diff --git a/Justfile b/Justfile
index 9730b1270fa..6b979015c65 100644
--- a/Justfile
+++ b/Justfile
@@ -256,7 +256,18 @@ desktop-tauri-test-compiled-flags: _ensure-sidecar-stubs
     BUZZ_BUILD_AGENT_ACCESS_OWNER_ONLY=1 \
       BUZZ_TEST_EXPECTED_AGENT_ACCESS_OWNER_ONLY=true \
       cargo test compiled_policy_matches_expected -- --ignored --nocapture
-    echo "Both compiled states verified."
+    echo "=== Maximum accepted demo name reaches Rust build validation ==="
+    DEMO_CONFIG="$(node ../scripts/demo-build-config.mjs "$(printf 'x%.0s' {1..31})" /dev/null 1234567812345678)"
+    DEMO_SLUG="$(node -e 'console.log(JSON.parse(process.argv[1]).slug)' "$DEMO_CONFIG")"
+    BUZZ_BUILD_DEMO_SLUG="$DEMO_SLUG" \
+      BUZZ_TEST_EXPECTED_DEMO_SLUG="$DEMO_SLUG" \
+      cargo test compiled_demo_slug_matches_expected -- --ignored --nocapture
+    BUZZ_BUILD_DEMO_SLUG="$DEMO_SLUG" cargo test --workspace
+    if node ../scripts/demo-build-config.mjs "$(printf 'x%.0s' {1..32})" /dev/null 1234567812345678; then
+      echo "A 32-character demo name unexpectedly passed JavaScript validation" >&2
+      exit 1
+    fi
+    echo "Both compiled states and the accepted/rejected demo-name boundary verified."
 
 # Build the full desktop Tauri app locally (unsigned, for testing)
 # Sidecar binary list must stay in sync with _ensure-sidecar-stubs above.
@@ -277,6 +288,38 @@ desktop-release-build target="aarch64-apple-darwin":
     pnpm install
     cd {{desktop_dir}} && pnpm tauri build --features mesh-llm --target {{target}}
 
+# Build an unsigned named macOS demo DMG with isolated app and runtime identities.
+desktop-demo-build demo_name target="aarch64-apple-darwin":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    TARGET={{target}}
+    [[ "$(uname -s)" == "Darwin" && "$TARGET" == *-apple-darwin ]] || { echo "Demo DMGs require a macOS Apple target" >&2; exit 2; }
+    CONFIG_PATH="$(mktemp "${TMPDIR:-/tmp}/buzz-demo-config.XXXXXX")"
+    trap 'rm -f "$CONFIG_PATH"' EXIT
+    DEMO_BUILD_ID="$(node -e 'console.log(require("node:crypto").randomBytes(8).toString("hex"))')"
+    DEMO_CONFIG="$(node desktop/scripts/demo-build-config.mjs {{quote(demo_name)}} "$CONFIG_PATH" "$DEMO_BUILD_ID")"
+    read_config() { node -e 'console.log(JSON.parse(process.argv[1])[process.argv[2]])' "$DEMO_CONFIG" "$1"; }
+    PRODUCT_NAME="$(read_config productName)"
+    DMG_VOLUME_NAME="$(read_config dmgVolumeName)"
+    DMG_FILE_STEM="$(read_config dmgFileStem)"
+    DEMO_SLUG="$(read_config slug)"
+    cargo build --release --target "$TARGET" \
+      -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp \
+      -p git-credential-nostr -p buzz-cli
+    ./scripts/bundle-sidecars.sh "$TARGET"
+    pnpm install
+    cd {{desktop_dir}}
+    BUZZ_BUILD_DEMO_SLUG="$DEMO_SLUG" pnpm tauri build --features mesh-llm --target "$TARGET" --bundles app --config "$CONFIG_PATH"
+    cd ..
+    VERSION="$(node -p "require('./desktop/package.json').version")"
+    DMG_ARCH="${TARGET%%-*}"; [[ "$DMG_ARCH" == "x86_64" ]] && DMG_ARCH=x64
+    APP_PATH="desktop/src-tauri/target/$TARGET/release/bundle/macos/$PRODUCT_NAME.app"
+    PLIST="$APP_PATH/Contents/Info.plist"
+    /usr/libexec/PlistBuddy -c "Set :CFBundleDisplayName $PRODUCT_NAME" "$PLIST"
+    /usr/libexec/PlistBuddy -c "Set :CFBundleName $PRODUCT_NAME" "$PLIST"
+    codesign --force --deep --sign - "$APP_PATH"
+    VOL_NAME="$DMG_VOLUME_NAME" ./desktop/scripts/package-macos-dmg.sh "$APP_PATH" "desktop/src-tauri/target/$TARGET/release/bundle/dmg/${DMG_FILE_STEM}_${VERSION}_${DMG_ARCH}.dmg"
+
 # Run desktop checks suitable for CI / pre-push
 desktop-ci: desktop-check desktop-test desktop-tauri-fmt-check desktop-build desktop-tauri-check desktop-tauri-test
 
diff --git a/crates/buzz-agent/src/auth.rs b/crates/buzz-agent/src/auth.rs
index a78a499bdd1..7ebabccbbbd 100644
--- a/crates/buzz-agent/src/auth.rs
+++ b/crates/buzz-agent/src/auth.rs
@@ -93,8 +93,9 @@ impl TokenSource for StaticTokenSource {
 ///
 /// The `discovery_url` must return a JSON document with at least
 /// `authorization_endpoint` and `token_endpoint` (RFC 8414). The
-/// `cache_namespace` is the directory under `~/.config/buzz-agent/oauth/`
-/// the token JSON lives in — separates providers' caches cleanly.
+/// `cache_namespace` is the directory under the platform config directory's
+/// `buzz-agent/oauth/` root where the token JSON lives — separates providers'
+/// caches cleanly.
 #[derive(Debug, Clone)]
 pub struct PkceOAuthConfig {
     pub discovery_url: String,
@@ -102,7 +103,7 @@ pub struct PkceOAuthConfig {
     pub scopes: Vec<String>,
     pub cache_namespace: String,
     /// When `Some`, the engine writes tokens here instead of
-    /// `~/.config/buzz-agent/oauth/<cache_namespace>/`. Production code
+    /// `<platform config dir>/buzz-agent/oauth/<cache_namespace>/`. Production code
     /// leaves this `None`. Integration tests use it to avoid stomping on
     /// a shared `$HOME` when running in parallel.
     pub cache_dir_override: Option<PathBuf>,
@@ -444,6 +445,29 @@ fn is_expired(t: &CachedToken) -> bool {
     now + TOKEN_REFRESH_LEEWAY.as_secs() >= exp
 }
 
+const BUZZ_AGENT_CONFIG_DIR_ENV: &str = "BUZZ_AGENT_CONFIG_DIR";
+
+fn oauth_cache_root_for(
+    config_override: Option<PathBuf>,
+    home_dir: Option<PathBuf>,
+) -> Result<PathBuf, AgentError> {
+    if let Some(root) = config_override {
+        return Ok(root.join("buzz-agent").join("oauth"));
+    }
+    Ok(home_dir
+        .ok_or_else(|| AgentError::Llm("oauth cache: home directory not found".into()))?
+        .join(".config")
+        .join("buzz-agent")
+        .join("oauth"))
+}
+
+fn default_oauth_cache_root() -> Result<PathBuf, AgentError> {
+    oauth_cache_root_for(
+        std::env::var_os(BUZZ_AGENT_CONFIG_DIR_ENV).map(PathBuf::from),
+        dirs::home_dir(),
+    )
+}
+
 fn cache_path_for(cfg: &PkceOAuthConfig) -> Result<PathBuf, AgentError> {
     let mut h = sha2::Sha256::new();
     h.update(cfg.discovery_url.as_bytes());
@@ -455,12 +479,7 @@ fn cache_path_for(cfg: &PkceOAuthConfig) -> Result<PathBuf, AgentError> {
 
     let dir = match &cfg.cache_dir_override {
         Some(p) => p.join(&cfg.cache_namespace),
-        None => dirs::home_dir()
-            .ok_or_else(|| AgentError::Llm("oauth cache: home directory not found".into()))?
-            .join(".config")
-            .join("buzz-agent")
-            .join("oauth")
-            .join(&cfg.cache_namespace),
+        None => default_oauth_cache_root()?.join(&cfg.cache_namespace),
     };
     Ok(dir.join(format!("{hash}.json")))
 }
@@ -862,7 +881,41 @@ mod tests {
     }
 
     #[test]
-    fn cache_path_uses_platform_home_directory() {
+    fn production_and_demo_oauth_roots_are_concrete_and_distinct() {
+        let home = PathBuf::from("/Users/demo");
+        let production = oauth_cache_root_for(None, Some(home.clone())).unwrap();
+        let first_demo_config = home
+            .join("Library/Application Support")
+            .join("buzz-demo-board-1234567812345678");
+        let second_demo_config = home
+            .join("Library/Application Support")
+            .join("buzz-demo-board-8765432187654321");
+        let first_demo = oauth_cache_root_for(Some(first_demo_config), Some(home.clone())).unwrap();
+        let second_demo = oauth_cache_root_for(Some(second_demo_config), Some(home)).unwrap();
+
+        assert_eq!(
+            production,
+            PathBuf::from("/Users/demo/.config/buzz-agent/oauth")
+        );
+        assert_eq!(
+            first_demo,
+            PathBuf::from(
+                "/Users/demo/Library/Application Support/buzz-demo-board-1234567812345678/buzz-agent/oauth"
+            )
+        );
+        assert_eq!(
+            second_demo,
+            PathBuf::from(
+                "/Users/demo/Library/Application Support/buzz-demo-board-8765432187654321/buzz-agent/oauth"
+            )
+        );
+        assert_ne!(production, first_demo);
+        assert_ne!(production, second_demo);
+        assert_ne!(first_demo, second_demo);
+    }
+
+    #[test]
+    fn cache_path_preserves_production_home_config_directory() {
         let cfg = PkceOAuthConfig {
             discovery_url: "https://example.com/.well-known".into(),
             client_id: "abc".into(),
diff --git a/crates/buzz-agent/src/catalog.rs b/crates/buzz-agent/src/catalog.rs
index 82f3b086cd6..f2cda834fd1 100644
--- a/crates/buzz-agent/src/catalog.rs
+++ b/crates/buzz-agent/src/catalog.rs
@@ -12,7 +12,7 @@
 //! This helper never opens a browser. Callers choose whether to reject, degrade,
 //! or start a separate interactive authentication flow.
 
-use std::{collections::HashSet, sync::Arc, time::Duration};
+use std::{collections::HashSet, path::Path, sync::Arc, time::Duration};
 
 use reqwest::Client;
 use serde_json::Value;
@@ -133,7 +133,26 @@ pub(crate) fn is_chat_capable_endpoint(name: &str) -> bool {
 /// # Panics
 /// Never panics.
 pub async fn discover_databricks_models(cfg: &Config) -> Result<Vec<ModelEntry>, AgentError> {
-    discover_databricks_models_with_token_source(cfg, build_token_source(cfg)?).await
+    discover_databricks_models_with_cache_dir(cfg, None).await
+}
+
+/// Discover Databricks models while storing PKCE credentials under an explicit
+/// cache root. `None` preserves buzz-agent's production cache location.
+pub async fn discover_databricks_models_with_cache_dir(
+    cfg: &Config,
+    cache_dir: Option<&Path>,
+) -> Result<Vec<ModelEntry>, AgentError> {
+    let token_source = if matches!(cfg.provider, Provider::Databricks | Provider::DatabricksV2)
+        && cfg.api_key.is_empty()
+    {
+        crate::auth::PkceOAuthTokenSource::new(crate::llm::databricks_pkce_config(
+            &cfg.base_url,
+            cache_dir.map(Path::to_path_buf),
+        ))?
+    } else {
+        build_token_source(cfg)?
+    };
+    discover_databricks_models_with_token_source(cfg, token_source).await
 }
 
 async fn discover_databricks_models_with_token_source(
diff --git a/crates/buzz-agent/src/lib.rs b/crates/buzz-agent/src/lib.rs
index b094a0f9fd7..3de47c82a4a 100644
--- a/crates/buzz-agent/src/lib.rs
+++ b/crates/buzz-agent/src/lib.rs
@@ -13,7 +13,9 @@ mod permission;
 pub mod types;
 mod wire;
 
-pub use catalog::{discover_databricks_models, ModelEntry};
+pub use catalog::{
+    discover_databricks_models, discover_databricks_models_with_cache_dir, ModelEntry,
+};
 pub use config::Provider;
 pub use types::AgentError;
 
@@ -161,10 +163,22 @@ pub fn run() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
+/// Authenticate to Databricks and store credentials under an optional explicit
+/// cache root. `None` preserves buzz-agent's production cache location.
+pub async fn authenticate_databricks_with_cache_dir(
+    host: &str,
+    cache_dir: Option<&std::path::Path>,
+) -> Result<(), AgentError> {
+    auth::PkceOAuthTokenSource::new(llm::databricks_pkce_config(
+        host,
+        cache_dir.map(std::path::Path::to_path_buf),
+    ))?
+    .interactive_login()
+    .await
+}
+
 pub async fn authenticate_databricks(host: &str) -> Result<(), AgentError> {
-    auth::PkceOAuthTokenSource::new(llm::databricks_pkce_config(host))?
-        .interactive_login()
-        .await
+    authenticate_databricks_with_cache_dir(host, None).await
 }
 
 /// `buzz-agent auth <provider>` — run the interactive auth flow for a
diff --git a/crates/buzz-agent/src/llm.rs b/crates/buzz-agent/src/llm.rs
index 1d46c16e163..1bac5147743 100644
--- a/crates/buzz-agent/src/llm.rs
+++ b/crates/buzz-agent/src/llm.rs
@@ -1,4 +1,5 @@
 use std::collections::BTreeSet;
+use std::path::PathBuf;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
 
@@ -2033,7 +2034,10 @@ where
     )))
 }
 
-pub(crate) fn databricks_pkce_config(host: &str) -> PkceOAuthConfig {
+pub(crate) fn databricks_pkce_config(
+    host: &str,
+    cache_dir_override: Option<PathBuf>,
+) -> PkceOAuthConfig {
     PkceOAuthConfig {
         discovery_url: format!(
             "{}/oidc/.well-known/oauth-authorization-server",
@@ -2045,7 +2049,7 @@ pub(crate) fn databricks_pkce_config(host: &str) -> PkceOAuthConfig {
             .map(|scope| (*scope).into())
             .collect(),
         cache_namespace: "databricks".into(),
-        cache_dir_override: None,
+        cache_dir_override,
     }
 }
 
@@ -2070,6 +2074,7 @@ pub(crate) fn build_token_source(cfg: &Config) -> Result<Arc<dyn TokenSource>, A
             }
             Ok(PkceOAuthTokenSource::new(databricks_pkce_config(
                 &cfg.base_url,
+                None,
             ))?)
         }
     }
diff --git a/crates/buzz-agent/src/mcp.rs b/crates/buzz-agent/src/mcp.rs
index 42c9cc48780..a848557ae2f 100644
--- a/crates/buzz-agent/src/mcp.rs
+++ b/crates/buzz-agent/src/mcp.rs
@@ -45,6 +45,9 @@ const PASSTHROUGH_ENV: &[&str] = &[
     "LC_ALL",
     "TMPDIR",
     "XDG_CONFIG_HOME",
+    // Explicit Buzz-owned OAuth root for named demo builds. The agent may spawn
+    // auth-capable child tools after clearing its ambient environment.
+    "BUZZ_AGENT_CONFIG_DIR",
     // SSH — required for git clone/push over SSH (git@github.com:...)
     "SSH_AUTH_SOCK",
     "SSH_AGENT_PID",
diff --git a/crates/buzz-agent/src/model_capabilities.rs b/crates/buzz-agent/src/model_capabilities.rs
index 940448dd2e4..b0e4ebc6e50 100644
--- a/crates/buzz-agent/src/model_capabilities.rs
+++ b/crates/buzz-agent/src/model_capabilities.rs
@@ -622,6 +622,8 @@ mod tests {
     Q::Vector { id: "dbv2-claude-opus-4-7-probe", provider: "databricks_v2", raw_model_id: "claude-opus-4-7", note: None },
     Q::Vector { id: "dbv2-databricks-prefix-probe", provider: "databricks_v2", raw_model_id: "databricks-claude-opus-4-7", note: Some("Probes stripping of the databricks- catalog prefix.") },
     Q::Vector { id: "dbv2-goose-claude-prefix-probe", provider: "databricks_v2", raw_model_id: "goose-claude-fable-5", note: Some("Probes stripping of the goose- catalog prefix.") },
+    Q::Vector { id: "dbv2-goose-claude-4-6-sonnet-alias-probe", provider: "databricks_v2", raw_model_id: "goose-claude-4-6-sonnet", note: Some("Probes the discovered Goose Sonnet 4.6 endpoint spelling and label.") },
+    Q::Vector { id: "dbv2-goose-claude-4-7-opus-alias-probe", provider: "databricks_v2", raw_model_id: "goose-claude-4-7-opus", note: Some("Probes the discovered Goose Opus 4.7 endpoint spelling and label.") },
     Q::Vector { id: "dbv2-team-prefix-probe", provider: "databricks_v2", raw_model_id: "team-x-claude-opus-4-7", note: Some("Probes stripping of a team-x- catalog prefix.") },
     Q::Vector { id: "dbv2-consolidated-llama-substring-probe", provider: "databricks_v2", raw_model_id: "consolidated-llama", note: Some("Probes a name where a code word ('sol') appears only as a substring, not a boundary-aligned segment.") },
     Q::Vector { id: "dbv2-terraform-coder-substring-probe", provider: "databricks_v2", raw_model_id: "terraform-coder", note: Some("Probes a name where a code word ('terra') is only a segment prefix, not a full segment.") },
@@ -638,6 +640,7 @@ mod tests {
     Q::Vector { id: "dbv2-goose-claude-opus-5-alias-probe", provider: "databricks_v2", raw_model_id: "goose-claude-opus-5", note: Some("Probes a prefixed alias of the Databricks Opus 5 endpoint.") },
     Q::Vector { id: "dbv2-claude-sonnet-5-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-claude-sonnet-5", note: Some("Probes the canonical Databricks Sonnet 5 endpoint record.") },
     Q::Vector { id: "dbv2-goose-claude-sonnet-5-alias-probe", provider: "databricks_v2", raw_model_id: "goose-claude-sonnet-5", note: Some("Probes a prefixed alias of the Databricks Sonnet 5 endpoint.") },
+    Q::Vector { id: "dbv2-kimi-2-7-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-kimi-2-7", note: Some("Probes the canonical Databricks Kimi 2.7 endpoint record.") },
     Q::Vector { id: "dbv2-kimi-k3-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-kimi-k3", note: Some("Probes the canonical Databricks Kimi K3 endpoint record.") },
     Q::Vector { id: "dbv2-goose-kimi-k3-alias-probe", provider: "databricks_v2", raw_model_id: "goose-kimi-k3", note: Some("Probes a prefixed alias of the Databricks Kimi K3 endpoint.") },
     Q::Vector { id: "resolver-prefixed-alias-probe", provider: "databricks_v2", raw_model_id: "team-x-databricks-gpt-5-4-mini", note: Some("Probes a prefixed alias of an exact-record id (raw exact key differs).") },
@@ -728,6 +731,7 @@ mod tests {
     Q::Vector { id: "dbv2-gemini-3-pro-image-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-gemini-3-pro-image", note: Some("Probes the Gemini 3 Pro Image endpoint record and label.") },
     Q::Vector { id: "dbv2-deepseek-v4-flash-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-deepseek-v4-flash-0731", note: Some("Probes the DeepSeek V4 Flash endpoint record and label.") },
     Q::Vector { id: "dbv2-deepseek-v4-pro-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-deepseek-v4-pro-0813", note: Some("Probes the DeepSeek V4 Pro endpoint record and label.") },
+    Q::Vector { id: "dbv2-glm-5-3-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-glm-5-3", note: Some("Probes the GLM-5.3 endpoint record and label.") },
     Q::Vector { id: "dbv2-glm-5-3-flash-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-glm-5-3-flash", note: Some("Probes the GLM-5.3 Flash endpoint record and label.") },
     Q::Vector { id: "dbv2-grok-4-6-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-grok-4-6", note: Some("Probes the Grok 4.6 endpoint record and label.") },
     Q::Vector { id: "dbv2-llama-4-maverick-exact-record-probe", provider: "databricks_v2", raw_model_id: "databricks-llama-4-maverick", note: Some("Probes the Llama 4 Maverick endpoint record and label.") },
@@ -839,7 +843,7 @@ mod tests {
     }
 
     #[test]
-    fn corpus_has_exactly_135_executable_vectors() {
+    fn corpus_has_exactly_139_executable_vectors() {
         // Locks the vector count so a silent INPUTS edit can't quietly drop
         // coverage; must equal the gate in the TS harness
         // (modelCapabilitiesCorpus.test.mjs).
@@ -848,7 +852,7 @@ mod tests {
             .filter(|q| matches!(q, Q::Vector { .. }))
             .count();
         assert_eq!(
-            vectors, 135,
+            vectors, 139,
             "corpus executable-vector count changed; update this gate deliberately"
         );
     }
@@ -1018,9 +1022,12 @@ mod tests {
             Some("Claude Fable 5")
         );
         for (alias, label) in [
+            ("goose-claude-4-6-sonnet", "Claude Sonnet 4.6"),
+            ("goose-claude-4-7-opus", "Claude Opus 4.7"),
             ("goose-claude-opus-4-8", "Claude Opus 4.8"),
             ("goose-claude-opus-5", "Claude Opus 5"),
             ("goose-claude-sonnet-5", "Claude Sonnet 5"),
+            ("goose-kimi-2-7", "Kimi 2.7"),
             ("goose-kimi-k3", "Kimi K3"),
         ] {
             assert_eq!(
@@ -1053,6 +1060,7 @@ mod tests {
                 "data_workflow_tools.goose.goose-deepseek-v4-flash-0731",
                 "DeepSeek V4 Flash",
             ),
+            ("data_workflow_tools.goose.goose-glm-5-3", "GLM-5.3"),
             (
                 "data_workflow_tools.goose.goose-glm-5-3-flash",
                 "GLM-5.3 Flash",
diff --git a/crates/buzz-db/src/runtime/migration.rs b/crates/buzz-db/src/runtime/migration.rs
index 00cd81c6940..66ac1d2f8f0 100644
--- a/crates/buzz-db/src/runtime/migration.rs
+++ b/crates/buzz-db/src/runtime/migration.rs
@@ -699,7 +699,7 @@ mod tests {
         let mut migrations: Vec<_> = MIGRATOR.iter().collect();
         migrations.sort_by_key(|migration| migration.version);
 
-        assert_eq!(migrations.len(), 40);
+        assert_eq!(migrations.len(), 42);
         assert_eq!(migrations[0].version, 1);
         assert_eq!(&*migrations[0].description, "initial schema");
         assert!(migrations[0]
@@ -1241,6 +1241,45 @@ mod tests {
             operator_audit.contains("_operator_global_tables"),
             "migration 39 must register relay_operator_audit in _operator_global_tables"
         );
+
+        // NIP-FI core identity + base-lifecycle foundation (migration 0041) and
+        // final-admission foundation (0042). Both widen the single SQL source of
+        // truth `community_write_fence_excluded_table` so their durable,
+        // immutable ledger relations are never fence-attached, purged, or
+        // counted as tenant-scoped drift. schema.sql keeps one consolidated
+        // definition of that function whose body must match 0042's exactly.
+        assert_eq!(migrations[40].version, 41);
+        let identity_foundation = migrations[40].sql.as_str();
+        assert!(identity_foundation.contains("CREATE TABLE identity_bindings"));
+        assert!(identity_foundation.contains("CREATE TABLE identity_lifecycle_history"));
+        assert!(identity_foundation
+            .contains("CREATE OR REPLACE FUNCTION community_write_fence_excluded_table"));
+        assert!(identity_foundation.contains("'identity_bindings'"));
+
+        assert_eq!(migrations[41].version, 42);
+        let authorization_foundation = migrations[41].sql.as_str();
+        assert!(authorization_foundation.contains("CREATE TABLE authorization_events"));
+        assert!(authorization_foundation.contains("CREATE TABLE protected_object_authority"));
+        assert!(authorization_foundation.contains("CREATE TABLE authorization_admission_results"));
+
+        // The consolidated desired-state exclusion function must byte-match
+        // migration 0042's CREATE OR REPLACE body, or a future schema
+        // consolidation would silently drop NIP-FI relations from the ledger.
+        fn extract_excluded_table_array(sql: &str) -> &str {
+            let anchor = "community_write_fence_excluded_table(target NAME) RETURNS BOOLEAN";
+            let start = sql.find(anchor).expect("exclusion function definition");
+            let array_start = sql[start..].find("ARRAY[").expect("exclusion array") + start;
+            let array_end = sql[array_start..]
+                .find("]::TEXT[]")
+                .expect("exclusion array end")
+                + array_start;
+            &sql[array_start..array_end]
+        }
+        assert_eq!(
+            extract_excluded_table_array(authorization_foundation),
+            extract_excluded_table_array(desired_schema),
+            "schema.sql exclusion list drifted from migration 0042"
+        );
     }
 
     #[test]
@@ -2618,4 +2657,2578 @@ mod tests {
             .await
             .expect("drop late-table fixtures");
     }
+
+    /// NIP-FI intermediate state: migration 0041 (identity + base lifecycle)
+    /// alone must present a coherent catalog. Its five community-scoped ledger
+    /// relations are immutable and durable, so they are registered in the
+    /// write-fence exclusion — never counted as tenant-scoped drift, never
+    /// fence-attached — and the exact deletion catalog must still validate.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn migration_0041_identity_foundation_is_durable_ledger_after_migration_a() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(41, &pool)
+            .await
+            .expect("apply migrations 1-41");
+
+        // The five identity relations exist.
+        let identity_tables = [
+            "authorization_operation_receipts",
+            "identity_enrollment_policies",
+            "identity_bindings",
+            "identity_lifecycle_history",
+            "identity_lifecycle_selectors",
+        ];
+        for table in identity_tables {
+            let exists = sqlx::query_scalar::<_, bool>(
+                "SELECT EXISTS (SELECT 1 FROM information_schema.tables \
+                 WHERE table_schema = 'public' AND table_name = $1)",
+            )
+            .bind(table)
+            .fetch_one(&pool)
+            .await
+            .unwrap_or_else(|err| panic!("check table {table}: {err}"));
+            assert!(exists, "migration 0041 must create {table}");
+        }
+
+        // Migration B's relations must NOT exist yet.
+        for table in ["authorization_events", "protected_object_authority"] {
+            let exists = sqlx::query_scalar::<_, bool>(
+                "SELECT EXISTS (SELECT 1 FROM information_schema.tables \
+                 WHERE table_schema = 'public' AND table_name = $1)",
+            )
+            .bind(table)
+            .fetch_one(&pool)
+            .await
+            .unwrap_or_else(|err| panic!("check table {table}: {err}"));
+            assert!(!exists, "{table} belongs to migration 0042, not 0041");
+        }
+
+        // Every identity relation is excluded from the write fence: none may
+        // appear as tenant-scoped drift or carry the fence trigger.
+        let scoped_or_fenced: Vec<String> = sqlx::query_scalar(
+            "WITH scoped AS ( \
+                 SELECT c.relname FROM pg_class c \
+                 JOIN pg_namespace n ON n.oid = c.relnamespace \
+                 JOIN pg_attribute a ON a.attrelid = c.oid \
+                 WHERE n.nspname = 'public' AND c.relkind IN ('r','p') \
+                   AND NOT c.relispartition AND a.attname = 'community_id' \
+                   AND NOT a.attisdropped \
+                   AND NOT community_write_fence_excluded_table(c.relname) \
+             ) \
+             SELECT relname FROM scoped \
+             WHERE relname = ANY($1) ORDER BY relname",
+        )
+        .bind(&identity_tables[..])
+        .fetch_all(&pool)
+        .await
+        .expect("read scoped identity relations");
+        assert!(
+            scoped_or_fenced.is_empty(),
+            "identity ledger relations must be write-fence excluded, not scoped: {scoped_or_fenced:?}"
+        );
+
+        // The exact deletion catalog validates: the excluded ledger relations
+        // do not perturb the scoped-table/fence equality check.
+        crate::deletion::DeletionStore::new(pool.clone())
+            .validate_catalog()
+            .await
+            .expect("deletion catalog validates after migration 0041");
+
+        // The immutability contract is enforced, not merely declared. TRUNCATE
+        // fires the statement-level guard unconditionally, so this proves the
+        // rejection without constructing a fully valid ledger row.
+        let rejected = sqlx::query("TRUNCATE identity_lifecycle_selectors")
+            .execute(&pool)
+            .await
+            .expect_err("identity_lifecycle_selectors truncation must be rejected");
+        assert!(
+            rejected.to_string().contains("cannot be truncated"),
+            "expected immutability rejection, got: {rejected}"
+        );
+    }
+
+    /// NIP-FI full state: migrations 0041 + 0042 together must present a
+    /// coherent 15-relation catalog with zero dangling foreign keys, all
+    /// relations write-fence excluded, and an intact exact deletion catalog.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn nip_fi_foundation_is_a_closed_durable_ledger_after_migrations_a_and_b() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let nip_fi_tables = [
+            "authorization_admission_results",
+            "authorization_authentication_denial_attempts",
+            "authorization_authority_epochs",
+            "authorization_event_capacity",
+            "authorization_events",
+            "authorization_invalidation_domains",
+            "authorization_invalidation_floors",
+            "authorization_operation_receipts",
+            "authorization_operation_version_delta_manifests",
+            "authorization_operation_version_deltas",
+            "identity_bindings",
+            "identity_enrollment_policies",
+            "identity_lifecycle_history",
+            "identity_lifecycle_selectors",
+            "protected_object_authority",
+        ];
+
+        // All fifteen relations exist.
+        let present: Vec<String> = sqlx::query_scalar(
+            "SELECT table_name FROM information_schema.tables \
+             WHERE table_schema = 'public' AND table_name = ANY($1) ORDER BY table_name",
+        )
+        .bind(&nip_fi_tables[..])
+        .fetch_all(&pool)
+        .await
+        .expect("read NIP-FI table catalog");
+        let mut expected: Vec<String> = nip_fi_tables.iter().map(|t| t.to_string()).collect();
+        expected.sort();
+        assert_eq!(
+            present, expected,
+            "all NIP-FI relations must exist after 0042"
+        );
+
+        // Zero dangling foreign keys: every FK target is a live relation.
+        let invalid_fks: i64 = sqlx::query_scalar(
+            "SELECT count(*)::BIGINT FROM pg_constraint \
+             WHERE contype = 'f' AND NOT convalidated",
+        )
+        .fetch_one(&pool)
+        .await
+        .expect("read FK validity");
+        assert_eq!(
+            invalid_fks, 0,
+            "no NIP-FI foreign key may be left unvalidated"
+        );
+
+        // None of the fifteen appear as tenant-scoped drift; all are excluded.
+        let scoped: Vec<String> = sqlx::query_scalar(
+            "SELECT c.relname FROM pg_class c \
+             JOIN pg_namespace n ON n.oid = c.relnamespace \
+             JOIN pg_attribute a ON a.attrelid = c.oid \
+             WHERE n.nspname = 'public' AND c.relkind IN ('r','p') \
+               AND NOT c.relispartition AND a.attname = 'community_id' \
+               AND NOT a.attisdropped \
+               AND NOT community_write_fence_excluded_table(c.relname) \
+               AND c.relname = ANY($1) ORDER BY c.relname",
+        )
+        .bind(&nip_fi_tables[..])
+        .fetch_all(&pool)
+        .await
+        .expect("read scoped NIP-FI relations");
+        assert!(
+            scoped.is_empty(),
+            "all NIP-FI ledger relations must be write-fence excluded: {scoped:?}"
+        );
+
+        // The exact deletion catalog validates with the full ledger present.
+        crate::deletion::DeletionStore::new(pool.clone())
+            .validate_catalog()
+            .await
+            .expect("deletion catalog validates after migrations 0041 + 0042");
+
+        // A migration-B relation is immutable too. TRUNCATE fires the
+        // statement-level guard unconditionally.
+        let rejected = sqlx::query("TRUNCATE authorization_admission_results")
+            .execute(&pool)
+            .await
+            .expect_err("authorization_admission_results truncation must be rejected");
+        assert!(
+            rejected.to_string().contains("cannot be truncated"),
+            "expected immutability rejection, got: {rejected}"
+        );
+    }
+
+    /// NIP-FI monotonic invalidation-floor advancement must actually run
+    /// through the `BEFORE UPDATE` guard. PL/pgSQL defers record-field
+    /// resolution to execution, so a guard that references a column absent from
+    /// its Phase-A table passes every catalog/parity test yet aborts the first
+    /// real advancement. This test exercises live UPDATEs: legitimate forward
+    /// moves on `floor_generation` and `binding_version_floor` must commit, and
+    /// equal/regressive moves must be rejected.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn authorization_invalidation_floor_advances_through_guard() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("floor-guard-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        // Each floor state points at an operation receipt via
+        // (community_id, operation_id, request_fingerprint). Seed one receipt
+        // per operation the test advances through.
+        let operations: [(uuid::Uuid, u8); 4] = [
+            (uuid::Uuid::new_v4(), 0x11),
+            (uuid::Uuid::new_v4(), 0x22),
+            (uuid::Uuid::new_v4(), 0x33),
+            (uuid::Uuid::new_v4(), 0x44),
+        ];
+        for (operation_id, fp_byte) in operations {
+            sqlx::query(
+                "INSERT INTO authorization_operation_receipts \
+                 (community_id, operation_id, request_fingerprint, operation_kind, \
+                  actor_fingerprint, outcome_code, result_digest) \
+                 VALUES ($1, $2, $3, 12, $4, 1, $5)",
+            )
+            .bind(community_id)
+            .bind(operation_id)
+            .bind(vec![fp_byte; 32])
+            .bind(vec![0xAA_u8; 32])
+            .bind(vec![0xBB_u8; 32])
+            .execute(&pool)
+            .await
+            .expect("seed operation receipt");
+        }
+
+        // selector_kind 3 requires binding_version_floor, so this row exercises
+        // both monotonic dimensions the guard still governs.
+        let selector_fingerprint = vec![0xCC_u8; 32];
+        sqlx::query(
+            "INSERT INTO authorization_invalidation_floors \
+             (community_id, selector_kind, selector_fingerprint, floor_generation, \
+              binding_version_floor, operation_id, request_fingerprint, updated_at) \
+             VALUES ($1, 3, $2, 1, 1, $3, $4, '2026-01-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(&selector_fingerprint)
+        .bind(operations[0].0)
+        .bind(vec![operations[0].1; 32])
+        .execute(&pool)
+        .await
+        .expect("insert initial invalidation floor");
+
+        let advance =
+            |generation: i64, binding_floor: i64, op_index: usize, updated_at: &'static str| {
+                sqlx::query(
+                    "UPDATE authorization_invalidation_floors \
+                 SET floor_generation = $1, binding_version_floor = $2, \
+                     operation_id = $3, request_fingerprint = $4, updated_at = $5::timestamptz \
+                 WHERE community_id = $6 AND selector_kind = 3 AND selector_fingerprint = $7",
+                )
+                .bind(generation)
+                .bind(binding_floor)
+                .bind(operations[op_index].0)
+                .bind(vec![operations[op_index].1; 32])
+                .bind(updated_at)
+                .bind(community_id)
+                .bind(selector_fingerprint.clone())
+                .execute(&pool)
+            };
+
+        // Forward generation advance commits.
+        advance(2, 1, 1, "2026-01-01T00:01:00Z")
+            .await
+            .expect("forward floor_generation advance must pass the guard");
+
+        // Forward binding_version_floor advance commits (generation unchanged).
+        advance(2, 2, 2, "2026-01-01T00:02:00Z")
+            .await
+            .expect("forward binding_version_floor advance must pass the guard");
+
+        // Regressive generation is rejected.
+        let regressive = advance(1, 2, 3, "2026-01-01T00:03:00Z")
+            .await
+            .expect_err("regressive floor_generation must be rejected");
+        assert!(
+            regressive.to_string().contains("cannot move backward"),
+            "expected monotonic rejection, got: {regressive}"
+        );
+
+        // Equal floors with only a new operation is a rejected no-op advance.
+        let no_op = advance(2, 2, 3, "2026-01-01T00:03:00Z")
+            .await
+            .expect_err("equal-floor no-op advance must be rejected");
+        assert!(
+            no_op.to_string().contains("cannot move backward"),
+            "expected no-op rejection, got: {no_op}"
+        );
+
+        // The committed state reflects only the two accepted advances.
+        let (generation, binding_floor): (i64, i64) = sqlx::query_as(
+            "SELECT floor_generation, binding_version_floor \
+             FROM authorization_invalidation_floors \
+             WHERE community_id = $1 AND selector_kind = 3 AND selector_fingerprint = $2",
+        )
+        .bind(community_id)
+        .bind(&selector_fingerprint)
+        .fetch_one(&pool)
+        .await
+        .expect("read final floor state");
+        assert_eq!(
+            (generation, binding_floor),
+            (2, 2),
+            "only the accepted forward advances may persist"
+        );
+    }
+
+    /// NIP-FI identity FK contract: a binding's provenance is determined from
+    /// operation evidence and is independent of the enrollment policy's mode.
+    /// The corrected FK references only `(community_id, policy_revision)`;
+    /// the original composite FK `(community_id, policy_revision,
+    /// binding_provenance) → (community_id, policy_revision, enrollment_mode)`
+    /// would have rejected valid admissions such as TOFU policy +
+    /// attested-key provenance (NIP-FI.md §352, §424).
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn identity_binding_provenance_is_independent_of_enrollment_mode() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(41, &pool)
+            .await
+            .expect("apply migrations 1-41");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("provenance-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        // Enrollment policy: mode 3 (TOFU).
+        let policy_revision: i64 = 1;
+        sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, $2, 3, $3, '2026-01-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(policy_revision)
+        .bind(vec![0xA0_u8; 32]) // policy_digest
+        .execute(&pool)
+        .await
+        .expect("insert TOFU enrollment policy");
+
+        // Insert a binding with provenance 1 (attested-key) under the TOFU
+        // policy.  The circular deferred FK between identity_bindings and
+        // identity_lifecycle_history requires both to be committed in one
+        // transaction; all cross-table FKs in this pair are DEFERRABLE
+        // INITIALLY DEFERRED.  A pinned connection is required so that BEGIN
+        // and each subsequent statement share the same session/transaction.
+        let binding_id = uuid::Uuid::new_v4();
+        let history_id = uuid::Uuid::new_v4();
+        let operation_id = uuid::Uuid::new_v4();
+        let request_fingerprint = vec![0xAB_u8; 32];
+
+        let mut conn = pool.acquire().await.expect("acquire connection");
+
+        sqlx::query("BEGIN")
+            .execute(&mut *conn)
+            .await
+            .expect("begin");
+
+        // Enrollment history must be inserted BEFORE the operation receipt:
+        // authorization_operation_receipt_history_guard_v1 fires AFTER INSERT
+        // on authorization_operation_receipts and checks that lifecycle receipts
+        // already have exactly one history row.  The history → receipt FK is
+        // DEFERRABLE INITIALLY DEFERRED, so this order is safe.
+        sqlx::query(
+            "INSERT INTO identity_lifecycle_history \
+             (community_id, history_id, transition_kind, outcome_code, \
+              successor_binding_id, successor_binding_version, \
+              successor_lifecycle_revision, successor_state, \
+              operation_id, request_fingerprint, transition_digest) \
+             VALUES ($1, $2, 1, 1, $3, 1, 1, 1, $4, $5, $6)",
+        )
+        .bind(community_id)
+        .bind(history_id)
+        .bind(binding_id)
+        .bind(operation_id)
+        .bind(&request_fingerprint)
+        .bind(vec![0xAE_u8; 32])
+        .execute(&mut *conn)
+        .await
+        .expect("insert lifecycle history");
+
+        // Operation receipt: kind 1 (enroll), outcome 1 (applied).
+        // The receipt_history_cardinality trigger fires here and validates the
+        // history row inserted above.
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(operation_id)
+        .bind(&request_fingerprint)
+        .bind(vec![0xAC_u8; 32])
+        .bind(vec![0xAD_u8; 32])
+        .execute(&mut *conn)
+        .await
+        .expect("insert operation receipt");
+
+        // Binding: provenance 1 (attested-key) under TOFU-mode policy.
+        // Before the FK fix this INSERT would fail at commit with a FK
+        // violation because 1 (attested-key) ≠ 3 (TOFU mode).
+        sqlx::query(
+            "INSERT INTO identity_bindings \
+             (community_id, binding_id, issuer, subject, \
+              principal_fingerprint, event_author_pubkey, \
+              binding_state, lifecycle_revision, binding_provenance, \
+              policy_revision, enrollment_evidence_digest, \
+              birth_history_id, creation_operation_id, \
+              creation_request_fingerprint) \
+             VALUES ($1, $2, 'https://issuer.example', 'sub-01', \
+                     $3, $4, 1, 1, 1, $5, $6, $7, $8, $9)",
+        )
+        .bind(community_id)
+        .bind(binding_id)
+        .bind(vec![0xAF_u8; 32]) // principal_fingerprint
+        .bind(vec![0xB0_u8; 32]) // event_author_pubkey
+        .bind(policy_revision)
+        .bind(vec![0xB1_u8; 32]) // enrollment_evidence_digest
+        .bind(history_id)
+        .bind(operation_id)
+        .bind(&request_fingerprint)
+        .execute(&mut *conn)
+        .await
+        .expect("insert binding");
+
+        sqlx::query("COMMIT")
+            .execute(&mut *conn)
+            .await
+            .expect("attested-key binding under TOFU policy must commit — FK is on (community_id, policy_revision) only");
+
+        // Confirm the binding persisted with provenance 1, policy mode 3.
+        let (stored_provenance, stored_mode): (i16, i16) = sqlx::query_as(
+            "SELECT b.binding_provenance, p.enrollment_mode \
+             FROM identity_bindings b \
+             JOIN identity_enrollment_policies p \
+               ON p.community_id = b.community_id AND p.policy_revision = b.policy_revision \
+             WHERE b.community_id = $1 AND b.binding_id = $2",
+        )
+        .bind(community_id)
+        .bind(binding_id)
+        .fetch_one(&pool)
+        .await
+        .expect("read persisted binding");
+        assert_eq!(stored_provenance, 1, "provenance must be attested-key (1)");
+        assert_eq!(stored_mode, 3, "enrollment mode must be TOFU (3)");
+        assert_ne!(
+            stored_provenance, stored_mode,
+            "provenance and mode are independent: they must differ here"
+        );
+
+        // --- Negative half: absent policy revision ---
+        //
+        // Two-sided mutation sensitivity requires that a FK dropped or neutered
+        // entirely is also detected.  A second otherwise-valid deferred
+        // transaction uses a nonexistent policy_revision (999) and must fail
+        // with SQLSTATE 23503 — the narrowed FK
+        // identity_bindings(community_id, policy_revision)
+        //   → identity_enrollment_policies(community_id, policy_revision)
+        // rejects the row.  This FK is not deferred, so it fires at INSERT
+        // time; a `COMMIT` is unnecessary and not reached.  If the FK were
+        // absent the INSERT would succeed and this assertion would catch the
+        // regression.
+        let absent_binding_id = uuid::Uuid::new_v4();
+        let absent_history_id = uuid::Uuid::new_v4();
+        let absent_operation_id = uuid::Uuid::new_v4();
+        let absent_fp = vec![0xC0_u8; 32];
+        let nonexistent_policy_revision: i64 = 999;
+
+        let mut conn2 = pool.acquire().await.expect("acquire second connection");
+
+        sqlx::query("BEGIN")
+            .execute(&mut *conn2)
+            .await
+            .expect("begin absent-policy transaction");
+
+        // History first (receipt_history_cardinality guard fires on receipt
+        // insert and requires the history row to already exist).
+        sqlx::query(
+            "INSERT INTO identity_lifecycle_history \
+             (community_id, history_id, transition_kind, outcome_code, \
+              successor_binding_id, successor_binding_version, \
+              successor_lifecycle_revision, successor_state, \
+              operation_id, request_fingerprint, transition_digest) \
+             VALUES ($1, $2, 1, 1, $3, 2, 1, 1, $4, $5, $6)",
+        )
+        .bind(community_id)
+        .bind(absent_history_id)
+        .bind(absent_binding_id)
+        .bind(absent_operation_id)
+        .bind(&absent_fp)
+        .bind(vec![0xC1_u8; 32])
+        .execute(&mut *conn2)
+        .await
+        .expect("insert absent-policy lifecycle history");
+
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(absent_operation_id)
+        .bind(&absent_fp)
+        .bind(vec![0xC2_u8; 32])
+        .bind(vec![0xC3_u8; 32])
+        .execute(&mut *conn2)
+        .await
+        .expect("insert absent-policy operation receipt");
+
+        // The policy FK is not deferred; it fires at INSERT, not COMMIT.
+        let absent_policy_err = sqlx::query(
+            "INSERT INTO identity_bindings \
+             (community_id, binding_id, issuer, subject, \
+              principal_fingerprint, event_author_pubkey, \
+              binding_state, lifecycle_revision, binding_provenance, \
+              policy_revision, enrollment_evidence_digest, \
+              birth_history_id, creation_operation_id, \
+              creation_request_fingerprint) \
+             VALUES ($1, $2, 'https://issuer.example', 'sub-02', \
+                     $3, $4, 1, 1, 1, $5, $6, $7, $8, $9)",
+        )
+        .bind(community_id)
+        .bind(absent_binding_id)
+        .bind(vec![0xC4_u8; 32]) // principal_fingerprint (unique, different from first binding)
+        .bind(vec![0xC5_u8; 32]) // event_author_pubkey (unique, different from first binding)
+        .bind(nonexistent_policy_revision)
+        .bind(vec![0xC6_u8; 32]) // enrollment_evidence_digest
+        .bind(absent_history_id)
+        .bind(absent_operation_id)
+        .bind(&absent_fp)
+        .execute(&mut *conn2)
+        .await
+        .expect_err("binding with nonexistent policy_revision must be rejected by the FK");
+        assert!(
+            absent_policy_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23503"))
+                .unwrap_or(false),
+            "expected FK violation (23503) for absent policy_revision, got: {absent_policy_err}"
+        );
+
+        sqlx::query("ROLLBACK")
+            .execute(&mut *conn2)
+            .await
+            .expect("rollback absent-policy transaction");
+    }
+
+    /// NIP-FI policy-revision monotonicity: each new policy revision for a
+    /// community must strictly exceed the current maximum revision
+    /// (FI-INV-06 — stable assertion policy). `effective_at` ordering is
+    /// deliberately not enforced — the downstream constructor stamps every
+    /// immediately-effective revision with Unix epoch.
+    ///
+    /// Mutation sensitivity is two-sided:
+    /// - neutering the guard lets a replayed or backfilled revision through
+    ///   (the positive half detects insertion into a guarded table);
+    /// - leaving the guard intact rejects equal/regressive inserts (negative
+    ///   halves detect that each rejection fires).
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn identity_enrollment_policy_revision_is_monotonic() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(41, &pool)
+            .await
+            .expect("apply migrations 1-41");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("policy-mono-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        // First insertion: no prior rows — should always succeed.
+        sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, 1, 1, $2, '2026-01-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(vec![0xA1_u8; 32])
+        .execute(&pool)
+        .await
+        .expect("first policy insertion (revision 1) must succeed");
+
+        // Forward advance: revision 2.
+        sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, 2, 1, $2, '2026-06-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(vec![0xA2_u8; 32])
+        .execute(&pool)
+        .await
+        .expect("forward advance to revision 2 must succeed");
+
+        // Seed a gap: skip from 2 to 100, then advance to 101.
+        sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, 100, 1, $2, '2027-01-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(vec![0xA3_u8; 32])
+        .execute(&pool)
+        .await
+        .expect("jump to revision 100 must succeed");
+
+        sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, 101, 1, $2, '2027-06-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(vec![0xA4_u8; 32])
+        .execute(&pool)
+        .await
+        .expect("advance to revision 101 must succeed");
+
+        // Negative: unused lower revision 99 — not a PK duplicate (never inserted),
+        // but the guard must reject it because 99 < MAX(100, 101). This is the
+        // case a plain PK constraint cannot catch; the named guard must fire.
+        let backfill_err = sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, 99, 1, $2, '2028-01-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(vec![0xA5_u8; 32])
+        .execute(&pool)
+        .await
+        .expect_err("unused lower revision 99 must be rejected by the guard");
+        assert!(
+            backfill_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23514"))
+                .unwrap_or(false),
+            "expected check_violation (23514) from identity_enrollment_policy_revision_monotonic \
+             guard for backfilled revision 99, got: {backfill_err}"
+        );
+
+        // Negative: equal revision (101 <= 101). The PK is (community_id, policy_revision)
+        // so this is a PK duplicate regardless of policy_digest; either 23505 from the PK
+        // or 23514 from the guard fires first. This case is secondary — the load-bearing
+        // proof is the unused-99 case above, which is not a PK duplicate.
+        let replay_err = sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, 101, 2, $2, '2028-01-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(vec![0xA6_u8; 32])
+        .execute(&pool)
+        .await
+        .expect_err("equal revision must be rejected");
+        // PK (23505) or guard (23514) — either proves the insert cannot commit.
+        assert!(
+            replay_err
+                .as_database_error()
+                .map(|e| {
+                    let code = e.code();
+                    let c = code.as_deref().unwrap_or("");
+                    c == "23514" || c == "23505"
+                })
+                .unwrap_or(false),
+            "expected check_violation (23514) or unique_violation (23505) for replayed revision, \
+             got: {replay_err}"
+        );
+
+        // Concurrency regression: prove the advisory lock is load-bearing. The
+        // test uses a controlled two-connection schedule:
+        //
+        //   1. tx1 opens a transaction and inserts revision 102. The BEFORE INSERT
+        //      trigger acquires `pg_advisory_xact_lock(lock_key)` and completes the
+        //      INSERT — tx1 now holds the advisory lock until it commits.
+        //   2. tx2 opens a transaction on a second backend and issues INSERT for
+        //      revision 103. The trigger fires and blocks inside
+        //      `pg_advisory_xact_lock(lock_key)` waiting for tx1 to release.
+        //   3. We observe tx2's backend entering a Lock-wait state via
+        //      pg_stat_activity (wait_event_type='Lock', wait_event='advisory'),
+        //      with a bounded timeout — not a sleep. If the advisory-lock call is
+        //      removed from the guard, the trigger returns immediately; tx2 never
+        //      enters the advisory wait, and the poll times out, failing the test.
+        //      This is the mutation-sensitivity guarantee.
+        //   4. tx1 commits, releasing the advisory lock. tx2 unblocks, its trigger
+        //      reads the fresh MAX=102, and the INSERT succeeds (103 > 102).
+        //   5. tx2 commits. Both revisions 102 and 103 are present.
+        use std::time::Instant;
+
+        // tx1: open a transaction and insert revision 102. The INSERT returns after
+        // the trigger acquires the lock and succeeds; the advisory lock stays held
+        // until the transaction commits.
+        let mut conn1 = pool.acquire().await.expect("acquire conn1");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn1)
+            .await
+            .expect("begin tx1");
+        sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, 102, 1, $2, '2029-01-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(vec![0xB1_u8; 32])
+        .execute(&mut *conn1)
+        .await
+        .expect("tx1 INSERT revision 102 must succeed");
+        // tx1 holds the advisory lock. Do NOT commit yet.
+
+        // tx2: acquire a separate backend, record its PID, then issue the INSERT.
+        // The trigger will block on the advisory lock held by tx1.
+        let pool2 = pool.clone();
+        let pool3 = pool.clone();
+        let (pid_tx, pid_rx) = tokio::sync::oneshot::channel::<i32>();
+        let tx2_task = tokio::spawn(async move {
+            let mut conn2 = pool2.acquire().await.expect("acquire conn2");
+            // Report this backend's PID so the observer can poll pg_stat_activity.
+            let backend_pid: i32 = sqlx::query_scalar("SELECT pg_backend_pid()")
+                .fetch_one(&mut *conn2)
+                .await
+                .expect("get conn2 backend pid");
+            let _ = pid_tx.send(backend_pid);
+            sqlx::query("BEGIN")
+                .execute(&mut *conn2)
+                .await
+                .expect("begin tx2");
+            // This INSERT will block inside the trigger waiting for tx1's advisory lock.
+            let insert_r = sqlx::query(
+                "INSERT INTO identity_enrollment_policies \
+                 (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+                 VALUES ($1, 103, 1, $2, '2029-06-01T00:00:00Z')",
+            )
+            .bind(community_id)
+            .bind(vec![0xB2_u8; 32])
+            .execute(&mut *conn2)
+            .await;
+            let commit_r = sqlx::query("COMMIT").execute(&mut *conn2).await;
+            (insert_r, commit_r)
+        });
+
+        // Receive tx2's backend PID and wait until it enters an advisory-lock wait.
+        // Mutation proof: without pg_advisory_xact_lock in the guard, the trigger
+        // returns immediately; tx2 never parks on an advisory lock; the poll below
+        // times out and panics, making this test deterministically red.
+        let tx2_pid = pid_rx.await.expect("tx2 reports its backend pid");
+        let deadline = Instant::now() + std::time::Duration::from_secs(10);
+        loop {
+            let waiting: bool = sqlx::query_scalar(
+                "SELECT EXISTS (\
+                     SELECT 1 FROM pg_stat_activity \
+                     WHERE pid = $1 \
+                       AND wait_event_type = 'Lock' \
+                       AND wait_event = 'advisory'\
+                 )",
+            )
+            .bind(tx2_pid)
+            .fetch_one(&pool3)
+            .await
+            .expect("poll tx2 advisory-lock wait");
+            if waiting {
+                break;
+            }
+            assert!(
+                Instant::now() < deadline,
+                "tx2 never entered advisory-lock wait — pg_advisory_xact_lock \
+                 must be present in the guard for the lock to serialize writers"
+            );
+            tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+        }
+
+        // tx2 is observably blocked. Commit tx1, releasing the advisory lock.
+        sqlx::query("COMMIT")
+            .execute(&mut *conn1)
+            .await
+            .expect("tx1 COMMIT must succeed");
+
+        // tx2 unblocks: the trigger re-runs its SELECT MAX, sees committed 102,
+        // and INSERT 103 succeeds. Both the INSERT and COMMIT must complete.
+        let (insert2, commit2) = tx2_task.await.expect("tx2 task completed");
+        insert2.expect("tx2 INSERT revision 103 must succeed after tx1 commits");
+        commit2.expect("tx2 COMMIT must succeed");
+
+        // Both revisions 102 and 103 must be present (total: 1, 2, 100, 101, 102, 103).
+        let count: i64 = sqlx::query_scalar(
+            "SELECT count(*) FROM identity_enrollment_policies WHERE community_id = $1",
+        )
+        .bind(community_id)
+        .fetch_one(&pool)
+        .await
+        .expect("count persisted policy revisions");
+        assert_eq!(
+            count, 6,
+            "exactly six revisions must persist after the controlled concurrency sequence"
+        );
+    }
+
+    /// NIP-FI admission-result ↔ kind-11 receipt cardinality: a kind-11
+    /// (protected-mutation) receipt must commit with exactly one admission
+    /// result; an admission result must commit against a kind-11 receipt.
+    ///
+    /// Mutation sensitivity is two-sided:
+    /// - the guard is load-bearing when a kind-11 receipt has no result row
+    ///   (negative A) — without the guard this commits silently;
+    /// - the guard is load-bearing when a result attaches to a non-kind-11
+    ///   receipt (negative B) — without the guard this commits silently.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn authorization_admission_result_requires_kind_11_receipt_bidirectional() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("adm-result-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        // Capacity must exist for authorization_events inserts; admission-result
+        // tests exercise only authorization_operation_receipts and
+        // authorization_admission_results — no authorization_events rows are
+        // needed here, but insert capacity anyway to satisfy any trigger
+        // that reads the policy row defensively.
+        sqlx::query(
+            "INSERT INTO authorization_event_capacity \
+             (community_id, max_events_per_domain, max_bytes_per_domain, max_envelope_bytes) \
+             VALUES ($1, 1000, 16777216, 16384)",
+        )
+        .bind(community_id)
+        .execute(&pool)
+        .await
+        .expect("insert event capacity");
+
+        let mut conn = pool.acquire().await.expect("acquire connection");
+
+        // --- Positive: kind-11 receipt + admission result in one transaction ---
+        let op1 = uuid::Uuid::new_v4();
+        let fp1 = vec![0xB1_u8; 32];
+
+        sqlx::query("BEGIN")
+            .execute(&mut *conn)
+            .await
+            .expect("begin");
+
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 11, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op1)
+        .bind(&fp1)
+        .bind(vec![0xB2_u8; 32])
+        .bind(vec![0xB3_u8; 32])
+        .execute(&mut *conn)
+        .await
+        .expect("insert kind-11 receipt");
+
+        sqlx::query(
+            "INSERT INTO authorization_admission_results \
+             (community_id, operation_id, request_fingerprint, semantic_fingerprint, \
+              object_kind, object_key) \
+             VALUES ($1, $2, $3, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op1)
+        .bind(&fp1)
+        .bind(vec![0xB4_u8; 32]) // semantic_fingerprint
+        .bind(vec![0xB5_u8; 32]) // object_key
+        .execute(&mut *conn)
+        .await
+        .expect("insert admission result");
+
+        sqlx::query("COMMIT")
+            .execute(&mut *conn)
+            .await
+            .expect("kind-11 receipt + result must commit");
+        drop(conn);
+
+        // --- Negative A: kind-11 receipt without result must be rejected ---
+        let op2 = uuid::Uuid::new_v4();
+        let fp2 = vec![0xC1_u8; 32];
+
+        let mut conn_a = pool.acquire().await.expect("acquire connection A");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_a)
+            .await
+            .expect("begin");
+
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 11, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op2)
+        .bind(&fp2)
+        .bind(vec![0xC2_u8; 32])
+        .bind(vec![0xC3_u8; 32])
+        .execute(&mut *conn_a)
+        .await
+        .expect("insert kind-11 receipt for negative A");
+
+        let no_result_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_a)
+            .await
+            .expect_err("kind-11 receipt without result must be rejected at commit");
+        assert!(
+            no_result_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23514"))
+                .unwrap_or(false),
+            "expected check_violation (23514) for kind-11 without result, got: {no_result_err}"
+        );
+        drop(conn_a);
+
+        // --- Negative B: admission result against non-kind-11 receipt ---
+        // Use operation_kind 12 (invalidation) — no admission result should
+        // ever attach to it. The guard fires at COMMIT (deferred trigger).
+        let op3 = uuid::Uuid::new_v4();
+        let fp3 = vec![0xD1_u8; 32];
+
+        let mut conn_b = pool.acquire().await.expect("acquire connection B");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_b)
+            .await
+            .expect("begin");
+
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 12, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op3)
+        .bind(&fp3)
+        .bind(vec![0xD2_u8; 32])
+        .bind(vec![0xD3_u8; 32])
+        .execute(&mut *conn_b)
+        .await
+        .expect("insert kind-12 receipt");
+
+        // The guard is deferred: the INSERT succeeds; the violation surfaces
+        // at COMMIT when the guard checks that the receipt is kind-11.
+        sqlx::query(
+            "INSERT INTO authorization_admission_results \
+             (community_id, operation_id, request_fingerprint, semantic_fingerprint, \
+              object_kind, object_key) \
+             VALUES ($1, $2, $3, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op3)
+        .bind(&fp3)
+        .bind(vec![0xD4_u8; 32])
+        .bind(vec![0xD5_u8; 32])
+        .execute(&mut *conn_b)
+        .await
+        .expect("result insert must pass — deferred guard fires at commit, not here");
+
+        let wrong_kind_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_b)
+            .await
+            .expect_err("result against non-kind-11 receipt must be rejected at commit");
+        assert!(
+            wrong_kind_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23514"))
+                .unwrap_or(false),
+            "expected check_violation (23514) for result against non-kind-11 receipt, got: {wrong_kind_err}"
+        );
+        drop(conn_b);
+
+        // --- Negative C: mismatched request_fingerprint rejected by composite FK ---
+        // The admission result table has an immediate composite FK
+        //   (community_id, operation_id, request_fingerprint)
+        //   REFERENCES authorization_operation_receipts(...)
+        // A result referencing a receipt that exists but with a different
+        // request_fingerprint must be rejected. This exercises the semantic half
+        // of Carl finding 2 — cardinality is handled by the deferred trigger;
+        // coordinate binding is handled by the structural FK.
+        let op4 = uuid::Uuid::new_v4();
+        let fp4_receipt = vec![0xE1_u8; 32]; // fingerprint stored in the receipt
+        let fp4_wrong = vec![0xE2_u8; 32]; // wrong fingerprint used in the result
+
+        let mut conn_c = pool.acquire().await.expect("acquire connection C");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_c)
+            .await
+            .expect("begin");
+
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 11, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op4)
+        .bind(&fp4_receipt)
+        .bind(vec![0xE3_u8; 32])
+        .bind(vec![0xE4_u8; 32])
+        .execute(&mut *conn_c)
+        .await
+        .expect("insert kind-11 receipt for negative C");
+
+        // The admission result FK is immediate (not deferred), so the INSERT
+        // itself rejects a fingerprint with no matching receipt row.
+        let wrong_fp_err = sqlx::query(
+            "INSERT INTO authorization_admission_results \
+             (community_id, operation_id, request_fingerprint, semantic_fingerprint, \
+              object_kind, object_key) \
+             VALUES ($1, $2, $3, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op4)
+        .bind(&fp4_wrong) // wrong fingerprint — no matching receipt row
+        .bind(vec![0xE5_u8; 32])
+        .bind(vec![0xE6_u8; 32])
+        .execute(&mut *conn_c)
+        .await
+        .expect_err("result with mismatched request_fingerprint must be rejected at INSERT");
+        // Immediate composite FK fires as foreign_key_violation (23503).
+        assert!(
+            wrong_fp_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23503"))
+                .unwrap_or(false),
+            "expected foreign_key_violation (23503) for mismatched request_fingerprint, got: {wrong_fp_err}"
+        );
+        sqlx::query("ROLLBACK").execute(&mut *conn_c).await.ok();
+    }
+
+    /// NIP-FI denial-attempt ↔ kind-9 event cardinality: a kind-9
+    /// (pre-authentication denial) audit event must commit with exactly one
+    /// denial attempt; a denial attempt must commit with a matching kind-9
+    /// audit event.
+    ///
+    /// Mutation sensitivity is two-sided:
+    /// - the event-side guard is load-bearing when a kind-9 event has no
+    ///   attempt row (negative A) — without it this commits silently, making
+    ///   replay reconstruction impossible;
+    /// - the attempt-side guard is load-bearing for semantic mismatches (negatives
+    ///   B1–B3) — the old deferred FK only checks event existence/kind and would
+    ///   not catch a correlation, reason_code, or attempt_id mismatch.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn authorization_denial_attempt_requires_kind_9_event_bidirectional() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("denial-attempt-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        // Capacity is required by the authorization_events BEFORE INSERT trigger.
+        sqlx::query(
+            "INSERT INTO authorization_event_capacity \
+             (community_id, max_events_per_domain, max_bytes_per_domain, max_envelope_bytes) \
+             VALUES ($1, 1000, 16777216, 16384)",
+        )
+        .bind(community_id)
+        .execute(&pool)
+        .await
+        .expect("insert event capacity");
+
+        let mut conn = pool.acquire().await.expect("acquire connection");
+
+        // --- Positive: kind-9 event + denial attempt in one transaction ---
+        let op1 = uuid::Uuid::new_v4();
+        let event1 = uuid::Uuid::new_v4();
+        let corr1 = uuid::Uuid::new_v4();
+        let attempt1_id = uuid::Uuid::new_v4();
+
+        sqlx::query("BEGIN")
+            .execute(&mut *conn)
+            .await
+            .expect("begin");
+
+        // Insert denial attempt first (FKs are deferred).
+        sqlx::query(
+            "INSERT INTO authorization_authentication_denial_attempts \
+             (community_id, operation_id, correlation_id, semantic_fingerprint, \
+              denial_reason, expected_revision, action, reason_code, \
+              attempt_id, audit_event_id, audit_event_kind) \
+             VALUES ($1, $2, $3, $4, 1, 1, 1, 2, $5, $6, 9)",
+        )
+        .bind(community_id)
+        .bind(op1)
+        .bind(corr1)
+        .bind(vec![0xE1_u8; 32]) // semantic_fingerprint
+        .bind(attempt1_id)
+        .bind(event1)
+        .execute(&mut *conn)
+        .await
+        .expect("insert denial attempt before event");
+
+        // Insert the kind-9 event (actor_kind 4, no request_fingerprint).
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, operation_id, correlation_id, attempt_id, \
+              semantic_fingerprint, occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 9, 2, 2, 4, $3, $4, $5, \
+                     $6, '2026-01-01T00:00:00Z', $7, $8)",
+        )
+        .bind(community_id)
+        .bind(event1)
+        .bind(op1)
+        .bind(corr1)
+        .bind(attempt1_id)
+        .bind(vec![0xE1_u8; 32]) // semantic_fingerprint matches denial attempt
+        .bind(vec![0xE2_u8; 64]) // canonical_envelope (≤16384 bytes)
+        .bind(vec![0xE3_u8; 32]) // envelope_digest
+        .execute(&mut *conn)
+        .await
+        .expect("insert kind-9 event");
+
+        sqlx::query("COMMIT")
+            .execute(&mut *conn)
+            .await
+            .expect("kind-9 event + denial attempt must commit");
+        drop(conn);
+
+        // --- Negative A: kind-9 event alone must be rejected at commit ---
+        let op2 = uuid::Uuid::new_v4();
+        let event2 = uuid::Uuid::new_v4();
+        let corr2 = uuid::Uuid::new_v4();
+        let attempt2_id = uuid::Uuid::new_v4();
+
+        let mut conn_a = pool.acquire().await.expect("acquire connection A");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_a)
+            .await
+            .expect("begin");
+
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, operation_id, correlation_id, attempt_id, \
+              semantic_fingerprint, occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 9, 2, 1, 4, $3, $4, $5, \
+                     $6, '2026-01-01T00:00:00Z', $7, $8)",
+        )
+        .bind(community_id)
+        .bind(event2)
+        .bind(op2)
+        .bind(corr2)
+        .bind(attempt2_id)
+        .bind(vec![0xF0_u8; 32]) // semantic_fingerprint (non-zero)
+        .bind(vec![0xF1_u8; 64])
+        .bind(vec![0xF2_u8; 32])
+        .execute(&mut *conn_a)
+        .await
+        .expect("insert kind-9 event without attempt");
+
+        let no_attempt_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_a)
+            .await
+            .expect_err("kind-9 event without denial attempt must be rejected at commit");
+        assert!(
+            no_attempt_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23514"))
+                .unwrap_or(false),
+            "expected check_violation (23514) for kind-9 event without attempt, got: {no_attempt_err}"
+        );
+        drop(conn_a);
+
+        // --- Negatives B1-B3: semantic coordinate mismatches, each attributed to
+        // the named guard (23514), not the old deferred FK (23503). Each case
+        // inserts a valid event then a denial attempt that matches everywhere
+        // except one coordinate; the guard must fire for that mismatch.
+
+        // B1: correlation_id mismatch — attempt carries a different correlation
+        // than the event it references.
+        let op_b1 = uuid::Uuid::new_v4();
+        let event_b1 = uuid::Uuid::new_v4();
+        let corr_b1_event = uuid::Uuid::new_v4();
+        let corr_b1_wrong = uuid::Uuid::new_v4(); // different from corr_b1_event
+        let attempt_b1 = uuid::Uuid::new_v4();
+
+        let mut conn_b1 = pool.acquire().await.expect("acquire connection B1");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_b1)
+            .await
+            .expect("begin B1");
+
+        // Insert the event first (deferred FK allows this ordering).
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, operation_id, correlation_id, attempt_id, \
+              semantic_fingerprint, occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 9, 2, 2, 4, $3, $4, $5, \
+                     $6, '2026-01-01T00:00:00Z', $7, $8)",
+        )
+        .bind(community_id)
+        .bind(event_b1)
+        .bind(op_b1)
+        .bind(corr_b1_event)
+        .bind(attempt_b1)
+        .bind(vec![0xB3_u8; 32]) // semantic_fingerprint matches denial attempt
+        .bind(vec![0xB1_u8; 64])
+        .bind(vec![0xB2_u8; 32])
+        .execute(&mut *conn_b1)
+        .await
+        .expect("insert kind-9 event for B1");
+
+        sqlx::query(
+            "INSERT INTO authorization_authentication_denial_attempts \
+             (community_id, operation_id, correlation_id, semantic_fingerprint, \
+              denial_reason, expected_revision, action, reason_code, \
+              attempt_id, audit_event_id, audit_event_kind) \
+             VALUES ($1, $2, $3, $4, 1, 1, 1, 2, $5, $6, 9)",
+        )
+        .bind(community_id)
+        .bind(op_b1)
+        .bind(corr_b1_wrong) // wrong correlation_id
+        .bind(vec![0xB3_u8; 32])
+        .bind(attempt_b1)
+        .bind(event_b1)
+        .execute(&mut *conn_b1)
+        .await
+        .expect("insert denial attempt with wrong correlation_id (guard deferred)");
+
+        let corr_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_b1)
+            .await
+            .expect_err("mismatched correlation_id must be rejected at commit");
+        assert!(
+            corr_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23514"))
+                .unwrap_or(false),
+            "expected check_violation (23514) from authorization_denial_attempt_semantic_binding \
+             for correlation_id mismatch, got: {corr_err}"
+        );
+        drop(conn_b1);
+
+        // B2: reason_code mismatch — attempt carries denial_reason=1 (MissingCredential,
+        // requires reason_code=2 per canonical mapping), but event carries reason_code=1.
+        // The attempt INSERT passes (denial_reason=1↔reason_code=2 is a valid mapping pair),
+        // then the deferred guard fires at commit because event reason_code=1 ≠ attempt
+        // reason_code=2.
+        let op_b2 = uuid::Uuid::new_v4();
+        let event_b2 = uuid::Uuid::new_v4();
+        let corr_b2 = uuid::Uuid::new_v4();
+        let attempt_b2 = uuid::Uuid::new_v4();
+
+        let mut conn_b2 = pool.acquire().await.expect("acquire connection B2");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_b2)
+            .await
+            .expect("begin B2");
+
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, operation_id, correlation_id, attempt_id, \
+              semantic_fingerprint, occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 9, 2, 1, 4, $3, $4, $5, \
+                     $6, '2026-01-01T00:00:00Z', $7, $8)",
+        )
+        .bind(community_id)
+        .bind(event_b2)
+        .bind(op_b2)
+        .bind(corr_b2)
+        .bind(attempt_b2)
+        .bind(vec![0xC3_u8; 32]) // semantic_fingerprint matches denial attempt
+        .bind(vec![0xC1_u8; 64])
+        .bind(vec![0xC2_u8; 32])
+        .execute(&mut *conn_b2)
+        .await
+        .expect("insert kind-9 event for B2 (reason_code=1)");
+
+        sqlx::query(
+            "INSERT INTO authorization_authentication_denial_attempts \
+             (community_id, operation_id, correlation_id, semantic_fingerprint, \
+              denial_reason, expected_revision, action, reason_code, \
+              attempt_id, audit_event_id, audit_event_kind) \
+             VALUES ($1, $2, $3, $4, 1, 1, 1, 2, $5, $6, 9)",
+            // reason_code = 2 but event has reason_code = 1
+        )
+        .bind(community_id)
+        .bind(op_b2)
+        .bind(corr_b2)
+        .bind(vec![0xC3_u8; 32])
+        .bind(attempt_b2)
+        .bind(event_b2)
+        .execute(&mut *conn_b2)
+        .await
+        .expect(
+            "insert denial attempt with wrong reason_code (deferred guard will fire at commit)",
+        );
+
+        let reason_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_b2)
+            .await
+            .expect_err("mismatched reason_code must be rejected at commit");
+        assert!(
+            reason_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23514"))
+                .unwrap_or(false),
+            "expected check_violation (23514) from authorization_denial_attempt_semantic_binding \
+             for reason_code mismatch, got: {reason_err}"
+        );
+        drop(conn_b2);
+
+        // B3: attempt_id mismatch — the denial attempt's attempt_id FK references
+        // a different event (attempt_b3_wrong) than the one being paired (event_b3).
+        // The attempt_id FK on the denial attempt table binds
+        //   (community_id, operation_id, audit_event_kind, attempt_id)
+        //   -> authorization_events(community_id, operation_id, event_kind, attempt_id)
+        // so using a different attempt_id that doesn't exist for this operation
+        // will be caught as a FK violation (23503) at commit.
+        let op_b3 = uuid::Uuid::new_v4();
+        let event_b3 = uuid::Uuid::new_v4();
+        let corr_b3 = uuid::Uuid::new_v4();
+        let attempt_b3_correct = uuid::Uuid::new_v4();
+        let attempt_b3_wrong = uuid::Uuid::new_v4(); // not registered for this operation
+
+        let mut conn_b3 = pool.acquire().await.expect("acquire connection B3");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_b3)
+            .await
+            .expect("begin B3");
+
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, operation_id, correlation_id, attempt_id, \
+              semantic_fingerprint, occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 9, 2, 2, 4, $3, $4, $5, \
+                     $6, '2026-01-01T00:00:00Z', $7, $8)",
+        )
+        .bind(community_id)
+        .bind(event_b3)
+        .bind(op_b3)
+        .bind(corr_b3)
+        .bind(attempt_b3_correct)
+        .bind(vec![0xD3_u8; 32]) // semantic_fingerprint (matches denial attempt)
+        .bind(vec![0xD1_u8; 64])
+        .bind(vec![0xD2_u8; 32])
+        .execute(&mut *conn_b3)
+        .await
+        .expect("insert kind-9 event for B3");
+
+        sqlx::query(
+            "INSERT INTO authorization_authentication_denial_attempts \
+             (community_id, operation_id, correlation_id, semantic_fingerprint, \
+              denial_reason, expected_revision, action, reason_code, \
+              attempt_id, audit_event_id, audit_event_kind) \
+             VALUES ($1, $2, $3, $4, 1, 1, 1, 2, $5, $6, 9)",
+        )
+        .bind(community_id)
+        .bind(op_b3)
+        .bind(corr_b3)
+        .bind(vec![0xD3_u8; 32])
+        .bind(attempt_b3_wrong) // wrong attempt_id — no matching UNIQUE row on events
+        .bind(event_b3)
+        .execute(&mut *conn_b3)
+        .await
+        .expect("insert denial attempt with wrong attempt_id (FK is deferred)");
+
+        let attempt_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_b3)
+            .await
+            .expect_err("mismatched attempt_id must be rejected at commit");
+        // The attempt_id FK is deferred and fires as foreign_key_violation (23503).
+        assert!(
+            attempt_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23503"))
+                .unwrap_or(false),
+            "expected foreign_key_violation (23503) for attempt_id mismatch \
+             (deferred FK on denial attempt), got: {attempt_err}"
+        );
+
+        // B4: denial_reason ↔ reason_code mapping violation — the denial attempt
+        // row carries denial_reason=2 (InvalidCredential) but reason_code=2
+        // (Missing). The canonical mapping requires InvalidCredential(2)↔Invalid(3);
+        // reason_code=2 is only valid for MissingCredential(denial_reason=1).
+        // The immediate CHECK constraint authorization_denial_reason_reason_code_binding
+        // fires at INSERT, not commit. Mutation-sensitive: removing the CHECK lets
+        // this INSERT succeed (the guard does not compare denial_reason; only the
+        // paired event's reason_code is checked at commit).
+        let op_b4 = uuid::Uuid::new_v4();
+        let event_b4 = uuid::Uuid::new_v4();
+        let corr_b4 = uuid::Uuid::new_v4();
+        let attempt_b4 = uuid::Uuid::new_v4();
+
+        let mut conn_b4 = pool.acquire().await.expect("acquire connection B4");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_b4)
+            .await
+            .expect("begin B4");
+
+        // Insert the matching kind-9 event first.
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, operation_id, correlation_id, attempt_id, \
+              semantic_fingerprint, occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 9, 2, 2, 4, $3, $4, $5, \
+                     $6, '2026-01-01T00:00:00Z', $7, $8)",
+        )
+        .bind(community_id)
+        .bind(event_b4)
+        .bind(op_b4)
+        .bind(corr_b4)
+        .bind(attempt_b4)
+        .bind(vec![0xE4_u8; 32]) // semantic_fingerprint
+        .bind(vec![0xE5_u8; 64])
+        .bind(vec![0xE6_u8; 32])
+        .execute(&mut *conn_b4)
+        .await
+        .expect("insert kind-9 event for B4");
+
+        // Insert denial attempt with denial_reason=2 (InvalidCredential) but
+        // reason_code=2 (Missing) — violates the canonical mapping (requires reason_code=3).
+        let denial_reason_err = sqlx::query(
+            "INSERT INTO authorization_authentication_denial_attempts \
+             (community_id, operation_id, correlation_id, semantic_fingerprint, \
+              denial_reason, expected_revision, action, reason_code, \
+              attempt_id, audit_event_id, audit_event_kind) \
+             VALUES ($1, $2, $3, $4, 2, 1, 1, 2, $5, $6, 9)",
+            // denial_reason=2 (InvalidCredential) requires reason_code=3; reason_code=2 is wrong
+        )
+        .bind(community_id)
+        .bind(op_b4)
+        .bind(corr_b4)
+        .bind(vec![0xE4_u8; 32])
+        .bind(attempt_b4)
+        .bind(event_b4)
+        .execute(&mut *conn_b4)
+        .await
+        .expect_err("denial_reason/reason_code mapping violation must be rejected at INSERT");
+
+        assert!(
+            denial_reason_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23514"))
+                .unwrap_or(false),
+            "expected check_violation (23514) from \
+             authorization_denial_reason_reason_code_binding for denial_reason mismatch, \
+             got: {denial_reason_err}"
+        );
+
+        // B5: semantic_fingerprint mismatch — the event carries semantic_fingerprint
+        // 0xB5…B5 while the denial attempt carries 0xB6…B6. correlation_id, reason_code,
+        // and attempt_id all match; only the fingerprint differs. The deferred guard
+        // authorization_denial_attempt_guard_v1 fires at COMMIT on the denial-attempt
+        // side, compares found_semantic_fingerprint (from the event) with
+        // NEW.semantic_fingerprint (from the attempt), and raises 23514 with named
+        // constraint authorization_denial_attempt_semantic_binding.
+        // Mutation-sensitive: removing the semantic_fingerprint comparison block from
+        // the guard function lets this transaction commit.
+        let op_b5 = uuid::Uuid::new_v4();
+        let event_b5 = uuid::Uuid::new_v4();
+        let corr_b5 = uuid::Uuid::new_v4();
+        let attempt_b5 = uuid::Uuid::new_v4();
+        let fp_event_b5 = vec![0xB5_u8; 32]; // event semantic_fingerprint
+        let fp_attempt_b5 = vec![0xB6_u8; 32]; // mismatched attempt semantic_fingerprint
+
+        let mut conn_b5 = pool.acquire().await.expect("acquire connection B5");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_b5)
+            .await
+            .expect("begin B5");
+
+        // Insert the kind-9 event with fingerprint 0xB5…B5.
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, operation_id, correlation_id, attempt_id, \
+              semantic_fingerprint, occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 9, 2, 2, 4, $3, $4, $5, \
+                     $6, '2026-01-01T00:00:00Z', $7, $8)",
+        )
+        .bind(community_id)
+        .bind(event_b5)
+        .bind(op_b5)
+        .bind(corr_b5)
+        .bind(attempt_b5)
+        .bind(fp_event_b5)
+        .bind(vec![0xB7_u8; 64]) // canonical_envelope
+        .bind(vec![0xB8_u8; 32]) // envelope_digest
+        .execute(&mut *conn_b5)
+        .await
+        .expect("insert kind-9 event for B5");
+
+        // Insert denial attempt with the WRONG semantic_fingerprint (0xB6…B6).
+        // correlation_id, reason_code=2, denial_reason=1 (MissingCredential↔Missing),
+        // and attempt_id all match the event — only semantic_fingerprint differs.
+        sqlx::query(
+            "INSERT INTO authorization_authentication_denial_attempts \
+             (community_id, operation_id, correlation_id, semantic_fingerprint, \
+              denial_reason, expected_revision, action, reason_code, \
+              attempt_id, audit_event_id, audit_event_kind) \
+             VALUES ($1, $2, $3, $4, 1, 1, 1, 2, $5, $6, 9)",
+        )
+        .bind(community_id)
+        .bind(op_b5)
+        .bind(corr_b5)
+        .bind(fp_attempt_b5) // 0xB6…B6 ≠ event's 0xB5…B5
+        .bind(attempt_b5)
+        .bind(event_b5)
+        .execute(&mut *conn_b5)
+        .await
+        .expect(
+            "insert denial attempt with mismatched fingerprint (deferred guard fires at commit)",
+        );
+
+        let fp_mismatch_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_b5)
+            .await
+            .expect_err("commit with mismatched semantic_fingerprint must be rejected");
+
+        assert!(
+            fp_mismatch_err
+                .as_database_error()
+                .map(|e| e.code().as_deref() == Some("23514"))
+                .unwrap_or(false),
+            "expected check_violation (23514) from \
+             authorization_denial_attempt_semantic_binding for semantic_fingerprint mismatch, \
+             got: {fp_mismatch_err}"
+        );
+    }
+
+    /// NIP-FI authenticated kind-9 OperatorDenied denial: an authenticated
+    /// kind-9 event (actor_kind 1–3, non-null request_fingerprint) must commit
+    /// without an authorization_authentication_denial_attempts row and must
+    /// reject any attempt to attach one.
+    ///
+    /// Mutation sensitivity:
+    /// - Removing the `actor_kind <> 4` guard from the event-side trigger makes
+    ///   positive A red: the COMMIT fails because the guard now requires a
+    ///   denial-attempt row for the authenticated event and none is present.
+    /// - Removing the `actor_kind <> 4` shape guard from the attempt-side
+    ///   trigger makes negative B red: the COMMIT is rejected by the pre-existing
+    ///   `authorization_denial_attempt_semantic_binding` guard instead (non-null
+    ///   attempt `semantic_fingerprint` vs. null on the authenticated event), so
+    ///   `assert_eq!` on the constraint name fails. The exact constraint name
+    ///   assertion is therefore the load-bearing proof that the new shape guard —
+    ///   not the pre-existing semantic-binding check — is what fires.
+    ///
+    /// The unresolved pre-auth positive path (actor_kind 4) is exercised in
+    /// `authorization_denial_attempt_requires_kind_9_event_bidirectional` and
+    /// is unchanged by this fix.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn authenticated_kind_9_denial_commits_without_denial_attempt() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("auth-denial-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        sqlx::query(
+            "INSERT INTO authorization_event_capacity \
+             (community_id, max_events_per_domain, max_bytes_per_domain, max_envelope_bytes) \
+             VALUES ($1, 1000, 16777216, 16384)",
+        )
+        .bind(community_id)
+        .execute(&pool)
+        .await
+        .expect("insert event capacity");
+
+        // Seed an operation receipt for the authenticated denial. Use
+        // operation_kind = 12 (invalidation) with outcome_code = 2 (denied):
+        // this satisfies the receipt CHECK constraints without triggering the
+        // lifecycle history guard (expected_count = 0 for non-lifecycle kinds)
+        // and without requiring a lifecycle event (expected_event_kind = NULL).
+        // The authorization_events FK on (community_id, operation_id,
+        // request_fingerprint) requires a receipt row.
+        let op_auth = uuid::Uuid::new_v4();
+        let fp_auth = vec![0xA1_u8; 32];
+
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 12, $4, 2, $5)",
+            // operation_kind 12 (invalidation), outcome_code 2 (denied)
+        )
+        .bind(community_id)
+        .bind(op_auth)
+        .bind(&fp_auth)
+        .bind(vec![0xA2_u8; 32]) // actor_fingerprint
+        .bind(vec![0xA3_u8; 32]) // result_digest
+        .execute(&pool)
+        .await
+        .expect("seed authenticated denial receipt");
+
+        let event_auth = uuid::Uuid::new_v4();
+        let corr_auth = uuid::Uuid::new_v4();
+        let attempt_auth = uuid::Uuid::new_v4();
+
+        // --- Positive A: authenticated kind-9 denial (actor_kind = 1) commits
+        // without any denial-attempt row. The semantic_fingerprint must be NULL
+        // per the corrected shape CHECK. The deferred cardinality guard must
+        // skip this event because actor_kind ≠ 4.
+        let mut conn = pool.acquire().await.expect("acquire connection");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn)
+            .await
+            .expect("begin");
+
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, actor_fingerprint, operation_id, request_fingerprint, \
+              correlation_id, attempt_id, semantic_fingerprint, \
+              occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 9, 2, 4, 1, $3, $4, $5, $6, $7, NULL, \
+                     '2026-01-01T00:00:00Z', $8, $9)",
+        )
+        .bind(community_id)
+        .bind(event_auth)
+        .bind(vec![0xA4_u8; 32]) // actor_fingerprint (required for actor_kind 1)
+        .bind(op_auth)
+        .bind(&fp_auth) // non-null request_fingerprint (authenticated shape)
+        .bind(corr_auth)
+        .bind(attempt_auth)
+        // semantic_fingerprint = NULL: authenticated kind-9 must not carry one
+        .bind(vec![0xA5_u8; 64]) // canonical_envelope
+        .bind(vec![0xA6_u8; 32]) // envelope_digest
+        .execute(&mut *conn)
+        .await
+        .expect("insert authenticated kind-9 event");
+
+        sqlx::query("COMMIT").execute(&mut *conn).await.expect(
+            "authenticated kind-9 denial must commit without a denial-attempt row \
+                 — the event-side cardinality guard must skip actor_kind 1",
+        );
+        drop(conn);
+
+        // Confirm no denial attempt was needed: the table must have zero rows
+        // for this event.
+        let attempt_count: i64 = sqlx::query_scalar(
+            "SELECT count(*) FROM authorization_authentication_denial_attempts \
+             WHERE community_id = $1 AND audit_event_id = $2",
+        )
+        .bind(community_id)
+        .bind(event_auth)
+        .fetch_one(&pool)
+        .await
+        .expect("count denial attempts for authenticated event");
+        assert_eq!(
+            attempt_count, 0,
+            "no denial-attempt row should exist for an authenticated kind-9 event"
+        );
+
+        // --- Negative B: a denial attempt cannot bind to the authenticated kind-9
+        // event. The attempt-side shape guard must reject this at commit because
+        // the referenced event has actor_kind = 1 (not 4). The rejection must
+        // name the exact shape constraint (authorization_denial_attempt_event_kind)
+        // rather than merely returning 23514, proving the new actor/request-fingerprint
+        // guard fires — not the pre-existing semantic_fingerprint equality check
+        // (which would fire as authorization_denial_attempt_semantic_binding if
+        // the shape guard were absent, because the attempt carries a non-null
+        // semantic_fingerprint while the authenticated event has null).
+        //
+        // Reuse attempt_auth from the committed event so the deferred attempt_id
+        // FK resolves (wrong attempt_id would activate that FK first and make the
+        // negative non-isolated to the new guard).
+        let mut conn_b = pool.acquire().await.expect("acquire connection B");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_b)
+            .await
+            .expect("begin B");
+
+        // Insert the denial attempt referencing the authenticated event.
+        // The attempt table FKs are deferred, so this INSERT succeeds;
+        // the shape guard fires at COMMIT.
+        sqlx::query(
+            "INSERT INTO authorization_authentication_denial_attempts \
+             (community_id, operation_id, correlation_id, semantic_fingerprint, \
+              denial_reason, expected_revision, action, reason_code, \
+              attempt_id, audit_event_id, audit_event_kind) \
+             VALUES ($1, $2, $3, $4, 1, 1, 1, 2, $5, $6, 9)",
+        )
+        .bind(community_id)
+        .bind(op_auth)
+        .bind(corr_auth)
+        .bind(vec![0xA7_u8; 32]) // semantic_fingerprint on the attempt (non-null)
+        .bind(attempt_auth) // reuse the event's attempt_id — FK isolation
+        .bind(event_auth) // references the authenticated event (actor_kind = 1)
+        .execute(&mut *conn_b)
+        .await
+        .expect("attempt INSERT must pass — shape guard is deferred");
+
+        let cross_shape_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_b)
+            .await
+            .expect_err(
+                "denial attempt binding to authenticated kind-9 event must be rejected at commit",
+            );
+        // The exact constraint name must be authorization_denial_attempt_event_kind —
+        // the new actor/request_fingerprint shape guard. If the shape guard were
+        // removed, the pre-existing semantic_fingerprint equality check would fire
+        // instead, named authorization_denial_attempt_semantic_binding. Requiring
+        // the exact name makes the mutation reliably red.
+        assert_eq!(
+            cross_shape_err
+                .as_database_error()
+                .and_then(|e| e.constraint()),
+            Some("authorization_denial_attempt_event_kind"),
+            "rejection must be attributed to authorization_denial_attempt_event_kind \
+             shape guard (not an incidental FK or semantic-binding check), \
+             got: {cross_shape_err}"
+        );
+    }
+
+    /// NIP-FI denied lifecycle receipt: a denied core lifecycle receipt
+    /// (outcome_code = 2) must commit without a paired audit event. Requiring
+    /// one would falsely record that the lifecycle transition occurred.
+    ///
+    /// The denied branch forbids any event from the complete core
+    /// success-transition class (kinds 1, 2, 3, 6). This test uses the mapped
+    /// kind (kind 1 for enroll). Cross-kind rejection — a wrong success-transition
+    /// kind on a denied receipt — is exercised by
+    /// `denied_lifecycle_receipt_wrong_kind_receipt_side` (receipt-side trigger)
+    /// and `denied_lifecycle_receipt_wrong_kind_event_side` (event-side trigger).
+    ///
+    /// Mutation sensitivity:
+    /// - Removing the `outcome_code IN (1, 3)` branch entirely (or replacing it with a
+    ///   blanket early-return) makes the positive case red — the denied enroll receipt
+    ///   cannot commit alone because the guard then demands a paired enroll audit event
+    ///   (expected_event_kind = 1) that is absent.
+    /// - Removing the `ELSIF outcome_code = 2` zero-event branch makes the
+    ///   receipt-then-event negative below green (COMMIT succeeds when it must not),
+    ///   failing `expect_err`. The event-side isolation in
+    ///   `denied_lifecycle_receipt_event_side_trigger_isolated` independently confirms
+    ///   the same branch using only the `authorization_event_receipt_cardinality`
+    ///   trigger direction.
+    /// Applied/no-op lifecycle cardinality is exercised by
+    /// `applied_lifecycle_receipt_requires_exactly_one_event`.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn denied_lifecycle_receipt_commits_without_audit_event() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!(
+                "denied-lifecycle-{}.example",
+                community_id.simple()
+            ))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        // Denied enroll receipt (operation_kind = 1, outcome_code = 2) must commit
+        // without any paired authorization_events row. The guard must skip it
+        // because outcome_code = 2 is not in (1, 3).
+        //
+        // The receipt history guard (migration 0041) uses `outcome_code IN (1, 3)`
+        // for lifecycle receipts, so a denied enroll receipt (outcome_code = 2)
+        // expects zero lifecycle history rows — no history setup is needed.
+        let op_denied = uuid::Uuid::new_v4();
+        let fp_denied = vec![0xB1_u8; 32];
+
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 2, $5)",
+            // operation_kind 1 (enroll), outcome_code 2 (denied)
+        )
+        .bind(community_id)
+        .bind(op_denied)
+        .bind(&fp_denied)
+        .bind(vec![0xB2_u8; 32])
+        .bind(vec![0xB3_u8; 32])
+        .execute(&pool)
+        .await
+        .expect("denied enroll receipt must commit without a paired audit event");
+
+        // No audit event for this operation; confirm the table is empty for it.
+        let event_count: i64 = sqlx::query_scalar(
+            "SELECT count(*) FROM authorization_events \
+             WHERE community_id = $1 AND operation_id = $2",
+        )
+        .bind(community_id)
+        .bind(op_denied)
+        .fetch_one(&pool)
+        .await
+        .expect("count events for denied receipt");
+        assert_eq!(
+            event_count, 0,
+            "no audit event should be required or present for a denied lifecycle receipt"
+        );
+
+        // --- Negative: denied enroll receipt paired with its mapped success-
+        // transition event (event_kind = 1, enrolled) must be rejected at COMMIT.
+        // The receipt-side deferred trigger fires here (receipt was inserted in
+        // this same transaction). The event-side trigger direction is isolated in
+        // `denied_lifecycle_receipt_event_side_trigger_isolated`.
+        //
+        // Seed event capacity; the authorization_events BEFORE INSERT trigger
+        // requires a capacity row. No lifecycle history is needed: denied receipts
+        // (outcome_code = 2) expect zero history rows per the history guard.
+        sqlx::query(
+            "INSERT INTO authorization_event_capacity \
+             (community_id, max_events_per_domain, max_bytes_per_domain, max_envelope_bytes) \
+             VALUES ($1, 1000, 16777216, 16384)",
+        )
+        .bind(community_id)
+        .execute(&pool)
+        .await
+        .expect("insert event capacity");
+
+        let op_neg = uuid::Uuid::new_v4();
+        let fp_neg = vec![0xD1_u8; 32];
+        let event_neg = uuid::Uuid::new_v4();
+        let corr_neg = uuid::Uuid::new_v4();
+        let attempt_neg = uuid::Uuid::new_v4();
+
+        let mut conn_neg = pool.acquire().await.expect("acquire connection neg");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_neg)
+            .await
+            .expect("begin neg");
+
+        // Denied enroll receipt — no history row needed (outcome_code = 2).
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 2, $5)",
+        )
+        .bind(community_id)
+        .bind(op_neg)
+        .bind(&fp_neg)
+        .bind(vec![0xD2_u8; 32])
+        .bind(vec![0xD3_u8; 32])
+        .execute(&mut *conn_neg)
+        .await
+        .expect("insert denied receipt — event guard is deferred");
+
+        // Insert the mapped success-transition event (event_kind = 1, enrolled).
+        // actor_kind = 1 requires a non-null actor_fingerprint and a matching
+        // receipt FK (satisfied by the denied receipt above, which shares the
+        // same (community_id, operation_id, request_fingerprint)).
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, actor_fingerprint, operation_id, request_fingerprint, \
+              correlation_id, attempt_id, semantic_fingerprint, \
+              occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 1, 1, 4, 1, $3, $4, $5, $6, $7, NULL, \
+                     '2026-01-01T00:00:00Z', $8, $9)",
+            // event_kind 1 (enrolled) — the mapped success transition for enroll
+        )
+        .bind(community_id)
+        .bind(event_neg)
+        .bind(vec![0xD4_u8; 32]) // actor_fingerprint
+        .bind(op_neg)
+        .bind(&fp_neg)
+        .bind(corr_neg)
+        .bind(attempt_neg)
+        .bind(vec![0xD5_u8; 64]) // canonical_envelope
+        .bind(vec![0xD6_u8; 32]) // envelope_digest
+        .execute(&mut *conn_neg)
+        .await
+        .expect("event INSERT must pass — deferred guard fires at COMMIT");
+
+        let contradiction_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_neg)
+            .await
+            .expect_err(
+                "denied receipt + mapped success event must be rejected at COMMIT \
+                 — contradictory durable facts must not be permitted",
+            );
+        assert_eq!(
+            contradiction_err
+                .as_database_error()
+                .and_then(|e| e.constraint()),
+            Some("authorization_denied_lifecycle_receipt_no_success_event"),
+            "expected authorization_denied_lifecycle_receipt_no_success_event constraint \
+             rejection for denied receipt + success event, got: {contradiction_err}"
+        );
+    }
+
+    /// NIP-FI event-side trigger isolation: when a denied enroll receipt is already
+    /// committed (auto-commit via pool), a new independent transaction that inserts
+    /// only the mapped success-transition event must be rejected at COMMIT by
+    /// `authorization_event_receipt_cardinality` (the event-side deferred trigger).
+    ///
+    /// This isolates the `authorization_event_receipt_cardinality` trigger path.
+    /// In `denied_lifecycle_receipt_commits_without_audit_event`'s receipt-then-event
+    /// negative, the receipt-side trigger (`authorization_operation_receipt_event_cardinality`)
+    /// also fires. Here the committed receipt produces no deferred trigger, so rejection
+    /// can only come from the event-side trigger. Uses the mapped kind (kind 1 for
+    /// enroll). Wrong-kind event-side isolation is in
+    /// `denied_lifecycle_receipt_wrong_kind_event_side`.
+    ///
+    /// Mutation sensitivity: disabling the
+    /// `authorization_event_receipt_cardinality` trigger (DROP or ALTER TABLE
+    /// DISABLE TRIGGER) makes this negative green — the COMMIT succeeds when it
+    /// must not, so `expect_err` panics.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn denied_lifecycle_receipt_event_side_trigger_isolated() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("evt-side-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        // Seed event capacity before any event insert.
+        sqlx::query(
+            "INSERT INTO authorization_event_capacity \
+             (community_id, max_events_per_domain, max_bytes_per_domain, max_envelope_bytes) \
+             VALUES ($1, 1000, 16777216, 16384)",
+        )
+        .bind(community_id)
+        .execute(&pool)
+        .await
+        .expect("insert event capacity");
+
+        // Commit a denied enroll receipt in auto-commit mode (no explicit BEGIN).
+        // This receipt produces no deferred trigger — the receipt-side deferred
+        // trigger only fires within the transaction that inserts the receipt row.
+        let op_id = uuid::Uuid::new_v4();
+        let fp = vec![0xE1_u8; 32];
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 2, $5)",
+        )
+        .bind(community_id)
+        .bind(op_id)
+        .bind(&fp)
+        .bind(vec![0xE2_u8; 32])
+        .bind(vec![0xE3_u8; 32])
+        .execute(&pool)
+        .await
+        .expect("denied receipt must commit alone in auto-commit mode");
+
+        // Now open a NEW transaction and insert only the mapped success-transition
+        // event (event_kind = 1, enrolled). The receipt is already committed and
+        // its deferred trigger is no longer active. Rejection at COMMIT must come
+        // from authorization_event_receipt_cardinality (the event-side trigger).
+        let event_id = uuid::Uuid::new_v4();
+        let corr_id = uuid::Uuid::new_v4();
+        let attempt_id = uuid::Uuid::new_v4();
+
+        let mut conn = pool
+            .acquire()
+            .await
+            .expect("acquire connection for event-side test");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn)
+            .await
+            .expect("begin event-side transaction");
+
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, actor_fingerprint, operation_id, request_fingerprint, \
+              correlation_id, attempt_id, semantic_fingerprint, \
+              occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 1, 1, 4, 1, $3, $4, $5, $6, $7, NULL, \
+                     '2026-01-01T00:00:00Z', $8, $9)",
+        )
+        .bind(community_id)
+        .bind(event_id)
+        .bind(vec![0xE4_u8; 32]) // actor_fingerprint
+        .bind(op_id)
+        .bind(&fp)
+        .bind(corr_id)
+        .bind(attempt_id)
+        .bind(vec![0xE5_u8; 64]) // canonical_envelope
+        .bind(vec![0xE6_u8; 32]) // envelope_digest
+        .execute(&mut *conn)
+        .await
+        .expect("event INSERT must pass — event-side deferred guard fires at COMMIT");
+
+        let event_side_err = sqlx::query("COMMIT").execute(&mut *conn).await.expect_err(
+            "mapping a success-transition event to a committed denied receipt \
+                 must be rejected at COMMIT by the event-side trigger",
+        );
+        assert_eq!(
+            event_side_err
+                .as_database_error()
+                .and_then(|e| e.constraint()),
+            Some("authorization_denied_lifecycle_receipt_no_success_event"),
+            "event-side trigger must reject with authorization_denied_lifecycle_receipt_no_success_event, \
+             got: {event_side_err}"
+        );
+    }
+
+    /// NIP-FI applied lifecycle receipt: an applied core lifecycle enroll receipt
+    /// (outcome_code = 1) requires exactly one mapped success-transition event
+    /// (event_kind = 1, enrolled). This exercises the `outcome_code IN (1, 3)`
+    /// branch of `authorization_operation_receipt_event_guard_v1` at migration 42.
+    ///
+    /// Mutation sensitivity:
+    /// - Removing/bypassing the applied/no-op branch (replacing it with a blanket
+    ///   RETURN NULL) makes the positive transaction commit without an event, leaving
+    ///   the contract silently unenforced. The negative below requires the cardinality
+    ///   constraint to fire when the event is absent.
+    /// - Removing the negative assertion: the absent-event case would commit when it
+    ///   must not.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn applied_lifecycle_receipt_requires_exactly_one_event() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!(
+                "applied-lifecycle-{}.example",
+                community_id.simple()
+            ))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        // Enrollment policy (TOFU, mode 3).
+        let policy_revision: i64 = 1;
+        sqlx::query(
+            "INSERT INTO identity_enrollment_policies \
+             (community_id, policy_revision, enrollment_mode, policy_digest, effective_at) \
+             VALUES ($1, $2, 3, $3, '2026-01-01T00:00:00Z')",
+        )
+        .bind(community_id)
+        .bind(policy_revision)
+        .bind(vec![0xF0_u8; 32])
+        .execute(&pool)
+        .await
+        .expect("insert enrollment policy");
+
+        // Event capacity — required by authorization_event_capacity_before_insert_v1.
+        sqlx::query(
+            "INSERT INTO authorization_event_capacity \
+             (community_id, max_events_per_domain, max_bytes_per_domain, max_envelope_bytes) \
+             VALUES ($1, 1000, 16777216, 16384)",
+        )
+        .bind(community_id)
+        .execute(&pool)
+        .await
+        .expect("insert event capacity");
+
+        // --- Positive: applied enroll commits with exactly one mapped event ---
+        //
+        // All cross-table FKs between identity_lifecycle_history, identity_bindings,
+        // authorization_operation_receipts, and authorization_events are
+        // DEFERRABLE INITIALLY DEFERRED — insert order within the transaction is
+        // flexible, but a pinned connection is required for BEGIN/COMMIT to share
+        // the same session. The receipt_history_cardinality trigger (migration 0041)
+        // fires at COMMIT and requires exactly one history row for applied enroll.
+        let op_id = uuid::Uuid::new_v4();
+        let binding_id = uuid::Uuid::new_v4();
+        let history_id = uuid::Uuid::new_v4();
+        let fp = vec![0xF1_u8; 32];
+        let event_id = uuid::Uuid::new_v4();
+        let corr_id = uuid::Uuid::new_v4();
+        let attempt_id = uuid::Uuid::new_v4();
+
+        let mut conn = pool
+            .acquire()
+            .await
+            .expect("acquire connection for positive case");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn)
+            .await
+            .expect("begin positive transaction");
+
+        // History first: the receipt_history_cardinality AFTER INSERT trigger
+        // on authorization_operation_receipts is DEFERRED and checks at COMMIT
+        // time, but inserting history before receipt is idiomatic.
+        // successor_binding_version = 1 because binding_version is an identity
+        // sequence starting at 1 per community; this is the first binding.
+        sqlx::query(
+            "INSERT INTO identity_lifecycle_history \
+             (community_id, history_id, transition_kind, outcome_code, \
+              successor_binding_id, successor_binding_version, \
+              successor_lifecycle_revision, successor_state, \
+              operation_id, request_fingerprint, transition_digest) \
+             VALUES ($1, $2, 1, 1, $3, 1, 1, 1, $4, $5, $6)",
+        )
+        .bind(community_id)
+        .bind(history_id)
+        .bind(binding_id)
+        .bind(op_id)
+        .bind(&fp)
+        .bind(vec![0xF2_u8; 32])
+        .execute(&mut *conn)
+        .await
+        .expect("insert lifecycle history");
+
+        // Applied enroll receipt (operation_kind = 1, outcome_code = 1).
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op_id)
+        .bind(&fp)
+        .bind(vec![0xF3_u8; 32])
+        .bind(vec![0xF4_u8; 32])
+        .execute(&mut *conn)
+        .await
+        .expect("insert applied enroll receipt");
+
+        // Binding — birth_history_id FK is deferred; binding_version is generated.
+        sqlx::query(
+            "INSERT INTO identity_bindings \
+             (community_id, binding_id, issuer, subject, \
+              principal_fingerprint, event_author_pubkey, \
+              binding_state, lifecycle_revision, binding_provenance, \
+              policy_revision, enrollment_evidence_digest, \
+              birth_history_id, creation_operation_id, \
+              creation_request_fingerprint) \
+             VALUES ($1, $2, 'https://issuer.example', 'sub-applied', \
+                     $3, $4, 1, 1, 1, $5, $6, $7, $8, $9)",
+        )
+        .bind(community_id)
+        .bind(binding_id)
+        .bind(vec![0xF5_u8; 32]) // principal_fingerprint
+        .bind(vec![0xF6_u8; 32]) // event_author_pubkey
+        .bind(policy_revision)
+        .bind(vec![0xF7_u8; 32]) // enrollment_evidence_digest
+        .bind(history_id)
+        .bind(op_id)
+        .bind(&fp)
+        .execute(&mut *conn)
+        .await
+        .expect("insert identity binding");
+
+        // Mapped success-transition event (event_kind = 1, enrolled).
+        // actor_kind = 1 requires non-null actor_fingerprint and matching receipt FK.
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, actor_fingerprint, operation_id, request_fingerprint, \
+              correlation_id, attempt_id, semantic_fingerprint, \
+              occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 1, 1, 4, 1, $3, $4, $5, $6, $7, NULL, \
+                     '2026-01-01T00:00:00Z', $8, $9)",
+        )
+        .bind(community_id)
+        .bind(event_id)
+        .bind(vec![0xF8_u8; 32]) // actor_fingerprint
+        .bind(op_id)
+        .bind(&fp)
+        .bind(corr_id)
+        .bind(attempt_id)
+        .bind(vec![0xF9_u8; 64]) // canonical_envelope
+        .bind(vec![0xFA_u8; 32]) // envelope_digest
+        .execute(&mut *conn)
+        .await
+        .expect("insert mapped success-transition event");
+
+        sqlx::query("COMMIT").execute(&mut *conn).await.expect(
+            "applied enroll receipt + exactly one mapped event must commit — \
+                 authorization_operation_receipt_event_guard_v1 applied/no-op branch",
+        );
+
+        // Confirm exactly one event committed for this operation.
+        let event_count: i64 = sqlx::query_scalar(
+            "SELECT count(*) FROM authorization_events \
+             WHERE community_id = $1 AND operation_id = $2",
+        )
+        .bind(community_id)
+        .bind(op_id)
+        .fetch_one(&pool)
+        .await
+        .expect("count events for applied receipt");
+        assert_eq!(
+            event_count, 1,
+            "exactly one audit event must be present for an applied enroll receipt"
+        );
+
+        // --- Negative: applied enroll receipt without a mapped event must reject ---
+        //
+        // A second applied enroll transaction that commits receipt + history + binding
+        // but no event must be rejected with authorization_operation_receipt_event_cardinality.
+        let op_neg = uuid::Uuid::new_v4();
+        let binding_neg = uuid::Uuid::new_v4();
+        let history_neg = uuid::Uuid::new_v4();
+        let fp_neg = vec![0xFB_u8; 32];
+
+        let mut conn_neg = pool
+            .acquire()
+            .await
+            .expect("acquire connection for negative case");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn_neg)
+            .await
+            .expect("begin negative transaction");
+
+        sqlx::query(
+            "INSERT INTO identity_lifecycle_history \
+             (community_id, history_id, transition_kind, outcome_code, \
+              successor_binding_id, successor_binding_version, \
+              successor_lifecycle_revision, successor_state, \
+              operation_id, request_fingerprint, transition_digest) \
+             VALUES ($1, $2, 1, 1, $3, 2, 1, 1, $4, $5, $6)",
+            // successor_binding_version = 2: second binding in this community
+        )
+        .bind(community_id)
+        .bind(history_neg)
+        .bind(binding_neg)
+        .bind(op_neg)
+        .bind(&fp_neg)
+        .bind(vec![0xFC_u8; 32])
+        .execute(&mut *conn_neg)
+        .await
+        .expect("insert negative lifecycle history");
+
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 1, $5)",
+        )
+        .bind(community_id)
+        .bind(op_neg)
+        .bind(&fp_neg)
+        .bind(vec![0xFD_u8; 32])
+        .bind(vec![0xFE_u8; 32])
+        .execute(&mut *conn_neg)
+        .await
+        .expect("insert negative applied receipt");
+
+        sqlx::query(
+            "INSERT INTO identity_bindings \
+             (community_id, binding_id, issuer, subject, \
+              principal_fingerprint, event_author_pubkey, \
+              binding_state, lifecycle_revision, binding_provenance, \
+              policy_revision, enrollment_evidence_digest, \
+              birth_history_id, creation_operation_id, \
+              creation_request_fingerprint) \
+             VALUES ($1, $2, 'https://issuer.example', 'sub-applied-neg', \
+                     $3, $4, 1, 1, 1, $5, $6, $7, $8, $9)",
+        )
+        .bind(community_id)
+        .bind(binding_neg)
+        .bind(vec![0xE7_u8; 32]) // principal_fingerprint (distinct from positive)
+        .bind(vec![0xE8_u8; 32]) // event_author_pubkey (distinct from positive)
+        .bind(policy_revision)
+        .bind(vec![0xE9_u8; 32])
+        .bind(history_neg)
+        .bind(op_neg)
+        .bind(&fp_neg)
+        .execute(&mut *conn_neg)
+        .await
+        .expect("insert negative binding — no event inserted");
+
+        // Commit without the mapped event — guard must reject.
+        let absent_event_err = sqlx::query("COMMIT")
+            .execute(&mut *conn_neg)
+            .await
+            .expect_err(
+                "applied enroll receipt without a mapped success-transition event \
+                 must be rejected at COMMIT",
+            );
+        assert_eq!(
+            absent_event_err
+                .as_database_error()
+                .and_then(|e| e.constraint()),
+            Some("authorization_operation_receipt_event_cardinality"),
+            "expected authorization_operation_receipt_event_cardinality rejection \
+             for applied receipt without event, got: {absent_event_err}"
+        );
+    }
+
+    /// NIP-FI cross-kind denied lifecycle: a wrong success-transition kind paired
+    /// with a denied lifecycle receipt must be rejected through the receipt-side
+    /// deferred trigger. Uses a denied enroll receipt (operation_kind = 1, mapped
+    /// kind = 1) with a kind-6 (retired) event — a different success-transition
+    /// kind that is equally forbidden by the class-based guard (kinds 1, 2, 3, 6).
+    ///
+    /// Both the receipt and the wrong-kind event are inserted in the same
+    /// transaction, so the receipt-side deferred trigger
+    /// (`authorization_operation_receipt_event_cardinality`) fires at COMMIT.
+    ///
+    /// Mutation sensitivity: narrowing the denied filter back to
+    /// `event_kind = expected_event_kind` (the mapped kind, 1) removes kind 6
+    /// from the forbidden set, causing this negative to turn green — COMMIT
+    /// succeeds when it must not, failing `expect_err`.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn denied_lifecycle_receipt_wrong_kind_receipt_side() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("wrong-kind-rcpt-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        sqlx::query(
+            "INSERT INTO authorization_event_capacity \
+             (community_id, max_events_per_domain, max_bytes_per_domain, max_envelope_bytes) \
+             VALUES ($1, 1000, 16777216, 16384)",
+        )
+        .bind(community_id)
+        .execute(&pool)
+        .await
+        .expect("insert event capacity");
+
+        let op_id = uuid::Uuid::new_v4();
+        let fp = vec![0xA0_u8; 32];
+        let event_id = uuid::Uuid::new_v4();
+        let corr_id = uuid::Uuid::new_v4();
+        let attempt_id = uuid::Uuid::new_v4();
+
+        let mut conn = pool
+            .acquire()
+            .await
+            .expect("acquire connection for wrong-kind receipt-side test");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn)
+            .await
+            .expect("begin");
+
+        // Denied enroll receipt (operation_kind = 1, outcome_code = 2).
+        // No history row needed: outcome_code = 2 expects zero history rows.
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 2, $5)",
+        )
+        .bind(community_id)
+        .bind(op_id)
+        .bind(&fp)
+        .bind(vec![0xA1_u8; 32])
+        .bind(vec![0xA2_u8; 32])
+        .execute(&mut *conn)
+        .await
+        .expect("insert denied enroll receipt — deferred guard");
+
+        // Wrong success-transition kind: event_kind = 6 (retired), not the mapped
+        // kind 1 (enrolled). Both are in the forbidden class (1, 2, 3, 6).
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, actor_fingerprint, operation_id, request_fingerprint, \
+              correlation_id, attempt_id, semantic_fingerprint, \
+              occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 6, 1, 4, 1, $3, $4, $5, $6, $7, NULL, \
+                     '2026-01-01T00:00:00Z', $8, $9)",
+            // event_kind 6 (retired) — wrong kind for a denied enroll receipt
+        )
+        .bind(community_id)
+        .bind(event_id)
+        .bind(vec![0xA3_u8; 32]) // actor_fingerprint
+        .bind(op_id)
+        .bind(&fp)
+        .bind(corr_id)
+        .bind(attempt_id)
+        .bind(vec![0xA4_u8; 64]) // canonical_envelope
+        .bind(vec![0xA5_u8; 32]) // envelope_digest
+        .execute(&mut *conn)
+        .await
+        .expect("event INSERT must pass — deferred guard fires at COMMIT");
+
+        let wrong_kind_err = sqlx::query("COMMIT").execute(&mut *conn).await.expect_err(
+            "denied receipt + wrong success-transition kind (6) must be rejected at COMMIT \
+                 — class-based guard forbids all of kinds 1, 2, 3, 6",
+        );
+        assert_eq!(
+            wrong_kind_err
+                .as_database_error()
+                .and_then(|e| e.constraint()),
+            Some("authorization_denied_lifecycle_receipt_no_success_event"),
+            "expected authorization_denied_lifecycle_receipt_no_success_event for \
+             denied receipt + wrong kind (6), got: {wrong_kind_err}"
+        );
+    }
+
+    /// NIP-FI cross-kind denied lifecycle event-side: after a denied enroll
+    /// receipt is committed alone (auto-commit), a new transaction that inserts
+    /// only a wrong success-transition kind (kind 6, retired) must be rejected at
+    /// COMMIT by `authorization_event_receipt_cardinality` (event-side trigger).
+    ///
+    /// This isolates the event-side trigger path for the cross-kind case.
+    /// The committed receipt produces no active deferred trigger, so rejection
+    /// can only come from the event-side trigger.
+    ///
+    /// Mutation sensitivity: narrowing the denied filter to
+    /// `event_kind = expected_event_kind` (kind 1) removes kind 6 from the
+    /// forbidden set, making this negative green — COMMIT succeeds when it must
+    /// not, failing `expect_err`.
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn denied_lifecycle_receipt_wrong_kind_event_side() {
+        let pool = connect_test_pool().await;
+        reset_public_schema(&pool).await;
+        MIGRATOR
+            .run_to(42, &pool)
+            .await
+            .expect("apply migrations 1-42");
+
+        let community_id = uuid::Uuid::new_v4();
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(community_id)
+            .bind(format!("wrong-kind-evt-{}.example", community_id.simple()))
+            .execute(&pool)
+            .await
+            .expect("insert community");
+
+        sqlx::query(
+            "INSERT INTO authorization_event_capacity \
+             (community_id, max_events_per_domain, max_bytes_per_domain, max_envelope_bytes) \
+             VALUES ($1, 1000, 16777216, 16384)",
+        )
+        .bind(community_id)
+        .execute(&pool)
+        .await
+        .expect("insert event capacity");
+
+        // Commit a denied enroll receipt in auto-commit mode. No deferred trigger
+        // is active after this commit; the receipt-side trigger fires only within
+        // the transaction that inserts the receipt.
+        let op_id = uuid::Uuid::new_v4();
+        let fp = vec![0xB0_u8; 32];
+        sqlx::query(
+            "INSERT INTO authorization_operation_receipts \
+             (community_id, operation_id, request_fingerprint, operation_kind, \
+              actor_fingerprint, outcome_code, result_digest) \
+             VALUES ($1, $2, $3, 1, $4, 2, $5)",
+        )
+        .bind(community_id)
+        .bind(op_id)
+        .bind(&fp)
+        .bind(vec![0xB1_u8; 32])
+        .bind(vec![0xB2_u8; 32])
+        .execute(&pool)
+        .await
+        .expect("denied receipt must commit alone in auto-commit mode");
+
+        // New transaction: insert only a kind-6 (retired) event for the same
+        // operation. The event-side trigger is the only active deferred trigger.
+        let event_id = uuid::Uuid::new_v4();
+        let corr_id = uuid::Uuid::new_v4();
+        let attempt_id = uuid::Uuid::new_v4();
+
+        let mut conn = pool
+            .acquire()
+            .await
+            .expect("acquire connection for wrong-kind event-side test");
+        sqlx::query("BEGIN")
+            .execute(&mut *conn)
+            .await
+            .expect("begin event-side wrong-kind transaction");
+
+        sqlx::query(
+            "INSERT INTO authorization_events \
+             (community_id, event_id, event_kind, outcome_code, reason_code, \
+              actor_kind, actor_fingerprint, operation_id, request_fingerprint, \
+              correlation_id, attempt_id, semantic_fingerprint, \
+              occurred_at, canonical_envelope, envelope_digest) \
+             VALUES ($1, $2, 6, 1, 4, 1, $3, $4, $5, $6, $7, NULL, \
+                     '2026-01-01T00:00:00Z', $8, $9)",
+            // event_kind 6 (retired) — wrong kind for the denied enroll receipt
+        )
+        .bind(community_id)
+        .bind(event_id)
+        .bind(vec![0xB3_u8; 32]) // actor_fingerprint
+        .bind(op_id)
+        .bind(&fp)
+        .bind(corr_id)
+        .bind(attempt_id)
+        .bind(vec![0xB4_u8; 64]) // canonical_envelope
+        .bind(vec![0xB5_u8; 32]) // envelope_digest
+        .execute(&mut *conn)
+        .await
+        .expect("event INSERT must pass — event-side deferred guard fires at COMMIT");
+
+        let wrong_kind_evt_err = sqlx::query("COMMIT").execute(&mut *conn).await.expect_err(
+            "kind-6 event paired with a committed denied enroll receipt must be \
+                 rejected at COMMIT by the event-side trigger",
+        );
+        assert_eq!(
+            wrong_kind_evt_err
+                .as_database_error()
+                .and_then(|e| e.constraint()),
+            Some("authorization_denied_lifecycle_receipt_no_success_event"),
+            "event-side trigger must reject with authorization_denied_lifecycle_receipt_no_success_event \
+             for wrong kind (6) against denied receipt, got: {wrong_kind_evt_err}"
+        );
+    }
 }
diff --git a/desktop/package.json b/desktop/package.json
index 14db248a134..425fbbbd9dd 100644
--- a/desktop/package.json
+++ b/desktop/package.json
@@ -14,7 +14,7 @@
     "lint": "biome lint .",
     "check": "biome check . && pnpm check:px-text && pnpm check:pubkey-truncation",
     "format": "biome format --write .",
-    "test": "node --import ./test-loader.mjs --experimental-strip-types --test \"src/**/*.test.mjs\"",
+    "test": "node --import ./test-loader.mjs --experimental-strip-types --test \"src/**/*.test.mjs\" \"scripts/*.test.mjs\"",
     "preview": "vite preview",
     "tauri": "node ./scripts/tauri-command.mjs",
     "test:e2e": "pnpm build:e2e && playwright test",
diff --git a/desktop/scripts/demo-build-config.mjs b/desktop/scripts/demo-build-config.mjs
new file mode 100644
index 00000000000..fd5c9ed2a1c
--- /dev/null
+++ b/desktop/scripts/demo-build-config.mjs
@@ -0,0 +1,94 @@
+import { randomBytes } from "node:crypto";
+import { writeFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+const PRODUCTION_IDENTIFIER = "xyz.block.buzz.app";
+// The build ID suffix is 17 characters including its separator, and the Rust
+// build contract caps the complete demo slug at 48 ASCII bytes.
+const MAX_DEMO_SLUG_LENGTH = 48;
+const DEMO_BUILD_ID_SUFFIX_LENGTH = 17;
+const MAX_DEMO_NAME_LENGTH = MAX_DEMO_SLUG_LENGTH - DEMO_BUILD_ID_SUFFIX_LENGTH;
+
+export const productionBuildIdentity = Object.freeze({
+  productName: "Buzz",
+  identifier: PRODUCTION_IDENTIFIER,
+  deepLinkScheme: "buzz",
+  keyringService: "buzz-desktop",
+  nestName: ".buzz",
+  cliName: "buzz",
+});
+
+export function demoBuildConfig(
+  rawName,
+  buildId = randomBytes(8).toString("hex"),
+) {
+  if (typeof rawName !== "string") throw new Error("Demo name must be text");
+  const name = rawName.trim().replace(/\s+/g, " ");
+  if (!name) throw new Error("Demo name must not be empty");
+  if (name.length > MAX_DEMO_NAME_LENGTH) {
+    throw new Error(
+      `Demo name must be at most ${MAX_DEMO_NAME_LENGTH} characters`,
+    );
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9 -]*$/.test(name)) {
+    throw new Error(
+      "Demo name may contain ASCII letters, numbers, spaces, and hyphens only",
+    );
+  }
+
+  if (!/^[a-f0-9]{16}$/.test(buildId)) {
+    throw new Error(
+      "Demo build ID must be sixteen lowercase hexadecimal characters",
+    );
+  }
+
+  const readableSlug = name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+  const slug = `${readableSlug}-${buildId}`;
+  const productName = `Buzz ${name}`;
+  return {
+    name,
+    slug,
+    productName,
+    dmgVolumeName: productName,
+    dmgFileStem: productName.replace(/ /g, "_"),
+    identifier: `${PRODUCTION_IDENTIFIER}.demo.${slug}`,
+    appDataIdentity: `${PRODUCTION_IDENTIFIER}.demo.${slug}`,
+    deepLinkScheme: `buzz-demo-${slug}`,
+    keyringService: `buzz-desktop-demo.${slug}`,
+    nestName: `.buzz-demo-${slug}`,
+    cliName: `buzz-demo-${slug}`,
+    tauriConfig: {
+      productName,
+      identifier: `${PRODUCTION_IDENTIFIER}.demo.${slug}`,
+      plugins: { "deep-link": { desktop: { schemes: [`buzz-demo-${slug}`] } } },
+      bundle: { targets: ["app"] },
+    },
+  };
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  const [name, outputPath, buildId] = process.argv.slice(2);
+  if (!outputPath) {
+    console.error(
+      "Usage: demo-build-config.mjs <demo-name> <output-config-path>",
+    );
+    process.exit(2);
+  }
+  try {
+    const config = demoBuildConfig(name, buildId);
+    writeFileSync(
+      outputPath,
+      `${JSON.stringify(config.tauriConfig, null, 2)}\n`,
+    );
+    console.log(JSON.stringify(config));
+  } catch (error) {
+    console.error(`Invalid demo build: ${error.message}`);
+    process.exit(1);
+  }
+}
diff --git a/desktop/scripts/demo-build-config.test.mjs b/desktop/scripts/demo-build-config.test.mjs
new file mode 100644
index 00000000000..db2ba568c7b
--- /dev/null
+++ b/desktop/scripts/demo-build-config.test.mjs
@@ -0,0 +1,134 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  demoBuildConfig,
+  productionBuildIdentity,
+} from "./demo-build-config.mjs";
+
+const expected = (name, slug) => ({
+  name,
+  slug,
+  productName: `Buzz ${name}`,
+  dmgVolumeName: `Buzz ${name}`,
+  dmgFileStem: `Buzz_${name.replace(/ /g, "_")}`,
+  identifier: `xyz.block.buzz.app.demo.${slug}`,
+  appDataIdentity: `xyz.block.buzz.app.demo.${slug}`,
+  deepLinkScheme: `buzz-demo-${slug}`,
+  keyringService: `buzz-desktop-demo.${slug}`,
+  nestName: `.buzz-demo-${slug}`,
+  cliName: `buzz-demo-${slug}`,
+  tauriConfig: {
+    productName: `Buzz ${name}`,
+    identifier: `xyz.block.buzz.app.demo.${slug}`,
+    plugins: { "deep-link": { desktop: { schemes: [`buzz-demo-${slug}`] } } },
+    bundle: { targets: ["app"] },
+  },
+});
+
+test("production identity remains unchanged", () => {
+  assert.deepEqual(productionBuildIdentity, {
+    productName: "Buzz",
+    identifier: "xyz.block.buzz.app",
+    deepLinkScheme: "buzz",
+    keyringService: "buzz-desktop",
+    nestName: ".buzz",
+    cliName: "buzz",
+  });
+});
+
+test("two demo names produce complete, distinct identities", () => {
+  const board = demoBuildConfig("Workstream Board", "27a4294c27a4294c");
+  const interests = demoBuildConfig("Interests Demo", "deb5339adeb5339a");
+  assert.deepEqual(
+    board,
+    expected("Workstream Board", "workstream-board-27a4294c27a4294c"),
+  );
+  assert.deepEqual(
+    interests,
+    expected("Interests Demo", "interests-demo-deb5339adeb5339a"),
+  );
+  for (const key of [
+    "productName",
+    "dmgVolumeName",
+    "dmgFileStem",
+    "identifier",
+    "appDataIdentity",
+    "deepLinkScheme",
+    "keyringService",
+    "nestName",
+    "cliName",
+  ]) {
+    assert.notEqual(board[key], interests[key], key);
+    assert.notEqual(board[key], productionBuildIdentity[key], key);
+  }
+});
+
+test("normalized spelling aliases retain distinct runtime identities", () => {
+  for (const [leftName, rightName] of [
+    ["A B", "A-B"],
+    ["Demo", "demo"],
+    ["Workstream Board", "WORKSTREAM BOARD"],
+  ]) {
+    const left = demoBuildConfig(leftName, "1111111111111111");
+    const right = demoBuildConfig(rightName, "2222222222222222");
+    assert.notEqual(left.slug, right.slug);
+    for (const key of [
+      "identifier",
+      "appDataIdentity",
+      "deepLinkScheme",
+      "keyringService",
+      "nestName",
+      "cliName",
+    ]) {
+      assert.notEqual(
+        left[key],
+        right[key],
+        `${leftName}/${rightName}: ${key}`,
+      );
+    }
+  }
+});
+
+test("the same display name gets a distinct identity for each build", () => {
+  const first = demoBuildConfig("Demo", "1111111111111111");
+  const second = demoBuildConfig("Demo", "2222222222222222");
+  assert.equal(first.productName, second.productName);
+  assert.equal(first.dmgFileStem, second.dmgFileStem);
+  for (const key of [
+    "slug",
+    "identifier",
+    "appDataIdentity",
+    "deepLinkScheme",
+    "keyringService",
+    "nestName",
+    "cliName",
+  ]) {
+    assert.notEqual(first[key], second[key], key);
+  }
+});
+
+test("whitespace normalization preserves deterministic identity", () => {
+  assert.deepEqual(
+    demoBuildConfig("  Workstream   Board  ", "27a4294c27a4294c"),
+    demoBuildConfig("Workstream Board", "27a4294c27a4294c"),
+  );
+});
+
+test("maximum-length name produces a Rust-valid 48-byte slug", () => {
+  const config = demoBuildConfig("x".repeat(31), "1234567812345678");
+  assert.equal(config.slug.length, 48);
+  assert.match(config.slug, /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/);
+});
+
+for (const name of [
+  "",
+  "   ",
+  "Workstream/Board",
+  "Workstream_Board",
+  "équipe",
+  "x".repeat(32),
+]) {
+  test(`rejects unusable name ${JSON.stringify(name)}`, () =>
+    assert.throws(() => demoBuildConfig(name, "1234567812345678")));
+}
diff --git a/desktop/scripts/package-macos-dmg.sh b/desktop/scripts/package-macos-dmg.sh
new file mode 100755
index 00000000000..7ecaf9502e8
--- /dev/null
+++ b/desktop/scripts/package-macos-dmg.sh
@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# Build a drag-to-Applications DMG without requiring a GUI login session.
+# Finder styling is optional; the disk image itself is always authoritative.
+
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+  echo "Usage: $0 <Buzz.app> <output.dmg>" >&2
+  exit 2
+fi
+
+app_path="$1"
+out_dmg="$2"
+app_name="$(basename "$app_path")"
+volume_name="${VOL_NAME:-Buzz}"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+background="$script_dir/../src-tauri/icons/dmg-background.png"
+work_dir="$(mktemp -d "${TMPDIR:-/tmp}/buzz-dmg.XXXXXX")"
+source_dir="$work_dir/source"
+rw_dmg="$work_dir/read-write.dmg"
+mount_point="$work_dir/mount"
+applescript="$work_dir/style.applescript"
+device=""
+
+finish() {
+  local status="$?"
+  trap - EXIT
+  if [[ -n "$device" ]]; then
+    hdiutil detach "$device" >/dev/null 2>&1 || true
+    hdiutil detach -force "$device" >/dev/null 2>&1 || true
+  fi
+  rm -rf "$work_dir"
+  exit "$status"
+}
+trap finish EXIT
+
+[[ -d "$app_path" ]] || { echo "App bundle not found: $app_path" >&2; exit 1; }
+[[ -f "$background" ]] || { echo "DMG background not found: $background" >&2; exit 1; }
+
+mkdir -p "$(dirname "$out_dmg")" "$source_dir/.background" "$mount_point"
+ditto "$app_path" "$source_dir/$app_name"
+ln -s /Applications "$source_dir/Applications"
+cp "$background" "$source_dir/.background/background.png"
+
+rm -f "$rw_dmg" "$out_dmg"
+hdiutil create -volname "$volume_name" -srcfolder "$source_dir" \
+  -format UDRW -ov "$rw_dmg" >/dev/null
+
+attach_output="$(hdiutil attach -readwrite -noverify -noautoopen -nobrowse \
+  -mountpoint "$mount_point" "$rw_dmg")"
+device="$(printf '%s\n' "$attach_output" | awk '/^\/dev\// { print $1; exit }')"
+[[ -n "$device" ]] || { echo "Failed to attach writable DMG" >&2; exit 1; }
+
+detach() {
+  local attempt
+  for attempt in 1 2 3 4 5; do
+    if hdiutil detach "$device" >/dev/null 2>&1; then
+      device=""
+      return 0
+    fi
+    sleep 1
+  done
+  hdiutil detach -force "$device" >/dev/null
+  device=""
+}
+
+if command -v SetFile >/dev/null 2>&1; then
+  SetFile -a V "$mount_point/.background" || true
+  icon="$mount_point/$app_name/Contents/Resources/icon.icns"
+  if [[ -f "$icon" ]]; then
+    cp "$icon" "$mount_point/.VolumeIcon.icns" || true
+    SetFile -c icnC "$mount_point/.VolumeIcon.icns" || true
+    SetFile -a C "$mount_point" || true
+  fi
+fi
+
+cat >"$applescript" <<'APPLESCRIPT'
+on run argv
+  set mountPath to item 1 of argv
+  set appName to item 2 of argv
+  tell application "Finder"
+    set rootFolder to POSIX file mountPath as alias
+    open rootFolder
+    set imageWindow to container window of rootFolder
+    set current view of imageWindow to icon view
+    set toolbar visible of imageWindow to false
+    set statusbar visible of imageWindow to false
+    set bounds of imageWindow to {200, 120, 860, 652}
+    set viewOptions to icon view options of imageWindow
+    set arrangement of viewOptions to not arranged
+    set icon size of viewOptions to 128
+    set text size of viewOptions to 14
+    set background picture of viewOptions to file ".background:background.png" of rootFolder
+    set position of item appName of rootFolder to {191, 330}
+    set position of item "Applications" of rootFolder to {469, 330}
+    set extension hidden of item appName of rootFolder to true
+    delay 1
+    close imageWindow
+  end tell
+end run
+APPLESCRIPT
+
+style_with_finder() {
+  local child elapsed=0
+  /usr/bin/osascript "$applescript" "$mount_point" "$app_name" &
+  child=$!
+  while kill -0 "$child" 2>/dev/null; do
+    if (( elapsed >= 100 )); then
+      echo "Finder styling timed out; continuing without it" >&2
+      kill "$child" 2>/dev/null || true
+      wait "$child" 2>/dev/null || true
+      return 124
+    fi
+    sleep 0.1
+    elapsed=$((elapsed + 1))
+  done
+  wait "$child"
+}
+
+if ! style_with_finder; then
+  echo "Finder styling unavailable; continuing without it" >&2
+fi
+
+sync
+detach
+hdiutil convert "$rw_dmg" -format UDZO -imagekey zlib-level=9 \
+  -o "$out_dmg" >/dev/null
+printf 'DMG ready: %s\n' "$out_dmg"
diff --git a/desktop/src-tauri/build.rs b/desktop/src-tauri/build.rs
index 2cdd785c735..8b0e63f12bc 100644
--- a/desktop/src-tauri/build.rs
+++ b/desktop/src-tauri/build.rs
@@ -18,8 +18,29 @@ fn main() {
     println!("cargo:rerun-if-env-changed=BUZZ_BUILD_RELAY_RECONNECT_CMD");
     println!("cargo:rerun-if-env-changed=BUZZ_BUILD_AGENT_ACCESS_OWNER_ONLY");
     println!("cargo:rerun-if-env-changed=BUZZ_BUILD_AUTO_CONNECT_DEFAULT_RELAY");
+    println!("cargo:rerun-if-env-changed=BUZZ_BUILD_DEMO_SLUG");
     println!("cargo:rustc-check-cfg=cfg(buzz_updater_enabled)");
 
+    if let Ok(slug) = std::env::var("BUZZ_BUILD_DEMO_SLUG") {
+        let valid = !slug.is_empty()
+            && slug.len() <= 48
+            && slug
+                .bytes()
+                .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
+            && slug
+                .bytes()
+                .next()
+                .is_some_and(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit())
+            && slug
+                .bytes()
+                .last()
+                .is_some_and(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit());
+        if !valid {
+            panic!("BUZZ_BUILD_DEMO_SLUG must be a lowercase ASCII slug");
+        }
+        println!("cargo:rustc-env=BUZZ_DESKTOP_BUILD_DEMO_SLUG={slug}");
+    }
+
     // Explicit owner-only agent-access capability. Release packaging sets this
     // presence-only marker; OSS/custom builds leave agent access configurable.
     if std::env::var("BUZZ_BUILD_AGENT_ACCESS_OWNER_ONLY").is_ok() {
diff --git a/desktop/src-tauri/src/app_state_keyring.rs b/desktop/src-tauri/src/app_state_keyring.rs
index 68d24e87f58..7684355a5bc 100644
--- a/desktop/src-tauri/src/app_state_keyring.rs
+++ b/desktop/src-tauri/src/app_state_keyring.rs
@@ -7,7 +7,12 @@ fn dev_keyring_service(configured: Option<String>) -> String {
 }
 
 pub(crate) fn keyring_service() -> &'static str {
-    if cfg!(debug_assertions) {
+    if crate::build_identity::is_demo_build() {
+        static DEMO_SERVICE: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+        DEMO_SERVICE
+            .get_or_init(|| crate::build_identity::keyring_service().into_owned())
+            .as_str()
+    } else if cfg!(debug_assertions) {
         static DEV_SERVICE: std::sync::OnceLock<String> = std::sync::OnceLock::new();
         DEV_SERVICE
             .get_or_init(|| dev_keyring_service(std::env::var("BUZZ_DEV_KEYRING_SERVICE").ok()))
diff --git a/desktop/src-tauri/src/build_identity.rs b/desktop/src-tauri/src/build_identity.rs
new file mode 100644
index 00000000000..ee84696c7f0
--- /dev/null
+++ b/desktop/src-tauri/src/build_identity.rs
@@ -0,0 +1,183 @@
+//! Compile-time identity for reusable named demo builds.
+//!
+//! Production builds leave `BUZZ_DESKTOP_BUILD_DEMO_SLUG` unset and retain all
+//! existing names. The demo recipe validates one slug and `build.rs` bakes it
+//! into the binary; every runtime identity is then derived from that one value.
+
+use std::borrow::Cow;
+
+pub(crate) fn demo_slug() -> Option<&'static str> {
+    option_env!("BUZZ_DESKTOP_BUILD_DEMO_SLUG")
+}
+
+pub(crate) fn is_demo_build() -> bool {
+    demo_slug().is_some()
+}
+
+pub(crate) const DEMO_AGENT_CONFIG_ENV: &str = "BUZZ_AGENT_CONFIG_DIR";
+
+pub(crate) fn demo_config_home() -> Result<Option<std::path::PathBuf>, String> {
+    demo_config_home_for(demo_slug(), dirs::config_dir())
+}
+
+pub(crate) fn demo_agent_oauth_cache_dir() -> Result<Option<std::path::PathBuf>, String> {
+    Ok(demo_config_home()?.map(|dir| dir.join("buzz-agent").join("oauth")))
+}
+
+/// Keep child config caches inside this demo build's identity. In particular,
+/// bundled buzz-agent OAuth tokens must not read or write production's root.
+/// Refuse launch if a demo cannot resolve its root; None means production only.
+pub(crate) fn apply_demo_config_home(command: &mut std::process::Command) -> Result<(), String> {
+    if let Some(config_home) = demo_config_home()? {
+        command.env(DEMO_AGENT_CONFIG_ENV, config_home);
+    }
+    Ok(())
+}
+
+fn demo_config_home_for(
+    demo_slug: Option<&str>,
+    config_dir: Option<std::path::PathBuf>,
+) -> Result<Option<std::path::PathBuf>, String> {
+    match demo_slug {
+        None => Ok(None),
+        Some(slug) => config_dir
+            .map(|dir| Some(dir.join(format!("buzz-demo-{slug}"))))
+            .ok_or_else(|| "cannot resolve demo credential directory".to_string()),
+    }
+}
+
+pub(crate) fn deep_link_scheme() -> Cow<'static, str> {
+    demo_slug()
+        .map(|slug| Cow::Owned(format!("buzz-demo-{slug}")))
+        .unwrap_or(Cow::Borrowed("buzz"))
+}
+
+pub(crate) fn is_deep_link_for_build(value: &str) -> bool {
+    is_deep_link_for_scheme(value, deep_link_scheme().as_ref())
+}
+
+fn is_deep_link_for_scheme(value: &str, scheme: &str) -> bool {
+    value
+        .strip_prefix(scheme)
+        .is_some_and(|suffix| suffix.starts_with("://"))
+}
+
+pub(crate) fn keyring_service() -> Cow<'static, str> {
+    demo_slug()
+        .map(|slug| Cow::Owned(format!("buzz-desktop-demo.{slug}")))
+        .unwrap_or(Cow::Borrowed("buzz-desktop"))
+}
+
+pub(crate) fn nest_name(is_dev: bool) -> Cow<'static, str> {
+    nest_name_for(demo_slug(), is_dev)
+}
+
+fn nest_name_for(demo_slug: Option<&str>, is_dev: bool) -> Cow<'_, str> {
+    if let Some(slug) = demo_slug {
+        Cow::Owned(format!(".buzz-demo-{slug}"))
+    } else if is_dev {
+        Cow::Borrowed(".buzz-dev")
+    } else {
+        Cow::Borrowed(".buzz")
+    }
+}
+
+pub(crate) fn cli_name(is_dev: bool) -> String {
+    if let Some(slug) = demo_slug() {
+        format!("buzz-demo-{slug}")
+    } else if is_dev {
+        "buzz-dev".to_string()
+    } else {
+        "buzz".to_string()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    #[ignore = "compiled with BUZZ_BUILD_DEMO_SLUG by the compiled-flags recipe"]
+    fn compiled_demo_slug_matches_expected() {
+        let expected = std::env::var("BUZZ_TEST_EXPECTED_DEMO_SLUG")
+            .expect("BUZZ_TEST_EXPECTED_DEMO_SLUG must be set");
+        assert_eq!(demo_slug(), Some(expected.as_str()));
+    }
+
+    #[test]
+    fn ordinary_release_defaults_remain_production_identity() {
+        if demo_slug().is_none() {
+            assert_eq!(deep_link_scheme(), "buzz");
+            assert_eq!(keyring_service(), "buzz-desktop");
+            assert_eq!(nest_name(false), ".buzz");
+            assert_eq!(cli_name(false), "buzz");
+        }
+    }
+
+    #[test]
+    fn demo_agent_config_and_oauth_roots_are_build_scoped() {
+        let base = std::path::PathBuf::from("/Users/demo/Library/Application Support");
+        assert_eq!(
+            demo_config_home_for(None, Some(base.clone())).unwrap(),
+            None
+        );
+        let first = demo_config_home_for(Some("board-1234567812345678"), Some(base.clone()))
+            .unwrap()
+            .unwrap();
+        let second = demo_config_home_for(Some("board-8765432187654321"), Some(base))
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            first,
+            std::path::PathBuf::from(
+                "/Users/demo/Library/Application Support/buzz-demo-board-1234567812345678"
+            )
+        );
+        assert_eq!(
+            first.join("buzz-agent/oauth"),
+            std::path::PathBuf::from(
+                "/Users/demo/Library/Application Support/buzz-demo-board-1234567812345678/buzz-agent/oauth"
+            )
+        );
+        assert_ne!(first, second);
+    }
+
+    #[test]
+    fn unresolved_demo_credentials_never_select_production_defaults() {
+        assert_eq!(demo_config_home_for(None, None).unwrap(), None);
+        assert_eq!(
+            demo_config_home_for(Some("board-1234567812345678"), None),
+            Err("cannot resolve demo credential directory".to_string())
+        );
+    }
+
+    #[test]
+    fn duplicate_instance_links_follow_the_build_scheme() {
+        assert!(is_deep_link_for_scheme("buzz://message?id=1", "buzz"));
+        assert!(!is_deep_link_for_scheme(
+            "buzz-demo-board-1234567812345678://message?id=1",
+            "buzz"
+        ));
+        assert!(is_deep_link_for_scheme(
+            "buzz-demo-board-1234567812345678://message?id=1",
+            "buzz-demo-board-1234567812345678"
+        ));
+        assert!(!is_deep_link_for_scheme(
+            "buzz://message?id=1",
+            "buzz-demo-board-1234567812345678"
+        ));
+    }
+
+    #[test]
+    fn production_and_named_demo_nests_are_distinct() {
+        assert_eq!(nest_name_for(None, false), ".buzz");
+        assert_eq!(
+            nest_name_for(Some("workstream-board"), false),
+            ".buzz-demo-workstream-board"
+        );
+        assert_eq!(
+            nest_name_for(Some("second-demo"), false),
+            ".buzz-demo-second-demo"
+        );
+    }
+}
diff --git a/desktop/src-tauri/src/commands/agent_model_process.rs b/desktop/src-tauri/src/commands/agent_model_process.rs
index 998edeca27d..f671983bbc6 100644
--- a/desktop/src-tauri/src/commands/agent_model_process.rs
+++ b/desktop/src-tauri/src/commands/agent_model_process.rs
@@ -54,6 +54,8 @@ pub(super) async fn run_agent_models_command(
         for (k, v) in &merged_env {
             cmd.env(k, v);
         }
+        // Demo identity is authoritative and must win over ambient/user env.
+        crate::build_identity::apply_demo_config_home(&mut cmd)?;
         crate::managed_agents::configure_runtime_cli(&mut cmd, known_acp_runtime(&agent_command));
         crate::util::configure_no_window(&mut cmd);
         cmd.stdout(std::process::Stdio::piped())
diff --git a/desktop/src-tauri/src/commands/agent_models_databricks.rs b/desktop/src-tauri/src/commands/agent_models_databricks.rs
index 1f66f24c6a3..07f19f9a204 100644
--- a/desktop/src-tauri/src/commands/agent_models_databricks.rs
+++ b/desktop/src-tauri/src/commands/agent_models_databricks.rs
@@ -178,12 +178,23 @@ pub(super) async fn discover_databricks_models(
         parsed_filter.clone(),
     );
     let redaction_env = redaction_env_with_value(env, "DATABRICKS_TOKEN", &api_key);
+    let oauth_cache_dir = crate::build_identity::demo_agent_oauth_cache_dir()?;
 
-    let entries = match buzz_agent_pkg::discover_databricks_models(&config).await {
+    let entries = match buzz_agent_pkg::discover_databricks_models_with_cache_dir(
+        &config,
+        oauth_cache_dir.as_deref(),
+    )
+    .await
+    {
         Ok(entries) => entries,
         Err(buzz_agent_pkg::AgentError::LlmAuth(_)) if should_start_interactive_auth(&api_key) => {
             let _auth = AUTH_GATE.lock().await;
-            match buzz_agent_pkg::discover_databricks_models(&config).await {
+            match buzz_agent_pkg::discover_databricks_models_with_cache_dir(
+                &config,
+                oauth_cache_dir.as_deref(),
+            )
+            .await
+            {
                 // A peer sign-in under the gate already succeeded.
                 Ok(entries) => entries,
                 Err(buzz_agent_pkg::AgentError::LlmAuth(_)) => {
@@ -194,22 +205,28 @@ pub(super) async fn discover_databricks_models(
                         return Err(databricks_sign_in_required_error());
                     }
                     run_interactive_databricks_auth(
-                        buzz_agent_pkg::authenticate_databricks(&host),
+                        buzz_agent_pkg::authenticate_databricks_with_cache_dir(
+                            &host,
+                            oauth_cache_dir.as_deref(),
+                        ),
                         AUTH_FLOW_TIMEOUT,
                         &AUTH_COOLDOWNS,
                         &host,
                         &redaction_env,
                     )
                     .await?;
-                    buzz_agent_pkg::discover_databricks_models(&config)
-                        .await
-                        .map_err(|error| {
-                            format_redacted_error(
-                                "Databricks model discovery failed after sign-in",
-                                &error,
-                                &redaction_env,
-                            )
-                        })?
+                    buzz_agent_pkg::discover_databricks_models_with_cache_dir(
+                        &config,
+                        oauth_cache_dir.as_deref(),
+                    )
+                    .await
+                    .map_err(|error| {
+                        format_redacted_error(
+                            "Databricks model discovery failed after sign-in",
+                            &error,
+                            &redaction_env,
+                        )
+                    })?
                 }
                 Err(error) => {
                     return Err(format_redacted_error(
diff --git a/desktop/src-tauri/src/commands/project_repo_paths.rs b/desktop/src-tauri/src/commands/project_repo_paths.rs
index 4193327c012..3fd4bbcaf82 100644
--- a/desktop/src-tauri/src/commands/project_repo_paths.rs
+++ b/desktop/src-tauri/src/commands/project_repo_paths.rs
@@ -145,13 +145,26 @@ pub(crate) fn find_local_repo_dir(
 }
 
 pub(crate) fn default_repos_root_candidates() -> Vec<std::path::PathBuf> {
+    default_repos_root_candidates_for(
+        nest_dir(),
+        dirs::home_dir(),
+        crate::build_identity::is_demo_build(),
+    )
+}
+
+fn default_repos_root_candidates_for(
+    nest: Option<std::path::PathBuf>,
+    home: Option<std::path::PathBuf>,
+    is_demo_build: bool,
+) -> Vec<std::path::PathBuf> {
     let mut candidates = Vec::new();
-    candidates.extend(nest_dir().map(|path| path.join("REPOS")));
-    candidates.extend(
-        dirs::home_dir()
-            .map(|home| home.join(".buzz").join("REPOS"))
-            .filter(|path| !candidates.iter().any(|candidate| candidate == path)),
-    );
+    candidates.extend(nest.map(|path| path.join("REPOS")));
+    if !is_demo_build {
+        candidates.extend(
+            home.map(|home| home.join(".buzz").join("REPOS"))
+                .filter(|path| !candidates.iter().any(|candidate| candidate == path)),
+        );
+    }
     candidates
 }
 
@@ -190,3 +203,34 @@ pub(crate) fn canonical_repos_roots(
     }
     Ok(roots)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::default_repos_root_candidates_for;
+    use std::path::PathBuf;
+
+    #[test]
+    fn production_keeps_the_legacy_repo_fallback() {
+        let home = PathBuf::from("/Users/example");
+        assert_eq!(
+            default_repos_root_candidates_for(
+                Some(home.join(".buzz-dev")),
+                Some(home.clone()),
+                false,
+            ),
+            vec![home.join(".buzz-dev/REPOS"), home.join(".buzz/REPOS")]
+        );
+    }
+
+    #[test]
+    fn named_demos_only_search_their_selected_nest() {
+        let home = PathBuf::from("/Users/example");
+        for slug in ["workstream-board", "second-demo"] {
+            let nest = home.join(format!(".buzz-demo-{slug}"));
+            assert_eq!(
+                default_repos_root_candidates_for(Some(nest.clone()), Some(home.clone()), true,),
+                vec![nest.join("REPOS")]
+            );
+        }
+    }
+}
diff --git a/desktop/src-tauri/src/deep_link.rs b/desktop/src-tauri/src/deep_link.rs
index 83ac7e59ff9..614c62e1aaf 100644
--- a/desktop/src-tauri/src/deep_link.rs
+++ b/desktop/src-tauri/src/deep_link.rs
@@ -404,6 +404,18 @@ const ENTITY_LINK_TABS: [&str; 6] = [
     "channels",
 ];
 
+/// Validate the build-specific transport URL, then hand the frontend its
+/// canonical entity-link representation. Never broaden frontend scheme trust.
+fn canonical_entity_deep_link(url: &Url, build_scheme: &str) -> Option<String> {
+    if url.scheme() != build_scheme {
+        return None;
+    }
+    parse_entity_deep_link(url)?;
+    let mut canonical = url.clone();
+    canonical.set_scheme("buzz").ok()?;
+    Some(canonical.into())
+}
+
 /// The canonical-form rules match `parseEntityLink`: no path segments, no
 /// fragment, and no parameters beyond `owner`/`d` (plus `id` for event
 /// links and the optional `tab` for coordinate links), so a future
@@ -600,7 +612,7 @@ pub(crate) fn handle_deep_link_url(app: &tauri::AppHandle, url_str: &str) {
         }
     };
 
-    if url.scheme() != "buzz" {
+    if url.scheme() != crate::build_identity::deep_link_scheme() {
         eprintln!("buzz-desktop: ignoring unsupported deep link scheme: {url_str}");
         return;
     }
@@ -678,17 +690,17 @@ pub(crate) fn handle_deep_link_url(app: &tauri::AppHandle, url_str: &str) {
             let _ = app.emit("deep-link-message", payload);
         }
         Some("repo" | "project" | "pr" | "issue") => {
-            // `buzz://repo|project?owner=<pubkey>&d=<dtag>` and
-            // `buzz://pr|issue?id=<eventId>&owner=<pubkey>&d=<dtag>` — the
-            // share links copied from the Projects UI. The frontend owns
-            // routing (`useEntityDeepLinks`), so the validated URL is
-            // forwarded unchanged.
-            if parse_entity_deep_link(&url).is_none() {
+            // OS routing uses this build's scheme; frontend navigation consumes
+            // canonical buzz:// entity links rather than transport identity.
+            let Some(href) = canonical_entity_deep_link(
+                &url,
+                crate::build_identity::deep_link_scheme().as_ref(),
+            ) else {
                 eprintln!("buzz-desktop: malformed entity deep link: {url_str}");
                 return;
-            }
+            };
             activate_main_window(app);
-            let pending = queue_entity_deep_link(app, url_str.to_owned());
+            let pending = queue_entity_deep_link(app, href);
             let _ = app.emit("deep-link-entity", pending);
         }
         Some("nostr-bind") => match parse_nostr_bind_deep_link(&url) {
diff --git a/desktop/src-tauri/src/deep_link_tests.rs b/desktop/src-tauri/src/deep_link_tests.rs
index 84a08c4c64e..da960f3a2d9 100644
--- a/desktop/src-tauri/src/deep_link_tests.rs
+++ b/desktop/src-tauri/src/deep_link_tests.rs
@@ -1,10 +1,11 @@
 use url::Url;
 
 use super::{
-    parse_add_community_deep_link, parse_channel_deep_link, parse_entity_deep_link,
-    parse_join_deep_link, parse_message_deep_link, parse_nostr_bind_deep_link,
-    PendingCommunityDeepLink, PendingCommunityDeepLinks, PendingEntityDeepLinks,
-    PendingNavigationDeepLink, PendingNavigationDeepLinks, ENTITY_LINK_TABS,
+    canonical_entity_deep_link, parse_add_community_deep_link, parse_channel_deep_link,
+    parse_entity_deep_link, parse_join_deep_link, parse_message_deep_link,
+    parse_nostr_bind_deep_link, PendingCommunityDeepLink, PendingCommunityDeepLinks,
+    PendingEntityDeepLinks, PendingNavigationDeepLink, PendingNavigationDeepLinks,
+    ENTITY_LINK_TABS,
 };
 
 fn entity_link_golden() -> serde_json::Value {
@@ -12,6 +13,35 @@ fn entity_link_golden() -> serde_json::Value {
         .expect("valid entity-links golden fixture")
 }
 
+#[test]
+fn demo_entity_transport_produces_the_frontend_golden_contract() {
+    let golden = entity_link_golden();
+    let scheme = "buzz-demo-board-1234567812345678";
+    for canonical in golden["links"].as_object().unwrap().values() {
+        let canonical = canonical.as_str().unwrap();
+        let transport = Url::parse(&canonical.replacen("buzz:", &format!("{scheme}:"), 1)).unwrap();
+        let href = canonical_entity_deep_link(&transport, scheme).unwrap();
+        // This same fixture is parsed and routed by the frontend entity tests.
+        assert_eq!(href, canonical);
+        let queue = PendingEntityDeepLinks::default();
+        let pending = queue.enqueue(href);
+        assert_eq!(queue.first().unwrap().href, canonical);
+        assert!(queue.acknowledge(&pending.id));
+        assert!(queue.first().is_none());
+        assert!(canonical_entity_deep_link(&transport, "buzz").is_none());
+        assert!(
+            canonical_entity_deep_link(&transport, "buzz-demo-other-8765432187654321").is_none()
+        );
+        assert!(canonical_entity_deep_link(&Url::parse(canonical).unwrap(), scheme).is_none());
+        assert_eq!(
+            canonical_entity_deep_link(&Url::parse(canonical).unwrap(), "buzz").as_deref(),
+            Some(canonical)
+        );
+    }
+    let invalid = Url::parse(&format!("{scheme}://repo?owner=bad&d=repo")).unwrap();
+    assert!(canonical_entity_deep_link(&invalid, scheme).is_none());
+}
+
 #[test]
 fn parse_entity_deep_link_accepts_every_share_link_shape() {
     let golden = entity_link_golden();
diff --git a/desktop/src-tauri/src/huddle/models.rs b/desktop/src-tauri/src/huddle/models.rs
index f9f70657698..09154d5237d 100644
--- a/desktop/src-tauri/src/huddle/models.rs
+++ b/desktop/src-tauri/src/huddle/models.rs
@@ -587,6 +587,10 @@ fn tts_model_slot() -> ModelSlot {
         .with_expected_sizes(tts_expected_size)
 }
 
+fn models_dir(nest_dir: PathBuf) -> PathBuf {
+    nest_dir.join("models")
+}
+
 // ── ModelManager ──────────────────────────────────────────────────────────────
 
 /// Manages download and location of STT/TTS model files.
@@ -594,18 +598,18 @@ fn tts_model_slot() -> ModelSlot {
 /// Cheap to clone — all inner state is behind `Arc`.
 #[derive(Clone)]
 pub struct ModelManager {
-    /// `~/.buzz/models/`
+    /// Model storage under the selected build's nest.
     models_dir: PathBuf,
     stt: ModelSlot,
     tts: ModelSlot,
 }
 
 impl ModelManager {
-    /// Create a new `ModelManager` rooted at `~/.buzz/models/`.
+    /// Create a new `ModelManager` rooted in the selected build's nest.
     ///
-    /// Returns `None` if the home directory cannot be resolved.
+    /// Returns `None` if the nest directory cannot be resolved.
     pub fn new() -> Option<Self> {
-        let models_dir = dirs::home_dir()?.join(".buzz").join("models");
+        let models_dir = models_dir(crate::managed_agents::nest_dir()?);
         let manager = Self {
             models_dir,
             stt: ModelSlot::new(STT_MODEL_DIR_NAME, STT_EXPECTED_FILES, STT_MODEL_VERSION),
diff --git a/desktop/src-tauri/src/huddle/models_tests.rs b/desktop/src-tauri/src/huddle/models_tests.rs
index 699ffbe459f..5f70b1f3f3a 100644
--- a/desktop/src-tauri/src/huddle/models_tests.rs
+++ b/desktop/src-tauri/src/huddle/models_tests.rs
@@ -1,5 +1,18 @@
 use super::*;
 
+#[test]
+fn voice_models_follow_the_selected_build_nest() {
+    let home = PathBuf::from("/Users/example");
+    for nest_name in [
+        ".buzz",
+        ".buzz-demo-workstream-board",
+        ".buzz-demo-second-demo",
+    ] {
+        let nest = home.join(nest_name);
+        assert_eq!(models_dir(nest.clone()), nest.join("models"));
+    }
+}
+
 fn create_ready_model_dir(root: &Path) -> PathBuf {
     let model_dir = root.join(TTS_MODEL_DIR_NAME);
     std::fs::create_dir_all(&model_dir).expect("create model dir");
diff --git a/desktop/src-tauri/src/lib.rs b/desktop/src-tauri/src/lib.rs
index bb9e90525b0..b9837551e43 100644
--- a/desktop/src-tauri/src/lib.rs
+++ b/desktop/src-tauri/src/lib.rs
@@ -3,6 +3,7 @@ mod adopt_buzz_data;
 mod app_menu;
 mod app_state;
 mod archive;
+mod build_identity;
 mod builderlab;
 mod channel_head_cache;
 mod commands;
@@ -126,7 +127,7 @@ pub fn run() {
             }
             // Forward any deep link URLs from the duplicate launch.
             for arg in &argv {
-                if arg.starts_with("buzz://") {
+                if crate::build_identity::is_deep_link_for_build(arg) {
                     handle_deep_link_url(app, arg);
                 }
             }
@@ -347,7 +348,10 @@ pub fn run() {
             // the now-inert ~/.sprout; the frontend dedupes the toast.
             // Suppressed when a reset completed this boot: the nest was wiped and
             // a fresh ~/.sprout-less state is exactly what we want.
-            if !reset_outcome.completed && migration::migrate_legacy_nest() {
+            if !crate::build_identity::is_demo_build()
+                && !reset_outcome.completed
+                && migration::migrate_legacy_nest()
+            {
                 let _ = app_handle.emit("legacy-nest-migrated", ());
             }
 
diff --git a/desktop/src-tauri/src/managed_agents/nest.rs b/desktop/src-tauri/src/managed_agents/nest.rs
index f4c263e3f30..3bcdc12b93a 100644
--- a/desktop/src-tauri/src/managed_agents/nest.rs
+++ b/desktop/src-tauri/src/managed_agents/nest.rs
@@ -63,12 +63,6 @@ const CANONICAL_SKILL_DIR: &str = ".agents/skills/buzz-cli";
 /// Nest directory name for production builds.
 const NEST_DIR_PROD: &str = ".buzz";
 
-/// Nest directory name for dev builds. Dev builds (those whose Tauri app-data
-/// directory name starts with `"xyz.block.buzz.app.dev"`) use a separate nest
-/// so that the DMG and dev-build instances don't clobber each other's
-/// `.repos-dir` dotfile and `REPOS` symlink.
-const NEST_DIR_DEV: &str = ".buzz-dev";
-
 /// Process-lifetime nest directory. Initialized once at startup via
 /// [`init_nest_dir`] before any call to [`nest_dir`].
 ///
@@ -88,8 +82,8 @@ static NEST_DIR: std::sync::OnceLock<Option<PathBuf>> = std::sync::OnceLock::new
 /// when the Tauri app-data directory name starts with `"xyz.block.buzz.app.dev"`.
 /// Pass `false` for production (signed DMG) builds.
 pub fn init_nest_dir(is_dev: bool) {
-    let suffix = if is_dev { NEST_DIR_DEV } else { NEST_DIR_PROD };
-    let path = dirs::home_dir().map(|h| h.join(suffix));
+    let suffix = crate::build_identity::nest_name(is_dev);
+    let path = dirs::home_dir().map(|h| h.join(suffix.as_ref()));
     // set() is a no-op when already initialized, which is correct: only the
     // first call (at boot, before any filesystem work) should win.
     let _ = NEST_DIR.set(path);
@@ -315,12 +309,8 @@ fn ensure_skill_symlinks(_root: &Path) -> Result<(), String> {
 /// Dev builds (`is_dev = true`) use `"buzz-dev"` so that a running DMG and a
 /// concurrent dev build each own a separate link and never clobber each other —
 /// the same isolation that separates `~/.buzz` (prod) from `~/.buzz-dev` (dev).
-pub fn cli_link_name(is_dev: bool) -> &'static str {
-    if is_dev {
-        "buzz-dev"
-    } else {
-        "buzz"
-    }
+pub fn cli_link_name(is_dev: bool) -> String {
+    crate::build_identity::cli_name(is_dev)
 }
 
 /// Ensures `~/.local/bin/buzz` (prod) or `~/.local/bin/buzz-dev` (dev) is a
diff --git a/desktop/src-tauri/src/managed_agents/nest/tests.rs b/desktop/src-tauri/src/managed_agents/nest/tests.rs
index 9aa1eeb0985..7d54c5a7b07 100644
--- a/desktop/src-tauri/src/managed_agents/nest/tests.rs
+++ b/desktop/src-tauri/src/managed_agents/nest/tests.rs
@@ -7,7 +7,7 @@ fn nest_dir_is_under_home() {
         // whether init_nest_dir was called before this test ran.
         let name = dir.file_name().and_then(|n| n.to_str()).unwrap_or("");
         assert!(
-            name == NEST_DIR_PROD || name == NEST_DIR_DEV,
+            name == NEST_DIR_PROD || name == crate::build_identity::nest_name(true),
             "nest_dir must end with .buzz or .buzz-dev, got {dir:?}"
         );
     }
@@ -23,7 +23,7 @@ fn init_nest_dir_prod_sets_buzz() {
     if let Some(d) = dir {
         let name = d.file_name().and_then(|n| n.to_str()).unwrap_or("");
         assert!(
-            name == NEST_DIR_PROD || name == NEST_DIR_DEV,
+            name == NEST_DIR_PROD || name == crate::build_identity::nest_name(true),
             "nest_dir suffix must be .buzz or .buzz-dev, got {d:?}"
         );
     }
@@ -357,13 +357,19 @@ fn ensure_skill_symlinks_skip_dangling_symlink() {
 }
 
 #[test]
-fn cli_link_name_prod_is_buzz() {
-    assert_eq!(cli_link_name(false), "buzz");
+fn cli_link_name_prod_follows_build_identity() {
+    let expected = crate::build_identity::demo_slug()
+        .map(|slug| format!("buzz-demo-{slug}"))
+        .unwrap_or_else(|| "buzz".to_string());
+    assert_eq!(cli_link_name(false), expected);
 }
 
 #[test]
-fn cli_link_name_dev_is_buzz_dev() {
-    assert_eq!(cli_link_name(true), "buzz-dev");
+fn cli_link_name_dev_follows_build_identity() {
+    let expected = crate::build_identity::demo_slug()
+        .map(|slug| format!("buzz-demo-{slug}"))
+        .unwrap_or_else(|| "buzz-dev".to_string());
+    assert_eq!(cli_link_name(true), expected);
 }
 
 #[cfg(unix)]
@@ -395,8 +401,8 @@ fn ensure_cli_symlink_creates_symlink_dev() {
     let local_bin = tmp.path().join("local_bin");
     fs::create_dir_all(&local_bin).unwrap();
 
-    // Dev link must be "buzz-dev", never "buzz".
-    assert_eq!(cli_link_name(true), "buzz-dev");
+    // Dev and demo links must never overwrite production's "buzz".
+    assert_ne!(cli_link_name(true), "buzz");
 
     let link = local_bin.join(cli_link_name(true));
     std::os::unix::fs::symlink(exe_parent.join("buzz"), &link).unwrap();
diff --git a/desktop/src-tauri/src/managed_agents/reserved_env_keys.rs b/desktop/src-tauri/src/managed_agents/reserved_env_keys.rs
index bbb8a8962f3..175deb5a193 100644
--- a/desktop/src-tauri/src/managed_agents/reserved_env_keys.rs
+++ b/desktop/src-tauri/src/managed_agents/reserved_env_keys.rs
@@ -74,6 +74,9 @@ pub(crate) const RESERVED_ENV_KEYS: &[&str] = &[
     // losing the waking mention, or making every ordinary start replay up
     // to 15 minutes of already-handled traffic.
     "BUZZ_ACP_REPLAY_FLOOR",
+    // Demo-build identity owns the child agent config root. A user override
+    // could silently reconnect a demo harness to production OAuth state.
+    "BUZZ_AGENT_CONFIG_DIR",
     // Desktop ownership markers: these brand every spawned harness with the
     // launching Desktop instance. A user-supplied override would let a
     // definition masquerade as a different instance or fake the nonce used
diff --git a/desktop/src-tauri/src/managed_agents/runtime.rs b/desktop/src-tauri/src/managed_agents/runtime.rs
index e1d5e848e99..faeda2566b7 100644
--- a/desktop/src-tauri/src/managed_agents/runtime.rs
+++ b/desktop/src-tauri/src/managed_agents/runtime.rs
@@ -515,7 +515,6 @@ pub fn spawn_agent_child(
     // The caller supplies the explicit canonical pair relay. This is the only
     // relay this child may connect to, regardless of the record/workspace default.
     let effective_relay_url = runtime_key.relay_url.clone();
-
     // Augment PATH for DMG launches so child processes can find:
     //   - bundled CLI via ~/.local/bin symlink
     //   - nvm-managed node/npm (nvm initializes only in interactive shells)
@@ -799,6 +798,7 @@ pub fn spawn_agent_child(
     for (key, value) in &descriptor.env {
         command.env(key, value);
     }
+    crate::build_identity::apply_demo_config_home(&mut command)?;
 
     // B5: carry persisted effort; harness resolves thought_level configId at first session.
     // Written AFTER descriptor.env so the canonical persisted value wins over any
diff --git a/desktop/src-tauri/src/migration.rs b/desktop/src-tauri/src/migration.rs
index 1c256d54eec..e49c09cbd9b 100644
--- a/desktop/src-tauri/src/migration.rs
+++ b/desktop/src-tauri/src/migration.rs
@@ -129,10 +129,9 @@ pub fn run_boot_migrations_after_reset(app: &tauri::AppHandle) {
 }
 
 fn run_boot_migrations_inner(app: &tauri::AppHandle, reset_completed: bool) {
-    // Initialize the process-lifetime nest directory before any filesystem
-    // operation that calls nest_dir(). The discriminator matches the existing
-    // pattern used by reconcile_target_dir: dev instances have an app-data-dir
-    // name starting with CANONICAL_DEV_IDENTIFIER.
+    // Initialize the process-lifetime nest directory before filesystem access
+    // that calls nest_dir(). The discriminator matches reconcile_target_dir:
+    // dev instances have an app-data-dir name starting with CANONICAL_DEV_IDENTIFIER.
     let is_dev = if let Ok(data_dir) = app.path().app_data_dir() {
         let dev = data_dir
             .file_name()
@@ -144,18 +143,18 @@ fn run_boot_migrations_inner(app: &tauri::AppHandle, reset_completed: bool) {
         false
     };
 
-    // On dev builds, copy `.repos-dir` from ~/.buzz → ~/.buzz-dev BEFORE
-    // control returns to lib.rs where resolve_repos_at_boot() reads it. This
-    // ensures the dev nest boots with the correct workspace on its first launch,
-    // matching what the prod nest had configured. Skip-if-dest-exists so it is
-    // idempotent and never clobbers a value the dev nest already set explicitly.
-    // Uses the composed helper so gate + migration share the tested code path.
+    // On dev builds, copy `.repos-dir` from ~/.buzz → ~/.buzz-dev before
+    // resolve_repos_at_boot() reads it. Skip-if-dest-exists so it is idempotent
+    // and never clobbers a value the dev nest already set explicitly.
+    // The composed helper keeps gate + migration on the tested code path.
     if let (Some(home), Some(dev_nest)) = (dirs::home_dir(), crate::managed_agents::nest_dir()) {
         maybe_migrate_dev_repos_dir(is_dev, reset_completed, &home, &dev_nest);
     }
 
-    migrate_legacy_app_data_dir(app);
-    sync_shared_agent_data(app);
+    if !crate::build_identity::is_demo_build() {
+        migrate_legacy_app_data_dir(app);
+        sync_shared_agent_data(app);
+    }
     // Dev-build-only: copy any agent keys that exist in the production
     // keyring ("buzz-desktop") into the dev service ("buzz-desktop-dev")
     // so existing agents don't lose their keys after the service-name split.
diff --git a/desktop/src-tauri/src/reset.rs b/desktop/src-tauri/src/reset.rs
index 18ddd80eb8d..401d63c9c49 100644
--- a/desktop/src-tauri/src/reset.rs
+++ b/desktop/src-tauri/src/reset.rs
@@ -104,6 +104,11 @@ pub(crate) struct ResetContext<'a> {
     pub keychain: &'a dyn ResetKeychain,
     pub home_dir: Option<PathBuf>,
     pub is_dev: bool,
+    /// Build-owned config root for demos. Production leaves this unset.
+    pub demo_config_dir: Option<PathBuf>,
+    /// Demo builds own only build-scoped state and must never delete shared
+    /// production or legacy agent roots.
+    pub is_demo: bool,
 }
 
 /// Entry point called from `lib.rs` setup (before migrations).
@@ -126,6 +131,16 @@ pub(crate) fn run_boot_reset(app_data_dir: &Path) -> ResetOutcome {
     let legacy_dir = crate::migration::legacy_app_data_dir(app_data_dir);
     let nest_dir = crate::managed_agents::nest_dir();
 
+    let demo_config_dir = match crate::build_identity::demo_config_home() {
+        Ok(dir) => dir,
+        Err(error) => {
+            eprintln!("buzz-desktop reset: {error}");
+            return ResetOutcome {
+                completed: false,
+                failed: true,
+            };
+        }
+    };
     let ctx = ResetContext {
         app_data_dir,
         legacy_app_data_dir: legacy_dir,
@@ -133,6 +148,8 @@ pub(crate) fn run_boot_reset(app_data_dir: &Path) -> ResetOutcome {
         keychain: &store,
         home_dir,
         is_dev,
+        demo_config_dir,
+        is_demo: crate::build_identity::is_demo_build(),
     };
 
     run_boot_reset_with_keychain(ctx)
@@ -166,6 +183,15 @@ fn rename_to_trash(src: &Path) -> Result<PathBuf, String> {
 
 /// Core wipe logic — separated for testing.
 pub(crate) fn run_boot_reset_with_keychain(ctx: ResetContext<'_>) -> ResetOutcome {
+    // An unknown demo credential root is not evidence of an absent root. Refuse
+    // before any destructive work and retain reset intent for the next boot.
+    if ctx.is_demo && ctx.demo_config_dir.is_none() {
+        eprintln!("buzz-desktop reset: cannot resolve demo credential directory");
+        return ResetOutcome {
+            completed: false,
+            failed: true,
+        };
+    }
     let app_data_dir = ctx.app_data_dir;
 
     // ── Step 1: rename app-data dir (atomic — sentinel survives the parent) ──
@@ -211,13 +237,34 @@ pub(crate) fn run_boot_reset_with_keychain(ctx: ResetContext<'_>) -> ResetOutcom
         None
     };
 
-    // ── Step 3: remove nest, ~/.sprout, ~/.config/buzz-agent, CLI symlink ────
+    // ── Step 3: remove build-owned nest and CLI symlink ──────────────────────
+    // Production and dev preserve their existing legacy/global cleanup. A demo
+    // never owns these shared roots, so signing out of one must leave them
+    // available to production and every other demo.
     if let Some(ref nest) = ctx.nest_dir {
         let _ = std::fs::remove_dir_all(nest);
     }
+    // A demo owns credentials here. Failure to remove them must keep the reset
+    // pending, even if the app data and keychain were successfully wiped.
+    let demo_config_removed =
+        ctx.demo_config_dir
+            .as_ref()
+            .is_none_or(|path| match std::fs::remove_dir_all(path) {
+                Ok(()) => true,
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => true,
+                Err(error) => {
+                    eprintln!(
+                        "buzz-desktop reset: remove demo config {}: {error}",
+                        path.display()
+                    );
+                    false
+                }
+            });
     if let Some(ref home) = ctx.home_dir {
-        let _ = std::fs::remove_dir_all(home.join(".sprout"));
-        let _ = std::fs::remove_dir_all(home.join(".config").join("buzz-agent"));
+        if !ctx.is_demo {
+            let _ = std::fs::remove_dir_all(home.join(".sprout"));
+            let _ = std::fs::remove_dir_all(home.join(".config").join("buzz-agent"));
+        }
         let link_name = crate::managed_agents::cli_link_name(ctx.is_dev);
         let _ = std::fs::remove_file(home.join(".local").join("bin").join(link_name));
     }
@@ -273,6 +320,11 @@ pub(crate) fn run_boot_reset_with_keychain(ctx: ResetContext<'_>) -> ResetOutcom
         .map(|p| !p.exists())
         .unwrap_or(true);
     let nest_gone = ctx.nest_dir.as_ref().map(|n| !n.exists()).unwrap_or(true);
+    // `exists()` treats metadata errors as absence. Only NotFound establishes
+    // that credentials are gone; a dangling symlink is not an absent root.
+    let demo_config_gone = ctx.demo_config_dir.as_ref().is_none_or(|path| {
+        matches!(std::fs::symlink_metadata(path), Err(error) if error.kind() == std::io::ErrorKind::NotFound)
+    });
     let trash_app_gone = !trash_app.exists();
     let trash_legacy_gone = trash_legacy.as_ref().map(|p| !p.exists()).unwrap_or(true);
     let trash_webkit_gone = trash_webkit.as_ref().map(|p| !p.exists()).unwrap_or(true);
@@ -281,6 +333,8 @@ pub(crate) fn run_boot_reset_with_keychain(ctx: ResetContext<'_>) -> ResetOutcom
         || !app_data_gone
         || !legacy_gone
         || !nest_gone
+        || !demo_config_removed
+        || !demo_config_gone
         || !trash_app_gone
         || !trash_legacy_gone
         || !trash_webkit_gone
@@ -288,6 +342,7 @@ pub(crate) fn run_boot_reset_with_keychain(ctx: ResetContext<'_>) -> ResetOutcom
         eprintln!(
             "buzz-desktop reset: verification failed (keychain_wiped={keychain_ok}, \
              app_data_gone={app_data_gone}, legacy_gone={legacy_gone}, nest_gone={nest_gone}, \
+             demo_config_removed={demo_config_removed}, demo_config_gone={demo_config_gone}, \
              trash_app_gone={trash_app_gone}, trash_legacy_gone={trash_legacy_gone}, \
              trash_webkit_gone={trash_webkit_gone})"
         );
@@ -318,6 +373,10 @@ mod tests {
     use std::cell::Cell;
     use tempfile::TempDir;
 
+    mod demo {
+        include!("reset_demo_tests.rs");
+    }
+
     // ── Fake keychain ─────────────────────────────────────────────────────────
 
     struct FakeKeychain {
@@ -408,6 +467,8 @@ mod tests {
             keychain,
             home_dir: None, // skip nest/sprout/CLI ops in unit tests
             is_dev,
+            demo_config_dir: None,
+            is_demo: false,
         }
     }
 
@@ -451,6 +512,8 @@ mod tests {
             keychain: &kc,
             home_dir: None,
             is_dev: false,
+            demo_config_dir: None,
+            is_demo: false,
         };
 
         let outcome = run_boot_reset_with_keychain(ctx);
@@ -584,6 +647,8 @@ mod tests {
             keychain: &kc,
             home_dir: None,
             is_dev: true,
+            demo_config_dir: None,
+            is_demo: false,
         };
 
         let outcome = run_boot_reset_with_keychain(ctx);
@@ -620,6 +685,8 @@ mod tests {
             keychain: &kc,
             home_dir: None,
             is_dev: false,
+            demo_config_dir: None,
+            is_demo: false,
         };
 
         let outcome = run_boot_reset_with_keychain(ctx);
@@ -653,6 +720,8 @@ mod tests {
             keychain: &kc,
             home_dir: None,
             is_dev: false,
+            demo_config_dir: None,
+            is_demo: false,
         };
 
         let outcome = run_boot_reset_with_keychain(ctx);
@@ -736,6 +805,8 @@ mod tests {
             keychain: &kc,
             home_dir: None,
             is_dev: true,
+            demo_config_dir: None,
+            is_demo: false,
         };
         let outcome = run_boot_reset_with_keychain(ctx);
         assert!(outcome.completed, "reset must complete");
@@ -830,6 +901,8 @@ mod tests {
             keychain: &kc1,
             home_dir: Some(tmp.path().to_path_buf()),
             is_dev: false,
+            demo_config_dir: None,
+            is_demo: false,
         };
         let first = run_boot_reset_with_keychain(ctx1);
         assert!(first.failed, "first attempt must fail");
@@ -853,6 +926,8 @@ mod tests {
             keychain: &kc2,
             home_dir: Some(tmp.path().to_path_buf()),
             is_dev: false,
+            demo_config_dir: None,
+            is_demo: false,
         };
         let second = run_boot_reset_with_keychain(ctx2);
         assert!(second.completed, "second attempt must complete");
diff --git a/desktop/src-tauri/src/reset_demo_tests.rs b/desktop/src-tauri/src/reset_demo_tests.rs
new file mode 100644
index 00000000000..9db2ab3dc74
--- /dev/null
+++ b/desktop/src-tauri/src/reset_demo_tests.rs
@@ -0,0 +1,169 @@
+use super::*;
+
+#[test]
+fn test_demo_reset_preserves_shared_and_other_build_state() {
+    let tmp = TempDir::new().unwrap();
+    let home = tmp.path().join("home");
+    let app_data = tmp
+        .path()
+        .join("Application Support")
+        .join("xyz.block.buzz.app.demo.current-1234567812345678");
+    let demo_nest = home.join(".buzz-demo-current-1234567812345678");
+    let prod_nest = home.join(".buzz");
+    let other_demo_nest = home.join(".buzz-demo-other-8765432187654321");
+    let shared_sprout = home.join(".sprout");
+    let shared_agent = home.join(".config").join("buzz-agent");
+    let demo_config = home
+        .join("Library")
+        .join("Application Support")
+        .join("buzz-demo-current-1234567812345678");
+    let demo_oauth = demo_config.join("buzz-agent").join("oauth");
+    let other_demo_config = home
+        .join("Library")
+        .join("Application Support")
+        .join("buzz-demo-other-8765432187654321");
+    let other_demo_oauth = other_demo_config.join("buzz-agent").join("oauth");
+
+    for path in [
+        &app_data,
+        &demo_nest,
+        &prod_nest,
+        &other_demo_nest,
+        &shared_sprout,
+        &shared_agent,
+        &demo_oauth,
+        &other_demo_oauth,
+    ] {
+        std::fs::create_dir_all(path).unwrap();
+    }
+    write_sentinel(&app_data).unwrap();
+
+    let kc = FakeKeychain::ok();
+    let ctx = ResetContext {
+        app_data_dir: &app_data,
+        legacy_app_data_dir: None,
+        nest_dir: Some(demo_nest.clone()),
+        keychain: &kc,
+        home_dir: Some(home),
+        is_dev: false,
+        demo_config_dir: Some(demo_config.clone()),
+        is_demo: true,
+    };
+
+    let outcome = run_boot_reset_with_keychain(ctx);
+
+    assert!(outcome.completed, "demo reset must complete");
+    assert!(!app_data.exists(), "demo app data must be wiped");
+    assert!(!demo_nest.exists(), "selected demo nest must be wiped");
+    assert!(
+        !demo_config.exists(),
+        "selected demo auth root must be wiped"
+    );
+    assert!(
+        other_demo_oauth.exists(),
+        "another demo's concrete auth root must survive"
+    );
+    assert!(prod_nest.exists(), "production nest must survive");
+    assert!(other_demo_nest.exists(), "another demo nest must survive");
+    assert!(shared_sprout.exists(), "shared legacy state must survive");
+    assert!(
+        shared_agent.exists(),
+        "shared agent auth state must survive"
+    );
+}
+
+#[test]
+fn demo_config_delete_failure_keeps_sentinel_until_retry() {
+    let tmp = TempDir::new().unwrap();
+    let app_data = make_app_data(&tmp);
+    let config = tmp.path().join("demo-config");
+    let production = tmp.path().join("production/oauth/token.json");
+    let sibling = tmp.path().join("sibling/oauth/token.json");
+    for path in [&production, &sibling] {
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, "preserve").unwrap();
+    }
+    // A file at the directory path makes remove_dir_all fail on every platform,
+    // independent of the test user's privileges.
+    std::fs::write(&config, "obstruction").unwrap();
+    write_sentinel(&app_data).unwrap();
+    let kc = FakeKeychain::ok();
+    let run = || {
+        let mut ctx = make_ctx(&app_data, &kc, false);
+        ctx.is_demo = true;
+        ctx.demo_config_dir = Some(config.clone());
+        run_boot_reset_with_keychain(ctx)
+    };
+    let first = run();
+    assert!(first.failed && !first.completed);
+    assert!(check_sentinel(&app_data));
+    assert!(config.exists());
+
+    std::fs::remove_file(&config).unwrap();
+    let token = config.join("buzz-agent/oauth/databricks/token.json");
+    std::fs::create_dir_all(token.parent().unwrap()).unwrap();
+    std::fs::write(&token, "demo credential").unwrap();
+    let second = run();
+    assert!(second.completed && !second.failed);
+    assert!(!check_sentinel(&app_data));
+    assert!(!config.exists());
+    for path in [&production, &sibling] {
+        assert_eq!(std::fs::read_to_string(path).unwrap(), "preserve");
+    }
+    // A retry after a crash that already removed the root must also succeed.
+    write_sentinel(&app_data).unwrap();
+    assert!(run().completed);
+    assert!(!check_sentinel(&app_data));
+}
+
+#[cfg(unix)]
+#[test]
+fn demo_oauth_permission_failure_preserves_retry_intent() {
+    use std::os::unix::fs::PermissionsExt;
+
+    let tmp = TempDir::new().unwrap();
+    let app_data = make_app_data(&tmp);
+    let config = tmp.path().join("demo-config");
+    let oauth = config.join("buzz-agent/oauth/databricks");
+    let token = oauth.join("token.json");
+    std::fs::create_dir_all(&oauth).unwrap();
+    std::fs::write(&token, "demo credential").unwrap();
+    write_sentinel(&app_data).unwrap();
+    let kc = FakeKeychain::ok();
+    let run = || {
+        let mut ctx = make_ctx(&app_data, &kc, false);
+        ctx.is_demo = true;
+        ctx.demo_config_dir = Some(config.clone());
+        run_boot_reset_with_keychain(ctx)
+    };
+    std::fs::set_permissions(&oauth, std::fs::Permissions::from_mode(0o500)).unwrap();
+    let first = run();
+    // Restore permissions before assertions so a failure never leaves test debris.
+    if oauth.exists() {
+        std::fs::set_permissions(&oauth, std::fs::Permissions::from_mode(0o700)).unwrap();
+    }
+    assert!(first.failed && !first.completed);
+    assert!(check_sentinel(&app_data));
+    assert_eq!(std::fs::read_to_string(&token).unwrap(), "demo credential");
+    assert!(run().completed);
+    assert!(!config.exists());
+    assert!(!check_sentinel(&app_data));
+}
+
+#[test]
+fn unresolved_demo_config_keeps_reset_pending_without_deleting_state() {
+    let tmp = TempDir::new().unwrap();
+    let app_data = make_app_data(&tmp);
+    write_sentinel(&app_data).unwrap();
+    let kc = FakeKeychain::ok();
+    let mut ctx = make_ctx(&app_data, &kc, false);
+    ctx.is_demo = true;
+    assert!(ctx.demo_config_dir.is_none());
+    let outcome = run_boot_reset_with_keychain(ctx);
+    assert!(outcome.failed && !outcome.completed);
+    assert!(check_sentinel(&app_data));
+    assert!(
+        app_data.exists(),
+        "unresolved root must refuse before wiping"
+    );
+}
diff --git a/desktop/src/features/agents/AGENTS.md b/desktop/src/features/agents/AGENTS.md
index 14d23a342a9..3506824450d 100644
--- a/desktop/src/features/agents/AGENTS.md
+++ b/desktop/src/features/agents/AGENTS.md
@@ -281,7 +281,7 @@ with a TypeScript lookup table or an id comparison in a component.
     refresh only local persona/team/managed-agent caches; they must never
     invalidate the remote relay directory.
 
-17. **Databricks model discovery has one shared catalog authority.** Desktop and ACP call the shared `buzz-agent` discovery library; Desktop passes the effective merged `DATABRICKS_MODEL_FILTER` explicitly, and the library applies it to raw workspace endpoint IDs and Unity Catalog model-service FQNs after the additive union. A successful filtered-empty catalog is authoritative: it stays empty, disables switching, and never falls through to configured or known-model fallback. UC FQNs are catalog data and always use the MLflow Chat Completions route, regardless of family-looking text in their components.
+17. **Databricks model discovery has one shared catalog authority.** Desktop and ACP call the shared `buzz-agent` discovery library; Desktop passes the effective merged `DATABRICKS_MODEL_FILTER` explicitly, and the library applies it to raw workspace endpoint IDs and Unity Catalog model-service FQNs after the additive union. A successful filtered-empty catalog is authoritative: it stays empty, disables switching, and never falls through to configured or known-model fallback. UC FQNs are catalog data and always use the MLflow Chat Completions route, regardless of family-looking text in their components. Global Defaults preserves the discovered model ID as the selected value while its closed trigger renders the provider-scoped display label; do not force the raw persisted ID over that label.
 
 ## The tests that enforce this
 
diff --git a/desktop/src/features/agents/ui/AgentConfigFields.tsx b/desktop/src/features/agents/ui/AgentConfigFields.tsx
index 295c37f23c8..52a58c91343 100644
--- a/desktop/src/features/agents/ui/AgentConfigFields.tsx
+++ b/desktop/src/features/agents/ui/AgentConfigFields.tsx
@@ -818,7 +818,6 @@ export function AgentConfigFields({
               fallbackModel === null &&
               !dependentFieldsDisabled
             }
-            keepSelectedModelValueLabel
             model={dependentFieldsDisabled ? "" : (config.model ?? "")}
             modelDiscoveryLoading={
               dependentFieldsDisabled ? false : modelDiscoveryLoading
diff --git a/desktop/src/features/agents/ui/agentConfigControls.tsx b/desktop/src/features/agents/ui/agentConfigControls.tsx
index 1a431d1f914..677db669a34 100644
--- a/desktop/src/features/agents/ui/agentConfigControls.tsx
+++ b/desktop/src/features/agents/ui/agentConfigControls.tsx
@@ -339,7 +339,6 @@ export function AgentModelField({
   allowDefaultModel = true,
   defaultModelLabel,
   disableSelectDuringDiscovery = true,
-  keepSelectedModelValueLabel = false,
   id = "agent-model",
   isCustomModelEditing,
   isRequired,
@@ -371,8 +370,6 @@ export function AgentModelField({
   defaultModelLabel?: string;
   /** Disable the trigger while live model discovery refreshes the option list. */
   disableSelectDuringDiscovery?: boolean;
-  /** Keep the closed trigger from swapping to discovered display labels. */
-  keepSelectedModelValueLabel?: boolean;
   /** DOM id for the model select. Defaults to `"agent-model"`. Override in
    *  contexts where multiple instances coexist on the same page (e.g. the
    *  global-config settings card) to avoid duplicate DOM ids. */
@@ -513,12 +510,6 @@ export function AgentModelField({
   // yields an empty list and discovery has finished, add a disabled sentinel
   // row so the user sees "No models found" instead of a bare white bar.
   appendNoModelsSentinel(modelOptions, modelDiscoveryLoading);
-  const stableSelectedModelLabel =
-    keepSelectedModelValueLabel &&
-    modelSelectValue === trimmedModel &&
-    trimmedModel.length > 0
-      ? trimmedModel
-      : undefined;
   // While discovery is in flight with nothing selected, the closed field
   // reads "Loading models…" instead of a select-prompt — the field isn't
   // waiting on the user, it's waiting on the harness.
@@ -547,7 +538,6 @@ export function AgentModelField({
       placeholder={restingPlaceholder}
       placeholderClassName={placeholderClassName}
       searchable
-      selectedLabel={stableSelectedModelLabel}
       testId={testId ?? id}
       value={modelSelectValue}
     />
diff --git a/desktop/src/features/agents/ui/modelCapabilitiesCorpus.test.mjs b/desktop/src/features/agents/ui/modelCapabilitiesCorpus.test.mjs
index 8d75b71d491..492c1cd6acf 100644
--- a/desktop/src/features/agents/ui/modelCapabilitiesCorpus.test.mjs
+++ b/desktop/src/features/agents/ui/modelCapabilitiesCorpus.test.mjs
@@ -25,10 +25,10 @@ const corpus = JSON.parse(readFileSync(fileURLToPath(corpusUrl), "utf8"));
 // (`_group`) are skipped. Mirrors the Rust corpus filter.
 const executable = corpus.filter((entry) => entry.expect != null);
 
-test("corpus has exactly 135 executable vectors", () => {
+test("corpus has exactly 139 executable vectors", () => {
   // Locks the vector count so a silent corpus edit can't quietly drop coverage;
   // must equal the gate in the Rust suite (model_capabilities.rs).
-  assert.equal(executable.length, 135);
+  assert.equal(executable.length, 139);
 });
 
 test("registry label aliases refuse an unprefixed query", () => {
@@ -50,6 +50,9 @@ test("UC model-family FQNs and goose- aliases humanize onto their base records",
   // must resolve onto the same base databricks_v2 records via the new family
   // tokens. Mirrors the Rust `test_databricks_registry_label_lookup` coverage.
   const cases = [
+    ["goose-claude-4-6-sonnet", "Claude Sonnet 4.6"],
+    ["goose-claude-4-7-opus", "Claude Opus 4.7"],
+    ["goose-kimi-2-7", "Kimi 2.7"],
     ["system.ai.gemini-3-5-flash", "Gemini 3.5 Flash"],
     ["system.ai.gemini-3-pro-image", "Gemini 3 Pro Image"],
     ["system.ai.deepseek-v4-pro-0813", "DeepSeek V4 Pro"],
@@ -65,6 +68,7 @@ test("UC model-family FQNs and goose- aliases humanize onto their base records",
       "data_workflow_tools.goose.goose-deepseek-v4-flash-0731",
       "DeepSeek V4 Flash",
     ],
+    ["data_workflow_tools.goose.goose-glm-5-3", "GLM-5.3"],
     ["data_workflow_tools.goose.goose-glm-5-3-flash", "GLM-5.3 Flash"],
     ["data_workflow_tools.goose.goose-grok-4-6", "Grok 4.6"],
   ];
diff --git a/desktop/src/features/forum/ui/ForumComposer.tsx b/desktop/src/features/forum/ui/ForumComposer.tsx
index 53b09cfd1dd..03fb365ebdd 100644
--- a/desktop/src/features/forum/ui/ForumComposer.tsx
+++ b/desktop/src/features/forum/ui/ForumComposer.tsx
@@ -5,6 +5,7 @@ import { ChevronDown } from "lucide-react";
 import { buildOutgoingMessage } from "@/features/messages/lib/imetaMediaMarkdown";
 import { useChannelLinks } from "@/features/messages/lib/useChannelLinks";
 import type { ChannelSuggestion } from "@/features/messages/lib/useChannelLinks";
+import { useComposerFocusOwnership } from "@/features/messages/lib/useComposerFocusOwnership";
 import { useMediaUpload } from "@/features/messages/lib/useMediaUpload";
 import { isMentionCodeContext } from "@/features/messages/lib/mentionCodeContext";
 import { useMentions } from "@/features/messages/lib/useMentions";
@@ -101,6 +102,8 @@ export function ForumComposer({
     mentions.isMentionOpen || channelLinks.isChannelOpen;
 
   const submitMessageRef = React.useRef<() => void>(() => {});
+  const formRef = React.useRef<HTMLFormElement>(null);
+  const composerOwnsFocus = useComposerFocusOwnership(formRef);
 
   // Set after `useLinkEditor` exists; the editor's link-click handler
   // delegates through this ref to break the hook ordering cycle.
@@ -500,6 +503,7 @@ export function ForumComposer({
         }}
         onFocusCapture={expandCompactComposer}
         onSubmit={handleSubmit}
+        ref={formRef}
       >
         {media.isDragOver && <DropZoneOverlay />}
         {isCompactLayout ? (
@@ -526,6 +530,7 @@ export function ForumComposer({
                   ? channelLinks.channelSuggestions
                   : []
               }
+              composerOwnsFocus={composerOwnsFocus}
               mentionSelectedIndex={mentions.mentionSelectedIndex}
               mentionSuggestions={
                 mentions.isMentionOpen ? mentions.suggestions : []
diff --git a/desktop/src/features/forum/ui/ForumComposerAutocompletes.tsx b/desktop/src/features/forum/ui/ForumComposerAutocompletes.tsx
index 149eec7b91c..e3a63e7dd58 100644
--- a/desktop/src/features/forum/ui/ForumComposerAutocompletes.tsx
+++ b/desktop/src/features/forum/ui/ForumComposerAutocompletes.tsx
@@ -8,6 +8,7 @@ import {
 type ForumComposerAutocompletesProps = {
   channelSelectedIndex: number;
   channelSuggestions: ChannelSuggestion[];
+  composerOwnsFocus: boolean;
   mentionSelectedIndex: number;
   mentionSuggestions: MentionSuggestion[];
   onChannelSelect: (suggestion: ChannelSuggestion) => void;
@@ -20,6 +21,7 @@ type ForumComposerAutocompletesProps = {
 export function ForumComposerAutocompletes({
   channelSelectedIndex,
   channelSuggestions,
+  composerOwnsFocus,
   mentionSelectedIndex,
   mentionSuggestions,
   onChannelSelect,
@@ -31,12 +33,14 @@ export function ForumComposerAutocompletes({
   return (
     <>
       <ChannelAutocomplete
+        composerOwnsFocus={composerOwnsFocus}
         onSelect={onChannelSelect}
         position={position}
         selectedIndex={channelSelectedIndex}
         suggestions={channelSuggestions}
       />
       <MentionAutocomplete
+        composerOwnsFocus={composerOwnsFocus}
         onDismiss={onMentionDismiss}
         onFetchMore={onMentionFetchMore}
         onSelect={onMentionSelect}
diff --git a/desktop/src/features/messages/lib/useChannelLinks.ts b/desktop/src/features/messages/lib/useChannelLinks.ts
index c9e573b3fc5..4b703f53cd6 100644
--- a/desktop/src/features/messages/lib/useChannelLinks.ts
+++ b/desktop/src/features/messages/lib/useChannelLinks.ts
@@ -177,8 +177,11 @@ export function useChannelLinks() {
         return { handled: true };
       }
 
+      // Forward Tab selects; Shift+Tab deliberately does not. The reverse
+      // move stays the browser's, so this overlay can't swallow a keyboard
+      // user's way back out (see useMentions for the same split).
       if (
-        event.key === "Tab" ||
+        (event.key === "Tab" && !event.shiftKey) ||
         (event.key === "Enter" &&
           !event.ctrlKey &&
           !event.metaKey &&
diff --git a/desktop/src/features/messages/lib/useComposerFocusOwnership.test.mjs b/desktop/src/features/messages/lib/useComposerFocusOwnership.test.mjs
new file mode 100644
index 00000000000..4e467949a8b
--- /dev/null
+++ b/desktop/src/features/messages/lib/useComposerFocusOwnership.test.mjs
@@ -0,0 +1,121 @@
+import assert from "node:assert/strict";
+import { after, afterEach, before, test } from "node:test";
+
+import { JSDOM } from "jsdom";
+
+const dom = new JSDOM("<!doctype html><html><body></body></html>", {
+  url: "http://localhost",
+});
+
+before(() => {
+  Object.assign(globalThis, {
+    document: dom.window.document,
+    Element: dom.window.Element,
+    Event: dom.window.Event,
+    FocusEvent: dom.window.FocusEvent,
+    getComputedStyle: dom.window.getComputedStyle.bind(dom.window),
+    HTMLElement: dom.window.HTMLElement,
+    IS_REACT_ACT_ENVIRONMENT: true,
+    Node: dom.window.Node,
+    window: dom.window,
+  });
+});
+
+afterEach(async () => {
+  const { cleanup } = await import("@testing-library/react");
+  cleanup();
+});
+
+after(() => dom.window.close());
+
+async function renderHarness() {
+  const React = await import("react");
+  const { render } = await import("@testing-library/react");
+  const { useComposerFocusOwnership } = await import(
+    "./useComposerFocusOwnership.ts"
+  );
+
+  function Harness() {
+    const formRef = React.useRef(null);
+    const ownsFocus = useComposerFocusOwnership(formRef);
+    return React.createElement(
+      React.Fragment,
+      null,
+      React.createElement(
+        "form",
+        { "data-testid": "composer", ref: formRef },
+        React.createElement("input", { "aria-label": "Editor" }),
+        React.createElement("button", { type: "button" }, "Overlay control"),
+        React.createElement("output", {
+          "data-testid": "owned",
+          "data-owned": String(ownsFocus),
+        }),
+      ),
+      React.createElement("input", { "aria-label": "Elsewhere" }),
+    );
+  }
+
+  const view = render(React.createElement(Harness));
+  return {
+    view,
+    ownership: () => view.getByTestId("owned").getAttribute("data-owned"),
+  };
+}
+
+test("tracks focus entering, moving within, and leaving the composer", async () => {
+  const { act } = await import("react");
+  const { view, ownership } = await renderHarness();
+
+  assert.equal(ownership(), "false");
+
+  const editor = view.getByRole("textbox", { name: "Editor" });
+  await act(async () => editor.focus());
+  assert.equal(ownership(), "true");
+
+  // Focus handed from the editor to an overlay control stays owned — this is
+  // the transition an editor-focus gate got wrong, unmounting the overlay
+  // before the control it was handing focus to could receive it.
+  const control = view.getByRole("button", { name: "Overlay control" });
+  await act(async () => control.focus());
+  assert.equal(ownership(), "true");
+
+  const elsewhere = view.getByRole("textbox", { name: "Elsewhere" });
+  await act(async () => elsewhere.focus());
+  assert.equal(ownership(), "false");
+});
+
+test("an internal focus move never reports an unowned intermediate state", async () => {
+  const React = await import("react");
+  const { act } = React;
+  const { render } = await import("@testing-library/react");
+  const { useComposerFocusOwnership } = await import(
+    "./useComposerFocusOwnership.ts"
+  );
+
+  const observed = [];
+  function Harness() {
+    const formRef = React.useRef(null);
+    const ownsFocus = useComposerFocusOwnership(formRef);
+    observed.push(ownsFocus);
+    return React.createElement(
+      "form",
+      { ref: formRef },
+      React.createElement("input", { "aria-label": "Editor" }),
+      React.createElement("button", { type: "button" }, "Overlay control"),
+    );
+  }
+
+  const view = render(React.createElement(Harness));
+  const editor = view.getByRole("textbox", { name: "Editor" });
+  const control = view.getByRole("button", { name: "Overlay control" });
+  await act(async () => editor.focus());
+  observed.length = 0;
+
+  // relatedTarget mirrors a browser handing focus editor → overlay control.
+  // The focusout handler must read it instead of assuming focus left.
+  const { fireEvent } = await import("@testing-library/react");
+  fireEvent.focusOut(editor, { relatedTarget: control });
+  fireEvent.focusIn(control);
+
+  assert.equal(observed.includes(false), false);
+});
diff --git a/desktop/src/features/messages/lib/useComposerFocusOwnership.ts b/desktop/src/features/messages/lib/useComposerFocusOwnership.ts
new file mode 100644
index 00000000000..f39d618dc03
--- /dev/null
+++ b/desktop/src/features/messages/lib/useComposerFocusOwnership.ts
@@ -0,0 +1,44 @@
+import * as React from "react";
+
+/**
+ * Tracks whether a composer owns document focus: true while the focused
+ * element lives anywhere inside `containerRef` (the composer form) — the
+ * editor or the focusable controls of its suggestion overlays.
+ *
+ * This is the value the autocomplete overlays gate their rendering on. It is
+ * deliberately not the editor's own focus state: an overlay gated on editor
+ * focus alone unmounts the moment keyboard focus moves from the editor into
+ * the overlay's controls, which makes those controls unreachable. Ownership
+ * is tracked with `focusout` + `relatedTarget` containment rather than
+ * blur/focus pairs so an internal focus move never passes through a false
+ * state — a false flicker would unmount the overlay before the control it
+ * is handing focus to receives it. Each composer form has its own instance,
+ * so focus in one composer never keeps a sibling composer's overlays alive.
+ */
+export function useComposerFocusOwnership(
+  containerRef: React.RefObject<HTMLElement | null>,
+): boolean {
+  const [ownsFocus, setOwnsFocus] = React.useState(false);
+
+  React.useEffect(() => {
+    const container = containerRef.current;
+    if (!container) return;
+
+    setOwnsFocus(container.contains(document.activeElement));
+    const handleFocusIn = () => setOwnsFocus(true);
+    const handleFocusOut = (event: FocusEvent) => {
+      setOwnsFocus(
+        event.relatedTarget instanceof Node &&
+          container.contains(event.relatedTarget),
+      );
+    };
+    container.addEventListener("focusin", handleFocusIn);
+    container.addEventListener("focusout", handleFocusOut);
+    return () => {
+      container.removeEventListener("focusin", handleFocusIn);
+      container.removeEventListener("focusout", handleFocusOut);
+    };
+  }, [containerRef]);
+
+  return ownsFocus;
+}
diff --git a/desktop/src/features/messages/lib/useEmojiAutocomplete.ts b/desktop/src/features/messages/lib/useEmojiAutocomplete.ts
index 57e458bc911..21a0a102350 100644
--- a/desktop/src/features/messages/lib/useEmojiAutocomplete.ts
+++ b/desktop/src/features/messages/lib/useEmojiAutocomplete.ts
@@ -238,8 +238,11 @@ export function useEmojiAutocomplete(customEmoji: CustomEmoji[] = []) {
         return { handled: true };
       }
 
+      // Forward Tab selects; Shift+Tab deliberately does not. The reverse
+      // move stays the browser's, so this overlay can't swallow a keyboard
+      // user's way back out (see useMentions for the same split).
       if (
-        event.key === "Tab" ||
+        (event.key === "Tab" && !event.shiftKey) ||
         (event.key === "Enter" &&
           !event.ctrlKey &&
           !event.metaKey &&
diff --git a/desktop/src/features/messages/lib/useMentions.ts b/desktop/src/features/messages/lib/useMentions.ts
index 74365e76292..4abee923c8d 100644
--- a/desktop/src/features/messages/lib/useMentions.ts
+++ b/desktop/src/features/messages/lib/useMentions.ts
@@ -728,9 +728,13 @@ export function useMentions(
         );
         return { handled: true };
       }
+      // Shift+Tab is deliberately not a select: it is the keyboard route out
+      // of the editor — into this overlay's Options controls where the
+      // composer offers them, otherwise the browser's own backward focus
+      // move — so those controls stay reachable.
       if (
         exactMentionSpace ||
-        event.key === "Tab" ||
+        (event.key === "Tab" && !event.shiftKey) ||
         (event.key === "Enter" &&
           !event.ctrlKey &&
           !event.metaKey &&
diff --git a/desktop/src/features/messages/lib/useRichTextEditor.ts b/desktop/src/features/messages/lib/useRichTextEditor.ts
index e3e17071fad..2f00531820d 100644
--- a/desktop/src/features/messages/lib/useRichTextEditor.ts
+++ b/desktop/src/features/messages/lib/useRichTextEditor.ts
@@ -167,16 +167,12 @@ export function useRichTextEditor({
   const addressedAgentMentionNamesRef = React.useRef<readonly string[]>([]);
   const onUpdateRef = React.useRef(onUpdate);
   onUpdateRef.current = onUpdate;
-
   const onSubmitRef = React.useRef(onSubmit);
   onSubmitRef.current = onSubmit;
-
   const onEditLastOwnMessageRef = React.useRef(onEditLastOwnMessage);
   onEditLastOwnMessageRef.current = onEditLastOwnMessage;
-
   const onEditLinkRef = React.useRef(onEditLink);
   onEditLinkRef.current = onEditLink;
-
   const onLinkSelectionChangeRef = React.useRef(onLinkSelectionChange);
   onLinkSelectionChangeRef.current = onLinkSelectionChange;
 
@@ -618,13 +614,19 @@ export function useRichTextEditor({
   const hadFocusBeforeDisableRef = React.useRef(false);
   React.useEffect(() => {
     if (!editor || editor.isEditable === editable) return;
+    // `emitUpdate: false` on both toggles — the doc hasn't changed, so the
+    // default synthetic `update` event would replay `onUpdate` with stale
+    // text/cursor and resurrect consumer state derived from it (e.g. reopen
+    // a mention menu the user dismissed with Escape, or re-fire a typing
+    // notification for an untouched draft). Real content changes (typing,
+    // clearContent) dispatch real transactions that emit their own updates.
     if (!editable) {
       // About to disable: remember whether we currently hold focus so we know
       // whether to restore it when re-enabled.
       hadFocusBeforeDisableRef.current = editor.isFocused;
-      editor.setEditable(false);
+      editor.setEditable(false, false);
     } else {
-      editor.setEditable(true);
+      editor.setEditable(true, false);
       // Re-enabled: if we owned focus before the disable blurred us, take it
       // back (preserving the current selection — `focus()` with no arg keeps
       // the existing selection rather than jumping to the end).
diff --git a/desktop/src/features/messages/ui/ChannelAutocomplete.tsx b/desktop/src/features/messages/ui/ChannelAutocomplete.tsx
index 1305919a1c9..5c759a8a693 100644
--- a/desktop/src/features/messages/ui/ChannelAutocomplete.tsx
+++ b/desktop/src/features/messages/ui/ChannelAutocomplete.tsx
@@ -12,6 +12,11 @@ import {
 type ChannelAutocompleteProps = {
   suggestions: ChannelSuggestion[];
   selectedIndex: number;
+  /**
+   * Whether the owning composer owns document focus. Composers that don't
+   * must not render suggestions — see MentionAutocomplete for the rationale.
+   */
+  composerOwnsFocus: boolean;
   onSelect: (suggestion: ChannelSuggestion) => void;
   position?: "above" | "below";
 };
@@ -19,6 +24,7 @@ type ChannelAutocompleteProps = {
 export const ChannelAutocomplete = React.memo(function ChannelAutocomplete({
   suggestions,
   selectedIndex,
+  composerOwnsFocus,
   onSelect,
   position = "above",
 }: ChannelAutocompleteProps) {
@@ -31,7 +37,7 @@ export const ChannelAutocomplete = React.memo(function ChannelAutocomplete({
     activeItem?.scrollIntoView({ block: "nearest" });
   }, [selectedIndex]);
 
-  if (suggestions.length === 0) {
+  if (!composerOwnsFocus || suggestions.length === 0) {
     return null;
   }
 
@@ -42,6 +48,7 @@ export const ChannelAutocomplete = React.memo(function ChannelAutocomplete({
         position === "below" ? "top-full mt-1" : "bottom-full mb-1",
       )}
     >
+      {/* biome-ignore lint/a11y/noStaticElementInteractions: pointer-only guard, no behavior of its own — an unprevented mousedown here (scrollbar, padding ring) blurs the editor, and the focus gate above would unmount the overlay mid-press. */}
       <div
         className={cn(
           "max-h-48 overflow-y-auto rounded-xl p-1",
@@ -51,6 +58,7 @@ export const ChannelAutocomplete = React.memo(function ChannelAutocomplete({
             : "origin-bottom slide-in-from-bottom-1",
           POPOVER_SURFACE_CLASS,
         )}
+        onMouseDown={(event) => event.preventDefault()}
         ref={listRef}
         style={POPOVER_SHADOW_STYLE}
       >
diff --git a/desktop/src/features/messages/ui/ComposerAddressControls.tsx b/desktop/src/features/messages/ui/ComposerAddressControls.tsx
index ae39931334e..30bfe196e3f 100644
--- a/desktop/src/features/messages/ui/ComposerAddressControls.tsx
+++ b/desktop/src/features/messages/ui/ComposerAddressControls.tsx
@@ -195,7 +195,10 @@ export function ComposerMentionButton({
                 data-testid="message-insert-mention"
                 disabled={disabled}
                 onClick={onOpen}
-                onMouseDown={onCaptureSelection}
+                onMouseDown={(event) => {
+                  onCaptureSelection();
+                  event.preventDefault();
+                }}
                 type="button"
               >
                 <AtSign aria-hidden="true" className="h-4 w-4 shrink-0" />
@@ -303,6 +306,7 @@ export function ComposerMentionButton({
           <button
             className="shrink-0 rounded-md px-1.5 py-1 font-medium text-primary outline-hidden hover:bg-primary/10 focus-visible:ring-1 focus-visible:ring-ring"
             onClick={onConfirmationTurnOff}
+            onMouseDown={(event) => event.preventDefault()}
             type="button"
           >
             Turn off
diff --git a/desktop/src/features/messages/ui/EmojiAutocomplete.tsx b/desktop/src/features/messages/ui/EmojiAutocomplete.tsx
index d44933aef1f..9807c2602a9 100644
--- a/desktop/src/features/messages/ui/EmojiAutocomplete.tsx
+++ b/desktop/src/features/messages/ui/EmojiAutocomplete.tsx
@@ -15,6 +15,11 @@ import {
 type EmojiAutocompleteProps = {
   suggestions: EmojiSuggestion[];
   selectedIndex: number;
+  /**
+   * Whether the owning composer owns document focus. Composers that don't
+   * must not render suggestions — see MentionAutocomplete for the rationale.
+   */
+  composerOwnsFocus: boolean;
   onSelect: (suggestion: EmojiSuggestion) => void;
   position?: "above" | "below";
 };
@@ -22,6 +27,7 @@ type EmojiAutocompleteProps = {
 export const EmojiAutocomplete = React.memo(function EmojiAutocomplete({
   suggestions,
   selectedIndex,
+  composerOwnsFocus,
   onSelect,
   position = "above",
 }: EmojiAutocompleteProps) {
@@ -40,7 +46,7 @@ export const EmojiAutocomplete = React.memo(function EmojiAutocomplete({
     [],
   );
 
-  if (suggestions.length === 0) {
+  if (!composerOwnsFocus || suggestions.length === 0) {
     return null;
   }
 
@@ -51,6 +57,7 @@ export const EmojiAutocomplete = React.memo(function EmojiAutocomplete({
         position === "below" ? "top-full mt-1" : "bottom-full mb-1",
       )}
     >
+      {/* biome-ignore lint/a11y/noStaticElementInteractions: pointer-only guard, no behavior of its own — an unprevented mousedown here blurs the editor, and the focus gate above would unmount the overlay mid-press. The scroll element lives inside VirtualizedList, but its mousedown bubbles to this wrapper and preventDefault acts on the same event, so scrollbar presses are covered too. */}
       <div
         className={cn(
           "rounded-xl p-1",
@@ -61,6 +68,7 @@ export const EmojiAutocomplete = React.memo(function EmojiAutocomplete({
           POPOVER_SURFACE_CLASS,
         )}
         data-testid="emoji-autocomplete"
+        onMouseDown={(event) => event.preventDefault()}
         style={POPOVER_SHADOW_STYLE}
       >
         <VirtualizedList
diff --git a/desktop/src/features/messages/ui/MentionAutocomplete.test.mjs b/desktop/src/features/messages/ui/MentionAutocomplete.test.mjs
index be3ec6938ef..ac0cc0ba4cb 100644
--- a/desktop/src/features/messages/ui/MentionAutocomplete.test.mjs
+++ b/desktop/src/features/messages/ui/MentionAutocomplete.test.mjs
@@ -50,6 +50,7 @@ test("agent rows offer automatic mention controls", async () => {
   const props = {
     suggestions: [suggestion],
     selectedIndex: 0,
+    composerOwnsFocus: true,
     onSelect: (value) => selected.push(value),
     onToggleAlwaysAddressAgent: (value) => toggled.push(value),
     lockedAgentPubkeys: new Set(),
@@ -119,6 +120,7 @@ test("options expand in place without replacing the people list", async () => {
     React.createElement(MentionAutocomplete, {
       suggestions: [suggestion],
       selectedIndex: 0,
+      composerOwnsFocus: true,
       onSelect: () => {},
       keepMentionedAgentsPinned: true,
       onKeepMentionedAgentsPinnedChange: (value) => changes.push(value),
@@ -150,6 +152,7 @@ test("options expand in place without replacing the people list", async () => {
     React.createElement(MentionAutocomplete, {
       suggestions: [],
       selectedIndex: 0,
+      composerOwnsFocus: true,
       onSelect: () => {},
       keepMentionedAgentsPinned: false,
       onKeepMentionedAgentsPinnedChange: (value) => changes.push(value),
@@ -161,6 +164,7 @@ test("options expand in place without replacing the people list", async () => {
     React.createElement(MentionAutocomplete, {
       suggestions: [suggestion],
       selectedIndex: 0,
+      composerOwnsFocus: true,
       onSelect: () => {},
       keepMentionedAgentsPinned: false,
       onKeepMentionedAgentsPinnedChange: (value) => changes.push(value),
@@ -189,6 +193,7 @@ test("automatic selection loads the setting once, then updates it in place", asy
   const props = {
     suggestions: [suggestion],
     selectedIndex: 0,
+    composerOwnsFocus: true,
     onSelect: () => {},
     keepMentionedAgentsPinned: false,
     onKeepMentionedAgentsPinnedChange: () => {},
@@ -252,6 +257,7 @@ test("clicking outside dismisses the tray without intercepting its trigger", asy
         React.createElement(MentionAutocomplete, {
           suggestions: [suggestion],
           selectedIndex: 0,
+          composerOwnsFocus: true,
           onDismiss: () => {
             dismissCount += 1;
           },
@@ -311,6 +317,7 @@ test("collision npubs sit inline with agent metadata", async () => {
     React.createElement(MentionAutocomplete, {
       suggestions,
       selectedIndex: 0,
+      composerOwnsFocus: true,
       onSelect: () => {},
     }),
   );
@@ -328,52 +335,201 @@ test("collision npubs sit inline with agent metadata", async () => {
   }
 });
 
-test("does not intercept Tab from the editor", async () => {
+test("focusMentionOptionsTrigger hands focus to the Options trigger", async () => {
   const React = await import("react");
-  const { fireEvent, render } = await import("@testing-library/react");
-  const { MentionAutocomplete } = await import("./MentionAutocomplete.tsx");
-  const { TooltipProvider } = await import("@/shared/ui/tooltip");
-  const suggestions = [
-    {
-      pubkey: "agent-a",
-      displayName: "Agent Ada",
-      isAgent: true,
-    },
-    {
-      pubkey: "agent-b",
-      displayName: "Agent Bea",
-      isAgent: true,
-    },
-  ];
+  const { render } = await import("@testing-library/react");
+  const { MentionAutocomplete, focusMentionOptionsTrigger } = await import(
+    "./MentionAutocomplete.tsx"
+  );
+  const suggestion = {
+    pubkey: "agent-pubkey",
+    displayName: "Agent Ada",
+    isAgent: true,
+  };
   const view = render(
     React.createElement(
-      TooltipProvider,
-      null,
-      React.createElement(
-        "form",
-        null,
-        React.createElement(
-          "div",
-          { "data-testid": "message-input-scroll" },
-          React.createElement("input", { "aria-label": "Message" }),
-        ),
-        React.createElement(MentionAutocomplete, {
-          suggestions,
-          selectedIndex: 1,
-          onSelect: () => {},
-          onToggleAlwaysAddressAgent: () => {},
-        }),
-      ),
+      "form",
+      { "data-testid": "composer-form" },
+      React.createElement("input", { "aria-label": "Message" }),
+      React.createElement(MentionAutocomplete, {
+        suggestions: [suggestion],
+        selectedIndex: 0,
+        composerOwnsFocus: true,
+        onSelect: () => {},
+        keepMentionedAgentsPinned: true,
+        onKeepMentionedAgentsPinnedChange: () => {},
+      }),
+    ),
+  );
+
+  const form = view.getByTestId("composer-form");
+  const input = view.getByRole("textbox", { name: "Message" });
+  input.focus();
+
+  assert.equal(focusMentionOptionsTrigger(form), true);
+  assert.equal(
+    document.activeElement,
+    view.getByTestId("mention-options-trigger"),
+  );
+});
+
+test("focusMentionOptionsTrigger declines when no Options surface renders", async () => {
+  const React = await import("react");
+  const { render } = await import("@testing-library/react");
+  const { MentionAutocomplete, focusMentionOptionsTrigger } = await import(
+    "./MentionAutocomplete.tsx"
+  );
+  const suggestion = {
+    pubkey: "agent-pubkey",
+    displayName: "Agent Ada",
+    isAgent: true,
+  };
+  const view = render(
+    React.createElement(
+      "form",
+      { "data-testid": "composer-form" },
+      React.createElement("input", { "aria-label": "Message" }),
+      // No onKeepMentionedAgentsPinnedChange: composers without audience
+      // controls render no Options surface, so the key event must fall
+      // through to its default backward focus move instead of stranding
+      // focus.
+      React.createElement(MentionAutocomplete, {
+        suggestions: [suggestion],
+        selectedIndex: 0,
+        composerOwnsFocus: true,
+        onSelect: () => {},
+      }),
     ),
   );
 
+  const form = view.getByTestId("composer-form");
   const input = view.getByRole("textbox", { name: "Message" });
   input.focus();
-  const wasNotCancelled = fireEvent.keyDown(input, { key: "Tab" });
 
-  assert.equal(wasNotCancelled, true);
+  assert.equal(focusMentionOptionsTrigger(form), false);
   assert.equal(document.activeElement, input);
+  assert.equal(focusMentionOptionsTrigger(null), false);
+});
+
+test("Escape inside the overlay returns focus to the editor and dismisses", async () => {
+  const React = await import("react");
+  const { fireEvent, render } = await import("@testing-library/react");
+  const { MentionAutocomplete, focusMentionOptionsTrigger } = await import(
+    "./MentionAutocomplete.tsx"
+  );
+  const dismissals = [];
+  const view = render(
+    React.createElement(
+      "form",
+      { "data-testid": "composer-form" },
+      React.createElement("input", {
+        "aria-label": "Message",
+        "data-testid": "message-input",
+      }),
+      React.createElement(MentionAutocomplete, {
+        suggestions: [
+          {
+            pubkey: "agent-pubkey",
+            displayName: "Agent Ada",
+            isAgent: true,
+          },
+        ],
+        selectedIndex: 0,
+        composerOwnsFocus: true,
+        onDismiss: () => dismissals.push(true),
+        onSelect: () => {},
+        keepMentionedAgentsPinned: true,
+        onKeepMentionedAgentsPinnedChange: () => {},
+      }),
+    ),
+  );
+
+  const form = view.getByTestId("composer-form");
+  assert.equal(focusMentionOptionsTrigger(form), true);
+  const trigger = view.getByTestId("mention-options-trigger");
+  const wasNotCancelled = fireEvent.keyDown(trigger, { key: "Escape" });
+
+  assert.equal(wasNotCancelled, false);
+  assert.equal(document.activeElement, view.getByTestId("message-input"));
+  assert.deepEqual(dismissals, [true]);
 });
+
+test("renders nothing while the composer does not own focus", async () => {
+  const React = await import("react");
+  const { render } = await import("@testing-library/react");
+  const { MentionAutocomplete } = await import("./MentionAutocomplete.tsx");
+  const props = {
+    suggestions: [
+      {
+        pubkey: "agent-pubkey",
+        displayName: "Agent Ada",
+        isAgent: true,
+      },
+    ],
+    selectedIndex: 0,
+    composerOwnsFocus: false,
+    onSelect: () => {},
+  };
+  const view = render(React.createElement(MentionAutocomplete, props));
+
+  assert.equal(view.queryByTestId("mention-autocomplete-layer"), null);
+
+  view.rerender(
+    React.createElement(MentionAutocomplete, {
+      ...props,
+      composerOwnsFocus: true,
+    }),
+  );
+  assert.ok(view.getByTestId("mention-autocomplete-layer"));
+});
+
+test("container presses do not blur the editor out from under the overlay", async () => {
+  const React = await import("react");
+  const { fireEvent, render } = await import("@testing-library/react");
+  const { MentionAutocomplete } = await import("./MentionAutocomplete.tsx");
+  const mention = {
+    pubkey: "agent-pubkey",
+    displayName: "Agent Ada",
+    isAgent: true,
+  };
+  const selected = [];
+  const pinnedChanges = [];
+  const view = render(
+    React.createElement(MentionAutocomplete, {
+      suggestions: [mention],
+      selectedIndex: 0,
+      composerOwnsFocus: true,
+      onSelect: (value) => selected.push(value),
+      keepMentionedAgentsPinned: true,
+      onKeepMentionedAgentsPinnedChange: (value) => pinnedChanges.push(value),
+    }),
+  );
+
+  // fireEvent returns false when the dispatched event was canceled, which is
+  // what keeps a contenteditable from losing focus on mousedown.
+  assert.equal(
+    fireEvent.mouseDown(view.getByTestId("mention-autocomplete")),
+    false,
+  );
+
+  const options = view.getByRole("button", { name: "Options" });
+  assert.equal(fireEvent.mouseDown(options.parentElement), false);
+
+  // A label hands focus to its control from the click default action, which
+  // no mousedown guard can cancel, so the label drives the switch itself.
+  fireEvent.click(options);
+  assert.equal(
+    fireEvent.click(view.getByText("Automatically mention agents")),
+    false,
+  );
+  assert.deepEqual(pinnedChanges, [false]);
+
+  // The row buttons must keep selecting: preventing mousedown on the
+  // containers, not pointerdown, leaves their compatibility events intact.
+  fireEvent.mouseDown(view.getByRole("button", { name: "Mention Agent Ada" }));
+  assert.deepEqual(selected, [mention]);
+});
+
 function suggestion(agentProvenance) {
   return {
     pubkey: "1".repeat(64),
diff --git a/desktop/src/features/messages/ui/MentionAutocomplete.tsx b/desktop/src/features/messages/ui/MentionAutocomplete.tsx
index 08b7dfb37ce..0b873a4074c 100644
--- a/desktop/src/features/messages/ui/MentionAutocomplete.tsx
+++ b/desktop/src/features/messages/ui/MentionAutocomplete.tsx
@@ -37,6 +37,15 @@ export type MentionSuggestion = {
 type MentionAutocompleteProps = {
   suggestions: MentionSuggestion[];
   selectedIndex: number;
+  /**
+   * Whether the owning composer owns document focus — its editor or this
+   * overlay's own controls (see useComposerFocusOwnership). The focus gate
+   * lives here rather than in each composer so a background composer
+   * replaying a stale update (e.g. a shared mid-send disabled toggle) can't
+   * resurrect its suggestion overlay, while keyboard focus moving into the
+   * Options controls keeps the overlay mounted.
+   */
+  composerOwnsFocus: boolean;
   onFetchMore?: () => void;
   onSelect: (suggestion: MentionSuggestion) => void;
   lockedAgentPubkeys?: ReadonlySet<string>;
@@ -56,9 +65,27 @@ export function showMentionAgentProvenanceMarker(
   return hasNameCollision && suggestion.agentProvenance === "managed-elsewhere";
 }
 
+/**
+ * Move keyboard focus to the mention overlay's Options trigger inside
+ * `container` (the composer form). Returns false when the trigger isn't
+ * rendered — overlay closed, or a composer without audience controls — so
+ * the caller can leave the key event to its default behavior.
+ */
+export function focusMentionOptionsTrigger(
+  container: HTMLElement | null,
+): boolean {
+  const trigger = container?.querySelector<HTMLElement>(
+    "[data-mention-options-trigger]",
+  );
+  if (!trigger) return false;
+  trigger.focus();
+  return true;
+}
+
 export const MentionAutocomplete = React.memo(function MentionAutocomplete({
   suggestions,
   selectedIndex,
+  composerOwnsFocus,
   onFetchMore,
   onSelect,
   lockedAgentPubkeys,
@@ -145,7 +172,27 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
     }
   }, [onFetchMore]);
 
-  if (suggestions.length === 0) {
+  // Escape from inside the overlay is the keyboard counterpart of pressing
+  // outside it: hand focus back to the editor the overlay belongs to, then
+  // dismiss. Focusing first keeps the composer's focus ownership unbroken, so
+  // the overlay never unmounts with focus stranded on the document. Escape in
+  // the editor itself never reaches here — that path is the composer's own
+  // key handler.
+  const handleOverlayKeyDown = React.useCallback(
+    (event: React.KeyboardEvent<HTMLDivElement>) => {
+      if (event.key !== "Escape") return;
+      event.preventDefault();
+      event.stopPropagation();
+      rootRef.current
+        ?.closest("form")
+        ?.querySelector<HTMLElement>('[data-testid="message-input"]')
+        ?.focus();
+      onDismiss?.();
+    },
+    [onDismiss],
+  );
+
+  if (!composerOwnsFocus || suggestions.length === 0) {
     return null;
   }
 
@@ -159,23 +206,27 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
   }
 
   return (
+    // biome-ignore lint/a11y/noStaticElementInteractions: the overlay's own controls are the interactive elements; this listener only gives them the standard Escape-to-dismiss exit.
     <div
       className={cn(
         "absolute left-0 right-0 z-50 px-3 sm:px-4",
         position === "below" ? "top-full mt-1" : "bottom-full mb-1",
       )}
       data-testid="mention-autocomplete-layer"
+      onKeyDown={handleOverlayKeyDown}
       ref={rootRef}
     >
       <div className="w-full max-w-2xl">
         {onKeepMentionedAgentsPinnedChange ? (
           <div className="mb-2 flex justify-end">
+            {/* biome-ignore lint/a11y/noStaticElementInteractions: pointer-only guard, no behavior of its own — an unprevented mousedown on this surface (its padding, the switch's label) blurs the editor, and the focus gate above would unmount the overlay before the click lands. */}
             <div
               className={cn(
                 "max-w-full overflow-hidden rounded-xl text-popover-foreground ring-1 ring-border/50 transition-[width] duration-200 ease-out",
                 POPOVER_SURFACE_CLASS,
                 optionsOpen ? "w-72" : "w-24",
               )}
+              onMouseDown={(event) => event.preventDefault()}
               ref={optionsSurfaceRef}
               style={POPOVER_SHADOW_STYLE}
             >
@@ -194,9 +245,23 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
                   transition={{ duration: 0.16, ease: "easeOut" }}
                 >
                   <div className="flex min-h-12 items-center justify-between gap-3 px-3 py-2">
+                    {/* A label moves focus to its control from the click
+                        default action, not from mousedown, so the surface's
+                        mousedown guard alone can't keep the editor focused
+                        here. Cancel the forwarding and drive the switch
+                        directly; the association still names the control for
+                        assistive tech, which reaches the switch by keyboard
+                        without going through this label. */}
+                    {/* biome-ignore lint/a11y/useKeyWithClickEvents: pointer-only affordance; the switch it labels is the keyboard-accessible path. */}
                     <label
                       className="flex min-w-0 flex-col"
                       htmlFor={keepPinnedSwitchId}
+                      onClick={(event) => {
+                        event.preventDefault();
+                        onKeepMentionedAgentsPinnedChange?.(
+                          !keepMentionedAgentsPinned,
+                        );
+                      }}
                     >
                       <span className="text-sm font-medium">
                         Automatically mention agents
@@ -222,6 +287,7 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
                 aria-controls={optionsId}
                 aria-expanded={optionsOpen}
                 className="flex h-8 w-full items-center justify-between gap-1 px-2.5 text-sm font-medium text-muted-foreground transition-colors hover:bg-accent hover:text-popover-foreground"
+                data-mention-options-trigger
                 data-testid="mention-options-trigger"
                 onClick={() => setOptionsOpen((open) => !open)}
                 onMouseDown={(event) => event.preventDefault()}
@@ -239,6 +305,7 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
             </div>
           </div>
         ) : null}
+        {/* biome-ignore lint/a11y/noStaticElementInteractions: pointer-only guard, same as the options surface — here it covers presses on the scrollbar and the list's padding ring. */}
         <div
           className={cn(
             "max-h-48 w-full overflow-y-auto rounded-xl p-1",
@@ -249,6 +316,7 @@ export const MentionAutocomplete = React.memo(function MentionAutocomplete({
             POPOVER_SURFACE_CLASS,
           )}
           data-testid="mention-autocomplete"
+          onMouseDown={(event) => event.preventDefault()}
           onScroll={handleScroll}
           ref={listRef}
           style={POPOVER_SHADOW_STYLE}
diff --git a/desktop/src/features/messages/ui/MessageComposer.tsx b/desktop/src/features/messages/ui/MessageComposer.tsx
index 0cc8650795e..dc33334f06b 100644
--- a/desktop/src/features/messages/ui/MessageComposer.tsx
+++ b/desktop/src/features/messages/ui/MessageComposer.tsx
@@ -25,6 +25,7 @@ import {
   takeQueuedAttachmentsForDraft,
   useBackgroundMediaUpload,
 } from "@/features/messages/lib/backgroundMediaUploadStore";
+import { useComposerFocusOwnership } from "@/features/messages/lib/useComposerFocusOwnership";
 import { isMentionCodeContext } from "@/features/messages/lib/mentionCodeContext";
 import { useMentions } from "@/features/messages/lib/useMentions";
 import {
@@ -46,11 +47,10 @@ import { useLinkEditor } from "@/features/messages/lib/useLinkEditor";
 import { useComposerSpoilerParticles } from "@/features/messages/lib/useComposerSpoilerParticles";
 import { useTypingBroadcast } from "@/features/messages/useTypingBroadcast";
 import { cn } from "@/shared/lib/cn";
-import { ChannelAutocomplete } from "./ChannelAutocomplete";
 import { ComposerReplyEditBanner } from "./ComposerReplyEditBanner";
 import { ComposerAttachments, DropZoneOverlay } from "./ComposerAttachments";
-import { EmojiAutocomplete } from "./EmojiAutocomplete";
-import { MentionAutocomplete } from "./MentionAutocomplete";
+import { focusMentionOptionsTrigger } from "./MentionAutocomplete";
+import { MessageComposerAutocompletes } from "./MessageComposerAutocompletes";
 import { ComposerDockToolbar } from "./ComposerDockToolbar";
 import { ComposerUploadProgressPill } from "./ComposerUploadProgressPill";
 import { NonMemberMentionDialog } from "./NonMemberMentionDialog";
@@ -248,6 +248,8 @@ function MessageComposerImpl({
     emojiAutocomplete.isEmojiAutocompleteOpen;
   const submitMessageRef = React.useRef<() => void>(() => {});
   const composerScrollRef = React.useRef<HTMLDivElement>(null);
+  const formRef = React.useRef<HTMLFormElement>(null);
+  const composerOwnsFocus = useComposerFocusOwnership(formRef);
   const onEditLinkRef = React.useRef<
     ((info: LinkSelectionInfo) => void) | null
   >(null);
@@ -722,6 +724,19 @@ function MessageComposerImpl({
         }
         return;
       }
+      // Shift+Tab is the keyboard route from the editor into the mention
+      // overlay's Options controls — forward Tab is consumed below to select
+      // the highlighted suggestion. Falls through (e.g. a composer with no
+      // audience controls) to the browser's native backward focus move.
+      if (
+        event.key === "Tab" &&
+        event.shiftKey &&
+        mentions.isMentionOpen &&
+        focusMentionOptionsTrigger(formRef.current)
+      ) {
+        event.preventDefault();
+        return;
+      }
       const { handled, suggestion } = mentions.handleMentionKeyDown(event, {
         isCodeContext: () => isMentionCodeContext(richText.editor),
       });
@@ -756,6 +771,7 @@ function MessageComposerImpl({
       applyEmojiInsert,
       channelLinks.handleChannelKeyDown,
       applyChannelInsert,
+      mentions.isMentionOpen,
       mentions.handleMentionKeyDown,
       richText.editor,
       selectMentionSuggestion,
@@ -838,46 +854,25 @@ function MessageComposerImpl({
             onSubmit={(event) => {
               handleSubmit(event);
             }}
+            ref={formRef}
           >
             {ownsDropZone && media.isDragOver && <DropZoneOverlay />}
-            <EmojiAutocomplete
-              onSelect={applyEmojiInsert}
-              selectedIndex={emojiAutocomplete.emojiSelectedIndex}
-              suggestions={
-                emojiAutocomplete.isEmojiAutocompleteOpen
-                  ? emojiAutocomplete.emojiSuggestions
-                  : []
-              }
-            />
-            <ChannelAutocomplete
-              onSelect={applyChannelInsert}
-              selectedIndex={channelLinks.channelSelectedIndex}
-              suggestions={
-                channelLinks.isChannelOpen
-                  ? channelLinks.channelSuggestions
-                  : []
-              }
-            />
-            <MentionAutocomplete
+            <MessageComposerAutocompletes
+              audienceControlsEnabled={Boolean(
+                audienceScope && editTarget == null,
+              )}
+              channelLinks={channelLinks}
+              composerOwnsFocus={composerOwnsFocus}
+              emojiAutocomplete={emojiAutocomplete}
               keepMentionedAgentsPinned={keepMentionedAgentsPinned}
               lockedAgentPubkeys={lockedAgentPubkeys}
+              mentions={mentions}
               openOptionsRequest={openMentionOptionsRequest}
-              onKeepMentionedAgentsPinnedChange={
-                audienceScope && editTarget == null
-                  ? setKeepMentionedAgentsPinned
-                  : undefined
-              }
+              onChannelSelect={applyChannelInsert}
+              onEmojiSelect={applyEmojiInsert}
+              onMentionSelect={selectMentionSuggestion}
               onOptionsRevealComplete={completeMentionOptionsReveal}
-              onToggleAlwaysAddressAgent={
-                audienceScope && editTarget == null
-                  ? toggleAlwaysAddressAgent
-                  : undefined
-              }
-              onFetchMore={mentions.fetchMoreSuggestions}
-              onDismiss={mentions.cancelMentionAutocomplete}
-              onSelect={selectMentionSuggestion}
-              selectedIndex={mentions.mentionSelectedIndex}
-              suggestions={mentions.isMentionOpen ? mentions.suggestions : []}
+              onToggleAlwaysAddressAgent={toggleAlwaysAddressAgent}
             />
             {media.uploadState.status === "error" ? (
               <div className="mb-2 rounded-lg bg-destructive/10 px-3 py-2 text-xs text-destructive">
diff --git a/desktop/src/features/messages/ui/MessageComposerAutocompletes.tsx b/desktop/src/features/messages/ui/MessageComposerAutocompletes.tsx
new file mode 100644
index 00000000000..a4e82121091
--- /dev/null
+++ b/desktop/src/features/messages/ui/MessageComposerAutocompletes.tsx
@@ -0,0 +1,104 @@
+import { setKeepMentionedAgentsPinned } from "@/features/messages/lib/autoPinMentionedAgentsPreference";
+import type {
+  ChannelSuggestion,
+  UseChannelLinksResult,
+} from "@/features/messages/lib/useChannelLinks";
+import type {
+  EmojiSuggestion,
+  UseEmojiAutocompleteResult,
+} from "@/features/messages/lib/useEmojiAutocomplete";
+import type { UseMentionsResult } from "@/features/messages/lib/useMentions";
+import { ChannelAutocomplete } from "./ChannelAutocomplete";
+import { EmojiAutocomplete } from "./EmojiAutocomplete";
+import {
+  MentionAutocomplete,
+  type MentionSuggestion,
+} from "./MentionAutocomplete";
+
+type MessageComposerAutocompletesProps = {
+  /**
+   * Whether the mention menu offers its agent-audience controls. Edit
+   * composers and channels without a persistent audience omit them.
+   */
+  audienceControlsEnabled: boolean;
+  channelLinks: UseChannelLinksResult;
+  composerOwnsFocus: boolean;
+  emojiAutocomplete: UseEmojiAutocompleteResult;
+  keepMentionedAgentsPinned: boolean;
+  lockedAgentPubkeys: ReadonlySet<string>;
+  mentions: UseMentionsResult;
+  /**
+   * Bumped to ask the mention menu to reveal its agent-audience options; the
+   * menu reports back through `onOptionsRevealComplete` once it has.
+   */
+  openOptionsRequest?: number;
+  onChannelSelect: (suggestion: ChannelSuggestion) => void;
+  onEmojiSelect: (suggestion: EmojiSuggestion) => void;
+  onMentionSelect: (suggestion: MentionSuggestion) => void;
+  onOptionsRevealComplete?: (request: number) => void;
+  onToggleAlwaysAddressAgent: (suggestion: MentionSuggestion) => void;
+};
+
+/**
+ * The message composer's three suggestion overlays. Each one gates its own
+ * rendering on `composerOwnsFocus`, so a background composer replaying a
+ * stale update cannot resurrect a suggestion menu over the focused composer,
+ * while keyboard focus moving into an overlay's own controls keeps that
+ * overlay mounted.
+ */
+export function MessageComposerAutocompletes({
+  audienceControlsEnabled,
+  channelLinks,
+  composerOwnsFocus,
+  emojiAutocomplete,
+  keepMentionedAgentsPinned,
+  lockedAgentPubkeys,
+  mentions,
+  openOptionsRequest,
+  onChannelSelect,
+  onEmojiSelect,
+  onMentionSelect,
+  onOptionsRevealComplete,
+  onToggleAlwaysAddressAgent,
+}: MessageComposerAutocompletesProps) {
+  return (
+    <>
+      <EmojiAutocomplete
+        composerOwnsFocus={composerOwnsFocus}
+        onSelect={onEmojiSelect}
+        selectedIndex={emojiAutocomplete.emojiSelectedIndex}
+        suggestions={
+          emojiAutocomplete.isEmojiAutocompleteOpen
+            ? emojiAutocomplete.emojiSuggestions
+            : []
+        }
+      />
+      <ChannelAutocomplete
+        composerOwnsFocus={composerOwnsFocus}
+        onSelect={onChannelSelect}
+        selectedIndex={channelLinks.channelSelectedIndex}
+        suggestions={
+          channelLinks.isChannelOpen ? channelLinks.channelSuggestions : []
+        }
+      />
+      <MentionAutocomplete
+        composerOwnsFocus={composerOwnsFocus}
+        keepMentionedAgentsPinned={keepMentionedAgentsPinned}
+        lockedAgentPubkeys={lockedAgentPubkeys}
+        openOptionsRequest={openOptionsRequest}
+        onKeepMentionedAgentsPinnedChange={
+          audienceControlsEnabled ? setKeepMentionedAgentsPinned : undefined
+        }
+        onOptionsRevealComplete={onOptionsRevealComplete}
+        onToggleAlwaysAddressAgent={
+          audienceControlsEnabled ? onToggleAlwaysAddressAgent : undefined
+        }
+        onFetchMore={mentions.fetchMoreSuggestions}
+        onDismiss={mentions.cancelMentionAutocomplete}
+        onSelect={onMentionSelect}
+        selectedIndex={mentions.mentionSelectedIndex}
+        suggestions={mentions.isMentionOpen ? mentions.suggestions : []}
+      />
+    </>
+  );
+}
diff --git a/desktop/src/shared/deep-link.test.mjs b/desktop/src/shared/deep-link.test.mjs
index b6cad59567a..59087861be1 100644
--- a/desktop/src/shared/deep-link.test.mjs
+++ b/desktop/src/shared/deep-link.test.mjs
@@ -1,4 +1,5 @@
 import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
 import { afterEach, test } from "node:test";
 
 const ipcHandlers = new Map();
@@ -23,8 +24,11 @@ globalThis.window = {
 };
 globalThis.__TAURI_INTERNALS__ = tauriInternals;
 
-const { listenForNavigationDeepLinks, resetNavigationDeepLinkDrain } =
-  await import("@/shared/deep-link.ts");
+const {
+  listenForEntityDeepLinks,
+  listenForNavigationDeepLinks,
+  resetNavigationDeepLinkDrain,
+} = await import("@/shared/deep-link.ts");
 
 function deferred() {
   let resolve;
@@ -449,3 +453,58 @@ test("rejected navigation remains queued and is not acknowledged", async () => {
     console.warn = originalWarn;
   }
 });
+
+for (const delivery of ["cold-start", "running-instance"]) {
+  test(`canonical native demo entity payloads navigate before acknowledgement: ${delivery}`, async () => {
+    // Rust's canonical_entity_deep_link test proves all demo transport URLs
+    // produce these exact shared values, rather than passing demo schemes on.
+    const golden = JSON.parse(
+      readFileSync(
+        new URL("../../../test-fixtures/entity-links.json", import.meta.url),
+        "utf8",
+      ),
+    );
+    const { parseEntityLink } = await import("@/shared/lib/entityLink.ts");
+    const pending = Object.entries(golden.links).map(([id, href]) => ({
+      id,
+      href,
+    }));
+    const queue = delivery === "cold-start" ? [...pending] : [];
+    const opened = [];
+    const acknowledged = [];
+    let notify;
+    ipcHandlers.set("plugin:event|listen", ({ handler }) => {
+      notify = callbacks.get(handler);
+      return handler;
+    });
+    ipcHandlers.set("plugin:event|unlisten", () => {});
+    ipcHandlers.set("take_pending_entity_deep_link", () => queue[0] ?? null);
+    ipcHandlers.set("acknowledge_pending_entity_deep_link", ({ id }) => {
+      assert.equal(queue[0]?.id, id);
+      assert.equal(opened.length, acknowledged.length + 1);
+      acknowledged.push(id);
+      queue.shift();
+      return true;
+    });
+    const unlisten = await listenForEntityDeepLinks((href) => {
+      const parsed = parseEntityLink(href);
+      assert.equal(parsed.ok, true, href);
+      opened.push(parsed.value);
+      return true;
+    });
+    await settle();
+    if (delivery === "running-instance") {
+      queue.push(...pending);
+      notify({ payload: pending[0] });
+    }
+    await settle();
+    await settle();
+    assert.deepEqual(
+      acknowledged,
+      pending.map(({ id }) => id),
+    );
+    assert.equal(opened.length, pending.length);
+    assert.equal(queue.length, 0);
+    unlisten();
+  });
+}
diff --git a/desktop/tests/e2e/agents.spec.ts b/desktop/tests/e2e/agents.spec.ts
index 57d018f38c5..fcdf0f3fdd1 100644
--- a/desktop/tests/e2e/agents.spec.ts
+++ b/desktop/tests/e2e/agents.spec.ts
@@ -746,7 +746,7 @@ test("agent defaults stays in the header without an actions menu", async ({
     defaultsDialog.getByTestId("global-agent-model"),
   ).toHaveAttribute("data-value", "gpt-5.5[high]");
   await expect(defaultsDialog.getByTestId("global-agent-model")).toContainText(
-    "gpt-5.5[high]",
+    "GPT-5.5 (high)",
   );
   await page.keyboard.press("Escape");
   await expect(defaultsDialog).toHaveCount(0);
diff --git a/desktop/tests/e2e/global-agent-config-screenshots.spec.ts b/desktop/tests/e2e/global-agent-config-screenshots.spec.ts
index fef87bb8b20..431a415771d 100644
--- a/desktop/tests/e2e/global-agent-config-screenshots.spec.ts
+++ b/desktop/tests/e2e/global-agent-config-screenshots.spec.ts
@@ -248,6 +248,49 @@ test.describe("global agent config screenshots", () => {
     expect(saved).toMatchObject({ preferred_runtime: "codex" });
   });
 
+  test("defaults render Databricks model labels without changing persisted ids", async ({
+    page,
+  }) => {
+    const modelId = "data_workflow_tools.goose.goose-glm-5-3";
+    await installMockBridge(page, {
+      globalAgentConfig: {
+        preferred_runtime: "goose",
+        provider: "databricks_v2",
+        model: modelId,
+        env_vars: {},
+      },
+      discoverAgentModels: {
+        models: [{ id: modelId, name: modelId }],
+        supportsSwitching: true,
+        selectedModel: modelId,
+      },
+      runtimeFileConfigs: {
+        goose: {
+          provider: "databricks_v2",
+          model: modelId,
+          satisfiedEnvKeys: ["DATABRICKS_HOST"],
+        },
+      },
+    });
+
+    await openAiDefaultsSettings(page);
+
+    const model = page.getByTestId("global-agent-model");
+    await expect(model).toHaveText("GLM-5.3");
+
+    const persisted = await page.evaluate(async () =>
+      (
+        window as typeof window & {
+          __BUZZ_E2E_INVOKE_MOCK_COMMAND__?: (
+            command: string,
+            payload: unknown,
+          ) => Promise<unknown>;
+        }
+      ).__BUZZ_E2E_INVOKE_MOCK_COMMAND__?.("get_global_agent_config", null),
+    );
+    expect(persisted).toMatchObject({ model: modelId });
+  });
+
   test("defaults honor credentials set in the harness config file", async ({
     page,
   }) => {
diff --git a/desktop/tests/e2e/persistent-agent-audience.spec.ts b/desktop/tests/e2e/persistent-agent-audience.spec.ts
index 643031454ac..6cc2f22a883 100644
--- a/desktop/tests/e2e/persistent-agent-audience.spec.ts
+++ b/desktop/tests/e2e/persistent-agent-audience.spec.ts
@@ -690,6 +690,188 @@ test("always-mentioned agents remain selected without replaying their animation
   ).toHaveCount(1);
 });
 
+test("the unfocused main composer keeps its dismissed mention menu closed through a thread send", async ({
+  page,
+}) => {
+  await installAudienceFixtures(page, { sendMessageDelayMs: 1_500 });
+  await openGeneral(page);
+
+  const mainComposer = channelComposer(page);
+  const mainInput = mainComposer.getByTestId("message-input");
+  await automaticallyMention(mainComposer, "Morgarita");
+  await mainInput.fill("@Morgarita earlier message");
+  await mainInput.press("Enter");
+  await expect(mainInput).toHaveText("@Morgarita ");
+  await mainInput.fill("@Morgarita");
+  await expect(mainInput).toHaveText("@Morgarita");
+  await expect(mainComposer.getByTestId("mention-autocomplete")).toBeVisible();
+  await mainInput.press("Escape");
+  await expect(mainComposer.getByTestId("mention-autocomplete")).toHaveCount(0);
+
+  const rootMessage = page.locator(
+    `[data-testid="message-row"][data-message-id="${THREAD_ROOT_ID}"]`,
+  );
+  await rootMessage
+    .getByRole("button", { name: "Reply" })
+    .evaluate((button: HTMLButtonElement) => button.click());
+
+  const threadPanel = page.getByTestId("message-thread-panel");
+  await expect(threadPanel).toBeVisible();
+  const threadInput = threadPanel.getByTestId("message-input");
+  await threadInput.click();
+  await expect(threadInput).toBeFocused();
+  await expect(mainComposer.getByTestId("mention-autocomplete")).toHaveCount(0);
+  await mainComposer.evaluate((element) => {
+    element.dataset.mentionMenuReopened = "false";
+    new MutationObserver(() => {
+      if (element.querySelector('[data-testid="mention-autocomplete"]')) {
+        element.dataset.mentionMenuReopened = "true";
+      }
+    }).observe(element, { childList: true, subtree: true });
+  });
+
+  const reply = `Thread reply ${Date.now()}`;
+  await threadInput.fill(reply);
+  await threadInput.press("Enter");
+  await expect(mainInput).toHaveAttribute("contenteditable", "false");
+  await expect(threadPanel).toContainText(reply);
+  await expect(mainInput).toHaveAttribute("contenteditable", "true");
+
+  expect(await mainComposer.getAttribute("data-mention-menu-reopened")).toBe(
+    "false",
+  );
+  await expect(mainComposer.getByTestId("mention-autocomplete")).toHaveCount(0);
+
+  // Refocusing the drafted composer must not resurrect the menu the user
+  // dismissed with Escape: the setEditable toggles around the send used to
+  // emit a phantom update that replayed the stale "@Morgarita" query and
+  // flipped the mention state back open, so a bare click brought the menu
+  // back without any typing.
+  await mainInput.click();
+  await expect(mainInput).toBeFocused();
+  await expect(mainComposer.getByTestId("mention-autocomplete")).toHaveCount(0);
+  expect(await mainComposer.getAttribute("data-mention-menu-reopened")).toBe(
+    "false",
+  );
+});
+
+test("pressing a mention overlay's own container keeps it open", async ({
+  page,
+}) => {
+  await keepMentionedAgentsPinned(page);
+  await installAudienceFixtures(page);
+  await openGeneral(page);
+
+  const composer = channelComposer(page);
+  const input = composer.getByTestId("message-input");
+  await composer.getByTestId("message-insert-mention").click();
+  const list = composer.getByTestId("mention-autocomplete");
+  await expect(list).toBeVisible();
+  await expect(input).toBeFocused();
+
+  // A mousedown landing on the list container itself — its padding ring here,
+  // a native scrollbar on platforms that render one — steals focus from the
+  // editor unless the default is prevented, and the focus gate would then
+  // unmount the menu mid-press.
+  const listBox = await list.boundingBox();
+  if (!listBox) throw new Error("mention list is not laid out");
+  await list.click({ position: { x: 2, y: listBox.height / 2 } });
+  await expect(input).toBeFocused();
+  await expect(list).toBeVisible();
+
+  // Same hazard on the options surface, where it needs no exotic scrollbar
+  // setting to reproduce: the switch's label text is a container press, so the
+  // overlay used to vanish before the forwarded click reached the switch.
+  await composer.getByTestId("mention-options-trigger").click();
+  const preference = composer.getByTestId("mention-keep-agents-pinned-toggle");
+  await expect(preference).toHaveAttribute("data-state", "checked");
+  await composer
+    .getByText("Automatically mention agents", { exact: true })
+    .click();
+  await expect(preference).toHaveAttribute("data-state", "unchecked");
+  await expect(input).toBeFocused();
+  await expect(list).toBeVisible();
+});
+
+test("the mention Options controls are reachable and operable by keyboard", async ({
+  page,
+}) => {
+  await keepMentionedAgentsPinned(page);
+  await installAudienceFixtures(page);
+  await openThread(page);
+
+  const mainComposer = channelComposer(page);
+  const mainInput = mainComposer.getByTestId("message-input");
+  await mainInput.click();
+  await mainInput.fill("@Mor");
+  const list = mainComposer.getByTestId("mention-autocomplete");
+  await expect(list).toBeVisible();
+  await expect(mainInput).toBeFocused();
+
+  // Trip a flag if the overlay ever unmounts from here on — "operable while
+  // the surface stays mounted" has to hold through every focus handoff below,
+  // not just at the polled assertion boundaries.
+  await mainComposer.evaluate((element) => {
+    element.dataset.mentionMenuUnmounted = "false";
+    new MutationObserver(() => {
+      if (!element.querySelector('[data-testid="mention-autocomplete"]')) {
+        element.dataset.mentionMenuUnmounted = "true";
+      }
+    }).observe(element, { childList: true, subtree: true });
+  });
+
+  // Forward Tab still selects the highlighted suggestion, so Shift+Tab is the
+  // route into the overlay. It only reaches the Options controls if the focus
+  // gate treats them as composer-owned focus rather than unmounting on the
+  // editor's blur.
+  await mainInput.press("Shift+Tab");
+  const optionsTrigger = mainComposer.getByTestId("mention-options-trigger");
+  await expect(optionsTrigger).toBeFocused();
+
+  await page.keyboard.press("Enter");
+  const preference = mainComposer.getByTestId(
+    "mention-keep-agents-pinned-toggle",
+  );
+  await expect(preference).toBeVisible();
+  await expect(preference).toHaveAttribute("data-state", "checked");
+
+  // The switch sits before its trigger in the expanded surface's tab order.
+  await page.keyboard.press("Shift+Tab");
+  await expect(preference).toBeFocused();
+  await page.keyboard.press("Space");
+  await expect(preference).toHaveAttribute("data-state", "unchecked");
+
+  await expect(list).toBeVisible();
+  expect(await mainComposer.getAttribute("data-mention-menu-unmounted")).toBe(
+    "false",
+  );
+
+  // Escape is the way back out: focus returns to the editor and the menu
+  // closes, rather than stranding focus on a control that just unmounted.
+  await page.keyboard.press("Escape");
+  await expect(mainInput).toBeFocused();
+  await expect(list).toHaveCount(0);
+
+  // Forward Tab is unchanged by the Shift+Tab route.
+  await mainInput.fill("@Morg");
+  await expect(list).toBeVisible();
+  await mainInput.press("Tab");
+  await expect(mainInput).toHaveText("@Morgarita ");
+  await expect(list).toHaveCount(0);
+
+  // Ownership is still per-composer: focus moving to a sibling composer hides
+  // this composer's menu, which is what stops a background composer from
+  // resurrecting a stale one. Programmatic focus, not a click — a pointerdown
+  // would dismiss the menu through its outside-press handler and mask the gate
+  // under test.
+  await mainInput.fill("@Mor");
+  await expect(list).toBeVisible();
+  const threadInput = threadComposer(page).getByTestId("message-input");
+  await threadInput.focus();
+  await expect(threadInput).toBeFocused();
+  await expect(list).toHaveCount(0);
+});
+
 test("a failed always-mentioned send shakes the composer avatar without replaying its selection animation", async ({
   page,
 }) => {
diff --git a/migrations/0041_nip_fi_identity_foundation.sql b/migrations/0041_nip_fi_identity_foundation.sql
new file mode 100644
index 00000000000..458a796cde6
--- /dev/null
+++ b/migrations/0041_nip_fi_identity_foundation.sql
@@ -0,0 +1,919 @@
+-- Provider-free NIP-FI core identity and base-lifecycle foundation.
+--
+-- This is direct-final fresh-schema DDL. It intentionally does not replay a
+-- historical uid/backfill/ALTER sequence.
+--
+-- Scope is NIP-FI *core* only. Base lifecycle is exactly retire, revoke, and
+-- rotate (NIP-FI.md "Base lifecycle"). The extended NIP-FI-LIFECYCLE surface
+-- (disabled identities, pending-replacement lineage, and their provision,
+-- disable, recover, enable, and admission-loss transitions) is deferred to a
+-- later migration owned by the FI-LIFECYCLE PR, per NIP-FI-MODEL.md: "NIP-FI-
+-- LIFECYCLE adds disabled identities and pending replacement lineage." So the
+-- closed vocabularies below are the core subset:
+--   transition/operation kinds: 1 enroll, 3 retire, 5 revoke, 6 rotate;
+--   lifecycle selector kinds:   1 retired pair (P), 3 revoked key (Y).
+-- A later migration widens these vocabularies additively; nothing here presumes
+-- a single global issuer — identity is issuer-qualified (iss, sub).
+
+-- The sole idempotency/result root shared by identity base lifecycle,
+-- protected operations, and invalidation. Pre-authentication denials never
+-- write this table. ExactReplay and IntentConflict are read-time observations,
+-- not persisted outcomes.
+CREATE TABLE authorization_operation_receipts (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    -- Core operation kinds: 1 enroll, 3 retire, 5 revoke, 6 rotate,
+    -- 11 protected mutation, 12 invalidation. Extended lifecycle kinds
+    -- (2 provision, 4 disable, 7 recover, 8 enable, 9 admission loss) and
+    -- 10 operator are introduced by their owning later migrations.
+    operation_kind SMALLINT NOT NULL CHECK (
+        operation_kind IN (1, 3, 5, 6, 11, 12)
+    ),
+    actor_fingerprint BYTEA NOT NULL CHECK (octet_length(actor_fingerprint) = 32),
+    -- 1 applied, 2 denied, 3 no-op.
+    outcome_code SMALLINT NOT NULL CHECK (outcome_code IN (1, 2, 3)),
+    result_digest BYTEA NOT NULL CHECK (octet_length(result_digest) = 32),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, operation_id),
+    UNIQUE (community_id, operation_id, request_fingerprint),
+    UNIQUE (
+        community_id,
+        operation_id,
+        request_fingerprint,
+        operation_kind,
+        outcome_code
+    ),
+    CHECK (operation_id <> '00000000-0000-0000-0000-000000000000'::uuid)
+);
+
+-- Immutable monotonic local policy revisions. Enrollment modes are the closed
+-- provider-free V1 set: 1 attested-key, 2 provisioned, 3 risk-labelled TOFU.
+CREATE TABLE identity_enrollment_policies (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    policy_revision BIGINT NOT NULL CHECK (policy_revision > 0),
+    enrollment_mode SMALLINT NOT NULL CHECK (enrollment_mode IN (1, 2, 3)),
+    policy_digest BYTEA NOT NULL CHECK (octet_length(policy_digest) = 32),
+    effective_at TIMESTAMPTZ NOT NULL,
+    -- Optional local binding-policy expiry. Federated token `exp` MUST NOT be
+    -- copied here: token lifetime bounds an authorization lease, not this
+    -- durable binding generation.
+    expires_at TIMESTAMPTZ,
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, policy_revision),
+    CHECK (expires_at IS NULL OR effective_at < expires_at)
+);
+
+-- One row is one immutable binding generation. binding_version is allocated
+-- from one non-cycling PostgreSQL identity sequence and is never changed or
+-- reused. Explicit lifecycle may only retire the generation; X/Y denial
+-- semantics live in immutable selector facts below, not alternate row states.
+CREATE TABLE identity_bindings (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    binding_id UUID NOT NULL,
+    binding_version BIGINT GENERATED ALWAYS AS IDENTITY (
+        START WITH 1 INCREMENT BY 1 NO MINVALUE NO MAXVALUE CACHE 1 NO CYCLE
+    ),
+    issuer TEXT COLLATE "C" NOT NULL CHECK (octet_length(issuer) BETWEEN 1 AND 2048),
+    subject TEXT COLLATE "C" NOT NULL CHECK (octet_length(subject) BETWEEN 1 AND 2048),
+    principal_fingerprint BYTEA NOT NULL CHECK (octet_length(principal_fingerprint) = 32),
+    event_author_pubkey BYTEA NOT NULL CHECK (octet_length(event_author_pubkey) = 32),
+    -- 1 active, 2 retired.
+    binding_state SMALLINT NOT NULL CHECK (binding_state IN (1, 2)),
+    lifecycle_revision BIGINT NOT NULL CHECK (lifecycle_revision IN (1, 2)),
+    -- 1 attested-key, 2 provisioned, 3 risk-labelled TOFU.
+    binding_provenance SMALLINT NOT NULL CHECK (binding_provenance IN (1, 2, 3)),
+    policy_revision BIGINT NOT NULL CHECK (policy_revision > 0),
+    -- Canonical evidence for the selected provenance. This is an assertion
+    -- digest for attested/TOFU admission and a provisioning receipt digest for
+    -- separately provisioned admission; it never stores credential bytes.
+    enrollment_evidence_digest BYTEA NOT NULL CHECK (
+        octet_length(enrollment_evidence_digest) = 32
+    ),
+    expires_at TIMESTAMPTZ,
+    birth_history_id UUID NOT NULL,
+    creation_operation_id UUID NOT NULL,
+    creation_request_fingerprint BYTEA NOT NULL CHECK (
+        octet_length(creation_request_fingerprint) = 32
+    ),
+    retirement_history_id UUID,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, binding_id),
+    UNIQUE (community_id, binding_version),
+    UNIQUE (community_id, binding_id, binding_version),
+    FOREIGN KEY (community_id, policy_revision)
+        REFERENCES identity_enrollment_policies
+            (community_id, policy_revision),
+    CHECK (binding_version > 0),
+    CHECK (binding_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (birth_history_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (creation_operation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (expires_at IS NULL OR created_at < expires_at),
+    CHECK (
+        (binding_state = 1 AND lifecycle_revision = 1 AND retirement_history_id IS NULL)
+        OR (binding_state = 2 AND lifecycle_revision = 2 AND retirement_history_id IS NOT NULL)
+    )
+);
+
+-- State 1 is Active. Expiry is evaluated with authoritative PostgreSQL time
+-- at read/finalization and is exclusive; it cannot appear in an index predicate.
+CREATE UNIQUE INDEX identity_bindings_active_principal
+    ON identity_bindings (community_id, issuer, subject)
+    WHERE binding_state = 1;
+CREATE INDEX identity_bindings_principal_fingerprint_lookup
+    ON identity_bindings (community_id, principal_fingerprint)
+    WHERE binding_state = 1;
+CREATE UNIQUE INDEX identity_bindings_active_event_author
+    ON identity_bindings (community_id, event_author_pubkey)
+    WHERE binding_state = 1;
+CREATE INDEX identity_bindings_current_lookup
+    ON identity_bindings (community_id, event_author_pubkey, binding_state, expires_at);
+
+-- The one canonical immutable lifecycle transition row for a successful or
+-- no-op lifecycle operation. A transition can name an old generation, a new
+-- successor generation, both (Rotate), or neither (a semantic no-op). It is not
+-- a second result/effect engine: the shared receipt remains the sole persisted
+-- operation outcome. Core transition kinds only: 1 enroll, 3 retire, 5 revoke,
+-- 6 rotate.
+CREATE TABLE identity_lifecycle_history (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    history_id UUID NOT NULL,
+    transition_kind SMALLINT NOT NULL CHECK (
+        transition_kind IN (1, 3, 5, 6)
+    ),
+    -- Matches the shared receipt: 1 applied, 3 no-op.
+    outcome_code SMALLINT NOT NULL CHECK (outcome_code IN (1, 3)),
+    old_binding_id UUID,
+    old_binding_version BIGINT CHECK (old_binding_version IS NULL OR old_binding_version > 0),
+    old_prior_lifecycle_revision BIGINT CHECK (
+        old_prior_lifecycle_revision IS NULL OR old_prior_lifecycle_revision IN (1, 2)
+    ),
+    old_prior_state SMALLINT CHECK (old_prior_state IS NULL OR old_prior_state IN (1, 2)),
+    old_resulting_lifecycle_revision BIGINT CHECK (
+        old_resulting_lifecycle_revision IS NULL OR old_resulting_lifecycle_revision IN (1, 2)
+    ),
+    old_resulting_state SMALLINT CHECK (
+        old_resulting_state IS NULL OR old_resulting_state IN (1, 2)
+    ),
+    successor_binding_id UUID,
+    successor_binding_version BIGINT CHECK (
+        successor_binding_version IS NULL OR successor_binding_version > 0
+    ),
+    successor_lifecycle_revision BIGINT CHECK (
+        successor_lifecycle_revision IS NULL OR successor_lifecycle_revision = 1
+    ),
+    successor_state SMALLINT CHECK (successor_state IS NULL OR successor_state = 1),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    transition_digest BYTEA NOT NULL CHECK (octet_length(transition_digest) = 32),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, history_id),
+    UNIQUE (community_id, operation_id),
+    UNIQUE (community_id, history_id, operation_id, request_fingerprint),
+    UNIQUE (
+        community_id,
+        history_id,
+        successor_binding_id,
+        successor_binding_version,
+        operation_id,
+        request_fingerprint
+    ),
+    UNIQUE (
+        community_id,
+        history_id,
+        old_binding_id,
+        old_binding_version,
+        old_resulting_lifecycle_revision,
+        old_resulting_state
+    ),
+    FOREIGN KEY (
+        community_id,
+        operation_id,
+        request_fingerprint,
+        transition_kind,
+        outcome_code
+    ) REFERENCES authorization_operation_receipts (
+        community_id,
+        operation_id,
+        request_fingerprint,
+        operation_kind,
+        outcome_code
+    ) DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, old_binding_id, old_binding_version)
+        REFERENCES identity_bindings (community_id, binding_id, binding_version)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, successor_binding_id, successor_binding_version)
+        REFERENCES identity_bindings (community_id, binding_id, binding_version)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (history_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (operation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (
+        (old_binding_id IS NULL
+            AND old_binding_version IS NULL
+            AND old_prior_lifecycle_revision IS NULL
+            AND old_prior_state IS NULL
+            AND old_resulting_lifecycle_revision IS NULL
+            AND old_resulting_state IS NULL)
+        OR (old_binding_id IS NOT NULL
+            AND old_binding_version IS NOT NULL
+            AND old_prior_lifecycle_revision IS NOT NULL
+            AND old_prior_state IS NOT NULL
+            AND old_resulting_lifecycle_revision IS NOT NULL
+            AND old_resulting_state IS NOT NULL)
+    ),
+    CHECK (
+        (successor_binding_id IS NULL
+            AND successor_binding_version IS NULL
+            AND successor_lifecycle_revision IS NULL
+            AND successor_state IS NULL)
+        OR (successor_binding_id IS NOT NULL
+            AND successor_binding_version IS NOT NULL
+            AND successor_lifecycle_revision = 1
+            AND successor_state = 1)
+    ),
+    CHECK (
+        old_binding_id IS NULL
+        OR successor_binding_id IS NULL
+        OR old_binding_id <> successor_binding_id
+    ),
+    CHECK (
+        old_binding_version IS NULL
+        OR successor_binding_version IS NULL
+        OR old_binding_version <> successor_binding_version
+    ),
+    -- Core lifecycle only ever moves Active/r1 to Retired/r2 for a named old
+    -- generation. Extended re-enablement (recover/enable from Retired/r2) is a
+    -- later migration's concern.
+    CHECK (
+        old_binding_id IS NULL
+        OR (old_prior_lifecycle_revision = 1
+            AND old_prior_state = 1
+            AND old_resulting_lifecycle_revision = 2
+            AND old_resulting_state = 2)
+    ),
+    CHECK (
+        (outcome_code = 3
+            AND old_binding_id IS NULL
+            AND successor_binding_id IS NULL)
+        OR (outcome_code = 1 AND (
+            (transition_kind = 1
+                AND old_binding_id IS NULL
+                AND successor_binding_id IS NOT NULL)
+            OR (transition_kind = 3
+                AND old_binding_id IS NOT NULL
+                AND successor_binding_id IS NULL)
+            OR (transition_kind = 5
+                AND successor_binding_id IS NULL)
+            OR (transition_kind = 6
+                AND old_binding_id IS NOT NULL
+                AND successor_binding_id IS NOT NULL)
+        ))
+    )
+);
+
+CREATE INDEX identity_lifecycle_history_old_binding
+    ON identity_lifecycle_history (community_id, old_binding_id, old_binding_version, recorded_at);
+CREATE INDEX identity_lifecycle_history_successor_binding
+    ON identity_lifecycle_history (
+        community_id,
+        successor_binding_id,
+        successor_binding_version,
+        recorded_at
+    );
+
+-- Circular birth/transition ordering is deliberate and fully deferred. Every
+-- generation must commit with its exact birth transition, and a retired row
+-- must commit with the exact transition that changed Active/r1 to Retired/r2.
+ALTER TABLE identity_bindings
+    ADD CONSTRAINT identity_bindings_exact_birth_history_fk
+    FOREIGN KEY (
+        community_id,
+        birth_history_id,
+        binding_id,
+        binding_version,
+        creation_operation_id,
+        creation_request_fingerprint
+    ) REFERENCES identity_lifecycle_history (
+        community_id,
+        history_id,
+        successor_binding_id,
+        successor_binding_version,
+        operation_id,
+        request_fingerprint
+    ) DEFERRABLE INITIALLY DEFERRED;
+
+ALTER TABLE identity_bindings
+    ADD CONSTRAINT identity_bindings_exact_retirement_history_fk
+    FOREIGN KEY (
+        community_id,
+        retirement_history_id,
+        binding_id,
+        binding_version,
+        lifecycle_revision,
+        binding_state
+    ) REFERENCES identity_lifecycle_history (
+        community_id,
+        history_id,
+        old_binding_id,
+        old_binding_version,
+        old_resulting_lifecycle_revision,
+        old_resulting_state
+    ) DEFERRABLE INITIALLY DEFERRED;
+
+-- One immutable closed-scope fact table. Core selector kinds only:
+-- 1 retired pair (P), 3 revoked key (Y). Both are permanent. The extended
+-- disabled-identity (X) and pending-replacement (Q) selectors, and their
+-- one-shot consumption, are introduced by the FI-LIFECYCLE migration.
+CREATE TABLE identity_lifecycle_selectors (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    selector_id UUID NOT NULL,
+    selector_kind SMALLINT NOT NULL CHECK (selector_kind IN (1, 3)),
+    selector_fingerprint BYTEA NOT NULL CHECK (octet_length(selector_fingerprint) = 32),
+    fact_generation BIGINT NOT NULL CHECK (fact_generation > 0),
+    principal_fingerprint BYTEA CHECK (
+        principal_fingerprint IS NULL OR octet_length(principal_fingerprint) = 32
+    ),
+    event_author_pubkey BYTEA CHECK (
+        event_author_pubkey IS NULL OR octet_length(event_author_pubkey) = 32
+    ),
+    binding_id UUID,
+    binding_version BIGINT CHECK (binding_version IS NULL OR binding_version > 0),
+    asserted_history_id UUID NOT NULL,
+    selected_by_operation_id UUID NOT NULL,
+    selected_by_request_fingerprint BYTEA NOT NULL CHECK (
+        octet_length(selected_by_request_fingerprint) = 32
+    ),
+    selected_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, selector_id),
+    UNIQUE (community_id, selector_id, selector_kind),
+    UNIQUE (community_id, selector_kind, selector_fingerprint, fact_generation),
+    FOREIGN KEY (
+        community_id,
+        asserted_history_id,
+        selected_by_operation_id,
+        selected_by_request_fingerprint
+    ) REFERENCES identity_lifecycle_history (
+        community_id,
+        history_id,
+        operation_id,
+        request_fingerprint
+    ) DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (
+        community_id,
+        selected_by_operation_id,
+        selected_by_request_fingerprint
+    ) REFERENCES authorization_operation_receipts (
+        community_id,
+        operation_id,
+        request_fingerprint
+    ) DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, binding_id, binding_version)
+        REFERENCES identity_bindings (community_id, binding_id, binding_version)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (selector_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (
+        (selector_kind = 1
+            AND fact_generation = 1
+            AND principal_fingerprint IS NOT NULL
+            AND event_author_pubkey IS NOT NULL
+            AND binding_id IS NOT NULL
+            AND binding_version IS NOT NULL)
+        OR (selector_kind = 3
+            AND fact_generation = 1
+            AND principal_fingerprint IS NULL
+            AND event_author_pubkey IS NOT NULL
+            AND binding_id IS NULL
+            AND binding_version IS NULL)
+    )
+);
+
+CREATE UNIQUE INDEX identity_lifecycle_selectors_permanent_pair
+    ON identity_lifecycle_selectors (community_id, binding_id, binding_version)
+    WHERE selector_kind = 1;
+CREATE UNIQUE INDEX identity_lifecycle_selectors_permanent_principal_key
+    ON identity_lifecycle_selectors (
+        community_id,
+        principal_fingerprint,
+        event_author_pubkey
+    ) WHERE selector_kind = 1;
+CREATE UNIQUE INDEX identity_lifecycle_selectors_permanent_key
+    ON identity_lifecycle_selectors (community_id, event_author_pubkey)
+    WHERE selector_kind = 3;
+CREATE INDEX identity_lifecycle_selectors_principal_lookup
+    ON identity_lifecycle_selectors
+        (community_id, selector_kind, principal_fingerprint, fact_generation);
+CREATE INDEX identity_lifecycle_selectors_key_lookup
+    ON identity_lifecycle_selectors
+        (community_id, selector_kind, event_author_pubkey, fact_generation);
+CREATE INDEX identity_lifecycle_selectors_binding_lookup
+    ON identity_lifecycle_selectors
+        (community_id, selector_kind, binding_id, binding_version, fact_generation);
+CREATE INDEX identity_lifecycle_selectors_asserted_history
+    ON identity_lifecycle_selectors
+        (community_id, asserted_history_id, selector_kind);
+
+-- Serializes policy-revision inserts per community: each new revision must
+-- strictly exceed the current maximum (FI-INV-06 — stable assertion policy
+-- anchor; a backfilled or replayed revision is incoherent). The per-community
+-- advisory lock prevents two concurrent writers from both passing a plain
+-- SELECT MAX() check and committing conflicting revisions.
+CREATE FUNCTION identity_enrollment_policy_revision_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    lock_key BIGINT;
+    max_revision BIGINT;
+BEGIN
+    -- Acquire a per-community exclusive transaction-scoped advisory lock so
+    -- that concurrent insertions serialize here. The key is a stable hash of
+    -- the namespace string and the community_id bytes.
+    lock_key := hashtextextended(
+        'buzz:enrollment-policy-revision:v1:' || NEW.community_id::text,
+        0
+    );
+    PERFORM pg_advisory_xact_lock(lock_key);
+
+    SELECT MAX(policy_revision)
+    INTO max_revision
+    FROM identity_enrollment_policies
+    WHERE community_id = NEW.community_id;
+
+    IF max_revision IS NOT NULL
+        AND NEW.policy_revision <= max_revision
+    THEN
+        RAISE EXCEPTION
+            'policy_revision % does not strictly exceed current maximum % for community %',
+            NEW.policy_revision, max_revision, NEW.community_id
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_enrollment_policy_revision_monotonic';
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION nip_fi_reject_row_mutation_v1() RETURNS TRIGGER AS $$
+BEGIN
+    RAISE EXCEPTION '% is immutable', TG_TABLE_NAME
+        USING ERRCODE = 'check_violation';
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION nip_fi_reject_truncate_v1() RETURNS TRIGGER AS $$
+BEGIN
+    RAISE EXCEPTION '% cannot be truncated', TG_TABLE_NAME
+        USING ERRCODE = 'check_violation';
+END;
+$$ LANGUAGE plpgsql;
+
+-- Every binding/selector path derives the same domain-scoped coordinates and
+-- takes their signed BIGINT advisory keys in numeric order. Typed transaction
+-- APIs take these locks before row mutation; the triggers are the fail-closed
+-- backstop for direct SQL.
+CREATE FUNCTION identity_lifecycle_lock_coordinates_v1(
+    locked_community_id UUID,
+    locked_principal_fingerprint BYTEA,
+    locked_event_author_pubkey BYTEA
+) RETURNS VOID AS $$
+DECLARE
+    principal_lock_key BIGINT;
+    event_author_lock_key BIGINT;
+BEGIN
+    IF locked_principal_fingerprint IS NOT NULL THEN
+        principal_lock_key := hashtextextended(
+            'buzz:identity-lifecycle-coordinate:v1:principal:'
+                || locked_community_id::text || ':'
+                || encode(locked_principal_fingerprint, 'hex'),
+            0
+        );
+    END IF;
+    IF locked_event_author_pubkey IS NOT NULL THEN
+        event_author_lock_key := hashtextextended(
+            'buzz:identity-lifecycle-coordinate:v1:key:'
+                || locked_community_id::text || ':'
+                || encode(locked_event_author_pubkey, 'hex'),
+            0
+        );
+    END IF;
+
+    IF principal_lock_key IS NOT NULL AND event_author_lock_key IS NOT NULL THEN
+        PERFORM pg_advisory_xact_lock(LEAST(principal_lock_key, event_author_lock_key));
+        IF principal_lock_key <> event_author_lock_key THEN
+            PERFORM pg_advisory_xact_lock(GREATEST(principal_lock_key, event_author_lock_key));
+        END IF;
+    ELSIF principal_lock_key IS NOT NULL THEN
+        PERFORM pg_advisory_xact_lock(principal_lock_key);
+    ELSIF event_author_lock_key IS NOT NULL THEN
+        PERFORM pg_advisory_xact_lock(event_author_lock_key);
+    END IF;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_bindings_insert_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM identity_lifecycle_lock_coordinates_v1(
+        NEW.community_id,
+        NEW.principal_fingerprint,
+        NEW.event_author_pubkey
+    );
+    IF NEW.binding_state <> 1
+        OR NEW.lifecycle_revision <> 1
+        OR NEW.retirement_history_id IS NOT NULL
+    THEN
+        RAISE EXCEPTION 'identity binding birth must be Active at lifecycle revision 1'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_bindings_birth_state';
+    END IF;
+    NEW.created_at := transaction_timestamp();
+    NEW.updated_at := transaction_timestamp();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_bindings_transition_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    PERFORM identity_lifecycle_lock_coordinates_v1(
+        OLD.community_id,
+        OLD.principal_fingerprint,
+        OLD.event_author_pubkey
+    );
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.binding_id IS DISTINCT FROM OLD.binding_id
+        OR NEW.binding_version IS DISTINCT FROM OLD.binding_version
+        OR NEW.issuer IS DISTINCT FROM OLD.issuer
+        OR NEW.subject IS DISTINCT FROM OLD.subject
+        OR NEW.principal_fingerprint IS DISTINCT FROM OLD.principal_fingerprint
+        OR NEW.event_author_pubkey IS DISTINCT FROM OLD.event_author_pubkey
+        OR NEW.binding_provenance IS DISTINCT FROM OLD.binding_provenance
+        OR NEW.policy_revision IS DISTINCT FROM OLD.policy_revision
+        OR NEW.enrollment_evidence_digest IS DISTINCT FROM OLD.enrollment_evidence_digest
+        OR NEW.expires_at IS DISTINCT FROM OLD.expires_at
+        OR NEW.birth_history_id IS DISTINCT FROM OLD.birth_history_id
+        OR NEW.creation_operation_id IS DISTINCT FROM OLD.creation_operation_id
+        OR NEW.creation_request_fingerprint IS DISTINCT FROM OLD.creation_request_fingerprint
+        OR NEW.created_at IS DISTINCT FROM OLD.created_at
+    THEN
+        RAISE EXCEPTION 'identity binding generation coordinates are immutable'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_bindings_immutable_generation';
+    END IF;
+    IF OLD.binding_state <> 1
+        OR OLD.lifecycle_revision <> 1
+        OR OLD.retirement_history_id IS NOT NULL
+        OR NEW.binding_state <> 2
+        OR NEW.lifecycle_revision <> 2
+        OR NEW.retirement_history_id IS NULL
+        OR NEW.retirement_history_id = OLD.birth_history_id
+    THEN
+        RAISE EXCEPTION 'identity binding permits only Active/r1 to Retired/r2'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_bindings_active_to_retired';
+    END IF;
+    NEW.updated_at := transaction_timestamp();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_lifecycle_history_insert_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    NEW.recorded_at := transaction_timestamp();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_binding_history_semantics_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    retirement identity_lifecycle_history%ROWTYPE;
+BEGIN
+    IF NEW.binding_state = 2 THEN
+        SELECT * INTO STRICT retirement
+        FROM identity_lifecycle_history
+        WHERE community_id = NEW.community_id
+          AND history_id = NEW.retirement_history_id
+          AND old_binding_id = NEW.binding_id
+          AND old_binding_version = NEW.binding_version;
+        IF retirement.outcome_code <> 1
+            OR retirement.old_prior_lifecycle_revision <> 1
+            OR retirement.old_prior_state <> 1
+            OR retirement.old_resulting_lifecycle_revision <> 2
+            OR retirement.old_resulting_state <> 2
+        THEN
+            RAISE EXCEPTION 'retired binding must reference its exact Active-to-Retired transition'
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'identity_bindings_retirement_history_semantics';
+        END IF;
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_binding_birth_eligibility_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF EXISTS (
+        SELECT 1
+        FROM identity_lifecycle_selectors selector
+        WHERE selector.community_id = NEW.community_id
+          AND (
+            (selector.selector_kind = 1
+                AND selector.principal_fingerprint = NEW.principal_fingerprint
+                AND selector.event_author_pubkey = NEW.event_author_pubkey)
+            OR (selector.selector_kind = 3
+                AND selector.event_author_pubkey = NEW.event_author_pubkey)
+          )
+    ) THEN
+        RAISE EXCEPTION 'binding birth conflicts with an effective lifecycle selector'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_bindings_birth_eligibility';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION authorization_operation_receipt_history_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    history_count BIGINT;
+    expected_count BIGINT;
+BEGIN
+    SELECT count(*) INTO history_count
+    FROM identity_lifecycle_history history
+    WHERE history.community_id = NEW.community_id
+      AND history.operation_id = NEW.operation_id;
+
+    -- Core lifecycle receipts (enroll, retire, revoke, rotate) each require
+    -- exactly one lifecycle-history row. Non-lifecycle receipts (protected
+    -- mutation, invalidation) require none.
+    expected_count := CASE
+        WHEN NEW.operation_kind IN (1, 3, 5, 6) AND NEW.outcome_code IN (1, 3) THEN 1
+        ELSE 0
+    END;
+    IF history_count <> expected_count THEN
+        RAISE EXCEPTION 'operation receipt requires % lifecycle history row, found %',
+            expected_count, history_count
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_operation_receipt_history_cardinality';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_lifecycle_selector_insert_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    NEW.selected_at := transaction_timestamp();
+    PERFORM identity_lifecycle_lock_coordinates_v1(
+        NEW.community_id,
+        CASE WHEN NEW.selector_kind = 1 THEN NEW.principal_fingerprint END,
+        NEW.event_author_pubkey
+    );
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_lifecycle_selector_history_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    history identity_lifecycle_history%ROWTYPE;
+    old_binding identity_bindings%ROWTYPE;
+BEGIN
+    SELECT * INTO STRICT history
+    FROM identity_lifecycle_history
+    WHERE community_id = NEW.community_id
+      AND history_id = NEW.asserted_history_id
+      AND operation_id = NEW.selected_by_operation_id
+      AND request_fingerprint = NEW.selected_by_request_fingerprint;
+
+    IF history.old_binding_id IS NOT NULL THEN
+        SELECT * INTO STRICT old_binding
+        FROM identity_bindings
+        WHERE community_id = history.community_id
+          AND binding_id = history.old_binding_id
+          AND binding_version = history.old_binding_version;
+    END IF;
+
+    -- A retired-pair (P) selector is asserted by retire, revoke, or rotate of a
+    -- named old generation; a revoked-key (Y) selector by revoke.
+    IF history.outcome_code <> 1
+        OR (NEW.selector_kind = 1 AND (
+            history.transition_kind NOT IN (3, 5, 6)
+            OR history.old_binding_id IS DISTINCT FROM NEW.binding_id
+            OR history.old_binding_version IS DISTINCT FROM NEW.binding_version
+            OR old_binding.principal_fingerprint IS DISTINCT FROM NEW.principal_fingerprint
+            OR old_binding.event_author_pubkey IS DISTINCT FROM NEW.event_author_pubkey
+        ))
+        OR (NEW.selector_kind = 3 AND (
+            history.transition_kind <> 5
+            OR (history.old_binding_id IS NOT NULL
+                AND old_binding.event_author_pubkey
+                    IS DISTINCT FROM NEW.event_author_pubkey)
+        ))
+    THEN
+        RAISE EXCEPTION 'selector does not match its lifecycle transition'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_lifecycle_selector_history_semantics';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_lifecycle_transition_integrity_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    transition identity_lifecycle_history%ROWTYPE;
+    old_binding_state SMALLINT;
+    asserted_p BIGINT;
+    asserted_y BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'identity_lifecycle_history' THEN
+        transition := NEW;
+    ELSIF TG_TABLE_NAME = 'identity_lifecycle_selectors' THEN
+        SELECT * INTO STRICT transition
+        FROM identity_lifecycle_history
+        WHERE community_id = NEW.community_id
+          AND history_id = NEW.asserted_history_id;
+    ELSE
+        SELECT * INTO STRICT transition
+        FROM identity_lifecycle_history
+        WHERE community_id = NEW.community_id
+          AND history_id = CASE
+              WHEN NEW.binding_state = 2 THEN NEW.retirement_history_id
+              ELSE NEW.birth_history_id
+          END;
+    END IF;
+
+    SELECT
+        count(*) FILTER (WHERE selector_kind = 1),
+        count(*) FILTER (WHERE selector_kind = 3)
+    INTO asserted_p, asserted_y
+    FROM identity_lifecycle_selectors
+    WHERE community_id = transition.community_id
+      AND asserted_history_id = transition.history_id;
+
+    IF transition.old_binding_id IS NOT NULL THEN
+        SELECT binding_state INTO STRICT old_binding_state
+        FROM identity_bindings
+        WHERE community_id = transition.community_id
+          AND binding_id = transition.old_binding_id
+          AND binding_version = transition.old_binding_version;
+        IF old_binding_state <> 2 THEN
+            RAISE EXCEPTION 'lifecycle transition old binding must be retired at commit'
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'identity_lifecycle_transition_integrity';
+        END IF;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1
+        FROM identity_lifecycle_selectors selector
+        JOIN identity_bindings active
+          ON active.community_id = selector.community_id
+         AND active.binding_state = 1
+         AND (
+            (selector.selector_kind = 1
+                AND active.principal_fingerprint = selector.principal_fingerprint
+                AND active.event_author_pubkey = selector.event_author_pubkey)
+            OR (selector.selector_kind = 3
+                AND active.event_author_pubkey = selector.event_author_pubkey)
+         )
+        WHERE selector.community_id = transition.community_id
+    ) THEN
+        RAISE EXCEPTION 'effective lifecycle selector conflicts with an active binding'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_lifecycle_transition_integrity';
+    END IF;
+
+    IF transition.outcome_code = 3 THEN
+        IF asserted_p + asserted_y <> 0 THEN
+            RAISE EXCEPTION 'no-op lifecycle transition cannot create selector facts'
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'identity_lifecycle_transition_integrity';
+        END IF;
+        RETURN NULL;
+    END IF;
+
+    -- Core selector companions per transition:
+    --   enroll  (1): none
+    --   retire  (3): exactly one P
+    --   revoke  (5): one Y always; one P when a named old generation is removed
+    --   rotate  (6): exactly one P (old generation retired)
+    IF (transition.transition_kind = 1
+            AND (asserted_p, asserted_y) <> (0, 0))
+        OR (transition.transition_kind = 3
+            AND (asserted_p, asserted_y) <> (1, 0))
+        OR (transition.transition_kind = 5 AND (
+            (transition.old_binding_id IS NOT NULL
+                AND (asserted_p, asserted_y) <> (1, 1))
+            OR (transition.old_binding_id IS NULL
+                AND (asserted_p, asserted_y) <> (0, 1))
+        ))
+        OR (transition.transition_kind = 6
+            AND (asserted_p, asserted_y) <> (1, 0))
+    THEN
+        RAISE EXCEPTION 'lifecycle transition has incomplete or forbidden selector companions'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_lifecycle_transition_integrity';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER identity_bindings_insert_guard
+    BEFORE INSERT ON identity_bindings
+    FOR EACH ROW EXECUTE FUNCTION identity_bindings_insert_guard_v1();
+CREATE TRIGGER identity_bindings_transition_guard
+    BEFORE UPDATE ON identity_bindings
+    FOR EACH ROW EXECUTE FUNCTION identity_bindings_transition_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_bindings_history_semantics
+    AFTER INSERT OR UPDATE ON identity_bindings
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_binding_history_semantics_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_bindings_birth_eligibility
+    AFTER INSERT ON identity_bindings
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_binding_birth_eligibility_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_bindings_transition_integrity
+    AFTER INSERT OR UPDATE ON identity_bindings
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_transition_integrity_guard_v1();
+CREATE TRIGGER identity_bindings_no_delete
+    BEFORE DELETE ON identity_bindings
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER identity_bindings_no_truncate
+    BEFORE TRUNCATE ON identity_bindings
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER identity_lifecycle_history_insert_guard
+    BEFORE INSERT ON identity_lifecycle_history
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_history_insert_guard_v1();
+CREATE CONSTRAINT TRIGGER authorization_operation_receipt_history_cardinality
+    AFTER INSERT ON authorization_operation_receipts
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_receipt_history_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_lifecycle_transition_integrity
+    AFTER INSERT ON identity_lifecycle_history
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_transition_integrity_guard_v1();
+
+CREATE TRIGGER identity_lifecycle_selector_insert_guard
+    BEFORE INSERT ON identity_lifecycle_selectors
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_selector_insert_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_lifecycle_selector_history_semantics
+    AFTER INSERT ON identity_lifecycle_selectors
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_selector_history_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_lifecycle_selector_transition_integrity
+    AFTER INSERT ON identity_lifecycle_selectors
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_transition_integrity_guard_v1();
+
+CREATE TRIGGER authorization_operation_receipts_immutable
+    BEFORE UPDATE OR DELETE ON authorization_operation_receipts
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_operation_receipts_no_truncate
+    BEFORE TRUNCATE ON authorization_operation_receipts
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER identity_enrollment_policies_revision_guard
+    BEFORE INSERT ON identity_enrollment_policies
+    FOR EACH ROW EXECUTE FUNCTION identity_enrollment_policy_revision_guard_v1();
+CREATE TRIGGER identity_enrollment_policies_immutable
+    BEFORE UPDATE OR DELETE ON identity_enrollment_policies
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER identity_enrollment_policies_no_truncate
+    BEFORE TRUNCATE ON identity_enrollment_policies
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER identity_lifecycle_history_immutable
+    BEFORE UPDATE OR DELETE ON identity_lifecycle_history
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER identity_lifecycle_history_no_truncate
+    BEFORE TRUNCATE ON identity_lifecycle_history
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER identity_lifecycle_selectors_immutable
+    BEFORE UPDATE OR DELETE ON identity_lifecycle_selectors
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER identity_lifecycle_selectors_no_truncate
+    BEFORE TRUNCATE ON identity_lifecycle_selectors
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+-- These identity relations are a durable, tamper-evident authorization ledger:
+-- FI-INV-02 (durable binding) and FI-INV-03 (tombstone monotonicity) require
+-- their denial facts to outlive any single tenant lifecycle, and the immutable
+-- no_delete/no_truncate triggers above enforce exactly that. They therefore
+-- carry community_id as provenance, not as deletable ownership — the same
+-- posture migration 0030 took for product_feedback and rate_limit_violations.
+-- Widen the single SQL source of truth so the universal write fence and the
+-- deletion catalog treat them as ledger: never fence-attached, never purged,
+-- never counted as tenant-scoped drift. community rows are permanent tombstones
+-- (never hard-deleted), so their NOT NULL community_id references never dangle.
+CREATE OR REPLACE FUNCTION community_write_fence_excluded_table(target NAME) RETURNS BOOLEAN
+LANGUAGE SQL IMMUTABLE STRICT PARALLEL SAFE AS $$
+    SELECT target::TEXT = ANY (ARRAY[
+        'community_deletion_requests', 'community_deletion_approvals',
+        'community_deletion_checkpoints', 'community_serving_write_leases',
+        'community_deletion_executor_heartbeats', 'product_feedback',
+        'rate_limit_violations',
+        'authorization_operation_receipts', 'identity_enrollment_policies',
+        'identity_bindings', 'identity_lifecycle_history',
+        'identity_lifecycle_selectors'
+    ]::TEXT[])
+$$;
diff --git a/migrations/0042_nip_fi_authorization_foundation.sql b/migrations/0042_nip_fi_authorization_foundation.sql
new file mode 100644
index 00000000000..043bae95618
--- /dev/null
+++ b/migrations/0042_nip_fi_authorization_foundation.sql
@@ -0,0 +1,1038 @@
+-- Provider-free NIP-FI authorization, audit, fencing, and restore foundation.
+--
+-- There is no provider registry/SPI/profile/evidence table, durable lease or
+-- audio admission ledger, 30382 projection, delivery queue, exporter claim,
+-- acknowledgement, retry scheduler, or online retention/compaction workflow.
+--
+-- This migration applies to migration 0041's resulting state. Its scope is the
+-- NIP-FI *final-admission* surface: replay/receipt, audit events, invalidation,
+-- capacity, protected-object authority, restore version deltas, and the closed
+-- admission result. Closed vocabularies below carry only the core subset;
+-- delegation coordinates (owner/relationship columns, invalidation selector 7,
+-- version-delta component kind 6) are deferred to the FI-DELEG migration and
+-- extended-lifecycle audit kinds (recover, enable, disable, admission-loss;
+-- version-delta component kind 7) to the FI-LIFECYCLE migration, matching
+-- 0041's carve. A later migration widens these additively; nothing here
+-- presumes a single global issuer.
+
+-- Durable one-way activation marker and current domain invalidation generation.
+CREATE TABLE authorization_invalidation_domains (
+    community_id UUID NOT NULL PRIMARY KEY REFERENCES communities(id),
+    current_generation BIGINT NOT NULL CHECK (current_generation >= 0),
+    activated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp()
+);
+
+-- Closed selectors: 1 principal, 2 Nostr key, 3 binding, 4 session, 5 domain,
+-- 6 configuration revision. Selector 7 (delegated relationship) and its
+-- relationship-revision floor are deferred to the FI-DELEG migration.
+CREATE TABLE authorization_invalidation_floors (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    selector_kind SMALLINT NOT NULL CHECK (selector_kind IN (1, 2, 3, 4, 5, 6)),
+    selector_fingerprint BYTEA NOT NULL CHECK (octet_length(selector_fingerprint) = 32),
+    floor_generation BIGINT NOT NULL CHECK (floor_generation > 0),
+    binding_version_floor BIGINT CHECK (binding_version_floor IS NULL OR binding_version_floor > 0),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, selector_kind, selector_fingerprint),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (
+        (selector_kind = 3 AND binding_version_floor IS NOT NULL)
+        OR (selector_kind <> 3 AND binding_version_floor IS NULL)
+    )
+);
+
+-- Protected-object kinds: 1 domain, 2 channel, 3 repository, 4 media,
+-- 5 moderation target, 6 audio session. Kind 7 is retired: current binding
+-- status is connection-local evidence and never a durable protected object.
+CREATE TABLE authorization_authority_epochs (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    object_kind SMALLINT NOT NULL CHECK (object_kind IN (1, 2, 3, 4, 5, 6)),
+    object_key BYTEA NOT NULL CHECK (octet_length(object_key) = 32),
+    authority_epoch BIGINT NOT NULL CHECK (authority_epoch > 0),
+    fence BYTEA NOT NULL CHECK (
+        octet_length(fence) = 32 AND fence <> decode(repeat('00', 32), 'hex')
+    ),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, object_kind, object_key),
+    UNIQUE (
+        community_id,
+        object_kind,
+        object_key,
+        authority_epoch,
+        fence,
+        operation_id,
+        request_fingerprint
+    ),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED
+);
+
+-- Direct-final current authority for a protected object. The authorization
+-- lease itself is sealed in memory and dies on restart; this durable row is the
+-- exact source re-fenced immediately before a protected mutation or emission.
+CREATE TABLE protected_object_authority (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    object_kind SMALLINT NOT NULL CHECK (object_kind IN (1, 2, 3, 4, 5, 6)),
+    object_key BYTEA NOT NULL CHECK (octet_length(object_key) = 32),
+    capability SMALLINT NOT NULL CHECK (
+        capability IN (
+            1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
+            15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27,
+            28, 29
+        )
+    ),
+    actor_pubkey BYTEA NOT NULL CHECK (octet_length(actor_pubkey) = 32),
+    binding_id UUID NOT NULL,
+    binding_version BIGINT NOT NULL CHECK (binding_version > 0),
+    policy_revision BIGINT NOT NULL CHECK (policy_revision > 0),
+    invalidation_generation BIGINT NOT NULL CHECK (invalidation_generation >= 0),
+    authority_epoch BIGINT NOT NULL CHECK (authority_epoch > 0),
+    fence BYTEA NOT NULL CHECK (
+        octet_length(fence) = 32 AND fence <> decode(repeat('00', 32), 'hex')
+    ),
+    issued_at TIMESTAMPTZ NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    PRIMARY KEY (community_id, object_kind, object_key),
+    FOREIGN KEY (community_id, binding_id, binding_version)
+        REFERENCES identity_bindings (community_id, binding_id, binding_version)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (
+        community_id,
+        object_kind,
+        object_key,
+        authority_epoch,
+        fence,
+        operation_id,
+        request_fingerprint
+    ) REFERENCES authorization_authority_epochs (
+        community_id,
+        object_kind,
+        object_key,
+        authority_epoch,
+        fence,
+        operation_id,
+        request_fingerprint
+    ) DEFERRABLE INITIALLY DEFERRED,
+    CHECK (issued_at < expires_at)
+);
+
+-- Explicit immutable-capacity policy required by Enforce mode. Hard ceilings
+-- match buzz-auth; installation limits must be sized explicitly below them.
+-- V1 has no online pruning/export/reset workflow.
+CREATE TABLE authorization_event_capacity (
+    community_id UUID NOT NULL PRIMARY KEY REFERENCES communities(id),
+    max_events_per_domain BIGINT NOT NULL CONSTRAINT authorization_event_capacity_max_events CHECK (
+        max_events_per_domain BETWEEN 1 AND 10000
+    ),
+    max_bytes_per_domain BIGINT NOT NULL CONSTRAINT authorization_event_capacity_max_bytes CHECK (
+        max_bytes_per_domain BETWEEN 1 AND 16777216
+    ),
+    max_envelope_bytes INTEGER NOT NULL CONSTRAINT authorization_event_capacity_max_envelope CHECK (
+        max_envelope_bytes BETWEEN 1 AND 16384
+    ),
+    retained_event_count BIGINT NOT NULL DEFAULT 0 CHECK (retained_event_count >= 0),
+    retained_envelope_bytes BIGINT NOT NULL DEFAULT 0 CHECK (retained_envelope_bytes >= 0),
+    -- 1 healthy, 2 audit unavailable/exhausted. Recovery/reset is not a V1
+    -- online workflow; enabled runtime latches failure when insertion aborts.
+    health_state SMALLINT NOT NULL DEFAULT 1 CHECK (health_state IN (1, 2)),
+    failure_code SMALLINT CHECK (failure_code IS NULL OR failure_code IN (1, 2, 3)),
+    failure_observed_at TIMESTAMPTZ,
+    configured_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    CHECK (max_envelope_bytes <= max_bytes_per_domain),
+    CHECK (retained_event_count <= max_events_per_domain),
+    CHECK (retained_envelope_bytes <= max_bytes_per_domain),
+    CHECK (
+        (health_state = 1 AND failure_code IS NULL AND failure_observed_at IS NULL)
+        OR (health_state = 2 AND failure_code IS NOT NULL AND failure_observed_at IS NOT NULL)
+    )
+);
+
+-- Durable versioned pseudonymous authorization envelope. event_kind:
+-- 1 enrolled, 2 revoked, 3 rotated, 6 retired, 9 operator denied,
+-- 10 protected allowed, 11 protected denied, 14 invalidation advanced.
+-- The extended-lifecycle audit kinds (4 recovered, 5 principal enabled,
+-- 7 principal disabled, 8 admission lost) are deferred to the FI-LIFECYCLE
+-- migration, matching 0041's core lifecycle carve. Kinds 12 and 13 are
+-- retired: kind 24244 publication/withdrawal is ephemeral connection state and
+-- never a durable authorization event.
+CREATE TABLE authorization_events (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    event_id UUID NOT NULL,
+    schema_version SMALLINT NOT NULL DEFAULT 1 CHECK (schema_version = 1),
+    event_kind SMALLINT NOT NULL CHECK (
+        event_kind IN (1, 2, 3, 6, 9, 10, 11, 14)
+    ),
+    outcome_code SMALLINT NOT NULL CHECK (outcome_code IN (1, 2, 3, 4, 5)),
+    reason_code SMALLINT NOT NULL CHECK (
+        reason_code IN (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
+    ),
+    actor_kind SMALLINT NOT NULL CHECK (actor_kind IN (1, 2, 3, 4)),
+    actor_fingerprint BYTEA CHECK (
+        actor_fingerprint IS NULL OR octet_length(actor_fingerprint) = 32
+    ),
+    subject_fingerprint BYTEA CHECK (
+        subject_fingerprint IS NULL OR octet_length(subject_fingerprint) = 32
+    ),
+    -- Always retains attempted operation identity. Only unresolved pre-auth
+    -- event kind 9 omits the canonical receipt fingerprint; authenticated
+    -- OperatorDenied events remain linked to their exact canonical receipt.
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA CHECK (
+        request_fingerprint IS NULL OR octet_length(request_fingerprint) = 32
+    ),
+    correlation_id UUID NOT NULL,
+    attempt_id UUID NOT NULL,
+    -- Redaction-safe pre-authentication denial identity. Present and non-zero
+    -- for unresolved pre-auth kind-9 events (actor_kind = 4); NULL for
+    -- authenticated kind-9 events (actor_kind 1-3) and all other event kinds.
+    -- Binds the event to the exact denial attempt's semantic_fingerprint
+    -- (intent_digest) for exact replay.
+    semantic_fingerprint BYTEA CHECK (
+        semantic_fingerprint IS NULL OR octet_length(semantic_fingerprint) = 32
+    ),
+    occurred_at TIMESTAMPTZ NOT NULL,
+    accepted_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    canonical_envelope BYTEA NOT NULL CONSTRAINT authorization_events_envelope_size CHECK (
+        octet_length(canonical_envelope) BETWEEN 1 AND 16384
+    ),
+    envelope_digest BYTEA NOT NULL CHECK (octet_length(envelope_digest) = 32),
+    PRIMARY KEY (community_id, event_id),
+    UNIQUE (community_id, event_id, operation_id),
+    UNIQUE (community_id, event_id, event_kind, operation_id),
+    UNIQUE (community_id, operation_id, event_kind, attempt_id),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (event_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (operation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (correlation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (attempt_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (
+        (actor_kind = 4 AND event_kind = 9 AND request_fingerprint IS NULL)
+        OR (actor_kind IN (1, 2, 3) AND request_fingerprint IS NOT NULL)
+    ),
+    CHECK (
+        (actor_kind = 4 AND actor_fingerprint IS NULL AND subject_fingerprint IS NULL)
+        OR (actor_kind IN (1, 2, 3) AND actor_fingerprint IS NOT NULL)
+    ),
+    -- Unresolved pre-auth kind-9 events (actor_kind = 4) carry a non-zero
+    -- semantic_fingerprint; authenticated kind-9 events (actor_kind 1-3) and
+    -- all other event kinds must not.
+    CHECK (
+        (event_kind = 9 AND actor_kind = 4 AND semantic_fingerprint IS NOT NULL
+            AND semantic_fingerprint <> decode(repeat('00', 32), 'hex'))
+        OR (event_kind = 9 AND actor_kind IN (1, 2, 3) AND semantic_fingerprint IS NULL)
+        OR (event_kind <> 9 AND semantic_fingerprint IS NULL)
+    )
+);
+
+-- Credential-free pre-authentication denial attempts. The five-column key is
+-- exact replay identity; no row or FK occupies canonical operation/result,
+-- effect, authority, approval, or consumption state.
+CREATE TABLE authorization_authentication_denial_attempts (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    operation_id UUID NOT NULL,
+    correlation_id UUID NOT NULL,
+    semantic_fingerprint BYTEA NOT NULL CHECK (octet_length(semantic_fingerprint) = 32),
+    denial_reason SMALLINT NOT NULL CHECK (denial_reason IN (1, 2, 3)),
+    expected_revision BIGINT NOT NULL CHECK (expected_revision > 0),
+    action SMALLINT NOT NULL CHECK (action IN (1, 2, 3, 4, 5, 6, 7, 8)),
+    reason_code SMALLINT NOT NULL CHECK (
+        reason_code IN (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
+    ),
+    attempt_id UUID NOT NULL,
+    audit_event_id UUID NOT NULL,
+    audit_event_kind SMALLINT NOT NULL DEFAULT 9 CHECK (audit_event_kind = 9),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (
+        community_id,
+        operation_id,
+        correlation_id,
+        semantic_fingerprint,
+        denial_reason
+    ),
+    UNIQUE (community_id, audit_event_id),
+    FOREIGN KEY (community_id, audit_event_id, audit_event_kind, operation_id)
+        REFERENCES authorization_events (community_id, event_id, event_kind, operation_id)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, operation_id, audit_event_kind, attempt_id)
+        REFERENCES authorization_events (community_id, operation_id, event_kind, attempt_id)
+        DEFERRABLE INITIALLY DEFERRED,
+    -- Canonical denial_reason ↔ reason_code binding: MissingCredential(1)↔Missing(2),
+    -- InvalidCredential(2)↔Invalid(3), Unauthenticated(3)↔Unauthenticated(4).
+    CONSTRAINT authorization_denial_reason_reason_code_binding CHECK (
+        (denial_reason = 1 AND reason_code = 2)
+        OR (denial_reason = 2 AND reason_code = 3)
+        OR (denial_reason = 3 AND reason_code = 4)
+    ),
+    CHECK (operation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (correlation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (attempt_id <> '00000000-0000-0000-0000-000000000000'::uuid)
+);
+
+-- Exact per-operation authority-version attribution for restore. Empty
+-- manifests are valid; every stored component must advance strictly.
+CREATE TABLE authorization_operation_version_delta_manifests (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    component_count INTEGER NOT NULL CHECK (component_count BETWEEN 0 AND 1024),
+    before_digest BYTEA NOT NULL CHECK (octet_length(before_digest) = 32),
+    after_digest BYTEA NOT NULL CHECK (octet_length(after_digest) = 32),
+    manifest_digest BYTEA NOT NULL CHECK (octet_length(manifest_digest) = 32),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, operation_id),
+    UNIQUE (community_id, operation_id, request_fingerprint),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED
+);
+
+-- component_kind: 1 binding version, 2 policy revision,
+-- 3 invalidation generation, 4 authority epoch. Kind 6 (delegated-relationship
+-- revision) is deferred to the FI-DELEG migration and kind 7 (lifecycle-selector
+-- generation) to the FI-LIFECYCLE migration. Kind 5 is retired with durable
+-- client-status revisions; retained kinds keep their original identities.
+CREATE TABLE authorization_operation_version_deltas (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    operation_id UUID NOT NULL,
+    component_kind SMALLINT NOT NULL CHECK (component_kind IN (1, 2, 3, 4)),
+    component_key BYTEA NOT NULL CHECK (octet_length(component_key) = 32),
+    before_version BIGINT NOT NULL CHECK (before_version >= 0),
+    after_version BIGINT NOT NULL,
+    component_digest BYTEA NOT NULL CHECK (octet_length(component_digest) = 32),
+    PRIMARY KEY (community_id, operation_id, component_kind, component_key),
+    FOREIGN KEY (community_id, operation_id)
+        REFERENCES authorization_operation_version_delta_manifests
+            (community_id, operation_id),
+    CHECK (after_version > before_version)
+);
+
+CREATE FUNCTION authorization_event_capacity_before_insert_v1() RETURNS TRIGGER AS $$
+DECLARE
+    policy authorization_event_capacity%ROWTYPE;
+    envelope_bytes BIGINT;
+BEGIN
+    SELECT * INTO policy
+    FROM authorization_event_capacity
+    WHERE community_id = NEW.community_id
+    FOR UPDATE;
+
+    IF NOT FOUND THEN
+        RAISE EXCEPTION 'authorization event capacity policy missing'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_event_capacity_policy_required';
+    END IF;
+    IF policy.health_state <> 1 THEN
+        RAISE EXCEPTION 'authorization audit is unavailable'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_event_capacity_health';
+    END IF;
+
+    envelope_bytes := octet_length(NEW.canonical_envelope);
+    IF envelope_bytes > policy.max_envelope_bytes
+        OR policy.retained_event_count + 1 > policy.max_events_per_domain
+        OR policy.retained_envelope_bytes + envelope_bytes > policy.max_bytes_per_domain
+    THEN
+        -- The INSERT and protected mutation abort together. The runtime maps
+        -- this stable constraint to typed CapacityExhausted and latches audit
+        -- health outside the rolled-back transaction.
+        RAISE EXCEPTION 'authorization event capacity exhausted'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_event_capacity_exhausted';
+    END IF;
+
+    UPDATE authorization_event_capacity
+    SET retained_event_count = retained_event_count + 1,
+        retained_envelope_bytes = retained_envelope_bytes + envelope_bytes,
+        updated_at = transaction_timestamp()
+    WHERE community_id = NEW.community_id;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_events_capacity
+    BEFORE INSERT ON authorization_events
+    FOR EACH ROW EXECUTE FUNCTION authorization_event_capacity_before_insert_v1();
+
+CREATE FUNCTION authorization_invalidation_domain_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.activated_at IS DISTINCT FROM OLD.activated_at
+        OR NEW.current_generation <= OLD.current_generation
+        OR NEW.updated_at <= OLD.updated_at
+    THEN
+        RAISE EXCEPTION 'authorization invalidation activation/generation cannot move backward'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_invalidation_domains_monotonic
+    BEFORE UPDATE ON authorization_invalidation_domains
+    FOR EACH ROW EXECUTE FUNCTION authorization_invalidation_domain_guard_v1();
+CREATE TRIGGER authorization_invalidation_domains_no_delete
+    BEFORE DELETE ON authorization_invalidation_domains
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_invalidation_domains_no_truncate
+    BEFORE TRUNCATE ON authorization_invalidation_domains
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE FUNCTION authorization_invalidation_floor_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.selector_kind IS DISTINCT FROM OLD.selector_kind
+        OR NEW.selector_fingerprint IS DISTINCT FROM OLD.selector_fingerprint
+        OR NEW.floor_generation < OLD.floor_generation
+        OR COALESCE(NEW.binding_version_floor, 0) < COALESCE(OLD.binding_version_floor, 0)
+        OR (
+            NEW.floor_generation = OLD.floor_generation
+            AND COALESCE(NEW.binding_version_floor, 0)
+                = COALESCE(OLD.binding_version_floor, 0)
+        )
+        OR NEW.operation_id IS NOT DISTINCT FROM OLD.operation_id
+        OR NEW.updated_at <= OLD.updated_at
+    THEN
+        RAISE EXCEPTION 'authorization invalidation floor cannot move backward'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_invalidation_floors_monotonic
+    BEFORE UPDATE ON authorization_invalidation_floors
+    FOR EACH ROW EXECUTE FUNCTION authorization_invalidation_floor_guard_v1();
+CREATE TRIGGER authorization_invalidation_floors_no_delete
+    BEFORE DELETE ON authorization_invalidation_floors
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_invalidation_floors_no_truncate
+    BEFORE TRUNCATE ON authorization_invalidation_floors
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE FUNCTION authorization_authority_epoch_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.object_kind IS DISTINCT FROM OLD.object_kind
+        OR NEW.object_key IS DISTINCT FROM OLD.object_key
+        OR NEW.authority_epoch <= OLD.authority_epoch
+        OR NEW.fence IS NOT DISTINCT FROM OLD.fence
+        OR NEW.operation_id IS NOT DISTINCT FROM OLD.operation_id
+        OR NEW.updated_at <= OLD.updated_at
+    THEN
+        RAISE EXCEPTION 'authorization authority epoch cannot move backward'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_authority_epochs_monotonic
+    BEFORE UPDATE ON authorization_authority_epochs
+    FOR EACH ROW EXECUTE FUNCTION authorization_authority_epoch_guard_v1();
+CREATE TRIGGER authorization_authority_epochs_no_delete
+    BEFORE DELETE ON authorization_authority_epochs
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_authority_epochs_no_truncate
+    BEFORE TRUNCATE ON authorization_authority_epochs
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE FUNCTION authorization_event_capacity_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.max_events_per_domain IS DISTINCT FROM OLD.max_events_per_domain
+        OR NEW.max_bytes_per_domain IS DISTINCT FROM OLD.max_bytes_per_domain
+        OR NEW.max_envelope_bytes IS DISTINCT FROM OLD.max_envelope_bytes
+        OR NEW.configured_at IS DISTINCT FROM OLD.configured_at
+        OR NEW.retained_event_count < OLD.retained_event_count
+        OR NEW.retained_envelope_bytes < OLD.retained_envelope_bytes
+        OR NEW.updated_at < OLD.updated_at
+        OR (OLD.health_state = 2 AND (
+            NEW.health_state <> 2
+            OR NEW.failure_code IS DISTINCT FROM OLD.failure_code
+            OR NEW.failure_observed_at IS DISTINCT FROM OLD.failure_observed_at
+        ))
+        OR (OLD.health_state = 1 AND NEW.health_state = 1 AND (
+            NEW.failure_code IS NOT NULL OR NEW.failure_observed_at IS NOT NULL
+        ))
+    THEN
+        RAISE EXCEPTION 'authorization event capacity cannot be reset online'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION protected_object_authority_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.object_kind IS DISTINCT FROM OLD.object_kind
+        OR NEW.object_key IS DISTINCT FROM OLD.object_key
+        OR NEW.authority_epoch <= OLD.authority_epoch
+        OR NEW.fence IS NOT DISTINCT FROM OLD.fence
+        OR NEW.operation_id IS NOT DISTINCT FROM OLD.operation_id
+        OR NEW.issued_at <= OLD.issued_at
+    THEN
+        RAISE EXCEPTION 'protected authority replacement requires a new operation and epoch'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_event_capacity_monotonic
+    BEFORE UPDATE ON authorization_event_capacity
+    FOR EACH ROW EXECUTE FUNCTION authorization_event_capacity_guard_v1();
+CREATE TRIGGER authorization_event_capacity_no_delete
+    BEFORE DELETE ON authorization_event_capacity
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_event_capacity_no_truncate
+    BEFORE TRUNCATE ON authorization_event_capacity
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER authorization_events_immutable
+    BEFORE UPDATE OR DELETE ON authorization_events
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_events_no_truncate
+    BEFORE TRUNCATE ON authorization_events
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER authorization_authentication_denial_attempts_immutable
+    BEFORE UPDATE OR DELETE ON authorization_authentication_denial_attempts
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_authentication_denial_attempts_no_truncate
+    BEFORE TRUNCATE ON authorization_authentication_denial_attempts
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+-- Bidirectional deferred guard: a kind-9 (pre-authentication denial) audit
+-- event must commit with exactly one denial attempt; a denial attempt must
+-- commit with its audit event present, kind-9, and matching semantic
+-- coordinates (correlation_id, reason_code, and semantic_fingerprint). Both
+-- directions deferred so event and attempt may be inserted in any order inside
+-- one transaction. The static denial_reason↔reason_code mapping is enforced
+-- by an immediate CHECK on the denial attempt table; the guard enforces the
+-- matching semantic coordinates between event and attempt.
+CREATE FUNCTION authorization_denial_attempt_guard_v1()
+RETURNS TRIGGER AS $$
+DECLARE
+    found_event_kind SMALLINT;
+    found_actor_kind SMALLINT;
+    found_request_fingerprint BYTEA;
+    found_correlation_id UUID;
+    found_reason_code SMALLINT;
+    found_semantic_fingerprint BYTEA;
+    attempt_count BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'authorization_events' THEN
+        -- Firing from the event side: only unresolved pre-auth kind-9 events
+        -- (actor_kind = 4) require a denial attempt row. Authenticated
+        -- OperatorDenied events (actor_kind 1-3) have a canonical receipt and
+        -- no denial attempt.
+        IF NEW.event_kind <> 9 OR NEW.actor_kind <> 4 THEN
+            RETURN NULL;
+        END IF;
+
+        SELECT count(*) INTO attempt_count
+        FROM authorization_authentication_denial_attempts
+        WHERE community_id = NEW.community_id
+          AND audit_event_id = NEW.event_id;
+
+        IF attempt_count <> 1 THEN
+            RAISE EXCEPTION
+                'kind-9 audit event requires exactly one denial attempt, found %',
+                attempt_count
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_cardinality';
+        END IF;
+
+        -- Verify semantic coordinates match between event and denial attempt.
+        SELECT correlation_id, reason_code, semantic_fingerprint
+        INTO found_correlation_id, found_reason_code, found_semantic_fingerprint
+        FROM authorization_authentication_denial_attempts
+        WHERE community_id = NEW.community_id
+          AND audit_event_id = NEW.event_id;
+
+        IF found_correlation_id IS DISTINCT FROM NEW.correlation_id THEN
+            RAISE EXCEPTION
+                'denial attempt correlation_id % does not match event correlation_id % for event %',
+                found_correlation_id, NEW.correlation_id, NEW.event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        IF found_reason_code IS DISTINCT FROM NEW.reason_code THEN
+            RAISE EXCEPTION
+                'denial attempt reason_code % does not match event reason_code % for event %',
+                found_reason_code, NEW.reason_code, NEW.event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        IF found_semantic_fingerprint IS DISTINCT FROM NEW.semantic_fingerprint THEN
+            RAISE EXCEPTION
+                'denial attempt semantic_fingerprint does not match event semantic_fingerprint for event %',
+                NEW.event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+    ELSE
+        -- Firing from the denial-attempt side: verify the audit event is the
+        -- unresolved pre-auth kind-9 shape (actor_kind = 4, null receipt
+        -- fingerprint) and that exactly one denial attempt references it.
+        SELECT event_kind, actor_kind, request_fingerprint,
+               correlation_id, reason_code, semantic_fingerprint
+        INTO found_event_kind, found_actor_kind, found_request_fingerprint,
+             found_correlation_id, found_reason_code,
+             found_semantic_fingerprint
+        FROM authorization_events
+        WHERE community_id = NEW.community_id
+          AND event_id = NEW.audit_event_id;
+
+        IF NOT FOUND THEN
+            RAISE EXCEPTION
+                'denial attempt references non-existent audit event %',
+                NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_kind';
+        END IF;
+
+        IF found_event_kind <> 9 THEN
+            RAISE EXCEPTION
+                'denial attempt audit event must be kind 9, got %',
+                found_event_kind
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_kind';
+        END IF;
+
+        -- The referenced event must be the unresolved pre-auth shape: actor_kind
+        -- 4 with a null receipt fingerprint. Attaching a denial attempt to an
+        -- authenticated OperatorDenied (actor_kind 1-3) would violate the
+        -- credential-free pre-authentication contract.
+        IF found_actor_kind <> 4 OR found_request_fingerprint IS NOT NULL THEN
+            RAISE EXCEPTION
+                'denial attempt must reference an unresolved pre-auth kind-9 event '
+                '(actor_kind 4, null request_fingerprint); got actor_kind % '
+                'and request_fingerprint % for event %',
+                found_actor_kind,
+                CASE WHEN found_request_fingerprint IS NULL THEN 'null' ELSE 'non-null' END,
+                NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_kind';
+        END IF;
+
+        -- Verify semantic coordinates match.
+        IF found_correlation_id IS DISTINCT FROM NEW.correlation_id THEN
+            RAISE EXCEPTION
+                'denial attempt correlation_id % does not match event correlation_id % for event %',
+                NEW.correlation_id, found_correlation_id, NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        IF found_reason_code IS DISTINCT FROM NEW.reason_code THEN
+            RAISE EXCEPTION
+                'denial attempt reason_code % does not match event reason_code % for event %',
+                NEW.reason_code, found_reason_code, NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        IF found_semantic_fingerprint IS DISTINCT FROM NEW.semantic_fingerprint THEN
+            RAISE EXCEPTION
+                'denial attempt semantic_fingerprint does not match event semantic_fingerprint for event %',
+                NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        SELECT count(*) INTO attempt_count
+        FROM authorization_authentication_denial_attempts
+        WHERE community_id = NEW.community_id
+          AND audit_event_id = NEW.audit_event_id;
+
+        IF attempt_count <> 1 THEN
+            RAISE EXCEPTION
+                'exactly one denial attempt must reference audit event %, found %',
+                NEW.audit_event_id, attempt_count
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_cardinality';
+        END IF;
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE CONSTRAINT TRIGGER authorization_denial_attempt_event_cardinality
+    AFTER INSERT ON authorization_events
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_denial_attempt_guard_v1();
+
+CREATE CONSTRAINT TRIGGER authorization_denial_event_attempt_cardinality
+    AFTER INSERT ON authorization_authentication_denial_attempts
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_denial_attempt_guard_v1();
+
+CREATE FUNCTION authorization_operation_version_delta_cardinality_guard_v1()
+RETURNS TRIGGER AS $$
+DECLARE
+    manifest authorization_operation_version_delta_manifests%ROWTYPE;
+    actual_component_count BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'authorization_operation_version_delta_manifests' THEN
+        manifest := NEW;
+    ELSE
+        SELECT * INTO STRICT manifest
+        FROM authorization_operation_version_delta_manifests
+        WHERE community_id = NEW.community_id
+          AND operation_id = NEW.operation_id
+        FOR NO KEY UPDATE;
+    END IF;
+
+    SELECT count(*) INTO actual_component_count
+    FROM authorization_operation_version_deltas
+    WHERE community_id = manifest.community_id
+      AND operation_id = manifest.operation_id;
+
+    IF actual_component_count <> manifest.component_count THEN
+        RAISE EXCEPTION 'operation version manifest declares % components, found %',
+            manifest.component_count, actual_component_count
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_operation_version_delta_cardinality';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE CONSTRAINT TRIGGER authorization_operation_version_delta_manifest_cardinality
+    AFTER INSERT ON authorization_operation_version_delta_manifests
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_version_delta_cardinality_guard_v1();
+CREATE CONSTRAINT TRIGGER authorization_operation_version_delta_component_cardinality
+    AFTER INSERT ON authorization_operation_version_deltas
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_version_delta_cardinality_guard_v1();
+
+CREATE TRIGGER authorization_operation_version_delta_manifests_immutable
+    BEFORE UPDATE OR DELETE ON authorization_operation_version_delta_manifests
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_operation_version_delta_manifests_no_truncate
+    BEFORE TRUNCATE ON authorization_operation_version_delta_manifests
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER authorization_operation_version_deltas_immutable
+    BEFORE UPDATE OR DELETE ON authorization_operation_version_deltas
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_operation_version_deltas_no_truncate
+    BEFORE TRUNCATE ON authorization_operation_version_deltas
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER protected_object_authority_no_delete
+    BEFORE DELETE ON protected_object_authority
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER protected_object_authority_no_truncate
+    BEFORE TRUNCATE ON protected_object_authority
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+CREATE TRIGGER protected_object_authority_strict_replacement
+    BEFORE UPDATE ON protected_object_authority
+    FOR EACH ROW EXECUTE FUNCTION protected_object_authority_guard_v1();
+
+-- Canonical admission keeps its complete logical intent and the closed,
+-- credential-free application result beside the immutable receipt. This is
+-- what lets an identical request replay reconstruct the same typed result
+-- without repeating membership or other application DML. Object kinds match
+-- protected_object_authority: 1 domain, 2 channel, 3 repository, 4 media,
+-- 5 moderation target, 6 audio session.
+CREATE TABLE authorization_admission_results (
+    community_id UUID NOT NULL,
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    semantic_fingerprint BYTEA NOT NULL CHECK (
+        octet_length(semantic_fingerprint) = 32
+        AND semantic_fingerprint <> decode(repeat('00', 32), 'hex')
+    ),
+    object_kind SMALLINT NOT NULL CHECK (object_kind BETWEEN 1 AND 6),
+    object_key BYTEA NOT NULL CHECK (
+        octet_length(object_key) = 32
+        AND object_key <> decode(repeat('00', 32), 'hex')
+    ),
+    application_type BYTEA CHECK (
+        application_type IS NULL
+        OR (octet_length(application_type) = 32
+            AND application_type <> decode(repeat('00', 32), 'hex'))
+    ),
+    application_version SMALLINT CHECK (application_version > 0),
+    application_code SMALLINT CHECK (application_code > 0),
+    application_payload BYTEA CHECK (
+        application_payload IS NULL OR octet_length(application_payload) <= 4096
+    ),
+    application_intent_digest BYTEA CHECK (
+        application_intent_digest IS NULL
+        OR (octet_length(application_intent_digest) = 32
+            AND application_intent_digest <> decode(repeat('00', 32), 'hex'))
+    ),
+    application_effect_digest BYTEA CHECK (
+        application_effect_digest IS NULL
+        OR (octet_length(application_effect_digest) = 32
+            AND application_effect_digest <> decode(repeat('00', 32), 'hex'))
+    ),
+    application_result_digest BYTEA CHECK (
+        application_result_digest IS NULL
+        OR (octet_length(application_result_digest) = 32
+            AND application_result_digest <> decode(repeat('00', 32), 'hex'))
+    ),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, operation_id),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint),
+    CHECK (
+        (application_type IS NULL
+            AND application_version IS NULL
+            AND application_code IS NULL
+            AND application_payload IS NULL
+            AND application_intent_digest IS NULL
+            AND application_effect_digest IS NULL
+            AND application_result_digest IS NULL)
+        OR (application_type IS NOT NULL
+            AND application_version IS NOT NULL
+            AND application_code IS NOT NULL
+            AND application_payload IS NOT NULL
+            AND application_intent_digest IS NOT NULL
+            AND application_effect_digest IS NOT NULL
+            AND application_result_digest IS NOT NULL)
+    )
+);
+
+CREATE TRIGGER authorization_admission_results_no_update
+    BEFORE UPDATE OR DELETE ON authorization_admission_results
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_admission_results_no_truncate
+    BEFORE TRUNCATE ON authorization_admission_results
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+-- Bidirectional deferred cardinality guard: a kind-11 (protected-mutation)
+-- receipt must commit with exactly one admission result; an admission result
+-- must commit against a kind-11 receipt. Deferred so receipt and result may
+-- be inserted in any order inside one transaction.
+CREATE FUNCTION authorization_admission_result_guard_v1()
+RETURNS TRIGGER AS $$
+DECLARE
+    receipt authorization_operation_receipts%ROWTYPE;
+    result_count BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'authorization_operation_receipts' THEN
+        receipt := NEW;
+    ELSE
+        -- Firing from authorization_admission_results: look up the receipt.
+        SELECT * INTO receipt
+        FROM authorization_operation_receipts
+        WHERE community_id = NEW.community_id
+          AND operation_id = NEW.operation_id;
+        IF NOT FOUND THEN
+            -- FK on the result table already guards the non-existent receipt
+            -- case; this path should not occur in normal operation.
+            RAISE EXCEPTION
+                'admission result references non-existent receipt for operation %',
+                NEW.operation_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_admission_result_receipt_kind';
+        END IF;
+    END IF;
+
+    -- Non-kind-11 receipts require no admission result.
+    IF receipt.operation_kind <> 11 THEN
+        -- If this fired from the result side and the receipt is not kind 11,
+        -- the result is attaching to the wrong receipt kind.
+        IF TG_TABLE_NAME = 'authorization_admission_results' THEN
+            RAISE EXCEPTION
+                'admission result may only attach to a kind-11 (protected-mutation) receipt, got kind %',
+                receipt.operation_kind
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_admission_result_receipt_kind';
+        END IF;
+        RETURN NULL;
+    END IF;
+
+    SELECT count(*) INTO result_count
+    FROM authorization_admission_results
+    WHERE community_id = receipt.community_id
+      AND operation_id = receipt.operation_id;
+
+    IF result_count <> 1 THEN
+        RAISE EXCEPTION
+            'kind-11 receipt requires exactly one admission result, found %',
+            result_count
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_admission_result_cardinality';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE CONSTRAINT TRIGGER authorization_admission_result_receipt_cardinality
+    AFTER INSERT ON authorization_operation_receipts
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_admission_result_guard_v1();
+
+CREATE CONSTRAINT TRIGGER authorization_admission_result_result_cardinality
+    AFTER INSERT ON authorization_admission_results
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_admission_result_guard_v1();
+
+-- Every successful/no-op core lifecycle receipt has exactly one privacy-safe
+-- audit event with the closed transition-kind mapping. Both directions are
+-- deferred so receipt, history, event, selectors, and binding may be inserted
+-- in any order inside one transaction but can never commit partially. The
+-- extended-lifecycle operation kinds (2 provision, 4 disable, 7 recover,
+-- 8 enable, 9 admission loss) and their event kinds arrive with the
+-- FI-LIFECYCLE migration; here the mapping covers only enroll/retire/revoke/
+-- rotate. Non-lifecycle receipts (protected mutation, invalidation) carry no
+-- audit-event cardinality requirement.
+CREATE FUNCTION authorization_operation_receipt_event_guard_v1()
+RETURNS TRIGGER AS $$
+DECLARE
+    receipt authorization_operation_receipts%ROWTYPE;
+    expected_event_kind SMALLINT;
+    matching_event_count BIGINT;
+    expected_event_count BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'authorization_operation_receipts' THEN
+        receipt := NEW;
+    ELSE
+        SELECT * INTO receipt
+        FROM authorization_operation_receipts
+        WHERE community_id = NEW.community_id
+          AND operation_id = NEW.operation_id;
+        IF NOT FOUND THEN
+            -- Credential-free pre-authentication denials intentionally have no
+            -- canonical receipt. Their separate FK/shape guards still run.
+            RETURN NULL;
+        END IF;
+    END IF;
+
+    expected_event_kind := CASE receipt.operation_kind
+        WHEN 1 THEN 1  -- enroll
+        WHEN 3 THEN 6  -- retire
+        WHEN 5 THEN 2  -- revoke
+        WHEN 6 THEN 3  -- rotate
+        ELSE NULL
+    END;
+    IF expected_event_kind IS NULL THEN
+        RETURN NULL;
+    END IF;
+
+    -- Only applied (outcome_code = 1) and no-op (outcome_code = 3) lifecycle
+    -- receipts require exactly one paired success-transition event. A denied
+    -- lifecycle receipt (outcome_code = 2) requires zero events from the
+    -- complete core lifecycle success-transition class (kinds 1, 2, 3, 6:
+    -- enrolled, revoked, rotated, retired). Forbidding only the mapped kind
+    -- would allow a wrong-kind transition event to attach to the denied receipt,
+    -- which is equally a contradictory durable fact. Legitimate audit/denial
+    -- events of other kinds (e.g., authenticated kind 9) remain allowed.
+    -- Other outcome codes (4, 5) are not core lifecycle outcomes; skip.
+    IF receipt.outcome_code IN (1, 3) THEN
+        SELECT
+            count(*),
+            count(*) FILTER (WHERE event_kind = expected_event_kind)
+        INTO matching_event_count, expected_event_count
+        FROM authorization_events
+        WHERE community_id = receipt.community_id
+          AND operation_id = receipt.operation_id
+          AND request_fingerprint = receipt.request_fingerprint;
+
+        IF matching_event_count <> 1 OR expected_event_count <> 1 THEN
+            RAISE EXCEPTION
+                'lifecycle receipt requires exactly one event kind %, found % total and % expected',
+                expected_event_kind, matching_event_count, expected_event_count
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_operation_receipt_event_cardinality';
+        END IF;
+    ELSIF receipt.outcome_code = 2 THEN
+        SELECT count(*) FILTER (WHERE event_kind IN (1, 2, 3, 6))
+        INTO expected_event_count
+        FROM authorization_events
+        WHERE community_id = receipt.community_id
+          AND operation_id = receipt.operation_id
+          AND request_fingerprint = receipt.request_fingerprint;
+
+        IF expected_event_count <> 0 THEN
+            RAISE EXCEPTION
+                'denied lifecycle receipt must not have any core success-transition event '
+                '(kinds 1/2/3/6); found % — contradictory durable facts are not permitted',
+                expected_event_count
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denied_lifecycle_receipt_no_success_event';
+        END IF;
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE CONSTRAINT TRIGGER authorization_operation_receipt_event_cardinality
+    AFTER INSERT ON authorization_operation_receipts
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_receipt_event_guard_v1();
+
+CREATE CONSTRAINT TRIGGER authorization_event_receipt_cardinality
+    AFTER INSERT ON authorization_events
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_receipt_event_guard_v1();
+
+-- Same ledger posture as migration 0041's identity relations: the admission,
+-- replay, audit, and invalidation relations below are append-only denial and
+-- authority facts protected by immutable no_delete/no_truncate triggers, so
+-- they carry community_id as provenance rather than deletable ownership. Widen
+-- the single SQL source of truth so the universal write fence and the deletion
+-- catalog treat all NIP-FI relations as ledger — never fence-attached, never
+-- purged, never counted as tenant-scoped drift. This re-declares the full set
+-- (0041's identity relations plus these) because CREATE OR REPLACE FUNCTION
+-- replaces the whole body.
+CREATE OR REPLACE FUNCTION community_write_fence_excluded_table(target NAME) RETURNS BOOLEAN
+LANGUAGE SQL IMMUTABLE STRICT PARALLEL SAFE AS $$
+    SELECT target::TEXT = ANY (ARRAY[
+        'community_deletion_requests', 'community_deletion_approvals',
+        'community_deletion_checkpoints', 'community_serving_write_leases',
+        'community_deletion_executor_heartbeats', 'product_feedback',
+        'rate_limit_violations',
+        'authorization_operation_receipts', 'identity_enrollment_policies',
+        'identity_bindings', 'identity_lifecycle_history',
+        'identity_lifecycle_selectors',
+        'authorization_invalidation_domains', 'authorization_invalidation_floors',
+        'authorization_authority_epochs', 'protected_object_authority',
+        'authorization_event_capacity', 'authorization_events',
+        'authorization_authentication_denial_attempts',
+        'authorization_operation_version_delta_manifests',
+        'authorization_operation_version_deltas', 'authorization_admission_results'
+    ]::TEXT[])
+$$;
diff --git a/schema/schema.sql b/schema/schema.sql
index 54566103335..2335f8bf0bd 100644
--- a/schema/schema.sql
+++ b/schema/schema.sql
@@ -1485,13 +1485,19 @@ $$;
 CREATE FUNCTION community_write_fence_excluded_table(target NAME) RETURNS BOOLEAN
 LANGUAGE SQL IMMUTABLE STRICT PARALLEL SAFE AS $$
     SELECT target::TEXT = ANY (ARRAY[
-        'community_deletion_requests',
-        'community_deletion_approvals',
-        'community_deletion_checkpoints',
-        'community_serving_write_leases',
-        'community_deletion_executor_heartbeats',
-        'product_feedback',
-        'rate_limit_violations'
+        'community_deletion_requests', 'community_deletion_approvals',
+        'community_deletion_checkpoints', 'community_serving_write_leases',
+        'community_deletion_executor_heartbeats', 'product_feedback',
+        'rate_limit_violations',
+        'authorization_operation_receipts', 'identity_enrollment_policies',
+        'identity_bindings', 'identity_lifecycle_history',
+        'identity_lifecycle_selectors',
+        'authorization_invalidation_domains', 'authorization_invalidation_floors',
+        'authorization_authority_epochs', 'protected_object_authority',
+        'authorization_event_capacity', 'authorization_events',
+        'authorization_authentication_denial_attempts',
+        'authorization_operation_version_delta_manifests',
+        'authorization_operation_version_deltas', 'authorization_admission_results'
     ]::TEXT[])
 $$;
 
@@ -1895,3 +1901,1889 @@ CREATE INDEX idx_relay_operator_audit_target
 
 INSERT INTO _operator_global_tables (table_name, reason) VALUES
     ('relay_operator_audit', 'deployment-global append-only roster mutation audit trail; no community_id intentionally');
+
+
+-- ============================================================================
+-- NIP-FI core identity + base-lifecycle foundation (mirror of migration 0041).
+-- The community_write_fence_excluded_table definition above already folds in
+-- the NIP-FI ledger relations; the per-migration CREATE OR REPLACE bodies are
+-- intentionally omitted here (desired state keeps one consolidated definition).
+-- ============================================================================
+
+-- The sole idempotency/result root shared by identity base lifecycle,
+-- protected operations, and invalidation. Pre-authentication denials never
+-- write this table. ExactReplay and IntentConflict are read-time observations,
+-- not persisted outcomes.
+CREATE TABLE authorization_operation_receipts (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    -- Core operation kinds: 1 enroll, 3 retire, 5 revoke, 6 rotate,
+    -- 11 protected mutation, 12 invalidation. Extended lifecycle kinds
+    -- (2 provision, 4 disable, 7 recover, 8 enable, 9 admission loss) and
+    -- 10 operator are introduced by their owning later migrations.
+    operation_kind SMALLINT NOT NULL CHECK (
+        operation_kind IN (1, 3, 5, 6, 11, 12)
+    ),
+    actor_fingerprint BYTEA NOT NULL CHECK (octet_length(actor_fingerprint) = 32),
+    -- 1 applied, 2 denied, 3 no-op.
+    outcome_code SMALLINT NOT NULL CHECK (outcome_code IN (1, 2, 3)),
+    result_digest BYTEA NOT NULL CHECK (octet_length(result_digest) = 32),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, operation_id),
+    UNIQUE (community_id, operation_id, request_fingerprint),
+    UNIQUE (
+        community_id,
+        operation_id,
+        request_fingerprint,
+        operation_kind,
+        outcome_code
+    ),
+    CHECK (operation_id <> '00000000-0000-0000-0000-000000000000'::uuid)
+);
+
+-- Immutable monotonic local policy revisions. Enrollment modes are the closed
+-- provider-free V1 set: 1 attested-key, 2 provisioned, 3 risk-labelled TOFU.
+CREATE TABLE identity_enrollment_policies (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    policy_revision BIGINT NOT NULL CHECK (policy_revision > 0),
+    enrollment_mode SMALLINT NOT NULL CHECK (enrollment_mode IN (1, 2, 3)),
+    policy_digest BYTEA NOT NULL CHECK (octet_length(policy_digest) = 32),
+    effective_at TIMESTAMPTZ NOT NULL,
+    -- Optional local binding-policy expiry. Federated token `exp` MUST NOT be
+    -- copied here: token lifetime bounds an authorization lease, not this
+    -- durable binding generation.
+    expires_at TIMESTAMPTZ,
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, policy_revision),
+    CHECK (expires_at IS NULL OR effective_at < expires_at)
+);
+
+-- One row is one immutable binding generation. binding_version is allocated
+-- from one non-cycling PostgreSQL identity sequence and is never changed or
+-- reused. Explicit lifecycle may only retire the generation; X/Y denial
+-- semantics live in immutable selector facts below, not alternate row states.
+CREATE TABLE identity_bindings (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    binding_id UUID NOT NULL,
+    binding_version BIGINT GENERATED ALWAYS AS IDENTITY (
+        START WITH 1 INCREMENT BY 1 NO MINVALUE NO MAXVALUE CACHE 1 NO CYCLE
+    ),
+    issuer TEXT COLLATE "C" NOT NULL CHECK (octet_length(issuer) BETWEEN 1 AND 2048),
+    subject TEXT COLLATE "C" NOT NULL CHECK (octet_length(subject) BETWEEN 1 AND 2048),
+    principal_fingerprint BYTEA NOT NULL CHECK (octet_length(principal_fingerprint) = 32),
+    event_author_pubkey BYTEA NOT NULL CHECK (octet_length(event_author_pubkey) = 32),
+    -- 1 active, 2 retired.
+    binding_state SMALLINT NOT NULL CHECK (binding_state IN (1, 2)),
+    lifecycle_revision BIGINT NOT NULL CHECK (lifecycle_revision IN (1, 2)),
+    -- 1 attested-key, 2 provisioned, 3 risk-labelled TOFU.
+    binding_provenance SMALLINT NOT NULL CHECK (binding_provenance IN (1, 2, 3)),
+    policy_revision BIGINT NOT NULL CHECK (policy_revision > 0),
+    -- Canonical evidence for the selected provenance. This is an assertion
+    -- digest for attested/TOFU admission and a provisioning receipt digest for
+    -- separately provisioned admission; it never stores credential bytes.
+    enrollment_evidence_digest BYTEA NOT NULL CHECK (
+        octet_length(enrollment_evidence_digest) = 32
+    ),
+    expires_at TIMESTAMPTZ,
+    birth_history_id UUID NOT NULL,
+    creation_operation_id UUID NOT NULL,
+    creation_request_fingerprint BYTEA NOT NULL CHECK (
+        octet_length(creation_request_fingerprint) = 32
+    ),
+    retirement_history_id UUID,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, binding_id),
+    UNIQUE (community_id, binding_version),
+    UNIQUE (community_id, binding_id, binding_version),
+    FOREIGN KEY (community_id, policy_revision)
+        REFERENCES identity_enrollment_policies
+            (community_id, policy_revision),
+    CHECK (binding_version > 0),
+    CHECK (binding_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (birth_history_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (creation_operation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (expires_at IS NULL OR created_at < expires_at),
+    CHECK (
+        (binding_state = 1 AND lifecycle_revision = 1 AND retirement_history_id IS NULL)
+        OR (binding_state = 2 AND lifecycle_revision = 2 AND retirement_history_id IS NOT NULL)
+    )
+);
+
+-- State 1 is Active. Expiry is evaluated with authoritative PostgreSQL time
+-- at read/finalization and is exclusive; it cannot appear in an index predicate.
+CREATE UNIQUE INDEX identity_bindings_active_principal
+    ON identity_bindings (community_id, issuer, subject)
+    WHERE binding_state = 1;
+CREATE INDEX identity_bindings_principal_fingerprint_lookup
+    ON identity_bindings (community_id, principal_fingerprint)
+    WHERE binding_state = 1;
+CREATE UNIQUE INDEX identity_bindings_active_event_author
+    ON identity_bindings (community_id, event_author_pubkey)
+    WHERE binding_state = 1;
+CREATE INDEX identity_bindings_current_lookup
+    ON identity_bindings (community_id, event_author_pubkey, binding_state, expires_at);
+
+-- The one canonical immutable lifecycle transition row for a successful or
+-- no-op lifecycle operation. A transition can name an old generation, a new
+-- successor generation, both (Rotate), or neither (a semantic no-op). It is not
+-- a second result/effect engine: the shared receipt remains the sole persisted
+-- operation outcome. Core transition kinds only: 1 enroll, 3 retire, 5 revoke,
+-- 6 rotate.
+CREATE TABLE identity_lifecycle_history (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    history_id UUID NOT NULL,
+    transition_kind SMALLINT NOT NULL CHECK (
+        transition_kind IN (1, 3, 5, 6)
+    ),
+    -- Matches the shared receipt: 1 applied, 3 no-op.
+    outcome_code SMALLINT NOT NULL CHECK (outcome_code IN (1, 3)),
+    old_binding_id UUID,
+    old_binding_version BIGINT CHECK (old_binding_version IS NULL OR old_binding_version > 0),
+    old_prior_lifecycle_revision BIGINT CHECK (
+        old_prior_lifecycle_revision IS NULL OR old_prior_lifecycle_revision IN (1, 2)
+    ),
+    old_prior_state SMALLINT CHECK (old_prior_state IS NULL OR old_prior_state IN (1, 2)),
+    old_resulting_lifecycle_revision BIGINT CHECK (
+        old_resulting_lifecycle_revision IS NULL OR old_resulting_lifecycle_revision IN (1, 2)
+    ),
+    old_resulting_state SMALLINT CHECK (
+        old_resulting_state IS NULL OR old_resulting_state IN (1, 2)
+    ),
+    successor_binding_id UUID,
+    successor_binding_version BIGINT CHECK (
+        successor_binding_version IS NULL OR successor_binding_version > 0
+    ),
+    successor_lifecycle_revision BIGINT CHECK (
+        successor_lifecycle_revision IS NULL OR successor_lifecycle_revision = 1
+    ),
+    successor_state SMALLINT CHECK (successor_state IS NULL OR successor_state = 1),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    transition_digest BYTEA NOT NULL CHECK (octet_length(transition_digest) = 32),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, history_id),
+    UNIQUE (community_id, operation_id),
+    UNIQUE (community_id, history_id, operation_id, request_fingerprint),
+    UNIQUE (
+        community_id,
+        history_id,
+        successor_binding_id,
+        successor_binding_version,
+        operation_id,
+        request_fingerprint
+    ),
+    UNIQUE (
+        community_id,
+        history_id,
+        old_binding_id,
+        old_binding_version,
+        old_resulting_lifecycle_revision,
+        old_resulting_state
+    ),
+    FOREIGN KEY (
+        community_id,
+        operation_id,
+        request_fingerprint,
+        transition_kind,
+        outcome_code
+    ) REFERENCES authorization_operation_receipts (
+        community_id,
+        operation_id,
+        request_fingerprint,
+        operation_kind,
+        outcome_code
+    ) DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, old_binding_id, old_binding_version)
+        REFERENCES identity_bindings (community_id, binding_id, binding_version)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, successor_binding_id, successor_binding_version)
+        REFERENCES identity_bindings (community_id, binding_id, binding_version)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (history_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (operation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (
+        (old_binding_id IS NULL
+            AND old_binding_version IS NULL
+            AND old_prior_lifecycle_revision IS NULL
+            AND old_prior_state IS NULL
+            AND old_resulting_lifecycle_revision IS NULL
+            AND old_resulting_state IS NULL)
+        OR (old_binding_id IS NOT NULL
+            AND old_binding_version IS NOT NULL
+            AND old_prior_lifecycle_revision IS NOT NULL
+            AND old_prior_state IS NOT NULL
+            AND old_resulting_lifecycle_revision IS NOT NULL
+            AND old_resulting_state IS NOT NULL)
+    ),
+    CHECK (
+        (successor_binding_id IS NULL
+            AND successor_binding_version IS NULL
+            AND successor_lifecycle_revision IS NULL
+            AND successor_state IS NULL)
+        OR (successor_binding_id IS NOT NULL
+            AND successor_binding_version IS NOT NULL
+            AND successor_lifecycle_revision = 1
+            AND successor_state = 1)
+    ),
+    CHECK (
+        old_binding_id IS NULL
+        OR successor_binding_id IS NULL
+        OR old_binding_id <> successor_binding_id
+    ),
+    CHECK (
+        old_binding_version IS NULL
+        OR successor_binding_version IS NULL
+        OR old_binding_version <> successor_binding_version
+    ),
+    -- Core lifecycle only ever moves Active/r1 to Retired/r2 for a named old
+    -- generation. Extended re-enablement (recover/enable from Retired/r2) is a
+    -- later migration's concern.
+    CHECK (
+        old_binding_id IS NULL
+        OR (old_prior_lifecycle_revision = 1
+            AND old_prior_state = 1
+            AND old_resulting_lifecycle_revision = 2
+            AND old_resulting_state = 2)
+    ),
+    CHECK (
+        (outcome_code = 3
+            AND old_binding_id IS NULL
+            AND successor_binding_id IS NULL)
+        OR (outcome_code = 1 AND (
+            (transition_kind = 1
+                AND old_binding_id IS NULL
+                AND successor_binding_id IS NOT NULL)
+            OR (transition_kind = 3
+                AND old_binding_id IS NOT NULL
+                AND successor_binding_id IS NULL)
+            OR (transition_kind = 5
+                AND successor_binding_id IS NULL)
+            OR (transition_kind = 6
+                AND old_binding_id IS NOT NULL
+                AND successor_binding_id IS NOT NULL)
+        ))
+    )
+);
+
+CREATE INDEX identity_lifecycle_history_old_binding
+    ON identity_lifecycle_history (community_id, old_binding_id, old_binding_version, recorded_at);
+CREATE INDEX identity_lifecycle_history_successor_binding
+    ON identity_lifecycle_history (
+        community_id,
+        successor_binding_id,
+        successor_binding_version,
+        recorded_at
+    );
+
+-- Circular birth/transition ordering is deliberate and fully deferred. Every
+-- generation must commit with its exact birth transition, and a retired row
+-- must commit with the exact transition that changed Active/r1 to Retired/r2.
+ALTER TABLE identity_bindings
+    ADD CONSTRAINT identity_bindings_exact_birth_history_fk
+    FOREIGN KEY (
+        community_id,
+        birth_history_id,
+        binding_id,
+        binding_version,
+        creation_operation_id,
+        creation_request_fingerprint
+    ) REFERENCES identity_lifecycle_history (
+        community_id,
+        history_id,
+        successor_binding_id,
+        successor_binding_version,
+        operation_id,
+        request_fingerprint
+    ) DEFERRABLE INITIALLY DEFERRED;
+
+ALTER TABLE identity_bindings
+    ADD CONSTRAINT identity_bindings_exact_retirement_history_fk
+    FOREIGN KEY (
+        community_id,
+        retirement_history_id,
+        binding_id,
+        binding_version,
+        lifecycle_revision,
+        binding_state
+    ) REFERENCES identity_lifecycle_history (
+        community_id,
+        history_id,
+        old_binding_id,
+        old_binding_version,
+        old_resulting_lifecycle_revision,
+        old_resulting_state
+    ) DEFERRABLE INITIALLY DEFERRED;
+
+-- One immutable closed-scope fact table. Core selector kinds only:
+-- 1 retired pair (P), 3 revoked key (Y). Both are permanent. The extended
+-- disabled-identity (X) and pending-replacement (Q) selectors, and their
+-- one-shot consumption, are introduced by the FI-LIFECYCLE migration.
+CREATE TABLE identity_lifecycle_selectors (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    selector_id UUID NOT NULL,
+    selector_kind SMALLINT NOT NULL CHECK (selector_kind IN (1, 3)),
+    selector_fingerprint BYTEA NOT NULL CHECK (octet_length(selector_fingerprint) = 32),
+    fact_generation BIGINT NOT NULL CHECK (fact_generation > 0),
+    principal_fingerprint BYTEA CHECK (
+        principal_fingerprint IS NULL OR octet_length(principal_fingerprint) = 32
+    ),
+    event_author_pubkey BYTEA CHECK (
+        event_author_pubkey IS NULL OR octet_length(event_author_pubkey) = 32
+    ),
+    binding_id UUID,
+    binding_version BIGINT CHECK (binding_version IS NULL OR binding_version > 0),
+    asserted_history_id UUID NOT NULL,
+    selected_by_operation_id UUID NOT NULL,
+    selected_by_request_fingerprint BYTEA NOT NULL CHECK (
+        octet_length(selected_by_request_fingerprint) = 32
+    ),
+    selected_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, selector_id),
+    UNIQUE (community_id, selector_id, selector_kind),
+    UNIQUE (community_id, selector_kind, selector_fingerprint, fact_generation),
+    FOREIGN KEY (
+        community_id,
+        asserted_history_id,
+        selected_by_operation_id,
+        selected_by_request_fingerprint
+    ) REFERENCES identity_lifecycle_history (
+        community_id,
+        history_id,
+        operation_id,
+        request_fingerprint
+    ) DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (
+        community_id,
+        selected_by_operation_id,
+        selected_by_request_fingerprint
+    ) REFERENCES authorization_operation_receipts (
+        community_id,
+        operation_id,
+        request_fingerprint
+    ) DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, binding_id, binding_version)
+        REFERENCES identity_bindings (community_id, binding_id, binding_version)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (selector_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (
+        (selector_kind = 1
+            AND fact_generation = 1
+            AND principal_fingerprint IS NOT NULL
+            AND event_author_pubkey IS NOT NULL
+            AND binding_id IS NOT NULL
+            AND binding_version IS NOT NULL)
+        OR (selector_kind = 3
+            AND fact_generation = 1
+            AND principal_fingerprint IS NULL
+            AND event_author_pubkey IS NOT NULL
+            AND binding_id IS NULL
+            AND binding_version IS NULL)
+    )
+);
+
+CREATE UNIQUE INDEX identity_lifecycle_selectors_permanent_pair
+    ON identity_lifecycle_selectors (community_id, binding_id, binding_version)
+    WHERE selector_kind = 1;
+CREATE UNIQUE INDEX identity_lifecycle_selectors_permanent_principal_key
+    ON identity_lifecycle_selectors (
+        community_id,
+        principal_fingerprint,
+        event_author_pubkey
+    ) WHERE selector_kind = 1;
+CREATE UNIQUE INDEX identity_lifecycle_selectors_permanent_key
+    ON identity_lifecycle_selectors (community_id, event_author_pubkey)
+    WHERE selector_kind = 3;
+CREATE INDEX identity_lifecycle_selectors_principal_lookup
+    ON identity_lifecycle_selectors
+        (community_id, selector_kind, principal_fingerprint, fact_generation);
+CREATE INDEX identity_lifecycle_selectors_key_lookup
+    ON identity_lifecycle_selectors
+        (community_id, selector_kind, event_author_pubkey, fact_generation);
+CREATE INDEX identity_lifecycle_selectors_binding_lookup
+    ON identity_lifecycle_selectors
+        (community_id, selector_kind, binding_id, binding_version, fact_generation);
+CREATE INDEX identity_lifecycle_selectors_asserted_history
+    ON identity_lifecycle_selectors
+        (community_id, asserted_history_id, selector_kind);
+
+-- Serializes policy-revision inserts per community: each new revision must
+-- strictly exceed the current maximum (FI-INV-06 — stable assertion policy
+-- anchor; a backfilled or replayed revision is incoherent). The per-community
+-- advisory lock prevents two concurrent writers from both passing a plain
+-- SELECT MAX() check and committing conflicting revisions.
+CREATE FUNCTION identity_enrollment_policy_revision_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    lock_key BIGINT;
+    max_revision BIGINT;
+BEGIN
+    -- Acquire a per-community exclusive transaction-scoped advisory lock so
+    -- that concurrent insertions serialize here. The key is a stable hash of
+    -- the namespace string and the community_id bytes.
+    lock_key := hashtextextended(
+        'buzz:enrollment-policy-revision:v1:' || NEW.community_id::text,
+        0
+    );
+    PERFORM pg_advisory_xact_lock(lock_key);
+
+    SELECT MAX(policy_revision)
+    INTO max_revision
+    FROM identity_enrollment_policies
+    WHERE community_id = NEW.community_id;
+
+    IF max_revision IS NOT NULL
+        AND NEW.policy_revision <= max_revision
+    THEN
+        RAISE EXCEPTION
+            'policy_revision % does not strictly exceed current maximum % for community %',
+            NEW.policy_revision, max_revision, NEW.community_id
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_enrollment_policy_revision_monotonic';
+    END IF;
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION nip_fi_reject_row_mutation_v1() RETURNS TRIGGER AS $$
+BEGIN
+    RAISE EXCEPTION '% is immutable', TG_TABLE_NAME
+        USING ERRCODE = 'check_violation';
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION nip_fi_reject_truncate_v1() RETURNS TRIGGER AS $$
+BEGIN
+    RAISE EXCEPTION '% cannot be truncated', TG_TABLE_NAME
+        USING ERRCODE = 'check_violation';
+END;
+$$ LANGUAGE plpgsql;
+
+-- Every binding/selector path derives the same domain-scoped coordinates and
+-- takes their signed BIGINT advisory keys in numeric order. Typed transaction
+-- APIs take these locks before row mutation; the triggers are the fail-closed
+-- backstop for direct SQL.
+CREATE FUNCTION identity_lifecycle_lock_coordinates_v1(
+    locked_community_id UUID,
+    locked_principal_fingerprint BYTEA,
+    locked_event_author_pubkey BYTEA
+) RETURNS VOID AS $$
+DECLARE
+    principal_lock_key BIGINT;
+    event_author_lock_key BIGINT;
+BEGIN
+    IF locked_principal_fingerprint IS NOT NULL THEN
+        principal_lock_key := hashtextextended(
+            'buzz:identity-lifecycle-coordinate:v1:principal:'
+                || locked_community_id::text || ':'
+                || encode(locked_principal_fingerprint, 'hex'),
+            0
+        );
+    END IF;
+    IF locked_event_author_pubkey IS NOT NULL THEN
+        event_author_lock_key := hashtextextended(
+            'buzz:identity-lifecycle-coordinate:v1:key:'
+                || locked_community_id::text || ':'
+                || encode(locked_event_author_pubkey, 'hex'),
+            0
+        );
+    END IF;
+
+    IF principal_lock_key IS NOT NULL AND event_author_lock_key IS NOT NULL THEN
+        PERFORM pg_advisory_xact_lock(LEAST(principal_lock_key, event_author_lock_key));
+        IF principal_lock_key <> event_author_lock_key THEN
+            PERFORM pg_advisory_xact_lock(GREATEST(principal_lock_key, event_author_lock_key));
+        END IF;
+    ELSIF principal_lock_key IS NOT NULL THEN
+        PERFORM pg_advisory_xact_lock(principal_lock_key);
+    ELSIF event_author_lock_key IS NOT NULL THEN
+        PERFORM pg_advisory_xact_lock(event_author_lock_key);
+    END IF;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_bindings_insert_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM identity_lifecycle_lock_coordinates_v1(
+        NEW.community_id,
+        NEW.principal_fingerprint,
+        NEW.event_author_pubkey
+    );
+    IF NEW.binding_state <> 1
+        OR NEW.lifecycle_revision <> 1
+        OR NEW.retirement_history_id IS NOT NULL
+    THEN
+        RAISE EXCEPTION 'identity binding birth must be Active at lifecycle revision 1'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_bindings_birth_state';
+    END IF;
+    NEW.created_at := transaction_timestamp();
+    NEW.updated_at := transaction_timestamp();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_bindings_transition_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    PERFORM identity_lifecycle_lock_coordinates_v1(
+        OLD.community_id,
+        OLD.principal_fingerprint,
+        OLD.event_author_pubkey
+    );
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.binding_id IS DISTINCT FROM OLD.binding_id
+        OR NEW.binding_version IS DISTINCT FROM OLD.binding_version
+        OR NEW.issuer IS DISTINCT FROM OLD.issuer
+        OR NEW.subject IS DISTINCT FROM OLD.subject
+        OR NEW.principal_fingerprint IS DISTINCT FROM OLD.principal_fingerprint
+        OR NEW.event_author_pubkey IS DISTINCT FROM OLD.event_author_pubkey
+        OR NEW.binding_provenance IS DISTINCT FROM OLD.binding_provenance
+        OR NEW.policy_revision IS DISTINCT FROM OLD.policy_revision
+        OR NEW.enrollment_evidence_digest IS DISTINCT FROM OLD.enrollment_evidence_digest
+        OR NEW.expires_at IS DISTINCT FROM OLD.expires_at
+        OR NEW.birth_history_id IS DISTINCT FROM OLD.birth_history_id
+        OR NEW.creation_operation_id IS DISTINCT FROM OLD.creation_operation_id
+        OR NEW.creation_request_fingerprint IS DISTINCT FROM OLD.creation_request_fingerprint
+        OR NEW.created_at IS DISTINCT FROM OLD.created_at
+    THEN
+        RAISE EXCEPTION 'identity binding generation coordinates are immutable'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_bindings_immutable_generation';
+    END IF;
+    IF OLD.binding_state <> 1
+        OR OLD.lifecycle_revision <> 1
+        OR OLD.retirement_history_id IS NOT NULL
+        OR NEW.binding_state <> 2
+        OR NEW.lifecycle_revision <> 2
+        OR NEW.retirement_history_id IS NULL
+        OR NEW.retirement_history_id = OLD.birth_history_id
+    THEN
+        RAISE EXCEPTION 'identity binding permits only Active/r1 to Retired/r2'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_bindings_active_to_retired';
+    END IF;
+    NEW.updated_at := transaction_timestamp();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_lifecycle_history_insert_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    NEW.recorded_at := transaction_timestamp();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_binding_history_semantics_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    retirement identity_lifecycle_history%ROWTYPE;
+BEGIN
+    IF NEW.binding_state = 2 THEN
+        SELECT * INTO STRICT retirement
+        FROM identity_lifecycle_history
+        WHERE community_id = NEW.community_id
+          AND history_id = NEW.retirement_history_id
+          AND old_binding_id = NEW.binding_id
+          AND old_binding_version = NEW.binding_version;
+        IF retirement.outcome_code <> 1
+            OR retirement.old_prior_lifecycle_revision <> 1
+            OR retirement.old_prior_state <> 1
+            OR retirement.old_resulting_lifecycle_revision <> 2
+            OR retirement.old_resulting_state <> 2
+        THEN
+            RAISE EXCEPTION 'retired binding must reference its exact Active-to-Retired transition'
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'identity_bindings_retirement_history_semantics';
+        END IF;
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_binding_birth_eligibility_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF EXISTS (
+        SELECT 1
+        FROM identity_lifecycle_selectors selector
+        WHERE selector.community_id = NEW.community_id
+          AND (
+            (selector.selector_kind = 1
+                AND selector.principal_fingerprint = NEW.principal_fingerprint
+                AND selector.event_author_pubkey = NEW.event_author_pubkey)
+            OR (selector.selector_kind = 3
+                AND selector.event_author_pubkey = NEW.event_author_pubkey)
+          )
+    ) THEN
+        RAISE EXCEPTION 'binding birth conflicts with an effective lifecycle selector'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_bindings_birth_eligibility';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION authorization_operation_receipt_history_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    history_count BIGINT;
+    expected_count BIGINT;
+BEGIN
+    SELECT count(*) INTO history_count
+    FROM identity_lifecycle_history history
+    WHERE history.community_id = NEW.community_id
+      AND history.operation_id = NEW.operation_id;
+
+    -- Core lifecycle receipts (enroll, retire, revoke, rotate) each require
+    -- exactly one lifecycle-history row. Non-lifecycle receipts (protected
+    -- mutation, invalidation) require none.
+    expected_count := CASE
+        WHEN NEW.operation_kind IN (1, 3, 5, 6) AND NEW.outcome_code IN (1, 3) THEN 1
+        ELSE 0
+    END;
+    IF history_count <> expected_count THEN
+        RAISE EXCEPTION 'operation receipt requires % lifecycle history row, found %',
+            expected_count, history_count
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_operation_receipt_history_cardinality';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_lifecycle_selector_insert_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    NEW.selected_at := transaction_timestamp();
+    PERFORM identity_lifecycle_lock_coordinates_v1(
+        NEW.community_id,
+        CASE WHEN NEW.selector_kind = 1 THEN NEW.principal_fingerprint END,
+        NEW.event_author_pubkey
+    );
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_lifecycle_selector_history_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    history identity_lifecycle_history%ROWTYPE;
+    old_binding identity_bindings%ROWTYPE;
+BEGIN
+    SELECT * INTO STRICT history
+    FROM identity_lifecycle_history
+    WHERE community_id = NEW.community_id
+      AND history_id = NEW.asserted_history_id
+      AND operation_id = NEW.selected_by_operation_id
+      AND request_fingerprint = NEW.selected_by_request_fingerprint;
+
+    IF history.old_binding_id IS NOT NULL THEN
+        SELECT * INTO STRICT old_binding
+        FROM identity_bindings
+        WHERE community_id = history.community_id
+          AND binding_id = history.old_binding_id
+          AND binding_version = history.old_binding_version;
+    END IF;
+
+    -- A retired-pair (P) selector is asserted by retire, revoke, or rotate of a
+    -- named old generation; a revoked-key (Y) selector by revoke.
+    IF history.outcome_code <> 1
+        OR (NEW.selector_kind = 1 AND (
+            history.transition_kind NOT IN (3, 5, 6)
+            OR history.old_binding_id IS DISTINCT FROM NEW.binding_id
+            OR history.old_binding_version IS DISTINCT FROM NEW.binding_version
+            OR old_binding.principal_fingerprint IS DISTINCT FROM NEW.principal_fingerprint
+            OR old_binding.event_author_pubkey IS DISTINCT FROM NEW.event_author_pubkey
+        ))
+        OR (NEW.selector_kind = 3 AND (
+            history.transition_kind <> 5
+            OR (history.old_binding_id IS NOT NULL
+                AND old_binding.event_author_pubkey
+                    IS DISTINCT FROM NEW.event_author_pubkey)
+        ))
+    THEN
+        RAISE EXCEPTION 'selector does not match its lifecycle transition'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_lifecycle_selector_history_semantics';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION identity_lifecycle_transition_integrity_guard_v1() RETURNS TRIGGER AS $$
+DECLARE
+    transition identity_lifecycle_history%ROWTYPE;
+    old_binding_state SMALLINT;
+    asserted_p BIGINT;
+    asserted_y BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'identity_lifecycle_history' THEN
+        transition := NEW;
+    ELSIF TG_TABLE_NAME = 'identity_lifecycle_selectors' THEN
+        SELECT * INTO STRICT transition
+        FROM identity_lifecycle_history
+        WHERE community_id = NEW.community_id
+          AND history_id = NEW.asserted_history_id;
+    ELSE
+        SELECT * INTO STRICT transition
+        FROM identity_lifecycle_history
+        WHERE community_id = NEW.community_id
+          AND history_id = CASE
+              WHEN NEW.binding_state = 2 THEN NEW.retirement_history_id
+              ELSE NEW.birth_history_id
+          END;
+    END IF;
+
+    SELECT
+        count(*) FILTER (WHERE selector_kind = 1),
+        count(*) FILTER (WHERE selector_kind = 3)
+    INTO asserted_p, asserted_y
+    FROM identity_lifecycle_selectors
+    WHERE community_id = transition.community_id
+      AND asserted_history_id = transition.history_id;
+
+    IF transition.old_binding_id IS NOT NULL THEN
+        SELECT binding_state INTO STRICT old_binding_state
+        FROM identity_bindings
+        WHERE community_id = transition.community_id
+          AND binding_id = transition.old_binding_id
+          AND binding_version = transition.old_binding_version;
+        IF old_binding_state <> 2 THEN
+            RAISE EXCEPTION 'lifecycle transition old binding must be retired at commit'
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'identity_lifecycle_transition_integrity';
+        END IF;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1
+        FROM identity_lifecycle_selectors selector
+        JOIN identity_bindings active
+          ON active.community_id = selector.community_id
+         AND active.binding_state = 1
+         AND (
+            (selector.selector_kind = 1
+                AND active.principal_fingerprint = selector.principal_fingerprint
+                AND active.event_author_pubkey = selector.event_author_pubkey)
+            OR (selector.selector_kind = 3
+                AND active.event_author_pubkey = selector.event_author_pubkey)
+         )
+        WHERE selector.community_id = transition.community_id
+    ) THEN
+        RAISE EXCEPTION 'effective lifecycle selector conflicts with an active binding'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_lifecycle_transition_integrity';
+    END IF;
+
+    IF transition.outcome_code = 3 THEN
+        IF asserted_p + asserted_y <> 0 THEN
+            RAISE EXCEPTION 'no-op lifecycle transition cannot create selector facts'
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'identity_lifecycle_transition_integrity';
+        END IF;
+        RETURN NULL;
+    END IF;
+
+    -- Core selector companions per transition:
+    --   enroll  (1): none
+    --   retire  (3): exactly one P
+    --   revoke  (5): one Y always; one P when a named old generation is removed
+    --   rotate  (6): exactly one P (old generation retired)
+    IF (transition.transition_kind = 1
+            AND (asserted_p, asserted_y) <> (0, 0))
+        OR (transition.transition_kind = 3
+            AND (asserted_p, asserted_y) <> (1, 0))
+        OR (transition.transition_kind = 5 AND (
+            (transition.old_binding_id IS NOT NULL
+                AND (asserted_p, asserted_y) <> (1, 1))
+            OR (transition.old_binding_id IS NULL
+                AND (asserted_p, asserted_y) <> (0, 1))
+        ))
+        OR (transition.transition_kind = 6
+            AND (asserted_p, asserted_y) <> (1, 0))
+    THEN
+        RAISE EXCEPTION 'lifecycle transition has incomplete or forbidden selector companions'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'identity_lifecycle_transition_integrity';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER identity_bindings_insert_guard
+    BEFORE INSERT ON identity_bindings
+    FOR EACH ROW EXECUTE FUNCTION identity_bindings_insert_guard_v1();
+CREATE TRIGGER identity_bindings_transition_guard
+    BEFORE UPDATE ON identity_bindings
+    FOR EACH ROW EXECUTE FUNCTION identity_bindings_transition_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_bindings_history_semantics
+    AFTER INSERT OR UPDATE ON identity_bindings
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_binding_history_semantics_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_bindings_birth_eligibility
+    AFTER INSERT ON identity_bindings
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_binding_birth_eligibility_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_bindings_transition_integrity
+    AFTER INSERT OR UPDATE ON identity_bindings
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_transition_integrity_guard_v1();
+CREATE TRIGGER identity_bindings_no_delete
+    BEFORE DELETE ON identity_bindings
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER identity_bindings_no_truncate
+    BEFORE TRUNCATE ON identity_bindings
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER identity_lifecycle_history_insert_guard
+    BEFORE INSERT ON identity_lifecycle_history
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_history_insert_guard_v1();
+CREATE CONSTRAINT TRIGGER authorization_operation_receipt_history_cardinality
+    AFTER INSERT ON authorization_operation_receipts
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_receipt_history_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_lifecycle_transition_integrity
+    AFTER INSERT ON identity_lifecycle_history
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_transition_integrity_guard_v1();
+
+CREATE TRIGGER identity_lifecycle_selector_insert_guard
+    BEFORE INSERT ON identity_lifecycle_selectors
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_selector_insert_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_lifecycle_selector_history_semantics
+    AFTER INSERT ON identity_lifecycle_selectors
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_selector_history_guard_v1();
+CREATE CONSTRAINT TRIGGER identity_lifecycle_selector_transition_integrity
+    AFTER INSERT ON identity_lifecycle_selectors
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION identity_lifecycle_transition_integrity_guard_v1();
+
+CREATE TRIGGER authorization_operation_receipts_immutable
+    BEFORE UPDATE OR DELETE ON authorization_operation_receipts
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_operation_receipts_no_truncate
+    BEFORE TRUNCATE ON authorization_operation_receipts
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER identity_enrollment_policies_revision_guard
+    BEFORE INSERT ON identity_enrollment_policies
+    FOR EACH ROW EXECUTE FUNCTION identity_enrollment_policy_revision_guard_v1();
+CREATE TRIGGER identity_enrollment_policies_immutable
+    BEFORE UPDATE OR DELETE ON identity_enrollment_policies
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER identity_enrollment_policies_no_truncate
+    BEFORE TRUNCATE ON identity_enrollment_policies
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER identity_lifecycle_history_immutable
+    BEFORE UPDATE OR DELETE ON identity_lifecycle_history
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER identity_lifecycle_history_no_truncate
+    BEFORE TRUNCATE ON identity_lifecycle_history
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER identity_lifecycle_selectors_immutable
+    BEFORE UPDATE OR DELETE ON identity_lifecycle_selectors
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER identity_lifecycle_selectors_no_truncate
+    BEFORE TRUNCATE ON identity_lifecycle_selectors
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+
+-- ============================================================================
+-- NIP-FI final-admission foundation (mirror of migration 0042).
+-- ============================================================================
+
+CREATE TABLE authorization_invalidation_domains (
+    community_id UUID NOT NULL PRIMARY KEY REFERENCES communities(id),
+    current_generation BIGINT NOT NULL CHECK (current_generation >= 0),
+    activated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp()
+);
+
+-- Closed selectors: 1 principal, 2 Nostr key, 3 binding, 4 session, 5 domain,
+-- 6 configuration revision. Selector 7 (delegated relationship) and its
+-- relationship-revision floor are deferred to the FI-DELEG migration.
+CREATE TABLE authorization_invalidation_floors (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    selector_kind SMALLINT NOT NULL CHECK (selector_kind IN (1, 2, 3, 4, 5, 6)),
+    selector_fingerprint BYTEA NOT NULL CHECK (octet_length(selector_fingerprint) = 32),
+    floor_generation BIGINT NOT NULL CHECK (floor_generation > 0),
+    binding_version_floor BIGINT CHECK (binding_version_floor IS NULL OR binding_version_floor > 0),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, selector_kind, selector_fingerprint),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (
+        (selector_kind = 3 AND binding_version_floor IS NOT NULL)
+        OR (selector_kind <> 3 AND binding_version_floor IS NULL)
+    )
+);
+
+-- Protected-object kinds: 1 domain, 2 channel, 3 repository, 4 media,
+-- 5 moderation target, 6 audio session. Kind 7 is retired: current binding
+-- status is connection-local evidence and never a durable protected object.
+CREATE TABLE authorization_authority_epochs (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    object_kind SMALLINT NOT NULL CHECK (object_kind IN (1, 2, 3, 4, 5, 6)),
+    object_key BYTEA NOT NULL CHECK (octet_length(object_key) = 32),
+    authority_epoch BIGINT NOT NULL CHECK (authority_epoch > 0),
+    fence BYTEA NOT NULL CHECK (
+        octet_length(fence) = 32 AND fence <> decode(repeat('00', 32), 'hex')
+    ),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, object_kind, object_key),
+    UNIQUE (
+        community_id,
+        object_kind,
+        object_key,
+        authority_epoch,
+        fence,
+        operation_id,
+        request_fingerprint
+    ),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED
+);
+
+-- Direct-final current authority for a protected object. The authorization
+-- lease itself is sealed in memory and dies on restart; this durable row is the
+-- exact source re-fenced immediately before a protected mutation or emission.
+CREATE TABLE protected_object_authority (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    object_kind SMALLINT NOT NULL CHECK (object_kind IN (1, 2, 3, 4, 5, 6)),
+    object_key BYTEA NOT NULL CHECK (octet_length(object_key) = 32),
+    capability SMALLINT NOT NULL CHECK (
+        capability IN (
+            1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
+            15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27,
+            28, 29
+        )
+    ),
+    actor_pubkey BYTEA NOT NULL CHECK (octet_length(actor_pubkey) = 32),
+    binding_id UUID NOT NULL,
+    binding_version BIGINT NOT NULL CHECK (binding_version > 0),
+    policy_revision BIGINT NOT NULL CHECK (policy_revision > 0),
+    invalidation_generation BIGINT NOT NULL CHECK (invalidation_generation >= 0),
+    authority_epoch BIGINT NOT NULL CHECK (authority_epoch > 0),
+    fence BYTEA NOT NULL CHECK (
+        octet_length(fence) = 32 AND fence <> decode(repeat('00', 32), 'hex')
+    ),
+    issued_at TIMESTAMPTZ NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    PRIMARY KEY (community_id, object_kind, object_key),
+    FOREIGN KEY (community_id, binding_id, binding_version)
+        REFERENCES identity_bindings (community_id, binding_id, binding_version)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (
+        community_id,
+        object_kind,
+        object_key,
+        authority_epoch,
+        fence,
+        operation_id,
+        request_fingerprint
+    ) REFERENCES authorization_authority_epochs (
+        community_id,
+        object_kind,
+        object_key,
+        authority_epoch,
+        fence,
+        operation_id,
+        request_fingerprint
+    ) DEFERRABLE INITIALLY DEFERRED,
+    CHECK (issued_at < expires_at)
+);
+
+-- Explicit immutable-capacity policy required by Enforce mode. Hard ceilings
+-- match buzz-auth; installation limits must be sized explicitly below them.
+-- V1 has no online pruning/export/reset workflow.
+CREATE TABLE authorization_event_capacity (
+    community_id UUID NOT NULL PRIMARY KEY REFERENCES communities(id),
+    max_events_per_domain BIGINT NOT NULL CONSTRAINT authorization_event_capacity_max_events CHECK (
+        max_events_per_domain BETWEEN 1 AND 10000
+    ),
+    max_bytes_per_domain BIGINT NOT NULL CONSTRAINT authorization_event_capacity_max_bytes CHECK (
+        max_bytes_per_domain BETWEEN 1 AND 16777216
+    ),
+    max_envelope_bytes INTEGER NOT NULL CONSTRAINT authorization_event_capacity_max_envelope CHECK (
+        max_envelope_bytes BETWEEN 1 AND 16384
+    ),
+    retained_event_count BIGINT NOT NULL DEFAULT 0 CHECK (retained_event_count >= 0),
+    retained_envelope_bytes BIGINT NOT NULL DEFAULT 0 CHECK (retained_envelope_bytes >= 0),
+    -- 1 healthy, 2 audit unavailable/exhausted. Recovery/reset is not a V1
+    -- online workflow; enabled runtime latches failure when insertion aborts.
+    health_state SMALLINT NOT NULL DEFAULT 1 CHECK (health_state IN (1, 2)),
+    failure_code SMALLINT CHECK (failure_code IS NULL OR failure_code IN (1, 2, 3)),
+    failure_observed_at TIMESTAMPTZ,
+    configured_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    CHECK (max_envelope_bytes <= max_bytes_per_domain),
+    CHECK (retained_event_count <= max_events_per_domain),
+    CHECK (retained_envelope_bytes <= max_bytes_per_domain),
+    CHECK (
+        (health_state = 1 AND failure_code IS NULL AND failure_observed_at IS NULL)
+        OR (health_state = 2 AND failure_code IS NOT NULL AND failure_observed_at IS NOT NULL)
+    )
+);
+
+-- Durable versioned pseudonymous authorization envelope. event_kind:
+-- 1 enrolled, 2 revoked, 3 rotated, 6 retired, 9 operator denied,
+-- 10 protected allowed, 11 protected denied, 14 invalidation advanced.
+-- The extended-lifecycle audit kinds (4 recovered, 5 principal enabled,
+-- 7 principal disabled, 8 admission lost) are deferred to the FI-LIFECYCLE
+-- migration, matching 0041's core lifecycle carve. Kinds 12 and 13 are
+-- retired: kind 24244 publication/withdrawal is ephemeral connection state and
+-- never a durable authorization event.
+CREATE TABLE authorization_events (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    event_id UUID NOT NULL,
+    schema_version SMALLINT NOT NULL DEFAULT 1 CHECK (schema_version = 1),
+    event_kind SMALLINT NOT NULL CHECK (
+        event_kind IN (1, 2, 3, 6, 9, 10, 11, 14)
+    ),
+    outcome_code SMALLINT NOT NULL CHECK (outcome_code IN (1, 2, 3, 4, 5)),
+    reason_code SMALLINT NOT NULL CHECK (
+        reason_code IN (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
+    ),
+    actor_kind SMALLINT NOT NULL CHECK (actor_kind IN (1, 2, 3, 4)),
+    actor_fingerprint BYTEA CHECK (
+        actor_fingerprint IS NULL OR octet_length(actor_fingerprint) = 32
+    ),
+    subject_fingerprint BYTEA CHECK (
+        subject_fingerprint IS NULL OR octet_length(subject_fingerprint) = 32
+    ),
+    -- Always retains attempted operation identity. Only unresolved pre-auth
+    -- event kind 9 omits the canonical receipt fingerprint; authenticated
+    -- OperatorDenied events remain linked to their exact canonical receipt.
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA CHECK (
+        request_fingerprint IS NULL OR octet_length(request_fingerprint) = 32
+    ),
+    correlation_id UUID NOT NULL,
+    attempt_id UUID NOT NULL,
+    -- Redaction-safe pre-authentication denial identity. Present and non-zero
+    -- for unresolved pre-auth kind-9 events (actor_kind = 4); NULL for
+    -- authenticated kind-9 events (actor_kind 1-3) and all other event kinds.
+    -- Binds the event to the exact denial attempt's semantic_fingerprint
+    -- (intent_digest) for exact replay.
+    semantic_fingerprint BYTEA CHECK (
+        semantic_fingerprint IS NULL OR octet_length(semantic_fingerprint) = 32
+    ),
+    occurred_at TIMESTAMPTZ NOT NULL,
+    accepted_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    canonical_envelope BYTEA NOT NULL CONSTRAINT authorization_events_envelope_size CHECK (
+        octet_length(canonical_envelope) BETWEEN 1 AND 16384
+    ),
+    envelope_digest BYTEA NOT NULL CHECK (octet_length(envelope_digest) = 32),
+    PRIMARY KEY (community_id, event_id),
+    UNIQUE (community_id, event_id, operation_id),
+    UNIQUE (community_id, event_id, event_kind, operation_id),
+    UNIQUE (community_id, operation_id, event_kind, attempt_id),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED,
+    CHECK (event_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (operation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (correlation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (attempt_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (
+        (actor_kind = 4 AND event_kind = 9 AND request_fingerprint IS NULL)
+        OR (actor_kind IN (1, 2, 3) AND request_fingerprint IS NOT NULL)
+    ),
+    CHECK (
+        (actor_kind = 4 AND actor_fingerprint IS NULL AND subject_fingerprint IS NULL)
+        OR (actor_kind IN (1, 2, 3) AND actor_fingerprint IS NOT NULL)
+    ),
+    -- Unresolved pre-auth kind-9 events (actor_kind = 4) carry a non-zero
+    -- semantic_fingerprint; authenticated kind-9 events (actor_kind 1-3) and
+    -- all other event kinds must not.
+    CHECK (
+        (event_kind = 9 AND actor_kind = 4 AND semantic_fingerprint IS NOT NULL
+            AND semantic_fingerprint <> decode(repeat('00', 32), 'hex'))
+        OR (event_kind = 9 AND actor_kind IN (1, 2, 3) AND semantic_fingerprint IS NULL)
+        OR (event_kind <> 9 AND semantic_fingerprint IS NULL)
+    )
+);
+
+-- Credential-free pre-authentication denial attempts. The five-column key is
+-- exact replay identity; no row or FK occupies canonical operation/result,
+-- effect, authority, approval, or consumption state.
+CREATE TABLE authorization_authentication_denial_attempts (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    operation_id UUID NOT NULL,
+    correlation_id UUID NOT NULL,
+    semantic_fingerprint BYTEA NOT NULL CHECK (octet_length(semantic_fingerprint) = 32),
+    denial_reason SMALLINT NOT NULL CHECK (denial_reason IN (1, 2, 3)),
+    expected_revision BIGINT NOT NULL CHECK (expected_revision > 0),
+    action SMALLINT NOT NULL CHECK (action IN (1, 2, 3, 4, 5, 6, 7, 8)),
+    reason_code SMALLINT NOT NULL CHECK (
+        reason_code IN (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
+    ),
+    attempt_id UUID NOT NULL,
+    audit_event_id UUID NOT NULL,
+    audit_event_kind SMALLINT NOT NULL DEFAULT 9 CHECK (audit_event_kind = 9),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (
+        community_id,
+        operation_id,
+        correlation_id,
+        semantic_fingerprint,
+        denial_reason
+    ),
+    UNIQUE (community_id, audit_event_id),
+    FOREIGN KEY (community_id, audit_event_id, audit_event_kind, operation_id)
+        REFERENCES authorization_events (community_id, event_id, event_kind, operation_id)
+        DEFERRABLE INITIALLY DEFERRED,
+    FOREIGN KEY (community_id, operation_id, audit_event_kind, attempt_id)
+        REFERENCES authorization_events (community_id, operation_id, event_kind, attempt_id)
+        DEFERRABLE INITIALLY DEFERRED,
+    -- Canonical denial_reason ↔ reason_code binding: MissingCredential(1)↔Missing(2),
+    -- InvalidCredential(2)↔Invalid(3), Unauthenticated(3)↔Unauthenticated(4).
+    CONSTRAINT authorization_denial_reason_reason_code_binding CHECK (
+        (denial_reason = 1 AND reason_code = 2)
+        OR (denial_reason = 2 AND reason_code = 3)
+        OR (denial_reason = 3 AND reason_code = 4)
+    ),
+    CHECK (operation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (correlation_id <> '00000000-0000-0000-0000-000000000000'::uuid),
+    CHECK (attempt_id <> '00000000-0000-0000-0000-000000000000'::uuid)
+);
+
+-- Exact per-operation authority-version attribution for restore. Empty
+-- manifests are valid; every stored component must advance strictly.
+CREATE TABLE authorization_operation_version_delta_manifests (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    component_count INTEGER NOT NULL CHECK (component_count BETWEEN 0 AND 1024),
+    before_digest BYTEA NOT NULL CHECK (octet_length(before_digest) = 32),
+    after_digest BYTEA NOT NULL CHECK (octet_length(after_digest) = 32),
+    manifest_digest BYTEA NOT NULL CHECK (octet_length(manifest_digest) = 32),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, operation_id),
+    UNIQUE (community_id, operation_id, request_fingerprint),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint)
+        DEFERRABLE INITIALLY DEFERRED
+);
+
+-- component_kind: 1 binding version, 2 policy revision,
+-- 3 invalidation generation, 4 authority epoch. Kind 6 (delegated-relationship
+-- revision) is deferred to the FI-DELEG migration and kind 7 (lifecycle-selector
+-- generation) to the FI-LIFECYCLE migration. Kind 5 is retired with durable
+-- client-status revisions; retained kinds keep their original identities.
+CREATE TABLE authorization_operation_version_deltas (
+    community_id UUID NOT NULL REFERENCES communities(id),
+    operation_id UUID NOT NULL,
+    component_kind SMALLINT NOT NULL CHECK (component_kind IN (1, 2, 3, 4)),
+    component_key BYTEA NOT NULL CHECK (octet_length(component_key) = 32),
+    before_version BIGINT NOT NULL CHECK (before_version >= 0),
+    after_version BIGINT NOT NULL,
+    component_digest BYTEA NOT NULL CHECK (octet_length(component_digest) = 32),
+    PRIMARY KEY (community_id, operation_id, component_kind, component_key),
+    FOREIGN KEY (community_id, operation_id)
+        REFERENCES authorization_operation_version_delta_manifests
+            (community_id, operation_id),
+    CHECK (after_version > before_version)
+);
+
+CREATE FUNCTION authorization_event_capacity_before_insert_v1() RETURNS TRIGGER AS $$
+DECLARE
+    policy authorization_event_capacity%ROWTYPE;
+    envelope_bytes BIGINT;
+BEGIN
+    SELECT * INTO policy
+    FROM authorization_event_capacity
+    WHERE community_id = NEW.community_id
+    FOR UPDATE;
+
+    IF NOT FOUND THEN
+        RAISE EXCEPTION 'authorization event capacity policy missing'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_event_capacity_policy_required';
+    END IF;
+    IF policy.health_state <> 1 THEN
+        RAISE EXCEPTION 'authorization audit is unavailable'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_event_capacity_health';
+    END IF;
+
+    envelope_bytes := octet_length(NEW.canonical_envelope);
+    IF envelope_bytes > policy.max_envelope_bytes
+        OR policy.retained_event_count + 1 > policy.max_events_per_domain
+        OR policy.retained_envelope_bytes + envelope_bytes > policy.max_bytes_per_domain
+    THEN
+        -- The INSERT and protected mutation abort together. The runtime maps
+        -- this stable constraint to typed CapacityExhausted and latches audit
+        -- health outside the rolled-back transaction.
+        RAISE EXCEPTION 'authorization event capacity exhausted'
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_event_capacity_exhausted';
+    END IF;
+
+    UPDATE authorization_event_capacity
+    SET retained_event_count = retained_event_count + 1,
+        retained_envelope_bytes = retained_envelope_bytes + envelope_bytes,
+        updated_at = transaction_timestamp()
+    WHERE community_id = NEW.community_id;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_events_capacity
+    BEFORE INSERT ON authorization_events
+    FOR EACH ROW EXECUTE FUNCTION authorization_event_capacity_before_insert_v1();
+
+CREATE FUNCTION authorization_invalidation_domain_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.activated_at IS DISTINCT FROM OLD.activated_at
+        OR NEW.current_generation <= OLD.current_generation
+        OR NEW.updated_at <= OLD.updated_at
+    THEN
+        RAISE EXCEPTION 'authorization invalidation activation/generation cannot move backward'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_invalidation_domains_monotonic
+    BEFORE UPDATE ON authorization_invalidation_domains
+    FOR EACH ROW EXECUTE FUNCTION authorization_invalidation_domain_guard_v1();
+CREATE TRIGGER authorization_invalidation_domains_no_delete
+    BEFORE DELETE ON authorization_invalidation_domains
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_invalidation_domains_no_truncate
+    BEFORE TRUNCATE ON authorization_invalidation_domains
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE FUNCTION authorization_invalidation_floor_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.selector_kind IS DISTINCT FROM OLD.selector_kind
+        OR NEW.selector_fingerprint IS DISTINCT FROM OLD.selector_fingerprint
+        OR NEW.floor_generation < OLD.floor_generation
+        OR COALESCE(NEW.binding_version_floor, 0) < COALESCE(OLD.binding_version_floor, 0)
+        OR (
+            NEW.floor_generation = OLD.floor_generation
+            AND COALESCE(NEW.binding_version_floor, 0)
+                = COALESCE(OLD.binding_version_floor, 0)
+        )
+        OR NEW.operation_id IS NOT DISTINCT FROM OLD.operation_id
+        OR NEW.updated_at <= OLD.updated_at
+    THEN
+        RAISE EXCEPTION 'authorization invalidation floor cannot move backward'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_invalidation_floors_monotonic
+    BEFORE UPDATE ON authorization_invalidation_floors
+    FOR EACH ROW EXECUTE FUNCTION authorization_invalidation_floor_guard_v1();
+CREATE TRIGGER authorization_invalidation_floors_no_delete
+    BEFORE DELETE ON authorization_invalidation_floors
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_invalidation_floors_no_truncate
+    BEFORE TRUNCATE ON authorization_invalidation_floors
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE FUNCTION authorization_authority_epoch_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.object_kind IS DISTINCT FROM OLD.object_kind
+        OR NEW.object_key IS DISTINCT FROM OLD.object_key
+        OR NEW.authority_epoch <= OLD.authority_epoch
+        OR NEW.fence IS NOT DISTINCT FROM OLD.fence
+        OR NEW.operation_id IS NOT DISTINCT FROM OLD.operation_id
+        OR NEW.updated_at <= OLD.updated_at
+    THEN
+        RAISE EXCEPTION 'authorization authority epoch cannot move backward'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_authority_epochs_monotonic
+    BEFORE UPDATE ON authorization_authority_epochs
+    FOR EACH ROW EXECUTE FUNCTION authorization_authority_epoch_guard_v1();
+CREATE TRIGGER authorization_authority_epochs_no_delete
+    BEFORE DELETE ON authorization_authority_epochs
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_authority_epochs_no_truncate
+    BEFORE TRUNCATE ON authorization_authority_epochs
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE FUNCTION authorization_event_capacity_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.max_events_per_domain IS DISTINCT FROM OLD.max_events_per_domain
+        OR NEW.max_bytes_per_domain IS DISTINCT FROM OLD.max_bytes_per_domain
+        OR NEW.max_envelope_bytes IS DISTINCT FROM OLD.max_envelope_bytes
+        OR NEW.configured_at IS DISTINCT FROM OLD.configured_at
+        OR NEW.retained_event_count < OLD.retained_event_count
+        OR NEW.retained_envelope_bytes < OLD.retained_envelope_bytes
+        OR NEW.updated_at < OLD.updated_at
+        OR (OLD.health_state = 2 AND (
+            NEW.health_state <> 2
+            OR NEW.failure_code IS DISTINCT FROM OLD.failure_code
+            OR NEW.failure_observed_at IS DISTINCT FROM OLD.failure_observed_at
+        ))
+        OR (OLD.health_state = 1 AND NEW.health_state = 1 AND (
+            NEW.failure_code IS NOT NULL OR NEW.failure_observed_at IS NOT NULL
+        ))
+    THEN
+        RAISE EXCEPTION 'authorization event capacity cannot be reset online'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION protected_object_authority_guard_v1() RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW IS NOT DISTINCT FROM OLD THEN
+        RETURN NEW;
+    END IF;
+    IF NEW.community_id IS DISTINCT FROM OLD.community_id
+        OR NEW.object_kind IS DISTINCT FROM OLD.object_kind
+        OR NEW.object_key IS DISTINCT FROM OLD.object_key
+        OR NEW.authority_epoch <= OLD.authority_epoch
+        OR NEW.fence IS NOT DISTINCT FROM OLD.fence
+        OR NEW.operation_id IS NOT DISTINCT FROM OLD.operation_id
+        OR NEW.issued_at <= OLD.issued_at
+    THEN
+        RAISE EXCEPTION 'protected authority replacement requires a new operation and epoch'
+            USING ERRCODE = 'check_violation';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER authorization_event_capacity_monotonic
+    BEFORE UPDATE ON authorization_event_capacity
+    FOR EACH ROW EXECUTE FUNCTION authorization_event_capacity_guard_v1();
+CREATE TRIGGER authorization_event_capacity_no_delete
+    BEFORE DELETE ON authorization_event_capacity
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_event_capacity_no_truncate
+    BEFORE TRUNCATE ON authorization_event_capacity
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER authorization_events_immutable
+    BEFORE UPDATE OR DELETE ON authorization_events
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_events_no_truncate
+    BEFORE TRUNCATE ON authorization_events
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER authorization_authentication_denial_attempts_immutable
+    BEFORE UPDATE OR DELETE ON authorization_authentication_denial_attempts
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_authentication_denial_attempts_no_truncate
+    BEFORE TRUNCATE ON authorization_authentication_denial_attempts
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+-- Bidirectional deferred guard: a kind-9 (pre-authentication denial) audit
+-- event must commit with exactly one denial attempt; a denial attempt must
+-- commit with its audit event present, kind-9, and matching semantic
+-- coordinates (correlation_id, reason_code, and semantic_fingerprint). Both
+-- directions deferred so event and attempt may be inserted in any order inside
+-- one transaction. The static denial_reason↔reason_code mapping is enforced
+-- by an immediate CHECK on the denial attempt table; the guard enforces the
+-- matching semantic coordinates between event and attempt.
+CREATE FUNCTION authorization_denial_attempt_guard_v1()
+RETURNS TRIGGER AS $$
+DECLARE
+    found_event_kind SMALLINT;
+    found_actor_kind SMALLINT;
+    found_request_fingerprint BYTEA;
+    found_correlation_id UUID;
+    found_reason_code SMALLINT;
+    found_semantic_fingerprint BYTEA;
+    attempt_count BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'authorization_events' THEN
+        -- Firing from the event side: only unresolved pre-auth kind-9 events
+        -- (actor_kind = 4) require a denial attempt row. Authenticated
+        -- OperatorDenied events (actor_kind 1-3) have a canonical receipt and
+        -- no denial attempt.
+        IF NEW.event_kind <> 9 OR NEW.actor_kind <> 4 THEN
+            RETURN NULL;
+        END IF;
+
+        SELECT count(*) INTO attempt_count
+        FROM authorization_authentication_denial_attempts
+        WHERE community_id = NEW.community_id
+          AND audit_event_id = NEW.event_id;
+
+        IF attempt_count <> 1 THEN
+            RAISE EXCEPTION
+                'kind-9 audit event requires exactly one denial attempt, found %',
+                attempt_count
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_cardinality';
+        END IF;
+
+        -- Verify semantic coordinates match between event and denial attempt.
+        SELECT correlation_id, reason_code, semantic_fingerprint
+        INTO found_correlation_id, found_reason_code, found_semantic_fingerprint
+        FROM authorization_authentication_denial_attempts
+        WHERE community_id = NEW.community_id
+          AND audit_event_id = NEW.event_id;
+
+        IF found_correlation_id IS DISTINCT FROM NEW.correlation_id THEN
+            RAISE EXCEPTION
+                'denial attempt correlation_id % does not match event correlation_id % for event %',
+                found_correlation_id, NEW.correlation_id, NEW.event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        IF found_reason_code IS DISTINCT FROM NEW.reason_code THEN
+            RAISE EXCEPTION
+                'denial attempt reason_code % does not match event reason_code % for event %',
+                found_reason_code, NEW.reason_code, NEW.event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        IF found_semantic_fingerprint IS DISTINCT FROM NEW.semantic_fingerprint THEN
+            RAISE EXCEPTION
+                'denial attempt semantic_fingerprint does not match event semantic_fingerprint for event %',
+                NEW.event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+    ELSE
+        -- Firing from the denial-attempt side: verify the audit event is the
+        -- unresolved pre-auth kind-9 shape (actor_kind = 4, null receipt
+        -- fingerprint) and that exactly one denial attempt references it.
+        SELECT event_kind, actor_kind, request_fingerprint,
+               correlation_id, reason_code, semantic_fingerprint
+        INTO found_event_kind, found_actor_kind, found_request_fingerprint,
+             found_correlation_id, found_reason_code,
+             found_semantic_fingerprint
+        FROM authorization_events
+        WHERE community_id = NEW.community_id
+          AND event_id = NEW.audit_event_id;
+
+        IF NOT FOUND THEN
+            RAISE EXCEPTION
+                'denial attempt references non-existent audit event %',
+                NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_kind';
+        END IF;
+
+        IF found_event_kind <> 9 THEN
+            RAISE EXCEPTION
+                'denial attempt audit event must be kind 9, got %',
+                found_event_kind
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_kind';
+        END IF;
+
+        -- The referenced event must be the unresolved pre-auth shape: actor_kind
+        -- 4 with a null receipt fingerprint. Attaching a denial attempt to an
+        -- authenticated OperatorDenied (actor_kind 1-3) would violate the
+        -- credential-free pre-authentication contract.
+        IF found_actor_kind <> 4 OR found_request_fingerprint IS NOT NULL THEN
+            RAISE EXCEPTION
+                'denial attempt must reference an unresolved pre-auth kind-9 event '
+                '(actor_kind 4, null request_fingerprint); got actor_kind % '
+                'and request_fingerprint % for event %',
+                found_actor_kind,
+                CASE WHEN found_request_fingerprint IS NULL THEN 'null' ELSE 'non-null' END,
+                NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_kind';
+        END IF;
+
+        -- Verify semantic coordinates match.
+        IF found_correlation_id IS DISTINCT FROM NEW.correlation_id THEN
+            RAISE EXCEPTION
+                'denial attempt correlation_id % does not match event correlation_id % for event %',
+                NEW.correlation_id, found_correlation_id, NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        IF found_reason_code IS DISTINCT FROM NEW.reason_code THEN
+            RAISE EXCEPTION
+                'denial attempt reason_code % does not match event reason_code % for event %',
+                NEW.reason_code, found_reason_code, NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        IF found_semantic_fingerprint IS DISTINCT FROM NEW.semantic_fingerprint THEN
+            RAISE EXCEPTION
+                'denial attempt semantic_fingerprint does not match event semantic_fingerprint for event %',
+                NEW.audit_event_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_semantic_binding';
+        END IF;
+
+        SELECT count(*) INTO attempt_count
+        FROM authorization_authentication_denial_attempts
+        WHERE community_id = NEW.community_id
+          AND audit_event_id = NEW.audit_event_id;
+
+        IF attempt_count <> 1 THEN
+            RAISE EXCEPTION
+                'exactly one denial attempt must reference audit event %, found %',
+                NEW.audit_event_id, attempt_count
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denial_attempt_event_cardinality';
+        END IF;
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE CONSTRAINT TRIGGER authorization_denial_attempt_event_cardinality
+    AFTER INSERT ON authorization_events
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_denial_attempt_guard_v1();
+
+CREATE CONSTRAINT TRIGGER authorization_denial_event_attempt_cardinality
+    AFTER INSERT ON authorization_authentication_denial_attempts
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_denial_attempt_guard_v1();
+
+CREATE FUNCTION authorization_operation_version_delta_cardinality_guard_v1()
+RETURNS TRIGGER AS $$
+DECLARE
+    manifest authorization_operation_version_delta_manifests%ROWTYPE;
+    actual_component_count BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'authorization_operation_version_delta_manifests' THEN
+        manifest := NEW;
+    ELSE
+        SELECT * INTO STRICT manifest
+        FROM authorization_operation_version_delta_manifests
+        WHERE community_id = NEW.community_id
+          AND operation_id = NEW.operation_id
+        FOR NO KEY UPDATE;
+    END IF;
+
+    SELECT count(*) INTO actual_component_count
+    FROM authorization_operation_version_deltas
+    WHERE community_id = manifest.community_id
+      AND operation_id = manifest.operation_id;
+
+    IF actual_component_count <> manifest.component_count THEN
+        RAISE EXCEPTION 'operation version manifest declares % components, found %',
+            manifest.component_count, actual_component_count
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_operation_version_delta_cardinality';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE CONSTRAINT TRIGGER authorization_operation_version_delta_manifest_cardinality
+    AFTER INSERT ON authorization_operation_version_delta_manifests
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_version_delta_cardinality_guard_v1();
+CREATE CONSTRAINT TRIGGER authorization_operation_version_delta_component_cardinality
+    AFTER INSERT ON authorization_operation_version_deltas
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_version_delta_cardinality_guard_v1();
+
+CREATE TRIGGER authorization_operation_version_delta_manifests_immutable
+    BEFORE UPDATE OR DELETE ON authorization_operation_version_delta_manifests
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_operation_version_delta_manifests_no_truncate
+    BEFORE TRUNCATE ON authorization_operation_version_delta_manifests
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER authorization_operation_version_deltas_immutable
+    BEFORE UPDATE OR DELETE ON authorization_operation_version_deltas
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_operation_version_deltas_no_truncate
+    BEFORE TRUNCATE ON authorization_operation_version_deltas
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+CREATE TRIGGER protected_object_authority_no_delete
+    BEFORE DELETE ON protected_object_authority
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER protected_object_authority_no_truncate
+    BEFORE TRUNCATE ON protected_object_authority
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+CREATE TRIGGER protected_object_authority_strict_replacement
+    BEFORE UPDATE ON protected_object_authority
+    FOR EACH ROW EXECUTE FUNCTION protected_object_authority_guard_v1();
+
+-- Canonical admission keeps its complete logical intent and the closed,
+-- credential-free application result beside the immutable receipt. This is
+-- what lets an identical request replay reconstruct the same typed result
+-- without repeating membership or other application DML. Object kinds match
+-- protected_object_authority: 1 domain, 2 channel, 3 repository, 4 media,
+-- 5 moderation target, 6 audio session.
+CREATE TABLE authorization_admission_results (
+    community_id UUID NOT NULL,
+    operation_id UUID NOT NULL,
+    request_fingerprint BYTEA NOT NULL CHECK (octet_length(request_fingerprint) = 32),
+    semantic_fingerprint BYTEA NOT NULL CHECK (
+        octet_length(semantic_fingerprint) = 32
+        AND semantic_fingerprint <> decode(repeat('00', 32), 'hex')
+    ),
+    object_kind SMALLINT NOT NULL CHECK (object_kind BETWEEN 1 AND 6),
+    object_key BYTEA NOT NULL CHECK (
+        octet_length(object_key) = 32
+        AND object_key <> decode(repeat('00', 32), 'hex')
+    ),
+    application_type BYTEA CHECK (
+        application_type IS NULL
+        OR (octet_length(application_type) = 32
+            AND application_type <> decode(repeat('00', 32), 'hex'))
+    ),
+    application_version SMALLINT CHECK (application_version > 0),
+    application_code SMALLINT CHECK (application_code > 0),
+    application_payload BYTEA CHECK (
+        application_payload IS NULL OR octet_length(application_payload) <= 4096
+    ),
+    application_intent_digest BYTEA CHECK (
+        application_intent_digest IS NULL
+        OR (octet_length(application_intent_digest) = 32
+            AND application_intent_digest <> decode(repeat('00', 32), 'hex'))
+    ),
+    application_effect_digest BYTEA CHECK (
+        application_effect_digest IS NULL
+        OR (octet_length(application_effect_digest) = 32
+            AND application_effect_digest <> decode(repeat('00', 32), 'hex'))
+    ),
+    application_result_digest BYTEA CHECK (
+        application_result_digest IS NULL
+        OR (octet_length(application_result_digest) = 32
+            AND application_result_digest <> decode(repeat('00', 32), 'hex'))
+    ),
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),
+    PRIMARY KEY (community_id, operation_id),
+    FOREIGN KEY (community_id, operation_id, request_fingerprint)
+        REFERENCES authorization_operation_receipts
+            (community_id, operation_id, request_fingerprint),
+    CHECK (
+        (application_type IS NULL
+            AND application_version IS NULL
+            AND application_code IS NULL
+            AND application_payload IS NULL
+            AND application_intent_digest IS NULL
+            AND application_effect_digest IS NULL
+            AND application_result_digest IS NULL)
+        OR (application_type IS NOT NULL
+            AND application_version IS NOT NULL
+            AND application_code IS NOT NULL
+            AND application_payload IS NOT NULL
+            AND application_intent_digest IS NOT NULL
+            AND application_effect_digest IS NOT NULL
+            AND application_result_digest IS NOT NULL)
+    )
+);
+
+CREATE TRIGGER authorization_admission_results_no_update
+    BEFORE UPDATE OR DELETE ON authorization_admission_results
+    FOR EACH ROW EXECUTE FUNCTION nip_fi_reject_row_mutation_v1();
+CREATE TRIGGER authorization_admission_results_no_truncate
+    BEFORE TRUNCATE ON authorization_admission_results
+    FOR EACH STATEMENT EXECUTE FUNCTION nip_fi_reject_truncate_v1();
+
+-- Bidirectional deferred cardinality guard: a kind-11 (protected-mutation)
+-- receipt must commit with exactly one admission result; an admission result
+-- must commit against a kind-11 receipt. Deferred so receipt and result may
+-- be inserted in any order inside one transaction.
+CREATE FUNCTION authorization_admission_result_guard_v1()
+RETURNS TRIGGER AS $$
+DECLARE
+    receipt authorization_operation_receipts%ROWTYPE;
+    result_count BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'authorization_operation_receipts' THEN
+        receipt := NEW;
+    ELSE
+        -- Firing from authorization_admission_results: look up the receipt.
+        SELECT * INTO receipt
+        FROM authorization_operation_receipts
+        WHERE community_id = NEW.community_id
+          AND operation_id = NEW.operation_id;
+        IF NOT FOUND THEN
+            -- FK on the result table already guards the non-existent receipt
+            -- case; this path should not occur in normal operation.
+            RAISE EXCEPTION
+                'admission result references non-existent receipt for operation %',
+                NEW.operation_id
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_admission_result_receipt_kind';
+        END IF;
+    END IF;
+
+    -- Non-kind-11 receipts require no admission result.
+    IF receipt.operation_kind <> 11 THEN
+        -- If this fired from the result side and the receipt is not kind 11,
+        -- the result is attaching to the wrong receipt kind.
+        IF TG_TABLE_NAME = 'authorization_admission_results' THEN
+            RAISE EXCEPTION
+                'admission result may only attach to a kind-11 (protected-mutation) receipt, got kind %',
+                receipt.operation_kind
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_admission_result_receipt_kind';
+        END IF;
+        RETURN NULL;
+    END IF;
+
+    SELECT count(*) INTO result_count
+    FROM authorization_admission_results
+    WHERE community_id = receipt.community_id
+      AND operation_id = receipt.operation_id;
+
+    IF result_count <> 1 THEN
+        RAISE EXCEPTION
+            'kind-11 receipt requires exactly one admission result, found %',
+            result_count
+            USING ERRCODE = 'check_violation',
+                  CONSTRAINT = 'authorization_admission_result_cardinality';
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE CONSTRAINT TRIGGER authorization_admission_result_receipt_cardinality
+    AFTER INSERT ON authorization_operation_receipts
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_admission_result_guard_v1();
+
+CREATE CONSTRAINT TRIGGER authorization_admission_result_result_cardinality
+    AFTER INSERT ON authorization_admission_results
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_admission_result_guard_v1();
+
+-- Every successful/no-op core lifecycle receipt has exactly one privacy-safe
+-- audit event with the closed transition-kind mapping. Both directions are
+-- deferred so receipt, history, event, selectors, and binding may be inserted
+-- in any order inside one transaction but can never commit partially. The
+-- extended-lifecycle operation kinds (2 provision, 4 disable, 7 recover,
+-- 8 enable, 9 admission loss) and their event kinds arrive with the
+-- FI-LIFECYCLE migration; here the mapping covers only enroll/retire/revoke/
+-- rotate. Non-lifecycle receipts (protected mutation, invalidation) carry no
+-- audit-event cardinality requirement.
+CREATE FUNCTION authorization_operation_receipt_event_guard_v1()
+RETURNS TRIGGER AS $$
+DECLARE
+    receipt authorization_operation_receipts%ROWTYPE;
+    expected_event_kind SMALLINT;
+    matching_event_count BIGINT;
+    expected_event_count BIGINT;
+BEGIN
+    IF TG_TABLE_NAME = 'authorization_operation_receipts' THEN
+        receipt := NEW;
+    ELSE
+        SELECT * INTO receipt
+        FROM authorization_operation_receipts
+        WHERE community_id = NEW.community_id
+          AND operation_id = NEW.operation_id;
+        IF NOT FOUND THEN
+            -- Credential-free pre-authentication denials intentionally have no
+            -- canonical receipt. Their separate FK/shape guards still run.
+            RETURN NULL;
+        END IF;
+    END IF;
+
+    expected_event_kind := CASE receipt.operation_kind
+        WHEN 1 THEN 1  -- enroll
+        WHEN 3 THEN 6  -- retire
+        WHEN 5 THEN 2  -- revoke
+        WHEN 6 THEN 3  -- rotate
+        ELSE NULL
+    END;
+    IF expected_event_kind IS NULL THEN
+        RETURN NULL;
+    END IF;
+
+    -- Only applied (outcome_code = 1) and no-op (outcome_code = 3) lifecycle
+    -- receipts require exactly one paired success-transition event. A denied
+    -- lifecycle receipt (outcome_code = 2) requires zero events from the
+    -- complete core lifecycle success-transition class (kinds 1, 2, 3, 6:
+    -- enrolled, revoked, rotated, retired). Forbidding only the mapped kind
+    -- would allow a wrong-kind transition event to attach to the denied receipt,
+    -- which is equally a contradictory durable fact. Legitimate audit/denial
+    -- events of other kinds (e.g., authenticated kind 9) remain allowed.
+    -- Other outcome codes (4, 5) are not core lifecycle outcomes; skip.
+    IF receipt.outcome_code IN (1, 3) THEN
+        SELECT
+            count(*),
+            count(*) FILTER (WHERE event_kind = expected_event_kind)
+        INTO matching_event_count, expected_event_count
+        FROM authorization_events
+        WHERE community_id = receipt.community_id
+          AND operation_id = receipt.operation_id
+          AND request_fingerprint = receipt.request_fingerprint;
+
+        IF matching_event_count <> 1 OR expected_event_count <> 1 THEN
+            RAISE EXCEPTION
+                'lifecycle receipt requires exactly one event kind %, found % total and % expected',
+                expected_event_kind, matching_event_count, expected_event_count
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_operation_receipt_event_cardinality';
+        END IF;
+    ELSIF receipt.outcome_code = 2 THEN
+        SELECT count(*) FILTER (WHERE event_kind IN (1, 2, 3, 6))
+        INTO expected_event_count
+        FROM authorization_events
+        WHERE community_id = receipt.community_id
+          AND operation_id = receipt.operation_id
+          AND request_fingerprint = receipt.request_fingerprint;
+
+        IF expected_event_count <> 0 THEN
+            RAISE EXCEPTION
+                'denied lifecycle receipt must not have any core success-transition event '
+                '(kinds 1/2/3/6); found % — contradictory durable facts are not permitted',
+                expected_event_count
+                USING ERRCODE = 'check_violation',
+                      CONSTRAINT = 'authorization_denied_lifecycle_receipt_no_success_event';
+        END IF;
+    END IF;
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE CONSTRAINT TRIGGER authorization_operation_receipt_event_cardinality
+    AFTER INSERT ON authorization_operation_receipts
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_receipt_event_guard_v1();
+
+CREATE CONSTRAINT TRIGGER authorization_event_receipt_cardinality
+    AFTER INSERT ON authorization_events
+    DEFERRABLE INITIALLY DEFERRED
+    FOR EACH ROW EXECUTE FUNCTION authorization_operation_receipt_event_guard_v1();
diff --git a/scripts/model-capabilities.json b/scripts/model-capabilities.json
index f825021b437..eb3a230a4d5 100644
--- a/scripts/model-capabilities.json
+++ b/scripts/model-capabilities.json
@@ -601,6 +601,24 @@
       "_reconciliation_note": "models.dev advertises reasoning_options=[{\"type\":\"budget_tokens\",\"min\":1024}]. This is a different capability axis (extended thinking token budget), not an effort-level selector. No effort divergence to reconcile — efforts for this model come from the anthropic family rule (anthropic-adaptive-xhigh-opus-4-7).",
       "_reconciliation_doc": "https://models.dev/api.json (retrieved 2026-07-31, SHA-256 d5a4974cd69f19b0f67713acaa6bb3b16e920defdc07ecbdf6b0a936181bb0e0): providers.databricks.models[\"databricks-claude-opus-4-7\"].reasoning_options=[{\"type\":\"budget_tokens\",\"min\":1024}]"
     },
+    {
+      "provider": "databricks_v2",
+      "raw_model_id": "goose-claude-4-7-opus",
+      "registry_label": "Claude Opus 4.7",
+      "thinking_mode": "adaptive",
+      "supported_efforts": [
+        "low",
+        "medium",
+        "high",
+        "xhigh",
+        "max"
+      ],
+      "default_effort": "high",
+      "databricks_v2_wire_route": "anthropic-messages",
+      "normalization_policy": "none",
+      "_provenance": "all axes copied from equivalent registry endpoint databricks-claude-opus-4-7 for the discovered Goose endpoint id",
+      "_source": "registry_labels"
+    },
     {
       "provider": "databricks_v2",
       "raw_model_id": "databricks-gpt-5-6-luna",
@@ -761,6 +779,23 @@
       "_provenance": "all axes materialized from family:anthropic-adaptive-no-xhigh-sonnet-4-6",
       "_source": "registry_labels"
     },
+    {
+      "provider": "databricks_v2",
+      "raw_model_id": "goose-claude-4-6-sonnet",
+      "registry_label": "Claude Sonnet 4.6",
+      "thinking_mode": "adaptive",
+      "supported_efforts": [
+        "low",
+        "medium",
+        "high",
+        "max"
+      ],
+      "default_effort": "high",
+      "databricks_v2_wire_route": "anthropic-messages",
+      "normalization_policy": "none",
+      "_provenance": "all axes copied from equivalent registry endpoint databricks-claude-sonnet-4-6 for the discovered Goose endpoint id",
+      "_source": "registry_labels"
+    },
     {
       "provider": "databricks_v2",
       "raw_model_id": "databricks-gemini-2-5-flash",
@@ -1031,6 +1066,25 @@
       "_reconciliation_note": "The exact databricks endpoint is absent from the models.dev databricks catalog, but the first-party deepseek entry advertises a reasoning toggle plus effort [high, max]. Per the Kimi-K3 precedent, adopt the model-level effort list despite endpoint absence. The toggle is not representable on the MLflow Chat request schema (reasoning_effort only), so thinking_mode stays none and default_effort is null — mirroring the kimi-k3 record.",
       "_reconciliation_doc": "https://models.dev/api.json (pinned SHA-256 9266003029c4ea265e923637826211f597db08e8f0f40123aad8547411029238): providers.deepseek.models[\"deepseek-v4-pro\"].reasoning_options=[{\"type\":\"toggle\"},{\"type\":\"effort\",\"values\":[\"high\",\"max\"]}]"
     },
+    {
+      "provider": "databricks_v2",
+      "raw_model_id": "databricks-glm-5-3",
+      "registry_label": "GLM-5.3",
+      "thinking_mode": "none",
+      "supported_efforts": [
+        "none",
+        "minimal",
+        "low",
+        "medium",
+        "high",
+        "xhigh"
+      ],
+      "default_effort": "medium",
+      "databricks_v2_wire_route": "mlflow-chat",
+      "normalization_policy": "openai-clamp-max-to-xhigh",
+      "_provenance": "all axes materialized from provider fallback (databricks_v2/concrete_unknown)",
+      "_source": "registry_labels"
+    },
     {
       "provider": "databricks_v2",
       "raw_model_id": "databricks-glm-5-3-flash",
@@ -1385,6 +1439,25 @@
       "_reconciliation_note": "models.dev advertises toggleable reasoning with [low, high, max], but no default. The Databricks endpoint is absent from its provider catalog, so retain the established MLflow Chat route, adopt the upstream capability set, and leave the effort unset rather than invent a Databricks default. The MLflow Chat request schema cannot express a reasoning toggle (only reasoning_effort is representable), so thinking_mode maps to none rather than the upstream toggle, matching the kimi-k2-7-code precedent.",
       "_reconciliation_doc": "https://models.dev/api.json (retrieved 2026-08-20, SHA-256 7ccb5635f682e4248ad8d39f515fbe3f2bb10e67bbc7fa1b94e66dddb00779e5): providers.moonshotai.models[\"kimi-k3\"].reasoning_options=[{\"type\":\"toggle\"},{\"type\":\"effort\",\"values\":[\"low\",\"high\",\"max\"]}]; Databricks endpoint absent from providers.databricks.models"
     },
+    {
+      "provider": "databricks_v2",
+      "raw_model_id": "databricks-kimi-2-7",
+      "registry_label": "Kimi 2.7",
+      "thinking_mode": "none",
+      "supported_efforts": [
+        "none",
+        "minimal",
+        "low",
+        "medium",
+        "high",
+        "xhigh"
+      ],
+      "default_effort": "medium",
+      "databricks_v2_wire_route": "mlflow-chat",
+      "normalization_policy": "openai-clamp-max-to-xhigh",
+      "_provenance": "all axes materialized from provider fallback (databricks_v2/concrete_unknown)",
+      "_source": "registry_labels"
+    },
     {
       "provider": "databricks_v2",
       "raw_model_id": "databricks-kimi-k2-7-code",
diff --git a/scripts/normative-corpus.json b/scripts/normative-corpus.json
index 7e5bfa90b36..23aedb1e645 100644
--- a/scripts/normative-corpus.json
+++ b/scripts/normative-corpus.json
@@ -534,6 +534,45 @@
       "registry_label": null
     }
   },
+  {
+    "id": "dbv2-goose-claude-4-6-sonnet-alias-probe",
+    "provider": "databricks_v2",
+    "raw_model_id": "goose-claude-4-6-sonnet",
+    "_note": "Probes the discovered Goose Sonnet 4.6 endpoint spelling and label.",
+    "expect": {
+      "thinking_mode": "adaptive",
+      "supported_efforts": [
+        "low",
+        "medium",
+        "high",
+        "max"
+      ],
+      "default_effort": "high",
+      "databricks_v2_wire_route": "anthropic-messages",
+      "normalization_policy": "none",
+      "registry_label": "Claude Sonnet 4.6"
+    }
+  },
+  {
+    "id": "dbv2-goose-claude-4-7-opus-alias-probe",
+    "provider": "databricks_v2",
+    "raw_model_id": "goose-claude-4-7-opus",
+    "_note": "Probes the discovered Goose Opus 4.7 endpoint spelling and label.",
+    "expect": {
+      "thinking_mode": "adaptive",
+      "supported_efforts": [
+        "low",
+        "medium",
+        "high",
+        "xhigh",
+        "max"
+      ],
+      "default_effort": "high",
+      "databricks_v2_wire_route": "anthropic-messages",
+      "normalization_policy": "none",
+      "registry_label": "Claude Opus 4.7"
+    }
+  },
   {
     "id": "dbv2-team-prefix-probe",
     "provider": "databricks_v2",
@@ -840,6 +879,27 @@
       "registry_label": null
     }
   },
+  {
+    "id": "dbv2-kimi-2-7-exact-record-probe",
+    "provider": "databricks_v2",
+    "raw_model_id": "databricks-kimi-2-7",
+    "_note": "Probes the canonical Databricks Kimi 2.7 endpoint record.",
+    "expect": {
+      "thinking_mode": "none",
+      "supported_efforts": [
+        "none",
+        "minimal",
+        "low",
+        "medium",
+        "high",
+        "xhigh"
+      ],
+      "default_effort": "medium",
+      "databricks_v2_wire_route": "mlflow-chat",
+      "normalization_policy": "openai-clamp-max-to-xhigh",
+      "registry_label": "Kimi 2.7"
+    }
+  },
   {
     "id": "dbv2-kimi-k3-exact-record-probe",
     "provider": "databricks_v2",
@@ -2401,6 +2461,27 @@
       "registry_label": "DeepSeek V4 Pro"
     }
   },
+  {
+    "id": "dbv2-glm-5-3-exact-record-probe",
+    "provider": "databricks_v2",
+    "raw_model_id": "databricks-glm-5-3",
+    "_note": "Probes the GLM-5.3 endpoint record and label.",
+    "expect": {
+      "thinking_mode": "none",
+      "supported_efforts": [
+        "none",
+        "minimal",
+        "low",
+        "medium",
+        "high",
+        "xhigh"
+      ],
+      "default_effort": "medium",
+      "databricks_v2_wire_route": "mlflow-chat",
+      "normalization_policy": "openai-clamp-max-to-xhigh",
+      "registry_label": "GLM-5.3"
+    }
+  },
   {
     "id": "dbv2-glm-5-3-flash-exact-record-probe",
     "provider": "databricks_v2",