diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index 375d9925d34..3cf1ddb5288 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -4773,12 +4773,12 @@
       "providers": ["local", "remote-runtime", "ssh", "wsl"],
       "coveredPlatforms": ["macos", "linux"],
       "coveredProviders": [],
-      "coverageNotes": "Audit4014 removes the complete browser client page command integration suite and its active command token, test selector and assertion reference. Its synthetic guest lifecycle still exercised real executor/dispatcher/Session/WebContents registry composition: navigation normalization, generation reclaim, spontaneous destruction inventory revocation, and exactly-once route/policy retirement alarms are intentionally lost. Electron guest navigation, proxy resolution and renderer lifecycle were supplied test ports; no equivalent replacement or fresh execution is claimed. The three unrelated active dated receipts and all prior historical strings remain unchanged. Historical prior account (preserved verbatim): Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1686 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1563 retires mock cookie inventories, summary/flag/counter checks, historical replacement/replay narratives and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise owned admission and cleanup, real staged-file lifetime, JSON/SQLite/WAL/schema compatibility, synthetic encryption and native Electron SameSite storage. Session/CDP/credential/write/renderer producers remain injected where recorded. Seven unchanged native definitions are not rerun locally; known stale registry-stub fixtures are not executable proof. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1559 removes mocked host/lease/reconciliation, event/flag/counter, forwarding, inventory and retry-budget alarms without equivalent replacement coverage. Retained cases establish owned promise, registry, rollback, admission and cleanup boundaries with injected Electron/renderer/host inputs; actual local sockets, file staging and Buffer collection are scoped in the PR. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain historical evidence only. No live paired runtime, rendered browser/profile/TLS or device claim. Historical scope before this audit: Audit1401 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1340 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic protocol, registry, injected-socket, and loopback-listener tests cover strict framing, remote-DNS targets, exact destination-write and source-consumption credit, at most 256 streams per route with pending opens counted inside that cap, 1024 admitted opens per 10-second monotonic window, an 8 MiB per-route application-buffer ledger, shared 32 MiB browser-host and 128 MiB process ledgers across application copies, encrypted client queues, and native WebSocket bufferedAmount, bounded byte/claim/socket-source counts, a four-frame queued-drain quantum, authority epochs, exact host selection, one host per authenticated connection, four hosts per paired device, eight global browser-host polls with four per authenticated paired device, a shared ask/host ceiling that retains one quarter for waits, bounded initial and reconnect runtime_busy recovery, long-poll metering and disconnect abort, monotonic host/page/route generations without page tombstones, two-phase exact page retirement with cancellation, connection-owned cleanup, exact client revocation, stale and replaced fences, retired stream IDs, half-close and close ordering, SOCKS CONNECT, bind/close races, listener wildcard normalization, unsupported commands, unavailable routes, and raw/terminal binary-handler isolation. Page commands use a separately echoed v1 attach negotiation, exact authority/host/page generations, bounded command IDs and sequences, and bounded create/navigate payloads; legacy attaches still receive only the unchanged ready/revoked event shapes. A second optional reconciliation subprotocol gates bounded reclaim, close, and restore payloads behind exact attach/ready echo, complete inventory, command negotiation, reconnect authority, and command-result authority; the production client advertises it only with the matching command and inventory capabilities. Exact guest or app-renderer loss marks one page generation outcome-unknown, coalesces a bounded negotiated inventory reattach, closes or retires the dead generation, and allocates a fresh generation before URL restore; explicit close is not misclassified as a crash. Mixed-version mutation tests project hidden client pages before activate, close, split, reorder, and move-to-group admission, preserve hidden raw order slots, translate visible insertion indices, and project mutation snapshots. A production server orchestrator consumes each immutable inventory once, reserves target generations without exposing placement, emits only negotiated ledger commands, commits after exact completed proof, preserves unrelated and server placements, aborts an attempt when connection authority enters reconnect grace, and requires fresh inventory after failure or abort. The production client dispatcher additionally proves per-page FIFO execution, exact payload-matched duplicate replay, frozen command/result snapshots, a global retired-generation floor, transactional admission, bounded pages/active commands/queues/per-page and global result cache/concurrency, create dependency failure, cancellation, deduplicated retirement joining, and bounded close without late-result overwrite. The server ledger owns issue order and immutable command/result snapshots, bounds outstanding commands, active pages, and per-page/global replay caches, releases active-page capacity after an exact completed close while retaining bounded result replay, validates the shared wire payload before admission, requires live delivery and exact placement, authenticates results to the negotiated connection and paired lease, rejects gaps and conflicting replay, and fences outstanding outcomes at exact retirement. Negotiated command results reuse the authenticated attach socket through bounded nested JSON requests; exact ID routing, reverse-order replies, unknown and duplicate IDs, timeout teardown, serialization failure, aggregate queue accounting, acknowledgement validation, and the unchanged non-v1 path are deterministic. A stable local listener rejects CONNECT while offline or reconnecting, retains its address across replacement, requires a strictly increasing tunnel generation, ignores late superseded callbacks, propagates tunnel protocol failure to the route owner, and recycles exhausted stream IDs only after generation replacement. Reconnect uses the unchanged native v1 attach payload and capability pair; SSH descriptors alone add an execution-host capability and require a runtime-minted grant bound to the exact browser-host lease. Exact SSH provider epoch and connection generation fence ssh2 forwardOut and one non-interactive standalone system-SSH dynamic forward per route. Unit tests preserve domain-form SOCKS requests, sanitize remote errors, bound stderr, cancel startup, release timed-out and synchronously failed sockets, and release routes once. An ephemeral Docker sshd resolves a container-only domain and returns a unique HTTP marker through both ssh2 and the actual system-OpenSSH dynamic-forward adapter without touching the user's SSH files; authority loss fences the ssh2 route. The execution runtime charges route application bytes to the same per-host/process policy; its existing E2EE owner separately caps native outbound buffers process-wide. Production-registered browser-host and paired-runtime methods lease one exact host, prove attach, command delivery, and result settlement share one exact connection identity, then carry SOCKS and HTTP bytes over a dedicated E2EE socket to the fenced execution-host revision and prove route close destroys the destination socket. The production desktop adapter now composes one exact host per environment pairing revision with the page executor, current renderer selector, route Session/WebContents registries, and one reference-counted route per canonical execution-host key. Negotiated same-client control reconnect retains exact authority, placements, grants, dispatcher dedupe, executor guests, and listener addresses; it fences tunnels immediately, blocks route admission, reattaches command delivery only after ready, and replays unsettled commands without repeating completed mutations. Terminal release, replacement, legacy disconnect, and reconnect-grace expiry make only the exact host generation's client placements non-cancellable retirement-pending while retaining capacity until exact cleanup; reconnect grace preserves them. Environment replacement and app shutdown still serialize transport closure before page cleanup and force-close every remaining route. The production placement preparation starts the exact desktop adapter and advertises host/tunnel capabilities only when the paired Electron client is eligible. Node stream-internal high-water bytes, strict cross-route scheduling, and physical cross-platform evidence remain uncovered. The two Docker remote-only SSH browser routing journeys now run in the dedicated Linux ssh-browser-network-route CI job on full runs and their mapped source/test changes; 2 baseline and 6 repeated cases passed with no skips/retries on 2026-09-06. The removed retry-arithmetic and attach-request inventory suites are not current coverage; retained lease and composition suites exercise admission retry, cleanup, inventory negotiation, and reconnect behavior. Test-value audit1293 removes src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/browser/client-pages/lifecycle/browser-client-page-unavailability.test.ts: Every route/guest lifecycle/currentness/navigation/renderer/automation authority is supplied by fake callbacks, then unavailability listener is invoked manually and private inventory/mock calls are checked. No guest destruction, renderer disconnect or actual reconciliation/close consumer. Lose generation fence/reconcile-once/missing-renderer-close branch alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1318: src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts: Retain actual local encrypted WebSocket subscription concurrency routing when host replies out of order, plus an exception thrown by a real ws consumer callback being turned into a subscription error. Server is a test-shaped handshake/response producer using production crypto, not actual runtime host/auth authority or independent cryptographic oracle. Remove happy second-request duplicate, unknown/duplicate-ID branches, fixed32 capacity, serialization/capacity/timeouts and fake memory release/admission call-count scenarios; intentionally lose those alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1340: src/main/runtime/runtime-binary-message-router.test.ts removed. Connection mode conflict exceptions and one terminal/raw callback each. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope. Audit1401: src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. No equivalent replacement coverage is claimed.",
+      "coverageNotes": "Audit5429 trims paired browser-host composition and reconnect tests. Retire composition close-order/whenClosed wiring and explicit inventory-refresh reattachment/publication/cardinality alarms without equivalent replacement. Keep generation/recovery ownership and completed-mutation replay at their existing narrower scope. The removed composition close assertion is retired; surviving file commands remain valid selectors. No fresh full-gate execution or validation of reduced selectors is claimed. All three unrelated complete dated receipts retain their original exact fields and scope. Historical prior account (preserved verbatim): Audit4014 removes the complete browser client page command integration suite and its active command token, test selector and assertion reference. Its synthetic guest lifecycle still exercised real executor/dispatcher/Session/WebContents registry composition: navigation normalization, generation reclaim, spontaneous destruction inventory revocation, and exactly-once route/policy retirement alarms are intentionally lost. Electron guest navigation, proxy resolution and renderer lifecycle were supplied test ports; no equivalent replacement or fresh execution is claimed. The three unrelated active dated receipts and all prior historical strings remain unchanged. Historical prior account (preserved verbatim): Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 removes low-value test definitions and retires affected assertion or execution-receipt claims without equivalent replacement coverage. Per-source reviews bound retained behavior and injected/native/remote limits. Unchanged assertions and receipts keep their original scope; gates lacking current active evidence are downgraded. Historical scope before this audit: Audit1687 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1686 removes low-value test projections, mock wiring, private-state assertions, inventories and duplicate examples without equivalent replacement coverage. Per-source reviews record retained public behavior and refusal boundaries with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1640 removes low-value IPC, SSH, workspace and transcript-watcher tests without equivalent replacement coverage. Per-source reviews record retained public refusal, cancellation, execution-host and real-filesystem outcomes with injected/native/remote limits. Affected historical receipts are retired; gates without active current evidence are downgraded. Historical scope before this audit: Audit1571 removes mock forwarding, capability/schema inventories, private predicates, supplied error/result replays, and filesystem-mocked persistence checks without equivalent replacement claims. Retained changed tests also exercise real local permission-file reread, registry proxy rollback/credential retirement, site display recovery, and pending sender/credential/document admission with injected Electron/UI producers. Retained network tests exercise owned stream credit/cleanup, generation and retirement fences, real loopback proxy/SOCKS bytes and file-backed binding state. SSH/WSL/paired runtime, native sessions, authority producers and storage clears remain injected; simulated relaunch uses filesystem mocks. The unchanged profile-retirement suite was statically reviewed and not rerun. No actual SSH/WSL runtime, native Chromium jar deletion, durable process restart, remote DNS or external site proof. Receipts selecting changed tests are retired and unaffected receipts remain unchanged. Historical scope before this audit: Audit1563 retires mock cookie inventories, summary/flag/counter checks, historical replacement/replay narratives and setup-only alarms without equivalent replacement coverage. Retained changed cases exercise owned admission and cleanup, real staged-file lifetime, JSON/SQLite/WAL/schema compatibility, synthetic encryption and native Electron SameSite storage. Session/CDP/credential/write/renderer producers remain injected where recorded. Seven unchanged native definitions are not rerun locally; known stale registry-stub fixtures are not executable proof. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain unchanged. Historical scope before this audit: Audit1559 removes mocked host/lease/reconciliation, event/flag/counter, forwarding, inventory and retry-budget alarms without equivalent replacement coverage. Retained cases establish owned promise, registry, rollback, admission and cleanup boundaries with injected Electron/renderer/host inputs; actual local sockets, file staging and Buffer collection are scoped in the PR. Receipts selecting modified tests are retired; unaffected exact-selector receipts remain historical evidence only. No live paired runtime, rendered browser/profile/TLS or device claim. Historical scope before this audit: Audit1401 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Audit1340 changes referenced sources. Retained unchanged-source receipts apply only to their unchanged commands; the reduced selectors have no new execution result. Historical coverage account (not a current claim for changed sources): Deterministic protocol, registry, injected-socket, and loopback-listener tests cover strict framing, remote-DNS targets, exact destination-write and source-consumption credit, at most 256 streams per route with pending opens counted inside that cap, 1024 admitted opens per 10-second monotonic window, an 8 MiB per-route application-buffer ledger, shared 32 MiB browser-host and 128 MiB process ledgers across application copies, encrypted client queues, and native WebSocket bufferedAmount, bounded byte/claim/socket-source counts, a four-frame queued-drain quantum, authority epochs, exact host selection, one host per authenticated connection, four hosts per paired device, eight global browser-host polls with four per authenticated paired device, a shared ask/host ceiling that retains one quarter for waits, bounded initial and reconnect runtime_busy recovery, long-poll metering and disconnect abort, monotonic host/page/route generations without page tombstones, two-phase exact page retirement with cancellation, connection-owned cleanup, exact client revocation, stale and replaced fences, retired stream IDs, half-close and close ordering, SOCKS CONNECT, bind/close races, listener wildcard normalization, unsupported commands, unavailable routes, and raw/terminal binary-handler isolation. Page commands use a separately echoed v1 attach negotiation, exact authority/host/page generations, bounded command IDs and sequences, and bounded create/navigate payloads; legacy attaches still receive only the unchanged ready/revoked event shapes. A second optional reconciliation subprotocol gates bounded reclaim, close, and restore payloads behind exact attach/ready echo, complete inventory, command negotiation, reconnect authority, and command-result authority; the production client advertises it only with the matching command and inventory capabilities. Exact guest or app-renderer loss marks one page generation outcome-unknown, coalesces a bounded negotiated inventory reattach, closes or retires the dead generation, and allocates a fresh generation before URL restore; explicit close is not misclassified as a crash. Mixed-version mutation tests project hidden client pages before activate, close, split, reorder, and move-to-group admission, preserve hidden raw order slots, translate visible insertion indices, and project mutation snapshots. A production server orchestrator consumes each immutable inventory once, reserves target generations without exposing placement, emits only negotiated ledger commands, commits after exact completed proof, preserves unrelated and server placements, aborts an attempt when connection authority enters reconnect grace, and requires fresh inventory after failure or abort. The production client dispatcher additionally proves per-page FIFO execution, exact payload-matched duplicate replay, frozen command/result snapshots, a global retired-generation floor, transactional admission, bounded pages/active commands/queues/per-page and global result cache/concurrency, create dependency failure, cancellation, deduplicated retirement joining, and bounded close without late-result overwrite. The server ledger owns issue order and immutable command/result snapshots, bounds outstanding commands, active pages, and per-page/global replay caches, releases active-page capacity after an exact completed close while retaining bounded result replay, validates the shared wire payload before admission, requires live delivery and exact placement, authenticates results to the negotiated connection and paired lease, rejects gaps and conflicting replay, and fences outstanding outcomes at exact retirement. Negotiated command results reuse the authenticated attach socket through bounded nested JSON requests; exact ID routing, reverse-order replies, unknown and duplicate IDs, timeout teardown, serialization failure, aggregate queue accounting, acknowledgement validation, and the unchanged non-v1 path are deterministic. A stable local listener rejects CONNECT while offline or reconnecting, retains its address across replacement, requires a strictly increasing tunnel generation, ignores late superseded callbacks, propagates tunnel protocol failure to the route owner, and recycles exhausted stream IDs only after generation replacement. Reconnect uses the unchanged native v1 attach payload and capability pair; SSH descriptors alone add an execution-host capability and require a runtime-minted grant bound to the exact browser-host lease. Exact SSH provider epoch and connection generation fence ssh2 forwardOut and one non-interactive standalone system-SSH dynamic forward per route. Unit tests preserve domain-form SOCKS requests, sanitize remote errors, bound stderr, cancel startup, release timed-out and synchronously failed sockets, and release routes once. An ephemeral Docker sshd resolves a container-only domain and returns a unique HTTP marker through both ssh2 and the actual system-OpenSSH dynamic-forward adapter without touching the user's SSH files; authority loss fences the ssh2 route. The execution runtime charges route application bytes to the same per-host/process policy; its existing E2EE owner separately caps native outbound buffers process-wide. Production-registered browser-host and paired-runtime methods lease one exact host, prove attach, command delivery, and result settlement share one exact connection identity, then carry SOCKS and HTTP bytes over a dedicated E2EE socket to the fenced execution-host revision and prove route close destroys the destination socket. The production desktop adapter now composes one exact host per environment pairing revision with the page executor, current renderer selector, route Session/WebContents registries, and one reference-counted route per canonical execution-host key. Negotiated same-client control reconnect retains exact authority, placements, grants, dispatcher dedupe, executor guests, and listener addresses; it fences tunnels immediately, blocks route admission, reattaches command delivery only after ready, and replays unsettled commands without repeating completed mutations. Terminal release, replacement, legacy disconnect, and reconnect-grace expiry make only the exact host generation's client placements non-cancellable retirement-pending while retaining capacity until exact cleanup; reconnect grace preserves them. Environment replacement and app shutdown still serialize transport closure before page cleanup and force-close every remaining route. The production placement preparation starts the exact desktop adapter and advertises host/tunnel capabilities only when the paired Electron client is eligible. Node stream-internal high-water bytes, strict cross-route scheduling, and physical cross-platform evidence remain uncovered. The two Docker remote-only SSH browser routing journeys now run in the dedicated Linux ssh-browser-network-route CI job on full runs and their mapped source/test changes; 2 baseline and 6 repeated cases passed with no skips/retries on 2026-09-06. The removed retry-arithmetic and attach-request inventory suites are not current coverage; retained lease and composition suites exercise admission retry, cleanup, inventory negotiation, and reconnect behavior. Test-value audit1293 removes src/main/browser/network/tunnels/browser-network-tunnel-client-memory-budget.test.ts (4 authored cases). Their isolated assertions no longer run; surviving tests are not claimed as equivalent coverage. Fresh execution against the candidate SHA is required. Audit1302: src/main/browser/client-pages/lifecycle/browser-client-page-unavailability.test.ts: Every route/guest lifecycle/currentness/navigation/renderer/automation authority is supplied by fake callbacks, then unavailability listener is invoked manually and private inventory/mock calls are checked. No guest destruction, renderer disconnect or actual reconciliation/close consumer. Lose generation fence/reconcile-once/missing-renderer-close branch alarms; no equivalent replacement. Reduced selectors require fresh validation; prior full-suite receipts do not validate removed or changed coverage. No equivalent replacement or physical-provider claim. Audit1318: src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts: Retain actual local encrypted WebSocket subscription concurrency routing when host replies out of order, plus an exception thrown by a real ws consumer callback being turned into a subscription error. Server is a test-shaped handshake/response producer using production crypto, not actual runtime host/auth authority or independent cryptographic oracle. Remove happy second-request duplicate, unknown/duplicate-ID branches, fixed32 capacity, serialization/capacity/timeouts and fake memory release/admission call-count scenarios; intentionally lose those alarms. Reduced selectors need fresh validation; historical full-suite receipts do not validate the changed coverage. No equivalent replacement or physical-provider claim. Audit1340: src/main/runtime/runtime-binary-message-router.test.ts removed. Connection mode conflict exceptions and one terminal/raw callback each. No equivalent replacement coverage is claimed. Audit1352: focused Linux unit selections validated on source head b638e07d395b76af3ba6b03761a1a0fe7e5e026e. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1360: focused Linux unit selections validated on source head 415c9cffc2d10024131ec4b6721767a22195de6d. Historical statements above retain their original scope. Intentional test losses are recorded in knownGaps; these runs claim no physical-provider, p95, rendered E2E or cross-platform validation. Audit1371 removes the reconciliation protocol/capability echo inventory from browser-client-host-reconciliation.test.ts. The pending command result refusal without exact authority and later accepted acknowledgement callback remains byte-identical. The narrow negotiation echo alarm is intentionally lost; no equivalent browser/authenticated transport proof is claimed. Existing receipts with unchanged selectors retain only their original scope. Audit1401: src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts reduced. Loses deterministic equal-length URL compaction tie-breaking and reversed-input invariance alarm. No equivalent replacement coverage is claimed.",
       "motivatingLinks": [
         "https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
       ],
       "invariant": "A client-hosted browser network route exists only for an exact live server-owned browser-host lease, authority epoch, host generation, paired identity, execution-host revision or SSH provider authority, and server-owned route generation. A client page is usable only when its runtime ID, authority epoch, host identity and generation, logical page ID, page-host generation, current placement, and still-live lease all match atomically; a retired, retirement-pending, or server-placed page cannot be claimed as live client placement. Live logical placements and their identities are bounded, an occupied logical page cannot change placement until exact two-phase retirement completes, cancellation restores the same authority, and the runtime-wide page generation stays monotonic without tombstones. Server-issued page commands and results remain bounded, FIFO per page, immutable after admission, authenticated to the exact paired lease, attach connection, and live placement, and replayable only when byte-equivalent. Negotiated transient result-transport loss retains exact authority and replays unsettled commands through the preserved client dedupe cache; terminal authority loss makes outstanding outcomes unknown and makes only the exact host generation's placements non-cancellable retirement-pending until exact cleanup or reconciliation proof. Desktop composition installs exact command authority before delivery, keeps result settlements below nested-request capacity, suspends every tunnel without closing guests on negotiated loss, gates handlers through route recovery, and synchronously suspends routes and revokes exact retained navigation grants before asynchronous transport or handler cleanup on terminal loss. Navigation-revocation failure remains observable without preventing guest destruction and route cleanup. One environment pairing revision owns at most one composed desktop host and one reference-counted route per canonical execution-host key; pairing replacement and shutdown close control transport before pages and force-close routes even when guest cleanup remains ambiguous. Non-native descriptors require explicit capability negotiation and an exact runtime-minted lease-bound execution-host grant. Host selection never chooses arbitrarily, stale cleanup or settlement cannot remove a replacement, destination names remain unresolved until the execution host, credit returns only after writes settle, and route loss never falls back to desktop DNS or sockets. A main-owned local listener remains stable across upstream transport loss, rejects CONNECT while offline, accepts only a strictly newer tunnel generation, ignores superseded callbacks, and never reuses a stream ID within one generation. Pending opens, admitted open rate, nested control requests, per-route application bytes, aggregate browser-host/process bytes, claims, and socket sources remain bounded with exact release on settlement and retirement. Queued transport drain yields after a bounded quantum. The local SOCKS endpoint accepts only loopback CONNECT and rejects unsupported commands.",
-      "oracle": "Audit4014 removes the complete browser client page command integration suite and its active command token, test selector and assertion reference. Its synthetic guest lifecycle still exercised real executor/dispatcher/Session/WebContents registry composition: navigation normalization, generation reclaim, spontaneous destruction inventory revocation, and exactly-once route/policy retirement alarms are intentionally lost. Electron guest navigation, proxy resolution and renderer lifecycle were supplied test ports; no equivalent replacement or fresh execution is claimed. The three unrelated active dated receipts and all prior historical strings remain unchanged. Historical prior account (preserved verbatim): Test-value audit3842 retires four ws-outbound queue unit probes: direct empty-queue send failure, configured drain quantum/zero-delay reschedule, injected aggregate claim/release accounting, and supplied unwritable drain guard. Their exact alarms are intentionally lost; retained queue behaviors are not equivalent replacements. All source-file commands remain valid. No fresh execution or measured-budget evidence is claimed. Historical prior account (preserved verbatim): Test-value audit removes the retired suite and its active selectors/assertions. Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1686 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Attach two browser hosts and require unqualified selection to fail ambiguous while exact selection succeeds. Reject a second identity on one connection and a fifth identity for one paired device, release one exact lease, then admit its replacement without starving another device. Admit four hosts from one authenticated device and a host from a second, reject the first device's fifth host, and release only the first device's exact counters while the second remains live. Fill asks and hosts to their shared ceiling, retain a quarter of the total budget for ordinary waits, close both sockets, and prove every global, class, and device counter releases. Reject one initial host attach with the unchanged runtime_busy response, then require bounded client-specific jitter to attach when capacity returns; repeated rejection and explicit close must release every timer and subscription. Replace one same-device connection, require the old subscription and route to fence, then prove late old cleanup leaves the new generation live. Mint an exact execution-host grant, reject a different key, prove late old grant cleanup leaves its replacement, and invalidate every grant with lease replacement. Reject client-to-client, client-to-server, server-to-server, and server-to-client placement overwrite until exact retirement. Begin retirement once idempotently, reject client use and every replacement while pending, cancel the exact token to restore the same placement, and reject delayed cancellation or completion after a newer retirement begins. On explicit release, replacement, legacy disconnect, and reconnect-grace expiry, require only the exact host generation's client placements to become non-cancellable retirement-pending before lease settlement; preserve negotiated grace, other hosts, server placements, replacements, and capacity until exact completion. Complete only the exact pending token, retain capacity until completion, and require a reused client page ID to receive a higher global generation without retaining a tombstone. Require a client page through the exact runtime, epoch, host, and page tuple; reject every mismatch, released or replaced leases, retirement-pending pages, retired pages, server placements, invalid identities, and the 257th live placement. Admit 1024 opens in one monotonic 10-second window and reject the 1025th until the window expires. Fill 8 MiB across destination-to-client queues and separately across unsettled client-to-destination writes, release one exact retired stream, admit one replacement, and require the next byte claim to close the route without stale-callback or reentrant-close underflow. Across multiple routes, charge application copies, encrypted queue entries, and dynamic native socket bytes to one 32 MiB browser-host and 128 MiB process ceiling; reject zero-byte claim/socket-source floods, fence released leases, synchronously release JavaScript queue claims while retaining native claims through exact socket close, and yield a parked queue after four frames without reordering. Route nested responses by exact ID under reordering, reject unknown and duplicate IDs, cap pending requests and queued bytes, and tear down every concurrent waiter once on timeout or close. Drive one real paired attach, command, and result through one exact connection ID; reject missing send support and malformed or wrong-runtime acknowledgements while preserving old non-v1 attaches. Drop an authenticated transport, require the same listener to reject CONNECT before and during reconnect, attach the exact existing native v1 payload and capability pair to a strictly newer generation, ignore late old callbacks, and roll an exhausted stream-ID ledger only by replacing the generation. Require SSH descriptors to add an execution-host capability and exact grant, reject missing grants and stale provider authority before resolver or binary registration, pass exact domains to ssh2 and system-SSH SOCKS without local resolution, sanitize connector diagnostics, and close every stream and standalone route process once on timeout, synchronous failure, or rotation. Drive the accepted lease through real paired E2EE native SOCKS-to-HTTP and ephemeral Docker ssh2 remote-only DNS journeys, then exercise exact frame, credit, half-close, stale-stream, remote-DNS, unsupported-command, offline, and teardown assertions.",
+      "oracle": "Audit5429 trims paired browser-host composition and reconnect tests. Retire composition close-order/whenClosed wiring and explicit inventory-refresh reattachment/publication/cardinality alarms without equivalent replacement. Keep generation/recovery ownership and completed-mutation replay at their existing narrower scope. The removed composition close assertion is retired; surviving file commands remain valid selectors. No fresh full-gate execution or validation of reduced selectors is claimed. All three unrelated complete dated receipts retain their original exact fields and scope. Historical prior account (preserved verbatim): Audit4014 removes the complete browser client page command integration suite and its active command token, test selector and assertion reference. Its synthetic guest lifecycle still exercised real executor/dispatcher/Session/WebContents registry composition: navigation normalization, generation reclaim, spontaneous destruction inventory revocation, and exactly-once route/policy retirement alarms are intentionally lost. Electron guest navigation, proxy resolution and renderer lifecycle were supplied test ports; no equivalent replacement or fresh execution is claimed. The three unrelated active dated receipts and all prior historical strings remain unchanged. Historical prior account (preserved verbatim): Test-value audit3842 retires four ws-outbound queue unit probes: direct empty-queue send failure, configured drain quantum/zero-delay reschedule, injected aggregate claim/release accounting, and supplied unwritable drain guard. Their exact alarms are intentionally lost; retained queue behaviors are not equivalent replacements. All source-file commands remain valid. No fresh execution or measured-budget evidence is claimed. Historical prior account (preserved verbatim): Test-value audit removes the retired suite and its active selectors/assertions. Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed. Module layout SSH policy: Retire the dynamic-forward launch argument/default inventory. The retained actual startup-cancellation entry case covers cancellation classification and termination/probe cleanup requests with supplied process/socket boundaries, not real SSH launch flags or live forwarding. Remove only the retired launch-flags assertion; unrelated dated receipts and their executed commands remain unchanged. Historical prior account (preserved verbatim): Audit2133 current-parent preparation: Current reduced sources/selectors intentionally retire the alarms listed in knownGaps; prior dated runs and replacement claims do not validate the changed set. Historical prior account (preserved verbatim): Audit1991: Remove the ordinary browser-host release/sub-cap and exact socket-close counter aliases. Retain the two actual admitted-device fairness and shared ask/browser/wait budget callbacks, which call server handlers with fake WebSockets and controlled pending RPCs. Preserve all3 unrelated dated receipts. No real browser placement or remote tunnel deployment is proved by this admission suite. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, physical provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1983: Delete the mocked browser placement mutation and projection suites and both prospective selectors. Preserve3 unrelated receipts. Changed-source prior results do not validate reduced-source bytes. No fresh execution, equivalent replacement, red/green, measured budget, soak, provider/PTY, rendered, live remote/mobile or cross-platform result is claimed. Historical prior account (preserved verbatim): Audit1973: Remove stale production-registration and negotiated metadata aliases, compound refusal/cleanup aliases, isolated descriptor/route/memory/cleanup microcases. Retain exact negotiated command settlement, duplicate/conflict fencing, ready/replay ordering, superseded-connection cleanup, second-host refusal, ungranted target refusal, public connector redaction, revocation race and route replacement aliases within injected-port scope. Reconciliation and all3 unrelated dated receipts remain unchanged. Whole original changed dated receipts are retired, never narrowed or transferred. This metadata review claims no fresh execution, equivalent replacement, provider/PTY, live remote/mobile, rendered, cross-platform, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1918 narrows browser-host-command-ledger-capacity: intentionally loses injected per-page/global cache expiry-count ceilings and authority/command/result cloning inventory alarms. Retain valid commands/testFile and the oversized-wire pre-admission and delivery-failure outstanding-outcome assertions, backed by unchanged retained real-ledger callbacks with supplied browser delivery. These survivors are not equivalent replacement coverage for the deleted cache/cloning examples. Existing three exact unrelated tunnel/wire receipts retain their original scope; no fresh reduced-gate, real browser/provider, native/platform, soak or measured-budget result is added. Historical prior account (preserved verbatim): Audit1900 reduces ws-outbound-backpressure-queue by seven authored definitions while retaining ten. Current source19 assertions still describe distinct direct/queued aggregate admission, cooperative drain ordering and aggregate claim release. Existing commands, testFiles and all three source19 assertions remain valid and unchanged. The affected2026-11-04 Linux44tests/4files/5.58s receipt is retired whole as historical evidence. The other three unchanged-selector browser receipts retain their exact original scope. Reduced selectors have no fresh integrated, physical-device, mixed-host, soak or measured-budget result. Historical prior account (preserved verbatim): Audit1709 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1687 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: Audit1686 retires changed-source assertion and execution scope without equivalent replacement coverage. Existing unchanged-selector receipts remain scoped to their original sources. Historical prior-source oracle: The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): The retained unchanged-source receipts are the only current execution evidence; reduced-source assertions await validation. Historical oracle account (not a current claim for changed sources): Attach two browser hosts and require unqualified selection to fail ambiguous while exact selection succeeds. Reject a second identity on one connection and a fifth identity for one paired device, release one exact lease, then admit its replacement without starving another device. Admit four hosts from one authenticated device and a host from a second, reject the first device's fifth host, and release only the first device's exact counters while the second remains live. Fill asks and hosts to their shared ceiling, retain a quarter of the total budget for ordinary waits, close both sockets, and prove every global, class, and device counter releases. Reject one initial host attach with the unchanged runtime_busy response, then require bounded client-specific jitter to attach when capacity returns; repeated rejection and explicit close must release every timer and subscription. Replace one same-device connection, require the old subscription and route to fence, then prove late old cleanup leaves the new generation live. Mint an exact execution-host grant, reject a different key, prove late old grant cleanup leaves its replacement, and invalidate every grant with lease replacement. Reject client-to-client, client-to-server, server-to-server, and server-to-client placement overwrite until exact retirement. Begin retirement once idempotently, reject client use and every replacement while pending, cancel the exact token to restore the same placement, and reject delayed cancellation or completion after a newer retirement begins. On explicit release, replacement, legacy disconnect, and reconnect-grace expiry, require only the exact host generation's client placements to become non-cancellable retirement-pending before lease settlement; preserve negotiated grace, other hosts, server placements, replacements, and capacity until exact completion. Complete only the exact pending token, retain capacity until completion, and require a reused client page ID to receive a higher global generation without retaining a tombstone. Require a client page through the exact runtime, epoch, host, and page tuple; reject every mismatch, released or replaced leases, retirement-pending pages, retired pages, server placements, invalid identities, and the 257th live placement. Admit 1024 opens in one monotonic 10-second window and reject the 1025th until the window expires. Fill 8 MiB across destination-to-client queues and separately across unsettled client-to-destination writes, release one exact retired stream, admit one replacement, and require the next byte claim to close the route without stale-callback or reentrant-close underflow. Across multiple routes, charge application copies, encrypted queue entries, and dynamic native socket bytes to one 32 MiB browser-host and 128 MiB process ceiling; reject zero-byte claim/socket-source floods, fence released leases, synchronously release JavaScript queue claims while retaining native claims through exact socket close, and yield a parked queue after four frames without reordering. Route nested responses by exact ID under reordering, reject unknown and duplicate IDs, cap pending requests and queued bytes, and tear down every concurrent waiter once on timeout or close. Drive one real paired attach, command, and result through one exact connection ID; reject missing send support and malformed or wrong-runtime acknowledgements while preserving old non-v1 attaches. Drop an authenticated transport, require the same listener to reject CONNECT before and during reconnect, attach the exact existing native v1 payload and capability pair to a strictly newer generation, ignore late old callbacks, and roll an exhausted stream-ID ledger only by replacing the generation. Require SSH descriptors to add an execution-host capability and exact grant, reject missing grants and stale provider authority before resolver or binary registration, pass exact domains to ssh2 and system-SSH SOCKS without local resolution, sanitize connector diagnostics, and close every stream and standalone route process once on timeout, synchronous failure, or rotation. Drive the accepted lease through real paired E2EE native SOCKS-to-HTTP and ephemeral Docker ssh2 remote-only DNS journeys, then exercise exact frame, credit, half-close, stale-stream, remote-DNS, unsupported-command, offline, and teardown assertions.",
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts",
@@ -4854,8 +4854,7 @@
           "file": "src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts",
           "assertions": [
             "waits for old handlers and ignores their late callbacks before replacement",
-            "keeps one command gate across repeated loss while fencing stale route recovery",
-            "fails closed without racing page cleanup when handlers do not settle"
+            "keeps one command gate across repeated loss while fencing stale route recovery"
           ]
         },
         {
@@ -5175,7 +5174,8 @@
         "Historical dynamic-forward assertion metadata before inventory retirement, preserved verbatim:\n{\n          \"file\": \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n          \"assertions\": [\n            \"system SSH uses BatchMode=yes, disables ControlMaster, and positions one dynamic forward before the destination\",\n            \"authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately\"\n          ]\n        }",
         "Audit3381 intentionally removes the entire browser network tunnel protocol suite and active selectors/assertion. Static envelope/dispatch protocol alarms are lost without equivalent replacement. Remaining tunnel session and stream tests have narrower scopes. All three unrelated complete dated receipts are preserved verbatim with their original selectors; no fresh execution claimed.\nOriginal active selector fields, historical raw native JSON values:\ncommands: [\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime/remote-runtime-client.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/remote-runtime-client.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts src/main/browser/network/execution-routes/browser-network-execution-route.test.ts src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts src/main/ssh/system-transport/forwarding/system-ssh-forward-process.test.ts src/main/ssh/system-transport/system-ssh-operations.test.ts src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n        \"ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\",\n        \"ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 node_modules/.bin/vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\"\n      ]\ntestFiles: [\n        \"src/main/browser/routing/guest-authority/browser-route-webcontents-registry.test.ts\",\n        \"src/main/runtime/browser/client-pages/runtime-browser-client-page-recovery.test.ts\",\n        \"src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts\",\n        \"src/main/runtime/browser-host/reconciliation/browser-host-page-retirement.test.ts\",\n        \"src/main/runtime/browser-host/reconciliation/browser-host-page-placement-replacement.test.ts\",\n        \"src/main/runtime/browser-host/reconciliation/browser-host-page-placement.test.ts\",\n        \"src/main/runtime/browser-host/commands/browser-host-command-ledger.test.ts\",\n        \"src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts\",\n        \"src/main/runtime/browser-host/leases/browser-host-lease-registry.test.ts\",\n        \"src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n        \"src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n        \"src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts\",\n        \"src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts\",\n        \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts\",\n        \"src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts\",\n        \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts\",\n        \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts\",\n        \"src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n        \"src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts\",\n        \"src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts\",\n        \"src/main/browser/client-pages/lifecycle/browser-client-page-inventory.test.ts\",\n        \"src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n        \"src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n        \"src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts\",\n        \"src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts\",\n        \"src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts\",\n        \"src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts\",\n        \"src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts\",\n        \"src/main/browser/network/execution-routes/browser-network-execution-route.test.ts\",\n        \"src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts\",\n        \"src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts\",\n        \"src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts\",\n        \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n        \"src/main/ssh/port-forwarding/ssh-port-forward.test.ts\",\n        \"src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n        \"src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts\",\n        \"src/main/runtime/browser/network/browser-network-tunnel-paired-runtime.integration.test.ts\",\n        \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n        \"src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n        \"src/shared/ws-outbound-backpressure-queue.test.ts\",\n        \"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\"\n      ]\nassertionRefs: [\n        {\n          \"file\": \"src/main/runtime/rpc/server/runtime-rpc-browser-host-admission.test.ts\",\n          \"assertions\": [\n            \"one paired device cannot consume the second device's reserved browser-host share\",\n            \"asks and browser hosts share a ceiling that retains one quarter of total capacity for waits\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/leases/paired-runtime-browser-host-lease.test.ts\",\n          \"assertions\": [\"closes a subscription acquired after local teardown\"]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts\",\n          \"assertions\": [\n            \"an acknowledged mutation replay uses the preserved dispatcher result without rerunning its handler\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts\",\n          \"assertions\": [\n            \"waits for old handlers and ignores their late callbacks before replacement\",\n            \"keeps one command gate across repeated loss while fencing stale route recovery\",\n            \"fails closed without racing page cleanup when handlers do not settle\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-pages/execution/browser-client-page-command-executor.test.ts\",\n          \"assertions\": [\"holds Session and route release for the exact destroyed acknowledgement\"]\n        },\n        {\n          \"file\": \"src/main/browser/client-pages/lifecycle/browser-client-page-reconciliation-adapters.test.ts\",\n          \"assertions\": [\n            \"destroys a guest rekeyed during an authority transition instead of granting navigation\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/routing/sessions/browser-route-prepared-page-rekey.test.ts\",\n          \"assertions\": [\n            \"prepared authority rekeys without changing its opaque capability token\",\n            \"stale, occupied, cross-page, and cross-renderer targets fail without mutation\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-pages/execution/browser-client-page-command-integration.test.ts\",\n          \"assertions\": [\n            \"spontaneous exact guest destruction revokes active inventory before explicit page retirement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-registry.test.ts\",\n          \"assertions\": [\"keeps a failed authority transition tombstoned until cleanup settles\"]\n        },\n        {\n          \"file\": \"src/main/browser/network/client-routes/browser-client-network-route-registry.test.ts\",\n          \"assertions\": [\n            \"retains one exact route until its final page releases it\",\n            \"keeps an ambiguously closed route fenced until final registry cleanup\",\n            \"retires old authority routes without destroying them before exact page cleanup\",\n            \"aborts a stale route recovery without retaining its retry timer\",\n            \"fails bounded recovery after one route exhausts grace without leaking timers\",\n            \"mints a fresh route for a retain that lands while the previous one is closing\",\n            \"waits for a route still closing before reporting retirement\",\n            \"rejects a retain the moment its signal aborts mid-startup\",\n            \"refuses a retain that waited out a closing route onto a retired registry\",\n            \"reports a failed final cleanup to an awaiting retirement\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/client-hosts/commands/browser-client-host-command-dispatcher.test.ts\",\n          \"assertions\": [\n            \"keeps a timed-out retirement fenced until its handler actually settles\",\n            \"bounds close while canceling queued and non-cooperative handlers\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/browser-host/commands/browser-host-command-ledger-capacity.test.ts\",\n          \"assertions\": [\n            \"oversized wire payloads fail before page, sequence, or delivery admission\",\n            \"new issue delivery failure closes the ledger and fences every outstanding outcome\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/browser/browser-client-host.test.ts\",\n          \"assertions\": [\n            \"negotiated exact reattach emits ready before replaying the unchanged unsettled command\",\n            \"reattach before old cleanup preserves the same authority and ends only the superseded connection stream\",\n            \"only the exact negotiated connection, paired device, and live page placement can settle a server-owned command\",\n            \"exact duplicate results are idempotent while conflicts and stale or retired placement fail closed\",\n            \"a second browser-host identity on one authenticated connection is rejected\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/browser/browser-client-host-reconciliation.test.ts\",\n          \"assertions\": [\n            \"command result settlement requires the exact negotiated reconciliation authority\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/browser/network/tunnels/browser-network-tunnel-protocol.test.ts\",\n          \"assertions\": [\n            \"remote DNS names round-trip without client resolution\",\n            \"unknown versions, opcodes, oversized payloads, and length mismatches fail closed\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-session.test.ts\",\n          \"assertions\": [\n            \"replenishes client credit only after the destination write settles\",\n            \"keeps concurrent streams alive when late data arrives for a retired stream\",\n            \"flushes credited destination bytes before close\",\n            \"caps aggregate retained destination bytes and releases exact stream accounting\",\n            \"caps unsettled destination writes and releases retirement exactly once\",\n            \"releases queued bytes once when an accepted send closes reentrantly\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-session-aggregate-memory.test.ts\",\n          \"assertions\": [\n            \"multiple execution-host routes share browser-host application-byte admission in both traffic directions\",\n            \"route close releases aggregate claims exactly before stale destination-write callbacks\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-client.test.ts\",\n          \"assertions\": [\n            \"preserves remote DNS and waits for an opened acknowledgement\",\n            \"sends only credited bytes in bounded frames and replenishes consumed input\",\n            \"ignores a retired stream frame but rejects a never-allocated stream ID\",\n            \"never reuses stream IDs within one generation after its bounded ledger exhausts\",\n            \"replenishes only bytes settled after the readable consumer takes them\",\n            \"fails closed when pending tiny destination frames exceed the chunk cap\",\n            \"drains data that precedes a remote close before retiring the socket\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/browser-network-tunnel-outbound-memory-budget.test.ts\",\n          \"assertions\": [\n            \"application, encrypted-queue, and native socket bytes share one host ceiling\",\n            \"distinct hosts share one process ceiling with exact release\",\n            \"zero-byte claims, socket sources, hosts, and leases have independent bounds\",\n            \"released leases cannot admit work and retained owners keep exact accounting alive\",\n            \"unavailable native-buffer evidence fails closed until its exact source releases\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/remote-browser-socks-server.test.ts\",\n          \"assertions\": [\n            \"domain CONNECT preserves the final execution-host DNS target\",\n            \"unsupported commands and unavailable routes open no fallback destination\"\n          ]\n        },\n        {\n          \"file\": \"src/main/runtime/rpc/methods/browser/browser-network-tunnel.test.ts\",\n          \"assertions\": [\n            \"ungranted or wrong-key SSH routes are rejected before resolver or binary registration\",\n            \"connector diagnostics are mapped to a stable public error without local path disclosure\",\n            \"grant revocation aborts connector startup immediately and cannot race through route admission\",\n            \"the server allocates route generations and fences the replaced route\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/execution-routes/paired-runtime-browser-network-route.test.ts\",\n          \"assertions\": [\n            \"closes a subscription that resolves after route teardown\",\n            \"settles startup when close follows subscription acquisition before readiness\",\n            \"bounds the post-auth readiness wait\",\n            \"binds and releases the exact browser-host outbound memory lease\",\n            \"keeps one listener fail-closed and accepts an increasing replacement generation\",\n            \"ignores late callbacks from a superseded transport\",\n            \"recovers again after a second transport death\",\n            \"rejects a non-increasing replacement generation and remains retryable\",\n            \"fences a ready generation even when the replacement closes before its await resumes\",\n            \"replaces the tunnel generation before recycling a bounded stream ID\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/execution-routes/browser-network-deferred-socket.test.ts\",\n          \"assertions\": [\n            \"destroy before source attachment emits one close and destroys a late source\",\n            \"source close after destroy cannot emit duplicate wrapper close\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/execution-routes/browser-network-execution-route.test.ts\",\n          \"assertions\": [\n            \"execution-host route keys cannot collide on delimiter-containing identities\",\n            \"native routing accepts only the exact runtime revision without retaining an invalidation callback\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/execution-routes/ssh-browser-network-execution-route.test.ts\",\n          \"assertions\": [\n            \"does not adopt a replacement ssh2 client under the captured authority\",\n            \"releases a deferred socket when forwardOut throws during disconnect\",\n            \"aborts system SSH startup when route authorization is revoked\",\n            \"reaches external sites over ssh2 through the host proxy and keeps local names direct\",\n            \"dials directly while the host environment is unreadable and adopts it once a retry reads it\",\n            \"reaches external sites over system SSH through the host proxy\"\n          ]\n        },\n        {\n          \"file\": \"src/main/browser/network/tunnels/system-ssh-socks-client-socket.test.ts\",\n          \"assertions\": [\n            \"the internal SOCKS5 client encodes the exact destination as a domain request\"\n          ]\n        },\n        {\n          \"file\": \"src/main/ssh/system-transport/forwarding/system-ssh-dynamic-forward-process.test.ts\",\n          \"assertions\": [\n            \"authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately\"\n          ]\n        },\n        {\n          \"file\": \"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts\",\n          \"assertions\": [\n            \"an ephemeral sshd resolves a container-only domain and returns a unique HTTP marker\",\n            \"the real ssh2 forwardOut receives that exact domain and provider loss fences the route\",\n            \"one non-interactive system-OpenSSH dynamic forward passes the same remote-only oracle and closes cleanly\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/remote-runtime/requests/remote-runtime-subscription-request.test.ts\",\n          \"assertions\": [\n            \"nested JSON responses route by exact request ID under reverse-order delivery\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/remote-runtime/remote-runtime-client.test.ts\",\n          \"assertions\": [\n            \"the authenticated socket binds the optional tunnel capability\",\n            \"the dedicated outbound queue reports hard overflow instead of dropping a frame\",\n            \"encrypted queue claims release synchronously while native socket ownership remains charged through exact close\"\n          ]\n        },\n        {\n          \"file\": \"src/shared/ws-outbound-backpressure-queue.test.ts\",\n          \"assertions\": [\n            \"direct and already-retained queued frames use distinct aggregate admission semantics\",\n            \"queued drain yields after its configured frame quantum without reordering\",\n            \"aggregate queue claims release on drain, denial, disposal, and close\"\n          ]\n        }\n      ]",
         "Test-value audit: Retire the paired-host late subscription smoke: it checks a mocked close count and startup rejection, without remote unsubscribe or successor outcomes. No equivalent replacement or fresh execution is claimed.",
-        "Test-value audit3842 removes four authored/four finite outbound queue probes and the count80 row from each of three inbound queue declarations (zero extra authored removals, three extra finite removals). Direct fast-path failure, synthetic work quantum, injected aggregate callback accounting, supplied unwritable guard, and repeated eighty-payload alarms are accepted losses without equivalent replacement claims. Remaining inbound count8 cases retain actual WeakRef/GC and FIFO/rejection observations. All three unrelated dated gate receipts retain their original command/results/counts and are not fresh validation of changed sources."
+        "Test-value audit3842 removes four authored/four finite outbound queue probes and the count80 row from each of three inbound queue declarations (zero extra authored removals, three extra finite removals). Direct fast-path failure, synthetic work quantum, injected aggregate callback accounting, supplied unwritable guard, and repeated eighty-payload alarms are accepted losses without equivalent replacement claims. Remaining inbound count8 cases retain actual WeakRef/GC and FIFO/rejection observations. All three unrelated dated gate receipts retain their original command/results/counts and are not fresh validation of changed sources.",
+        "Audit5429 removes composition close-order and explicit reconnect-refresh alarms. No replacement equivalence or full-gate execution. Retired assertion: fails closed without racing page cleanup when handlers do not settle"
       ],
       "demotionRule": "Keep experimental or demote if a self-asserted or ambiguous host can receive a route, an SSH descriptor bypasses capability, lease-bound grant, or provider-authority checks, late cleanup can remove a replacement, a route can resolve names on the desktop, exceed a byte or stream bound, replenish credit before destination settlement, accept a stale or non-increasing generation, reuse a stream ID within one generation, lose or bypass its fail-closed listener during reconnect, expose the SOCKS listener off-loopback, accept BIND/UDP, or fall back when the selected route is unavailable."
     },
diff --git a/config/scripts/ci/sharding/ci-shard-timings.json b/config/scripts/ci/sharding/ci-shard-timings.json
index d9b8ba5e795..9250f1df917 100644
--- a/config/scripts/ci/sharding/ci-shard-timings.json
+++ b/config/scripts/ci/sharding/ci-shard-timings.json
@@ -4097,8 +4097,6 @@
       "src/renderer/src/components/NewWorkspaceComposerCard.set-location.test.tsx": 1301,
       "src/renderer/src/components/SelectedTextCopyMenu.test.tsx": 329,
       "src/renderer/src/components/UpdateCard.error-card.test.tsx": 2851,
-      "src/renderer/src/components/UpdateCard.test.ts": 694,
-      "src/renderer/src/components/WorktreeBaseFallbackDialog.test.tsx": 2104,
       "src/renderer/src/components/activity/activity-auto-mark-read-loop.react185.test.tsx": 5607,
       "src/renderer/src/components/activity/activity-clear-completed-hmr.test.ts": 814,
       "src/renderer/src/components/activity/activity-clear-completed-state-lifetime.test.ts": 4609,
diff --git a/src/cli/orchestration/identity/orchestration-caller-identity-cli.test.ts b/src/cli/orchestration/identity/orchestration-caller-identity-cli.test.ts
index 0ad16f94cb8..959a87a6893 100644
--- a/src/cli/orchestration/identity/orchestration-caller-identity-cli.test.ts
+++ b/src/cli/orchestration/identity/orchestration-caller-identity-cli.test.ts
@@ -47,14 +47,6 @@ describe('orchestration dispatch coordinator handle', () => {
       json
     } as never)
 
-  const invokeRun = (flags: Map<string, string | boolean>) =>
-    ORCHESTRATION_HANDLERS['orchestration coordinator-start']({
-      flags,
-      client: { call: callMock },
-      cwd: '/tmp/repo',
-      json: true
-    } as never)
-
   it('rejects stale coordinator env handles when the caller pane cannot be proven', async () => {
     process.env.ORCA_TERMINAL_HANDLE = 'term_stale_coord'
     callMock.mockRejectedValueOnce(staleHandleError())
@@ -74,51 +66,4 @@ describe('orchestration dispatch coordinator handle', () => {
     expect(callMock).toHaveBeenCalledTimes(1)
     expect(getTerminalHandleMock).not.toHaveBeenCalled()
   })
-
-  it('retires the legacy coordinator command without runtime effects', async () => {
-    await expect(
-      invokeRun(new Map<string, string | boolean>([['spec', 'run the plan']]))
-    ).rejects.toMatchObject({
-      code: 'orchestration_migration_required',
-      data: {
-        reason: 'command_retired',
-        effectsApplied: false,
-        nextCommandArgs: ['skills', 'get', 'orchestration', '--full']
-      }
-    })
-    expect(callMock).not.toHaveBeenCalled()
-  })
-})
-
-describe('orchestration task-create caller handle', () => {
-  beforeEach(() => {
-    callMock.mockReset()
-    getTerminalHandleMock.mockReset()
-    delete process.env.ORCA_TERMINAL_HANDLE
-    delete process.env.ORCA_PANE_KEY
-  })
-
-  const invokeTaskCreate = (flags: Map<string, string | boolean>) =>
-    ORCHESTRATION_HANDLERS['orchestration task-create']({
-      flags,
-      client: { call: callMock },
-      cwd: '/tmp/repo',
-      json: true
-    } as never)
-
-  it('fails closed when a stale task creator handle cannot be reminted', async () => {
-    process.env.ORCA_TERMINAL_HANDLE = 'term_stale'
-    callMock.mockRejectedValueOnce(staleHandleError())
-    getTerminalHandleMock.mockResolvedValue('term_wrong_active')
-
-    await expect(
-      invokeTaskCreate(new Map<string, string | boolean>([['spec', 'do work']]))
-    ).rejects.toMatchObject({ code: 'no_active_sender_terminal' })
-
-    expect(callMock).toHaveBeenNthCalledWith(1, 'terminal.resolveIdentity', {
-      terminal: 'term_stale'
-    })
-    expect(getTerminalHandleMock).not.toHaveBeenCalled()
-    expect(callMock).toHaveBeenCalledTimes(1)
-  })
 })
diff --git a/src/cli/orchestration/identity/orchestration-session-caller-cli.test.ts b/src/cli/orchestration/identity/orchestration-session-caller-cli.test.ts
deleted file mode 100644
index bb88c63d84a..00000000000
--- a/src/cli/orchestration/identity/orchestration-session-caller-cli.test.ts
+++ /dev/null
@@ -1,139 +0,0 @@
-// Inherited pane identity and an available sibling must never override the injected session caller.
-
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-
-const callMock = vi.hoisted(() => vi.fn())
-const getTerminalHandleMock = vi.hoisted(() => vi.fn())
-
-vi.mock('../../output/command-result-output', () => ({ printResult: vi.fn() }))
-vi.mock('../../terminals/terminal-selector', () => ({ getTerminalHandle: getTerminalHandleMock }))
-
-import { ORCHESTRATION_HANDLERS } from '../orchestration-handlers'
-import { findCommandSpec } from '../../arguments/args'
-import { COMMAND_SPECS } from '../../specs/index'
-import { refuseConflictingSessionCallerFlags } from './session-caller-flags'
-import { createOrchestrationCompatibilityEnvelope } from './orchestration-compatibility-envelope'
-
-const SESSION = 'f7a1c0de-1111-4222-8333-444455556666'
-const IDENTITY_ENV = [
-  'ORCA_AGENT_SESSION_ID',
-  'ORCA_TERMINAL_HANDLE',
-  'ORCA_PANE_KEY',
-  'ORCA_STRUCTURED_SESSION'
-] as const
-const originalEnv = Object.fromEntries(IDENTITY_ENV.map((name) => [name, process.env[name]]))
-
-const RESULT = {
-  result: {
-    run: { id: 'run_1', objective: 'o', consumer_generation: 1 },
-    runs: [],
-    nextCursor: null,
-    messages: [],
-    count: 0,
-    message: { id: 'msg_1' },
-    lifecycle: { action: 'completed' },
-    dispatch: { id: 'dispatch_1', task_id: 'task_1', status: 'dispatched' },
-    gate: { id: 'gate_1', task_id: 'task_1', status: 'pending', resolution: 'r' },
-    gates: [],
-    task: { id: 'task_1', status: 'pending' },
-    tasks: [],
-    answer: 'yes',
-    messageId: 'msg_1',
-    threadId: 'thread_1',
-    timedOut: false,
-    state: 'ready',
-    runId: 'run_1',
-    taskId: 'task_1',
-    dispatchId: 'dispatch_1',
-    effects: [],
-    residualResources: [],
-    workers: [],
-    counts: {}
-  }
-}
-
-/** dispatch-show is excluded: its --from fills preview text rather than naming the caller. */
-
-function flagMap(flags: Record<string, string | true>): Map<string, string | boolean> {
-  return new Map(Object.entries(flags))
-}
-
-async function invoke(
-  command: string,
-  flags: Map<string, string | boolean>,
-  json = true
-): Promise<void> {
-  const handler = ORCHESTRATION_HANDLERS[`orchestration ${command}`]
-  if (!handler) {
-    throw new Error(`no handler for ${command}`)
-  }
-  refuseConflictingSessionCallerFlags(
-    findCommandSpec(COMMAND_SPECS, ['orchestration', command]),
-    flags
-  )
-  await handler({
-    flags,
-    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: these handlers read only `call`; RuntimeClient is a class, so a structural double cannot satisfy it without the cast.
-    client: { call: callMock } as never,
-    cwd: '/tmp/repo',
-    json
-  })
-}
-
-function setEnv(env: Partial<Record<(typeof IDENTITY_ENV)[number], string>>): void {
-  for (const name of IDENTITY_ENV) {
-    const value = env[name]
-    if (value === undefined) {
-      delete process.env[name]
-    } else {
-      process.env[name] = value
-    }
-  }
-}
-
-beforeEach(() => {
-  callMock.mockReset().mockResolvedValue(RESULT)
-  getTerminalHandleMock.mockReset().mockResolvedValue('term_sibling')
-  vi.spyOn(console, 'log').mockImplementation(() => {})
-  vi.spyOn(console, 'error').mockImplementation(() => {})
-})
-
-afterEach(() => {
-  vi.restoreAllMocks()
-  setEnv(originalEnv)
-  process.exitCode = undefined
-})
-
-describe('the identity a session presents', () => {
-  it('keeps the identity-less refusal, without --from advice, for a child that has no id', async () => {
-    setEnv({ ORCA_STRUCTURED_SESSION: '1' })
-
-    await expect(invoke('reply', flagMap({ id: 'msg_1', body: 'b' }))).rejects.toMatchObject({
-      code: 'no_active_sender_terminal',
-      message: expect.not.stringContaining('Pass --from')
-    })
-    expect(getTerminalHandleMock).not.toHaveBeenCalled()
-    expect(callMock).not.toHaveBeenCalled()
-  })
-})
-
-describe('the orchestration envelope', () => {
-  it('carries the injected id beside whatever terminal evidence the process also has', () => {
-    const envelope = createOrchestrationCompatibilityEnvelope({
-      ORCA_AGENT_SESSION_ID: ` ${SESSION} `,
-      ORCA_TERMINAL_HANDLE: 'term_inherited_pane'
-    })
-
-    expect(envelope.orchestrationCompatibilityEvidence).toEqual({
-      terminalHandle: 'term_inherited_pane',
-      agentSessionId: SESSION
-    })
-  })
-
-  it('claims no session without an injected id', () => {
-    expect(
-      createOrchestrationCompatibilityEnvelope({ ORCA_AGENT_SESSION_ID: '  ' })
-        .orchestrationCompatibilityEvidence
-    ).toBeUndefined()
-  })
-})
diff --git a/src/main/browser/client-hosts/lifecycle/browser-client-host-id.test.ts b/src/main/browser/client-hosts/lifecycle/browser-client-host-id.test.ts
deleted file mode 100644
index 4971a8aaf03..00000000000
--- a/src/main/browser/client-hosts/lifecycle/browser-client-host-id.test.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-import { mkdtempSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import type * as BrowserClientHostIdModule from './browser-client-host-id'
-
-function profileDirectory(): string {
-  return mkdtempSync(join(tmpdir(), 'orca-host-id-'))
-}
-
-async function freshModule(): Promise<typeof BrowserClientHostIdModule> {
-  vi.resetModules()
-  return await import('./browser-client-host-id')
-}
-
-afterEach(() => {
-  vi.restoreAllMocks()
-  vi.resetModules()
-})
-
-describe('browser client host id', () => {
-  it('answers the same durable id to every launch of one profile', async () => {
-    const directory = profileDirectory()
-
-    const first = await freshModule()
-    first.initializeBrowserClientHostId(directory)
-    const second = await freshModule()
-    second.initializeBrowserClientHostId(directory)
-
-    expect(first.getBrowserClientHostId()).toBe(second.getBrowserClientHostId())
-  })
-
-  it('keeps the id a renderer already holds when startup resolves the profile too late', async () => {
-    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const module = await freshModule()
-
-    const stamped = module.getBrowserClientHostId()
-    module.initializeBrowserClientHostId(profileDirectory())
-
-    expect(module.getBrowserClientHostId()).toBe(stamped)
-    expect(warn).toHaveBeenCalled()
-  })
-})
diff --git a/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts b/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts
index 9d0fe1d60aa..e226cbc1e2c 100644
--- a/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts
+++ b/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-composition.test.ts
@@ -84,37 +84,6 @@ describe('PairedRuntimeBrowserClientHostComposition', () => {
     expect(rig.routes.reconnect).toHaveBeenCalledTimes(2)
     expect(rig.executor.handle).toHaveBeenCalledOnce()
   })
-
-  it('fails closed without racing page cleanup when handlers do not settle', async () => {
-    const rig = createRig({ hostSettled: false })
-    const composition = rig.createComposition()
-    await composition.start()
-
-    await expect(composition.close()).resolves.toBe(false)
-
-    expect(rig.order).toEqual([
-      'activate-routes',
-      'closing',
-      'suspend-routes',
-      'fence-navigation',
-      'close-host',
-      'close-routes'
-    ])
-    expect(rig.executor.close).not.toHaveBeenCalled()
-
-    rig.settleHandlers()
-    await composition.whenClosed()
-
-    expect(rig.order).toEqual([
-      'activate-routes',
-      'closing',
-      'suspend-routes',
-      'fence-navigation',
-      'close-host',
-      'close-routes',
-      'close-executor'
-    ])
-  })
 })
 
 function createRig(
diff --git a/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts b/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts
index 3e485a8e74c..d6ab5eda4c2 100644
--- a/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts
+++ b/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-client-host-reconnect.test.ts
@@ -33,41 +33,6 @@ afterEach(() => {
 })
 
 describe('PairedRuntimeBrowserClientHost reconnect', () => {
-  it('reattaches once with the refreshed unavailable-page inventory', async () => {
-    const attempts = mockAttempts()
-    let state: 'active' | 'outcomeUnknown' = 'active'
-    const host = new PairedRuntimeBrowserClientHost({
-      connection: pairedRuntimeConnectionFromOffer(pairing),
-      authorityRuntimeId: 'runtime-a',
-      browserHostClientId: 'host-a',
-      hostCapabilities: ['webview'],
-      handler: vi.fn(() => ({ status: 'completed' as const })),
-      getPageInventory: () => [inventoryPage(state)],
-      pageReconciliationProtocolVersion: 1,
-      reconnectRetryDelayMs: 1
-    })
-    const starting = host.start()
-    await vi.waitFor(() => expect(attempts).toHaveLength(1))
-    expect(subscribeRemoteRuntimeRequestMock.mock.calls[0]?.[2]).toMatchObject({
-      pageInventory: [expect.objectContaining({ state: 'active' })]
-    })
-    attempts[0]!.callbacks.onResponse(readyResponse({ reconciliation: true }))
-    await starting
-
-    state = 'outcomeUnknown'
-    const refreshing = host.refreshPageInventory()
-    await vi.waitFor(() => expect(attempts).toHaveLength(2))
-    expect(attempts[0]!.close).toHaveBeenCalledOnce()
-    expect(subscribeRemoteRuntimeRequestMock.mock.calls[1]?.[2]).toMatchObject({
-      pageInventory: [expect.objectContaining({ state: 'outcomeUnknown' })]
-    })
-    attempts[1]!.callbacks.onResponse(readyResponse({ reconciliation: true }))
-
-    await expect(refreshing).resolves.toBeUndefined()
-    expect(attempts).toHaveLength(2)
-    await host.close()
-  })
-
   it('replays a completed mutation without executing its handler twice', async () => {
     const attempts = mockAttempts()
     const handler = vi.fn(() => ({ status: 'completed' as const }))
@@ -139,7 +104,7 @@ function mockAttempts(): {
   return attempts
 }
 
-function readyResponse(options: { reconciliation?: boolean } = {}) {
+function readyResponse() {
   return {
     id: 'browser-host',
     ok: true as const,
@@ -149,27 +114,12 @@ function readyResponse(options: { reconciliation?: boolean } = {}) {
       browserHostGeneration: 4,
       pageCommandProtocolVersion: 1 as const,
       pageInventoryProtocolVersion: 1 as const,
-      leaseReconnectProtocolVersion: 1 as const,
-      ...(options.reconciliation ? { pageReconciliationProtocolVersion: 1 as const } : {})
+      leaseReconnectProtocolVersion: 1 as const
     },
     _meta: { runtimeId: 'runtime-a' }
   }
 }
 
-function inventoryPage(state: 'active' | 'outcomeUnknown') {
-  return {
-    authorityRuntimeId: 'runtime-a',
-    authorityEpoch: 'epoch-a',
-    browserHostClientId: 'host-a',
-    browserHostGeneration: 4,
-    browserPageId: 'page-a',
-    pageHostGeneration: 1,
-    browserProfileId: 'default',
-    executionHostKey: 'native:runtime-a:1',
-    state
-  } as const
-}
-
 function commandResponse() {
   return {
     id: 'browser-host',
diff --git a/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-host-command-admission.test.ts b/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-host-command-admission.test.ts
deleted file mode 100644
index 1728d75ba89..00000000000
--- a/src/main/browser/client-hosts/lifecycle/paired-runtime-browser-host-command-admission.test.ts
+++ /dev/null
@@ -1,232 +0,0 @@
-import type { subscribeRemoteRuntimeTransport } from '../../../../shared/remote-runtime/requests/remote-runtime-subscription-transport'
-import { pairedRuntimeConnectionFromOffer } from '../../../../shared/remote-runtime/pairing/paired-runtime-connection'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import type { PairingOffer } from '../../../../shared/remote-runtime/pairing/mobile-relay-pairing-offer'
-import type {
-  RemoteRuntimeTransportSubscription,
-  RemoteRuntimeTransportSubscriptionCallbacks
-} from '../../../../shared/remote-runtime/requests/remote-runtime-subscription-contract'
-
-const { subscribeRemoteRuntimeRequestMock } = vi.hoisted(() => ({
-  subscribeRemoteRuntimeRequestMock: vi.fn()
-}))
-
-vi.mock('../../../../shared/remote-runtime/requests/remote-runtime-subscription-transport', () => ({
-  subscribeRemoteRuntimeTransport: subscribeRemoteRuntimeRequestMock
-}))
-
-import { PairedRuntimeBrowserHostLease } from '../leases/paired-runtime-browser-host-lease'
-import type { PairedRuntimeBrowserHostLeaseOptions } from '../leases/paired-runtime-browser-host-lease-options'
-
-const pairing = {
-  v: 2,
-  endpoint: 'ws://127.0.0.1:6768',
-  deviceToken: 'device-token',
-  publicKeyB64: 'public-key',
-  pairedDeviceId: 'device-a',
-  scope: 'runtime'
-} as PairingOffer
-
-afterEach(() => {
-  subscribeRemoteRuntimeRequestMock.mockReset()
-  vi.restoreAllMocks()
-})
-
-describe('paired runtime browser host command admission', () => {
-  it('rejects page commands when an old host did not negotiate them', async () => {
-    const { callbacks, close } = await subscribeLease({
-      sendRequest: undefined
-    })
-    const onError = vi.fn()
-    const onPageCommand = vi.fn()
-    const lease = createLease({
-      pageCommandProtocolVersion: 1,
-      onPageCommand,
-      onError
-    })
-    const starting = lease.start()
-    await vi.waitFor(() => expect(callbacks.current).toBeDefined())
-    callbacks.current!.onResponse({
-      id: 'browser-host',
-      ok: true,
-      result: {
-        type: 'ready',
-        authorityEpoch: 'epoch-a',
-        browserHostGeneration: 4
-      },
-      _meta: { runtimeId: 'runtime-a' }
-    })
-    await starting
-
-    callbacks.current!.onResponse({
-      id: 'browser-host',
-      ok: true,
-      result: {
-        type: 'command',
-        pageCommandProtocolVersion: 1,
-        authorityRuntimeId: 'runtime-a',
-        authorityEpoch: 'epoch-a',
-        browserHostClientId: 'host-a',
-        browserHostGeneration: 4,
-        browserPageId: 'page-a',
-        pageHostGeneration: 1,
-        commandSequence: 1,
-        commandId: 'command-a',
-        command: {
-          type: 'createPage',
-          browserProfileId: 'default',
-          executionHostKey: 'native:runtime-a:1'
-        }
-      },
-      _meta: { runtimeId: 'runtime-a' }
-    })
-
-    await vi.waitFor(() => expect(close).toHaveBeenCalledOnce())
-    expect(onPageCommand).not.toHaveBeenCalled()
-    expect(onError).toHaveBeenCalledWith(
-      expect.objectContaining({
-        message: 'Unnegotiated browser host page command'
-      })
-    )
-  })
-
-  it.each([
-    ['authorityEpoch', { authorityEpoch: 'epoch-b' }],
-    ['authorityRuntimeId', { authorityRuntimeId: 'runtime-b' }],
-    ['browserHostClientId', { browserHostClientId: 'host-b' }],
-    ['browserHostGeneration', { browserHostGeneration: 5 }]
-  ])(
-    'rejects a negotiated command whose %s is stale before delivery',
-    async (_field, staleness) => {
-      const { callbacks, close } = await subscribeLease()
-      const onError = vi.fn()
-      const onPageCommand = vi.fn()
-      const lease = createLease({
-        pageCommandProtocolVersion: 1,
-        onPageCommand,
-        onError
-      })
-      const starting = lease.start()
-      await vi.waitFor(() => expect(callbacks.current).toBeDefined())
-      callbacks.current!.onResponse({
-        id: 'browser-host',
-        ok: true,
-        result: {
-          type: 'ready',
-          authorityEpoch: 'epoch-a',
-          browserHostGeneration: 4,
-          pageCommandProtocolVersion: 1
-        },
-        _meta: { runtimeId: 'runtime-a' }
-      })
-      await starting
-
-      callbacks.current!.onResponse({
-        id: 'browser-host',
-        ok: true,
-        result: {
-          type: 'command',
-          pageCommandProtocolVersion: 1,
-          authorityRuntimeId: 'runtime-a',
-          authorityEpoch: 'epoch-a',
-          browserHostClientId: 'host-a',
-          browserHostGeneration: 4,
-          browserPageId: 'page-a',
-          pageHostGeneration: 1,
-          commandSequence: 1,
-          commandId: 'command-a',
-          command: {
-            type: 'createPage',
-            browserProfileId: 'default',
-            executionHostKey: 'native:runtime-a:1'
-          },
-          ...staleness
-        },
-        _meta: { runtimeId: 'runtime-a' }
-      })
-
-      await vi.waitFor(() => expect(close).toHaveBeenCalledOnce())
-      expect(onPageCommand).not.toHaveBeenCalled()
-      expect(onError).toHaveBeenCalledWith(
-        expect.objectContaining({ message: 'Stale browser host page command' })
-      )
-    }
-  )
-
-  it('refuses an inventory refresh on a lease that never negotiated reconnect', async () => {
-    const { callbacks, close } = await subscribeLease()
-    const lease = createLease({
-      pageInventoryProtocolVersion: 1,
-      getPageInventory: () => []
-    })
-    const starting = lease.start()
-    await vi.waitFor(() => expect(callbacks.current).toBeDefined())
-    callbacks.current!.onResponse({
-      id: 'browser-host',
-      ok: true,
-      result: {
-        type: 'ready',
-        authorityEpoch: 'epoch-a',
-        browserHostGeneration: 4,
-        pageInventoryProtocolVersion: 1
-      },
-      _meta: { runtimeId: 'runtime-a' }
-    })
-    await starting
-
-    await expect(lease.refreshPageInventory()).rejects.toThrow(
-      'Browser host inventory refresh is unavailable'
-    )
-    expect(close).not.toHaveBeenCalled()
-    await lease.close()
-  })
-})
-
-function createLease(
-  overrides: Partial<PairedRuntimeBrowserHostLeaseOptions> = {}
-): PairedRuntimeBrowserHostLease {
-  return new PairedRuntimeBrowserHostLease({
-    connection: pairedRuntimeConnectionFromOffer(pairing),
-    authorityRuntimeId: 'runtime-a',
-    browserHostClientId: 'host-a',
-    hostCapabilities: ['webview'],
-    ...overrides
-  })
-}
-
-async function subscribeLease(options?: {
-  sendRequest?: RemoteRuntimeTransportSubscription['sendRequest']
-}): Promise<{
-  callbacks: { current?: RemoteRuntimeTransportSubscriptionCallbacks }
-  close: ReturnType<typeof vi.fn>
-}> {
-  const callbacks: { current?: RemoteRuntimeTransportSubscriptionCallbacks } = {}
-  const close = vi.fn()
-  const sendRequest =
-    options && 'sendRequest' in options
-      ? options.sendRequest
-      : vi.fn().mockResolvedValue({
-          id: 'command-result',
-          ok: true,
-          result: { accepted: true },
-          _meta: { runtimeId: 'runtime-a' }
-        })
-  subscribeRemoteRuntimeRequestMock.mockImplementationOnce(
-    async (
-      ...args: Parameters<typeof subscribeRemoteRuntimeTransport>
-    ): Promise<RemoteRuntimeTransportSubscription> => {
-      callbacks.current = args[4]
-      return {
-        requestId: 'browser-host',
-        close,
-        sendBinary: () => false,
-        ...(sendRequest
-          ? {
-              sendRequest: sendRequest
-            }
-          : {})
-      }
-    }
-  )
-  return { callbacks, close }
-}
diff --git a/src/renderer/src/components/UpdateCard.test.ts b/src/renderer/src/components/UpdateCard.test.ts
deleted file mode 100644
index 14868a1ebb2..00000000000
--- a/src/renderer/src/components/UpdateCard.test.ts
+++ /dev/null
@@ -1,120 +0,0 @@
-import { createStore, type StoreApi } from 'zustand/vanilla'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type { UpdateStatus } from '../../../shared/update-status-types'
-import { createUISlice } from '../store/slices/ui/create-ui-slice'
-import type { AppState } from '../store/types'
-import { isUpdateCardVisible } from './maintenance/update-card/update-card-visibility'
-
-function createTestStore(): StoreApi<AppState> {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  return createStore<any>()((...args: any[]) => ({
-    repos: [],
-    rightSidebarWidth: 280,
-    ...createUISlice(...(args as Parameters<typeof createUISlice>))
-  })) as unknown as StoreApi<AppState>
-}
-
-function setState(store: StoreApi<AppState>, status: UpdateStatus): void {
-  store.getState().setUpdateStatus(status)
-}
-
-beforeEach(() => {
-  vi.stubGlobal('window', {
-    api: {
-      ui: { set: vi.fn().mockResolvedValue(undefined) },
-      shell: { openUrl: vi.fn() },
-      updater: {
-        download: vi.fn().mockResolvedValue(undefined),
-        quitAndInstall: vi.fn().mockResolvedValue(undefined),
-        dismissNudge: vi.fn().mockResolvedValue(undefined),
-        dismissAvailableUpdate: vi.fn().mockResolvedValue(undefined)
-      }
-    },
-    matchMedia: vi.fn().mockReturnValue({
-      matches: false,
-      addEventListener: vi.fn(),
-      removeEventListener: vi.fn()
-    })
-  })
-})
-
-afterEach(() => {
-  vi.unstubAllGlobals()
-})
-
-describe('updateCardCollapsed', () => {
-  it('resets to false on every state transition so new phases re-surface', () => {
-    const store = createTestStore()
-
-    setState(store, { state: 'downloading', percent: 20, version: '1.2.0' })
-    store.getState().setUpdateCardCollapsed(true)
-    expect(store.getState().updateCardCollapsed).toBe(true)
-
-    // Why: percent-only updates are not transitions and must not reset.
-    setState(store, { state: 'downloading', percent: 50, version: '1.2.0' })
-    expect(store.getState().updateCardCollapsed).toBe(true)
-
-    setState(store, { state: 'downloaded', version: '1.2.0' })
-    expect(store.getState().updateCardCollapsed).toBe(false)
-  })
-})
-
-// Exercise visibility gates without a full DOM so irrelevant cards stay hidden and real updates remain visible.
-
-type VisibilityInput = {
-  status: UpdateStatus
-  dismissedVersion: string | null
-  cachedVersion: string | null
-  updateUserInitiatedCycle?: boolean
-  collapsed?: boolean
-}
-
-type VisibilityResult = 'hidden' | 'visible'
-
-function computeVisibility(input: VisibilityInput): VisibilityResult {
-  return isUpdateCardVisible({
-    ...input,
-    updateUserInitiatedCycle: input.updateUserInitiatedCycle ?? false
-  })
-    ? 'visible'
-    : 'hidden'
-}
-
-describe('UpdateCard visibility gates', () => {
-  it('hides check errors once a new checking cycle cleared the cached version', () => {
-    const store = createTestStore()
-    setState(store, { state: 'available', version: '1.2.0', changelog: null })
-    setState(store, { state: 'checking' })
-    setState(store, { state: 'error', message: 'network timeout' })
-
-    expect(
-      computeVisibility({
-        status: store.getState().updateStatus,
-        collapsed: store.getState().updateCardCollapsed,
-        dismissedVersion: '1.2.0',
-        cachedVersion: null
-      })
-    ).toBe('hidden')
-  })
-})
-
-describe('full update lifecycle through setUpdateStatus', () => {
-  it('dismiss → new version cycle → card visible again', () => {
-    const store = createTestStore()
-
-    setState(store, { state: 'available', version: '1.2.0', changelog: null })
-    store.getState().dismissUpdate()
-    expect(store.getState().dismissedUpdateVersion).toBe('1.2.0')
-
-    setState(store, { state: 'checking' })
-    setState(store, { state: 'available', version: '1.3.0', changelog: null })
-
-    expect(
-      computeVisibility({
-        status: store.getState().updateStatus,
-        dismissedVersion: store.getState().dismissedUpdateVersion,
-        cachedVersion: '1.3.0'
-      })
-    ).toBe('visible')
-  })
-})
diff --git a/src/renderer/src/components/WorktreeBaseFallbackDialog.test.tsx b/src/renderer/src/components/WorktreeBaseFallbackDialog.test.tsx
deleted file mode 100644
index aa4cc1157d5..00000000000
--- a/src/renderer/src/components/WorktreeBaseFallbackDialog.test.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-// @vitest-environment happy-dom
-
-import { act } from 'react'
-import { createRoot, type Root } from 'react-dom/client'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { useAppStore } from '@/store'
-import type { AppState } from '@/store/types'
-import WorktreeBaseFallbackDialog from './WorktreeBaseFallbackDialog'
-import {
-  requestWorktreeBaseFallbackNotice,
-  resetWorktreeBaseFallbackNoticesForTests
-} from './worktree-base-fallback-notice'
-
-const initialState = useAppStore.getInitialState()
-let root: Root | null = null
-
-async function renderDialog(activeModal: AppState['activeModal'] = 'none'): Promise<void> {
-  useAppStore.setState({
-    activeModal,
-    setContextualToursBlockingSurfaceVisible: vi.fn()
-  })
-  const container = document.createElement('div')
-  document.body.appendChild(container)
-  root = createRoot(container)
-  await act(async () => {
-    root?.render(<WorktreeBaseFallbackDialog />)
-  })
-}
-
-describe('WorktreeBaseFallbackDialog', () => {
-  beforeEach(() => {
-    useAppStore.setState(initialState, true)
-    resetWorktreeBaseFallbackNoticesForTests()
-  })
-
-  afterEach(async () => {
-    await act(async () => {
-      root?.unmount()
-    })
-    root = null
-    document.body.innerHTML = ''
-    resetWorktreeBaseFallbackNoticesForTests()
-    useAppStore.setState(initialState, true)
-  })
-
-  it('waits until another app modal closes', async () => {
-    requestWorktreeBaseFallbackNotice({
-      requestedRef: 'origin/main',
-      localRef: 'main'
-    })
-    await renderDialog('new-workspace-composer')
-
-    expect(document.body.textContent).not.toContain('Workspace created from a local base')
-
-    await act(async () => {
-      useAppStore.setState({ activeModal: 'none' })
-    })
-
-    expect(document.body.textContent).toContain('Workspace created from a local base')
-  })
-})
diff --git a/src/renderer/src/components/worktree-base-fallback-notice.ts b/src/renderer/src/components/worktree-base-fallback-notice.ts
index 1d31517b224..f65cba96b1f 100644
--- a/src/renderer/src/components/worktree-base-fallback-notice.ts
+++ b/src/renderer/src/components/worktree-base-fallback-notice.ts
@@ -28,8 +28,3 @@ export function subscribeWorktreeBaseFallbackNotice(listener: () => void): () =>
   listeners.add(listener)
   return () => listeners.delete(listener)
 }
-
-export function resetWorktreeBaseFallbackNoticesForTests(): void {
-  notices.length = 0
-  notifyListeners()
-}