diff --git a/.claude/skills/test/SKILL.md b/.claude/skills/test/SKILL.md
index 83134bd26..e35bb0221 100644
--- a/.claude/skills/test/SKILL.md
+++ b/.claude/skills/test/SKILL.md
@@ -369,3 +369,7 @@ Examples:
 - [ ] State-machine tests cover both valid transitions and invalid/terminal-state attempts
 - [ ] Persistence tests reload from the repository rather than trusting the returned object
 - [ ] No `new` on domain entities — always use factory delegates from DI
+- [ ] Verified with a **scoped** run — `dotnet test <the affected project>`, narrowed with
+      `--filter "FullyQualifiedName~<Class>"` while iterating. Not the whole solution: CI runs
+      `dotnet test Proxytrace.sln` on every push. See
+      [`docs/testing.md`](../../../docs/testing.md#which-tests-to-run).
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1db6f01ac..03e631f7c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -75,11 +75,13 @@ jobs:
           curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.24.3/gitleaks_8.24.3_linux_x64.tar.gz | tar xz gitleaks
           ./gitleaks git . --redact --verbose
 
-  # Lint/build cannot break from a merge-order interaction, so the PR run is enough
-  # and this is skipped on master pushes.
+  # Kept on master pushes for the same reason as `backend`: the Vitest suite is the
+  # post-merge safety net for a PR that was verified against a stale base. Lint and
+  # build cannot break from a merge-order interaction on their own, but they share this
+  # job's `npm ci`, so they ride along rather than paying for a second install.
   frontend:
     needs: changes
-    if: ${{ inputs.full || (github.event_name == 'pull_request' && needs.changes.outputs.frontend == 'true') }}
+    if: ${{ inputs.full || needs.changes.outputs.frontend == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
@@ -102,6 +104,12 @@ jobs:
         run: npm run lint
         working-directory: frontend
 
+      # Vitest unit/component suite. `pretest` regenerates the docs index from manual/,
+      # so this also catches a manual edit that breaks Tracey's search_docs fixture.
+      - name: Test
+        run: npm test
+        working-directory: frontend
+
       - name: Build
         run: npm run build
         working-directory: frontend
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3006d7f80..6ec17cc1a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,347 @@ follow [Semantic Versioning](https://semver.org). Ongoing work is collected unde
 
 ## [Unreleased]
 
+### Security
+
+- **The shipped configuration no longer starts the app in the login-free demo mode.** The
+  `appsettings.json` baked into the image had kiosk mode switched on. Kiosk mode exists for the
+  public showcase: it accepts every request as the built-in demo user without asking for a password,
+  and keeps all data in memory. The supported ways of starting Proxytrace each turned it off by
+  hand, so a normal install was unaffected — but anyone starting the app another way (their own
+  Kubernetes manifest, a custom container, running the binary directly) got an installation that
+  served the entire API to anyone who could reach it and lost its data on every restart. The default
+  is now off, and the demo stacks switch it on explicitly.
+
+- **A REST API key can no longer read or change other projects.** An API key is described, and sold
+  in the UI, as granting access to *the project it was created for*. In practice the key acted purely
+  as the person who created it, and its project was ignored — and because keys can only be minted by
+  an administrator, the key normally inherited administrator reach over **every** project in the
+  installation. Anyone holding a key issued for one project could list another project's traces, read
+  their full request and response bodies, and — with the write scope — delete traces and modify test
+  suites anywhere. Keys are now confined to their own project, in addition to whatever their owner
+  may reach.
+
+- **Test suites can no longer be used to pull in another project's data.** Updating a test suite
+  accepted agent, test-case and evaluator identifiers without checking that the caller may access
+  them. Supplying an identifier from another project attached that project's test case — and the
+  response echoed its full conversation and expected output back — re-parented the suite into a
+  project the caller had no access to, or attached another project's evaluator so that running the
+  suite spent that project's provider credit. All three are now checked the same way the rest of the
+  app already checks them.
+
+- **Dashboard figures no longer fall back to showing every project's results.** For a project with no
+  agents yet — a newly created one, or one whose agents were all archived — the test-run pass rate and
+  its trend chart were computed across the whole installation instead of across nothing, showing one
+  project's numbers to another.
+
+- **A single-use streaming credential is now accepted only on streaming endpoints.** The short-lived
+  ticket that live-updating views use to open their connection was honoured on any address, so within
+  its brief validity window it could be replayed against ordinary endpoints, including administrative
+  ones. It is now restricted to the live-update endpoints it was minted for.
+
+- **The log can no longer be made to show entries that nobody wrote.** Several warnings recorded a
+  value taken straight from the caller — the requested URL path, an email address — and a caller who
+  percent-encoded a line break into it got that break back out in the log file. A request for
+  `/x%0D%0A…` was written as two lines, and a line-oriented log viewer rendered the second as an
+  entry of its own, letting anyone who could reach the app plant convincing but fabricated entries
+  and obscure what really happened. Line breaks are now stripped from these values before they are
+  logged.
+
+### Changed
+
+- **Optimization proposals are now held to a stricter, correct standard of proof.** Two flaws made
+  the optimizer accept proposals it should not have. Repeating a test run several times — intended to
+  average out flaky results — was counted as if each repeat were fresh independent evidence, so the
+  statistical check grew *more* confident the more repeats were configured, which is backwards.
+  Separately, model-switch comparisons measured the proposed model against a previously recorded run
+  rather than a fresh one, so anything that had changed in between was attributed to the model.
+  Comparisons are now made case by case against a run executed at the same time, and repeats sharpen
+  each case's result without inflating confidence. **Some proposals that would previously have been
+  accepted will now be reported as unproven** — that is the correction, not a regression. Model
+  switches also now honour the configured number of samples, which they previously ignored.
+
+### Fixed
+
+- **A REST API key now sees its own project's data without having to name the project.** List
+  endpoints take an optional project filter, and leaving it out was meant to mean "everything I am
+  allowed to see". For anyone who is not an administrator it instead meant *nothing*: the request
+  succeeded and returned an empty list. The callers who hit this were the ones with no reason to
+  name a project in the first place — a REST API key, which is confined to a single project, and
+  integrations driving `/api/*` directly — so a service could ask for its traces, agents, suites,
+  runs or evaluators and be told, with a perfectly successful response, that there were none. An
+  unfiltered request is now answered with the caller's own projects, and a caller who belongs to
+  several gets all of them as one correctly paged list. The web app was never affected, because it
+  always names the current project.
+
+- **The Agent Playground no longer asks for an agent that is gone.** The playground remembers which
+  agent you had selected, and it kept asking the server for that agent even after it had been
+  deleted — or, in the login-free demo, after a restart had re-created the demo data with new
+  identities. The page recovered by falling back to the first agent, but every visit fired a request
+  that could only fail, which showed up as a "404 Not Found" in the browser's network console. The
+  remembered selection is now checked against the project's agents first, and a selection that no
+  longer exists is simply dropped.
+
+- **The demo showcase no longer displays A/B tests that never finish.** Two of the seeded improvement
+  theories claimed their A/B test was running, so the proposals board showed a pulsing "A/B in flight"
+  row and a progress bar that never moved — the demo deliberately never executes those tests. Both now
+  arrive with their result already in: one proven and waiting for a promote decision, one disproven.
+
+- **One busy project can no longer use up the whole installation's monthly trace allowance.**
+  Reaching the licensed trace limit stopped capture everywhere at once, so a single heavy project
+  could exhaust the month and silently take every other project's tracing down with it — including
+  projects that had barely recorded anything. Each project is now measured against an equal share of
+  the limit, and only projects above their share stop being captured. **Dropping is also no longer
+  invisible:** the affected project gets a notification, and the Error Log records that the limit was
+  reached. The check also runs far more often as the limit approaches, so an installation overshoots
+  by much less than it could before.
+
+- **A restart no longer skips a scheduled night's optimization.** Finished test runs waited in an
+  in-memory queue to be analysed for improvement suggestions. Restarting the application — a deploy,
+  an upgrade, a host reboot — discarded whatever was still waiting, so a restart that happened to
+  land during a scheduled run window silently cancelled that night's analysis, with nothing recorded
+  to show it had been due. Runs that have not yet been analysed are now picked up on the next start.
+  Existing history is not retroactively analysed, and the demo installation is unaffected.
+
+- **Evaluator history no longer goes blank on a busy installation.** The recent-results list, the
+  latest result, and the search on an evaluator's detail page all worked by taking the most recent few
+  hundred test results from across the *entire* installation and then picking out the ones belonging
+  to that evaluator. Once anything else had produced more results than that window held, the page
+  showed nothing at all — and because the window was shared, one busy project's activity emptied
+  other projects' pages. Each evaluator's history is now looked up directly, so what you see depends
+  only on your own evaluator's results.
+
+- **Playground model settings now actually affect the request.** Temperature, top-p, penalties, max
+  tokens, seed, stop sequences, reasoning effort and choice count could all be set in the playground's
+  right-hand panel, but none of them were sent to the provider — every response came back with the
+  provider's defaults, with nothing to indicate the settings had been ignored. They are now included
+  in the request. Providers that do not accept a particular setting (reasoning models reject
+  temperature, for example) now say so, rather than the value being dropped in silence.
+
+- **Licence limits are no longer exceeded by two simultaneous requests.** The checks for the number
+  of test suites, user seats, and projects each counted what already existed and then created the new
+  item as a separate step. Two requests arriving at the same moment both counted the same "before"
+  figure and both went ahead, so an installation could end up one over its licensed limit — most
+  easily by double-clicking a create button. Each check now completes before the next can start.
+
+- **Pass rates no longer include test runs you never started.** When the optimizer evaluates a
+  proposed improvement it runs the suite itself, behind the scenes. Those internal runs are correctly
+  hidden from the run list — but their results were still counted in the pass-rate figures and in the
+  baseline that anomaly detection compares against. Pass rates therefore moved for reasons nobody
+  could see or investigate, and the baseline was skewed by runs deliberately testing unproven
+  changes. Internal runs are now excluded from both, and any already recorded are cleared on the next
+  start.
+
+- **Deleting a user no longer silently destroys the API keys they created.** API keys were tied to
+  the person who minted them, so removing that person — routine when somebody leaves — deleted their
+  keys along with the account. Keys cannot be recovered, only replaced, so every integration using
+  one stopped working with nothing to explain it but a rejected request. Deleting a user who still
+  owns keys is now refused, with a message listing them so they can be removed or reissued
+  deliberately first. Deleting a provider can no longer destroy its keys either.
+
+- **Two-factor backup codes are now stored the way passwords are.** The recovery codes issued when
+  two-factor authentication is switched on were stored as a single plain hash each. Because a backup
+  code is short enough to type by hand, and because every code was hashed the same way, one stolen
+  database could be attacked against every user's codes at once with ordinary graphics hardware. They
+  are now stored salted and deliberately slow, so each code has to be attacked on its own. Codes
+  issued before this release keep working; new ones — and any issued after re-enrolling — get the
+  stronger storage.
+
+- **A stolen database backup no longer reveals weak upstream provider keys.** Proxytrace stores each
+  provider's upstream key encrypted, alongside a fingerprint it uses to look the provider up when a
+  request arrives. That fingerprint was a plain hash, which is safe for the long random keys
+  Proxytrace generates itself but not for one an operator types in — self-hosted model servers are
+  commonly configured with values like `EMPTY` or `ollama`, and a plain hash of those is recovered
+  from a word list in seconds, defeating the encryption next to it. The fingerprint is now computed
+  with a secret held in the installation's data directory, which a database backup does not contain.
+  Existing installations are upgraded automatically on the next start and keep working throughout;
+  operators running the API and proxy as separate containers must have them share the data directory,
+  as they already must for encryption to work at all.
+
+- **Forwarding non-inference requests through the proxy now needs its own permission.** Proxytrace
+  relays any path under `/{project}/` that is not an LLM call — `/health` and anything else the
+  provider serves — straight to the provider using your real upstream credential. That reach is
+  broader than capturing traffic: on a provider that also serves account-management routes at the
+  same address, a key issued purely to record LLM calls could reach those too, and none of it is
+  traced, checked by detectors, or written to the audit log. Keys now need an explicit **Upstream
+  pass-through** capability for it. **Existing keys keep it, so nothing breaks on upgrade** — but new
+  keys must be granted it deliberately. Requests authenticated with the provider's own key are
+  unaffected, since they could reach the provider directly anyway.
+
+- **Provider credentials are no longer sent to the browser on every providers-page load.** The
+  Providers settings page received every configured provider's upstream key in full each time it
+  loaded, whether or not anyone pressed "Reveal" — so the secrets sat in browser memory, in the
+  browser's network log, and in any proxy or extension between, with no record of who had seen them.
+  The page now receives only a masked preview; choosing **Reveal** or **Copy** fetches the key
+  itself, and each of those reads is written to the audit log as *Provider Key Revealed*.
+
+- **The sign-in form no longer reveals which email addresses have an account.** Signing in with an
+  unknown address was rejected immediately, while a known address took noticeably longer because the
+  password actually had to be checked. Timing the two apart let an outsider work through a list of
+  addresses and learn which ones are registered — useful for targeting a phishing or password-spraying
+  attempt. Both answers now take the same work, and so the same time.
+
+- **The licence holder's email address is no longer readable without signing in.** The licence
+  endpoint is deliberately public so the setup wizard and sign-in screen can show the edition, but it
+  also returned the purchaser's email to anyone who asked. Signed-in users still see it.
+
+- **Setting up a new installation is now recorded in the audit log.** The setup wizard creates the
+  first provider — including storing its upstream credential — its endpoint and the first project,
+  none of which left an audit entry, even though every other way of creating them does.
+
+- **The sign-in cookie is now marked as HTTPS-only.** Proxytrace decided this per request by looking
+  at whether *that* request arrived over HTTPS — but with TLS terminated at the reverse proxy in
+  front of it, as every supported deployment does, the request it sees is plain HTTP. So the session
+  cookie was never marked HTTPS-only, and any plain-HTTP request a browser could be led into making
+  would carry the full session token in the clear. It is now marked correctly, and can be overridden
+  for a deliberate plain-HTTP installation.
+
+- **Sign-in now has a rate limit.** Password guessing against a known account was limited only by how
+  fast requests could be sent. The same limit now also covers sign-up, the legacy-account claim, and
+  invite-link lookups.
+
+- **Rate limits can now tell clients apart behind a reverse proxy.** The password-reset and
+  two-factor limits are meant to apply per client, but every request appeared to come from the proxy,
+  so the whole installation shared one allowance — ten attempts locked *everyone* out of password
+  reset and two-factor sign-in for fifteen minutes. The released all-in-one image now gets this right
+  with no configuration; if you run the API behind your own proxy, see
+  [Configuration](/admin/configuration) for the one setting to declare.
+
+- **A lost encryption key directory is now reported instead of failing quietly.** Proxytrace encrypts
+  stored provider keys, SMTP passwords and two-factor secrets with a key set kept in its data
+  directory. If that directory was not configured the key set lived only in memory and was discarded
+  on every restart, and the affected secrets silently read back as empty — visible only as upstream
+  authentication failures and "invalid authenticator code". This is now reported as a critical error
+  in the operator error log, and the published images set the directory themselves.
+
+- **Stored secrets can no longer be printed by accident.** Several internal objects holding a
+  password, an upstream key or a two-factor secret would have included it verbatim if they were ever
+  written to a log or an error message. They now redact it, as the provider record already did.
+
+### Fixed
+
+- **Editing a provider, project or agent now takes effect on captured traffic immediately.** Settings
+  that rarely change are held in a short-lived in-memory cache, but that cache was kept separately per
+  request — so saving a change refreshed only the copy belonging to the browser request that made it,
+  while the trace-capture path went on reading its own untouched copy for up to five minutes. Rotating
+  a provider's upstream API key was the sharpest case: capture kept authenticating with the old key,
+  and the calls it was recording failed, until the cache happened to expire. Saving a change now
+  refreshes every copy at once.
+
+- **Opening a single agent no longer gets slower as traces accumulate.** The agent page (and the
+  `get_agent` MCP tool) worked out when the agent was last used by scanning and grouping the entire
+  trace table across every agent, then picking one row out of the result. On a busy installation that
+  turned a page that should be instant into one that slowed down month after month. It now reads only
+  that agent's own traces.
+
+- **Resetting an installation's data no longer loads every trace into memory first.** The admin data
+  reset deleted traces by loading them all and marking each one removed, so resetting an installation
+  with millions of traces could exhaust memory before it finished. The deletion is now done by the
+  database in a single statement.
+
+- **The agent distribution charts no longer load an unlimited number of traces at once.** The time
+  range comes from the request, so asking for a wide enough range pulled an agent's entire history
+  into memory in one go. The charts are now computed from a bounded sample of the most recent traces
+  in the range, and the log records when that limit applies.
+
+- **Test runs no longer make far more provider calls at once than configured.** The parallelism
+  setting was applied separately to each of three nested stages — the runs in a group, the test cases
+  in a run, and the evaluators on a case — so the configured number was multiplied by itself three
+  times rather than respected: the default of 2 allowed up to 8 simultaneous calls. Installations
+  hitting provider rate limits during a run, or seeing sharper cost spikes than the setting implied,
+  were seeing this. The setting is now an absolute cap on simultaneous provider calls.
+
+- **Searching traces by model, and searching the error log, now ignores capitalisation.** Both
+  searches matched letter-for-letter against the database, so filtering traces for "GPT" found nothing
+  when the model was recorded as "gpt-4o", and an error search for "TimeoutException" missed entries
+  logged in another casing. Typing `%` or `_` in either box also acted as a wildcard rather than being
+  searched for. Both now match regardless of capitalisation, and those two characters are searched
+  literally.
+
+- **A schedule anchored to a non-UTC time no longer fires every minute.** The next-run calculation
+  compared two timestamps by their wall-clock reading rather than the instant they represent, so an
+  anchor carrying a UTC offset — say a daily run at 09:00+02:00 — lost a whole step and produced a
+  next-run time in the *past*. The scheduler polls every minute, found the schedule perpetually due,
+  and re-derived the same past instant each time, so the suite ran over and over for as long as the
+  offset was wide, billing a full LLM test run on every pass. Alignment is now offset-aware, and the
+  next run is always strictly in the future.
+
+- **Proposal text now reads the same on every server.** The savings percentage, cost and latency
+  figures written into an optimization proposal's rationale were formatted using the host's regional
+  settings, so a server configured for a comma-decimal locale persisted "cuts cost by 12,3%" instead
+  of "12.3%". These numbers are stored prose, so the wrong separator stuck around and rendered for
+  everyone. They are now always formatted the same way regardless of host locale.
+
+- **A Redis outage no longer adds ~5 seconds to every proxied call.** Handing the captured call to
+  the ingestion queue is meant to be fire-and-forget, but the proxy waits for it after answering
+  each request — and while Redis was unreachable the client library quietly queued the write instead
+  of failing, so the wait ran to its full timeout. Every single agent call through the proxy paid
+  that delay, and cancelling the request did not shorten it. The proxy now checks the connection
+  first: with Redis down the capture is dropped with a warning in the log and the response goes out
+  at full speed, instead of the whole proxy crawling because the *tracing* backend is unavailable.
+
+- **A provider key with a stray newline no longer breaks the model list.** An API key pasted with a
+  trailing line break or invisible control character made listing an Azure OpenAI deployment fail
+  with an opaque server error instead of a clean upstream error. The key is now forwarded as-is, the
+  way every other header on the proxy path already was.
+
+- **The proxy's 64 MiB request limit is now the real one.** The standalone proxy documented and
+  checked a 64 MiB cap on request bodies, but the web server underneath it rejected anything over
+  30 MB first — so a large-but-legal request was refused with the wrong error, and the proxy's own
+  check never ran. The server limit is now pinned to the same 64 MiB, and an oversized upload is cut
+  off as it arrives rather than being read into memory in full before being rejected.
+
+- **A non-streaming reply to a streaming request can no longer exhaust proxy memory.** When a client
+  asked for `stream: true` but the upstream answered with one large single-line body — a provider
+  that ignores the flag, or a firewall error page in front of it — the proxy held the entire body in
+  memory (several times over) before forwarding a single byte. It now forwards such a response in
+  bounded pieces; the bytes the client receives are unchanged.
+
+- **Cancelling a test run now actually stops it.** Pressing Cancel marked the run cancelled in the
+  UI, but the work carried on to completion behind the scenes — every remaining model call was still
+  made and still billed. The run also logged a spurious failure and raised a completion notification
+  after finishing. Cancelling now stops the in-flight calls immediately, and the run settles as
+  cancelled without the phantom failure.
+
+- **The proxy no longer follows an upstream redirect.** If a provider answered a redirect, the proxy
+  chased it and carried the provider credential and the forwarded client headers to whatever address
+  the response named. It now relays the redirect to the client instead, matching what it already did
+  for non-model requests.
+
+- **Very large replies are no longer held in memory in full.** Non-streaming responses were read
+  completely into memory before any of them was forwarded, despite the code being written to stream
+  them through — so one big reply could push the proxy far past its intended footprint.
+
+- **Model prices no longer disappear until restart after one failed lookup.** If the first fetch of
+  the pricing catalogue failed — a brief network problem was enough — the empty result was cached
+  permanently, so every model showed an unknown price for the remaining life of the process. A failed
+  fetch is now retried on the next request.
+
+- **Paging past the end of a list no longer returns the first page again.** Asking for a very high
+  page number overflowed the internal offset calculation and silently served page 1, so an
+  integration walking pages could loop forever instead of finishing.
+
+- **The project list now respects the page-size limit.** Requesting a huge page size returned every
+  project the caller belongs to in a single response, unlike every other list in the app.
+
+- **A failure part-way through a live-updating view no longer hides its cause.** When something went
+  wrong after a stream had already started sending, the error handler tried to write a response that
+  was already on its way, which replaced the real error with an abrupt disconnection and logged the
+  wrong thing. The real cause is now logged.
+
+- **Keys with REST API access now show it.** The provider screen listed a key's capabilities from a
+  hardcoded list that had never been updated for the REST API scopes, so a key that could read or
+  write over the REST API appeared to have no REST access at all.
+
+- **Ambiguous project addresses now resolve consistently.** Two projects whose names reduce to the
+  same URL segment — "My Project" and "my-project", for instance — could each win at random, so
+  proxied calls landed in one project or the other from request to request. The same project now wins
+  every time, and the clash is reported in the log.
+
+- **Bulk requests are now bounded.** Several endpoints accepted lists of identifiers with no limit and
+  did a database round-trip per entry, some while holding a transaction open, so one oversized request
+  could stall the whole installation. These lists now have explicit limits and oversized requests are
+  rejected up front.
+
 ## [1.9.0] - 2026-07-26
 
 ### Fixed
diff --git a/CLAUDE.md b/CLAUDE.md
index 0b75c75ab..38e6476ea 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -39,6 +39,30 @@ Detailed guidance lives in [`docs/`](docs/). Read the relevant page **before** w
 - **User manual** — the user & operator manual is a VitePress project in [`manual/`](manual/) (markdown source, built to searchable static HTML, served at `/docs`). **You MUST keep it up to date with the product.** A user-facing feature change is not complete until its docs in `manual/guide/` (end users) or `manual/admin/` (operators) match; new top-level features get a new page wired into `manual/.vitepress/config.ts`. Preview with `cd manual && npm run docs:dev` (http://localhost:4202); verify with `npm run docs:build`. **Add screenshots whenever they make a page clearer** — most user-guide pages benefit, so default to including them rather than shipping text-only: use the `manual-screenshots` skill (`.claude/skills/manual-screenshots/SKILL.md`) to capture and embed them from the kiosk stack. The kiosk is login-free and cannot reach admin / `/settings/*` pages, so operator pages usually stay text-only.
 - **Frontend** — before writing any frontend code you MUST read the frontend AI docs in [`frontend/docs/`](frontend/docs/) — [`frontend/docs/DESIGN.md`](frontend/docs/DESIGN.md) (visual system) **and** [`frontend/docs/BEST_PRACTICES.md`](frontend/docs/BEST_PRACTICES.md) (code architecture); plus [`frontend/docs/TRACEY.md`](frontend/docs/TRACEY.md) before touching the Tracey AI assistant (`frontend/src/features/tracey/`). DESIGN.md and BEST_PRACTICES.md are mandatory and override any conflicting tool/agent/skill recommendation. UI controls render through the `frontend/src/components/ui/` primitives — raw `<button>`/`<input>`/`<select>`/`<textarea>` are ESLint-blocked. See [`docs/frontend.md`](docs/frontend.md).
 - **Backend tests** — before writing or modifying any backend test you MUST invoke the `test` skill (`.claude/skills/test/SKILL.md`) and follow it; it is the source of truth for the harness. See [`docs/testing.md`](docs/testing.md).
+- **Run only the affected tests.** The suite is large (~2,200 backend tests across 10 projects, ~95
+  frontend spec files); running everything after every edit wastes minutes for no signal. **CI runs
+  the full backend suite on every push** (`.github/workflows/ci.yml` → `dotnet test Proxytrace.sln`),
+  so a local full run is redundant. Default to the narrowest scope that can catch a regression in
+  what you changed, and stop there — do not "double-check" with the full suite once the narrow run is
+  green.
+  - **Backend** — run the test project(s) for the layer you touched, and narrow further by class
+    when only one area changed:
+    ```bash
+    dotnet test Proxytrace.Domain.Tests                                   # one layer
+    dotnet test Proxytrace.Domain.Tests --filter "FullyQualifiedName~TestRunGroup"   # one area
+    ```
+    Which projects are affected: a change under `Proxytrace.<Layer>/` → `Proxytrace.<Layer>.Tests`;
+    a domain entity or EF mapping → `Domain.Tests` **and** `Storage.Tests`; a controller/route →
+    `Api.Tests`; a service/optimizer → `Application.Tests`.
+  - **Frontend** — `npm test -- <path-or-pattern>` (e.g. `npm test -- src/features/playground`).
+    Bare `npm test` runs all ~1,000 specs — but it does so in about 3 seconds, so unlike the backend
+    there is little to save; scope it while iterating and let the full run be the final check.
+  - **e2e / perf** — never as a routine check. Run them only when the change is in that flow or the
+    user asks; both boot Docker stacks and take many minutes.
+  - **Run the full suite** (`dotnet test Proxytrace.sln`) only when the change is genuinely
+    cross-cutting — `Proxytrace.Common`, `Proxytrace.Testing`, DI/module wiring, a shared interface
+    signature, a package bump — or when cutting a release. Say which scope you ran and why, so a
+    narrow run is never mistaken for a full one.
 - **Internationalization** — the UI is multilingual (English is the source). Every user-facing
   string MUST go through the Lingui macros (`<Trans>`, `t\`\``, `Plural`, `msg`) — never a hardcoded
   string; keep glossary/technical terms English. After adding labels run `npm run i18n:extract` then
@@ -49,6 +73,12 @@ Detailed guidance lives in [`docs/`](docs/). Read the relevant page **before** w
   letting it slide. Invoke the `file-issue` skill (`.claude/skills/file-issue/SKILL.md`) — it covers
   dedup, title/body quality, and labels — then carry on with your task.
 - **Nullable suppression** — suppressing nullable warnings with `!` is strictly forbidden everywhere.
+  There is exactly **one** sanctioned exception, and it is not extensible: `Validation.Success` in
+  [`Proxytrace.Common/Validation/Validation.cs`](Proxytrace.Common/Validation/Validation.cs). The BCL
+  defines validation success as a `null` `ValidationResult` while declaring
+  `IValidatableObject.Validate` to return a **non-nullable** element type, so the framework demands a
+  value it defines as null through a signature we cannot change. That single line is documented in
+  place. Do not add a second exemption — return `Validation.Success` instead.
 - **Perf at scale** — whenever you touch a query, repository, EF mapping, or index on a high-volume
   entity (above all `AgentCallEntity`/traces, but any table that grows unboundedly), you MUST add or
   extend a perf test in [`perf/`](perf/) that measures the changed path against a budget in
diff --git a/Proxytrace.Api.Tests/AgentCallsControllerTests.cs b/Proxytrace.Api.Tests/AgentCallsControllerTests.cs
index 7fc4bcb13..655a84532 100644
--- a/Proxytrace.Api.Tests/AgentCallsControllerTests.cs
+++ b/Proxytrace.Api.Tests/AgentCallsControllerTests.cs
@@ -171,6 +171,66 @@ public async Task GetAll_AsNonAdminWithoutAccessibleProjectFilter_ReturnsEmpty()
         result.Items.Should().BeEmpty();
     }
 
+    [TestMethod]
+    public async Task GetAll_AsNonAdminWithoutProjectFilter_ReturnsOwnProjectsCallsOnly()
+    {
+        // #482: an unfiltered list from a non-admin used to short-circuit to an empty page, so a
+        // REST API key — confined to one project, and with no reason to send a projectId — was told
+        // its own project had no traces.
+        IServiceProvider services = GetServices();
+        var mine = await SeedAgentInNewProjectAsync(services, "mine");
+        var theirs = await SeedAgentInNewProjectAsync(services, "theirs");
+        var myCall = await SeedCallWithToolsAsync(services, mine, []);
+        await SeedCallWithToolsAsync(services, theirs, []);
+
+        var controller = ResolveController(services, ScopedGuard(mine.Project.Id));
+        var result = await controller.GetAll(cancellationToken: CancellationToken);
+
+        result.Items.Should().ContainSingle().Which.Id.Should().Be(myCall.Id);
+        result.Total.Should().Be(1);
+    }
+
+    [TestMethod]
+    public async Task GetAll_AsNonAdminInSeveralProjectsWithoutFilter_ReturnsTheUnion()
+    {
+        IServiceProvider services = GetServices();
+        var first = await SeedAgentInNewProjectAsync(services, "first");
+        var second = await SeedAgentInNewProjectAsync(services, "second");
+        var outsider = await SeedAgentInNewProjectAsync(services, "outsider");
+        var firstCall = await SeedCallWithToolsAsync(services, first, []);
+        var secondCall = await SeedCallWithToolsAsync(services, second, []);
+        await SeedCallWithToolsAsync(services, outsider, []);
+
+        // A member of two projects: the page must be computed over the union of both, not one of
+        // them and not the whole instance.
+        var controller = ResolveController(services, ScopedGuard(first.Project.Id, second.Project.Id));
+        var result = await controller.GetAll(cancellationToken: CancellationToken);
+
+        result.Items.Select(i => i.Id).Should().BeEquivalentTo([firstCall.Id, secondCall.Id]);
+        result.Total.Should().Be(2);
+    }
+
+    /// <summary>
+    /// An agent in a project of its own, so a test can tell two tenants' rows apart.
+    /// </summary>
+    private async Task<IAgent> SeedAgentInNewProjectAsync(IServiceProvider services, string name)
+    {
+        var endpoint = await services.GetRequiredService<IDomainEntityGenerator<Proxytrace.Domain.ModelEndpoint.IModelEndpoint>>()
+            .GetOrCreateAsync(CancellationToken);
+        var project = await services.GetRequiredService<Proxytrace.Domain.Project.IProjectRepository>().AddAsync(
+            services.GetRequiredService<Proxytrace.Domain.Project.IProject.CreateNew>()($"P-{name}-{Guid.NewGuid():N}", endpoint, []),
+            CancellationToken);
+
+        var template = services.GetRequiredService<Proxytrace.Domain.Prompt.IPromptTemplate.Create>()(
+            $"T-{name}", "You are a test agent.");
+        var parameters = services.GetRequiredService<Proxytrace.Domain.Inference.IModelParameters.Create>()(null, null, null, null, null);
+
+        return await services.GetRequiredService<IAgentRepository>().AddAsync(
+            services.GetRequiredService<IAgent.CreateNew>()(
+                $"A-{name}", template, [], endpoint, project, parameters),
+            CancellationToken);
+    }
+
     // ── tool-name filter + picker ──────────────────────────────────────────────
 
     [TestMethod]
@@ -289,8 +349,8 @@ await ResolveController(services).Seed(
 
         // A project-scoped (non-admin) member opens the session timeline: the list request carries
         // both projectId and sessionId, so the access guard authorizes and the sessionId filter
-        // narrows to the one session. Without the projectId the guard would deny and the timeline
-        // would render empty for every non-admin.
+        // narrows to the one session. (Since #482 the projectId is no longer required for a
+        // non-admin to see anything — omitting it scopes to their own projects instead.)
         var controller = ResolveController(services, ScopedGuard(projectId));
         var result = await controller.GetAll(
             projectId: projectId, sessionId: expectedSessionId, cancellationToken: CancellationToken);
diff --git a/Proxytrace.Api.Tests/Auth/JwtBearerEventsFactoryTests.cs b/Proxytrace.Api.Tests/Auth/JwtBearerEventsFactoryTests.cs
index 66af68e9b..7ec32dd55 100644
--- a/Proxytrace.Api.Tests/Auth/JwtBearerEventsFactoryTests.cs
+++ b/Proxytrace.Api.Tests/Auth/JwtBearerEventsFactoryTests.cs
@@ -82,6 +82,8 @@ public async Task OnMessageReceived_WithValidStreamTicket_AuthenticatesUser()
         serviceCollection.AddSingleton(tickets);
         serviceCollection.AddSingleton(repo);
         var httpContext = new DefaultHttpContext { RequestServices = serviceCollection.BuildServiceProvider() };
+        httpContext.Request.Method = HttpMethods.Get;
+        httpContext.Request.Path = "/api/agent-calls/stream";
         httpContext.Request.QueryString = new QueryString("?stream_ticket=ticket-abc");
         var ctx = new MessageReceivedContext(httpContext, Scheme(), new JwtBearerOptions());
 
@@ -95,6 +97,42 @@ public async Task OnMessageReceived_WithValidStreamTicket_AuthenticatesUser()
         httpContext.Items[CurrentUserAccessor.UserIdItemKey].Should().Be(userId);
     }
 
+    [TestMethod]
+    public async Task OnMessageReceived_WithStreamTicketOnNonStreamRoute_DoesNotAuthenticate()
+    {
+        // The ticket redeems into a full principal including the live Role claim, so honoring it
+        // outside the SSE routes it was minted for would turn a URL-borne credential into general
+        // API access — including admin endpoints — for its validity window.
+        var userId = Guid.NewGuid();
+        var user = Substitute.For<IUser>();
+        user.Id.Returns(userId);
+        user.Role.Returns(UserRole.Admin);
+
+        var tickets = Substitute.For<IStreamTicketService>();
+        tickets.Consume("ticket-abc").Returns(userId);
+        var repo = Substitute.For<IRepository<IUser>>();
+        repo.FindAsync(userId, Arg.Any<CancellationToken>()).Returns(user);
+
+        var serviceCollection = new ServiceCollection();
+        serviceCollection.AddSingleton(tickets);
+        serviceCollection.AddSingleton(repo);
+        var httpContext = new DefaultHttpContext { RequestServices = serviceCollection.BuildServiceProvider() };
+        httpContext.Request.Method = HttpMethods.Get;
+        httpContext.Request.Path = "/api/users";
+        httpContext.Request.QueryString = new QueryString("?stream_ticket=ticket-abc");
+        var ctx = new MessageReceivedContext(httpContext, Scheme(), new JwtBearerOptions());
+
+        var events = JwtBearerEventsFactory.Create();
+
+        await events.OnMessageReceived(ctx);
+
+        ctx.Result.Should().BeNull();
+        ctx.Principal.Should().BeNull();
+        httpContext.Items.Should().NotContainKey(CurrentUserAccessor.UserIdItemKey);
+        // The ticket must also stay unspent, so a genuine stream request can still redeem it.
+        tickets.DidNotReceive().Consume(Arg.Any<string>());
+    }
+
     [TestMethod]
     public async Task OnMessageReceived_WithInvalidStreamTicket_FailsContext()
     {
@@ -105,6 +143,8 @@ public async Task OnMessageReceived_WithInvalidStreamTicket_FailsContext()
         serviceCollection.AddSingleton(tickets);
         serviceCollection.AddSingleton(Substitute.For<IRepository<IUser>>());
         var httpContext = new DefaultHttpContext { RequestServices = serviceCollection.BuildServiceProvider() };
+        httpContext.Request.Method = HttpMethods.Get;
+        httpContext.Request.Path = "/api/agent-calls/stream";
         httpContext.Request.QueryString = new QueryString("?stream_ticket=bad");
         var ctx = new MessageReceivedContext(httpContext, Scheme(), new JwtBearerOptions());
 
diff --git a/Proxytrace.Api.Tests/Auth/SessionCookieTests.cs b/Proxytrace.Api.Tests/Auth/SessionCookieTests.cs
new file mode 100644
index 000000000..6fc470538
--- /dev/null
+++ b/Proxytrace.Api.Tests/Auth/SessionCookieTests.cs
@@ -0,0 +1,67 @@
+using AwesomeAssertions;
+using Microsoft.AspNetCore.Http;
+using Proxytrace.Api.Auth;
+
+namespace Proxytrace.Api.Tests.Auth;
+
+[TestClass]
+public sealed class SessionCookieTests
+{
+    private static string AppendAndRead(bool secure)
+    {
+        var context = new DefaultHttpContext();
+        // The backend hop is plain HTTP in the documented topology (TLS terminates at the reverse
+        // proxy), so a request-derived Secure flag would always be false here.
+        context.Request.Scheme = "http";
+        var cookie = new SessionCookie(new SessionCookieOptions { Secure = secure });
+
+        cookie.Append(context.Response, "session-jwt", DateTimeOffset.UtcNow.AddDays(7));
+
+        return context.Response.Headers.SetCookie.ToString().ToLowerInvariant();
+    }
+
+    [TestMethod]
+    public void Secure_ByDefault_IsEnabled()
+    {
+        new SessionCookieOptions().Secure.Should().BeTrue();
+    }
+
+    [TestMethod]
+    public void Append_OverPlainHttpHop_StillMarksTheCookieSecure()
+    {
+        var setCookie = AppendAndRead(secure: true);
+
+        setCookie.Should().Contain("proxytrace_session=session-jwt");
+        setCookie.Should().Contain("; secure");
+    }
+
+    [TestMethod]
+    public void Append_WhenSecureDisabled_OmitsTheSecureAttribute()
+    {
+        var setCookie = AppendAndRead(secure: false);
+
+        setCookie.Should().Contain("proxytrace_session=session-jwt");
+        setCookie.Should().NotContain("; secure");
+    }
+
+    [TestMethod]
+    public void Append_Always_KeepsHttpOnlyAndStrictSameSite()
+    {
+        var setCookie = AppendAndRead(secure: true);
+
+        setCookie.Should().Contain("httponly").And.Contain("samesite=strict");
+    }
+
+    [TestMethod]
+    public void Delete_WhenSecureConfigured_ClearsTheCookieWithMatchingAttributes()
+    {
+        var context = new DefaultHttpContext();
+        var cookie = new SessionCookie(new SessionCookieOptions { Secure = true });
+
+        cookie.Delete(context.Response);
+
+        var setCookie = context.Response.Headers.SetCookie.ToString().ToLowerInvariant();
+        setCookie.Should().Contain("proxytrace_session=;");
+        setCookie.Should().Contain("; secure");
+    }
+}
diff --git a/Proxytrace.Api.Tests/AuthControllerTests.cs b/Proxytrace.Api.Tests/AuthControllerTests.cs
index fe5362197..bad43e949 100644
--- a/Proxytrace.Api.Tests/AuthControllerTests.cs
+++ b/Proxytrace.Api.Tests/AuthControllerTests.cs
@@ -7,6 +7,7 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using NSubstitute;
+using Proxytrace.Api.Auth;
 using Proxytrace.Api.Controllers;
 using Proxytrace.Api.Dto.Auth;
 using Proxytrace.Application.Auth;
@@ -398,7 +399,8 @@ private static AuthController ResolveController(
         services.GetRequiredService<IStreamTicketService>(),
         config ?? new ConfigurationBuilder().Build(),
         Microsoft.Extensions.Logging.Abstractions.NullLogger<Proxytrace.Domain.AuditLog.Audit>.Instance,
-        emailSettings ?? Substitute.For<IEmailSettingsStore>())
+        emailSettings ?? Substitute.For<IEmailSettingsStore>(),
+        services.GetRequiredService<ISessionCookie>())
     {
         ControllerContext = new ControllerContext { HttpContext = new DefaultHttpContext() },
     };
diff --git a/Proxytrace.Api.Tests/AuthRateLimiterConfiguratorTests.cs b/Proxytrace.Api.Tests/AuthRateLimiterConfiguratorTests.cs
new file mode 100644
index 000000000..4acb46d76
--- /dev/null
+++ b/Proxytrace.Api.Tests/AuthRateLimiterConfiguratorTests.cs
@@ -0,0 +1,138 @@
+using System.Net;
+using System.Reflection;
+using AwesomeAssertions;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.RateLimiting;
+using Microsoft.Extensions.Configuration;
+using Proxytrace.Api.Controllers;
+
+namespace Proxytrace.Api.Tests;
+
+[TestClass]
+public sealed class AuthRateLimiterConfiguratorTests
+{
+    private static IConfiguration Configuration(params (string Key, string Value)[] entries) =>
+        new ConfigurationBuilder()
+            .AddInMemoryCollection(entries.Select(e => new KeyValuePair<string, string?>(e.Key, e.Value)))
+            .Build();
+
+    private static string? PolicyOf(string action) =>
+        typeof(AuthController).GetMethod(action)?
+            .GetCustomAttribute<EnableRateLimitingAttribute>()?.PolicyName;
+
+    [TestMethod]
+    public void LoginLimits_ByDefault_AllowThirtyAttemptsPerMinute()
+    {
+        var limits = new AuthRateLimiterConfigurator(Configuration()).LoginLimits();
+
+        limits.PermitLimit.Should().Be(30);
+        limits.Window.Should().Be(TimeSpan.FromMinutes(1));
+        limits.QueueLimit.Should().Be(0);
+    }
+
+    [TestMethod]
+    public void LoginLimits_WhenConfigured_UseTheOperatorValues()
+    {
+        var limits = new AuthRateLimiterConfigurator(Configuration(
+            ("RateLimiting:Login:PermitLimit", "5"),
+            ("RateLimiting:Login:WindowSeconds", "120"))).LoginLimits();
+
+        limits.PermitLimit.Should().Be(5);
+        limits.Window.Should().Be(TimeSpan.FromMinutes(2));
+    }
+
+    [TestMethod]
+    public void PasswordResetLimits_ByDefault_KeepTheDocumentedTenPerQuarterHour()
+    {
+        var limits = new AuthRateLimiterConfigurator(Configuration()).PasswordResetLimits();
+
+        limits.PermitLimit.Should().Be(10);
+        limits.Window.Should().Be(TimeSpan.FromMinutes(15));
+    }
+
+    [TestMethod]
+    public void MfaLimits_ByDefault_KeepTheDocumentedTenPerQuarterHour()
+    {
+        var limits = new AuthRateLimiterConfigurator(Configuration()).MfaLimits();
+
+        limits.PermitLimit.Should().Be(10);
+        limits.Window.Should().Be(TimeSpan.FromMinutes(15));
+    }
+
+    [TestMethod]
+    public void PartitionKey_ForDifferentClientAddresses_SeparatesTheBuckets()
+    {
+        var configurator = new AuthRateLimiterConfigurator(Configuration());
+        var first = new DefaultHttpContext();
+        first.Connection.RemoteIpAddress = IPAddress.Parse("203.0.113.7");
+        var second = new DefaultHttpContext();
+        second.Connection.RemoteIpAddress = IPAddress.Parse("203.0.113.8");
+
+        configurator.PartitionKey(first).Should().NotBe(configurator.PartitionKey(second));
+    }
+
+    [TestMethod]
+    public void PartitionKey_WithoutARemoteAddress_FallsBackToASharedBucket()
+    {
+        var configurator = new AuthRateLimiterConfigurator(Configuration());
+
+        configurator.PartitionKey(new DefaultHttpContext()).Should().Be("unknown");
+    }
+
+    [TestMethod]
+    public void Configure_Always_RejectsWithTooManyRequests()
+    {
+        var options = new RateLimiterOptions();
+
+        new AuthRateLimiterConfigurator(Configuration()).Configure(options);
+
+        options.RejectionStatusCode.Should().Be(StatusCodes.Status429TooManyRequests);
+    }
+
+    [TestMethod]
+    public void Login_IsRateLimited()
+    {
+        // Without this the only bound on password guessing is request throughput — there is no
+        // per-account failed-attempt counter anywhere in the auth stack.
+        PolicyOf(nameof(AuthController.Login)).Should().Be(AuthRateLimiterConfigurator.LoginPolicy);
+    }
+
+    [TestMethod]
+    public void ClaimLegacy_IsRateLimited()
+    {
+        PolicyOf(nameof(AuthController.ClaimLegacy)).Should().Be(AuthRateLimiterConfigurator.LoginPolicy);
+    }
+
+    [TestMethod]
+    public void Signup_IsRateLimited()
+    {
+        PolicyOf(nameof(AuthController.Signup)).Should().Be(AuthRateLimiterConfigurator.LoginPolicy);
+    }
+
+    [TestMethod]
+    public void InvitePreview_IsRateLimited()
+    {
+        PolicyOf(nameof(AuthController.Preview)).Should().Be(AuthRateLimiterConfigurator.LoginPolicy);
+    }
+
+    [TestMethod]
+    public void PasswordResetEndpoints_KeepTheirRateLimit()
+    {
+        PolicyOf(nameof(AuthController.ForgotPassword)).Should().Be(AuthRateLimiterConfigurator.PasswordResetPolicy);
+        PolicyOf(nameof(AuthController.ResetPassword)).Should().Be(AuthRateLimiterConfigurator.PasswordResetPolicy);
+    }
+
+    [TestMethod]
+    public void MfaVerify_KeepsItsRateLimit()
+    {
+        PolicyOf(nameof(AuthController.MfaVerify)).Should().Be(AuthRateLimiterConfigurator.MfaPolicy);
+    }
+
+    [TestMethod]
+    public void PolicyNames_MatchTheDocumentedIdentifiers()
+    {
+        AuthRateLimiterConfigurator.LoginPolicy.Should().Be("auth-login");
+        AuthRateLimiterConfigurator.PasswordResetPolicy.Should().Be("auth-reset");
+        AuthRateLimiterConfigurator.MfaPolicy.Should().Be("auth-mfa");
+    }
+}
diff --git a/Proxytrace.Api.Tests/LicenseControllerTests.cs b/Proxytrace.Api.Tests/LicenseControllerTests.cs
index b04bf3b3c..5cbb242f4 100644
--- a/Proxytrace.Api.Tests/LicenseControllerTests.cs
+++ b/Proxytrace.Api.Tests/LicenseControllerTests.cs
@@ -91,7 +91,7 @@ public void Get_ActiveEnterprise_ReturnsEnterpriseDto()
             LicenseSource.Stored);
 
         var services = GetServices();
-        var dto = ResolveController(services, StubLicense(snapshot)).Get();
+        var dto = ResolveController(services, StubLicense(snapshot), authenticatedAsAdmin: true).Get();
 
         dto.Tier.Should().Be("enterprise");
         dto.Status.Should().Be("active");
@@ -100,6 +100,33 @@ public void Get_ActiveEnterprise_ReturnsEnterpriseDto()
         dto.Features.Should().Contain(nameof(LicenseFeature.OptimizationProposals));
     }
 
+    [TestMethod]
+    public void Get_Anonymously_WithholdsTheCustomerEmail()
+    {
+        // The endpoint is deliberately anonymous (the setup wizard and sign-in screen need the tier
+        // before any user exists), so it must not disclose who the licence belongs to — otherwise a
+        // plain unauthenticated GET yields the purchaser's email address.
+        var definition = LicensePolicy.For(LicenseTier.Enterprise);
+        var snapshot = new LicenseSnapshot(
+            LicenseTier.Enterprise,
+            LicenseStatus.Active,
+            DateTimeOffset.UtcNow.AddDays(30),
+            null,
+            "customer@example.com",
+            "jti-1",
+            definition.Features,
+            definition.Limits,
+            LicenseSource.Stored);
+
+        var services = GetServices();
+        var dto = ResolveController(services, StubLicense(snapshot)).Get();
+
+        dto.CustomerEmail.Should().BeNull();
+        // Everything the anonymous callers actually need is still there.
+        dto.Tier.Should().Be("enterprise");
+        dto.Status.Should().Be("active");
+    }
+
     [TestMethod]
     public void Get_OfflineLicense_ProjectsOfflineFlag()
     {
diff --git a/Proxytrace.Api.Tests/ModelProvidersControllerTests.cs b/Proxytrace.Api.Tests/ModelProvidersControllerTests.cs
index a2e92d28c..ad5c3cfee 100644
--- a/Proxytrace.Api.Tests/ModelProvidersControllerTests.cs
+++ b/Proxytrace.Api.Tests/ModelProvidersControllerTests.cs
@@ -97,6 +97,103 @@ public async Task Update_Existing_PersistsChange()
         result.Value.Name.Should().Be("Renamed");
     }
 
+    [TestMethod]
+    public async Task GetAll_DoesNotReturnTheUpstreamKey()
+    {
+        // The key used to be projected into the list response, so every provider credential in the
+        // installation reached the browser on every admin providers-page load.
+        IServiceProvider services = GetServices();
+        var controller = ResolveController(services);
+        var provider = await services.GetRequiredService<IDomainEntityGenerator<IModelProvider>>().CreateAsync(CancellationToken);
+
+        var paged = await controller.GetAll(cancellationToken: CancellationToken);
+
+        var dto = paged.Items.Should().ContainSingle(p => p.Id == provider.Id).Subject;
+        provider.ApiKey.Should().NotBeNullOrEmpty("the fixture must have a key for this to be meaningful");
+        dto.UpstreamApiKeyPreview.Should().NotBe(provider.ApiKey);
+        dto.UpstreamApiKeyPreview.Should().Contain("•");
+    }
+
+    [TestMethod]
+    public async Task GetOverview_DoesNotReturnTheUpstreamKey()
+    {
+        IServiceProvider services = GetServices();
+        var controller = ResolveController(services);
+        var provider = await services.GetRequiredService<IDomainEntityGenerator<IModelProvider>>().CreateAsync(CancellationToken);
+
+        var overview = await controller.GetOverview(CancellationToken);
+
+        var dto = overview.Providers.Should().ContainSingle(p => p.Provider.Id == provider.Id).Subject;
+        dto.Provider.UpstreamApiKeyPreview.Should().NotBe(provider.ApiKey);
+    }
+
+    [TestMethod]
+    public async Task GetUpstreamKey_ReturnsTheKeyAndAuditsTheRead()
+    {
+        IServiceProvider services = GetServices();
+        var audit = new RecordingAuditLogger();
+        var controller = ResolveController(services, audit: audit);
+        var provider = await services.GetRequiredService<IDomainEntityGenerator<IModelProvider>>().CreateAsync(CancellationToken);
+
+        var result = await controller.GetUpstreamKey(provider.Id, CancellationToken);
+
+        result.Value.Should().NotBeNull();
+        result.Value.UpstreamApiKey.Should().Be(provider.ApiKey);
+        audit.Events.Should().ContainSingle()
+            .Which.Id.Should().Be((int)AuditAction.ProviderUpstreamKeyRevealed);
+    }
+
+    [TestMethod]
+    public async Task GetUpstreamKey_UnknownProvider_ReturnsNotFoundAndAuditsNothing()
+    {
+        IServiceProvider services = GetServices();
+        var audit = new RecordingAuditLogger();
+        var controller = ResolveController(services, audit: audit);
+
+        var result = await controller.GetUpstreamKey(Guid.NewGuid(), CancellationToken);
+
+        result.Result.Should().BeOfType<NotFoundResult>();
+        audit.Events.Should().BeEmpty();
+    }
+
+    [TestMethod]
+    public async Task Update_WithNullUpstreamKey_LeavesTheStoredCredentialUnchanged()
+    {
+        // The client no longer holds the key, so an edit that only renames a provider sends null.
+        // Treating that as "no key" would wipe the credential and break every proxied call.
+        IServiceProvider services = GetServices();
+        var controller = ResolveController(services);
+        var providers = services.GetRequiredService<IModelProviderRepository>();
+        var provider = await services.GetRequiredService<IDomainEntityGenerator<IModelProvider>>().CreateAsync(CancellationToken);
+        var originalKey = provider.ApiKey;
+
+        await controller.Update(
+            provider.Id,
+            new UpdateModelProviderRequest("Renamed", provider.Endpoint.ToString(), null, provider.Kind),
+            CancellationToken);
+
+        var reloaded = await providers.GetAsync(provider.Id, CancellationToken);
+        reloaded.Name.Should().Be("Renamed");
+        reloaded.ApiKey.Should().Be(originalKey);
+    }
+
+    [TestMethod]
+    public async Task Update_WithNullUpstreamKey_DoesNotAuditAKeyRotation()
+    {
+        IServiceProvider services = GetServices();
+        var audit = new RecordingAuditLogger();
+        var controller = ResolveController(services, audit: audit);
+        var provider = await services.GetRequiredService<IDomainEntityGenerator<IModelProvider>>().CreateAsync(CancellationToken);
+
+        await controller.Update(
+            provider.Id,
+            new UpdateModelProviderRequest("Renamed", provider.Endpoint.ToString(), null, provider.Kind),
+            CancellationToken);
+
+        audit.Events.Should().ContainSingle()
+            .Which.Id.Should().Be((int)AuditAction.ProviderConfigUpdated);
+    }
+
     [TestMethod]
     public async Task Update_ChangedUpstreamKey_AuditsKeyRotation()
     {
diff --git a/Proxytrace.Api.Tests/ProjectAccessGuardTests.cs b/Proxytrace.Api.Tests/ProjectAccessGuardTests.cs
index 12b3699ed..f121d3746 100644
--- a/Proxytrace.Api.Tests/ProjectAccessGuardTests.cs
+++ b/Proxytrace.Api.Tests/ProjectAccessGuardTests.cs
@@ -1,7 +1,9 @@
 using AwesomeAssertions;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
 using NSubstitute;
 using Proxytrace.Api.Auth;
+using Proxytrace.Api.Auth.Rest;
 using Proxytrace.Application.Auth;
 using Proxytrace.Domain;
 using Proxytrace.Domain.ModelEndpoint;
@@ -91,11 +93,155 @@ public async Task GetAccessibleProjectIds_NoCurrentUser_ReturnsEmpty()
         (await guard.GetAccessibleProjectIdsAsync(CancellationToken)).Should().BeEmpty();
     }
 
-    private static ProjectAccessGuard NewGuard(IServiceProvider services, IUser? currentUser)
+    [TestMethod]
+    public async Task CanAccessProject_WithApiKeyScopedToAnotherProject_FalseEvenForAdminOwner()
+    {
+        IServiceProvider services = GetServices();
+        // The key's owner is an Admin — POST /api/providers/{id}/keys is admin-only, so this is the
+        // ordinary case, not a corner one. Role alone must not widen the key beyond its own project.
+        var admin = await AdminUserAsync(services);
+        var keyProject = await ProjectWithMembersAsync(services);
+        var otherProject = await ProjectWithMembersAsync(services);
+        var guard = NewGuard(services, admin, apiKeyProjectId: keyProject.Id);
+
+        (await guard.CanAccessProjectAsync(otherProject.Id, CancellationToken)).Should().BeFalse();
+    }
+
+    [TestMethod]
+    public async Task CanAccessProject_WithApiKeyScopedToThatProject_True()
+    {
+        IServiceProvider services = GetServices();
+        var admin = await AdminUserAsync(services);
+        var keyProject = await ProjectWithMembersAsync(services);
+        var guard = NewGuard(services, admin, apiKeyProjectId: keyProject.Id);
+
+        (await guard.CanAccessProjectAsync(keyProject.Id, CancellationToken)).Should().BeTrue();
+    }
+
+    [TestMethod]
+    public async Task GetAccessibleProjectIds_WithApiKey_ReturnsOnlyTheKeyProject_NotAdminWildcard()
+    {
+        IServiceProvider services = GetServices();
+        var admin = await AdminUserAsync(services);
+        var keyProject = await ProjectWithMembersAsync(services);
+        await ProjectWithMembersAsync(services); // another project the admin would otherwise see
+        var guard = NewGuard(services, admin, apiKeyProjectId: keyProject.Id);
+
+        var ids = await guard.GetAccessibleProjectIdsAsync(CancellationToken);
+
+        // null would mean "all projects" — the admin wildcard must not survive API-key auth.
+        ids.Should().NotBeNull();
+        ids.Should().ContainSingle().Which.Should().Be(keyProject.Id);
+    }
+
+    [TestMethod]
+    public async Task GetAccessibleProjectIds_WithApiKeyOwnerNotAMember_ReturnsEmpty()
+    {
+        IServiceProvider services = GetServices();
+        var member = await MemberUserAsync(services);
+        var keyProject = await ProjectWithMembersAsync(services); // member deliberately not added
+        var guard = NewGuard(services, member, apiKeyProjectId: keyProject.Id);
+
+        (await guard.GetAccessibleProjectIdsAsync(CancellationToken)).Should().BeEmpty();
+    }
+
+    [TestMethod]
+    public async Task ResolveListScope_AsAdminWithoutProjectFilter_ReturnsNullForAllProjects()
+    {
+        IServiceProvider services = GetServices();
+        var guard = NewGuard(services, await AdminUserAsync(services));
+
+        (await guard.ResolveListScopeAsync(null, CancellationToken)).Should().BeNull();
+    }
+
+    [TestMethod]
+    public async Task ResolveListScope_AsMemberWithoutProjectFilter_ReturnsTheirProjects()
+    {
+        // #482: an unfiltered list from a non-admin used to resolve to "nothing", so every list
+        // endpoint answered with an empty page instead of the caller's own rows.
+        IServiceProvider services = GetServices();
+        var member = await MemberUserAsync(services);
+        var mine = await ProjectWithMembersAsync(services, member);
+        var alsoMine = await ProjectWithMembersAsync(services, member);
+        await ProjectWithMembersAsync(services); // someone else's project
+
+        var guard = NewGuard(services, member);
+
+        var scope = await guard.ResolveListScopeAsync(null, CancellationToken);
+
+        scope.Should().NotBeNull();
+        scope.Should().BeEquivalentTo([mine.Id, alsoMine.Id]);
+    }
+
+    [TestMethod]
+    public async Task ResolveListScope_WithAccessibleProjectFilter_NarrowsToThatProject()
+    {
+        IServiceProvider services = GetServices();
+        var member = await MemberUserAsync(services);
+        var mine = await ProjectWithMembersAsync(services, member);
+        await ProjectWithMembersAsync(services, member); // a second membership the filter excludes
+        var guard = NewGuard(services, member);
+
+        var scope = await guard.ResolveListScopeAsync(mine.Id, CancellationToken);
+
+        scope.Should().ContainSingle().Which.Should().Be(mine.Id);
+    }
+
+    [TestMethod]
+    public async Task ResolveListScope_WithInaccessibleProjectFilter_ReturnsEmpty()
+    {
+        IServiceProvider services = GetServices();
+        var member = await MemberUserAsync(services);
+        await ProjectWithMembersAsync(services, member);
+        var theirs = await ProjectWithMembersAsync(services); // member deliberately not added
+        var guard = NewGuard(services, member);
+
+        (await guard.ResolveListScopeAsync(theirs.Id, CancellationToken)).Should().BeEmpty();
+    }
+
+    [TestMethod]
+    public async Task ResolveListScope_WithApiKeyAndNoFilter_ReturnsTheKeyProject()
+    {
+        // The consumer #482 hurt most: a key is confined to one project, so it has no reason to
+        // send a projectId — and used to get an empty page for its own project's rows.
+        IServiceProvider services = GetServices();
+        var admin = await AdminUserAsync(services);
+        var keyProject = await ProjectWithMembersAsync(services);
+        await ProjectWithMembersAsync(services); // another project the admin would otherwise see
+        var guard = NewGuard(services, admin, apiKeyProjectId: keyProject.Id);
+
+        var scope = await guard.ResolveListScopeAsync(null, CancellationToken);
+
+        scope.Should().ContainSingle().Which.Should().Be(keyProject.Id);
+    }
+
+    [TestMethod]
+    public async Task ResolveListScope_NoCurrentUser_ReturnsEmpty()
+    {
+        IServiceProvider services = GetServices();
+        var guard = NewGuard(services, currentUser: null);
+
+        (await guard.ResolveListScopeAsync(null, CancellationToken)).Should().BeEmpty();
+    }
+
+    private static ProjectAccessGuard NewGuard(
+        IServiceProvider services,
+        IUser? currentUser,
+        Guid? apiKeyProjectId = null)
     {
         var accessor = Substitute.For<ICurrentUserAccessor>();
         accessor.GetCurrentUserAsync(Arg.Any<CancellationToken>()).Returns(currentUser);
-        return new ProjectAccessGuard(accessor, services.GetRequiredService<IProjectRepository>());
+
+        var httpContextAccessor = new HttpContextAccessor { HttpContext = new DefaultHttpContext() };
+        if (apiKeyProjectId is { } projectId)
+        {
+            httpContextAccessor.HttpContext.Items[ApiKeyAuthenticationHandler.ProjectIdItemKey] = projectId;
+        }
+
+        return new ProjectAccessGuard(
+            accessor,
+            services.GetRequiredService<IProjectRepository>(),
+            httpContextAccessor);
     }
 
     private async Task<IUser> AdminUserAsync(IServiceProvider services) => await CreateUserAsync(services, UserRole.Admin);
diff --git a/Proxytrace.Api.Tests/SeededRandomIsNotUsedForSecretsTests.cs b/Proxytrace.Api.Tests/SeededRandomIsNotUsedForSecretsTests.cs
new file mode 100644
index 000000000..9e6f079a2
--- /dev/null
+++ b/Proxytrace.Api.Tests/SeededRandomIsNotUsedForSecretsTests.cs
@@ -0,0 +1,94 @@
+using System.Reflection;
+using AwesomeAssertions;
+using Proxytrace.Common.Random;
+using Proxytrace.Domain;
+using Proxytrace.Testing;
+
+namespace Proxytrace.Api.Tests;
+
+/// <summary>
+/// Keeps deterministic test-data randomness away from anything security-relevant.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <see cref="IRandom"/> is registered as <c>SeededRandom</c> with a <b>fixed seed</b>, so every
+/// process produces the identical sequence. That is the point for reproducible fixtures and demo
+/// data, and it is catastrophic for a credential: a secret drawn from it would be the same on every
+/// installation in the world.
+/// </para>
+/// <para>
+/// Nothing is broken today — every real credential path (API keys, invite and password-reset tokens,
+/// TOTP secrets, MFA backup codes, MFA challenges, stream tickets) calls
+/// <c>RandomNumberGenerator</c> directly, and no production code path resolves a
+/// <c>IDomainEntityGenerator&lt;T&gt;</c>. But nothing structurally stopped a future caller from
+/// injecting <see cref="IRandom"/> into a service that mints something secret, and the two kinds of
+/// randomness are easy to confuse behind one interface name. This test is that structural stop.
+/// </para>
+/// </remarks>
+[TestClass]
+public sealed class SeededRandomIsNotUsedForSecretsTests : BaseTest<Module>
+{
+    /// <summary>
+    /// Production types allowed to depend on <see cref="IRandom"/> despite not being a domain
+    /// generator. Each entry needs a reason, and must not mint anything a caller authenticates with.
+    /// </summary>
+    private static readonly IReadOnlyDictionary<string, string> Allowed = new Dictionary<string, string>
+    {
+        // Seeds the demo/kiosk dataset. Deterministic on purpose: the showcase must look the same
+        // on every boot. Produces trace statistics, never a credential.
+        ["Proxytrace.Application.Demo.Scenarios.StatisticsBackfillScenario"] =
+            "demo data seeding — deterministic by design, mints no credential",
+    };
+
+    [TestMethod]
+    public void NoProductionTypeOutsideTheGeneratorSurfaceDependsOnSeededRandom()
+    {
+        var offenders = ProductionAssemblies()
+            .SelectMany(a => a.GetTypes())
+            .Where(TakesRandomDependency)
+            .Where(t => !IsDomainGenerator(t))
+            .Where(t => t.FullName is null || !Allowed.ContainsKey(t.FullName))
+            .Select(t => t.FullName ?? t.Name)
+            .OrderBy(n => n, StringComparer.Ordinal)
+            .ToArray();
+
+        offenders.Should().BeEmpty(
+            "IRandom is a fixed-seed generator for test and demo data. A secret drawn from it would "
+            + "be identical on every installation. Use RandomNumberGenerator for anything a caller "
+            + "authenticates with; if this type genuinely needs reproducible non-secret randomness, "
+            + "add it to the allowlist above with a reason.");
+    }
+
+    [TestMethod]
+    public void TheGuardCanActuallySeeTheTypesItIsMeantToProtect()
+    {
+        // A reflection guard that silently scans nothing always passes. Assert the scan reaches the
+        // real graph and does find IRandom consumers among the generators.
+        var generatorsUsingRandom = ProductionAssemblies()
+            .SelectMany(a => a.GetTypes())
+            .Where(TakesRandomDependency)
+            .Where(IsDomainGenerator)
+            .ToArray();
+
+        generatorsUsingRandom.Should().NotBeEmpty(
+            "the domain test-data generators take IRandom — if none are found the scan is not "
+            + "reaching the production assemblies and the guard above proves nothing");
+    }
+
+    private static IEnumerable<Assembly> ProductionAssemblies()
+        => AppDomain.CurrentDomain.GetAssemblies()
+            .Where(a => a.GetName().Name is { } name
+                        && name.StartsWith("Proxytrace.", StringComparison.Ordinal)
+                        && !name.EndsWith(".Tests", StringComparison.Ordinal)
+                        // The testing harness exists to build fixtures; it is not production code.
+                        && name != "Proxytrace.Testing");
+
+    private static bool TakesRandomDependency(Type type)
+        => type.GetConstructors(BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance)
+            .Any(c => c.GetParameters().Any(p => p.ParameterType == typeof(IRandom)));
+
+    private static bool IsDomainGenerator(Type type)
+        => type.GetInterfaces().Any(i => i.IsGenericType
+            && (i.GetGenericTypeDefinition() == typeof(IDomainEntityGenerator<>)
+                || i.GetGenericTypeDefinition() == typeof(IDomainObjectGenerator<>)));
+}
diff --git a/Proxytrace.Api.Tests/ShippedConfigurationTests.cs b/Proxytrace.Api.Tests/ShippedConfigurationTests.cs
new file mode 100644
index 000000000..c37f18e05
--- /dev/null
+++ b/Proxytrace.Api.Tests/ShippedConfigurationTests.cs
@@ -0,0 +1,44 @@
+using AwesomeAssertions;
+using Microsoft.Extensions.Configuration;
+using Proxytrace.Domain.Kiosk;
+
+namespace Proxytrace.Api.Tests;
+
+/// <summary>
+/// Guards the defaults baked into the shipped <c>appsettings.json</c>. These matter because they are
+/// what a host gets when it is started by any path other than the two blessed ones — a hand-written
+/// Kubernetes manifest, a custom Dockerfile, a bare <c>dotnet Proxytrace.Api.dll</c> — none of which
+/// export the environment overrides that <c>docker-compose.yml</c> and
+/// <c>deploy/allinone/entrypoint.sh</c> set by hand.
+/// </summary>
+[TestClass]
+public sealed class ShippedConfigurationTests
+{
+    [TestMethod]
+    public void ShippedAppSettings_DoesNotEnableKiosk()
+    {
+        KioskOptions kiosk = ReadShippedSection<KioskOptions>("Kiosk");
+
+        // Kiosk mode registers KioskAuthenticationHandler as the DEFAULT AND ONLY authentication
+        // scheme, and that handler authenticates every request as the seeded demo user with its real
+        // role — no credential is examined. It also forces in-memory storage and an Enterprise
+        // license override. Shipping it on by default means any deployment that forgets
+        // Kiosk__Enabled=false serves the whole API unauthenticated and loses its data on restart.
+        // Kiosk consumers (docker-compose.kiosk.yml, dev.sh, the e2e/screenshot stacks) opt in.
+        kiosk.Enabled.Should().BeFalse(
+            "the shipped default must fail closed — kiosk mode disables authentication entirely");
+    }
+
+    private static T ReadShippedSection<T>(string section)
+        where T : new()
+    {
+        // AppContext.BaseDirectory is the test output folder, into which the Api project's
+        // appsettings.json is copied by the project reference — i.e. the very file that ships.
+        IConfigurationRoot configuration = new ConfigurationBuilder()
+            .SetBasePath(AppContext.BaseDirectory)
+            .AddJsonFile("appsettings.json", optional: false)
+            .Build();
+
+        return configuration.GetSection(section).Get<T>() ?? new T();
+    }
+}
diff --git a/Proxytrace.Api.Tests/TestSuitesControllerTests.cs b/Proxytrace.Api.Tests/TestSuitesControllerTests.cs
index ec7eb9d85..f95bf41fd 100644
--- a/Proxytrace.Api.Tests/TestSuitesControllerTests.cs
+++ b/Proxytrace.Api.Tests/TestSuitesControllerTests.cs
@@ -638,6 +638,7 @@ private static TestSuitesController ResolveController(
             services.GetRequiredService<IStatsReader<TestRunStats, TestRunStats.Filter>>(),
             license ?? UnlimitedLicense(),
             accessGuard ?? services.GetRequiredService<Proxytrace.Api.Auth.IProjectAccessGuard>(),
+            services.GetRequiredService<Proxytrace.Common.Async.IAsyncLock>(),
             Microsoft.Extensions.Logging.Abstractions.NullLogger<Proxytrace.Domain.AuditLog.Audit>.Instance);
 
     [TestMethod]
@@ -730,6 +731,45 @@ public async Task Create_WhenBelowSuiteLimit_Succeeds()
         result.Result.Should().BeOfType<CreatedAtActionResult>();
     }
 
+    [TestMethod]
+    public async Task Create_WhenTwoRequestsRaceAtTheLimit_OnlyOneSucceeds()
+    {
+        // The count and the create it authorises are check-then-act. Concurrently, both requests
+        // observed "0 suites" against a limit of 1 and both proceeded, leaving a Free-tier install
+        // with two suites and no way to notice.
+        IServiceProvider services = GetServices();
+        var agent = await services.GetRequiredService<IDomainEntityGenerator<IAgent>>().CreateAsync(CancellationToken);
+        var license = LicenseWithSuiteLimit(1);
+
+        // Separate controller instances, as two concurrent requests would have. They share the
+        // singleton IAsyncLock from the container, which is what actually serializes them.
+        var first = ResolveController(services, license);
+        var second = ResolveController(services, license);
+
+        var results = await Task.WhenAll(
+            Attempt(first, "Suite A"),
+            Attempt(second, "Suite B"));
+
+        results.Count(r => r).Should().Be(1, "exactly one of the two racing creates may be admitted");
+        (await services.GetRequiredService<ITestSuiteRepository>().CountAsync(CancellationToken))
+            .Should().Be(1, "the licensed limit must hold under concurrency");
+
+        async Task<bool> Attempt(TestSuitesController controller, string name)
+        {
+            try
+            {
+                await controller.Create(
+                    new CreateTestSuiteRequest(Name: name, AgentId: agent.Id, TestCases: []),
+                    CancellationToken);
+                return true;
+            }
+            catch (LicenseLimitExceededException)
+            {
+                return false;
+            }
+        }
+    }
+
     [TestMethod]
     public async Task PromoteFromTraces_WhenSuiteLimitReached_ThrowsLicenseLimitExceeded()
     {
diff --git a/Proxytrace.Api.Tests/TrustedProxyConfigurationTests.cs b/Proxytrace.Api.Tests/TrustedProxyConfigurationTests.cs
new file mode 100644
index 000000000..4d3fbc114
--- /dev/null
+++ b/Proxytrace.Api.Tests/TrustedProxyConfigurationTests.cs
@@ -0,0 +1,113 @@
+using System.Net;
+using AwesomeAssertions;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.HttpOverrides;
+using Microsoft.Extensions.Configuration;
+
+namespace Proxytrace.Api.Tests;
+
+[TestClass]
+public sealed class TrustedProxyConfigurationTests
+{
+    private static IConfiguration Configuration(params (string Key, string Value)[] entries) =>
+        new ConfigurationBuilder()
+            .AddInMemoryCollection(entries.Select(e => new KeyValuePair<string, string?>(e.Key, e.Value)))
+            .Build();
+
+    [TestMethod]
+    public void Build_ByDefault_ProcessesForwardedForAndProto()
+    {
+        var options = new TrustedProxyConfiguration(Configuration()).Build();
+
+        options.Should().NotBeNull();
+        options?.ForwardedHeaders.Should().Be(ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto);
+    }
+
+    [TestMethod]
+    public void Build_WithNoTrustDeclared_TrustsNothingBeyondTheFrameworkLoopbackDefault()
+    {
+        // Fail safe: an unrestricted X-Forwarded-For would turn the rate-limit partition key into a
+        // client-controlled value, so an unconfigured deployment must trust no extra peer.
+        var defaults = new ForwardedHeadersOptions();
+
+        var options = new TrustedProxyConfiguration(Configuration()).Build();
+
+        options.Should().NotBeNull();
+        options?.KnownProxies.Should().HaveCount(defaults.KnownProxies.Count);
+        options?.KnownIPNetworks.Should().HaveCount(defaults.KnownIPNetworks.Count);
+    }
+
+    [TestMethod]
+    public void Build_ByDefault_AllowsASingleProxyHop()
+    {
+        var options = new TrustedProxyConfiguration(Configuration()).Build();
+
+        options?.ForwardLimit.Should().Be(1);
+    }
+
+    [TestMethod]
+    public void Build_WhenDisabled_ReturnsNoOptions()
+    {
+        var options = new TrustedProxyConfiguration(Configuration(("ForwardedHeaders:Enabled", "false"))).Build();
+
+        options.Should().BeNull();
+    }
+
+    [TestMethod]
+    public void Build_WithKnownNetworks_TrustsTheConfiguredRanges()
+    {
+        var options = new TrustedProxyConfiguration(
+            Configuration(("ForwardedHeaders:KnownNetworks", "172.16.0.0/12, 10.0.0.0/8"))).Build();
+
+        options?.KnownIPNetworks.Should().Contain(System.Net.IPNetwork.Parse("172.16.0.0/12"));
+        options?.KnownIPNetworks.Should().Contain(System.Net.IPNetwork.Parse("10.0.0.0/8"));
+    }
+
+    [TestMethod]
+    public void Build_WithKnownNetworksAsAnArray_TrustsTheConfiguredRanges()
+    {
+        var options = new TrustedProxyConfiguration(
+            Configuration(("ForwardedHeaders:KnownNetworks:0", "192.168.0.0/16"))).Build();
+
+        options?.KnownIPNetworks.Should().Contain(System.Net.IPNetwork.Parse("192.168.0.0/16"));
+    }
+
+    [TestMethod]
+    public void Build_WithKnownProxies_TrustsTheConfiguredAddresses()
+    {
+        var options = new TrustedProxyConfiguration(
+            Configuration(("ForwardedHeaders:KnownProxies", "172.18.0.4"))).Build();
+
+        options?.KnownProxies.Should().Contain(IPAddress.Parse("172.18.0.4"));
+    }
+
+    [TestMethod]
+    public void Build_WithForwardLimit_UsesTheConfiguredHopCount()
+    {
+        var options = new TrustedProxyConfiguration(Configuration(("ForwardedHeaders:ForwardLimit", "2"))).Build();
+
+        options?.ForwardLimit.Should().Be(2);
+    }
+
+    [TestMethod]
+    public void Build_WithAMalformedNetwork_FailsFast()
+    {
+        var configuration = new TrustedProxyConfiguration(
+            Configuration(("ForwardedHeaders:KnownNetworks", "172.16.0.0")));
+
+        var build = () => configuration.Build();
+
+        build.Should().Throw<InvalidOperationException>().WithMessage("*KnownNetworks*");
+    }
+
+    [TestMethod]
+    public void Build_WithAMalformedProxyAddress_FailsFast()
+    {
+        var configuration = new TrustedProxyConfiguration(
+            Configuration(("ForwardedHeaders:KnownProxies", "not-an-ip")));
+
+        var build = () => configuration.Build();
+
+        build.Should().Throw<InvalidOperationException>().WithMessage("*KnownProxies*");
+    }
+}
diff --git a/Proxytrace.Api/Auth/IProjectAccessGuard.cs b/Proxytrace.Api/Auth/IProjectAccessGuard.cs
index 29283c18e..491c7b1b2 100644
--- a/Proxytrace.Api/Auth/IProjectAccessGuard.cs
+++ b/Proxytrace.Api/Auth/IProjectAccessGuard.cs
@@ -1,3 +1,4 @@
+using Proxytrace.Api.Auth.Rest;
 using Proxytrace.Application.Auth;
 using Proxytrace.Domain.Project;
 using Proxytrace.Domain.User;
@@ -28,15 +29,27 @@ internal sealed class ProjectAccessGuard : IProjectAccessGuard
 {
     private readonly ICurrentUserAccessor currentUser;
     private readonly IProjectRepository projects;
+    private readonly IHttpContextAccessor httpContextAccessor;
 
-    public ProjectAccessGuard(ICurrentUserAccessor currentUser, IProjectRepository projects)
+    public ProjectAccessGuard(
+        ICurrentUserAccessor currentUser,
+        IProjectRepository projects,
+        IHttpContextAccessor httpContextAccessor)
     {
         this.currentUser = currentUser;
         this.projects = projects;
+        this.httpContextAccessor = httpContextAccessor;
     }
 
     public async Task<bool> CanAccessProjectAsync(Guid projectId, CancellationToken cancellationToken = default)
     {
+        // A REST API key is confined to the project it was minted for, on top of whatever its owner
+        // may reach. This check must come first: the key acts as its owner, and since minting is an
+        // admin-only endpoint the owner is typically an Admin — whose role alone would otherwise
+        // satisfy the membership check below for every project in the instance.
+        if (ApiKeyProjectId is { } keyProjectId && keyProjectId != projectId)
+            return false;
+
         var user = await currentUser.GetCurrentUserAsync(cancellationToken);
         if (user is null)
             return false;
@@ -51,9 +64,23 @@ public async Task<bool> CanAccessProjectAsync(Guid projectId, CancellationToken
         var user = await currentUser.GetCurrentUserAsync(cancellationToken);
         if (user is null)
             return [];
-        if (user.Role == UserRole.Admin)
-            return null;
-        var memberships = await projects.GetByMemberAsync(user.Id, cancellationToken);
-        return memberships.Select(p => p.Id).ToArray();
+
+        IReadOnlyCollection<Guid>? ownerScope = user.Role == UserRole.Admin
+            ? null
+            : (await projects.GetByMemberAsync(user.Id, cancellationToken)).Select(p => p.Id).ToArray();
+
+        // Same confinement for list endpoints: an API-key request sees exactly its own project (and
+        // only if the owner could reach it anyway), never the unscoped admin "all projects" null.
+        if (ApiKeyProjectId is { } keyProjectId)
+            return ownerScope is null || ownerScope.Contains(keyProjectId) ? [keyProjectId] : [];
+
+        return ownerScope;
     }
+
+    /// <summary>
+    /// The project a REST API key confines this request to, or <see langword="null"/> when the
+    /// request was not authenticated with an API key (a JWT/session request is unconfined).
+    /// </summary>
+    private Guid? ApiKeyProjectId =>
+        httpContextAccessor.HttpContext?.Items[ApiKeyAuthenticationHandler.ProjectIdItemKey] as Guid?;
 }
diff --git a/Proxytrace.Api/Auth/JwtBearerEventsFactory.cs b/Proxytrace.Api/Auth/JwtBearerEventsFactory.cs
index bc11e97d4..7093bd8e1 100644
--- a/Proxytrace.Api/Auth/JwtBearerEventsFactory.cs
+++ b/Proxytrace.Api/Auth/JwtBearerEventsFactory.cs
@@ -17,8 +17,12 @@ internal static class JwtBearerEventsFactory
             // SSE connections authenticate with a short-lived, single-use ticket instead of
             // the session JWT (which would leak via the EventSource query string). Redeem it
             // here and authenticate the request directly — works in both local and OIDC mode.
+            // Fenced to stream routes for the same reason as the access_token fallback below: the
+            // ticket redeems into a FULL principal (including the live Role claim), so honoring it on
+            // any path would let a URL-borne credential — the very thing the ticket exists to contain
+            // — reach every endpoint its owner can, admin ones included, inside its validity window.
             var streamTicket = context.Request.Query[StreamTicketQueryKey].ToString();
-            if (!string.IsNullOrEmpty(streamTicket))
+            if (!string.IsNullOrEmpty(streamTicket) && IsStreamRequest(context.Request))
             {
                 await AuthenticateStreamTicket(context, streamTicket);
                 return;
diff --git a/Proxytrace.Api/Auth/ProjectListScope.cs b/Proxytrace.Api/Auth/ProjectListScope.cs
new file mode 100644
index 000000000..6a83a7793
--- /dev/null
+++ b/Proxytrace.Api/Auth/ProjectListScope.cs
@@ -0,0 +1,76 @@
+namespace Proxytrace.Api.Auth;
+
+/// <summary>
+/// Helpers for reading the list scope produced by
+/// <see cref="IProjectAccessGuard.ResolveListScopeAsync"/>.
+///
+/// The scope follows the same <c>null</c> convention as
+/// <see cref="IProjectAccessGuard.GetAccessibleProjectIdsAsync"/>: <c>null</c> means "every
+/// project", an empty collection means "no project", and any other value is the exact set the
+/// query must be restricted to.
+/// </summary>
+internal static class ProjectListScope
+{
+    /// <summary>
+    /// Resolves a list endpoint's optional <c>projectId</c> filter into the projects the query must
+    /// actually be restricted to: <c>null</c> when the caller may read every project (an admin
+    /// listing unfiltered), an empty collection when it may read none, and otherwise the exact set
+    /// to filter by — one id when the request named a project it may read, and the caller's whole
+    /// membership when it named none.
+    ///
+    /// This is what list endpoints must use. Reading
+    /// <see cref="IProjectAccessGuard.GetAccessibleProjectIdsAsync"/> directly and *demanding* a
+    /// <c>projectId</c> is what produced #482: an unfiltered request from a non-admin — every REST
+    /// API key, since a key is confined to a single project and so has no reason to send one — was
+    /// answered with an empty page instead of that caller's own rows.
+    ///
+    /// Derived behaviour, so it is an extension rather than an interface member: there is exactly
+    /// one implementation, and it stays correct for every <see cref="IProjectAccessGuard"/>.
+    /// </summary>
+    public static async Task<IReadOnlyCollection<Guid>?> ResolveListScopeAsync(
+        this IProjectAccessGuard guard,
+        Guid? requestedProjectId,
+        CancellationToken cancellationToken = default)
+    {
+        var accessible = await guard.GetAccessibleProjectIdsAsync(cancellationToken);
+
+        // No filter: the caller's own reach *is* the scope — every project for an admin (null),
+        // their memberships otherwise.
+        if (requestedProjectId is not { } projectId)
+            return accessible;
+
+        // A named project narrows the scope to itself, provided the caller may read it.
+        return accessible is null || accessible.Contains(projectId) ? [projectId] : [];
+    }
+
+    /// <summary>
+    /// True when the caller may read nothing, so the endpoint can answer with an empty result
+    /// without querying at all.
+    /// </summary>
+    public static bool IsEmpty(this IReadOnlyCollection<Guid>? scope) => scope is { Count: 0 };
+
+    /// <summary>
+    /// The single project this scope names, or <c>null</c> when it is unrestricted or spans
+    /// several. Lets an endpoint keep using its existing indexed by-one-project query for the
+    /// common case — a named project, or a REST API key, which is confined to exactly one.
+    /// </summary>
+    public static Guid? SingleProject(this IReadOnlyCollection<Guid>? scope) =>
+        scope is { Count: 1 } ids ? ids.First() : null;
+
+    /// <summary>
+    /// True when the scope admits <paramref name="projectId"/> — either because it is
+    /// unrestricted or because it contains that project.
+    /// </summary>
+    public static bool Admits(this IReadOnlyCollection<Guid>? scope, Guid projectId) =>
+        scope is null || scope.Contains(projectId);
+
+    /// <summary>
+    /// Splits a scope into the pair <c>AgentCallFilter</c> takes. A scope naming exactly one
+    /// project goes through the filter's existing single-project branch, so the hot traces query
+    /// keeps its equality predicate against <c>AgentVersion(Project)</c>; only a genuinely
+    /// multi-project scope takes the set branch.
+    /// </summary>
+    public static (Guid? ProjectId, IReadOnlyCollection<Guid>? ProjectIds) ToFilterScope(
+        this IReadOnlyCollection<Guid>? scope) =>
+        scope.SingleProject() is { } single ? (single, null) : (null, scope);
+}
diff --git a/Proxytrace.Api/Auth/Rest/ApiKeyAuthenticationHandler.cs b/Proxytrace.Api/Auth/Rest/ApiKeyAuthenticationHandler.cs
index fd7fcbab5..7e4c8dc4d 100644
--- a/Proxytrace.Api/Auth/Rest/ApiKeyAuthenticationHandler.cs
+++ b/Proxytrace.Api/Auth/Rest/ApiKeyAuthenticationHandler.cs
@@ -27,6 +27,13 @@ internal sealed class ApiKeyAuthenticationHandler : AuthenticationHandler<Authen
     /// <summary>Claim type carrying each granted REST scope (<c>ApiRead</c>/<c>ApiWrite</c>).</summary>
     public const string ScopeClaimType = "proxytrace:api_scope";
 
+    /// <summary>
+    /// Key under which this handler stashes the key's own project id on <see cref="HttpContext.Items"/>,
+    /// so <c>ProjectAccessGuard</c> can confine the request to it. The analogue of
+    /// <c>McpProjectAccessor.ProjectIdItemKey</c>.
+    /// </summary>
+    internal const string ProjectIdItemKey = "Proxytrace.ApiKey.ProjectId";
+
     // Proxytrace-issued keys are the only bearer tokens this scheme handles. Anything else on the
     // Authorization header (an OIDC/local JWT) is left to the JwtBearer handler, and — crucially —
     // skipped before any database lookup, so this scheme adds no per-request cost to JWT traffic.
@@ -83,10 +90,17 @@ protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
         Context.Items[CurrentUserAccessor.UserIdItemKey] = apiKey.Owner.Id;
         Context.Items[McpApiKeyAuthenticationHandler.ApiKeyIdItemKey] = apiKey.Id;
 
+        // Confine the request to the key's own project. This MUST be an HttpContext.Items entry that
+        // ProjectAccessGuard reads, not just a claim: the key acts as its owner, and because
+        // POST /api/providers/{id}/keys is admin-only the owner is typically an Admin — whose role
+        // alone would otherwise let the guard wave through every project in the instance. The
+        // manual's contract for the REST scopes is "read/write *the key's project*"
+        // (manual/admin/providers-and-api-keys.md), which is exactly what this pins.
+        Context.Items[ProjectIdItemKey] = apiKey.Project.Id;
+
         var claims = new List<Claim>
         {
             new(ClaimTypes.Name, apiKey.Name),
-            new("project", apiKey.Project.Id.ToString()),
         };
         // Emit a claim per granted REST scope; ApiKeyScopeHandler reads these to enforce read vs write.
         if (canRead) claims.Add(new Claim(ScopeClaimType, nameof(ApiKeyScopes.ApiRead)));
diff --git a/Proxytrace.Api/Auth/SessionCookie.cs b/Proxytrace.Api/Auth/SessionCookie.cs
index 07fda5459..84843c06a 100644
--- a/Proxytrace.Api/Auth/SessionCookie.cs
+++ b/Proxytrace.Api/Auth/SessionCookie.cs
@@ -1,5 +1,38 @@
 namespace Proxytrace.Api.Auth;
 
+/// <summary>
+/// Operator-facing options for the local-mode session cookie (config section
+/// <c>Authentication:SessionCookie</c>).
+/// </summary>
+public sealed class SessionCookieOptions
+{
+    /// <summary>
+    /// Whether the session cookie carries the <c>Secure</c> attribute. This is deliberately NOT
+    /// inferred from the request: the documented topology terminates TLS at a reverse proxy and
+    /// forwards plain HTTP to the API, so <c>Request.IsHttps</c> is <see langword="false"/> on
+    /// every hop and would strip <c>Secure</c> from an HTTPS installation's cookie. Defaults to
+    /// <see langword="true"/> everywhere except the Development environment; set it to
+    /// <see langword="false"/> only for a deliberate plain-HTTP deployment on a non-localhost host.
+    /// </summary>
+    public bool Secure { get; init; } = true;
+}
+
+/// <summary>
+/// Issues and clears the local-mode session cookie.
+/// </summary>
+public interface ISessionCookie
+{
+    /// <summary>
+    /// Writes the session JWT as the httpOnly session cookie.
+    /// </summary>
+    void Append(HttpResponse response, string token, DateTimeOffset expiresAt);
+
+    /// <summary>
+    /// Clears the session cookie (logout).
+    /// </summary>
+    void Delete(HttpResponse response);
+}
+
 /// <summary>
 /// The local-mode session cookie. The session JWT is issued as an httpOnly cookie so the
 /// SPA never has to persist it in script-readable storage (localStorage XSS hardening);
@@ -8,24 +41,32 @@ namespace Proxytrace.Api.Auth;
 /// Authorization header. <see cref="JwtBearerEventsFactory"/> falls back to this cookie
 /// when no bearer token is present.
 /// </summary>
-internal static class SessionCookie
+internal sealed class SessionCookie : ISessionCookie
 {
     public const string Name = "proxytrace_session";
 
-    public static void Append(HttpResponse response, string token, DateTimeOffset expiresAt) =>
+    private readonly SessionCookieOptions options;
+
+    public SessionCookie(SessionCookieOptions options)
+    {
+        this.options = options;
+    }
+
+    public void Append(HttpResponse response, string token, DateTimeOffset expiresAt) =>
         response.Cookies.Append(Name, token, new CookieOptions
         {
             HttpOnly = true,
-            Secure = response.HttpContext.Request.IsHttps,
+            Secure = options.Secure,
             SameSite = SameSiteMode.Strict,
             Path = "/",
             Expires = expiresAt,
         });
 
-    public static void Delete(HttpResponse response) =>
+    public void Delete(HttpResponse response) =>
         response.Cookies.Delete(Name, new CookieOptions
         {
             HttpOnly = true,
+            Secure = options.Secure,
             SameSite = SameSiteMode.Strict,
             Path = "/",
         });
diff --git a/Proxytrace.Api/Controllers/AgentCallsController.cs b/Proxytrace.Api/Controllers/AgentCallsController.cs
index 8c38e590f..14b36f3cf 100644
--- a/Proxytrace.Api/Controllers/AgentCallsController.cs
+++ b/Proxytrace.Api/Controllers/AgentCallsController.cs
@@ -64,23 +64,22 @@ public AgentCallsController(
         this.audit = audit;
     }
 
-    // Resolve the effective owning project of a list query and verify access. Admins
-    // (accessible == null) may run any query. Non-admins must scope to a project they belong to —
-    // directly via projectId or via the agent's project — otherwise the list returns nothing rather
-    // than leaking other tenants' rows (#193).
-    private async Task<bool> CanListAsync(Guid? projectId, Guid? agentId, CancellationToken cancellationToken)
+    // Resolve the projects a list query may read. Admins (scope == null) may run any query;
+    // everyone else is confined to the projects they belong to, so no query can leak another
+    // tenant's rows (#193). An unfiltered request is scoped to the caller's own projects rather
+    // than answered with an empty page (#482). An agentId is authorized against the same scope —
+    // the query then filters by that agent, which is already confined to one project.
+    private async Task<IReadOnlyCollection<Guid>?> ListScopeAsync(
+        Guid? projectId,
+        Guid? agentId,
+        CancellationToken cancellationToken)
     {
-        var accessible = await accessGuard.GetAccessibleProjectIdsAsync(cancellationToken);
-        if (accessible is null)
-            return true;
-        if (projectId is { } pid)
-            return accessible.Contains(pid);
-        if (agentId is { } aid)
-        {
-            var agent = await agentRepository.FindAsync(aid, cancellationToken);
-            return agent is not null && accessible.Contains(agent.Project.Id);
-        }
-        return false;
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        if (scope is null || scope.IsEmpty() || agentId is not { } aid)
+            return scope;
+
+        var agent = await agentRepository.FindAsync(aid, cancellationToken);
+        return agent is not null && scope.Contains(agent.Project.Id) ? scope : [];
     }
 
     // Truncate a caller-supplied session key and pair it with its derived id, so the seed endpoint
@@ -119,11 +118,13 @@ public async Task<PagedResult<AgentCallListItemDto>> GetAll(
         CancellationToken cancellationToken = default)
     {
         (page, pageSize) = Paging.Clamp(page, pageSize);
-        if (!await CanListAsync(projectId, agentId, cancellationToken))
+        var scope = await ListScopeAsync(projectId, agentId, cancellationToken);
+        if (scope.IsEmpty())
             return new PagedResult<AgentCallListItemDto>([], 0, page, pageSize);
+        var (scopedProjectId, scopedProjectIds) = scope.ToFilterScope();
         var filter = new AgentCallFilter(
             AgentId: agentId,
-            ProjectId: projectId,
+            ProjectId: scopedProjectId,
             EndpointId: endpointId,
             Model: model,
             From: from,
@@ -142,7 +143,8 @@ public async Task<PagedResult<AgentCallListItemDto>> GetAll(
             ToolName: toolName,
             SortBy: sortBy,
             SortDescending: sortDesc,
-            SessionId: sessionId);
+            SessionId: sessionId,
+            ProjectIds: scopedProjectIds);
         var (items, total) = await repository.GetFilteredListAsync(filter, page, pageSize, cancellationToken);
         return new PagedResult<AgentCallListItem>(items, total, page, pageSize).Map(agentCallDtoMapper.ToListItemDto);
     }
@@ -158,7 +160,8 @@ public async Task<IReadOnlyList<string>> GetToolNames(
         [FromQuery] Guid? agentId = null,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(projectId, agentId, cancellationToken))
+        var scope = await ListScopeAsync(projectId, agentId, cancellationToken);
+        if (scope.IsEmpty())
             return [];
         return await repository.GetToolNamesAsync(projectId, agentId, cancellationToken);
     }
@@ -187,9 +190,11 @@ public async Task<PagedResult<AgentCallDto>> GetAllFull(
         CancellationToken cancellationToken = default)
     {
         (page, pageSize) = Paging.Clamp(page, pageSize);
-        if (!await CanListAsync(projectId, agentId, cancellationToken))
+        var scope = await ListScopeAsync(projectId, agentId, cancellationToken);
+        if (scope.IsEmpty())
             return new PagedResult<AgentCallDto>([], 0, page, pageSize);
-        var filter = new AgentCallFilter(agentId, projectId, endpointId, model, from, to, httpStatus, includeSystemAgents, q, conversationId, SessionId: sessionId);
+        var (scopedProjectId, scopedProjectIds) = scope.ToFilterScope();
+        var filter = new AgentCallFilter(agentId, scopedProjectId, endpointId, model, from, to, httpStatus, includeSystemAgents, q, conversationId, SessionId: sessionId, ProjectIds: scopedProjectIds);
         var (items, total) = await repository.GetFilteredAsync(filter, page, pageSize, cancellationToken);
         return new PagedResult<IAgentCall>(items, total, page, pageSize).Map(agentCallDtoMapper.ToDto);
     }
@@ -201,16 +206,26 @@ public async Task<TracesOverviewDto> GetOverview(
         [FromQuery] DateTimeOffset? from = null,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(projectId, agentId, cancellationToken))
+        var scope = await ListScopeAsync(projectId, agentId, cancellationToken);
+        if (scope.IsEmpty())
+            return new TracesOverviewDto([], [], []);
+
+        // Unlike the trace lists, the aggregates below go through StatisticsFilter, which filters by
+        // a single project (partly in raw SQL). A scope spanning several projects therefore has
+        // nothing it can safely aggregate over — running unscoped would mix in other tenants' rows —
+        // so those callers still get an empty overview. Every single-project caller, including an
+        // unfiltered REST API key, is served. Tracked in #483.
+        var scopedProjectId = scope.SingleProject();
+        if (scope is not null && scopedProjectId is null)
             return new TracesOverviewDto([], [], []);
 
-        var latencyFilter = new StatisticsFilter(from, null, projectId, agentId);
-        var breakdownFilter = new StatisticsFilter(from, null, projectId);
+        var latencyFilter = new StatisticsFilter(from, null, scopedProjectId, agentId);
+        var breakdownFilter = new StatisticsFilter(from, null, scopedProjectId);
 
         // Scope the agent load to the project when filtered, instead of loading every agent and
         // discarding the rest in memory.
-        Task<IReadOnlyList<IAgent>> agentsTask = projectId.HasValue
-            ? agentRepository.GetByProjectAsync(projectId.Value, cancellationToken)
+        Task<IReadOnlyList<IAgent>> agentsTask = scopedProjectId.HasValue
+            ? agentRepository.GetByProjectAsync(scopedProjectId.Value, cancellationToken)
             : agentRepository.GetAllAsync(cancellationToken);
         Task<IReadOnlyDictionary<Guid, DateTimeOffset>> lastCallTask = repository.GetLastCallTimesAsync(cancellationToken);
         Task<IReadOnlyList<AgentBreakdownStat>> breakdownTask = statistics.GetAgentBreakdownAsync(breakdownFilter, cancellationToken);
@@ -256,13 +271,15 @@ public async Task<IReadOnlyList<TraceHistogramBucketDto>> GetHistogram(
         CancellationToken cancellationToken = default)
     {
         buckets = Math.Clamp(buckets, 1, 240);
-        if (!await CanListAsync(projectId, agentId, cancellationToken))
+        var scope = await ListScopeAsync(projectId, agentId, cancellationToken);
+        if (scope.IsEmpty())
             return [];
+        var (scopedProjectId, scopedProjectIds) = scope.ToFilterScope();
         // Same filter surface as GetAll (minus paging/sort — a histogram has neither), so the
         // timeline always reflects exactly the rows the filtered table shows.
         var filter = new AgentCallFilter(
             AgentId: agentId,
-            ProjectId: projectId,
+            ProjectId: scopedProjectId,
             EndpointId: endpointId,
             Model: model,
             From: from,
@@ -279,7 +296,8 @@ public async Task<IReadOnlyList<TraceHistogramBucketDto>> GetHistogram(
             MinLatencyMs: minLatencyMs,
             MaxLatencyMs: maxLatencyMs,
             ToolName: toolName,
-            SessionId: sessionId);
+            SessionId: sessionId,
+            ProjectIds: scopedProjectIds);
         var result = await repository.GetHistogramAsync(filter, buckets, cancellationToken);
         return result.Select(b => new TraceHistogramBucketDto(b.Start, b.Total, b.Errors)).ToList();
     }
@@ -313,12 +331,14 @@ public async Task<AgentCallSummaryDto> GetSummary(
         [FromQuery] string? toolName = null,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(projectId, agentId, cancellationToken))
+        var scope = await ListScopeAsync(projectId, agentId, cancellationToken);
+        if (scope.IsEmpty())
             return agentCallDtoMapper.ToSummaryDto(AgentCallSummary.Empty);
+        var (scopedProjectId, scopedProjectIds) = scope.ToFilterScope();
 
         var filter = new AgentCallFilter(
             AgentId: agentId,
-            ProjectId: projectId,
+            ProjectId: scopedProjectId,
             EndpointId: endpointId,
             Model: model,
             From: from,
@@ -335,7 +355,8 @@ public async Task<AgentCallSummaryDto> GetSummary(
             MinLatencyMs: minLatencyMs,
             MaxLatencyMs: maxLatencyMs,
             ToolName: toolName,
-            SessionId: sessionId);
+            SessionId: sessionId,
+            ProjectIds: scopedProjectIds);
 
         return agentCallDtoMapper.ToSummaryDto(await repository.GetSummaryAsync(filter, cancellationToken));
     }
diff --git a/Proxytrace.Api/Controllers/AgentsController.cs b/Proxytrace.Api/Controllers/AgentsController.cs
index 0bb15249f..592a92639 100644
--- a/Proxytrace.Api/Controllers/AgentsController.cs
+++ b/Proxytrace.Api/Controllers/AgentsController.cs
@@ -68,12 +68,6 @@ public AgentsController(
         this.accessGuard = accessGuard;
     }
 
-    private async Task<bool> CanListAsync(Guid? projectId, CancellationToken cancellationToken)
-    {
-        var accessible = await accessGuard.GetAccessibleProjectIdsAsync(cancellationToken);
-        return accessible is null || (projectId.HasValue && accessible.Contains(projectId.Value));
-    }
-
     [HttpGet]
     public async Task<PagedResult<AgentListItemDto>> GetAll(
         [FromQuery] Guid? projectId = null,
@@ -81,16 +75,17 @@ public async Task<PagedResult<AgentListItemDto>> GetAll(
         [FromQuery] int pageSize = 50,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(projectId, cancellationToken))
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        if (scope is { Count: 0 })
             return new PagedResult<AgentListItemDto>([], 0, page, pageSize);
 
         // Archived (soft-deleted) agents are hidden from the listing — they keep resolving by id for
         // history, but must not appear here (mirrors EvaluatorsController, which lists via the
         // archive-filtered GetAllAsync/GetByProjectAsync). EnumerateAsync streams the full set.
         var all = repository.EnumerateAsync(cancellationToken).Where(a => !a.IsArchived);
-        var filtered = projectId.HasValue
-            ? all.Where(a => a.Project.Id == projectId.Value)
-            : all;
+        var filtered = scope is null
+            ? all
+            : all.Where(a => scope.Contains(a.Project.Id));
 
         var lastCallTimes = await agentCallRepository.GetLastCallTimesAsync(cancellationToken);
 
@@ -102,7 +97,7 @@ public async Task<PagedResult<AgentListItemDto>> GetAll(
 
         (page, pageSize) = Paging.Clamp(page, pageSize);
         var items = sorted
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .Select(a => agentDtoMapper.ToListItemDto(a, lastCallTimes.TryGetValue(a.Id, out var t) ? t : null))
             .ToArray();
@@ -117,8 +112,8 @@ public async Task<ActionResult<AgentDto>> Get(Guid id, CancellationToken cancell
             return NotFound();
         if (!await accessGuard.CanAccessProjectAsync(agent.Project.Id, cancellationToken))
             return NotFound();
-        var lastCallTimes = await agentCallRepository.GetLastCallTimesAsync(cancellationToken);
-        return agentDtoMapper.ToDto(agent, lastCallTimes.TryGetValue(agent.Id, out var t) ? t : null);
+        var lastCallTime = await agentCallRepository.GetLastCallTimeAsync(agent.Id, cancellationToken);
+        return agentDtoMapper.ToDto(agent, lastCallTime);
     }
 
     /// <summary>
diff --git a/Proxytrace.Api/Controllers/AnomaliesController.cs b/Proxytrace.Api/Controllers/AnomaliesController.cs
index 6d036cae4..bea890488 100644
--- a/Proxytrace.Api/Controllers/AnomaliesController.cs
+++ b/Proxytrace.Api/Controllers/AnomaliesController.cs
@@ -47,19 +47,18 @@ public AnomaliesController(
     // Same scoping rule as AgentCallsController.GetAll (#193): admins (accessible == null) may run
     // any query; non-admins must scope to a project they belong to — directly via projectId or via
     // the agent's project — otherwise the list returns nothing rather than leaking other tenants' rows.
-    private async Task<bool> CanListAsync(Guid? projectId, Guid? agentId, CancellationToken cancellationToken)
+    // Mirrors AgentCallsController.ListScopeAsync — anomalies are traces, filtered the same way.
+    private async Task<IReadOnlyCollection<Guid>?> ListScopeAsync(
+        Guid? projectId,
+        Guid? agentId,
+        CancellationToken cancellationToken)
     {
-        var accessible = await accessGuard.GetAccessibleProjectIdsAsync(cancellationToken);
-        if (accessible is null)
-            return true;
-        if (projectId is { } pid)
-            return accessible.Contains(pid);
-        if (agentId is { } aid)
-        {
-            var agent = await agentRepository.FindAsync(aid, cancellationToken);
-            return agent is not null && accessible.Contains(agent.Project.Id);
-        }
-        return false;
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        if (scope is null || scope.IsEmpty() || agentId is not { } aid)
+            return scope;
+
+        var agent = await agentRepository.FindAsync(aid, cancellationToken);
+        return agent is not null && scope.Contains(agent.Project.Id) ? scope : [];
     }
 
     /// <summary>
@@ -75,9 +74,11 @@ public async Task<PagedResult<AnomalyListItemDto>> GetRecent(
         CancellationToken cancellationToken = default)
     {
         (page, pageSize) = Paging.Clamp(page, pageSize);
-        if (!await CanListAsync(projectId, agentId, cancellationToken))
+        var scope = await ListScopeAsync(projectId, agentId, cancellationToken);
+        if (scope.IsEmpty())
             return new PagedResult<AnomalyListItemDto>([], 0, page, pageSize);
-        var filter = new AgentCallFilter(AgentId: agentId, ProjectId: projectId, OutlierOnly: true);
+        var (scopedProjectId, scopedProjectIds) = scope.ToFilterScope();
+        var filter = new AgentCallFilter(AgentId: agentId, ProjectId: scopedProjectId, OutlierOnly: true, ProjectIds: scopedProjectIds);
         var (items, total) = await repository.GetFilteredListAsync(filter, page, pageSize, cancellationToken);
         var flaggedIds = items
             .Where(i => ((OutlierFlags)i.OutlierFlags).HasFlag(OutlierFlags.CustomAnomaly))
diff --git a/Proxytrace.Api/Controllers/AuthController.cs b/Proxytrace.Api/Controllers/AuthController.cs
index 5805cf7bd..9201398db 100644
--- a/Proxytrace.Api/Controllers/AuthController.cs
+++ b/Proxytrace.Api/Controllers/AuthController.cs
@@ -33,6 +33,7 @@ public class AuthController : ControllerBase
     private readonly IConfiguration config;
     private readonly ILogger<Audit> audit;
     private readonly IEmailSettingsStore emailSettings;
+    private readonly ISessionCookie sessionCookie;
 
     public AuthController(
         AuthOptions options,
@@ -48,7 +49,8 @@ public AuthController(
         IStreamTicketService streamTickets,
         IConfiguration config,
         ILogger<Audit> audit,
-        IEmailSettingsStore emailSettings)
+        IEmailSettingsStore emailSettings,
+        ISessionCookie sessionCookie)
     {
         this.options = options;
         this.setup = setup;
@@ -64,6 +66,7 @@ public AuthController(
         this.config = config;
         this.audit = audit;
         this.emailSettings = emailSettings;
+        this.sessionCookie = sessionCookie;
     }
 
     [HttpGet("mode")]
@@ -79,6 +82,7 @@ public async Task<AuthModeDto> GetMode(CancellationToken ct)
     [HttpPost("claim-legacy")]
     [AllowAnonymous]
     [RequireLocalMode]
+    [EnableRateLimiting(AuthRateLimiterConfigurator.LoginPolicy)]
     public async Task<ActionResult<TokenResponse>> ClaimLegacy([FromBody] ClaimLegacyRequest req, CancellationToken ct)
     {
         var v = policy.Validate(req.Password);
@@ -86,7 +90,7 @@ public async Task<ActionResult<TokenResponse>> ClaimLegacy([FromBody] ClaimLegac
 
         var result = await legacyClaim.ClaimAsync(req.Email, req.Password, ct);
         if (result is null) return Conflict("No eligible legacy account.");
-        SessionCookie.Append(Response, result.Token, result.ExpiresAt);
+        sessionCookie.Append(Response, result.Token, result.ExpiresAt);
         audit.LogAudit(AuditAction.LegacyAccountClaimed, nameof(IUser), result.User.Id, result.User.Email);
         return new TokenResponse(result.Token, result.ExpiresAt);
     }
@@ -102,7 +106,7 @@ public async Task<ActionResult<TokenResponse>> Setup([FromBody] SetupAdminReques
         if (!v.IsValid) return BadRequest(v.Errors);
 
         var result = await setup.CreateFirstAdminAsync(req.Email, req.Password, ct);
-        SessionCookie.Append(Response, result.Token, result.ExpiresAt);
+        sessionCookie.Append(Response, result.Token, result.ExpiresAt);
         audit.LogAudit(AuditAction.AdminBootstrapped, nameof(IUser), result.UserId, req.Email);
         return new TokenResponse(result.Token, result.ExpiresAt);
     }
@@ -122,9 +126,12 @@ public async Task<ActionResult<StreamTicketResponse>> StreamTicket(CancellationT
         return new StreamTicketResponse(ticket.Token, ticket.ExpiresAt);
     }
 
+    // Rate-limited per client IP: there is no per-account failed-attempt counter, so without this
+    // password guessing against a known address is bounded only by request throughput.
     [HttpPost("login")]
     [AllowAnonymous]
     [RequireLocalMode]
+    [EnableRateLimiting(AuthRateLimiterConfigurator.LoginPolicy)]
     public async Task<ActionResult<LoginResponseDto>> Login([FromBody] LoginRequest req, CancellationToken ct)
     {
         var outcome = await login.LoginAsync(req.Email, req.Password, ct);
@@ -151,7 +158,7 @@ private LoginResponseDto IssueLoginResponse(LoginOutcome outcome)
     {
         if (outcome is LoginSucceeded s)
         {
-            SessionCookie.Append(Response, s.Token, s.ExpiresAt);
+            sessionCookie.Append(Response, s.Token, s.ExpiresAt);
             return new LoginResponseDto(s.Token, s.ExpiresAt, MfaRequired: false, null, null);
         }
 
@@ -164,7 +171,7 @@ private LoginResponseDto IssueLoginResponse(LoginOutcome outcome)
     [HttpPost("mfa/verify")]
     [AllowAnonymous]
     [RequireLocalMode]
-    [EnableRateLimiting("auth-mfa")]
+    [EnableRateLimiting(AuthRateLimiterConfigurator.MfaPolicy)]
     public async Task<ActionResult<LoginResponseDto>> MfaVerify([FromBody] MfaVerifyRequest req, CancellationToken ct)
     {
         var result = await mfa.VerifyChallengeAsync(req.ChallengeToken, req.Code, ct);
@@ -174,7 +181,7 @@ public async Task<ActionResult<LoginResponseDto>> MfaVerify([FromBody] MfaVerify
             return Unauthorized();
         }
 
-        SessionCookie.Append(Response, result.Token, result.ExpiresAt);
+        sessionCookie.Append(Response, result.Token, result.ExpiresAt);
         audit.LogAudit(AuditAction.UserLoggedIn, nameof(IUser), result.User.Id, result.User.Email);
         return new LoginResponseDto(result.Token, result.ExpiresAt, MfaRequired: false, null, null);
     }
@@ -235,7 +242,7 @@ public IActionResult Logout()
         // Only audit a logout that actually ended a session — a spurious anonymous call records
         // nothing. The actor (who logged out) is enriched from the session cookie's context.
         var hadSession = Request.Cookies.ContainsKey(SessionCookie.Name);
-        SessionCookie.Delete(Response);
+        sessionCookie.Delete(Response);
         if (hadSession)
             audit.LogAudit(AuditAction.UserLoggedOut, nameof(IUser));
         return NoContent();
@@ -261,6 +268,7 @@ public async Task<ActionResult<MeDto>> Me(CancellationToken ct)
     [HttpPost("signup")]
     [AllowAnonymous]
     [RequireLocalMode]
+    [EnableRateLimiting(AuthRateLimiterConfigurator.LoginPolicy)]
     public async Task<ActionResult<TokenResponse>> Signup([FromBody] SignupRequest req, CancellationToken ct)
     {
         var v = policy.Validate(req.Password);
@@ -272,7 +280,7 @@ public async Task<ActionResult<TokenResponse>> Signup([FromBody] SignupRequest r
 
         // A freshly created user has no MFA enrollment, so the password login always yields a session.
         if (await login.LoginAsync(user.Email, req.Password, ct) is not LoginSucceeded session) return NotFound();
-        SessionCookie.Append(Response, session.Token, session.ExpiresAt);
+        sessionCookie.Append(Response, session.Token, session.ExpiresAt);
         return new TokenResponse(session.Token, session.ExpiresAt);
     }
 
@@ -283,7 +291,7 @@ public async Task<ActionResult<TokenResponse>> Signup([FromBody] SignupRequest r
     [HttpPost("forgot-password")]
     [AllowAnonymous]
     [RequireLocalMode]
-    [EnableRateLimiting("auth-reset")]
+    [EnableRateLimiting(AuthRateLimiterConfigurator.PasswordResetPolicy)]
     public async Task<IActionResult> ForgotPassword([FromBody] ForgotPasswordRequest req, CancellationToken ct)
     {
         await passwordReset.RequestResetAsync(req.Email, BuildResetUrl, ct);
@@ -294,7 +302,7 @@ public async Task<IActionResult> ForgotPassword([FromBody] ForgotPasswordRequest
     [HttpPost("reset-password")]
     [AllowAnonymous]
     [RequireLocalMode]
-    [EnableRateLimiting("auth-reset")]
+    [EnableRateLimiting(AuthRateLimiterConfigurator.PasswordResetPolicy)]
     public async Task<ActionResult<LoginResponseDto>> ResetPassword([FromBody] ResetPasswordRequest req, CancellationToken ct)
     {
         var v = policy.Validate(req.Password);
@@ -325,9 +333,12 @@ private string BuildResetUrl(string token)
         return $"{baseUrl.TrimEnd('/')}/reset-password?token={Uri.EscapeDataString(token)}";
     }
 
+    // Anonymous lookup of an invite by its raw token — rate-limited so the token space cannot be
+    // swept, sharing the login bucket because both are anonymous credential guesses.
     [HttpGet("invites/by-token/{token}")]
     [AllowAnonymous]
     [RequireLocalMode]
+    [EnableRateLimiting(AuthRateLimiterConfigurator.LoginPolicy)]
     public async Task<ActionResult<InvitePreviewDto>> Preview(string token, CancellationToken ct)
     {
         var invite = await invites.GetByTokenAsync(token, ct);
diff --git a/Proxytrace.Api/Controllers/EvaluatorsController.cs b/Proxytrace.Api/Controllers/EvaluatorsController.cs
index 8bc19aacb..5c0f1c48f 100644
--- a/Proxytrace.Api/Controllers/EvaluatorsController.cs
+++ b/Proxytrace.Api/Controllers/EvaluatorsController.cs
@@ -64,10 +64,37 @@ public EvaluatorsController(
         this.transaction = transaction;
     }
 
-    private async Task<bool> CanListAsync(Guid? projectId, CancellationToken cancellationToken)
+    /// <summary>
+    /// The evaluators the caller may list under the optional project filter — the whole instance
+    /// for an unfiltered admin, one project's when the scope names one, and the union of the
+    /// caller's projects otherwise.
+    /// </summary>
+    private async Task<IReadOnlyList<IEvaluator>> ListScopedAsync(
+        IReadOnlyCollection<Guid>? scope,
+        CancellationToken cancellationToken)
+    {
+        if (scope.IsEmpty())
+            return [];
+        if (scope.SingleProject() is { } projectId)
+            return await evaluatorRepository.GetByProjectAsync(projectId, cancellationToken);
+        var all = await evaluatorRepository.GetAllAsync(cancellationToken);
+        return scope is null ? all : all.Where(e => scope.Contains(e.Project.Id)).ToArray();
+    }
+
+    /// <summary>
+    /// The suites behind the overview's evaluator→suite references, scoped the same way as
+    /// <see cref="ListScopedAsync"/>.
+    /// </summary>
+    private async Task<IReadOnlyList<ITestSuite>> ListScopedSuitesAsync(
+        IReadOnlyCollection<Guid>? scope,
+        CancellationToken cancellationToken)
     {
-        var accessible = await accessGuard.GetAccessibleProjectIdsAsync(cancellationToken);
-        return accessible is null || (projectId.HasValue && accessible.Contains(projectId.Value));
+        if (scope.IsEmpty())
+            return [];
+        if (scope.SingleProject() is { } projectId)
+            return await testSuites.GetByProjectAsync(projectId, cancellationToken);
+        var all = await testSuites.GetAllAsync(cancellationToken);
+        return scope is null ? all : all.Where(s => scope.Contains(s.Agent.Project.Id)).ToArray();
     }
 
     [HttpGet("agentic-presets")]
@@ -81,11 +108,8 @@ public async Task<IReadOnlyList<EvaluatorDetailDto>> GetAll(
         [FromQuery] Guid? projectId = null,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(projectId, cancellationToken))
-            return [];
-        var all = projectId.HasValue
-            ? await evaluatorRepository.GetByProjectAsync(projectId.Value, cancellationToken)
-            : await evaluatorRepository.GetAllAsync(cancellationToken);
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        var all = await ListScopedAsync(scope, cancellationToken);
         return all.Select(evaluatorMapper.ToDto).ToArray();
     }
 
@@ -94,11 +118,8 @@ public async Task<IReadOnlyList<EvaluatorListItemDto>> GetSummaries(
         [FromQuery] Guid? projectId = null,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(projectId, cancellationToken))
-            return [];
-        var all = projectId.HasValue
-            ? await evaluatorRepository.GetByProjectAsync(projectId.Value, cancellationToken)
-            : await evaluatorRepository.GetAllAsync(cancellationToken);
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        var all = await ListScopedAsync(scope, cancellationToken);
         return all.Select(e => new EvaluatorListItemDto(e.Id, e.Kind, e.Name)).ToArray();
     }
 
@@ -121,16 +142,17 @@ public async Task<EvaluatorsOverviewDto> GetOverview(
         [FromQuery] StatisticsBucket bucket = StatisticsBucket.Daily,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(projectId, cancellationToken))
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        if (scope.IsEmpty())
             return new EvaluatorsOverviewDto([], [], []);
-        Task<IReadOnlyList<IEvaluator>> evaluatorsTask = projectId.HasValue
-            ? evaluatorRepository.GetByProjectAsync(projectId.Value, cancellationToken)
-            : evaluatorRepository.GetAllAsync(cancellationToken);
-        Task<IReadOnlyList<ITestSuite>> suitesTask = projectId.HasValue
-            ? testSuites.GetByProjectAsync(projectId.Value, cancellationToken)
-            : testSuites.GetAllAsync(cancellationToken);
-        Task<IReadOnlyList<EvaluatorSparklineStat>> sparklinesTask = projectId.HasValue && from.HasValue && to.HasValue
-            ? evaluatorStats.GetSparklinesAsync(projectId.Value, from.Value, to.Value, bucket, cancellationToken)
+
+        // The sparkline query is per-project, so it runs whenever the scope narrows to exactly one
+        // — which now includes an unfiltered REST API key, confined to its own project.
+        var singleProject = scope.SingleProject();
+        Task<IReadOnlyList<IEvaluator>> evaluatorsTask = ListScopedAsync(scope, cancellationToken);
+        Task<IReadOnlyList<ITestSuite>> suitesTask = ListScopedSuitesAsync(scope, cancellationToken);
+        Task<IReadOnlyList<EvaluatorSparklineStat>> sparklinesTask = singleProject is { } sparklineProject && from.HasValue && to.HasValue
+            ? evaluatorStats.GetSparklinesAsync(sparklineProject, from.Value, to.Value, bucket, cancellationToken)
             : Task.FromResult<IReadOnlyList<EvaluatorSparklineStat>>([]);
 
         await Task.WhenAll(evaluatorsTask, suitesTask, sparklinesTask);
diff --git a/Proxytrace.Api/Controllers/LicenseController.cs b/Proxytrace.Api/Controllers/LicenseController.cs
index ccc7d77d2..4193673d3 100644
--- a/Proxytrace.Api/Controllers/LicenseController.cs
+++ b/Proxytrace.Api/Controllers/LicenseController.cs
@@ -37,9 +37,21 @@ public LicenseController(
         this.audit = audit;
     }
 
+    /// <summary>
+    /// The current license. Anonymous by design — the setup wizard and the login screen need the
+    /// tier before any user exists — but the licensee's identity is withheld from unauthenticated
+    /// callers: without that, <c>curl https://host/api/license</c> from the internet discloses the
+    /// purchaser's email address. Signed-in callers (the Settings → License panel) still see it.
+    /// </summary>
     [HttpGet]
     [AllowAnonymous]
-    public LicenseDto Get() => Map(licenseService.Current);
+    public LicenseDto Get()
+    {
+        LicenseDto dto = Map(licenseService.Current);
+        return User.Identity?.IsAuthenticated == true
+            ? dto
+            : dto with { CustomerEmail = null };
+    }
 
     /// <summary>
     /// Validates a license key without storing or applying it. Anonymous by design: it is a
diff --git a/Proxytrace.Api/Controllers/ModelProvidersController.cs b/Proxytrace.Api/Controllers/ModelProvidersController.cs
index 64b91dd39..c3cd3c27e 100644
--- a/Proxytrace.Api/Controllers/ModelProvidersController.cs
+++ b/Proxytrace.Api/Controllers/ModelProvidersController.cs
@@ -99,6 +99,29 @@ public async Task<ActionResult<ModelProviderDto>> Get(Guid id, CancellationToken
         return mapper.ToRedactedDto(provider);
     }
 
+    /// <summary>
+    /// Returns a provider's upstream credential in the clear.
+    /// </summary>
+    /// <remarks>
+    /// The key used to be projected into the ordinary list/overview responses, so every provider
+    /// credential reached the browser on every admin providers-page load, whether or not anyone
+    /// pressed "reveal" — and nothing recorded who had seen what. It now has to be asked for
+    /// explicitly, and every read is audited.
+    /// </remarks>
+    [HttpGet("{id:guid}/key")]
+    [Authorize(Roles = nameof(UserRole.Admin))]
+    public async Task<ActionResult<ModelProviderKeyDto>> GetUpstreamKey(Guid id, CancellationToken cancellationToken)
+    {
+        var provider = await providerRepository.FindAsync(id, cancellationToken);
+        if (provider is null)
+            return NotFound();
+
+        // Audit before returning, so a read is recorded even if the response never reaches the
+        // client. Only the fact of the read is recorded — never the key value.
+        audit.LogAudit(AuditAction.ProviderUpstreamKeyRevealed, nameof(IModelProvider), provider.Id, provider.Name);
+        return new ModelProviderKeyDto(provider.ApiKey);
+    }
+
     [HttpGet("overview")]
     [Authorize(Roles = nameof(UserRole.Admin))]
     public async Task<ProvidersOverviewDto> GetOverview(CancellationToken cancellationToken = default)
@@ -148,14 +171,18 @@ public async Task<ActionResult<ModelProviderDto>> Update(
         var existing = await providerRepository.FindAsync(id, cancellationToken);
         if (existing is null)
             return NotFound();
+        // A null key means "leave the credential alone" — the client no longer receives it, so an
+        // edit that only renames the provider has nothing to send back.
+        string apiKey = request.UpstreamApiKey ?? existing.ApiKey;
+
         // Credential rotation is a security-relevant action of its own; compare against the stored
         // key before it is overwritten so the audit trail distinguishes a rotation from an
         // endpoint/name/kind edit. Only the fact of the change is recorded — never the key value.
-        bool keyRotated = existing.ApiKey != request.UpstreamApiKey;
+        bool keyRotated = existing.ApiKey != apiKey;
         bool configChanged = existing.Name != request.Name
             || existing.Endpoint != request.Endpoint.ToEndpointUri()
             || existing.Kind != request.Kind;
-        var updated = updateProvider(request.Name, request.Endpoint.ToEndpointUri(), request.UpstreamApiKey, request.Kind, existing);
+        var updated = updateProvider(request.Name, request.Endpoint.ToEndpointUri(), apiKey, request.Kind, existing);
         var saved = await providerRepository.UpdateAsync(updated, cancellationToken);
         if (keyRotated)
             audit.LogAudit(AuditAction.ProviderUpstreamKeyRotated, nameof(IModelProvider), saved.Id, saved.Name);
diff --git a/Proxytrace.Api/Controllers/ProjectsController.cs b/Proxytrace.Api/Controllers/ProjectsController.cs
index c4aac9cbe..29ca71e3b 100644
--- a/Proxytrace.Api/Controllers/ProjectsController.cs
+++ b/Proxytrace.Api/Controllers/ProjectsController.cs
@@ -63,6 +63,11 @@ public async Task<PagedResult<ProjectListItemDto>> GetAll(
         [FromQuery] int pageSize = 50,
         CancellationToken cancellationToken = default)
     {
+        // Clamp before either branch: the admin path clamps inside GetPagedAsync, but the in-memory
+        // member path below did not, so pageSize=int.MaxValue returned every member project in one
+        // response and echoed the unclamped size back in the PagedResult.
+        (page, pageSize) = Paging.Clamp(page, pageSize);
+
         // Admins see every project; non-admins (e.g. the sidebar project switcher) see only the
         // projects they belong to — never the full cross-tenant list.
         if (User.IsInRole(nameof(UserRole.Admin)))
@@ -77,7 +82,7 @@ public async Task<PagedResult<ProjectListItemDto>> GetAll(
 
         var memberProjects = await repository.GetByMemberAsync(user.Id, cancellationToken);
         var items = memberProjects
-            .Skip(Math.Max(page - 1, 0) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .Select(ProjectDtoMapper.ToListItemDto)
             .ToArray();
diff --git a/Proxytrace.Api/Controllers/SetupController.cs b/Proxytrace.Api/Controllers/SetupController.cs
index e5c833583..545dec082 100644
--- a/Proxytrace.Api/Controllers/SetupController.cs
+++ b/Proxytrace.Api/Controllers/SetupController.cs
@@ -8,6 +8,7 @@
 using Proxytrace.Common.Net;
 using Proxytrace.Domain;
 using Proxytrace.Domain.AuditLog;
+using Proxytrace.Domain.ModelEndpoint;
 using Proxytrace.Domain.ModelProvider;
 using Proxytrace.Domain.Project;
 using Proxytrace.Domain.User;
@@ -72,6 +73,14 @@ public async Task<ActionResult<CompleteSetupResponse>> Complete(
             request.ProjectName);
 
         var result = await setup.CompleteAsync(input, cancellationToken);
+
+        // The setup wizard creates exactly the entities every other path audits — including a model
+        // provider carrying an upstream credential — so it must leave the same record. Without these
+        // the compliance log has no trace of who configured the instance's first provider key.
+        audit.LogAudit(AuditAction.ProviderConfigCreated, nameof(IModelProvider), result.ProviderId, request.ProviderName);
+        audit.LogAudit(AuditAction.EndpointConfigCreated, nameof(IModelEndpoint), result.EndpointId, request.ModelName);
+        audit.LogAudit(AuditAction.ProjectCreated, nameof(IProject), result.ProjectId, request.ProjectName, projectId: result.ProjectId);
+
         return new CompleteSetupResponse(
             result.ProviderId,
             result.EndpointId,
diff --git a/Proxytrace.Api/Controllers/TestRunGroupsController.cs b/Proxytrace.Api/Controllers/TestRunGroupsController.cs
index 542c7fe40..48ca8abd7 100644
--- a/Proxytrace.Api/Controllers/TestRunGroupsController.cs
+++ b/Proxytrace.Api/Controllers/TestRunGroupsController.cs
@@ -66,24 +66,31 @@ public TestRunGroupsController(
     // (accessible == null) pass for any scope. Non-admins must scope to a project they belong to —
     // via projectId, the suite's project, or the agent's project — otherwise the query returns
     // nothing rather than leaking other tenants' rows.
-    private async Task<bool> CanListAsync(Guid? suiteId, Guid? agentId, Guid? projectId, CancellationToken cancellationToken)
+    // The projects this list request may read: null for an admin, the caller's own projects when no
+    // narrower filter is given (#482), and [] when a named suite/agent/project is out of reach.
+    private async Task<IReadOnlyCollection<Guid>?> ListScopeAsync(
+        Guid? suiteId,
+        Guid? agentId,
+        Guid? projectId,
+        CancellationToken cancellationToken)
     {
-        var accessible = await accessGuard.GetAccessibleProjectIdsAsync(cancellationToken);
-        if (accessible is null)
-            return true;
-        if (projectId is { } pid)
-            return accessible.Contains(pid);
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        if (scope is null || scope.IsEmpty())
+            return scope;
+
         if (suiteId is { } sid)
         {
             var suite = await suiteRepository.FindAsync(sid, cancellationToken);
-            return suite is not null && accessible.Contains(suite.Agent.Project.Id);
+            return suite is not null && scope.Contains(suite.Agent.Project.Id) ? scope : [];
         }
+
         if (agentId is { } aid)
         {
             var agent = await agentRepository.FindAsync(aid, cancellationToken);
-            return agent is not null && accessible.Contains(agent.Project.Id);
+            return agent is not null && scope.Contains(agent.Project.Id) ? scope : [];
         }
-        return false;
+
+        return scope;
     }
 
     [HttpGet]
@@ -96,7 +103,8 @@ public async Task<PagedResult<TestRunGroupListItemDto>> GetAll(
         [FromQuery] int pageSize = 50,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(suiteId, agentId, projectId, cancellationToken))
+        var scope = await ListScopeAsync(suiteId, agentId, projectId, cancellationToken);
+        if (scope.IsEmpty())
             return new PagedResult<TestRunGroupListItemDto>([], 0, page, pageSize);
 
         PagedResult<ITestRunGroup> paged;
@@ -104,10 +112,10 @@ public async Task<PagedResult<TestRunGroupListItemDto>> GetAll(
             paged = await groupRepository.GetBySuitePagedAsync(suiteId.Value, page, pageSize, includeSystem, cancellationToken);
         else if (agentId.HasValue)
             paged = await groupRepository.GetByAgentPagedAsync(agentId.Value, page, pageSize, includeSystem, cancellationToken);
-        else if (projectId.HasValue)
-            paged = await groupRepository.GetByProjectPagedAsync(projectId.Value, page, pageSize, includeSystem, cancellationToken);
-        else
+        else if (scope is null)
             paged = await groupRepository.GetPagedAsync(page, pageSize, cancellationToken);
+        else
+            paged = await groupRepository.GetByProjectsPagedAsync(scope, page, pageSize, includeSystem, cancellationToken);
 
         var items = await Task.WhenAll(
             paged.Items.Select(g => runMapper.ToListItemDtoAsync(g, runRepository, cancellationToken)));
diff --git a/Proxytrace.Api/Controllers/TestRunSchedulesController.cs b/Proxytrace.Api/Controllers/TestRunSchedulesController.cs
index 94e2d3857..31a74d964 100644
--- a/Proxytrace.Api/Controllers/TestRunSchedulesController.cs
+++ b/Proxytrace.Api/Controllers/TestRunSchedulesController.cs
@@ -64,19 +64,33 @@ public TestRunSchedulesController(
     // (accessible == null) pass for any scope. Non-admins must scope to a project they belong to —
     // directly via projectId or via the agent's project — otherwise the query returns nothing rather
     // than leaking other tenants' rows.
-    private async Task<bool> CanListAsync(Guid? agentId, Guid? projectId, CancellationToken cancellationToken)
+    /// <summary>
+    /// The schedules the caller may list under the optional agent/project filters. An agent filter
+    /// authorizes against that agent's project and then queries by agent; otherwise the request is
+    /// scoped to the projects the caller may read.
+    /// </summary>
+    private async Task<IReadOnlyList<ITestRunSchedule>> ListScopedAsync(
+        Guid? agentId,
+        Guid? projectId,
+        CancellationToken cancellationToken)
     {
-        var accessible = await accessGuard.GetAccessibleProjectIdsAsync(cancellationToken);
-        if (accessible is null)
-            return true;
-        if (projectId is { } pid)
-            return accessible.Contains(pid);
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        if (scope.IsEmpty())
+            return [];
+
         if (agentId is { } aid)
         {
             var agent = await agentRepository.FindAsync(aid, cancellationToken);
-            return agent is not null && accessible.Contains(agent.Project.Id);
+            if (agent is null || !scope.Admits(agent.Project.Id))
+                return [];
+            return await scheduleRepository.GetByAgentAsync(aid, cancellationToken);
         }
-        return false;
+
+        if (scope.SingleProject() is { } singleProject)
+            return await scheduleRepository.GetByProjectAsync(singleProject, cancellationToken);
+
+        var all = await scheduleRepository.GetAllAsync(cancellationToken);
+        return scope is null ? all : all.Where(s => scope.Contains(s.Suite.Agent.Project.Id)).ToArray();
     }
 
     /// <summary>
@@ -89,16 +103,7 @@ public async Task<IReadOnlyList<TestRunScheduleDto>> GetAll(
         [FromQuery] Guid? projectId = null,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(agentId, projectId, cancellationToken))
-            return [];
-
-        IReadOnlyList<ITestRunSchedule> schedules;
-        if (agentId.HasValue)
-            schedules = await scheduleRepository.GetByAgentAsync(agentId.Value, cancellationToken);
-        else if (projectId.HasValue)
-            schedules = await scheduleRepository.GetByProjectAsync(projectId.Value, cancellationToken);
-        else
-            schedules = await scheduleRepository.GetAllAsync(cancellationToken);
+        IReadOnlyList<ITestRunSchedule> schedules = await ListScopedAsync(agentId, projectId, cancellationToken);
 
         return await Task.WhenAll(schedules.Select(s => ToDtoAsync(s, cancellationToken)));
     }
diff --git a/Proxytrace.Api/Controllers/TestSuitesController.cs b/Proxytrace.Api/Controllers/TestSuitesController.cs
index 67e36654f..aa6eeb7cb 100644
--- a/Proxytrace.Api/Controllers/TestSuitesController.cs
+++ b/Proxytrace.Api/Controllers/TestSuitesController.cs
@@ -1,3 +1,4 @@
+using Proxytrace.Common.Async;
 using Proxytrace.Domain.Statistics;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -37,8 +38,21 @@ public class TestSuitesController : ControllerBase
     private readonly IStatsReader<TestRunStats, TestRunStats.Filter> runStats;
     private readonly ILicenseService license;
     private readonly IProjectAccessGuard accessGuard;
+    private readonly IAsyncLock asyncLock;
     private readonly ILogger<Audit> audit;
 
+    /// <summary>
+    /// Lock key serializing the licensed-suite-count check against the create that follows it.
+    /// </summary>
+    /// <remarks>
+    /// The limit is installation-wide, so the key is a constant rather than per-project. Mirrors
+    /// <c>TheoryValidationService.SubmitAsync</c>, which serializes its own check-then-act quota the
+    /// same way. Like that one this is per-process: it closes the ordinary double-submit race, not a
+    /// race between two replicas — enforcing across replicas needs a database constraint, which a
+    /// count-based limit cannot express.
+    /// </remarks>
+    private const string SuiteQuotaLockKey = "license-quota:test-suites";
+
     public TestSuitesController(
         ITestSuiteRepository suiteRepository,
         IAgentRepository agentRepository,
@@ -55,10 +69,12 @@ public TestSuitesController(
         IStatsReader<TestRunStats, TestRunStats.Filter> runStats,
         ILicenseService license,
         IProjectAccessGuard accessGuard,
+        IAsyncLock asyncLock,
         ILogger<Audit> audit)
     {
         this.audit = audit;
         this.accessGuard = accessGuard;
+        this.asyncLock = asyncLock;
         this.suiteRepository = suiteRepository;
         this.agentRepository = agentRepository;
         this.agentCallRepository = agentCallRepository;
@@ -75,6 +91,43 @@ public TestSuitesController(
         this.license = license;
     }
 
+    // Caller-supplied evaluator and test-case ids are not implicitly the caller's. Without these
+    // guards a crafted id lets a member of one project attach — and, because the response echoes the
+    // saved suite, read back — another project's evaluator or test-case conversation and expected
+    // output, and spend that project's provider credential when the suite runs its agentic judge.
+    // Same shape as EvaluatorTestBenchController's guards (#265): resolve the owning project, deny
+    // behind a 404 rather than a 403 so an id cannot be used as an existence oracle.
+    private async Task<bool> CanAccessEvaluatorsAsync(
+        IReadOnlyCollection<Guid> evaluatorIds,
+        CancellationToken cancellationToken)
+    {
+        foreach (var evaluatorId in evaluatorIds)
+        {
+            var projectId = await evaluatorRepository.GetProjectIdAsync(evaluatorId, cancellationToken);
+            if (projectId is null || !await accessGuard.CanAccessProjectAsync(projectId.Value, cancellationToken))
+                return false;
+        }
+
+        return true;
+    }
+
+    // A test case carries no project of its own — it is reachable only through the suite that
+    // references it — so an orphaned case (its suite was deleted) has no resolvable owner and stays
+    // accessible, matching EvaluatorTestBenchController.CanAccessTestCaseAsync.
+    private async Task<bool> CanAccessTestCasesAsync(
+        IReadOnlyCollection<Guid> testCaseIds,
+        CancellationToken cancellationToken)
+    {
+        foreach (var testCaseId in testCaseIds)
+        {
+            var projectId = await suiteRepository.GetProjectIdByTestCaseAsync(testCaseId, cancellationToken);
+            if (projectId is not null && !await accessGuard.CanAccessProjectAsync(projectId.Value, cancellationToken))
+                return false;
+        }
+
+        return true;
+    }
+
     [HttpGet]
     public async Task<PagedResult<TestSuiteListItemDto>> GetAll(
         [FromQuery] Guid? agentId = null,
@@ -92,16 +145,17 @@ public async Task<PagedResult<TestSuiteListItemDto>> GetAll(
             scopeProjectId = scopeAgent.Project.Id;
         }
 
-        if (!await CanListAsync(scopeProjectId, cancellationToken))
+        var scope = await accessGuard.ResolveListScopeAsync(scopeProjectId, cancellationToken);
+        if (scope.IsEmpty())
             return new PagedResult<TestSuiteListItemDto>([], 0, page, pageSize);
 
         PagedResult<ITestSuite> paged;
         if (agentId.HasValue)
             paged = await suiteRepository.GetByAgentPagedAsync(agentId.Value, page, pageSize, cancellationToken);
-        else if (projectId.HasValue)
-            paged = await suiteRepository.GetByProjectPagedAsync(projectId.Value, page, pageSize, cancellationToken);
-        else
+        else if (scope is null)
             paged = await suiteRepository.GetPagedAsync(page, pageSize, cancellationToken);
+        else
+            paged = await suiteRepository.GetByProjectsPagedAsync(scope, page, pageSize, cancellationToken);
 
         var statsBySuite = await GetRunStatsBySuiteAsync(
             paged.Items.Select(s => s.Id).ToArray(), cancellationToken);
@@ -132,11 +186,6 @@ private async Task<IReadOnlyDictionary<Guid, IReadOnlyList<TestRunStats>>> GetRu
             .ToDictionary(g => g.Key, g => (IReadOnlyList<TestRunStats>)g.ToArray());
     }
 
-    private async Task<bool> CanListAsync(Guid? projectId, CancellationToken cancellationToken)
-    {
-        var accessible = await accessGuard.GetAccessibleProjectIdsAsync(cancellationToken);
-        return accessible is null || (projectId.HasValue && accessible.Contains(projectId.Value));
-    }
 
     [HttpGet("{id:guid}")]
     public async Task<ActionResult<TestSuiteDto>> Get(Guid id, CancellationToken cancellationToken)
@@ -189,12 +238,18 @@ public async Task<ActionResult<TestSuiteDto>> Create(
         if (!await accessGuard.CanAccessProjectAsync(agent.Project.Id, cancellationToken))
             return NotFound();
 
+        // Held to the end of the method, so the count and the create that acts on it cannot be
+        // interleaved by a concurrent request — two simultaneous creates both used to observe
+        // "0 suites" and both proceed, taking a Free-tier install to two.
+        using IDisposable quotaLock = await asyncLock.LockAsync(SuiteQuotaLockKey, cancellationToken);
         license.Ensure(LicenseLimit.MaxTestSuites, await suiteRepository.CountAsync(cancellationToken));
 
         IReadOnlyCollection<IEvaluator> evaluators;
         if (request.EvaluatorIds is { Count: > 0 })
         {
             var distinctEvalIds = request.EvaluatorIds.Distinct().ToArray();
+            if (!await CanAccessEvaluatorsAsync(distinctEvalIds, cancellationToken))
+                return NotFound();
             evaluators = await evaluatorRepository.GetManyAsync(distinctEvalIds, cancellationToken);
         }
         else
@@ -233,17 +288,38 @@ public async Task<ActionResult<TestSuiteDto>> Update(
         if (!await accessGuard.CanAccessProjectAsync(existing.Agent.Project.Id, cancellationToken))
             return NotFound();
 
-        var agent = request.AgentId.HasValue && request.AgentId.Value != existing.Agent.Id
-            ? await agentRepository.GetAsync(request.AgentId.Value, cancellationToken)
-            : existing.Agent;
+        // Re-parenting the suite moves it — and every test case it carries — under another agent, so
+        // the target agent's project needs the same access check as the suite's own.
+        var agent = existing.Agent;
+        if (request.AgentId.HasValue && request.AgentId.Value != existing.Agent.Id)
+        {
+            var requestedAgent = await agentRepository.FindAsync(request.AgentId.Value, cancellationToken);
+            if (requestedAgent is null
+                || !await accessGuard.CanAccessProjectAsync(requestedAgent.Project.Id, cancellationToken))
+            {
+                return NotFound($"Agent {request.AgentId.Value} not found.");
+            }
+
+            agent = requestedAgent;
+        }
 
         IReadOnlyCollection<IEvaluator> evaluators = existing.Evaluators;
         if (request.EvaluatorIds is not null)
-            evaluators = await evaluatorRepository.GetManyAsync(request.EvaluatorIds.Distinct().ToArray(), cancellationToken);
+        {
+            var distinctEvalIds = request.EvaluatorIds.Distinct().ToArray();
+            if (!await CanAccessEvaluatorsAsync(distinctEvalIds, cancellationToken))
+                return NotFound();
+            evaluators = await evaluatorRepository.GetManyAsync(distinctEvalIds, cancellationToken);
+        }
 
         IReadOnlyCollection<ITestCase> testCases = existing.TestCases;
         if (request.TestCaseIds is not null)
-            testCases = await testCaseRepository.GetManyAsync(request.TestCaseIds.Distinct().ToArray(), cancellationToken);
+        {
+            var distinctCaseIds = request.TestCaseIds.Distinct().ToArray();
+            if (!await CanAccessTestCasesAsync(distinctCaseIds, cancellationToken))
+                return NotFound();
+            testCases = await testCaseRepository.GetManyAsync(distinctCaseIds, cancellationToken);
+        }
 
         var updated = createSuiteExisting(existing.Name, agent, evaluators, testCases, existing);
         var saved = await suiteRepository.UpdateAsync(updated, cancellationToken);
@@ -293,12 +369,19 @@ public async Task<ActionResult<TestSuiteDto>> PromoteFromTraces(
         if (!await accessGuard.CanAccessProjectAsync(agent.Project.Id, cancellationToken))
             return NotFound();
 
+        // Held to the end of the method, so the count and the create that acts on it cannot be
+        // interleaved by a concurrent request — two simultaneous creates both used to observe
+        // "0 suites" and both proceed, taking a Free-tier install to two.
+        using IDisposable quotaLock = await asyncLock.LockAsync(SuiteQuotaLockKey, cancellationToken);
         license.Ensure(LicenseLimit.MaxTestSuites, await suiteRepository.CountAsync(cancellationToken));
 
         IReadOnlyCollection<IEvaluator> evaluators;
         if (request.EvaluatorIds is { Count: > 0 })
         {
-            evaluators = await evaluatorRepository.GetManyAsync(request.EvaluatorIds.Distinct().ToArray(), cancellationToken);
+            var distinctEvalIds = request.EvaluatorIds.Distinct().ToArray();
+            if (!await CanAccessEvaluatorsAsync(distinctEvalIds, cancellationToken))
+                return NotFound();
+            evaluators = await evaluatorRepository.GetManyAsync(distinctEvalIds, cancellationToken);
         }
         else
         {
diff --git a/Proxytrace.Api/Controllers/TestSupportController.cs b/Proxytrace.Api/Controllers/TestSupportController.cs
index a1970b5f8..7a08b2c43 100644
--- a/Proxytrace.Api/Controllers/TestSupportController.cs
+++ b/Proxytrace.Api/Controllers/TestSupportController.cs
@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Proxytrace.Domain.TestSupport;
+using Proxytrace.Common.Text;
 
 namespace Proxytrace.Api.Controllers;
 
@@ -61,11 +62,11 @@ public IActionResult LogError([FromBody] LogErrorRequest request)
         {
             if (request.Critical)
             {
-                logger.LogCritical(exception, "{Message}", request.Message);
+                logger.LogCritical(exception, "{Message}", request.Message.ToSingleLogLine());
             }
             else
             {
-                logger.LogError(exception, "{Message}", request.Message);
+                logger.LogError(exception, "{Message}", request.Message.ToSingleLogLine());
             }
         }
 
diff --git a/Proxytrace.Api/Controllers/TheoriesController.cs b/Proxytrace.Api/Controllers/TheoriesController.cs
index 39b7651a4..b6887e828 100644
--- a/Proxytrace.Api/Controllers/TheoriesController.cs
+++ b/Proxytrace.Api/Controllers/TheoriesController.cs
@@ -70,19 +70,33 @@ public TheoriesController(
     // (accessible == null) pass for any scope. Non-admins must scope to a project they belong to —
     // directly via projectId or via the agent's project — otherwise the query returns nothing rather
     // than leaking other tenants' rows.
-    private async Task<bool> CanListAsync(Guid? agentId, Guid? projectId, CancellationToken cancellationToken)
+    /// <summary>
+    /// The theories the caller may list under the optional agent/project filters. An agent filter
+    /// authorizes against that agent's project and then queries by agent; otherwise the request is
+    /// scoped to the projects the caller may read.
+    /// </summary>
+    private async Task<IReadOnlyList<IOptimizationTheory>> ListScopedAsync(
+        Guid? agentId,
+        Guid? projectId,
+        CancellationToken cancellationToken)
     {
-        var accessible = await accessGuard.GetAccessibleProjectIdsAsync(cancellationToken);
-        if (accessible is null)
-            return true;
-        if (projectId is { } pid)
-            return accessible.Contains(pid);
+        var scope = await accessGuard.ResolveListScopeAsync(projectId, cancellationToken);
+        if (scope.IsEmpty())
+            return [];
+
         if (agentId is { } aid)
         {
             var agent = await agents.FindAsync(aid, cancellationToken);
-            return agent is not null && accessible.Contains(agent.Project.Id);
+            if (agent is null || !scope.Admits(agent.Project.Id))
+                return [];
+            return await repository.GetByAgentAsync(aid, cancellationToken);
         }
-        return false;
+
+        if (scope.SingleProject() is { } singleProject)
+            return await repository.GetByProjectAsync(singleProject, cancellationToken);
+
+        var all = await repository.GetAllAsync(cancellationToken);
+        return scope is null ? all : all.Where(t => scope.Contains(t.Agent.Project.Id)).ToArray();
     }
 
     [HttpGet]
@@ -92,16 +106,7 @@ public async Task<IReadOnlyList<TheoryDto>> GetAll(
         [FromQuery] TheoryStatus? status = null,
         CancellationToken cancellationToken = default)
     {
-        if (!await CanListAsync(agentId, projectId, cancellationToken))
-            return [];
-
-        IReadOnlyList<IOptimizationTheory> theories;
-        if (agentId.HasValue)
-            theories = await repository.GetByAgentAsync(agentId.Value, cancellationToken);
-        else if (projectId.HasValue)
-            theories = await repository.GetByProjectAsync(projectId.Value, cancellationToken);
-        else
-            theories = await repository.GetAllAsync(cancellationToken);
+        IReadOnlyList<IOptimizationTheory> theories = await ListScopedAsync(agentId, projectId, cancellationToken);
 
         if (status.HasValue)
             theories = theories.Where(t => t.Status == status.Value).ToList();
diff --git a/Proxytrace.Api/Controllers/TraceyChatController.cs b/Proxytrace.Api/Controllers/TraceyChatController.cs
index 7aceff603..8ee05c580 100644
--- a/Proxytrace.Api/Controllers/TraceyChatController.cs
+++ b/Proxytrace.Api/Controllers/TraceyChatController.cs
@@ -11,6 +11,7 @@
 using Proxytrace.Application.Auth;
 using Proxytrace.Application.Ingestion;
 using Proxytrace.Application.Tracey;
+using Proxytrace.Common.Text;
 using Proxytrace.Domain;
 using Proxytrace.Domain.Project;
 using Proxytrace.Domain.User;
@@ -130,7 +131,7 @@ public async Task Forward(Guid projectId, string path, CancellationToken cancell
         }
         catch (Exception ex)
         {
-            logger.LogWarning(ex, "Tracey upstream request to /v1/{Path} failed", path);
+            logger.LogWarning(ex, "Tracey upstream request to /v1/{Path} failed", path.ToSingleLogLine());
             Response.StatusCode = StatusCodes.Status502BadGateway;
             return;
         }
diff --git a/Proxytrace.Api/Dockerfile b/Proxytrace.Api/Dockerfile
index a77f1d406..c3b8340c0 100644
--- a/Proxytrace.Api/Dockerfile
+++ b/Proxytrace.Api/Dockerfile
@@ -6,6 +6,12 @@ USER root
 # /app/data inherits this ownership on first use (an empty named volume copies the image
 # dir's owner); bind mounts must be made writable by $APP_UID on the host.
 RUN mkdir -p /app/searchindex /app/data && chown -R $APP_UID:$APP_UID /app
+# Default the Data Protection key ring (and the other appdata state) at the directory created above,
+# matching what every compose file already mounts there. Without this variable the ring is in-memory
+# only, so provider keys / TOTP enrollments / the SMTP password stop decrypting after any restart —
+# a green boot that only shows up as upstream 401s. An operator writing their own manifest inherits
+# the safe default; overriding the variable still wins. See docs/security.md.
+ENV PROXYTRACE_DATA_DIR=/app/data
 USER $APP_UID
 WORKDIR /app
 EXPOSE 8080
diff --git a/Proxytrace.Api/Dto/Anomalies/CustomAnomalyDetectorDtos.cs b/Proxytrace.Api/Dto/Anomalies/CustomAnomalyDetectorDtos.cs
index 80c5aeab4..f1a50b3fe 100644
--- a/Proxytrace.Api/Dto/Anomalies/CustomAnomalyDetectorDtos.cs
+++ b/Proxytrace.Api/Dto/Anomalies/CustomAnomalyDetectorDtos.cs
@@ -1,3 +1,4 @@
+using System.ComponentModel.DataAnnotations;
 using Proxytrace.Domain.CustomAnomaly;
 
 namespace Proxytrace.Api.Dto.Anomalies;
@@ -32,6 +33,7 @@ public sealed record CreateCustomAnomalyDetectorRequest
 
     public required IReadOnlyList<AnomalyTriggerDto> Triggers { get; init; }
     public bool AllAgents { get; init; } = true;
+    [MaxLength(RequestLimits.MaxScopedAgents)]
     public IReadOnlyList<Guid>? AgentIds { get; init; }
     public bool IsEnabled { get; init; } = true;
 
@@ -49,6 +51,7 @@ public sealed record UpdateCustomAnomalyDetectorRequest
 
     public required IReadOnlyList<AnomalyTriggerDto> Triggers { get; init; }
     public required bool AllAgents { get; init; }
+    [MaxLength(RequestLimits.MaxScopedAgents)]
     public IReadOnlyList<Guid>? AgentIds { get; init; }
     public required bool IsEnabled { get; init; }
 
diff --git a/Proxytrace.Api/Dto/ModelProviders/ModelProviderDto.cs b/Proxytrace.Api/Dto/ModelProviders/ModelProviderDto.cs
index 5ba5b364b..04c877b7e 100644
--- a/Proxytrace.Api/Dto/ModelProviders/ModelProviderDto.cs
+++ b/Proxytrace.Api/Dto/ModelProviders/ModelProviderDto.cs
@@ -2,15 +2,33 @@
 
 namespace Proxytrace.Api.Dto.ModelProviders;
 
+/// <summary>
+/// A configured upstream provider.
+/// </summary>
+/// <param name="UpstreamApiKeyPreview">
+/// A masked rendering of the upstream credential — enough to tell two keys apart in the UI, never
+/// enough to use. The key itself is returned only by <c>GET /api/providers/{id}/key</c>, which is
+/// admin-gated and audited; it used to ship with every providers-page load, so no record existed of
+/// who had actually seen it.
+/// </param>
 public record ModelProviderDto(
     Guid Id,
     string Name,
     string Endpoint,
-    string UpstreamApiKey,
+    string UpstreamApiKeyPreview,
     ModelProviderKind Kind,
     DateTimeOffset CreatedAt,
     DateTimeOffset UpdatedAt);
 
+/// <summary>The cleartext upstream credential, returned only from the audited reveal endpoint.</summary>
+public record ModelProviderKeyDto(string UpstreamApiKey);
+
 public record CreateModelProviderRequest(string Name, string Endpoint, string UpstreamApiKey, ModelProviderKind Kind);
 
-public record UpdateModelProviderRequest(string Name, string Endpoint, string UpstreamApiKey, ModelProviderKind Kind);
+/// <param name="UpstreamApiKey">
+/// The replacement credential, or <see langword="null"/> to leave the stored one untouched. Nullable
+/// because the client no longer holds the key: it is not part of <see cref="ModelProviderDto"/>, so
+/// an edit that only renames a provider or changes its kind has nothing to echo back — and sending
+/// an empty string would wipe the credential.
+/// </param>
+public record UpdateModelProviderRequest(string Name, string Endpoint, string? UpstreamApiKey, ModelProviderKind Kind);
diff --git a/Proxytrace.Api/Dto/ModelProviders/ModelProviderDtoMapper.cs b/Proxytrace.Api/Dto/ModelProviders/ModelProviderDtoMapper.cs
index fc5be5654..ea1eaa5c2 100644
--- a/Proxytrace.Api/Dto/ModelProviders/ModelProviderDtoMapper.cs
+++ b/Proxytrace.Api/Dto/ModelProviders/ModelProviderDtoMapper.cs
@@ -11,17 +11,40 @@ namespace Proxytrace.Api.Dto.ModelProviders;
 /// </summary>
 public sealed class ModelProviderDtoMapper
 {
+    /// <summary>
+    /// Maps a provider, masking its upstream credential.
+    /// </summary>
+    /// <remarks>
+    /// This mapper has <b>no</b> variant that emits the cleartext key: it used to, and the result
+    /// was that every provider credential in the installation was sent to the browser on every
+    /// admin providers-page load — whether or not anyone pressed "reveal" — with nothing recording
+    /// who saw what. The key is now served only by the dedicated, audited reveal endpoint. Keep it
+    /// that way; do not add a "full" overload here.
+    /// </remarks>
     public ModelProviderDto ToDto(IModelProvider p) =>
-        new(p.Id, p.Name, p.Endpoint.ToString(), p.ApiKey, p.Kind, p.CreatedAt, p.UpdatedAt);
+        new(p.Id, p.Name, p.Endpoint.ToString(), Mask(p.ApiKey), p.Kind, p.CreatedAt, p.UpdatedAt);
 
     /// <summary>
-    /// Maps a provider without its upstream API key, for endpoints readable by non-admin
-    /// members (e.g. the by-id lookup used by Tracey tools). The secret must only ever be
-    /// returned from admin-gated endpoints.
+    /// Maps a provider without even the masked credential, for endpoints readable by non-admin
+    /// members (e.g. the by-id lookup used by Tracey tools).
     /// </summary>
     public ModelProviderDto ToRedactedDto(IModelProvider p) =>
         new(p.Id, p.Name, p.Endpoint.ToString(), string.Empty, p.Kind, p.CreatedAt, p.UpdatedAt);
 
+    /// <summary>
+    /// Renders a credential as a preview: enough to tell two keys apart and to confirm a rotation
+    /// took effect, never enough to use. Short keys are masked whole rather than leaking a
+    /// proportionally large share of themselves — self-hosted backends conventionally use values
+    /// like <c>EMPTY</c> or <c>ollama</c>.
+    /// </summary>
+    private static string Mask(string key)
+        => key.Length switch
+        {
+            0 => string.Empty,
+            <= 8 => new string('•', 8),
+            _ => key[..3] + new string('•', 8) + key[^4..],
+        };
+
     public ApiKeyDto ToKeyDto(IApiKey k)
         => ToKeyDto(k, plaintextKey: null);
 
@@ -34,8 +57,11 @@ public ApiKeyDto ToCreatedKeyDto(IApiKey k, string plaintextKey)
 
     private static ApiKeyDto ToKeyDto(IApiKey k, string? plaintextKey)
     {
-        var scopes = new[] { ApiKeyScopes.Ingestion, ApiKeyScopes.McpRead, ApiKeyScopes.McpWrite }
-            .Where(s => k.Scopes.HasFlag(s))
+        // Enumerate the enum rather than a hand-written list: the hardcoded list silently omitted
+        // ApiRead/ApiWrite, so a REST-capable key rendered in the Providers UI as having no REST
+        // capability at all. Deriving from the enum means a newly added scope cannot be forgotten.
+        var scopes = Enum.GetValues<ApiKeyScopes>()
+            .Where(s => s != ApiKeyScopes.None && k.Scopes.HasFlag(s))
             .ToArray();
         return new(k.Id, k.Name, k.KeyPrefix, k.Project.Id, k.Project.Name, k.Provider.Id, k.Provider.Name, scopes, k.Owner.Id, k.Owner.Email, k.CreatedAt, plaintextKey);
     }
diff --git a/Proxytrace.Api/Dto/RequestLimits.cs b/Proxytrace.Api/Dto/RequestLimits.cs
new file mode 100644
index 000000000..dda0d26b1
--- /dev/null
+++ b/Proxytrace.Api/Dto/RequestLimits.cs
@@ -0,0 +1,26 @@
+namespace Proxytrace.Api.Dto;
+
+/// <summary>
+/// Upper bounds for caller-supplied collections on request DTOs.
+///
+/// Without them the only ceiling is Kestrel's 30 MB body limit, and several handlers do one
+/// database round-trip per element — some inside an open transaction. A single ~20 MB array of
+/// GUIDs would issue hundreds of thousands of sequential queries while holding that transaction,
+/// exhausting the connection pool and blocking every other write. The domain already enforces the
+/// analogous caps it owns (<c>ICustomAnomalyDetector.MaxTriggers</c>,
+/// <c>ITestRunGroup.MaxModelEndpoints</c>/<c>MaxSampleCount</c>); these cover the collections that
+/// only ever exist at the API boundary.
+///
+/// <c>[ApiController]</c> turns a violation into an automatic 400 before the action body runs.
+/// </summary>
+internal static class RequestLimits
+{
+    /// <summary>Agents a single anomaly detector may be scoped to.</summary>
+    public const int MaxScopedAgents = 500;
+
+    /// <summary>Evaluators that may be attached to one test suite.</summary>
+    public const int MaxEvaluators = 50;
+
+    /// <summary>Test cases accepted in one suite create/update, and traces promoted in one call.</summary>
+    public const int MaxTestCases = 500;
+}
diff --git a/Proxytrace.Api/Dto/TestSuites/TestSuiteDto.cs b/Proxytrace.Api/Dto/TestSuites/TestSuiteDto.cs
index f17b3defa..359af1b33 100644
--- a/Proxytrace.Api/Dto/TestSuites/TestSuiteDto.cs
+++ b/Proxytrace.Api/Dto/TestSuites/TestSuiteDto.cs
@@ -85,8 +85,8 @@ public record UpdateTestCaseRequest(TestSuiteMessageDto ExpectedOutput);
 public record CreateTestSuiteRequest(
     [Required, StringLength(200, MinimumLength = 1)] string Name,
     [Required] Guid AgentId,
-    [Required] IReadOnlyList<CreateTestCaseRequest> TestCases,
-    IReadOnlyList<Guid>? EvaluatorIds = null);
+    [Required, MaxLength(RequestLimits.MaxTestCases)] IReadOnlyList<CreateTestCaseRequest> TestCases,
+    [MaxLength(RequestLimits.MaxEvaluators)] IReadOnlyList<Guid>? EvaluatorIds = null);
 
 public record CreateTestCaseRequest(
     Guid? FromAgentCallId,
@@ -105,5 +105,5 @@ public record AddTestCaseRequest(
 public record PromoteTracesRequest(
     [Required, StringLength(200, MinimumLength = 1)] string Name,
     [Required] Guid AgentId,
-    [Required, MinLength(1)] IReadOnlyList<Guid> AgentCallIds,
-    IReadOnlyList<Guid>? EvaluatorIds = null);
+    [Required, MinLength(1), MaxLength(RequestLimits.MaxTestCases)] IReadOnlyList<Guid> AgentCallIds,
+    [MaxLength(RequestLimits.MaxEvaluators)] IReadOnlyList<Guid>? EvaluatorIds = null);
diff --git a/Proxytrace.Api/Dto/TestSuites/UpdateTestSuiteRequest.cs b/Proxytrace.Api/Dto/TestSuites/UpdateTestSuiteRequest.cs
index 5fe966635..afb96a1f9 100644
--- a/Proxytrace.Api/Dto/TestSuites/UpdateTestSuiteRequest.cs
+++ b/Proxytrace.Api/Dto/TestSuites/UpdateTestSuiteRequest.cs
@@ -1,6 +1,8 @@
+using System.ComponentModel.DataAnnotations;
+
 namespace Proxytrace.Api.Dto.TestSuites;
 
 public record UpdateTestSuiteRequest(
     Guid? AgentId,
-    IReadOnlyList<Guid>? EvaluatorIds,
-    IReadOnlyList<Guid>? TestCaseIds);
+    [MaxLength(RequestLimits.MaxEvaluators)] IReadOnlyList<Guid>? EvaluatorIds,
+    [MaxLength(RequestLimits.MaxTestCases)] IReadOnlyList<Guid>? TestCaseIds);
diff --git a/Proxytrace.Api/Mcp/Tools/AgentTools.cs b/Proxytrace.Api/Mcp/Tools/AgentTools.cs
index a36661bcc..bf2929b48 100644
--- a/Proxytrace.Api/Mcp/Tools/AgentTools.cs
+++ b/Proxytrace.Api/Mcp/Tools/AgentTools.cs
@@ -60,7 +60,7 @@ public async Task<AgentDto> GetAgent(
             throw new McpException($"Agent '{agentId}' was not found in this project.");
         }
 
-        var lastCallTimes = await agentCalls.GetLastCallTimesAsync(cancellationToken);
-        return mapper.ToDto(agent, lastCallTimes.TryGetValue(agent.Id, out var t) ? t : null);
+        var lastCallTime = await agentCalls.GetLastCallTimeAsync(agent.Id, cancellationToken);
+        return mapper.ToDto(agent, lastCallTime);
     }
 }
diff --git a/Proxytrace.Api/Middleware/ExceptionHandlingMiddleware.cs b/Proxytrace.Api/Middleware/ExceptionHandlingMiddleware.cs
index ee4bf05de..d17f9775b 100644
--- a/Proxytrace.Api/Middleware/ExceptionHandlingMiddleware.cs
+++ b/Proxytrace.Api/Middleware/ExceptionHandlingMiddleware.cs
@@ -1,6 +1,7 @@
 using System.Text.Json;
 using Proxytrace.Api.Middleware.Exceptions;
 using Proxytrace.Application.ErrorLog;
+using Proxytrace.Common.Text;
 
 namespace Proxytrace.Api.Middleware;
 
@@ -40,7 +41,9 @@ public async Task InvokeAsync(HttpContext context)
             // without the alarming error-level log.
             if (ex is NotImplementedException)
             {
-                logger.LogInformation("Not-implemented endpoint called: {Path}", context.Request.Path);
+                logger.LogInformation(
+                    "Not-implemented endpoint called: {Path}",
+                    context.Request.Path.Value.ToSingleLogLine());
             }
             else
             {
@@ -53,6 +56,20 @@ public async Task InvokeAsync(HttpContext context)
                 }
             }
 
+            // Once the response has started (every SSE stream writes its headers and first frames
+            // long before its work can fail) the status and headers are read-only: assigning them
+            // throws InvalidOperationException, that secondary exception escapes this catch, and the
+            // original fault is replaced by a bare connection abort. Nothing useful can be sent at
+            // this point, so log the real cause and let the abort happen on its own.
+            if (context.Response.HasStarted)
+            {
+                logger.LogWarning(
+                    ex,
+                    "Unhandled exception after the response had already started for {Path}; cannot write an error body",
+                    context.Request.Path.Value.ToSingleLogLine());
+                return;
+            }
+
             context.Response.ContentType = "application/json";
 
             var mapping = Resolve(ex);
diff --git a/Proxytrace.Api/Module.cs b/Proxytrace.Api/Module.cs
index e6d73eb6b..3525c4397 100644
--- a/Proxytrace.Api/Module.cs
+++ b/Proxytrace.Api/Module.cs
@@ -323,7 +323,30 @@ private void ConfigureAuth(ContainerBuilder builder, IConfiguration configuratio
     {
         var authOptions = configuration.GetSection("Authentication").Get<AuthOptions>() ?? new AuthOptions();
         builder.RegisterInstance(authOptions);
-        
+
+        // The session cookie's Secure attribute is configuration-driven, never inferred from the
+        // request: the documented topology terminates TLS at a reverse proxy and forwards plain HTTP,
+        // so Request.IsHttps is false on every hop and would strip Secure from an HTTPS install's
+        // 7-day session cookie. Default: on, except in Development (where the SPA and API are plain
+        // http:// — browsers do accept Secure cookies on localhost, but a dev host that is not
+        // localhost would otherwise silently fail to log in). Override with
+        // Authentication:SessionCookie:Secure for a deliberate plain-HTTP deployment. See docs/security.md.
+        var environmentName = configuration["ASPNETCORE_ENVIRONMENT"]
+                              ?? configuration["DOTNET_ENVIRONMENT"]
+                              ?? "Production";
+        var isDevelopment = string.Equals(environmentName, "Development", StringComparison.OrdinalIgnoreCase);
+        builder
+            .RegisterInstance(new SessionCookieOptions
+            {
+                Secure = configuration.GetSection("Authentication:SessionCookie:Secure").Get<bool?>() ?? !isDevelopment,
+            })
+            .SingleInstance();
+
+        builder
+            .RegisterType<SessionCookie>()
+            .As<ISessionCookie>()
+            .SingleInstance();
+
         builder.RegisterServiceCollection(services =>
         {
             if (kiosk.Enabled)
diff --git a/Proxytrace.Api/Program.cs b/Proxytrace.Api/Program.cs
index 8e1d9d648..4a1e02223 100644
--- a/Proxytrace.Api/Program.cs
+++ b/Proxytrace.Api/Program.cs
@@ -1,11 +1,14 @@
 using Autofac;
 using Autofac.Extensions.DependencyInjection;
+using System.Net;
 using System.Text.Json.Serialization;
 using System.Threading.RateLimiting;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.Mvc.ApplicationParts;
 using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.OpenApi;
+using Proxytrace.Api;
 using Proxytrace.Api.Auth.Mcp;
 using Proxytrace.Api.Kiosk;
 using Proxytrace.Api.Middleware;
@@ -29,34 +32,13 @@
 
 builder.Services.AddHttpContextAccessor();
 
-// Throttle the anonymous password-reset endpoints (forgot/reset) per client IP to blunt account
-// enumeration and brute-forcing of reset tokens. In-memory is fine — each deployment runs a single
-// API instance. Applied via [EnableRateLimiting("auth-reset")] on the endpoints.
-builder.Services.AddRateLimiter(options =>
-{
-    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
-    options.AddPolicy("auth-reset", httpContext =>
-        RateLimitPartition.GetFixedWindowLimiter(
-            partitionKey: httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown",
-            factory: _ => new FixedWindowRateLimiterOptions
-            {
-                PermitLimit = 10,
-                Window = TimeSpan.FromMinutes(15),
-                QueueLimit = 0,
-            }));
-
-    // The MFA verify endpoint validates a 6-digit code — a small space — so it is rate-limited per
-    // client IP (in addition to the per-challenge attempt cap) to blunt brute force.
-    options.AddPolicy("auth-mfa", httpContext =>
-        RateLimitPartition.GetFixedWindowLimiter(
-            partitionKey: httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown",
-            factory: _ => new FixedWindowRateLimiterOptions
-            {
-                PermitLimit = 10,
-                Window = TimeSpan.FromMinutes(15),
-                QueueLimit = 0,
-            }));
-});
+// Throttle the anonymous auth endpoints (login/signup, password reset, MFA verify) per client IP.
+// In-memory is fine — each deployment runs a single API instance. Applied via
+// [EnableRateLimiting(...)] on the endpoints. NOTE: the partition key is the *connection* remote
+// address, which is only the real client when UseForwardedHeaders below is configured to trust the
+// reverse proxy — otherwise every request shares one bucket. See docs/security.md.
+var rateLimiting = new AuthRateLimiterConfigurator(builder.Configuration);
+builder.Services.AddRateLimiter(rateLimiting.Configure);
 
 builder.Services.AddAuthorization(options =>
 {
@@ -123,6 +105,19 @@ [new OpenApiSecuritySchemeReference("Bearer", doc)] = [],
                       && app.Services.GetRequiredService<KioskEndpointOptions>().IsConfigured;
 KioskProxyMounting.Apply(app.Services.GetRequiredService<ApplicationPartManager>(), mountKioskProxy);
 
+// FIRST middleware: rewrite Request.Scheme / Connection.RemoteIpAddress from the X-Forwarded-Proto
+// and X-Forwarded-For headers the reverse proxy sets, so everything downstream (rate-limit partition
+// keys, audit trails, generated absolute URLs) sees the real client instead of the proxy container.
+// Only headers arriving from an explicitly trusted proxy are honoured — an unrestricted
+// X-Forwarded-For would be a client-controlled rate-limit partition key. Unconfigured, the trust set
+// is the framework default (loopback only), so this is a no-op behind a containerised proxy until an
+// operator declares it. See docs/security.md.
+var forwardedHeaders = new TrustedProxyConfiguration(builder.Configuration).Build();
+if (forwardedHeaders is not null)
+{
+    app.UseForwardedHeaders(forwardedHeaders);
+}
+
 if (app.Environment.IsDevelopment())
 {
     app.UseSwagger();
@@ -156,4 +151,167 @@ [new OpenApiSecuritySchemeReference("Bearer", doc)] = [],
 app.MapFallbackToFile("/docs/{*path}", "docs/index.html");
 app.MapFallbackToFile("index.html");
 
-app.Run();
\ No newline at end of file
+app.Run();
+
+namespace Proxytrace.Api
+{
+    /// <summary>
+    /// Builds the forwarded-headers configuration from the <c>ForwardedHeaders</c> config section.
+    /// The documented topology terminates TLS at a reverse proxy and forwards plain HTTP, so the API
+    /// only learns the real client address and scheme from <c>X-Forwarded-For</c> /
+    /// <c>X-Forwarded-Proto</c>. Those headers are attacker-controlled unless the peer that sent them
+    /// is trusted, so the trust set must be declared by the operator: with none declared the
+    /// framework default (loopback only) applies and forwarded headers from a containerised proxy are
+    /// ignored — the fail-safe choice, since a spoofable client address would silently defeat the
+    /// per-IP auth rate limiters. See docs/security.md.
+    /// </summary>
+    internal sealed class TrustedProxyConfiguration
+    {
+        public const string SectionName = "ForwardedHeaders";
+
+        private readonly IConfiguration configuration;
+
+        public TrustedProxyConfiguration(IConfiguration configuration)
+        {
+            this.configuration = configuration;
+        }
+
+        /// <summary>
+        /// Returns the options to hand to <c>UseForwardedHeaders</c>, or <see langword="null"/> when
+        /// the operator disabled forwarded-header processing entirely.
+        /// </summary>
+        public ForwardedHeadersOptions? Build()
+        {
+            var section = configuration.GetSection(SectionName);
+            if (section.GetValue<bool?>("Enabled") == false)
+            {
+                return null;
+            }
+
+            var options = new ForwardedHeadersOptions
+            {
+                ForwardedHeaders = Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedFor
+                                   | Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedProto,
+
+                // One hop by default: the single reverse proxy of the documented topology. Raise it
+                // only when there really are N chained proxies, all of them trusted.
+                ForwardLimit = section.GetValue<int?>("ForwardLimit") ?? 1,
+            };
+
+            foreach (var proxy in ReadList(section, "KnownProxies"))
+            {
+                options.KnownProxies.Add(ParseAddress(proxy));
+            }
+
+            foreach (var network in ReadList(section, "KnownNetworks"))
+            {
+                options.KnownIPNetworks.Add(ParseNetwork(network));
+            }
+
+            return options;
+        }
+
+        // Accepts both the array form (ForwardedHeaders:KnownNetworks:0) and a comma-separated
+        // scalar, so a container can declare the trust set in a single environment variable.
+        private IReadOnlyList<string> ReadList(IConfigurationSection section, string key)
+        {
+            var child = section.GetSection(key);
+            if (child.Value is not null)
+            {
+                return child.Value.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+            }
+
+            return child.Get<string[]>() ?? [];
+        }
+
+        private IPAddress ParseAddress(string value) =>
+            IPAddress.TryParse(value, out var address)
+                ? address
+                : throw new InvalidOperationException(
+                    $"{SectionName}:KnownProxies contains '{value}', which is not a valid IP address.");
+
+        private System.Net.IPNetwork ParseNetwork(string value) =>
+            System.Net.IPNetwork.TryParse(value, out var network)
+                ? network
+                : throw new InvalidOperationException(
+                    $"{SectionName}:KnownNetworks contains '{value}', which is not valid CIDR notation (e.g. 172.16.0.0/12).");
+    }
+
+    /// <summary>
+    /// Registers the fixed-window rate-limiting policies guarding the anonymous auth endpoints, with
+    /// operator-overridable limits under the <c>RateLimiting</c> config section.
+    /// </summary>
+    internal sealed class AuthRateLimiterConfigurator
+    {
+        public const string SectionName = "RateLimiting";
+
+        /// <summary>
+        /// Guards the anonymous credential-accepting endpoints: login, legacy claim, invite signup
+        /// and the invite-token preview.
+        /// </summary>
+        public const string LoginPolicy = "auth-login";
+
+        public const string PasswordResetPolicy = "auth-reset";
+        public const string MfaPolicy = "auth-mfa";
+
+        private readonly IConfiguration configuration;
+
+        public AuthRateLimiterConfigurator(IConfiguration configuration)
+        {
+            this.configuration = configuration;
+        }
+
+        public void Configure(RateLimiterOptions options)
+        {
+            options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+            AddPolicy(options, LoginPolicy, LoginLimits());
+            AddPolicy(options, PasswordResetPolicy, PasswordResetLimits());
+            AddPolicy(options, MfaPolicy, MfaLimits());
+        }
+
+        /// <summary>
+        /// Password guessing is otherwise bounded only by throughput (there is no per-account failed
+        /// attempt counter), so a client address gets 30 credential submissions per minute: an order
+        /// of magnitude above a human fumbling a password or a shared office NAT signing in, and
+        /// three-plus orders of magnitude below what an unthrottled endpoint allows.
+        /// </summary>
+        public FixedWindowRateLimiterOptions LoginLimits() => Limits("Login", 30, TimeSpan.FromMinutes(1));
+
+        /// <summary>
+        /// Blunts account enumeration and brute-forcing of reset tokens.
+        /// </summary>
+        public FixedWindowRateLimiterOptions PasswordResetLimits() =>
+            Limits("PasswordReset", 10, TimeSpan.FromMinutes(15));
+
+        /// <summary>
+        /// The MFA verify endpoint validates a 6-digit code — a small space — so it is limited in
+        /// addition to the per-challenge attempt cap.
+        /// </summary>
+        public FixedWindowRateLimiterOptions MfaLimits() => Limits("Mfa", 10, TimeSpan.FromMinutes(15));
+
+        /// <summary>
+        /// The partition a request is counted against. Only as good as the forwarded-headers trust
+        /// configuration: behind an untrusted proxy every client collapses into one bucket.
+        /// </summary>
+        public string PartitionKey(HttpContext httpContext) =>
+            httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown";
+
+        private void AddPolicy(RateLimiterOptions options, string policy, FixedWindowRateLimiterOptions limits) =>
+            options.AddPolicy(policy, httpContext =>
+                RateLimitPartition.GetFixedWindowLimiter(
+                    partitionKey: PartitionKey(httpContext),
+                    factory: _ => limits));
+
+        private FixedWindowRateLimiterOptions Limits(string key, int permitLimit, TimeSpan window)
+        {
+            var section = configuration.GetSection($"{SectionName}:{key}");
+            var seconds = section.GetValue<int?>("WindowSeconds");
+            return new FixedWindowRateLimiterOptions
+            {
+                PermitLimit = Math.Max(1, section.GetValue<int?>("PermitLimit") ?? permitLimit),
+                Window = seconds is > 0 ? TimeSpan.FromSeconds(seconds.Value) : window,
+                QueueLimit = 0,
+            };
+        }
+    }
+}
\ No newline at end of file
diff --git a/Proxytrace.Api/appsettings.json b/Proxytrace.Api/appsettings.json
index 1a5c74fbe..ae304e34c 100644
--- a/Proxytrace.Api/appsettings.json
+++ b/Proxytrace.Api/appsettings.json
@@ -10,8 +10,9 @@
     "FxApiUrl": "https://api.frankfurter.app/latest",
     "RefreshIntervalHours": 1
   },
+  "_KioskComment": "Kiosk mode authenticates EVERY request as the seeded demo user (KioskAuthenticationHandler) and forces in-memory storage, so the shipped default must stay false — fail closed. Consumers opt in explicitly: docker-compose.kiosk.yml, dev.sh's kiosk path, and the e2e/manual-screenshot stacks.",
   "Kiosk": {
-    "Enabled": true
+    "Enabled": false
   },
   "Updates": {
     "Enabled": true,
diff --git a/Proxytrace.Application.Tests/Auth/Local/LoginServiceTests.cs b/Proxytrace.Application.Tests/Auth/Local/LoginServiceTests.cs
index a2c492150..fd5088c47 100644
--- a/Proxytrace.Application.Tests/Auth/Local/LoginServiceTests.cs
+++ b/Proxytrace.Application.Tests/Auth/Local/LoginServiceTests.cs
@@ -1,5 +1,7 @@
+using Autofac;
 using AwesomeAssertions;
 using Microsoft.Extensions.DependencyInjection;
+using NSubstitute;
 using Proxytrace.Application.Auth.Local;
 using Proxytrace.Domain.User;
 using Proxytrace.Testing;
@@ -49,4 +51,38 @@ public async Task Login_WithUnknownEmail_ReturnsNull()
         var svc = GetServices().GetRequiredService<ILoginService>();
         (await svc.LoginAsync("unknown@b.com", "Abcdef1!", CancellationToken)).Should().BeNull();
     }
+
+    [TestMethod]
+    public async Task Login_WithUnknownEmail_StillSpendsTheVerificationCost()
+    {
+        // Bailing out before hashing made an unknown email answer far faster than a known one,
+        // disclosing which addresses have accounts. The not-found path must verify against a dummy
+        // hash so the work — and so the response time — matches the found path.
+        var passwords = Substitute.For<IPasswordService>();
+        var s = GetServices(builder => builder.RegisterInstance(passwords).As<IPasswordService>());
+
+        var svc = s.GetRequiredService<ILoginService>();
+        var result = await svc.LoginAsync("nobody@b.com", "Abcdef1!", CancellationToken);
+
+        result.Should().BeNull();
+        passwords.Received(1).VerifyDummy("Abcdef1!");
+    }
+
+    [TestMethod]
+    public async Task Login_WithKnownEmailButNoPasswordSet_StillSpendsTheVerificationCost()
+    {
+        // Same oracle via a different door: an SSO-only account has no password hash, so the
+        // early return would otherwise distinguish it from an account that simply does not exist.
+        var passwords = Substitute.For<IPasswordService>();
+        var s = GetServices(builder => builder.RegisterInstance(passwords).As<IPasswordService>());
+
+        var factory = s.GetRequiredService<IUser.CreateNew>();
+        await factory("sso@b.com", "external-subject", null, UserRole.Member).AddAsync(CancellationToken);
+
+        var svc = s.GetRequiredService<ILoginService>();
+        var result = await svc.LoginAsync("sso@b.com", "Abcdef1!", CancellationToken);
+
+        result.Should().BeNull();
+        passwords.Received(1).VerifyDummy("Abcdef1!");
+    }
 }
diff --git a/Proxytrace.Application.Tests/Auth/Local/MfaServiceTests.cs b/Proxytrace.Application.Tests/Auth/Local/MfaServiceTests.cs
index fd3f1c5fd..7cf5ac52a 100644
--- a/Proxytrace.Application.Tests/Auth/Local/MfaServiceTests.cs
+++ b/Proxytrace.Application.Tests/Auth/Local/MfaServiceTests.cs
@@ -161,6 +161,73 @@ public async Task VerifyChallenge_WithBackupCode_IssuesSessionAndConsumesCode()
         (await mfa.VerifyChallengeAsync(second.Token, codes[0], CancellationToken)).Should().BeNull();
     }
 
+    [TestMethod]
+    public async Task BackupCodes_AreStoredSaltedAndSlow_NotAsAPlainHashOfTheCode()
+    {
+        // A backup code is ~50 bits — sized to be typed, not to resist a GPU. Stored as one
+        // unsalted single-round SHA-256, a dump could be attacked against every user's codes at
+        // once, because the same code hashed to the same value for everyone.
+        var services = GetServices();
+        var user = await SeedUser(services);
+        var (_, codes) = await EnableMfa(services, user);
+
+        var stored = await services.GetRequiredService<IMfaBackupCodeRepository>()
+            .ListByUserAsync(user.Id, CancellationToken);
+        var raw = new string(codes[0].Where(char.IsLetterOrDigit).ToArray()).ToUpperInvariant();
+
+        var plainHash = services.GetRequiredService<Domain.Security.ISecretHasher>().Hash(raw);
+        stored.Should().NotContain(c => c.CodeHash == plainHash,
+            "storing the bare hash makes one dump crackable against every user at once");
+
+        // Salted: two codes never share a hash, and no stored hash is the 64-char hex shape.
+        stored.Select(c => c.CodeHash).Should().OnlyHaveUniqueItems();
+        stored.Should().NotContain(c => c.CodeHash.Length == 64 && c.CodeHash.All(Uri.IsHexDigit));
+    }
+
+    [TestMethod]
+    public async Task VerifyChallenge_WithABackupCodeStoredUnderTheLegacyHash_StillSucceeds()
+    {
+        // Existing codes cannot be re-hashed (the raw code is unrecoverable), so they must keep
+        // verifying against the old scheme until they are used or the user re-enrolls. Otherwise
+        // this change would lock every already-enrolled user out of their recovery codes.
+        var services = GetServices();
+        var user = await SeedUser(services);
+        var mfa = services.GetRequiredService<IMfaService>();
+        var challenges = services.GetRequiredService<IMfaChallengeService>();
+        var (_, codes) = await EnableMfa(services, user);
+
+        var raw = new string(codes[0].Where(char.IsLetterOrDigit).ToArray()).ToUpperInvariant();
+        var legacyHash = services.GetRequiredService<Domain.Security.ISecretHasher>().Hash(raw);
+
+        // Rewrite that one row to the pre-change representation.
+        var repository = services.GetRequiredService<IMfaBackupCodeRepository>();
+        var all = await repository.ListByUserAsync(user.Id, CancellationToken);
+        var target = all[0];
+        var createExisting = services.GetRequiredService<IMfaBackupCode.CreateExisting>();
+        await repository.UpdateAsync(
+            createExisting(target.User, legacyHash, target.ConsumedAt, target),
+            CancellationToken);
+
+        var challenge = challenges.Issue(user);
+        var result = await mfa.VerifyChallengeAsync(challenge.Token, codes[0], CancellationToken);
+
+        result.Should().NotBeNull("a legacy-hashed backup code must keep working");
+    }
+
+    [TestMethod]
+    public async Task VerifyChallenge_WithAnUnissuedBackupCode_ReturnsNull()
+    {
+        var services = GetServices();
+        var user = await SeedUser(services);
+        var mfa = services.GetRequiredService<IMfaService>();
+        var challenges = services.GetRequiredService<IMfaChallengeService>();
+        await EnableMfa(services, user);
+
+        var challenge = challenges.Issue(user);
+
+        (await mfa.VerifyChallengeAsync(challenge.Token, "ABCDE-FGHJK", CancellationToken)).Should().BeNull();
+    }
+
     [TestMethod]
     public async Task VerifyChallenge_WithUnknownToken_ReturnsNull()
     {
diff --git a/Proxytrace.Application.Tests/Demo/DemoSeedingTests.cs b/Proxytrace.Application.Tests/Demo/DemoSeedingTests.cs
index 11b64dca8..e00664dc1 100644
--- a/Proxytrace.Application.Tests/Demo/DemoSeedingTests.cs
+++ b/Proxytrace.Application.Tests/Demo/DemoSeedingTests.cs
@@ -78,7 +78,7 @@ public async Task Seed_All_Scenarios_Populates_Expected_Entity_Counts()
 
         var proposals = await services.GetRequiredService<IRepository<IOptimizationProposal>>()
             .GetAllAsync(CancellationToken);
-        proposals.Should().HaveCount(9);
+        proposals.Should().HaveCount(10);
         proposals.Select(p => p.Status).Should().Contain(
             [ProposalStatus.Draft, ProposalStatus.Accepted, ProposalStatus.Rejected, ProposalStatus.Adopted]);
         proposals.Select(p => p.Kind).Should().Contain(
@@ -168,6 +168,20 @@ public async Task Terminal_Theories_Reference_The_Seeded_AB_Candidate_Run()
         }
     }
 
+    [TestMethod]
+    public async Task Seed_Leaves_No_Theory_Mid_AB_Validation()
+    {
+        // The kiosk skips the validation queue's restart recovery (RecoverInFlightTheoriesAsync),
+        // so a seeded Validating theory is never picked up: the board would show a pulsing
+        // "A/B in flight" row and an indeterminate progress bar that never resolves.
+        var theories = await services.GetRequiredService<IRepository<IOptimizationTheory>>()
+            .GetAllAsync(CancellationToken);
+
+        theories.Should().NotBeEmpty();
+        theories.Should().NotContain(t => t.Status == TheoryStatus.Validating,
+            "no seeded theory may sit mid-A/B in a kiosk that never runs the validation queue");
+    }
+
     [TestMethod]
     public async Task Validated_Theories_Link_Distinct_Proposals()
     {
diff --git a/Proxytrace.Application.Tests/Ingestion/TraceQuotaGuardTests.cs b/Proxytrace.Application.Tests/Ingestion/TraceQuotaGuardTests.cs
index 42bc488af..be9b39f42 100644
--- a/Proxytrace.Application.Tests/Ingestion/TraceQuotaGuardTests.cs
+++ b/Proxytrace.Application.Tests/Ingestion/TraceQuotaGuardTests.cs
@@ -3,7 +3,10 @@
 using Microsoft.Extensions.DependencyInjection;
 using NSubstitute;
 using Proxytrace.Application.Ingestion.Internal;
+using Proxytrace.Application.Notifications;
 using Proxytrace.Domain.AgentCall;
+using Proxytrace.Domain.Notification;
+using Proxytrace.Domain.Project;
 using Proxytrace.Licensing;
 using Proxytrace.Testing;
 
@@ -41,6 +44,12 @@ private async Task WaitUntilAsync(Func<bool> condition)
 
     private static bool CountWasRead(IAgentCallRepository repo) => repo.ReceivedCalls().Any();
 
+    private static bool ProjectScopedCountWasRead(IAgentCallRepository repo)
+        => repo.ReceivedCalls()
+            .SelectMany(c => c.GetArguments())
+            .OfType<AgentCallFilter>()
+            .Any(f => f.ProjectId is not null);
+
     [TestMethod]
     public async Task IsCurrentMonthOverQuota_WhenTotalAtLimit_ReturnsTrue()
     {
@@ -79,6 +88,209 @@ public async Task IsCurrentMonthOverQuota_WhenTotalBelowLimit_ReturnsFalse()
         }
     }
 
+    // ── per-project fair share ───────────────────────────────────────────────────────────
+    //
+    // The cap is installation-wide, but enforcing it as a single global switch meant one busy
+    // project could consume the whole month's allowance and silently stop capture for every other
+    // project — and nothing surfaced that captures were being dropped at all.
+
+    /// <summary>A repository whose month count varies by the filter's project.</summary>
+    private static IAgentCallRepository RepositoryWithProjectTotals(
+        int installTotal,
+        IReadOnlyDictionary<Guid, int> perProject)
+    {
+        var repo = Substitute.For<IAgentCallRepository>();
+        repo.GetFilteredAsync(Arg.Any<AgentCallFilter>(), Arg.Any<int>(), Arg.Any<int>(), Arg.Any<CancellationToken>())
+            .Returns(call =>
+            {
+                var filter = call.Arg<AgentCallFilter>();
+                ArgumentNullException.ThrowIfNull(filter);
+                int total = filter.ProjectId is { } id ? perProject.GetValueOrDefault(id) : installTotal;
+                return Task.FromResult<(IReadOnlyList<IAgentCall> Items, int Total)>(([], total));
+            });
+        return repo;
+    }
+
+    private static IProjectRepository ProjectsNamed(IEnumerable<Guid> ids)
+    {
+        // The project substitutes are stubbed BEFORE the Returns() below: stubbing one substitute
+        // inside another's Returns() argument leaves NSubstitute unable to tell which call it is
+        // returning from.
+        var projects = new List<IProject>();
+        foreach (Guid id in ids)
+        {
+            var project = Substitute.For<IProject>();
+            project.Id.Returns(id);
+            projects.Add(project);
+        }
+
+        var repo = Substitute.For<IProjectRepository>();
+        repo.GetAllAsync(Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<IProject>>(projects));
+        return repo;
+    }
+
+    private async Task<TraceQuotaGuard> RunToFirstRecomputeAsync(
+        long limit,
+        int installTotal,
+        IReadOnlyDictionary<Guid, int> perProject,
+        bool expectOverQuota,
+        INotificationService? notifications = null)
+    {
+        var license = Substitute.For<ILicenseService>();
+        license.GetLimit(LicenseLimit.MaxTracesPerMonth).Returns(limit);
+        var repo = RepositoryWithProjectTotals(installTotal, perProject);
+
+        var projectRepo = ProjectsNamed(perProject.Keys);
+        var services = GetServices(b =>
+        {
+            b.RegisterInstance(license).As<ILicenseService>();
+            b.RegisterInstance(repo).As<IAgentCallRepository>();
+            b.RegisterInstance(projectRepo).As<IProjectRepository>();
+            if (notifications is not null)
+                b.RegisterInstance(notifications).As<INotificationService>();
+        });
+
+        var guard = services.GetRequiredService<TraceQuotaGuard>();
+        await guard.StartAsync(CancellationToken);
+
+        // The recompute runs on the background loop, so wait for evidence it has landed rather than
+        // for a fixed delay. Over-quota is directly observable; under it, the per-project counts are
+        // read only after the installation total, so a project-filtered read proves the pass got
+        // past the point that would have set the flag.
+        await WaitUntilAsync(() => expectOverQuota
+            ? guard.IsCurrentMonthOverQuota
+            : ProjectScopedCountWasRead(repo));
+
+        return guard;
+    }
+
+    [TestMethod]
+    public async Task IsOverQuota_AtTheLimit_ThrottlesOnlyTheProjectAboveItsShare()
+    {
+        // THE regression. A global switch stopped capture for the quiet project too, even though it
+        // had consumed 10 of a 500-trace share. The cap still binds — the busy project is throttled.
+        var busy = Guid.NewGuid();
+        var quiet = Guid.NewGuid();
+
+        var guard = await RunToFirstRecomputeAsync(
+            limit: 1000, installTotal: 1000,
+            perProject: new Dictionary<Guid, int> { [busy] = 990, [quiet] = 10 },
+            expectOverQuota: true);
+
+        try
+        {
+            guard.IsCurrentMonthOverQuota.Should().BeTrue();
+            guard.IsOverQuota(busy).Should().BeTrue("it is above its 500-trace share of the cap");
+            guard.IsOverQuota(quiet).Should().BeFalse("it has consumed 10 of its 500-trace share");
+        }
+        finally
+        {
+            await guard.StopAsync(CancellationToken);
+        }
+    }
+
+    [TestMethod]
+    public async Task IsOverQuota_AtTheLimit_ThrottlesEveryProjectAboveItsShare()
+    {
+        // The limit must still bind when the overrun is shared out evenly.
+        var a = Guid.NewGuid();
+        var b = Guid.NewGuid();
+
+        var guard = await RunToFirstRecomputeAsync(
+            limit: 1000, installTotal: 1000,
+            perProject: new Dictionary<Guid, int> { [a] = 500, [b] = 500 },
+            expectOverQuota: true);
+
+        try
+        {
+            guard.IsOverQuota(a).Should().BeTrue();
+            guard.IsOverQuota(b).Should().BeTrue();
+        }
+        finally
+        {
+            await guard.StopAsync(CancellationToken);
+        }
+    }
+
+    [TestMethod]
+    public async Task IsOverQuota_BelowTheLimit_ThrottlesNobody()
+    {
+        var busy = Guid.NewGuid();
+        var quiet = Guid.NewGuid();
+
+        var guard = await RunToFirstRecomputeAsync(
+            limit: 1000, installTotal: 400,
+            perProject: new Dictionary<Guid, int> { [busy] = 390, [quiet] = 10 },
+            expectOverQuota: false);
+
+        try
+        {
+            guard.IsCurrentMonthOverQuota.Should().BeFalse();
+            guard.IsOverQuota(busy).Should().BeFalse();
+        }
+        finally
+        {
+            await guard.StopAsync(CancellationToken);
+        }
+    }
+
+    [TestMethod]
+    public async Task IsOverQuota_ForAProjectWithNoTraces_IsFalseEvenAtTheLimit()
+    {
+        // Covers a project created since the last recompute: it has consumed nothing.
+        var busy = Guid.NewGuid();
+
+        var guard = await RunToFirstRecomputeAsync(
+            limit: 100, installTotal: 100,
+            perProject: new Dictionary<Guid, int> { [busy] = 100 },
+            expectOverQuota: true);
+
+        try
+        {
+            guard.IsOverQuota(Guid.NewGuid()).Should().BeFalse();
+        }
+        finally
+        {
+            await guard.StopAsync(CancellationToken);
+        }
+    }
+
+    [TestMethod]
+    public async Task WhenAProjectStartsBeingThrottled_ANotificationIsRaisedForItAlone()
+    {
+        // A dropped capture is still acknowledged to the client — failing the proxied call would
+        // take the caller's application down over a billing limit — so without this the only symptom
+        // was traces quietly going missing.
+        var busy = Guid.NewGuid();
+        var quiet = Guid.NewGuid();
+        var notifications = Substitute.For<INotificationService>();
+
+        var guard = await RunToFirstRecomputeAsync(
+            limit: 1000, installTotal: 1000,
+            perProject: new Dictionary<Guid, int> { [busy] = 990, [quiet] = 10 },
+            expectOverQuota: true,
+            notifications: notifications);
+
+        try
+        {
+            await WaitUntilAsync(() => notifications.ReceivedCalls().Any());
+
+            await notifications.Received(1).NotifyAsync(
+                Arg.Is<NotificationRequest>(r =>
+                    r != null && r.Kind == NotificationKind.TraceQuotaReached && r.ProjectId == busy),
+                Arg.Any<CancellationToken>());
+
+            await notifications.DidNotReceive().NotifyAsync(
+                Arg.Is<NotificationRequest>(r => r != null && r.ProjectId == quiet),
+                Arg.Any<CancellationToken>());
+        }
+        finally
+        {
+            await guard.StopAsync(CancellationToken);
+        }
+    }
+
     [TestMethod]
     public async Task IsCurrentMonthOverQuota_WhenLimitUnlimited_ReturnsFalseWithoutCounting()
     {
diff --git a/Proxytrace.Application.Tests/ModelSwitchTheoryValidatorTests.cs b/Proxytrace.Application.Tests/ModelSwitchTheoryValidatorTests.cs
index d09966796..59ddcd29a 100644
--- a/Proxytrace.Application.Tests/ModelSwitchTheoryValidatorTests.cs
+++ b/Proxytrace.Application.Tests/ModelSwitchTheoryValidatorTests.cs
@@ -11,6 +11,7 @@
 using Proxytrace.Domain.TestCase;
 using Proxytrace.Domain.TestResult;
 using Proxytrace.Domain.TestRun;
+using Proxytrace.Domain.TestRunGroup;
 using Proxytrace.Domain.TestSuite;
 using Proxytrace.Domain.Usage;
 using Proxytrace.Testing;
@@ -57,7 +58,61 @@ public async Task Validate_CheaperButPassRateRegresses_ReturnsNoProposal()
         outcome.Proposal.Should().BeNull();
     }
 
-    private static Fixture Build(decimal currentCost, decimal proposedCost, bool[] baselinePassed, bool[] candidatePassed)
+    [TestMethod]
+    public async Task Validate_ExecutesBothArmsFreshRatherThanReusingStoredEvidence()
+    {
+        // The baseline used to come from a PREVIOUSLY STORED evidence run while the candidate ran
+        // fresh, so anything that drifted between the two — the model's behaviour, a provider
+        // update, an edit to the suite — was attributed to the model switch. A theory waiting in the
+        // validation queue widened that gap arbitrarily. docs/optimization-loop.md always said the
+        // arms run "fresh, back to back"; now they do.
+        var f = Build(currentCost: 10m, proposedCost: 4m, baselinePassed: [true, true], candidatePassed: [true, true]);
+
+        await f.Validator.ValidateAsync(f.Theory, CancellationToken);
+
+        await f.Runner.Received(2).RunInForegroundAsync(
+            Arg.Any<ITestSuite>(), Arg.Any<IReadOnlyList<IModelEndpoint>>(),
+            Arg.Any<IAgent?>(), Arg.Any<bool>(),
+            Arg.Any<Func<ITestRunGroup, CancellationToken, Task>?>(), Arg.Any<int>(), Arg.Any<CancellationToken>());
+    }
+
+    [TestMethod]
+    public async Task Validate_HonoursTheConfiguredSampleCount()
+    {
+        // AbSampleCount was ignored entirely here, so the setting silently applied to some
+        // validators and not others.
+        var f = Build(
+            currentCost: 10m, proposedCost: 4m,
+            baselinePassed: [true, true], candidatePassed: [true, true],
+            sampleCount: 3);
+
+        await f.Validator.ValidateAsync(f.Theory, CancellationToken);
+
+        await f.Runner.Received(2).RunInForegroundAsync(
+            Arg.Any<ITestSuite>(), Arg.Any<IReadOnlyList<IModelEndpoint>>(),
+            Arg.Any<IAgent?>(), Arg.Any<bool>(),
+            Arg.Any<Func<ITestRunGroup, CancellationToken, Task>?>(), sampleCount: 3, Arg.Any<CancellationToken>());
+    }
+
+    [TestMethod]
+    public async Task Validate_WithASingleTestCase_IsRefusedAsUnprovable()
+    {
+        // One case agrees with itself trivially, so it cannot evidence parity. The gate is on the
+        // size of the paired comparison — NOT on finding a significant difference, which for a
+        // model switch would be backwards: identical answers plus a lower price is the ideal result.
+        var f = Build(currentCost: 10m, proposedCost: 4m, baselinePassed: [true], candidatePassed: [true]);
+
+        var outcome = await f.Validator.ValidateAsync(f.Theory, CancellationToken);
+
+        outcome.Proposal.Should().BeNull();
+    }
+
+    private static Fixture Build(
+        decimal currentCost,
+        decimal proposedCost,
+        bool[] baselinePassed,
+        bool[] candidatePassed,
+        int sampleCount = 1)
     {
         var currentEndpoint = MakeEndpoint(currentCost);
         var proposedEndpoint = MakeEndpoint(proposedCost);
@@ -70,10 +125,10 @@ private static Fixture Build(decimal currentCost, decimal proposedCost, bool[] b
         var caseCount = Math.Max(baselinePassed.Length, candidatePassed.Length);
         suite.TestCases.Returns(Enumerable.Range(0, caseCount).Select(_ => Substitute.For<ITestCase>()).ToList());
 
-        var baselineId = Guid.NewGuid();
-        var candidateId = Guid.NewGuid();
-        var baselineRun = MakeRun(baselineId, currentEndpoint, baselinePassed);
-        var candidateRun = MakeRun(candidateId, proposedEndpoint, candidatePassed);
+        // Case ids shared across both arms: the significance test is PAIRED on the test case.
+        var caseIds = Enumerable.Range(0, caseCount).Select(_ => Guid.NewGuid()).ToArray();
+        var baselineRun = MakeRun(Guid.NewGuid(), currentEndpoint, baselinePassed, caseIds);
+        var candidateRun = MakeRun(Guid.NewGuid(), proposedEndpoint, candidatePassed, caseIds);
 
         var theory = Substitute.For<IModelSwitchTheory>();
         theory.Agent.Returns(agent);
@@ -81,11 +136,23 @@ private static Fixture Build(decimal currentCost, decimal proposedCost, bool[] b
         theory.Priority.Returns(Priority.Medium);
         theory.Rationale.Returns("switch");
         theory.ProposedEndpoint.Returns(proposedEndpoint);
-        theory.EvidenceTestRunIds.Returns(new[] { baselineId, candidateId });
-
-        var testRuns = Substitute.For<ITestRunRepository>();
-        testRuns.FindAsync(baselineId, Arg.Any<CancellationToken>()).Returns(Task.FromResult<ITestRun?>(baselineRun));
-        testRuns.FindAsync(candidateId, Arg.Any<CancellationToken>()).Returns(Task.FromResult<ITestRun?>(candidateRun));
+        theory.EvidenceTestRunIds.Returns(Array.Empty<Guid>());
+
+        // Both arms are executed FRESH, back to back — the validator no longer reuses a previously
+        // stored evidence run as its baseline, so the runner is what has to be stubbed, not the run
+        // repository. Reusing an old run meant any drift since it was recorded (the model's own
+        // behaviour, a provider update, an edited suite) was attributed to the model switch.
+        // Built before the Returns() call: GroupReturning itself stubs a substitute, and doing that
+        // inside the argument list leaves NSubstitute unable to tell which call it is returning from.
+        var baselineGroup = GroupReturning(baselineRun);
+        var candidateGroup = GroupReturning(candidateRun);
+
+        var runner = Substitute.For<ITestRunnerService>();
+        runner.RunInForegroundAsync(
+                Arg.Any<ITestSuite>(), Arg.Any<IReadOnlyList<IModelEndpoint>>(),
+                Arg.Any<IAgent?>(), Arg.Any<bool>(),
+                Arg.Any<Func<ITestRunGroup, CancellationToken, Task>?>(), Arg.Any<int>(), Arg.Any<CancellationToken>())
+            .Returns(baselineGroup, candidateGroup);
 
         var captured = new Captured();
         IModelSwitchProposal.CreateNew factory = (
@@ -100,11 +167,11 @@ private static Fixture Build(decimal currentCost, decimal proposedCost, bool[] b
 
         var validator = new ModelSwitchTheoryValidator(
             factory,
-            new Lazy<ITestRunnerService>(() => Substitute.For<ITestRunnerService>()),
-            testRuns,
-            new OptimizationOptions { AbSampleCount = 1 });
+            new Lazy<ITestRunnerService>(() => runner),
+            Substitute.For<ITestRunRepository>(),
+            new OptimizationOptions { AbSampleCount = sampleCount });
 
-        return new Fixture { Validator = validator, Theory = theory, Captured = captured };
+        return new Fixture { Validator = validator, Theory = theory, Captured = captured, Runner = runner };
     }
 
     private static IModelEndpoint MakeEndpoint(decimal costPerCall)
@@ -115,14 +182,24 @@ private static IModelEndpoint MakeEndpoint(decimal costPerCall)
         return endpoint;
     }
 
-    private static ITestRun MakeRun(Guid id, IModelEndpoint endpoint, bool[] passed)
+    private static ITestRunGroup GroupReturning(ITestRun run)
+    {
+        var group = Substitute.For<ITestRunGroup>();
+        group.GetTestRuns(Arg.Any<CancellationToken>()).Returns(Task.FromResult<IReadOnlyList<ITestRun>>([run]));
+        return group;
+    }
+
+    private static ITestRun MakeRun(Guid id, IModelEndpoint endpoint, bool[] passed, IReadOnlyList<Guid> caseIds)
     {
-        var results = passed.Select(p =>
+        var results = passed.Select((p, i) =>
         {
             var ev = Substitute.For<Domain.Evaluation.IEvaluation>();
             ev.Passed.Returns(p);
+            var testCase = Substitute.For<ITestCase>();
+            testCase.Id.Returns(caseIds[i]);
             var result = Substitute.For<ITestResult>();
             result.Evaluations.Returns([ev]);
+            result.TestCase.Returns(testCase);
             result.Latency.Returns(TimeSpan.FromMilliseconds(100));
             result.Usage.Returns(new TokenUsage(10, 5));
             return result;
@@ -140,6 +217,7 @@ private sealed class Fixture
         public required ModelSwitchTheoryValidator Validator { get; init; }
         public required IModelSwitchTheory Theory { get; init; }
         public required Captured Captured { get; init; }
+        public required ITestRunnerService Runner { get; init; }
     }
 
     private sealed class Captured
diff --git a/Proxytrace.Application.Tests/Optimization/OptimizerQueueRecoveryTests.cs b/Proxytrace.Application.Tests/Optimization/OptimizerQueueRecoveryTests.cs
new file mode 100644
index 000000000..5aefb3e5e
--- /dev/null
+++ b/Proxytrace.Application.Tests/Optimization/OptimizerQueueRecoveryTests.cs
@@ -0,0 +1,177 @@
+using AwesomeAssertions;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+using Proxytrace.Application.Optimization;
+using Proxytrace.Application.Optimization.Internal;
+using Proxytrace.Domain;
+using Proxytrace.Domain.Kiosk;
+using Proxytrace.Domain.ModelEndpoint;
+using Proxytrace.Domain.OptimizationTheory;
+using Proxytrace.Domain.TestRun;
+using Proxytrace.Domain.TestRunGroup;
+using Proxytrace.Domain.TestSuite;
+using Proxytrace.Testing;
+
+namespace Proxytrace.Application.Tests.Optimization;
+
+/// <summary>
+/// The optimizer's work queue is an in-process channel, so anything still in it when the process
+/// stopped was lost: a deploy during a scheduled-run window silently dropped that night's
+/// optimization, with nothing recorded anywhere to show it had been due.
+/// </summary>
+/// <remarks>
+/// The theory queue has always had this recovery — it could, because a theory's status is its own
+/// durable marker. A test run group had no equivalent until
+/// <see cref="ITestRunGroup.OptimizationConsideredAt"/>, which is what these tests cover.
+/// </remarks>
+[TestClass]
+public sealed class OptimizerQueueRecoveryTests : BaseTest<Module>
+{
+    [TestMethod]
+    public async Task PendingOptimization_ListsACompletedGroupThatWasNeverConsidered()
+    {
+        IServiceProvider services = GetServices();
+        var groups = services.GetRequiredService<ITestRunGroupRepository>();
+        var group = await CreateCompletedGroupAsync(services, isSystemRun: false);
+
+        var pending = await groups.GetPendingOptimizationAsync(50, CancellationToken);
+
+        pending.Should().ContainSingle(g => g.Id == group.Id);
+    }
+
+    [TestMethod]
+    public async Task PendingOptimization_ExcludesAGroupAlreadyConsidered()
+    {
+        // "Considered and found nothing" must not be confused with "never considered", or a barren
+        // group would be reprocessed on every single boot for the life of the installation.
+        IServiceProvider services = GetServices();
+        var groups = services.GetRequiredService<ITestRunGroupRepository>();
+        var group = await CreateCompletedGroupAsync(services, isSystemRun: false);
+
+        await group.MarkOptimizationConsidered(CancellationToken);
+
+        (await groups.GetPendingOptimizationAsync(50, CancellationToken))
+            .Should().NotContain(g => g.Id == group.Id);
+    }
+
+    [TestMethod]
+    public async Task PendingOptimization_ExcludesSystemRuns()
+    {
+        // System runs are the optimizer's own A/B runs. Recovering them would make the optimizer
+        // feed itself.
+        IServiceProvider services = GetServices();
+        var groups = services.GetRequiredService<ITestRunGroupRepository>();
+        var group = await CreateCompletedGroupAsync(services, isSystemRun: true);
+
+        (await groups.GetPendingOptimizationAsync(50, CancellationToken))
+            .Should().NotContain(g => g.Id == group.Id);
+    }
+
+    [TestMethod]
+    public async Task PendingOptimization_ExcludesAGroupStillRunning()
+    {
+        // A group that has not finished has not produced the evidence the optimizer reads, and will
+        // be enqueued normally when it does.
+        IServiceProvider services = GetServices();
+        var groups = services.GetRequiredService<ITestRunGroupRepository>();
+        var suite = await services.GetRequiredService<IDomainEntityGenerator<ITestSuite>>().GetOrCreateAsync(CancellationToken);
+        var pendingGroup = services.GetRequiredService<ITestRunGroup.CreateNew>()(suite, false, null, 1);
+        pendingGroup = await groups.AddAsync(pendingGroup, CancellationToken);
+
+        (await groups.GetPendingOptimizationAsync(50, CancellationToken))
+            .Should().NotContain(g => g.Id == pendingGroup.Id);
+    }
+
+    [TestMethod]
+    public async Task Recovery_ReQueuesTheBacklogAndMarksEachGroupConsidered()
+    {
+        IServiceProvider services = GetServices();
+        var groups = services.GetRequiredService<ITestRunGroupRepository>();
+        var group = await CreateCompletedGroupAsync(services, isSystemRun: false);
+
+        var optimizer = Substitute.For<IOptimizer>();
+        optimizer.DiscoverTheories(Arg.Any<ITestRunGroup>(), Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<IOptimizationTheory>>([]));
+
+        var service = new OptimizerService(
+            optimizer,
+            groups,
+            Substitute.For<ITheoryValidationService>(),
+            new KioskOptions { Enabled = false },
+            NullLogger<OptimizerService>.Instance);
+
+        await service.StartAsync(CancellationToken);
+        try
+        {
+            // The backlog is drained by the same loop that serves live enqueues, so wait for the
+            // marker rather than for a fixed delay.
+            await WaitForConsideredAsync(groups, group.Id);
+        }
+        finally
+        {
+            await service.StopAsync(CancellationToken);
+        }
+
+        var reloaded = await groups.GetAsync(group.Id, CancellationToken);
+        reloaded.OptimizationConsideredAt.Should().NotBeNull(
+            "a recovered group must be marked, even when discovery produced no theories");
+        await optimizer.Received(1).DiscoverTheories(
+            Arg.Is<ITestRunGroup>(g => g != null && g.Id == group.Id), Arg.Any<CancellationToken>());
+    }
+
+    [TestMethod]
+    public async Task Recovery_IsSkippedInKioskMode()
+    {
+        // Kiosk storage is in-memory and freshly demo-seeded on every start, so the only backlog
+        // recovery could find is the seeded groups — re-queuing those would fire real A/B runs, and
+        // real spend, on every boot when a live endpoint is configured.
+        IServiceProvider services = GetServices();
+        var groups = services.GetRequiredService<ITestRunGroupRepository>();
+        var group = await CreateCompletedGroupAsync(services, isSystemRun: false);
+
+        var optimizer = Substitute.For<IOptimizer>();
+        var service = new OptimizerService(
+            optimizer,
+            groups,
+            Substitute.For<ITheoryValidationService>(),
+            new KioskOptions { Enabled = true },
+            NullLogger<OptimizerService>.Instance);
+
+        await service.RecoverPendingGroupsAsync(CancellationToken);
+
+        await optimizer.DidNotReceiveWithAnyArgs().DiscoverTheories(default!, default);
+        (await groups.GetAsync(group.Id, CancellationToken)).OptimizationConsideredAt.Should().BeNull();
+    }
+
+    private async Task WaitForConsideredAsync(ITestRunGroupRepository groups, Guid groupId)
+    {
+        for (var attempt = 0; attempt < 100; attempt++)
+        {
+            var current = await groups.GetAsync(groupId, CancellationToken);
+            if (current.OptimizationConsideredAt is not null) return;
+            await Task.Delay(20, CancellationToken);
+        }
+    }
+
+    private async Task<ITestRunGroup> CreateCompletedGroupAsync(IServiceProvider services, bool isSystemRun)
+    {
+        var suite = await services.GetRequiredService<IDomainEntityGenerator<ITestSuite>>().GetOrCreateAsync(CancellationToken);
+        var endpoint = await services.GetRequiredService<IDomainEntityGenerator<IModelEndpoint>>().GetOrCreateAsync(CancellationToken);
+        var groups = services.GetRequiredService<ITestRunGroupRepository>();
+
+        var group = await groups.AddAsync(
+            services.GetRequiredService<ITestRunGroup.CreateNew>()(suite, isSystemRun, null, 1),
+            CancellationToken);
+
+        // A group only reaches a terminal status through its runs, so give it one and settle both.
+        var run = await services.GetRequiredService<IRepository<ITestRun>>().AddAsync(
+            services.GetRequiredService<ITestRun.CreateNew>()(group, endpoint, sampleIndex: 0),
+            CancellationToken);
+        await run.SetRunning(CancellationToken);
+
+        group = await group.ReloadAsync(CancellationToken);
+        group = await group.SetRunning(CancellationToken);
+        return await group.SetCompleted(CancellationToken);
+    }
+}
diff --git a/Proxytrace.Application.Tests/Optimization/ProportionStatsTests.cs b/Proxytrace.Application.Tests/Optimization/ProportionStatsTests.cs
index f5f8b8858..8c31af7c7 100644
--- a/Proxytrace.Application.Tests/Optimization/ProportionStatsTests.cs
+++ b/Proxytrace.Application.Tests/Optimization/ProportionStatsTests.cs
@@ -57,4 +57,135 @@ public void TwoSidedPValue_IsSymmetric()
         double? regression = ProportionStats.TwoSidedPValue(70, 100, 50, 100);
         improvement.Should().Be(regression);
     }
+
+    // ── paired test (the A/B gate) ───────────────────────────────────────────────────────
+    //
+    // The gate now pairs on the test case instead of pooling replays. Pooling was wrong in a way
+    // that always erred toward accepting: it counted cases × replays as that many independent
+    // trials, so the standard error shrank by roughly √(replays) and the gate got EASIER to pass
+    // the more samples an operator configured.
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_MatchesAnIndependentReferenceImplementation()
+    {
+        // Expected values computed by a separate implementation of the paired t-test written from
+        // scratch (regularized incomplete beta via the Lentz continued fraction), which reproduces
+        // the published two-sided critical values — t=2.262/df=9, t=2.228/df=10 and t=2.086/df=20 all
+        // return 0.0500. Pinning to those rather than to this code's own output, so the numerics are
+        // checked against something, not against themselves.
+
+        // mean difference 0.2, sample sd 0.262467, n = 10 → t = 2.40966, df = 9.
+        ProportionStats.PairedTwoSidedPValue(
+                [0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+                [0.6, 0.6, 0.4, 0.2, 0.2, 0.2, 0.0, 0.0, -0.1, -0.1])!
+            .Value.Should().BeApproximately(0.039271, 1e-6);
+
+        ProportionStats.PairedTwoSidedPValue(
+                [1.0, 0.0, 1.0, 0.0, 1.0, 0.0],
+                [1.0, 0.0, 1.0, 0.0, 1.0, 0.2])!
+            .Value.Should().BeApproximately(0.363217, 1e-6);
+
+        ProportionStats.PairedTwoSidedPValue(
+                [0.0, 0.2, 0.4, 0.6, 0.8],
+                [0.3, 0.5, 0.7, 0.9, 1.0])!
+            .Value.Should().BeApproximately(0.000151, 1e-6);
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_UsesTheTDistributionNotTheNormalApproximation()
+    {
+        // n here is the number of test cases — routinely well under 30, where the normal
+        // approximation's thinner tails understate the p-value and quietly reintroduce the
+        // over-acceptance this change exists to remove. At t = 2.4097 the normal approximation
+        // would give ≈0.0160; the correct t value for df = 9 is ≈0.0393, well over twice as large.
+        double? p = ProportionStats.PairedTwoSidedPValue(
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+            [0.6, 0.6, 0.4, 0.2, 0.2, 0.2, 0.0, 0.0, -0.1, -0.1]);
+
+        p!.Value.Should().BeGreaterThan(0.03, "the normal approximation would have reported ≈0.016");
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_MoreReplaysOfTheSameEvidence_DoNotLowerThePValue()
+    {
+        // THE regression this replaces. Replays sharpen each case's proportion; they must not
+        // manufacture sample size. With every replay agreeing, ten replays carry no more
+        // information than one, and the paired p-value is unchanged...
+        double[] baseline = [0.0, 0.0, 1.0, 1.0, 0.0, 1.0];
+        double[] candidate = [1.0, 0.0, 1.0, 1.0, 1.0, 1.0];
+
+        double? paired = ProportionStats.PairedTwoSidedPValue(baseline, candidate);
+        paired.Should().Be(ProportionStats.PairedTwoSidedPValue(baseline, candidate));
+
+        // ...whereas the pooled test reported a materially smaller p-value for being handed the
+        // identical evidence ten times over.
+        double? pooledOnce = ProportionStats.TwoSidedPValue(3, 6, 5, 6);
+        double? pooledTenTimes = ProportionStats.TwoSidedPValue(30, 60, 50, 60);
+        pooledTenTimes.Should().BeLessThan(pooledOnce!.Value);
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_WithASingleTestCase_IsUndefinedRatherThanConfident()
+    {
+        // One case cannot evidence a difference between arms, however often it is replayed. The
+        // pooled test produced a number here, and the gate treated that number as proof.
+        ProportionStats.PairedTwoSidedPValue([0.0], [1.0]).Should().BeNull();
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_WithNoDifference_IsUndefined()
+    {
+        double[] arm = [1.0, 0.5, 0.0, 0.75];
+        ProportionStats.PairedTwoSidedPValue(arm, arm).Should().BeNull();
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_WhenEveryCaseImprovesUnanimously_UsesTheSignTestBound()
+    {
+        // Zero spread makes t unbounded. Rather than claiming p = 0 from a handful of cases, fall
+        // back to the two-sided sign test — the odds that all n moved the same way by chance.
+        double[] baseline = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+        double[] candidate = [1, 1, 1, 1, 1, 1, 1, 1, 1, 1];
+
+        double? p = ProportionStats.PairedTwoSidedPValue(baseline, candidate);
+
+        p!.Value.Should().BeApproximately(2 * Math.Pow(0.5, 10), 1e-9);
+        p!.Value.Should().BeLessThan(0.05, "ten cases all flipping to passing is real evidence");
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_WhenOnlyTwoCasesFlipUnanimously_IsNotSignificant()
+    {
+        // The other edge of the same rule: two cases agreeing is a coin toss.
+        ProportionStats.PairedTwoSidedPValue([0, 0], [1, 1])!.Value
+            .Should().BeApproximately(0.5, 1e-9);
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_WithASmallShiftAgainstWideSpread_IsNotSignificant()
+    {
+        double[] baseline = [1.0, 0.0, 1.0, 0.0, 1.0, 0.0];
+        double[] candidate = [1.0, 0.0, 1.0, 0.0, 1.0, 0.2];
+
+        ProportionStats.PairedTwoSidedPValue(baseline, candidate)!.Value
+            .Should().BeGreaterThan(0.3, "one case nudging, amid wide spread, proves nothing");
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_WithMismatchedArms_IsUndefined()
+    {
+        ProportionStats.PairedTwoSidedPValue([0.0, 1.0], [1.0]).Should().BeNull();
+    }
+
+    [TestMethod]
+    public void PairedTwoSidedPValue_IsSymmetricInDirection()
+    {
+        double[] baseline = [0.0, 0.2, 0.4, 0.6, 0.8];
+        double[] candidate = [0.3, 0.5, 0.7, 0.9, 1.0];
+
+        double? improvement = ProportionStats.PairedTwoSidedPValue(baseline, candidate);
+        double? regression = ProportionStats.PairedTwoSidedPValue(candidate, baseline);
+
+        regression!.Value.Should().BeApproximately(improvement!.Value, 1e-12);
+    }
 }
diff --git a/Proxytrace.Application.Tests/Statistics/TestRunStatsProjectorTests.cs b/Proxytrace.Application.Tests/Statistics/TestRunStatsProjectorTests.cs
new file mode 100644
index 000000000..e59274ef8
--- /dev/null
+++ b/Proxytrace.Application.Tests/Statistics/TestRunStatsProjectorTests.cs
@@ -0,0 +1,102 @@
+using AwesomeAssertions;
+using Microsoft.Extensions.DependencyInjection;
+using Proxytrace.Application.Statistics.TestRun.Internal;
+using Proxytrace.Domain;
+using Proxytrace.Domain.ModelEndpoint;
+using Proxytrace.Domain.Statistics;
+using Proxytrace.Domain.Statistics.TestRun;
+using Proxytrace.Domain.TestRun;
+using Proxytrace.Domain.TestRunGroup;
+using Proxytrace.Domain.TestSuite;
+using Proxytrace.Testing;
+
+namespace Proxytrace.Application.Tests.Statistics;
+
+/// <summary>
+/// Internal A/B validation runs must not reach the user-facing statistics.
+/// </summary>
+/// <remarks>
+/// <c>IsSystemRun</c> already hides them from the run list, so a user can neither see nor inspect
+/// them — but their results were still folded into the pass-rate figures and the anomaly baseline.
+/// People saw pass rates move because of runs that, as far as the UI is concerned, never happened.
+/// </remarks>
+[TestClass]
+public sealed class TestRunStatsProjectorTests : BaseTest<Module>
+{
+    [TestMethod]
+    public async Task Project_ForAUserRun_WritesStats()
+    {
+        IServiceProvider services = GetServices();
+        var run = await CreateRunAsync(services, isSystemRun: false);
+
+        await ProjectorFor(services).ProjectAsync(run.Id, CancellationToken);
+
+        (await ReaderFor(services).FindAsync(run.Id, CancellationToken))
+            .Should().NotBeNull("an ordinary run belongs in the statistics");
+    }
+
+    [TestMethod]
+    public async Task Project_ForASystemRun_WritesNoStats()
+    {
+        IServiceProvider services = GetServices();
+        var run = await CreateRunAsync(services, isSystemRun: true);
+
+        await ProjectorFor(services).ProjectAsync(run.Id, CancellationToken);
+
+        (await ReaderFor(services).FindAsync(run.Id, CancellationToken))
+            .Should().BeNull("a system run must not appear in user-facing statistics");
+    }
+
+    [TestMethod]
+    public async Task Project_ForASystemRunWithALeftoverRow_RemovesIt()
+    {
+        // Rows written before system runs were excluded must be cleaned up, not merely stopped —
+        // skipping alone would leave them in the statistics forever.
+        IServiceProvider services = GetServices();
+        var run = await CreateRunAsync(services, isSystemRun: true);
+        var writer = services.GetRequiredService<IStatsWriter<TestRunStats>>();
+        await writer.UpsertAsync(
+            new TestRunStats(
+                TestRunId: run.Id,
+                AgentId: run.Group.Suite.Agent.Id,
+                EndpointId: run.Endpoint.Id,
+                GroupId: run.Group.Id,
+                SuiteId: run.Group.Suite.Id,
+                TestCases: 1,
+                Passed: 1,
+                TotalDuration: TimeSpan.FromSeconds(1),
+                Usage: null,
+                Cost: null,
+                RunCompletedAt: DateTimeOffset.UtcNow),
+            CancellationToken);
+
+        (await ReaderFor(services).FindAsync(run.Id, CancellationToken)).Should().NotBeNull();
+
+        await ProjectorFor(services).ProjectAsync(run.Id, CancellationToken);
+
+        (await ReaderFor(services).FindAsync(run.Id, CancellationToken))
+            .Should().BeNull("projecting a system run must remove any stats row it already had");
+    }
+
+    private static TestRunStatsProjector ProjectorFor(IServiceProvider services)
+        => new(
+            services.GetRequiredService<IStatsWriter<TestRunStats>>(),
+            services.GetRequiredService<IRepository<ITestRun>>());
+
+    private static IStatsReader<TestRunStats, TestRunStats.Filter> ReaderFor(IServiceProvider services)
+        => services.GetRequiredService<IStatsReader<TestRunStats, TestRunStats.Filter>>();
+
+    private async Task<ITestRun> CreateRunAsync(IServiceProvider services, bool isSystemRun)
+    {
+        var suite = await services.GetRequiredService<IDomainEntityGenerator<ITestSuite>>()
+            .GetOrCreateAsync(CancellationToken);
+        var endpoint = await services.GetRequiredService<IDomainEntityGenerator<IModelEndpoint>>()
+            .GetOrCreateAsync(CancellationToken);
+
+        var group = services.GetRequiredService<ITestRunGroup.CreateNew>()(suite, isSystemRun, null, 1);
+        group = await services.GetRequiredService<IRepository<ITestRunGroup>>().AddAsync(group, CancellationToken);
+
+        var run = services.GetRequiredService<ITestRun.CreateNew>()(group, endpoint, sampleIndex: 0);
+        return await services.GetRequiredService<IRepository<ITestRun>>().AddAsync(run, CancellationToken);
+    }
+}
diff --git a/Proxytrace.Application.Tests/SwitchModelOptimizerTests.cs b/Proxytrace.Application.Tests/SwitchModelOptimizerTests.cs
index c5f000a68..a65e158b5 100644
--- a/Proxytrace.Application.Tests/SwitchModelOptimizerTests.cs
+++ b/Proxytrace.Application.Tests/SwitchModelOptimizerTests.cs
@@ -1,3 +1,4 @@
+using System.Globalization;
 using AwesomeAssertions;
 using NSubstitute;
 using Proxytrace.Application.Optimization.Internal;
@@ -170,6 +171,61 @@ public async Task DiscoverTheories_BothMetricsQualify_LargerRelativeSavingWins()
         c.Priority.Should().Be(Priority.High);
     }
 
+    [TestMethod]
+    public async Task DiscoverTheories_CostWinUnderCommaDecimalCulture_FormatsRationaleInvariantly()
+    {
+        Fixture fixture = Build(
+            Spec("current", cost: 12.5m, latency: Sec(5), isCurrent: true),
+            Spec("altA", cost: 10m, latency: Sec(5)));
+
+        await DiscoverUnderCulture(fixture);
+
+        // Persisted proposal text must read the same on every host: "20.0%", not "20,0%".
+        fixture.Captured.Rationale.Should().Contain("20.0%").And.Contain("12.5");
+        fixture.Captured.Rationale.Should().NotContain(",");
+    }
+
+    [TestMethod]
+    public async Task DiscoverTheories_LatencyWinUnderCommaDecimalCulture_FormatsRationaleInvariantly()
+    {
+        Fixture fixture = Build(
+            Spec("current", cost: 10m, latency: Sec(12.5), isCurrent: true),
+            Spec("altA", cost: 10m, latency: Sec(5)));
+
+        await DiscoverUnderCulture(fixture);
+
+        fixture.Captured.Rationale.Should().Contain("60.0%").And.Contain("5.00s").And.Contain("12.50s");
+        fixture.Captured.Rationale.Should().NotContain(",");
+    }
+
+    /// <summary>
+    /// Runs the optimizer with a comma-decimal culture in scope, restoring the ambient culture on
+    /// every path. The culture is set on the flowing <see cref="CultureInfo.CurrentCulture"/> only —
+    /// never on the process-wide <c>DefaultThreadCurrentCulture</c> — and the optimizer completes
+    /// synchronously, so nothing escapes this method.
+    /// </summary>
+    private async Task DiscoverUnderCulture(Fixture fixture)
+    {
+        var german = new CultureInfo("de-DE");
+
+        // Guard against a globalization-invariant host silently making these tests vacuous.
+        12.5m.ToString("0.####", german).Should().Be("12,5");
+
+        CultureInfo previous = CultureInfo.CurrentCulture;
+        CultureInfo.CurrentCulture = german;
+        try
+        {
+            var theories = await fixture.Optimizer.DiscoverTheories(
+                fixture.Group, fixture.Cohorts, CancellationToken);
+
+            theories.Should().HaveCount(1);
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = previous;
+        }
+    }
+
     private static TimeSpan Sec(double seconds) => TimeSpan.FromSeconds(seconds);
 
     private static RunSpec Spec(
diff --git a/Proxytrace.Application.Tests/SystemPromptTheoryValidatorTests.cs b/Proxytrace.Application.Tests/SystemPromptTheoryValidatorTests.cs
index ad865dd7c..d0a4506ae 100644
--- a/Proxytrace.Application.Tests/SystemPromptTheoryValidatorTests.cs
+++ b/Proxytrace.Application.Tests/SystemPromptTheoryValidatorTests.cs
@@ -98,23 +98,44 @@ public async Task Validate_UnevaluatedResults_DoNotCountAsPass()
     }
 
     [TestMethod]
-    public async Task Validate_PoolsSamples_SoASmallSuiteCanReachSignificance()
+    public async Task Validate_ReplayingTheSameOutcome_DoesNotManufactureSignificance()
     {
-        // The showcase's real numbers: an 11-case suite going 5/11 → 8/11. That is a large, genuine
-        // improvement, but on a single sample per arm it lands at p≈0.19 and is discarded as noise —
-        // which is exactly why the kiosk demo's optimizer never produced a proposal. Replaying the
-        // same per-sample outcome three times pools it into 15/33 → 24/33, which clears 0.05.
-        var f = BuildSampled(
-            samples: 3,
-            baselinePassed: Passes(5, 11),
-            candidatePassed: Passes(8, 11));
-
-        var outcome = await f.Validator.ValidateAsync(f.Theory, CancellationToken);
+        // This test previously asserted the OPPOSITE, and its own comment described the mechanism:
+        // "replaying the same per-sample outcome three times pools it into 15/33 → 24/33, which
+        // clears 0.05". That was the defect, encoded as a feature. Replaying an outcome that does
+        // not change adds no information about whether the change works — but the pooled test
+        // counted 33 independent trials where there were only 11 test cases, so it grew more
+        // confident purely because it was handed the same evidence again.
+        //
+        // 5/11 → 8/11 is three cases flipping out of eleven. Paired on the case, that is p ≈ 0.08:
+        // suggestive, not proven, at one sample or at three.
+        var f = BuildSampled(samples: 3, baselinePassed: Passes(5, 11), candidatePassed: Passes(8, 11));
+        var pooled = await f.Validator.ValidateAsync(f.Theory, CancellationToken);
+
+        // The reported pass rates still pool — "of everything attempted, this fraction passed" is
+        // what a reader expects to see — but the verdict does not follow them.
+        pooled.BaselinePassRate.Should().BeApproximately(15d / 33d, 1e-9);
+        pooled.ProjectedPassRate.Should().BeApproximately(24d / 33d, 1e-9);
+        pooled.PValue.Should().BeGreaterThan(0.05,
+            "three replays of an unchanged outcome are not three times the evidence");
+        pooled.Proposal.Should().BeNull();
+    }
 
-        outcome.Proposal.Should().NotBeNull("pooling three samples makes the 5/11 → 8/11 effect provable");
-        outcome.BaselinePassRate.Should().BeApproximately(15d / 33d, 1e-9);
-        outcome.ProjectedPassRate.Should().BeApproximately(24d / 33d, 1e-9);
-        outcome.PValue.Should().BeLessThan(0.05);
+    [TestMethod]
+    public async Task Validate_TheSameEffect_IsJudgedIdenticallyAtOneSampleAndAtThree()
+    {
+        // The property that makes the gate trustworthy: raising AbSampleCount must not change the
+        // verdict on identical per-sample outcomes. Under the pooled test it did — more samples
+        // meant an easier gate, so the setting quietly traded rigour for acceptances.
+        var single = BuildSampled(samples: 1, baselinePassed: Passes(5, 11), candidatePassed: Passes(8, 11));
+        var triple = BuildSampled(samples: 3, baselinePassed: Passes(5, 11), candidatePassed: Passes(8, 11));
+
+        var singleOutcome = await single.Validator.ValidateAsync(single.Theory, CancellationToken);
+        var tripleOutcome = await triple.Validator.ValidateAsync(triple.Theory, CancellationToken);
+
+        tripleOutcome.PValue.Should().BeApproximately(singleOutcome.PValue ?? -1, 1e-12);
+        tripleOutcome.Proposal.Should().BeNull();
+        singleOutcome.Proposal.Should().BeNull();
     }
 
     [TestMethod]
@@ -163,6 +184,9 @@ public async Task Validate_WithoutSignificanceRequirement_StillRejectsARegressio
         outcome.Proposal.Should().BeNull();
     }
 
+    private static Guid[] CaseIds(int count)
+        => Enumerable.Range(0, count).Select(_ => Guid.NewGuid()).ToArray();
+
     private static bool[] Passes(int passed, int total)
         => Enumerable.Range(0, total).Select(i => i < passed).ToArray();
 
@@ -193,8 +217,9 @@ private Fixture Build(bool[] baselinePassed, bool[] candidatePassed)
         theory.ProposedSystemMessage.Returns("You are better.");
         theory.EvidenceTestRunIds.Returns(Array.Empty<Guid>());
 
-        var baselineRun = MakeRun(endpoint, baselinePassed);
-        var candidateRun = MakeRun(endpoint, candidatePassed);
+        var caseIds = CaseIds(caseCount);
+        var baselineRun = MakeRun(endpoint, baselinePassed, caseIds);
+        var candidateRun = MakeRun(endpoint, candidatePassed, caseIds);
         var baselineGroup = GroupReturning(baselineRun);
         var candidateGroup = GroupReturning(candidateRun);
 
@@ -273,8 +298,9 @@ private Fixture BuildSampled(
 
         // Build every substitute BEFORE the Returns() call — NSubstitute cannot configure a
         // substitute while it is resolving the arguments of another one.
-        var baselineRuns = Enumerable.Range(0, samples).Select(_ => MakeRun(endpoint, baselinePassed)).ToList();
-        var candidateRuns = Enumerable.Range(0, samples).Select(_ => MakeRun(endpoint, candidatePassed)).ToList();
+        var caseIds = CaseIds(Math.Max(baselinePassed.Length, candidatePassed.Length));
+        var baselineRuns = Enumerable.Range(0, samples).Select(_ => MakeRun(endpoint, baselinePassed, caseIds)).ToList();
+        var candidateRuns = Enumerable.Range(0, samples).Select(_ => MakeRun(endpoint, candidatePassed, caseIds)).ToList();
         var baselineGroup = GroupReturningMany(baselineRuns);
         var candidateGroup = GroupReturningMany(candidateRuns);
 
@@ -318,14 +344,20 @@ private static ITestRunGroup GroupReturningMany(IReadOnlyList<ITestRun> runs)
         return group;
     }
 
-    private static ITestRun MakeRun(IModelEndpoint endpoint, bool[] passed)
+    // Case ids are supplied by the caller and shared across both arms, because the significance
+    // test is PAIRED on the test case: a result whose TestCase is an unstubbed substitute reports
+    // Guid.Empty, which would collapse every result of a run into one case and leave nothing to pair.
+    private static ITestRun MakeRun(IModelEndpoint endpoint, bool[] passed, IReadOnlyList<Guid> caseIds)
     {
-        var results = passed.Select(p =>
+        var results = passed.Select((p, i) =>
         {
             var ev = Substitute.For<IEvaluation>();
             ev.Passed.Returns(p);
+            var testCase = Substitute.For<ITestCase>();
+            testCase.Id.Returns(caseIds[i]);
             var r = Substitute.For<ITestResult>();
             r.Evaluations.Returns([ev]);
+            r.TestCase.Returns(testCase);
             return r;
         }).ToList();
 
diff --git a/Proxytrace.Application.Tests/TestRunnerServiceTests.cs b/Proxytrace.Application.Tests/TestRunnerServiceTests.cs
index 92ca907ef..aec3d21e2 100644
--- a/Proxytrace.Application.Tests/TestRunnerServiceTests.cs
+++ b/Proxytrace.Application.Tests/TestRunnerServiceTests.cs
@@ -1,3 +1,4 @@
+using System.Collections.Concurrent;
 using System.Reflection;
 using Autofac;
 using AwesomeAssertions;
@@ -140,6 +141,137 @@ private static void RegisterBlockingModelClient(ContainerBuilder builder, TaskCo
         });
     }
 
+    // A model client that reports whether the token it was handed was ever signalled. It announces
+    // `entered` once the run is provably inside the model call, then waits on that token; the wait
+    // is bounded so a run whose cancellation never arrives finishes on its own instead of hanging
+    // the suite — which is exactly what the pre-fix code did with a live, un-cancelled token.
+    private static void RegisterCancellationObservingModelClient(
+        ContainerBuilder builder,
+        AssistantMessage response,
+        TaskCompletionSource entered,
+        TaskCompletionSource tokenSignalled)
+    {
+        builder.Register(ct =>
+        {
+            IModelClient handler = Substitute.For<IModelClient>();
+            var completionFactory = ct.Resolve<ICompletion.Create>();
+            handler.CompleteAsync(Arg.Any<Conversation>(), Arg.Any<ModelOptions>(), Arg.Any<IReadOnlyDictionary<string, string>?>(), Arg.Any<CancellationToken>())
+                .Returns(async call =>
+                {
+                    CancellationToken callToken = call.Arg<CancellationToken>();
+                    entered.TrySetResult();
+                    try
+                    {
+                        await Task.Delay(TimeSpan.FromSeconds(10), callToken);
+                    }
+                    catch (OperationCanceledException)
+                    {
+                        // Recorded before the exception escapes, so a caller that has observed the
+                        // run unwind has necessarily observed this too — no polling, no timing.
+                        tokenSignalled.TrySetResult();
+                        throw;
+                    }
+
+                    return completionFactory(response, null, TimeSpan.FromMilliseconds(1000));
+                });
+            return handler;
+        });
+    }
+
+    [TestMethod]
+    public async Task CancelAsync_WhileGroupIsRunning_SignalsTheInFlightModelCallsToken()
+    {
+        // Regression: ExecuteGroupAsync registers the group's CancellationTokenSource under the
+        // *group* id, but CancelAsync looked it up under each *run* id — the lookup never matched,
+        // so cancelling a group only flipped the database rows while the parallel loop kept issuing
+        // real, billed model calls through to completion.
+        var expectedOutput = new AssistantMessage([Content.FromText(MatchingText)], []);
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var tokenSignalled = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var services = GetServices(config =>
+            RegisterCancellationObservingModelClient(config, expectedOutput, entered, tokenSignalled));
+
+        var suite = await BuildSuiteAsync(services, expectedOutput, CancellationToken);
+        var endpoint = (await CreateEndpoints(services, 1))[0];
+        var runner = services.GetRequiredService<ITestRunnerService>();
+
+        ITestRunGroup? created = null;
+        var runTask = runner.RunInForegroundAsync(
+            suite,
+            [endpoint],
+            isSystemTestRun: true,
+            onGroupCreated: (g, _) => { created = g; return Task.CompletedTask; },
+            cancellationToken: CancellationToken);
+
+        // Deterministic mid-run point: the model call has been entered and is now waiting on its
+        // token, so the cancellation below always lands while the run is genuinely in flight.
+        await entered.Task;
+        if (created is not { } group)
+            throw new InvalidOperationException("onGroupCreated must run before the model call is reached");
+
+        await runner.CancelAsync(group, CancellationToken);
+
+        await FluentActions.Invoking(() => runTask).Should().ThrowAsync<OperationCanceledException>();
+        tokenSignalled.Task.IsCompletedSuccessfully.Should()
+            .BeTrue("cancelling the group must reach the token the in-flight model call is running on");
+    }
+
+    [TestMethod]
+    public async Task CancelAsync_WhileGroupIsRunning_SettlesGroupCancelledWithoutASpuriousCompletion()
+    {
+        // The post-run SetCompleted used to be unguarded: a group already driven terminal by
+        // CancelAsync was pushed into an invalid transition, the InvalidOperationException landed in
+        // the generic handler and was logged as "Test run group failed", and a completion event was
+        // broadcast for a group the user had cancelled.
+        var expectedOutput = new AssistantMessage([Content.FromText(MatchingText)], []);
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var tokenSignalled = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+
+        var broadcaster = Substitute.For<ITestResultBroadcaster>();
+        var groupEvents = new ConcurrentQueue<GroupRunCompleteEvent>();
+        broadcaster.When(b => b.PublishGroupComplete(Arg.Any<GroupRunCompleteEvent>()))
+            .Do(ci =>
+            {
+                var groupEvent = ci.Arg<GroupRunCompleteEvent>();
+                ArgumentNullException.ThrowIfNull(groupEvent);
+                groupEvents.Enqueue(groupEvent);
+            });
+
+        var services = GetServices(config =>
+        {
+            RegisterCancellationObservingModelClient(config, expectedOutput, entered, tokenSignalled);
+            config.RegisterInstance(broadcaster).As<ITestResultBroadcaster>();
+        });
+
+        var suite = await BuildSuiteAsync(services, expectedOutput, CancellationToken);
+        var endpoint = (await CreateEndpoints(services, 1))[0];
+        var runner = services.GetRequiredService<ITestRunnerService>();
+
+        ITestRunGroup? created = null;
+        var runTask = runner.RunInForegroundAsync(
+            suite,
+            [endpoint],
+            isSystemTestRun: true,
+            onGroupCreated: (g, _) => { created = g; return Task.CompletedTask; },
+            cancellationToken: CancellationToken);
+
+        await entered.Task;
+        if (created is not { } group)
+            throw new InvalidOperationException("onGroupCreated must run before the model call is reached");
+
+        await runner.CancelAsync(group, CancellationToken);
+        await FluentActions.Invoking(() => runTask).Should().ThrowAsync<OperationCanceledException>();
+
+        var groups = services.GetRequiredService<ITestRunGroupRepository>();
+        var final = await groups.GetAsync(group.Id, CancellationToken);
+        final.Status.Should().Be(TestRunStatus.Cancelled);
+
+        // Exactly one terminal event, carrying Cancelled: no completion broadcast for a group the
+        // user cancelled, and no duplicate from the execution unwinding alongside the canceller.
+        groupEvents.Should().ContainSingle()
+            .Which.GroupStatus.Should().Be(TestRunStatus.Cancelled);
+    }
+
     [TestMethod]
     public async Task RunInForeground_WhenCancelledMidRun_MarksGroupCancelled()
     {
@@ -686,6 +818,97 @@ public async Task RunInForeground_WhenEveryCaseSucceeds_CompletesTheRun()
         storedRun.TestResults.Should().HaveCount(2);
     }
 
+    [TestMethod]
+    public async Task Run_AcrossNestedParallelLoops_NeverExceedsTheConfiguredDegreeOfModelCalls()
+    {
+        // The runner nests three parallel loops — runs, then that run's test cases, then that
+        // case's evaluators — and each was configured with the same MaxDegreeOfParallelism, so the
+        // setting multiplied instead of capping: at the default of 2 the loops permitted 2×2×2 = 8
+        // concurrent upstream calls. With several endpoints and several cases, the observed peak
+        // must stay within the configured value.
+        const int degree = 2;
+        var expectedOutput = new AssistantMessage([Content.FromText(MatchingText)], []);
+
+        var inFlight = 0;
+        var peak = 0;
+
+        var services = GetServices(config =>
+        {
+            config.RegisterInstance(new TestRunnerConfiguration { MaxDegreeOfParallelism = degree })
+                .As<TestRunnerConfiguration>();
+
+            config.Register(ct =>
+            {
+                IModelClient handler = Substitute.For<IModelClient>();
+                var completionFactory = ct.Resolve<ICompletion.Create>();
+                handler.CompleteAsync(Arg.Any<Conversation>(), Arg.Any<ModelOptions>(), Arg.Any<IReadOnlyDictionary<string, string>?>(), Arg.Any<CancellationToken>())
+                    .Returns(async _ =>
+                    {
+                        int current = Interlocked.Increment(ref inFlight);
+                        // Record the high-water mark without locking: retry until our observed
+                        // value is no longer higher than what is stored.
+                        int observed = Volatile.Read(ref peak);
+                        while (current > observed)
+                        {
+                            int won = Interlocked.CompareExchange(ref peak, current, observed);
+                            if (won == observed) break;
+                            observed = won;
+                        }
+
+                        // Hold the slot long enough for every other loop iteration to pile up, so a
+                        // missing cap shows as a peak above `degree` rather than as lucky timing.
+                        await Task.Delay(TimeSpan.FromMilliseconds(50), CancellationToken);
+                        Interlocked.Decrement(ref inFlight);
+                        return completionFactory(expectedOutput, null, TimeSpan.FromMilliseconds(1));
+                    });
+                return handler;
+            });
+        });
+
+        var suite = await BuildSuiteWithCasesAsync(services, expectedOutput, caseCount: 3, CancellationToken);
+        var endpoints = await CreateEndpoints(services, 3);
+        var runner = services.GetRequiredService<ITestRunnerService>();
+
+        await runner.RunInForegroundAsync(suite, endpoints, isSystemTestRun: true, cancellationToken: CancellationToken);
+
+        Volatile.Read(ref peak).Should().BeLessThanOrEqualTo(degree,
+            "the configured degree is an absolute cap on concurrent model calls, not a per-loop one");
+        Volatile.Read(ref peak).Should().BeGreaterThan(0, "the run must actually have called the model");
+    }
+
+    /// Builds a suite with <paramref name="caseCount"/> test cases, so a run exercises the
+    /// test-case loop nested inside the per-run loop.
+    private static async Task<ITestSuite> BuildSuiteWithCasesAsync(
+        IServiceProvider services,
+        AssistantMessage expectedOutput,
+        int caseCount,
+        CancellationToken ct)
+    {
+        var agentGenerator = services.GetRequiredService<IDomainEntityGenerator<IAgent>>();
+        var evaluatorGenerator = services.GetRequiredService<IDomainEntityGenerator<IExactMatchEvaluator>>();
+        var createTestCase = services.GetRequiredService<ITestCase.CreateNew>();
+        var testCaseRepo = services.GetRequiredService<IRepository<ITestCase>>();
+        var createTestSuite = services.GetRequiredService<ITestSuite.CreateNew>();
+        var testSuiteRepo = services.GetRequiredService<IRepository<ITestSuite>>();
+
+        var agent = await agentGenerator.GetOrCreateAsync(ct);
+        var evaluator = await evaluatorGenerator.CreateAsync(ct);
+
+        var testCases = new List<ITestCase>(caseCount);
+        for (var i = 0; i < caseCount; i++)
+        {
+            var input = Conversation.Create()
+                .With(new UserMessage([Content.FromText($"Question {i}")]));
+            var testCase = createTestCase(input, expectedOutput, sourceAgentCallId: null);
+            await testCaseRepo.AddAsync(testCase, ct);
+            testCases.Add(testCase);
+        }
+
+        var suite = createTestSuite("Parallelism Suite", agent, [evaluator], testCases);
+        await testSuiteRepo.AddAsync(suite, ct);
+        return suite;
+    }
+
     [TestMethod]
     public async Task RunInBackground_WithSampleCountOutOfRange_Throws()
     {
diff --git a/Proxytrace.Application.Tests/UserAdministrationServiceTests.cs b/Proxytrace.Application.Tests/UserAdministrationServiceTests.cs
index cadf0e64b..25460bd7a 100644
--- a/Proxytrace.Application.Tests/UserAdministrationServiceTests.cs
+++ b/Proxytrace.Application.Tests/UserAdministrationServiceTests.cs
@@ -133,9 +133,56 @@ public async Task RemoveAsync_Unknown_ReturnsFalse()
         removed.Should().BeFalse();
     }
 
+    [TestMethod]
+    public async Task RemoveAsync_WhenTheUserOwnsApiKeys_IsRefusedAndKeepsTheUser()
+    {
+        // Deleting a user used to cascade-delete every API key they owned. Only the key hash is
+        // stored, so those keys are unrecoverable — routine offboarding silently revoked live
+        // integrations, which surfaced later as unexplained 401s. The delete is now refused with a
+        // message naming the keys so an operator deals with them deliberately.
+        IServiceProvider services = GetServices(Register);
+        var service = services.GetRequiredService<IUserAdministrationService>();
+        var acting = await CreateUserAsync(services, UserRole.Admin);
+        var target = await CreateUserAsync(services, UserRole.Member);
+        await CreateApiKeyAsync(services, target, "ci-pipeline");
+
+        var act = () => service.RemoveAsync(acting.Id, target.Id, CancellationToken);
+
+        (await act.Should().ThrowAsync<UserAdministrationException>())
+            .Which.Message.Should().Contain("ci-pipeline");
+
+        (await services.GetRequiredService<IRepository<IUser>>().ContainsAsync(target.Id, CancellationToken))
+            .Should().BeTrue("the user must survive a refused deletion");
+    }
+
+    [TestMethod]
+    public async Task RemoveAsync_WhenTheUserOwnsNoApiKeys_StillDeletes()
+    {
+        IServiceProvider services = GetServices(Register);
+        var service = services.GetRequiredService<IUserAdministrationService>();
+        var acting = await CreateUserAsync(services, UserRole.Admin);
+        var target = await CreateUserAsync(services, UserRole.Member);
+
+        var removed = await service.RemoveAsync(acting.Id, target.Id, CancellationToken);
+
+        removed.Should().BeTrue();
+    }
+
     private static void Register(ContainerBuilder builder) =>
         builder.RegisterType<UserAdministrationService>().As<IUserAdministrationService>();
 
+    private async Task CreateApiKeyAsync(IServiceProvider services, IUser owner, string name)
+    {
+        var project = await services.GetRequiredService<IDomainEntityGenerator<Domain.Project.IProject>>()
+            .GetOrCreateAsync(CancellationToken);
+        var provider = await services.GetRequiredService<IDomainEntityGenerator<Domain.ModelProvider.IModelProvider>>()
+            .GetOrCreateAsync(CancellationToken);
+        var create = services.GetRequiredService<Domain.ApiKey.IApiKey.CreateNew>();
+        var key = create(name, $"hash-{Guid.NewGuid():N}", "prefix", project, provider,
+            Domain.ApiKey.ApiKeyScopes.Ingestion, owner);
+        await services.GetRequiredService<Domain.ApiKey.IApiKeyRepository>().AddAsync(key, CancellationToken);
+    }
+
     private async Task<IUser> CreateUserAsync(IServiceProvider services, UserRole role)
     {
         var create = services.GetRequiredService<IUser.CreateNew>();
diff --git a/Proxytrace.Application/Auth/Internal/UserAdministrationService.cs b/Proxytrace.Application/Auth/Internal/UserAdministrationService.cs
index d22e3faeb..83f1ef9e4 100644
--- a/Proxytrace.Application/Auth/Internal/UserAdministrationService.cs
+++ b/Proxytrace.Application/Auth/Internal/UserAdministrationService.cs
@@ -1,3 +1,4 @@
+using Proxytrace.Domain.ApiKey;
 using Proxytrace.Domain.User;
 
 namespace Proxytrace.Application.Auth.Internal;
@@ -5,10 +6,12 @@ namespace Proxytrace.Application.Auth.Internal;
 internal sealed class UserAdministrationService : IUserAdministrationService
 {
     private readonly IUserRepository users;
+    private readonly IApiKeyRepository apiKeys;
 
-    public UserAdministrationService(IUserRepository users)
+    public UserAdministrationService(IUserRepository users, IApiKeyRepository apiKeys)
     {
         this.users = users;
+        this.apiKeys = apiKeys;
     }
 
     public async Task<IUser?> ChangeRoleAsync(
@@ -49,6 +52,20 @@ public async Task<bool> RemoveAsync(
         if (target.Role == UserRole.Admin && await IsLastAdminAsync(cancellationToken))
             throw new UserAdministrationException("At least one Admin must remain.");
 
+        // Keys owned by this user used to be cascade-deleted along with them. Only the hash is
+        // stored, so those keys are unrecoverable — offboarding an admin who happened to mint an
+        // integration key silently revoked it, and the failure surfaced later as unexplained 401s in
+        // whatever was using it. The FK is now Restrict, so this check turns what would be an opaque
+        // database error into an actionable 409 naming the keys to deal with first.
+        var ownedKeys = await apiKeys.GetKeyNamesByOwnerAsync(targetUserId, cancellationToken);
+        if (ownedKeys.Count > 0)
+        {
+            throw new UserAdministrationException(
+                $"This user owns {ownedKeys.Count} API key(s): {string.Join(", ", ownedKeys)}. "
+                + "Delete or reassign them before deleting the user — an API key cannot be recovered "
+                + "once removed, and anything using it will stop working.");
+        }
+
         return await users.RemoveAsync(targetUserId, cancellationToken);
     }
 
diff --git a/Proxytrace.Application/Auth/Local/IPasswordService.cs b/Proxytrace.Application/Auth/Local/IPasswordService.cs
index d7589f9d2..59ebc4332 100644
--- a/Proxytrace.Application/Auth/Local/IPasswordService.cs
+++ b/Proxytrace.Application/Auth/Local/IPasswordService.cs
@@ -6,4 +6,18 @@ public interface IPasswordService
 {
     string Hash(IUser user, string password);
     bool Verify(IUser user, string hash, string password);
+
+    /// <summary>
+    /// Runs a full password verification against a fixed, unknowable dummy hash and discards the
+    /// result. Call this on paths that bail out <b>before</b> reaching <see cref="Verify"/> — above
+    /// all "no such user" — so the work done, and therefore the response time, does not disclose
+    /// whether the account exists.
+    /// </summary>
+    /// <remarks>
+    /// Verification is PBKDF2 with a high iteration count, so skipping it is measurable from the
+    /// outside: an unknown email returned in a fraction of the time a known one took, which is a
+    /// user-enumeration oracle. Rate limiting raises the cost of exploiting that but does not
+    /// close it.
+    /// </remarks>
+    void VerifyDummy(string password);
 }
diff --git a/Proxytrace.Application/Auth/Local/Internal/InviteService.cs b/Proxytrace.Application/Auth/Local/Internal/InviteService.cs
index 4609ce783..b688ce9d9 100644
--- a/Proxytrace.Application/Auth/Local/Internal/InviteService.cs
+++ b/Proxytrace.Application/Auth/Local/Internal/InviteService.cs
@@ -1,3 +1,4 @@
+using Proxytrace.Common.Async;
 using System.Security.Cryptography;
 using Proxytrace.Domain.Security;
 using Proxytrace.Domain;
@@ -17,6 +18,10 @@ internal sealed class InviteService : IInviteService
     private readonly IInvite.CreateNew createInvite;
     private readonly IUser.CreateNew createUser;
     private readonly IPasswordService passwords;
+    private readonly IAsyncLock asyncLock;
+
+    /// <summary>Lock key serializing the licensed-seat check against the invite it authorises.</summary>
+    private const string UserQuotaLockKey = "license-quota:users";
     private readonly ITransaction transaction;
     private readonly ILicenseService license;
     private readonly ISecretHasher hasher;
@@ -27,6 +32,7 @@ public InviteService(
         IInvite.CreateNew createInvite,
         IUser.CreateNew createUser,
         IPasswordService passwords,
+        IAsyncLock asyncLock,
         ITransaction transaction,
         ILicenseService license,
         ISecretHasher hasher)
@@ -36,6 +42,7 @@ public InviteService(
         this.createInvite = createInvite;
         this.createUser = createUser;
         this.passwords = passwords;
+        this.asyncLock = asyncLock;
         this.transaction = transaction;
         this.license = license;
         this.hasher = hasher;
@@ -47,6 +54,10 @@ public async Task<InviteCreated> CreateAsync(
         IUser invitedBy,
         CancellationToken cancellationToken = default)
     {
+        // Held for the rest of the method: the count and the invite it authorises are check-then-act,
+        // so two concurrent invites both used to observe the pre-invite user count and both proceed,
+        // taking an install past its licensed seat limit. Per-process, like the other quota locks.
+        using IDisposable quotaLock = await asyncLock.LockAsync(UserQuotaLockKey, cancellationToken);
         license.Ensure(LicenseLimit.MaxUsers, await users.CountAsync(cancellationToken));
 
         // Persist only the hash of the token; the raw value is returned once so the caller can build
diff --git a/Proxytrace.Application/Auth/Local/Internal/LoginService.cs b/Proxytrace.Application/Auth/Local/Internal/LoginService.cs
index b52c00bc2..0deb63cc6 100644
--- a/Proxytrace.Application/Auth/Local/Internal/LoginService.cs
+++ b/Proxytrace.Application/Auth/Local/Internal/LoginService.cs
@@ -30,6 +30,10 @@ public LoginService(
         var user = await users.FindByEmailAsync(email, cancellationToken);
         if (user is null || string.IsNullOrEmpty(user.PasswordHash))
         {
+            // Spend the same PBKDF2 cost the found-user path spends below. Returning here without
+            // hashing made an unknown email answer in a fraction of the time a known one took,
+            // disclosing which addresses have accounts (a user-enumeration oracle).
+            passwords.VerifyDummy(password);
             return null;
         }
 
diff --git a/Proxytrace.Application/Auth/Local/Internal/MfaService.cs b/Proxytrace.Application/Auth/Local/Internal/MfaService.cs
index a8bc4b0c6..71fc626b3 100644
--- a/Proxytrace.Application/Auth/Local/Internal/MfaService.cs
+++ b/Proxytrace.Application/Auth/Local/Internal/MfaService.cs
@@ -1,5 +1,6 @@
 using System.Data.Common;
 using System.Security.Cryptography;
+using System.Text;
 using Proxytrace.Domain.Security;
 using Proxytrace.Domain;
 using Proxytrace.Domain.MfaBackupCode;
@@ -132,7 +133,7 @@ private static bool IsPerUserUniqueViolation(Exception ex)
         return await transaction.InvokeAsync<IReadOnlyList<string>>(async () =>
         {
             await enrollment.Confirm(matchedStep, cancellationToken);
-            var (display, hashes) = GenerateBackupCodes();
+            var (display, hashes) = GenerateBackupCodes(user);
             foreach (var hash in hashes)
             {
                 await createBackupCode(user, hash).AddAsync(cancellationToken);
@@ -182,8 +183,8 @@ public Task<bool> AdminDisableAsync(Guid userId, CancellationToken cancellationT
         var normalized = NormalizeBackupCode(code);
         if (normalized.Length > 0)
         {
-            var backup = await backupCodes.FindByCodeHashAsync(user.Id, hasher.Hash(normalized), cancellationToken);
-            if (backup is { IsConsumed: false })
+            var backup = await FindMatchingBackupCodeAsync(user, normalized, cancellationToken);
+            if (backup is not null)
             {
                 await backup.MarkConsumedAsync(cancellationToken);
                 challenges.Consume(challengeToken);
@@ -195,6 +196,67 @@ public Task<bool> AdminDisableAsync(Guid userId, CancellationToken cancellationT
         return null;
     }
 
+    /// <summary>
+    /// Finds the user's unconsumed backup code matching <paramref name="normalized"/>, or
+    /// <see langword="null"/>.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Codes are hashed with a <b>per-code salt</b>, so there is no hash to look the row up by —
+    /// the candidates have to be loaded and verified one at a time. That is the point: the previous
+    /// single-round unsalted SHA-256 supported a direct indexed lookup precisely because every code
+    /// in the installation hashed under the same function, which is what let one dump be attacked
+    /// against every user's codes simultaneously.
+    /// </para>
+    /// <para>
+    /// The scan is bounded by <see cref="BackupCodeCount"/> (10) and only runs after a TOTP code has
+    /// already failed, so the added verification cost lands on a rare recovery path, never on the
+    /// normal login. Consumed codes are filtered out first so a redeemed code is never re-verified.
+    /// </para>
+    /// </remarks>
+    private async Task<IMfaBackupCode?> FindMatchingBackupCodeAsync(
+        IUser user,
+        string normalized,
+        CancellationToken cancellationToken)
+    {
+        var candidates = await backupCodes.ListByUserAsync(user.Id, cancellationToken);
+        foreach (var candidate in candidates)
+        {
+            if (candidate.IsConsumed)
+            {
+                continue;
+            }
+
+            if (Matches(user, candidate.CodeHash, normalized))
+            {
+                return candidate;
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// Verifies a presented code against a stored hash, accepting both the current salted PBKDF2
+    /// form and the legacy unsalted SHA-256 that predates it.
+    /// </summary>
+    /// <remarks>
+    /// Legacy rows are not rewritten: the raw code is unrecoverable, so a stored hash can only be
+    /// upgraded when the user redeems it — and redeeming consumes it, leaving nothing to upgrade.
+    /// Existing codes therefore keep working until they are used or the user regenerates them by
+    /// re-enrolling; only newly issued batches get the stronger hash.
+    /// </remarks>
+    private bool Matches(IUser user, string storedHash, string normalized)
+        => IsLegacySha256(storedHash)
+            ? CryptographicOperations.FixedTimeEquals(
+                Encoding.UTF8.GetBytes(storedHash),
+                Encoding.UTF8.GetBytes(hasher.Hash(normalized)))
+            : passwords.Verify(user, storedHash, normalized);
+
+    // A hex SHA-256 is exactly 64 hex characters; the PBKDF2 form is base64 and longer.
+    private static bool IsLegacySha256(string storedHash)
+        => storedHash.Length == 64 && storedHash.All(Uri.IsHexDigit);
+
     private Task<bool> RemoveEnrollmentAsync(Guid userId, CancellationToken cancellationToken)
         => transaction.InvokeAsync(async () =>
         {
@@ -221,7 +283,18 @@ private LoginResult Issue(IUser user)
         return new LoginResult(user, issued.Token, issued.ExpiresAt);
     }
 
-    private (IReadOnlyList<string> Display, IReadOnlyList<string> Hashes) GenerateBackupCodes()
+    /// <summary>
+    /// Mints a fresh batch of backup codes, returning the display forms (shown once) and the hashes
+    /// to store.
+    /// </summary>
+    /// <remarks>
+    /// Hashed through <see cref="IPasswordService"/> — PBKDF2 with a per-code salt — rather than the
+    /// unkeyed <see cref="ISecretHasher"/> used for Proxytrace's own 256-bit CSPRNG secrets. A code
+    /// is ~50 bits, sized to be typed by a human, which is well within reach of a GPU rig against a
+    /// single-round unsalted hash; and because that hash was the same function for everyone, one
+    /// dump could be attacked against every user's codes at once.
+    /// </remarks>
+    private (IReadOnlyList<string> Display, IReadOnlyList<string> Hashes) GenerateBackupCodes(IUser user)
     {
         var display = new List<string>(BackupCodeCount);
         var hashes = new List<string>(BackupCodeCount);
@@ -229,7 +302,7 @@ private LoginResult Issue(IUser user)
         {
             var raw = RandomCode(BackupCodeChars);
             display.Add($"{raw[..5]}-{raw[5..]}");
-            hashes.Add(hasher.Hash(raw));
+            hashes.Add(passwords.Hash(user, raw));
         }
         return (display, hashes);
     }
diff --git a/Proxytrace.Application/Auth/Local/Internal/PasswordResetService.cs b/Proxytrace.Application/Auth/Local/Internal/PasswordResetService.cs
index f17a8cf47..d8eec8dcf 100644
--- a/Proxytrace.Application/Auth/Local/Internal/PasswordResetService.cs
+++ b/Proxytrace.Application/Auth/Local/Internal/PasswordResetService.cs
@@ -9,6 +9,7 @@
 using Proxytrace.Domain.PasswordResetToken;
 using Proxytrace.Domain.User;
 using Proxytrace.Domain.UserTotpEnrollment;
+using Proxytrace.Common.Text;
 
 namespace Proxytrace.Application.Auth.Local.Internal;
 
@@ -119,7 +120,7 @@ private void LogResetLinkFallback(IUser user, IssuedReset issued, int minutes, s
                 "logging is enabled — one-time link (valid {Minutes} min): {ResetUrl}. Hand it to the " +
                 "user over a trusted channel; anyone who can read this log within the TTL can take over " +
                 "the account.",
-                user.Email, reason, minutes, issued.ResetLink.Link);
+                user.Email.ToSingleLogLine(), reason, minutes, issued.ResetLink.Link.ToSingleLogLine());
             return;
         }
 
@@ -128,7 +129,7 @@ private void LogResetLinkFallback(IUser user, IssuedReset issued, int minutes, s
             "Password reset for {Email} could not be emailed ({Reason}). The one-time reset link " +
             "(valid {Minutes} min, token {TokenHint}…) is NOT logged. To recover a locked-out account " +
             "when email is down, set Authentication:EmergencyLogResetLink=true and retry to log the full link.",
-            user.Email, reason, minutes, TokenHint(issued.TokenHash));
+            user.Email.ToSingleLogLine(), reason, minutes, TokenHint(issued.TokenHash));
     }
 
     public async Task<PasswordResetLink?> IssueResetLinkAsync(Guid userId, Func<string, string> buildResetUrl, CancellationToken cancellationToken = default)
diff --git a/Proxytrace.Application/Auth/Local/Internal/PasswordService.cs b/Proxytrace.Application/Auth/Local/Internal/PasswordService.cs
index 351d3d3a4..7672ee179 100644
--- a/Proxytrace.Application/Auth/Local/Internal/PasswordService.cs
+++ b/Proxytrace.Application/Auth/Local/Internal/PasswordService.cs
@@ -1,3 +1,4 @@
+using System.Security.Cryptography;
 using Microsoft.AspNetCore.Identity;
 using Proxytrace.Domain.User;
 
@@ -5,9 +6,23 @@ namespace Proxytrace.Application.Auth.Local.Internal;
 
 internal sealed class PasswordService : IPasswordService
 {
-    private readonly PasswordHasher<IUser> hasher = new();
+    // Typed as object rather than IUser: the identity hasher never reads the user (it is a pure
+    // PBKDF2 over the password with a salt embedded in the hash), and dropping the constraint lets
+    // VerifyDummy spend the same cost without inventing a fake IUser. The hash format is unchanged,
+    // so existing stored hashes keep verifying.
+    private readonly PasswordHasher<object> hasher = new();
 
-    public string Hash(IUser user, string password) 
+    private static readonly object Sentinel = new();
+
+    // A hash of a random password nobody can supply, computed once per process and only when first
+    // needed. Verifying against it costs the same PBKDF2 work as verifying a real user's hash.
+    private static readonly Lazy<string> DummyHash = new(
+        () => new PasswordHasher<object>().HashPassword(
+            Sentinel,
+            Convert.ToHexString(RandomNumberGenerator.GetBytes(32))),
+        LazyThreadSafetyMode.ExecutionAndPublication);
+
+    public string Hash(IUser user, string password)
         => hasher.HashPassword(user, password);
 
     public bool Verify(IUser user, string hash, string password)
@@ -15,4 +30,11 @@ public bool Verify(IUser user, string hash, string password)
         var result = hasher.VerifyHashedPassword(user, hash, password);
         return result is PasswordVerificationResult.Success or PasswordVerificationResult.SuccessRehashNeeded;
     }
+
+    public void VerifyDummy(string password)
+    {
+        // The result is deliberately unused — only the elapsed work matters. The call is not
+        // elidable: VerifyHashedPassword allocates and runs the full key derivation.
+        _ = hasher.VerifyHashedPassword(Sentinel, DummyHash.Value, password);
+    }
 }
diff --git a/Proxytrace.Application/Demo/Scenarios/OptimizationProposalSeedScenario.cs b/Proxytrace.Application/Demo/Scenarios/OptimizationProposalSeedScenario.cs
index 2830d370c..1833d1e5b 100644
--- a/Proxytrace.Application/Demo/Scenarios/OptimizationProposalSeedScenario.cs
+++ b/Proxytrace.Application/Demo/Scenarios/OptimizationProposalSeedScenario.cs
@@ -174,6 +174,25 @@ public async Task SeedAsync(CancellationToken cancellationToken)
                     evidence,
                     ab)),
 
+            // Backs the validated triage taxonomy theory (OptimizationTheorySeedScenario): the
+            // prompt fix the loop measured for the defective agent, waiting on a promote decision.
+            new(
+                SelectAgent: c => c.RequireEmailTriageAgent(),
+                Status: ProposalStatus.Draft,
+                BuildDraft: (_, agent, evidence, ab) => createSystemPrompt(
+                    agent,
+                    Priority.Critical,
+                    "The prompt defines no category taxonomy and no priority rules, so the model invents both. "
+                    + "Pinning an explicit taxonomy and P1–P4 definitions recovers most of the failing cases.",
+                    "You are an email triage assistant for a SaaS company. Classify every email into exactly one "
+                    + "of: Outage, Bug, Billing, Compliance, Account Access, Feature Request, How-To. Assign "
+                    + "priority P1 (outage, data loss, legal deadline) to P4 (nice-to-have). Escalate P1 immediately. "
+                    + "Never state plan or billing details you have not looked up.",
+                    0.25,
+                    0.62,
+                    evidence,
+                    ab)),
+
             new(
                 SelectAgent: c => c.RequireCodeReviewAgent(),
                 Status: ProposalStatus.Draft,
diff --git a/Proxytrace.Application/Demo/Scenarios/OptimizationTheorySeedScenario.cs b/Proxytrace.Application/Demo/Scenarios/OptimizationTheorySeedScenario.cs
index 1b3d3aea0..9b8894651 100644
--- a/Proxytrace.Application/Demo/Scenarios/OptimizationTheorySeedScenario.cs
+++ b/Proxytrace.Application/Demo/Scenarios/OptimizationTheorySeedScenario.cs
@@ -14,6 +14,12 @@ namespace Proxytrace.Application.Demo.Scenarios;
 /// Seeds the optimization-theory pipeline so the proposals board shows hypotheses spread across
 /// every lifecycle column. Validated theories link to the Draft proposals seeded just before
 /// (Order 40) so the board's "Promote" action has a real target.
+/// <para>
+/// No theory is seeded <see cref="TheoryStatus.Validating"/>: the kiosk skips the validation
+/// queue's restart recovery (see <c>TheoryValidationService.RecoverInFlightTheoriesAsync</c>), so
+/// such a theory would sit mid-A/B forever — a pulsing "A/B in flight" row and a progress bar that
+/// never resolves. Every theory here is either queued (Proposed) or already decided.
+/// </para>
 /// </summary>
 internal sealed class OptimizationTheorySeedScenario : IDemoScenario
 {
@@ -86,26 +92,6 @@ [new ToolSpecification(
                 arguments: ToolArguments.None)],
             EvidenceFor(triage)), TheoryStatus.Proposed, cancellationToken);
 
-        // ── Validating: A/B test in flight ────────────────────────────────────────────────
-        await SeedAsync(createSystemPrompt(
-            triage, SuiteFor(triage), TheorySource.Optimizer, Priority.Critical,
-            "The prompt defines no category taxonomy and no priority rules, so the model invents both. "
-            + "Pinning an explicit taxonomy and P1–P4 definitions should recover the failing cases.",
-            "You are an email triage assistant for a SaaS company. Classify every email into exactly one "
-            + "of: Outage, Bug, Billing, Compliance, Account Access, Feature Request, How-To. Assign "
-            + "priority P1 (outage, data loss, legal deadline) to P4 (nice-to-have). Escalate P1 immediately. "
-            + "Never state plan or billing details you have not looked up.",
-            EvidenceFor(triage)), TheoryStatus.Validating, cancellationToken);
-
-        await SeedAsync(createToolUpdate(
-            support, SuiteFor(support), TheorySource.TraceyAi, Priority.High,
-            "Giving the agent a typed lookup_shipping_carrier tool will eliminate fabricated carrier tracking instructions.",
-            [new ToolSpecification(
-                name: "lookup_shipping_carrier",
-                description: "Resolve the carrier and tracking URL for a shipment id.",
-                arguments: ToolArguments.None)],
-            EvidenceFor(support)), TheoryStatus.Validating, cancellationToken);
-
         // ── Validated: confirmed, ready to ship ───────────────────────────────────────────
         await SeedAsync(createSystemPrompt(
             support, SuiteFor(support), TheorySource.Optimizer, Priority.High,
@@ -123,12 +109,35 @@ await SeedAsync(createSystemPrompt(
             EvidenceFor(support)),
             TheoryStatus.Validated, cancellationToken, baseline: 0.71, projected: 0.78, pValue: 0.03);
 
+        // The defective triage agent's fix, measured: it backs the Draft triage prompt proposal
+        // seeded at Order 40 and is the board's headline "needs decision" row.
+        await SeedAsync(createSystemPrompt(
+            triage, SuiteFor(triage), TheorySource.Optimizer, Priority.Critical,
+            "The prompt defines no category taxonomy and no priority rules, so the model invents both. "
+            + "Pinning an explicit taxonomy and P1–P4 definitions should recover the failing cases.",
+            "You are an email triage assistant for a SaaS company. Classify every email into exactly one "
+            + "of: Outage, Bug, Billing, Compliance, Account Access, Feature Request, How-To. Assign "
+            + "priority P1 (outage, data loss, legal deadline) to P4 (nice-to-have). Escalate P1 immediately. "
+            + "Never state plan or billing details you have not looked up.",
+            EvidenceFor(triage)),
+            TheoryStatus.Validated, cancellationToken, baseline: 0.25, projected: 0.62, pValue: 0.01);
+
         // ── Rejected: disproven by A/B ────────────────────────────────────────────────────
         await SeedAsync(createModelSwitch(
             analytics, SuiteFor(analytics), TheorySource.Optimizer, Priority.Low,
             "Lowering temperature 0.7 → 0.2 will make repeated classifications consistent.",
             ctx.RequireGpt54MiniEndpoint(), EvidenceFor(analytics)),
             TheoryStatus.Invalidated, cancellationToken, baseline: 0.89, projected: 0.90, pValue: 0.41);
+
+        await SeedAsync(createToolUpdate(
+            support, SuiteFor(support), TheorySource.TraceyAi, Priority.High,
+            "Giving the agent a typed lookup_shipping_carrier tool will eliminate fabricated carrier tracking instructions.",
+            [new ToolSpecification(
+                name: "lookup_shipping_carrier",
+                description: "Resolve the carrier and tracking URL for a shipment id.",
+                arguments: ToolArguments.None)],
+            EvidenceFor(support)),
+            TheoryStatus.Invalidated, cancellationToken, baseline: 0.83, projected: 0.84, pValue: 0.52);
     }
 
     private ITestSuite SuiteFor(IAgent agent)
diff --git a/Proxytrace.Application/Demo/Scenarios/StatisticsBackfillScenario.cs b/Proxytrace.Application/Demo/Scenarios/StatisticsBackfillScenario.cs
index 0e6c8c0c3..60b9a58b5 100644
--- a/Proxytrace.Application/Demo/Scenarios/StatisticsBackfillScenario.cs
+++ b/Proxytrace.Application/Demo/Scenarios/StatisticsBackfillScenario.cs
@@ -608,6 +608,7 @@ private async Task BackdateGroupAsync(
             isSystemRun: fresh.IsSystemRun,
             scheduleId: fresh.ScheduleId,
             sampleCount: fresh.SampleCount,
+            optimizationConsideredAt: fresh.OptimizationConsideredAt,
             existing: new BackdatedData(fresh.Id, groupTime, fresh.UpdatedAt));
         await backdatedGroup.UpdateAsync(cancellationToken);
     }
diff --git a/Proxytrace.Application/Demo/Scenarios/TestRunSeedScenario.cs b/Proxytrace.Application/Demo/Scenarios/TestRunSeedScenario.cs
index da2bbab6c..038e3e9f2 100644
--- a/Proxytrace.Application/Demo/Scenarios/TestRunSeedScenario.cs
+++ b/Proxytrace.Application/Demo/Scenarios/TestRunSeedScenario.cs
@@ -156,6 +156,10 @@ private Task<ITestRunGroup> SeedCompletedGroupAsync(
                 completedAt: now,
                 isSystemRun: isSystemRun,
                 scheduleId: null,
+                // Marked as already considered: these groups are seeded terminal, so the optimizer's
+                // restart recovery would otherwise treat every demo group as an unprocessed backlog
+                // and fire a real A/B run (and real LLM spend) on every boot.
+                optimizationConsideredAt: now,
                 sampleCount: 1,
                 existing: new SeedData(Guid.NewGuid(), now, now))
             .AddAsync(cancellationToken);
@@ -250,6 +254,7 @@ private async Task SeedFailedToneGroupAsync(CancellationToken cancellationToken)
                 status: TestRunStatus.Failed,
                 completedAt: now,
                 isSystemRun: false,
+                optimizationConsideredAt: now,
                 scheduleId: null,
                 sampleCount: 1,
                 existing: new SeedData(Guid.NewGuid(), now, now))
@@ -279,6 +284,9 @@ private async Task SeedAbCandidateRunsAsync(CancellationToken cancellationToken)
         {
             ("customer-support-tone", c => c.RequireGpt54Endpoint(), 0.90),
             ("data-analytics-queries", c => c.RequireGpt54MiniEndpoint(), 0.88),
+            // The triage candidate stays on the cheap model: the theory it backs rewrites the
+            // system prompt (pinning a taxonomy), it does not switch the endpoint.
+            ("email-triage-priority", c => c.RequireGpt54MiniEndpoint(), 0.62),
         };
 
         foreach (var (suiteKey, selectEndpoint, passRate) in candidates)
diff --git a/Proxytrace.Application/Ingestion/ITraceQuotaGuard.cs b/Proxytrace.Application/Ingestion/ITraceQuotaGuard.cs
index bfdeda651..36f0657e5 100644
--- a/Proxytrace.Application/Ingestion/ITraceQuotaGuard.cs
+++ b/Proxytrace.Application/Ingestion/ITraceQuotaGuard.cs
@@ -7,7 +7,31 @@ namespace Proxytrace.Application.Ingestion;
 public interface ITraceQuotaGuard
 {
     /// <summary>
-    /// True when the number of traces captured this month meets or exceeds the licensed limit.
+    /// True when the installation as a whole has reached its licensed monthly trace limit.
     /// </summary>
+    /// <remarks>
+    /// This is the <b>installation</b> view, and it is not the right question to ask before dropping
+    /// a specific trace — use <see cref="IsOverQuota"/> for that. Being at the cap install-wide does
+    /// not mean every project should stop capturing; see the fair-share rule there.
+    /// </remarks>
     bool IsCurrentMonthOverQuota { get; }
+
+    /// <summary>
+    /// True when a trace belonging to <paramref name="projectId"/> should be dropped.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The licensed limit is installation-wide, but enforcing it as a single global switch meant one
+    /// busy project could consume the whole month's allowance and silently stop capture for every
+    /// other project — including projects that had ingested almost nothing.
+    /// </para>
+    /// <para>
+    /// The limit therefore stays global while the <i>drop decision</i> is per project: once the
+    /// installation is at its cap, a project is dropped only while it sits above its equal share of
+    /// that cap. Since the total is at or over the cap, at least one project must be above its
+    /// share, so the licensed limit still binds — but the projects consuming it are the ones
+    /// throttled, and a quiet project keeps capturing.
+    /// </para>
+    /// </remarks>
+    bool IsOverQuota(Guid projectId);
 }
diff --git a/Proxytrace.Application/Ingestion/Internal/IngestionExecutor.cs b/Proxytrace.Application/Ingestion/Internal/IngestionExecutor.cs
index 71a6f1dd1..05f0bdaec 100644
--- a/Proxytrace.Application/Ingestion/Internal/IngestionExecutor.cs
+++ b/Proxytrace.Application/Ingestion/Internal/IngestionExecutor.cs
@@ -38,7 +38,13 @@ public async Task IngestAsync(IngestMessage message, CancellationToken cancellat
     {
         // Once the licensed monthly trace quota is reached, drop further captures rather than
         // persisting them. (The stream consumer still acks the dropped envelope to avoid redelivery.)
-        if (quotaGuard.IsCurrentMonthOverQuota)
+        //
+        // Asked PER PROJECT, not installation-wide: the cap is global, but applying it as one switch
+        // let a single busy project consume the month's allowance and silently stop capture for
+        // every other project. Only projects above their share of the cap are dropped. The guard
+        // raises a notification and logs at Error when a project starts being throttled, so this is
+        // no longer invisible to the operator.
+        if (quotaGuard.IsOverQuota(message.ProjectId))
         {
             logger.LogWarning("Monthly trace quota exceeded; dropping captured call for project {ProjectId}", message.ProjectId);
             return;
diff --git a/Proxytrace.Application/Ingestion/Internal/TraceQuotaGuard.cs b/Proxytrace.Application/Ingestion/Internal/TraceQuotaGuard.cs
index 34aa129cb..4e7ee29a9 100644
--- a/Proxytrace.Application/Ingestion/Internal/TraceQuotaGuard.cs
+++ b/Proxytrace.Application/Ingestion/Internal/TraceQuotaGuard.cs
@@ -1,41 +1,97 @@
+using System.Collections.Concurrent;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
+using Proxytrace.Application.Notifications;
 using Proxytrace.Common.Time;
 using Proxytrace.Domain.AgentCall;
+using Proxytrace.Domain.Notification;
+using Proxytrace.Domain.Project;
 using Proxytrace.Licensing;
 
 namespace Proxytrace.Application.Ingestion.Internal;
 
 /// <summary>
 /// Periodically recomputes whether the current calendar month's trace count has exceeded the
-/// licensed <see cref="LicenseLimit.MaxTracesPerMonth"/> cap. Ingestion reads the cached flag to
-/// decide whether to drop incoming traces, avoiding a database count on every captured call.
+/// licensed <see cref="LicenseLimit.MaxTracesPerMonth"/> cap, per project as well as overall.
+/// Ingestion reads the cached decision to decide whether to drop an incoming trace, avoiding a
+/// database count on every captured call.
 /// </summary>
+/// <remarks>
+/// <para>
+/// The cap is installation-wide, but the drop decision is not: enforcing it as one global switch let
+/// a single busy project consume the whole month's allowance and silently stop capture for every
+/// other project. Counts are therefore tracked per project and the decision applies a fair-share
+/// rule — see <see cref="ITraceQuotaGuard.IsOverQuota"/>.
+/// </para>
+/// <para>
+/// Dropping is also no longer silent. A dropped trace is acknowledged to the client (there is
+/// nothing useful it could do with a rejection, and failing the proxied call would take the caller's
+/// application down over a billing limit), so without something surfacing it, an operator's only
+/// symptom was traces quietly going missing. Entering the dropping state raises a notification and
+/// logs at Error, which is what the operator Error Log captures.
+/// </para>
+/// </remarks>
 internal sealed class TraceQuotaGuard : BackgroundService, ITraceQuotaGuard
 {
     private static readonly TimeSpan RecomputeInterval = TimeSpan.FromMinutes(5);
 
+    // Near the cap the ordinary interval is far too coarse — a busy install can ingest a long way
+    // past the limit inside five minutes. Once usage is close, recompute far more often.
+    private static readonly TimeSpan NearLimitRecomputeInterval = TimeSpan.FromSeconds(30);
+    private const double NearLimitFraction = 0.9;
+
     private readonly IAgentCallRepository agentCalls;
+    private readonly IProjectRepository projects;
     private readonly ILicenseService licenseService;
+    private readonly INotificationService notifications;
     private readonly IClock clock;
     private readonly ILogger<TraceQuotaGuard> logger;
 
     private volatile bool overQuota;
 
+    // Per-project month counts and the fair share each is measured against. Replaced wholesale on
+    // each recompute, so a reader never sees a half-updated map.
+    private volatile IReadOnlyDictionary<Guid, long> projectCounts = new Dictionary<Guid, long>();
+    private long fairShare = long.MaxValue;
+
+    // Projects already reported as throttled this month, so the notification fires on entering the
+    // state rather than on every recompute for as long as it lasts.
+    private readonly ConcurrentDictionary<Guid, string> reportedProjects = new();
+    private string reportedMonth = string.Empty;
+
     public TraceQuotaGuard(
         IAgentCallRepository agentCalls,
+        IProjectRepository projects,
         ILicenseService licenseService,
+        INotificationService notifications,
         IClock clock,
         ILogger<TraceQuotaGuard> logger)
     {
         this.agentCalls = agentCalls;
+        this.projects = projects;
         this.licenseService = licenseService;
+        this.notifications = notifications;
         this.clock = clock;
         this.logger = logger;
     }
 
     public bool IsCurrentMonthOverQuota => overQuota;
 
+    public bool IsOverQuota(Guid projectId)
+    {
+        if (!overQuota)
+        {
+            return false;
+        }
+
+        long share = Interlocked.Read(ref fairShare);
+
+        // A project with no counted traces yet is never the one to throttle. Unknown ids (a project
+        // created since the last recompute) land here too, which is the right way round: a brand-new
+        // project has consumed nothing.
+        return projectCounts.TryGetValue(projectId, out long count) && count >= share;
+    }
+
     protected override async Task ExecuteAsync(CancellationToken cancellationToken)
     {
         await RecomputeAsync(cancellationToken);
@@ -44,7 +100,7 @@ protected override async Task ExecuteAsync(CancellationToken cancellationToken)
         {
             try
             {
-                await Task.Delay(RecomputeInterval, cancellationToken);
+                await Task.Delay(NextInterval(), cancellationToken);
             }
             catch (OperationCanceledException)
             {
@@ -55,6 +111,20 @@ protected override async Task ExecuteAsync(CancellationToken cancellationToken)
         }
     }
 
+    /// <summary>Poll faster the closer the installation is to its cap.</summary>
+    private TimeSpan NextInterval()
+    {
+        long share = Interlocked.Read(ref fairShare);
+        if (share == long.MaxValue)
+        {
+            return RecomputeInterval;
+        }
+
+        long total = projectCounts.Values.Sum();
+        long limit = share * Math.Max(1, projectCounts.Count);
+        return total >= limit * NearLimitFraction ? NearLimitRecomputeInterval : RecomputeInterval;
+    }
+
     private async Task RecomputeAsync(CancellationToken cancellationToken)
     {
         try
@@ -63,6 +133,8 @@ private async Task RecomputeAsync(CancellationToken cancellationToken)
             if (limit == long.MaxValue)
             {
                 overQuota = false;
+                projectCounts = new Dictionary<Guid, long>();
+                Interlocked.Exchange(ref fairShare, long.MaxValue);
                 return;
             }
 
@@ -75,15 +147,114 @@ private async Task RecomputeAsync(CancellationToken cancellationToken)
                 pageSize: 1,
                 cancellationToken);
 
-            var nowOverQuota = total >= limit;
-            if (nowOverQuota && !overQuota)
-                logger.LogWarning("Monthly trace quota reached ({Total}/{Limit}); dropping further traces", total, limit);
+            // Per-project counts reuse the same filtered count the installation total uses, one call
+            // per project. Projects are few (they are themselves licence-limited) and this runs on a
+            // timer rather than per request, so a handful of counts is cheaper than a bespoke
+            // multi-join aggregate — the trace row has no project column, the project is reached
+            // through AgentVersion → Agent.
+            var allProjects = await projects.GetAllAsync(cancellationToken);
+            var counts = new Dictionary<Guid, long>(allProjects.Count);
+            foreach (var project in allProjects)
+            {
+                var (_, projectTotal) = await agentCalls.GetFilteredAsync(
+                    new AgentCallFilter(From: monthStart, ProjectId: project.Id),
+                    page: 1,
+                    pageSize: 1,
+                    cancellationToken);
+                counts[project.Id] = projectTotal;
+            }
 
+            long share = limit / Math.Max(1, allProjects.Count);
+            projectCounts = counts;
+            Interlocked.Exchange(ref fairShare, share);
+
+            var nowOverQuota = total >= limit;
+            bool entering = nowOverQuota && !overQuota;
             overQuota = nowOverQuota;
+
+            if (nowOverQuota)
+            {
+                await ReportThrottledProjectsAsync(now, counts, share, total, limit, entering, cancellationToken);
+            }
+            else
+            {
+                ResetReportingFor(now);
+            }
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
             logger.LogWarning(ex, "Failed to recompute trace quota");
         }
     }
+
+    /// <summary>
+    /// Makes dropping visible: logs at Error (which the operator Error Log captures) and raises one
+    /// notification per project as it starts being throttled.
+    /// </summary>
+    private async Task ReportThrottledProjectsAsync(
+        DateTimeOffset now,
+        IReadOnlyDictionary<Guid, long> counts,
+        long share,
+        long total,
+        long limit,
+        bool entering,
+        CancellationToken cancellationToken)
+    {
+        ResetReportingFor(now);
+
+        if (entering)
+        {
+            logger.LogError(
+                "Monthly trace quota reached ({Total}/{Limit}). Captures are now being dropped for "
+                + "projects above their {Share}-trace share of the limit; projects below it continue "
+                + "to capture.",
+                total, limit, share);
+        }
+
+        foreach ((Guid projectId, long count) in counts)
+        {
+            if (count < share || !reportedProjects.TryAdd(projectId, CurrentMonthKey(now)))
+            {
+                continue;
+            }
+
+            try
+            {
+                await notifications.NotifyAsync(
+                    new NotificationRequest(
+                        Kind: NotificationKind.TraceQuotaReached,
+                        Severity: NotificationSeverity.Warning,
+                        Title: "Trace capture paused for this project",
+                        Message:
+                            $"This installation has reached its licensed limit of {limit:N0} traces for the month "
+                            + $"({total:N0} captured). This project has captured {count:N0}, which is at or above its "
+                            + $"{share:N0} share, so new traces for it are not being stored until the month resets or "
+                            + "the licence is upgraded. Projects below their share continue to capture.",
+                        ProjectId: projectId),
+                    cancellationToken);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                // A failed notification must not stop the guard from enforcing the quota, but it
+                // must not be swallowed either — this is the mechanism that makes dropping visible.
+                reportedProjects.TryRemove(projectId, out _);
+                logger.LogWarning(ex, "Could not raise the trace-quota notification for project {ProjectId}", projectId);
+            }
+        }
+    }
+
+    /// <summary>Clears the per-month "already reported" set when the month rolls over.</summary>
+    private void ResetReportingFor(DateTimeOffset now)
+    {
+        string month = CurrentMonthKey(now);
+        if (reportedMonth == month)
+        {
+            return;
+        }
+
+        reportedMonth = month;
+        reportedProjects.Clear();
+    }
+
+    private static string CurrentMonthKey(DateTimeOffset now) => $"{now.Year:D4}-{now.Month:D2}";
 }
diff --git a/Proxytrace.Application/Optimization/Internal/OptimizerService.cs b/Proxytrace.Application/Optimization/Internal/OptimizerService.cs
index db0e6ab3d..9067f2a25 100644
--- a/Proxytrace.Application/Optimization/Internal/OptimizerService.cs
+++ b/Proxytrace.Application/Optimization/Internal/OptimizerService.cs
@@ -1,6 +1,7 @@
 using System.Threading.Channels;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
+using Proxytrace.Domain.Kiosk;
 using Proxytrace.Domain.TestRunGroup;
 
 namespace Proxytrace.Application.Optimization.Internal;
@@ -10,8 +11,16 @@ internal class OptimizerService : BackgroundService, IOptimizerService
     private readonly IOptimizer optimizer;
     private readonly ITestRunGroupRepository testRunGroupRepository;
     private readonly ITheoryValidationService theoryValidationService;
+    private readonly KioskOptions kiosk;
     private readonly ILogger<OptimizerService> logger;
 
+    /// <summary>
+    /// Upper bound on how many groups one restart re-queues, so a long-dormant install does not
+    /// enqueue its whole history — and its whole LLM cost — on the first start after upgrading.
+    /// The remainder is picked up on the next start.
+    /// </summary>
+    private const int MaxRecoveredGroups = 50;
+
     private readonly Channel<Guid> channel = Channel.CreateUnbounded<Guid>(
         new UnboundedChannelOptions
         {
@@ -23,11 +32,13 @@ public OptimizerService(
         IOptimizer optimizer,
         ITestRunGroupRepository testRunGroupRepository,
         ITheoryValidationService theoryValidationService,
+        KioskOptions kiosk,
         ILogger<OptimizerService> logger)
     {
         this.optimizer = optimizer;
         this.testRunGroupRepository = testRunGroupRepository;
         this.theoryValidationService = theoryValidationService;
+        this.kiosk = kiosk;
         this.logger = logger;
     }
 
@@ -38,6 +49,8 @@ protected override async Task ExecuteAsync(CancellationToken cancellationToken)
     {
         try
         {
+            await RecoverPendingGroupsAsync(cancellationToken);
+
             await foreach (var groupId in channel.Reader.ReadAllAsync(cancellationToken))
             {
                 try
@@ -49,6 +62,13 @@ protected override async Task ExecuteAsync(CancellationToken cancellationToken)
                         continue;
                     }
 
+                    if (group.OptimizationConsideredAt is not null)
+                    {
+                        // Already handled — a group submitted while restart recovery was re-queuing
+                        // the backlog can be enqueued twice. Mirrors the theory queue's own check.
+                        continue;
+                    }
+
                     logger.LogInformation("Discovering optimization theories for test run group {GroupId}", groupId);
                     var theories = await optimizer.DiscoverTheories(group, cancellationToken);
 
@@ -60,6 +80,13 @@ protected override async Task ExecuteAsync(CancellationToken cancellationToken)
                             submitted++;
                     }
 
+                    // Marked only after the theories have been submitted, so a crash mid-discovery
+                    // leaves the group pending and it is retried on the next start. Marked even when
+                    // discovery produced nothing: "considered and found nothing" must not be
+                    // mistaken for "never considered", or every barren group would be reprocessed
+                    // on every boot forever.
+                    await group.MarkOptimizationConsidered(cancellationToken);
+
                     logger.LogInformation(
                         "Group {GroupId} produced {Discovered} theory/theories, {Submitted} submitted for validation",
                         groupId, theories.Count, submitted);
@@ -79,4 +106,60 @@ protected override async Task ExecuteAsync(CancellationToken cancellationToken)
             // graceful shutdown
         }
     }
+
+    /// <summary>
+    /// Re-queues completed groups that were never considered — the backlog a restart would otherwise
+    /// discard.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The optimizer queue is an in-memory channel, so anything still in it when the process stopped
+    /// was simply lost: a deploy during a scheduled-run window silently dropped that night's
+    /// optimization, with nothing recorded anywhere to show it had happened. The theory queue has
+    /// had this recovery all along; it could, because a theory's status is its own durable marker.
+    /// A group had no equivalent until <see cref="ITestRunGroup.OptimizationConsideredAt"/>.
+    /// </para>
+    /// <para>
+    /// Skipped in kiosk mode for the same reason the theory queue skips it: kiosk storage is
+    /// in-memory and freshly demo-seeded on every start, so the only backlog recovery could find is
+    /// the seeded groups — re-queuing those would fire real A/B runs, and real spend, on every boot
+    /// when a live endpoint is configured.
+    /// </para>
+    /// </remarks>
+    internal async Task RecoverPendingGroupsAsync(CancellationToken cancellationToken)
+    {
+        if (kiosk.Enabled)
+            return;
+
+        try
+        {
+            var pending = await testRunGroupRepository.GetPendingOptimizationAsync(
+                MaxRecoveredGroups, cancellationToken);
+
+            foreach (var group in pending)
+            {
+                await channel.Writer.WriteAsync(group.Id, cancellationToken);
+            }
+
+            if (pending.Count > 0)
+                logger.LogInformation("Re-queued {Count} test run group(s) for optimization after restart", pending.Count);
+
+            if (pending.Count == MaxRecoveredGroups)
+            {
+                // Never truncate silently: the remainder is picked up on the next start, but an
+                // operator seeing optimization lag deserves to know a cap is in play.
+                logger.LogWarning(
+                    "Optimization recovery hit its {Cap}-group cap; the remaining backlog is deferred to the next start.",
+                    MaxRecoveredGroups);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(ex, "Failed to recover pending optimization groups after restart");
+        }
+    }
 }
diff --git a/Proxytrace.Application/Optimization/Internal/SwitchModelOptimizer.cs b/Proxytrace.Application/Optimization/Internal/SwitchModelOptimizer.cs
index b96b647a8..aa55d641f 100644
--- a/Proxytrace.Application/Optimization/Internal/SwitchModelOptimizer.cs
+++ b/Proxytrace.Application/Optimization/Internal/SwitchModelOptimizer.cs
@@ -1,3 +1,4 @@
+using System.Globalization;
 using Proxytrace.Domain.Statistics.TestRun;
 using Proxytrace.Application.TestRun;
 using Proxytrace.Domain.OptimizationTheory;
@@ -85,7 +86,9 @@ public Task<IReadOnlyList<IOptimizationTheory>> DiscoverTheories(
         };
 
         var metricLabel = chosen.Metric == Metric.Cost ? "cost" : "latency";
-        var savingPct = (chosen.RelativeSaving * 100).ToString("F1");
+        // Invariant culture: the rationale is persisted proposal text, so it must not read
+        // "12,3%" merely because the host happens to run under de-DE.
+        var savingPct = (chosen.RelativeSaving * 100).ToString("F1", CultureInfo.InvariantCulture);
         var currentName = currentRun.Endpoint.Model.Name;
         var bestName = bestRun.Endpoint.Model.Name;
         var rationale =
@@ -174,9 +177,9 @@ private static Task<IReadOnlyList<IOptimizationTheory>> Empty
     private static string FormatMetric(Metric metric, TestRunStats stats) 
         => metric switch
         {
-            Metric.Cost => stats.Cost?.ToString("0.####") ?? "?",
+            Metric.Cost => stats.Cost?.ToString("0.####", CultureInfo.InvariantCulture) ?? "?",
             Metric.Latency => stats.TotalDuration.HasValue
-                ? $"{stats.TotalDuration.Value.TotalSeconds:F2}s"
+                ? $"{stats.TotalDuration.Value.TotalSeconds.ToString("F2", CultureInfo.InvariantCulture)}s"
                 : "?",
             _ => "?",
         };
diff --git a/Proxytrace.Application/Optimization/Internal/TheoryValidationService.cs b/Proxytrace.Application/Optimization/Internal/TheoryValidationService.cs
index 6f336e1a6..4ba872e87 100644
--- a/Proxytrace.Application/Optimization/Internal/TheoryValidationService.cs
+++ b/Proxytrace.Application/Optimization/Internal/TheoryValidationService.cs
@@ -235,10 +235,11 @@ protected override async Task ExecuteAsync(CancellationToken cancellationToken)
     /// The validation queue is in-memory, so without this the backlog would be stranded —
     /// never validated, yet permanently counted against the per-project submission quota.
     /// Skipped in kiosk mode: kiosk storage is in-memory and freshly demo-seeded on every
-    /// start, so the only "backlog" recovery could find is the seeded Proposed/Validating
-    /// theories — re-queuing those would fire real A/B runs (and LLM spend) on every kiosk
-    /// boot when a live Kiosk:Endpoint is configured. User-submitted theories still enqueue
-    /// normally via <see cref="SubmitAsync"/>.
+    /// start, so the only "backlog" recovery could find is the seeded Proposed theories —
+    /// re-queuing those would fire real A/B runs (and LLM spend) on every kiosk boot when a
+    /// live Kiosk:Endpoint is configured. Because of that the demo seed never leaves a theory
+    /// in Validating (it would pulse "A/B in flight" forever). User-submitted theories still
+    /// enqueue normally via <see cref="SubmitAsync"/>.
     /// </summary>
     internal async Task RecoverInFlightTheoriesAsync(CancellationToken cancellationToken)
     {
diff --git a/Proxytrace.Application/Optimization/Internal/Validation/AbTestTheoryValidator.cs b/Proxytrace.Application/Optimization/Internal/Validation/AbTestTheoryValidator.cs
index 93e5cfc00..bd7a9fc63 100644
--- a/Proxytrace.Application/Optimization/Internal/Validation/AbTestTheoryValidator.cs
+++ b/Proxytrace.Application/Optimization/Internal/Validation/AbTestTheoryValidator.cs
@@ -54,9 +54,8 @@ public sealed override async Task<TheoryValidationOutcome> ValidateAsync(
         // The run the UI links to; its siblings are the extra samples behind the same comparison.
         ITestRun candidateRun = candidateRuns[0];
 
-        // Pool the samples. Each sample is an independent replay of the same suite, so summing
-        // passes and totals across them is exactly the evidence the significance test needs — and
-        // on a small suite it is the difference between proving a real effect and discarding it.
+        // Pooled counts give the pass rates that are REPORTED — "of everything attempted, this
+        // fraction passed" — which is what a reader expects to see.
         (int basePasses, int baseTotal) = SumPassCounts(baselineRuns);
         (int candPasses, int candTotal) = SumPassCounts(candidateRuns);
 
@@ -67,7 +66,14 @@ public sealed override async Task<TheoryValidationOutcome> ValidateAsync(
 
         double basePassRate = basePasses / (double)baseTotal;
         double candidatePassRate = candPasses / (double)candTotal;
-        double? pValue = ProportionStats.TwoSidedPValue(basePasses, baseTotal, candPasses, candTotal);
+
+        // The significance test, however, must NOT consume those pooled totals. Replays of one test
+        // case are not independent trials of each other, so summing them inflated the sample size by
+        // the replay count and shrank the standard error by roughly its square root — the gate got
+        // easier to pass the more samples an operator configured, which is exactly backwards. Both
+        // arms run the same cases, so the test is paired on the case. See ProportionStats.
+        (var basePerCase, var candPerCase) = PairedPassRates(baselineRuns, candidateRuns);
+        double? pValue = ProportionStats.PairedTwoSidedPValue(basePerCase, candPerCase);
 
         if (candidatePassRate <= basePassRate)
         {
diff --git a/Proxytrace.Application/Optimization/Internal/Validation/ModelSwitchTheoryValidator.cs b/Proxytrace.Application/Optimization/Internal/Validation/ModelSwitchTheoryValidator.cs
index 944109225..9ca12f19e 100644
--- a/Proxytrace.Application/Optimization/Internal/Validation/ModelSwitchTheoryValidator.cs
+++ b/Proxytrace.Application/Optimization/Internal/Validation/ModelSwitchTheoryValidator.cs
@@ -37,26 +37,38 @@ public override async Task<TheoryValidationOutcome> ValidateAsync(
         var modelSwitchTheory = (IModelSwitchTheory)theory;
         var agent = theory.Agent;
 
-        ITestRun baselineRun = await ResolveRunAsync(theory, agent, agent.Endpoint, cancellationToken);
-        ITestRun candidateRun = await ResolveRunAsync(theory, agent, modelSwitchTheory.ProposedEndpoint, cancellationToken, onCandidateRun);
+        // Both arms run fresh, back to back, honouring the configured sample count — the same
+        // contract the other A/B validators keep, and the one docs/optimization-loop.md states.
+        // This used to compare a freshly executed candidate against a PREVIOUSLY STORED baseline
+        // run, so anything that had drifted since that run — the model's own behaviour, a provider
+        // update, an edit to the suite — was attributed to the model switch. A theory sitting in
+        // the validation queue made the gap, and the misattribution, arbitrarily large.
+        int samples = Options.AbSampleCount;
+        var baselineRuns = await RunSamplesAsync(theory.Suite, agent, agent.Endpoint, samples, cancellationToken);
+        var candidateRuns = await RunSamplesAsync(
+            theory.Suite, agent, modelSwitchTheory.ProposedEndpoint, samples, cancellationToken, onCandidateRun);
 
         // Never score a partial run (a failed/cancelled case leaves fewer results than the suite).
-        if (!IsRunComplete(baselineRun, theory.Suite) || !IsRunComplete(candidateRun, theory.Suite))
+        if (baselineRuns.Concat(candidateRuns).Any(r => !IsRunComplete(r, theory.Suite)))
         {
             return TheoryValidationOutcome.CouldNotTest;
         }
 
-        RunMetrics baseline = Metrics(baselineRun);
-        RunMetrics candidate = Metrics(candidateRun);
+        // The run the UI links to; its siblings are the extra samples behind the same comparison.
+        ITestRun candidateRun = candidateRuns[0];
+
+        RunMetrics baseline = AggregateMetrics(baselineRuns);
+        RunMetrics candidate = AggregateMetrics(candidateRuns);
 
         if (baseline.PassRate is not { } basePassRate || candidate.PassRate is not { } candidatePassRate)
         {
             return TheoryValidationOutcome.CouldNotTest;
         }
 
-        (int basePasses, int baseTotal) = PassCounts(baselineRun);
-        (int candPasses, int candTotal) = PassCounts(candidateRun);
-        double? pValue = ProportionStats.TwoSidedPValue(basePasses, baseTotal, candPasses, candTotal);
+        // Paired on the test case, like the other validators — pooling replays would treat each
+        // replay as an independent trial and overstate confidence. See ProportionStats.
+        (var basePerCase, var candPerCase) = PairedPassRates(baselineRuns, candidateRuns);
+        double? pValue = ProportionStats.PairedTwoSidedPValue(basePerCase, candPerCase);
 
         decimal? costDelta = candidate.Cost.HasValue && baseline.Cost.HasValue
             ? candidate.Cost.Value - baseline.Cost.Value
@@ -64,9 +76,9 @@ public override async Task<TheoryValidationOutcome> ValidateAsync(
         TimeSpan latencyDelta = candidate.Latency - baseline.Latency;
 
         // Pass-rate must not regress, and the switch must actually save money or time —
-        // equal-quality-but-pricier is not a win. The conservative raw-rate comparison never
-        // recommends a model that scored worse on the evidence, even by a noisy margin; the p-value
-        // is still recorded on the outcome for transparency.
+        // equal-quality-but-pricier is not a win. The raw-rate comparison is deliberately
+        // conservative: it never recommends a model that scored worse on the evidence, even by a
+        // noisy margin.
         bool cheaper = costDelta is < 0m;
         bool faster = latencyDelta < TimeSpan.Zero;
         if (candidatePassRate < basePassRate || (!cheaper && !faster))
@@ -74,6 +86,24 @@ public override async Task<TheoryValidationOutcome> ValidateAsync(
             return TheoryValidationOutcome.Rejected(basePassRate, candidatePassRate, pValue, candidateRun.Id);
         }
 
+        // The evidence gate here is DIRECTIONAL, and deliberately not the one the improvement
+        // validators use. A model switch claims *parity* on quality plus a cost or latency win, so
+        // demanding a statistically significant DIFFERENCE would be exactly backwards: it would
+        // reject the ideal result — identical answers, materially cheaper — and accept only switches
+        // that measurably changed the output. Note in particular that a null p-value here usually
+        // means "the two arms agreed on every case", which is the best possible outcome, not a
+        // missing one.
+        //
+        // What must be ruled out is concluding parity from evidence that could not have shown a
+        // difference in the first place. Fewer than two paired cases cannot: a one-case suite agrees
+        // with itself trivially. So the gate is on the size of the paired comparison, not on its
+        // result. The kiosk showcase drops it to keep the demo moving, as it does for the others.
+        const int minimumPairedCases = 2;
+        if (Options.RequireStatisticalSignificance && basePerCase.Count < minimumPairedCases)
+        {
+            return TheoryValidationOutcome.Rejected(basePassRate, candidatePassRate, pValue, candidateRun.Id);
+        }
+
         var proposal = proposalFactory(
             agent: agent,
             priority: theory.Priority,
diff --git a/Proxytrace.Application/Optimization/Internal/Validation/ProportionStats.cs b/Proxytrace.Application/Optimization/Internal/Validation/ProportionStats.cs
index 799f2e342..f4d6fe8aa 100644
--- a/Proxytrace.Application/Optimization/Internal/Validation/ProportionStats.cs
+++ b/Proxytrace.Application/Optimization/Internal/Validation/ProportionStats.cs
@@ -37,6 +37,176 @@ internal static class ProportionStats
         return Math.Clamp(p, 0, 1);
     }
 
+    /// <summary>
+    /// Two-sided p-value for an A/B comparison in which both arms ran the <b>same test cases</b>,
+    /// each possibly replayed several times. <paramref name="baselinePerCase"/> and
+    /// <paramref name="candidatePerCase"/> hold one pass proportion per test case, in matching order.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// This replaces a two-proportion test over <b>pooled</b> replays, which was wrong in a way that
+    /// always erred toward accepting: summing the samples treated <c>cases × replays</c> as that many
+    /// independent trials. Replays of the same case are not independent of each other — a case that
+    /// deterministically passes contributes the same outcome every time — so the sample size was
+    /// inflated by the replay count and the standard error shrank by roughly √(replays). The gate
+    /// therefore admitted differences that were not significant, and admitted them more readily the
+    /// more samples an operator configured, which is precisely backwards.
+    /// </para>
+    /// <para>
+    /// The test case is the unit of independence, and the two arms run the same ones, so this is a
+    /// <b>paired</b> design: per case, take the difference in pass proportion and test whether the
+    /// mean difference differs from zero (a paired t-test on n = number of cases). Replays still earn
+    /// their keep — they sharpen each case's proportion, reducing the spread of the differences —
+    /// but they no longer manufacture sample size.
+    /// </para>
+    /// <para>
+    /// Returns <see langword="null"/> when a p-value is undefined: fewer than two paired cases (a
+    /// single case cannot evidence a difference between arms), mismatched arms, or no difference at
+    /// all in any case.
+    /// </para>
+    /// </remarks>
+    public static double? PairedTwoSidedPValue(
+        IReadOnlyList<double> baselinePerCase,
+        IReadOnlyList<double> candidatePerCase)
+    {
+        if (baselinePerCase.Count != candidatePerCase.Count || baselinePerCase.Count < 2)
+            return null;
+
+        int n = baselinePerCase.Count;
+        var differences = new double[n];
+        for (var i = 0; i < n; i++)
+        {
+            differences[i] = candidatePerCase[i] - baselinePerCase[i];
+        }
+
+        double mean = differences.Average();
+        double sumSquares = differences.Sum(d => (d - mean) * (d - mean));
+        double standardDeviation = Math.Sqrt(sumSquares / (n - 1));
+
+        if (standardDeviation <= 0)
+        {
+            // Every case moved by exactly the same amount. If that amount is zero the arms are
+            // indistinguishable; otherwise the t statistic is unbounded, so fall back to the
+            // two-sided sign test — the probability that all n cases move the same way by chance.
+            // That keeps a unanimous change from being discarded, without asserting p = 0 from a
+            // handful of cases: two cases give 0.5, ten give ~0.002.
+            return mean == 0 ? null : Math.Clamp(2 * Math.Pow(0.5, n), 0, 1);
+        }
+
+        double t = mean / (standardDeviation / Math.Sqrt(n));
+        return StudentTTwoSidedPValue(Math.Abs(t), degreesOfFreedom: n - 1);
+    }
+
+    /// <summary>
+    /// Two-sided p-value of Student's t distribution: <c>I_x(df/2, 1/2)</c> with
+    /// <c>x = df / (df + t²)</c>.
+    /// </summary>
+    /// <remarks>
+    /// The t distribution, not the normal one, because the paired test above runs on n = the number
+    /// of test cases — routinely under 30, where the normal approximation's thinner tails would
+    /// under-state the p-value and quietly reintroduce the over-acceptance this change exists to fix.
+    /// </remarks>
+    private static double StudentTTwoSidedPValue(double t, int degreesOfFreedom)
+    {
+        if (degreesOfFreedom <= 0)
+            return 1;
+
+        double x = degreesOfFreedom / (degreesOfFreedom + t * t);
+        return Math.Clamp(RegularizedIncompleteBeta(x, degreesOfFreedom / 2.0, 0.5), 0, 1);
+    }
+
+    /// <summary>
+    /// Regularized incomplete beta function <c>I_x(a, b)</c>, evaluated with the Lentz continued
+    /// fraction and the standard symmetry reflection for fast convergence.
+    /// </summary>
+    private static double RegularizedIncompleteBeta(double x, double a, double b)
+    {
+        if (x <= 0) return 0;
+        if (x >= 1) return 1;
+
+        double logPrefix = LogGamma(a + b) - LogGamma(a) - LogGamma(b)
+                           + a * Math.Log(x) + b * Math.Log(1 - x);
+        double prefix = Math.Exp(logPrefix);
+
+        // The continued fraction converges quickly only on one side of the distribution's mode;
+        // reflect onto that side when needed.
+        return x < (a + 1) / (a + b + 2)
+            ? prefix * BetaContinuedFraction(x, a, b) / a
+            : 1 - prefix * BetaContinuedFraction(1 - x, b, a) / b;
+    }
+
+    private static double BetaContinuedFraction(double x, double a, double b)
+    {
+        const int maxIterations = 300;
+        const double epsilon = 1e-15;
+        const double tiny = 1e-300;
+
+        double qab = a + b;
+        double qap = a + 1;
+        double qam = a - 1;
+        double c = 1;
+        double d = 1 - qab * x / qap;
+        if (Math.Abs(d) < tiny) d = tiny;
+        d = 1 / d;
+        double result = d;
+
+        for (var m = 1; m <= maxIterations; m++)
+        {
+            int m2 = 2 * m;
+
+            // Even step.
+            double numerator = m * (b - m) * x / ((qam + m2) * (a + m2));
+            d = 1 + numerator * d;
+            if (Math.Abs(d) < tiny) d = tiny;
+            c = 1 + numerator / c;
+            if (Math.Abs(c) < tiny) c = tiny;
+            d = 1 / d;
+            result *= d * c;
+
+            // Odd step.
+            numerator = -(a + m) * (qab + m) * x / ((a + m2) * (qap + m2));
+            d = 1 + numerator * d;
+            if (Math.Abs(d) < tiny) d = tiny;
+            c = 1 + numerator / c;
+            if (Math.Abs(c) < tiny) c = tiny;
+            d = 1 / d;
+            double delta = d * c;
+            result *= delta;
+
+            if (Math.Abs(delta - 1) < epsilon)
+                break;
+        }
+
+        return result;
+    }
+
+    /// <summary>Lanczos approximation of <c>ln Γ(z)</c> (|relative error| &lt; 1e-13).</summary>
+    private static double LogGamma(double z)
+    {
+        double[] coefficients =
+        [
+            676.5203681218851, -1259.1392167224028, 771.32342877765313,
+            -176.61502916214059, 12.507343278686905, -0.13857109526572012,
+            9.9843695780195716e-6, 1.5056327351493116e-7,
+        ];
+
+        if (z < 0.5)
+        {
+            // Reflection formula, so the series below only ever runs on the convergent side.
+            return Math.Log(Math.PI / Math.Sin(Math.PI * z)) - LogGamma(1 - z);
+        }
+
+        z -= 1;
+        double x = 0.99999999999980993;
+        for (var i = 0; i < coefficients.Length; i++)
+        {
+            x += coefficients[i] / (z + i + 1);
+        }
+
+        double t = z + coefficients.Length - 0.5;
+        return 0.5 * Math.Log(2 * Math.PI) + (z + 0.5) * Math.Log(t) - t + Math.Log(x);
+    }
+
     /// <summary>
     /// Cumulative distribution function of the standard normal distribution, via the
     /// Abramowitz &amp; Stegun 7.1.26 error-function approximation (|error| &lt; 1.5e-7).
diff --git a/Proxytrace.Application/Optimization/Internal/Validation/TheoryValidatorBase.cs b/Proxytrace.Application/Optimization/Internal/Validation/TheoryValidatorBase.cs
index 24a02c161..dbfe770dd 100644
--- a/Proxytrace.Application/Optimization/Internal/Validation/TheoryValidatorBase.cs
+++ b/Proxytrace.Application/Optimization/Internal/Validation/TheoryValidatorBase.cs
@@ -145,6 +145,35 @@ protected static RunMetrics Metrics(ITestRun run)
         return new RunMetrics(passRate, cost, latency);
     }
 
+    /// <summary>
+    /// <see cref="Metrics"/> across every sample in one A/B arm, so cost and latency describe the
+    /// arm rather than whichever sample happened to be first.
+    /// </summary>
+    /// <remarks>
+    /// Cost and latency are <b>averaged per sample</b>, not summed: they are compared directly
+    /// against the other arm's figures and surfaced on the proposal as "what this switch would cost
+    /// you", so summing would scale both arms by the sample count and make the reported saving that
+    /// many times too large. Pass rate is pooled over all results, matching what the other
+    /// validators report.
+    /// </remarks>
+    protected static RunMetrics AggregateMetrics(IReadOnlyList<ITestRun> runs)
+    {
+        if (runs.Count == 0)
+            return new RunMetrics(null, null, TimeSpan.Zero);
+
+        var perRun = runs.Select(Metrics).ToList();
+
+        (int passes, int total) = SumPassCounts(runs);
+        double? passRate = total > 0 ? passes / (double)total : null;
+
+        var costs = perRun.Where(m => m.Cost.HasValue).Select(m => m.Cost ?? 0m).ToList();
+        decimal? cost = costs.Count > 0 ? costs.Sum() / costs.Count : null;
+
+        var latency = TimeSpan.FromTicks(perRun.Sum(m => m.Latency.Ticks) / runs.Count);
+
+        return new RunMetrics(passRate, cost, latency);
+    }
+
     /// <summary>
     /// Returns the number of passing results and the total result count for a run — the raw
     /// counts a two-proportion test needs, as opposed to the rounded <see cref="RunMetrics.PassRate"/>.
@@ -156,15 +185,61 @@ protected static (int Passes, int Total) PassCounts(ITestRun run)
     }
 
     /// <summary>
-    /// Pools <see cref="PassCounts"/> over every sample in one A/B arm. Each sample is an
-    /// independent replay of the same suite, so the sums are the arm's total evidence.
+    /// Pools <see cref="PassCounts"/> over every sample in one A/B arm.
     /// </summary>
+    /// <remarks>
+    /// Use for the <b>reported</b> pass rate, which is simply "how many of the attempts passed" and
+    /// is correctly a pooled figure. Do <b>not</b> feed these totals to a significance test:
+    /// replays of the same case are not independent trials, so the pooled total overstates the
+    /// sample size by the replay count. <see cref="PairedPassRates"/> is what the test consumes.
+    /// </remarks>
     protected static (int Passes, int Total) SumPassCounts(IReadOnlyList<ITestRun> runs)
     {
         var counts = runs.Select(PassCounts).ToList();
         return (counts.Sum(c => c.Passes), counts.Sum(c => c.Total));
     }
 
+    /// <summary>
+    /// Aligns two A/B arms case by case, returning one pass proportion per test case for each arm.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The unit of independence in these comparisons is the <b>test case</b>, and both arms run the
+    /// same ones — so the honest analysis is paired. This projects each arm to "for test case X,
+    /// what fraction of its replays passed", keyed on the case so the two arms line up even if the
+    /// runner returned results in a different order.
+    /// </para>
+    /// <para>
+    /// Only cases present in both arms are returned; a case missing from one side has no pair and
+    /// cannot contribute a difference. Callers already refuse to score incomplete runs, so in
+    /// practice this drops nothing.
+    /// </para>
+    /// </remarks>
+    protected static (IReadOnlyList<double> Baseline, IReadOnlyList<double> Candidate) PairedPassRates(
+        IReadOnlyList<ITestRun> baselineRuns,
+        IReadOnlyList<ITestRun> candidateRuns)
+    {
+        var baseline = PassRateByCase(baselineRuns);
+        var candidate = PassRateByCase(candidateRuns);
+
+        // Ordered by case id so the pairing is deterministic run to run, which keeps the p-value
+        // reproducible for the same evidence.
+        var sharedCases = baseline.Keys.Intersect(candidate.Keys).OrderBy(id => id).ToArray();
+
+        return (
+            sharedCases.Select(id => baseline[id]).ToArray(),
+            sharedCases.Select(id => candidate[id]).ToArray());
+    }
+
+    /// <summary>Mean pass proportion per test case across every sample in one arm.</summary>
+    private static Dictionary<Guid, double> PassRateByCase(IReadOnlyList<ITestRun> runs)
+        => runs
+            .SelectMany(run => run.TestResults)
+            .GroupBy(result => result.TestCase.Id)
+            .ToDictionary(
+                group => group.Key,
+                group => group.Count(r => r.IsPass()) / (double)group.Count());
+
     /// <summary>
     /// Whether a run is trustworthy as A/B evidence: it must have produced a result for every case in
     /// the suite. A run that failed or cancelled part-way (or skipped a case after an inference error)
diff --git a/Proxytrace.Application/Playground/Internal/PlaygroundService.cs b/Proxytrace.Application/Playground/Internal/PlaygroundService.cs
index 727adb071..ff29ec8b8 100644
--- a/Proxytrace.Application/Playground/Internal/PlaygroundService.cs
+++ b/Proxytrace.Application/Playground/Internal/PlaygroundService.cs
@@ -76,7 +76,9 @@ public async IAsyncEnumerable<PlaygroundEvent> CompleteStreamAsync(
 
         SystemMessage systemMessage = new(request.SystemPrompt);
         IReadOnlyList<ToolSpecification> tools = ResolveTools(agent.Tools, request.Tools);
-        ModelOptions options = new(endpoint.Model.Name, tools);
+        // The parameters the user set in the right rail. They used to stop here: ModelOptions had
+        // nowhere to put them, so every control silently did nothing.
+        ModelOptions options = new(endpoint.Model.Name, tools, ToSampling(request.Parameters));
         Conversation conversation = BuildConversation(request.Messages);
 
         using IModelClient client = agent.CreateClient(endpoint, skipIngestion: true);
@@ -167,6 +169,25 @@ public async IAsyncEnumerable<PlaygroundEvent> CompleteStreamAsync(
     /// substitute description and per-arg description from the override.
     /// Tools in the override that don't match an agent tool by name are skipped (no schema available).
     /// </summary>
+    /// <summary>
+    /// Maps the playground's parameter panel onto the request's sampling overrides.
+    /// </summary>
+    /// <remarks>
+    /// A blank stop-sequence list is normalised to <see langword="null"/> so an untouched control
+    /// sends nothing at all rather than an empty array the provider then has to interpret.
+    /// </remarks>
+    private static ModelSamplingParameters ToSampling(PlaygroundModelParameters parameters)
+        => new(
+            Temperature: parameters.Temperature,
+            TopP: parameters.TopP,
+            FrequencyPenalty: parameters.FrequencyPenalty,
+            PresencePenalty: parameters.PresencePenalty,
+            MaxOutputTokens: parameters.MaxTokens,
+            Seed: parameters.Seed,
+            StopSequences: parameters.Stop is { Count: > 0 } stop ? stop : null,
+            ReasoningEffort: string.IsNullOrWhiteSpace(parameters.ReasoningEffort) ? null : parameters.ReasoningEffort,
+            ChoiceCount: parameters.N);
+
     private static IReadOnlyList<ToolSpecification> ResolveTools(
         IReadOnlyList<ToolSpecification> agentTools,
         IReadOnlyList<PlaygroundToolSpecification> overrides)
diff --git a/Proxytrace.Application/Setup/Internal/SetupService.cs b/Proxytrace.Application/Setup/Internal/SetupService.cs
index 4a02f0f2e..fced528bd 100644
--- a/Proxytrace.Application/Setup/Internal/SetupService.cs
+++ b/Proxytrace.Application/Setup/Internal/SetupService.cs
@@ -1,3 +1,4 @@
+using Proxytrace.Common.Async;
 using Proxytrace.Application.Auth;
 using Proxytrace.Application.Auth.Local;
 using Proxytrace.Application.Pricing;
@@ -24,6 +25,10 @@ internal class SetupService : ISetupService
     private readonly IProject.CreateNew createProject;
     private readonly IUser.CreateNew createUser;
     private readonly IPasswordService passwords;
+    private readonly IAsyncLock asyncLock;
+
+    /// <summary>Lock key serializing first-run setup against a concurrent submission of itself.</summary>
+    private const string SetupLockKey = "license-quota:setup";
     private readonly ILocalTokenIssuer tokens;
     private readonly ITransaction transaction;
     private readonly ILicenseService license;
@@ -41,6 +46,7 @@ public SetupService(
         IProject.CreateNew createProject,
         IUser.CreateNew createUser,
         IPasswordService passwords,
+        IAsyncLock asyncLock,
         ILocalTokenIssuer tokens,
         ITransaction transaction,
         ILicenseService license,
@@ -57,6 +63,7 @@ public SetupService(
         this.createProject = createProject;
         this.createUser = createUser;
         this.passwords = passwords;
+        this.asyncLock = asyncLock;
         this.tokens = tokens;
         this.transaction = transaction;
         this.license = license;
@@ -94,6 +101,11 @@ public async Task<FirstAdminResult> CreateFirstAdminAsync(string email, string p
 
     public async Task<SetupResult> CompleteAsync(SetupInput input, CancellationToken cancellationToken = default)
     {
+        // Taken outside the transaction, and held for the whole of it: the "already completed" test
+        // and the project-limit check below are both check-then-act against the same count, so two
+        // concurrent setup submissions could each observe zero projects and each proceed.
+        using IDisposable setupLock = await asyncLock.LockAsync(SetupLockKey, cancellationToken);
+
         IModelProvider? savedProvider = null;
         var result = await transaction.InvokeAsync(async () =>
         {
diff --git a/Proxytrace.Application/Statistics/Internal/AbstractStatsProjector.cs b/Proxytrace.Application/Statistics/Internal/AbstractStatsProjector.cs
index 0225b2db1..9dbe0e9fd 100644
--- a/Proxytrace.Application/Statistics/Internal/AbstractStatsProjector.cs
+++ b/Proxytrace.Application/Statistics/Internal/AbstractStatsProjector.cs
@@ -22,8 +22,11 @@ protected AbstractStatsProjector(
     public async Task ProjectAsync(Guid entityId, CancellationToken cancellationToken)
     {
         TDomainEntity? entity = await repository.FindAsync(entityId, cancellationToken);
-        if (entity is null)
+        if (entity is null || !ShouldProject(entity))
         {
+            // Removing rather than merely skipping matters: an entity that should not be projected
+            // may already have a row from before it was excluded, and leaving that row behind would
+            // keep it in the statistics forever.
             await writer.RemoveAsync(entityId, cancellationToken);
             return;
         }
@@ -32,5 +35,11 @@ public async Task ProjectAsync(Guid entityId, CancellationToken cancellationToke
         await writer.UpsertAsync(stats, cancellationToken);
     }
 
+    /// <summary>
+    /// Whether <paramref name="entity"/> belongs in the user-facing statistics at all. Default:
+    /// everything does.
+    /// </summary>
+    protected virtual bool ShouldProject(TDomainEntity entity) => true;
+
     protected abstract Task<TStats> ComputeStatsAsync(TDomainEntity entity, CancellationToken cancellationToken);
 }
diff --git a/Proxytrace.Application/Statistics/Internal/Worker/StatisticsBackfillHostedService.cs b/Proxytrace.Application/Statistics/Internal/Worker/StatisticsBackfillHostedService.cs
index ce748b793..0e657f1c7 100644
--- a/Proxytrace.Application/Statistics/Internal/Worker/StatisticsBackfillHostedService.cs
+++ b/Proxytrace.Application/Statistics/Internal/Worker/StatisticsBackfillHostedService.cs
@@ -84,8 +84,14 @@ private async Task RunAsync(CancellationToken cancellationToken)
 
                 // Skip runs already projected — avoids racing the live drainer when a run finalizes
                 // during backfill, and is a cheap no-op on warm restarts.
+                //
+                // System runs invert the test. They must NOT appear in the statistics, so the work
+                // here is the opposite: a system run with a leftover row (written before that rule
+                // existed) needs projecting precisely so the projector can remove it, while one with
+                // no row is already correct and is skipped.
                 TestRunStats? existing = await runStatsReader.FindAsync(run.Id, cancellationToken);
-                if (existing is not null)
+                bool isSystemRun = run.Group.IsSystemRun;
+                if (isSystemRun ? existing is null : existing is not null)
                 {
                     continue;
                 }
diff --git a/Proxytrace.Application/Statistics/TestRun/Internal/TestRunStatsProjector.cs b/Proxytrace.Application/Statistics/TestRun/Internal/TestRunStatsProjector.cs
index ddf73af43..9d425036d 100644
--- a/Proxytrace.Application/Statistics/TestRun/Internal/TestRunStatsProjector.cs
+++ b/Proxytrace.Application/Statistics/TestRun/Internal/TestRunStatsProjector.cs
@@ -15,6 +15,19 @@ public TestRunStatsProjector(IStatsWriter<TestRunStats> writer, IRepository<ITes
     {
     }
 
+    /// <summary>
+    /// Excludes internal system runs from the user-facing statistics.
+    /// </summary>
+    /// <remarks>
+    /// A/B validation runs are executed by the optimizer, not by a user. <c>IsSystemRun</c> already
+    /// hides them from the run list, so a user cannot see or inspect them — but their results were
+    /// still folded into the pass-rate figures and the anomaly baseline, so people saw pass rates
+    /// computed partly from runs that do not exist as far as the UI is concerned, moving for reasons
+    /// they could not investigate. Being deliberately adversarial (a candidate prompt under test),
+    /// those runs also skew the baseline that anomaly detection compares against.
+    /// </remarks>
+    protected override bool ShouldProject(ITestRun run) => !run.Group.IsSystemRun;
+
     protected override Task<TestRunStats> ComputeStatsAsync(ITestRun run, CancellationToken cancellationToken)
     {
         int testCases = run.Group.Suite.TestCases.Count;
diff --git a/Proxytrace.Application/TestRun/Internal/TestRunnerService.cs b/Proxytrace.Application/TestRun/Internal/TestRunnerService.cs
index 401440717..5dde7b1cd 100644
--- a/Proxytrace.Application/TestRun/Internal/TestRunnerService.cs
+++ b/Proxytrace.Application/TestRun/Internal/TestRunnerService.cs
@@ -40,6 +40,29 @@ internal class TestRunnerService : BackgroundService, ITestRunnerService
     private readonly TestRunnerConfiguration configuration;
     private readonly ConcurrentDictionary<Guid, CancellationTokenSource> cancellationTokens = new();
 
+    /// <summary>
+    /// Caps how many upstream model calls this process has in flight at once.
+    /// </summary>
+    /// <remarks>
+    /// The three <c>Parallel.ForEachAsync</c> loops below nest — runs, then that run's test cases,
+    /// then that case's evaluators — and each was configured with the same
+    /// <see cref="TestRunnerConfiguration.MaxDegreeOfParallelism"/>. That <b>multiplies</b> rather
+    /// than caps: at the default of 2 the loops alone permit 2×2×2 = 8 concurrent upstream calls,
+    /// not the documented 2, so the setting understated the load put on the provider — and the
+    /// spend — by its own cube. This service is a singleton, so one semaphore around the calls that
+    /// actually leave the process gives the setting the meaning it claims, process-wide.
+    ///
+    /// Only genuine model calls are gated: local evaluators (exact match, contains, …) stay fully
+    /// parallel rather than queueing behind an LLM round trip. Nothing holds a permit while
+    /// acquiring another — a test case releases before its evaluators run — so the gate cannot
+    /// deadlock the nested loops.
+    ///
+    /// A <see cref="SemaphoreSlim"/> rather than the usual <c>IAsyncLock</c>: this is a counting
+    /// limit ("at most N at once"), and <c>IAsyncLock</c> only grants one holder per key, so it
+    /// cannot express it. Sanctioned exception — see the Concurrency section of docs/code-style.md.
+    /// </remarks>
+    private readonly SemaphoreSlim modelCallGate;
+
     private readonly Channel<Guid> channel = Channel.CreateUnbounded<Guid>(
         new UnboundedChannelOptions
         {
@@ -77,6 +100,27 @@ public TestRunnerService(
         this.asyncLock = asyncLock;
         this.logger = logger;
         this.configuration = configuration;
+        this.modelCallGate = new SemaphoreSlim(Math.Max(1, configuration.MaxDegreeOfParallelism));
+    }
+
+    /// <summary>
+    /// Runs <paramref name="call"/> holding one <see cref="modelCallGate"/> permit, so concurrent
+    /// upstream calls stay within the configured degree of parallelism however the nested loops
+    /// happen to interleave.
+    /// </summary>
+    private async Task<T> ThroughModelCallGateAsync<T>(
+        Func<CancellationToken, Task<T>> call,
+        CancellationToken cancellationToken)
+    {
+        await modelCallGate.WaitAsync(cancellationToken);
+        try
+        {
+            return await call(cancellationToken);
+        }
+        finally
+        {
+            modelCallGate.Release();
+        }
     }
 
     public async Task<ITestRunGroup> RunInForegroundAsync(
@@ -144,26 +188,49 @@ private async Task<ITestRunGroup> CreateGroup(
 
     public async Task<ITestRunGroup> CancelAsync(ITestRunGroup group, CancellationToken cancellationToken = default)
     {
-        var runs = await testRunRepository.GetByGroupAsync(group.Id, cancellationToken);
-
-        foreach (var run in runs)
+        // The executing group registers its source under the *group* id (see ExecuteGroupAsync).
+        // Looking it up per run never matched, so cancelling only flipped the rows to Cancelled
+        // while the parallel loop kept issuing real, billed model calls through to completion.
+        if (cancellationTokens.TryGetValue(group.Id, out CancellationTokenSource? cts))
         {
-            if (cancellationTokens.TryGetValue(run.Id, out CancellationTokenSource? cts))
+            try
+            {
                 await cts.CancelAsync();
+            }
+            catch (ObjectDisposedException)
+            {
+                // The group finished and disposed its source between the lookup and the cancel.
+                // There is nothing left to stop; the reconciliation below still settles the rows.
+            }
         }
 
-        // Reload runs and mark any that didn't reach a terminal state as Cancelled.
-        var reloaded = await testRunRepository.GetByGroupAsync(group.Id, cancellationToken);
-        foreach (var run in reloaded.Where(r => !r.Status.IsTerminal()))
+        return await SettleCancelledAsync(group, cancellationToken);
+    }
+
+    /// <summary>
+    /// Drives a cancelled group and its unfinished runs to their terminal state, exactly once.
+    /// </summary>
+    /// <remarks>
+    /// Both the canceller and the cancelled execution land here: the token <see cref="CancelAsync"/>
+    /// trips unwinds <see cref="ExecuteGroupAsync"/> concurrently, and the two touch the same rows.
+    /// Serializing on the group id makes the "already terminal?" check and the transition atomic, so
+    /// the loser is a no-op instead of an <c>OptimisticConcurrencyException</c> on a run row or a
+    /// second group-complete broadcast.
+    /// </remarks>
+    private async Task<ITestRunGroup> SettleCancelledAsync(ITestRunGroup group, CancellationToken cancellationToken)
+    {
+        using IDisposable sync = await asyncLock.LockAsync(group.Id, cancellationToken);
+
+        var runs = await testRunRepository.GetByGroupAsync(group.Id, cancellationToken);
+        foreach (var run in runs.Where(r => !r.Status.IsTerminal()))
             await run.SetCancelled(cancellationToken);
 
         group = await testRunGroupRepository.GetAsync(group.Id, cancellationToken);
-        if (!group.Status.IsTerminal())
-        {
-            group = await group.SetCancelled(cancellationToken);
-            broadcaster.PublishGroupComplete(GroupRunCompleteEvent.Create(group));
-        }
+        if (group.Status.IsTerminal())
+            return group;
 
+        group = await group.SetCancelled(cancellationToken);
+        broadcaster.PublishGroupComplete(GroupRunCompleteEvent.Create(group));
         return group;
     }
 
@@ -199,9 +266,21 @@ await Parallel.ForEachAsync(
                 parallelOptions,
                 async (testRun, ct) => await RunTestRun(testRun, customAgent, ct));
 
-            group = await group.ReloadAsync(cancellationToken);
-            group = await group.SetCompleted(cancellationToken);
-            broadcaster.PublishGroupComplete(GroupRunCompleteEvent.Create(group));
+            using (IDisposable sync = await asyncLock.LockAsync(group.Id, cancellationToken))
+            {
+                group = await group.ReloadAsync(cancellationToken);
+
+                // A concurrent CancelAsync may already have driven the group terminal while the
+                // parallel loop was draining. Completing it then is an invalid transition that
+                // SetState rejects, which used to surface as a bogus "Test run group failed" — plus
+                // a completion broadcast and anomaly detection for a group the user cancelled.
+                // Leave the settled group exactly as the cancellation left it.
+                if (group.Status.IsTerminal())
+                    return group;
+
+                group = await group.SetCompleted(cancellationToken);
+                broadcaster.PublishGroupComplete(GroupRunCompleteEvent.Create(group));
+            }
 
             if (!isSystemTestRun)
             {
@@ -212,21 +291,13 @@ await Parallel.ForEachAsync(
         }
         catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
         {
-            // The run was cancelled (process shutdown, or a user cancelling theory validation through
-            // the linked token). Mark the group and any non-terminal runs Cancelled with a fresh token
-            // so the in-flight A/B run isn't stranded in Running forever, then rethrow. Best-effort.
+            // The run was cancelled (process shutdown, a user cancelling the group through
+            // CancelAsync, or a caller cancelling theory validation through the linked token). Mark
+            // the group and any non-terminal runs Cancelled with a fresh token so the in-flight A/B
+            // run isn't stranded in Running forever, then rethrow. Best-effort.
             try
             {
-                var runs = await testRunRepository.GetByGroupAsync(group.Id, CancellationToken.None);
-                foreach (var run in runs.Where(r => !r.Status.IsTerminal()))
-                    await run.SetCancelled(CancellationToken.None);
-
-                group = await group.ReloadAsync(CancellationToken.None);
-                if (!group.Status.IsTerminal())
-                {
-                    group = await group.SetCancelled(CancellationToken.None);
-                    broadcaster.PublishGroupComplete(GroupRunCompleteEvent.Create(group));
-                }
+                group = await SettleCancelledAsync(group, CancellationToken.None);
             }
             catch (Exception ex)
             {
@@ -240,12 +311,17 @@ await Parallel.ForEachAsync(
             logger.LogError(ex, "Test run group {GroupId} failed", group.Id);
             try
             {
-                group = await group.ReloadAsync(CancellationToken.None);
-                if (!group.Status.IsTerminal())
+                // Same check-then-act as the cancel path: a user cancelling while the group is
+                // failing must not collide with this transition or its broadcast.
+                using (IDisposable sync = await asyncLock.LockAsync(group.Id, CancellationToken.None))
                 {
-                    group = await group.SetFailed(CancellationToken.None);
+                    group = await group.ReloadAsync(CancellationToken.None);
+                    if (!group.Status.IsTerminal())
+                    {
+                        group = await group.SetFailed(CancellationToken.None);
+                    }
+                    broadcaster.PublishGroupComplete(GroupRunCompleteEvent.Create(group));
                 }
-                broadcaster.PublishGroupComplete(GroupRunCompleteEvent.Create(group));
 
                 // A failed group is the most important anomaly. The success-path enqueue above is
                 // skipped when we land here, so detect from the failure path too.
@@ -332,9 +408,9 @@ private async Task RunTestCase(
             using IModelClient client = agent.CreateClient(
                 customEndpoint: testRun.Endpoint,
                 skipIngestion: true);
-            ICompletion completion = await client.CompleteAsync(
-                testCase.Input,
-                cancellationToken: cancellationToken);
+            ICompletion completion = await ThroughModelCallGateAsync(
+                ct => client.CompleteAsync(testCase.Input, cancellationToken: ct),
+                cancellationToken);
 
             broadcaster.Publish(new InferenceDoneEvent(testRun.Id, testRun.Group.Id, testCase.Id));
 
@@ -399,7 +475,10 @@ private async Task RunEvaluator(
         var sw = Stopwatch.StartNew();
         try
         {
-            evaluation = await evaluator.EvaluateAsync(testResult, cancellationToken);
+            // Agentic evaluators call a model; the rest are local and must not queue behind one.
+            evaluation = evaluator.Kind == EvaluatorKind.Agentic
+                ? await ThroughModelCallGateAsync(ct => evaluator.EvaluateAsync(testResult, ct), cancellationToken)
+                : await evaluator.EvaluateAsync(testResult, cancellationToken);
         }
         catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
         {
diff --git a/Proxytrace.Application/TestRun/TestRunnerConfiguration.cs b/Proxytrace.Application/TestRun/TestRunnerConfiguration.cs
index eedec1e80..3f9e6235d 100644
--- a/Proxytrace.Application/TestRun/TestRunnerConfiguration.cs
+++ b/Proxytrace.Application/TestRun/TestRunnerConfiguration.cs
@@ -3,9 +3,16 @@ namespace Proxytrace.Application.TestRun;
 public sealed class TestRunnerConfiguration
 {
     /// <summary>
-    /// Maximum number of test cases that can execute in parallel within a single test run.
-    /// Default is 2.
+    /// Maximum number of upstream model calls the test runner keeps in flight at once, across every
+    /// running group, run, test case and agentic evaluator. Default is 2.
     /// </summary>
+    /// <remarks>
+    /// This is an absolute cap, not a per-level one. The runner nests three parallel loops (runs →
+    /// test cases → evaluators); applying this value to each of them separately would multiply it,
+    /// so a setting of 2 would allow 8 concurrent calls. <c>TestRunnerService</c> enforces the value
+    /// with a single semaphore around the calls that leave the process, which is what governs
+    /// provider rate limits and spend.
+    /// </remarks>
     public int MaxDegreeOfParallelism { get; init; } = 2;
 }
 
diff --git a/Proxytrace.Common.Tests/LogSafeExtensionsTests.cs b/Proxytrace.Common.Tests/LogSafeExtensionsTests.cs
new file mode 100644
index 000000000..7a037d92f
--- /dev/null
+++ b/Proxytrace.Common.Tests/LogSafeExtensionsTests.cs
@@ -0,0 +1,26 @@
+using AwesomeAssertions;
+using Proxytrace.Common.Text;
+
+namespace Proxytrace.Common.Tests;
+
+[TestClass]
+public sealed class LogSafeExtensionsTests
+{
+    [TestMethod]
+    [DataRow("/api/agents", "/api/agents")]
+    [DataRow("/x\r\nINFO: admin logged in", "/xINFO: admin logged in")]
+    [DataRow("/x\nsecond line", "/xsecond line")]
+    [DataRow("/x\rsecond line", "/xsecond line")]
+    [DataRow("\r\n\r\n", "")]
+    [DataRow("", "")]
+    public void ToSingleLogLine_StripsLineBreaks(string input, string expected)
+        => input.ToSingleLogLine().Should().Be(expected);
+
+    [TestMethod]
+    public void ToSingleLogLine_WithNull_ReturnsEmpty()
+        => ((string?)null).ToSingleLogLine().Should().BeEmpty();
+
+    [TestMethod]
+    public void ToSingleLogLine_Always_LeavesNoLineBreakBehind()
+        => "a\rb\nc\r\nd".ToSingleLogLine().Should().Be("abcd");
+}
diff --git a/Proxytrace.Common/Random/IRandom.cs b/Proxytrace.Common/Random/IRandom.cs
index 00eac67c9..4960b5894 100644
--- a/Proxytrace.Common/Random/IRandom.cs
+++ b/Proxytrace.Common/Random/IRandom.cs
@@ -1,5 +1,22 @@
 namespace Proxytrace.Common.Random;
 
+/// <summary>
+/// Deterministic pseudo-random values for <b>generating test and demo data</b>.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>Never use this for anything security-relevant.</b> The registered implementation is
+/// <c>SeededRandom</c> — a <see cref="System.Random"/> with a <b>fixed seed</b>, so its output is
+/// identical on every run and in every process. That is exactly what test-data generators and the
+/// demo seeder want (reproducible fixtures) and exactly what a credential must never be.
+/// </para>
+/// <para>
+/// Secrets — API keys, invite and password-reset tokens, TOTP secrets, MFA backup codes, stream
+/// tickets — use <see cref="System.Security.Cryptography.RandomNumberGenerator"/> directly at their
+/// point of use. <c>SeededRandomIsNotUsedForSecretsTests</c> enforces the separation: it fails if
+/// any production type outside the generator surface takes an <see cref="IRandom"/> dependency.
+/// </para>
+/// </remarks>
 public interface IRandom
 {
     bool Bool();
diff --git a/Proxytrace.Common/Text/LogSafeExtensions.cs b/Proxytrace.Common/Text/LogSafeExtensions.cs
new file mode 100644
index 000000000..1b5e0f40f
--- /dev/null
+++ b/Proxytrace.Common/Text/LogSafeExtensions.cs
@@ -0,0 +1,24 @@
+namespace Proxytrace.Common.Text;
+
+/// <summary>
+/// Neutralises untrusted values before they are written to a log.
+/// </summary>
+public static class LogSafeExtensions
+{
+    /// <summary>
+    /// Removes the carriage returns and line feeds from a value that came from the request, so it
+    /// cannot forge additional entries in a line-oriented log sink.
+    ///
+    /// The request line itself cannot carry a raw newline, but percent-encoded ones survive URL
+    /// decoding: a request for <c>/x%0D%0AINFO:%20admin%20logged%20in</c> reaches
+    /// <c>Request.Path</c> as two lines, and a flat-file or console sink renders the second as a
+    /// log entry of its own. Structured sinks that keep the value in a field are unaffected, but
+    /// the sink is a deployment choice, so sanitise at the call site instead of assuming one.
+    /// </summary>
+    public static string ToSingleLogLine(this string? value) =>
+        value is null
+            ? string.Empty
+            : value
+                .Replace("\r", string.Empty, StringComparison.Ordinal)
+                .Replace("\n", string.Empty, StringComparison.Ordinal);
+}
diff --git a/Proxytrace.Common/Validation/Validation.cs b/Proxytrace.Common/Validation/Validation.cs
index 459f074ba..997076b4d 100644
--- a/Proxytrace.Common/Validation/Validation.cs
+++ b/Proxytrace.Common/Validation/Validation.cs
@@ -3,12 +3,37 @@
 using System.Text.Json;
 using System.Text.RegularExpressions;
 
-// ReSharper disable NullableWarningSuppressionIsUsed
-
 namespace Proxytrace.Common.Validation;
 
 public static class Validation
 {
+    /// <summary>
+    /// The "no error" result every check below returns on success.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// This is the <b>one sanctioned null-suppression in the repository</b> (CLAUDE.md otherwise
+    /// forbids <c>!</c> outright), and it exists to work around a BCL under-annotation that cannot
+    /// be fixed from here.
+    /// </para>
+    /// <para>
+    /// <see cref="ValidationResult.Success"/> is declared <c>ValidationResult?</c> and its value
+    /// <b>is</b> <c>null</c> — that is how the framework represents success, and
+    /// <see cref="Validator"/> detects it by comparing against <c>null</c>. Yet
+    /// <see cref="IValidatableObject.Validate"/>, which every caller implements, is declared to
+    /// return <c>IEnumerable&lt;ValidationResult&gt;</c> with a <b>non-nullable</b> element type. So
+    /// the framework requires us to yield a value it itself defines as null, through a signature we
+    /// cannot change. Returning any genuinely non-null sentinel instead would be read by
+    /// <see cref="Validator"/> as a validation <i>failure</i>, breaking every entity.
+    /// </para>
+    /// <para>
+    /// Concentrating the suppression here keeps it to a single reviewed line instead of one per
+    /// check. Do not copy the pattern elsewhere; if you need "success" in a new check, return this.
+    /// </para>
+    /// </remarks>
+    // ReSharper disable once NullableWarningSuppressionIsUsed -- see the remarks above.
+    private static ValidationResult Success => ValidationResult.Success!;
+
     /// <summary>
     /// Adapts a nullable <see cref="ValidationResult"/> (where <c>null</c> represents success, matching
     /// <see cref="ValidationResult.Success"/>) to a non-null <see cref="IEnumerable{ValidationResult}"/>
@@ -22,97 +47,97 @@ public static IEnumerable<ValidationResult> AsEnumerable(this ValidationResult?
     public static ValidationResult NotNull(object? value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value is null
             ? new ValidationResult($"{memberName} cannot be null", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult Null(object? value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value is not null
             ? new ValidationResult($"{memberName} must be null", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult NotNullOrWhiteSpace(string? value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => string.IsNullOrWhiteSpace(value)
             ? new ValidationResult($"{memberName} cannot be empty", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult NotNullOrEmpty(string? value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => string.IsNullOrEmpty(value)
             ? new ValidationResult($"{memberName} cannot be null or empty", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult NotDefault<T>(T value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => EqualityComparer<T>.Default.Equals(value, default)
             ? new ValidationResult($"{memberName} cannot be default", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult InPast(DateTimeOffset value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value > DateTimeOffset.UtcNow
             ? new ValidationResult($"{memberName} must be in the past", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult InFuture(DateTimeOffset value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value <= DateTimeOffset.UtcNow
             ? new ValidationResult($"{memberName} must be in the future", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult NotBefore(DateTimeOffset value, DateTimeOffset minValue, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value < minValue
             ? new ValidationResult($"{memberName} cannot be before {minValue}", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult NotAfter(DateTimeOffset value, DateTimeOffset maxValue, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value > maxValue
             ? new ValidationResult($"{memberName} cannot be after {maxValue}", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult NotNegative(decimal value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value < 0
             ? new ValidationResult($"{memberName} cannot be negative", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult Positive(decimal value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value <= 0
             ? new ValidationResult($"{memberName} must be positive", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult LessThan(decimal value, decimal maxValue, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value >= maxValue
             ? new ValidationResult($"{memberName} must be less than {maxValue}", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult LessThanOrEqual(decimal value, decimal maxValue, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value > maxValue
             ? new ValidationResult($"{memberName} must be less than or equal to {maxValue}", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult GreaterThan(decimal value, decimal minValue, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value <= minValue
             ? new ValidationResult($"{memberName} must be greater than {minValue}", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult GreaterThanOrEqual(decimal value, decimal minValue, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value < minValue
             ? new ValidationResult($"{memberName} must be greater than or equal to {minValue}", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult HasCount<T>(IReadOnlyCollection<T> value, int count, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value.Count != count
             ? new ValidationResult($"{memberName} must have {count} items", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult MaxLength(string? value, int maxLength, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => (value?.Length ?? 0) > maxLength
             ? new ValidationResult($"{memberName} cannot be longer than {maxLength} characters", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult MinLength(string? value, int minLength, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => (value?.Length ?? 0) < minLength
             ? new ValidationResult($"{memberName} cannot be shorter than {minLength} characters", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult ExactLength(string? value, int length, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => (value?.Length ?? 0) != length
             ? new ValidationResult($"{memberName} must be exactly {length} characters", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult NotEmpty(string? value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => MinLength(value, 1, memberName);
@@ -120,30 +145,30 @@ public static ValidationResult NotEmpty(string? value, [CallerArgumentExpression
     public static ValidationResult NotEmpty<T>(IReadOnlyCollection<T> value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value.Count == 0
             ? new ValidationResult($"{memberName} cannot be empty", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult Matches(string? value, string pattern, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value is null || !Regex.IsMatch(value, pattern)
             ? new ValidationResult($"{memberName} does not match the required pattern", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult ValidUri(string? value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => !Uri.TryCreate(value, UriKind.Absolute, out var uri) || string.IsNullOrEmpty(uri.Host)
             ? new ValidationResult($"{memberName} must be a valid absolute URI", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult Defined<TEnum>(TEnum value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         where TEnum : struct, Enum
         => !Enum.IsDefined(typeof(TEnum), value)
             ? new ValidationResult($"{memberName} has an undefined value {value}", [memberName])
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult Json(string value, [CallerArgumentExpression(nameof(value))] string memberName = "")
     {
         try
         {
             JsonDocument.Parse(value);
-            return ValidationResult.Success!;
+            return Success;
         }
         catch
         {
@@ -154,20 +179,20 @@ public static ValidationResult Json(string value, [CallerArgumentExpression(name
     public static ValidationResult InRange(int value, int greateOrEqual, int lessOrEqual, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => value < greateOrEqual || value > lessOrEqual
             ? new ValidationResult($"{memberName} must be between {greateOrEqual} and {lessOrEqual}")
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult GreaterThan(int variable, int greaterThan, [CallerArgumentExpression(nameof(variable))] string memberName = "")
         => variable <= greaterThan
             ? new ValidationResult($"{memberName} must be greater than {greaterThan}")
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult Positive(TimeSpan variable, [CallerArgumentExpression(nameof(variable))] string memberName = "")
         => variable <= TimeSpan.Zero
             ? new ValidationResult($"{memberName} must be positive")
-            : ValidationResult.Success!;
+            : Success;
 
     public static ValidationResult True(bool value, [CallerArgumentExpression(nameof(value))] string memberName = "")
         => !value 
             ? new ValidationResult($"{memberName} must be true")
-            : ValidationResult.Success!;
+            : Success;
 }
diff --git a/Proxytrace.Domain.Tests/ProviderEndpointsTests.cs b/Proxytrace.Domain.Tests/ProviderEndpointsTests.cs
index d378e83ab..21db30b07 100644
--- a/Proxytrace.Domain.Tests/ProviderEndpointsTests.cs
+++ b/Proxytrace.Domain.Tests/ProviderEndpointsTests.cs
@@ -11,6 +11,9 @@ public sealed class ProviderEndpointsTests
     [DataRow("https://eastus.api.cognitive.microsoft.azure.com/", true)]
     [DataRow("https://api.openai.com/v1", false)]
     [DataRow("https://api.anthropic.com/v1", false)]
+    // Lookalike hosts must not match: the suffix is a domain boundary, not a substring.
+    [DataRow("https://my-azure.com.example.net/v1", false)]
+    [DataRow("https://notazure.com/v1", false)]
     public void IsAzure_DetectsByHost(string endpoint, bool expected)
     {
         ProviderEndpoints.IsAzure(new Uri(endpoint)).Should().Be(expected);
diff --git a/Proxytrace.Domain.Tests/SecretRedactionToStringTests.cs b/Proxytrace.Domain.Tests/SecretRedactionToStringTests.cs
new file mode 100644
index 000000000..37b3aecd6
--- /dev/null
+++ b/Proxytrace.Domain.Tests/SecretRedactionToStringTests.cs
@@ -0,0 +1,108 @@
+using AwesomeAssertions;
+using Microsoft.Extensions.DependencyInjection;
+using Proxytrace.Domain.Kiosk;
+using Proxytrace.Domain.ModelProvider;
+using Proxytrace.Domain.Notification;
+using Proxytrace.Domain.Notifications;
+using Proxytrace.Domain.UserTotpEnrollment;
+using Proxytrace.Testing;
+
+namespace Proxytrace.Domain.Tests;
+
+/// <summary>
+/// A record's generated ToString() prints every member, so any secret-bearing record leaks its
+/// plaintext the first time someone writes <c>logger.LogX("... {Settings}", settings)</c> or
+/// interpolates it into an exception message. Every record that carries a replayable secret must
+/// therefore override PrintMembers and mask it, the way ModelProvider does. See docs/security.md.
+/// </summary>
+[TestClass]
+public sealed class SecretRedactionToStringTests : DomainTest<Module>
+{
+    [TestMethod]
+    public void EmailSettings_ToString_RedactsSmtpPassword()
+    {
+        var settings = new EmailSettings(
+            Enabled: true,
+            SmtpHost: "smtp.example.com",
+            SmtpPort: 587,
+            Security: SmtpSecurity.StartTls,
+            Username: "postmaster@example.com",
+            Password: "super-secret-smtp-password",
+            FromAddress: "noreply@example.com",
+            FromName: "Proxytrace",
+            AppBaseUrl: "https://proxytrace.example.com",
+            MinSeverity: NotificationSeverity.Warning);
+
+        var text = settings.ToString();
+
+        text.Should().NotContain("super-secret-smtp-password");
+        text.Should().Contain("Password = ***");
+        // The non-secret members still render, so the type stays useful in a log line.
+        text.Should().Contain("smtp.example.com").And.Contain("postmaster@example.com");
+    }
+
+    [TestMethod]
+    public void KioskEndpointOptions_ToString_RedactsApiKey()
+    {
+        var options = new KioskEndpointOptions
+        {
+            BaseUrl = "https://api.openai.com/v1",
+            ApiKey = "sk-kiosk-secret-value",
+            Model = "gpt-4o",
+        };
+
+        var text = options.ToString();
+
+        text.Should().NotContain("sk-kiosk-secret-value");
+        text.Should().Contain("ApiKey = ***");
+        text.Should().Contain("gpt-4o");
+    }
+
+    [TestMethod]
+    public void ResolvedKioskEndpoint_ToString_RedactsApiKey()
+    {
+        var resolved = new KioskEndpointOptions
+        {
+            BaseUrl = "https://api.openai.com/v1",
+            ApiKey = "sk-kiosk-secret-value",
+            Model = "gpt-4o",
+        }.Resolve();
+
+        var text = resolved.ToString();
+
+        text.Should().NotContain("sk-kiosk-secret-value");
+        text.Should().Contain("ApiKey = ***");
+        text.Should().Contain("gpt-4o");
+    }
+
+    [TestMethod]
+    public async Task UserTotpEnrollment_ToString_RedactsSharedSecret()
+    {
+        IServiceProvider services = GetServices();
+        var enrollment = await services
+            .GetRequiredService<IDomainEntityGenerator<IUserTotpEnrollment>>()
+            .CreateAsync(CancellationToken);
+
+        var text = enrollment.ToString();
+
+        text.Should().NotBeNull();
+        text.Should().NotContain(enrollment.Secret);
+        text.Should().Contain("Secret = ***");
+    }
+
+    [TestMethod]
+    public async Task ModelProvider_ToString_RedactsApiKey()
+    {
+        // Pins the reference implementation the four peers above mirror.
+        IServiceProvider services = GetServices();
+        var provider = await services
+            .GetRequiredService<IDomainEntityGenerator<IModelProvider>>()
+            .CreateAsync(CancellationToken);
+
+        var text = provider.ToString();
+
+        text.Should().NotBeNull();
+        text.Should().NotContain(provider.ApiKey);
+        text.Should().Contain("ApiKey = ***");
+    }
+}
diff --git a/Proxytrace.Domain.Tests/TestRunGroupValidationTests.cs b/Proxytrace.Domain.Tests/TestRunGroupValidationTests.cs
index 667db4948..6c056b5fb 100644
--- a/Proxytrace.Domain.Tests/TestRunGroupValidationTests.cs
+++ b/Proxytrace.Domain.Tests/TestRunGroupValidationTests.cs
@@ -125,7 +125,7 @@ public async Task CreateExisting_RestoresAllProperties()
         var generator = services.GetRequiredService<IDomainEntityGenerator<ITestRunGroup>>();
         var existing = await generator.CreateAsync(CancellationToken);
 
-        var group = createExisting(existing.Suite, existing.Status, existing.CompletedAt, existing.IsSystemRun, existing.ScheduleId, existing.SampleCount, existing);
+        var group = createExisting(existing.Suite, existing.Status, existing.CompletedAt, existing.IsSystemRun, existing.ScheduleId, existing.SampleCount, existing.OptimizationConsideredAt, existing);
 
         group.Id.Should().Be(existing.Id);
         group.Suite.Should().Be(existing.Suite);
@@ -133,6 +133,7 @@ public async Task CreateExisting_RestoresAllProperties()
         group.CompletedAt.Should().Be(existing.CompletedAt);
         group.IsSystemRun.Should().Be(existing.IsSystemRun);
         group.ScheduleId.Should().Be(existing.ScheduleId);
+        group.OptimizationConsideredAt.Should().Be(existing.OptimizationConsideredAt);
         group.CreatedAt.Should().Be(existing.CreatedAt);
         group.UpdatedAt.Should().Be(existing.UpdatedAt);
     }
diff --git a/Proxytrace.Domain.Tests/TestRunScheduleValidationTests.cs b/Proxytrace.Domain.Tests/TestRunScheduleValidationTests.cs
index 522af74ae..38224e7cc 100644
--- a/Proxytrace.Domain.Tests/TestRunScheduleValidationTests.cs
+++ b/Proxytrace.Domain.Tests/TestRunScheduleValidationTests.cs
@@ -107,6 +107,28 @@ public async Task CreateNew_WithPastAnchor_AlignsNextRunToTheAnchorTimeOfDay()
         ((schedule.NextRunAt - anchor).Ticks % day.Ticks).Should().Be(0);
     }
 
+    [TestMethod]
+    public async Task CreateNew_WithNonUtcOffsetPastAnchor_FirstRunIsStrictlyInTheFuture()
+    {
+        IServiceProvider services = GetServicesWithRepository();
+        var factory = services.GetRequiredService<ITestRunSchedule.CreateNew>();
+        var suite = await GetOrCreate<ITestSuite>(services);
+        var endpoint = await GetOrCreate<IModelEndpoint>(services);
+
+        // Same instant, expressed at +02:00: DateTimeOffset.Ticks is the wall-clock reading, so it
+        // reads two hours higher than UtcTicks. Offset-naive alignment therefore loses a whole step
+        // and puts the first fire an hour in the PAST — which the scheduler then re-derives on every
+        // 60s poll, firing (and LLM-billing) the suite once a minute.
+        var day = TimeSpan.FromDays(1);
+        var anchor = DateTimeOffset.UtcNow.AddDays(-30).AddHours(-1).ToOffset(TimeSpan.FromHours(2));
+
+        var schedule = factory("Nightly", suite, [endpoint], day, true, anchor);
+
+        schedule.NextRunAt.Should().BeAfter(schedule.CreatedAt);
+        schedule.NextRunAt.Should().BeAfter(DateTimeOffset.UtcNow);
+        ((schedule.NextRunAt - anchor).Ticks % day.Ticks).Should().Be(0);
+    }
+
     [TestMethod]
     public async Task CreateNew_IdsAreUniquePerInstance()
     {
@@ -247,6 +269,29 @@ public async Task RecordFired_WithManyMissedIntervals_CollapsesIntoSingleForward
         (fired.NextRunAt - now).Should().BeLessThanOrEqualTo(TimeSpan.FromHours(1));
     }
 
+    [TestMethod]
+    public async Task RecordFired_WithNonUtcOffsetAnchor_AdvancesNextRunStrictlyAfterNow()
+    {
+        IServiceProvider services = GetServicesWithRepository();
+        var factory = services.GetRequiredService<ITestRunSchedule.CreateNew>();
+        var repo = services.GetRequiredService<IRepository<ITestRunSchedule>>();
+        var suite = await GetOrCreate<ITestSuite>(services);
+        var endpoint = await GetOrCreate<IModelEndpoint>(services);
+
+        // Daily schedule anchored at 09:00+02:00 (= 07:00Z), fired five seconds past 07:00Z. Naive
+        // tick subtraction understates the gap by the 2h offset, drops a step, and yields 07:00Z —
+        // five seconds in the past — so the schedule stays perpetually due.
+        var anchor = new DateTimeOffset(2026, 7, 1, 9, 0, 0, TimeSpan.FromHours(2));
+        var now = new DateTimeOffset(2026, 7, 27, 7, 0, 5, TimeSpan.Zero);
+        var schedule = await repo.AddAsync(
+            factory("Nightly", suite, [endpoint], TimeSpan.FromDays(1), true, anchor), CancellationToken);
+
+        var fired = await schedule.RecordFired(now, CancellationToken);
+
+        fired.NextRunAt.Should().BeAfter(now);
+        fired.NextRunAt.Should().Be(new DateTimeOffset(2026, 7, 28, 9, 0, 0, TimeSpan.FromHours(2)));
+    }
+
     [TestMethod]
     public async Task RecordFired_PersistsLastRunAndNextRun()
     {
@@ -324,6 +369,24 @@ public async Task Update_WithNewAnchor_RecomputesNextRunToTheNewAnchor()
         updated.NextRunAt.Should().Be(newAnchor);
     }
 
+    [TestMethod]
+    public async Task Update_WithNonUtcOffsetPastAnchor_RecomputesNextRunStrictlyAfterNow()
+    {
+        IServiceProvider services = GetServicesWithRepository();
+        var endpoint = await GetOrCreate<IModelEndpoint>(services);
+        var schedule = await CreateSchedule(services, interval: TimeSpan.FromHours(1));
+
+        // Re-anchor onto a +02:00 wall-clock time whose instant is a whole number of days before
+        // `now`; the third AlignForward call site must be offset-aware too.
+        var anchor = new DateTimeOffset(2026, 7, 1, 9, 0, 0, TimeSpan.FromHours(2));
+        var now = new DateTimeOffset(2026, 7, 27, 7, 0, 5, TimeSpan.Zero);
+
+        var updated = await schedule.Update(
+            "Nightly", [endpoint], TimeSpan.FromDays(1), true, anchor, now, CancellationToken);
+
+        updated.NextRunAt.Should().BeAfter(now);
+    }
+
     [TestMethod]
     public async Task Update_WhenCadenceUnchanged_PreservesOverdueNextRun()
     {
diff --git a/Proxytrace.Domain/AgentCall/AgentCallFilter.cs b/Proxytrace.Domain/AgentCall/AgentCallFilter.cs
index 68b47eb37..bdd4851e4 100644
--- a/Proxytrace.Domain/AgentCall/AgentCallFilter.cs
+++ b/Proxytrace.Domain/AgentCall/AgentCallFilter.cs
@@ -21,4 +21,5 @@ public record AgentCallFilter(
     string? ToolName = null,
     AgentCallSortField SortBy = AgentCallSortField.CreatedAt,
     bool SortDescending = true,
-    Guid? SessionId = null);
+    Guid? SessionId = null,
+    IReadOnlyCollection<Guid>? ProjectIds = null);
diff --git a/Proxytrace.Domain/AgentCall/IAgentCallRepository.cs b/Proxytrace.Domain/AgentCall/IAgentCallRepository.cs
index 38ddb77c3..d30cbaed2 100644
--- a/Proxytrace.Domain/AgentCall/IAgentCallRepository.cs
+++ b/Proxytrace.Domain/AgentCall/IAgentCallRepository.cs
@@ -55,9 +55,27 @@ Task<AgentCallSummary> GetSummaryAsync(
     /// Returns the timestamp of the most recent call for each agent, keyed by agent ID.
     /// Agents with no calls are omitted.
     /// </summary>
+    /// <remarks>
+    /// This aggregates the <b>entire</b> trace table. Only call it when every agent's timestamp is
+    /// genuinely needed (a listing); for a single agent use
+    /// <see cref="GetLastCallTimeAsync"/>, which is filtered.
+    /// </remarks>
     Task<IReadOnlyDictionary<Guid, DateTimeOffset>> GetLastCallTimesAsync(
         CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Returns the timestamp of the most recent call for a single agent, or <see langword="null"/>
+    /// when it has none.
+    /// </summary>
+    /// <remarks>
+    /// Filtered to the one agent's versions so the database aggregates only that agent's rows —
+    /// the single-agent GET is a hot path, and running the whole-table grouping there made its
+    /// cost grow with the trace table rather than with the agent.
+    /// </remarks>
+    Task<DateTimeOffset?> GetLastCallTimeAsync(
+        Guid agentId,
+        CancellationToken cancellationToken = default);
+
     /// <summary>
     /// Returns the most recently created call for the given conversation, or <see langword="null"/> if none exists.
     /// </summary>
diff --git a/Proxytrace.Domain/ApiKey/ApiKeyScopes.cs b/Proxytrace.Domain/ApiKey/ApiKeyScopes.cs
index 7faef81d6..51c43cb86 100644
--- a/Proxytrace.Domain/ApiKey/ApiKeyScopes.cs
+++ b/Proxytrace.Domain/ApiKey/ApiKeyScopes.cs
@@ -29,4 +29,21 @@ public enum ApiKeyScopes
 
     /// <summary>Mutate project data over the REST API (<c>POST</c>/<c>PUT</c>/<c>PATCH</c>/<c>DELETE</c> requests).</summary>
     ApiWrite = 16,
+
+    /// <summary>
+    /// Forward non-inference paths through the proxy to the provider's host
+    /// (<c>/{project}/health</c> and anything else the upstream serves).
+    /// </summary>
+    /// <remarks>
+    /// Separate from <see cref="Ingestion"/> because its reach is different in kind. Pass-through
+    /// relays <b>any</b> method and <b>any</b> path to the provider origin with the organisation's
+    /// real upstream credential attached — on a provider that serves account or
+    /// organization-management routes at the same host, that is the provider account's reach, not
+    /// just its inference API. It is also not detected, traced, or audited. Granting it should
+    /// therefore be a decision, not a side effect of being allowed to capture traffic.
+    ///
+    /// Keys minted before this scope existed were granted it by migration, so the documented
+    /// "reach other upstream endpoints" setup keeps working; new keys must ask for it.
+    /// </remarks>
+    Passthrough = 32,
 }
diff --git a/Proxytrace.Domain/ApiKey/IApiKeyRepository.cs b/Proxytrace.Domain/ApiKey/IApiKeyRepository.cs
index 5a691d757..bfc64ee1b 100644
--- a/Proxytrace.Domain/ApiKey/IApiKeyRepository.cs
+++ b/Proxytrace.Domain/ApiKey/IApiKeyRepository.cs
@@ -14,4 +14,14 @@ public interface IApiKeyRepository : IRepository<IApiKey>
     /// Returns all API keys belonging to the provider identified by <paramref name="providerId"/>.
     /// </summary>
     Task<IReadOnlyList<IApiKey>> GetByProviderAsync(Guid providerId, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Returns the names of the API keys owned by <paramref name="ownerId"/>.
+    /// </summary>
+    /// <remarks>
+    /// Used to refuse a user deletion that would otherwise strand or destroy live credentials. Only
+    /// the names are returned — enough to tell the operator which integrations are affected, and
+    /// nothing that could be replayed.
+    /// </remarks>
+    Task<IReadOnlyList<string>> GetKeyNamesByOwnerAsync(Guid ownerId, CancellationToken cancellationToken = default);
 }
\ No newline at end of file
diff --git a/Proxytrace.Domain/AuditLog/AuditAction.cs b/Proxytrace.Domain/AuditLog/AuditAction.cs
index 2c43d2fd5..69c0928e2 100644
--- a/Proxytrace.Domain/AuditLog/AuditAction.cs
+++ b/Proxytrace.Domain/AuditLog/AuditAction.cs
@@ -118,4 +118,10 @@ public enum AuditAction
     // ProviderConfigUpdated so security review can find rotations without diffing configurations.
     // The key value itself is never recorded.
     ProviderUpstreamKeyRotated = 70,
+
+    // An administrator read a provider's upstream API key back in the clear. The key used to ship
+    // with every providers-page load, so nothing recorded who had actually seen it; it is now
+    // returned only from a dedicated endpoint, and each read lands here. The key value itself is
+    // never recorded.
+    ProviderUpstreamKeyRevealed = 71,
 }
diff --git a/Proxytrace.Domain/Kiosk/KioskEndpointOptions.cs b/Proxytrace.Domain/Kiosk/KioskEndpointOptions.cs
index 25a918880..c700efcdf 100644
--- a/Proxytrace.Domain/Kiosk/KioskEndpointOptions.cs
+++ b/Proxytrace.Domain/Kiosk/KioskEndpointOptions.cs
@@ -1,3 +1,4 @@
+using System.Text;
 using Proxytrace.Domain.ModelProvider;
 
 namespace Proxytrace.Domain.Kiosk;
@@ -103,6 +104,25 @@ public ResolvedKioskEndpoint Resolve()
             InputTokenCost,
             OutputTokenCost);
     }
+
+    // Redact the upstream provider credential from the record's generated ToString()/PrintMembers so
+    // it never leaks into a log line, exception message or debugger string — the same treatment
+    // ModelProvider gives its API key. Note Resolve() already throws with the *unredacted* BaseUrl
+    // and Kind only, never the key. Private, not protected virtual, because this record is sealed and
+    // derives from object.
+    private bool PrintMembers(StringBuilder builder)
+    {
+        builder.Append("BaseUrl = ").Append(BaseUrl)
+            .Append(", ApiKey = ***")
+            .Append(", Model = ").Append(Model)
+            .Append(", Kind = ").Append(Kind)
+            .Append(", ProviderName = ").Append(ProviderName)
+            .Append(", InputTokenCost = ").Append(InputTokenCost)
+            .Append(", OutputTokenCost = ").Append(OutputTokenCost)
+            .Append(", HasAnyCredential = ").Append(HasAnyCredential)
+            .Append(", IsConfigured = ").Append(IsConfigured);
+        return true;
+    }
 }
 
 /// <summary>
@@ -115,4 +135,19 @@ public sealed record ResolvedKioskEndpoint(
     ModelProviderKind Kind,
     string ProviderName,
     decimal? InputTokenCost,
-    decimal? OutputTokenCost);
+    decimal? OutputTokenCost)
+{
+    // Same redaction as KioskEndpointOptions: this record carries the resolved, definitely-present
+    // upstream credential, so its textual rendering must never contain it.
+    private bool PrintMembers(StringBuilder builder)
+    {
+        builder.Append("BaseUrl = ").Append(BaseUrl)
+            .Append(", ApiKey = ***")
+            .Append(", Model = ").Append(Model)
+            .Append(", Kind = ").Append(Kind)
+            .Append(", ProviderName = ").Append(ProviderName)
+            .Append(", InputTokenCost = ").Append(InputTokenCost)
+            .Append(", OutputTokenCost = ").Append(OutputTokenCost);
+        return true;
+    }
+}
diff --git a/Proxytrace.Domain/MfaBackupCode/IMfaBackupCode.cs b/Proxytrace.Domain/MfaBackupCode/IMfaBackupCode.cs
index b63aa6a43..e271b62c4 100644
--- a/Proxytrace.Domain/MfaBackupCode/IMfaBackupCode.cs
+++ b/Proxytrace.Domain/MfaBackupCode/IMfaBackupCode.cs
@@ -13,7 +13,17 @@ public interface IMfaBackupCode : IDomainEntity<IMfaBackupCode>
     /// <summary>The user who owns this backup code.</summary>
     IUser User { get; }
 
-    /// <summary>SHA-256 hash of the raw backup code. Verify-only — the raw code is unrecoverable.</summary>
+    /// <summary>
+    /// Salted, slow hash of the raw backup code (PBKDF2, via <c>IPasswordService</c>). Verify-only —
+    /// the raw code is unrecoverable.
+    /// </summary>
+    /// <remarks>
+    /// Deliberately <b>not</b> the unkeyed SHA-256 used for Proxytrace-generated 256-bit secrets. A
+    /// backup code is ~50 bits (10 characters over a 32-symbol alphabet), which is chosen to be
+    /// typeable rather than unguessable, and one unsalted single-round hash per code means a single
+    /// dump can be attacked against every user's codes at once on commodity GPU hardware. Per-code
+    /// salting removes the shared work, and the iteration count removes the throughput.
+    /// </remarks>
     string CodeHash { get; }
 
     /// <summary>When the code was redeemed, or <see langword="null"/> if still usable.</summary>
diff --git a/Proxytrace.Domain/ModelEndpoint/IModelClient.cs b/Proxytrace.Domain/ModelEndpoint/IModelClient.cs
index 42b59ad78..4af2ead7d 100644
--- a/Proxytrace.Domain/ModelEndpoint/IModelClient.cs
+++ b/Proxytrace.Domain/ModelEndpoint/IModelClient.cs
@@ -9,7 +9,8 @@ namespace Proxytrace.Domain.ModelEndpoint;
 
 public record ModelOptions(
     string ModelName,
-    IReadOnlyList<ToolSpecification> Tools)
+    IReadOnlyList<ToolSpecification> Tools,
+    ModelSamplingParameters? Sampling = null)
 {
 
     public static ModelOptions FromModel(IModel model)
@@ -23,6 +24,48 @@ public static ModelOptions FromAgent(IAgent agent, IModel model)
             Tools: agent.Tools);
 }
 
+/// <summary>
+/// Per-request sampling overrides. Every member is optional; a <see langword="null"/> leaves the
+/// provider's own default in place rather than sending a value.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Added because the playground offered these controls, mapped them through its request DTO, and
+/// then had nowhere to put them — <see cref="ModelOptions"/> carried only the model name and tools,
+/// so every one of them was dropped before the request left the process. Changing temperature in the
+/// playground did nothing at all, silently.
+/// </para>
+/// <para>
+/// Support is per-provider: an OpenAI-compatible backend may reject or ignore individual fields
+/// (reasoning models, for instance, refuse <c>temperature</c>). Nothing is validated here — the
+/// provider's own error is the honest answer, and it now actually reaches the user instead of the
+/// value being discarded locally.
+/// </para>
+/// </remarks>
+public record ModelSamplingParameters(
+    double? Temperature = null,
+    double? TopP = null,
+    double? FrequencyPenalty = null,
+    double? PresencePenalty = null,
+    int? MaxOutputTokens = null,
+    long? Seed = null,
+    IReadOnlyList<string>? StopSequences = null,
+    string? ReasoningEffort = null,
+    int? ChoiceCount = null)
+{
+    /// <summary>True when no override is set, so the request carries the provider's defaults.</summary>
+    public bool IsEmpty
+        => Temperature is null
+           && TopP is null
+           && FrequencyPenalty is null
+           && PresencePenalty is null
+           && MaxOutputTokens is null
+           && Seed is null
+           && (StopSequences is null || StopSequences.Count == 0)
+           && string.IsNullOrWhiteSpace(ReasoningEffort)
+           && ChoiceCount is null;
+}
+
 public record TypedCompletion<TOutput>(TOutput? Response, TokenUsage? Usage, TimeSpan Latency);
 
 /// <summary>
diff --git a/Proxytrace.Domain/ModelProvider/ProviderEndpoints.cs b/Proxytrace.Domain/ModelProvider/ProviderEndpoints.cs
index c62959861..17115a76e 100644
--- a/Proxytrace.Domain/ModelProvider/ProviderEndpoints.cs
+++ b/Proxytrace.Domain/ModelProvider/ProviderEndpoints.cs
@@ -9,9 +9,17 @@ public static class ProviderEndpoints
     /// </summary>
     public const string AzureDeploymentsApiVersion = "2023-03-15-preview";
 
-    /// <summary>True when the endpoint host indicates an Azure OpenAI resource.</summary>
+    /// <summary>
+    /// True when the endpoint host indicates an Azure OpenAI resource. Matched as a domain suffix,
+    /// not a substring: a substring test also accepts lookalike hosts such as
+    /// <c>my-azure.com.example.net</c>, and misclassifying one as Azure makes the proxy attach the
+    /// provider credential in a second <c>api-key</c> header on top of the bearer.
+    /// </summary>
     public static bool IsAzure(Uri endpoint) =>
-        endpoint.Host.Contains("azure.com", StringComparison.OrdinalIgnoreCase);
+        endpoint.Host.Equals(AzureDomain, StringComparison.OrdinalIgnoreCase)
+        || endpoint.Host.EndsWith($".{AzureDomain}", StringComparison.OrdinalIgnoreCase);
+
+    private const string AzureDomain = "azure.com";
 
     /// <summary>
     /// The deployments-listing URI for an Azure OpenAI resource (<c>/openai/deployments?api-version=…</c>),
diff --git a/Proxytrace.Domain/Notification/NotificationKind.cs b/Proxytrace.Domain/Notification/NotificationKind.cs
index 663a452e9..830a15ace 100644
--- a/Proxytrace.Domain/Notification/NotificationKind.cs
+++ b/Proxytrace.Domain/Notification/NotificationKind.cs
@@ -12,4 +12,15 @@ public enum NotificationKind
 
     /// <summary>An optimization proposal has been generated and is awaiting review.</summary>
     ProposalReady,
+
+    /// <summary>
+    /// The installation has reached its licensed monthly trace limit and captures for this project
+    /// are being dropped.
+    /// </summary>
+    /// <remarks>
+    /// A dropped capture is still acknowledged to the client — failing the proxied call would take
+    /// the caller's application down over a billing limit — so without this notification the only
+    /// symptom was traces quietly going missing.
+    /// </remarks>
+    TraceQuotaReached,
 }
diff --git a/Proxytrace.Domain/Notifications/EmailSettings.cs b/Proxytrace.Domain/Notifications/EmailSettings.cs
index fd62cfd90..4b50b02d8 100644
--- a/Proxytrace.Domain/Notifications/EmailSettings.cs
+++ b/Proxytrace.Domain/Notifications/EmailSettings.cs
@@ -1,3 +1,4 @@
+using System.Text;
 using Proxytrace.Domain.Notification;
 
 namespace Proxytrace.Domain.Notifications;
@@ -26,4 +27,25 @@ public sealed record EmailSettings(
     string FromAddress,
     string FromName,
     string? AppBaseUrl,
-    NotificationSeverity MinSeverity);
+    NotificationSeverity MinSeverity)
+{
+    // Redact the SMTP password from the record's generated ToString()/PrintMembers so it never leaks
+    // into a log line, exception message or debugger string — the same treatment ModelProvider gives
+    // its upstream API key. Password stays a normal member (the mailer reads it; equality keeps it);
+    // only its textual rendering is masked. Private, not protected virtual, because this record is
+    // sealed and derives from object.
+    private bool PrintMembers(StringBuilder builder)
+    {
+        builder.Append("Enabled = ").Append(Enabled)
+            .Append(", SmtpHost = ").Append(SmtpHost)
+            .Append(", SmtpPort = ").Append(SmtpPort)
+            .Append(", Security = ").Append(Security)
+            .Append(", Username = ").Append(Username)
+            .Append(", Password = ***")
+            .Append(", FromAddress = ").Append(FromAddress)
+            .Append(", FromName = ").Append(FromName)
+            .Append(", AppBaseUrl = ").Append(AppBaseUrl)
+            .Append(", MinSeverity = ").Append(MinSeverity);
+        return true;
+    }
+}
diff --git a/Proxytrace.Domain/Paging/Paging.cs b/Proxytrace.Domain/Paging/Paging.cs
index 545b47c06..d4e6b4500 100644
--- a/Proxytrace.Domain/Paging/Paging.cs
+++ b/Proxytrace.Domain/Paging/Paging.cs
@@ -6,4 +6,16 @@ public static class Paging
 
     public static (int Page, int PageSize) Clamp(int page, int pageSize)
         => (Math.Max(1, page), Math.Clamp(pageSize, 1, MaxPageSize));
+
+    /// <summary>
+    /// The number of rows to skip for a 1-based <paramref name="page"/>, saturating at
+    /// <see cref="int.MaxValue"/> instead of overflowing.
+    ///
+    /// A plain <c>(page - 1) * pageSize</c> overflows to a <em>negative</em> int for a large page
+    /// (e.g. page 2147483647 × pageSize 100), and both <c>Enumerable.Skip</c> and
+    /// <c>Queryable.Skip</c> treat a negative count as zero — so the caller silently receives
+    /// page 1 again instead of an empty page, which makes an offset-paging integration loop forever.
+    /// </summary>
+    public static int Offset(int page, int pageSize)
+        => (int)Math.Min((long)(Math.Max(1, page) - 1) * Math.Max(1, pageSize), int.MaxValue);
 }
diff --git a/Proxytrace.Domain/Security/ISecretIndexer.cs b/Proxytrace.Domain/Security/ISecretIndexer.cs
new file mode 100644
index 000000000..c89b0db50
--- /dev/null
+++ b/Proxytrace.Domain/Security/ISecretIndexer.cs
@@ -0,0 +1,52 @@
+namespace Proxytrace.Domain.Security;
+
+/// <summary>
+/// Deterministic blind index for a secret that is <b>not</b> guaranteed to be high-entropy — today,
+/// the operator-entered upstream provider API key.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <see cref="ISecretHasher"/> is a plain unkeyed SHA-256, which is safe only because the secrets it
+/// covers are 256-bit CSPRNG values that a dump cannot reverse. The upstream provider key is not one
+/// of those: an operator types it in, and self-hosted OpenAI-compatible backends conventionally use
+/// values like <c>EMPTY</c>, <c>ollama</c>, or <c>sk-1234</c>. An unkeyed index over those falls to a
+/// wordlist in seconds, which would undo the column encryption sitting right beside it.
+/// </para>
+/// <para>
+/// The index is therefore an <b>HMAC under a key that never leaves the deployment</b> (see
+/// <c>docs/security.md</c>). A dump of the database alone no longer yields the key, because it does
+/// not contain the HMAC key.
+/// </para>
+/// <para>
+/// Values are prefixed with a scheme marker so the storage layer can tell a keyed index from a
+/// legacy unkeyed one and upgrade rows in place.
+/// </para>
+/// </remarks>
+public interface ISecretIndexer
+{
+    /// <summary>
+    /// Returns the blind index for <paramref name="value"/>, prefixed with its scheme marker.
+    /// </summary>
+    string Index(string value);
+
+    /// <summary>
+    /// Returns the pre-keying unkeyed index for <paramref name="value"/>.
+    /// </summary>
+    /// <remarks>
+    /// Only for matching rows that predate the keyed scheme, so a lookup keeps working until the
+    /// backfill has upgraded them. Never write this for a new row.
+    /// </remarks>
+    string LegacyIndex(string value);
+
+    /// <summary>
+    /// Whether <see cref="Index"/> is actually keyed.
+    /// </summary>
+    /// <remarks>
+    /// False when no persisted key is available (no <c>PROXYTRACE_DATA_DIR</c> — Development and the
+    /// test harnesses). The index then falls back to the legacy unkeyed form rather than to an
+    /// ephemeral key, because an ephemeral key would silently stop every existing provider from
+    /// authenticating on the next restart. The backfill uses this to decide whether upgrading rows
+    /// is safe.
+    /// </remarks>
+    bool IsKeyed { get; }
+}
diff --git a/Proxytrace.Domain/Security/SecretIndexScheme.cs b/Proxytrace.Domain/Security/SecretIndexScheme.cs
new file mode 100644
index 000000000..92f6130ce
--- /dev/null
+++ b/Proxytrace.Domain/Security/SecretIndexScheme.cs
@@ -0,0 +1,17 @@
+namespace Proxytrace.Domain.Security;
+
+/// <summary>
+/// Scheme markers stored inline in a blind-index column.
+/// </summary>
+/// <remarks>
+/// A hex SHA-256 and a hex HMAC-SHA256 are both 64 characters, so length cannot tell the pre-keying
+/// index from the keyed one. The scheme is therefore written into the value itself, which is what
+/// lets the lookup match both while rows are being upgraded and lets the backfill find the ones that
+/// still need upgrading. Shared here because both the infrastructure implementation and the storage
+/// backfill need the same literal.
+/// </remarks>
+public static class SecretIndexScheme
+{
+    /// <summary>Prefix identifying a keyed (HMAC-SHA256) blind index.</summary>
+    public const string KeyedPrefix = "hmac1:";
+}
diff --git a/Proxytrace.Domain/TestRunGroup/ITestRunGroup.cs b/Proxytrace.Domain/TestRunGroup/ITestRunGroup.cs
index d2bfa8710..17f129a00 100644
--- a/Proxytrace.Domain/TestRunGroup/ITestRunGroup.cs
+++ b/Proxytrace.Domain/TestRunGroup/ITestRunGroup.cs
@@ -46,6 +46,24 @@ public interface ITestRunGroup : IDomainEntity<ITestRunGroup>
     /// <summary>The schedule that triggered this group, or null for a manual/system run.</summary>
     Guid? ScheduleId { get; }
 
+    /// <summary>
+    /// When the optimizer finished looking at this group, or <see langword="null"/> if it has not
+    /// yet been considered.
+    /// </summary>
+    /// <remarks>
+    /// A durable marker for a queue that is otherwise in memory. Completed groups are handed to the
+    /// optimizer through an unbounded in-process channel; a restart discarded whatever was still
+    /// queued, so a deploy during a scheduled-run window silently dropped that night's optimization
+    /// with nothing recorded anywhere. The theory queue can recover because a theory's status *is*
+    /// its marker — a group had no equivalent, which is what this is. It is set once the group has
+    /// been considered, whether or not that produced any theories: "looked at and found nothing" and
+    /// "never looked at" must not be confused.
+    /// </remarks>
+    DateTimeOffset? OptimizationConsideredAt { get; }
+
+    /// <summary>Records that the optimizer has considered this group, and persists.</summary>
+    Task<ITestRunGroup> MarkOptimizationConsidered(CancellationToken cancellationToken = default);
+
     /// <summary>Factory delegate for creating a new test run group.</summary>
     public delegate ITestRunGroup CreateNew(ITestSuite suite, bool isSystemRun, Guid? scheduleId, int sampleCount);
 
@@ -57,6 +75,7 @@ public delegate ITestRunGroup CreateExisting(
         bool isSystemRun,
         Guid? scheduleId,
         int sampleCount,
+        DateTimeOffset? optimizationConsideredAt,
         IDomainEntityData existing);
 
     Task<ITestRunGroup> SetRunning(CancellationToken cancellationToken = default);
diff --git a/Proxytrace.Domain/TestRunGroup/ITestRunGroupRepository.cs b/Proxytrace.Domain/TestRunGroup/ITestRunGroupRepository.cs
index 5c871b03e..d18602b40 100644
--- a/Proxytrace.Domain/TestRunGroup/ITestRunGroupRepository.cs
+++ b/Proxytrace.Domain/TestRunGroup/ITestRunGroupRepository.cs
@@ -15,6 +15,20 @@ Task<IReadOnlyList<ITestRunGroup>> GetByStatusesAsync(
         IReadOnlyCollection<TestRunStatus> statuses,
         CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Returns terminal, non-system groups the optimizer has not considered yet, oldest first.
+    /// </summary>
+    /// <remarks>
+    /// Backs the optimizer's restart recovery. Its queue is an in-process channel, so a restart
+    /// discarded whatever was still in it — a deploy during a scheduled-run window silently dropped
+    /// that night's optimization. System runs are excluded because they are the optimizer's own A/B
+    /// runs and must never re-trigger it. Filters in SQL over the
+    /// (OptimizationConsideredAt, IsSystemRun, Status) index.
+    /// </remarks>
+    Task<IReadOnlyList<ITestRunGroup>> GetPendingOptimizationAsync(
+        int limit,
+        CancellationToken cancellationToken = default);
+
     Task<IReadOnlyList<ITestRunGroup>> GetByProjectAsync(Guid projectId, CancellationToken cancellationToken = default);
 
     Task<PagedResult<ITestRunGroup>> GetByAgentPagedAsync(
@@ -31,6 +45,18 @@ Task<PagedResult<ITestRunGroup>> GetByProjectPagedAsync(
         bool includeSystem = false,
         CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Run groups across several projects, paged as one list. Backs an unfiltered list request from
+    /// a caller who may read more than one project: the page has to be computed over the union, so
+    /// merging per-project pages afterwards would not produce a correct page (#482).
+    /// </summary>
+    Task<PagedResult<ITestRunGroup>> GetByProjectsPagedAsync(
+        IReadOnlyCollection<Guid> projectIds,
+        int page,
+        int pageSize,
+        bool includeSystem = false,
+        CancellationToken cancellationToken = default);
+
     /// <summary>Run groups for a single suite, newest first — backs the suite's run-history view.</summary>
     Task<PagedResult<ITestRunGroup>> GetBySuitePagedAsync(
         Guid suiteId,
diff --git a/Proxytrace.Domain/TestRunGroup/Internal/TestRunGroup.cs b/Proxytrace.Domain/TestRunGroup/Internal/TestRunGroup.cs
index bcbebe6e0..8b15897a0 100644
--- a/Proxytrace.Domain/TestRunGroup/Internal/TestRunGroup.cs
+++ b/Proxytrace.Domain/TestRunGroup/Internal/TestRunGroup.cs
@@ -15,6 +15,7 @@ internal record TestRunGroup : DomainEntity<ITestRunGroup>, ITestRunGroup
     public bool IsSystemRun { get; }
     public Guid? ScheduleId { get; }
     public int SampleCount { get; }
+    public DateTimeOffset? OptimizationConsideredAt { get; private init; }
 
     public TestRunGroup(
         ITestSuite suite,
@@ -31,6 +32,7 @@ public TestRunGroup(
         IsSystemRun = isSystemRun;
         ScheduleId = scheduleId;
         SampleCount = sampleCount;
+        OptimizationConsideredAt = null;
     }
 
     public TestRunGroup(
@@ -40,6 +42,7 @@ public TestRunGroup(
         bool isSystemRun,
         Guid? scheduleId,
         int sampleCount,
+        DateTimeOffset? optimizationConsideredAt,
         IDomainEntityData existing,
         IRepository<ITestRunGroup> repository,
         ITestRunRepository testRuns) : base(existing, repository)
@@ -51,8 +54,12 @@ public TestRunGroup(
         IsSystemRun = isSystemRun;
         ScheduleId = scheduleId;
         SampleCount = sampleCount;
+        OptimizationConsideredAt = optimizationConsideredAt;
     }
 
+    public Task<ITestRunGroup> MarkOptimizationConsidered(CancellationToken cancellationToken = default)
+        => ApplyAsync(this with { OptimizationConsideredAt = DateTimeOffset.UtcNow }, cancellationToken);
+
     public Task<IReadOnlyList<ITestRun>> GetTestRuns(CancellationToken cancellationToken = default)
         => testRuns.GetByGroupAsync(Id, cancellationToken);
 
diff --git a/Proxytrace.Domain/TestRunSchedule/Internal/TestRunSchedule.cs b/Proxytrace.Domain/TestRunSchedule/Internal/TestRunSchedule.cs
index afba56fcc..aabfe9a9f 100644
--- a/Proxytrace.Domain/TestRunSchedule/Internal/TestRunSchedule.cs
+++ b/Proxytrace.Domain/TestRunSchedule/Internal/TestRunSchedule.cs
@@ -60,7 +60,13 @@ private static DateTimeOffset AlignForward(DateTimeOffset anchor, TimeSpan inter
         if (interval <= TimeSpan.Zero || anchor > after)
             return anchor;
 
-        long steps = (after.Ticks - anchor.Ticks) / interval.Ticks + 1;
+        // UtcTicks, never Ticks: DateTimeOffset.Ticks is the wall-clock reading in the value's own
+        // offset, so subtracting two of them silently understates the elapsed time by the offset
+        // difference. With an anchor like 09:00+02:00 that lands NextRunAt in the *past*, and the
+        // scheduler then re-derives the same past instant on every 60s poll — firing (and billing)
+        // the suite once a minute. The `anchor > after` guard above is instant-based, so the two
+        // must agree on what "later" means.
+        long steps = (after.UtcTicks - anchor.UtcTicks) / interval.Ticks + 1;
         return anchor + TimeSpan.FromTicks(interval.Ticks * steps);
     }
 
diff --git a/Proxytrace.Domain/TestSuite/ITestSuiteRepository.cs b/Proxytrace.Domain/TestSuite/ITestSuiteRepository.cs
index a10f5c136..987a906f2 100644
--- a/Proxytrace.Domain/TestSuite/ITestSuiteRepository.cs
+++ b/Proxytrace.Domain/TestSuite/ITestSuiteRepository.cs
@@ -26,6 +26,17 @@ Task<PagedResult<ITestSuite>> GetByProjectPagedAsync(
         int pageSize,
         CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Suites across several projects, paged as one list. Backs an unfiltered list request from a
+    /// caller who may read more than one project: the page has to be computed over the union, so
+    /// merging per-project pages afterwards would not produce a correct page (#482).
+    /// </summary>
+    Task<PagedResult<ITestSuite>> GetByProjectsPagedAsync(
+        IReadOnlyCollection<Guid> projectIds,
+        int page,
+        int pageSize,
+        CancellationToken cancellationToken = default);
+
     /// <summary>
     /// Returns the id of the project that owns the test case identified by <paramref name="testCaseId"/>
     /// — the project of the agent whose suite references it — or <see langword="null"/> when no suite
diff --git a/Proxytrace.Domain/UserTotpEnrollment/Internal/UserTotpEnrollment.cs b/Proxytrace.Domain/UserTotpEnrollment/Internal/UserTotpEnrollment.cs
index f4de68131..b3323003c 100644
--- a/Proxytrace.Domain/UserTotpEnrollment/Internal/UserTotpEnrollment.cs
+++ b/Proxytrace.Domain/UserTotpEnrollment/Internal/UserTotpEnrollment.cs
@@ -1,4 +1,5 @@
 using System.ComponentModel.DataAnnotations;
+using System.Text;
 using Proxytrace.Common.Validation;
 using Proxytrace.Domain.Internal;
 using Proxytrace.Domain.User;
@@ -51,6 +52,24 @@ public Task<IUserTotpEnrollment> RecordUsedStep(long step, CancellationToken can
         return ApplyAsync(this with { LastUsedStep = step }, cancellationToken);
     }
 
+    // Redact the TOTP shared secret from the record's generated ToString()/PrintMembers so it never
+    // leaks into a log line, exception message or debugger string — anyone holding it can mint valid
+    // authenticator codes for this user indefinitely. Secret stays a public member (the verifier
+    // reads it; equality keeps it) — only its textual rendering is masked.
+    protected override bool PrintMembers(StringBuilder builder)
+    {
+        if (base.PrintMembers(builder))
+        {
+            builder.Append(", ");
+        }
+
+        builder.Append("User = ").Append(User)
+            .Append(", Secret = ***")
+            .Append(", ConfirmedAt = ").Append(ConfirmedAt)
+            .Append(", LastUsedStep = ").Append(LastUsedStep);
+        return true;
+    }
+
     public override IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
     {
         foreach (var result in base.Validate(validationContext))
diff --git a/Proxytrace.Infrastructure.Tests/BlindIndexTests.cs b/Proxytrace.Infrastructure.Tests/BlindIndexTests.cs
new file mode 100644
index 000000000..913619911
--- /dev/null
+++ b/Proxytrace.Infrastructure.Tests/BlindIndexTests.cs
@@ -0,0 +1,118 @@
+using Autofac;
+using AwesomeAssertions;
+using Microsoft.Extensions.DependencyInjection;
+using Proxytrace.Common.Security;
+using Proxytrace.Domain.Security;
+using Proxytrace.Infrastructure.Security;
+using Proxytrace.Testing;
+
+namespace Proxytrace.Infrastructure.Tests;
+
+/// <summary>
+/// The blind index over the upstream provider API key must be <b>keyed</b>.
+/// </summary>
+/// <remarks>
+/// The unkeyed SHA-256 used by <see cref="ISecretHasher"/> is safe for the secrets Proxytrace
+/// generates itself — 256-bit CSPRNG values a dump cannot reverse. The provider key is not one of
+/// those: an operator types it in, and self-hosted OpenAI-compatible backends conventionally use
+/// <c>EMPTY</c>, <c>ollama</c> or <c>sk-1234</c>. Unkeyed, a database dump recovers those by wordlist
+/// in seconds, undoing the encryption on the column beside it.
+/// </remarks>
+[TestClass]
+public sealed class BlindIndexTests : BaseTest<Module>
+{
+    [TestMethod]
+    public void Index_WithAPersistedKey_IsNotDerivableFromTheValueAlone()
+    {
+        // The whole point: the index must not be reproducible by someone holding only the dump.
+        using var dataDir = new TempDataDirectory();
+        var indexer = ResolveIndexer(dataDir.Path);
+
+        indexer.IsKeyed.Should().BeTrue();
+
+        const string weakKey = "ollama";
+        var index = indexer.Index(weakKey);
+
+        index.Should().NotContain(Sha256.HexHash(weakKey),
+            "an attacker with the dump can compute the plain hash of every wordlist entry");
+        index.Should().StartWith(SecretIndexScheme.KeyedPrefix, "the scheme must be self-describing");
+    }
+
+    [TestMethod]
+    public void Index_IsStableAcrossInstancesSharingADataDirectory()
+    {
+        // The API host writes the index and the lean proxy host reads it. If the two derived
+        // different keys, every provider-key lookup at the proxy would miss.
+        using var dataDir = new TempDataDirectory();
+
+        var first = ResolveIndexer(dataDir.Path).Index("sk-shared");
+        var second = ResolveIndexer(dataDir.Path).Index("sk-shared");
+
+        second.Should().Be(first);
+    }
+
+    [TestMethod]
+    public void Index_UnderDifferentDataDirectories_Differs()
+    {
+        // Two unrelated installations must not produce the same index for the same weak key —
+        // otherwise a precomputed table built against one works against all of them.
+        using var a = new TempDataDirectory();
+        using var b = new TempDataDirectory();
+
+        ResolveIndexer(a.Path).Index("ollama").Should().NotBe(ResolveIndexer(b.Path).Index("ollama"));
+    }
+
+    [TestMethod]
+    public void Index_WithNoDataDirectory_FallsBackToTheLegacyIndexRatherThanAnEphemeralKey()
+    {
+        // A per-process random key would make every stored index stop matching on the next restart,
+        // silently breaking upstream authentication for every provider. Falling back keeps
+        // Development and the test harnesses working exactly as before.
+        var indexer = ResolveIndexer(keyRingPath: null);
+
+        indexer.IsKeyed.Should().BeFalse();
+        indexer.Index("ollama").Should().Be(indexer.LegacyIndex("ollama"));
+    }
+
+    [TestMethod]
+    public void LegacyIndex_MatchesThePreKeyingScheme()
+    {
+        // This is what rows written before the change carry; the lookup still has to match them.
+        using var dataDir = new TempDataDirectory();
+
+        ResolveIndexer(dataDir.Path).LegacyIndex("sk-old").Should().Be(Sha256.HexHash("sk-old"));
+    }
+
+    private ISecretIndexer ResolveIndexer(string? keyRingPath)
+    {
+        IServiceProvider services = GetServices(builder =>
+        {
+            builder.RegisterModule<SecretProtectionModule>();
+            builder.RegisterInstance(new KeyRingLocation(keyRingPath));
+        });
+        return services.GetRequiredService<ISecretIndexer>();
+    }
+
+    private sealed class TempDataDirectory : IDisposable
+    {
+        public TempDataDirectory()
+        {
+            Path = System.IO.Path.Combine(System.IO.Path.GetTempPath(), "proxytrace-blind-index-" + Guid.NewGuid().ToString("N"));
+            Directory.CreateDirectory(Path);
+        }
+
+        public string Path { get; }
+
+        public void Dispose()
+        {
+            try
+            {
+                Directory.Delete(Path, recursive: true);
+            }
+            catch (IOException)
+            {
+                // Best effort — a leaked temp directory must not fail the suite.
+            }
+        }
+    }
+}
diff --git a/Proxytrace.Infrastructure.Tests/KeyRingPersistenceCheckTests.cs b/Proxytrace.Infrastructure.Tests/KeyRingPersistenceCheckTests.cs
new file mode 100644
index 000000000..033bf135a
--- /dev/null
+++ b/Proxytrace.Infrastructure.Tests/KeyRingPersistenceCheckTests.cs
@@ -0,0 +1,60 @@
+using Autofac;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Proxytrace.Infrastructure.Security;
+using Proxytrace.Testing;
+
+namespace Proxytrace.Infrastructure.Tests;
+
+/// <summary>
+/// A missing PROXYTRACE_DATA_DIR leaves the Data Protection key ring in memory, so every secret
+/// encrypted at rest stops decrypting after a restart — and the three decrypt paths swallow the
+/// resulting CryptographicException at Warning only. The operator Error Log captures >= Error, so
+/// without a Critical at startup that outage is completely invisible. See docs/security.md.
+/// </summary>
+[TestClass]
+public sealed class KeyRingPersistenceCheckTests : BaseTest<Module>
+{
+    [TestMethod]
+    public async Task StartAsync_WhenNoDataDirectoryIsConfigured_LogsCritical()
+    {
+        var logger = Substitute.For<ILogger<SecretProtectionModule>>();
+        IServiceProvider services = GetServices(builder =>
+        {
+            builder.RegisterModule<SecretProtectionModule>();
+            builder.RegisterInstance(new KeyRingLocation(null));
+            builder.RegisterInstance(logger).As<ILogger<SecretProtectionModule>>();
+        });
+
+        await services.GetRequiredService<KeyRingPersistenceCheck>().StartAsync(CancellationToken);
+
+        logger.Received(1).Log(
+            LogLevel.Critical,
+            Arg.Any<EventId>(),
+            Arg.Any<Arg.AnyType>(),
+            Arg.Any<Exception?>(),
+            Arg.Any<Func<Arg.AnyType, Exception?, string>>());
+    }
+
+    [TestMethod]
+    public async Task StartAsync_WhenTheKeyRingIsPersisted_DoesNotLogCritical()
+    {
+        var logger = Substitute.For<ILogger<SecretProtectionModule>>();
+        IServiceProvider services = GetServices(builder =>
+        {
+            builder.RegisterModule<SecretProtectionModule>();
+            builder.RegisterInstance(new KeyRingLocation("/app/data/dataprotection-keys"));
+            builder.RegisterInstance(logger).As<ILogger<SecretProtectionModule>>();
+        });
+
+        await services.GetRequiredService<KeyRingPersistenceCheck>().StartAsync(CancellationToken);
+
+        logger.DidNotReceive().Log(
+            LogLevel.Critical,
+            Arg.Any<EventId>(),
+            Arg.Any<Arg.AnyType>(),
+            Arg.Any<Exception?>(),
+            Arg.Any<Func<Arg.AnyType, Exception?, string>>());
+    }
+}
diff --git a/Proxytrace.Infrastructure.Tests/LiteLlmCatalogResolverTests.cs b/Proxytrace.Infrastructure.Tests/LiteLlmCatalogResolverTests.cs
index e0cdcc117..05677b7f3 100644
--- a/Proxytrace.Infrastructure.Tests/LiteLlmCatalogResolverTests.cs
+++ b/Proxytrace.Infrastructure.Tests/LiteLlmCatalogResolverTests.cs
@@ -101,10 +101,86 @@ public async Task Resolve_NoFxRate_ReturnsUnknown()
         price.Should().Be(ModelPrice.Unknown);
     }
 
+    [TestMethod]
+    public async Task Resolve_AfterFailedFetch_RetriesInsteadOfCachingTheEmptyCatalog()
+    {
+        var fx = Substitute.For<IFxRateProvider>();
+        fx.GetUsdToEurAsync(Arg.Any<CancellationToken>()).Returns(1.0m);
+        var handler = new SequencedHandler(
+            _ => throw new HttpRequestException("transient"),
+            _ => new HttpResponseMessage(HttpStatusCode.OK)
+            { Content = new StringContent(Catalog, Encoding.UTF8, "application/json") });
+        var sut = new LiteLlmCatalogResolver(new HttpClient(handler), new PricingOptions(), fx, Substitute.For<IAsyncLock>());
+
+        // First fetch fails: fail-soft to Unknown, but the empty result must not be cached...
+        ModelPrice first = await sut.ResolveAsync(["gpt-4o"], TestContext.CancellationToken);
+        // ...so the next call re-fetches and picks the catalog up.
+        ModelPrice second = await sut.ResolveAsync(["gpt-4o"], TestContext.CancellationToken);
+
+        first.Should().Be(ModelPrice.Unknown);
+        second.InputTokenCost.Should().Be(2.5m);
+    }
+
+    [TestMethod]
+    public async Task Resolve_SuccessfulFetch_IsCachedAndNotRefetched()
+    {
+        var fx = Substitute.For<IFxRateProvider>();
+        fx.GetUsdToEurAsync(Arg.Any<CancellationToken>()).Returns(1.0m);
+        var handler = new SequencedHandler(
+            _ => new HttpResponseMessage(HttpStatusCode.OK)
+            { Content = new StringContent(Catalog, Encoding.UTF8, "application/json") },
+            _ => throw new InvalidOperationException("catalog must not be fetched twice"));
+        var sut = new LiteLlmCatalogResolver(new HttpClient(handler), new PricingOptions(), fx, Substitute.For<IAsyncLock>());
+
+        await sut.ResolveAsync(["gpt-4o"], TestContext.CancellationToken);
+        ModelPrice second = await sut.ResolveAsync(["gpt-4o"], TestContext.CancellationToken);
+
+        second.InputTokenCost.Should().Be(2.5m);
+        handler.CallCount.Should().Be(1);
+    }
+
+    [TestMethod]
+    public async Task Resolve_WhenCancelled_PropagatesCancellationInsteadOfEmptyCatalog()
+    {
+        var fx = Substitute.For<IFxRateProvider>();
+        fx.GetUsdToEurAsync(Arg.Any<CancellationToken>()).Returns(1.0m);
+        using var cts = new CancellationTokenSource();
+        var handler = new SequencedHandler(ct =>
+        {
+            cts.Cancel();
+            ct.ThrowIfCancellationRequested();
+            throw new InvalidOperationException("unreachable");
+        });
+        var sut = new LiteLlmCatalogResolver(new HttpClient(handler), new PricingOptions(), fx, Substitute.For<IAsyncLock>());
+
+        await FluentActions
+            .Invoking(() => sut.ResolveAsync(["gpt-4o"], cts.Token))
+            .Should().ThrowAsync<OperationCanceledException>();
+    }
+
     private sealed class StubHandler(HttpStatusCode status, string body) : HttpMessageHandler
     {
         protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct) =>
             Task.FromResult(new HttpResponseMessage(status)
             { Content = new StringContent(body, Encoding.UTF8, "application/json") });
     }
+
+    /// <summary>
+    /// Responds with a different scripted outcome per call, so a test can assert what happens
+    /// across repeated fetches (retry after failure, or no second fetch at all).
+    /// </summary>
+    private sealed class SequencedHandler(params Func<CancellationToken, HttpResponseMessage>[] responses)
+        : HttpMessageHandler
+    {
+        private int calls;
+
+        public int CallCount => calls;
+
+        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
+        {
+            int index = Interlocked.Increment(ref calls) - 1;
+            Func<CancellationToken, HttpResponseMessage> response = responses[Math.Min(index, responses.Length - 1)];
+            return Task.FromResult(response(ct));
+        }
+    }
 }
diff --git a/Proxytrace.Infrastructure.Tests/ModelClientTests.cs b/Proxytrace.Infrastructure.Tests/ModelClientTests.cs
index b2badbe5f..1cdca8c56 100644
--- a/Proxytrace.Infrastructure.Tests/ModelClientTests.cs
+++ b/Proxytrace.Infrastructure.Tests/ModelClientTests.cs
@@ -384,6 +384,88 @@ public async Task CompleteAsync_WhenOptionsProvided_UsesProvidedModelName()
         capturedOptions?.ModelId.Should().Be(overrideName);
     }
 
+    [TestMethod]
+    public async Task CompleteAsync_WithSamplingParameters_SendsThemToTheProvider()
+    {
+        // The playground offers these controls and mapped them all the way to its request DTO — and
+        // then dropped them, because ModelOptions had nowhere to put them. Changing temperature did
+        // nothing at all, with no error and no indication.
+        ChatOptions? capturedOptions = null;
+
+        IChatClient chatClient = Substitute.For<IChatClient>();
+        chatClient.GetResponseAsync(
+                Arg.Any<IEnumerable<ChatMessage>>(),
+                Arg.Do<ChatOptions>(o => capturedOptions = o),
+                Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult(TextResponse("done")));
+
+        var services = GetServices(config =>
+        {
+            RegisterEndpoint(config);
+            config.RegisterInstance(chatClient).As<IChatClient>();
+        });
+
+        var sampling = new ModelSamplingParameters(
+            Temperature: 0.25,
+            TopP: 0.9,
+            FrequencyPenalty: 0.5,
+            PresencePenalty: 0.75,
+            MaxOutputTokens: 512,
+            Seed: 42,
+            StopSequences: ["END"],
+            ReasoningEffort: "high",
+            ChoiceCount: 2);
+
+        var client = services.GetRequiredService<IModelClient>();
+        await client.CompleteAsync(
+            SimpleConversation(),
+            new ModelOptions("gpt-4o", [], sampling),
+            cancellationToken: CancellationToken);
+
+        capturedOptions.Should().NotBeNull();
+        capturedOptions?.Temperature.Should().BeApproximately(0.25f, 0.0001f);
+        capturedOptions?.TopP.Should().BeApproximately(0.9f, 0.0001f);
+        capturedOptions?.FrequencyPenalty.Should().BeApproximately(0.5f, 0.0001f);
+        capturedOptions?.PresencePenalty.Should().BeApproximately(0.75f, 0.0001f);
+        capturedOptions?.MaxOutputTokens.Should().Be(512);
+        capturedOptions?.Seed.Should().Be(42);
+        capturedOptions?.StopSequences.Should().ContainSingle().Which.Should().Be("END");
+        capturedOptions?.AdditionalProperties?["reasoning_effort"].Should().Be("high");
+        capturedOptions?.AdditionalProperties?["n"].Should().Be(2);
+    }
+
+    [TestMethod]
+    public async Task CompleteAsync_WithNoSamplingParameters_LeavesProviderDefaultsAlone()
+    {
+        // An untouched control must send nothing, not pin the provider to a value nobody chose.
+        ChatOptions? capturedOptions = null;
+
+        IChatClient chatClient = Substitute.For<IChatClient>();
+        chatClient.GetResponseAsync(
+                Arg.Any<IEnumerable<ChatMessage>>(),
+                Arg.Do<ChatOptions>(o => capturedOptions = o),
+                Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult(TextResponse("done")));
+
+        var services = GetServices(config =>
+        {
+            RegisterEndpoint(config);
+            config.RegisterInstance(chatClient).As<IChatClient>();
+        });
+
+        var client = services.GetRequiredService<IModelClient>();
+        await client.CompleteAsync(
+            SimpleConversation(),
+            new ModelOptions("gpt-4o", []),
+            cancellationToken: CancellationToken);
+
+        capturedOptions.Should().NotBeNull();
+        capturedOptions?.Temperature.Should().BeNull();
+        capturedOptions?.MaxOutputTokens.Should().BeNull();
+        capturedOptions?.StopSequences.Should().BeNull();
+        capturedOptions?.AdditionalProperties.Should().BeNull();
+    }
+
     [TestMethod]
     public async Task CompleteAsync_WhenOptionsHaveTools_PassesToolsToChatOptions()
     {
diff --git a/Proxytrace.Infrastructure/Internal/ChatClientExtensions.cs b/Proxytrace.Infrastructure/Internal/ChatClientExtensions.cs
index 4500d3467..ba838a1f1 100644
--- a/Proxytrace.Infrastructure/Internal/ChatClientExtensions.cs
+++ b/Proxytrace.Infrastructure/Internal/ChatClientExtensions.cs
@@ -79,6 +79,44 @@ public static ChatOptions ToChatOptions(this ModelOptions options)
                 .ToList();
         }
 
+        ApplySampling(chatOptions, options.Sampling);
         return chatOptions;
     }
+
+    /// <summary>
+    /// Copies the caller's sampling overrides onto the outgoing request.
+    /// </summary>
+    /// <remarks>
+    /// Only non-null members are set, so an unset override leaves the provider's default alone
+    /// rather than pinning it to a value the user never chose. Reasoning effort and choice count
+    /// have no first-class <see cref="ChatOptions"/> member, so they go through
+    /// <see cref="ChatOptions.AdditionalProperties"/> under their OpenAI wire names; a backend that
+    /// does not understand them answers with its own error, which is more useful than dropping the
+    /// value silently — the behaviour this whole method exists to fix.
+    /// </remarks>
+    private static void ApplySampling(ChatOptions chatOptions, ModelSamplingParameters? sampling)
+    {
+        if (sampling is null || sampling.IsEmpty)
+        {
+            return;
+        }
+
+        if (sampling.Temperature is { } temperature) chatOptions.Temperature = (float)temperature;
+        if (sampling.TopP is { } topP) chatOptions.TopP = (float)topP;
+        if (sampling.FrequencyPenalty is { } frequency) chatOptions.FrequencyPenalty = (float)frequency;
+        if (sampling.PresencePenalty is { } presence) chatOptions.PresencePenalty = (float)presence;
+        if (sampling.MaxOutputTokens is { } maxTokens) chatOptions.MaxOutputTokens = maxTokens;
+        if (sampling.Seed is { } seed) chatOptions.Seed = seed;
+        if (sampling.StopSequences is { Count: > 0 } stop) chatOptions.StopSequences = [.. stop];
+
+        if (!string.IsNullOrWhiteSpace(sampling.ReasoningEffort))
+        {
+            (chatOptions.AdditionalProperties ??= [])["reasoning_effort"] = sampling.ReasoningEffort;
+        }
+
+        if (sampling.ChoiceCount is { } choiceCount)
+        {
+            (chatOptions.AdditionalProperties ??= [])["n"] = choiceCount;
+        }
+    }
 }
\ No newline at end of file
diff --git a/Proxytrace.Infrastructure/Internal/LiteLlmCatalogResolver.cs b/Proxytrace.Infrastructure/Internal/LiteLlmCatalogResolver.cs
index abf16b81e..8662c7994 100644
--- a/Proxytrace.Infrastructure/Internal/LiteLlmCatalogResolver.cs
+++ b/Proxytrace.Infrastructure/Internal/LiteLlmCatalogResolver.cs
@@ -83,8 +83,16 @@ public async Task<ModelPrice> ResolveAsync(
         using var _ = await gate.LockAsync(lockKey, cancellationToken);
         if (cache is not null)
             return cache;
-        cache = await FetchAsync(cancellationToken);
-        return cache;
+
+        IReadOnlyDictionary<string, (decimal?, decimal?, decimal?)> fetched = await FetchAsync(cancellationToken);
+
+        // Only a fetch that actually produced entries is cached. A failed or empty fetch is left
+        // uncached so the next caller retries — caching it would pin every model price to
+        // ModelPrice.Unknown for the rest of the process lifetime after a single network blip.
+        if (fetched.Count > 0)
+            cache = fetched;
+
+        return fetched;
     }
 
     private async Task<IReadOnlyDictionary<string, (decimal?, decimal?, decimal?)>> FetchAsync(
@@ -109,9 +117,17 @@ public async Task<ModelPrice> ResolveAsync(
                     ReadDecimal(prop.Value, "cache_read_input_token_cost"));
             }
         }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            // Caller-initiated cancellation is not a catalog failure — never swallow it into an
+            // empty (and previously permanently cached) result.
+            throw;
+        }
         catch
         {
-            // fail-soft: empty catalog → callers get ModelPrice.Unknown
+            // fail-soft: empty catalog → callers get ModelPrice.Unknown, and GetCatalogAsync
+            // deliberately does not cache it, so the next call retries.
+            return new Dictionary<string, (decimal?, decimal?, decimal?)>(StringComparer.OrdinalIgnoreCase);
         }
 
         return result;
diff --git a/Proxytrace.Infrastructure/Internal/ModelClient.cs b/Proxytrace.Infrastructure/Internal/ModelClient.cs
index 3e2f46662..eea291982 100644
--- a/Proxytrace.Infrastructure/Internal/ModelClient.cs
+++ b/Proxytrace.Infrastructure/Internal/ModelClient.cs
@@ -3,6 +3,7 @@
 using System.Diagnostics;
 using System.Net;
 using System.Runtime.CompilerServices;
+using System.Runtime.ExceptionServices;
 using System.Text.Json;
 using Microsoft.Extensions.AI;
 using OpenAI;
@@ -246,7 +247,9 @@ private async Task<ICompletion> CompleteAsync(
 
         if (error is not null)
         {
-            throw error;
+            // Rethrow via ExceptionDispatchInfo so the original provider-side stack trace survives;
+            // a bare `throw error` would reset it to this line and lose the failure's origin.
+            ExceptionDispatchInfo.Capture(error).Throw();
         }
 
         return completion
diff --git a/Proxytrace.Infrastructure/Security/Internal/BlindIndexKey.cs b/Proxytrace.Infrastructure/Security/Internal/BlindIndexKey.cs
new file mode 100644
index 000000000..28a25adb2
--- /dev/null
+++ b/Proxytrace.Infrastructure/Security/Internal/BlindIndexKey.cs
@@ -0,0 +1,101 @@
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using Microsoft.Extensions.Logging;
+
+namespace Proxytrace.Infrastructure.Security.Internal;
+
+/// <summary>
+/// The HMAC key backing <see cref="HmacSecretIndexer"/>, persisted beside the Data Protection key
+/// ring so every host that reads or writes provider credentials derives the same index.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Kept in its own file rather than derived from the Data Protection ring: Data Protection
+/// deliberately exposes no stable raw key material (its whole API is protect/unprotect, and its
+/// output is non-deterministic), so there is nothing there to HMAC with.
+/// </para>
+/// <para>
+/// The file is created once, with owner-only permissions, and never rotated automatically —
+/// rotating it would invalidate every stored index at once and stop every provider from
+/// authenticating until a re-index. A deliberate rotation therefore means: delete the file, restart,
+/// and let the backfill re-index from the decrypted keys.
+/// </para>
+/// <para>
+/// When no data directory is configured the key is <b>absent</b>, not ephemeral. A per-process
+/// random key would produce indexes that stop matching on the next restart, silently breaking
+/// upstream-key authentication for every provider; falling back to the unkeyed index instead keeps
+/// Development and the test harnesses working exactly as before.
+/// </para>
+/// </remarks>
+internal sealed class BlindIndexKey
+{
+    private const string KeyFileName = "blind-index.key";
+    private const int KeyLengthBytes = 32;
+
+    public BlindIndexKey(KeyRingLocation location, ILogger<BlindIndexKey> logger)
+    {
+        if (location.KeyRingPath is not { } keyRingPath)
+        {
+            Material = null;
+            return;
+        }
+
+        try
+        {
+            Material = LoadOrCreate(Path.Combine(keyRingPath, KeyFileName));
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or CryptographicException)
+        {
+            // Never fail host boot over this: falling back to the unkeyed index keeps existing
+            // providers authenticating, which is strictly better than refusing to start. It is a
+            // real misconfiguration though, so it is loud.
+            logger.LogCritical(ex,
+                "Could not read or create the blind-index key at {Path}. Upstream provider API keys "
+                + "will be indexed with an unkeyed hash until this is fixed; a database dump would "
+                + "then be enough to recover a weak provider key by wordlist. See docs/security.md.",
+                Path.Combine(keyRingPath, KeyFileName));
+            Material = null;
+        }
+    }
+
+    /// <summary>The key bytes, or <see langword="null"/> when no persisted key is available.</summary>
+    public byte[]? Material { get; }
+
+    public bool IsAvailable => Material is not null;
+
+    private static byte[] LoadOrCreate(string path)
+    {
+        if (File.Exists(path))
+        {
+            var existing = File.ReadAllBytes(path);
+            if (existing.Length == KeyLengthBytes)
+            {
+                return existing;
+            }
+
+            // A truncated or corrupt key must not be silently replaced — regenerating would
+            // invalidate every stored index and break provider authentication with no explanation.
+            throw new CryptographicException(
+                $"The blind-index key at {path} is {existing.Length} bytes; expected {KeyLengthBytes}.");
+        }
+
+        Directory.CreateDirectory(Path.GetDirectoryName(path) ?? ".");
+        var material = RandomNumberGenerator.GetBytes(KeyLengthBytes);
+
+        // Write through a temporary file and move it into place, so a crash mid-write cannot leave a
+        // half-written key that the branch above would then refuse to load on every boot.
+        var temporary = path + ".tmp";
+        File.WriteAllBytes(temporary, material);
+        RestrictToOwner(temporary);
+        File.Move(temporary, path, overwrite: false);
+        return material;
+    }
+
+    private static void RestrictToOwner(string path)
+    {
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+        {
+            File.SetUnixFileMode(path, UnixFileMode.UserRead | UnixFileMode.UserWrite);
+        }
+    }
+}
diff --git a/Proxytrace.Infrastructure/Security/Internal/HmacSecretIndexer.cs b/Proxytrace.Infrastructure/Security/Internal/HmacSecretIndexer.cs
new file mode 100644
index 000000000..9339ec594
--- /dev/null
+++ b/Proxytrace.Infrastructure/Security/Internal/HmacSecretIndexer.cs
@@ -0,0 +1,39 @@
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.Extensions.Logging;
+using Proxytrace.Common.Security;
+using Proxytrace.Domain.Security;
+
+namespace Proxytrace.Infrastructure.Security.Internal;
+
+/// <summary>
+/// <see cref="ISecretIndexer"/> over HMAC-SHA256, keyed by <see cref="BlindIndexKey"/>.
+/// </summary>
+internal sealed class HmacSecretIndexer : ISecretIndexer
+{
+    private readonly BlindIndexKey key;
+
+    public HmacSecretIndexer(BlindIndexKey key, ILogger<HmacSecretIndexer> logger)
+    {
+        this.key = key;
+
+        if (!key.IsAvailable)
+        {
+            logger.LogWarning(
+                "No persisted blind-index key is available, so upstream provider API keys are indexed "
+                + "with an unkeyed hash. Set {Variable} to a persistent, writable directory so the key "
+                + "can be stored; see docs/security.md.",
+                SecretProtectionModule.DataDirectoryVariable);
+        }
+    }
+
+    public bool IsKeyed => key.IsAvailable;
+
+    public string Index(string value)
+        => key.Material is { } material
+            ? SecretIndexScheme.KeyedPrefix + Convert.ToHexString(
+                HMACSHA256.HashData(material, Encoding.UTF8.GetBytes(value))).ToLowerInvariant()
+            : LegacyIndex(value);
+
+    public string LegacyIndex(string value) => Sha256.HexHash(value);
+}
diff --git a/Proxytrace.Infrastructure/Security/SecretProtectionModule.cs b/Proxytrace.Infrastructure/Security/SecretProtectionModule.cs
index c0804d82a..a09508733 100644
--- a/Proxytrace.Infrastructure/Security/SecretProtectionModule.cs
+++ b/Proxytrace.Infrastructure/Security/SecretProtectionModule.cs
@@ -1,6 +1,8 @@
 using Autofac;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
 using Proxytrace.Common.DependencyInjection;
 using Proxytrace.Domain.Security;
 
@@ -17,9 +19,20 @@ namespace Proxytrace.Infrastructure.Security;
 /// key-ring configuration; keeping that configuration in one module stops the two hosts from silently
 /// drifting (a mismatched application name or key path would make decryption fail at runtime). Both
 /// hosts must therefore also mount the same <c>PROXYTRACE_DATA_DIR</c> volume. See <c>docs/security.md</c>.
+///
+/// When the variable is unset the ring stays in memory and dies with the process; that is legitimate
+/// in Development and in the test harnesses, so it is not fatal — but it is silently destructive in a
+/// real deployment, so <see cref="KeyRingPersistenceCheck"/> shouts about it at startup.
 /// </summary>
 public sealed class SecretProtectionModule : Autofac.Module
 {
+    /// <summary>
+    /// Environment variable naming the writable directory that holds the Data Protection key ring.
+    /// </summary>
+    public const string DataDirectoryVariable = "PROXYTRACE_DATA_DIR";
+
+    private const string KeyRingDirectoryName = "dataprotection-keys";
+
     protected override void Load(ContainerBuilder builder)
     {
         base.Load(builder);
@@ -32,15 +45,101 @@ protected override void Load(ContainerBuilder builder)
             .As<ISecretHasher>()
             .SingleInstance();
 
-        var dataProtectionDir = Environment.GetEnvironmentVariable("PROXYTRACE_DATA_DIR");
+        // Blind index for the operator-entered upstream provider key. Keyed (HMAC), unlike
+        // ISecretHasher — that one covers 256-bit CSPRNG secrets a dump cannot reverse, while a
+        // provider key is whatever the operator typed, often "EMPTY" or "ollama" on a self-hosted
+        // backend. See ISecretIndexer.
+        builder.RegisterType<Internal.BlindIndexKey>()
+            .AsSelf()
+            .SingleInstance();
+
+        builder.RegisterType<Internal.HmacSecretIndexer>()
+            .As<ISecretIndexer>()
+            .SingleInstance();
+
+        var dataProtectionDir = Environment.GetEnvironmentVariable(DataDirectoryVariable);
         builder.RegisterServiceCollection(services =>
         {
             var dataProtection = services.AddDataProtection().SetApplicationName("Proxytrace");
             if (!string.IsNullOrWhiteSpace(dataProtectionDir))
             {
                 dataProtection.PersistKeysToFileSystem(
-                    new DirectoryInfo(Path.Combine(dataProtectionDir, "dataprotection-keys")));
+                    new DirectoryInfo(Path.Combine(dataProtectionDir, KeyRingDirectoryName)));
             }
         });
+
+        // The resolved location is registered as a value so the startup check reports on exactly the
+        // configuration applied above, and so a test can exercise both branches without mutating
+        // process-wide environment state.
+        builder.RegisterInstance(new KeyRingLocation(
+                string.IsNullOrWhiteSpace(dataProtectionDir)
+                    ? null
+                    : Path.Combine(dataProtectionDir, KeyRingDirectoryName)))
+            .SingleInstance();
+
+        // Resolvable as itself so tests can drive it directly, mirroring the storage backfills.
+        builder.RegisterType<KeyRingPersistenceCheck>()
+            .AsSelf()
+            .SingleInstance();
+        builder.RegisterServiceCollection(services =>
+            services.AddHostedService(sp => sp.GetRequiredService<KeyRingPersistenceCheck>()));
+    }
+}
+
+/// <summary>
+/// Where the Data Protection key ring is persisted, or <c>null</c> when it is in-memory only because
+/// <see cref="SecretProtectionModule.DataDirectoryVariable"/> was unset.
+/// </summary>
+internal sealed record KeyRingLocation(string? KeyRingPath);
+
+/// <summary>
+/// Startup check that makes an ephemeral Data Protection key ring loud instead of silent.
+///
+/// Without a persisted ring every encrypted secret — upstream provider API keys, TOTP/MFA
+/// enrollments, the SMTP password — becomes undecryptable the moment the process restarts, and the
+/// three decrypt paths degrade a <c>CryptographicException</c> to an empty secret at Warning only. An
+/// operator writing their own manifest therefore gets a green boot whose only symptoms are upstream
+/// 401s and "invalid authenticator code", with nothing at Error level. This logs at Critical so it
+/// reaches the operator Error Log (which captures <c>&gt;= Error</c>), but does not throw: Development
+/// and the test harnesses legitimately run without a data directory.
+/// </summary>
+internal sealed class KeyRingPersistenceCheck : IHostedService
+{
+    private readonly KeyRingLocation location;
+
+    // Categorised under the (public) module rather than this internal class: the category is what an
+    // operator filters the log by, so it must be a stable, nameable type — and NSubstitute cannot
+    // proxy an ILogger<T> whose T is internal, which would make this unassertable in a test.
+    private readonly ILogger<SecretProtectionModule> logger;
+
+    public KeyRingPersistenceCheck(KeyRingLocation location, ILogger<SecretProtectionModule> logger)
+    {
+        this.location = location;
+        this.logger = logger;
+    }
+
+    public Task StartAsync(CancellationToken cancellationToken)
+    {
+        if (location.KeyRingPath is null)
+        {
+            logger.LogCritical(
+                "{Variable} is not set, so the Data Protection key ring is held in memory and is discarded when "
+                + "this process stops. Every secret encrypted at rest — upstream provider API keys, TOTP/MFA "
+                + "enrollments and the SMTP password — will fail to decrypt after a restart and is silently read "
+                + "back as unset, which shows up only as upstream 401s and rejected authenticator codes. Set "
+                + "{Variable} to a persistent, writable directory (the official images and compose files use "
+                + "/app/data) and point every host that reads or writes secrets at the same volume. See "
+                + "docs/security.md.",
+                SecretProtectionModule.DataDirectoryVariable,
+                SecretProtectionModule.DataDirectoryVariable);
+        }
+        else
+        {
+            logger.LogInformation("Data Protection key ring persisted to {KeyRingPath}.", location.KeyRingPath);
+        }
+
+        return Task.CompletedTask;
     }
+
+    public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask;
 }
diff --git a/Proxytrace.Messaging.Tests/RedisIngestionStreamTests.cs b/Proxytrace.Messaging.Tests/RedisIngestionStreamTests.cs
index 4bccf5c66..a98dbd58f 100644
--- a/Proxytrace.Messaging.Tests/RedisIngestionStreamTests.cs
+++ b/Proxytrace.Messaging.Tests/RedisIngestionStreamTests.cs
@@ -36,6 +36,62 @@ public async Task GetQueueDepthAsync_WhenDisconnected_ReturnsZeroWithoutIssuingC
         connection.DidNotReceiveWithAnyArgs().GetDatabase();
     }
 
+    // Regression: PublishAsync is fire-and-forget on the proxy hot path, but the proxy awaits it in
+    // the `finally` of both response paths with CancellationToken.None — an uncancellable wait. With
+    // AbortOnConnectFail=false the multiplexer does NOT fail fast while Redis is down: it backlogs
+    // the XADD until the async timeout (~5s), so every proxied response used to be stalled by that
+    // much and a client abort could not release it. The publish must short-circuit on IsConnected
+    // exactly like GetQueueDepthAsync does, dropping the capture instead of issuing the command.
+    [TestMethod]
+    public async Task PublishAsync_WhenDisconnected_DropsCaptureWithoutIssuingCommand()
+    {
+        var database = Substitute.For<IDatabase>();
+
+        var connection = Substitute.For<IConnectionMultiplexer>();
+        connection.IsConnected.Returns(false);
+        connection.GetDatabase(Arg.Any<int>(), Arg.Any<object>()).Returns(database);
+
+        var stream = new RedisIngestionStream(
+            connection,
+            new MessagingConfiguration(),
+            NullLogger<RedisIngestionStream>.Instance);
+
+        await stream.PublishAsync(SampleMessage(), CancellationToken.None);
+
+        connection.DidNotReceiveWithAnyArgs().GetDatabase();
+        await database.DidNotReceiveWithAnyArgs().StreamAddAsync(
+            Arg.Any<RedisKey>(), Arg.Any<RedisValue>(), Arg.Any<RedisValue>(),
+            Arg.Any<RedisValue?>(), Arg.Any<int?>(), Arg.Any<bool>(), Arg.Any<CommandFlags>());
+    }
+
+    // The short-circuit above must not swallow the happy path: while the multiplexer reports a
+    // connection the capture is still XADDed to the configured stream.
+    [TestMethod]
+    public async Task PublishAsync_WhenConnected_AddsPayloadToStream()
+    {
+        var config = new MessagingConfiguration();
+        var database = Substitute.For<IDatabase>();
+
+        var connection = Substitute.For<IConnectionMultiplexer>();
+        connection.IsConnected.Returns(true);
+        connection.GetDatabase(Arg.Any<int>(), Arg.Any<object>()).Returns(database);
+
+        var stream = new RedisIngestionStream(
+            connection, config, NullLogger<RedisIngestionStream>.Instance);
+
+        IngestMessage message = SampleMessage();
+        await stream.PublishAsync(message, CancellationToken.None);
+
+        await database.Received(1).StreamAddAsync(
+            config.Stream,
+            "payload",
+            Arg.Is<RedisValue>(value => value.ToString().Contains(message.ProviderId.ToString())),
+            Arg.Any<RedisValue?>(),
+            config.MaxStreamLength,
+            true,
+            Arg.Any<CommandFlags>());
+    }
+
     [TestMethod]
     public void RedeliversUnacknowledged_IsTrue()
     {
diff --git a/Proxytrace.Messaging/Internal/RedisIngestionStream.cs b/Proxytrace.Messaging/Internal/RedisIngestionStream.cs
index e2787384e..3ab1f1890 100644
--- a/Proxytrace.Messaging/Internal/RedisIngestionStream.cs
+++ b/Proxytrace.Messaging/Internal/RedisIngestionStream.cs
@@ -41,6 +41,23 @@ public RedisIngestionStream(
     public async Task PublishAsync(IngestMessage message, CancellationToken cancellationToken = default)
     {
         cancellationToken.ThrowIfCancellationRequested();
+
+        // Publishing is fire-and-forget on the proxy hot path, and the producer awaits it inside the
+        // `finally` of both response paths with CancellationToken.None — an uncancellable wait that a
+        // client abort cannot release. The multiplexer is configured with AbortOnConnectFail=false, so
+        // while Redis is down StackExchange.Redis backlogs the command until its async timeout (~5s)
+        // rather than failing fast, adding that delay to *every* proxied response. Short-circuit on the
+        // same IsConnected check GetQueueDepthAsync uses: drop the capture instead of stalling the
+        // response the proxy exists to forward. Logged (never thrown) so an outage is not a silent loss.
+        if (!connection.IsConnected)
+        {
+            logger.LogWarning(
+                "Redis is not connected — dropping the captured call for project {ProjectId} rather than "
+                + "stalling the proxy response until the command times out",
+                message.ProjectId);
+            return;
+        }
+
         var payload = JsonSerializer.Serialize(message);
         // Approximate MAXLEN trim bounds Redis memory if the consumer lags or the app is down.
         await Database.StreamAddAsync(
diff --git a/Proxytrace.Messaging/Module.cs b/Proxytrace.Messaging/Module.cs
index 46fd17df8..612399f9e 100644
--- a/Proxytrace.Messaging/Module.cs
+++ b/Proxytrace.Messaging/Module.cs
@@ -29,8 +29,10 @@ protected override void Load(ContainerBuilder builder)
                     var options = ConfigurationOptions.Parse(configuration.RedisConnectionString);
                     // Never throw on connect: a Redis outage must not stop the proxy from
                     // constructing its controller and forwarding agent traffic. The multiplexer
-                    // reconnects in the background; publishes made while it is down fail fast and
-                    // are swallowed by the producer.
+                    // reconnects in the background. It does NOT fail fast while down — a command is
+                    // backlogged until its async timeout (~5s) — so RedisIngestionStream checks
+                    // IConnectionMultiplexer.IsConnected before issuing one and drops the capture
+                    // instead, keeping the proxy hot path free of that stall.
                     options.AbortOnConnectFail = false;
                     return ConnectionMultiplexer.Connect(options);
                 })
diff --git a/Proxytrace.Proxy.Api/Dockerfile b/Proxytrace.Proxy.Api/Dockerfile
index c60210870..3b10d807d 100644
--- a/Proxytrace.Proxy.Api/Dockerfile
+++ b/Proxytrace.Proxy.Api/Dockerfile
@@ -1,7 +1,14 @@
 FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
 USER root
-RUN mkdir -p /app
-RUN chown $APP_UID:$APP_UID /app
+# /app/data holds the Data Protection key ring the proxy must read to decrypt the upstream provider
+# key before replaying it — it is the SAME ring the API writes, so the composes mount the shared
+# appdata volume here. Pre-create it (an empty named volume inherits the image dir's ownership on
+# first use) and hand /app to the non-root app user.
+RUN mkdir -p /app/data && chown -R $APP_UID:$APP_UID /app
+# Default the key-ring location to that directory, matching what every compose file already mounts.
+# Without this variable the ring is in-memory only and the proxy cannot decrypt anything the API
+# wrote, which surfaces only as upstream 401s. See docs/security.md.
+ENV PROXYTRACE_DATA_DIR=/app/data
 USER $APP_UID
 WORKDIR /app
 EXPOSE 8080
diff --git a/Proxytrace.Proxy.Api/Program.cs b/Proxytrace.Proxy.Api/Program.cs
index 443a4cab7..0b755a633 100644
--- a/Proxytrace.Proxy.Api/Program.cs
+++ b/Proxytrace.Proxy.Api/Program.cs
@@ -6,6 +6,13 @@
 
 var builder = WebApplication.CreateBuilder(args);
 
+// Kestrel's default MaxRequestBodySize is 30 MB, which would reject an oversized request before the
+// controller's own 64 MiB cap ever ran — leaving OpenAiProxyController.MaxRequestBodyBytes (and the
+// 413 it produces) unreachable, and the real ceiling silently half the documented one. Pin the server
+// limit to the same constant so there is exactly one request-size bound.
+builder.WebHost.ConfigureKestrel(options =>
+    options.Limits.MaxRequestBodySize = OpenAiProxyController.MaxRequestBodyBytes);
+
 builder.Host.UseServiceProviderFactory(new AutofacServiceProviderFactory());
 builder.Host.ConfigureContainer<ContainerBuilder>(containerBuilder =>
     containerBuilder.RegisterModule<Proxytrace.Proxy.Api.Module>());
diff --git a/Proxytrace.Proxy.Tests/FakeHttpClients.cs b/Proxytrace.Proxy.Tests/FakeHttpClients.cs
index 2ca533a1a..148cf2516 100644
--- a/Proxytrace.Proxy.Tests/FakeHttpClients.cs
+++ b/Proxytrace.Proxy.Tests/FakeHttpClients.cs
@@ -213,6 +213,84 @@ public override void Flush() { }
     public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
 }
 
+/// <summary>
+/// A response stream that records everything written to it plus the size of the largest single write,
+/// so a test can assert the proxy forwarded a body in bounded pieces instead of materializing it whole.
+/// </summary>
+internal sealed class RecordingResponseStream : Stream
+{
+    private readonly MemoryStream written = new();
+
+    public int LargestWriteBytes { get; private set; }
+
+    public byte[] Written => written.ToArray();
+
+    public override bool CanRead => false;
+    public override bool CanSeek => false;
+    public override bool CanWrite => true;
+    public override long Length => written.Length;
+    public override long Position { get => written.Position; set => throw new NotSupportedException(); }
+
+    public override async ValueTask WriteAsync(ReadOnlyMemory<byte> buffer, CancellationToken cancellationToken = default)
+    {
+        LargestWriteBytes = Math.Max(LargestWriteBytes, buffer.Length);
+        await written.WriteAsync(buffer, cancellationToken);
+    }
+
+    public override void Write(byte[] buffer, int offset, int count)
+    {
+        LargestWriteBytes = Math.Max(LargestWriteBytes, count);
+        written.Write(buffer, offset, count);
+    }
+
+    public override void Flush() { }
+    public override Task FlushAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+    public override int Read(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+    public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+    public override void SetLength(long value) => throw new NotSupportedException();
+}
+
+/// <summary>
+/// A read-only stream that produces <c>length</c> bytes of filler without materializing them, and
+/// counts how many were actually consumed. Lets a test drive the proxy's request-body cap with a body
+/// far larger than the cap and then assert the proxy stopped reading at the cap.
+/// </summary>
+internal sealed class GeneratedByteStream : Stream
+{
+    private readonly long length;
+    private long position;
+
+    public GeneratedByteStream(long length) => this.length = length;
+
+    /// <summary>Bytes the consumer actually pulled — never the full length once the cap bites.</summary>
+    public long BytesRead => position;
+
+    public override bool CanRead => true;
+    public override bool CanSeek => false;
+    public override bool CanWrite => false;
+    public override long Length => length;
+    public override long Position { get => position; set => throw new NotSupportedException(); }
+
+    public override int Read(byte[] buffer, int offset, int count)
+    {
+        var remaining = length - position;
+        if (remaining <= 0)
+        {
+            return 0;
+        }
+
+        var n = (int)Math.Min(count, remaining);
+        Array.Fill(buffer, (byte)'a', offset, n);
+        position += n;
+        return n;
+    }
+
+    public override void Flush() { }
+    public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+    public override void SetLength(long value) => throw new NotSupportedException();
+    public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+}
+
 /// <summary>A response stream that fails every write — simulates a client that disconnected.</summary>
 internal sealed class ThrowOnWriteStream : Stream
 {
diff --git a/Proxytrace.Proxy.Tests/OpenAiProxyControllerTests.cs b/Proxytrace.Proxy.Tests/OpenAiProxyControllerTests.cs
index 62b683a9b..be549d355 100644
--- a/Proxytrace.Proxy.Tests/OpenAiProxyControllerTests.cs
+++ b/Proxytrace.Proxy.Tests/OpenAiProxyControllerTests.cs
@@ -415,6 +415,96 @@ await FluentActions
         await stream.Received(1).PublishAsync(Arg.Any<IngestMessage>(), CancellationToken.None);
     }
 
+    [TestMethod]
+    public async Task Proxy_ChunkedRequestBodyOverCap_Returns413_WithoutBufferingTheWholeBody()
+    {
+        // Regression: MaxRequestBodyBytes was only checked AFTER Request.Body.CopyToAsync had already
+        // grown the MemoryStream to whatever the client sent. A chunked request reports no
+        // Content-Length, so the pre-check cannot see its size — the copy itself has to be bounded.
+        // (The cap is also reachable at all only now that the proxy host pins Kestrel's own
+        // MaxRequestBodySize to the same constant; Kestrel's 30 MB default used to reject first,
+        // making both the constant and this 413 dead code.)
+        const long overCap = OpenAiProxyController.MaxRequestBodyBytes + (8L * 1024 * 1024);
+        var body = new GeneratedByteStream(overCap);
+
+        var controller = BuildController(Substitute.For<IIngestionStream>(), ResolverFor(ApiKey()));
+        controller.ControllerContext = BuildContext("Bearer valid", body: "{}");
+        // Replace the buffered body with an unbounded one and leave ContentLength unset, exactly as a
+        // chunked upload arrives.
+        controller.ControllerContext.HttpContext.Request.Body = body;
+
+        await controller.Proxy("chat/completions", project: null, CancellationToken.None);
+
+        controller.Response.StatusCode.Should().Be(StatusCodes.Status413PayloadTooLarge);
+        body.BytesRead.Should().BeLessThan(
+            overCap, "the copy must abort at the cap instead of buffering the entire body first");
+        body.BytesRead.Should().BeLessThanOrEqualTo(
+            OpenAiProxyController.MaxRequestBodyBytes + (64L * 1024),
+            "at most the chunk that crossed the cap may be read before bailing");
+    }
+
+    [TestMethod]
+    public async Task Proxy_StreamingUpstreamSingleHugeLine_ForwardsVerbatim_InBoundedWrites()
+    {
+        // Regression: the streaming path read with StreamReader.ReadLineAsync, which grows an
+        // unbounded internal buffer until it finds a '\n'. Whether a response is treated as an event
+        // stream is decided by the REQUEST ("stream": true), never by the upstream — so a provider
+        // that ignores the flag, or a WAF/error page in front of it, can answer with one
+        // multi-megabyte single-line body. That was materialized whole as a string and then re-rented
+        // at 3x its length to forward. The bytes must still reach the client verbatim, in bounded
+        // pieces.
+        var line = new string('x', (4 * 1024 * 1024) + 7); // deliberately contains no '\n'
+        var bodyBytes = Encoding.UTF8.GetBytes(line);
+
+        var responseBody = new RecordingResponseStream();
+        var controller = BuildController(
+            Substitute.For<IIngestionStream>(),
+            ResolverFor(ApiKey()),
+            new ChunkedRawHttpClientFactory(bodyBytes, maxBytesPerRead: 64 * 1024));
+        controller.ControllerContext = BuildContext(
+            "Bearer valid", body: """{"model":"gpt-4o","stream":true,"messages":[]}""");
+        controller.ControllerContext.HttpContext.Response.Body = responseBody;
+
+        await controller.Proxy("chat/completions", project: null, CancellationToken.None);
+
+        Encoding.UTF8.GetString(responseBody.Written).Should().Be(
+            line + "\n", "the forwarded body must be byte-for-byte upstream's, plus the line terminator");
+        responseBody.LargestWriteBytes.Should().BeLessThan(
+            1024 * 1024,
+            "an un-terminated line must be flushed in bounded segments, never held whole in memory");
+    }
+
+    [TestMethod]
+    public async Task Proxy_StreamingSseWithCrlf_NormalizesToLf_AndCapturesTranscript()
+    {
+        // The chunked line splitter replaced ReadLineAsync; it must keep that method's line semantics
+        // — CRLF and lone LF both terminate a line, and the forwarded/captured copies use LF.
+        const string upstreamBody = "data: {\"a\":1}\r\n\r\ndata: [DONE]\r\n";
+        const string expected = "data: {\"a\":1}\n\ndata: [DONE]\n";
+
+        IngestMessage? captured = null;
+        var stream = Substitute.For<IIngestionStream>();
+        stream.PublishAsync(Arg.Do<IngestMessage>(m => captured = m), Arg.Any<CancellationToken>())
+            .Returns(Task.CompletedTask);
+
+        var responseBody = new MemoryStream();
+        var controller = BuildController(
+            stream,
+            ResolverFor(ApiKey()),
+            // One byte per read, so every line terminator (and the CR/LF pair itself) is split across
+            // chunk boundaries.
+            new ChunkedRawHttpClientFactory(Encoding.UTF8.GetBytes(upstreamBody), maxBytesPerRead: 1));
+        controller.ControllerContext = BuildContext(
+            "Bearer valid", body: """{"model":"gpt-4o","stream":true,"messages":[]}""");
+        controller.ControllerContext.HttpContext.Response.Body = responseBody;
+
+        await controller.Proxy("chat/completions", project: null, CancellationToken.None);
+
+        Encoding.UTF8.GetString(responseBody.ToArray()).Should().Be(expected);
+        captured.Should().NotBeNull();
+        captured?.ResponseBody.Should().Be(expected, "the captured transcript mirrors what was forwarded");
+    }
+
     private static OpenAiProxyController BuildController(
         IIngestionStream stream,
         IApiKeyResolver resolver,
diff --git a/Proxytrace.Proxy.Tests/OpenAiProxyModelsTests.cs b/Proxytrace.Proxy.Tests/OpenAiProxyModelsTests.cs
index 059ce4d01..a7321a912 100644
--- a/Proxytrace.Proxy.Tests/OpenAiProxyModelsTests.cs
+++ b/Proxytrace.Proxy.Tests/OpenAiProxyModelsTests.cs
@@ -82,6 +82,30 @@ public async Task Proxy_GetModels_AzureDeploymentsFail_PassesUpstreamStatusThrou
         controller.Response.StatusCode.Should().Be((int)HttpStatusCode.Unauthorized);
     }
 
+    // Regression: ServeAzureModelsAsync attached the provider key through the *validating* header
+    // APIs (HttpRequestHeaders.Add and the Authorization setter). Both throw FormatException on a key
+    // carrying a trailing newline or control character — the classic paste artefact — and that
+    // escaped the action as an unhandled 500 instead of the upstream status / 502 this path carefully
+    // produces. Every other header the proxy sets goes through TryAddWithoutValidation for exactly
+    // this reason.
+    [TestMethod]
+    public async Task Proxy_GetModels_AzureKeyWithTrailingNewline_DoesNotThrowUnhandled()
+    {
+        var handler = new AzureRoutingHandler(
+            deploymentsBody: """{"object":"list","data":[{"id":"gpt-4o-prod","model":"gpt-4o"}]}""",
+            modelsBody: """{"object":"list","data":[]}""");
+
+        var controller = BuildController(handler, Key(new Uri("https://myres.openai.azure.com/openai/v1"), "sk-upstream\n"));
+        controller.ControllerContext = BuildGetContext("Bearer valid");
+
+        await FluentActions
+            .Awaiting(() => controller.Proxy("models", project: null, CancellationToken.None))
+            .Should().NotThrowAsync("a malformed provider key must not escape the proxy as an unhandled 500");
+
+        controller.Response.StatusCode.Should().Be((int)HttpStatusCode.OK);
+        handler.DeploymentsRequested.Should().BeTrue("the deployments lookup must still be attempted");
+    }
+
     // ── helpers ────────────────────────────────────────────────────────────────
 
     private static OpenAiProxyController BuildController(HttpMessageHandler handler, ResolvedApiKey key)
@@ -121,12 +145,12 @@ private static IApiKeyResolver ResolverFor(ResolvedApiKey resolved)
     private static ResolvedApiKey AzureKey() => Key(new Uri("https://myres.openai.azure.com/openai/v1"));
     private static ResolvedApiKey OpenAiKey() => Key(new Uri("https://api.openai.com/v1"));
 
-    private static ResolvedApiKey Key(Uri endpoint)
+    private static ResolvedApiKey Key(Uri endpoint, string apiKey = "sk-upstream")
     {
         var provider = Substitute.For<IModelProvider>();
         provider.Id.Returns(Guid.NewGuid());
         provider.Name.Returns("test-provider");
-        provider.ApiKey.Returns("sk-upstream");
+        provider.ApiKey.Returns(apiKey);
         provider.Endpoint.Returns(endpoint);
 
         var project = Substitute.For<IProject>();
diff --git a/Proxytrace.Proxy.Tests/OpenAiProxyPassthroughTests.cs b/Proxytrace.Proxy.Tests/OpenAiProxyPassthroughTests.cs
index c80e2fe7b..3ae55aa2a 100644
--- a/Proxytrace.Proxy.Tests/OpenAiProxyPassthroughTests.cs
+++ b/Proxytrace.Proxy.Tests/OpenAiProxyPassthroughTests.cs
@@ -5,6 +5,7 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging.Abstractions;
 using NSubstitute;
+using Proxytrace.Domain.ApiKey;
 using Proxytrace.Domain.Kiosk;
 using Proxytrace.Domain.ModelProvider;
 using Proxytrace.Domain.Project;
@@ -43,6 +44,60 @@ public async Task Passthrough_BogusKey_ReturnsUnauthorized()
         controller.Response.StatusCode.Should().Be(StatusCodes.Status401Unauthorized);
     }
 
+    [TestMethod]
+    public async Task Passthrough_KeyWithoutThePassthroughScope_IsForbiddenAndForwardsNothing()
+    {
+        // Pass-through needs its own scope, not merely the Ingestion scope that admitted the key to
+        // the proxy: it relays any method and any path to the provider ORIGIN with the organisation's
+        // real upstream credential attached, and none of it is detected, traced or audited. On a
+        // provider serving account-management routes at the same host, that is the provider account's
+        // reach, handed to a key issued only to capture traffic.
+        var capture = new CapturingHttpMessageHandler("""{"status":"ok"}""");
+        var controller = BuildController(
+            Substitute.For<IIngestionStream>(),
+            ResolverFor(ApiKey(new Uri("http://upstream.test/v1"), ApiKeyScopes.Ingestion)),
+            new SingleHandlerClientFactory(capture));
+        controller.ControllerContext = BuildContext("Bearer valid");
+
+        await controller.Passthrough("acme", "health", CancellationToken.None);
+
+        controller.Response.StatusCode.Should().Be(StatusCodes.Status403Forbidden);
+        capture.LastUri.Should().BeNull("the request must never reach the provider");
+    }
+
+    [TestMethod]
+    public async Task Passthrough_KeyWithThePassthroughScope_IsForwarded()
+    {
+        var capture = new CapturingHttpMessageHandler("""{"status":"ok"}""");
+        var controller = BuildController(
+            Substitute.For<IIngestionStream>(),
+            ResolverFor(ApiKey(new Uri("http://upstream.test/v1"), ApiKeyScopes.Ingestion | ApiKeyScopes.Passthrough)),
+            new SingleHandlerClientFactory(capture));
+        controller.ControllerContext = BuildContext("Bearer valid");
+
+        await controller.Passthrough("acme", "health", CancellationToken.None);
+
+        capture.LastUri.Should().Be(new Uri("http://upstream.test/health"));
+    }
+
+    [TestMethod]
+    public async Task Passthrough_AuthenticatedWithTheProvidersOwnKey_IsForwardedUngated()
+    {
+        // A caller holding the provider's own credential can already call the provider directly, so
+        // gating which of its paths they may reach through Proxytrace would protect nothing. That
+        // path resolves with no scopes at all, which is what null means here.
+        var capture = new CapturingHttpMessageHandler("""{"status":"ok"}""");
+        var controller = BuildController(
+            Substitute.For<IIngestionStream>(),
+            ResolverFor(ApiKey(new Uri("http://upstream.test/v1"), scopes: null)),
+            new SingleHandlerClientFactory(capture));
+        controller.ControllerContext = BuildContext("Bearer sk-upstream");
+
+        await controller.Passthrough("acme", "health", CancellationToken.None);
+
+        capture.LastUri.Should().Be(new Uri("http://upstream.test/health"));
+    }
+
     [TestMethod]
     public async Task Passthrough_ValidKey_ForwardsToUpstreamOrigin_NotEndpointPath()
     {
@@ -303,6 +358,9 @@ private static IApiKeyResolver ResolverFor(ResolvedApiKey resolved)
         return resolver;
     }
 
+    private static ResolvedApiKey ApiKey(Uri endpoint, ApiKeyScopes? scopes)
+        => ApiKey(endpoint) with { Scopes = scopes };
+
     private static ResolvedApiKey ApiKey(Uri endpoint)
     {
         var provider = Substitute.For<IModelProvider>();
diff --git a/Proxytrace.Proxy/Controllers/OpenAiProxyController.cs b/Proxytrace.Proxy/Controllers/OpenAiProxyController.cs
index 089170d9c..fa0242689 100644
--- a/Proxytrace.Proxy/Controllers/OpenAiProxyController.cs
+++ b/Proxytrace.Proxy/Controllers/OpenAiProxyController.cs
@@ -1,11 +1,12 @@
 using System.Buffers;
 using System.Diagnostics;
 using System.Net;
-using System.Net.Http.Headers;
 using System.Text;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
+using Proxytrace.Common.Text;
+using Proxytrace.Domain.ApiKey;
 using Proxytrace.Domain.Kiosk;
 using Proxytrace.Domain.ModelProvider;
 using Proxytrace.Domain.Project;
@@ -32,9 +33,25 @@ public class OpenAiProxyController : ControllerBase
     // Hard caps so a single request can't exhaust proxy memory: reject oversized request bodies
     // outright, and bound the in-memory transcript we accumulate for capture (the bytes are still
     // streamed through to the client untruncated — only the captured copy is bounded).
-    private const long MaxRequestBodyBytes = 64L * 1024 * 1024;
+    //
+    // MaxRequestBodyBytes is public because the host has to pin Kestrel's own
+    // KestrelServerLimits.MaxRequestBodySize to the *same* number: Kestrel's 30 MB default rejects
+    // first otherwise, and this cap — plus the 413 it produces — is unreachable dead code.
+    // See Proxytrace.Proxy.Api/Program.cs.
+    public const long MaxRequestBodyBytes = 64L * 1024 * 1024;
+
     private const int MaxCapturedResponseChars = 16 * 1024 * 1024;
 
+    // Chunk size for every stream copy the proxy performs (request buffering, buffered response
+    // forwarding, streaming reads).
+    private const int CopyChunkBytes = 64 * 1024;
+    private const int StreamReadChunkChars = 16 * 1024;
+
+    // Upper bound on how much of a single un-terminated SSE line the proxy holds in memory before
+    // flushing it onward. Well above any real `data: …` frame, small enough that a pathological
+    // single-line upstream body cannot grow the proxy's working set with it.
+    private const int MaxForwardedLineChars = 256 * 1024;
+
     // Optional: a client may name its owning agent explicitly. When present, ingestion attributes the
     // call to that named agent directly, skipping the prompt/tool similarity matcher.
     private const string AgentNameHeader = "x-proxytrace-agent";
@@ -190,15 +207,16 @@ await RejectBlockedRequestAsync(
         HttpResponseMessage upstreamResponse;
         try
         {
-            var completionOption = isStreaming
-                ? HttpCompletionOption.ResponseHeadersRead
-                : HttpCompletionOption.ResponseContentRead;
-
-            upstreamResponse = await client.SendAsync(upstream, completionOption, cancellationToken);
+            // ResponseHeadersRead on BOTH branches. ResponseContentRead would call
+            // LoadIntoBufferAsync before returning, materializing the entire upstream body in memory
+            // (bounded only by HttpClient.MaxResponseContentBufferSize, ~2 GB by default) — which is
+            // exactly the unbounded residency ProxyBufferedResponseAsync's chunked copy exists to
+            // avoid. Both paths read the body as a stream, so neither needs the eager buffer.
+            upstreamResponse = await client.SendAsync(upstream, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
         }
         catch (Exception ex)
         {
-            logger.LogWarning(ex, "Upstream request to /v1/{Path} failed", path);
+            logger.LogWarning(ex, "Upstream request to /v1/{Path} failed", path.ToSingleLogLine());
             Response.StatusCode = StatusCodes.Status502BadGateway;
             return;
         }
@@ -240,6 +258,23 @@ public async Task Passthrough(string project, string? rest, CancellationToken ca
             return;
         }
 
+        // Pass-through needs its OWN scope, not merely the Ingestion scope that admitted the key to
+        // the proxy. Its reach differs in kind: any method and any path relayed to the provider
+        // origin with the organisation's real upstream credential attached — on a provider serving
+        // account or organization-management routes at the same host, that is the provider account's
+        // reach, and none of it is detected, traced or audited.
+        //
+        // A null Scopes means the caller authenticated with the provider's OWN key, in which case
+        // they can already call the provider directly and gating them here would protect nothing.
+        if (buffered.Resolved.Scopes is { } scopes && !scopes.HasFlag(ApiKeyScopes.Passthrough))
+        {
+            logger.LogWarning(
+                "API key for project {ProjectId} lacks the Passthrough scope; refusing to forward /{Path}",
+                buffered.Resolved.Project.Id, path.ToSingleLogLine());
+            Response.StatusCode = StatusCodes.Status403Forbidden;
+            return;
+        }
+
         // Map to the provider's host ORIGIN (scheme+host+port), not its versioned API endpoint:
         // `openai/v1/…` is a Proxytrace routing prefix, so the upstream's `/health` etc. live at the
         // host root, siblings of the endpoint's `/v1` path.
@@ -258,7 +293,7 @@ public async Task Passthrough(string project, string? rest, CancellationToken ca
         }
         catch (Exception ex)
         {
-            logger.LogWarning(ex, "Upstream pass-through to /{Path} failed", path);
+            logger.LogWarning(ex, "Upstream pass-through to /{Path} failed", path.ToSingleLogLine());
             Response.StatusCode = StatusCodes.Status502BadGateway;
             return;
         }
@@ -277,7 +312,7 @@ private async Task ForwardResponseAsync(HttpResponseMessage upstreamResponse, Ca
     {
         CopyUpstreamStatusAndHeaders(upstreamResponse);
 
-        var buffer = ArrayPool<byte>.Shared.Rent(64 * 1024);
+        var buffer = ArrayPool<byte>.Shared.Rent(CopyChunkBytes);
         try
         {
             await using var upstreamStream = await upstreamResponse.Content.ReadAsStreamAsync(cancellationToken);
@@ -351,12 +386,8 @@ await Response.WriteAsync(
             return null;
         }
 
-        using var requestBodyStream = new MemoryStream();
-        await Request.Body.CopyToAsync(requestBodyStream, cancellationToken);
-        var requestBodyBytes = requestBodyStream.ToArray();
-
-        // Re-check after buffering: a chunked request reports no ContentLength up-front.
-        if (requestBodyBytes.LongLength > MaxRequestBodyBytes)
+        byte[]? requestBodyBytes = await BufferRequestBodyAsync(cancellationToken);
+        if (requestBodyBytes is null)
         {
             Response.StatusCode = StatusCodes.Status413PayloadTooLarge;
             return null;
@@ -365,6 +396,36 @@ await Response.WriteAsync(
         return new BufferedProxyRequest(requestBodyBytes, resolved);
     }
 
+    // Buffers the request body with the cap enforced *during* the copy, not after it. A chunked
+    // request reports no Content-Length up front, so the pre-check above cannot see its size — and a
+    // plain CopyToAsync would grow the MemoryStream to whatever the client sends before anyone looked
+    // at the total. Reading in fixed-size chunks and bailing the moment the cap is crossed means the
+    // resident bytes never exceed MaxRequestBodyBytes. Returns null when the body is over the cap.
+    private async Task<byte[]?> BufferRequestBodyAsync(CancellationToken cancellationToken)
+    {
+        using var buffered = new MemoryStream();
+        var chunk = ArrayPool<byte>.Shared.Rent(CopyChunkBytes);
+        try
+        {
+            int read;
+            while ((read = await Request.Body.ReadAsync(chunk.AsMemory(0, CopyChunkBytes), cancellationToken)) > 0)
+            {
+                if (buffered.Length + read > MaxRequestBodyBytes)
+                {
+                    return null;
+                }
+
+                await buffered.WriteAsync(chunk.AsMemory(0, read), cancellationToken);
+            }
+        }
+        finally
+        {
+            ArrayPool<byte>.Shared.Return(chunk);
+        }
+
+        return buffered.ToArray();
+    }
+
     // Reports whether the (already once-decoded) catch-all route value hides a `..` traversal
     // segment behind percent-encoding. Fully unescapes the value — iteratively, so a double-encoded
     // `%252e%252e` is unwrapped too — and checks each decoded layer for a literal `..`. A value that
@@ -416,8 +477,12 @@ private async Task ServeAzureModelsAsync(IModelProvider provider, CancellationTo
     {
         var client = httpClientFactory.CreateClient("openai");
         using var request = new HttpRequestMessage(HttpMethod.Get, ProviderEndpoints.AzureDeploymentsUri(provider.Endpoint));
-        request.Headers.Add("api-key", provider.ApiKey);
-        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", provider.ApiKey);
+        // TryAddWithoutValidation, exactly as BuildUpstreamRequest does: `Headers.Add` and the
+        // Authorization setter both validate, and a stored key with a stray newline or control
+        // character (the classic paste artefact) makes them throw FormatException — which would escape
+        // as an unhandled 500 instead of the 502 this method carefully produces for upstream trouble.
+        request.Headers.TryAddWithoutValidation("api-key", provider.ApiKey);
+        request.Headers.TryAddWithoutValidation("Authorization", $"Bearer {provider.ApiKey}");
 
         HttpResponseMessage upstreamResponse;
         try
@@ -531,7 +596,7 @@ private async Task ProxyBufferedResponseAsync(
         // MaxCapturedResponseChars, exactly as the streaming path does.
         var captured = new StringBuilder();
         var decoder = Encoding.UTF8.GetDecoder();
-        var buffer = ArrayPool<byte>.Shared.Rent(64 * 1024);
+        var buffer = ArrayPool<byte>.Shared.Rent(CopyChunkBytes);
         var chars = ArrayPool<char>.Shared.Rent(Encoding.UTF8.GetMaxCharCount(buffer.Length));
 
         try
@@ -584,28 +649,53 @@ private async Task ProxyStreamingResponseAsync(
         await using var upstreamStream = await upstreamResponse.Content.ReadAsStreamAsync(cancellationToken);
         using var reader = new StreamReader(upstreamStream, Encoding.UTF8, leaveOpen: true);
 
+        // Read fixed-size chunks and split on '\n' ourselves rather than calling ReadLineAsync, which
+        // grows an unbounded internal buffer until it finds a newline. Whether the response is really
+        // an event stream is decided by the *request* (`"stream": true`), never by the upstream, so a
+        // provider that ignores the flag — or a WAF/error page in front of it — can answer with one
+        // multi-megabyte single-line body, which ReadLineAsync would materialize whole as a string and
+        // WriteSseSegmentAsync would then rent 3x its length on top of. A line that grows past
+        // MaxForwardedLineChars is flushed as a raw, unterminated segment instead: the client still
+        // receives every byte, but nothing unbounded is ever resident.
+        var chunk = ArrayPool<char>.Shared.Rent(StreamReadChunkChars);
+        var pending = new StringBuilder();
+
         try
         {
-            while (true)
+            int read;
+            while ((read = await reader.ReadAsync(chunk.AsMemory(0, StreamReadChunkChars), cancellationToken)) > 0)
             {
-                var line = await reader.ReadLineAsync(cancellationToken);
-                if (line is null)
+                var start = 0;
+                while (start < read)
                 {
-                    break;
+                    var newline = Array.IndexOf(chunk, '\n', start, read - start);
+                    if (newline < 0)
+                    {
+                        pending.Append(chunk, start, read - start);
+                        break;
+                    }
+
+                    pending.Append(chunk, start, newline - start);
+                    start = newline + 1;
+                    await EmitSseSegmentAsync(pending, accumulated, terminated: true, cancellationToken);
                 }
 
-                // Bound the captured copy (the forwarded stream below is never truncated). Use '\n'
-                // explicitly so the capture matches what is forwarded rather than Environment.NewLine.
-                if (accumulated.Length < MaxCapturedResponseChars)
+                if (pending.Length >= MaxForwardedLineChars)
                 {
-                    accumulated.Append(line).Append('\n');
+                    await EmitSseSegmentAsync(pending, accumulated, terminated: false, cancellationToken);
                 }
+            }
 
-                await WriteSseLineAsync(line, cancellationToken);
+            if (pending.Length > 0)
+            {
+                // Upstream ended without a trailing newline. The terminator is still written, exactly
+                // as the previous ReadLineAsync-based loop did.
+                await EmitSseSegmentAsync(pending, accumulated, terminated: true, cancellationToken);
             }
         }
         finally
         {
+            ArrayPool<char>.Shared.Return(chunk);
             // Always publish what we accumulated, even when the client disconnects mid-stream: the
             // forward loop above throws out on disconnect, but the partial transcript is exactly the
             // data the proxy exists to capture. Decouple from the request-aborted token with
@@ -617,17 +707,55 @@ private async Task ProxyStreamingResponseAsync(
 
     // ── Helpers ───────────────────────────────────────────────────────────────
 
-    // Forwards one streamed line plus its '\n' terminator and flushes so the token reaches the
-    // client immediately. Encodes into a pooled buffer to avoid the per-line string concat and
-    // throwaway byte[] that a token-by-token completion would otherwise allocate thousands of.
-    private async Task WriteSseLineAsync(string line, CancellationToken cancellationToken)
+    // Drains the pending segment: appends it to the bounded capture buffer and forwards it to the
+    // client. `terminated` distinguishes a real line (a '\n' was seen upstream, so one is written and
+    // a trailing '\r' is dropped — the CRLF→LF normalization StreamReader.ReadLine used to do) from a
+    // length-forced flush of an over-long line, which is written raw so the forwarded bytes stay
+    // faithful and no newline is invented.
+    private async Task EmitSseSegmentAsync(
+        StringBuilder pending,
+        StringBuilder accumulated,
+        bool terminated,
+        CancellationToken cancellationToken)
+    {
+        if (terminated && pending.Length > 0 && pending[^1] == '\r')
+        {
+            pending.Length--;
+        }
+
+        var segment = pending.ToString();
+        pending.Clear();
+
+        // Bound the captured copy (the forwarded bytes below are never truncated).
+        if (accumulated.Length < MaxCapturedResponseChars)
+        {
+            accumulated.Append(segment, 0, Math.Min(segment.Length, MaxCapturedResponseChars - accumulated.Length));
+            if (terminated && accumulated.Length < MaxCapturedResponseChars)
+            {
+                accumulated.Append('\n');
+            }
+        }
+
+        await WriteSseSegmentAsync(segment, terminated, cancellationToken);
+    }
+
+    // Forwards one streamed segment (plus its '\n' terminator when the segment is a complete line)
+    // and flushes so the token reaches the client immediately. Encodes into a pooled buffer to avoid
+    // the per-line string concat and throwaway byte[] that a token-by-token completion would
+    // otherwise allocate thousands of.
+    private async Task WriteSseSegmentAsync(string segment, bool terminated, CancellationToken cancellationToken)
     {
-        var buffer = ArrayPool<byte>.Shared.Rent(Encoding.UTF8.GetMaxByteCount(line.Length) + 1);
+        var buffer = ArrayPool<byte>.Shared.Rent(Encoding.UTF8.GetMaxByteCount(segment.Length) + 1);
         try
         {
-            var count = Encoding.UTF8.GetBytes(line, buffer);
-            buffer[count] = (byte)'\n';
-            await Response.Body.WriteAsync(buffer.AsMemory(0, count + 1), cancellationToken);
+            var count = Encoding.UTF8.GetBytes(segment, buffer);
+            if (terminated)
+            {
+                buffer[count] = (byte)'\n';
+                count++;
+            }
+
+            await Response.Body.WriteAsync(buffer.AsMemory(0, count), cancellationToken);
             await Response.Body.FlushAsync(cancellationToken);
         }
         finally
diff --git a/Proxytrace.Proxy/IApiKeyResolver.cs b/Proxytrace.Proxy/IApiKeyResolver.cs
index 91b33c893..e017b9dfb 100644
--- a/Proxytrace.Proxy/IApiKeyResolver.cs
+++ b/Proxytrace.Proxy/IApiKeyResolver.cs
@@ -1,3 +1,4 @@
+using Proxytrace.Domain.ApiKey;
 using Proxytrace.Domain.ModelProvider;
 using Proxytrace.Domain.Project;
 
@@ -31,4 +32,14 @@ public interface IApiKeyResolver
 /// which authentication path matched (a Proxytrace-issued <see cref="Domain.ApiKey.IApiKey"/>
 /// or the provider's own upstream <see cref="IModelProvider.ApiKey"/>).
 /// </summary>
-public sealed record ResolvedApiKey(IProject Project, IModelProvider Provider);
+/// <param name="Scopes">
+/// The capabilities of the Proxytrace-issued key that authenticated the call, or
+/// <see langword="null"/> when the caller authenticated with the provider's <b>own</b> upstream
+/// credential.
+/// </param>
+/// <remarks>
+/// Null means "unscoped, and legitimately so": a caller holding the provider's own key can already
+/// call the provider directly, so restricting which of the provider's paths they may reach through
+/// Proxytrace would protect nothing.
+/// </remarks>
+public sealed record ResolvedApiKey(IProject Project, IModelProvider Provider, ApiKeyScopes? Scopes = null);
diff --git a/Proxytrace.Proxy/Internal/ApiKeyResolver.cs b/Proxytrace.Proxy/Internal/ApiKeyResolver.cs
index 904b86d19..864976f16 100644
--- a/Proxytrace.Proxy/Internal/ApiKeyResolver.cs
+++ b/Proxytrace.Proxy/Internal/ApiKeyResolver.cs
@@ -46,7 +46,7 @@ public ApiKeyResolver(
             // so match canonical slug to canonical slug rather than rejecting "/Development".
             return !string.IsNullOrEmpty(projectSlug) && apiKey.Project.Name.ToSlug() != projectSlug.ToSlug()
                 ? null
-                : new ResolvedApiKey(apiKey.Project, apiKey.Provider);
+                : new ResolvedApiKey(apiKey.Project, apiKey.Provider, apiKey.Scopes);
         }
 
         // Upstream-provider-key path: caller authenticated with the provider's own credentials. The
diff --git a/Proxytrace.Proxy/Module.cs b/Proxytrace.Proxy/Module.cs
index 43911b1fc..0552c8eab 100644
--- a/Proxytrace.Proxy/Module.cs
+++ b/Proxytrace.Proxy/Module.cs
@@ -57,8 +57,15 @@ protected override void Load(ContainerBuilder builder)
         builder.RegisterServiceCollection(services =>
         {
             services.AddMemoryCache();
-            // The upstream target is per-request (provider endpoint), so only the timeout matters here.
-            services.AddHttpClient("openai", client => client.Timeout = TimeSpan.FromMinutes(5));
+            // The upstream target is per-request (provider endpoint), so only the timeout matters
+            // here. Auto-redirect is off for the same reason as the pass-through client below: a
+            // transparent proxy relays a 3xx to the client rather than chasing it server-side. The
+            // BCL's redirect handler only clears the typed Authorization header on a cross-origin
+            // hop — the Azure `api-key` header (BuildUpstreamRequest) and every blanket-forwarded
+            // client header survive the hop, so following an upstream redirect would hand the
+            // provider credential to whatever host the upstream named.
+            services.AddHttpClient("openai", client => client.Timeout = TimeSpan.FromMinutes(5))
+                .ConfigurePrimaryHttpMessageHandler(() => new SocketsHttpHandler { AllowAutoRedirect = false });
 
             // Non-LLM pass-through relays redirects to the client verbatim instead of following them
             // server-side (the BCL would also strip Authorization on the redirect hop), so it needs
diff --git a/Proxytrace.Storage.Tests/AgentLastCallTimeQueryTests.cs b/Proxytrace.Storage.Tests/AgentLastCallTimeQueryTests.cs
new file mode 100644
index 000000000..5023131a9
--- /dev/null
+++ b/Proxytrace.Storage.Tests/AgentLastCallTimeQueryTests.cs
@@ -0,0 +1,65 @@
+using AwesomeAssertions;
+using Microsoft.Extensions.DependencyInjection;
+using Proxytrace.Domain;
+using Proxytrace.Domain.AgentCall;
+using Proxytrace.Testing;
+
+namespace Proxytrace.Storage.Tests;
+
+/// <summary>
+/// Covers the single-agent "last used" lookup. The single-agent GET used to call
+/// <c>GetLastCallTimesAsync</c> — an unfiltered whole-table GROUP BY — just to read one agent's
+/// timestamp, so a hot per-agent page scaled with total trace volume. These assert the filtered
+/// variant agrees with the whole-table one, which is what makes the substitution safe.
+/// </summary>
+[TestClass]
+public sealed class AgentLastCallTimeQueryTests : BaseTest<Module>
+{
+    [TestMethod]
+    public async Task GetLastCallTime_WithNoCalls_ReturnsNull()
+    {
+        IServiceProvider services = GetServices();
+        var repo = services.GetRequiredService<IAgentCallRepository>();
+
+        var result = await repo.GetLastCallTimeAsync(Guid.NewGuid(), CancellationToken);
+
+        result.Should().BeNull();
+    }
+
+    [TestMethod]
+    public async Task GetLastCallTime_ForAnAgentWithCalls_MatchesTheWholeTableGrouping()
+    {
+        IServiceProvider services = GetServices();
+        var repo = services.GetRequiredService<IAgentCallRepository>();
+        var gen = services.GetRequiredService<IDomainEntityGenerator<IAgentCall>>();
+
+        var call = await gen.CreateAsync(CancellationToken);
+        await gen.CreateAsync(CancellationToken);
+
+        var agentId = call.Agent.Id;
+        var all = await repo.GetLastCallTimesAsync(CancellationToken);
+        all.Should().ContainKey(agentId);
+
+        var single = await repo.GetLastCallTimeAsync(agentId, CancellationToken);
+
+        single.Should().Be(all[agentId]);
+    }
+
+    [TestMethod]
+    public async Task GetLastCallTime_ForAnAgentWithoutCalls_ReturnsNullWhileOthersHaveCalls()
+    {
+        // The filter must actually scope to the requested agent — an unfiltered MAX would return
+        // the other agent's timestamp here.
+        IServiceProvider services = GetServices();
+        var repo = services.GetRequiredService<IAgentCallRepository>();
+        var callGen = services.GetRequiredService<IDomainEntityGenerator<IAgentCall>>();
+        var agentGen = services.GetRequiredService<IDomainEntityGenerator<Domain.Agent.IAgent>>();
+
+        await callGen.CreateAsync(CancellationToken);
+        var untouched = await agentGen.CreateAsync(CancellationToken);
+
+        var result = await repo.GetLastCallTimeAsync(untouched.Id, CancellationToken);
+
+        result.Should().BeNull();
+    }
+}
diff --git a/Proxytrace.Storage.Tests/AuditLogRepositoryTests.cs b/Proxytrace.Storage.Tests/AuditLogRepositoryTests.cs
index ac5d7c42a..b757a7317 100644
--- a/Proxytrace.Storage.Tests/AuditLogRepositoryTests.cs
+++ b/Proxytrace.Storage.Tests/AuditLogRepositoryTests.cs
@@ -99,6 +99,24 @@ public async Task GetPagedNewestFirst_WithActorSearch_MatchesEmailInfixCaseInsen
         paged.Items.Should().ContainSingle(e => e.ActorEmail == "alice@example.com");
     }
 
+    [TestMethod]
+    public async Task GetPagedNewestFirst_WithWildcardInActorSearch_MatchesItLiterally()
+    {
+        // % and _ are LIKE operators, so an unescaped search term made "%" match every actor and
+        // "a_b" match "axb". The pattern builder escapes them, so they are matched as typed.
+        var services = GetServices();
+        var repository = services.GetRequiredService<IAuditLogRepository>();
+
+        await SeedAsync(services, Guid.NewGuid(), email: "alice@example.com");
+        await SeedAsync(services, Guid.NewGuid(), email: "bob@example.com");
+
+        var paged = await repository.GetPagedNewestFirstAsync(
+            1, 50, action: null, actorSearch: "%", projectIds: null, includeGlobal: true,
+            targetType: null, targetId: null, from: null, to: null, CancellationToken);
+
+        paged.Total.Should().Be(0, "no actor email contains a literal percent sign");
+    }
+
     private async Task<IAuditLogEntry> SeedAsync(
         IServiceProvider services,
         Guid? projectId,
diff --git a/Proxytrace.Storage.Tests/CachedRepositoryTests.cs b/Proxytrace.Storage.Tests/CachedRepositoryTests.cs
index 258fb9b5d..8d536e863 100644
--- a/Proxytrace.Storage.Tests/CachedRepositoryTests.cs
+++ b/Proxytrace.Storage.Tests/CachedRepositoryTests.cs
@@ -1,4 +1,5 @@
 using System.ComponentModel.DataAnnotations;
+using Autofac;
 using AwesomeAssertions;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
@@ -189,7 +190,7 @@ public void EntityCache_TtlExpiry_EvictsStaleEntriesAndSnapshots()
     {
         // Direct unit test of the cache itself with a fake clock.
         var clock = new FakeTimeProvider(new DateTimeOffset(2025, 1, 1, 0, 0, 0, TimeSpan.Zero));
-        var cache = new EntityCache<IModel>(clock, TimeSpan.FromMinutes(1));
+        var cache = new EntityCache<IModel>(new EntityCacheVersions<IModel>(), clock, TimeSpan.FromMinutes(1));
         var model = new StubModel(Guid.NewGuid(), "m1");
 
         cache.Set(model);
@@ -269,6 +270,83 @@ await transaction.InvokeAsync(async () =>
         reloaded.Name.Should().Be("after-update");
     }
 
+    [TestMethod]
+    public async Task Write_InOneLifetimeScope_InvalidatesTheCacheHeldByAnother()
+    {
+        // The #8 failure: caches are per-lifetime-scope, so an admin's write invalidated only its
+        // own request scope while the singleton ingestion path kept reading its ROOT-scope copy —
+        // e.g. rotating a provider's upstream API key left ingestion authenticating against the
+        // stale key until the 5-minute TTL expired. The cache must stay scope-local (its entries
+        // hold repositories bound to the resolving scope), so invalidation is instead shared
+        // process-wide via EntityCacheVersions.
+        IServiceProvider services = GetServices();
+        var root = services.GetRequiredService<ILifetimeScope>();
+        var generator = services.GetRequiredService<IDomainEntityGenerator<IModel>>();
+        var createExisting = services.GetRequiredService<IModel.CreateExisting>();
+
+        IModel created = await generator.CreateAsync(CancellationToken);
+
+        await using var readerScope = root.BeginLifetimeScope();
+        await using var writerScope = root.BeginLifetimeScope();
+
+        // Reader populates its own scope's cache.
+        IModel before = await readerScope.Resolve<IRepository<IModel>>().FindAsync(created.Id, CancellationToken)
+            ?? throw new InvalidOperationException("Expected the reader scope to load the model.");
+        before.Name.Should().Be(created.Name);
+
+        // Writer commits in a different scope entirely — it never touches the reader's cache instance.
+        await writerScope.Resolve<IRepository<IModel>>()
+            .UpdateAsync(createExisting("rotated", created), CancellationToken);
+
+        IModel after = await readerScope.Resolve<IRepository<IModel>>().FindAsync(created.Id, CancellationToken)
+            ?? throw new InvalidOperationException("Expected the reader scope to reload the model.");
+        after.Name.Should().Be("rotated", "a write in any scope must invalidate every scope's cached copy");
+    }
+
+    [TestMethod]
+    public async Task GetAllAsync_AfterAWriteInAnotherLifetimeScope_ReturnsAFreshSnapshot()
+    {
+        // Same cross-scope guarantee for the "all entities" snapshot, which backs the list reads.
+        IServiceProvider services = GetServices();
+        var root = services.GetRequiredService<ILifetimeScope>();
+        var generator = services.GetRequiredService<IDomainEntityGenerator<IModel>>();
+
+        await generator.CreateAsync(CancellationToken);
+
+        await using var readerScope = root.BeginLifetimeScope();
+        await using var writerScope = root.BeginLifetimeScope();
+
+        IReadOnlyList<IModel> first = await readerScope.Resolve<IRepository<IModel>>().GetAllAsync(CancellationToken);
+        first.Should().HaveCount(1);
+
+        var added = await writerScope.Resolve<IDomainEntityGenerator<IModel>>().GenerateAsync(CancellationToken);
+        await writerScope.Resolve<IRepository<IModel>>().AddAsync(added, CancellationToken);
+
+        IReadOnlyList<IModel> second = await readerScope.Resolve<IRepository<IModel>>().GetAllAsync(CancellationToken);
+        second.Should().HaveCount(2, "an add in any scope must drop every scope's cached snapshot");
+    }
+
+    [TestMethod]
+    public void EntityCacheVersions_WhenTheTrackedIdCapIsExceeded_StillReportsEveryEntryStale()
+    {
+        // The per-id map is bounded. Dropping a version must fail safe: a forgotten id reads back as
+        // version 0, which no live entry matches, so eviction can only cause an extra miss.
+        var versions = new EntityCacheVersions<IModel>();
+        var first = Guid.NewGuid();
+
+        versions.Invalidate(first);
+        long trackedVersion = versions.VersionOf(first);
+        trackedVersion.Should().BeGreaterThan(0);
+
+        for (var i = 0; i < 10_000; i++)
+        {
+            versions.Invalidate(Guid.NewGuid());
+        }
+
+        versions.VersionOf(first).Should().NotBe(trackedVersion,
+            "an evicted id must not keep matching an entry cached under its old version");
+    }
+
     private sealed class FakeTimeProvider : TimeProvider
     {
         private DateTimeOffset now;
diff --git a/Proxytrace.Storage.Tests/CascadeDeleteBehaviorModelTests.cs b/Proxytrace.Storage.Tests/CascadeDeleteBehaviorModelTests.cs
index 4c6206cb9..aa9b06371 100644
--- a/Proxytrace.Storage.Tests/CascadeDeleteBehaviorModelTests.cs
+++ b/Proxytrace.Storage.Tests/CascadeDeleteBehaviorModelTests.cs
@@ -2,6 +2,7 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
 using Proxytrace.Storage.Internal.Entities.AgentCall;
+using Proxytrace.Storage.Internal.Entities.ApiKey;
 using Proxytrace.Storage.Internal.Entities.ModelEndpoint;
 using Proxytrace.Storage.Internal.Entities.ModelProvider;
 using Proxytrace.Storage.Internal.Entities.TestRun;
@@ -40,6 +41,28 @@ public void ModelEndpointToModelProvider_IsRestrict_SoDeletingAProviderCannotWip
                 "a hard delete of a ModelProvider must never cascade through its endpoints to the traces table");
     }
 
+    [TestMethod]
+    public void ApiKeyToModelProvider_IsRestrict_SoDeletingAProviderCannotDestroyItsKeys()
+    {
+        // Only the key's hash is stored, so a deleted API key is unrecoverable — it cannot be
+        // re-issued, only replaced, and every integration configured with it breaks at once with
+        // nothing but a 401 to go on.
+        DeleteBehaviorFor<ApiKeyEntity>(nameof(ApiKeyEntity.Provider))
+            .Should().Be(DeleteBehavior.Restrict,
+                "a hard delete of a ModelProvider must never cascade-delete the API keys issued for it");
+    }
+
+    [TestMethod]
+    public void ApiKeyToUser_IsRestrict_SoOffboardingAnOwnerCannotDestroyTheirKeys()
+    {
+        // Deleting a user used to silently revoke every key they had minted. The keys are
+        // unrecoverable, so that turned routine offboarding into an unannounced outage;
+        // UserAdministrationService now refuses the delete with a 409 naming the keys.
+        DeleteBehaviorFor<ApiKeyEntity>(nameof(ApiKeyEntity.Owner))
+            .Should().Be(DeleteBehavior.Restrict,
+                "deleting a user must never cascade-delete the API keys they own");
+    }
+
     [TestMethod]
     public void TestRunToModelEndpoint_IsRestrict_SoDeletingAnEndpointCannotWipeTestRuns()
     {
diff --git a/Proxytrace.Storage.Tests/MigrationDriftTests.cs b/Proxytrace.Storage.Tests/MigrationDriftTests.cs
new file mode 100644
index 000000000..8920ce386
--- /dev/null
+++ b/Proxytrace.Storage.Tests/MigrationDriftTests.cs
@@ -0,0 +1,38 @@
+using Autofac;
+using AwesomeAssertions;
+using Microsoft.EntityFrameworkCore;
+using Proxytrace.Testing;
+
+namespace Proxytrace.Storage.Tests;
+
+/// <summary>
+/// Guards against schema drift: a change to an EF model that no migration applies.
+/// </summary>
+/// <remarks>
+/// EF's own <c>PendingModelChangesWarning</c> is suppressed in <c>Storage.Module</c> because it is
+/// raised at <c>Migrate()</c> time — on a real deployment, against a real database, where throwing
+/// means the application will not start. Suppressing it there and asserting the same condition here
+/// keeps the safety net without letting a metadata quirk take down a production boot: drift is
+/// caught in CI, by the people who can fix it, instead of at a customer's startup.
+/// </remarks>
+[TestClass]
+public sealed class MigrationDriftTests : BaseTest<Module>
+{
+    [TestMethod]
+    public void Model_HasNoChangesMissingFromMigrations()
+    {
+        // Needs the relational provider: the model differ compares against the migrations snapshot,
+        // which only the Npgsql model carries. No connection is opened — nothing here talks to a
+        // database, so this runs anywhere the unit suite runs.
+        using var scope = BuildContainer(builder =>
+            builder.RegisterInstance(StorageConfiguration.Postgres(
+                    "Host=drift-check;Database=drift-check;Username=drift;Password=drift"))
+                .As<StorageConfiguration>());
+
+        using var context = scope.Resolve<StorageDbContext>();
+
+        context.Database.HasPendingModelChanges().Should().BeFalse(
+            "every model change must ship with the migration that applies it — run "
+            + "`dotnet ef migrations add <Name> --project Proxytrace.Storage` and commit the result");
+    }
+}
diff --git a/Proxytrace.Storage.Tests/ModelProviderSecretTests.cs b/Proxytrace.Storage.Tests/ModelProviderSecretTests.cs
index aab5c2d07..3dd1ccde6 100644
--- a/Proxytrace.Storage.Tests/ModelProviderSecretTests.cs
+++ b/Proxytrace.Storage.Tests/ModelProviderSecretTests.cs
@@ -49,4 +49,48 @@ public async Task FindByApiKey_ResolvesByPlaintext_ViaBlindIndex()
         byKey.Should().NotBeNull();
         byKey?.Id.Should().Be(saved.Id);
     }
+
+    [TestMethod]
+    public async Task FindByApiKey_ResolvesARowStillCarryingTheLegacyUnkeyedIndex()
+    {
+        // Rows written before the index became keyed carry a bare SHA-256 until the startup backfill
+        // upgrades them. Accepting only the keyed form would make every provider on a not-yet-
+        // backfilled install fail to authenticate upstream — an outage, not a hardening.
+        IServiceProvider services = GetServices();
+        var providers = services.GetRequiredService<IModelProviderRepository>();
+        var create = services.GetRequiredService<IModelProvider.CreateNew>();
+        var indexer = services.GetRequiredService<Domain.Security.ISecretIndexer>();
+
+        var saved = await providers.AddAsync(
+            create("p", new Uri("https://api.example.com/v1"), "sk-legacy-789", ModelProviderKind.OpenAiCompatible),
+            CancellationToken);
+
+        // Rewrite the index column to the pre-keying form, bypassing the mapper.
+        var context = services.GetRequiredService<Func<StorageDbContext>>()();
+        var raw = await context.Set<ModelProviderEntity>().FirstAsync(e => e.Id == saved.Id, CancellationToken);
+        context.Entry(raw).CurrentValues.SetValues(raw with
+        {
+            ApiKeyLookupHash = indexer.LegacyIndex("sk-legacy-789"),
+        });
+        await context.SaveChangesAsync(CancellationToken);
+
+        var byKey = await providers.FindByApiKeyAsync("sk-legacy-789", CancellationToken);
+
+        byKey.Should().NotBeNull();
+        byKey?.Id.Should().Be(saved.Id);
+    }
+
+    [TestMethod]
+    public async Task FindByApiKey_WithAWrongKey_ResolvesNothing()
+    {
+        IServiceProvider services = GetServices();
+        var providers = services.GetRequiredService<IModelProviderRepository>();
+        var create = services.GetRequiredService<IModelProvider.CreateNew>();
+
+        await providers.AddAsync(
+            create("p", new Uri("https://api.example.com/v1"), "sk-right", ModelProviderKind.OpenAiCompatible),
+            CancellationToken);
+
+        (await providers.FindByApiKeyAsync("sk-wrong", CancellationToken)).Should().BeNull();
+    }
 }
diff --git a/Proxytrace.Storage.Tests/SecretsBackfillServiceTests.cs b/Proxytrace.Storage.Tests/SecretsBackfillServiceTests.cs
index 5962eef4b..b882e2f4f 100644
--- a/Proxytrace.Storage.Tests/SecretsBackfillServiceTests.cs
+++ b/Proxytrace.Storage.Tests/SecretsBackfillServiceTests.cs
@@ -3,6 +3,7 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
 using NSubstitute;
+using Proxytrace.Common.Security;
 using Proxytrace.Domain.Security;
 using Proxytrace.Domain;
 using Proxytrace.Domain.ApiKey;
@@ -88,6 +89,53 @@ public async Task Backfill_ProtectsPlaintextRowsInPlace_AndIsIdempotent()
         rawProviderAgain.ApiKey.Should().Be(providerCipher);
     }
 
+    [TestMethod]
+    public async Task Backfill_WhenPreRetrofitKeyWasSavedBeforeTheBackfillRan_StillHashesIt()
+    {
+        // Regression: the "not yet protected" marker for ApiKey used to be `KeyPrefix IS NULL`, but
+        // ApiKeyConfig maps that null to string.Empty on read and writes the "" straight back, so any
+        // save of a pre-retrofit row erased the marker and the row was skipped forever — its KeyHash
+        // column kept the plaintext key, which FindByKeyAsync (which hashes the presented value) can
+        // never match, so the credential silently stopped authenticating. The marker is now the shape
+        // of KeyHash itself: a hex SHA-256 is 64 chars, a plaintext key is not.
+        IServiceProvider services = GetServices();
+        var contextFactory = services.GetRequiredService<Func<StorageDbContext>>();
+        var now = DateTimeOffset.UtcNow;
+
+        var project = await services.GetRequiredService<IDomainEntityGenerator<IProject>>().CreateAsync(CancellationToken);
+        var fkProvider = await services.GetRequiredService<IDomainEntityGenerator<IModelProvider>>().CreateAsync(CancellationToken);
+        var owner = await services.GetRequiredService<IDomainEntityGenerator<IUser>>().CreateAsync(CancellationToken);
+
+        var keyId = Guid.NewGuid();
+        const string keyPlaintext = "proxytrace-inbound-plain";
+        var seed = contextFactory();
+        seed.Set<ApiKeyEntity>().Add(new ApiKeyEntity
+        {
+            Id = keyId, Name = "legacy-key", KeyHash = keyPlaintext, KeyPrefix = null,
+            Project = project.Id, Provider = fkProvider.Id, Scopes = ApiKeyScopes.Ingestion, Owner = owner.Id,
+            CreatedAt = now, UpdatedAt = now,
+        });
+        await seed.SaveChangesAsync(CancellationToken);
+
+        // Round-trip the row through the mapper once — this is what destroys a NULL-based marker.
+        var keys = services.GetRequiredService<IApiKeyRepository>();
+        var loaded = await keys.GetAsync(keyId, CancellationToken);
+        await keys.UpdateAsync(loaded, CancellationToken);
+        var afterSave = await contextFactory().Set<ApiKeyEntity>().AsNoTracking().FirstAsync(e => e.Id == keyId, CancellationToken);
+        afterSave.KeyPrefix.Should().BeEmpty("the mapper collapses the NULL, so KeyPrefix cannot be the marker");
+        afterSave.KeyHash.Should().Be(keyPlaintext);
+
+        await services.GetRequiredService<SecretsBackfillService>().StartAsync(CancellationToken);
+
+        // The row is still recognised as un-backfilled and is hashed, so the key authenticates again.
+        var found = await keys.FindByKeyAsync(keyPlaintext, CancellationToken);
+        found.Should().NotBeNull();
+        found?.Id.Should().Be(keyId);
+        var raw = await contextFactory().Set<ApiKeyEntity>().AsNoTracking().FirstAsync(e => e.Id == keyId, CancellationToken);
+        raw.KeyHash.Should().Be(Sha256.HexHash(keyPlaintext));
+        raw.KeyPrefix.Should().Be(keyPlaintext[..16]);
+    }
+
     [TestMethod]
     public async Task Backfill_WhenEncryptionFails_DoesNotCrash_AndLeavesProviderUnbackfilled()
     {
diff --git a/Proxytrace.Storage.Tests/StatsQueryTranslationTests.cs b/Proxytrace.Storage.Tests/StatsQueryTranslationTests.cs
index cd37cb106..e52b4f1c9 100644
--- a/Proxytrace.Storage.Tests/StatsQueryTranslationTests.cs
+++ b/Proxytrace.Storage.Tests/StatsQueryTranslationTests.cs
@@ -40,6 +40,7 @@ private static IContainer BuildPostgresContainer()
             "Host=localhost;Database=translation-check;Username=none;Password=none")));
         builder.RegisterStub<ISecretProtector>();
         builder.RegisterStub<ISecretHasher>();
+        builder.RegisterStub<ISecretIndexer>();
         builder.RegisterStub<IAgentNameGenerator>();
         builder.RegisterStub<IProviderClient>();
         builder.RegisterInstance(NullLoggerFactory.Instance).As<ILoggerFactory>();
diff --git a/Proxytrace.Storage.Tests/TestResultRepositoryTests.cs b/Proxytrace.Storage.Tests/TestResultRepositoryTests.cs
index 1e54ba279..b37694f48 100644
--- a/Proxytrace.Storage.Tests/TestResultRepositoryTests.cs
+++ b/Proxytrace.Storage.Tests/TestResultRepositoryTests.cs
@@ -135,6 +135,80 @@ public async Task UpdateAsync_BackdatedCreatedAt_RewritesEvaluationStatRows()
         row.Score.Should().Be(EvaluationScore.Good);
     }
 
+    [TestMethod]
+    public async Task GetRecentByEvaluator_WhenOtherEvaluatorsHaveManyNewerResults_StillFindsItsOwn()
+    {
+        // The window used to be the most recent N results across the WHOLE install, filtered by
+        // evaluator only afterwards. Once anything else produced N newer results, an evaluator's
+        // own history silently returned empty — and it was cross-tenant: a busy project's runs
+        // evicted everyone else's. Filtering by evaluator in SQL makes the answer depend only on
+        // this evaluator's own history.
+        var services = GetServices();
+        var evaluatorGen = services.GetRequiredService<IDomainEntityGenerator<IEvaluator>>();
+        var repo = services.GetRequiredService<ITestResultRepository>();
+
+        var mine = await evaluatorGen.CreateAsync(CancellationToken);
+        var noisy = await evaluatorGen.CreateAsync(CancellationToken);
+
+        await PersistResult(services, mine, EvaluationScore.Good);
+
+        // Bury it under far more recent results belonging to a different evaluator than any
+        // plausible global window would have held.
+        for (var i = 0; i < 250; i++)
+        {
+            await PersistResult(services, noisy, EvaluationScore.Good);
+        }
+
+        var recent = await repo.GetRecentByEvaluatorAsync(mine.Id, count: 10, cancellationToken: CancellationToken);
+        var latest = await repo.GetLatestByEvaluatorAsync(mine.Id, CancellationToken);
+
+        recent.Should().ContainSingle("this evaluator has exactly one result, however much else ran since");
+        latest.Should().NotBeNull();
+        latest?.Evaluations.Should().Contain(e => e.Evaluator.Id == mine.Id);
+    }
+
+    [TestMethod]
+    public async Task SearchByEvaluator_WhenOtherEvaluatorsHaveManyNewerResults_StillFindsItsOwn()
+    {
+        var services = GetServices();
+        var evaluatorGen = services.GetRequiredService<IDomainEntityGenerator<IEvaluator>>();
+        var repo = services.GetRequiredService<ITestResultRepository>();
+
+        var mine = await evaluatorGen.CreateAsync(CancellationToken);
+        var noisy = await evaluatorGen.CreateAsync(CancellationToken);
+
+        await PersistResult(services, mine, EvaluationScore.Bad, reasoning: "needle-in-a-haystack");
+
+        for (var i = 0; i < 250; i++)
+        {
+            await PersistResult(services, noisy, EvaluationScore.Good, reasoning: "unrelated");
+        }
+
+        var matches = await repo.SearchByEvaluatorAsync(mine.Id, "needle-in-a-haystack", count: 10, CancellationToken);
+
+        matches.Should().ContainSingle();
+    }
+
+    [TestMethod]
+    public async Task GetRecentByEvaluator_WithAScoreFilter_ReturnsOnlyMatchingResults()
+    {
+        // The score filter moved into SQL alongside the evaluator filter — assert it still holds.
+        var services = GetServices();
+        var evaluator = await services.GetRequiredService<IDomainEntityGenerator<IEvaluator>>()
+            .CreateAsync(CancellationToken);
+        var repo = services.GetRequiredService<ITestResultRepository>();
+
+        await PersistResult(services, evaluator, EvaluationScore.Good);
+        await PersistResult(services, evaluator, EvaluationScore.Bad);
+        await PersistResult(services, evaluator, EvaluationScore.Bad);
+
+        var bad = await repo.GetRecentByEvaluatorAsync(
+            evaluator.Id, count: 10, score: EvaluationScore.Bad, cancellationToken: CancellationToken);
+
+        bad.Should().HaveCount(2);
+        bad.Should().OnlyContain(r => r.Evaluations.Any(e => e.Score == EvaluationScore.Bad));
+    }
+
     private sealed record BackdatedData(Guid Id, DateTimeOffset CreatedAt, DateTimeOffset UpdatedAt) : IDomainEntityData;
 
     private async Task<ITestCase> PersistResult(
diff --git a/Proxytrace.Storage.Tests/TestRunStatsStoreTests.cs b/Proxytrace.Storage.Tests/TestRunStatsStoreTests.cs
index d4596ee3f..14fdcc6c2 100644
--- a/Proxytrace.Storage.Tests/TestRunStatsStoreTests.cs
+++ b/Proxytrace.Storage.Tests/TestRunStatsStoreTests.cs
@@ -48,6 +48,38 @@ public async Task UpsertAsync_NewRow_PersistsAndIsReadable()
         found.TotalDuration.Should().Be(TimeSpan.FromSeconds(2));
     }
 
+    [TestMethod]
+    public async Task QueryAsync_EmptyAgentIds_MatchesNothing_NotEverything()
+    {
+        var services = GetServices();
+        var writer = services.GetRequiredService<IStatsWriter<TestRunStats>>();
+        var reader = services.GetRequiredService<IStatsReader<TestRunStats, TestRunStats.Filter>>();
+        var run = await services.GetRequiredService<IDomainEntityGenerator<ITestRun>>().CreateAsync(CancellationToken);
+        await writer.UpsertAsync(StatsFor(run), CancellationToken);
+
+        // An empty AgentIds list is what the dashboard produces for a project that has no agents.
+        // It must narrow to nothing; treating it as "no filter" leaked every other project's runs.
+        var scoped = await reader.QueryAsync(new TestRunStats.Filter(AgentIds: []), CancellationToken);
+        var unfiltered = await reader.QueryAsync(new TestRunStats.Filter(AgentIds: null), CancellationToken);
+
+        scoped.Should().BeEmpty();
+        unfiltered.Should().ContainSingle(s => s.TestRunId == run.Id);
+    }
+
+    [TestMethod]
+    public async Task QueryAsync_EmptySuiteIds_MatchesNothing_NotEverything()
+    {
+        var services = GetServices();
+        var writer = services.GetRequiredService<IStatsWriter<TestRunStats>>();
+        var reader = services.GetRequiredService<IStatsReader<TestRunStats, TestRunStats.Filter>>();
+        var run = await services.GetRequiredService<IDomainEntityGenerator<ITestRun>>().CreateAsync(CancellationToken);
+        await writer.UpsertAsync(StatsFor(run), CancellationToken);
+
+        var scoped = await reader.QueryAsync(new TestRunStats.Filter(SuiteIds: []), CancellationToken);
+
+        scoped.Should().BeEmpty();
+    }
+
     [TestMethod]
     public async Task UpsertAsync_ExistingRow_UpdatesValuesInPlace()
     {
diff --git a/Proxytrace.Storage/Internal/AbstractRepository.cs b/Proxytrace.Storage/Internal/AbstractRepository.cs
index 0694e5c3e..23acd9b20 100644
--- a/Proxytrace.Storage/Internal/AbstractRepository.cs
+++ b/Proxytrace.Storage/Internal/AbstractRepository.cs
@@ -202,7 +202,7 @@ public async Task<PagedResult<TDomainEntity>> GetPagedAsync(
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(e => e.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
@@ -494,6 +494,27 @@ public virtual async Task<bool> RemoveAsync(Guid id, CancellationToken cancellat
         return removed;
     }
 
+    /// <summary>
+    /// Removes every row of this entity type.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Used by the admin data reset, which invokes it on <c>AgentCallEntity</c> — the highest-volume
+    /// table in the install. <c>RemoveRange(set)</c> loaded every row into the change tracker first,
+    /// so resetting an install with millions of traces meant materializing all of them just to
+    /// delete them. The relational path issues a single server-side <c>DELETE</c> instead.
+    /// </para>
+    /// <para>
+    /// The in-memory provider (kiosk/tests) cannot translate <c>ExecuteDelete</c>, so it keeps the
+    /// materializing path — cheap on those datasets. See the same relational/in-memory split in
+    /// <c>AgentCallRepository.RemoveOlderThanAsync</c>.
+    /// </para>
+    /// <para>
+    /// Change notifications are still emitted per row, so ids are read before the delete. That read
+    /// is a single indexed column projection rather than a full-entity materialization, and callers
+    /// depend on the events (SSE, cache invalidation), so it stays.
+    /// </para>
+    /// </remarks>
     public async Task RemoveAllAsync(CancellationToken cancellationToken = default)
     {
         Guid[] removedIds = await transaction.InvokeAsync(async () =>
@@ -501,8 +522,17 @@ public async Task RemoveAllAsync(CancellationToken cancellationToken = default)
             StorageDbContext context = ambient.RequireContext();
             DbSet<TStoredEntity> set = context.Set<TStoredEntity>();
             Guid[] ids = await set.AsNoTracking().Select(e => e.Id).ToArrayAsync(cancellationToken);
-            set.RemoveRange(set);
-            await context.SaveChangesAsync(cancellationToken);
+
+            if (context.Database.IsRelational())
+            {
+                await set.ExecuteDeleteAsync(cancellationToken);
+            }
+            else
+            {
+                set.RemoveRange(set);
+                await context.SaveChangesAsync(cancellationToken);
+            }
+
             InvalidateCache();
             return ids;
         });
diff --git a/Proxytrace.Storage/Internal/Entities/AgentCall/AgentCallRepository.cs b/Proxytrace.Storage/Internal/Entities/AgentCall/AgentCallRepository.cs
index 2ff10f3b9..e3dae107b 100644
--- a/Proxytrace.Storage/Internal/Entities/AgentCall/AgentCallRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/AgentCall/AgentCallRepository.cs
@@ -8,6 +8,7 @@
 using Proxytrace.Domain.Session;
 using Proxytrace.Domain.Events;
 using Proxytrace.Domain.ModelEndpoint;
+using Proxytrace.Domain.Paging;
 using Proxytrace.Domain.Project;
 using Proxytrace.Domain.Search;
 using Proxytrace.Domain.Usage;
@@ -61,7 +62,7 @@ public AgentCallRepository(
         var total = await query.CountAsync(cancellationToken);
 
         var stored = await ApplySort(query, filter)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
@@ -87,7 +88,7 @@ public AgentCallRepository(
         // Project scalar columns only — the Request/Response/ModelParameters payload columns are
         // never read, so a page does not materialise (or transfer) large conversation JSON.
         var rows = await ApplySort(query, filter)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .Select(e => new ListRow(
                 e.Id,
@@ -335,6 +336,17 @@ public async Task<AgentCallSummary> GetSummaryAsync(
             query = query.Where(e => versionIdsForProject.Contains(e.AgentVersionId));
         }
 
+        // Multi-project scope (a non-admin listing without a project filter, #482). Same shape as
+        // the single-project branch above — an IN over the agent-version subquery — so it stays a
+        // server-side semi-join on AgentVersion(Project) rather than a client-side filter.
+        if (filter.ProjectIds is { Count: > 0 } projectIds)
+        {
+            var versionIdsForProjects = context.Set<AgentVersionEntity>()
+                .Where(v => projectIds.Contains(v.Project))
+                .Select(v => v.Id);
+            query = query.Where(e => versionIdsForProjects.Contains(e.AgentVersionId));
+        }
+
         if (filter.EndpointId is not null)
         {
             query = query.Where(e => e.EndpointId == filter.EndpointId);
@@ -352,10 +364,15 @@ public async Task<AgentCallSummary> GetSummaryAsync(
 
         if (!string.IsNullOrWhiteSpace(filter.Model))
         {
-            var search = filter.Model;
+            // Lower both sides and escape the user's wildcards — see LikePattern. A bare
+            // EF.Functions.Like(m.Name, $"%{search}%") is case-sensitive on Postgres but
+            // case-insensitive on the in-memory test provider, so the tests pass while the
+            // production filter silently misses matches.
+            var pattern = LikePattern.Contains(filter.Model);
             var matchingEndpointIds = context.Set<ModelEndpointEntity>()
                 .Where(me => context.Set<ModelEntity>()
-                    .Any(m => m.Id == me.Model && EF.Functions.Like(m.Name, $"%{search}%")))
+                    .Any(m => m.Id == me.Model
+                              && EF.Functions.Like(m.Name.ToLower(), pattern, LikePattern.EscapeCharacter)))
                 .Select(me => me.Id);
             query = query.Where(e => matchingEndpointIds.Contains(e.EndpointId));
         }
@@ -420,24 +437,35 @@ public async Task<AgentCallSummary> GetSummaryAsync(
 
         if (!string.IsNullOrWhiteSpace(filter.Query))
         {
-            if (filter.ProjectId is null)
+            // The full-text index is partitioned per project, so a text query needs at least one
+            // project to search. A multi-project scope (#482) searches each and unions the hits —
+            // scopes are a caller's memberships, so this is a handful of index lookups, not a fan-out.
+            IReadOnlyCollection<Guid> searchProjects = filter.ProjectId is { } singleProject
+                ? [singleProject]
+                : filter.ProjectIds ?? [];
+
+            if (searchProjects.Count == 0)
             {
                 return null;
             }
 
-            var matchingIds = await searchService.SearchEntityIdsAsync(
-                filter.ProjectId.Value,
-                filter.Query,
-                SearchKind.AgentCall,
-                MaxFulltextHits,
-                cancellationToken);
+            var idSet = new HashSet<Guid>();
+            foreach (var searchProject in searchProjects)
+            {
+                var hits = await searchService.SearchEntityIdsAsync(
+                    searchProject,
+                    filter.Query,
+                    SearchKind.AgentCall,
+                    MaxFulltextHits,
+                    cancellationToken);
+                idSet.UnionWith(hits);
+            }
 
-            if (matchingIds.Count == 0)
+            if (idSet.Count == 0)
             {
                 return null;
             }
 
-            var idSet = matchingIds.ToHashSet();
             query = query.Where(e => idSet.Contains(e.Id));
         }
 
@@ -498,6 +526,28 @@ into g
         return result;
     }
 
+    public async Task<DateTimeOffset?> GetLastCallTimeAsync(
+        Guid agentId,
+        CancellationToken cancellationToken = default)
+    {
+        var context = contextFactory();
+
+        // Filtered to this agent's versions, so the database scans that agent's calls via the
+        // AgentVersionId index instead of grouping the whole trace table the way
+        // GetLastCallTimesAsync must. Max over an empty set yields null, which is exactly the
+        // "never called" answer — hence the nullable projection rather than a Max on DateTimeOffset.
+        var versionIds = context.Set<AgentVersionEntity>()
+            .AsNoTracking()
+            .Where(v => v.AgentId == agentId)
+            .Select(v => v.Id);
+
+        return await context.Set<AgentCallEntity>()
+            .AsNoTracking()
+            .Where(c => versionIds.Contains(c.AgentVersionId))
+            .Select(c => (DateTimeOffset?)c.CreatedAt)
+            .MaxAsync(cancellationToken);
+    }
+
     public async Task<IAgentCall?> FindLatestByConversationIdAsync(
         Guid conversationId,
         IProject project,
diff --git a/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyConfig.cs b/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyConfig.cs
index 1e4666290..37007b62a 100644
--- a/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyConfig.cs
+++ b/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyConfig.cs
@@ -48,18 +48,28 @@ public override void Configure(EntityTypeBuilder<ApiKeyEntity> builder)
             .HasForeignKey(e => e.Project)
             .OnDelete(DeleteBehavior.Restrict);
 
+        // Restrict, not Cascade. Only the key's hash is stored, so a deleted key is unrecoverable —
+        // it cannot be re-issued, only replaced, and every integration configured with it breaks at
+        // once with no diagnostic beyond a 401. Cascading meant hard-deleting a provider silently
+        // destroyed every key issued for it. The provider repository is already archive-only
+        // (SupportsHardDelete => false), so this is the database-level backstop for the paths the
+        // repository never sees (raw SQL, EF bulk deletes) — the same pairing ModelEndpoint uses.
         builder
             .HasOne<ModelProviderEntity>()
             .WithMany()
             .HasForeignKey(e => e.Provider)
-            .OnDelete(DeleteBehavior.Cascade);
+            .OnDelete(DeleteBehavior.Restrict);
 
-        // The key acts as its owner; it cannot outlive them, so deleting a user removes their keys.
+        // Also Restrict. A key acts as its owner, so it genuinely must not outlive them — but
+        // cascading turned "offboard this admin" into "silently revoke every integration they
+        // happened to mint", discovered only when production traffic started failing.
+        // UserAdministrationService now refuses the delete with a 409 naming the keys, so an
+        // operator deletes or reassigns them deliberately instead of finding out afterwards.
         builder
             .HasOne<UserEntity>()
             .WithMany()
             .HasForeignKey(e => e.Owner)
-            .OnDelete(DeleteBehavior.Cascade);
+            .OnDelete(DeleteBehavior.Restrict);
     }
 
     public async Task<IApiKey> Map(ApiKeyEntity stored, CancellationToken cancellationToken = default)
diff --git a/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyEntity.cs b/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyEntity.cs
index 45cec1935..43764618e 100644
--- a/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyEntity.cs
+++ b/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyEntity.cs
@@ -19,8 +19,10 @@ internal record ApiKeyEntity : Entity
 
     /// <summary>
     /// <see cref="Proxytrace.Domain.ApiKey.IApiKey.KeyPrefix"/> — a non-secret display slice. Null on a
-    /// pre-retrofit row until the startup backfill sets it (the null marks an un-migrated row whose
-    /// <see cref="KeyHash"/> still holds the plaintext key).
+    /// pre-retrofit row until the startup backfill sets it. It is deliberately <em>not</em> the
+    /// backfill's "still plaintext" marker: the mapper collapses the null to <c>""</c> on every round
+    /// trip, so any save would erase it. <c>SecretsBackfillService</c> keys on the shape of
+    /// <see cref="KeyHash"/> instead.
     /// </summary>
     public string? KeyPrefix { get; init; }
 
diff --git a/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyRepository.cs b/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyRepository.cs
index 21405d54a..c83902a42 100644
--- a/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/ApiKey/ApiKeyRepository.cs
@@ -46,4 +46,15 @@ public async Task<IReadOnlyList<IApiKey>> GetByProviderAsync(Guid providerId, Ca
 
         return await Map(stored, cancellationToken);
     }
+
+    public async Task<IReadOnlyList<string>> GetKeyNamesByOwnerAsync(Guid ownerId, CancellationToken cancellationToken = default)
+        // Projects the name column only — no mapping, so this never materializes a key entity (and
+        // never resolves its project/provider/owner graph) just to answer "does this user own any?".
+        => await contextFactory()
+            .Set<ApiKeyEntity>()
+            .AsNoTracking()
+            .Where(e => e.Owner == ownerId)
+            .OrderBy(e => e.Name)
+            .Select(e => e.Name)
+            .ToListAsync(cancellationToken);
 }
diff --git a/Proxytrace.Storage/Internal/Entities/ApplicationError/ApplicationErrorRepository.cs b/Proxytrace.Storage/Internal/Entities/ApplicationError/ApplicationErrorRepository.cs
index 870275d20..ec2edfd0b 100644
--- a/Proxytrace.Storage/Internal/Entities/ApplicationError/ApplicationErrorRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/ApplicationError/ApplicationErrorRepository.cs
@@ -50,16 +50,21 @@ public async Task<PagedResult<IApplicationError>> GetPagedNewestFirstAsync(
 
         if (!string.IsNullOrWhiteSpace(search))
         {
-            var pattern = $"%{search.Trim()}%";
+            // Lower both sides and escape the user's wildcards — see LikePattern. A bare
+            // EF.Functions.Like over the raw column is case-sensitive on Postgres but
+            // case-insensitive on the in-memory test provider, so searching "TimeoutException"
+            // silently missed rows logged as "timeoutexception" in production only.
+            var pattern = LikePattern.Contains(search);
             query = query.Where(e =>
-                EF.Functions.Like(e.Message, pattern) ||
-                (e.StackTrace != null && EF.Functions.Like(e.StackTrace, pattern)));
+                EF.Functions.Like(e.Message.ToLower(), pattern, LikePattern.EscapeCharacter) ||
+                (e.StackTrace != null
+                 && EF.Functions.Like(e.StackTrace.ToLower(), pattern, LikePattern.EscapeCharacter)));
         }
 
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(e => e.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
diff --git a/Proxytrace.Storage/Internal/Entities/AuditLog/AuditLogRepository.cs b/Proxytrace.Storage/Internal/Entities/AuditLog/AuditLogRepository.cs
index 273396e11..4c4399af6 100644
--- a/Proxytrace.Storage/Internal/Entities/AuditLog/AuditLogRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/AuditLog/AuditLogRepository.cs
@@ -78,8 +78,10 @@ public async Task<PagedResult<IAuditLogEntry>> GetPagedNewestFirstAsync(
             // Case-insensitive infix match: lower-case both sides so it works identically on Postgres
             // (where SQL LIKE is case-sensitive — translates to lower(ActorEmail) LIKE …) and the
             // in-memory provider. A plain EF.Functions.Like would silently be case-sensitive in prod.
-            var pattern = $"%{actorSearch.Trim().ToLowerInvariant()}%";
-            query = query.Where(e => e.ActorEmail != null && EF.Functions.Like(e.ActorEmail.ToLower(), pattern));
+            // LikePattern also escapes % and _ so a search for them matches literally.
+            var pattern = LikePattern.Contains(actorSearch);
+            query = query.Where(e => e.ActorEmail != null
+                                     && EF.Functions.Like(e.ActorEmail.ToLower(), pattern, LikePattern.EscapeCharacter));
         }
 
         int total = await query.CountAsync(cancellationToken);
@@ -88,7 +90,7 @@ public async Task<PagedResult<IAuditLogEntry>> GetPagedNewestFirstAsync(
             // stable, total order across pages — without it a tied row can duplicate or vanish at a boundary.
             .OrderByDescending(e => e.CreatedAt)
             .ThenByDescending(e => e.Id)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
diff --git a/Proxytrace.Storage/Internal/Entities/MfaBackupCode/MfaBackupCodeConfig.cs b/Proxytrace.Storage/Internal/Entities/MfaBackupCode/MfaBackupCodeConfig.cs
index 6f10db699..bbf62a6db 100644
--- a/Proxytrace.Storage/Internal/Entities/MfaBackupCode/MfaBackupCodeConfig.cs
+++ b/Proxytrace.Storage/Internal/Entities/MfaBackupCode/MfaBackupCodeConfig.cs
@@ -24,7 +24,10 @@ public MfaBackupCodeConfig(IMfaBackupCode.CreateExisting factory, IRepository<IU
     public override void Configure(EntityTypeBuilder<MfaBackupCodeEntity> builder)
     {
         builder.HasIndex(e => e.CodeHash).IsUnique();
-        builder.Property(e => e.CodeHash).HasMaxLength(64);
+        // Backup codes are hashed with PBKDF2 + a per-code salt (IPasswordService), whose encoded
+        // form is far longer than the 64-char hex SHA-256 this column originally held. Legacy rows
+        // keep their 64-char value and still verify.
+        builder.Property(e => e.CodeHash).HasMaxLength(256);
         builder.HasIndex(e => e.User);
         // The codes are owned by the user — deleting the user discards them.
         builder.HasOne<UserEntity>()
diff --git a/Proxytrace.Storage/Internal/Entities/ModelProvider/ModelProviderConfig.cs b/Proxytrace.Storage/Internal/Entities/ModelProvider/ModelProviderConfig.cs
index 32e0ed28b..e18bcdc32 100644
--- a/Proxytrace.Storage/Internal/Entities/ModelProvider/ModelProviderConfig.cs
+++ b/Proxytrace.Storage/Internal/Entities/ModelProvider/ModelProviderConfig.cs
@@ -15,18 +15,22 @@ internal class ModelProviderConfig : AbstractEntityConfiguration<ModelProviderEn
     // ring — the design-time migration tooling builds the model via Configure() and never calls
     // Map(), so it must not force IDataProtectionProvider resolution.
     private readonly Lazy<ISecretProtector> protector;
-    private readonly ISecretHasher hasher;
+
+    // ISecretIndexer, not ISecretHasher: the upstream key is operator-entered, so it may be a
+    // dictionary word (self-hosted backends conventionally use "EMPTY"/"ollama"/"sk-1234"). An
+    // unkeyed index over that falls to a wordlist and undoes the encryption on the column beside it.
+    private readonly ISecretIndexer indexer;
     private readonly ILogger<ModelProviderConfig> logger;
 
     public ModelProviderConfig(
         IModelProvider.CreateExisting factory,
         Lazy<ISecretProtector> protector,
-        ISecretHasher hasher,
+        ISecretIndexer indexer,
         ILogger<ModelProviderConfig> logger)
     {
         this.factory = factory;
         this.protector = protector;
-        this.hasher = hasher;
+        this.indexer = indexer;
         this.logger = logger;
     }
 
@@ -40,7 +44,9 @@ public override void Configure(EntityTypeBuilder<ModelProviderEntity> builder)
         builder.Property(e => e.Endpoint).HasMaxLength(2048).IsRequired();
         // Ciphertext is far larger than the plaintext key — drop the 512 cap.
         builder.Property(e => e.ApiKey).IsRequired();
-        builder.Property(e => e.ApiKeyLookupHash).HasMaxLength(64);
+        // Wide enough for the scheme-prefixed keyed index ("hmac1:" + 64 hex chars) as well as the
+        // bare 64-char legacy hash that predates it.
+        builder.Property(e => e.ApiKeyLookupHash).HasMaxLength(128);
         builder.Property(e => e.Kind).IsRequired();
         builder.HasIndex(e => e.IsArchived);
     }
@@ -55,7 +61,7 @@ public Task<ModelProviderEntity> Map(IModelProvider domain, CancellationToken ca
             Name = domain.Name,
             Endpoint = domain.Endpoint.ToString(),
             ApiKey = protector.Value.Protect(domain.ApiKey),
-            ApiKeyLookupHash = hasher.Hash(domain.ApiKey),
+            ApiKeyLookupHash = indexer.Index(domain.ApiKey),
             Kind = domain.Kind,
             IsArchived = domain.IsArchived,
             CreatedAt = domain.CreatedAt,
diff --git a/Proxytrace.Storage/Internal/Entities/ModelProvider/ModelProviderRepository.cs b/Proxytrace.Storage/Internal/Entities/ModelProvider/ModelProviderRepository.cs
index 9a46237dd..91ce2e9c3 100644
--- a/Proxytrace.Storage/Internal/Entities/ModelProvider/ModelProviderRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/ModelProvider/ModelProviderRepository.cs
@@ -11,7 +11,7 @@ namespace Proxytrace.Storage.Internal.Entities.ModelProvider;
 [UsedImplicitly]
 internal class ModelProviderRepository : ArchivableRepository<IModelProvider, ModelProviderEntity>, IModelProviderRepository
 {
-    private readonly ISecretHasher hasher;
+    private readonly ISecretIndexer indexer;
 
     public ModelProviderRepository(
         IMapper<IModelProvider, ModelProviderEntity> mapper,
@@ -20,9 +20,9 @@ public ModelProviderRepository(
         IEntityEventService entityEvents,
         IEntityCache<IModelProvider> cache,
         AmbientDbContext ambient,
-        ISecretHasher hasher) : base(mapper, contextFactory, transaction, entityEvents, ambient, cache)
+        ISecretIndexer indexer) : base(mapper, contextFactory, transaction, entityEvents, ambient, cache)
     {
-        this.hasher = hasher;
+        this.indexer = indexer;
     }
 
     // Archive-only: a hard delete would cascade through this provider's endpoints to every AgentCall
@@ -33,13 +33,20 @@ public ModelProviderRepository(
     public async Task<IModelProvider?> FindByApiKeyAsync(string apiKey, CancellationToken cancellationToken = default)
     {
         // The plaintext key is encrypted (non-deterministic) at rest, so match on its deterministic
-        // blind-index hash instead. Intentionally unfiltered so an archived provider that still
-        // receives matching traffic keeps resolving, mirroring agent/endpoint attribution.
-        var lookupHash = hasher.Hash(apiKey);
+        // blind-index instead. Intentionally unfiltered so an archived provider that still receives
+        // matching traffic keeps resolving, mirroring agent/endpoint attribution.
+        //
+        // Both schemes are matched in one indexed query: rows written since the index became keyed
+        // carry the "hmac1:" form, while rows predating it still carry the bare SHA-256 until the
+        // startup backfill upgrades them. Accepting only the keyed form would make every provider on
+        // an install that has not finished backfilling fail to authenticate upstream. The two values
+        // cannot collide — the keyed one is prefixed — so this cannot match the wrong provider.
+        var keyed = indexer.Index(apiKey);
+        var legacy = indexer.LegacyIndex(apiKey);
         var entity = await contextFactory()
             .Set<ModelProviderEntity>()
             .AsNoTracking()
-            .Where(e => e.ApiKeyLookupHash == lookupHash)
+            .Where(e => e.ApiKeyLookupHash == keyed || e.ApiKeyLookupHash == legacy)
             .FirstOrDefaultAsync(cancellationToken);
 
         return await Map(entity, cancellationToken);
diff --git a/Proxytrace.Storage/Internal/Entities/Project/ProjectRepository.cs b/Proxytrace.Storage/Internal/Entities/Project/ProjectRepository.cs
index e732d495d..a750fd21b 100644
--- a/Proxytrace.Storage/Internal/Entities/Project/ProjectRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/Project/ProjectRepository.cs
@@ -1,5 +1,6 @@
 using JetBrains.Annotations;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
 using Proxytrace.Common.Text;
 using Proxytrace.Domain;
 using Proxytrace.Domain.Events;
@@ -11,13 +12,17 @@ namespace Proxytrace.Storage.Internal.Entities.Project;
 [UsedImplicitly]
 internal class ProjectRepository : AbstractRepository<IProject, ProjectEntity>, IProjectRepository
 {
+    private readonly ILogger<ProjectRepository> logger;
+
     public ProjectRepository(
         IMapper<IProject, ProjectEntity> mapper,
         Func<StorageDbContext> contextFactory,
         ITransaction transaction,
         IEntityEventService entityEvents,
-        AmbientDbContext ambient) : base(mapper, contextFactory, transaction, entityEvents, ambient)
+        AmbientDbContext ambient,
+        ILogger<ProjectRepository> logger) : base(mapper, contextFactory, transaction, entityEvents, ambient)
     {
+        this.logger = logger;
     }
 
     public async Task<IProject?> FindByNameAsync(
@@ -46,8 +51,31 @@ public ProjectRepository(
         // Slugify the incoming value too: a request-path segment keeps its original casing
         // (e.g. "/Development/openai/v1"), so compare canonical slug to canonical slug.
         var normalizedSlug = slug.ToSlug();
-        var match = candidates.FirstOrDefault(p => p.Name.ToSlug() == normalizedSlug);
-        return match is null ? null : await this.GetAsync(match.Id, cancellationToken);
+
+        // Project *names* are the unique key, not slugs, and ToSlug is lossy — "My Project",
+        // "my-project" and "my_project" all collapse to the same slug. Two legitimately distinct
+        // projects can therefore collide here. Order by Id so the winner is stable instead of
+        // whatever the query happens to return first (which can flip between requests and silently
+        // re-attribute a proxied trace to a different project), and surface the ambiguity.
+        var matches = candidates
+            .Where(p => p.Name.ToSlug() == normalizedSlug)
+            .OrderBy(p => p.Id)
+            .ToArray();
+
+        if (matches.Length == 0)
+            return null;
+
+        if (matches.Length > 1)
+        {
+            logger.LogWarning(
+                "Project slug '{Slug}' is ambiguous — {Count} projects share it ({Names}). Resolving to the " +
+                "lowest id deterministically; rename one of them so proxied traces are attributed unambiguously.",
+                normalizedSlug,
+                matches.Length,
+                string.Join(", ", matches.Select(p => p.Name)));
+        }
+
+        return await this.GetAsync(matches[0].Id, cancellationToken);
     }
 
     public async Task<IReadOnlyList<IProject>> GetByMemberAsync(
diff --git a/Proxytrace.Storage/Internal/Entities/Session/SessionRepository.cs b/Proxytrace.Storage/Internal/Entities/Session/SessionRepository.cs
index c7f40be0d..c5cc4bbe5 100644
--- a/Proxytrace.Storage/Internal/Entities/Session/SessionRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/Session/SessionRepository.cs
@@ -3,6 +3,7 @@
 using Microsoft.Extensions.Logging;
 using Proxytrace.Domain;
 using Proxytrace.Domain.Events;
+using Proxytrace.Domain.Paging;
 using Proxytrace.Domain.Session;
 
 namespace Proxytrace.Storage.Internal.Entities.Session;
@@ -190,7 +191,7 @@ private static SessionEntity NewRow(
         var total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(e => e.LastActivityAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
diff --git a/Proxytrace.Storage/Internal/Entities/TestResult/TestResultRepository.cs b/Proxytrace.Storage/Internal/Entities/TestResult/TestResultRepository.cs
index a6cbfc983..e0fc32d5a 100644
--- a/Proxytrace.Storage/Internal/Entities/TestResult/TestResultRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/TestResult/TestResultRepository.cs
@@ -10,6 +10,19 @@ namespace Proxytrace.Storage.Internal.Entities.TestResult;
 [UsedImplicitly]
 internal class TestResultRepository : AbstractRepository<ITestResult, TestResultEntity>, ITestResultRepository
 {
+    // How many of this evaluator's rows to consider per requested result, so repeats of the same
+    // test case (a suite re-run, or an A/B sample count) do not starve the de-duplicated output.
+    private const int CandidateWindowPerResult = 20;
+    private const int MaxCandidateWindow = 2_000;
+
+    // The search path filters on text after mapping, so it needs a wider pool of distinct cases to
+    // filter down from than the plain "recent" listing does.
+    private const int SearchCandidateCases = 300;
+    private const int SearchCandidateWindow = MaxCandidateWindow;
+
+    private static int CandidateWindow(int count)
+        => Math.Min(MaxCandidateWindow, Math.Max(count, count * CandidateWindowPerResult));
+
     public TestResultRepository(
         IMapper<ITestResult, TestResultEntity> mapper,
         Func<StorageDbContext> contextFactory,
@@ -52,12 +65,15 @@ protected override async Task UpdateRelationsAsync(
     public async Task<ITestResult?> GetLatestByEvaluatorAsync(Guid evaluatorId, CancellationToken cancellationToken = default)
     {
         var context = contextFactory();
-        // Project only the columns the evaluator filter needs (skips the large ActualResponse
-        // payload) to find the matching row, then load that single full row for mapping.
-        var recent = await ScanWindowQuery(context, 200).ToListAsync(cancellationToken);
 
-        var matchId = recent
-            .FirstOrDefault(r => r.Evaluations.Any(e => e.EvaluatorId == evaluatorId))?.Id;
+        // Exact, and independent of how many results exist elsewhere: the EvaluationStat projection
+        // is filtered by evaluator in SQL over its (EvaluatorId, CreatedAt) index, so this reads the
+        // single newest row for this evaluator. The previous implementation scanned the 200 most
+        // recent results across the whole install and filtered afterwards, so an evaluator whose
+        // latest result had fallen outside that global window simply reported nothing.
+        var matchId = await EvaluatorStatsQuery(context, evaluatorId)
+            .Select(s => (Guid?)s.TestResultId)
+            .FirstOrDefaultAsync(cancellationToken);
         if (matchId is null) return null;
 
         var entity = await context
@@ -76,15 +92,8 @@ public async Task<IReadOnlyList<ITestResult>> GetRecentByEvaluatorAsync(
         if (count <= 0) return [];
 
         var context = contextFactory();
-        var recent = await ScanWindowQuery(context, 500).ToListAsync(cancellationToken);
-
-        var matchingIds = recent
-            .Where(r => r.Evaluations.Any(e =>
-                e.EvaluatorId == evaluatorId && (score is null || e.Score == score)))
-            .GroupBy(r => r.TestCase)
-            .Select(g => g.First().Id)
-            .Take(count)
-            .ToList();
+        var matchingIds = await DedupedRecentIdsAsync(
+            context, evaluatorId, score, count, CandidateWindow(count), cancellationToken);
 
         return await LoadFullInOrderAsync(context, matchingIds, cancellationToken);
     }
@@ -97,17 +106,12 @@ public async Task<IReadOnlyList<ITestResult>> SearchByEvaluatorAsync(
     {
         if (count <= 0) return [];
 
-        // Mirror GetRecentByEvaluatorAsync: scan a recent window and filter in memory so the
-        // in-memory test provider behaves identically to PostgreSQL (no relational-only operators).
+        // Mirrors GetRecentByEvaluatorAsync: the evaluator filter runs in SQL, then the text filter
+        // runs after mapping (Summary is computed by the domain entity, so it cannot be pushed down).
         var context = contextFactory();
-        var recent = await ScanWindowQuery(context, 1000).ToListAsync(cancellationToken);
-
-        var dedupedIds = recent
-            .Where(r => r.Evaluations.Any(e => e.EvaluatorId == evaluatorId))
-            .GroupBy(r => r.TestCase)
-            .Select(g => g.First().Id)
-            .Take(300)
-            .ToList();
+        var dedupedIds = await DedupedRecentIdsAsync(
+            context, evaluatorId, score: null, take: SearchCandidateCases,
+            candidateWindow: SearchCandidateWindow, cancellationToken);
         if (dedupedIds.Count == 0) return [];
 
         // Load the deduped candidates' full rows once, then map+filter until count is reached.
@@ -133,15 +137,98 @@ public async Task<IReadOnlyList<ITestResult>> SearchByEvaluatorAsync(
         return matches;
     }
 
-    // Most-recent-N projection used by the evaluator-history scans. Reads only the columns the
-    // evaluator/score filter needs — notably never the large ActualResponse payload column.
-    private static IQueryable<EvaluatorScanRow> ScanWindowQuery(StorageDbContext context, int window)
-        => context
+    /// <summary>
+    /// Newest-first <see cref="EvaluationStatEntity"/> rows for one evaluator.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// This is the fix for the evaluator-history queries. They used to take the most recent N test
+    /// results <b>across the whole installation</b> and filter by evaluator in memory afterwards, so
+    /// once more than N results existed anywhere, an evaluator whose results fell outside that
+    /// global window silently returned nothing — and it was cross-tenant: a busy project's runs
+    /// evicted everyone else's. The filter now runs in SQL, over the
+    /// <c>(EvaluatorId, CreatedAt)</c> index on the projection table, so what a caller sees depends
+    /// only on their own evaluator's history.
+    /// </para>
+    /// <para>
+    /// <see cref="EvaluationStatEntity"/> exists precisely for this: it is the queryable projection
+    /// of the evaluations that are otherwise only reachable inside a JSON column, and
+    /// <c>EvaluationStatBackfillService</c> populates it for results written before it existed.
+    /// </para>
+    /// </remarks>
+    private static IQueryable<EvaluationStatEntity> EvaluatorStatsQuery(
+        StorageDbContext context,
+        Guid evaluatorId,
+        EvaluationScore? score = null)
+    {
+        var query = context
+            .Set<EvaluationStatEntity>()
+            .AsNoTracking()
+            .Where(s => s.EvaluatorId == evaluatorId);
+
+        if (score is not null)
+        {
+            query = query.Where(s => s.Score == score);
+        }
+
+        // Id as the tiebreak so results sharing a CreatedAt (a run's cases are written together, and
+        // the timestamp truncates to microseconds) keep a stable total order rather than an
+        // arbitrary one that could drop or duplicate a row at the window boundary.
+        return query
+            .OrderByDescending(s => s.CreatedAt)
+            .ThenByDescending(s => s.Id);
+    }
+
+    /// <summary>
+    /// Ids of the most recent test results for one evaluator, at most one per test case, newest
+    /// first.
+    /// </summary>
+    /// <remarks>
+    /// De-duplication by test case still happens in memory, because the column it keys on lives on
+    /// the parent result rather than the projection row. It is bounded by
+    /// <paramref name="candidateWindow"/> — a window over <b>this evaluator's</b> rows, not over the
+    /// whole table, so it cannot be exhausted by unrelated activity. A window smaller than the
+    /// number of repeats of a single case is the only way to under-fill the result, which is why it
+    /// scales with what the caller asked for.
+    /// </remarks>
+    private static async Task<IReadOnlyList<Guid>> DedupedRecentIdsAsync(
+        StorageDbContext context,
+        Guid evaluatorId,
+        EvaluationScore? score,
+        int take,
+        int candidateWindow,
+        CancellationToken cancellationToken)
+    {
+        var candidateIds = await EvaluatorStatsQuery(context, evaluatorId, score)
+            .Select(s => s.TestResultId)
+            .Take(candidateWindow)
+            .ToListAsync(cancellationToken);
+        if (candidateIds.Count == 0) return [];
+
+        // Reads only the two columns the de-duplication needs — never the large ActualResponse
+        // payload, which the caller loads afterwards for the rows it actually keeps.
+        var candidates = await context
             .Set<TestResultEntity>()
             .AsNoTracking()
-            .OrderByDescending(r => r.CreatedAt)
-            .Take(window)
-            .Select(r => new EvaluatorScanRow(r.Id, r.TestCase, r.Evaluations));
+            .Where(r => candidateIds.Contains(r.Id))
+            .Select(r => new { r.Id, r.TestCase, r.CreatedAt })
+            .ToListAsync(cancellationToken);
+
+        var byId = candidates.ToDictionary(c => c.Id);
+        var seenCases = new HashSet<Guid>();
+        var result = new List<Guid>(Math.Min(take, candidateIds.Count));
+
+        // Walk in the candidate order, which is the SQL ordering — newest first.
+        foreach (var id in candidateIds)
+        {
+            if (!byId.TryGetValue(id, out var candidate)) continue;
+            if (!seenCases.Add(candidate.TestCase)) continue;
+            result.Add(candidate.Id);
+            if (result.Count >= take) break;
+        }
+
+        return result;
+    }
 
     // Loads the full rows for the given ids and maps them, preserving the order of <paramref name="ids"/>.
     private async Task<IReadOnlyList<ITestResult>> LoadFullInOrderAsync(
@@ -168,12 +255,6 @@ private async Task<IReadOnlyList<ITestResult>> LoadFullInOrderAsync(
         return mapped;
     }
 
-    // Lightweight projection for the evaluator-history window scans (excludes ActualResponse).
-    private sealed record EvaluatorScanRow(
-        Guid Id,
-        Guid TestCase,
-        IReadOnlyCollection<StoredEvaluation> Evaluations);
-
     private static bool MatchesQuery(ITestResult result, Guid evaluatorId, string query)
     {
         if (result.TestCase.GetSummary().Contains(query, StringComparison.OrdinalIgnoreCase))
diff --git a/Proxytrace.Storage/Internal/Entities/TestRun/TestRunRepository.cs b/Proxytrace.Storage/Internal/Entities/TestRun/TestRunRepository.cs
index c8744b099..fe268aa07 100644
--- a/Proxytrace.Storage/Internal/Entities/TestRun/TestRunRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/TestRun/TestRunRepository.cs
@@ -68,7 +68,7 @@ public async Task<PagedResult<ITestRun>> GetByAgentPagedAsync(
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(r => r.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
@@ -96,7 +96,7 @@ public async Task<PagedResult<ITestRun>> GetAllPagedAsync(
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(r => r.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
diff --git a/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupConfig.cs b/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupConfig.cs
index c4ad8d355..cd106b680 100644
--- a/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupConfig.cs
+++ b/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupConfig.cs
@@ -40,6 +40,11 @@ public override void Configure(EntityTypeBuilder<TestRunGroupEntity> builder)
         builder
             .Property(e => e.SampleCount)
             .HasDefaultValue(1);
+
+        // Serves the optimizer's restart recovery, which asks for terminal, non-system groups that
+        // have not been considered yet. Leading on the marker keeps that an index range read over
+        // the small unconsidered tail rather than a scan of every group ever run.
+        builder.HasIndex(e => new { e.OptimizationConsideredAt, e.IsSystemRun, e.Status });
     }
 
     public async Task<ITestRunGroup> Map(TestRunGroupEntity stored, CancellationToken cancellationToken = default)
@@ -50,6 +55,7 @@ public async Task<ITestRunGroup> Map(TestRunGroupEntity stored, CancellationToke
             isSystemRun: stored.IsSystemRun,
             scheduleId: stored.ScheduleId,
             sampleCount: stored.SampleCount,
+            optimizationConsideredAt: stored.OptimizationConsideredAt,
             existing: stored);
 
     public Task<TestRunGroupEntity> Map(ITestRunGroup domain, CancellationToken cancellationToken = default)
@@ -62,6 +68,7 @@ public Task<TestRunGroupEntity> Map(ITestRunGroup domain, CancellationToken canc
             IsSystemRun = domain.IsSystemRun,
             ScheduleId = domain.ScheduleId,
             SampleCount = domain.SampleCount,
+            OptimizationConsideredAt = domain.OptimizationConsideredAt,
             CreatedAt = domain.CreatedAt,
             UpdatedAt = domain.UpdatedAt,
         }.ToTaskResult();
diff --git a/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupEntity.cs b/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupEntity.cs
index 746c2253f..12b29be14 100644
--- a/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupEntity.cs
+++ b/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupEntity.cs
@@ -12,4 +12,10 @@ internal record TestRunGroupEntity : Entity
     public bool IsSystemRun { get; init; }
     public Guid? ScheduleId { get; init; }
     public int SampleCount { get; init; } = 1;
+
+    /// <summary>
+    /// <see cref="ITestRunGroup.OptimizationConsideredAt"/>. Null means the optimizer has not looked
+    /// at this group yet — the durable marker its otherwise in-memory queue recovers from.
+    /// </summary>
+    public DateTimeOffset? OptimizationConsideredAt { get; init; }
 }
diff --git a/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupRepository.cs b/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupRepository.cs
index 7fc8802c4..1681dca6c 100644
--- a/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/TestRunGroup/TestRunGroupRepository.cs
@@ -56,6 +56,32 @@ public async Task<IReadOnlyList<ITestRunGroup>> GetByStatusesAsync(
         return await Map(stored, cancellationToken);
     }
 
+    public async Task<IReadOnlyList<ITestRunGroup>> GetPendingOptimizationAsync(
+        int limit,
+        CancellationToken cancellationToken = default)
+    {
+        if (limit <= 0)
+            return [];
+
+        // Terminal statuses only — a group still running has not finished producing the evidence the
+        // optimizer reads, and will be enqueued normally when it does. Oldest first so a backlog is
+        // worked in the order it accumulated. Bounded, so a long-dormant install does not enqueue its
+        // entire history (and its entire LLM cost) in one go on the first start after upgrading.
+        var context = contextFactory();
+        var stored = await context
+            .Set<TestRunGroupEntity>()
+            .AsNoTracking()
+            .Where(g => g.OptimizationConsideredAt == null
+                        && !g.IsSystemRun
+                        && (g.Status == TestRunStatus.Completed || g.Status == TestRunStatus.Failed))
+            .OrderBy(g => g.CreatedAt)
+            .ThenBy(g => g.Id)
+            .Take(limit)
+            .ToListAsync(cancellationToken);
+
+        return await Map(stored, cancellationToken);
+    }
+
     public async Task<IReadOnlyList<ITestRunGroup>> GetByProjectAsync(Guid projectId, CancellationToken cancellationToken = default)
     {
         var context = contextFactory();
@@ -99,18 +125,26 @@ public async Task<PagedResult<ITestRunGroup>> GetByAgentPagedAsync(
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(g => g.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
         return new PagedResult<ITestRunGroup>(await Map(stored, cancellationToken), total, page, pageSize);
     }
 
-    public async Task<PagedResult<ITestRunGroup>> GetByProjectPagedAsync(
+    public Task<PagedResult<ITestRunGroup>> GetByProjectPagedAsync(
         Guid projectId,
         int page,
         int pageSize,
         bool includeSystem = false,
+        CancellationToken cancellationToken = default) =>
+        GetByProjectsPagedAsync([projectId], page, pageSize, includeSystem, cancellationToken);
+
+    public async Task<PagedResult<ITestRunGroup>> GetByProjectsPagedAsync(
+        IReadOnlyCollection<Guid> projectIds,
+        int page,
+        int pageSize,
+        bool includeSystem = false,
         CancellationToken cancellationToken = default)
     {
         (page, pageSize) = Paging.Clamp(page, pageSize);
@@ -126,13 +160,13 @@ public async Task<PagedResult<ITestRunGroup>> GetByProjectPagedAsync(
                 gs => gs.Suite.Agent,
                 a => a.Id,
                 (gs, a) => new { gs.Group, Agent = a })
-            .Where(x => x.Agent.Project == projectId && (includeSystem || !x.Group.IsSystemRun))
+            .Where(x => projectIds.Contains(x.Agent.Project) && (includeSystem || !x.Group.IsSystemRun))
             .Select(x => x.Group);
 
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(g => g.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
@@ -157,7 +191,7 @@ public async Task<PagedResult<ITestRunGroup>> GetBySuitePagedAsync(
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(g => g.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
diff --git a/Proxytrace.Storage/Internal/Entities/TestSuite/TestSuiteRepository.cs b/Proxytrace.Storage/Internal/Entities/TestSuite/TestSuiteRepository.cs
index 6b7c6aef7..6aae25edf 100644
--- a/Proxytrace.Storage/Internal/Entities/TestSuite/TestSuiteRepository.cs
+++ b/Proxytrace.Storage/Internal/Entities/TestSuite/TestSuiteRepository.cs
@@ -64,17 +64,24 @@ public async Task<PagedResult<ITestSuite>> GetByAgentPagedAsync(
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(e => e.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
         return new PagedResult<ITestSuite>(await Map(stored, cancellationToken), total, page, pageSize);
     }
 
-    public async Task<PagedResult<ITestSuite>> GetByProjectPagedAsync(
+    public Task<PagedResult<ITestSuite>> GetByProjectPagedAsync(
         Guid projectId,
         int page,
         int pageSize,
+        CancellationToken cancellationToken = default) =>
+        GetByProjectsPagedAsync([projectId], page, pageSize, cancellationToken);
+
+    public async Task<PagedResult<ITestSuite>> GetByProjectsPagedAsync(
+        IReadOnlyCollection<Guid> projectIds,
+        int page,
+        int pageSize,
         CancellationToken cancellationToken = default)
     {
         (page, pageSize) = Paging.Clamp(page, pageSize);
@@ -86,13 +93,13 @@ public async Task<PagedResult<ITestSuite>> GetByProjectPagedAsync(
                 s => s.Agent,
                 a => a.Id,
                 (s, a) => new { Suite = s, Agent = a })
-            .Where(x => x.Agent.Project == projectId)
+            .Where(x => projectIds.Contains(x.Agent.Project))
             .Select(x => x.Suite);
 
         int total = await query.CountAsync(cancellationToken);
         var stored = await query
             .OrderByDescending(s => s.CreatedAt)
-            .Skip((page - 1) * pageSize)
+            .Skip(Paging.Offset(page, pageSize))
             .Take(pageSize)
             .ToListAsync(cancellationToken);
 
diff --git a/Proxytrace.Storage/Internal/EntityCache.cs b/Proxytrace.Storage/Internal/EntityCache.cs
index d7229963d..54ab511f9 100644
--- a/Proxytrace.Storage/Internal/EntityCache.cs
+++ b/Proxytrace.Storage/Internal/EntityCache.cs
@@ -15,13 +15,23 @@ internal sealed class EntityCache<TDomainEntity> : IEntityCache<TDomainEntity>
 
     private readonly TimeSpan ttl;
     private readonly TimeProvider clock;
+
+    // Shared across every lifetime scope, so a write in one scope invalidates the copies held by
+    // all the others — including the root-scope cache the singleton ingestion path reads through.
+    // See EntityCacheVersions for why the entries themselves must stay scope-local.
+    private readonly EntityCacheVersions<TDomainEntity> versions;
+
     private readonly ConcurrentDictionary<Guid, Entry> entries = new();
     private Snapshot? allSnapshot;
 
     // Single ctor so Autofac never has to choose. Defaults to the system clock and the
     // module-default TTL; tests construct directly with a fake TimeProvider/short TTL.
-    public EntityCache(TimeProvider? clock = null, TimeSpan? ttl = null)
+    public EntityCache(
+        EntityCacheVersions<TDomainEntity> versions,
+        TimeProvider? clock = null,
+        TimeSpan? ttl = null)
     {
+        this.versions = versions;
         this.clock = clock ?? TimeProvider.System;
         this.ttl = ttl ?? defaultTtl;
     }
@@ -33,7 +43,9 @@ public EntityCache(TimeProvider? clock = null, TimeSpan? ttl = null)
             return default;
         }
 
-        if (IsExpired(entry.CachedAt))
+        // A write in any scope bumps the shared version, so a version mismatch means this copy is
+        // stale even though our own scope never saw the invalidation.
+        if (IsExpired(entry.CachedAt) || entry.Version != versions.VersionOf(id))
         {
             entries.TryRemove(id, out _);
             return default;
@@ -43,10 +55,11 @@ public EntityCache(TimeProvider? clock = null, TimeSpan? ttl = null)
     }
 
     public void Set(TDomainEntity entity)
-        => entries[entity.Id] = new Entry(entity, clock.GetUtcNow());
+        => entries[entity.Id] = new Entry(entity, clock.GetUtcNow(), versions.VersionOf(entity.Id));
 
     public void Invalidate(Guid id)
     {
+        versions.Invalidate(id);
         entries.TryRemove(id, out _);
         Volatile.Write(ref allSnapshot, null);
     }
@@ -59,7 +72,7 @@ public void Invalidate(Guid id)
             return null;
         }
 
-        if (IsExpired(snap.CachedAt))
+        if (IsExpired(snap.CachedAt) || snap.AllVersion != versions.AllVersion)
         {
             Volatile.Write(ref allSnapshot, null);
             return null;
@@ -71,19 +84,23 @@ public void Invalidate(Guid id)
     public void SetAll(IReadOnlyList<TDomainEntity> entities)
     {
         DateTimeOffset now = clock.GetUtcNow();
+        long allVersion = versions.AllVersion;
         foreach (TDomainEntity entity in entities)
         {
-            entries[entity.Id] = new Entry(entity, now);
+            entries[entity.Id] = new Entry(entity, now, versions.VersionOf(entity.Id));
         }
-        Volatile.Write(ref allSnapshot, new Snapshot(entities, now));
+        Volatile.Write(ref allSnapshot, new Snapshot(entities, now, allVersion));
     }
 
-    public void InvalidateAll() 
-        => Volatile.Write(ref allSnapshot, null);
+    public void InvalidateAll()
+    {
+        versions.InvalidateAll();
+        Volatile.Write(ref allSnapshot, null);
+    }
 
     private bool IsExpired(DateTimeOffset cachedAt)
         => clock.GetUtcNow() - cachedAt > ttl;
 
-    private sealed record Entry(TDomainEntity Entity, DateTimeOffset CachedAt);
-    private sealed record Snapshot(IReadOnlyList<TDomainEntity> Entities, DateTimeOffset CachedAt);
+    private sealed record Entry(TDomainEntity Entity, DateTimeOffset CachedAt, long Version);
+    private sealed record Snapshot(IReadOnlyList<TDomainEntity> Entities, DateTimeOffset CachedAt, long AllVersion);
 }
diff --git a/Proxytrace.Storage/Internal/EntityCacheVersions.cs b/Proxytrace.Storage/Internal/EntityCacheVersions.cs
new file mode 100644
index 000000000..d7c68c5ec
--- /dev/null
+++ b/Proxytrace.Storage/Internal/EntityCacheVersions.cs
@@ -0,0 +1,73 @@
+using System.Collections.Concurrent;
+using JetBrains.Annotations;
+using Proxytrace.Domain;
+
+namespace Proxytrace.Storage.Internal;
+
+/// <summary>
+/// Process-wide invalidation registry for <see cref="IEntityCache{TDomainEntity}"/>, one per domain
+/// entity type. Registered as a <b>singleton</b> — unlike the caches themselves, which are
+/// per-lifetime-scope.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The cache cannot be a singleton: every domain entity holds the <see cref="IRepository{T}"/> it
+/// was materialized from, and that repository's <c>Func&lt;StorageDbContext&gt;</c> closes over the
+/// lifetime scope it was resolved in. Caching an entity in the root container would therefore hand
+/// later callers an entity whose repository points at a <b>disposed</b> request scope, so
+/// <c>UpdateAsync</c>/<c>ReloadAsync</c> on it would throw. That is why the cache registration is
+/// <c>InstancePerLifetimeScope</c> (fc4b5f72).
+/// </para>
+/// <para>
+/// But scope-local caches also made write-through invalidation scope-local, which is the actual
+/// defect: the singleton <c>IngestionExecutor</c> resolves its repositories — and therefore its
+/// cache — from the <b>root</b> scope, while an admin's write invalidates only its own
+/// <b>request</b> scope. Rotating a provider's upstream API key in the admin UI left ingestion
+/// authenticating against the stale key until the 5-minute TTL expired.
+/// </para>
+/// <para>
+/// This registry closes that gap without reintroducing the lifetime bug: cached <i>instances</i>
+/// stay scope-local, while the <i>validity</i> of every entry is decided by a counter shared across
+/// all scopes. A write bumps the counter; every scope's copy of that entry is stale on its next read.
+/// </para>
+/// </remarks>
+[UsedImplicitly]
+internal sealed class EntityCacheVersions<TDomainEntity>
+    where TDomainEntity : IDomainEntity
+{
+    // Bound on the per-id version map. These are slow-changing reference entities (models,
+    // providers, endpoints, projects, agents, evaluators, API keys, users), so the map stays small
+    // in practice; the cap only guards against unbounded growth over a long-lived process. Dropping
+    // a version is always safe — a missing version reads back as 0, which no live entry can match,
+    // so an eviction can only cause an extra cache miss, never a stale hit.
+    private const int MaxTrackedIds = 10_000;
+
+    private readonly ConcurrentDictionary<Guid, long> idVersions = new();
+    private long allVersion;
+
+    /// <summary>Current version of the "all entities" snapshot. Any invalidation bumps it.</summary>
+    public long AllVersion => Interlocked.Read(ref allVersion);
+
+    /// <summary>Current version of <paramref name="id"/>; 0 when it has never been invalidated.</summary>
+    public long VersionOf(Guid id) => idVersions.TryGetValue(id, out long version) ? version : 0;
+
+    /// <summary>
+    /// Marks <paramref name="id"/> stale in every lifetime scope. Also bumps <see cref="AllVersion"/>,
+    /// because a single-entity write invalidates any snapshot that contained it.
+    /// </summary>
+    public void Invalidate(Guid id)
+    {
+        if (idVersions.Count >= MaxTrackedIds && !idVersions.ContainsKey(id))
+        {
+            // Over the cap: drop the whole map rather than growing it. Every tracked entry falls back
+            // to version 0 and so misses, which the AllVersion bump below already implies anyway.
+            idVersions.Clear();
+        }
+
+        idVersions.AddOrUpdate(id, 1, static (_, version) => version + 1);
+        Interlocked.Increment(ref allVersion);
+    }
+
+    /// <summary>Marks the "all entities" snapshot stale in every lifetime scope.</summary>
+    public void InvalidateAll() => Interlocked.Increment(ref allVersion);
+}
diff --git a/Proxytrace.Storage/Internal/IEntityCache.cs b/Proxytrace.Storage/Internal/IEntityCache.cs
index 4b7345197..103ddf60b 100644
--- a/Proxytrace.Storage/Internal/IEntityCache.cs
+++ b/Proxytrace.Storage/Internal/IEntityCache.cs
@@ -3,8 +3,14 @@
 namespace Proxytrace.Storage.Internal;
 
 /// <summary>
-/// In-memory cache for a single domain entity type. Registered as a singleton in DI for
-/// storage entities marked with <see cref="CacheableAttribute"/>.
+/// In-memory cache for a single domain entity type. Registered <b>per lifetime scope</b> in DI for
+/// storage entities marked with <see cref="CacheableAttribute"/> — a cached domain entity holds the
+/// repository it was materialized from, and that repository closes over its resolving scope, so a
+/// singleton cache would serve entities bound to a disposed scope.
+///
+/// Invalidation is nevertheless process-wide: validity is decided by the shared singleton
+/// <see cref="EntityCacheVersions{TDomainEntity}"/>, so a write in a request scope also invalidates
+/// the root-scope copy that singleton services (e.g. the ingestion executor) read through.
 ///
 /// Callers (in practice <see cref="AbstractRepository{TDomainEntity,TStoredEntity}"/>) are
 /// responsible for transaction safety: do not read from or populate the cache while an
diff --git a/Proxytrace.Storage/Internal/LikePattern.cs b/Proxytrace.Storage/Internal/LikePattern.cs
new file mode 100644
index 000000000..3de057de9
--- /dev/null
+++ b/Proxytrace.Storage/Internal/LikePattern.cs
@@ -0,0 +1,50 @@
+namespace Proxytrace.Storage.Internal;
+
+/// <summary>
+/// Builds the right-hand side of an <c>EF.Functions.Like</c> infix search.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Two things go wrong with a hand-rolled <c>$"%{search}%"</c>:
+/// </para>
+/// <list type="number">
+/// <item><b>Case.</b> SQL <c>LIKE</c> is case-sensitive on PostgreSQL but the EF in-memory provider
+/// matches case-insensitively — so a test passes while production silently misses matches. Callers
+/// must lower <b>both</b> sides: pass the column through <c>.ToLower()</c> and the search term
+/// through <see cref="Contains"/>, which lowers it here.</item>
+/// <item><b>Wildcards.</b> <c>%</c> and <c>_</c> typed by the user are operators, not literals, so
+/// searching for <c>100%</c> or <c>a_b</c> matches far more than the user asked for. They are
+/// escaped here under <see cref="EscapeCharacter"/>, which the caller must pass to the matching
+/// <c>EF.Functions.Like</c> overload.</item>
+/// </list>
+/// <para>
+/// Usage — the column is lowered in the query, the term is lowered and escaped here:
+/// <code>
+/// var pattern = LikePattern.Contains(search);
+/// query = query.Where(e => EF.Functions.Like(e.Name.ToLower(), pattern, LikePattern.EscapeCharacter));
+/// </code>
+/// </para>
+/// </remarks>
+internal static class LikePattern
+{
+    /// <summary>
+    /// Escape character for the generated patterns. Pass to the three-argument
+    /// <c>EF.Functions.Like(matchExpression, pattern, escapeCharacter)</c> overload.
+    /// </summary>
+    public const string EscapeCharacter = "\\";
+
+    /// <summary>
+    /// Builds a case-insensitive "contains" pattern for <paramref name="search"/>: trims it, lowers
+    /// it, and escapes the <c>LIKE</c> wildcards so user input is matched literally.
+    /// </summary>
+    public static string Contains(string search)
+        => $"%{Escape(search.Trim().ToLowerInvariant())}%";
+
+    // The escape character itself must be escaped first, otherwise escaping a wildcard would
+    // re-escape the backslash this method just introduced.
+    private static string Escape(string value)
+        => value
+            .Replace(EscapeCharacter, EscapeCharacter + EscapeCharacter, StringComparison.Ordinal)
+            .Replace("%", EscapeCharacter + "%", StringComparison.Ordinal)
+            .Replace("_", EscapeCharacter + "_", StringComparison.Ordinal);
+}
diff --git a/Proxytrace.Storage/Internal/SecretsBackfillService.cs b/Proxytrace.Storage/Internal/SecretsBackfillService.cs
index bc6047955..11e06c1ee 100644
--- a/Proxytrace.Storage/Internal/SecretsBackfillService.cs
+++ b/Proxytrace.Storage/Internal/SecretsBackfillService.cs
@@ -1,3 +1,4 @@
+using System.Security.Cryptography;
 using System.Text.Json;
 using Autofac.Features.OwnedInstances;
 using Microsoft.EntityFrameworkCore;
@@ -18,17 +19,27 @@ namespace Proxytrace.Storage.Internal;
 /// per-row marker so a partial run resumes and a re-run is a no-op:
 /// <list type="bullet">
 /// <item><description><c>ModelProvider</c>: <c>ApiKeyLookupHash IS NULL</c> ⇒ <c>ApiKey</c> still plaintext.</description></item>
-/// <item><description><c>ApiKey</c>: <c>KeyPrefix IS NULL</c> ⇒ <c>KeyHash</c> still holds the plaintext key.</description></item>
+/// <item><description><c>ApiKey</c>: <c>KeyHash</c> length ≠ 64 ⇒ it still holds the plaintext key.</description></item>
 /// <item><description><c>Invite</c>: a 64-char hash vs the 43-char base64url token ⇒ length 64 means done.</description></item>
 /// </list>
 /// It reads the still-plaintext value and writes the protected value directly (bypassing the
 /// encrypt/hash-aware mappers). It never fails host boot: each table is isolated, and the provider
 /// pass is skipped (logged) if encryption is unavailable, while the key-ring-independent hash passes
 /// still run.
+///
+/// The two hash markers deliberately read the <em>protected column itself</em> rather than a
+/// companion column: a hex SHA-256 is always 64 characters, while the pre-retrofit plaintexts are
+/// not (an inbound key is <c>"proxytrace-"</c> + 43 base64url chars, an invite token 43). A marker
+/// held in a separate column is only as durable as that column's mapper — <c>ApiKey.KeyPrefix</c>
+/// was such a marker until its <c>NULL</c> turned out to be collapsed to <c>""</c> by
+/// <c>ApiKeyConfig</c> (<c>stored.KeyPrefix ?? string.Empty</c>) on every round trip, so a single
+/// save of an un-backfilled row would have hidden it from the pass forever, stranding a plaintext
+/// key that can never authenticate again.
 /// </summary>
 internal sealed class SecretsBackfillService : IHostedService
 {
-    private const int InviteTokenHashLength = 64;
+    // Length of a hex-encoded SHA-256 — the shape of an already-protected verify-only column.
+    private const int HexHashLength = 64;
     private const int DisplayPrefixLength = 16;
 
     // An Owned<StorageDbContext> factory (not the ambient-aware Func<StorageDbContext>): this service is a
@@ -38,17 +49,20 @@ internal sealed class SecretsBackfillService : IHostedService
     // inside a logical transaction, so it never needs the shared ambient context.
     private readonly Func<Owned<StorageDbContext>> contextFactory;
     private readonly ISecretProtector protector;
+    private readonly ISecretIndexer indexer;
     private readonly ILogger<SecretsBackfillService> logger;
     private readonly ILogger<Audit> audit;
 
     public SecretsBackfillService(
         Func<Owned<StorageDbContext>> contextFactory,
         ISecretProtector protector,
+        ISecretIndexer indexer,
         ILogger<SecretsBackfillService> logger,
         ILogger<Audit> audit)
     {
         this.contextFactory = contextFactory;
         this.protector = protector;
+        this.indexer = indexer;
         this.logger = logger;
         this.audit = audit;
     }
@@ -67,14 +81,17 @@ public async Task StartAsync(CancellationToken cancellationToken)
             "existing API keys cannot authenticate at the proxy or MCP server until this completes", cancellationToken);
         var inviteTokens = await RunSafely(BackfillInvitesAsync, "invite token",
             "pending invites cannot be redeemed until this completes", cancellationToken);
+        var providerIndexes = await RunSafely(ReindexProviderKeysAsync, "provider key blind index",
+            "provider keys stay recoverable from a database dump by wordlist until this completes",
+            cancellationToken);
 
         // Audit the one-time at-rest protection only when it actually changed rows, so a re-run
         // (everything already protected) records nothing. No request context here ⇒ System actor.
-        if (providerKeys + inboundKeys + inviteTokens > 0)
+        if (providerKeys + inboundKeys + inviteTokens + providerIndexes > 0)
         {
             audit.LogAudit(
                 AuditAction.SecretsBackfilled, "Secrets",
-                details: JsonSerializer.Serialize(new { providerKeys, inboundKeys, inviteTokens }));
+                details: JsonSerializer.Serialize(new { providerKeys, inboundKeys, inviteTokens, providerIndexes }));
         }
     }
 
@@ -122,7 +139,7 @@ private async Task<int> BackfillProvidersAsync(CancellationToken cancellationTok
             db.Entry(row).CurrentValues.SetValues(row with
             {
                 ApiKey = protector.Protect(row.ApiKey),
-                ApiKeyLookupHash = Sha256.HexHash(row.ApiKey),
+                ApiKeyLookupHash = indexer.Index(row.ApiKey),
             });
         }
 
@@ -135,12 +152,83 @@ private async Task<int> BackfillProvidersAsync(CancellationToken cancellationTok
         return rows.Count;
     }
 
+    /// <summary>
+    /// Upgrades provider rows still carrying the pre-keying, unkeyed blind index to the keyed one.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The original index was a plain SHA-256, justified on the grounds that the secrets it covers
+    /// are 256-bit CSPRNG values. That holds for the secrets Proxytrace generates, but not for this
+    /// one: the upstream provider key is typed in by an operator, and self-hosted OpenAI-compatible
+    /// backends conventionally use <c>EMPTY</c>, <c>ollama</c> or <c>sk-1234</c>. A database dump
+    /// then recovers the key by wordlist, undoing the encryption on the column beside it.
+    /// </para>
+    /// <para>
+    /// Re-indexing needs the plaintext, which means decrypting the stored ciphertext — so the pass is
+    /// skipped when the key ring cannot decrypt, exactly like the encryption pass above. It is also
+    /// skipped when no persisted blind-index key exists, because indexing under a per-process key
+    /// would make every provider fail to authenticate after the next restart.
+    /// </para>
+    /// </remarks>
+    private async Task<int> ReindexProviderKeysAsync(CancellationToken cancellationToken)
+    {
+        if (!indexer.IsKeyed)
+        {
+            // Not an error: Development and the test harnesses run without a data directory, and the
+            // indexer already logged a warning naming the variable to set.
+            return 0;
+        }
+
+        await using var owned = contextFactory();
+        var db = owned.Value;
+
+        // A row is upgraded when its index is present but not yet scheme-prefixed. Reading the
+        // stored column itself, rather than a companion marker column, follows the same reasoning as
+        // the two hash markers above: a separate marker is only as durable as its mapper.
+        var rows = await db.Set<ModelProviderEntity>()
+            .Where(e => e.ApiKeyLookupHash != null && !e.ApiKeyLookupHash.StartsWith(SecretIndexScheme.KeyedPrefix))
+            .ToListAsync(cancellationToken);
+
+        var upgraded = 0;
+        foreach (var row in rows)
+        {
+            string plaintext;
+            try
+            {
+                plaintext = protector.Unprotect(row.ApiKey);
+            }
+            catch (CryptographicException ex)
+            {
+                // An undecryptable row is already broken for upstream auth (see
+                // ModelProviderConfig.Decrypt); re-indexing it to the HMAC of an empty string would
+                // additionally make the legacy fallback stop matching. Leave it exactly as it is.
+                logger.LogWarning(ex,
+                    "Could not decrypt provider {ProviderId} while re-indexing its API key; leaving its "
+                    + "existing blind index in place.", row.Id);
+                continue;
+            }
+
+            db.Entry(row).CurrentValues.SetValues(row with { ApiKeyLookupHash = indexer.Index(plaintext) });
+            upgraded++;
+        }
+
+        if (upgraded > 0)
+        {
+            await db.SaveChangesAsync(cancellationToken);
+            logger.LogInformation("Re-indexed {Count} provider API keys under the keyed blind index.", upgraded);
+        }
+
+        return upgraded;
+    }
+
     private async Task<int> BackfillApiKeysAsync(CancellationToken cancellationToken)
     {
         await using var owned = contextFactory();
         var db = owned.Value;
+        // Marker: the stored KeyHash is not yet a hex SHA-256, so it is still the plaintext key.
+        // KeyPrefix cannot serve as the marker — the mapper collapses its NULL to "" on any save.
         var rows = await db.Set<ApiKeyEntity>()
-            .Where(e => e.KeyPrefix == null)
+            .Where(e => e.KeyHash.Length != HexHashLength)
             .ToListAsync(cancellationToken);
         foreach (var row in rows)
         {
@@ -166,7 +254,7 @@ private async Task<int> BackfillInvitesAsync(CancellationToken cancellationToken
         await using var owned = contextFactory();
         var db = owned.Value;
         var rows = await db.Set<InviteEntity>()
-            .Where(e => e.TokenHash.Length != InviteTokenHashLength)
+            .Where(e => e.TokenHash.Length != HexHashLength)
             .ToListAsync(cancellationToken);
         foreach (var row in rows)
         {
diff --git a/Proxytrace.Storage/Internal/Statistics/AgentCallStatsQueries.cs b/Proxytrace.Storage/Internal/Statistics/AgentCallStatsQueries.cs
index 3a5adc234..6d9e310da 100644
--- a/Proxytrace.Storage/Internal/Statistics/AgentCallStatsQueries.cs
+++ b/Proxytrace.Storage/Internal/Statistics/AgentCallStatsQueries.cs
@@ -1,5 +1,6 @@
 using JetBrains.Annotations;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
 using Proxytrace.Domain.Statistics;
 using Proxytrace.Domain.AgentCall;
 using Proxytrace.Domain.ModelEndpoint;
@@ -15,15 +16,31 @@ namespace Proxytrace.Storage.Internal.Statistics;
 [UsedImplicitly]
 internal class AgentCallStatsQueries : IAgentCallStatsReader
 {
+    /// <summary>
+    /// Upper bound on the per-call rows <see cref="GetAgentDistributionsAsync"/> pulls into memory.
+    /// </summary>
+    /// <remarks>
+    /// The distributions are computed in C# (std-dev, and cost-per-conversation needs endpoint
+    /// pricing), so the rows have to be materialized. The window is caller-supplied and unbounded,
+    /// so without a cap a request spanning the whole history of a busy agent materializes every one
+    /// of its traces — a memory spike that grows with the trace table. The cap keeps that bounded;
+    /// distributions are statistical summaries, so the most recent N calls describe the shape of the
+    /// data. When the cap bites it is logged rather than silently applied.
+    /// </remarks>
+    private const int MaxDistributionSamples = 200_000;
+
     private readonly Func<StorageDbContext> contextFactory;
     private readonly IMapper<IModelEndpoint, ModelEndpointEntity> endpointMapper;
+    private readonly ILogger<AgentCallStatsQueries> logger;
 
     public AgentCallStatsQueries(
         Func<StorageDbContext> contextFactory,
-        IMapper<IModelEndpoint, ModelEndpointEntity> endpointMapper)
+        IMapper<IModelEndpoint, ModelEndpointEntity> endpointMapper,
+        ILogger<AgentCallStatsQueries> logger)
     {
         this.contextFactory = contextFactory;
         this.endpointMapper = endpointMapper;
+        this.logger = logger;
     }
 
     public async Task<StatisticsSummary> GetSummaryAsync(StatisticsFilter filter, CancellationToken cancellationToken = default)
@@ -701,15 +718,20 @@ public async Task<AgentCallDistributions> GetAgentDistributionsAsync(
             .Where(v => v.AgentId == agentId)
             .Select(v => v.Id);
 
-        // Single materialise-and-compute pass. Scoped to one agent over a bounded window, so pulling
-        // the minimal per-call projection into memory is cheap. Std-dev needs no ordered-set aggregate
-        // (unlike the latency percentiles above), and cost-per-conversation needs C# endpoint pricing,
-        // so every distribution is computed here rather than splitting relational/in-memory paths.
+        // Single materialise-and-compute pass. Std-dev needs no ordered-set aggregate (unlike the
+        // latency percentiles above), and cost-per-conversation needs C# endpoint pricing, so every
+        // distribution is computed here rather than splitting relational/in-memory paths.
+        //
+        // The window is caller-supplied and unbounded, so the row set is capped at
+        // MaxDistributionSamples most-recent calls: a request spanning a busy agent's whole history
+        // would otherwise materialize its entire trace history at once.
         var calls = await context.Set<AgentCallEntity>()
             .AsNoTracking()
             .Where(c => versionIdsForAgent.Contains(c.AgentVersionId)
                 && c.CreatedAt >= from && c.CreatedAt <= to
                 && c.HttpStatus >= 200 && c.HttpStatus < 300)
+            .OrderByDescending(c => c.CreatedAt)
+            .ThenByDescending(c => c.Id)
             .Select(c => new
             {
                 ConvKey = c.ConversationId ?? c.Id,
@@ -721,6 +743,7 @@ public async Task<AgentCallDistributions> GetAgentDistributionsAsync(
                 c.LatencyMs,
                 Tools = c.ResponseToolRequestCount,
             })
+            .Take(MaxDistributionSamples)
             .ToListAsync(cancellationToken);
 
         if (calls.Count == 0)
@@ -728,6 +751,15 @@ public async Task<AgentCallDistributions> GetAgentDistributionsAsync(
             return AgentCallDistributions.Empty;
         }
 
+        if (calls.Count == MaxDistributionSamples)
+        {
+            // Never truncate silently — the caller is looking at a sample, not the whole window.
+            logger.LogInformation(
+                "Distributions for agent {AgentId} over {From:o}–{To:o} hit the {Cap}-call sample cap; "
+                + "the returned distributions describe the most recent {Cap} calls in that window.",
+                agentId, from, to, MaxDistributionSamples, MaxDistributionSamples);
+        }
+
         // Per-call metrics.
         MetricDistribution inputTokens = Distribution(calls.Select(c => (double)(c.InputTokens ?? 0UL)).ToArray());
         MetricDistribution outputTokens = Distribution(calls.Select(c => (double)(c.OutputTokens ?? 0UL)).ToArray());
diff --git a/Proxytrace.Storage/Internal/Statistics/TestRunStatsStore.cs b/Proxytrace.Storage/Internal/Statistics/TestRunStatsStore.cs
index 106084c4e..14dd9eafd 100644
--- a/Proxytrace.Storage/Internal/Statistics/TestRunStatsStore.cs
+++ b/Proxytrace.Storage/Internal/Statistics/TestRunStatsStore.cs
@@ -185,7 +185,11 @@ private static IQueryable<TestRunStatsEntity> Query(StorageDbContext context, Te
         {
             q = q.Where(e => e.AgentId == filter.AgentId.Value);
         }
-        if (filter.AgentIds is { Count: > 0 } agentIds)
+        // `null` means "no agent filter"; an EMPTY collection means "no agent matches" and must
+        // narrow to nothing. Treating empty as unfiltered leaked global figures: a project with no
+        // agents yet (or all archived) produced an empty AgentIds list, and the dashboard's
+        // OverallPassRate and pass-rate sparkline were then computed over every other project's runs.
+        if (filter.AgentIds is { } agentIds)
         {
             q = q.Where(e => agentIds.Contains(e.AgentId));
         }
@@ -201,7 +205,8 @@ private static IQueryable<TestRunStatsEntity> Query(StorageDbContext context, Te
         {
             q = q.Where(e => e.SuiteId == filter.SuiteId.Value);
         }
-        if (filter.SuiteIds is { Count: > 0 } suiteIds)
+        // Same null-vs-empty distinction as AgentIds above.
+        if (filter.SuiteIds is { } suiteIds)
         {
             q = q.Where(e => suiteIds.Contains(e.SuiteId));
         }
diff --git a/Proxytrace.Storage/Migrations/20260727150217_WidenProviderApiKeyLookupHash.Designer.cs b/Proxytrace.Storage/Migrations/20260727150217_WidenProviderApiKeyLookupHash.Designer.cs
new file mode 100644
index 000000000..3f8f99927
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727150217_WidenProviderApiKeyLookupHash.Designer.cs
@@ -0,0 +1,2108 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using Proxytrace.Storage;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    [DbContext(typeof(StorageDbContext))]
+    [Migration("20260727150217_WidenProviderApiKeyLookupHash")]
+    partial class WidenProviderApiKeyLookupHash
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.10")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("CurrentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("IsSystemAgent")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("IsSystemAgent");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.HasIndex("Project", "Name");
+
+                    b.ToTable("AgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("CacheHitRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<decimal?>("CachedInputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<Guid?>("ConversationId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ErrorMessage")
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<string>("FinishReason")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<int>("HttpStatus")
+                        .HasColumnType("integer");
+
+                    b.Property<decimal?>("InputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<double?>("LatencyMs")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<byte>("OutlierFlags")
+                        .HasColumnType("smallint");
+
+                    b.Property<decimal?>("OutputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<string>("Request")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("RequestPreview")
+                        .HasMaxLength(1000)
+                        .HasColumnType("character varying(1000)");
+
+                    b.Property<string>("Response")
+                        .HasColumnType("text");
+
+                    b.Property<int>("ResponseToolRequestCount")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("SessionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("TotalTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CacheHitRate");
+
+                    b.HasIndex("ConversationId");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("LatencyMs");
+
+                    b.HasIndex("OutlierFlags")
+                        .HasFilter("\"OutlierFlags\" <> 0");
+
+                    b.HasIndex("ResponseToolRequestCount");
+
+                    b.HasIndex("TotalTokens");
+
+                    b.HasIndex("AgentVersionId", "CreatedAt");
+
+                    b.HasIndex("SessionId", "CreatedAt");
+
+                    b.ToTable("AgentCallEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ToolName")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("ProjectId", "ToolName");
+
+                    b.HasIndex("ToolName", "AgentCallId");
+
+                    b.HasIndex("ProjectId", "AgentId", "ToolName");
+
+                    b.ToTable("AgentCallToolEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Fingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("LooseFingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("SystemPrompt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Tools")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("VersionNumber")
+                        .HasColumnType("integer");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("AgentId", "VersionNumber")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "Fingerprint")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "LooseFingerprint");
+
+                    b.ToTable("AgentVersionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("KeyHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("KeyPrefix")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Owner")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Scopes")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("KeyHash")
+                        .IsUnique();
+
+                    b.HasIndex("Owner");
+
+                    b.HasIndex("Project");
+
+                    b.HasIndex("Provider");
+
+                    b.ToTable("ApiKeyEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApplicationError.ApplicationErrorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Category")
+                        .IsRequired()
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExceptionType")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<int>("Level")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)");
+
+                    b.Property<string>("StackTrace")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.ToTable("ApplicationErrorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AuditLog.AuditLogEntryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Action")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorApiKeyId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActorEmail")
+                        .HasMaxLength(320)
+                        .HasColumnType("character varying(320)");
+
+                    b.Property<int>("ActorType")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorUserId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Details")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Outcome")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("TargetLabel")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<string>("TargetType")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Action");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.ToTable("AuditLogEntryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("DetectorId", "AgentId");
+
+                    b.HasIndex("AgentId");
+
+                    b.ToTable("CustomAnomalyDetectorAgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AllAgents")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("BlockUpstream")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false);
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Triggers")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Project", "IsEnabled");
+
+                    b.ToTable("CustomAnomalyDetectorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("MatchedTrigger")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Reasoning")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("DetectorId");
+
+                    b.HasIndex("ProjectId", "CreatedAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("CustomAnomalyResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.EmailSettings.EmailSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("AppBaseUrl")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("FromAddress")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("FromName")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("MinSeverity")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Password")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Security")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("SmtpHost")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("SmtpPort")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Username")
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("EmailSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.ToTable("EvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("InvitedBy")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email");
+
+                    b.HasIndex("InvitedBy");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.ToTable("InviteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Licensing.StoredLicenseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Jwt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("StoredLicenseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("CodeHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CodeHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("MfaBackupCodeEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("CachedInputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<decimal?>("InputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Model")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("OutputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Model", "Provider")
+                        .IsUnique();
+
+                    b.HasIndex("Provider", "IsArchived");
+
+                    b.ToTable("ModelEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ApiKey")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("ApiKeyLookupHash")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Endpoint")
+                        .IsRequired()
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ApiKeyLookupHash");
+
+                    b.HasIndex("IsArchived");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelProviderEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Severity")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("TargetKind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("ProjectId", "Status");
+
+                    b.HasIndex("TargetKind", "TargetId");
+
+                    b.ToTable("NotificationEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("ABTestRun")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("AdoptedAgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("AdoptedAgentVersionNumber")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset?>("AdoptedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool?>("AdoptedManually")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<double?>("CurrentPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProposedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRun");
+
+                    b.HasIndex("AdoptedAgentVersionId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationProposalEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("ABTestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("BaselinePassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("PValue")
+                        .HasColumnType("double precision");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProjectedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ResultingProposalId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Source")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRunId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("ResultingProposalId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationTheoryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OutlierSettings.OutlierSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("MinSampleCount")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("SampleWindow")
+                        .HasColumnType("integer");
+
+                    b.Property<double>("SigmaMultiplier")
+                        .HasColumnType("double precision");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("OutlierSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("PasswordResetTokenEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("SystemEndpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.HasIndex("SystemEndpoint");
+
+                    b.ToTable("ProjectEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ProjectId", "UserId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ProjectUserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AutoReindexOnChange")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("IndexedKinds")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SnippetLength")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Project")
+                        .IsUnique();
+
+                    b.ToTable("ProjectSearchSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExternalKey")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<DateTimeOffset>("LastActivityAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long>("TotalTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("TraceCount")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ProjectId", "ExternalKey")
+                        .IsUnique();
+
+                    b.HasIndex("ProjectId", "LastActivityAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("SessionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("GroupId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("Passed")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("RunCompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("SuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("TestCases")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("TestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("TotalDurationMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("GroupId");
+
+                    b.HasIndex("RunCompletedAt");
+
+                    b.HasIndex("SuiteId");
+
+                    b.HasIndex("TestRunId")
+                        .IsUnique();
+
+                    b.ToTable("TestRunStatsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExpectedOutput")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Input")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("SourceAgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("TestCaseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("HasError")
+                        .HasColumnType("boolean");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long>("LatencyMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<byte?>("Score")
+                        .HasColumnType("smallint");
+
+                    b.Property<Guid>("TestResultId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TestResultId");
+
+                    b.HasIndex("EvaluatorId", "CreatedAt");
+
+                    b.ToTable("EvaluationStatEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActualResponse")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long>("DurationMs")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Evaluations")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<Guid>("TestCase")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("TestCase");
+
+                    b.ToTable("TestResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Group")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SampleIndex")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TestResults")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("Group");
+
+                    b.ToTable("TestRunEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsSystemRun")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("SampleCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<Guid?>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ScheduleId");
+
+                    b.HasIndex("Suite");
+
+                    b.ToTable("TestRunGroupEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.Property<Guid>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ScheduleId", "EndpointId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.ToTable("TestRunScheduleEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("AnchorAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("IntervalMinutes")
+                        .HasColumnType("integer");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LastRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("NextRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("IsEnabled", "NextRunAt");
+
+                    b.ToTable("TestRunScheduleEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("TestCases")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.ToTable("TestSuiteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("TestSuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("TestSuiteId", "EvaluatorId");
+
+                    b.HasIndex("EvaluatorId");
+
+                    b.ToTable("TestSuiteEvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.User.UserEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("EmailNotificationMinSeverity")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(0);
+
+                    b.Property<bool>("EmailNotificationsEnabled")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(true);
+
+                    b.Property<string>("ExternalSubject")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Language")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("text")
+                        .HasDefaultValue("en");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email")
+                        .IsUnique();
+
+                    b.HasIndex("ExternalSubject")
+                        .IsUnique()
+                        .HasFilter("\"ExternalSubject\" IS NOT NULL");
+
+                    b.ToTable("UserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConfirmedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long?>("LastUsedStep")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Secret")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("User")
+                        .IsUnique();
+
+                    b.ToTable("UserTotpEnrollmentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentVersionId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany("Tools")
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Owner")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany("ScopedAgents")
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("InvitedBy")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Model")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRun")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AdoptedAgentVersionId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRunId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ResultingProposalId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("SystemEndpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany("ProjectUsers")
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithOne()
+                        .HasForeignKey("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", "TestRunId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", null)
+                        .WithMany("EvaluationStats")
+                        .HasForeignKey("TestResultId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", null)
+                        .WithMany()
+                        .HasForeignKey("TestCase")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Group")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Restrict);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany("ScheduleEndpoints")
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EvaluatorId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany("TestSuiteEvaluators")
+                        .HasForeignKey("TestSuiteId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Navigation("Tools");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Navigation("ScopedAgents");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Navigation("ProjectUsers");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Navigation("EvaluationStats");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Navigation("ScheduleEndpoints");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Navigation("TestSuiteEvaluators");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727150217_WidenProviderApiKeyLookupHash.cs b/Proxytrace.Storage/Migrations/20260727150217_WidenProviderApiKeyLookupHash.cs
new file mode 100644
index 000000000..ed72d3f90
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727150217_WidenProviderApiKeyLookupHash.cs
@@ -0,0 +1,58 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    /// <summary>
+    /// Widens <c>ModelProviderEntity.ApiKeyLookupHash</c> from 64 to 128 characters so it can hold
+    /// the scheme-prefixed keyed blind index (<c>"hmac1:"</c> + 64 hex chars) alongside the bare
+    /// 64-char hash that predates it.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// <b>Up is a widening — no existing value can be truncated, and no data is rewritten here.</b>
+    /// Existing rows keep their legacy unkeyed index and stay fully functional: the provider lookup
+    /// matches both schemes, and <c>SecretsBackfillService.ReindexProviderKeysAsync</c> upgrades them
+    /// on the next start.
+    /// </para>
+    /// <para>
+    /// The tooling's "may result in the loss of data" warning refers to <c>Down</c>, which narrows
+    /// the column back to 64 and would therefore truncate any already-upgraded keyed index. That is
+    /// inherent to reverting this change; a rollback needs the rows re-indexed to the legacy scheme
+    /// first, which is the same operation as re-keying and is not automated.
+    /// </para>
+    /// </remarks>
+    public partial class WidenProviderApiKeyLookupHash : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<string>(
+                name: "ApiKeyLookupHash",
+                table: "ModelProviderEntity",
+                type: "character varying(128)",
+                maxLength: 128,
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "character varying(64)",
+                oldMaxLength: 64,
+                oldNullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<string>(
+                name: "ApiKeyLookupHash",
+                table: "ModelProviderEntity",
+                type: "character varying(64)",
+                maxLength: 64,
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "character varying(128)",
+                oldMaxLength: 128,
+                oldNullable: true);
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727150920_WidenMfaBackupCodeHash.Designer.cs b/Proxytrace.Storage/Migrations/20260727150920_WidenMfaBackupCodeHash.Designer.cs
new file mode 100644
index 000000000..78e52c0d9
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727150920_WidenMfaBackupCodeHash.Designer.cs
@@ -0,0 +1,2108 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using Proxytrace.Storage;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    [DbContext(typeof(StorageDbContext))]
+    [Migration("20260727150920_WidenMfaBackupCodeHash")]
+    partial class WidenMfaBackupCodeHash
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.10")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("CurrentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("IsSystemAgent")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("IsSystemAgent");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.HasIndex("Project", "Name");
+
+                    b.ToTable("AgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("CacheHitRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<decimal?>("CachedInputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<Guid?>("ConversationId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ErrorMessage")
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<string>("FinishReason")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<int>("HttpStatus")
+                        .HasColumnType("integer");
+
+                    b.Property<decimal?>("InputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<double?>("LatencyMs")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<byte>("OutlierFlags")
+                        .HasColumnType("smallint");
+
+                    b.Property<decimal?>("OutputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<string>("Request")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("RequestPreview")
+                        .HasMaxLength(1000)
+                        .HasColumnType("character varying(1000)");
+
+                    b.Property<string>("Response")
+                        .HasColumnType("text");
+
+                    b.Property<int>("ResponseToolRequestCount")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("SessionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("TotalTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CacheHitRate");
+
+                    b.HasIndex("ConversationId");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("LatencyMs");
+
+                    b.HasIndex("OutlierFlags")
+                        .HasFilter("\"OutlierFlags\" <> 0");
+
+                    b.HasIndex("ResponseToolRequestCount");
+
+                    b.HasIndex("TotalTokens");
+
+                    b.HasIndex("AgentVersionId", "CreatedAt");
+
+                    b.HasIndex("SessionId", "CreatedAt");
+
+                    b.ToTable("AgentCallEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ToolName")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("ProjectId", "ToolName");
+
+                    b.HasIndex("ToolName", "AgentCallId");
+
+                    b.HasIndex("ProjectId", "AgentId", "ToolName");
+
+                    b.ToTable("AgentCallToolEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Fingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("LooseFingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("SystemPrompt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Tools")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("VersionNumber")
+                        .HasColumnType("integer");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("AgentId", "VersionNumber")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "Fingerprint")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "LooseFingerprint");
+
+                    b.ToTable("AgentVersionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("KeyHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("KeyPrefix")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Owner")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Scopes")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("KeyHash")
+                        .IsUnique();
+
+                    b.HasIndex("Owner");
+
+                    b.HasIndex("Project");
+
+                    b.HasIndex("Provider");
+
+                    b.ToTable("ApiKeyEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApplicationError.ApplicationErrorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Category")
+                        .IsRequired()
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExceptionType")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<int>("Level")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)");
+
+                    b.Property<string>("StackTrace")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.ToTable("ApplicationErrorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AuditLog.AuditLogEntryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Action")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorApiKeyId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActorEmail")
+                        .HasMaxLength(320)
+                        .HasColumnType("character varying(320)");
+
+                    b.Property<int>("ActorType")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorUserId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Details")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Outcome")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("TargetLabel")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<string>("TargetType")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Action");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.ToTable("AuditLogEntryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("DetectorId", "AgentId");
+
+                    b.HasIndex("AgentId");
+
+                    b.ToTable("CustomAnomalyDetectorAgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AllAgents")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("BlockUpstream")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false);
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Triggers")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Project", "IsEnabled");
+
+                    b.ToTable("CustomAnomalyDetectorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("MatchedTrigger")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Reasoning")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("DetectorId");
+
+                    b.HasIndex("ProjectId", "CreatedAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("CustomAnomalyResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.EmailSettings.EmailSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("AppBaseUrl")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("FromAddress")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("FromName")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("MinSeverity")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Password")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Security")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("SmtpHost")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("SmtpPort")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Username")
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("EmailSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.ToTable("EvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("InvitedBy")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email");
+
+                    b.HasIndex("InvitedBy");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.ToTable("InviteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Licensing.StoredLicenseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Jwt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("StoredLicenseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("CodeHash")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CodeHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("MfaBackupCodeEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("CachedInputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<decimal?>("InputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Model")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("OutputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Model", "Provider")
+                        .IsUnique();
+
+                    b.HasIndex("Provider", "IsArchived");
+
+                    b.ToTable("ModelEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ApiKey")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("ApiKeyLookupHash")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Endpoint")
+                        .IsRequired()
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ApiKeyLookupHash");
+
+                    b.HasIndex("IsArchived");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelProviderEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Severity")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("TargetKind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("ProjectId", "Status");
+
+                    b.HasIndex("TargetKind", "TargetId");
+
+                    b.ToTable("NotificationEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("ABTestRun")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("AdoptedAgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("AdoptedAgentVersionNumber")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset?>("AdoptedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool?>("AdoptedManually")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<double?>("CurrentPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProposedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRun");
+
+                    b.HasIndex("AdoptedAgentVersionId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationProposalEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("ABTestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("BaselinePassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("PValue")
+                        .HasColumnType("double precision");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProjectedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ResultingProposalId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Source")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRunId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("ResultingProposalId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationTheoryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OutlierSettings.OutlierSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("MinSampleCount")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("SampleWindow")
+                        .HasColumnType("integer");
+
+                    b.Property<double>("SigmaMultiplier")
+                        .HasColumnType("double precision");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("OutlierSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("PasswordResetTokenEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("SystemEndpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.HasIndex("SystemEndpoint");
+
+                    b.ToTable("ProjectEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ProjectId", "UserId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ProjectUserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AutoReindexOnChange")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("IndexedKinds")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SnippetLength")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Project")
+                        .IsUnique();
+
+                    b.ToTable("ProjectSearchSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExternalKey")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<DateTimeOffset>("LastActivityAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long>("TotalTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("TraceCount")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ProjectId", "ExternalKey")
+                        .IsUnique();
+
+                    b.HasIndex("ProjectId", "LastActivityAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("SessionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("GroupId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("Passed")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("RunCompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("SuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("TestCases")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("TestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("TotalDurationMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("GroupId");
+
+                    b.HasIndex("RunCompletedAt");
+
+                    b.HasIndex("SuiteId");
+
+                    b.HasIndex("TestRunId")
+                        .IsUnique();
+
+                    b.ToTable("TestRunStatsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExpectedOutput")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Input")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("SourceAgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("TestCaseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("HasError")
+                        .HasColumnType("boolean");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long>("LatencyMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<byte?>("Score")
+                        .HasColumnType("smallint");
+
+                    b.Property<Guid>("TestResultId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TestResultId");
+
+                    b.HasIndex("EvaluatorId", "CreatedAt");
+
+                    b.ToTable("EvaluationStatEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActualResponse")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long>("DurationMs")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Evaluations")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<Guid>("TestCase")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("TestCase");
+
+                    b.ToTable("TestResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Group")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SampleIndex")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TestResults")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("Group");
+
+                    b.ToTable("TestRunEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsSystemRun")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("SampleCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<Guid?>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ScheduleId");
+
+                    b.HasIndex("Suite");
+
+                    b.ToTable("TestRunGroupEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.Property<Guid>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ScheduleId", "EndpointId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.ToTable("TestRunScheduleEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("AnchorAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("IntervalMinutes")
+                        .HasColumnType("integer");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LastRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("NextRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("IsEnabled", "NextRunAt");
+
+                    b.ToTable("TestRunScheduleEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("TestCases")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.ToTable("TestSuiteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("TestSuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("TestSuiteId", "EvaluatorId");
+
+                    b.HasIndex("EvaluatorId");
+
+                    b.ToTable("TestSuiteEvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.User.UserEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("EmailNotificationMinSeverity")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(0);
+
+                    b.Property<bool>("EmailNotificationsEnabled")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(true);
+
+                    b.Property<string>("ExternalSubject")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Language")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("text")
+                        .HasDefaultValue("en");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email")
+                        .IsUnique();
+
+                    b.HasIndex("ExternalSubject")
+                        .IsUnique()
+                        .HasFilter("\"ExternalSubject\" IS NOT NULL");
+
+                    b.ToTable("UserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConfirmedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long?>("LastUsedStep")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Secret")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("User")
+                        .IsUnique();
+
+                    b.ToTable("UserTotpEnrollmentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentVersionId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany("Tools")
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Owner")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany("ScopedAgents")
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("InvitedBy")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Model")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRun")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AdoptedAgentVersionId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRunId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ResultingProposalId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("SystemEndpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany("ProjectUsers")
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithOne()
+                        .HasForeignKey("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", "TestRunId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", null)
+                        .WithMany("EvaluationStats")
+                        .HasForeignKey("TestResultId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", null)
+                        .WithMany()
+                        .HasForeignKey("TestCase")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Group")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Restrict);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany("ScheduleEndpoints")
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EvaluatorId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany("TestSuiteEvaluators")
+                        .HasForeignKey("TestSuiteId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Navigation("Tools");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Navigation("ScopedAgents");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Navigation("ProjectUsers");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Navigation("EvaluationStats");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Navigation("ScheduleEndpoints");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Navigation("TestSuiteEvaluators");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727150920_WidenMfaBackupCodeHash.cs b/Proxytrace.Storage/Migrations/20260727150920_WidenMfaBackupCodeHash.cs
new file mode 100644
index 000000000..54a7e29bc
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727150920_WidenMfaBackupCodeHash.cs
@@ -0,0 +1,55 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    /// <summary>
+    /// Widens <c>MfaBackupCodeEntity.CodeHash</c> from 64 to 256 characters so it can hold the
+    /// salted PBKDF2 hash that replaced the single-round unsalted SHA-256.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// <b>Up is a widening — no existing value is truncated or rewritten.</b> Codes issued before
+    /// this change keep their 64-character hash and keep working: <c>MfaService</c> recognises the
+    /// legacy form and verifies against it. They cannot be upgraded in place, because the raw code
+    /// is unrecoverable — a stored hash could only be re-hashed at the moment the user redeems it,
+    /// and redeeming consumes it. Existing codes therefore age out as they are used or when the user
+    /// re-enrolls; every newly issued batch gets the stronger hash.
+    /// </para>
+    /// <para>
+    /// The tooling's data-loss warning refers to <c>Down</c>, which narrows the column back to 64 and
+    /// would truncate any PBKDF2 hash already written.
+    /// </para>
+    /// </remarks>
+    public partial class WidenMfaBackupCodeHash : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<string>(
+                name: "CodeHash",
+                table: "MfaBackupCodeEntity",
+                type: "character varying(256)",
+                maxLength: 256,
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "character varying(64)",
+                oldMaxLength: 64);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<string>(
+                name: "CodeHash",
+                table: "MfaBackupCodeEntity",
+                type: "character varying(64)",
+                maxLength: 64,
+                nullable: false,
+                oldClrType: typeof(string),
+                oldType: "character varying(256)",
+                oldMaxLength: 256);
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727151400_RestrictApiKeyOwnerAndProviderDeletes.Designer.cs b/Proxytrace.Storage/Migrations/20260727151400_RestrictApiKeyOwnerAndProviderDeletes.Designer.cs
new file mode 100644
index 000000000..127fc4936
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727151400_RestrictApiKeyOwnerAndProviderDeletes.Designer.cs
@@ -0,0 +1,2108 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using Proxytrace.Storage;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    [DbContext(typeof(StorageDbContext))]
+    [Migration("20260727151400_RestrictApiKeyOwnerAndProviderDeletes")]
+    partial class RestrictApiKeyOwnerAndProviderDeletes
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.10")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("CurrentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("IsSystemAgent")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("IsSystemAgent");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.HasIndex("Project", "Name");
+
+                    b.ToTable("AgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("CacheHitRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<decimal?>("CachedInputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<Guid?>("ConversationId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ErrorMessage")
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<string>("FinishReason")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<int>("HttpStatus")
+                        .HasColumnType("integer");
+
+                    b.Property<decimal?>("InputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<double?>("LatencyMs")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<byte>("OutlierFlags")
+                        .HasColumnType("smallint");
+
+                    b.Property<decimal?>("OutputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<string>("Request")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("RequestPreview")
+                        .HasMaxLength(1000)
+                        .HasColumnType("character varying(1000)");
+
+                    b.Property<string>("Response")
+                        .HasColumnType("text");
+
+                    b.Property<int>("ResponseToolRequestCount")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("SessionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("TotalTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CacheHitRate");
+
+                    b.HasIndex("ConversationId");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("LatencyMs");
+
+                    b.HasIndex("OutlierFlags")
+                        .HasFilter("\"OutlierFlags\" <> 0");
+
+                    b.HasIndex("ResponseToolRequestCount");
+
+                    b.HasIndex("TotalTokens");
+
+                    b.HasIndex("AgentVersionId", "CreatedAt");
+
+                    b.HasIndex("SessionId", "CreatedAt");
+
+                    b.ToTable("AgentCallEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ToolName")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("ProjectId", "ToolName");
+
+                    b.HasIndex("ToolName", "AgentCallId");
+
+                    b.HasIndex("ProjectId", "AgentId", "ToolName");
+
+                    b.ToTable("AgentCallToolEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Fingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("LooseFingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("SystemPrompt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Tools")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("VersionNumber")
+                        .HasColumnType("integer");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("AgentId", "VersionNumber")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "Fingerprint")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "LooseFingerprint");
+
+                    b.ToTable("AgentVersionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("KeyHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("KeyPrefix")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Owner")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Scopes")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("KeyHash")
+                        .IsUnique();
+
+                    b.HasIndex("Owner");
+
+                    b.HasIndex("Project");
+
+                    b.HasIndex("Provider");
+
+                    b.ToTable("ApiKeyEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApplicationError.ApplicationErrorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Category")
+                        .IsRequired()
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExceptionType")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<int>("Level")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)");
+
+                    b.Property<string>("StackTrace")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.ToTable("ApplicationErrorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AuditLog.AuditLogEntryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Action")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorApiKeyId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActorEmail")
+                        .HasMaxLength(320)
+                        .HasColumnType("character varying(320)");
+
+                    b.Property<int>("ActorType")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorUserId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Details")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Outcome")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("TargetLabel")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<string>("TargetType")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Action");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.ToTable("AuditLogEntryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("DetectorId", "AgentId");
+
+                    b.HasIndex("AgentId");
+
+                    b.ToTable("CustomAnomalyDetectorAgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AllAgents")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("BlockUpstream")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false);
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Triggers")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Project", "IsEnabled");
+
+                    b.ToTable("CustomAnomalyDetectorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("MatchedTrigger")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Reasoning")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("DetectorId");
+
+                    b.HasIndex("ProjectId", "CreatedAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("CustomAnomalyResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.EmailSettings.EmailSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("AppBaseUrl")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("FromAddress")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("FromName")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("MinSeverity")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Password")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Security")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("SmtpHost")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("SmtpPort")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Username")
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("EmailSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.ToTable("EvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("InvitedBy")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email");
+
+                    b.HasIndex("InvitedBy");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.ToTable("InviteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Licensing.StoredLicenseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Jwt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("StoredLicenseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("CodeHash")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CodeHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("MfaBackupCodeEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("CachedInputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<decimal?>("InputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Model")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("OutputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Model", "Provider")
+                        .IsUnique();
+
+                    b.HasIndex("Provider", "IsArchived");
+
+                    b.ToTable("ModelEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ApiKey")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("ApiKeyLookupHash")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Endpoint")
+                        .IsRequired()
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ApiKeyLookupHash");
+
+                    b.HasIndex("IsArchived");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelProviderEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Severity")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("TargetKind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("ProjectId", "Status");
+
+                    b.HasIndex("TargetKind", "TargetId");
+
+                    b.ToTable("NotificationEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("ABTestRun")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("AdoptedAgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("AdoptedAgentVersionNumber")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset?>("AdoptedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool?>("AdoptedManually")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<double?>("CurrentPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProposedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRun");
+
+                    b.HasIndex("AdoptedAgentVersionId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationProposalEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("ABTestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("BaselinePassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("PValue")
+                        .HasColumnType("double precision");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProjectedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ResultingProposalId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Source")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRunId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("ResultingProposalId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationTheoryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OutlierSettings.OutlierSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("MinSampleCount")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("SampleWindow")
+                        .HasColumnType("integer");
+
+                    b.Property<double>("SigmaMultiplier")
+                        .HasColumnType("double precision");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("OutlierSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("PasswordResetTokenEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("SystemEndpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.HasIndex("SystemEndpoint");
+
+                    b.ToTable("ProjectEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ProjectId", "UserId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ProjectUserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AutoReindexOnChange")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("IndexedKinds")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SnippetLength")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Project")
+                        .IsUnique();
+
+                    b.ToTable("ProjectSearchSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExternalKey")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<DateTimeOffset>("LastActivityAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long>("TotalTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("TraceCount")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ProjectId", "ExternalKey")
+                        .IsUnique();
+
+                    b.HasIndex("ProjectId", "LastActivityAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("SessionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("GroupId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("Passed")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("RunCompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("SuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("TestCases")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("TestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("TotalDurationMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("GroupId");
+
+                    b.HasIndex("RunCompletedAt");
+
+                    b.HasIndex("SuiteId");
+
+                    b.HasIndex("TestRunId")
+                        .IsUnique();
+
+                    b.ToTable("TestRunStatsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExpectedOutput")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Input")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("SourceAgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("TestCaseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("HasError")
+                        .HasColumnType("boolean");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long>("LatencyMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<byte?>("Score")
+                        .HasColumnType("smallint");
+
+                    b.Property<Guid>("TestResultId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TestResultId");
+
+                    b.HasIndex("EvaluatorId", "CreatedAt");
+
+                    b.ToTable("EvaluationStatEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActualResponse")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long>("DurationMs")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Evaluations")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<Guid>("TestCase")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("TestCase");
+
+                    b.ToTable("TestResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Group")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SampleIndex")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TestResults")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("Group");
+
+                    b.ToTable("TestRunEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsSystemRun")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("SampleCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<Guid?>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ScheduleId");
+
+                    b.HasIndex("Suite");
+
+                    b.ToTable("TestRunGroupEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.Property<Guid>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ScheduleId", "EndpointId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.ToTable("TestRunScheduleEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("AnchorAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("IntervalMinutes")
+                        .HasColumnType("integer");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LastRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("NextRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("IsEnabled", "NextRunAt");
+
+                    b.ToTable("TestRunScheduleEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("TestCases")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.ToTable("TestSuiteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("TestSuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("TestSuiteId", "EvaluatorId");
+
+                    b.HasIndex("EvaluatorId");
+
+                    b.ToTable("TestSuiteEvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.User.UserEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("EmailNotificationMinSeverity")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(0);
+
+                    b.Property<bool>("EmailNotificationsEnabled")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(true);
+
+                    b.Property<string>("ExternalSubject")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Language")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("text")
+                        .HasDefaultValue("en");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email")
+                        .IsUnique();
+
+                    b.HasIndex("ExternalSubject")
+                        .IsUnique()
+                        .HasFilter("\"ExternalSubject\" IS NOT NULL");
+
+                    b.ToTable("UserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConfirmedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long?>("LastUsedStep")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Secret")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("User")
+                        .IsUnique();
+
+                    b.ToTable("UserTotpEnrollmentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentVersionId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany("Tools")
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Owner")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany("ScopedAgents")
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("InvitedBy")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Model")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRun")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AdoptedAgentVersionId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRunId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ResultingProposalId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("SystemEndpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany("ProjectUsers")
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithOne()
+                        .HasForeignKey("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", "TestRunId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", null)
+                        .WithMany("EvaluationStats")
+                        .HasForeignKey("TestResultId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", null)
+                        .WithMany()
+                        .HasForeignKey("TestCase")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Group")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Restrict);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany("ScheduleEndpoints")
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EvaluatorId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany("TestSuiteEvaluators")
+                        .HasForeignKey("TestSuiteId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Navigation("Tools");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Navigation("ScopedAgents");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Navigation("ProjectUsers");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Navigation("EvaluationStats");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Navigation("ScheduleEndpoints");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Navigation("TestSuiteEvaluators");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727151400_RestrictApiKeyOwnerAndProviderDeletes.cs b/Proxytrace.Storage/Migrations/20260727151400_RestrictApiKeyOwnerAndProviderDeletes.cs
new file mode 100644
index 000000000..024aaa236
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727151400_RestrictApiKeyOwnerAndProviderDeletes.cs
@@ -0,0 +1,66 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    /// <inheritdoc />
+    public partial class RestrictApiKeyOwnerAndProviderDeletes : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_ApiKeyEntity_ModelProviderEntity_Provider",
+                table: "ApiKeyEntity");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_ApiKeyEntity_UserEntity_Owner",
+                table: "ApiKeyEntity");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_ApiKeyEntity_ModelProviderEntity_Provider",
+                table: "ApiKeyEntity",
+                column: "Provider",
+                principalTable: "ModelProviderEntity",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_ApiKeyEntity_UserEntity_Owner",
+                table: "ApiKeyEntity",
+                column: "Owner",
+                principalTable: "UserEntity",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_ApiKeyEntity_ModelProviderEntity_Provider",
+                table: "ApiKeyEntity");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_ApiKeyEntity_UserEntity_Owner",
+                table: "ApiKeyEntity");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_ApiKeyEntity_ModelProviderEntity_Provider",
+                table: "ApiKeyEntity",
+                column: "Provider",
+                principalTable: "ModelProviderEntity",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Cascade);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_ApiKeyEntity_UserEntity_Owner",
+                table: "ApiKeyEntity",
+                column: "Owner",
+                principalTable: "UserEntity",
+                principalColumn: "Id",
+                onDelete: ReferentialAction.Cascade);
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727160700_AddTestRunGroupOptimizationConsideredAt.Designer.cs b/Proxytrace.Storage/Migrations/20260727160700_AddTestRunGroupOptimizationConsideredAt.Designer.cs
new file mode 100644
index 000000000..508ddb7cf
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727160700_AddTestRunGroupOptimizationConsideredAt.Designer.cs
@@ -0,0 +1,2113 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using Proxytrace.Storage;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    [DbContext(typeof(StorageDbContext))]
+    [Migration("20260727160700_AddTestRunGroupOptimizationConsideredAt")]
+    partial class AddTestRunGroupOptimizationConsideredAt
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.10")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("CurrentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("IsSystemAgent")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("IsSystemAgent");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.HasIndex("Project", "Name");
+
+                    b.ToTable("AgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("CacheHitRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<decimal?>("CachedInputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<Guid?>("ConversationId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ErrorMessage")
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<string>("FinishReason")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<int>("HttpStatus")
+                        .HasColumnType("integer");
+
+                    b.Property<decimal?>("InputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<double?>("LatencyMs")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<byte>("OutlierFlags")
+                        .HasColumnType("smallint");
+
+                    b.Property<decimal?>("OutputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<string>("Request")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("RequestPreview")
+                        .HasMaxLength(1000)
+                        .HasColumnType("character varying(1000)");
+
+                    b.Property<string>("Response")
+                        .HasColumnType("text");
+
+                    b.Property<int>("ResponseToolRequestCount")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("SessionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("TotalTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CacheHitRate");
+
+                    b.HasIndex("ConversationId");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("LatencyMs");
+
+                    b.HasIndex("OutlierFlags")
+                        .HasFilter("\"OutlierFlags\" <> 0");
+
+                    b.HasIndex("ResponseToolRequestCount");
+
+                    b.HasIndex("TotalTokens");
+
+                    b.HasIndex("AgentVersionId", "CreatedAt");
+
+                    b.HasIndex("SessionId", "CreatedAt");
+
+                    b.ToTable("AgentCallEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ToolName")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("ProjectId", "ToolName");
+
+                    b.HasIndex("ToolName", "AgentCallId");
+
+                    b.HasIndex("ProjectId", "AgentId", "ToolName");
+
+                    b.ToTable("AgentCallToolEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Fingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("LooseFingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("SystemPrompt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Tools")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("VersionNumber")
+                        .HasColumnType("integer");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("AgentId", "VersionNumber")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "Fingerprint")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "LooseFingerprint");
+
+                    b.ToTable("AgentVersionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("KeyHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("KeyPrefix")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Owner")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Scopes")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("KeyHash")
+                        .IsUnique();
+
+                    b.HasIndex("Owner");
+
+                    b.HasIndex("Project");
+
+                    b.HasIndex("Provider");
+
+                    b.ToTable("ApiKeyEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApplicationError.ApplicationErrorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Category")
+                        .IsRequired()
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExceptionType")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<int>("Level")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)");
+
+                    b.Property<string>("StackTrace")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.ToTable("ApplicationErrorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AuditLog.AuditLogEntryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Action")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorApiKeyId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActorEmail")
+                        .HasMaxLength(320)
+                        .HasColumnType("character varying(320)");
+
+                    b.Property<int>("ActorType")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorUserId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Details")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Outcome")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("TargetLabel")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<string>("TargetType")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Action");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.ToTable("AuditLogEntryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("DetectorId", "AgentId");
+
+                    b.HasIndex("AgentId");
+
+                    b.ToTable("CustomAnomalyDetectorAgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AllAgents")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("BlockUpstream")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false);
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Triggers")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Project", "IsEnabled");
+
+                    b.ToTable("CustomAnomalyDetectorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("MatchedTrigger")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Reasoning")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("DetectorId");
+
+                    b.HasIndex("ProjectId", "CreatedAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("CustomAnomalyResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.EmailSettings.EmailSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("AppBaseUrl")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("FromAddress")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("FromName")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("MinSeverity")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Password")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Security")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("SmtpHost")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("SmtpPort")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Username")
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("EmailSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.ToTable("EvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("InvitedBy")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email");
+
+                    b.HasIndex("InvitedBy");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.ToTable("InviteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Licensing.StoredLicenseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Jwt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("StoredLicenseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("CodeHash")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CodeHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("MfaBackupCodeEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("CachedInputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<decimal?>("InputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Model")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("OutputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Model", "Provider")
+                        .IsUnique();
+
+                    b.HasIndex("Provider", "IsArchived");
+
+                    b.ToTable("ModelEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ApiKey")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("ApiKeyLookupHash")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Endpoint")
+                        .IsRequired()
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ApiKeyLookupHash");
+
+                    b.HasIndex("IsArchived");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelProviderEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Severity")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("TargetKind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("ProjectId", "Status");
+
+                    b.HasIndex("TargetKind", "TargetId");
+
+                    b.ToTable("NotificationEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("ABTestRun")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("AdoptedAgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("AdoptedAgentVersionNumber")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset?>("AdoptedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool?>("AdoptedManually")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<double?>("CurrentPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProposedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRun");
+
+                    b.HasIndex("AdoptedAgentVersionId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationProposalEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("ABTestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("BaselinePassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("PValue")
+                        .HasColumnType("double precision");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProjectedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ResultingProposalId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Source")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRunId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("ResultingProposalId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationTheoryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OutlierSettings.OutlierSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("MinSampleCount")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("SampleWindow")
+                        .HasColumnType("integer");
+
+                    b.Property<double>("SigmaMultiplier")
+                        .HasColumnType("double precision");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("OutlierSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("PasswordResetTokenEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("SystemEndpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.HasIndex("SystemEndpoint");
+
+                    b.ToTable("ProjectEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ProjectId", "UserId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ProjectUserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AutoReindexOnChange")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("IndexedKinds")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SnippetLength")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Project")
+                        .IsUnique();
+
+                    b.ToTable("ProjectSearchSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExternalKey")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<DateTimeOffset>("LastActivityAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long>("TotalTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("TraceCount")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ProjectId", "ExternalKey")
+                        .IsUnique();
+
+                    b.HasIndex("ProjectId", "LastActivityAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("SessionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("GroupId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("Passed")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("RunCompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("SuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("TestCases")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("TestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("TotalDurationMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("GroupId");
+
+                    b.HasIndex("RunCompletedAt");
+
+                    b.HasIndex("SuiteId");
+
+                    b.HasIndex("TestRunId")
+                        .IsUnique();
+
+                    b.ToTable("TestRunStatsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExpectedOutput")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Input")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("SourceAgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("TestCaseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("HasError")
+                        .HasColumnType("boolean");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long>("LatencyMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<byte?>("Score")
+                        .HasColumnType("smallint");
+
+                    b.Property<Guid>("TestResultId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TestResultId");
+
+                    b.HasIndex("EvaluatorId", "CreatedAt");
+
+                    b.ToTable("EvaluationStatEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActualResponse")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long>("DurationMs")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Evaluations")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<Guid>("TestCase")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("TestCase");
+
+                    b.ToTable("TestResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Group")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SampleIndex")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TestResults")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("Group");
+
+                    b.ToTable("TestRunEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsSystemRun")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("OptimizationConsideredAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("SampleCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<Guid?>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ScheduleId");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("OptimizationConsideredAt", "IsSystemRun", "Status");
+
+                    b.ToTable("TestRunGroupEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.Property<Guid>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ScheduleId", "EndpointId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.ToTable("TestRunScheduleEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("AnchorAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("IntervalMinutes")
+                        .HasColumnType("integer");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LastRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("NextRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("IsEnabled", "NextRunAt");
+
+                    b.ToTable("TestRunScheduleEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("TestCases")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.ToTable("TestSuiteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("TestSuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("TestSuiteId", "EvaluatorId");
+
+                    b.HasIndex("EvaluatorId");
+
+                    b.ToTable("TestSuiteEvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.User.UserEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("EmailNotificationMinSeverity")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(0);
+
+                    b.Property<bool>("EmailNotificationsEnabled")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(true);
+
+                    b.Property<string>("ExternalSubject")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Language")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("text")
+                        .HasDefaultValue("en");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email")
+                        .IsUnique();
+
+                    b.HasIndex("ExternalSubject")
+                        .IsUnique()
+                        .HasFilter("\"ExternalSubject\" IS NOT NULL");
+
+                    b.ToTable("UserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConfirmedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long?>("LastUsedStep")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Secret")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("User")
+                        .IsUnique();
+
+                    b.ToTable("UserTotpEnrollmentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentVersionId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany("Tools")
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Owner")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany("ScopedAgents")
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("InvitedBy")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Model")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRun")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AdoptedAgentVersionId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRunId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ResultingProposalId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("SystemEndpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany("ProjectUsers")
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithOne()
+                        .HasForeignKey("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", "TestRunId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", null)
+                        .WithMany("EvaluationStats")
+                        .HasForeignKey("TestResultId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", null)
+                        .WithMany()
+                        .HasForeignKey("TestCase")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Group")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Restrict);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany("ScheduleEndpoints")
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EvaluatorId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany("TestSuiteEvaluators")
+                        .HasForeignKey("TestSuiteId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Navigation("Tools");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Navigation("ScopedAgents");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Navigation("ProjectUsers");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Navigation("EvaluationStats");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Navigation("ScheduleEndpoints");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Navigation("TestSuiteEvaluators");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727160700_AddTestRunGroupOptimizationConsideredAt.cs b/Proxytrace.Storage/Migrations/20260727160700_AddTestRunGroupOptimizationConsideredAt.cs
new file mode 100644
index 000000000..550739506
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727160700_AddTestRunGroupOptimizationConsideredAt.cs
@@ -0,0 +1,53 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    /// <summary>
+    /// Adds the durable "the optimizer has looked at this group" marker that its otherwise in-memory
+    /// queue recovers from after a restart.
+    /// </summary>
+    /// <remarks>
+    /// <b>Existing rows are backfilled as already considered</b>, and that is the load-bearing part
+    /// of this migration. The column is nullable and a fresh column is null everywhere, so without
+    /// the backfill the first start after upgrading would see every completed group an installation
+    /// has ever run as an unprocessed backlog — and re-queuing those means real A/B validation runs
+    /// against a real provider, i.e. real money, for history nobody asked to re-analyse. Only groups
+    /// that complete *after* the upgrade are eligible for recovery.
+    /// </remarks>
+    public partial class AddTestRunGroupOptimizationConsideredAt : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<DateTimeOffset>(
+                name: "OptimizationConsideredAt",
+                table: "TestRunGroupEntity",
+                type: "timestamp with time zone",
+                nullable: true);
+
+            // Backfill before the index exists: history is not a backlog. See the remarks above.
+            migrationBuilder.Sql(
+                """UPDATE "TestRunGroupEntity" SET "OptimizationConsideredAt" = NOW() WHERE "OptimizationConsideredAt" IS NULL;""");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_TestRunGroupEntity_OptimizationConsideredAt_IsSystemRun_Sta~",
+                table: "TestRunGroupEntity",
+                columns: new[] { "OptimizationConsideredAt", "IsSystemRun", "Status" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropIndex(
+                name: "IX_TestRunGroupEntity_OptimizationConsideredAt_IsSystemRun_Sta~",
+                table: "TestRunGroupEntity");
+
+            migrationBuilder.DropColumn(
+                name: "OptimizationConsideredAt",
+                table: "TestRunGroupEntity");
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727163658_GrantPassthroughScopeToExistingApiKeys.Designer.cs b/Proxytrace.Storage/Migrations/20260727163658_GrantPassthroughScopeToExistingApiKeys.Designer.cs
new file mode 100644
index 000000000..e415dceb8
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727163658_GrantPassthroughScopeToExistingApiKeys.Designer.cs
@@ -0,0 +1,2113 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using Proxytrace.Storage;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    [DbContext(typeof(StorageDbContext))]
+    [Migration("20260727163658_GrantPassthroughScopeToExistingApiKeys")]
+    partial class GrantPassthroughScopeToExistingApiKeys
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.10")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("CurrentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("IsSystemAgent")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("IsSystemAgent");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.HasIndex("Project", "Name");
+
+                    b.ToTable("AgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("CacheHitRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<decimal?>("CachedInputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<Guid?>("ConversationId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ErrorMessage")
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<string>("FinishReason")
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<int>("HttpStatus")
+                        .HasColumnType("integer");
+
+                    b.Property<decimal?>("InputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<double?>("LatencyMs")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ModelParameters")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<byte>("OutlierFlags")
+                        .HasColumnType("smallint");
+
+                    b.Property<decimal?>("OutputTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<string>("Request")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("RequestPreview")
+                        .HasMaxLength(1000)
+                        .HasColumnType("character varying(1000)");
+
+                    b.Property<string>("Response")
+                        .HasColumnType("text");
+
+                    b.Property<int>("ResponseToolRequestCount")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("SessionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("TotalTokens")
+                        .HasColumnType("numeric(20,0)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CacheHitRate");
+
+                    b.HasIndex("ConversationId");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("LatencyMs");
+
+                    b.HasIndex("OutlierFlags")
+                        .HasFilter("\"OutlierFlags\" <> 0");
+
+                    b.HasIndex("ResponseToolRequestCount");
+
+                    b.HasIndex("TotalTokens");
+
+                    b.HasIndex("AgentVersionId", "CreatedAt");
+
+                    b.HasIndex("SessionId", "CreatedAt");
+
+                    b.ToTable("AgentCallEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ToolName")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("ProjectId", "ToolName");
+
+                    b.HasIndex("ToolName", "AgentCallId");
+
+                    b.HasIndex("ProjectId", "AgentId", "ToolName");
+
+                    b.ToTable("AgentCallToolEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Fingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("LooseFingerprint")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("SystemPrompt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Tools")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("VersionNumber")
+                        .HasColumnType("integer");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("AgentId", "VersionNumber")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "Fingerprint")
+                        .IsUnique();
+
+                    b.HasIndex("Project", "LooseFingerprint");
+
+                    b.ToTable("AgentVersionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("KeyHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<string>("KeyPrefix")
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Owner")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Scopes")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("KeyHash")
+                        .IsUnique();
+
+                    b.HasIndex("Owner");
+
+                    b.HasIndex("Project");
+
+                    b.HasIndex("Provider");
+
+                    b.ToTable("ApiKeyEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApplicationError.ApplicationErrorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Category")
+                        .IsRequired()
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExceptionType")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<int>("Level")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasMaxLength(4096)
+                        .HasColumnType("character varying(4096)");
+
+                    b.Property<string>("StackTrace")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.ToTable("ApplicationErrorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AuditLog.AuditLogEntryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Action")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorApiKeyId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActorEmail")
+                        .HasMaxLength(320)
+                        .HasColumnType("character varying(320)");
+
+                    b.Property<int>("ActorType")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ActorUserId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Details")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Outcome")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("TargetLabel")
+                        .HasMaxLength(512)
+                        .HasColumnType("character varying(512)");
+
+                    b.Property<string>("TargetType")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Action");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.ToTable("AuditLogEntryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("DetectorId", "AgentId");
+
+                    b.HasIndex("AgentId");
+
+                    b.ToTable("CustomAnomalyDetectorAgentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AllAgents")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("BlockUpstream")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(false);
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Triggers")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Project", "IsEnabled");
+
+                    b.ToTable("CustomAnomalyDetectorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("DetectorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("MatchedTrigger")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("Reasoning")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentCallId");
+
+                    b.HasIndex("DetectorId");
+
+                    b.HasIndex("ProjectId", "CreatedAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("CustomAnomalyResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.EmailSettings.EmailSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("AppBaseUrl")
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("FromAddress")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("FromName")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("MinSeverity")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Password")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Security")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("SmtpHost")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("SmtpPort")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Username")
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("EmailSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Project", "IsArchived");
+
+                    b.ToTable("EvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("InvitedBy")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email");
+
+                    b.HasIndex("InvitedBy");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.ToTable("InviteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Licensing.StoredLicenseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Jwt")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("StoredLicenseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("CodeHash")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CodeHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("MfaBackupCodeEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("CachedInputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<decimal?>("InputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Model")
+                        .HasColumnType("uuid");
+
+                    b.Property<decimal?>("OutputTokenCost")
+                        .HasPrecision(18, 6)
+                        .HasColumnType("numeric(18,6)");
+
+                    b.Property<Guid>("Provider")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Model", "Provider")
+                        .IsUnique();
+
+                    b.HasIndex("Provider", "IsArchived");
+
+                    b.ToTable("ModelEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ApiKey")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("ApiKeyLookupHash")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Endpoint")
+                        .IsRequired()
+                        .HasMaxLength(2048)
+                        .HasColumnType("character varying(2048)");
+
+                    b.Property<bool>("IsArchived")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ApiKeyLookupHash");
+
+                    b.HasIndex("IsArchived");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("ModelProviderEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Message")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Severity")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid?>("TargetId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("TargetKind")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("ProjectId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("ProjectId", "Status");
+
+                    b.HasIndex("TargetKind", "TargetId");
+
+                    b.ToTable("NotificationEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("ABTestRun")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("AdoptedAgentVersionId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int?>("AdoptedAgentVersionNumber")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset?>("AdoptedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool?>("AdoptedManually")
+                        .HasColumnType("boolean");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<double?>("CurrentPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProposedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRun");
+
+                    b.HasIndex("AdoptedAgentVersionId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationProposalEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid?>("ABTestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<double?>("BaselinePassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("ContentHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Data")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("EvidenceTestRunIds")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("PValue")
+                        .HasColumnType("double precision");
+
+                    b.Property<int>("Priority")
+                        .HasColumnType("integer");
+
+                    b.Property<double?>("ProjectedPassRate")
+                        .HasColumnType("double precision");
+
+                    b.Property<string>("Rationale")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("ResultingProposalId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Source")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ABTestRunId");
+
+                    b.HasIndex("Agent");
+
+                    b.HasIndex("Kind");
+
+                    b.HasIndex("ResultingProposalId");
+
+                    b.HasIndex("Status");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("Agent", "ContentHash");
+
+                    b.ToTable("OptimizationTheoryEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OutlierSettings.OutlierSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("MinSampleCount")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("SampleWindow")
+                        .HasColumnType("integer");
+
+                    b.Property<double>("SigmaMultiplier")
+                        .HasColumnType("double precision");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("OutlierSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConsumedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(64)
+                        .HasColumnType("character varying(64)");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.HasIndex("User");
+
+                    b.ToTable("PasswordResetTokenEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("SystemEndpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.HasIndex("SystemEndpoint");
+
+                    b.ToTable("ProjectEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ProjectId", "UserId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ProjectUserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("AutoReindexOnChange")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("Enabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("IndexedKinds")
+                        .IsRequired()
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<Guid>("Project")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SnippetLength")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Project")
+                        .IsUnique();
+
+                    b.ToTable("ProjectSearchSettingsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExternalKey")
+                        .IsRequired()
+                        .HasMaxLength(200)
+                        .HasColumnType("character varying(200)");
+
+                    b.Property<DateTimeOffset>("LastActivityAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("ProjectId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long>("TotalTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("TraceCount")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ProjectId", "ExternalKey")
+                        .IsUnique();
+
+                    b.HasIndex("ProjectId", "LastActivityAt")
+                        .IsDescending(false, true);
+
+                    b.ToTable("SessionEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("AgentId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("GroupId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("Passed")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("RunCompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("SuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("TestCases")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("TestRunId")
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("TotalDurationMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AgentId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.HasIndex("GroupId");
+
+                    b.HasIndex("RunCompletedAt");
+
+                    b.HasIndex("SuiteId");
+
+                    b.HasIndex("TestRunId")
+                        .IsUnique();
+
+                    b.ToTable("TestRunStatsEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ExpectedOutput")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Input")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<Guid?>("SourceAgentCallId")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("TestCaseEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<decimal?>("Cost")
+                        .HasColumnType("numeric");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.Property<bool>("HasError")
+                        .HasColumnType("boolean");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long>("LatencyMicroseconds")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<byte?>("Score")
+                        .HasColumnType("smallint");
+
+                    b.Property<Guid>("TestResultId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TestResultId");
+
+                    b.HasIndex("EvaluatorId", "CreatedAt");
+
+                    b.ToTable("EvaluationStatEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ActualResponse")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("CachedInputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long>("DurationMs")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Evaluations")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<long?>("InputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<long?>("OutputTokens")
+                        .HasColumnType("bigint");
+
+                    b.Property<Guid>("TestCase")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CreatedAt");
+
+                    b.HasIndex("TestCase");
+
+                    b.ToTable("TestResultEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Endpoint")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Group")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("SampleIndex")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("TestResults")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Endpoint");
+
+                    b.HasIndex("Group");
+
+                    b.ToTable("TestRunEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("CompletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsSystemRun")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("OptimizationConsideredAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("SampleCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(1);
+
+                    b.Property<Guid?>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("integer");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ScheduleId");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("OptimizationConsideredAt", "IsSystemRun", "Status");
+
+                    b.ToTable("TestRunGroupEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.Property<Guid>("ScheduleId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EndpointId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("ScheduleId", "EndpointId");
+
+                    b.HasIndex("EndpointId");
+
+                    b.ToTable("TestRunScheduleEndpointEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("AnchorAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("IntervalMinutes")
+                        .HasColumnType("integer");
+
+                    b.Property<bool>("IsEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LastRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("NextRunAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("Suite")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Suite");
+
+                    b.HasIndex("IsEnabled", "NextRunAt");
+
+                    b.ToTable("TestRunScheduleEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("Agent")
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("TestCases")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Agent");
+
+                    b.ToTable("TestSuiteEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.Property<Guid>("TestSuiteId")
+                        .HasColumnType("uuid");
+
+                    b.Property<Guid>("EvaluatorId")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("TestSuiteId", "EvaluatorId");
+
+                    b.HasIndex("EvaluatorId");
+
+                    b.ToTable("TestSuiteEvaluatorEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.User.UserEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("EmailNotificationMinSeverity")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(0);
+
+                    b.Property<bool>("EmailNotificationsEnabled")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(true);
+
+                    b.Property<string>("ExternalSubject")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Language")
+                        .IsRequired()
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("text")
+                        .HasDefaultValue("en");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Email")
+                        .IsUnique();
+
+                    b.HasIndex("ExternalSubject")
+                        .IsUnique()
+                        .HasFilter("\"ExternalSubject\" IS NOT NULL");
+
+                    b.ToTable("UserEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset?>("ConfirmedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<long?>("LastUsedStep")
+                        .HasColumnType("bigint");
+
+                    b.Property<string>("Secret")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .IsConcurrencyToken()
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<Guid>("User")
+                        .HasColumnType("uuid");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("User")
+                        .IsUnique();
+
+                    b.ToTable("UserTotpEnrollmentEntity");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentVersionId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallToolEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany("Tools")
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ApiKey.ApiKeyEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Owner")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorAgentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany("ScopedAgents")
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyResult.CustomAnomalyResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AgentCallId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("DetectorId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Invite.InviteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("InvitedBy")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.MfaBackupCode.MfaBackupCodeEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Model.ModelEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Model")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Provider")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Notification.NotificationEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade);
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRun")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.AgentVersion.AgentVersionEntity", null)
+                        .WithMany()
+                        .HasForeignKey("AdoptedAgentVersionId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.OptimizationTheory.OptimizationTheoryEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ABTestRunId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.OptimizationProposal.OptimizationProposalEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ResultingProposalId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.PasswordResetToken.PasswordResetTokenEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("SystemEndpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectUserEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany("ProjectUsers")
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.ProjectSearchSettings.ProjectSearchSettingsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Project")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Session.SessionEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ProjectId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", null)
+                        .WithOne()
+                        .HasForeignKey("Proxytrace.Storage.Internal.Entities.Statistics.TestRunStatsEntity", "TestRunId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.EvaluationStatEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", null)
+                        .WithMany("EvaluationStats")
+                        .HasForeignKey("TestResultId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestCase.TestCaseEntity", null)
+                        .WithMany()
+                        .HasForeignKey("TestCase")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRun.TestRunEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Endpoint")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Group")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunGroup.TestRunGroupEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany()
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Restrict);
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEndpointEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.ModelEndpoint.ModelEndpointEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EndpointId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", null)
+                        .WithMany("ScheduleEndpoints")
+                        .HasForeignKey("ScheduleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Suite")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Agent.AgentEntity", null)
+                        .WithMany()
+                        .HasForeignKey("Agent")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEvaluatorEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.Evaluator.EvaluatorEntity", null)
+                        .WithMany()
+                        .HasForeignKey("EvaluatorId")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", null)
+                        .WithMany("TestSuiteEvaluators")
+                        .HasForeignKey("TestSuiteId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.UserTotpEnrollment.UserTotpEnrollmentEntity", b =>
+                {
+                    b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
+                        .WithMany()
+                        .HasForeignKey("User")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.AgentCall.AgentCallEntity", b =>
+                {
+                    b.Navigation("Tools");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.CustomAnomalyDetector.CustomAnomalyDetectorEntity", b =>
+                {
+                    b.Navigation("ScopedAgents");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", b =>
+                {
+                    b.Navigation("ProjectUsers");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestResult.TestResultEntity", b =>
+                {
+                    b.Navigation("EvaluationStats");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestRunSchedule.TestRunScheduleEntity", b =>
+                {
+                    b.Navigation("ScheduleEndpoints");
+                });
+
+            modelBuilder.Entity("Proxytrace.Storage.Internal.Entities.TestSuite.TestSuiteEntity", b =>
+                {
+                    b.Navigation("TestSuiteEvaluators");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/20260727163658_GrantPassthroughScopeToExistingApiKeys.cs b/Proxytrace.Storage/Migrations/20260727163658_GrantPassthroughScopeToExistingApiKeys.cs
new file mode 100644
index 000000000..4ca80aad6
--- /dev/null
+++ b/Proxytrace.Storage/Migrations/20260727163658_GrantPassthroughScopeToExistingApiKeys.cs
@@ -0,0 +1,55 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Proxytrace.Storage.Migrations
+{
+    /// <summary>
+    /// Grants the new <c>ApiKeyScopes.Passthrough</c> (32) to every existing key that can already use
+    /// the proxy, so upgrading does not break the documented "reach other upstream endpoints" setup.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Pass-through — relaying any method and any path to the provider's host with the organisation's
+    /// real upstream credential — used to be admitted by the <c>Ingestion</c> scope alone. It now has
+    /// its own scope, because its reach differs in kind from capturing inference traffic and is
+    /// neither detected, traced, nor audited.
+    /// </para>
+    /// <para>
+    /// <b>No schema change: this migration is data only.</b> Existing keys keep exactly the behaviour
+    /// they have today (grandfathered), while newly minted keys must request the scope explicitly —
+    /// so least privilege applies going forward without an upgrade breaking anyone mid-flight.
+    /// </para>
+    /// <para>
+    /// Scoped to keys holding <c>Ingestion</c> (1): a key that cannot reach the proxy at all has no
+    /// use for pass-through, and granting it would widen that key for no reason.
+    /// </para>
+    /// </remarks>
+    public partial class GrantPassthroughScopeToExistingApiKeys : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql(
+                """
+                UPDATE "ApiKeyEntity"
+                SET "Scopes" = "Scopes" | 32
+                WHERE ("Scopes" & 1) = 1 AND ("Scopes" & 32) = 0;
+                """);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            // Clearing the bit is the exact inverse. A key granted the scope deliberately after this
+            // migration ran also loses it, which is the correct behaviour for reverting to a schema
+            // where the scope does not exist.
+            migrationBuilder.Sql(
+                """
+                UPDATE "ApiKeyEntity"
+                SET "Scopes" = "Scopes" & ~32
+                WHERE ("Scopes" & 32) = 32;
+                """);
+        }
+    }
+}
diff --git a/Proxytrace.Storage/Migrations/StorageDbContextModelSnapshot.cs b/Proxytrace.Storage/Migrations/StorageDbContextModelSnapshot.cs
index ffd2ddeeb..085ff0df4 100644
--- a/Proxytrace.Storage/Migrations/StorageDbContextModelSnapshot.cs
+++ b/Proxytrace.Storage/Migrations/StorageDbContextModelSnapshot.cs
@@ -17,7 +17,7 @@ protected override void BuildModel(ModelBuilder modelBuilder)
         {
 #pragma warning disable 612, 618
             modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.9")
+                .HasAnnotation("ProductVersion", "10.0.10")
                 .HasAnnotation("Relational:MaxIdentifierLength", 63);
 
             NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
@@ -689,8 +689,8 @@ protected override void BuildModel(ModelBuilder modelBuilder)
 
                     b.Property<string>("CodeHash")
                         .IsRequired()
-                        .HasMaxLength(64)
-                        .HasColumnType("character varying(64)");
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
 
                     b.Property<DateTimeOffset?>("ConsumedAt")
                         .HasColumnType("timestamp with time zone");
@@ -796,8 +796,8 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                         .HasColumnType("text");
 
                     b.Property<string>("ApiKeyLookupHash")
-                        .HasMaxLength(64)
-                        .HasColumnType("character varying(64)");
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
 
                     b.Property<DateTimeOffset>("CreatedAt")
                         .HasColumnType("timestamp with time zone");
@@ -1486,6 +1486,9 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.Property<bool>("IsSystemRun")
                         .HasColumnType("boolean");
 
+                    b.Property<DateTimeOffset?>("OptimizationConsideredAt")
+                        .HasColumnType("timestamp with time zone");
+
                     b.Property<int>("SampleCount")
                         .ValueGeneratedOnAdd()
                         .HasColumnType("integer")
@@ -1510,6 +1513,8 @@ protected override void BuildModel(ModelBuilder modelBuilder)
 
                     b.HasIndex("Suite");
 
+                    b.HasIndex("OptimizationConsideredAt", "IsSystemRun", "Status");
+
                     b.ToTable("TestRunGroupEntity");
                 });
 
@@ -1765,7 +1770,7 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.HasOne("Proxytrace.Storage.Internal.Entities.User.UserEntity", null)
                         .WithMany()
                         .HasForeignKey("Owner")
-                        .OnDelete(DeleteBehavior.Cascade)
+                        .OnDelete(DeleteBehavior.Restrict)
                         .IsRequired();
 
                     b.HasOne("Proxytrace.Storage.Internal.Entities.Project.ProjectEntity", null)
@@ -1777,7 +1782,7 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.HasOne("Proxytrace.Storage.Internal.Entities.ModelProvider.ModelProviderEntity", null)
                         .WithMany()
                         .HasForeignKey("Provider")
-                        .OnDelete(DeleteBehavior.Cascade)
+                        .OnDelete(DeleteBehavior.Restrict)
                         .IsRequired();
                 });
 
diff --git a/Proxytrace.Storage/Module.cs b/Proxytrace.Storage/Module.cs
index 119877427..405d78277 100644
--- a/Proxytrace.Storage/Module.cs
+++ b/Proxytrace.Storage/Module.cs
@@ -248,6 +248,15 @@ private static void ConfigureEntity(Type storedEntityType, ContainerBuilder buil
             // opt-in in-memory cache for slow-changing reference data
             if (storedEntityType.GetCustomAttribute<CacheableAttribute>() != null)
             {
+                // The invalidation registry is a singleton; the cache that consults it is NOT.
+                // Cached domain entities hold the repository they were materialized from, which
+                // closes over its resolving lifetime scope — caching them in the root container
+                // would hand out entities bound to a disposed request scope (fc4b5f72). Keeping
+                // the entries scope-local and the *versions* process-wide gives cross-scope
+                // write-through invalidation without reintroducing that. See EntityCacheVersions.
+                Type versionsType = typeof(EntityCacheVersions<>).MakeGenericType(domainEntityType);
+                builder.RegisterType(versionsType).AsSelf().SingleInstance();
+
                 Type cacheImpl = typeof(EntityCache<>).MakeGenericType(domainEntityType);
                 Type cacheInterface = typeof(IEntityCache<>).MakeGenericType(domainEntityType);
                 builder.RegisterType(cacheImpl).As(cacheInterface).InstancePerLifetimeScope();
@@ -265,12 +274,20 @@ private static void ConfigureStorage(DbContextOptionsBuilder options, StorageCon
                     (RelationalEventId.CommandExecuted, LogLevel.Debug),
                     (RelationalEventId.ConnectionClosed, LogLevel.Debug));
 
-                // Suppress pending model changes warning across all providers.
-                // The snapshot generated by EF Core 10 tools can diverge from the runtime
-                // model in metadata-only ways (e.g. explicit Schema=null annotations, Npgsql
-                // column type conventions) without actual schema differences. All real schema
-                // changes have a corresponding migration; this suppression only hides the
-                // cosmetic metadata mismatch that the tools and runtime resolve differently.
+                // Suppress the pending-model-changes warning across all providers.
+                //
+                // EF raises this at Migrate() time and treats it as an error, so an un-migrated
+                // model change does not merely warn — it stops the application from starting, at a
+                // customer's deployment, where nobody can fix it. The snapshot generated by the
+                // EF Core 10 tools can also diverge from the runtime model in metadata-only ways
+                // (explicit Schema=null annotations, Npgsql column type conventions) that are not
+                // schema differences at all, which would turn a cosmetic mismatch into an outage.
+                //
+                // Suppressing it here does NOT mean drift goes undetected: MigrationDriftTests
+                // asserts HasPendingModelChanges() is false against the relational model, which is
+                // the same comparison Migrate() performs. Drift therefore fails CI — in front of
+                // the people who can add the migration — rather than a production boot. Do not
+                // remove this suppression without keeping that test.
                 b.Ignore(RelationalEventId.PendingModelChangesWarning);
 
                 // The in-memory provider has no real transactions; silence the warning so the
diff --git a/Proxytrace.Storage/StorageDbContextFactory.cs b/Proxytrace.Storage/StorageDbContextFactory.cs
index fa7e686fb..71acf39c1 100644
--- a/Proxytrace.Storage/StorageDbContextFactory.cs
+++ b/Proxytrace.Storage/StorageDbContextFactory.cs
@@ -53,7 +53,7 @@ public StorageDbContext CreateDbContext(string[] args)
         // lean proxy host, which resolves the same storage graph with the same stubs (see
         // Proxytrace.Proxy.Module / #270).
         var designTimeSecrets = new DesignTimeSecretSeam();
-        containerBuilder.RegisterInstance(designTimeSecrets).As<ISecretProtector>().As<ISecretHasher>();
+        containerBuilder.RegisterInstance(designTimeSecrets).As<ISecretProtector>().As<ISecretHasher>().As<ISecretIndexer>();
         containerBuilder.RegisterType<DesignTimeAgentNameGenerator>().As<IAgentNameGenerator>().SingleInstance();
         containerBuilder.RegisterType<DesignTimeProviderClient>().As<IProviderClient>();
 
@@ -69,13 +69,19 @@ public StorageDbContext CreateDbContext(string[] args)
     /// configurations but never runs their value converters, so the real Data Protection-backed
     /// implementations (Proxytrace.Infrastructure.Security) are not needed by <c>dotnet ef</c> tooling.
     /// </summary>
-    private sealed class DesignTimeSecretSeam : ISecretProtector, ISecretHasher
+    private sealed class DesignTimeSecretSeam : ISecretProtector, ISecretHasher, ISecretIndexer
     {
         public string Protect(string plaintext) => plaintext;
 
         public string Unprotect(string ciphertext) => ciphertext;
 
         public string Hash(string value) => value;
+
+        public string Index(string value) => value;
+
+        public string LegacyIndex(string value) => value;
+
+        public bool IsKeyed => false;
     }
 
     /// <summary>
diff --git a/dev.sh b/dev.sh
index 202a7b15b..96f0d8c29 100755
--- a/dev.sh
+++ b/dev.sh
@@ -75,9 +75,14 @@ if [ "$SPLIT" = "1" ]; then
         ConnectionStrings__Default="$PG_CONN" \
         dotnet run --urls "http://localhost:5002") &
 else
-    # Start backend in development mode (single-process kiosk demo)
+    # Start backend in development mode (single-process kiosk demo). Kiosk is opted into
+    # explicitly here: appsettings.json ships Kiosk:Enabled=false so a plain `dotnet run` of the
+    # published app never silently boots the login-free demo handler.
     echo "Starting backend on http://localhost:5001 ..."
-    (cd "$REPO_ROOT/Proxytrace.Api" && ASPNETCORE_ENVIRONMENT=Development dotnet run --urls "http://localhost:5001") &
+    (cd "$REPO_ROOT/Proxytrace.Api" && \
+        ASPNETCORE_ENVIRONMENT=Development \
+        Kiosk__Enabled=true \
+        dotnet run --urls "http://localhost:5001") &
 fi
 
 # Give the backend a moment to bind its port before the frontend proxy tries to connect
diff --git a/docker-compose.e2e.yml b/docker-compose.e2e.yml
index a76ec5acf..fa9f604ed 100644
--- a/docker-compose.e2e.yml
+++ b/docker-compose.e2e.yml
@@ -39,6 +39,12 @@ services:
       # E2e specs seed data and immediately assert it on the dashboard; the server-side dashboard
       # cache (default 10s) would serve a pre-seed payload and flake those assertions. Disable it.
       - Statistics__DashboardCacheTtlSeconds=0
+      # Every spec authenticates its own ProxytraceApiClient, so a run drives ~80 real logins in a
+      # few minutes — and they all arrive from one source address, which is precisely the partition
+      # the per-IP auth-login limiter counts. The whole suite therefore shares a single 30/min
+      # bucket and the tail of the run 429s. Lift the budget for the test stack only; the shipped
+      # default in appsettings.json is untouched. See AuthRateLimiterConfigurator.
+      - RateLimiting__Login__PermitLimit=100000
       # Throwaway Enterprise license signed (ES256, kid 2026-05) with the TEST private key.
       # This stack's images are built with the LICENSE_PUBLIC_KEY build-arg baking in the
       # matching test public key (see docs/licensing.md). Official release images embed the
@@ -113,6 +119,8 @@ services:
       - TestSupport__Enabled=true
       # Same as `api`: keep e2e dashboard assertions deterministic (no server-side cache).
       - Statistics__DashboardCacheTtlSeconds=0
+      # Same as `api`: the `licensing` project's logins all share one rate-limit partition.
+      - RateLimiting__Login__PermitLimit=100000
       # Share the SAME Data Protection key ring as `api` (mounts the same appdata volume below).
       # api-free reads the shared Postgres DB, so it must decrypt secrets (provider keys, protected
       # columns) the primary `api` encrypted — its own ephemeral key ring would throw
diff --git a/docs/architecture.md b/docs/architecture.md
index a2aac2346..a871354ba 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -56,7 +56,7 @@ Your Agent ──► Proxytrace.Proxy.Api ──► Upstream LLM provider
          Application ingestion worker ──► AgentCallIngestor ──► Storage
 ```
 
-`PublishAsync` is **fire-and-forget on the proxy hot path** — keep it cheap and never rely on it to surface processing errors. The consumer must `AckAsync` each `IngestEnvelope` only after processing succeeds. Recovery from a retryable failure depends on the transport (`IIngestionStream.RedeliversUnacknowledged`): Redis Streams redeliver unacknowledged envelopes, so the worker leaves the entry pending and caps redelivery attempts; the in-process channel drops anything unacked, so the worker retries inline (bounded) instead — otherwise a retryable failure would silently lose the captured call.
+`PublishAsync` is **fire-and-forget on the proxy hot path** — keep it cheap and never rely on it to surface processing errors. "Cheap" is a real constraint, not a wish: the proxy `await`s the publish inside the `finally` of both response paths with `CancellationToken.None`, so anything slow there is added to every proxied response and a client abort cannot release it. The Redis multiplexer is built with `AbortOnConnectFail = false`, which means a command issued while Redis is down is *backlogged* until its async timeout (~5s) instead of failing fast — so `RedisIngestionStream.PublishAsync` short-circuits on `IConnectionMultiplexer.IsConnected` and **drops the capture with a warning** rather than stalling the response (the same guard `GetQueueDepthAsync` uses). Keep that guard in front of any new command you put on this path. The consumer must `AckAsync` each `IngestEnvelope` only after processing succeeds. Recovery from a retryable failure depends on the transport (`IIngestionStream.RedeliversUnacknowledged`): Redis Streams redeliver unacknowledged envelopes, so the worker leaves the entry pending and caps redelivery attempts; the in-process channel drops anything unacked, so the worker retries inline (bounded) instead — otherwise a retryable failure would silently lose the captured call.
 
 **What counts as retryable.** `AgentCallProcessor.IsRetryable` is the single place that decides whether a failed ingest is requeued/retried or dropped as poison, and *dropped means the captured trace is gone for good*. Retryable = anything transient: EF Core's `DbUpdateException`/`DbUpdateConcurrencyException` (unique-index races), ADO.NET `DbException` (connectivity, deadlocks), and the domain-level `OptimisticConcurrencyException` raised by `AbstractRepository`'s own concurrency pre-check before EF sees the write. That last one matters because ingestion *mutates the agent* (endpoint, model parameters, current version), so a burst of calls for one agent genuinely collides — and a lost race is exactly the case a retry fixes. Everything else (malformed payload, validation failure, missing referenced entity) is poison and is dropped. When you add a write to the ingest path, check that the exceptions it can raise land on the right side of this line.
 
@@ -75,3 +75,36 @@ DI is wired with Autofac. Each project ships a `Module : Autofac.Module` (`Proxy
 `Proxytrace.Application.Module` registers the hosted services for ingestion + test running plus the optimization sub-module. `Proxytrace.Storage.Module` takes a `Func<IServiceProvider, StorageConfiguration>` (the configuration is auto-detected by `Proxytrace.Api.Module`) plus a `registerApplicationServices` flag (default `true`).
 
 **The `registerApplicationServices` flag.** When `true` — the API/app host and the test/perf harnesses (`Storage.Tests`, `Domain.Tests`, `Application.Tests`, the perf harness) — `Storage.Module` registers Storage's own startup/initialization hosted services: the DB-initializer (`IDatabaseInitializer`) plus the secret/preview backfill services. The standalone **proxy host** (`Proxytrace.Proxy.Api`) passes `false`: it attaches to an already-migrated database read-only and runs no schema init or backfills. Since [#270](https://github.com/SyntaktikEU/Proxytrace/issues/270), `Storage.Module` no longer references or registers `Application.Module` (the flag's name is historical) — each composition root that needs the Application graph (the API host plus the four `Storage.Tests` / `Domain.Tests` / `Application.Tests` / perf harnesses) registers `Application.Module` **and** the at-rest secret seam (`Infrastructure.Security.SecretProtectionModule`) explicitly. The API root's registrations are idempotent (the `IfNotRegistered`/`builder.Properties` guards make any double registration a no-op).
+
+## Multi-tenant list scoping (`IProjectAccessGuard`)
+
+Every resource belongs to an `IProject`; users belong to projects via `Project.Members`, and the
+`Admin` role bypasses membership. Controllers never trust a raw route/query id — they resolve the
+owning project of what they are about to read or mutate and ask
+[`IProjectAccessGuard`](../Proxytrace.Api/Auth/IProjectAccessGuard.cs) (the IDOR fix, #193).
+
+For a **single resource**, use `CanAccessProjectAsync` and hide a denial behind a `404`.
+
+For a **list endpoint** with an optional `projectId` filter, use the
+`ResolveListScopeAsync(projectId)` extension in
+[`Proxytrace.Api/Auth/ProjectListScope.cs`](../Proxytrace.Api/Auth/ProjectListScope.cs) — **not**
+`GetAccessibleProjectIdsAsync` directly. It returns the projects the query must be restricted to:
+
+| Result | Meaning | What the endpoint does |
+|---|---|---|
+| `null` | every project (an admin, unfiltered) | run the unscoped query |
+| empty | nothing | return an empty result without querying |
+| one id | that project | run the existing indexed by-one-project query (`SingleProject()`) |
+| several ids | the caller's memberships | filter the query by the set |
+
+The set case is what makes an **unfiltered** request from a non-admin return that caller's own rows
+instead of an empty page (#482 — the callers who hit it were REST API keys and MCP, which are
+confined to one project and so have no reason to send a `projectId`). It must be applied *inside*
+the query: paging has to be computed over the union, so a paged endpoint needs a set-aware
+repository method (`GetByProjectsPagedAsync`) rather than merging per-project pages. `ToFilterScope()`
+splits a scope into the `(ProjectId, ProjectIds)` pair `AgentCallFilter` takes, so the hot traces
+query keeps its equality predicate whenever the scope names a single project.
+
+Aggregates built on `StatisticsFilter` still take a single project. `StatisticsController` refuses an
+unscoped non-admin request with `403` (an explicit contract, not a silent empty page); the traces
+overview returns empty for a multi-project scope rather than aggregating across tenants (#483).
diff --git a/docs/ci.md b/docs/ci.md
index 02544fdcf..18a069847 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -7,7 +7,7 @@ workflow, or changing a build cache — the gating rules below are not obvious f
 
 | Workflow | Trigger | What it does |
 |---|---|---|
-| `ci.yml` | PR, master push, `workflow_call` | Secret scan, frontend lint/build, backend build+test, all-in-one image build + boot smoke test |
+| `ci.yml` | PR, master push, `workflow_call` | Secret scan, frontend lint/test/build, backend build+test, all-in-one image build + boot smoke test |
 | `e2e.yml` | PR, master push, `workflow_call` | Boots the full Docker stack and runs the Playwright suite |
 | `codeql.yml` | PR, master push, weekly | Static analysis; findings land in the Security tab |
 | `cache-cleanup.yml` | PR closed | Deletes the closed PR's Actions caches |
@@ -22,7 +22,7 @@ Jobs are gated on which areas a diff touches, computed by the local composite ac
 | Job | PR | master push | Release gate |
 |---|---|---|---|
 | `secrets` | always | skipped | always |
-| `frontend` | if `frontend/**` changed | skipped | always |
+| `frontend` | if `frontend/**` changed | if `frontend/**` changed | always |
 | `backend` | if .NET sources changed | if .NET sources changed | always |
 | `image` | if backend/frontend/`deploy/**`/Dockerfiles changed | skipped | always |
 | e2e | unless the diff is purely prose | unless the diff is purely prose | always |
@@ -30,10 +30,12 @@ Jobs are gated on which areas a diff touches, computed by the local composite ac
 
 Three rules explain the table:
 
-- **master keeps `backend` and e2e as a post-merge safety net.** A PR is verified against the base
-  it was opened on; if master moved underneath it, the merge can still break. Tests are what catch
-  that. Lint, packaging and the secret scan cannot regress from merge order alone, so the PR run is
-  the only time they need to run.
+- **master keeps `frontend`, `backend` and e2e as a post-merge safety net.** A PR is verified
+  against the base it was opened on; if master moved underneath it, the merge can still break. Tests
+  are what catch that — both the .NET suite and the frontend's Vitest suite, which is why `frontend`
+  is no longer PR-only. Its lint and build steps ride along on the same `npm ci` rather than paying
+  for a second install; packaging and the secret scan cannot regress from merge order alone, so the
+  PR run is the only time they need to run.
 - **e2e is barely gated on purpose.** 98% of merges touch backend or frontend, so a path filter
   would almost never skip it and skipping it wrongly is expensive. Only a diff that is entirely
   `docs/**`, `manual/**` or `**.md` misses it, via `paths-ignore`.
diff --git a/docs/code-style.md b/docs/code-style.md
index f5dbf66df..b87408d2e 100644
--- a/docs/code-style.md
+++ b/docs/code-style.md
@@ -49,6 +49,14 @@
   buys no safety. This is rare and must be justified with a comment pointing here. Current sanctioned
   uses: the Lucene index writer/indexing service (`Proxytrace.Application/Search/Internal`), which
   serialize synchronous Lucene operations. Everything else uses `IAsyncLock`.
+- **Second narrow exception — counting, not excluding.** `IAsyncLock` grants *one* holder per key, so
+  it cannot express "at most N concurrently". Where the requirement is a **concurrency limit** rather
+  than mutual exclusion, `SemaphoreSlim` is the correct primitive and is permitted, with a comment
+  pointing here. Current sanctioned use: `TestRunnerService.modelCallGate`, which caps in-flight
+  upstream model calls at `TestRunnerConfiguration.MaxDegreeOfParallelism` across the three nested
+  `Parallel.ForEachAsync` loops (which otherwise multiply that setting rather than respecting it).
+  A limiter must never be held while acquiring another lock — the gate is released before a test
+  case's evaluators run, so the nesting cannot deadlock.
 - `IAsyncLock` is **keyed**: `LockAsync(key, ct)` serializes only callers sharing the same `key`,
   so use the narrowest natural key (e.g. an entity `Id`, a fingerprint) to avoid serializing
   unrelated work. Pass the `CancellationToken` through.
diff --git a/docs/commands.md b/docs/commands.md
index 290cddc65..60ff4f967 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -4,11 +4,16 @@
 ```bash
 dotnet restore Proxytrace.sln          # Restore packages
 dotnet build Proxytrace.sln            # Build all projects
-dotnet test Proxytrace.sln             # Run all tests
-dotnet test Proxytrace.Domain.Tests    # Run a single test project
+dotnet test Proxytrace.Domain.Tests    # Run a single test project (the default — see below)
+dotnet test Proxytrace.Domain.Tests --filter "FullyQualifiedName~TestRunGroup"   # one class/area
+dotnet test Proxytrace.sln             # Run all tests (cross-cutting changes / releases only)
 cd Proxytrace.Api && dotnet run        # Start API on http://localhost:5001
 ```
 
+**Scope your test runs.** The full solution run is ~2,200 tests across 10 projects and CI runs it on
+every push — locally, run only the projects (or classes) affected by your change. See
+[`testing.md`](testing.md#which-tests-to-run) for the mapping from changed code to test project.
+
 Swagger UI is available at `http://localhost:5001/swagger` in Development mode.
 
 The dev backend port is **5001** everywhere: `launchSettings.json`, `dev.sh`, the `Self:BaseUrl`
@@ -29,7 +34,8 @@ See [`database.md`](database.md) for full migration details.
 npm install
 npm run dev         # Dev server on http://localhost:4201
 npm run build       # Production build
-npm test            # Vitest unit tests
+npm test -- src/features/playground   # Vitest, scoped to the touched files (preferred)
+npm test            # Vitest, all ~96 spec files (~3s — cheap enough to be the final check)
 ```
 
 ## All-in-one dev mode
diff --git a/docs/database.md b/docs/database.md
index 5891d503c..1474d7de8 100644
--- a/docs/database.md
+++ b/docs/database.md
@@ -351,6 +351,40 @@ commit**, queuing the second call through `AmbientDbContext.RegisterPostCommit`
 `Notify` uses for change events. Every write path (add, add-range, update, upsert, remove,
 remove-all, archive/unarchive, and bypass writes such as `AgentRepository.SetCurrentVersionIdAsync`)
 goes through those two helpers; do not call `cache?.Invalidate(...)` directly.
+
+## Schema drift is caught by a test, not at startup
+
+`RelationalEventId.PendingModelChangesWarning` is suppressed in `Storage.Module`. EF raises it from
+`Migrate()` and treats it as an **error**, so an un-migrated model change would stop the app from
+booting on a customer's deployment — and the EF Core 10 tools can produce snapshot/runtime
+divergences that are metadata-only, turning a cosmetic mismatch into an outage.
+
+The safety net lives in `MigrationDriftTests` instead: it asserts `HasPendingModelChanges()` is
+`false` against the Npgsql model — the same comparison `Migrate()` makes — so drift fails CI, in
+front of whoever can add the migration. **If you change an EF model without adding a migration, that
+test goes red.** Do not remove the suppression without keeping the test, and do not weaken the test
+to make a model change pass; add the migration.
+
+### The cache is per-scope; its invalidation is process-wide
+
+`IEntityCache<T>` is registered **`InstancePerLifetimeScope`**, not as a singleton, and that is
+deliberate: a cached domain entity holds the `IRepository<TSelf>` it was materialized from (see
+`DomainEntity<TSelf>`), and that repository's `Func<StorageDbContext>` closes over the lifetime scope
+it was resolved in. A root-container cache would therefore hand later callers entities whose
+repository points at a **disposed** request scope, so `UpdateAsync`/`ReloadAsync` on them would throw.
+
+Scope-local caches on their own, however, made write-through invalidation scope-local too — a real
+defect, because singleton services (notably the ingestion executor) resolve their repositories, and
+so their cache, from the **root** scope, while an admin's write invalidates only its own **request**
+scope. Rotating a provider's upstream API key left ingestion authenticating with the stale key for up
+to the full TTL.
+
+The two requirements are separated: the cached **instances** stay scope-local, while each entry's
+**validity** is decided by `EntityCacheVersions<T>`, a **singleton** counter shared by every scope. A
+write bumps the counter, and every scope's copy of that entry misses on its next read.
+`EntityCacheVersions` bounds its per-id map; dropping a version fails safe, since a forgotten id reads
+back as version 0 and no live entry can match it. When adding a cacheable entity you get both
+registrations automatically — do not "fix" the cache's lifetime to `SingleInstance`.
 The `AddEmailSettings` migration adds the `EmailSettingsEntity` table: the single-row operator
 SMTP/email configuration (mirrors the `StoredLicenseEntity` single-row pattern). Columns: `Id` uuid
 PK, `Enabled` boolean, `SmtpHost` / `FromAddress` / `FromName` non-nullable text, `SmtpPort`
diff --git a/docs/domain-entities.md b/docs/domain-entities.md
index 6689da724..b6590d05d 100644
--- a/docs/domain-entities.md
+++ b/docs/domain-entities.md
@@ -52,7 +52,15 @@ The boundary is sharp: **domain layer references the full entity, storage layer
 
 - **1:N** — domain holds the parent as `IModelEndpoint SystemEndpoint { get; }`; storage holds `Guid SystemEndpoint`; mapper resolves the parent via the parent's repository in `Map(stored, ct)`. Configure with `HasOne<ModelEndpointEntity>().WithMany().HasForeignKey(e => e.SystemEndpoint).OnDelete(DeleteBehavior.Restrict)`.
 - **N:M** — domain holds `IReadOnlyCollection<IEvaluator> Evaluators { get; }`; storage uses a junction entity (e.g. `TestSuiteEvaluatorEntity` with `TestSuiteId`/`EvaluatorId`) and a navigation collection on the parent storage entity. Junction entities have **no domain counterpart** and are registered explicitly in `Proxytrace.Storage.Module`. The custom repository overrides `UpdateRelationsAsync` to sync the junction rows during `Update` (see `TestSuiteRepository`).
-- **Delete behavior** — `Restrict` for optional references, `Cascade` for owned children.
+- **Delete behavior** — `Restrict` for optional references, `Cascade` for owned children. **A row
+  that cannot be recreated is never an "owned child", however strong the ownership reads.**
+  `ApiKey → ModelProvider` and `ApiKey → User` were both `Cascade` on exactly that reasoning ("the
+  key acts as its owner, so it cannot outlive them") — but only the key's *hash* is stored, so the
+  cascade did not detach a key, it destroyed one: hard-deleting a provider, or offboarding an admin
+  who had minted an integration key, silently revoked credentials that can never be recovered, and
+  the failure surfaced later as unexplained 401s. Both are now `Restrict`, with
+  `UserAdministrationService` turning the resulting FK violation into a 409 naming the keys to
+  delete or reassign first. Ask "can this row be recreated?" before choosing `Cascade`.
 - **FK-free (denormalized snapshot)** — an entity that must **survive deletion of what it points at**
   deliberately holds **no** FK: it stores the referenced id as a plain `Guid?` column, so the row
   outlives its referent. `AuditLogEntry` is the reference example (`ActorUserId`, `ProjectId`,
diff --git a/docs/licensing.md b/docs/licensing.md
index b35142561..d288b45ba 100644
--- a/docs/licensing.md
+++ b/docs/licensing.md
@@ -99,6 +99,22 @@ JWT carries one extra claim, `offline` (a JSON boolean), and the server emits it
 
 ## Notes on specific gates
 
+- **`MaxTracesPerMonth`** is an **installation-wide** limit whose *enforcement* is **per project**
+  (`TraceQuotaGuard` / `ITraceQuotaGuard.IsOverQuota`). Enforcing it as one global switch — the
+  original shape — meant a single busy project could consume the whole month's allowance and
+  silently stop capture for every other project. The guard therefore also counts per project and
+  drops only for projects at or above their **equal share** of the cap; because the total is at or
+  over the cap, at least one project must be above its share, so the licence still binds while quiet
+  projects keep capturing.
+  Two further properties are load-bearing and should not be dropped in a refactor:
+  - **A drop is never silent.** The captured call is still acked to the client (failing the proxied
+    request would take the caller's application down over a billing limit), so the guard raises a
+    `NotificationKind.TraceQuotaReached` notification per project as it starts being throttled, and
+    logs at **Error** — the level the operator Error Log captures. Entering the state is reported
+    once per month, not on every recompute.
+  - **Polling tightens near the cap.** The recompute interval drops from 5 minutes to 30 seconds
+    once usage passes 90% of the limit; at the flat 5-minute interval a busy install could ingest a
+    long way past its cap before the flag flipped.
 - **`AgenticEvaluators`** is enforced at *use* time, not creation time. Default agentic evaluators
   are provisioned for every project regardless of tier (`IDefaultEvaluatorProvisioner`); the gate
   applies in two places: (1) `TestRunnerService` skips agentic evaluators during a run when the
diff --git a/docs/mcp.md b/docs/mcp.md
index 3e3b76b4a..74f540141 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -89,6 +89,18 @@ scope pair from MCP, kept least-privilege:
   Like the MCP handler it stashes the owner id so `ICurrentUserAccessor` attributes the call to the
   owner, and the key id under the same item key the audit actor accessor reads — attribution comes for
   free (`AuditActorType.ApiKey`).
+- **The key is confined to its own project**, and this is load-bearing, not cosmetic. The handler
+  stashes `apiKey.Project.Id` under `ApiKeyAuthenticationHandler.ProjectIdItemKey`, and
+  `ProjectAccessGuard` intersects **every** access decision with it — `CanAccessProjectAsync` denies a
+  different project outright, and `GetAccessibleProjectIdsAsync` collapses the admin "all projects"
+  `null` to just that one id. Without this the key acts purely as its owner, and because
+  `POST /api/providers/{id}/keys` is admin-only the owner is normally an **Admin**, whose role alone
+  satisfies the guard for every project in the instance — so a key minted for one project could read
+  and (with `ApiWrite`) mutate all of them, contradicting the contract the UI and
+  `manual/admin/providers-and-api-keys.md` advertise. A claim is **not** sufficient here: the
+  `"project"` claim these handlers used to emit was read by nothing. Pin new scoping on the
+  `HttpContext.Items` entry the guard actually consults, exactly as MCP does with
+  `McpProjectAccessor.ProjectIdItemKey`.
 - The **default** authorization policy (`Module.ConfigureAuth`, non-kiosk) accepts the `ApiKey` scheme
   **alongside** JwtBearer and carries an `ApiKeyScopeRequirement`. `ApiKeyScopeHandler` enforces the
   read/write split **by HTTP method** for API-key callers only: safe methods (`GET`/`HEAD`/`OPTIONS`)
diff --git a/docs/mfa.md b/docs/mfa.md
index efe6cc8ee..098051465 100644
--- a/docs/mfa.md
+++ b/docs/mfa.md
@@ -71,8 +71,30 @@ single `IUserTotpEnrollmentRepository.ListConfirmedUserIdsAsync` query.
 - **`IUserTotpEnrollment`** — `User`, `Secret` (encrypted at rest via `ISecretProtector` in the storage
   mapper, like `ModelProvider.ApiKey`), `ConfirmedAt`, `LastUsedStep`. Unique index on `User`
   (one enrollment per user), FK cascade-deletes with the user.
-- **`IMfaBackupCode`** — `User`, `CodeHash` (SHA-256 via `ISecretHasher`), `ConsumedAt`. ~10 per user,
-  unique index on `CodeHash`, FK cascade.
+- **`IMfaBackupCode`** — `User`, `CodeHash` (**salted PBKDF2 via `IPasswordService`**), `ConsumedAt`.
+  10 per user, unique index on `CodeHash`, FK cascade.
+
+### Backup codes are hashed like passwords, not like Proxytrace-generated secrets
+
+`ISecretHasher` (unkeyed single-round SHA-256) is correct for the 256-bit CSPRNG secrets Proxytrace
+mints itself, and **wrong** here. A backup code is 10 characters over a 32-symbol alphabet ≈ **50
+bits** — deliberately small enough for a human to read off a card and type. Under one unsalted
+single-round hash, 50 bits is within reach of a GPU rig, and because every installation hashed with
+the same function, a single dump could be attacked against **every user's codes at once**. They
+therefore go through `IPasswordService` (PBKDF2, per-code salt): the salt removes the shared work,
+the iteration count removes the throughput.
+
+Two consequences follow from the salt:
+
+- **There is no hash to look a code up by.** `MfaService` loads the user's unconsumed codes and
+  verifies them one at a time (bounded by the 10-code batch, and only reached after a TOTP code has
+  already failed — never on a normal login). `IMfaBackupCodeRepository.FindByCodeHashAsync` is
+  meaningful only for the legacy scheme.
+- **Codes issued before the change cannot be upgraded in place.** The raw code is unrecoverable, so
+  a stored hash could only be re-hashed at the moment it is redeemed — and redeeming consumes it.
+  `MfaService` detects the legacy 64-char hex form and verifies against it, so existing codes keep
+  working; they age out as they are used, or when the user re-enrolls. Every newly issued batch gets
+  the stronger hash.
 
 **Disable removes rows via per-row `RemoveAsync`, never a bulk `ExecuteDelete`** — the in-memory
 provider (tests + kiosk) breaks on bulk deletes.
diff --git a/docs/optimization-loop.md b/docs/optimization-loop.md
index 5e6df6908..eaf05f35d 100644
--- a/docs/optimization-loop.md
+++ b/docs/optimization-loop.md
@@ -200,10 +200,12 @@ concurrent-validation quota (`TheorySubmissionOutcome`: `Accepted` / `Duplicate`
 is in-memory; on startup the service re-queues every theory still `Proposed`/`Validating`
 (`IOptimizationTheoryRepository.GetActiveAsync`) so a restart cannot strand the backlog.
 Recovery is skipped in kiosk mode: kiosk storage is in-memory and freshly demo-seeded on
-every boot, so the only backlog it could find is the seeded `Proposed`/`Validating` demo
-theories — re-queuing those would trigger real A/B runs (LLM spend) on every kiosk start
-when a live `Kiosk:Endpoint` is configured. Theories submitted during a kiosk session still
-validate normally via `SubmitAsync`:
+every boot, so the only backlog it could find is the seeded `Proposed` demo theories —
+re-queuing those would trigger real A/B runs (LLM spend) on every kiosk start when a live
+`Kiosk:Endpoint` is configured. The flip side is that a seeded theory never advances, so
+the demo seed leaves **no** theory in `Validating`: it would render as a permanently
+pulsing "A/B in flight" row. Theories submitted during a kiosk session still validate
+normally via `SubmitAsync`:
 
 | Validator | File |
 |---|---|
@@ -213,7 +215,7 @@ validate normally via `SubmitAsync`:
 | System-prompt theory | `.../Validation/SystemPromptTheoryValidator.cs` |
 | Tool-update theory | `.../Validation/ToolUpdateTheoryValidator.cs` |
 | Model-switch theory | `.../Validation/ModelSwitchTheoryValidator.cs` |
-| Two-proportion stats / p-value | `.../Validation/ProportionStats.cs` |
+| Paired significance test / p-value | `.../Validation/ProportionStats.cs` |
 | Evidence assembly | `Optimization/Internal/Evidence/OptimizerEvidenceBuilder.cs` |
 
 Validation runs the **baseline and candidate fresh, back to back**, against the same suite and
@@ -224,19 +226,84 @@ agent on the alternate endpoint. The candidate run is linked to the theory while
 via the `CandidateRunObserver` callback, and is flagged `isSystemTestRun` so it stays out of the
 user's run list.
 
-Each arm runs `OptimizationOptions.AbSampleCount` times (default **3**) and the samples are
-**pooled** — passes and totals summed across them — before the significance test. One sample per arm
-caps the evidence at the suite's case count, which on a small suite cannot resolve anything but an
-enormous effect: an 11-case suite improving 5/11 → 8/11 lands at p≈0.19 and is discarded, while the
-same effect pooled over three samples (15/33 → 24/33) is significant. The cost is proportional —
+Each arm runs `OptimizationOptions.AbSampleCount` times (default **3**). The cost is proportional —
 each extra sample is another full suite run per arm.
 
+#### The significance test is paired on the test case, not pooled over replays
+
+This is worth understanding before changing anything here, because the obvious implementation is
+wrong in a direction that always errs toward accepting.
+
+The samples used to be **pooled**: passes and totals summed across replays, then fed to a
+two-proportion test. That treats `cases × replays` as that many independent trials — but replays of
+the *same* test case are not independent of each other, and a case that deterministically passes
+contributes the identical outcome every time. The sample size was therefore inflated by the replay
+count and the standard error shrank by roughly √(replays), so **the gate got easier to pass the more
+samples an operator configured** — exactly backwards, and it meant raising `AbSampleCount` quietly
+bought acceptances rather than confidence.
+
+The unit of independence is the **test case**, and both arms run the same ones, so the analysis is
+**paired**: per case, take the difference in pass proportion across its replays and test whether the
+mean difference differs from zero — a paired t-test with n = the number of test cases. Replays still
+earn their keep (they sharpen each case's proportion, narrowing the spread of the differences) but
+they no longer manufacture sample size. Because n is routinely well under 30, the test uses the
+**t distribution**, not the normal approximation, whose thinner tails would understate the p-value
+and reintroduce the same over-acceptance.
+
+Two consequences to keep in mind:
+
+- **Pass rates are still reported pooled** ("of everything attempted, this fraction passed"), which
+  is what a reader expects to see. Only the *verdict* is paired. Do not feed `SumPassCounts` to a
+  significance test — use `PairedPassRates`.
+- **A p-value can be undefined**, and that is meaningful rather than missing: fewer than two paired
+  cases (one case cannot evidence a difference between arms), or no difference in any case. Where
+  every case moves the same way by exactly the same amount, the t statistic is unbounded and the
+  test falls back to the two-sided **sign test** — ten cases all flipping to passing gives p ≈ 0.002,
+  while two cases agreeing gives 0.5, which is the honest reading of a coin toss.
+
+An 11-case suite improving 5/11 → 8/11 is three cases flipping, and lands at p ≈ 0.08 — suggestive
+but unproven, at one sample per arm or at three. That is the correct answer; the previous pooled
+figure of 15/33 → 24/33 "reaching significance" was an artefact of counting the same evidence three
+times.
+
+#### Both queues survive a restart
+
+The optimizer queue and the theory queue are both **in-process channels**, so a restart discards
+whatever is still in them. Each therefore re-queues its backlog on start, from a durable marker:
+
+| Queue | Marker | Recovery |
+|-------|--------|----------|
+| Theory validation | `TheoryStatus` (Proposed/Validating) | `TheoryValidationService.RecoverInFlightTheoriesAsync` |
+| Optimizer (theory discovery) | `ITestRunGroup.OptimizationConsideredAt` | `OptimizerService.RecoverPendingGroupsAsync` |
+
+The group marker exists solely for this: without it there was nothing to distinguish "never
+considered" from "considered and produced no theories", so a deploy during a scheduled-run window
+silently dropped that night's optimization. It is set **after** the theories are submitted, so a
+crash mid-discovery leaves the group pending and retries it; and it is set **even when discovery
+found nothing**, or every barren group would be reprocessed on every boot forever.
+
+Two guards worth preserving when touching this:
+
+- **Recovery is capped** (50 groups per start, remainder deferred and logged), so a long-dormant
+  install does not enqueue its entire history — and its entire LLM cost — on the first start after
+  upgrading. For the same reason the migration that added the column **backfills existing rows as
+  already considered**: history is not a backlog.
+- **Recovery is skipped in kiosk mode**, exactly as the theory queue's is — kiosk storage is
+  in-memory and demo-seeded on every start, so its only "backlog" is the seed.
+
 The outcome (`TheoryValidationOutcome`) records baseline pass rate, projected pass rate, p-value,
 and candidate run id **regardless of result**:
-- **Won** — improvement is real (beyond sampling noise: the two-proportion p-value must be
+- **Won** — improvement is real (beyond sampling noise: the paired p-value must be
   ≤ `OptimizationOptions.SignificanceLevel` = 0.05) → spawns a **Draft `OptimizationProposal`**
   carrying the A/B comparison as evidence. Model-switch theories instead require *no* pass-rate
   regression plus a genuine cost or latency win — equal-quality-but-pricier is not a win.
+  **Their evidence gate is directional and deliberately different:** a model switch claims *parity*
+  on quality, so demanding a statistically significant *difference* would be backwards — it would
+  reject the ideal result (identical answers, materially cheaper) and admit only switches that
+  measurably changed the output. A null p-value there usually means the arms agreed on every case,
+  which is the best outcome available. What is gated instead is the *size of the paired comparison*
+  (at least two paired cases), so parity is never concluded from evidence that could not have shown
+  a difference at all.
 - **Rejected** — the A/B ran cleanly but showed no significant improvement → theory marked
   Invalidated; metrics still kept so the same idea isn't retried (dedup).
 - **Could not test** — the comparison never happened: a run was incomplete (unreachable/unauthorized
@@ -255,8 +322,8 @@ configuration — tests, tooling — still resolve it:
 
 | Setting | Default | Effect |
 |---------|---------|--------|
-| `AbSampleCount` | `3` | Runs per arm, pooled before the significance test (max `ITestRunGroup.MaxSampleCount`). |
-| `SignificanceLevel` | `0.05` | Maximum two-sided p-value that counts as a real difference. |
+| `AbSampleCount` | `3` | Runs per arm (max `ITestRunGroup.MaxSampleCount`). Sharpens each case's pass proportion; does **not** increase the significance test's sample size — see above. |
+| `SignificanceLevel` | `0.05` | Maximum two-sided paired p-value that counts as a real difference. |
 | `RequireStatisticalSignificance` | `true` | When false, beating the baseline is enough — the p-value is still computed and stored. |
 
 `OptimizationOptions.KioskShowcase` is the one place the gate is dropped: the demo runs one sample
diff --git a/docs/security.md b/docs/security.md
index 0c941b27c..9544085b7 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -45,13 +45,39 @@ and the lean ingestion proxy can reach without loading `Application`.
   `EmailSettingsStore.DecryptPassword`.
 - **`ISecretHasher`** — `Hash(value)` → hex SHA-256 (`Sha256SecretHasher`, delegating to the shared
   `Proxytrace.Common.Security.Sha256.HexHash`). Deterministic and **key-ring-independent**, so the
-  verify paths keep working even if `PROXYTRACE_DATA_DIR` is lost. Unkeyed SHA-256 is safe here
-  because the secrets are 256-bit CSPRNG values — a dump cannot reverse or forge them. **Not for
-  passwords** (use `IPasswordService`, which is salted + slow).
+  verify paths keep working even if `PROXYTRACE_DATA_DIR` is lost. Unkeyed SHA-256 is safe **only**
+  because every secret it covers is a 256-bit CSPRNG value Proxytrace generated itself (inbound API
+  keys, invite tokens, password-reset tokens) — a dump cannot reverse or forge them. **Not for
+  passwords** (use `IPasswordService`, which is salted + slow), and **not for anything a human
+  chooses** (see `ISecretIndexer`).
+- **`ISecretIndexer`** — `Index(value)` → `"hmac1:"` + hex HMAC-SHA256 (`HmacSecretIndexer`), for a
+  blind index over a secret that is **not** guaranteed to be high-entropy. Today that is exactly one
+  value: the **operator-entered upstream provider API key**. The CSPRNG argument above does not
+  apply to it — an operator types it in, and `OpenAiCompatible` self-hosted backends conventionally
+  use `EMPTY`, `ollama`, or `sk-1234`. Under an unkeyed hash a database dump yields those by
+  wordlist in seconds, undoing the column encryption sitting right beside them. The HMAC key is not
+  in the database, so the dump alone is no longer enough.
 
 `Sha256` lives in `Proxytrace.Common` so the `Domain` layer (entity generators) can hash without
 referencing `Application`.
 
+### A missing `PROXYTRACE_DATA_DIR` must be loud
+
+An unset variable is not an error — Development and every test harness legitimately run on an
+in-memory ring — but in a real deployment it silently destroys every encrypted secret on each
+restart, and the three decrypt paths (`ModelProviderConfig`, `UserTotpEnrollmentConfig`,
+`EmailSettingsStore`) degrade the resulting `CryptographicException` at **Warning** only. The
+operator Error Log captures `>= Error`, so the outage would present purely as upstream 401s and
+"invalid authenticator code" with nothing to look at. Two things close that hole:
+
+- `KeyRingPersistenceCheck` (an `IHostedService` in `SecretProtectionModule.cs`) logs at
+  **Critical** at startup when the variable is unset, and at Information with the resolved path
+  when it is. It never throws.
+- Both split-shape Dockerfiles (`Proxytrace.Api/Dockerfile`, `Proxytrace.Proxy.Api/Dockerfile`)
+  set `ENV PROXYTRACE_DATA_DIR=/app/data` — the path the composes already mount the shared
+  `appdata` volume at — so a hand-written manifest inherits the safe default. The single-container
+  image keeps its own `/data/appdata`. An explicit environment value still overrides.
+
 ## Blind-index lookup
 
 Encryption is non-deterministic (random IV), so an encrypted column cannot be looked up or indexed by
@@ -59,7 +85,30 @@ value. Where a replayable secret also needs a by-value lookup, store a determini
 hash** column alongside the ciphertext and query that:
 
 - `ModelProvider.ApiKey` (ciphertext) + `ModelProviderEntity.ApiKeyLookupHash` (indexed) —
-  `FindByApiKeyAsync` hashes the presented key and matches the hash, then decrypts the row.
+  `FindByApiKeyAsync` indexes the presented key and matches the index, then decrypts the row.
+
+### The provider-key index is keyed (HMAC), and why it has two schemes
+
+This index uses `ISecretIndexer`, not `ISecretHasher`, for the entropy reason above. Two consequences
+follow, and both are load-bearing:
+
+- **The HMAC key lives in `PROXYTRACE_DATA_DIR/dataprotection-keys/blind-index.key`**, created once
+  with owner-only permissions (`BlindIndexKey`). It is a separate file rather than something derived
+  from the Data Protection ring because Data Protection deliberately exposes no stable raw key
+  material. **Every host that resolves provider credentials must mount the same volume** — the same
+  requirement the key ring already has. Deleting the file is how you rotate: restart, and the
+  startup backfill re-indexes from the decrypted keys.
+- **When no data directory is configured the index falls back to the legacy unkeyed form**, and says
+  so at Warning. It deliberately does *not* invent a per-process key: that would produce indexes
+  that stop matching after the next restart, silently breaking upstream authentication for every
+  provider. Development and the test harnesses therefore behave exactly as before.
+
+Stored values are **scheme-prefixed** (`hmac1:`) because a hex SHA-256 and a hex HMAC-SHA256 are both
+64 characters, so length cannot tell them apart. `FindByApiKeyAsync` matches **both** forms in one
+indexed query — rows predating the change keep authenticating until
+`SecretsBackfillService.ReindexProviderKeysAsync` upgrades them on the next start — and the prefix
+means the two can never collide onto the wrong provider. An undecryptable row is left untouched by
+that pass rather than re-indexed to the HMAC of an empty string.
 
 Hashed secrets need no separate column: the stored value *is* the hash, so the repository hashes the
 presented raw value before the equality lookup (`ApiKeyRepository.FindByKeyAsync`,
@@ -76,6 +125,22 @@ presented raw value before the equality lookup (`ApiKeyRepository.FindByKeyAsync
   repository. It must **not** happen in the mapper — a hashed entity that is re-saved (e.g.
   `Invite.MarkConsumedAsync`) would otherwise be double-hashed.
 
+## Secrets must not survive `ToString()`
+
+A `record`'s generated `ToString()`/`PrintMembers` prints **every** member, so a secret-bearing
+record leaks its plaintext the first time anyone writes `logger.LogX("… {Settings}", settings)`,
+interpolates it into an exception message, or looks at it in a debugger. **Every record that carries
+a replayable secret must override `PrintMembers` and render that member as `***`** — the rest of the
+members stay, so the type is still useful in a log line. The member itself stays public and part of
+record equality; only its textual rendering is masked.
+
+Current overrides: `ModelProvider` (`ApiKey`, the reference implementation), `EmailSettings`
+(`Password`), `UserTotpEnrollment` (`Secret`), `KioskEndpointOptions` and `ResolvedKioskEndpoint`
+(`ApiKey`). Note the accessibility differs: a sealed record deriving from `object` must declare
+`private bool PrintMembers(StringBuilder)`, one deriving from another record
+`protected override bool PrintMembers(StringBuilder)` (and must chain to `base.PrintMembers`).
+`Proxytrace.Domain.Tests/SecretRedactionToStringTests` pins all five.
+
 ## Backfill of pre-existing rows
 
 The product shipped with plaintext secrets, so `SecretsBackfillService` (an `IHostedService`
@@ -85,9 +150,16 @@ idempotent and per-row (a partial run resumes; a re-run is a no-op), keyed on a
 | Table | "Not yet protected" marker | Action |
 |---|---|---|
 | `ModelProvider` | `ApiKeyLookupHash IS NULL` | encrypt `ApiKey`, set the lookup hash |
-| `ApiKey` | `KeyPrefix IS NULL` | hash the plaintext in `KeyHash`, set `KeyPrefix` |
+| `ApiKey` | `KeyHash` length ≠ 64 | hash the plaintext in `KeyHash`, set `KeyPrefix` |
 | `Invite` | `TokenHash` length ≠ 64 | hash the plaintext token |
 
+The two hash markers read the **protected column itself** (a hex SHA-256 is always 64 chars; the
+pre-retrofit plaintexts never are). Do not move a marker into a companion column: it is then only as
+durable as that column's mapper. `ApiKey` used `KeyPrefix IS NULL` until it turned out `ApiKeyConfig`
+collapses that null (`stored.KeyPrefix ?? string.Empty`) and writes `""` back on every round trip, so
+one save of an un-backfilled row would have hidden it from the pass forever — leaving the plaintext in
+`KeyHash`, where `FindByKeyAsync` (which hashes the presented value) can never match it.
+
 The accompanying migration (`ProtectSecretsAtRest`) **renames** the verify-only columns
 (`ApiKey`→`KeyHash`, `Token`→`TokenHash`) rather than dropping and re-adding them, so the existing
 plaintext survives into the new column for the backfill to read. A drop+add would destroy live keys
@@ -114,6 +186,27 @@ The per-request cost is a few indexed point lookups plus one Data Protection dec
 `proxyResolve*` budgets in `perf/perf-budgets.json`. Do not reintroduce positive caching on this
 path; the freshness guarantee is pinned by `ApiKeyResolverRotationTests`.
 
+## Proxy scopes: capture and pass-through are separate capabilities
+
+`ApiKeyScopes.Ingestion` admits a key to the ingestion proxy. It does **not** admit it to the
+untraced pass-through (`OpenAiProxyController.Passthrough`), which needs `ApiKeyScopes.Passthrough`.
+
+The split exists because the two differ in kind, not degree. Pass-through relays **any method and any
+path** to the provider's host origin with the organisation's real upstream credential attached, and
+is deliberately not evaluated by detectors, not traced, and not audited — Proxytrace does not
+interpret those payloads. On a provider serving account or organization-management routes at the same
+host, that is the provider account's reach, which should not follow from "may record LLM calls".
+
+Two properties to preserve:
+
+- **Existing keys were grandfathered** by `GrantPassthroughScopeToExistingApiKeys` (a data-only
+  migration ORing the bit into every key that already held `Ingestion`), so upgrading does not break
+  the documented `/health` setup. New keys must request the scope.
+- **The upstream-provider-key auth path is intentionally ungated.** `ResolvedApiKey.Scopes` is
+  `null` there, and the check skips: a caller holding the provider's own credential can call the
+  provider directly, so restricting which of its paths they reach *through Proxytrace* protects
+  nothing.
+
 ## Threat model
 
 Protects **database dumps and backups**: the encryption key ring lives outside the database (in
@@ -144,6 +237,62 @@ Operators always have two non-logged recovery paths that do **not** require this
 **Settings → Users → Reset password** (shown once in the UI, never logged). The flag exists only for
 the genuine sole-admin-plus-no-email lockout.
 
+## Reverse-proxy trust: forwarded headers
+
+The documented topology terminates TLS at a reverse proxy (`frontend/nginx.conf`) and forwards to the
+API **over plain HTTP**. Without processing `X-Forwarded-*` the API therefore sees `http` as the
+scheme and the proxy container's address as the client for *every* request. `Program.cs` runs
+`UseForwardedHeaders` as its **first** middleware, processing `XForwardedFor | XForwardedProto`, so
+rate-limit partition keys, audit trails and generated absolute URLs describe the real client.
+
+Those headers are attacker-controlled unless the peer that sent them is trusted, and an unrestricted
+`X-Forwarded-For` is *worse* than none: it turns the rate-limit partition key into a value the client
+picks, defeating throttling entirely. The trust set is therefore operator-declared under the
+**`ForwardedHeaders`** config section (`TrustedProxyConfiguration` in `Program.cs`):
+
+| Key | Default | Meaning |
+|---|---|---|
+| `ForwardedHeaders:Enabled` | `true` | Set `false` to skip the middleware entirely. |
+| `ForwardedHeaders:KnownProxies` | *(none)* | Trusted proxy addresses. Comma-separated or an array. |
+| `ForwardedHeaders:KnownNetworks` | *(none)* | Trusted CIDR ranges, e.g. `172.16.0.0/12`. |
+| `ForwardedHeaders:ForwardLimit` | `1` | Number of trusted proxy hops. |
+
+Both this section and `RateLimiting` below are read from the **host** configuration
+(`appsettings.json` + environment variables), not from `appsettings.local.json` — they are deployment
+settings, and the middleware/limiters are wired before the Autofac container (which owns the
+`appsettings.local.json` view) exists.
+
+**With nothing declared the trust set is the framework default — loopback only.** That is the
+fail-safe choice: it never trusts a forged header, but it also means that behind a *containerised*
+proxy (whose address is not loopback) the forwarded headers are ignored and the per-IP limiters below
+collapse into one global bucket. **An operator running the split deployment must declare the proxy**,
+e.g. on the `api` service in `docker-compose.yml`:
+
+```yaml
+- ForwardedHeaders__KnownNetworks=172.16.0.0/12   # the compose bridge network
+```
+
+Narrow this to the proxy's own address (`ForwardedHeaders__KnownProxies=<nginx ip>`) where the
+address is stable. Do **not** widen it to a range that untrusted clients can originate from — anyone
+inside it can spoof their client address. Note that publishing the API port on the host (`5100:8080`
+in the shipped compose file) lets a client reach the API *around* nginx from the bridge network, so
+keep that port unpublished in any deployment where the trust set covers it.
+
+## Session cookie `Secure` is configuration-driven
+
+The 7-day `proxytrace_session` JWT cookie (`Proxytrace.Api/Auth/SessionCookie.cs`) is `HttpOnly`,
+`SameSite=Strict`, and `Secure` **from configuration** — never inferred from `Request.IsHttps`, which
+is `false` on the plain-HTTP hop behind the TLS-terminating proxy and would strip `Secure` from every
+HTTPS installation's cookie, leaking the full session token on any plaintext request the browser can
+be induced to make.
+
+- Default: **on** everywhere except the `Development` environment (which `dev.sh` and
+  `launchSettings.json` set), where the SPA and API are plain `http://`.
+- Override: `Authentication:SessionCookie:Secure`. Set it to `false` only for a deliberate
+  plain-HTTP deployment on a host that is **not** `localhost` — browsers treat `http://localhost` as
+  a secure context and accept `Secure` cookies there, so the local Docker/e2e/kiosk stacks
+  (`http://localhost:5101`, `:5103`) work with the default.
+
 ## In-process auth/MFA/rate-limit state is single-instance by design
 
 Several auth defenses keep their state **in process memory**, not in a shared store:
@@ -151,8 +300,22 @@ Several auth defenses keep their state **in process memory**, not in a shared st
 - **MFA challenge tickets** (`MfaChallengeService`) — the short-lived two-step-login tickets and their
   per-ticket failed-attempt cap (see [`docs/mfa.md`](mfa.md)).
 - **SSE stream tickets** (`StreamTicketService`).
-- **Per-IP rate limiters** (`Proxytrace.Api/Program.cs` — the `auth-reset` and `auth-mfa` fixed-window
-  policies).
+- **Per-IP rate limiters** (`AuthRateLimiterConfigurator` in `Proxytrace.Api/Program.cs` — the
+  `auth-login`, `auth-reset` and `auth-mfa` fixed-window policies). They partition on
+  `Connection.RemoteIpAddress`, so they are only genuinely *per-IP* once the forwarded-header trust
+  set above is declared; otherwise every client shares one bucket, which both weakens brute-force
+  protection and lets one noisy client exhaust the window for everyone. Limits are overridable under
+  `RateLimiting:{Login,PasswordReset,Mfa}:{PermitLimit,WindowSeconds}`:
+
+  | Policy | Default | Endpoints |
+  |---|---|---|
+  | `auth-login` | 30 / minute | `login`, `claim-legacy`, `signup`, `invites/by-token/{token}` |
+  | `auth-reset` | 10 / 15 min | `forgot-password`, `reset-password` |
+  | `auth-mfa` | 10 / 15 min | `mfa/verify` |
+
+  There is **no per-account failed-attempt counter or lockout**; the `auth-login` window is the only
+  bound on online password guessing, so it is sized to swallow a human fumbling a password (and a
+  shared-NAT office signing in) while cutting an unthrottled attack by three-plus orders of magnitude.
 
 This is correct for the **documented single-instance topology**: the API runs as exactly one replica
 (both the split and kiosk deployment shapes run a single API process — see
@@ -196,5 +359,10 @@ are committed on purpose — the test-signed e2e/perf license JWT, demo-data key
 
 `StoredLicense` JWT is left plaintext: it is a signed license token, not a credential, so encrypting
 it adds migration + decrypt-on-startup cost for no real secrecy gain. `User.PasswordHash` is already
-hashed via `IPasswordService`. Key rotation / re-encryption tooling and a keyed-HMAC blind index are
-deliberately not implemented.
+hashed via `IPasswordService`. Automated key rotation / bulk re-encryption tooling is deliberately
+not implemented.
+
+(A keyed-HMAC blind index *was* previously listed here as out of scope. It is now implemented for the
+one value that needed it — the operator-entered upstream provider key — because the "these are all
+256-bit CSPRNG secrets" justification never applied to that one. See the blind-index section above.
+The remaining indexes stay unkeyed, and that is correct for them.)
diff --git a/docs/testing.md b/docs/testing.md
index 79e9ca83f..bcd4141c4 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -7,6 +7,38 @@ DI hooks, NSubstitute substitution patterns, and the hard rules against shared
 state/fields and `[TestFixture]`-style helper classes. The summary below is orientation
 only; the skill overrides it where they differ.
 
+## Which tests to run
+
+The backend suite is ~2,200 tests across 10 projects; the frontend has ~95 Vitest spec files.
+**Run only what your change can break.** `.github/workflows/ci.yml` runs
+`dotnet test Proxytrace.sln` on every push, so a local full run buys nothing but wall-clock — and
+once a scoped run is green, do not re-run the full suite to "make sure".
+
+| Changed | Run |
+|---|---|
+| `Proxytrace.<Layer>/**` | `dotnet test Proxytrace.<Layer>.Tests` |
+| A domain entity, its EF entity, or a mapping | `dotnet test Proxytrace.Domain.Tests` **and** `Proxytrace.Storage.Tests` |
+| A controller, route, or auth handler | `dotnet test Proxytrace.Api.Tests` |
+| A service, optimizer, or the run loop | `dotnet test Proxytrace.Application.Tests` |
+| One class/area inside a project | `dotnet test <Project> --filter "FullyQualifiedName~<Name>"` |
+| Frontend components/hooks | `npm test -- <path-or-pattern>` (from `frontend/`) |
+| `Proxytrace.Common`, `Proxytrace.Testing`, DI/module wiring, a shared interface signature, a package bump, a release | `dotnet test Proxytrace.sln` |
+
+Add `--no-restore` (and `--no-build` when nothing changed since the last build) to skip repeat work.
+
+Two things worth remembering:
+
+- The **frontend suite is cheap** — ~1,000 specs in ~3 seconds — so scoping it matters far less than
+  on the backend. Scope while iterating, then run bare `npm test` before you call it done. CI runs
+  it too (the `frontend` job).
+- The e2e and perf suites are **not** routine checks. Both boot Docker stacks and take many minutes;
+  run them only when the change is in that flow or when asked (`run-e2e-tests`, `run-perf-tests`).
+
+When reporting results, say which scope you ran — a scoped green run must never be reported as
+"all tests pass".
+
+## The harness
+
 All tests extend `BaseTest<TModule>` (MSTest + AwesomeAssertions):
 
 ```csharp
diff --git a/docs/validation.md b/docs/validation.md
index 9b545d9bb..5863f4551 100644
--- a/docs/validation.md
+++ b/docs/validation.md
@@ -15,6 +15,18 @@ For referenced entities, cascade validation:
 foreach (var r in SystemEndpoint.Validate(validationContext)) yield return r;
 ```
 
+## Writing a new check
+
+A check returns a `ValidationResult` describing the failure, or `Validation.Success` when the value is
+fine — never `ValidationResult.Success` directly.
+
+That indirection is deliberate. The BCL represents success as a **null** `ValidationResult`, but
+declares `IValidatableObject.Validate` to return a non-nullable element type, so every check has to
+hand back a value the framework itself defines as null through a signature we cannot change. The
+resulting suppression is concentrated on the single `Validation.Success` member — the one sanctioned
+`!` in the repository (see the nullable-suppression rule in `CLAUDE.md`). Returning any genuinely
+non-null "success" sentinel instead would be read by `Validator` as a validation *failure*.
+
 For a value constrained to a closed set that isn't an enum (e.g. `User.Language` must be one of the
 `SupportedLanguages`), validate membership explicitly:
 ```csharp
diff --git a/frontend/src/api/models.ts b/frontend/src/api/models.ts
index 9864004dd..81a6fdb9e 100644
--- a/frontend/src/api/models.ts
+++ b/frontend/src/api/models.ts
@@ -747,11 +747,20 @@ export interface ProviderDto {
   id: string;
   name: string;
   endpoint: string;
-  upstreamApiKey: string;
+  /**
+   * Masked rendering of the upstream credential — enough to tell two keys apart, never enough to
+   * use. The cleartext key is fetched on demand from `providersApi.getUpstreamKey`, which is
+   * admin-gated and audited server-side.
+   */
+  upstreamApiKeyPreview: string;
   kind: ModelProviderKind;
   createdAt: string;
   updatedAt: string;
 }
+/** Cleartext upstream credential, returned only by the audited reveal endpoint. */
+export interface ProviderKeyDto {
+  upstreamApiKey: string;
+}
 /** A provider with its model endpoints and API keys embedded. */
 export interface ProviderWithDetailsDto {
   provider: ProviderDto;
@@ -775,7 +784,7 @@ export interface ModelEndpointDto {
   createdAt: string;
   updatedAt: string;
 }
-export type ApiKeyScope = 'Ingestion' | 'McpRead' | 'McpWrite' | 'ApiRead' | 'ApiWrite';
+export type ApiKeyScope = 'Ingestion' | 'Passthrough' | 'McpRead' | 'McpWrite' | 'ApiRead' | 'ApiWrite';
 export interface ApiKeyDto {
   id: string;
   name: string;
@@ -1186,7 +1195,12 @@ export type TestRunEvent =
   | GroupRunCompleteEvent;
 
 /* ── Notifications ── */
-export enum NotificationKind { Anomaly = 'Anomaly', ProposalReady = 'ProposalReady' }
+export enum NotificationKind {
+  Anomaly = 'Anomaly',
+  ProposalReady = 'ProposalReady',
+  /** The licensed monthly trace limit is reached and captures for this project are being dropped. */
+  TraceQuotaReached = 'TraceQuotaReached',
+}
 export enum NotificationSeverity { Info = 'Info', Warning = 'Warning', Critical = 'Critical' }
 export enum NotificationStatus { Unread = 'Unread', Read = 'Read', Dismissed = 'Dismissed' }
 export enum NotificationTargetKind {
@@ -1331,6 +1345,7 @@ export enum AuditAction {
   CustomAnomalyDetectorUpdated = 'CustomAnomalyDetectorUpdated',
   CustomAnomalyDetectorDeleted = 'CustomAnomalyDetectorDeleted',
   ProviderUpstreamKeyRotated = 'ProviderUpstreamKeyRotated',
+  ProviderUpstreamKeyRevealed = 'ProviderUpstreamKeyRevealed',
 }
 
 export enum AuditActorType {
diff --git a/frontend/src/api/providers.ts b/frontend/src/api/providers.ts
index 0870784f5..9d7c2803a 100644
--- a/frontend/src/api/providers.ts
+++ b/frontend/src/api/providers.ts
@@ -2,15 +2,22 @@ import { api, type RequestOptions } from './client';
 import type {
   ApiKeyDto, CreateApiKeyRequest, CreateProviderRequest,
   ModelEndpointDto, ModelProviderKind,
-  ProviderDto, ProvidersOverviewDto,
+  ProviderDto, ProviderKeyDto, ProvidersOverviewDto,
 } from './models';
 
 export const providersApi = {
   /** Page payload: every provider with embedded models + keys, plus projects, in one request. */
   overview: () => api.get<ProvidersOverviewDto>('/api/providers/overview'),
   get: (id: string, opts?: RequestOptions) => api.get<ProviderDto>(`/api/providers/${id}`, opts),
+  /**
+   * Fetches a provider's upstream credential in the clear. Deliberately a separate request rather
+   * than a field on the provider: the key used to ship with every providers-page load, so nothing
+   * recorded who had actually seen it. The server audits each call — only ask when the user asks.
+   */
+  getUpstreamKey: (id: string) => api.get<ProviderKeyDto>(`/api/providers/${id}/key`),
   create: (req: CreateProviderRequest) => api.post<ProviderDto>('/api/providers', req),
-  update: (id: string, req: { name: string; endpoint: string; upstreamApiKey: string; kind: ModelProviderKind }) =>
+  /** `upstreamApiKey: null` leaves the stored credential untouched — the client never holds it. */
+  update: (id: string, req: { name: string; endpoint: string; upstreamApiKey: string | null; kind: ModelProviderKind }) =>
     api.put<ProviderDto>(`/api/providers/${id}`, req),
   delete: (id: string) => api.del(`/api/providers/${id}`),
 
diff --git a/frontend/src/features/audit-log/auditLogMeta.ts b/frontend/src/features/audit-log/auditLogMeta.ts
index dbd45a6b9..72945e7c4 100644
--- a/frontend/src/features/audit-log/auditLogMeta.ts
+++ b/frontend/src/features/audit-log/auditLogMeta.ts
@@ -71,6 +71,7 @@ export const AUDIT_ACTION_LABEL: Record<AuditAction, MessageDescriptor> = {
   [AuditAction.CustomAnomalyDetectorUpdated]: msg`Anomaly Detector Updated`,
   [AuditAction.CustomAnomalyDetectorDeleted]: msg`Anomaly Detector Deleted`,
   [AuditAction.ProviderUpstreamKeyRotated]: msg`Provider Key Rotated`,
+  [AuditAction.ProviderUpstreamKeyRevealed]: msg`Provider Key Revealed`,
 };
 
 export const AUDIT_ACTOR_TYPE_LABEL: Record<AuditActorType, MessageDescriptor> = {
@@ -153,4 +154,5 @@ export const ACTION_COLOR: Record<AuditAction, string> = {
   [AuditAction.CustomAnomalyDetectorUpdated]: 'var(--warn)',
   [AuditAction.CustomAnomalyDetectorDeleted]: 'var(--danger)',
   [AuditAction.ProviderUpstreamKeyRotated]: 'var(--warn)',
+  [AuditAction.ProviderUpstreamKeyRevealed]: 'var(--warn)',
 };
diff --git a/frontend/src/features/notifications/notificationsMeta.ts b/frontend/src/features/notifications/notificationsMeta.ts
index 46ca1ee59..10c29026e 100644
--- a/frontend/src/features/notifications/notificationsMeta.ts
+++ b/frontend/src/features/notifications/notificationsMeta.ts
@@ -18,6 +18,7 @@ const SEVERITY_LABEL: Record<NotificationSeverity, MessageDescriptor> = {
 const KIND_LABEL: Record<NotificationKind, MessageDescriptor> = {
   [NotificationKind.Anomaly]: msg`Anomaly`,
   [NotificationKind.ProposalReady]: msg`Proposal ready`,
+  [NotificationKind.TraceQuotaReached]: msg`Trace limit reached`,
 };
 
 const STATUS_LABEL: Record<NotificationStatus, MessageDescriptor> = {
diff --git a/frontend/src/features/playground/Playground.tsx b/frontend/src/features/playground/Playground.tsx
index 046f6abd6..056186ece 100644
--- a/frontend/src/features/playground/Playground.tsx
+++ b/frontend/src/features/playground/Playground.tsx
@@ -32,8 +32,11 @@ export default function Playground() {
   const { showSeed, setShowSeed, seedAnchorRef } = useSeedDropdown();
   const [streamingId, setStreamingId] = useState<string | null>(null);
 
-  const { agent } = usePlaygroundAgent({ agentId: state.agentId, dispatch });
-  usePlaygroundAgentList({ projectId: currentProject?.id, agentId: state.agentId, dispatch });
+  // The list runs first: it tells the single-agent query whether the id restored from the persisted
+  // session still exists here, so a selection left over from an earlier instance is dropped rather
+  // than fetched (see `resolveStoredAgent`).
+  const { known } = usePlaygroundAgentList({ projectId: currentProject?.id, agentId: state.agentId, dispatch });
+  const { agent } = usePlaygroundAgent({ agentId: state.agentId, known, dispatch });
   useAutoLoadAgentCall({ agentId: state.agentId, agent, messages: state.messages, dispatch });
   useAgentFromSearchParam({ agentId: state.agentId, dispatch });
 
diff --git a/frontend/src/features/playground/hooks/usePlaygroundAgent.spec.ts b/frontend/src/features/playground/hooks/usePlaygroundAgent.spec.ts
new file mode 100644
index 000000000..4f3ffbebe
--- /dev/null
+++ b/frontend/src/features/playground/hooks/usePlaygroundAgent.spec.ts
@@ -0,0 +1,34 @@
+import { describe, it, expect } from 'vitest';
+import { resolveStoredAgent } from './usePlaygroundAgent';
+
+const list = (ids: string[], total = ids.length) => ({ ids, total });
+
+describe('resolveStoredAgent', () => {
+  it('waits while nothing is selected', () => {
+    expect(resolveStoredAgent(null, list(['a']))).toBe('wait');
+  });
+
+  it('waits until the agent list has loaded, rather than guessing', () => {
+    expect(resolveStoredAgent('a', undefined)).toBe('wait');
+  });
+
+  it('fetches an agent the project actually has', () => {
+    expect(resolveStoredAgent('a', list(['a', 'b']))).toBe('fetch');
+  });
+
+  it('clears a stored id the project no longer has', () => {
+    // The kiosk re-seeds into in-memory storage on every restart, so the id persisted by a
+    // previous boot is dead. Fetching it would only earn a 404.
+    expect(resolveStoredAgent('c5fe0321', list(['a', 'b']))).toBe('clear');
+  });
+
+  it('clears when the project has no agents at all', () => {
+    expect(resolveStoredAgent('a', list([]))).toBe('clear');
+  });
+
+  it('fetches an unlisted id when the list is truncated — absence proves nothing', () => {
+    // Only a complete list can prove an id is gone; past the page size, fall back to asking the
+    // server (and tolerating its answer) instead of dropping a valid selection.
+    expect(resolveStoredAgent('z', list(['a', 'b'], 500))).toBe('fetch');
+  });
+});
diff --git a/frontend/src/features/playground/hooks/usePlaygroundAgent.ts b/frontend/src/features/playground/hooks/usePlaygroundAgent.ts
index 94f2b43ba..656073706 100644
--- a/frontend/src/features/playground/hooks/usePlaygroundAgent.ts
+++ b/frontend/src/features/playground/hooks/usePlaygroundAgent.ts
@@ -7,7 +7,7 @@
  *  - auto-loading the last trace when a fresh agent is selected
  *  - consuming the ?agentId= search param to deep-link into an agent
  */
-import { useEffect, useRef } from 'react';
+import { useEffect, useMemo, useRef } from 'react';
 import { useQuery } from '@tanstack/react-query';
 import { useSearchParams } from 'react-router';
 import { agentsApi } from '../../../api/agents';
@@ -38,8 +38,37 @@ export function fetchAndPickAgent(agentId: string, dispatch: SessionDispatch): v
 // usePlaygroundAgent — single-agent query + stale-agent clear
 // ─────────────────────────────────────────────────────────────────────────────
 
+/** The project's agent ids as far as the list query knows them, plus the server-side total. */
+export interface KnownAgents {
+  ids: readonly string[];
+  total: number;
+}
+
+/**
+ * What to do with the agent id restored from the persisted session.
+ *
+ * The session id is remembered across reloads *and across API restarts*, so it can name an agent
+ * this instance no longer has — most visibly in the kiosk, which re-seeds into in-memory storage on
+ * every boot and therefore mints fresh agent ids each time. Fetching such an id is a guaranteed
+ * 404, so the selection is checked against the already-loaded agent list first and a dead id is
+ * dropped without a request.
+ *
+ * Only a *complete* list can prove an id is gone: past the list query's page size, an id's absence
+ * says nothing, so the fetch goes ahead and the 404 path below still cleans up.
+ */
+export function resolveStoredAgent(
+  agentId: string | null,
+  known: KnownAgents | undefined,
+): 'wait' | 'fetch' | 'clear' {
+  if (!agentId || known === undefined) return 'wait';
+  if (known.ids.includes(agentId)) return 'fetch';
+  return known.ids.length >= known.total ? 'clear' : 'fetch';
+}
+
 interface UsePlaygroundAgentOptions {
   agentId: string | null;
+  /** The project's agents, once {@link usePlaygroundAgentList} has loaded them. */
+  known: KnownAgents | undefined;
   dispatch: SessionDispatch;
 }
 
@@ -48,13 +77,16 @@ interface UsePlaygroundAgentResult {
 }
 
 /**
- * Fetches the currently-selected agent and clears it from the session when it
- * returns 404 or errors.
+ * Fetches the currently-selected agent and clears it from the session when it is stale, returns
+ * 404, or errors.
  */
 export function usePlaygroundAgent({
   agentId,
+  known,
   dispatch,
 }: UsePlaygroundAgentOptions): UsePlaygroundAgentResult {
+  const action = resolveStoredAgent(agentId, known);
+
   const { data: agent, error: agentError } = useQuery({
     queryKey: QUERY_KEYS.agent(agentId),
     queryFn: async () => {
@@ -65,18 +97,18 @@ export function usePlaygroundAgent({
         throw e;
       }
     },
-    enabled: !!agentId,
+    enabled: action === 'fetch',
     throwOnError: false,
   });
 
-  // Effect 1 resolution: responds to query data (agent 404/error) by dispatching
-  // clearAgent. Cannot be replaced by a query select because the side-effect is a
-  // reducer dispatch, not a cached value. Kept minimal (1 dispatch).
+  // Effect 1 resolution: responds to query data (agent 404/error) and to a selection the list has
+  // outlived by dispatching clearAgent. Cannot be replaced by a query select because the
+  // side-effect is a reducer dispatch, not a cached value. Kept minimal (1 dispatch).
   useEffect(() => {
-    if (agentId && (agent === null || agentError)) {
+    if (action === 'clear' || (agentId && (agent === null || agentError))) {
       dispatch({ type: 'clearAgent' });
     }
-  }, [agentId, agent, agentError, dispatch]);
+  }, [action, agentId, agent, agentError, dispatch]);
 
   return { agent: agent ?? null };
 }
@@ -94,6 +126,9 @@ interface UsePlaygroundAgentListOptions {
 /**
  * Fetches all agents for the current project and auto-selects the first one
  * when no agent is currently selected.
+ *
+ * Also reports the loaded ids as {@link KnownAgents}, which {@link usePlaygroundAgent} uses to
+ * recognise a stale stored selection before it asks the server for it.
  */
 export function usePlaygroundAgentList({
   projectId,
@@ -106,6 +141,11 @@ export function usePlaygroundAgentList({
     enabled: !!projectId,
   });
 
+  const known = useMemo<KnownAgents | undefined>(
+    () => (agentsList ? { ids: agentsList.items.map(a => a.id), total: agentsList.total } : undefined),
+    [agentsList],
+  );
+
   // Effect 2 resolution: auto-pick first agent. Cannot be converted to a TanStack
   // select because the side-effect is a reducer dispatch. Kept minimal.
   useEffect(() => {
@@ -114,7 +154,7 @@ export function usePlaygroundAgentList({
     if (first) fetchAndPickAgent(first.id, dispatch);
   }, [agentId, agentsList, dispatch]);
 
-  return { agentsList };
+  return { agentsList, known };
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
diff --git a/frontend/src/features/providers/components/KeyCapabilities.tsx b/frontend/src/features/providers/components/KeyCapabilities.tsx
index 7a4680780..9d237a46d 100644
--- a/frontend/src/features/providers/components/KeyCapabilities.tsx
+++ b/frontend/src/features/providers/components/KeyCapabilities.tsx
@@ -5,6 +5,7 @@ import { SCOPE_LETTER, SCOPE_ORDER } from '../keyScopes';
 
 const GRANTED: Record<ApiKeyScope, string> = {
   Ingestion: cn('border-transparent bg-[color-mix(in_srgb,var(--text-secondary)_16%,transparent)] text-primary'),
+  Passthrough: cn('border-[color-mix(in_srgb,var(--warn)_30%,transparent)] bg-[var(--warn-subtle)] text-[var(--warn)]'),
   McpRead: cn('border-[color-mix(in_srgb,var(--accent-primary)_30%,transparent)] bg-[var(--accent-subtle)] text-[var(--accent-hover)]'),
   McpWrite: cn('border-[color-mix(in_srgb,var(--warn)_30%,transparent)] bg-[var(--warn-subtle)] text-[var(--warn)]'),
   ApiRead: cn('border-[color-mix(in_srgb,var(--teal)_30%,transparent)] bg-[color-mix(in_srgb,var(--teal)_14%,transparent)] text-[var(--teal)]'),
@@ -22,6 +23,7 @@ export function KeyCapabilities({ scopes }: { scopes: ApiKeyScope[] }) {
   const { t } = useLingui();
   const names: Record<ApiKeyScope, string> = {
     Ingestion: t`Ingestion proxy`,
+    Passthrough: t`Upstream pass-through`,
     McpRead: t`MCP read`,
     McpWrite: t`MCP write`,
     ApiRead: t`REST API read`,
diff --git a/frontend/src/features/providers/components/KeysSection.tsx b/frontend/src/features/providers/components/KeysSection.tsx
index c6a7c305b..42102cac5 100644
--- a/frontend/src/features/providers/components/KeysSection.tsx
+++ b/frontend/src/features/providers/components/KeysSection.tsx
@@ -55,6 +55,7 @@ export function KeysSection({ providerId, keys, projects, defaultProjectId }: Ke
     McpWrite: <Trans>MCP write — let agents curate suites, start runs and change proposals</Trans>,
     ApiRead: <Trans>REST API read — let a service read this project over the REST API</Trans>,
     ApiWrite: <Trans>REST API write — let a service create and change data over the REST API</Trans>,
+    Passthrough: <Trans>Upstream pass-through — forward non-inference paths (such as /health) to the provider using its own credential. Not traced, and not checked by detectors.</Trans>,
   };
 
   const toggleScope = (scope: ApiKeyScope, on: boolean) =>
diff --git a/frontend/src/features/providers/components/UpstreamKeyRow.tsx b/frontend/src/features/providers/components/UpstreamKeyRow.tsx
index 088e13b56..b542ef4fb 100644
--- a/frontend/src/features/providers/components/UpstreamKeyRow.tsx
+++ b/frontend/src/features/providers/components/UpstreamKeyRow.tsx
@@ -8,8 +8,7 @@ import { Spinner } from '../../../components/ui/Spinner';
 import useToast from '../../../hooks/useToast';
 import { cn } from '../../../lib/cn';
 import { ProviderConnectionTestError, providerConnectionErrorMessage } from '../../../lib/providerConnection';
-import { maskKey } from '../providerMeta';
-import { useRotateUpstreamKey } from '../hooks/useProviderMutations';
+import { useRevealUpstreamKey, useRotateUpstreamKey } from '../hooks/useProviderMutations';
 
 interface UpstreamKeyRowProps {
   provider: ProviderDto;
@@ -21,25 +20,37 @@ export function UpstreamKeyRow({ provider }: UpstreamKeyRowProps) {
   const { t, i18n } = useLingui();
   const { show: toast } = useToast();
   const [isEditing, setIsEditing] = useState(false);
-  const [isRevealed, setIsRevealed] = useState(false);
+  // The cleartext key is held only while the user is looking at it, and never in the Query cache.
+  const [revealedKey, setRevealedKey] = useState<string | null>(null);
   const [draft, setDraft] = useState('');
   const [feedback, setFeedback] = useState<Feedback | null>(null);
   const editButtonRef = useRef<HTMLButtonElement>(null);
   const inputRef = useRef<HTMLInputElement>(null);
   const rotateKey = useRotateUpstreamKey(provider);
+  const revealKey = useRevealUpstreamKey(provider.id);
   const normalizedDraft = draft.trim();
-  const canSave = normalizedDraft.length > 0
-    && normalizedDraft !== provider.upstreamApiKey
-    && !rotateKey.isPending;
+  const canSave = normalizedDraft.length > 0 && !rotateKey.isPending;
   const inputSize = 'sm' as const;
 
   function startEditing() {
     setDraft('');
     setFeedback(null);
-    setIsRevealed(false);
+    setRevealedKey(null);
     setIsEditing(true);
   }
 
+  function toggleReveal() {
+    if (revealedKey !== null) {
+      setRevealedKey(null);
+      return;
+    }
+    // Fetched only when actually asked for — each read is audited server-side.
+    revealKey.mutate(undefined, {
+      onSuccess: key => setRevealedKey(key),
+      onError: () => setFeedback({ tone: 'error', message: t`Could not read the upstream API key.` }),
+    });
+  }
+
   function focusEditButton() {
     requestAnimationFrame(() => editButtonRef.current?.focus());
   }
@@ -51,7 +62,7 @@ export function UpstreamKeyRow({ provider }: UpstreamKeyRowProps) {
       onSuccess: result => {
         setDraft('');
         setIsEditing(false);
-        setIsRevealed(false);
+        setRevealedKey(null);
         focusEditButton();
         setFeedback(result.modelCount === 0
           ? { tone: 'warning', message: t`Key accepted, but the provider reported no models.` }
@@ -72,9 +83,21 @@ export function UpstreamKeyRow({ provider }: UpstreamKeyRowProps) {
   }
 
   function copyKey() {
-    void navigator.clipboard.writeText(provider.upstreamApiKey);
-    // eslint-disable-next-line lingui/no-unlocalized-strings -- toast tone token, not UI copy
-    toast(t`Upstream key copied`, 'success');
+    // Reuse an already-revealed key rather than spending a second audited read on it.
+    if (revealedKey !== null) {
+      void navigator.clipboard.writeText(revealedKey);
+      // eslint-disable-next-line lingui/no-unlocalized-strings -- toast tone token, not UI copy
+      toast(t`Upstream key copied`, 'success');
+      return;
+    }
+    revealKey.mutate(undefined, {
+      onSuccess: key => {
+        void navigator.clipboard.writeText(key);
+        // eslint-disable-next-line lingui/no-unlocalized-strings -- toast tone token, not UI copy
+        toast(t`Upstream key copied`, 'success');
+      },
+      onError: () => setFeedback({ tone: 'error', message: t`Could not read the upstream API key.` }),
+    });
   }
 
   return (
@@ -125,15 +148,16 @@ export function UpstreamKeyRow({ provider }: UpstreamKeyRowProps) {
         ) : (
           <>
             <code className="flex-1 font-mono text-body text-secondary overflow-hidden text-ellipsis whitespace-nowrap">
-              {isRevealed ? provider.upstreamApiKey : maskKey(provider.upstreamApiKey)}
+              {revealedKey ?? provider.upstreamApiKeyPreview}
             </code>
             <Button
               data-testid="provider-upstream-key-reveal-btn"
               size="sm"
               variant="ghost"
-              onClick={() => setIsRevealed(value => !value)}
+              loading={revealKey.isPending}
+              onClick={toggleReveal}
             >
-              {isRevealed ? <Trans>Hide</Trans> : <Trans>Reveal</Trans>}
+              {revealedKey !== null ? <Trans>Hide</Trans> : <Trans>Reveal</Trans>}
             </Button>
             <Button
               data-testid="provider-upstream-key-copy-btn"
diff --git a/frontend/src/features/providers/hooks/useProviderMutations.spec.tsx b/frontend/src/features/providers/hooks/useProviderMutations.spec.tsx
index 1013698ea..a1273a11d 100644
--- a/frontend/src/features/providers/hooks/useProviderMutations.spec.tsx
+++ b/frontend/src/features/providers/hooks/useProviderMutations.spec.tsx
@@ -11,6 +11,7 @@ import { ProviderConnectionTestError } from '../../../lib/providerConnection';
 const mocks = vi.hoisted(() => ({
   testConnection: vi.fn(),
   update: vi.fn(),
+  getUpstreamKey: vi.fn(),
   toast: vi.fn(),
 }));
 
@@ -18,13 +19,13 @@ vi.mock('../../../api/setup', () => ({
   setupApi: { testConnection: mocks.testConnection },
 }));
 vi.mock('../../../api/providers', () => ({
-  providersApi: { update: mocks.update },
+  providersApi: { update: mocks.update, getUpstreamKey: mocks.getUpstreamKey },
 }));
 vi.mock('../../../hooks/useToast', () => ({
   default: () => ({ show: mocks.toast }),
 }));
 
-import { useRotateUpstreamKey } from './useProviderMutations';
+import { useRevealUpstreamKey, useRotateUpstreamKey } from './useProviderMutations';
 
 (globalThis as Record<string, unknown>).IS_REACT_ACT_ENVIRONMENT = true;
 
@@ -32,7 +33,7 @@ const provider: ProviderDto = {
   id: 'provider-1',
   name: 'OpenAI',
   endpoint: 'https://api.openai.com/v1',
-  upstreamApiKey: 'sk-old',
+  upstreamApiKeyPreview: 'sk-••••••••••••-old',
   kind: ModelProviderKind.OpenAi,
   createdAt: '2026-01-01T00:00:00Z',
   updatedAt: '2026-01-01T00:00:00Z',
@@ -43,12 +44,20 @@ let root: Root;
 let container: HTMLDivElement;
 let queryClient: QueryClient;
 
+let latestReveal: ReturnType<typeof useRevealUpstreamKey> | null = null;
+
 function Host() {
   const rotation = useRotateUpstreamKey(provider);
-  useEffect(() => { latest = rotation; });
+  const reveal = useRevealUpstreamKey(provider.id);
+  useEffect(() => { latest = rotation; latestReveal = reveal; });
   return null;
 }
 
+function reveal(): ReturnType<typeof useRevealUpstreamKey> {
+  if (latestReveal === null) throw new Error('Reveal hook has not rendered');
+  return latestReveal;
+}
+
 function rotation(): ReturnType<typeof useRotateUpstreamKey> {
   if (latest === null) throw new Error('Rotation hook has not rendered');
   return latest;
@@ -58,7 +67,7 @@ beforeAll(() => i18n.loadAndActivate({ locale: 'en', messages: {} }));
 
 beforeEach(() => {
   vi.clearAllMocks();
-  mocks.update.mockResolvedValue({ ...provider, upstreamApiKey: 'sk-new' });
+  mocks.update.mockResolvedValue({ ...provider, upstreamApiKeyPreview: 'sk-••••••••••••-new' });
   latest = null;
   queryClient = new QueryClient({ defaultOptions: { mutations: { retry: false } } });
   container = document.createElement('div');
@@ -141,6 +150,30 @@ describe('useRotateUpstreamKey', () => {
     expect(mocks.toast).toHaveBeenCalledWith('Upstream API key updated.', 'success');
   });
 
+  it('fetches the cleartext key only when reveal is invoked, never on render', async () => {
+    // The key used to arrive with the providers page itself. It must now cost an explicit,
+    // server-audited request — so simply rendering the hook must not ask for it.
+    expect(mocks.getUpstreamKey).not.toHaveBeenCalled();
+
+    mocks.getUpstreamKey.mockResolvedValue({ upstreamApiKey: 'sk-secret' });
+    let revealed: string | undefined;
+    await act(async () => {
+      revealed = await reveal().mutateAsync();
+    });
+
+    expect(mocks.getUpstreamKey).toHaveBeenCalledExactlyOnceWith(provider.id);
+    expect(revealed).toBe('sk-secret');
+  });
+
+  it('keeps the revealed key out of the query cache', async () => {
+    // A secret in the Query cache outlives the moment the user asked for it.
+    mocks.getUpstreamKey.mockResolvedValue({ upstreamApiKey: 'sk-secret' });
+    await act(async () => { await reveal().mutateAsync(); });
+
+    const cached = JSON.stringify(queryClient.getQueryCache().getAll().map(q => q.state.data));
+    expect(cached).not.toContain('sk-secret');
+  });
+
   it('saves when verification succeeds with zero reported models', async () => {
     mocks.testConnection.mockResolvedValue({
       success: true,
diff --git a/frontend/src/features/providers/hooks/useProviderMutations.ts b/frontend/src/features/providers/hooks/useProviderMutations.ts
index 4af2f7ca6..54d4389fd 100644
--- a/frontend/src/features/providers/hooks/useProviderMutations.ts
+++ b/frontend/src/features/providers/hooks/useProviderMutations.ts
@@ -24,17 +24,32 @@ export function useCreateProvider() {
 export function useUpdateProviderKind() {
   const qc = useQueryClient();
   return useMutation({
-    mutationFn: (args: { provider: { id: string; name: string; endpoint: string; upstreamApiKey: string }; kind: ModelProviderKind }) =>
+    mutationFn: (args: { provider: { id: string; name: string; endpoint: string }; kind: ModelProviderKind }) =>
       providersApi.update(args.provider.id, {
         name: args.provider.name,
         endpoint: args.provider.endpoint,
-        upstreamApiKey: args.provider.upstreamApiKey,
+        // null = leave the stored credential alone. The client does not hold the upstream key, so
+        // there is nothing to echo back on an edit that only changes the kind.
+        upstreamApiKey: null,
         kind: args.kind,
       }),
     onSuccess: () => qc.invalidateQueries({ queryKey: QUERY_KEYS.providersOverview }),
   });
 }
 
+/**
+ * Fetches a provider's upstream credential on demand.
+ *
+ * Deliberately a mutation, not a query: the key must never enter the Query cache, where it would
+ * outlive the moment the user asked for it and be visible to anything reading the cache. The server
+ * audits every call, so it is only invoked on an explicit reveal or copy.
+ */
+export function useRevealUpstreamKey(providerId: string) {
+  return useMutation({
+    mutationFn: () => providersApi.getUpstreamKey(providerId).then(r => r.upstreamApiKey),
+  });
+}
+
 /** Verifies a replacement upstream key before persisting it. */
 export function useRotateUpstreamKey(provider: ProviderDto) {
   const { t } = useLingui();
@@ -65,6 +80,7 @@ export function useRotateUpstreamKey(provider: ProviderDto) {
         upstreamApiKey: newKey,
         kind: provider.kind,
       });
+
       return { provider: saved, modelCount: verification.modelCount };
     },
     onSuccess: () => {
diff --git a/frontend/src/features/providers/keyScopes.ts b/frontend/src/features/providers/keyScopes.ts
index 84c4c24dc..448e38ee8 100644
--- a/frontend/src/features/providers/keyScopes.ts
+++ b/frontend/src/features/providers/keyScopes.ts
@@ -3,11 +3,12 @@ import type { ApiKeyScope } from '../../api/models';
 // ApiKeyScope members and the `/mcp` path are domain identifiers, not translatable UI copy. Keeping
 // them in this plain-.ts module (where the lingui lint rule does not apply) keeps the feature's .tsx
 // literal-free.
-export const SCOPE_ORDER: ApiKeyScope[] = ['Ingestion', 'McpRead', 'McpWrite', 'ApiRead', 'ApiWrite'];
+export const SCOPE_ORDER: ApiKeyScope[] = ['Ingestion', 'Passthrough', 'McpRead', 'McpWrite', 'ApiRead', 'ApiWrite'];
 
 /** Single-letter mnemonic shown on the capability chip. Lowercase r/w mark the REST API pair. */
 export const SCOPE_LETTER: Record<ApiKeyScope, string> = {
   Ingestion: 'P',
+  Passthrough: 'F',
   McpRead: 'R',
   McpWrite: 'W',
   ApiRead: 'r',
diff --git a/frontend/src/features/providers/providerMeta.spec.ts b/frontend/src/features/providers/providerMeta.spec.ts
index b67f50f13..c21d294a2 100644
--- a/frontend/src/features/providers/providerMeta.spec.ts
+++ b/frontend/src/features/providers/providerMeta.spec.ts
@@ -1,7 +1,7 @@
 import { beforeAll, describe, it, expect } from 'vitest';
 import { ModelProviderKind } from '../../api/models';
 import { i18n } from '../../i18n';
-import { kindLabel, kindColor, maskKey, isDefaultEndpoint, isAzureEndpoint } from './providerMeta';
+import { kindLabel, kindColor, isDefaultEndpoint, isAzureEndpoint } from './providerMeta';
 
 // Activate an empty catalog so i18n._() resolves MessageDescriptors to their source strings.
 beforeAll(() => i18n.loadAndActivate({ locale: 'en', messages: {} }));
@@ -24,16 +24,6 @@ describe('kindColor', () => {
   });
 });
 
-describe('maskKey', () => {
-  it('fully masks short keys', () => {
-    expect(maskKey('short')).toBe('••••••••');
-    expect(maskKey('12345678')).toBe('••••••••');
-  });
-  it('shows a prefix and suffix for long keys', () => {
-    expect(maskKey('sk-ant-abcdef0123456789')).toBe('sk-ant-••••••••••••6789');
-  });
-});
-
 describe('isDefaultEndpoint', () => {
   it('treats the canonical OpenAI endpoint as default', () => {
     expect(isDefaultEndpoint(ModelProviderKind.OpenAi, 'https://api.openai.com/v1')).toBe(true);
diff --git a/frontend/src/features/providers/providerMeta.ts b/frontend/src/features/providers/providerMeta.ts
index 040e991a6..9ad204257 100644
--- a/frontend/src/features/providers/providerMeta.ts
+++ b/frontend/src/features/providers/providerMeta.ts
@@ -17,10 +17,6 @@ export function kindColor(k: ModelProviderKind): string {
   return 'var(--text-muted)';
 }
 
-export function maskKey(k: string): string {
-  return k.length <= 8 ? '••••••••' : k.slice(0, 7) + '••••••••••••' + k.slice(-4);
-}
-
 const DEFAULT_ENDPOINT: Partial<Record<ModelProviderKind, string>> = {
   [ModelProviderKind.OpenAi]: 'https://api.openai.com/v1',
 };
diff --git a/frontend/src/locales/de/messages.po b/frontend/src/locales/de/messages.po
index c8b18544e..2cc14c853 100644
--- a/frontend/src/locales/de/messages.po
+++ b/frontend/src/locales/de/messages.po
@@ -1519,6 +1519,9 @@ msgstr "Die Trace für diese Antwort konnte nicht geöffnet werden."
 msgid "Could not reach the provider."
 msgstr "Der Anbieter konnte nicht erreicht werden."
 
+msgid "Could not read the upstream API key."
+msgstr "Der Upstream-API-Schlüssel konnte nicht gelesen werden."
+
 msgid "Could not reset your password. Please try again."
 msgstr "Das Passwort konnte nicht zurückgesetzt werden. Bitte versuchen Sie es erneut."
 
@@ -3929,6 +3932,9 @@ msgstr "Provider-Konfiguration gelöscht"
 msgid "Provider Config Updated"
 msgstr "Provider-Config aktualisiert"
 
+msgid "Provider Key Revealed"
+msgstr "Provider-Schlüssel angezeigt"
+
 msgid "Provider Key Rotated"
 msgstr "Provider-Schlüssel rotiert"
 
@@ -5345,6 +5351,9 @@ msgstr "Trace gelöscht"
 msgid "Trace is still being captured — try again in a moment."
 msgstr "Trace wird noch erfasst — bitte in einem Moment erneut versuchen."
 
+msgid "Trace limit reached"
+msgstr "Trace-Limit erreicht"
+
 #. placeholder {0}: trace.model
 msgid "Trace preview · {0}"
 msgstr "Trace-Vorschau · {0}"
@@ -5509,6 +5518,12 @@ msgstr "Upstream-API-Schlüssel aktualisiert."
 msgid "Upstream key copied"
 msgstr "Upstream-Schlüssel kopiert"
 
+msgid "Upstream pass-through"
+msgstr "Upstream-Pass-through"
+
+msgid "Upstream pass-through — forward non-inference paths (such as /health) to the provider using its own credential. Not traced, and not checked by detectors."
+msgstr "Upstream-Pass-through — leitet Nicht-Inferenz-Pfade (etwa /health) mit den eigenen Zugangsdaten an den Provider weiter. Wird nicht als Trace erfasst und nicht von Detektoren geprüft."
+
 msgid "Use your resource’s OpenAI-compatible v1 endpoint. Model discovery lists the models you have deployed."
 msgstr "Verwenden Sie den OpenAI-kompatiblen v1-Endpunkt Ihrer Ressource. Die Modellauswahl zeigt die Modelle an, die Sie bereitgestellt haben."
 
diff --git a/frontend/src/locales/en/messages.po b/frontend/src/locales/en/messages.po
index aaca6fcc6..b477aa4d8 100644
--- a/frontend/src/locales/en/messages.po
+++ b/frontend/src/locales/en/messages.po
@@ -1519,6 +1519,9 @@ msgstr "Could not open the trace for this response."
 msgid "Could not reach the provider."
 msgstr "Could not reach the provider."
 
+msgid "Could not read the upstream API key."
+msgstr "Could not read the upstream API key."
+
 msgid "Could not reset your password. Please try again."
 msgstr "Could not reset your password. Please try again."
 
@@ -3929,6 +3932,9 @@ msgstr "Provider Config Deleted"
 msgid "Provider Config Updated"
 msgstr "Provider Config Updated"
 
+msgid "Provider Key Revealed"
+msgstr "Provider Key Revealed"
+
 msgid "Provider Key Rotated"
 msgstr "Provider Key Rotated"
 
@@ -5345,6 +5351,9 @@ msgstr "Trace Deleted"
 msgid "Trace is still being captured — try again in a moment."
 msgstr "Trace is still being captured — try again in a moment."
 
+msgid "Trace limit reached"
+msgstr "Trace limit reached"
+
 #. placeholder {0}: trace.model
 msgid "Trace preview · {0}"
 msgstr "Trace preview · {0}"
@@ -5509,6 +5518,12 @@ msgstr "Upstream API key updated."
 msgid "Upstream key copied"
 msgstr "Upstream key copied"
 
+msgid "Upstream pass-through"
+msgstr "Upstream pass-through"
+
+msgid "Upstream pass-through — forward non-inference paths (such as /health) to the provider using its own credential. Not traced, and not checked by detectors."
+msgstr "Upstream pass-through — forward non-inference paths (such as /health) to the provider using its own credential. Not traced, and not checked by detectors."
+
 msgid "Use your resource’s OpenAI-compatible v1 endpoint. Model discovery lists the models you have deployed."
 msgstr "Use your resource’s OpenAI-compatible v1 endpoint. Model discovery lists the models you have deployed."
 
diff --git a/frontend/src/locales/es/messages.po b/frontend/src/locales/es/messages.po
index 6bea67350..e10ec9505 100644
--- a/frontend/src/locales/es/messages.po
+++ b/frontend/src/locales/es/messages.po
@@ -1519,6 +1519,9 @@ msgstr "No se pudo abrir el Trace de esta respuesta."
 msgid "Could not reach the provider."
 msgstr "No se pudo contactar con el proveedor."
 
+msgid "Could not read the upstream API key."
+msgstr "No se pudo leer la API key de upstream."
+
 msgid "Could not reset your password. Please try again."
 msgstr "No se pudo restablecer tu contraseña. Por favor, inténtalo de nuevo."
 
@@ -3929,6 +3932,9 @@ msgstr "Configuración de Provider eliminada"
 msgid "Provider Config Updated"
 msgstr "Configuración de Provider actualizada"
 
+msgid "Provider Key Revealed"
+msgstr "Clave de Provider revelada"
+
 msgid "Provider Key Rotated"
 msgstr "Clave de Provider rotada"
 
@@ -5345,6 +5351,9 @@ msgstr "Trace eliminada"
 msgid "Trace is still being captured — try again in a moment."
 msgstr "El Trace aún se está capturando — inténtalo de nuevo en un momento."
 
+msgid "Trace limit reached"
+msgstr "Límite de Traces alcanzado"
+
 #. placeholder {0}: trace.model
 msgid "Trace preview · {0}"
 msgstr "Vista previa de Trace · {0}"
@@ -5509,6 +5518,12 @@ msgstr "API key de upstream actualizada."
 msgid "Upstream key copied"
 msgstr "API key de upstream copiada"
 
+msgid "Upstream pass-through"
+msgstr "Paso directo al upstream"
+
+msgid "Upstream pass-through — forward non-inference paths (such as /health) to the provider using its own credential. Not traced, and not checked by detectors."
+msgstr "Paso directo al upstream: reenvía rutas que no son de inferencia (como /health) al Provider usando su propia credencial. No se registra como Trace ni lo revisan los detectores."
+
 msgid "Use your resource’s OpenAI-compatible v1 endpoint. Model discovery lists the models you have deployed."
 msgstr "Usa el endpoint v1 compatible con OpenAI de tu recurso. La detección de modelos lista los modelos que has desplegado."
 
diff --git a/frontend/src/locales/fr/messages.po b/frontend/src/locales/fr/messages.po
index 83bae9abd..cdf784732 100644
--- a/frontend/src/locales/fr/messages.po
+++ b/frontend/src/locales/fr/messages.po
@@ -1519,6 +1519,9 @@ msgstr "Impossible d’ouvrir le Trace pour cette réponse."
 msgid "Could not reach the provider."
 msgstr "Impossible de joindre le fournisseur."
 
+msgid "Could not read the upstream API key."
+msgstr "Impossible de lire l'API key amont."
+
 msgid "Could not reset your password. Please try again."
 msgstr "Impossible de réinitialiser votre mot de passe. Veuillez réessayer."
 
@@ -3929,6 +3932,9 @@ msgstr "Configuration du Provider supprimée"
 msgid "Provider Config Updated"
 msgstr "Configuration de Provider mise à jour"
 
+msgid "Provider Key Revealed"
+msgstr "Clé de Provider affichée"
+
 msgid "Provider Key Rotated"
 msgstr "Clé de Provider renouvelée"
 
@@ -5345,6 +5351,9 @@ msgstr "Trace supprimée"
 msgid "Trace is still being captured — try again in a moment."
 msgstr "Le Trace est toujours en cours de capture — réessayez dans un instant."
 
+msgid "Trace limit reached"
+msgstr "Limite de Traces atteinte"
+
 #. placeholder {0}: trace.model
 msgid "Trace preview · {0}"
 msgstr "Aperçu de Trace · {0}"
@@ -5509,6 +5518,12 @@ msgstr "API key amont mise à jour."
 msgid "Upstream key copied"
 msgstr "API key amont copiée"
 
+msgid "Upstream pass-through"
+msgstr "Relais direct amont"
+
+msgid "Upstream pass-through — forward non-inference paths (such as /health) to the provider using its own credential. Not traced, and not checked by detectors."
+msgstr "Relais direct amont — transmet les chemins hors inférence (comme /health) au Provider avec ses propres identifiants. Non enregistré comme Trace et non contrôlé par les détecteurs."
+
 msgid "Use your resource’s OpenAI-compatible v1 endpoint. Model discovery lists the models you have deployed."
 msgstr "Utilisez le endpoint v1 OpenAI-compatible de votre ressource. La découverte de modèle liste les modèles que vous avez déployés."
 
diff --git a/frontend/src/locales/it/messages.po b/frontend/src/locales/it/messages.po
index 71397f36b..ca587bf44 100644
--- a/frontend/src/locales/it/messages.po
+++ b/frontend/src/locales/it/messages.po
@@ -1519,6 +1519,9 @@ msgstr "Impossibile aprire il Trace per questa risposta."
 msgid "Could not reach the provider."
 msgstr "Impossibile contattare il provider."
 
+msgid "Could not read the upstream API key."
+msgstr "Impossibile leggere l'API key upstream."
+
 msgid "Could not reset your password. Please try again."
 msgstr "Impossibile reimpostare la password. Riprova."
 
@@ -3929,6 +3932,9 @@ msgstr "Configurazione di Provider eliminata"
 msgid "Provider Config Updated"
 msgstr "Configurazione Provider aggiornata"
 
+msgid "Provider Key Revealed"
+msgstr "Chiave Provider rivelata"
+
 msgid "Provider Key Rotated"
 msgstr "Chiave Provider ruotata"
 
@@ -5345,6 +5351,9 @@ msgstr "Trace eliminata"
 msgid "Trace is still being captured — try again in a moment."
 msgstr "Il Trace è ancora in fase di acquisizione — riprova tra un momento."
 
+msgid "Trace limit reached"
+msgstr "Limite di Trace raggiunto"
+
 #. placeholder {0}: trace.model
 msgid "Trace preview · {0}"
 msgstr "Anteprima Trace · {0}"
@@ -5509,6 +5518,12 @@ msgstr "API key upstream aggiornata."
 msgid "Upstream key copied"
 msgstr "API key upstream copiata"
 
+msgid "Upstream pass-through"
+msgstr "Pass-through upstream"
+
+msgid "Upstream pass-through — forward non-inference paths (such as /health) to the provider using its own credential. Not traced, and not checked by detectors."
+msgstr "Pass-through upstream — inoltra i percorsi non di inferenza (come /health) al Provider usando le sue credenziali. Non registrato come Trace e non controllato dai detector."
+
 msgid "Use your resource’s OpenAI-compatible v1 endpoint. Model discovery lists the models you have deployed."
 msgstr "Usa l'endpoint v1 OpenAI-compatible della tua risorsa. La discovery dei modelli elenca i modelli che hai distribuito."
 
diff --git a/manual/admin/configuration.md b/manual/admin/configuration.md
index 421ccdafa..0cdd461ed 100644
--- a/manual/admin/configuration.md
+++ b/manual/admin/configuration.md
@@ -66,6 +66,25 @@ behind a reverse proxy or its own domain. When unset, the UI falls back to its o
 which is only correct if your own reverse proxy routes ingestion paths
 (`/{project}/openai/v1/…`) to the proxy service.
 
+### Data directory (`PROXYTRACE_DATA_DIR`)
+
+`PROXYTRACE_DATA_DIR` is the writable directory holding the state that must outlive the
+container: the **Data Protection key ring** (which encrypts your stored provider API keys, TOTP/MFA
+enrollments and the SMTP password), the session signing key, and the offline license-status cache.
+
+The official images already default it (`/app/data` in the split shape, `/data/appdata` in the
+single-container shape), and the supplied compose files mount a persistent volume there — so a
+standard installation needs no action. **Every process that reads or writes secrets must point at
+the same directory**: in the split shape the API *and* the ingestion proxy mount the shared
+`appdata` volume, because the proxy decrypts the upstream provider key the API encrypted.
+
+If you write your own deployment manifest (for example a Kubernetes Deployment) and leave the
+variable unset — or point it at a path that is not persisted — the key ring lives only in memory.
+The application still starts and looks healthy, but after every restart the encrypted secrets fail
+to decrypt and are read back as unset, which shows up only as upstream `401`s from your provider
+and rejected authenticator codes. To make that impossible to miss, an unset `PROXYTRACE_DATA_DIR`
+is reported at **Critical** at startup, so it appears in [Error Log](/admin/error-log).
+
 ### Model pricing feeds
 
 Proxytrace auto-fetches model prices when a provider is added (and when its **Reload models &
@@ -275,6 +294,42 @@ applies to the bundled manual at `/docs` (which needs a slightly relaxed `script
 
 Empty values are rejected on startup.
 
+## Running behind your own reverse proxy
+
+The released all-in-one image needs nothing here: its bundled nginx and the API share a
+container and talk over the loopback interface, which Proxytrace trusts out of the box. Two
+things then work correctly on their own — the session cookie is marked `Secure`, and the
+sign-in, password-reset and two-factor rate limits apply per client.
+
+If you instead run the API **behind your own reverse proxy or load balancer**, tell Proxytrace
+which hop to trust. Until you do, it ignores the `X-Forwarded-For` and `X-Forwarded-Proto`
+headers your proxy sends, and every request looks like it came from the proxy itself — so the
+per-client rate limits collapse into a single shared bucket that one caller can exhaust for
+everyone.
+
+| Setting | What it does |
+|---|---|
+| `ForwardedHeaders__KnownProxies` | The address of your proxy. Comma-separated for several. |
+| `ForwardedHeaders__KnownNetworks` | A CIDR range to trust instead, e.g. `10.1.0.0/16`. |
+
+```yaml
+environment:
+  - ForwardedHeaders__KnownProxies=10.1.0.7
+```
+
+::: danger Trust only the proxy itself
+Only list addresses that **exclusively** belong to your proxy. Anything in the trusted set can
+choose its own apparent client address, which lets it sidestep the rate limits entirely — so a
+range that untrusted clients can also originate from is worse than leaving this unset. In
+particular, if you publish the API's own port so it is reachable without going through the
+proxy, do not trust the network that reaches it.
+:::
+
+If you terminate TLS at your proxy and deliberately serve Proxytrace over plain HTTP on a
+non-`localhost` address, the session cookie's `Secure` flag will stop the browser from sending
+it. Prefer fixing the TLS path; as a last resort set
+`Authentication__SessionCookie__Secure=false`, which sends session tokens in the clear.
+
 ## Endpoint tuning
 
 A few API limits are configurable; the defaults are sensible and rarely need changing. Invalid
diff --git a/manual/admin/licensing.md b/manual/admin/licensing.md
index aeaf9c220..7dfdfadb2 100644
--- a/manual/admin/licensing.md
+++ b/manual/admin/licensing.md
@@ -169,6 +169,28 @@ licensed one: cyan when the license is active, amber while a re-check is pending
 monthly trace quota is exhausted, a banner appears above the top bar warning
 that new traces are being dropped until the quota resets.
 
+### What happens when the monthly trace limit is reached
+
+The trace limit applies to the **whole installation**, but reaching it does not stop every project
+from capturing.
+
+Each project is measured against an equal share of the limit. Once the installation is at its cap,
+only projects **above** their share stop being captured; a project that has used little of its share
+carries on. So one busy project can no longer consume the month's allowance and take every other
+project's tracing down with it.
+
+When a project starts being throttled you get told, rather than having to notice traces going
+missing:
+
+- A **notification** is raised for that project ("Trace limit reached"), naming how many traces it
+  has captured and what its share is.
+- An entry appears in the **Error Log** recording that the installation reached its cap and that
+  dropping has begun.
+
+Proxied calls themselves keep working throughout — only the *recording* of them stops. Proxytrace
+will not fail a customer's LLM request because of a billing limit, which is why the drop has to be
+reported rather than returned as an error.
+
 The **agent** limit is enforced differently because agents are discovered automatically from
 captured traces rather than created by an explicit request. Once the agent limit is reached,
 traces that would create a **new** agent are silently dropped (a warning is logged); traces
diff --git a/manual/admin/providers-and-api-keys.md b/manual/admin/providers-and-api-keys.md
index e21793f2b..bade9a703 100644
--- a/manual/admin/providers-and-api-keys.md
+++ b/manual/admin/providers-and-api-keys.md
@@ -44,6 +44,19 @@ custom or self-hosted endpoint is shown). The model
 list is **pulled from the provider** — there is no manual "add model" control; use reload (or wait
 for the periodic refresh) to pick up newly deployed models.
 
+### Viewing an upstream API key
+
+The **Upstream API key** row shows the stored credential masked — a few leading and trailing
+characters, enough to tell two keys apart and to confirm a rotation took effect.
+
+Choosing **Reveal** (or **Copy**) fetches the key itself. Only administrators can do this, and
+**every reveal is recorded in the audit log** as *Provider Key Revealed*, naming the administrator
+and the provider. The key value itself is never written to the audit log.
+
+The key is fetched only at the moment you ask for it. It is not part of the providers page's data,
+so simply opening the page — or leaving it open — does not put any provider credential in front of
+the browser.
+
 ### Rotating an upstream API key
 
 To replace the credential Proxytrace uses when forwarding requests to a provider:
@@ -106,6 +119,10 @@ Each key also carries explicit **capabilities** (least privilege), chosen when y
 - **REST API write** — additionally create and change data over the REST API (`POST`/`PUT`/`PATCH`/
   `DELETE`). A REST key acts as its owner and, like an MCP key, can never reach admin-only endpoints.
 
+A REST key is confined to its own project, so list endpoints that take an optional `projectId` return
+that project's rows whether or not you pass one — there is no need to repeat the project on every
+call, and a key can never widen its reach by omitting it.
+
 A key works only on the surfaces it was granted: an ingestion-only key cannot drive MCP or the REST API,
 an MCP-only key cannot proxy LLM traffic or drive REST, and a REST key cannot drive MCP. Keys issued
 before these capabilities existed are **ingestion-only**.
diff --git a/manual/admin/user-management.md b/manual/admin/user-management.md
index 55c76be57..4b7cd1910 100644
--- a/manual/admin/user-management.md
+++ b/manual/admin/user-management.md
@@ -24,6 +24,16 @@ own** account from this page. Those actions are disabled in the UI and rejected
 (HTTP 409), so the instance can never be locked out of administration.
 :::
 
+::: warning A user who owns API keys cannot be deleted outright
+Every API key records the person who created it. Deleting a user who still owns keys is **refused**,
+and the message lists the keys by name.
+
+This is deliberate: an API key is stored in a form that cannot be read back, so a deleted key cannot
+be restored — only replaced — and anything configured with it stops working immediately, with no
+indication beyond rejected requests. Before deleting the user, go to **Settings → Providers** and
+either delete the keys (updating whatever uses them) or reissue equivalents under another owner.
+:::
+
 ## Adding users (local mode)
 
 When Proxytrace uses local username/password authentication, users are onboarded by invitation —
diff --git a/manual/guide/proxy-setup.md b/manual/guide/proxy-setup.md
index f6a7a49cb..bc53ec352 100644
--- a/manual/guide/proxy-setup.md
+++ b/manual/guide/proxy-setup.md
@@ -52,6 +52,26 @@ your browser's URL bar.
 - **Collisions.** If the same string is valid as both a Proxytrace key and an upstream
   provider key, the Proxytrace key wins.
 
+::: warning An upstream provider key is not scoped to a project
+This is the deliberate trade-off that makes the "same key, several projects" setup above work, and
+it is worth understanding before you rely on it.
+
+When the bearer is the **upstream provider's own key**, Proxytrace has no way to tell which project
+the call belongs to except the path segment — so whoever holds that key chooses it, by editing the
+URL. Two consequences:
+
+- **Attribution.** Traces can be recorded against any project, so per-project trace counts and costs
+  are only as trustworthy as the holders of that key.
+- **Blocking rules.** Detectors are configured per project, and the **chosen** project's rules are
+  the ones applied. Pointing the path at a project with no detectors therefore means the call is not
+  evaluated against any blocking rule.
+
+If either matters — you rely on detectors to block prompts, or on per-project attribution for
+chargeback — issue a **Proxytrace key per project** instead. A Proxytrace key carries its own
+project, so the path cannot override it: supply a mismatched segment and the request is rejected
+rather than re-attributed.
+:::
+
 ### The project segment
 
 The proxy base URL carries the project as the first path segment:
@@ -161,6 +181,29 @@ require a valid key for the project, exactly like a traced call. If the upstream
 redirect, Proxytrace relays the `3xx` (including its `Location`) back to your client verbatim
 rather than following it server-side — `Location` values are not rewritten to proxy URLs.
 
+::: warning Pass-through needs its own permission, and reaches the whole upstream host
+Forwarding is deliberately unrestricted in *path*: **any** method and **any** path under
+`/{project}/` is relayed to the provider's host with your real upstream key attached. That is what
+makes `/health` and other provider-specific routes work without configuration, but it also means the
+reach is the provider account's, not just its inference API — on a provider that serves account or
+organization-management routes at the same host, a key that can pass through can reach those too.
+Pass-through calls are **not evaluated by detectors, not traced, and not written to the audit log**,
+by design, since Proxytrace does not interpret their payloads.
+
+Because that reach differs in kind from capturing traffic, it is a **separate permission**:
+
+- A Proxytrace API key must carry the **Upstream pass-through** capability. A key with only
+  **Ingestion proxy** can capture LLM calls but gets `403 Forbidden` on any other path.
+- **Keys created before this permission existed keep it**, so an existing `/health` setup is
+  unaffected by upgrading. New keys must be granted it deliberately — choose it when creating the
+  key under **Settings → Providers**.
+- Calls authenticated with the **provider's own upstream key** are not restricted, since anyone
+  holding that key can already call the provider directly.
+
+Grant it only to clients that need it, issue keys per client so they can be revoked individually,
+and if your provider offers scoped upstream keys, configure the provider in Proxytrace with one.
+:::
+
 ::: tip Which upstream, which path
 The target is the **host** of the project's provider — the same provider your LLM calls resolve
 to. The path after `/{project}/` is forwarded to that host's root, so `/{project}/health` maps to
diff --git a/manual/public/screenshots/theories/board.png b/manual/public/screenshots/theories/board.png
index eadd10834..30ef83e7e 100644
Binary files a/manual/public/screenshots/theories/board.png and b/manual/public/screenshots/theories/board.png differ
diff --git a/manual/screenshots/_capture.mjs b/manual/screenshots/_capture.mjs
deleted file mode 100644
index 787a0422f..000000000
--- a/manual/screenshots/_capture.mjs
+++ /dev/null
@@ -1,26 +0,0 @@
-import { launch, goto, shot, waitForReady, outDir } from './capture-lib.mjs';
-import { join } from 'node:path';
-
-await waitForReady();
-const { browser, page } = await launch();
-const dir = outDir('traces');
-
-await goto(page, '/traces', '[data-testid="traces-timeline"]');
-
-// The auto-default snaps to the smallest quick range holding data — which is the sample client's
-// last minute. Widen to 7 days so the strip shows the seeded history's diurnal shape.
-await page.getByTestId('traces-time-trigger').click();
-await page.getByTestId('traces-time-preset-7d').click();
-await page.keyboard.press('Escape'); // close the picker popover before shooting
-await page.waitForTimeout(2000);
-
-await shot(page, join(dir, 'list.png'));
-
-// The strip on its own, with the hover playhead + readout showing.
-const strip = page.locator('[data-testid="traces-timeline"]');
-const box = await strip.boundingBox();
-await page.mouse.move(box.x + box.width * 0.63, box.y + box.height * 0.4);
-await page.waitForTimeout(500);
-await shot(page, join(dir, 'timeline.png'), { selector: '[data-testid="traces-timeline"]' });
-
-await browser.close();
diff --git a/perf/Proxytrace.PerfHarness/Scenarios/QueryLatencyScenario.cs b/perf/Proxytrace.PerfHarness/Scenarios/QueryLatencyScenario.cs
index e0e19f910..b25b53a12 100644
--- a/perf/Proxytrace.PerfHarness/Scenarios/QueryLatencyScenario.cs
+++ b/perf/Proxytrace.PerfHarness/Scenarios/QueryLatencyScenario.cs
@@ -67,6 +67,13 @@ await Measure("agentCallsListByTimeRange",
             () => callRepo.GetFilteredListAsync(new AgentCallFilter(From: recent, To: now), 1, 50, cancellationToken));
         await Measure("agentCallsHistogram",
             () => callRepo.GetHistogramAsync(new AgentCallFilter(AgentId: agentId), 50, cancellationToken));
+        // Multi-project scope (#482): an unfiltered list from a caller who may read several
+        // projects filters on a set instead of one id. Same shape as the single-project branch — a
+        // semi-join against AgentVersion(Project) — so it must stay in the same class as
+        // agentCallsList rather than degrading into a client-side filter over every row.
+        await Measure("agentCallsListByProjects",
+            () => callRepo.GetFilteredListAsync(
+                new AgentCallFilter(ProjectIds: [projectId ?? Guid.Empty, Guid.NewGuid()]), 1, 50, cancellationToken));
 
         // Filtered-set summary — the traces KPI band. The list scrolls rather than pages, so this
         // aggregate spans EVERY matching row, not a page: at 1M rows the unfiltered case is a full
@@ -171,6 +178,14 @@ await Measure("agentOverview",
         await Measure("agentDistributions",
             () => agentStats.GetAgentDistributionsAsync(agentId, from, now, cancellationToken));
 
+        // Last-call timestamps. The whole-table grouping backs the agents LIST; the filtered variant
+        // backs the single-agent GET, which used to run the grouping and so scaled with the trace
+        // table rather than with the one agent. Measuring both keeps that separation honest.
+        await Measure("agentLastCallTimesAll",
+            () => callRepo.GetLastCallTimesAsync(cancellationToken));
+        await Measure("agentLastCallTimeSingle",
+            () => callRepo.GetLastCallTimeAsync(agentId, cancellationToken));
+
         return results;
     }
 }
diff --git a/perf/Proxytrace.PerfHarness/Scenarios/TestRunStatsQueryScenario.cs b/perf/Proxytrace.PerfHarness/Scenarios/TestRunStatsQueryScenario.cs
index 3b78e9679..69c2028c3 100644
--- a/perf/Proxytrace.PerfHarness/Scenarios/TestRunStatsQueryScenario.cs
+++ b/perf/Proxytrace.PerfHarness/Scenarios/TestRunStatsQueryScenario.cs
@@ -1,5 +1,8 @@
 using Autofac;
+using Proxytrace.Domain;
+using Proxytrace.Domain.Evaluator;
 using Proxytrace.Domain.Statistics;
+using Proxytrace.Domain.TestResult;
 using Proxytrace.Domain.Statistics.TestRun;
 using Proxytrace.PerfHarness.Bootstrap;
 using Proxytrace.PerfHarness.Reporting;
@@ -71,6 +74,31 @@ await Measure("testRunStatsPassTotals",
         await Measure("testRunStatsRecentCohorts",
             () => aggregateReader.GetRecentCohortsAsync(new TestRunStats.Filter(), limit: 50, cancellationToken));
 
+        // Evaluator history. These used to take the most recent N test results across the whole
+        // install and filter by evaluator in memory, so their cost — and their correctness — was
+        // governed by total table size rather than by the evaluator asked about. They now filter in
+        // SQL over the EvaluationStat (EvaluatorId, CreatedAt) index, so the budgets below are the
+        // regression signal: a drift toward the full-scan aggregates means the filter stopped being
+        // pushed down.
+        var evaluators = scope.Resolve<IRepository<IEvaluator>>();
+        var testResults = scope.Resolve<ITestResultRepository>();
+        IReadOnlyList<IEvaluator> seededEvaluators = await evaluators.GetAllAsync(cancellationToken);
+        if (seededEvaluators.Count == 0)
+        {
+            Console.WriteLine("[db-layer] no evaluators seeded — skipping evaluator-history metrics");
+            return results;
+        }
+
+        Guid evaluatorId = seededEvaluators[0].Id;
+        Console.WriteLine($"[db-layer] evaluator history target={evaluatorId}");
+
+        await Measure("evaluatorLatestResult",
+            () => testResults.GetLatestByEvaluatorAsync(evaluatorId, cancellationToken));
+        await Measure("evaluatorRecentResults",
+            () => testResults.GetRecentByEvaluatorAsync(evaluatorId, count: 20, cancellationToken: cancellationToken));
+        await Measure("evaluatorSearchResults",
+            () => testResults.SearchByEvaluatorAsync(evaluatorId, "the", count: 20, cancellationToken));
+
         return results;
     }
 }
diff --git a/perf/perf-budgets.json b/perf/perf-budgets.json
index 1a919552f..eb2962cb3 100644
--- a/perf/perf-budgets.json
+++ b/perf/perf-budgets.json
@@ -1,6 +1,8 @@
 {
   "_comment": "Absolute performance budgets — the single source of truth for all three perf scopes (DB-layer runner, k6 HTTP, BenchmarkDotNet). A scope exits non-zero when a measured value breaches its budget. Most budgets are calibrated from a 1M-row run on a dev machine (2026-06); RECALIBRATE on your target/CI hardware. SIZING RULE: budget above a metric's run-to-run SPREAD, not above one observed sample — and note what the reported number is, because at the default --iterations 10 the 95th percentile of ten samples IS the slowest of the ten (PerfReport.Percentile: rank = ceil(0.95*10) = 10), so it already carries every scheduling hiccup and autovacuum pass the run happened to hit. For the heavy hundreds-of-ms aggregates that spread is a few percent, so ~20-30% headroom holds; for the SHORT sub-100ms queries the same absolute jitter is a large fraction of the cost (a 50ms query doubles on a busy host while an 800ms one moves 5%), so they need 3-4x — the same small-number reasoning already applied to the 25-40ms budgets on sub-millisecond index reads. anomalyTimeline was the one budget sized by the percentage rule despite being a short query, and it flapped for exactly that reason (#372). A missing key = measure but never fail.",
 
+  "_comment_listByProjects": "agentCallsListByProjects covers the multi-project scope added for #482: a list request from a caller who may read several projects (an unfiltered non-admin) filters AgentVersionId against the versions of a SET of projects rather than one. It is the same semi-join as the single-project branch with IN instead of =, so it belongs in the same class as agentCallsList; the budget is agentCallsList's plus headroom for the wider subquery, NOT a new class of cost. Regression signature: a climb toward the unfiltered-scan aggregates means the IN stopped translating and the scope is being applied client-side over every row — which at 1M is the exact failure mode the perf rule exists to catch. Measured against a two-element scope (one real project plus one absent id) so the set genuinely has to be evaluated. RECALIBRATE on your CI hardware.",
+
   "_comment_summary": "agentCallsSummary/agentCallsSummaryByTimeRange back the traces KPI band. The trace list scrolls rather than pages, so the band describes the WHOLE filtered set — these are unpaged aggregates by design, and the unfiltered case is a full-table scan at any size. The query GROUPs BY EndpointId (cost is priced per endpoint via CalculateCost and cannot be summed in SQL), so what crosses the wire is O(endpoints), never O(rows): EXPLAIN shows a HashAggregate over the scan emitting one row per endpoint, with width=42 on the scan — only the narrow scalar columns are read, never the request/response JSON. Budgets are measured p95 on a 1M dev seed (2026-07: 276.9ms / 170.6ms) plus ~45% headroom. Like the other scan-bound aggregates below, no index helps the unfiltered full-window case; the time-ranged variant rides the CreatedAt index and is the state the UI actually opens in. Regression signature: a jump toward seconds means either the cost fold started round-tripping per endpoint or the planner lost its statistics. RECALIBRATE on your CI hardware.",
 
   "_comment_sessionRemovalDeltas": "sessionRemovalDeltas times the aggregate trace retention reads BEFORE it deletes: the per-session totals of the doomed calls, which the sweep hands back to the session counters so a session header cannot keep claiming traces its timeline no longer holds (#436). A GROUP BY SessionId over the same indexed CreatedAt range the delete uses, null-session rows excluded — what crosses the wire is O(sessions in the window), never O(rows). The probe passes a cutoff covering the WHOLE seed, which is the worst case by design; the nightly sweep only ever sees the tail beyond the retention window. Budget is the measured p95 on a 1M dev seed (2026-07: 464.4ms) plus ~40% headroom. Like the other scan-bound aggregates no index helps the full-window case. Regression signature: a climb toward seconds means the grouping stopped translating and started materialising the doomed rows client-side. RECALIBRATE on your CI hardware.",
@@ -13,6 +15,7 @@
 
   "dbQueryP95Ms": {
     "agentCallsList": 90,
+    "agentCallsListByProjects": 120,
     "agentCallsListByAgent": 40,
     "agentCallsListByTimeRange": 80,
     "agentCallsHistogram": 150,
@@ -39,10 +42,15 @@
     "anomalyTimeline": 150,
     "agentOverview": 250,
     "agentDistributions": 250,
+    "agentLastCallTimesAll": 900,
+    "agentLastCallTimeSingle": 40,
     "testRunStatsBySuite": 60,
     "testRunStatsBySuitePage": 90,
     "testRunStatsPassTotals": 150,
     "testRunStatsRecentCohorts": 200,
+    "evaluatorLatestResult": 40,
+    "evaluatorRecentResults": 120,
+    "evaluatorSearchResults": 300,
     "proxyResolveProxytraceKey": 50,
     "proxyResolveUpstreamKey": 75
   },
@@ -55,6 +63,10 @@
 
   "_comment_traceSort": "agentCallsListSort* guard the traces table's server-side column sorts (SortBy whitelist) measured at their worst case: no narrowing filter, whole-table top-50 at 1M rows. The nullable columns (LatencyMs/TotalTokens/CacheHitRate) sort with a '(col IS NULL)' pre-key for nulls-last-in-both-directions, which the planner cannot serve from the plain single-column index — the plan is a parallel seq scan + top-N heapsort (~230ms of the total; the rest is the page COUNT). ToolCount rides its index via incremental sort but its low cardinality makes that no cheaper. Filtered sorts (project/agent/time window — the normal UI state) are far cheaper. If these ever blow past budget, the lever is a raw-SQL '(col DESC NULLS LAST, Id DESC)' index pair per column plus NULLS LAST ordering EF can't express — deliberately not paid while worst case sits ~300-440ms. agentCallsListByToolName guards the ToolName EXISTS semi-join against AgentCallToolEntity ((ToolName, AgentCallId) index); agentCallToolNames guards the project-scoped DISTINCT picker ((ProjectId, ToolName) index-only scan); agentCallToolNamesByAgent guards the agent-scoped picker shown when an agent filter is active — AgentId is denormalised onto the tool row so it stays a single-table index-only DISTINCT over the (ProjectId, AgentId, ToolName) index (no join to the call table), and being scoped to one agent it scans only that agent's slice of the index, so it is far cheaper than the project-wide picker (~2ms vs ~67ms measured). Calibrated 2026-07-03 at 1M calls / ~600k tool rows: sorts p95 310-440ms, byToolName ~297ms, toolNames ~72ms; agentCallToolNamesByAgent recalibrated 2026-07-04 at 1M calls (p95 ~2.2ms, budget 40ms for small-number/CI jitter headroom, in-family with the fast list queries).",
 
+  "_comment_evaluatorHistory": "evaluatorLatestResult/evaluatorRecentResults/evaluatorSearchResults guard the evaluator-detail history reads. These were previously O(total test results): each took the most recent N results ACROSS THE WHOLE INSTALL (N = 200/500/1000) and filtered by evaluator in memory afterwards, which was both a scan that grew with the table and a correctness bug — once more than N results existed anywhere, an evaluator whose results fell outside that global window silently returned EMPTY, cross-tenant (a noisy project's runs evicted yours). The filter now runs in SQL against the EvaluationStatEntity projection over its (EvaluatorId, CreatedAt) index, so cost tracks the requested evaluator's own history, not table size. evaluatorLatestResult is a single indexed row read (budget in-family with the fast narrowly-filtered reads, 40ms of small-number/CI-jitter headroom); evaluatorRecentResults reads a bounded candidate window over that index plus a keyed load of the de-duplicated rows; evaluatorSearchResults uses the widest window (2000 candidate rows) and additionally maps them to filter on text, so it is the most expensive of the three. All three budgets are UNCALIBRATED PLACEHOLDERS — RECALIBRATE ~20-30% above observed p95 on a full 1M-row seed. Regression signature: any of them drifting into the hundreds-of-ms full-scan band (statsSummary ~268ms and up) means the evaluator filter stopped being pushed down and the query went back to scanning the results table.",
+
+  "_comment_lastCallTimes": "agentLastCallTimesAll/agentLastCallTimeSingle guard the agent 'last used' timestamp. GetLastCallTimesAsync is an UNFILTERED GROUP BY over the whole traces table joined to AgentVersion — inherently O(rows), and legitimately so: the agents LIST sorts every agent by recency, so it genuinely needs one row per agent. It sits in-family with the other full-window scan aggregates (statsCallTrends ~1100, statsLatencyPercentiles ~1200); budget is an UNCALIBRATED PLACEHOLDER pending a 1M run — RECALIBRATE ~20-30% above observed p95. GetLastCallTimeAsync is the fix for the single-agent GET (and the MCP get_agent tool), which previously ran that same whole-table grouping just to read ONE agent's timestamp, so a hot per-agent page scaled with total trace volume. It is a MAX over one agent's version slice via the AgentVersionId index, so it is independent of table size and belongs with the fast narrowly-filtered reads (agentCallsListByAgent / agentCallToolNamesByAgent, budget 40) — 40ms is small-number/CI-jitter headroom over an expected sub-millisecond index read. Regression signature: agentLastCallTimeSingle drifting toward the agentLastCallTimesAll band means the filter stopped being pushed down and the single-agent path went back to grouping the whole table.",
+
   "_comment_testRunStats": "testRunStatsBySuite/testRunStatsBySuitePage guard the suite-scoped TestRunStats projection query (issue #253). The test-suites controller previously materialized the whole TestRunStatsEntity table and filtered in memory on every suites list + single-suite GET; the fix pushes the suite set into SQL (WHERE SuiteId IN (...)), backed by the existing index on TestRunStatsEntity.SuiteId. The query returns only the rows for the requested suite(s), so it is an index range read independent of total table size. testRunStatsPassTotals/testRunStatsRecentCohorts guard the dashboard's server-side TestRunStats aggregates (issue #288): the pass-rate totals (single scalar GROUP BY row) and the sparkline cohorts (GROUP BY (GroupId, EndpointId) ordered by max(RunCompletedAt), capped at 50) that replaced two O(all-history) materializations in DashboardStatistics. All four budgets are UNCALIBRATED PLACEHOLDERS (set conservatively; the aggregates scan the ~25k-row seeded table but return a bounded result) — RECALIBRATE on a full ~1M / 25k-test-run seed (set ~20-30% above the observed p95).",
 
   "httpP95Ms": {