diff --git a/.github/workflows/ci-non-linux.yml b/.github/workflows/ci-non-linux.yml
index 937848758..a432b83df 100644
--- a/.github/workflows/ci-non-linux.yml
+++ b/.github/workflows/ci-non-linux.yml
@@ -60,6 +60,14 @@ jobs:
       matrix:
         os: [macos-latest, windows-latest]
         partition: ["1/8", "2/8", "3/8", "4/8", "5/8", "6/8", "7/8", "8/8"]
+    # macOS/Windows default per-test thread stacks are smaller than Linux's, so
+    # Config-heavy async test frames that build more than one Agent/ServeAgentDeps
+    # in the same frame (e.g. build_agent_factory_gates_trust_state_independently_per_session,
+    # build_combined_deps_wires_policy_gate_through_to_session_agent) can overflow the
+    # default stack here even though they pass in Linux's non-instrumented `test` job
+    # (same root cause as the coverage job's fix in ci.yml, run 29873938646).
+    env:
+      RUST_MIN_STACK: "33554432"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d633a68fa..388206ffb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,35 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
+
+## [0.22.3] - 2026-07-22
+### Fixed
+
+- `.github/workflows/ci-non-linux.yml`: the sharded macOS/Windows `Test` jobs intermittently
+  crashed with `fatal runtime error: stack overflow, aborting` on
+  `serve::agent_factory::tests::build_agent_factory_gates_trust_state_independently_per_session`
+  and `build_combined_deps_wires_policy_gate_through_to_session_agent` (run 29873938646) — the
+  same root cause already fixed for the `coverage` job (Config-heavy async test frames that
+  build more than one `Agent`/`ServeAgentDeps` at once overflow the smaller default per-test
+  stack on non-Linux runners even though they pass on Linux). Added `RUST_MIN_STACK: "33554432"`
+  (32 MiB) to the sharded `test` job's env, scoped to that job only.
+- `src/agent_setup.rs`, `src/acp.rs`: `build_tool_setup_wires_risk_chain_and_blocks_exfil_sequence`
+  and `acp_session_risk_chain_state_does_not_leak_across_sessions` executed `cat /etc/passwd` to
+  trigger the risk chain's `SensitiveRead` classification and asserted the call succeeds — the
+  classifier only pattern-matches the command text (`classify()` in `risk_chain.rs`), so the
+  path never needed to actually exist, but a real `/etc/passwd` read failed on Windows runners
+  where the path is absent. Swapped to `echo /etc/passwd`, which preserves the classification
+  match while succeeding on every platform.
+- `src/commands/durable.rs`: `durable_db_is_filename_namespaced_sibling_of_sqlite_path` asserted
+  a hardcoded forward-slash path against `resolve_durable_db_url`'s `Path::join`-built output,
+  which uses the platform's native separator — a mismatch on Windows (`\` vs `/`). The expected
+  value is now built via the same `Path::join` the function under test uses.
+- `src/acp.rs`: `already_locked_session_log_notifies_client_proactively_without_prompt` drives
+  genuine `flock(2)` contention through `SessionEventLog::open_exclusive`, whose advisory lock is
+  a documented no-op on non-Unix targets (`AdvisoryLock`, `zeph-session`'s `log.rs`) — a second
+  `open_exclusive` never contends on Windows, so the test never exercised its own assertion
+  there. Gated `#[cfg(unix)]`, matching `zeph-session`'s own tests for the same primitive.
+
 ### Removed
 
 - `zeph-core`: removed the `#[cfg(test)]`-only legacy sequential-dispatch harness in
@@ -17298,7 +17327,8 @@ let agent = Agent::new(provider, channel, &skills_prompt, executor);
 
 [0.16.0]: https://github.com/bug-ops/zeph/compare/v0.15.3...v0.16.0
 
-[Unreleased]: https://github.com/bug-ops/zeph/compare/v0.22.2...HEAD
+[Unreleased]: https://github.com/bug-ops/zeph/compare/v0.22.3...HEAD
+[0.22.3]: https://github.com/bug-ops/zeph/compare/v0.22.2...v0.22.3
 [0.22.2]: https://github.com/bug-ops/zeph/compare/v0.22.1...v0.22.2
 [0.22.1]: https://github.com/bug-ops/zeph/compare/v0.22.0...v0.22.1
 [0.22.0]: https://github.com/bug-ops/zeph/compare/v0.21.4...v0.22.0
diff --git a/Cargo.lock b/Cargo.lock
index b6de0362f..1c19f06ef 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -11127,7 +11127,7 @@ dependencies = [
 
 [[package]]
 name = "zeph"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "agent-client-protocol",
  "anyhow",
@@ -11212,7 +11212,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-a2a"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -11243,7 +11243,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-acp"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "agent-client-protocol",
  "agent-client-protocol-schema",
@@ -11287,7 +11287,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-agent-context"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "chrono",
  "futures",
@@ -11312,7 +11312,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-agent-feedback"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "regex",
  "schemars 1.2.1",
@@ -11327,7 +11327,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-agent-persistence"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "serde",
  "serde_json",
@@ -11346,11 +11346,11 @@ dependencies = [
 
 [[package]]
 name = "zeph-agent-tools"
-version = "0.22.2"
+version = "0.22.3"
 
 [[package]]
 name = "zeph-bench"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "clap",
  "schemars 1.2.1",
@@ -11372,7 +11372,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-channels"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "axum 0.8.9",
  "criterion",
@@ -11401,7 +11401,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-commands"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "serde",
  "thiserror 2.0.18",
@@ -11412,7 +11412,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-common"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "axum 0.8.9",
  "blake3",
@@ -11451,7 +11451,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-config"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "dirs",
  "insta",
@@ -11472,7 +11472,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-context"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "blake3",
  "criterion",
@@ -11493,7 +11493,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-core"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "age",
  "base64 0.22.1",
@@ -11565,7 +11565,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-db"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "regex",
  "sqlx",
@@ -11582,7 +11582,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-durable"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "blake3",
  "bytes",
@@ -11608,7 +11608,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-experiments"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "futures",
  "ordered-float 5.3.0",
@@ -11632,7 +11632,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-gateway"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "axum 0.8.9",
  "http-body-util",
@@ -11649,7 +11649,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-index"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "futures",
  "ignore",
@@ -11682,7 +11682,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-llm"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "async-stream",
  "audioadapter-buffers",
@@ -11732,7 +11732,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-mcp"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -11773,7 +11773,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-memory"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "arc-swap",
  "blake3",
@@ -11815,7 +11815,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-orchestration"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "blake3",
  "chrono",
@@ -11846,7 +11846,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-plugins"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "dirs",
  "flate2",
@@ -11873,7 +11873,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-sanitizer"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "image",
  "parking_lot",
@@ -11896,7 +11896,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-scheduler"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "chrono",
  "cron",
@@ -11919,7 +11919,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-session"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "rustix 1.1.4",
  "serde",
@@ -11939,7 +11939,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-skills"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "anyhow",
  "blake3",
@@ -11976,7 +11976,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-subagent"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "dirs",
  "indoc",
@@ -12008,7 +12008,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-tools"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "arc-swap",
  "dashmap",
@@ -12053,7 +12053,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-tui"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "arboard",
  "base64 0.22.1",
@@ -12104,7 +12104,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-vault"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "age",
  "proptest",
@@ -12121,7 +12121,7 @@ dependencies = [
 
 [[package]]
 name = "zeph-worktree"
-version = "0.22.2"
+version = "0.22.3"
 dependencies = [
  "parking_lot",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index cf8d01c6a..5024685d4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,7 +6,7 @@ resolver = "3"
 [workspace.package]
 edition = "2024"
 rust-version = "1.97"
-version = "0.22.2"
+version = "0.22.3"
 authors = ["bug-ops"]
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/bug-ops/zeph"
@@ -155,38 +155,38 @@ url = "2.5.8"
 uuid = "1.24.0"
 walkdir = "2.5"
 wiremock = "0.6.5"
-zeph-a2a = { path = "crates/zeph-a2a", version = "0.22.2" }
-zeph-acp = { path = "crates/zeph-acp", default-features = false, version = "0.22.2" }
-zeph-agent-context = { path = "crates/zeph-agent-context", default-features = false, version = "0.22.2" }
-zeph-agent-feedback = { path = "crates/zeph-agent-feedback", version = "0.22.2" }
-zeph-agent-persistence = { path = "crates/zeph-agent-persistence", default-features = false, version = "0.22.2" }
-zeph-agent-tools = { path = "crates/zeph-agent-tools", version = "0.22.2" }
-zeph-bench = { path = "crates/zeph-bench", default-features = false, version = "0.22.2" }
-zeph-channels = { path = "crates/zeph-channels", default-features = false, version = "0.22.2" }
-zeph-commands = { path = "crates/zeph-commands", version = "0.22.2" }
-zeph-common = { path = "crates/zeph-common", version = "0.22.2" }
-zeph-config = { path = "crates/zeph-config", version = "0.22.2" }
-zeph-context = { path = "crates/zeph-context", version = "0.22.2" }
-zeph-core = { path = "crates/zeph-core", default-features = false, version = "0.22.2" }
-zeph-db = { path = "crates/zeph-db", default-features = false, version = "0.22.2" }
-zeph-durable = { path = "crates/zeph-durable", default-features = false, version = "0.22.2" }
-zeph-experiments = { path = "crates/zeph-experiments", default-features = false, version = "0.22.2" }
-zeph-gateway = { path = "crates/zeph-gateway", version = "0.22.2" }
-zeph-index = { path = "crates/zeph-index", default-features = false, version = "0.22.2" }
-zeph-llm = { path = "crates/zeph-llm", version = "0.22.2" }
-zeph-mcp = { path = "crates/zeph-mcp", default-features = false, version = "0.22.2" }
-zeph-memory = { path = "crates/zeph-memory", default-features = false, version = "0.22.2" }
-zeph-orchestration = { path = "crates/zeph-orchestration", default-features = false, version = "0.22.2" }
-zeph-plugins = { path = "crates/zeph-plugins", default-features = false, version = "0.22.2" }
-zeph-sanitizer = { path = "crates/zeph-sanitizer", default-features = false, version = "0.22.2" }
-zeph-scheduler = { path = "crates/zeph-scheduler", default-features = false, version = "0.22.2" }
-zeph-session = { path = "crates/zeph-session", default-features = false, version = "0.22.2" }
-zeph-skills = { path = "crates/zeph-skills", default-features = false, version = "0.22.2" }
-zeph-subagent = { path = "crates/zeph-subagent", default-features = false, version = "0.22.2" }
-zeph-tools = { path = "crates/zeph-tools", default-features = false, version = "0.22.2" }
-zeph-tui = { path = "crates/zeph-tui", default-features = false, version = "0.22.2" }
-zeph-worktree = { path = "crates/zeph-worktree", version = "0.22.2" }
-zeph-vault = { path = "crates/zeph-vault", version = "0.22.2" }
+zeph-a2a = { path = "crates/zeph-a2a", version = "0.22.3" }
+zeph-acp = { path = "crates/zeph-acp", default-features = false, version = "0.22.3" }
+zeph-agent-context = { path = "crates/zeph-agent-context", default-features = false, version = "0.22.3" }
+zeph-agent-feedback = { path = "crates/zeph-agent-feedback", version = "0.22.3" }
+zeph-agent-persistence = { path = "crates/zeph-agent-persistence", default-features = false, version = "0.22.3" }
+zeph-agent-tools = { path = "crates/zeph-agent-tools", version = "0.22.3" }
+zeph-bench = { path = "crates/zeph-bench", default-features = false, version = "0.22.3" }
+zeph-channels = { path = "crates/zeph-channels", default-features = false, version = "0.22.3" }
+zeph-commands = { path = "crates/zeph-commands", version = "0.22.3" }
+zeph-common = { path = "crates/zeph-common", version = "0.22.3" }
+zeph-config = { path = "crates/zeph-config", version = "0.22.3" }
+zeph-context = { path = "crates/zeph-context", version = "0.22.3" }
+zeph-core = { path = "crates/zeph-core", default-features = false, version = "0.22.3" }
+zeph-db = { path = "crates/zeph-db", default-features = false, version = "0.22.3" }
+zeph-durable = { path = "crates/zeph-durable", default-features = false, version = "0.22.3" }
+zeph-experiments = { path = "crates/zeph-experiments", default-features = false, version = "0.22.3" }
+zeph-gateway = { path = "crates/zeph-gateway", version = "0.22.3" }
+zeph-index = { path = "crates/zeph-index", default-features = false, version = "0.22.3" }
+zeph-llm = { path = "crates/zeph-llm", version = "0.22.3" }
+zeph-mcp = { path = "crates/zeph-mcp", default-features = false, version = "0.22.3" }
+zeph-memory = { path = "crates/zeph-memory", default-features = false, version = "0.22.3" }
+zeph-orchestration = { path = "crates/zeph-orchestration", default-features = false, version = "0.22.3" }
+zeph-plugins = { path = "crates/zeph-plugins", default-features = false, version = "0.22.3" }
+zeph-sanitizer = { path = "crates/zeph-sanitizer", default-features = false, version = "0.22.3" }
+zeph-scheduler = { path = "crates/zeph-scheduler", default-features = false, version = "0.22.3" }
+zeph-session = { path = "crates/zeph-session", default-features = false, version = "0.22.3" }
+zeph-skills = { path = "crates/zeph-skills", default-features = false, version = "0.22.3" }
+zeph-subagent = { path = "crates/zeph-subagent", default-features = false, version = "0.22.3" }
+zeph-tools = { path = "crates/zeph-tools", default-features = false, version = "0.22.3" }
+zeph-tui = { path = "crates/zeph-tui", default-features = false, version = "0.22.3" }
+zeph-worktree = { path = "crates/zeph-worktree", version = "0.22.3" }
+zeph-vault = { path = "crates/zeph-vault", version = "0.22.3" }
 zeroize = { version = "1.9.0", default-features = false }
 
 [workspace.lints.rust]
diff --git a/README.md b/README.md
index 2a0511444..036ce3974 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@
   [![CI](https://img.shields.io/github/actions/workflow/status/bug-ops/zeph/ci.yml?branch=main&label=CI)](https://github.com/bug-ops/zeph/actions)
   [![codecov](https://codecov.io/gh/bug-ops/zeph/graph/badge.svg?token=S5O0GR9U6G)](https://codecov.io/gh/bug-ops/zeph)
   [![MSRV](https://img.shields.io/badge/MSRV-1.97-blue)](https://www.rust-lang.org)
-  [![Tests](https://img.shields.io/badge/tests-14890-brightgreen)](https://github.com/bug-ops/zeph/actions)
+  [![Tests](https://img.shields.io/badge/tests-15347-brightgreen)](https://github.com/bug-ops/zeph/actions)
   [![License: MIT OR Apache-2.0](https://img.shields.io/badge/License-MIT%20OR%20Apache--2.0-yellow.svg)](LICENSE)
 </div>
 
@@ -195,6 +195,7 @@ Secrets live in an [age-encrypted](https://github.com/FiloSottile/age) vault, ne
 - **SSRF defense (5 layers)** — HTTPS-only, pre-DNS blocklist, post-DNS IP validation, pinned-address client (blocks DNS-rebinding), and redirect-chain re-validation (max 3 hops).
 - **ShadowSentinel** — an optional LLM probe evaluates risky tool calls *before* execution, with every verdict written to an audit table.
 - **Exfiltration guard** — blocks tracking-pixel image links and suspicious URLs in tool output, and suppresses injection-flagged memory writes.
+- **Safe-by-default limits** — a fresh install ships with the per-category tool rate limiter (`[security.rate_limit]`) and a daily LLM cost cap (`[cost].max_daily_cents`, default $25/day) already enabled, so a runaway agent loop can't hammer a tool category or burn unbounded API spend. Local-only Ollama/Candle usage costs `0` and never trips the cap; any config that sets these keys explicitly keeps its own values.
 - **Tamper-evident, downgrade-resistant history** — sub-agent transcripts and session event logs are keyed-BLAKE3 hash-chained (vault-keyed `ZEPH_HISTORY_KEY`), so an edited, reordered, or partially-stripped entry is detected and fails closed before it's replayed as trusted prior context; a tampered session can be inspected read-only via `zeph sessions resume <id> --print --allow-unverified`. A per-file vault anchor (`[integrity] anchor = "vault"`, the default) additionally closes the whole-file-strip downgrade a chain alone can't catch — a file-write-only attacker cannot forge or delete a vault entry. Durable execution journals use a separate authenticated high-water-mark, vault-sealable via `zeph durable seal-integrity` to close the equivalent whole-row-delete lever. `zeph sessions verify` / `zeph doctor` report status.
 
 See the [security model](https://bug-ops.github.io/zeph/reference/security.html).
diff --git a/book/src/advanced/gateway.md b/book/src/advanced/gateway.md
index dc3aaf979..5e8f4195d 100644
--- a/book/src/advanced/gateway.md
+++ b/book/src/advanced/gateway.md
@@ -33,7 +33,7 @@ Add the `[gateway]` section to `config/default.toml`:
 enabled = true
 bind = "127.0.0.1"
 port = 8090
-# auth_token = "secret"  # optional, from vault ZEPH_GATEWAY_TOKEN
+auth_token = "secret"     # required; set from vault via ZEPH_GATEWAY_TOKEN
 rate_limit = 120          # max requests/minute per IP (0 = unlimited)
 max_body_size = 1048576   # 1 MB
 ```
@@ -42,7 +42,9 @@ Set `bind = "0.0.0.0"` to accept connections from all interfaces. The gateway lo
 
 ### Authentication
 
-When `auth_token` is set (or resolved from vault via `ZEPH_GATEWAY_TOKEN`), all requests to `/webhook` must include a bearer token:
+**`auth_token` is required.** The gateway fails to start if `auth_token` is missing or blank, protecting against unauthenticated webhook injection.
+
+All requests to `/webhook` must include a bearer token:
 
 ```
 Authorization: Bearer <token>
@@ -50,6 +52,27 @@ Authorization: Bearer <token>
 
 Token comparison uses constant-time hashing (blake3 + `subtle`) to prevent timing attacks. The `/health` endpoint is always unauthenticated.
 
+To set the token:
+
+**Option 1: Store in age vault** (recommended):
+```bash
+zeph vault set ZEPH_GATEWAY_TOKEN "your-secret-token"
+```
+
+**Option 2: Environment variable** (dev only):
+```bash
+export ZEPH_GATEWAY_TOKEN="your-secret-token"
+zeph --daemon
+```
+
+**Option 3: Direct config** (not recommended):
+```toml
+[gateway]
+auth_token = "your-secret-token"  # prefer vault
+```
+
+The `--init` wizard now explicitly prompts for the gateway token and instructs you to store it in the vault.
+
 ## Endpoints
 
 ### `GET /health`
diff --git a/book/src/advanced/observability.md b/book/src/advanced/observability.md
index 3e1e57935..8079477fc 100644
--- a/book/src/advanced/observability.md
+++ b/book/src/advanced/observability.md
@@ -87,6 +87,31 @@ CPS resets daily at UTC midnight alongside the cost budget. Use it to track whet
 
 **In code:** access via `MetricsSnapshot.cost_cps_cents` and `MetricsSnapshot.cost_successful_tasks`.
 
+### Per-Message Usage Records
+
+Every LLM call that contributes to cost tracking is durably recorded in the `usage_records` table, indexed by message ID. This provides a detailed audit trail of per-message token counts, latency, and cost — useful for understanding what drove total spend.
+
+**Accessing usage data:**
+
+- **CLI**: `zeph usage <message_id>` shows token counts and cost for a specific conversation message
+- **SQL query**: 
+  ```sql
+  SELECT message_id, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, 
+         cost_cents, latency_ms, ttft_ms FROM usage_records 
+  WHERE created_at > datetime('now', '-1 day') 
+  ORDER BY cost_cents DESC;
+  ```
+
+Each row records:
+- **input_tokens, output_tokens, cache_read_tokens, cache_write_tokens** — token count breakdown
+- **cost_cents** — total cost in cents, calculated using the same pricing formula as the daily aggregate
+- **latency_ms** — total round-trip time (including retries and backoff)
+- **ttft_ms** — time-to-first-token (true value on streaming paths, time-to-first-byte proxy on non-streaming)
+- **tokens_per_sec** — throughput (output_tokens / latency_ms * 1000)
+- **message_id** — links to conversation message (NULL for background work: planner, aggregator, verifier)
+
+Usage rows are written inline-awaited alongside cost tracking — no separate toggle or config needed. They honor the same `[cost] enabled` gate: when cost tracking is off, usage records are not written.
+
 ## TaskSupervisor Metrics
 
 Zeph uses a `TaskSupervisor` to manage background tasks (embedding, memory consolidation, file watching, etc.). Task metrics provide CPU and wall-time measurement for performance debugging.
diff --git a/book/src/advanced/sub-agents.md b/book/src/advanced/sub-agents.md
index 85df58fba..0250e7ad7 100644
--- a/book/src/advanced/sub-agents.md
+++ b/book/src/advanced/sub-agents.md
@@ -215,6 +215,8 @@ Report findings as a structured list with severity (critical/warning/info).
 | `hooks.PreToolUse` | HookMatcher[] | `[]` | Hooks fired before tool execution (see [Hooks](#hooks)) |
 | `hooks.PostToolUse` | HookMatcher[] | `[]` | Hooks fired after tool execution (see [Hooks](#hooks)) |
 
+> **Breaking Change (v0.22.3):** Sub-agent frontmatter files with a misspelled key in the `tools:` or `permissions:` sections (e.g., `pemission_mode:`, `alow:`) now fail to load with a parse error instead of silently falling back to defaults. This is intentional to catch configuration errors early. Review and fix any typos in existing sub-agent definitions — keys are case-sensitive.
+
 If neither `tools.allow` nor `tools.deny` is specified, the sub-agent inherits all tools from the main agent.
 
 Matched skill bodies are capped by `[skills] subagent_skill_token_budget` (default `12000` tokens, config-wide, not per-agent) — applies only when `skills.include` is empty; an explicit, hand-curated `include` list is never capped — see [Skill Filtering](#skill-filtering) below.
@@ -286,6 +288,62 @@ Summarize the provided content in three bullet points.
 
 The default is `20`. Set a lower value for narrow, well-defined tasks.
 
+### `delegation_mode` — Autonomous Spawning Control
+
+`delegation_mode` controls whether the main agent can autonomously spawn this sub-agent via the orchestration scheduler, or whether spawns must be initiated by direct user action.
+
+Three modes are available:
+
+| Mode | Description |
+|------|-------------|
+| `proactive` (default) | The orchestration scheduler can autonomously spawn this agent. This is the default and preserves the subsystem's prior behavior. |
+| `explicit_request_only` | The agent can only be spawned via direct user action: `/agent spawn`, `/agent resume`, `/subagent spawn`. The orchestration scheduler cannot autonomously spawn it. Useful for channels where prompt injection is a risk (Telegram, Discord, webhooks). |
+| `disabled` | No spawn path is available (read-only operations like `/agent list` still work). Set `enabled: false` in config to disable all sub-agents globally. |
+
+Example:
+
+```yaml
+---
+name: code-reviewer
+description: Reviews code for correctness and style
+delegation_mode: explicit_request_only  # only spawn via /agent spawn, not via scheduler
+---
+
+You are a code reviewer...
+```
+
+Override in `config.toml`:
+
+```toml
+[agents]
+delegation_mode = "explicit_request_only"  # applies to all agents without explicit override
+```
+
+Or via CLI:
+
+```bash
+zeph --delegation-mode explicit_request_only
+```
+
+### Token-Level Transcript Streaming
+
+Sub-agents can stream response text and thinking output as token-level deltas within a turn, rather than waiting for the turn to complete. This provides faster, more interactive feedback.
+
+**Requirements:**
+- Provider must support streaming with tools (currently Claude)
+- Configured via the existing `forward_transcript` setting (no new config needed)
+
+When enabled, each token appears in real-time:
+
+```
+Sub-agent 'analyzer' thinking…
+Looking at the file…
+I can see the issue…
+The bug is on line 42…
+```
+
+Deltas are ephemeral and display-only (dropped under backpressure, just like turn-end summaries). The final accumulated response remains the sole source of truth for the next turn's LLM context. Providers without native streaming support fall back to full per-turn text at completion, with zero behavior change.
+
 ### Definition Locations
 
 | Path | Scope | Priority |
diff --git a/book/src/reference/configuration.md b/book/src/reference/configuration.md
index b2eab1cd4..14ae6dcf0 100644
--- a/book/src/reference/configuration.md
+++ b/book/src/reference/configuration.md
@@ -487,6 +487,13 @@ edge_history_limit = 100               # Max historical edge versions per source
 # contradiction_risk_threshold = 0.7           # Graph edge conflict risk (default: 0.7)
 # Fail-open contract: embed/LLM/graph errors yield neutral defaults. Requires graph memory for contradiction scoring.
 
+[memory.consent_gate]
+# Write-time memory consent gate — requires confirmation for untrusted tool outputs before saving
+enabled = false                    # Enable consent gate for memory writes (default: false)
+confirm_threshold = "external_untrusted"  # Trust level triggering confirmation: "trusted", "local_untrusted", "external_untrusted" (default: "external_untrusted")
+disclose_threshold = "local_untrusted"    # Trust level triggering a disclosure note: "trusted", "local_untrusted", "external_untrusted" (default: "local_untrusted")
+audit_all = true                   # Log all memory writes to audit trail (default: true)
+
 [session]
 # Durable, replayable event log per conversation-session — see "Session Persistence and Resume"
 # in the mdBook guide (advanced/session-persistence.md).
@@ -759,6 +766,7 @@ enabled = false                    # Enable native worktree isolation for backgr
 [agents]
 enabled = false            # Enable sub-agent system (default: false)
 max_concurrent = 1         # Max concurrent sub-agents (default: 1)
+delegation_mode = "proactive"  # Autonomous spawn control: "proactive" (default), "explicit_request_only", or "disabled"
 extra_dirs = []            # Additional directories to scan for agent definitions
 # default_memory_scope = "project"  # Default memory scope for agents without explicit `memory` field
                                     # Valid: "user", "project", "local". Omit to disable.
@@ -811,7 +819,7 @@ verify_timeout_secs = 120                # Timeout for post-task completeness ve
 enabled = false
 bind = "127.0.0.1"
 port = 8090
-# auth_token = "secret"     # Bearer token for gateway auth (from vault ZEPH_GATEWAY_TOKEN); warn logged at startup if unset
+auth_token = "secret"       # Required: Bearer token for gateway auth (from vault ZEPH_GATEWAY_TOKEN); gateway fails to start if missing
 rate_limit = 120
 max_body_size = 1048576     # 1 MiB
 
diff --git a/crates/zeph-channels/README.md b/crates/zeph-channels/README.md
index beb602b27..c102b6c19 100644
--- a/crates/zeph-channels/README.md
+++ b/crates/zeph-channels/README.md
@@ -24,7 +24,7 @@ Implements I/O channel adapters that connect the agent to different frontends. S
 | `discord` | Discord adapter (optional feature) |
 | `slack` | Slack adapter (optional feature); audio file detection and download with Bearer auth |
 | `any` | `AnyChannel` — enum dispatch over all channels |
-| `markdown` | Markdown rendering helpers |
+| `markdown` | `markdown_to_telegram` renders CommonMark to Telegram `MarkdownV2` (Bot API 10.1 rich text); multi-line blockquotes prefix every line with `>`, nested quotes flatten to a single level (MarkdownV2 has no nested-quote grammar), and long quotes render as Bot API 10.1 expandable (collapsed-by-default) blockquotes at or above `expandable_blockquote_min_lines` |
 
 **Re-exports:** `AnyChannel`, `CliChannel`, `JsonCliChannel`
 
@@ -38,6 +38,7 @@ Key fields in the `[telegram]` config section:
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
 | `stream_interval_ms` | u64 | `3000` | Minimum interval between streaming message edits (minimum 500 ms) |
+| `expandable_blockquote_min_lines` | u32 | `10` | Blockquotes with at least this many lines render as Bot API 10.1 expandable (collapsed-by-default) quotes; `0` disables the expandable form |
 | `guest_mode` | bool | `false` | Enable Bot API 10.0 Guest Mode — surfaces guest messages via a local proxy |
 | `bot_to_bot` | bool | `false` | Enable Bot-to-Bot communication via `setManagedBotAccessSettings` |
 | `allowed_bots` | `Vec<String>` | `[]` | Telegram user IDs of bots allowed to interact with this agent |
@@ -45,11 +46,12 @@ Key fields in the `[telegram]` config section:
 
 ```toml
 [telegram]
-stream_interval_ms  = 3000
-guest_mode          = false
-bot_to_bot          = false
-allowed_bots        = []
-max_bot_chain_depth = 3
+stream_interval_ms              = 3000
+expandable_blockquote_min_lines = 10
+guest_mode                      = false
+bot_to_bot                      = false
+allowed_bots                    = []
+max_bot_chain_depth             = 3
 ```
 
 > [!NOTE]
diff --git a/crates/zeph-commands/README.md b/crates/zeph-commands/README.md
index c7fc02929..583be17e7 100644
--- a/crates/zeph-commands/README.md
+++ b/crates/zeph-commands/README.md
@@ -16,7 +16,7 @@ startup.
 
 - `sink` — [`ChannelSink`] minimal async I/O trait; replaces the `C: Channel` generic in handlers
 - `context` — [`CommandContext`] non-generic dispatch context with trait-object fields
-- `traits` — sub-trait definitions for subsystem access (`AgentAccess`, `DebugAccess`, etc.)
+- `traits` — 15 per-domain subsystem-access sub-traits (`MemoryAccess`, `GraphAccess`, `ModelAccess`, `SkillAccess`, `PolicyAccess`, `SchedulerAccess`, `LspAccess`, `SessionControlAccess`, `McpAccess`, `OrchestrationAccess`, `SubagentAccess`, `IntegrationAccess`, `TrackingAccess`, `WorktreeAccess`, `MiscAccess`); `AgentAccess` is an empty marker supertrait over all 15 (blanket-impl'd) so `dyn AgentAccess` call sites are unchanged
 - `handlers` — concrete handler implementations (session, debug, skill, mcp, plan, …)
 - `commands` — static `COMMANDS` metadata table used by `/help`
 
diff --git a/crates/zeph-memory/README.md b/crates/zeph-memory/README.md
index d6e11b19c..887d49338 100644
--- a/crates/zeph-memory/README.md
+++ b/crates/zeph-memory/README.md
@@ -370,6 +370,7 @@ enabled = true
 max_hops = 2
 recall_limit = 10
 extraction_timeout_secs = 15
+retrieval_strategy = "synapse"      # synapse (default) | bfs | astar | water_circles | beam_search | hybrid
 use_embedding_resolution = true     # semantic entity dedup via Qdrant (default: false)
 entity_similarity_threshold = 0.85  # auto-merge threshold
 entity_ambiguous_threshold = 0.70   # LLM disambiguation threshold
@@ -387,8 +388,16 @@ timeout_ms = 500                    # Activation timeout to prevent runaway trav
 
 [memory.graph]
 recall_timeout_ms = 1000            # Timeout for the full graph recall call (default: 1000)
+
+[memory.graph.beam_search]
+beam_width = 10                     # top candidates kept per hop when retrieval_strategy = "beam_search"
+
+[memory.graph.watercircles]
+ring_limit = 0                      # facts per ring when retrieval_strategy = "water_circles" (0 = auto: limit / max_hops)
 ```
 
+`retrieval_strategy` selects which recall algorithm the live graph-recall path invokes: `synapse` (default; SYNAPSE spreading activation), `bfs` (hop-weighted traversal), `astar` (A* shortest path), `water_circles` (concentric ring-hop expansion, tuned by `[memory.graph.watercircles] ring_limit`), `beam_search` (top-K per hop, tuned by `[memory.graph.beam_search] beam_width`), or `hybrid` (an LLM classifier picks a strategy per query). Setting `[memory.graph.spreading_activation] enabled = true` force-overrides the strategy to `synapse`. `ZoomIn`/`ZoomOut` `recall_view` enrichment is preserved across all six strategies.
+
 ## BeliefMem probabilistic edges
 
 `BeliefMem` (`[memory.graph.belief_mem]`) stages candidate graph facts as probabilistic beliefs before committing them as permanent APEX-MEM edges. Evidence from multiple turns accumulates via Noisy-OR, and facts are only committed when confidence exceeds the promotion threshold.
@@ -458,6 +467,15 @@ Tags messages with a category derived from the active skill or tool context. The
 
 Organises memories as leaf nodes and periodically consolidates similar clusters into parent summaries via a background sweep. Context assembly traverses the tree for complex queries, mixing leaf-level detail with higher-level summaries. Configure via `[memory.tree]`.
 
+## Per-message usage and cost tracking
+
+The `usage_records` table (migration 115, SQLite and PostgreSQL) durably records token counts, cost, latency, TTFT/TTFB, and tokens-per-second for every LLM call that feeds `CostTracker::record_usage`, joined to the conversational message that produced it. Writes follow the existing `[cost] enabled` gate and are inline-awaited on the same call sites that update `CostTracker` — no new background tasks and no new config surface (additive telemetry).
+
+- `UsageRecord` / `UsageSource` — the per-call record type and its origin classification.
+- `SqliteStore::record_usage_row` — persist one row.
+- `SqliteStore::message_usage` / `conversation_usage` — query usage for a single message or a whole conversation.
+- `SqliteStore::usage_cost_since` — aggregate cost over a time window.
+
 ## Features
 
 | Feature | Default | Description |
diff --git a/crates/zeph-subagent/README.md b/crates/zeph-subagent/README.md
index 056929528..589fb4a3f 100644
--- a/crates/zeph-subagent/README.md
+++ b/crates/zeph-subagent/README.md
@@ -82,6 +82,9 @@ You are a research assistant. Use web_scrape to gather information.
 Always cite your sources.
 ```
 
+> [!IMPORTANT]
+> The top-level frontmatter and its nested `tools:` and `permissions:` sections all reject unknown keys. A misspelled key (e.g. `pemission_mode:`, `alow:`) fails the definition load instead of silently falling back to defaults, so security-relevant `permission_mode`/`worktree` typos surface immediately.
+
 ## Zero-trust grants
 
 Sub-agents receive only what is explicitly granted:
@@ -98,6 +101,8 @@ let grants = PermissionGrants::builder()
 
 **Important:** Tools not in the grant list are inaccessible to the sub-agent even if they are globally available. Use `tools.except` in the definition to additionally deny specific tools from an inherited grant set.
 
+Both `GrantKind::Tool` and `GrantKind::Secret` grants carry TTL and revocation state. `handle_tool_step` re-checks `PermissionGrants::check_tool_grant` immediately before every tool dispatch, so an expired or revoked tool grant is rejected with an actionable error at call time — grants are shared between `SubAgentManager` and the spawned agent-loop task via `Arc<Mutex<..>>`.
+
 ## Context propagation
 
 Sub-agents inherit context from their parent agent to reduce cold-start latency:
diff --git a/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_ansi16_full_layout.snap b/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_ansi16_full_layout.snap
index da2e4a6b1..333a5b786 100644
--- a/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_ansi16_full_layout.snap
+++ b/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_ansi16_full_layout.snap
@@ -1,11 +1,10 @@
 ---
 source: crates/zeph-tui/src/widgets/splash.rs
-assertion_line: 261
 expression: output
 ---
                                                             
                            ≈ zeph                           
                        think further.                       
-                           v0.22.2                          
+                           v0.22.3                          
                                                             
            / commands  @ files  ? keys  Tab panels
diff --git a/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_ascii_only_full_layout.snap b/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_ascii_only_full_layout.snap
index a7b77e209..cbc571332 100644
--- a/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_ascii_only_full_layout.snap
+++ b/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_ascii_only_full_layout.snap
@@ -1,11 +1,10 @@
 ---
 source: crates/zeph-tui/src/widgets/splash.rs
-assertion_line: 267
 expression: output
 ---
                                                             
                            ~ zeph                           
                        think further.                       
-                           v0.22.2                          
+                           v0.22.3                          
                                                             
            / commands  @ files  ? keys  Tab panels
diff --git a/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_truecolor_full_layout.snap b/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_truecolor_full_layout.snap
index 68bcf2c61..333a5b786 100644
--- a/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_truecolor_full_layout.snap
+++ b/crates/zeph-tui/src/widgets/snapshots/zeph_tui__widgets__splash__tests__splash_truecolor_full_layout.snap
@@ -1,11 +1,10 @@
 ---
 source: crates/zeph-tui/src/widgets/splash.rs
-assertion_line: 255
 expression: output
 ---
                                                             
                            ≈ zeph                           
                        think further.                       
-                           v0.22.2                          
+                           v0.22.3                          
                                                             
            / commands  @ files  ? keys  Tab panels
diff --git a/specs/002-agent-loop/spec.md b/specs/002-agent-loop/spec.md
index 4df2468df..34b95c24a 100644
--- a/specs/002-agent-loop/spec.md
+++ b/specs/002-agent-loop/spec.md
@@ -256,6 +256,35 @@ strip_orphaned_tool_results(messages: &mut Vec<Message>)
 
 ---
 
+## Focus/Compaction Summary Sanitization (SEC-CC-03)
+
+LLM-generated compaction summaries (`complete_focus_tool`, `handle_compress_context` backing
+the `compress_context`/`request_compaction` tools) are appended to the pinned Knowledge block,
+which is re-inserted immediately after the system prompt on every subsequent turn. Because the
+summary can transitively carry content from compressed tool/web output, it must be sanitized
+(`WebScrape`/`ExternalUntrusted` trust level) before the append — otherwise an injection
+surviving compaction reaches the model unfiltered on every turn thereafter. `handle_compress_context`
+lacked this sanitizer call until #6585; both sinks now share the same sanitize-before-append
+step and have regression coverage (#6562, #6572).
+
+Separately, `build_compression_prompt` truncates each message to 500 chars before handing it to
+the compression LLM. Untrusted tool-result content is already spotlight-wrapped
+(`<tool-output>`/`<external-data>`) at write time by `sanitize_tool_output`; blind truncation
+could sever a trailing wrapper's closing tag, leaving an opened-but-never-closed spotlight block
+in the compaction prompt. `repair_truncated_spotlight_wrapper` re-closes a severed wrapper by
+open/close tag count, checked independently per wrapper kind since one message can bundle
+multiple concatenated wrappers from a multi-tool-call turn (#6584, fixed in #6613).
+
+### Key Invariants
+
+- Every sink that appends an LLM-generated summary to the pinned Knowledge block MUST sanitize
+  it first — `complete_focus_tool` and `handle_compress_context` both go through the same
+  `WebScrape`/`ExternalUntrusted` sanitizer call
+- NEVER let a truncated compaction-prompt message leave a spotlight wrapper
+  (`<tool-output>`/`<external-data>`) open without its matching closing tag
+
+---
+
 ## Goal Lifecycle (#3567)
 
 The agent tracks a per-session *goal state* that reflects whether the current user
diff --git a/specs/003-llm-providers/spec.md b/specs/003-llm-providers/spec.md
index 92a6c2dca..a26275ab5 100644
--- a/specs/003-llm-providers/spec.md
+++ b/specs/003-llm-providers/spec.md
@@ -90,7 +90,7 @@ AnyProvider { Ollama, Claude, OpenAi, Gemini, Candle (feature "candle"),
 |---|---|---|
 | Claude | `claude.rs` | Anthropic API, prompt caching (4 breakpoints), thinking blocks |
 | OpenAI | `openai.rs` | OpenAI API + compatible endpoints |
-| Ollama | `ollama.rs` | Local via `ollama-rs`, streaming |
+| Ollama | `ollama.rs` | Local via `ollama-rs`, streaming; HTTP-status + transport-level retry (#6531) |
 | Compatible | `compatible.rs` | OpenAI-compatible HTTP (LM Studio, vLLM, etc.); also used for GonkaGate Phase 1 |
 | Candle | `candle.rs` | Local inference via HuggingFace candle (feature-gated) |
 | Gemini | `gemini.rs` | Google Gemini API |
@@ -167,6 +167,47 @@ default = true
 
 Subsystems reference a provider by name via a `*_provider` field. When the field is absent, the subsystem falls back to the default provider. See `.local/specs/024-multi-model-design/spec.md` for the full per-subsystem mapping.
 
+## Ollama Retry: HTTP-Status and Transport-Level (#6531, #6491)
+
+Unlike Claude/OpenAI/Gemini, `OllamaProvider::chat`/`chat_stream`/`chat_with_tools` originally
+sent every request through `ollama-rs` with no retry — `ollama-rs` discards the HTTP status
+code on non-2xx responses, so a single 429/503 or transient connection failure failed the whole
+turn immediately. `ollama.rs` now posts chat requests directly via a dedicated `reqwest` client
+(`ollama-rs`'s internal client is a different major `reqwest` version and not interchangeable
+with `retry::send_with_retry`), reusing `ChatMessageRequest`/`ChatMessageResponse` only for
+(de)serialization shape.
+
+Two independent retry layers:
+
+- **HTTP-status retry**: `retry::send_with_retry` (the same helper Claude/OpenAI/Gemini use)
+  retries on real HTTP 429/503, honoring `Retry-After`. Max 3 attempts, matching the other
+  backends' `MAX_RETRIES`.
+- **Transport-level retry**: `send_with_transport_retry`, layered underneath, retries transient
+  transport failures — request timeout, or a connection reset mid-request (`is_request()`
+  without `is_connect()`) — that fail before a `reqwest::Response` exists to inspect, so they
+  never reach `send_with_retry`'s status check. Same exponential backoff schedule as
+  `send_with_retry`.
+
+Connect-phase failures (`is_connect()`, e.g. no Ollama server running) are deliberately NOT
+retried — they are far more likely to be permanent misconfiguration than a transient blip, and
+`RouterProvider`'s fallback-exhaustion diagnostics depend on this failing fast.
+
+The streaming NDJSON parser introduced alongside this change buffers raw bytes across chunk
+boundaries and decodes only once a complete line is assembled, rather than decoding each chunk
+independently — decoding per-chunk can silently drop a chunk that splits a multi-byte UTF-8
+character.
+
+### Key Invariants
+
+- Ollama chat/streaming requests MUST retry on real HTTP 429/503 via `send_with_retry` — same
+  retry semantics as Claude/OpenAI/Gemini
+- Transport-level failures (timeout, mid-request connection reset) MUST be retried by
+  `send_with_transport_retry` before status-level retry ever sees a response
+- Connect-phase failures (e.g. server unreachable) MUST NOT be retried — fail fast to preserve
+  `RouterProvider` fallback diagnostics
+- The NDJSON stream parser MUST buffer across chunk boundaries and decode complete lines only —
+  NEVER decode a chunk in isolation (risks silently dropping a split multi-byte character)
+
 ## BetaHeaderRejected Retry (Claude)
 
 When a Claude request fails with `LlmError::BetaHeaderRejected`, the provider automatically
@@ -181,6 +222,35 @@ paths: `chat_with_tools_stream`, `chat_typed`, and `chat_with_tools` (extended i
 - The retried request uses identical parameters except the beta header is omitted
 - Retry happens at most once per request — no retry loop
 
+## Tool-Call ID Uniqueness (OpenAI/Compatible) (#6506, #6501)
+
+`convert_messages_structured` (OpenAI provider; also used by `CompatibleProvider`, which
+delegates message conversion to it) runs a `dedupe_tool_call_ids` pass at the end of
+conversion. Some OpenAI-compatible backends derive their `tool_call.id` counter relative to
+their own perceived context window; after Focus-based context compaction shrinks what Zeph
+sends, the backend's counter can reset and re-mint an id that collides with one still present
+earlier in the still-serialized history. A colliding `tool_calls[].id` is rejected outright by
+the backend (`tool_calls[].id must be unique within the request`), stalling the turn.
+
+`dedupe_tool_call_ids` walks the outgoing request in order, rewrites any repeated
+`tool_calls[].id` to a freshly-minted unique id, and keeps the paired `tool`-role message's
+`tool_call_id` in sync (FIFO pairing per original id, so multiple collisions on the same
+original id resolve to the correct occurrence).
+
+### Key Invariants
+
+- Every `tool_calls[].id` in a single outgoing request MUST be unique before serialization —
+  this is a hard wire-format requirement of the OpenAI-compatible API, not an optional
+  cleanliness pass
+- Ids that never collide MUST be left untouched — only colliding ids are rewritten
+- Rewriting a `tool_calls[].id` MUST update the paired `tool`-role message's `tool_call_id` to
+  match — an unpaired rewrite corrupts call/response matching
+- Dedup applies to both `openai` and `compatible` provider types, since `CompatibleProvider`
+  delegates message conversion to `OpenAiProvider`
+- Zeph does not mint `tool_call.id` values itself — it replays whatever the upstream model
+  returned as history; the fix is defensive rewriting on the outbound path, not a change to id
+  generation
+
 ## o-Series Models (OpenAI)
 
 OpenAI o-series models (`o1`, `o2-*`, `o3`, `o4-mini`, `o4`, and any model matching the
diff --git a/specs/004-memory/004-9-memory-write-gate.md b/specs/004-memory/004-9-memory-write-gate.md
index 8905bf82b..341d69193 100644
--- a/specs/004-memory/004-9-memory-write-gate.md
+++ b/specs/004-memory/004-9-memory-write-gate.md
@@ -17,6 +17,7 @@ related:
   - "[[004-memory/spec]]"
   - "[[004-3-admission-control]]"
   - "[[024-multi-model-design/spec]]"
+  - "[[083-memory-write-consent-gate/spec]]"
 ---
 
 # Spec: MemReader Write Quality Gate
@@ -76,6 +77,10 @@ MVP; LLM-assisted scoring is opt-in via `quality_gate_provider`.
 - Retrospective cleanup of existing low-quality entries (handled by `#[forgetting]`)
 - Graph-edge admission (see `[[004-7-memory-apex-magma]]`)
 - Tool-output admission (always admitted; quality runs only on conversational writes)
+- Provenance/consent/trust gating of writes derived from untrusted content — this gate is a
+  **noise-control** mechanism (redundancy, reference completeness, contradiction), not a
+  security/consent filter (see NFR-011 below). That concern is a separate, composed gate:
+  see `[[083-memory-write-consent-gate/spec|MemGhost write-time consent gate]]`
 
 ---
 
@@ -328,4 +333,5 @@ AND the LLM timeout counter increments
 - [[004-3-admission-control]] — upstream A-MAC admission
 - [[004-7-memory-apex-magma]] — graph-side conflict handling (composes with `contradiction_risk`)
 - [[024-multi-model-design/spec]] — provider tier guidance
+- [[083-memory-write-consent-gate/spec]] — MemGhost write-time consent gate (orthogonal: security/consent, not quality)
 - [[MOC-specs]] — all specifications
diff --git a/specs/004-memory/spec.md b/specs/004-memory/spec.md
index 8c01e8b2c..600a1746c 100644
--- a/specs/004-memory/spec.md
+++ b/specs/004-memory/spec.md
@@ -261,6 +261,55 @@ embed_timeout_secs = 5   # per-embed timeout; 0 = disabled
 This is separate from `context.fidelity.max_embed_input_tokens` (which limits input size) —
 `embed_timeout_secs` limits wall-clock duration of the embed call itself.
 
+## Vector Search Limit Clamp (`MAX_SEARCH_LIMIT`, #6553/#6616/#6623)
+
+`zeph_memory::MAX_SEARCH_LIMIT = 100` bounds every caller-supplied `limit`/`top_k` search
+parameter reaching Qdrant, closing an oversized-result-set DoS: an unbounded `limit` (e.g. a
+misconfigured `memory.retrieval.depth` or a caller passing `usize::MAX`) would otherwise make
+`zeph-memory` allocate/deserialize an arbitrarily large Qdrant result set in one call. There is
+deliberately no config knob to raise this ceiling.
+
+The enforcement point evolved across three PRs on the same invariant — only the final
+(current) state below reflects live behavior:
+
+1. **#6553/PR #6615** (`e0af1f70c`, breaking commit shared with A2A — see
+   [[014-a2a/spec]]) added the clamp only at the wrapper layer: `EmbeddingStore::search`/
+   `search_collection`, `EmbeddingRegistry::search_raw`, `ReasoningMemory::retrieve_by_embedding`.
+   A caller reaching a `VectorStore` implementor directly (e.g. `zeph-index`'s `CodeStore::search`
+   or a generic `RetrievalStep<P, V: VectorStore>` pipeline step) bypassed these wrappers entirely.
+2. **#6622** (closes #6616) added a `clamp_search_limit` call at the top of `search()` in each of
+   the three production implementors (`QdrantOps`, `DbVectorStore`, `InMemoryVectorStore`) —
+   but this relied on every implementor remembering to call the helper by convention.
+3. **#6627** (closes #6623, current state) converts `VectorStore::search` into a **template
+   method**: it is now trait-provided, clamps `limit` to `[1, MAX_SEARCH_LIMIT]` unconditionally,
+   and delegates to a new required `search_clamped()` method that implementors supply instead of
+   `search()` itself. This closes the gap where a 4th implementor (a test mock) had silently
+   skipped the by-convention clamp in #6622 — the bound is now structurally reached by every
+   call path regardless of implementor.
+
+A one-shot `tracing::warn!` fires the first time a requested limit is actually reduced (each
+clamping site warns independently, at most once per process).
+
+### Key Invariants
+
+- `limit`/`top_k` reaching Qdrant is always in `[1, MAX_SEARCH_LIMIT]`, regardless of call path —
+  enforced structurally by `VectorStore::search`'s template method, not by per-implementor convention
+- Implementors of `VectorStore` MUST implement `search_clamped`, NEVER override `search` — overriding
+  `search` bypasses the clamp entirely
+- `search_clamped` MUST NOT re-clamp `limit` — it is guaranteed already within bounds by `search`
+- NEVER add a config field to raise `MAX_SEARCH_LIMIT` — this reopens the oversized-result-set DoS
+  the constant exists to close; a config-driven candidate pool larger than 100 is silently truncated
+  (with a one-shot warning), by design
+
+### Related: Qdrant Endpoint Hardening Warning
+
+Same PR (#6553/#6615) added a non-fatal `tracing::warn!` in `Config::validate` when
+`memory.qdrant_url` points at a non-loopback host without TLS (`https://`) or an API key
+(`memory.qdrant_api_key`) configured — memory content would otherwise travel in plaintext with
+no server authentication. Loopback targets (`localhost`, `127.0.0.1`, `::1`) are exempt. This is
+a warning, not a hard validation failure, since a remote Qdrant reachable only over an
+already-trusted internal network is a legitimate deployment.
+
 ## Benna-Fusi Multi-Timescale SYNAPSE Edges (#3709, #3710, #3994)
 
 ### Fast/Slow Synaptic Variables (#3709)
@@ -318,6 +367,26 @@ deep_reasoning_query_conditioned = false   # opt-in
 - Migration 096 is append-only — existing rows get `NULL` fast/slow until first reassertion; read code handles `NULL` gracefully
 - `deep_reasoning_query_conditioned = true` must be fail-open — if `recall_graph_hela` errors, fall back to static-weight path
 
+### `GraphConfig::retrieval_strategy` Wired to the Live Recall Path (#6597, BREAKING)
+
+`retrieval_strategy` (`[memory.graph]`, values `synapse`/`bfs`/`astar`/`watercircles`/
+`beam_search`/`hybrid`) was parsed, validated, and documented, but **not consulted** by the
+live graph-recall path used by every real entry point (CLI/ACP/daemon/serve) — that path
+(`SemanticMemoryBackend::recall_graph_facts`) only switched on `spreading_activation.enabled`
+(SYNAPSE vs. plain BFS). The correct 6-way dispatch existed only in
+`zeph-agent-context::helpers`, which had zero production callers. #6597 ports the dispatch into
+the live path (`fetch_graph_facts` in `zeph-context` → `recall_graph_facts` in
+`zeph-agent-context`) and removes the dead duplicate chain. Full strategy details, the variant
+table, and the WaterCircles ring-hop fix live in [[012-graph-memory/spec]]; see that spec's
+"Graph Retrieval Strategy Dispatch" section.
+
+**BREAKING**: deployments on the default config (`spreading_activation.enabled = false`,
+`retrieval_strategy` unset) now get SYNAPSE spreading-activation recall instead of the
+previous — unintentional — plain-BFS fallback, since `retrieval_strategy`'s documented default
+(`synapse`) now actually takes effect. Set `retrieval_strategy = "bfs"` under `[memory.graph]`
+to keep the prior BFS-only behavior; benchmark before upgrading if graph-recall latency/cost
+is a concern.
+
 ---
 
 ## JoinSet and CancellationToken Fixes
diff --git a/specs/005-skills/spec.md b/specs/005-skills/spec.md
index 9f6eb9615..c3c39dc72 100644
--- a/specs/005-skills/spec.md
+++ b/specs/005-skills/spec.md
@@ -270,6 +270,50 @@ emits a `DEBUG` log noting absent provenance.
 
 ---
 
+## Self-Learning Auto-Improved Skill Trust Cap (#6619, #6568)
+
+Self-learning paths that rewrite a skill's active body (not just newly-created skills, see
+"NL Skill Generation and GitHub Repo Mining" above) previously bypassed both the injection scan
+and trust demotion: `store_improved_version` wrote LLM-regenerated bodies straight to the live
+`SKILL.md` with no `scan_skill_body` call, and the new `"auto"`-sourced version silently
+inherited the parent skill's trust tier — including `Trusted`/`Verified` — instead of being
+demoted for machine-evolved content.
+
+A shared `scan_and_cap_for_activation` gate is now wired into all three points that can activate
+a skill version:
+
+- `store_improved_version` — the failure-driven self-learning path
+- `activate_version_and_write` — the choke point shared by `/skill activate`, `/skill approve`,
+  and `/skill reset`, run unconditionally regardless of the target version's `source`
+- `arise_store_version` — the ARISE success-trace-driven path
+
+The gate runs `scan_skill_body` and hard-blocks activation on a match (the version row is still
+saved for forensics; the previously-active body stays live), and caps the newly-activated
+version's trust at `Quarantined` via `min_trust` (or the parent's level, if already worse than
+Quarantined) before the live file write, failing closed (skipping activation) if the trust write
+itself errors.
+
+Retroactive re-scan of pre-existing auto versions and per-version (rather than per-skill-name)
+trust restoration on rollback are deferred follow-ups — trust is stored per skill name, not per
+version, so a demoted trust level is not automatically restored when rolling back to an
+earlier, previously-vetted version.
+
+### Key Invariants
+
+- Every code path that can activate a skill version (self-learning improvement, ARISE
+  trace-driven storage, or manual `/skill activate`/`approve`/`reset`) MUST run the same
+  injection scan as manually-created skills — single-path scanning is incomplete
+- An auto-improved or auto-generated version MUST NOT silently inherit the parent skill's trust
+  level — cap at `Quarantined` (or lower, if the parent is already below it) before the live
+  write
+- The trust cap MUST be written and confirmed BEFORE the live SKILL.md file is written — writing
+  the file first and the trust cap second would reopen the vulnerability this fix closes
+- A scan match MUST hard-block activation — the version row is saved for forensics but the live
+  body and file are never touched
+- NEVER activate a version when the trust-cap write itself fails — fail closed, not open
+
+---
+
 ## Skill Category System
 
 
@@ -448,6 +492,33 @@ Install-time filtering:
 
 At startup and on hot-reload, `build_registry()` assigns `Trusted` trust to all skills that carry a `.bundled` marker file. This initialization is unconditional — it does not wait for feedback accumulation.
 
+### Trust Snapshot Must Not Fail Open on Transient Load Failure (#6513, #6482)
+
+`Agent::build_skill_trust_map` distinguishes a genuine `load_all_skill_trust()` read error from
+a legitimate empty result via `SkillTrustMapLoad::{Fresh, LoadFailed}`. Previously both cases
+collapsed into the same empty `HashMap`, so a transient DB read failure (lock contention, disk
+I/O hiccup) made every active skill resolve to `SkillTrustLevel::Trusted` for the turn —
+including skills an operator had explicitly `Blocked` or left `Quarantined` — unblocking
+`QUARANTINE_DENIED` tools and skipping body sanitization.
+
+On `LoadFailed`, both call sites (`apply_skill_trust_and_gating` and `reload_skills`) reuse the
+previous turn's `trust_snapshot` instead of overwriting it with an empty map — a transient
+failure degrades to stale-but-real trust data, never to maximum trust. The one residual gap:
+on the very first turn ever, `trust_snapshot` still holds its construction-time empty value, so
+a load failure on that narrow bootstrap window still yields an empty map (no prior state
+exists to fall back to).
+
+#### Key Invariants
+
+- A genuine `load_all_skill_trust()` read error MUST be distinguishable from "no rows yet" —
+  NEVER collapse both into the same empty map
+- On a load failure, callers MUST reuse the previous turn's `trust_snapshot` — NEVER fail open
+  to `SkillTrustLevel::Trusted`
+- Memory being unconfigured (`None`) is a permanent, expected condition, not a load failure — it
+  legitimately yields an empty `Fresh` map
+- The first-turn bootstrap window (no prior snapshot exists) is an accepted residual gap, not a
+  regression — there is no "previous" state to protect before the first turn
+
 ### Key Invariants (Hub Install)
 
 - `.bundled` marker is write-once at install time — never added post-install by the agent
diff --git a/specs/007-channels/007-3-telegram-rich-text.md b/specs/007-channels/007-3-telegram-rich-text.md
index f3f002a56..6f722efd7 100644
--- a/specs/007-channels/007-3-telegram-rich-text.md
+++ b/specs/007-channels/007-3-telegram-rich-text.md
@@ -10,7 +10,7 @@ tags:
   - telegram
   - bot-api-10
 created: 2026-07-20
-status: draft
+status: implemented
 related:
   - "[[007-channels/spec]]"
   - "[[007-channels/007-1-telegram-guest-mode]]"
@@ -30,6 +30,11 @@ related:
 > as Phase 1 MVP, defines the phased roadmap for the new formatting surface (Phase 2:
 > spoiler/underline/custom-emoji via markup), and defers structured `sendRichMessage`
 > blocks to a separate epic (Phase 3). Closes #6541.
+>
+> **Phase 1 MVP landed** in commit `fdd887fbf` (#6604): guest-mode escaping fix, per-line
+> multi-line/nested blockquote flattening, `expandable_blockquote_min_lines` config
+> (wired into `--init`/`--migrate-config`), all matching this spec's FR-001..009. Phase 2/3
+> (§8) remain roadmap-only — not implemented.
 
 ## Sources
 
@@ -338,6 +343,12 @@ on BlockQuote end:
 > for other multi-event constructs (e.g. lists), as long as the per-line `>` prefix invariant
 > (FR-005) and the length-triggered expandable form (FR-006/FR-007) hold.
 
+**As implemented (#6604):** nested `BlockQuote` events are flattened to a single `>`-per-line
+level via a bounded mark stack, `MAX_BLOCKQUOTE_NESTING_DEPTH = 512` (same pattern as
+`MAX_CHUNK_DEPTH`, #6595) — input nesting past the cap does not grow tracked-mark memory
+unboundedly; only the outermost mark within the cap is recorded, and flattening still applies
+beyond it.
+
 ---
 
 ## 8. Phase 2 / Phase 3 Roadmap (Not Committed in This Spec's PR)
diff --git a/specs/007-channels/spec.md b/specs/007-channels/spec.md
index 47568bcf7..edd18303d 100644
--- a/specs/007-channels/spec.md
+++ b/specs/007-channels/spec.md
@@ -328,6 +328,42 @@ A shared `StreamingBuffer` abstraction was extracted from channel-specific code.
 and Slack adapters now use the shared buffer for streaming chunk accumulation. Stub
 `elicit()` methods were added to Discord and Slack channels for future elicitation support.
 
+### Fail-Closed Allowlist Gate — Discord/Slack Parity (#6502, #6472, #6498)
+
+`TelegramChannel::start()` already refused to start with an empty allowed-users list.
+Discord (`allowed_user_ids`/`allowed_role_ids`) and Slack (`allowed_user_ids`) had no
+equivalent check: `DiscordChannel::new` and `SlackChannel::new`/`new_with_supervisor`
+started successfully with an empty allowlist and silently accepted messages from any
+sender — a fail-open default. Slack's recv-time filter in `slack/events.rs` (the actual
+per-message enforcement point, since `SlackChannel::recv`/`try_recv` do not re-check the
+allowlist) was a separate hand-rolled fail-open check with the same gap.
+
+A new `zeph_channels::auth` module centralizes both responsibilities so a future channel
+adapter cannot silently diverge from the fail-closed policy:
+
+- `require_configured_allowlist` — the **startup gate**, called before any listener is
+  spawned or network call made; refuses to start when every relevant allowlist is empty
+- `is_identity_allowed` / `all_lists_empty` — the **per-message check**, reused by every
+  adapter's `is_authorized` path and by `ConfirmLoop::confirm_accepts`
+
+An empty list is treated as "unrestricted" only inside the per-message check, which is
+safe *only* because the startup gate guarantees the list is never actually empty at call
+time in a correctly constructed adapter — the two must not be used independently.
+
+The `--init` wizard's Discord and Slack steps now prompt for an allowlist, mirroring
+Telegram's existing prompt, so a freshly initialized config is startable under the new
+fail-closed check.
+
+#### Key Invariants
+
+- Discord and Slack MUST refuse to start (fail closed) when their identity allowlist(s)
+  are entirely empty — mirroring Telegram's pre-existing policy; NEVER silently run open
+- Telegram, Discord, and Slack MUST share one authorization primitive
+  (`zeph_channels::auth`) for both the startup gate and the per-message check — no adapter
+  may hand-roll its own allowlist check
+- Breaking-but-safe: existing Discord/Slack configs with an empty allowlist fail to start
+  until an allowlist is configured; there is no opt-out config field
+
 ### Discord API 429 Rate-Limit Retry (#4746)
 
 `DiscordChannel` now handles HTTP 429 responses from the Discord API by reading the
@@ -339,3 +375,25 @@ HTTP 429 responses were propagated as `ChannelError::Send` and the message was d
 - On HTTP 429, the channel MUST wait `Retry-After` seconds before retrying — never drop the message
 - If `Retry-After` is absent or unparseable, fall back to a fixed 1-second delay
 - Retry applies to `send()` and `send_chunk()` only — `send_typing()` is non-critical and may be dropped on 429
+
+### Retry-After Clamp (#6516, #6496)
+
+`crates/zeph-channels/src/common/http_retry.rs`'s `send_with_retry` is the shared 429-retry
+dispatch path used by Discord, Slack, and Telegram alike. `f64::min` only guards against `NaN`,
+not negative values, so a malicious or misbehaving upstream 429 response with a negative or
+non-finite (`NaN`/`±inf`) `Retry-After` header or JSON body value reached
+`Duration::from_secs_f64` unclamped — which panics on such inputs, crashing the shared dispatch
+path for all three channels.
+
+`valid_retry_secs()` filters out non-finite and negative values from both the header and body
+sources, before the existing header → body → 1 s-default fallback and `MAX_RETRY_SECS` clamp —
+treating a hostile/malformed value exactly like an absent or unparseable one.
+
+#### Key Invariants
+
+- A `Retry-After` value (header or JSON body) MUST be validated finite and non-negative before
+  reaching `Duration::from_secs_f64` — an unclamped hostile value panics the shared dispatch path
+- A negative, `NaN`, or infinite `Retry-After` value MUST be treated the same as an absent or
+  unparseable one — fall through to the next source, then the 1 s default
+- This validation applies uniformly to Discord, Slack, and Telegram, since all three share
+  `send_with_retry`
diff --git a/specs/008-mcp/spec.md b/specs/008-mcp/spec.md
index 7f9223b66..8e5ead60f 100644
--- a/specs/008-mcp/spec.md
+++ b/specs/008-mcp/spec.md
@@ -106,6 +106,14 @@ Config migration step 50 adds these fields. Both live under `[[mcp.servers]]`.
 
 - `ToolRefreshEvent` channel is bounded to 16 slots (commit #4488) — prevents unbounded memory growth in high-churn registries
 - Cancellation token plumbed through retry loop (commit #4609) — shutdown is clean even during retry wait
+- **Breaking change (#6614)**: `McpClient::connect` no longer takes two adjacent positional
+  `bool`s (`suppress_stderr`, `env_isolation`) — it takes `StderrPolicy` (`Forward`/`Suppress`)
+  and `EnvPolicy` (`InheritAll`/`Isolated`) enums instead, so a future call-site edit can no
+  longer silently swap the two and flip security-relevant behavior (full parent-env
+  inheritance) without a compiler error. `connect_url`/`connect_url_with_headers`/
+  `connect_url_oauth` now take `McpTrustLevel` directly instead of a pre-collapsed
+  `trusted: bool`. No runtime behavior change — call sites in `manager/retry.rs` and
+  `manager/connect.rs` convert at the boundary.
 
 ## See Also
 
diff --git a/specs/010-security/spec.md b/specs/010-security/spec.md
index e32b06557..ca5c9d868 100644
--- a/specs/010-security/spec.md
+++ b/specs/010-security/spec.md
@@ -573,14 +573,25 @@ call risk signals.
 
 ### Integration
 
-`RiskChainAccumulator` is reset at `begin_turn()` via `SecurityState` and accumulates signals
-from `ShellExecutor` and `NetworkEgress` risk classifications during the tool loop. Signals
-are pushed to `RiskSignalQueue`. When a complete chain is detected, a `SecurityEvent::RiskChain`
-is emitted before the offending tool is executed.
+`RiskChainAccumulator::advance_turn()` (#6602) is called at `begin_turn()` via `SecurityState`
+and accumulates signals from `ShellExecutor` and `NetworkEgress` risk classifications during the
+tool loop. Signals are pushed to `RiskSignalQueue`. When a complete chain is detected, a
+`SecurityEvent::RiskChain` is emitted before the offending tool is executed. `advance_turn()`
+does NOT fully clear state — it prunes only calls older than a bounded window
+(`CROSS_TURN_WINDOW_TURNS`, 3 turns) and recomputes the cumulative score from what remains, so a
+chain deliberately split across turns (sensitive read in turn N, network egress in turn N+1) is
+still caught. Each detection pushes its signal code once (deduped while the same chain stays
+live) to avoid flooding `TrajectorySentinel` with duplicates from one logical attack.
 
 ### Key Invariants
 
-- `RiskChainAccumulator` MUST be reset at the start of every turn — accumulated chains never span across turns
+- `RiskChainAccumulator` is scoped to one agent **session** (constructed once per
+  session/connection, never shared across concurrent sessions via a common `Arc`) — a
+  per-connection-shared instance lets one session's turn boundary wipe or cross-contaminate
+  another session's chain state
+- `advance_turn()` prunes calls older than the bounded cross-turn window — it never fully
+  resets state, so a chain split across turns within the window is still detected; a call
+  that ages out of the window no longer contributes to a later detection
 - A `RiskChain` event blocks the triggering tool call — not just logs it
 - NEVER accumulate signals from subagent tool calls into the parent session's chain accumulator
 
diff --git a/specs/012-graph-memory/spec.md b/specs/012-graph-memory/spec.md
index 06aef7caf..30fff38e2 100644
--- a/specs/012-graph-memory/spec.md
+++ b/specs/012-graph-memory/spec.md
@@ -335,6 +335,102 @@ link_weight_decay_interval_secs = 86400
 
 ---
 
+## Graph Retrieval Strategy Dispatch (`GraphConfig::retrieval_strategy`, #6597, BREAKING)
+
+### Overview
+
+`[memory.graph] retrieval_strategy` selects which recall algorithm the live graph-recall path
+uses. Six variants, dispatched from `SemanticMemoryBackend::recall_graph_facts`
+(`crates/zeph-agent-context/src/memory_backend.rs`) to the matching `SemanticMemory` method:
+
+| `retrieval_strategy` value | `SemanticMemory` method | Description |
+|---|---|---|
+| `synapse` (default) | `recall_graph_activated` | SYNAPSE spreading activation — see above |
+| `bfs` | `recall_graph` | Hop-limited BFS (pre-SYNAPSE behavior) |
+| `astar` | `recall_graph_astar` | A* shortest-path via petgraph — see PRISM below |
+| `watercircles` | `recall_graph_watercircles` | Concentric ring BFS — see below |
+| `beam_search` | `recall_graph_beam` | Beam search, top-K candidates per hop (`beam_search.beam_width`) |
+| `hybrid` | classifies the query first via `classify_graph_strategy`, then dispatches to the matching method above | Dynamic per-query strategy selection |
+
+`spreading_activation.enabled = true` force-overrides the resolved strategy to `synapse`
+regardless of `retrieval_strategy`'s configured value.
+
+### Before #6597: Dead-on-Arrival Config Field
+
+`retrieval_strategy` was parsed, validated, and documented in `zeph-config`, but the live
+recall path used by every real entry point (CLI/ACP/daemon/serve) never read it — it only
+switched on the `spreading_activation.enabled` boolean (SYNAPSE vs. plain BFS). The correct
+6-way dispatch logic existed in `zeph-agent-context::helpers`, but that module had zero
+production callers — a "wired in isolation, never connected" defect. #6597 ports the dispatch
+into the live path (`zeph-context`'s `fetch_graph_facts` → `zeph-agent-context`'s
+`SemanticMemoryBackend::recall_graph_facts`) and removes the now-fully-dead duplicate chain
+from `zeph-agent-context::helpers`.
+
+`ZoomIn`/`ZoomOut` `recall_view` enrichment (source-message provenance, 1-hop neighbor
+expansion) — previously implemented only inside `SemanticMemory::recall_graph_view` — is
+preserved across all 6 strategies via a shared `SemanticMemory::enrich_recall_view` post-dispatch
+pass, run after whichever concrete method produced the base fact set.
+
+### Config
+
+```toml
+[memory.graph]
+retrieval_strategy = "synapse"   # synapse | bfs | astar | watercircles | beam_search | hybrid
+
+[memory.graph.beam_search]
+beam_width = 10
+
+[memory.graph.watercircles]
+ring_limit = 0   # 0 = auto (recall_limit / max_hops)
+```
+
+### Key Invariants
+
+- `spreading_activation.enabled = true` always overrides `retrieval_strategy` to `synapse` — never let a configured `bfs`/`astar`/etc. silently win over an explicitly enabled spreading-activation config
+- `enrich_recall_view` (ZoomIn/ZoomOut) MUST run after every strategy's base recall, not just BFS's — `memcot_config.recall_view` must keep working regardless of `retrieval_strategy`
+- `hybrid` classifies once per `recall_graph_facts` call, then dispatches — never re-classifies per candidate
+
+### BREAKING CHANGE (#6597)
+
+Deployments running the default graph-memory config (`spreading_activation.enabled = false`,
+`retrieval_strategy` left unset) now use SYNAPSE spreading-activation recall
+(`recall_graph_activated`) instead of the previous, unintentional plain-BFS fallback
+(`recall_graph`) — before this fix, `retrieval_strategy` was never read at all, and the live
+path fell back to BFS purely because `spreading_activation`'s own params were only built when
+`enabled = true`. Set `retrieval_strategy = "bfs"` under `[memory.graph]` to keep the prior
+BFS-only behavior. Spreading activation is more expensive per-recall than plain BFS —
+deployments sensitive to graph-recall latency/cost should benchmark before upgrading or pin
+`retrieval_strategy = "bfs"`.
+
+---
+
+## WaterCircles: Concentric Ring BFS. `crates/zeph-memory/src/graph/retrieval_watercircles.rs`.
+
+### Overview
+
+`graph_recall_watercircles` (`retrieval_strategy = "watercircles"`) buckets BFS-discovered
+edges into concentric rings by hop distance from the seed entities, returning results ring by
+ring up to `max_hops`. `[memory.graph.watercircles] ring_limit` caps facts returned per ring
+(`0` = auto: `recall_limit / max_hops`).
+
+### Ring-Hop Distance Fix (#6600)
+
+`hop_dist` for an edge must be the edge's **farther** endpoint from the seed — i.e.
+`max(source_depth, target_depth)` — not simply "prefer source, fall back to target". BFS
+discovers an edge regardless of traversal direction, so an edge's source-node depth is almost
+always present in the depth map but one ring shallower than the edge's true ring. Before
+this fix, `hop_dist` preferred source depth whenever present, so the `dist != hop` ring filter
+never matched for any typical seed-outward graph — every edge was silently dropped regardless
+of `ring_limit`, for any `ring_limit`.
+
+### Key Invariants
+
+- `hop_dist = max(source_depth, target_depth)` — NEVER prefer one endpoint's depth over the
+  other; a "prefer source, fallback to target" rule misclassifies the ring for edges discovered
+  in the opposite BFS orientation and silently drops them from every ring's results
+
+---
+
 ## PRISM: Query-Sensitive A* Edge Costing (#4079, #4360)
 
 Opt-in traversal enhancement that weights BFS graph recall by cosine similarity between the
diff --git a/specs/013-acp/spec.md b/specs/013-acp/spec.md
index e834ae5fa..439baff3b 100644
--- a/specs/013-acp/spec.md
+++ b/specs/013-acp/spec.md
@@ -8,7 +8,7 @@ tags:
   - protocol
   - acp
 created: 2026-04-08
-updated: 2026-07-17
+updated: 2026-07-21
 status: approved
 related:
   - "[[MOC-specs]]"
@@ -34,6 +34,7 @@ related:
 | 1.6 | 2026-07-01 | developer | Review fix pass on #5361/#5362: (S-C1) `default_temperature_preset` is now primed into the effective `provider_override` at session creation (`do_new_session`/`do_load_session`/`do_fork_session`/`do_resume_session`), not just advertised in the IDE dropdown; (S-C2) the `$/cancel_request` watcher select is now `biased` with prompt completion checked first, and `drain_agent_events` drains a stale `cancel_signal` permit before its main loop, so a cancellation resolving at/after prompt completion can no longer leak into the next, unrelated prompt (also hardens the pre-existing `session/cancel` no-active-prompt race — `cancel_before_prompt_returns_cancelled` renamed to `cancel_before_prompt_is_a_no_op` to reflect the corrected semantics). Documented fork/resume reset behavior for `temperature_preset` (#5373 tracking issue filed); filed #5374 for the untested `resume_session` store-backed path. |
 | 1.7 | 2026-07-01 | developer | Fixed #5379: `zeph acp model-config show` now loads the resolved config and marks the active `[acp.model_config].default_temperature_preset` in its output, instead of only printing the static preset table. Resolved #5373: `session/fork` and `session/resume` now inherit `model`/`temperature_preset`/`thinking_enabled`/`auto_approve_level` from the source session (live in-memory state, falling back to a persisted close-time snapshot, falling back to configured defaults) instead of always resetting to defaults — new `acp_sessions` columns via migration `105_acp_session_config`; see "Fork/Resume Config Inheritance" below. |
 | 1.8 | 2026-07-17 | developer | Renovate `rust-minor-patch` bundle bumped core `1.0.1`→`1.2.0`, schema `=1.1.0`→`=1.4.0`. Core `1.1.0` stabilized `$/cancel_request` unconditionally and dropped its `unstable_cancel_request` forward — `unstable-cancel-request` is now a local-only opt-in gate (Cargo feature unchanged, but no longer maps to an upstream feature); `unstable-boolean-config` tombstoned the same way after schema `1.1.0` made `SessionConfigOptionValue::Boolean` unconditional. Schema `1.4.0` renamed `SetProviderRequest`/`DisableProviderRequest`/`ProviderInfo`'s `id: String` field to `provider_id: ProviderId` (`Arc<str>` newtype) — updated all `providers.rs` call sites and tests. No handler/transport/builder-chain logic changed otherwise. |
+| 1.9 | 2026-07-21 | developer | Mechanical decomposition (#6624): `ZephAcpAgentState`'s god-object `agent/mod.rs` (4424 lines, six unrelated responsibilities) split into eight sibling files under `crates/zeph-acp/src/agent/`. No public API or behavior change. See "Implementation Structure" below. |
 
 > [!warning] Body narrative lags the 1.8 changelog entry — 2026-07 audit
 > Only the top summary (line 22) and the changelog table above were updated for the 1.8 bump.
@@ -98,6 +99,33 @@ AcpSessionManager
 - Session fork: create a new session branching from an existing session at a given turn
 - Session resume: reconnect to an existing session by ID
 
+## Implementation Structure (`agent/` module decomposition, #6624)
+
+`ZephAcpAgentState` (the ACP session coordinator struct) had accumulated six unrelated
+responsibilities spanning ~2955 lines of impl blocks inside a 4424-line `agent/mod.rs`:
+builder wiring, idle-session reaping, LSP diagnostics, session lifecycle, slash-command/model
+dispatch, and MCP extension handling. This increased merge-conflict surface on every ACP
+feature PR and made it hard to reason about which methods were safe to test in isolation.
+
+Each cluster was extracted into a sibling file under `crates/zeph-acp/src/agent/`, following
+the existing `providers.rs`/`usage.rs` precedent (file-local `impl ZephAcpAgentState` blocks):
+
+| Module | Responsibility |
+|---|---|
+| `builder.rs` | Dependency wiring / construction |
+| `reaper.rs` | Idle-session reaping |
+| `lsp_events.rs` | LSP diagnostics forwarding |
+| `mcp_ext.rs` | MCP extension-method handling |
+| `model.rs` | Model switching / model_config dispatch |
+| `slash.rs` | Slash-command dispatch |
+| `turn.rs` | Turn/prompt execution |
+| `session.rs` | Session lifecycle (new/load/fork/resume/close) |
+
+`mod.rs` shrank from 4424 to 1408 lines, retaining the struct definition, type aliases, and
+thin protocol dispatch methods. Mechanical extraction only: all 25 fields stay on the
+coordinator struct, no behavior change, no signature changes beyond the necessary
+private-to-`pub(crate)` visibility bumps required for cross-file calls within the crate.
+
 ### Agent Spawner Contract (1.0.1)
 
 Agent sessions use the `Agent.builder()` / `run_agent()` pattern. Session state is `Arc`-wrapped.
@@ -130,6 +158,35 @@ AcpPermissionGate (TOML-backed, SQLite-persisted)
 - Async request queue: async lookup with oneshot reply channels — agent blocked until user answers
 - Tool call lifecycle: `proposed → approved/denied → persisted → executed → result`
 
+### Shell Interpreter Permission Cache Identity (#6511, #6485)
+
+For ordinary binaries, the "Allow always"/"Reject always" cache key is the extracted
+binary name (`build_permission_title` in `crates/zeph-acp/src/terminal.rs`), preserving
+per-binary granularity. For shell interpreters (`SHELL_INTERPRETERS`: `bash`, `sh`, `zsh`,
+`fish`, `dash`) the binary name alone does not determine what the command does — `bash -c
+<script>` can run arbitrary code, and shell-stdin writes are equivalent to typing more
+commands. Keying the cache on the interpreter name alone let one approved `bash -c` script
+silently authorize every future invocation of that interpreter regardless of content,
+including the args-form (`command` + structured `args`) variant and case-variant
+interpreter names.
+
+The cache key for shell interpreters now embeds a BLAKE3 digest of the effective
+payload — the full command line, or (for the args-form) `command` joined with `args` via
+a `\u{1}` separator (`effective_bash_payload`), or the stdin bytes for `bash_stdin` writes.
+"Allow always" is therefore scoped to the exact command/payload: repeating the identical
+command still short-circuits the prompt, but any different command triggers a fresh IDE
+prompt.
+
+#### Key Invariants
+
+- A shell-interpreter "Allow always" grant MUST NOT extend to a different command/payload
+  through the same interpreter — the cache identity binds to a digest of the payload, not
+  the interpreter name alone
+- This applies uniformly to both the inline-command and args-form (`command` + `args`)
+  invocation styles, and to `bash_stdin` writes
+- Breaking change: persisted shell-interpreter permission cache entries from before this
+  fix are silently ignored and re-prompted
+
 ## Protocol Messages
 
 - Rich content: images, file resources, binary data
diff --git a/specs/014-a2a/spec.md b/specs/014-a2a/spec.md
index e83946bcc..af29477bd 100644
--- a/specs/014-a2a/spec.md
+++ b/specs/014-a2a/spec.md
@@ -104,6 +104,13 @@ vault-referenced, since these are public keys). Env override: `ZEPH_A2A_CARD_TRU
 Setting `card_trust_policy = "require"` while the `card-signing` feature is not compiled in
 **fails config load** (`Config::validate`) rather than silently downgrading to `ignore`.
 
+Since #6553/PR #6615 (`e0af1f70c`), resolving to the default `ignore` policy emits a
+`tracing::warn!` at TUI-remote discovery time (`src/tui_remote.rs`), plus a visible in-chat
+system message queued before any other TUI event (default logging alone is not a reliable
+signal in `--tui` mode — the stderr layer is suppressed there) — a non-fatal, visibility-only
+change: peer `AgentCard`s are still accepted without signature/origin verification under
+`ignore`, the same as before.
+
 ## JSON-RPC 2.0 Protocol
 
 ```
@@ -180,6 +187,13 @@ so a call site can never silently inherit a permissive client by omission (issue
 `A2aClient::new_insecure` is the explicit opt-in to `SecurityPolicy::permissive()` for
 local/dev callers that want the previous default-constructor behavior.
 
+> [!warning] BREAKING CHANGE (#6553/PR #6615, `e0af1f70c`)
+> `A2aClient::new` changed signature from `new(client)` (permissive by default) to
+> `new(client, security)` — the `SecurityPolicy` argument is now mandatory, not optional via
+> `.with_security(...)`. Existing callers of `A2aClient::new(client)` must migrate to either
+> `A2aClient::new(client, SecurityPolicy::hardened())` (recommended for production) or
+> `A2aClient::new_insecure(client)` (explicit opt-in, equivalent to the old default).
+
 ### SSRF invariant: validated address == connected address
 
 `validate_endpoint` resolves the endpoint hostname via DNS once and returns the resolved
diff --git a/specs/017-index/spec.md b/specs/017-index/spec.md
index f80409677..7bb96dbea 100644
--- a/specs/017-index/spec.md
+++ b/specs/017-index/spec.md
@@ -141,6 +141,20 @@ crates/zeph-core/src/agent/mod.rs
 - Size bounded by `max_repo_map_tokens` config
 - Generated on demand, not pre-computed
 
+## Recursion Depth Guard (#6551, #6595)
+
+`chunk_children` (AST descent in `chunker.rs`) recursed on the native call stack with no depth
+limit, letting an adversarially deep source file (e.g. thousands of nested brackets placed in a
+watched/indexed project directory) exhaust the stack and abort the process (CWE-674, uncatchable
+by `Result`/`catch_unwind`). It now takes an explicit `depth: usize` parameter bounded by
+`MAX_CHUNK_DEPTH = 512`; at the bound, the oversized subtree is emitted as a single leaf chunk
+instead of recursing further, and a `tracing::warn!` is logged.
+
+### Key Invariants
+
+- `chunk_children` MUST bound AST descent depth (`MAX_CHUNK_DEPTH`) — never recurse unboundedly on parsed source
+- At the depth bound, degrade gracefully (emit the remaining subtree as one leaf chunk) — never panic or crash
+
 ## Key Invariants
 
 - Indexing always runs in background — never block agent loop
diff --git a/specs/019-gateway/spec.md b/specs/019-gateway/spec.md
index 7cbbf12b3..3ff534679 100644
--- a/specs/019-gateway/spec.md
+++ b/specs/019-gateway/spec.md
@@ -55,9 +55,20 @@ AuthConfig { auth_token: Option<blake3::Hash> }
 - **Never use `==` for token comparison** — timing side-channel
 - Only `bearer_hash` stored/logged — plaintext token never persisted
 - Warning logged if binding to `0.0.0.0` without explicit acknowledgment
+- **Auth is mandatory, fail-closed (#6487, closes #6509's premise)**: `GatewayServer::serve()`
+  refuses to start (`GatewayError::MissingAuthToken`) when `auth_token` is `None`, empty, or
+  whitespace-only — since `POST /webhook` forwards its body directly into the agent's turn loop,
+  an unauthenticated gateway lets any caller that reaches the listener inject content. This
+  replaced the prior behavior of logging a warning and continuing with auth disabled.
+  `build_router`'s `AuthConfig::require_auth` is derived from whether a non-empty token was
+  actually passed in (no longer hardcoded `false`); direct `build_router()` callers (tests) can
+  still construct a no-auth router, but `serve()` is the only production entry point and it
+  always fails closed first.
 
 Auth middleware flow:
-1. If `auth_token` is `None` → skip auth (no token configured)
+1. `GatewayServer::serve()` fails closed at startup if no non-empty token is configured (see
+   above) — the middleware's `None`-token skip-auth branch is only reachable via a direct
+   `build_router()` call (tests), never through `serve()` in production.
 2. Extract `Authorization: Bearer <token>` header
 3. `blake3::hash(submitted_token).ct_eq(expected_hash)` — constant-time
 4. Missing header or mismatch → 401 Unauthorized
@@ -89,6 +100,29 @@ POST /webhook
 - Shutdown via `watch::Receiver` — server listens for signal, gracefully closes connections
 - Webhook sender (`webhook_tx`) is closed on shutdown
 
+## Startup Supervision
+
+- `src/gateway_spawn.rs`'s `spawn_gateway_server` registers the `gateway_server` task through
+  `TaskSupervisor::spawn_classified(..., Result::is_ok)` (#6510) and propagates `serve()`'s
+  `Result` instead of discarding it into a log line. A startup failure (bind error, or
+  `GatewayError::MissingAuthToken`) now surfaces as `TaskStatus::Failed` in
+  `list_tasks()`/the TUI — previously every outcome, success or failure, was reported as
+  `Completed`, making a failed gateway indistinguishable from a normal one at the supervision
+  layer.
+- `TaskSupervisor::spawn_classified` (`zeph-common`) is the general mechanism behind this: it
+  classifies a supervised task's typed `Future::Output` via a caller-supplied `is_success`
+  predicate, so a task whose `Fut::Output` encodes failure (typically `Result<T, E>`) is
+  reported by its actual outcome rather than by whether the outer future merely resolved.
+
+## Setup & Diagnostics
+
+- `--init`'s Prometheus step, which auto-enables `[gateway]` as a side effect, now discloses that
+  this also opens the `POST /webhook` endpoint and prints `zeph vault set ZEPH_GATEWAY_TOKEN
+  <token>` instructions — the wizard never prompts for the raw token itself; it is resolved from
+  the age vault at startup like other vault-only secrets (#6487).
+- `zeph doctor` has a `gateway.auth` check that flags `[gateway] enabled = true` with no
+  resolvable `auth_token` before a real launch attempt (#6487).
+
 ## Key Invariants
 
 - Auth middleware runs before all handlers — enforced by middleware layer order in router build
@@ -99,3 +133,7 @@ POST /webhook
 - Gateway only injects into `message_queue` via mpsc — never calls agent methods directly
 - Max body size enforced (1 MiB default) — requests exceeding this are rejected with 413
 - Plaintext token never stored, logged, or included in error messages
+- **Fail-closed startup (#6487)**: `[gateway] enabled = true` with no non-empty `auth_token` MUST
+  refuse to start (`GatewayError::MissingAuthToken`), never silently run open
+- **Startup failure MUST surface as `TaskStatus::Failed` (#6510)**, never `Completed` — a
+  supervised gateway that fails to bind or start is a review-visible anomaly, not silent success
diff --git a/specs/038-vault/spec.md b/specs/038-vault/spec.md
index 4dbf4b97a..df4cb8397 100644
--- a/specs/038-vault/spec.md
+++ b/specs/038-vault/spec.md
@@ -374,10 +374,53 @@ cargo run --features full -- vault set ZEPH_OPENAI_API_KEY sk-proj-...
 # List all keys (without values)
 cargo run --features full -- vault list
 
-# Generate a new age keypair
-cargo run --features full -- vault init-age
+# Generate a new age keypair and empty vault (refuses to overwrite an existing one; see §9.2)
+cargo run --features full -- vault init
+# cargo run --features full -- vault init --force   # overwrite an existing vault
 ```
 
+### 9.1 Vault Location Overrides (`--vault`, `--vault-key`, `--vault-path`)
+
+Every vault-touching CLI path resolves the vault location with a single precedence: **CLI flag
+> `ZEPH_VAULT_KEY`/`ZEPH_VAULT_PATH` env var > default vault directory**, via
+`crate::bootstrap::parse_vault_args` (and its thin wrapper `crate::bootstrap::resolve_vault_paths`,
+which falls back to `default_vault_dir()` gracefully rather than failing the caller).
+
+This precedence was the intended contract from `zeph doctor` and agent startup's inception, but
+several vault-key consumers bypassed it by hardcoding `default_vault_dir()` directly. As of #6610
+(2026-07-20), the following gap-closure fixes made the guarantee uniformly true across the binary:
+- `zeph vault init` (#6499) — previously ignored the overrides entirely, always targeting the
+  default directory
+- `zeph vault {get,set,list,rm,init}` env var resolution (#6522) — previously honored only the CLI
+  flag, not `ZEPH_VAULT_KEY`/`ZEPH_VAULT_PATH`
+- `zeph durable`'s key-material loaders (`load_write_cipher`, `load_write_hmac_key`,
+  `load_write_hwm_key`, `load_integrity_seal`), `rotate-key`, and the history-chain integrity
+  bootstrap (`configure_history_integrity`) (#6590) — previously hardcoded `default_vault_dir()`,
+  so `zeph doctor`'s `integrity.anchor` check could report `OK` against an override vault while
+  the real runtime writer silently read the default vault instead. Also fixed: `zeph serve`'s
+  non-foreground detach re-exec, which previously dropped `--vault-key`/`--vault-path` entirely
+  for the long-running daemon child process
+- registry token resolution for `zeph skill`/`zeph plugin` `search`/`get` (#6610) — previously
+  hardcoded `default_vault_dir()` for the age backend, so registry auth could resolve against a
+  different vault than the rest of the command
+
+Every vault-touching code path in the binary — init, subcommands, registry token resolution, and
+durable key-material resolution — now resolves the vault location identically. A future call site
+that reads vault key material without going through `bootstrap::resolve_vault_paths`/
+`parse_vault_args` reopens this defect class.
+
+### 9.2 Overwrite Guard on `vault init`
+
+`zeph vault init` refuses to overwrite an existing vault (a `vault-key.txt` or `secrets.age`
+already present at the resolved target) unless `--force` is passed (#6499). This closed a
+data-loss incident where `init` unconditionally regenerated a fresh, empty keypair over a live
+vault holding real secrets, silently destroying them with no recovery path.
+`AgeVaultProvider::init_vault_at(key_path, vault_path, force)` is the guarded primitive;
+`init_vault(dir)` (the pre-existing ~20 internal call sites) is a thin `force: false` wrapper, so
+every caller gets the guard by default with no signature changes required at those call sites. A
+`--force` overwrite prints an explicit "Overwriting existing vault at ..." notice, distinct from
+the normal first-time "Vault initialized:" success message.
+
 ---
 
 ## 10. Key Invariants
@@ -389,6 +432,10 @@ cargo run --features full -- vault init-age
 - All secret memory is zeroized on drop — no plaintext leaks
 - Vault failures are fatal at startup (missing key → error, not fallback)
 - Age vault key file is created with `0600` permissions on Unix
+- `--vault-key`/`--vault-path` CLI overrides (and `ZEPH_VAULT_KEY`/`ZEPH_VAULT_PATH` env vars)
+  resolve identically across every vault-touching path: init, subcommands, registry token
+  resolution, and durable key-material loading (§9.1)
+- `zeph vault init` never silently overwrites an existing vault — requires `--force` (§9.2)
 
 ### Ask First
 - Using `backend = "env"` in a persistent config (should be `age` or explicit CI handling)
diff --git a/specs/040-sanitizer/spec.md b/specs/040-sanitizer/spec.md
index e82eac894..98abcc142 100644
--- a/specs/040-sanitizer/spec.md
+++ b/specs/040-sanitizer/spec.md
@@ -49,6 +49,7 @@ eight layers, each addressing different threat vectors:
 | 9 | `IpiFilter` | Unwired | Weighted-pattern Indirect Prompt Injection scorer for web-scraped content |
 | 10 | `NliSanitizer` | Wired | SONAR NLI entailment-based injection layer; can be attached via builder |
 | 11 | `SecretMaskRegistry` | Wired | Vault-secret placeholder masking at the LLM boundary |
+| — | `secret_shape::scrub_secret_shapes` | Wired | Shape-based (not registered-value) secret masking — catches secrets a subagent fabricates/echoes (#6593) |
 | 12 | `ShadowMemory` | Wired | Cross-turn goal-drift detector; complements Layer 8's single-batch analysis |
 
 ---
@@ -243,6 +244,16 @@ impl QuarantinedSummarizer {
 (`quarantine_summarizer_timeout_secs`, default 30s). Timeout returns `SummarizedFacts::empty()`
 rather than propagating an error — the agent continues without the extracted facts (commit #4526).
 
+**Fail strategy on extraction error (#6511)**: `QuarantineConfig.fail_strategy`
+(`GuardrailFailStrategy`, default `Closed`) governs what happens when `extract_facts` itself
+errors (distinct from the timeout case above, which already yields empty facts). All three
+call sites now check `error_should_block()`: under the default `Closed` strategy, the
+pre-quarantine sanitized content is **not** used as a fallback — a blocked placeholder
+(`QUARANTINE_BLOCKED_PLACEHOLDER`) is substituted instead, since quarantine-flagged content is
+by definition the highest-risk content the agent handles and falling back to baseline-only
+sanitization on LLM error would let it reach the LLM context anyway. Operators may opt into
+`Open` (fail-open, pre-1.0 explicit choice) via config.
+
 ```rust
 ```
 
@@ -295,6 +306,21 @@ Example: If the agent's response contains:
 
 The guard detects the unexpected external URL and logs a risk.
 
+### 8.1 URL-Matching Hardening (#6507, #6518, #6523)
+
+Detection covers scheme case-insensitively (`HTTPS://`, mixed-case), scheme-relative
+destinations (`//evil.com/...`, treated as external — a renderer follows these identically to
+an explicit `https://`), and CommonMark/HTML5-valid markdown/HTML image variants beyond the
+original literal syntax (leading whitespace or angle-bracket-wrapped destinations, unquoted
+HTML `img src`). The tool-URL flagging path (`URL_EXTRACT_RE`/`flagged_urls`, distinct from
+`scan_output`'s image-URL detection) normalizes both scheme and scheme-relative forms to a
+canonical shape before set-membership comparison, so the same origin captured in either
+textual form still matches.
+
+**Key invariant**: scheme matching in all exfiltration-guard URL detection is
+case-insensitive and treats a scheme-relative (`//host/...`) URL as equivalent to an explicit
+`https://` — NEVER anchor detection on a literal-case, scheme-required pattern.
+
 ---
 
 ## 9. Memory Validation (Layer 7)
@@ -503,6 +529,47 @@ provider = ""   # [[llm.providers]] name; empty = primary provider fallback
 
 ---
 
+## Generic Secret-Shape Masking (#6593)
+
+`SecretMaskRegistry` only masks literal secret *values* explicitly registered at runtime
+(actual vault-loaded secrets) — a secret-shaped string a subagent invents, fabricates, or
+echoes in its own generated text (e.g. an `sk-`-prefixed API key it hallucinates) is invisible
+to it. `zeph_sanitizer::secret_shape::scrub_secret_shapes` closes this gap by pattern-matching
+known secret *shapes* (API-key prefixes from `zeph_common::secrets`, `Authorization: Bearer`
+headers, standalone JWTs) regardless of registration. Wired into the sub-agent live-transcript
+forward pipeline and the background sub-agent completion notice; `zeph-core::redact::redact_secrets`
+delegates to the same function rather than duplicating the regex logic.
+
+### Key Invariants
+
+- Shape-based masking is a **complement** to `SecretMaskRegistry`, not a replacement — exact
+  registered-value masking still runs; shape-based masking additionally catches unregistered,
+  agent-fabricated or agent-echoed secret-shaped strings
+- Any operator-visible surface that displays raw or lightly-processed sub-agent output
+  (transcript forwarding, completion notices) MUST pass through shape-based masking, not only
+  `SecretMaskRegistry`
+
+## JSON Recursion Depth Guard (#6551, #6554, #6594, #6595, #6605)
+
+Recursive JSON traversal helpers that walk arbitrarily-nested tool-call/tool-output values
+(`ExfiltrationGuard`'s `collect_strings` in `exfiltration.rs`, and sibling scanners in
+`zeph-tools`'s `verifier.rs`) previously recursed on the native call stack with no depth
+limit — adversarially deep, nested JSON (e.g. from a prompt-injected tool result or LLM
+output) could exhaust the stack and abort the process (CWE-674, uncatchable by
+`Result`/`catch_unwind`). Each now takes an explicit `depth: usize` parameter bounded by a
+module-level `MAX_JSON_DEPTH = 256`; at the bound, further descent is skipped (content past
+the bound is simply not scanned) and a `tracing::warn!` is logged.
+
+### Key Invariants
+
+- Every recursive JSON-value walker in the sanitization/verification path MUST bound descent
+  depth (`MAX_JSON_DEPTH` or equivalent) — never recurse unboundedly on parsed tool
+  input/output
+- At the depth bound, degrade gracefully (stop scanning further, log a warning) — never panic
+  or crash; the bound limits nesting *depth*, not element count/width
+
+---
+
 ## 15. See Also
 
 - [[MOC-specs]] — all specifications
diff --git a/specs/041-experiments/spec.md b/specs/041-experiments/spec.md
index 5262864bb..5b7181203 100644
--- a/specs/041-experiments/spec.md
+++ b/specs/041-experiments/spec.md
@@ -418,7 +418,29 @@ parallel_evals = 3   # max concurrent subject model calls in Phase 1 and Phase 2
 
 ---
 
-## 12. See Also
+## 12. `ParameterRange` Deserialization Validation (#6606)
+
+`ParameterRange` (used by the hyperparameter search space, `zeph-experiments::search_space`)
+enforces its invariants — `min < max` (both finite), `min <= default <= max`, and `step`
+finite and positive when `Some` — in `ParameterRange::new`. A derived `Deserialize`
+previously populated the private fields directly, bypassing `new()`: a config-supplied
+out-of-order range (e.g. `min > max`) deserialized successfully and only panicked later, in
+`clamp()`, via `f64::clamp`'s `min <= max` precondition.
+
+Deserialization now routes through a private `RawParameterRange` shadow struct via
+`#[serde(try_from = "RawParameterRange")]`, so every deserialized `ParameterRange` — from
+TOML config or any other source — passes through the same validation as programmatic
+construction. `SearchSpace::is_valid`, a dead validation-bypass guard with zero production
+callers, was removed as superseded.
+
+### Key Invariants
+
+- Every `ParameterRange` construction path, including deserialization, MUST validate through `ParameterRange::new`'s invariants — NEVER derive `Deserialize` directly on `ParameterRange`
+- An invalid range MUST fail at deserialization time (config/search-space load) — NEVER panic later at `clamp()`/`quantize()` call time
+
+---
+
+## 13. See Also
 
 - [[MOC-specs]] — all specifications
 - [[029-feature-flags/spec]] — compile-time feature flags
diff --git a/specs/042-zeph-commands/spec.md b/specs/042-zeph-commands/spec.md
index 52a444d51..076284b7f 100644
--- a/specs/042-zeph-commands/spec.md
+++ b/specs/042-zeph-commands/spec.md
@@ -16,6 +16,7 @@ related:
   - "[[001-system-invariants/spec]]"
   - "[[002-agent-loop/spec]]"
   - "[[030-tui-slash-autocomplete/spec]]"
+  - "[[049-agent-decomposition/spec]]"
 ---
 
 # Spec: Slash Command Registry (`zeph-commands`)
@@ -253,6 +254,51 @@ before calling `handler.handle()`.
 
 ---
 
+## 13. `AgentAccess` God-Trait Split (#6543)
+
+`AgentAccess` — the trait `zeph-core`'s `Agent<C>` implements to expose itself to command
+handlers as a trait object — had grown to 53 async methods spanning 40+ unrelated command
+domains in a single trait, forcing every handler to depend on the entire surface and
+blocking targeted review or testing of a single domain (same defect class as
+[[049-agent-decomposition/spec]]'s god-object decomposition, applied here to the command
+access boundary instead of `Agent<C>`'s fields).
+
+`AgentAccess` itself and its 15 domain sub-traits are defined in `zeph-commands`
+(`src/traits/`, one file per sub-trait); `zeph-core` provides the concrete `impl` blocks on
+`Agent<C>`, split out of the former monolithic `agent_access_impl.rs` into per-domain
+`*_commands.rs` files under `crates/zeph-core/src/agent/` (e.g. `memory_commands.rs`,
+`model_commands.rs`, `worktree_commands.rs`).
+
+### Sub-Traits
+
+| Sub-trait | Domain |
+|-----------|--------|
+| `MemoryAccess` | Semantic memory read/write |
+| `GraphAccess` | Memory graph queries |
+| `ModelAccess` | LLM provider/model selection and routing |
+| `SkillAccess` | Skill registry, matching, hot-reload |
+| `PolicyAccess` | Tool/security policy state |
+| `SchedulerAccess` | Cron-based scheduled task management |
+| `LspAccess` | LSP client state (IDE/ACP) |
+| `SessionControlAccess` | Session lifecycle (resume, fork, exit) |
+| `McpAccess` | MCP server connections and tool registry |
+| `OrchestrationAccess` | Task orchestration / DAG execution |
+| `SubagentAccess` | Subagent spawning, grants, transcripts |
+| `IntegrationAccess` | External integrations (channels, webhooks) |
+| `TrackingAccess` | Cost/usage tracking |
+| `WorktreeAccess` | Git worktree lifecycle for subagents |
+| `MiscAccess` | Remaining cross-cutting operations that don't fit another domain |
+
+`AgentAccess` becomes an empty marker supertrait (`trait AgentAccess: MemoryAccess + ... + MiscAccess + Send {}`) with a blanket `impl<T> AgentAccess for T where T: ...`, so `dyn AgentAccess` and existing call sites are unaffected.
+
+### Key Invariants
+
+- Pure refactor — no behavior change; `Agent<C>`'s method bodies moved, not modified
+- New handler domains MUST add a method to the matching existing sub-trait, or a new sub-trait if none fits — NEVER grow `MiscAccess` or `AgentAccess` directly as a catch-all
+- `AgentAccess` stays an empty marker supertrait — NEVER add methods directly to it
+
+---
+
 ## 9. Open Questions
 
 None.
diff --git a/specs/044-subagent-lifecycle/spec.md b/specs/044-subagent-lifecycle/spec.md
index 133557316..df9cf3a13 100644
--- a/specs/044-subagent-lifecycle/spec.md
+++ b/specs/044-subagent-lifecycle/spec.md
@@ -97,12 +97,16 @@ SO THAT secrets are not exposed beyond the subagent's session lifetime.
 **Acceptance criteria:**
 
 ```
-GIVEN a Grant with kind=VaultSecret and a TTL of 300s
+GIVEN a Grant with kind=Secret(key) and a TTL of 300s
 WHEN the grant expires (TTL elapses)
 THEN subsequent calls to grants.check() return Err for that grant
 AND memory is zeroized when the grant is dropped
 ```
 
+`GrantKind::Tool(tool_name)` grants are TTL-tracked identically but are a separate,
+narrower mechanism — see Section 17 for its distinct default-permit, time-box-only
+enforcement semantics, which differ from `Secret`'s fail-closed check.
+
 ### US-004: Tool Policy Enforcement
 
 AS A subagent spawned with a restricted tool policy
@@ -215,7 +219,7 @@ AND memory content exceeding the token budget is truncated, not omitted entirely
 | `SpawnContext` | Parent-derived spawn state | `parent_messages`, `parent_cancel`, `parent_provider_name`, `spawn_depth`, `mcp_tool_names`, `max_trust_level`, `inherited_tool_allowlist` |
 | `PermissionGrants` | TTL-bounded permission registry | Map of `GrantKind` → expiry timestamp |
 | `Grant` | Single permission grant | `kind: GrantKind`, `ttl_secs`, expiry instant |
-| `GrantKind` | Type of permission | Variants: `VaultSecret`, `Tool` |
+| `GrantKind` | Type of permission | Variants: `Secret(String)` (vault key), `Tool(String)` (tool name, #6625) |
 | `FilteredToolExecutor` | Tool executor with policy gate | Wraps real executor; enforces `ToolPolicy` and denylist; tool ID comparison is case-insensitive and strips argument suffixes via `normalize_tool_id` |
 | `MemoryAwareExecutor` | Sandbox-bypass executor for `memory: user` subagents | Wraps inner executor; retries `SandboxViolation` file-tool calls against a `FileExecutor` scoped to `~/.zeph/agent-memory/<name>/`; path canonicalization delegated to `FileExecutor` to prevent traversal (#3771) |
 | `PlanModeExecutor` | Executor for plan mode | Wraps real executor; disables write operations |
@@ -456,12 +460,39 @@ arrives:
 - Default `false`; enabling it changes only what is forwarded, never the underlying turn loop's
   control flow or result.
 
+### Token-Level Intra-Turn Streaming (issue #6456)
+
+Superseding the once-per-turn-only limitation above: when the active provider's native
+streaming-with-tools path is available (`AnyProvider::chat_with_tools_stream`, driven from
+`agent_loop.rs`), text/thinking chunks are forwarded as partial deltas *within* a turn rather
+than only once the turn completes. Non-streaming backends, or a streaming attempt that fails,
+keep the prior once-per-turn forwarding unchanged — both delivery modes share the same
+`ForwardSender::send_text`/`send_thinking` API and are tail-dropped identically under
+backpressure. A caller must never send both the streamed deltas and the final whole-turn text
+for the same turn (that would double-forward the same content).
+
+**Split-pattern masking gap and its fix**: sanitizing each streamed delta in isolation let a
+secret or PII pattern split across two delta boundaries evade both fragments' individual checks.
+The forwarding drain now holds back the trailing `SANITIZE_HOLDBACK_BYTES` (256) bytes of each
+pending `Text`/`Thinking` buffer — rounded down to the nearest UTF-8 char boundary — before
+sanitizing and releasing the safe prefix; the full remaining buffer is flushed with zero
+holdback immediately before an explicit `Terminal` chunk or the hard-abort backstop, so buffered
+content is only ever delayed, never silently dropped. A secret/PII pattern whose split halves
+are separated by more than 256 bytes of other already-flushed content remains a residual,
+practically-unreachable limitation of any bounded-window approach.
+
+**Design contract — deltas are ephemeral, display-only**: no consumer (TUI ring buffer, `--bare`
+sink, or any future sink) may reconstruct the subagent's conversational state from concatenated
+forwarded chunks, let alone feed it back into the parent's LLM context. The loop's own
+accumulated response text (returned from `run_agent_loop` and pushed into `messages`) is
+assembled independently of whether any given delta was actually forwarded; only the guaranteed
+terminal chunk marks the point at which a consumer may treat the run as having reached a
+terminal state.
+
 ### Known Limitation
 
-Token-level intra-turn streaming (sub-turn granularity) is deferred to a follow-up — forwarding
-happens once per completed LLM response, not per token. Combining `--bare` with `--json`
-interleaves two different JSON schemas on stdout — unsupported for now; use `--bare` without
-`--json` for scripted-pipeline forwarding.
+Combining `--bare` with `--json` interleaves two different JSON schemas on stdout — unsupported
+for now; use `--bare` without `--json` for scripted-pipeline forwarding.
 
 ---
 
@@ -547,7 +578,146 @@ so it remains permitted under `explicit_request_only` and `proactive`).
 
 ---
 
-## 16. See Also
+## 16. Secret-Leak, Trust-Cap, and Transcript-Finalize Wiring (#6503: issues #6492, #6493, #6494)
+
+Three trust-boundary gaps in the grant/spawn/transcript machinery, each closed by wiring
+already-existing enforcement code to an actual call site — the enforcement logic itself
+predated this fix in every case; only the connection was missing.
+
+### 1. Secret-leak on tool echo (#6492)
+
+A granted vault secret echoed back verbatim by a tool (e.g. `shell: echo $SOME_VAULT_KEY`)
+could previously reach the transcript, the next turn's LLM context, and the debug dump
+unmasked. `SubAgentManager::deliver_secret` now registers the delivered value into the shared
+`SecretMaskRegistry` (the same registry instance already used for the parent's outbound-LLM
+masking and the forward-transcript drain's `SanitizeLayers`, Section 14) at delivery time, not
+only on eventual read. The subagent loop's `handle_tool_step` masks every tool-result `content`
+against this registry (`would_mask` pre-check, then `mask`) immediately before it is pushed
+into `messages` — the single chokepoint feeding the transcript, the following turn's LLM
+context, and the debug dump. Contingent on `secret_masking.enabled` (default `true`; the
+registry is `None` when disabled) and on the secret being at least `MIN_SECRET_LEN` (8) bytes.
+
+### 2. Trust-cap wiring (#6493)
+
+Section 12's `apply_constraint_propagation` clamps `SpawnContext::max_trust_level` correctly,
+but `build_spawn_context` — the only production call site constructing a top-level
+`SpawnContext` — left the field `None` unconditionally, so the clamp had nothing to clamp
+against and a spawned sub-agent's trust was never actually capped despite the enforcement
+machinery existing. `build_spawn_context` now sets `max_trust_level` from a new
+`parent_effective_trust_level()`, which folds `min_trust` across the trust levels of every
+currently-active skill this turn (yielding `Trusted` when no skill is active) — mirroring
+exactly the fold `apply_skill_trust_and_gating` applies to the parent's own tool gate, so the
+cap handed to a spawned sub-agent is always consistent with what the parent itself enforces on
+its own turn. Because `build_spawn_context` is the single top-level construction site, every
+spawn path reached through it (foreground, background, `/agent resume`) is covered.
+
+### 3. Finalize-skip on turn error (#6494)
+
+`run_agent_loop`'s transcript anchor `finalize()` call (issue #6449) was reached only on the
+loop's normal-completion or explicit-`break` exit paths — a `run_turn` error propagated via an
+early `?`-return skipped it entirely, leaving that transcript chained-but-unanchored and
+reopening the whole-strip downgrade issues #6449/#6461 had closed. A `run_turn` error is now
+captured into a `pending_error` local and the loop `break`s instead of early-returning;
+`finalize()` then runs unconditionally on every loop-exit path (including the LLM-error path),
+and the captured error is only re-raised to the caller after `finalize()` has run.
+`publish_completed_status` is skipped whenever `pending_error.is_some()`, since
+`call_provider_with_status` already published the terminal `Failed` status (and its matching
+forwarded terminal chunk, Section 14) before returning the error — publishing `Completed`
+afterward would overwrite that status and double-forward a terminal chunk.
+
+### Key Invariants
+
+- A delivered secret MUST be registered into the shared mask registry before it can reach any
+  tool-result content — masking a registry that was never populated with the secret it is
+  supposed to catch is equivalent to no masking at all.
+- `max_trust_level` MUST be populated from the parent's own current effective trust at every
+  top-level spawn call site — an unpopulated (`None`) field makes Section 12's clamp a no-op,
+  not an error, so this is a silent-bypass class of gap distinct from a panic or rejected spawn.
+- Transcript `finalize()` MUST run on every `run_agent_loop` exit path, including an LLM/tool
+  error — skipping it on any path reopens the anchor-chain downgrade #6449/#6461 closed.
+
+---
+
+## 17. Tool Grant TTL Enforcement Before Dispatch (issue #6625)
+
+### Problem
+
+`GrantKind::Tool` grants were TTL-tracked in `PermissionGrants` identically to
+`GrantKind::Secret` grants (Section 3, US-003), but prior to this fix no production call site
+ever checked a `Tool` grant before dispatching the corresponding tool call — the type implied
+enforcement that did not exist. A `Tool` grant could expire or be revoked with no observable
+effect on subsequent dispatch.
+
+### Mechanism
+
+`PermissionGrants` is now shared via `Arc<Mutex<_>>` between `SubAgentHandle` and the spawned
+agent-loop task. This differs from how `Secret` grants are delivered (per-key over a channel):
+`Tool` grants need live shared state instead, since `revoke_all()` must be visible to the loop
+immediately, without a delivery round-trip. `PermissionGrants::check_tool_grant(tool_name)`
+returns a `ToolGrantCheck` (`NoGrant` / `Active` / `Expired`) and is enforced as the *first*
+check in `handle_tool_step` — before any hook fires or the executor runs. A loop-local
+`active_tool_grants_seen` set distinguishes "revoked" from "never granted" after
+`sweep_expired()` evicts a stale entry — without it, a rejected dispatch would silently permit
+the very next call for the same tool, since the evicted grant would then read as `NoGrant`.
+
+### Confirmed Semantics — default-permit, time-box only, NOT an allow-list
+
+- Absence of any `Tool` grant for a given tool name always permits the call — this is the
+  universal state for every production caller today, since none yet creates `GrantKind::Tool`
+  grants, so this fix causes no observable behavior change until a caller starts issuing them.
+- A grant existing for one tool name never restricts any other tool name, even for the same
+  sub-agent — there is no implicit "some grants exist, so everything else is denied" mode.
+- Matching is exact tool-name string equality only — no prefix/glob support for tool families
+  (e.g. an MCP server-scoped grant does not cover sub-tool names under that server).
+
+### Key Invariants
+
+- `check_tool_grant` MUST run before any hook fires or the executor runs — enforcing after
+  either would let a revoked/expired grant's side effects occur regardless of the check result.
+- `Tool` grants MUST NEVER be reinterpreted as an allow-list — `NoGrant` always means
+  "unrestricted by this mechanism," never "denied." Extending this into allow-list semantics
+  requires a deliberate, separately-specified design change, not an incidental generalization.
+- A grant evicted by `sweep_expired()` MUST still read as `Expired` (fail-closed) rather than
+  `NoGrant` (fail-open) on the same tool for the remainder of the run — the loop-local
+  `active_tool_grants_seen` set is what makes this distinction possible.
+
+---
+
+## 18. Strict Nested Frontmatter Parsing (issue #6626) — BREAKING CHANGE
+
+### Problem
+
+`RawSubAgentDef` carries `#[serde(deny_unknown_fields)]`, but serde does not propagate that
+attribute into nested struct types — `RawToolPolicy` (the `tools:` section) and
+`RawPermissions` (the `permissions:` section) each need their own independent
+`deny_unknown_fields` declaration. Without it, a typo inside either nested section (e.g.
+`pemission_mode:`, `alow:`) was silently ignored by serde's normal unknown-field handling and
+the section fell back to its fail-safe default, instead of the definition failing to load —
+masking a misconfigured sub-agent definition as a silently-permissive default.
+
+### Mechanism
+
+Both `RawToolPolicy` and `RawPermissions` now carry `#[serde(deny_unknown_fields)]`. Every
+field on both structs already carries an explicit `#[serde(default = ...)]`, so this addition
+only rejects genuinely unknown keys (typos) — it has no effect on omission of optional fields,
+so existing valid frontmatter that omits optional keys continues to parse unchanged.
+
+**BREAKING CHANGE**: `SubAgentDef::parse()` now returns `Err(SubAgentError::Parse)` for any
+sub-agent frontmatter file with a misspelled or otherwise unrecognized key inside its nested
+`tools:` or `permissions:` section — previously such a file loaded successfully with that
+field's section silently reset to its default.
+
+### Key Invariants
+
+- `#[serde(deny_unknown_fields)]` on a parent struct does NOT extend to nested struct types —
+  each nested struct requiring strict rejection must declare the attribute independently.
+- Strict rejection must never conflict with optional-field omission — adding
+  `deny_unknown_fields` to a struct without first ensuring every field has an explicit default
+  would reject currently-valid frontmatter that merely omits an optional key.
+
+---
+
+## 19. See Also
 
 - [[constitution]] — project principles
 - [[002-agent-loop/spec]] — parent agent loop that uses `SubAgentManager`
diff --git a/specs/048-slm-cost-metrics/spec.md b/specs/048-slm-cost-metrics/spec.md
index 513ea3eb9..6e724d809 100644
--- a/specs/048-slm-cost-metrics/spec.md
+++ b/specs/048-slm-cost-metrics/spec.md
@@ -60,6 +60,16 @@ Both fields are updated in `record_cost_and_cache` → `record_successful_task`
 - A turn that errors before `record_cost_and_cache` is called is NOT counted as successful.
 - Per-provider CPS is not tracked; only the global daily counter is maintained.
 
+## Default Daily Cost Cap (#6469)
+
+`CostConfig::max_daily_cents` — the daily cap enforced by the same `CostTracker`
+(`crates/zeph-core/src/cost.rs`) this spec's CPS metric is computed from — now defaults to
+`2500` ($25.00/day), changed from `0` (unlimited). A fresh install previously shipped with no
+built-in defense against unbounded LLM spend. `0` remains a valid explicit override meaning
+unlimited; existing configs with an explicit `max_daily_cents` value (including an explicit
+`0`) are preserved — migration step 101 only appends an advisory comment, it never rewrites an
+active value.
+
 ## SLM Provider Configuration
 
 Add to `[[llm.providers]]` in config when Ollama is available locally:
@@ -88,3 +98,4 @@ Reference this provider via `planner_provider = "slm-medium"` in `[orchestration
 - #2192 — SLMs are the Future of Agentic AI
 - #2165 — Unified routing+cascading framework
 - #2185 — Candle-backed lightweight classifiers
+- #6469 — Enable runaway tool-call rate limiting and daily cost cap by default
diff --git a/specs/050-security-capability-governance/spec.md b/specs/050-security-capability-governance/spec.md
index bb7a83152..44c2fb93e 100644
--- a/specs/050-security-capability-governance/spec.md
+++ b/specs/050-security-capability-governance/spec.md
@@ -349,9 +349,20 @@ pub enum RiskSignal {
     /// A configured high-risk tool-pair transition occurred within K turns.
     /// E.g. `web_scrape` → `write` to a system path. (C7-d transition)
     ToolPairTransition,
+    /// `RiskChainAccumulator` (`zeph-tools`) confirmed an `exfil_read_then_send` multi-step
+    /// chain (signal code 10). Weighted alongside `VigilFlagged(High)` — both are
+    /// high-confidence signals, not heuristics (#6602).
+    ExfilReadThenSend,
+    /// `RiskChainAccumulator` (`zeph-tools`) confirmed a `cred_then_egress` multi-step chain
+    /// (signal code 11). Weighted alongside `ExfiltrationRedaction`/`ToolPairTransition` (#6602).
+    CredThenEgress,
 }
 ```
 
+`RiskSignal::from_code` maps codes `10`/`11` (previously unmapped, falling through to the
+lowest-confidence `VigilFlagged(Low)` fallback) to these two variants — see
+[[010-security/spec#RiskChainAccumulator (#4246, #3887)]] for the accumulator that emits them.
+
 `NovelTool` (Phase-1 candidate in v1 of this spec) is **dropped from Phase
 1** because of conflict with legitimate first-time MCP server use. It is
 reserved behind a feature flag (`security.trajectory.novelty_signal`) for
@@ -372,6 +383,8 @@ Phase 2 when persistent per-installation novelty tracking is available.
 | `weight(HighCallRate)` | 1.5 | Fires at most once per 3-turn window. |
 | `weight(UnusualReadVolume)` | 1.5 | Fires at most once per `window_turns`. |
 | `weight(ToolPairTransition)` | 2.0 | Fires only on configured anti-patterns; cardinality is operator-bounded. |
+| `weight(ExfilReadThenSend)` | 2.5 | Confirmed `RiskChainAccumulator` multi-step chain, not a heuristic; matches `VigilFlagged(High)` (#6602). |
+| `weight(CredThenEgress)` | 2.0 | Confirmed `RiskChainAccumulator` chain; matches `ExfiltrationRedaction`/`ToolPairTransition` (#6602). |
 | `decay_per_turn` | 0.85 | Half-life ≈ 4.3 turns; balances slow-burn detection vs. recovery. |
 | `window_turns` | 8 | Twice the half-life; bounds memory. |
 | `elevated_at` | 2.0 | One PolicyDeny + one PiiRedaction crosses it. |
diff --git a/specs/083-memory-write-consent-gate/spec.md b/specs/083-memory-write-consent-gate/spec.md
new file mode 100644
index 000000000..a80b3ec9e
--- /dev/null
+++ b/specs/083-memory-write-consent-gate/spec.md
@@ -0,0 +1,251 @@
+---
+aliases:
+  - MemGhost
+  - Write-Time Memory Consent Gate
+  - Memory Write Consent Gate
+tags:
+  - sdd
+  - spec
+  - memory
+  - security
+  - consent
+created: 2026-07-22
+status: implemented
+related:
+  - "[[MOC-specs]]"
+  - "[[constitution]]"
+  - "[[004-memory/spec]]"
+  - "[[004-9-memory-write-gate]]"
+  - "[[039-background-task-supervisor/spec]]"
+  - "[[001-system-invariants/spec]]"
+---
+
+# Spec: Write-Time Memory Consent Gate (MemGhost)
+
+> [!info]
+> Write-time provenance tagging, interactive confirmation, and audit logging for durable
+> memory writes derived from untrusted content (tool output, web scrapes, MCP/A2A responses).
+> Closes the disclosed **MemGhost** attack pattern. Complements #3960 (retrieval-time trust
+> filtering) without implementing its scope. Resolves GitHub issue
+> [#6490](https://github.com/bug-ops/zeph/issues/6490).
+
+## Sources
+
+### Internal
+| File | Contents |
+|---|---|
+| `crates/zeph-config/src/memory/consent_gate.rs` | `ConsentGateConfig` — `[memory.consent_gate]` |
+| `crates/zeph-core/src/memory_tools.rs` | `MemoryToolExecutor`, `MemoryConsentTrustSlot`, interactive confirm path |
+| `crates/zeph-core/src/agent/tool_execution/sanitize.rs` | `sanitize_tool_output`, `ratchet_memory_consent_trust_for_dispatch` |
+| `crates/zeph-core/src/agent/persistence/store.rs` | Background tool-output write path, disclosure note, audit gating |
+| `crates/zeph-sanitizer/src/types.rs` | `ContentSourceKind`, `ContentTrustLevel` (reused taxonomy) |
+| `crates/zeph-tools/src/audit.rs` | `AuditEntry::memory_write` constructor |
+| `crates/zeph-agent-context/src/state.rs`, `crates/zeph-llm/src/provider.rs` | `MessageMetadata::trust_level` tag, `Agent::context_max_trust_level` |
+
+---
+
+## 1. Overview
+
+### Problem Statement (MemGhost)
+
+Content from autonomous tool output — web scrape, MCP results, batched tool calls — could
+persist into durable memory (SQLite + Qdrant) with no provenance tag, no consent, and no
+visible disclosure. Once written, untrusted external content becomes indistinguishable from
+trusted context in every future session: a prompt-injection payload planted via a scraped page
+could be recalled turns or sessions later as if it were the user's own words.
+
+### Goal
+
+Every durable memory write carries write-time provenance (`ContentSourceKind` +
+`ContentTrustLevel`, reusing the existing `zeph-sanitizer` taxonomy). Writes derived from
+content at or above a configurable trust threshold are gated: the interactive `memory_save`
+tool path requires `Channel::confirm`; autonomous background tool-output writes never block
+(per the project's non-blocking contract — see [[039-background-task-supervisor/spec]]) but
+emit a visible in-turn disclosure note instead. Every write, gated or not, is recorded in the
+audit log with source attribution when `audit_all = true`.
+
+### Relationship to [[004-9-memory-write-gate|MemReader Write Quality Gate]]
+
+Two independently-composed gates exist on the memory write path, in this order:
+
+1. **A-MAC admission** ([[004-3-admission-control]]) — importance scoring
+2. **MemReader quality gate** ([[004-9-memory-write-gate]]) — content-quality scoring
+   (redundancy, reference completeness, contradiction) — a **noise-control** mechanism
+3. **MemGhost consent gate** (this spec) — provenance/trust gating — a **security/consent**
+   mechanism
+
+They are orthogonal and must not be conflated: MemReader asks "is this write worth keeping?";
+MemGhost asks "does the user/operator know and consent that this write came from untrusted
+content?" A write can pass MemReader's quality bar while still requiring MemGhost confirmation
+(a high-quality fact scraped from an adversarial web page), and vice versa. [[004-9-memory-write-gate]]'s
+own "Never" section ("Use quality gate as a security filter") is the reason this separate gate
+exists — MemReader was explicitly scoped to exclude consent/security semantics.
+
+### Out of Scope
+
+- Retrieval-time trust filtering (tracked separately as #3960; this spec is write-time only)
+- Replacing or altering [[004-9-memory-write-gate]]'s quality scoring
+- Path-based trust inference (e.g. treating user-authored instruction files as `Trusted`) —
+  `ContentSourceKind::InstructionFile` is treated as `LocalUntrusted` by default; a Phase 2 concern
+
+---
+
+## 2. Mechanism
+
+### Write-Time Provenance
+
+`ContentSourceKind` (`ToolResult`, `WebScrape`, `McpResponse`, `A2aMessage`, `MemoryRetrieval`,
+`InstructionFile`, channel message, …) and `ContentTrustLevel` (`Trusted` < `LocalUntrusted` <
+`ExternalUntrusted`) are computed once by `sanitize_tool_output` and threaded through
+`PersistenceService`/`SemanticMemory::remember*` into nullable `messages.source_kind` /
+`trust_level` columns (migration 114) and a Qdrant payload field. `NULL` means "provenance not
+recorded" (legacy rows, not-yet-migrated writers) — **never** interpreted as trusted.
+
+### Interactive Path: `memory_save`
+
+The interactive `memory_save` tool requires `Channel::confirm` (via the existing
+`ToolError::ConfirmationRequired`/`handle_confirmation_phase` protocol) when the current turn's
+tool output reached `confirm_threshold` (default `external_untrusted`). Tracked via a
+turn-scoped `MemoryConsentTrustSlot` (`Arc<RwLock<u8>>`, the `ContentTrustLevel` discriminant)
+shared between `Agent` and `MemoryToolExecutor` — the latter has no `&Agent` access (the
+`ToolExecutor` trait is deliberately object-safe). The model-supplied `role` field on a
+`memory_save` call is never trusted as a provenance signal.
+
+### Background Path: Autonomous Tool-Output Writes
+
+Autonomous background tool-output writes never block on `Channel::confirm` — instead, when the
+batch's trust reaches `disclose_threshold` (default `local_untrusted`), a visible in-turn
+channel disclosure note is emitted (non-blocking, fire-and-forget on the persistence path).
+
+### Audit Logging
+
+Every write (trusted or not) is recorded via `AuditEntry::memory_write` (`source_kind`/
+`trust_level` fields, reuses `ClaimSource::Memory` and the existing JSONL audit sink) when
+`audit_all = true` (default). Gated by `audit_all` consistently on **both** the interactive
+(`MemoryToolExecutor`) and background (`persist_message_inner`) paths — see Follow-up Fixes
+below for the bug where this initially diverged between paths.
+
+---
+
+## 3. Follow-up Fixes (Same Feature, Sequential PRs)
+
+The initial implementation (#6544, closes #6490) shipped the mechanism above. Three follow-up
+PRs closed defects in the same threat class before the feature reached its current, correct
+state — all three are part of this spec's invariants, not separate features.
+
+### #6598 — TOCTOU Bypasses Across Turns, Tiers, and Reload
+
+The turn-scoped trust slot was read at points that did not yet reflect all untrusted content
+already present or concurrently arriving in the current turn:
+
+- **Cross-turn deferral (#6558)**: `begin_turn` hard-reset the trust slot to `Trusted` every
+  turn, so untrusted tool output fetched in turn N was invisible to a `memory_save` dispatched
+  in turn N+1, even though the untrusted content was still live in context. Fixed by tagging
+  tool-result batch messages with a persisted `trust_level` (`MessageMetadata::trust_level`,
+  the worst-case tier) and scanning the live context (`Agent::context_max_trust_level`) for any
+  still-present tag before every tool dispatch.
+- **Same-tier/cross-tier parallel dispatch race (#6569)**: the slot was only ratcheted up
+  inside `sanitize_tool_output`, which runs *after* a tier's tool calls have already executed
+  concurrently via `join_all`. A `memory_save` dispatched in the same batch as `web_scrape` (or
+  `memory_search`) could read a stale `Trusted` value during its own concurrent dispatch. Fixed
+  by precomputing the batch's worst-case trust tier from tool names alone
+  (`Agent::ratchet_memory_consent_trust_for_dispatch`) and writing it to the slot before any
+  tool in the batch starts executing.
+- **Cross-process reload residual**: `load_history`/`load_history_filtered`/`message_by_id`
+  hardcoded `trust_level: None` on reload, silently dropping the gate's context tag across a
+  daemon/serve/ACP restart. Fixed by restoring `MessageMetadata::trust_level` from the
+  persisted column on every reload path (fail-safe: an unrecognized persisted value maps to the
+  most conservative tier, never to `Trusted`).
+- **Compaction/summarization residual**: condensing an untrusted tool-result batch into an LLM
+  summary (`compact_context`) or a deferred tool-pair summary previously produced an untagged
+  summary message/row. Fixed by propagating the worst-case trust tier of the condensed messages
+  onto both the in-memory summary message and the persisted summary row.
+
+### #6599 — Provenance Mislabeling and Inconsistent Audit Gating
+
+- A batch's write-time `source_kind` was derived via a lossy heuristic keyed only on aggregated
+  `trust_level` (a two-way `if`/`else`), mislabeling MCP responses, A2A messages,
+  memory-retrieval replays, and channel messages all as `web_scrape`. Fixed:
+  `Agent::sanitize_tool_output` now returns the real per-call `ContentSourceKind` alongside
+  `ContentTrustLevel`, tracked directly (tie-break: later call in the batch wins on equal trust
+  tier) rather than re-derived from the trust level.
+- `consent_gate.audit_all = false` was honored on the background tool-output write path but
+  **not** on the interactive `memory_save` path — setting it to `false` did not suppress
+  interactive audit entries as documented. Fixed: `MemoryToolExecutor` gates its audit block on
+  `audit_all` consistently with the background path, wired through all four entry points
+  (CLI/TUI, ACP, A2A daemon, `/sessions*` server).
+
+---
+
+## 4. Config
+
+```toml
+[memory.consent_gate]
+enabled = true
+confirm_threshold = "external_untrusted"   # trusted | local_untrusted | external_untrusted
+disclose_threshold = "local_untrusted"
+audit_all = true
+```
+
+Wired through `AgentSessionConfig` (all four agent entry points: CLI/TUI, ACP, A2A daemon,
+`/sessions*` server), the `--init` wizard, and `--migrate-config`.
+
+---
+
+## 5. Key Invariants
+
+- Interactive `memory_save` MUST request `Channel::confirm` when the live-context trust tier is
+  at or above `confirm_threshold` — the model-supplied `role` field is NEVER a substitute for
+  the tracked trust tier
+- Background tool-output writes MUST NEVER block on `Channel::confirm` — only the interactive
+  `memory_save` path may block; background writes use the non-blocking disclosure-note path
+- `MemoryConsentTrustSlot` MUST be ratcheted up **before** any tool in a dispatch batch starts
+  executing (`ratchet_memory_consent_trust_for_dispatch`), not after — ratcheting after
+  `join_all` resolves reopens the #6569 same-batch race
+- `MessageMetadata::trust_level` MUST be restored on every history-reload path
+  (`load_history`/`load_history_filtered`/`message_by_id`) and propagated through both
+  compaction and deferred tool-pair summarization — dropping it on any of these paths
+  reopens a #6598-class bypass
+- An unrecognized/missing persisted `trust_level` MUST map to the most conservative tier
+  (`ExternalUntrusted`), never to `Trusted` — fail-safe, not fail-open, for this gate
+  specifically (contrast with [[004-9-memory-write-gate]]'s scoring, which is fail-open)
+- `source_kind` MUST be tracked directly from `sanitize_tool_output`'s per-call classification,
+  NEVER re-derived from the aggregated `trust_level` alone
+- `consent_gate.audit_all` MUST gate both the interactive (`MemoryToolExecutor`) and background
+  (`persist_message_inner`) audit-logging call sites identically
+- `NULL`/unrecorded `source_kind`/`trust_level` on a legacy row is never treated as `Trusted`
+
+### Never
+
+- Use the model-supplied `role` field as a provenance/trust signal
+- Block the background tool-output write path on `Channel::confirm`
+- Treat this gate as a replacement for, or superset of, [[004-9-memory-write-gate]]'s quality
+  scoring — the two compose, they do not substitute for each other
+
+---
+
+## 6. GitHub Issues
+
+| Issue | Description |
+|---|---|
+| #6490 | Original MemGhost disclosure |
+| #6544 | Initial implementation (write-time provenance, confirm/disclose gates, audit) |
+| #6556 | Provenance mislabeling (source_kind derived from trust_level heuristic) |
+| #6557 | Missing test coverage for the disclosure-note branch |
+| #6558 | Cross-turn deferral TOCTOU bypass |
+| #6559 | `audit_all` not honored on interactive path |
+| #6569 | Same-tier/cross-tier parallel-dispatch race |
+| #6598 | Umbrella fix: closes #6558 + #6569 + reload/compaction residuals |
+| #6599 | Umbrella fix: closes #6556 + #6557 + #6559 |
+
+---
+
+## 7. See Also
+
+- [[constitution]] — project principles
+- [[004-memory/spec]] — memory system parent index
+- [[004-9-memory-write-gate]] — MemReader write quality gate (orthogonal, noise-control)
+- [[004-16-shadow-memory-safety]] — MAGE shadow memory (orthogonal, trajectory-level attack defense)
+- [[039-background-task-supervisor/spec]] — non-blocking contract this gate's background path follows
+- [[001-system-invariants/spec]] — system-wide non-negotiable rules
+- [[MOC-specs]] — all specifications
diff --git a/specs/MOC-specs.md b/specs/MOC-specs.md
index 9d9398e0b..3122b7f37 100644
--- a/specs/MOC-specs.md
+++ b/specs/MOC-specs.md
@@ -168,6 +168,12 @@ status: moc
 ### Transcript Integrity
 - [[081-transcript-integrity/spec|Transcript Integrity]] — tamper-evident persisted history (competitive-parity finding vs. Claude Code 2.1.205): keyed-BLAKE3 hash-chain over sub-agent transcript and session event log JSONL (new `ZEPH_HISTORY_KEY` vault root secret), detecting in-place edits, reordering, partial chain-strip, and key-epoch tampering, all fail-closed; durable journal uses a separate authenticated per-execution high-water-mark instead of a chain (positional chains are incompatible with `checkpoint_fold` compaction), default-on whenever `ZEPH_DURABLE_KEY` is provisioned, with its own key-rotation window riding the AEAD cipher's `key_id`/`previous_key_id` lifecycle (#6460); the whole-file/whole-execution downgrade-to-legacy strip gap is closed via a vault-anchor mechanism (GitHub #6449, #6461); GitHub #6360 [implemented]
 
+### Per-Message Usage/Cost Tracking
+- [[082-per-message-usage-cost-tracking/spec|Per-Message Usage/Cost Tracking]] — new `usage_records` table (migration 115, both dialects) additive to `CostTracker`'s daily aggregate; every `CostTracker`-feeding site (turn loop, planner + aggregator, ensemble members) writes a paired row via `CostTracker::price_of`, inline-awaited, no new `tokio::spawn` site; `ttft_ms` true time-to-first-token on the speculative-decoding streaming path or a TTFB proxy otherwise; Goose per-message usage-stats parity gap; GitHub #6549 [implemented]
+
+### Memory Write Consent Gate
+- [[083-memory-write-consent-gate/spec|Memory Write Consent Gate]] — write-time consent gate ("MemGhost") for untrusted memory writes: provenance tagging, confirm/disclose thresholds, and audit logging gating what untrusted-origin content may be committed to memory, distinct from `004-9`'s MemReader quality scorer; closes cross-turn/cross-tier/reload TOCTOU bypasses and write-time provenance/audit gating gaps; GitHub #6544
+
 ---
 
 ## System-Wide Features
@@ -283,6 +289,8 @@ status: moc
 | 079 | [[079-plugins/spec\|Plugin Management]] | specify | approved |
 | 080 | [[080-cross-thread-store-dynamic-handoff/spec\|Cross-Thread Store & Dynamic Handoff]] | specify | approved |
 | 081 | [[081-transcript-integrity/spec\|Transcript Integrity]] | specify | implemented |
+| 082 | [[082-per-message-usage-cost-tracking/spec\|Per-Message Usage/Cost Tracking]] | specify | implemented |
+| 083 | [[083-memory-write-consent-gate/spec\|Memory Write Consent Gate]] | specify | implemented |
 
 ---
 
diff --git a/specs/README.md b/specs/README.md
index 8bd1fa5f3..fcee3d134 100644
--- a/specs/README.md
+++ b/specs/README.md
@@ -182,3 +182,4 @@ Spec IDs (001–069) follow a logical grouping:
 | `080-cross-thread-store-dynamic-handoff/spec.md` | Cross-thread Store + Command-style dynamic task handoff (LangGraph `Store`/`Command` parity, #6363): generic namespaced `owner_key`-scoped KV store (migration 110, both dialects, optimistic versioning) in `zeph-memory`; `TaskOutcome::Handoff{output,goto}` terminal routing outcome produced via output-convention parse (not a native tool) in `zeph-orchestration`, with ALL store I/O (the `update` write and the `<shared-state>` prompt read) relocated to `zeph-core` so `zeph-orchestration` never gains a production `zeph-memory` dependency; forward-only `goto` (target must not be `Completed` and must have satisfied `depends_on`, mirroring `route_to`'s constraint), Handoff-emitting node becomes terminal (livelock guard making `max_handoffs` a true backstop), `route_to`-reservation contention rejected, sanitizer/`ExfiltrationGuard` scan on the parsed Command before routing/write, `<shared-state>` wrapped untrusted/spotlighted, loud `TaskOutcome::Failed` on malformed/rejected Command (never silent `Completed`); both `[memory.store]`/`[orchestration.command]` opt-in, default OFF; two-round architect/critic design review (final verdict: approved/minor); GitHub #6363 [approved] | `zeph-memory`, `zeph-orchestration`, `zeph-core`, `zeph-db`, `zeph-config` |
 | `081-transcript-integrity/spec.md` | Tamper-evident persisted history (competitive-parity finding vs. Claude Code 2.1.205): keyed-BLAKE3 hash-chain (`zeph_common::hash_chain`) over sub-agent transcript (`TranscriptWriter`/`TranscriptReader`) and session event log (`SessionEventLog`) JSONL, new `ZEPH_HISTORY_KEY` vault root secret domain-separated per subsystem; detects in-place edits, reordering, partial chain-strip, and key-epoch tampering, all fail-closed; durable journal uses a separate authenticated per-execution high-water-mark (HWM, `with_hwm_key`) rather than a chain (positional chains are incompatible with `checkpoint_fold`'s routine compaction), activating unconditionally whenever `ZEPH_DURABLE_KEY` is provisioned — closing the prior default-off gap, and now with its own `key_id`/`previous_key_id` rotation window (#6460, replacing an initially-frozen epoch counter — see `[[064-durable-execution/spec]]` Key Rotation Windows); `key_epoch` rotation window distinguishes "re-keyed" from "TAMPER" on both sides; auto-trust-once migration posture for pre-feature legacy content, no backfill; three-round architect/critic design review (final verdict: minor); **closed** the whole-file/whole-execution downgrade-to-legacy strip gap via a vault-anchor mechanism (`zeph_common::anchor`, `zeph durable seal-integrity`) — GitHub #6449, #6461; GitHub #6360 [implemented] | `zeph-common`, `zeph-subagent`, `zeph-session`, `zeph-core`, `zeph-durable`, `zeph-db`, `zeph-config` |
 | `082-per-message-usage-cost-tracking/spec.md` | Per-message usage/cost tracking: new `usage_records` table (migration 115, both dialects) with nullable `message_id`/`conversation_id` FKs and a `source` discriminator, additive to `CostTracker`'s existing provider-keyed daily aggregate — `SUM(cost_cents)` for the current UTC day reconciles with `CostTracker.current_spend()`; every `CostTracker`-feeding site (turn loop, `plan.rs` planner + aggregator, `scheduler_loop.rs` ensemble members) writes a paired row via `CostTracker::price_of`, inline-awaited on the same call sites that already update `CostTracker` — no new `tokio::spawn` site; `ttft_ms` is true time-to-first-token on the one production streaming path (speculative decoding, `SpeculativeStreamDrainer::drive`) or a TTFB proxy otherwise (measured per-attempt inside `retry::send_with_retry`, never inflated by retry backoff), delegated through `AnyProvider`/`MaskedProvider`/`TriageRouter`; Goose per-message usage-stats parity gap (CI-1394, CI-1431); GitHub #6549 [implemented] | `zeph-core`, `zeph-llm`, `zeph-memory`, `zeph-orchestration`, `zeph-db` |
+| `083-memory-write-consent-gate/spec.md` | Write-time consent gate ("MemGhost") for untrusted memory writes: provenance tagging + confirm/disclose thresholds + audit logging gating what untrusted-origin content may be committed to memory, distinct from `004-9`'s MemReader quality scorer; closes cross-turn/cross-tier/reload TOCTOU bypasses (#6598) and write-time provenance/audit gating gaps (#6599); GitHub #6544 | `zeph-memory`, `zeph-core` |
diff --git a/src/acp.rs b/src/acp.rs
index 8ffb33603..18e35fa42 100644
--- a/src/acp.rs
+++ b/src/acp.rs
@@ -4278,8 +4278,12 @@ mod tests {
         let (session_a, _queue_a) = build_acp_session_shell_composite(vec![PathBuf::from("/")]);
         let (session_b, queue_b) = build_acp_session_shell_composite(vec![PathBuf::from("/")]);
 
+        // `echo` (not `cat`) — the risk-chain classifier tags `SensitiveRead` purely from the
+        // `/etc/passwd` substring in the command text (`classify()` in risk_chain.rs), so the
+        // path need not actually exist; `cat` would fail on Windows runners where `/etc/passwd`
+        // is absent, turning this into a portability failure unrelated to risk-chain blocking.
         let a_read = session_a
-            .execute_tool_call(&acp_bash_call("cat /etc/passwd"))
+            .execute_tool_call(&acp_bash_call("echo /etc/passwd"))
             .await;
         assert!(
             a_read.is_ok(),
@@ -5377,6 +5381,12 @@ mod tests {
     /// helper `spawn_acp_agent`'s no-`conversation_id` hydration branch calls — and asserts the
     /// client is notified via `SessionStatusNotifier` synchronously, i.e. without any
     /// `session/prompt` drain (`try_recv`, not `recv().await` behind a drain loop).
+    ///
+    /// Unix-only: `SessionEventLog::open_exclusive`'s advisory lock is `flock(2)`-backed and is
+    /// a documented no-op on non-Unix targets (`AdvisoryLock`, zeph-session's `log.rs`), so a
+    /// second `open_exclusive` on non-Unix never contends — matching zeph-session's own
+    /// `#[cfg(unix)]`-gated contention tests for the same primitive.
+    #[cfg(unix)]
     #[tokio::test]
     async fn already_locked_session_log_notifies_client_proactively_without_prompt() {
         let tmp = TempDir::new().unwrap();
diff --git a/src/agent_setup.rs b/src/agent_setup.rs
index 57ed667bf..f11278b4c 100644
--- a/src/agent_setup.rs
+++ b/src/agent_setup.rs
@@ -3419,9 +3419,13 @@ mod tests {
         )
         .await;
 
+        // `echo` (not `cat`) — the risk-chain classifier tags `SensitiveRead` purely from the
+        // `/etc/passwd` substring in the command text (`classify()` in risk_chain.rs), so the
+        // path need not actually exist; `cat` would fail on Windows runners where `/etc/passwd`
+        // is absent, turning this into a portability failure unrelated to risk-chain blocking.
         let first = tool_setup
             .executor
-            .execute_tool_call(&agent_setup_bash_call("cat /etc/passwd"))
+            .execute_tool_call(&agent_setup_bash_call("echo /etc/passwd"))
             .await;
         assert!(
             first.is_ok(),
diff --git a/src/commands/durable.rs b/src/commands/durable.rs
index 5a133110b..49f359ad3 100644
--- a/src/commands/durable.rs
+++ b/src/commands/durable.rs
@@ -1409,9 +1409,13 @@ mod tests {
     fn durable_db_is_filename_namespaced_sibling_of_sqlite_path() {
         let mut config = Config::default();
         config.memory.sqlite_path = "/data/zeph/zeph.db".to_owned();
+        // Built via the same `Path::join` the production code uses rather than a hardcoded
+        // forward-slash literal — `Path::join` inserts the platform's native separator, so a
+        // literal `"/data/zeph/zeph.db.durable.db"` mismatches on Windows (`\` vs `/`).
+        let expected = Path::new("/data/zeph").join("zeph.db.durable.db");
         assert_eq!(
             resolve_durable_db_url(&config),
-            "/data/zeph/zeph.db.durable.db"
+            expected.to_string_lossy().into_owned()
         );
     }