0087 AC-11).
+
+    The child is a separate ``Popen`` with **no** inherited ``PYTHONHASHSEED``, and ``Send`` is a frozen
+    dataclass hashed on its fields, so the child iterates a 6-element set in a different order than the
+    parent would. Asserting an order here would pin a per-process accident and flake; asserting the
+    multiset is the contract the engine actually offers. That the two modes do NOT necessarily agree on
+    order is why `docs/CONNECTIONS.md` steers authors to a list/tuple when order matters.
+
+    The counts are pinned at 6 so the comparison cannot pass by both sides being empty — which is the
+    exact way this test would have "passed" before the fix, when a set delivered nothing in either mode.
+    """
+    registry, config_dir = graph
+    session = _session(config_dir)
+    try:
+        sandboxed = _deliveries(registry, "h_set_fanout", sandbox=session, run_context=RunContext())
+    finally:
+        session.close()
+    off = _deliveries(registry, "h_set_fanout")
+    assert len(sandboxed) == len(off) == 6
+    assert sorted(sandboxed) == sorted(off)
+    assert sorted(p for _, p in sandboxed) == [f"SET_{c}" for c in "ABCDEF"]
+
+
 def test_generator_router_routes_under_mode_subprocess(graph: tuple[Registry, str]) -> None:
     """A generator Router is documented-supported and unpicklable, so ``mode=subprocess`` used to
     dead-letter every message it routed. The child now materialises the router result with
@@ -698,7 +756,12 @@ def _codeset_graph(tmp_path: Path, mapped: str) -> Registry:
         '    return "h"\n'
         '@handler("h")\n'
         "def h(msg):\n"
-        '    return Send("OB_C", code_set("cs")["A"])\n',
+        '    return Send("OB_C", code_set("cs")["A"])\n'
+        '@handler("h_gen_cs")\n'
+        "def h_gen_cs(msg):\n"
+        "    # A GENERATOR whose BODY reads a run-scoped provider. The read happens when something\n"
+        "    # iterates the generator, so this probes WHERE that materialization runs in the child.\n"
+        '    yield Send("OB_C", code_set("cs")["A"])\n',
         encoding="utf-8",
     )
     return load_config(tmp_path)
@@ -722,6 +785,29 @@ def test_code_sets_are_loaded_by_the_child_and_resolve(tmp_path: Path) -> None:
     assert [(d.to, d.payload) for d in ds] == [("OB_C", "MAPPED")]
 
 
+def test_a_generator_handlers_body_runs_inside_the_childs_run_context(tmp_path: Path) -> None:
+    """A generator Handler's body executes LAZILY — at the instant something materialises it. In the
+    child that instant must fall INSIDE ``with run_contexts(...)``.
+
+    The codec's ``enc_result`` is called from ``_respond``, *outside* that block, so materialising
+    there would run the Handler body with no active run context: a ``code_set(...)`` inside a
+    generator Handler would raise ``CodeSetError`` under ``mode=subprocess`` while working fine under
+    ``mode=off``. That is a mode-dependent disposition — the exact class of failure ADR 0087's parity
+    rule forbids, and the reason the worker materialises the result itself."""
+    registry = _codeset_graph(tmp_path, "MAPPED")
+    session = _session(str(tmp_path), code_sets=registry.code_sets)
+    rc = RunContext(code_sets=registry.code_sets)
+    try:
+        ds, _, _, _ = transform_one(registry, "h_gen_cs", RAW, sandbox=session, run_context=rc)
+    finally:
+        session.close()
+    assert [(d.to, d.payload) for d in ds] == [("OB_C", "MAPPED")]
+    # And byte-identical to mode=off, which activates the same providers around the same call.
+    with run_contexts(rc, phase="transform"):
+        off, _, _, _ = transform_one(registry, "h_gen_cs", RAW, run_context=rc)
+    assert [(d.to, d.payload) for d in ds] == [(d.to, d.payload) for d in off]
+
+
 def test_an_unreloaded_codeset_edit_does_not_brick_the_inbound(tmp_path: Path) -> None:
     """Regression for the fail-closed cure that was worse than the disease.
 
diff --git a/tests/test_sandbox_codec.py b/tests/test_sandbox_codec.py
index a29bfb9c..24807e73 100644
--- a/tests/test_sandbox_codec.py
+++ b/tests/test_sandbox_codec.py
@@ -26,7 +26,13 @@
 from messagefoundry.config.response import CapturedResponse
 from messagefoundry.config.run_context import RunContext, run_contexts
 from messagefoundry.config.state import state_get
-from messagefoundry.config.wiring import Send, SetMeta, SetState, WiringError
+from messagefoundry.config.wiring import (
+    Send,
+    SetMeta,
+    SetState,
+    WiringError,
+    handler_result_items,
+)
 from messagefoundry.parsing.message import Message, RawMessage
 from messagefoundry.pipeline import _sandbox_codec as codec
 from messagefoundry.pipeline import sandbox
@@ -575,6 +581,32 @@ def gen() -> Iterator[Send]:
     return gen()
 
 
+#: What each return shape partitions to, as ``[sends, state, meta]``. The table is the acceptance
+#: criterion, asserted against BOTH modes — a shape may not partition differently across the pipe.
+_PARITY: dict[str, list[int]] = {
+    "none": [0, 0, 0],
+    "bare_send": [1, 0, 0],
+    "mixed_list": [1, 1, 1],  # the trailing `7` is unrecognised and drops
+    "send_subclass": [1, 0, 0],
+    "tuple_of_sends": [2, 0, 0],  # BACKLOG #341 — was [0, 0, 0]
+    # >1 element on purpose — a 1-element set has only one ordering, so it cannot see _UNORDERED.
+    "set_of_sends": [3, 0, 0],  # BACKLOG #341 — was [0, 0, 0]
+    "bare_int": [0, 0, 0],  # not a container, not a recognised item — still DROPS
+    "generator": [1, 0, 0],  # BACKLOG #341 — was [0, 0, 0]
+    # THE acceptance criterion of #341 — `return []` / `return ()` must keep FILTERING, not start
+    # delivering and not start raising — carried across the process boundary, not just in-process.
+    "empty_list": [0, 0, 0],
+    "empty_tuple": [0, 0, 0],
+}
+
+#: Cases whose container defines **no** iteration order, so parity is over the delivered MULTISET only.
+#: ``Send`` is a frozen dataclass hashed on its fields and ``str`` hashing is seeded per process, so a
+#: ``set``'s fan-out order differs between processes — i.e. between the sandbox child and the parent,
+#: and between a first pass and a crash re-run. Asserting an order here would pin a per-process
+#: accident as a contract; ADR 0087's AC-11 and `wiring.handler_result_items` say the same in prose.
+_UNORDERED = {"set_of_sends"}
+
+
 @pytest.mark.parametrize(
     ("case", "make"),
     [
@@ -583,23 +615,73 @@ def gen() -> Iterator[Send]:
         ("mixed_list", lambda: [Send("OB_A", "x"), SetState("n", "k", 1), SetMeta("m", "v"), 7]),
         ("send_subclass", lambda: _SubSend("OB_A", "x")),
         ("tuple_of_sends", lambda: (Send("OB_A", "x"), Send("OB_B", "y"))),
-        ("set_of_sends", lambda: {Send("OB_A", "x")}),
+        ("set_of_sends", lambda: {Send("OB_A", "x"), Send("OB_B", "y"), Send("OB_C", "z")}),
         ("bare_int", lambda: 7),
         ("generator", _generator_result),
+        ("empty_list", list),
+        ("empty_tuple", tuple),
     ],
 )
 def test_partition_parity_table(case: str, make: Any) -> None:
-    """``_partition`` stays the SOLE filter: the codec reproduces its exact input container, so the
-    ``(sends, state, meta)`` shape is identical to ``mode=off`` for every return shape — including the
-    ones ``mode=off`` silently drops. Normalising an iterable into a list here would start delivering
-    ``Send``\\ s the current engine does not (shipping PHI it drops today)."""
+    """``[sandbox].mode`` never changes which ``Send``\\ s a Handler delivers.
+
+    The child materialises a transform return with ``_partition``'s OWN rule
+    (:func:`~messagefoundry.config.wiring.handler_result_items`), exactly as it already materialises a
+    router return with ``_handler_names``' logic — so a tuple/set/generator fan-out delivers under
+    ``mode=subprocess`` precisely as it does under ``mode=off`` (BACKLOG #341), an EMPTY container still
+    FILTERS, a ``Send`` **subclass** still delivers, and a value neither rule recognises still drops
+    (described as an ``Ignored`` slot rather than omitted, so ``_partition`` stays the SOLE filter).
+    Fixing the parent's ``_partition`` alone would make the disposition MODE-DEPENDENT — in-process
+    delivers while subprocess drops — which is worse than the original accept-and-drop this closes.
+
+    **Destinations are compared, not just counts** — equal lengths would pass even if the codec swapped
+    one outbound for another. For an ordered container the exact ORDER is pinned too; for a ``set``
+    (``_UNORDERED``) only the multiset is, because a set has no iteration order to preserve. Note the
+    scope honestly: this round-trip is **in-process**, so it cannot observe the cross-process reordering
+    a real child imposes on a ``set`` — which is precisely why the contract is stated over the multiset
+    rather than asserted over an order that only holds within one hash seed."""
     direct = _partition(make())
     through_codec = _partition(_rt_transform(make()))  # type: ignore[arg-type]
-    assert [len(x) for x in through_codec] == [len(x) for x in direct]
+    assert [len(x) for x in direct] == _PARITY[case]
+    assert [len(x) for x in through_codec] == _PARITY[case]
     if case == "send_subclass":
         assert len(direct[0]) == 1 and through_codec[0][0].to == "OB_A"  # still DELIVERS
-    if case in ("tuple_of_sends", "set_of_sends", "bare_int", "generator", "none"):
-        assert [len(x) for x in direct] == [0, 0, 0]  # still DROPS, in both modes
+    dests_direct = [s.to for s in direct[0]]
+    dests_codec = [s.to for s in through_codec[0]]
+    if case in _UNORDERED:
+        assert sorted(dests_codec) == sorted(dests_direct)
+    else:
+        assert dests_codec == dests_direct
+    if case in ("empty_list", "empty_tuple"):
+        # The filter idiom must cross the pipe AS A CONTAINER, and `[0, 0, 0]` alone cannot see that:
+        # an empty container mis-described as an *unrecognised single value* also partitions to
+        # `[0, 0, 0]` (the parent rebuilds an `Ignored`). Pinning the described shape is what makes
+        # this row falsifiable at all — a truthiness gate in `handler_result_items` (`and result`,
+        # the natural "simplification") flips `shape` to `"one"` while every count stays green.
+        assert enc_result("transform", make(), _Blobs()) == {"r": "items", "shape": "list", "i": []}
+
+
+def test_handler_result_items_treats_a_str_as_a_single_value() -> None:
+    """The shared materialization rule's two carve-outs, asserted directly on the rule itself.
+
+    A ``str``/``bytes`` IS iterable but is not a container of ``Send``\\ s — iterating one would
+    partition its characters. And the gate is an explicit ``__iter__`` (``isinstance(..., Iterable)``),
+    never a duck-typed ``list(result)``, so a non-iterable value is a single item rather than a raise.
+
+    An end-to-end "a ``str`` return still drops" test could NOT catch the first carve-out: characters
+    are not ``Send``\\ s, so the disposition is ``[0, 0, 0]`` with or without it. Asserting on the rule
+    is what makes the carve-out falsifiable at all."""
+    s1, s2 = Send("OB_A", "x"), Send("OB_B", "y")
+    assert handler_result_items("OB_A") is None
+    assert handler_result_items(b"x") is None
+    assert handler_result_items(bytearray(b"x")) is None
+    assert handler_result_items(7) is None
+    assert handler_result_items(None) is None
+    assert handler_result_items(s1) is None  # a frozen dataclass is not iterable
+    assert handler_result_items((s1, s2)) == [s1, s2]
+    assert handler_result_items([s1]) == [s1]
+    assert handler_result_items(()) == []
+    assert _partition("OB_A") == ([], [], [])  # and a str return still DROPS end to end
 
 
 # --- (8) parent-side constructor faults are wrapped --------------------------