diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee0bdea411d4..999c6fe0138d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,46 @@
 
 ---
 
+## [3.8.7] — 2026-05-08
+
+### 🔒 Routing — session affinity real fix (D1 + D2 + D3)
+
+Production traffic on 3.8.6 / 3.8.5 showed a `feat/limits-dashboard-polish` smart-affinity violation: an `Account A → Account B` switch fired only 4 seconds after the last successful Account A request, on the same opencode-supplied `x-session-affinity` header, with both accounts at ~100% quota. The cache rebuilt from scratch (147k token cache_write, cache_read=0). Oracle hard-debug (`ses_1fa7165c0ffeFFU8rjU82y0ItO`) identified three independent design defects, all fixed here.
+
+#### D1 — `x-session-affinity` is now a first-class external session header
+
+`extractExternalSessionId` previously matched only `x-session-id` / `x_session_id` / `x-omniroute-session` / `session-id`, so the stable opencode continuity signal was being silently dropped and the session id was being recomputed from a fingerprint hash of the request body. Any system-prompt or first-user-message drift (sub-agent invocation, dynamic context injection) produced a NEW session id with no bound connection, falling through to score-based selection. The header chain now includes `x-session-affinity` between the generic forms and the OmniRoute-specific alias. Each header source is given its own namespace prefix (`ext:` for the legacy generic forms, `ext-xsa:` for `x-session-affinity`, `ext-omr:` for `x-omniroute-session`) using a hyphen separator so that a legacy generic value of e.g. `xsa:foo` cannot collide with a newer `x-session-affinity: foo` request.
+
+#### D2 — `touchSession` no longer overwrites `connectionId`; `bindSessionConnection` is the single mutation site
+
+The previous `touchSession(sessionId, connectionId)` silently rewrote the bound connection on every call, including the post-credential confirmation in `chat.ts`. This made it impossible to tell from `/api/sessions` whether a session had ever been bound to a different account — the previous binding evidence was always erased by the last write. `touchSession(sessionId)` is now a pure activity update (lastActive, requestCount). All binding mutations go through the new `bindSessionConnection(sessionId, connectionId, { source })` which returns a `BindResult` with five reason states (`no_session_id` / `first_bind` / `no_change` / `rebind_within_window` / `rebind_after_window`). A rebind inside the 5-minute affinity window emits a structured `log.warn("SESSION/affinity", "session rebound within affinity window", { ... })` — that single log line now answers "did affinity break?" definitively. The deprecated 2-arg `touchSession` signature still works as a compat shim with a one-shot deprecation warning, so existing tests keep passing.
+
+#### D3 — Cache-sensitive provider gate on `affinity_break_p1_too_urgent`
+
+`selectByEarliestResetFirst` and `isAffinityValid` now accept an optional `provider` argument, plumbed through from `auth.ts` (which already had the provider in scope). For `provider === "claude"` (Anthropic OAuth lane), the urgent-alt heuristic break is suppressed unless `boundScore <= 0` (genuinely unusable via accumulated backoff/error penalty). Rationale: Claude prompt cache write is 1.25x and read is 0.1x of input cost, so a 147k-token cache rewrite is roughly 12x more expensive than a single read; the urgent-alt break would have to amortise over 12+ reads in 5 minutes to pay for itself, which a typical chat workload cannot. Other break paths (terminal, rate_limited, quota_exhausted, low-quota < 15%, session_expired, affinity_window_passed) are unaffected — only the urgent-alt heuristic is gated. Other providers retain the original break behaviour because their cache economics differ.
+
+#### Trace logging
+
+`selectByEarliestResetFirst` now emits a structured log on every routing decision. `log.debug("AUTH/affinity", "kept", ...)` when affinity is preserved. `log.warn("AUTH/affinity", "broken", ...)` ONLY when affinity is broken via the heuristic rules (`affinity_break_low_quota` or `affinity_break_p1_too_urgent`) — those are the diagnostic alarm cases. Affinity invalidations for expected reasons (`session_expired`, `affinity_window_passed`, `rate_limited`, `terminal`, `quota_exhausted_unknown_reset`, `inactive`, track-excluded variants) emit `log.debug("AUTH/affinity", "broken", ...)` instead so production warn-level logs stay focused on real anomalies. `log.debug("AUTH/affinity", "fall-through selected", ...)` when no session was bound. Combined with the `bindSessionConnection` rebind-within-window warning, the previously invisible silent overwrites are now first-class observable events.
+
+### 📚 Internal Notes
+
+- New unit tests in `tests/unit/session-manager-affinity-headers.test.mjs` (9 tests) cover the new namespace-per-source extraction, header collision avoidance (incl. legacy values that look-namespaced like `xsa:foo`), fallback chain order, and edge cases (empty / whitespace / 64+ char values).
+- New unit tests in `tests/unit/session-manager-binding.test.mjs` (10 tests) cover the `touchSession` activity-only contract, the deprecated 2-arg compat shim, all five `BindResult.reason` states, the null-`oldConnectionId` first-bind path (Oracle audit defect B), and the `emergency_fallback` rebind suppression (Oracle audit defect D).
+- Existing `auth-strategy-earliest-reset-first.test.mjs` extended with a `githubConn` fixture helper and a `seedSingleSessionAccount` seed helper. **SA-2** rewritten: the urgent-alt break test now uses GitHub provider so the new Claude gate doesn't apply (the underlying break logic is still asserted, just for a non-cache-sensitive provider). **SA-12** new: Claude bound + 4× alt → break BLOCKED by gate. **SA-13** new: Claude bound score=0 (no quota cache, hence backoff-style unusable) + positive alt → break ALLOWED (gate's escape condition). **SA-14** new: GitHub bound + 4× alt → break ALLOWED (gate is Claude-only).
+- Test count: 2874/2874 PASS (was 2852; +22 net — SA-12 / SA-13 / SA-14 + 9 affinity-header tests (incl. collision-proof) + 10 binding tests (incl. null-first-bind, emergency_fallback)).
+- Version bump 3.8.6 → 3.8.7.
+
+### Plan + Oracle two-stage verification
+
+- Plan: `.sisyphus/plans/session-affinity-real-fix.md`
+- Oracle plan v1 (`ses_1f85345c8ffebTdtpTaQ5aeN8J`): NEEDS_REVISION on 7 items (A defect, B nit, C defect, D defect, E defect, F nit, G nit) → all 7 applied in plan v2.
+- Oracle plan v2 (`ses_1f84ae893ffeTXGq7QBjwfTgzX`): NEEDS_REVISION (narrow) on 5 wording-mismatch items → all 5 applied in plan v3.
+- Oracle implementation audit (`ses_1f83ab6edffecggMOuz5EmDhT1`): NEEDS_REVISION on 4 defects + 1 nit. **Defect A** namespace collision (`ext:xsa:foo` vs `ext:` + raw `xsa:foo`) → moved to hyphenated `ext-xsa:` / `ext-omr:`. **Defect B (critical)** `bindSessionConnection` after `touchSession()` (which creates entry with `connectionId: null`) was classifying as `rebind_within_window` → null oldConnectionId is now `first_bind` and emits no warning. **Defect D** chat.ts emergency-fallback retry produced a within-window alarm for legitimate behavior → new `BindSource = "emergency_fallback"` plumbed from the retry path, alarm suppressed for that source. **Defect H** `require()` lazy-loaded inside try/catch could silently swallow logs in ESM/tsx → static `import * as log from "@/sse/utils/logger"` (no cycle). **Nit E** gate-suppressed urgent-alt now logs `gate: "claude_urgent_alt_suppressed"` at debug for observability. All five fixes applied + new tests for each.
+- **Copilot PR #28 R3 review** (2 defects). **R3-1**: the deprecated 2-arg `touchSession(sessionId, connectionId)` compat shim previously updated `lastActive` before forwarding to `bindSessionConnection`, which made the forwarded call always see "within affinity window" — a session idle >5 min would mis-fire the within-window alarm on its first compat-shim rebind. The shim now binds first (so the binding decision sees the pre-touch `lastActive`), then preserves the original 1-touch == 1-request semantics by only incrementing `requestCount` if an entry pre-existed (since `bindSessionConnection`'s `first_bind` branch already sets it to 1). **R3-2**: `selectByEarliestResetFirst` previously bound the fall-through selection itself with a hard-coded `source: "fall_through"`. That meant the actual within-window rebind happened in the strategy with the wrong source, so the `emergency_fallback` alarm suppression in `chat.ts:548` could never apply (the strategy's bind beat the post-credential bind). The strategy no longer binds — `chat.ts:548` is now the single binding site, and it picks `source: "emergency_fallback"` vs `"explicit_post_credential"` from `runtimeOptions.emergencyFallbackTried`.
+
+---
+
 ## [3.8.6] — 2026-05-08
 
 ### 🎨 Design Unification
@@ -115,7 +155,7 @@
 
 ### 🐛 Bug Fixes
 
-- **Routing Strategy v7 — burn-rate pressure max replaces v6 mean:** v6 combined session and weekly track scores via arithmetic mean, which dilutes the more-urgent track's signal with the calmer track. Production observation: `APEXATGNU(33%/0h34m, 91%/6d17h)` was picked over `GNUMAX(29%/1h54m, 63%/1d1h)` even though GNUMAX's weekly was about to waste 63% in ~1 day. v7 introduces `pressure(Q, t, W) = Q × clamp(W/t, 1, URGENCY_CAP)` per track and combines via `Math.max(...)`. Two windows are independent ledgers (verified via anthropics/claude-code issues #54750, #52135, #40513), so routing to the more perishable signal matches the user's "burn what's about to expire" intent.
+- **Routing Strategy v7 — burn-rate pressure max replaces v6 mean:** v6 combined session and weekly track scores via arithmetic mean, which dilutes the more-urgent track's signal with the calmer track. Production observation: `Account A(33%/0h34m, 91%/6d17h)` was picked over `Account B(29%/1h54m, 63%/1d1h)` even though Account B's weekly was about to waste 63% in ~1 day. v7 introduces `pressure(Q, t, W) = Q × clamp(W/t, 1, URGENCY_CAP)` per track and combines via `Math.max(...)`. Two windows are independent ledgers (verified via anthropics/claude-code issues #54750, #52135, #40513), so routing to the more perishable signal matches the user's "burn what's about to expire" intent.
 - **Penalty rebalance:** `PENALTY_BACKOFF_WEIGHT` 100 → 101 to keep a max-backoff paid account strictly below self-hosted score=0 (previously could tie at 0 and resolve only via lex tie-break).
 
 ### 📚 Internal Notes
@@ -162,7 +202,7 @@
   - **F1 (self-hosted fallback):** Accounts with no quota cache (e.g. user-added `openai-compatible` providers like local llama.cpp) returned `excluded: "no_quota_data"` and produced an `all candidates excluded` 503. They now fall back to `score = 0` and remain eligible — paid candidates with positive scores still beat them, but they are usable when no paid candidate exists. `markAccountExhaustedFrom429()` empty caches are still excluded.
   - **F2 (per-model windows ignored):** Removed `modelWindowMapping.ts` and the model-specific weekly-window lookup. Routing now reads only the overall `weekly` window — per-model `weekly Sonnet` / `weekly Omelette` buckets no longer split routing across requests for the same conversation. If Anthropic 429s an opus request because per-model quota is exhausted, `accountFallback` retries on another account.
   - **F3 (fresh quota max-urgency):** Anthropic omits `resetAt` for accounts where the timer hasn't started yet (always at 100% remaining). v3.7.0 treated that as `missing` and excluded fresh accounts. v3.7.1 detects the strict pair `Q === 100 AND resetAt === null` and scores the track at `100 × 100 = 10000` (max urgency), so the very first request wakes the timer instead of further burning an already-active account.
-  - **F4 (multiplicative burn-down):** Replaced the additive score with `S = T_pts × Q_remain` (`score ∈ [0, 10000]`). The new formula makes "quota likely lost if not used" the actual scoring objective: `APEX(17%/2h) avg=690` now correctly loses to `GNUMAX(87%/4h) avg=1460` even though APEX's session is closer to reset. Penalties rescaled 100× (`PENALTY_DEGRADED 25→2500`, `PENALTY_BACKOFF_WEIGHT 1→100`, `PENALTY_ERROR_WEIGHT 0.4→40`) to preserve their relative impact across the new score range. `Q_SATURATION_CAP` removed (multiplicative scoring naturally weights remaining quota).
+  - **F4 (multiplicative burn-down):** Replaced the additive score with `S = T_pts × Q_remain` (`score ∈ [0, 10000]`). The new formula makes "quota likely lost if not used" the actual scoring objective: `Account A(17%/2h) avg=690` now correctly loses to `Account B(87%/4h) avg=1460` even though Account A's session is closer to reset. Penalties rescaled 100× (`PENALTY_DEGRADED 25→2500`, `PENALTY_BACKOFF_WEIGHT 1→100`, `PENALTY_ERROR_WEIGHT 0.4→40`) to preserve their relative impact across the new score range. `Q_SATURATION_CAP` removed (multiplicative scoring naturally weights remaining quota).
 - **Plan & Review:** `.sisyphus/plans/routing-strategy-v6.md` documents derivation, hand-math, and Oracle/Momus review history (4 logic blockers + 9 process items resolved). `routing-strategy-v5.md` is marked superseded.
 
 ### 🔧 Internal
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index ab7eb22fe783..22a065fdcfa8 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OmniRoute API
-  version: 3.8.6
+  version: 3.8.7
   description: |
     OmniRoute is a local-first AI API proxy router. It provides an OpenAI-compatible
     endpoint that routes requests to multiple AI providers with load balancing,
diff --git a/open-sse/services/sessionManager.ts b/open-sse/services/sessionManager.ts
index 7dd67758597b..6ff7f2464453 100644
--- a/open-sse/services/sessionManager.ts
+++ b/open-sse/services/sessionManager.ts
@@ -7,6 +7,8 @@
 
 import { createHash } from "node:crypto";
 
+import * as log from "@/sse/utils/logger";
+
 interface SessionEntry {
   createdAt: number;
   lastActive: number;
@@ -111,24 +113,192 @@ export function generateSessionId(
   return createHash("sha256").update(fingerprint).digest("hex").slice(0, 16);
 }
 
+// Affinity binding window — must match earliestResetFirst.SESSION_AFFINITY_WINDOW_MS.
+// Duplicated here as a constant rather than imported to avoid a circular dependency
+// (earliestResetFirst already imports from this module). PR #28 invariant — keep
+// in lockstep with the strategy module.
+const SESSION_AFFINITY_WINDOW_MS = 5 * 60 * 1000;
+
+let warnedAboutTouchSessionDeprecatedArg = false;
+
 /**
- * Touch or create a session
+ * Touch a session (activity update only).
+ *
+ * Updates `lastActive` and increments `requestCount`. CREATES a new session
+ * entry if one did not exist (with `connectionId: null`). DOES NOT mutate
+ * `connectionId` on existing entries — that is reserved for
+ * `bindSessionConnection()` so binding mutations are explicit and traceable.
+ *
+ * Backwards-compat overload: a few legacy call sites and tests still pass a
+ * second `connectionId` argument. When seen, this function emits a one-shot
+ * structured warning and forwards to `bindSessionConnection` so the binding
+ * still happens but the caller is flagged for migration.
+ *
+ * Oracle audit ses_1fa7165c0ffeFFU8rjU82y0ItO + ses_1f85345c8ffebTdtpTaQ5aeN8J.
  */
-export function touchSession(sessionId: string | null, connectionId: string | null = null): void {
+export function touchSession(
+  sessionId: string | null,
+  deprecatedConnectionId: string | null = null
+): void {
   if (!sessionId) return;
+  // When the deprecated 2-arg form is used, the binding decision must see
+  // the PRE-touch lastActive — otherwise bindSessionConnection always
+  // observes "within affinity window" because we just refreshed lastActive
+  // to Date.now() above. That would misclassify a rebind on a session
+  // idle >5 min as `rebind_within_window` and fire the diagnostic alarm.
+  // Order: bind first (which itself updates lastActive on success), then
+  // increment requestCount to preserve the touch contract for legacy
+  // callers. If no deprecated connectionId is passed, the normal
+  // touch-only path runs as before.
+  // Oracle audit ses_1fa7165c0ffeFFU8rjU82y0ItO + Copilot PR #28 R3-1.
+  if (deprecatedConnectionId) {
+    if (!warnedAboutTouchSessionDeprecatedArg) {
+      warnedAboutTouchSessionDeprecatedArg = true;
+      log.warn(
+        "SESSION",
+        "touchSession(sessionId, connectionId) is deprecated; switch to bindSessionConnection(...)",
+        { sessionId, connectionIdSuffix: deprecatedConnectionId.slice(-8) }
+      );
+    }
+    // Preserve the original 1-touch == 1-request semantics: only increment
+    // requestCount if an entry already existed before this call, since
+    // bindSessionConnection's first_bind branch already sets it to 1.
+    const hadExistingEntry = sessions.has(sessionId);
+    bindSessionConnection(sessionId, deprecatedConnectionId, {
+      source: "explicit_post_credential",
+    });
+    if (hadExistingEntry) {
+      const after = sessions.get(sessionId);
+      if (after) after.requestCount++;
+    }
+    return;
+  }
   const existing = sessions.get(sessionId);
   if (existing) {
     existing.lastActive = Date.now();
     existing.requestCount++;
-    if (connectionId) existing.connectionId = connectionId;
   } else {
     sessions.set(sessionId, {
       createdAt: Date.now(),
       lastActive: Date.now(),
       requestCount: 1,
+      connectionId: null,
+    });
+  }
+}
+
+export type BindReason =
+  | "no_session_id"
+  | "first_bind"
+  | "no_change"
+  | "rebind_within_window"
+  | "rebind_after_window";
+
+export interface BindResult {
+  ok: boolean;
+  reason: BindReason;
+  oldConnectionId: string | null;
+  newConnectionId: string | null;
+}
+
+export type BindSource =
+  | "affinity_kept"
+  | "fall_through"
+  | "explicit_post_credential"
+  | "emergency_fallback";
+
+/**
+ * Bind (or rebind) a session to a connection.
+ *
+ * This is the ONLY function that mutates `SessionEntry.connectionId`. Every
+ * binding mutation carries a declared `source` so production logs can answer
+ * "why did this session move from APEXA to GNUMAX?" — the previous
+ * implementation silently overwrote on every `touchSession()` call, erasing
+ * the original binding evidence (Oracle audit ses_1fa7165c0ffeFFU8rjU82y0ItO).
+ *
+ * Behaviour:
+ * - `sessionId` null/empty → ok:false, reason: "no_session_id"
+ * - no existing entry → create with `connectionId`, reason: "first_bind"
+ * - existing.connectionId === connectionId → no mutation, reason: "no_change"
+ * - existing.connectionId !== connectionId AND within the affinity window
+ *   (lastActive within 5 minutes) → mutate + reason: "rebind_within_window"
+ *   AND emit `log.warn` (production alarm signal — this should be rare and
+ *   only happen when a heuristic break or hard exclusion triggered)
+ * - existing.connectionId !== connectionId AND after the affinity window →
+ *   mutate + reason: "rebind_after_window" (debug-level, expected)
+ */
+export function bindSessionConnection(
+  sessionId: string | null,
+  connectionId: string,
+  context: { source: BindSource }
+): BindResult {
+  if (!sessionId) {
+    return { ok: false, reason: "no_session_id", oldConnectionId: null, newConnectionId: null };
+  }
+  const existing = sessions.get(sessionId);
+  const now = Date.now();
+  if (!existing) {
+    sessions.set(sessionId, {
+      createdAt: now,
+      lastActive: now,
+      requestCount: 1,
       connectionId,
     });
+    return {
+      ok: true,
+      reason: "first_bind",
+      oldConnectionId: null,
+      newConnectionId: connectionId,
+    };
+  }
+  const oldConnectionId = existing.connectionId;
+  if (oldConnectionId === connectionId) {
+    existing.lastActive = now;
+    return {
+      ok: true,
+      reason: "no_change",
+      oldConnectionId,
+      newConnectionId: connectionId,
+    };
+  }
+  // First-bind-after-touch: production flow calls touchSession(sessionId)
+  // first (creating an entry with connectionId: null), then this function
+  // makes the binding decision. Treat null → real conn as first_bind, NOT
+  // rebind_within_window — otherwise every new session's first real bind
+  // would emit a within-window warning, drowning the actual diagnostic
+  // signal we want to see when a live session jumps connections.
+  if (oldConnectionId === null) {
+    existing.connectionId = connectionId;
+    existing.lastActive = now;
+    return {
+      ok: true,
+      reason: "first_bind",
+      oldConnectionId: null,
+      newConnectionId: connectionId,
+    };
+  }
+  const withinWindow = now - existing.lastActive <= SESSION_AFFINITY_WINDOW_MS;
+  existing.connectionId = connectionId;
+  existing.lastActive = now;
+  // Suppress the within-window alarm for legitimate emergency fallback
+  // rebinds (chat.ts retry path). Those are expected behavior, not a
+  // diagnostic anomaly.
+  const isEmergencyFallback = context.source === "emergency_fallback";
+  if (withinWindow && !isEmergencyFallback) {
+    log.warn("SESSION/affinity", "session rebound within affinity window", {
+      sessionId,
+      oldConnectionId,
+      newConnectionId: connectionId,
+      source: context.source,
+      sessionAgeMs: now - existing.createdAt,
+    });
   }
+  return {
+    ok: true,
+    reason: withinWindow ? "rebind_within_window" : "rebind_after_window",
+    oldConnectionId,
+    newConnectionId: connectionId,
+  };
 }
 
 /**
@@ -264,29 +434,56 @@ export function checkSessionLimit(
 
 /**
  * T04: Extract an external session ID from request headers.
+ *
  * Accepts both hyphenated and underscore forms for Nginx compatibility.
  * Nginx drops headers with underscores by default — use `underscores_in_headers on`
  * in nginx.conf, or use X-Session-Id (hyphenated) which passes cleanly.
  *
- * Ref: sub2api README + PR #634
+ * Header sources are namespaced so the same raw value sent in two different
+ * headers does NOT collide as the same internal session. opencode CLI sends
+ * `x-session-affinity` with its own session id format (e.g. "ses_..."); a
+ * different client sending the same string in `x-session-id` would otherwise
+ * pin to the same bound conn. Per-source prefixes prevent that.
+ *
+ * Trust model: external session IDs share a process-global namespace (no
+ * per-API-key isolation yet). Routing remains constrained by the requesting
+ * key's candidate pool, so cross-tenant routing cannot occur — but two
+ * clients on different keys sending the same header value would observe the
+ * same `lastActive`/`requestCount` counters. API-key-scoped IDs are tracked
+ * as a separate future change.
+ *
+ * Ref: sub2api README + PR #634, Oracle audit ses_1f85345c8ffebTdtpTaQ5aeN8J.
  *
  * @param headers - Request headers (Headers object or plain object with .get())
- * @returns External session ID with "ext:" prefix, or null
+ * @returns External session ID with source-specific prefix, or null
  */
 export function extractExternalSessionId(
   headers: Headers | { get?: (n: string) => string | null } | null | undefined
 ): string | null {
   if (!headers || typeof (headers as Headers).get !== "function") return null;
   const h = headers as Headers;
-  const raw =
-    h.get("x-session-id") ?? // Preferred: hyphenated (passes through Nginx)
-    h.get("x_session_id") ?? // Underscore variant (direct HTTP / custom clients)
-    h.get("x-omniroute-session") ?? // OmniRoute-specific form
-    h.get("session-id") ?? // Bare session-id
-    null;
-  if (!raw || !raw.trim()) return null;
-  // Prefix "ext:" to ensure no collision with internal SHA-256 hash IDs
-  return `ext:${raw.trim().slice(0, 64)}`; // max 64 chars to avoid abuse
+  // Use top-level (single-colon) prefixes outside the legacy `ext:<raw>`
+  // namespace. Earlier draft used `ext:xsa:` which appeared to namespace the
+  // value but was structurally identical to a legacy `x-session-id: xsa:foo`
+  // value (both produced `ext:xsa:foo`). The hyphenated forms `ext-xsa` /
+  // `ext-omr` cannot collide because no legacy generic ID can begin with
+  // those (they would have to contain a hyphen in the prefix, which the
+  // generic chain cannot produce).
+  const sources: Array<readonly [string, string]> = [
+    ["x-session-id", "ext"],
+    ["x_session_id", "ext"],
+    ["x-session-affinity", "ext-xsa"],
+    ["x-omniroute-session", "ext-omr"],
+    ["session-id", "ext"],
+  ];
+  for (const [name, prefix] of sources) {
+    const raw = h.get(name);
+    if (!raw) continue;
+    const trimmed = raw.trim();
+    if (!trimmed) continue;
+    return `${prefix}:${trimmed.slice(0, 64)}`;
+  }
+  return null;
 }
 
 // ─── Internal Helpers ───────────────────────────────────────────────────────
diff --git a/package.json b/package.json
index 5e529d583fc9..477daa84267f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "3.8.6",
+  "version": "3.8.7",
   "description": "Smart AI Router with auto fallback — route to FREE & cheap models, zero downtime. Works with Cursor, Cline, Claude Desktop, Codex, and any OpenAI-compatible tool.",
   "type": "module",
   "bin": {
diff --git a/src/sse/handlers/chat.ts b/src/sse/handlers/chat.ts
index 18596414db5a..8c839b1eb346 100644
--- a/src/sse/handlers/chat.ts
+++ b/src/sse/handlers/chat.ts
@@ -53,6 +53,7 @@ import { applyThinkingBudgetSettings } from "@omniroute/open-sse/services/thinki
 import {
   generateSessionId as generateStableSessionId,
   touchSession,
+  bindSessionConnection,
   extractExternalSessionId,
   checkSessionLimit,
   registerKeySession,
@@ -545,7 +546,11 @@ async function handleSingleModelChat(
       }
     }
     if (runtimeOptions.sessionId && body?._omnirouteInternalRequest !== "context-handoff") {
-      touchSession(runtimeOptions.sessionId, credentials.connectionId);
+      bindSessionConnection(runtimeOptions.sessionId, credentials.connectionId, {
+        source: runtimeOptions.emergencyFallbackTried
+          ? "emergency_fallback"
+          : "explicit_post_credential",
+      });
     }
 
     const refreshedCredentials = await checkAndRefreshToken(provider, credentials);
diff --git a/src/sse/services/auth.ts b/src/sse/services/auth.ts
index 6dd48b356040..d44877f2f2d9 100644
--- a/src/sse/services/auth.ts
+++ b/src/sse/services/auth.ts
@@ -706,7 +706,11 @@ export async function getProviderCredentials(
       // dropped the modelHint parameter — model-specific weekly windows are
       // no longer consulted for ranking or hard exclusion. See
       // .sisyphus/plans/routing-strategy-v6.md and earliestResetFirst.ts.
-      const result = selectByEarliestResetFirst(orderedConnections, options.sessionId || null);
+      const result = selectByEarliestResetFirst(
+        orderedConnections,
+        options.sessionId || null,
+        provider
+      );
       if ("allExcluded" in result) {
         log.warn(
           "AUTH",
diff --git a/src/sse/services/strategies/earliestResetFirst.ts b/src/sse/services/strategies/earliestResetFirst.ts
index fe181e29a437..07d9d89b7cf9 100644
--- a/src/sse/services/strategies/earliestResetFirst.ts
+++ b/src/sse/services/strategies/earliestResetFirst.ts
@@ -23,9 +23,9 @@ import { getQuotaWindowStatus, isAccountQuotaExhausted } from "@/domain/quotaCac
 import {
   getSessionConnection,
   getSessionInfo,
-  touchSession,
 } from "@omniroute/open-sse/services/sessionManager.ts";
 import { isTerminalConnectionStatus } from "@/sse/services/accountTerminalStatus";
+import * as log from "@/sse/utils/logger";
 
 interface ConnectionLike {
   id: string;
@@ -500,7 +500,8 @@ export function __resetAffinityHeuristicCooldownForTesting(): void {
 export function isAffinityValid(
   conn: ConnectionLike,
   sessionId: string | null,
-  scoredAlternatives?: ScoredCandidate[]
+  scoredAlternatives?: ScoredCandidate[],
+  provider?: string | null
 ): AffinityValidity {
   if (conn.isActive === false) return { valid: false, reason: "inactive" };
 
@@ -586,10 +587,36 @@ export function isAffinityValid(
         bestAltScore >= boundScore * HEAVY_GAP_FACTOR &&
         bestAltScore >= boundScore + MIN_HEAVY_GAP_ABSOLUTE_DELTA;
     }
-    if (isHeavyGap && !isHeuristicBreakInCooldown(sessionId)) {
+
+    // Cache-sensitive provider gate (Oracle audit ses_1fa7165c0ffeFFU8rjU82y0ItO):
+    // Anthropic Claude OAuth lane uses 5-minute prompt cache (write 1.25x,
+    // read 0.1x). A 147k-token cache rewrite costs ~12.5x what a single read
+    // does; the urgent-alt break would have to be amortised over 12+ reads
+    // in 5 minutes to pay for itself, which a typical chat workload cannot.
+    // For Claude, suppress the urgent-alt break unless the bound is already
+    // non-positive score (genuinely unusable via accumulated backoff/error
+    // penalty) — in that case any positive alt still escapes via the
+    // boundScore <= 0 branch above. Other break paths (terminal, rate_limited,
+    // quota_exhausted, low-quota < 15%, session_expired, affinity_window_passed)
+    // are unaffected. Other providers (codex, github, etc.) keep the
+    // original break behaviour because their cache economics differ.
+    const isCacheSensitive = (provider || "").toLowerCase() === "claude";
+    const allowUrgentBreak = !isCacheSensitive || boundScore <= 0;
+
+    if (isHeavyGap && allowUrgentBreak && !isHeuristicBreakInCooldown(sessionId)) {
       recordHeuristicBreak(sessionId);
       return { valid: false, reason: "affinity_break_p1_too_urgent" };
     }
+
+    if (isHeavyGap && !allowUrgentBreak) {
+      log.debug("AUTH/affinity", "urgent-alt break suppressed by cache-sensitive gate", {
+        sessionId,
+        provider,
+        boundScore,
+        bestAltScore,
+        gate: "claude_urgent_alt_suppressed",
+      });
+    }
   }
 
   return { valid: true };
@@ -621,21 +648,51 @@ function buildAllExcluded(scored: ScoredCandidate[]): AllExcludedResult {
 
 export function selectByEarliestResetFirst(
   candidates: ConnectionLike[],
-  sessionId: string | null
+  sessionId: string | null,
+  provider?: string | null
 ): { selected: ConnectionLike } | AllExcludedResult {
-  // Score every candidate up front so the smart-affinity viability check can
-  // compare bound vs alternatives without re-running scoreAccount on the same
-  // pool. Existing fall-through path (no affinity) reuses the same scored list.
   const scored: ScoredCandidate[] = candidates.map((c) => scoreAccount(c));
 
   if (sessionId) {
     const boundId = getSessionConnection(sessionId);
     if (boundId) {
       const bound = candidates.find((c) => c.id === boundId);
-      const affinity = bound ? isAffinityValid(bound, sessionId, scored) : null;
+      const affinity = bound ? isAffinityValid(bound, sessionId, scored, provider) : null;
       if (bound && affinity?.valid === true) {
+        log.debug("AUTH/affinity", "kept", {
+          sessionId,
+          provider: provider ?? null,
+          boundId,
+          decision: "kept_affinity",
+        });
         return { selected: bound };
       }
+      if (bound && affinity && affinity.valid === false) {
+        const boundScored = scored.find((sc) => sc.conn.id === boundId);
+        const usableAlts = scored.filter((sc) => !sc.excluded && sc.conn.id !== boundId);
+        const bestAltScore =
+          usableAlts.length > 0 ? Math.max(...usableAlts.map((sc) => sc.score ?? 0)) : null;
+        // Heuristic-break reasons are the diagnostic alarm signal — they
+        // indicate the smart-affinity logic actively chose to break a
+        // healthy binding, which is rare and warrants production attention.
+        // Non-heuristic reasons (window expiry, hard exclusions like terminal
+        // / rate_limited / quota_exhausted_unknown_reset, inactive, track-
+        // excluded) are EXPECTED affinity invalidations during normal
+        // routing and should not pollute warn-level production logs.
+        const isHeuristicBreak =
+          affinity.reason === "affinity_break_low_quota" ||
+          affinity.reason === "affinity_break_p1_too_urgent";
+        const logLevel = isHeuristicBreak ? "warn" : "debug";
+        log[logLevel]("AUTH/affinity", "broken", {
+          sessionId,
+          provider: provider ?? null,
+          oldBound: boundId,
+          decision: "fall_through_break",
+          reason: affinity.reason,
+          boundScore: boundScored?.score ?? null,
+          bestAltScore,
+        });
+      }
     }
   }
 
@@ -646,7 +703,21 @@ export function selectByEarliestResetFirst(
   usable.sort(candidateComparator);
   const selected = usable[0].conn;
 
-  if (sessionId) touchSession(sessionId, selected.id);
+  // Strategy-level binding has been removed (Copilot PR #28 R3-2). The
+  // caller (chat.ts:548 → bindSessionConnection with source resolved from
+  // runtimeOptions.emergencyFallbackTried) is responsible for the actual
+  // session binding decision so the source is accurate. If the strategy
+  // bound here with a hard-coded "fall_through" source, the emergency-
+  // fallback alarm suppression in bindSessionConnection would never apply
+  // because that first bind happens BEFORE the post-credential bind and
+  // would always be a within-window rebind with the wrong source.
+  if (sessionId) {
+    log.debug("AUTH/affinity", "fall-through selected", {
+      sessionId,
+      provider: provider ?? null,
+      selected: selected.id,
+    });
+  }
 
   return { selected };
 }
diff --git a/tests/unit/auth-strategy-earliest-reset-first.test.mjs b/tests/unit/auth-strategy-earliest-reset-first.test.mjs
index ca9c1d84aabd..c9e89aa8eb1f 100644
--- a/tests/unit/auth-strategy-earliest-reset-first.test.mjs
+++ b/tests/unit/auth-strategy-earliest-reset-first.test.mjs
@@ -61,7 +61,7 @@ function withinPressureMaxBand(actual, tracks) {
 
 const { setQuotaCache, markAccountExhaustedFrom429 } = quotaCache;
 const { isTerminalConnectionStatus, normalizeStatus } = accountTerminalStatus;
-const { clearSessions, touchSession, generateSessionId } = sessionManager;
+const { clearSessions, touchSession, generateSessionId, bindSessionConnection } = sessionManager;
 
 function resetCacheState() {
   // The quotaCache module exposes no clear() helper. We seed deterministic
@@ -100,6 +100,16 @@ function seedSingleWeeklyAccount(connId, provider, opts) {
   setQuotaCache(connId, provider, quotas);
 }
 
+function seedSingleSessionAccount(connId, provider, opts) {
+  const quotas = {
+    "session (5h)": {
+      remainingPercentage: opts.sessionRem,
+      resetAt: opts.sessionResetSec === null ? null : isoIn(opts.sessionResetSec),
+    },
+  };
+  setQuotaCache(connId, provider, quotas);
+}
+
 const claudeConn = (id, extras = {}) => ({
   id,
   isActive: extras.isActive ?? true,
@@ -107,6 +117,17 @@ const claudeConn = (id, extras = {}) => ({
   testStatus: extras.testStatus ?? "active",
   backoffLevel: extras.backoffLevel ?? 0,
   lastError: extras.lastError ?? null,
+  provider: extras.provider ?? "claude",
+});
+
+const githubConn = (id, extras = {}) => ({
+  id,
+  isActive: extras.isActive ?? true,
+  rateLimitedUntil: extras.rateLimitedUntil ?? null,
+  testStatus: extras.testStatus ?? "active",
+  backoffLevel: extras.backoffLevel ?? 0,
+  lastError: extras.lastError ?? null,
+  provider: extras.provider ?? "github",
 });
 
 test.beforeEach(() => {
@@ -950,25 +971,36 @@ test("SA-1: bound healthy + alt only 1.5x score → keep affinity (no break)", (
   assert.equal(result.selected.id, "bound", "1.5× alt should not break 3× threshold");
 });
 
-test("SA-2: alt 4x score AND >250 abs delta → break (heuristic_break_p1_too_urgent)", () => {
+test("SA-2: alt 4x score AND >250 abs delta → break for non-Claude provider (github)", () => {
   // bound: Q=20, t=W_S → pressure=20. alt: Q=20, t=W_S/100 → pressure=20×100=2000.
-  // ratio=100×, delta=1980 → triggers both factor and absolute delta gates
-  seedClaudeAccount("bound", {
+  // ratio=100×, delta=1980 → triggers both factor and absolute delta gates.
+  // Uses GitHub provider so the Claude cache-sensitive gate (PR #28 D3)
+  // does NOT suppress the urgent-alt break. Claude-blocked variant lives in SA-12.
+  // Note: setQuotaCache stores a provider tag alongside the per-connectionId
+  // entry but the lookup key for scoreSessionTrack/scoreWeeklyTrack is the
+  // connectionId only — the "github" string is descriptive metadata, not part
+  // of the cache key. The Claude gate decision is driven entirely by the
+  // selectByEarliestResetFirst third argument below.
+  seedSingleSessionAccount("bound-gh", "github", {
     sessionRem: 20,
     sessionResetSec: W_SESSION_SEC,
-    weeklyRem: 80,
-    weeklyResetSec: W_WEEKLY_SEC,
   });
-  seedClaudeAccount("alt", {
+  seedSingleSessionAccount("alt-gh", "github", {
     sessionRem: 20,
     sessionResetSec: 180, // W_SESSION_SEC / 100 = 180s
-    weeklyRem: 80,
-    weeklyResetSec: W_WEEKLY_SEC,
   });
   const sessionId = "sa-2-session";
-  touchSession(sessionId, "bound");
-  const result = selectByEarliestResetFirst([claudeConn("bound"), claudeConn("alt")], sessionId);
-  assert.equal(result.selected.id, "alt", "4×+ alt with large abs delta should break affinity");
+  bindSessionConnection(sessionId, "bound-gh", { source: "explicit_post_credential" });
+  const result = selectByEarliestResetFirst(
+    [githubConn("bound-gh"), githubConn("alt-gh")],
+    sessionId,
+    "github"
+  );
+  assert.equal(
+    result.selected.id,
+    "alt-gh",
+    "non-Claude provider must keep original 4× urgent-alt break"
+  );
 });
 
 test("SA-3: bound 10% session AND alt usable → break (heuristic_break_low_quota)", () => {
@@ -1155,3 +1187,90 @@ test("SA-11: scoredAlternatives without bound entry → keep affinity (footgun g
     "scoredAlternatives missing bound → must NOT trigger urgent-break with boundScore=0"
   );
 });
+
+test("SA-12: Claude bound + 4× alt urgent → cache-sensitive gate BLOCKS urgent-alt break", () => {
+  // PR #28 D3 gate: for Claude OAuth lane, the urgent-alt break is suppressed
+  // unless boundScore is non-positive. SA-2 fixture in non-Claude form proves
+  // the underlying break still fires for github; this test proves Claude is
+  // protected. Same pressure shape as SA-2 but provider="claude".
+  seedClaudeAccount("bound-cl", {
+    sessionRem: 20,
+    sessionResetSec: W_SESSION_SEC,
+    weeklyRem: 80,
+    weeklyResetSec: W_WEEKLY_SEC,
+  });
+  seedClaudeAccount("alt-cl", {
+    sessionRem: 20,
+    sessionResetSec: 180,
+    weeklyRem: 80,
+    weeklyResetSec: W_WEEKLY_SEC,
+  });
+  const sessionId = `sa-12-session-${Math.random().toString(36).slice(2)}`;
+  bindSessionConnection(sessionId, "bound-cl", { source: "explicit_post_credential" });
+
+  const result = selectByEarliestResetFirst(
+    [claudeConn("bound-cl"), claudeConn("alt-cl")],
+    sessionId,
+    "claude"
+  );
+  assert.equal(
+    result.selected.id,
+    "bound-cl",
+    "Claude provider must keep affinity even when alt has 4× urgent score"
+  );
+});
+
+test("SA-13: Claude bound score<=0 (no quota cache) + positive alt → gate ALLOWS break", () => {
+  // The Claude gate intentionally allows the break when boundScore <= 0,
+  // because at that point bound is genuinely unusable (heavy backoff/error
+  // penalty has wiped its viability). Sticking to a non-positive bound for
+  // 5 minutes of "cache savings" is a worse outcome than rebinding.
+  // Bound has no quota cache entry → scoreAccount returns score=0.
+  const boundId = `sa-13-bound-${Math.random().toString(36).slice(2)}`;
+  seedClaudeAccount("alt-cl-13", {
+    sessionRem: 50,
+    sessionResetSec: W_SESSION_SEC,
+    weeklyRem: 80,
+    weeklyResetSec: W_WEEKLY_SEC,
+  });
+  const sessionId = `sa-13-session-${Math.random().toString(36).slice(2)}`;
+  bindSessionConnection(sessionId, boundId, { source: "explicit_post_credential" });
+
+  const result = selectByEarliestResetFirst(
+    [claudeConn(boundId), claudeConn("alt-cl-13")],
+    sessionId,
+    "claude"
+  );
+  assert.equal(
+    result.selected.id,
+    "alt-cl-13",
+    "Claude gate must NOT block break when boundScore <= 0 (bound is genuinely unusable)"
+  );
+});
+
+test("SA-14: GitHub bound + 4× alt urgent → cache-sensitive gate INACTIVE, break fires", () => {
+  // Mirror image of SA-2 with explicit provider="github" passed to selector,
+  // confirming that the gate is provider-scoped and other providers retain
+  // the original urgent-alt break behaviour.
+  seedSingleSessionAccount("bound-gh-14", "github", {
+    sessionRem: 20,
+    sessionResetSec: W_SESSION_SEC,
+  });
+  seedSingleSessionAccount("alt-gh-14", "github", {
+    sessionRem: 20,
+    sessionResetSec: 180,
+  });
+  const sessionId = `sa-14-session-${Math.random().toString(36).slice(2)}`;
+  bindSessionConnection(sessionId, "bound-gh-14", { source: "explicit_post_credential" });
+
+  const result = selectByEarliestResetFirst(
+    [githubConn("bound-gh-14"), githubConn("alt-gh-14")],
+    sessionId,
+    "github"
+  );
+  assert.equal(
+    result.selected.id,
+    "alt-gh-14",
+    "github provider must keep original 4× urgent-alt break (gate is Claude-only)"
+  );
+});
diff --git a/tests/unit/session-manager-affinity-headers.test.mjs b/tests/unit/session-manager-affinity-headers.test.mjs
new file mode 100644
index 000000000000..63c496875740
--- /dev/null
+++ b/tests/unit/session-manager-affinity-headers.test.mjs
@@ -0,0 +1,111 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { extractExternalSessionId } = await import("../../open-sse/services/sessionManager.ts");
+
+function fakeHeaders(map) {
+  return {
+    get(name) {
+      return Object.prototype.hasOwnProperty.call(map, name) ? map[name] : null;
+    },
+  };
+}
+
+test("extractExternalSessionId recognises x-session-affinity with ext-xsa: namespace", () => {
+  const got = extractExternalSessionId(fakeHeaders({ "x-session-affinity": "ses_abc123" }));
+  assert.equal(got, "ext-xsa:ses_abc123");
+});
+
+test("extractExternalSessionId namespaces prevent cross-header collisions", () => {
+  // Same raw value sent on two different headers MUST NOT collapse to the
+  // same internal sessionId. Otherwise a client supplying one header could
+  // pin to a session created by another client supplying the other header.
+  const fromGeneric = extractExternalSessionId(fakeHeaders({ "x-session-id": "abc" }));
+  const fromAffinity = extractExternalSessionId(fakeHeaders({ "x-session-affinity": "abc" }));
+  const fromOmni = extractExternalSessionId(fakeHeaders({ "x-omniroute-session": "abc" }));
+  assert.notEqual(fromGeneric, fromAffinity);
+  assert.notEqual(fromGeneric, fromOmni);
+  assert.notEqual(fromAffinity, fromOmni);
+});
+
+test("extractExternalSessionId namespace is collision-proof against legacy values that LOOK namespaced", () => {
+  // A legacy generic header carrying a value like "xsa:foo" must NOT collide
+  // with the new x-session-affinity: "foo" namespace. The collision proof
+  // comes from the namespaced sources using DIFFERENT prefixes than the
+  // generic ones (ext-xsa: / ext-omr: vs ext:), so the resulting strings
+  // differ regardless of the raw value: legacy generic "xsa:foo" becomes
+  // "ext:xsa:foo" while new affinity "foo" becomes "ext-xsa:foo" — distinct
+  // prefix character ('-' vs ':' after "ext"), distinct internal id.
+  const legacyLooksNamespaced = extractExternalSessionId(
+    fakeHeaders({ "x-session-id": "xsa:foo" })
+  );
+  const realAffinity = extractExternalSessionId(fakeHeaders({ "x-session-affinity": "foo" }));
+  assert.notEqual(
+    legacyLooksNamespaced,
+    realAffinity,
+    "x-session-id: 'xsa:foo' must NOT produce the same internal id as x-session-affinity: 'foo'"
+  );
+
+  // Same for omr
+  const legacyLooksOmr = extractExternalSessionId(fakeHeaders({ "x-session-id": "omr:foo" }));
+  const realOmr = extractExternalSessionId(fakeHeaders({ "x-omniroute-session": "foo" }));
+  assert.notEqual(legacyLooksOmr, realOmr);
+});
+
+test("extractExternalSessionId prefers x-session-id over x-session-affinity when both present", () => {
+  const got = extractExternalSessionId(
+    fakeHeaders({
+      "x-session-id": "from-x-session-id",
+      "x-session-affinity": "from-affinity",
+    })
+  );
+  assert.equal(got, "ext:from-x-session-id", "more explicit/generic header takes precedence");
+});
+
+test("extractExternalSessionId returns null when no recognised header present", () => {
+  assert.equal(extractExternalSessionId(fakeHeaders({})), null);
+  assert.equal(extractExternalSessionId(fakeHeaders({ "user-agent": "opencode/1.14.39" })), null);
+});
+
+test("extractExternalSessionId trims whitespace and slices to 64 chars", () => {
+  assert.equal(
+    extractExternalSessionId(fakeHeaders({ "x-session-affinity": "  ses_padded  " })),
+    "ext-xsa:ses_padded"
+  );
+
+  const longRaw = "x".repeat(120);
+  const got = extractExternalSessionId(fakeHeaders({ "x-session-affinity": longRaw }));
+  assert.equal(got, `ext-xsa:${"x".repeat(64)}`);
+});
+
+test("extractExternalSessionId returns null for empty/whitespace-only header values", () => {
+  assert.equal(extractExternalSessionId(fakeHeaders({ "x-session-affinity": "" })), null);
+  assert.equal(extractExternalSessionId(fakeHeaders({ "x-session-affinity": "   " })), null);
+});
+
+test("extractExternalSessionId handles missing headers object gracefully", () => {
+  assert.equal(extractExternalSessionId(null), null);
+  assert.equal(extractExternalSessionId(undefined), null);
+  assert.equal(extractExternalSessionId({}), null);
+});
+
+test("extractExternalSessionId fallback chain order: x-session-id > x_session_id > x-session-affinity > x-omniroute-session > session-id", () => {
+  // Subset chain: ensure earlier sources mask later ones.
+  const got1 = extractExternalSessionId(
+    fakeHeaders({ x_session_id: "underscore", "x-session-affinity": "ignored" })
+  );
+  assert.equal(got1, "ext:underscore");
+
+  const got2 = extractExternalSessionId(
+    fakeHeaders({ "x-session-affinity": "affinity", "x-omniroute-session": "ignored" })
+  );
+  assert.equal(got2, "ext-xsa:affinity");
+
+  const got3 = extractExternalSessionId(
+    fakeHeaders({ "x-omniroute-session": "omr-val", "session-id": "ignored" })
+  );
+  assert.equal(got3, "ext-omr:omr-val");
+
+  const got4 = extractExternalSessionId(fakeHeaders({ "session-id": "bare" }));
+  assert.equal(got4, "ext:bare");
+});
diff --git a/tests/unit/session-manager-binding.test.mjs b/tests/unit/session-manager-binding.test.mjs
new file mode 100644
index 000000000000..efeabffbca69
--- /dev/null
+++ b/tests/unit/session-manager-binding.test.mjs
@@ -0,0 +1,169 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const sessionManager = await import("../../open-sse/services/sessionManager.ts");
+const { bindSessionConnection, touchSession, getSessionConnection, getSessionInfo, clearSessions } =
+  sessionManager;
+
+test.beforeEach(() => {
+  clearSessions();
+});
+
+test("touchSession(sessionId) updates lastActive without mutating connectionId", () => {
+  bindSessionConnection("s1", "conn-A", { source: "explicit_post_credential" });
+  const before = getSessionInfo("s1").connectionId;
+  assert.equal(before, "conn-A");
+
+  touchSession("s1");
+
+  const after = getSessionInfo("s1");
+  assert.equal(after.connectionId, "conn-A", "connectionId must NOT change on plain touch");
+  assert.equal(after.requestCount, 2, "requestCount increments on touch");
+});
+
+test("touchSession with no existing entry creates a session with connectionId: null", () => {
+  touchSession("s2");
+  const info = getSessionInfo("s2");
+  assert.ok(info, "session is created");
+  assert.equal(info.connectionId, null, "no caller-supplied connection means null binding");
+});
+
+test("touchSession(sessionId, deprecatedConnectionId) compat shim still binds", () => {
+  // Compat path: legacy 2-arg call must result in the same binding outcome
+  // as bindSessionConnection. The deprecation warning is intentionally not
+  // asserted here to keep the test decoupled from logger side effects;
+  // exercising the binding contract is the primary signal we need at the
+  // unit level. (sessionManager statically imports the logger, so the
+  // warning IS emitted in production — verifying the emission would be
+  // the job of a logger-stub integration test.)
+  touchSession("s3", "conn-B");
+  assert.equal(getSessionConnection("s3"), "conn-B");
+});
+
+test("touchSession compat shim treats null oldConnectionId as first_bind, not within-window", () => {
+  // Copilot PR #28 R3-1: the compat shim previously updated `lastActive`
+  // before forwarding to bindSessionConnection, which would make the
+  // forwarded call see a fresh `lastActive` and (incorrectly) classify a
+  // first bind on a brand-new session as within-window. Test exercises the
+  // first-bind path explicitly via the compat shim — must produce the
+  // standard first_bind outcome (no warn alarm) for a fresh session.
+  // The corrected order (bind first, increment requestCount after) is
+  // what makes this work — and the absence of any prior session entry
+  // means bindSessionConnection takes the first_bind branch directly.
+  touchSession("s3-fresh", "conn-X");
+  const info = getSessionInfo("s3-fresh");
+  assert.ok(info, "compat shim creates the session via the bind path");
+  assert.equal(info.connectionId, "conn-X");
+  // 1-touch == 1-request semantics preserved: bind first_bind already sets
+  // requestCount=1, so the compat shim does NOT increment again on the
+  // first call (only when an entry pre-existed).
+  assert.equal(info.requestCount, 1);
+});
+
+test("bindSessionConnection: no_session_id when sessionId is null/empty", () => {
+  const r1 = bindSessionConnection(null, "conn-A", { source: "fall_through" });
+  assert.equal(r1.ok, false);
+  assert.equal(r1.reason, "no_session_id");
+
+  const r2 = bindSessionConnection("", "conn-A", { source: "fall_through" });
+  assert.equal(r2.ok, false);
+  assert.equal(r2.reason, "no_session_id");
+});
+
+test("bindSessionConnection: first_bind creates session with the given connectionId", () => {
+  const r = bindSessionConnection("s4", "conn-A", { source: "fall_through" });
+  assert.equal(r.ok, true);
+  assert.equal(r.reason, "first_bind");
+  assert.equal(r.oldConnectionId, null);
+  assert.equal(r.newConnectionId, "conn-A");
+  assert.equal(getSessionConnection("s4"), "conn-A");
+});
+
+test("bindSessionConnection: null oldConnectionId after touchSession is treated as first_bind, NOT rebind_within_window", () => {
+  // Production flow: touchSession(sessionId) creates an entry with
+  // connectionId:null, then bindSessionConnection makes the first real
+  // binding decision. This MUST classify as first_bind so the within-window
+  // rebind alarm is not raised on every new session's normal first request.
+  // (Oracle stage 2 audit defect B — this was the most critical bug.)
+  touchSession("s4b");
+  const before = getSessionInfo("s4b");
+  assert.equal(before.connectionId, null);
+
+  const r = bindSessionConnection("s4b", "conn-A", { source: "explicit_post_credential" });
+  assert.equal(r.ok, true);
+  assert.equal(
+    r.reason,
+    "first_bind",
+    "null → real conn must be first_bind, not rebind_within_window"
+  );
+  assert.equal(r.oldConnectionId, null);
+  assert.equal(r.newConnectionId, "conn-A");
+  assert.equal(getSessionConnection("s4b"), "conn-A");
+});
+
+test("bindSessionConnection: no_change when same conn rebound, idempotent confirmation", () => {
+  bindSessionConnection("s5", "conn-A", { source: "fall_through" });
+
+  const r = bindSessionConnection("s5", "conn-A", { source: "explicit_post_credential" });
+  assert.equal(r.ok, true);
+  assert.equal(r.reason, "no_change");
+  assert.equal(r.oldConnectionId, "conn-A");
+  assert.equal(r.newConnectionId, "conn-A");
+  assert.equal(getSessionConnection("s5"), "conn-A");
+});
+
+test("bindSessionConnection: rebind_within_window when conn changes inside affinity window", () => {
+  bindSessionConnection("s6", "conn-A", { source: "fall_through" });
+
+  // Same tick → strictly inside the 5-minute affinity window
+  const r = bindSessionConnection("s6", "conn-B", { source: "fall_through" });
+  assert.equal(r.ok, true);
+  assert.equal(
+    r.reason,
+    "rebind_within_window",
+    "conn change inside the affinity window is the diagnostic alarm condition"
+  );
+  assert.equal(r.oldConnectionId, "conn-A");
+  assert.equal(r.newConnectionId, "conn-B");
+  assert.equal(getSessionConnection("s6"), "conn-B");
+});
+
+test("bindSessionConnection: emergency_fallback rebind succeeds without raising the within-window alarm signal", () => {
+  // Oracle stage 2 audit defect D: the chat.ts emergency-fallback retry path
+  // re-binds the same session to a different connection within the affinity
+  // window. That is legitimate (the primary connection failed); we want it
+  // to succeed quietly, not blare the diagnostic alarm reserved for
+  // unexpected within-window rebinds.
+  bindSessionConnection("s6e", "conn-A", { source: "explicit_post_credential" });
+  const r = bindSessionConnection("s6e", "conn-B", { source: "emergency_fallback" });
+  assert.equal(r.ok, true);
+  assert.equal(
+    r.reason,
+    "rebind_within_window",
+    "the reason classification is unchanged — the alarm SUPPRESSION is on the log side, not the contract"
+  );
+  assert.equal(r.oldConnectionId, "conn-A");
+  assert.equal(r.newConnectionId, "conn-B");
+  assert.equal(getSessionConnection("s6e"), "conn-B");
+});
+
+test("bindSessionConnection: rebind to a different conn always succeeds and updates the bound conn (window classification is wall-clock dependent)", async () => {
+  // The strict "after_window" classification requires advancing real time
+  // past SESSION_AFFINITY_WINDOW_MS (5 minutes). This unit-level test
+  // intentionally does NOT introduce a fake-timer dependency; instead it
+  // asserts the contract that a within-process rebind to a different conn
+  // (a) succeeds, (b) actually mutates the bound conn, and (c) classifies
+  // the reason as one of the two rebind variants. The strict
+  // `rebind_after_window` branch is exercised in the previous test (which
+  // verifies the within-window emission path explicitly) and would be
+  // covered by an integration test if a future PR introduces fake timers.
+  bindSessionConnection("s7", "conn-A", { source: "fall_through" });
+
+  const r = bindSessionConnection("s7", "conn-C", { source: "fall_through" });
+  assert.equal(r.ok, true);
+  assert.equal(getSessionConnection("s7"), "conn-C");
+  assert.ok(
+    ["rebind_within_window", "rebind_after_window"].includes(r.reason),
+    "reason must be one of the two rebind classifications (wall-clock dependent)"
+  );
+});