diff --git a/.claude/launch.json b/.claude/launch.json
index 43a6c535b..371f5ecb5 100644
--- a/.claude/launch.json
+++ b/.claude/launch.json
@@ -22,6 +22,20 @@
       "cwd": "backend/src/apis/app_api",
       "autoPort": false
     },
+    {
+      "name": "app-api-branch",
+      "runtimeExecutable": "/Users/philmerrell/Repos/agentcore-public-stack/backend/.venv/bin/python",
+      "runtimeArgs": [
+        "-m",
+        "uvicorn",
+        "apis.app_api.main:app",
+        "--port",
+        "8010"
+      ],
+      "port": 8010,
+      "cwd": "backend/src",
+      "autoPort": false
+    },
     {
       "name": "inference-api",
       "runtimeExecutable": "/Users/philmerrell/Repos/agentcore-public-stack/backend/.venv/bin/python",
diff --git a/.claude/skills/cutting-a-release/SKILL.md b/.claude/skills/cutting-a-release/SKILL.md
index fa41973d3..e196f96b4 100644
--- a/.claude/skills/cutting-a-release/SKILL.md
+++ b/.claude/skills/cutting-a-release/SKILL.md
@@ -225,12 +225,27 @@ required" — that is the note that sends someone digging through `git log`:
 > for tool rows written before it existed. Idempotent; dry-run by default.
 >
 > ```bash
-> AWS_PROFILE=<env> python backend/scripts/backfill_tool_catalog_index.py \
+> AWS_PROFILE=<env> backend/.venv/bin/python backend/scripts/backfill_tool_catalog_index.py \
 >     --table <prefix>-app-roles --region us-west-2 --apply
 > ```
 >
-> Verify `skipped=0 failed=0` and that the index item count matches the tool
-> count before considering the deploy complete.
+> Verify `skipped=0 failed=0`, then confirm with a live Query on the index.
+
+Two details that cost real time on the v1.21.0 prod run, both worth carrying
+into whatever backfill note you write:
+
+- **Give the backend venv's interpreter, not a bare `python`.** These scripts
+  need `boto3`, which is not in the system Python — a bare `python` fails with
+  `ModuleNotFoundError: No module named 'boto3'` before it does anything. All
+  six `backfill_*.py` scripts are runnable as
+  `backend/.venv/bin/python backend/scripts/<script>.py …` from the repo root
+  (`uv run --project backend python …` works too).
+- **Never tell an operator to verify with `describe-table` `ItemCount`.**
+  DynamoDB refreshes table and index item counts roughly every **six hours**,
+  so a correct backfill still reports `0` immediately afterwards and reads as a
+  failure. Name a live `query … --select COUNT` instead, and pair it with a
+  scan for rows the backfill missed — a *partial* backfill is silent, and is
+  exactly what a sparse-index read path's fallback does not cover.
 
 ### Ordering, when the release also switches a read onto the backfilled data
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 21d771988..7dea55e10 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -62,7 +62,10 @@ jobs:
         run: uv sync --extra agentcore --extra dev
       - name: Run pytest
         working-directory: backend
-        run: uv run pytest tests/ -v
+        # `-n auto` fans the suite across all runner cores (pytest-xdist).
+        # Verbosity/--tb live in backend/pytest.ini. The nightly coverage run
+        # (scripts/backend/test.sh) is deliberately left serial.
+        run: uv run pytest tests/ -n auto
 
   test-frontend:
     if: ${{ inputs.run_frontend }}
@@ -151,6 +154,12 @@ jobs:
       - name: Install
         working-directory: infrastructure
         run: npm ci --prefer-offline
+      - name: Type-check (tsc --noEmit)
+        working-directory: infrastructure
+        # Single shared type-check for the whole project. jest now transpiles
+        # only (isolatedModules), so this is where infra type errors are caught
+        # on a PR — cheaper once here than re-run inside every jest worker.
+        run: npm run build
       - name: Run tests
         working-directory: infrastructure
         run: npx jest --maxWorkers=2
diff --git a/.kiro/specs/kb-chunk-inspector/design.md b/.kiro/specs/kb-chunk-inspector/design.md
index 2a45fdac2..d0331b136 100644
--- a/.kiro/specs/kb-chunk-inspector/design.md
+++ b/.kiro/specs/kb-chunk-inspector/design.md
@@ -1,6 +1,16 @@
 # KB Chunk Inspector — Design
 
-**Status:** Draft · Reads only. Built entirely on the existing retrieval facade.
+**Status:** **BUILT** (PR #1057, live in dev). Reads only. Built entirely on the existing
+retrieval facade.
+
+> **AMENDED DURING IMPLEMENTATION — managed only.** §2 below lists
+> `backend.search(kb_ref, query, top_k, retrieval_filter=None)` as available on both
+> adapters. It is not: `retrieval_filter` exists only on `ManagedKbBackend.search`. The
+> legacy adapter is `search(kb_ref, query, top_k)` — no filter, and it ignores `top_k`,
+> always returning five results from the whole knowledge base. So on legacy the
+> inspector would render *other documents'* chunks under this document's name. As built,
+> a legacy document returns `available=false` with a reason, as a 200 rather than an
+> error. See the amendment note in `requirements.md` under Requirement 2.
 
 ## 1. The one hard constraint
 
diff --git a/.kiro/specs/kb-chunk-inspector/requirements.md b/.kiro/specs/kb-chunk-inspector/requirements.md
index 0228372e2..660358a26 100644
--- a/.kiro/specs/kb-chunk-inspector/requirements.md
+++ b/.kiro/specs/kb-chunk-inspector/requirements.md
@@ -1,6 +1,16 @@
 # KB Chunk Inspector — Requirements
 
-**Status:** Draft · **Related:** `managed-kb-migration` (§5.41 diagram answer quality, task 16.2)
+**Status:** **BUILT AND MERGED** ([PR #1057](https://github.com/Boise-State-Development/agentcore-public-stack/pull/1057), `415b13c8`, 2026-09-11) and **live in dev** — no flag gates it, since it is a read-only view.
+Tasks 1–5 complete; task 6 (eyeball it against the real §5.41 corpus) is the remaining
+acceptance check and needs a human, not code. Requirement 2 was **amended during
+implementation** — see the note under it. ·
+**Related:** `managed-kb-migration` (§5.41 diagram answer quality, task 16.2)
+
+> It has already earned its place: the first thing it revealed in dev was that a single
+> image's generated description is split across chunks, the second half orphaned from
+> the image it describes. That is invisible without this view, and it is a plausible
+> contributor to §5.41's wrong answers. See the handoff's "Chunking strategy is not
+> configurable" entry.
 
 ## Problem
 
diff --git a/.kiro/specs/managed-kb-migration/HANDOFF.md b/.kiro/specs/managed-kb-migration/HANDOFF.md
index 0391490b7..b6c4833c7 100644
--- a/.kiro/specs/managed-kb-migration/HANDOFF.md
+++ b/.kiro/specs/managed-kb-migration/HANDOFF.md
@@ -57,8 +57,9 @@ Four things invalidate earlier versions of this document:
 | Implementation | **Build phase done.** Groups 1–14 except 14.4 (retry endpoint) and 14.5 (admin surface); all of group 16; born-managed provision-then-ingest. A migration has completed `shadow → verify → promote → retain` in dev and serves from the managed backend |
 | Tests | Counts drift with every merge — read the latest `develop` run rather than a number pasted here. CI is green on `develop` (backend pytest, frontend, infra jest, load suite, scan) |
 | Deployed | **dev and prod.** In dev: `migrationEnabled` on, everything else off. In prod: **every flag off**, so none of it can fire |
-| Open PRs | **none** for this feature. Last merged: **#1027** born-managed (`f1e11bd3`, 2026-09-10), **#1019** upload-time byte cap, **#1018** doc-reconciler flag forwarding, **#1017** task-16.2 docs |
+| Open PRs | **none** for this feature. Last merged: **#1059** mid-upload delete fix (`0d109b7c`), **#1057** chunk inspector (`415b13c8`), **#1056** this handoff's previous refresh (`07a1e636`), **#1027** born-managed (`f1e11bd3`), **#1019** upload-time byte cap, **#1018** doc-reconciler flag forwarding, **#1017** task-16.2 docs |
 | Uncommitted | none |
+| Exercised for real? | **Born-managed: as of 2026-09-14, being exercised in dev for the first time** (see the flag table). The chunk inspector is live in dev and needs no flag. The Upgrade path has completed a real migration in dev. |
 
 **What is left is not build work.** It is (a) the three pre-promotion probes in
 group 15, (b) turning flags on in prod, and (c) two deferred surfaces (14.4, 14.5).
@@ -69,11 +70,25 @@ See §6.
 | Flag | development | production |
 |---|---|---|
 | `CDK_MANAGED_KB_MIGRATION_ENABLED` | `true` | `false` |
-| `CDK_MANAGED_KB_NEW_DEFAULT` | `false` | `false` |
+| `CDK_MANAGED_KB_NEW_DEFAULT` | **`true`** (armed 2026-09-14) | `false` |
 | `CDK_MANAGED_KB_RECONCILER_ARMED` | `false` | `false` |
-| `CDK_MANAGED_KB_DOC_RECONCILER_ARMED` | `false` | `false` |
+| `CDK_MANAGED_KB_DOC_RECONCILER_ARMED` | unset (= off) | `false` |
 | `CDK_TAG_ENVIRONMENT` | `dev` | `prod` |
 
+⚠️ **`NEW_DEFAULT` was armed in dev on 2026-09-14 to exercise born-managed for the
+first time.** Until then the feature had been merged, deployed and never once
+executed — every test was a unit test against fakes, which cannot tell you that AWS
+accepts the `CreateKnowledgeBase` call or that a work key the trigger writes is one the
+dispatcher's index actually returns. In dev, therefore, **both rungs 2 and 3 of the
+ladder are live at once**; keep that in mind when reading logs, because an agent can
+reach the managed backend by either path.
+
+Setting the GitHub variable alone changes nothing: it is read by `platform.yml` and
+threaded through CDK, so it takes effect only on the next Platform Stack deploy — which
+is what publishes both the dispatcher's schedule state and the app-api task
+environment. Flipping the variable without deploying looks exactly like the feature
+being broken.
+
 `CDK_MANAGED_KB_DOC_RECONCILER_ARMED` is the fourth flag, added by task 16.5. It was
 settable only by hand-editing `cdk.context.json` until PR #1018 added the missing
 `platform.yml` line — the wiring existed end to end *except* for forwarding the
@@ -1020,22 +1035,31 @@ answer than legacy** on a question it retrieves *better*. Both are open.
 
 ### Do these first
 
-The build is done. What remains is proving it against prod's constraints and then
-turning flags on. In order:
+The build is done. What remains is proving it against real AWS and then turning flags
+on in prod. In order:
 
 | | |
 |---|---|
-| **1. Task 15.1 — the live SDK probe** | The only item that can invalidate the whole feature in prod. The *static* half passes (`boto3==1.43.68` carries `MANAGED`, the embedding members, `FLOAT32`, all four document ops, with no `AWS_DATA_PATH`), and a real create → ingest → retrieve → promote has succeeded in dev. What is missing is doing it deliberately, with the checked-in environment and **no** side-loaded service model, and recording the result. If this fails, managed knowledge bases do not work in prod at all |
-| **2. Flip `CDK_MANAGED_KB_NEW_DEFAULT` in prod** | Ladder step 2. New agents are born managed on their first document; not one existing knowledge base is touched. Lowest-blast-radius rung: each agent is independent, so a problem affects that agent and no other. Deploy first, confirm the deploy, *then* set the variable — never both in one motion |
-| **3. Task 15.2 — the ingestion-concurrency probe** | Gates ladder step 3 (`MIGRATION_ENABLED`), **not** step 2. The quota page lists no account-level ingestion-concurrency limit, which is not evidence there is none. Do not size a wide fleet migration before this is answered |
-| **4. Task 14.5 — the admin surface** | Also gates step 3 rather than step 2. The moment existing knowledge bases start migrating you have a mixed fleet and no view of who is on which engine — and "how many are affected?" is the first question anyone asks when something goes wrong |
-| **5. Task 15.3 — full matrix in the dev container** | Housekeeping; CI already covers most of it |
-
-⚠️ **Before flipping anything, re-read §5.41.** Managed is *worse* than legacy for
+| **1. Observe born-managed actually running in dev** | ⏳ IN PROGRESS — `NEW_DEFAULT` was armed in dev on 2026-09-14. Create an agent, upload one document, and watch the whole chain: the `DOC#` row reads `provisioning`, the dispatcher picks the `born_managed` work key up, `provision_managed_kb` succeeds against real Bedrock, the worker hands the document to ingestion, it reaches `complete`, and the agent answers from it. **The first document will sit on "Provisioning knowledge base…" for up to 15 minutes** before anything starts — that is the known dispatcher-interval latency, not a hang, and it is the thing most likely to be misread as a failure |
+| **2. Task 15.1 — the live SDK probe** | Largely SATISFIED BY step 1, which is why step 1 comes first. 15.1 asks for a real create → ingest → retrieve with the checked-in environment and **no** side-loaded service model, and born-managed's happy path is exactly that. Record the result against 15.1 rather than running a separate probe. If it fails, managed knowledge bases do not work in prod at all — which is why nothing below matters until it passes |
+| **3. Flip `CDK_MANAGED_KB_NEW_DEFAULT` in prod** | Ladder rung 2. New agents are born managed on their first document; not one existing knowledge base is touched. Lowest blast radius: each agent is independent. Deploy first, confirm the deploy, *then* set the variable — never both in one motion |
+| **4. Task 15.2 — the ingestion-concurrency probe** | Gates rung 3 (`MIGRATION_ENABLED`), **not** rung 2. The quota page lists no account-level ingestion-concurrency limit, which is not evidence there is none. Do not size a wide fleet migration before this is answered |
+| **5. Task 14.5 — the admin surface** | Also gates rung 3. The moment existing knowledge bases start migrating you have a mixed fleet and no view of who is on which engine — and "how many are affected?" is the first question anyone asks when something goes wrong |
+| **6. Task 15.3 — full matrix in the dev container** | Housekeeping; CI already covers most of it |
+
+⚠️ **Before flipping anything in prod, re-read §5.41.** Managed is *worse* than legacy for
 column-structured diagrams and two-dimensional tables: legacy returned nothing,
 managed returns a confident wrong answer. Born-managed makes managed the default for
 every new agent, so that trade stops being opt-in. The agreed mitigation is guidance,
-not code — and the `kb-chunk-inspector` spec is the tooling half of that guidance.
+not code — and the chunk inspector (now live in dev) is the tooling half of it.
+
+### Known open defects, none blocking the above
+
+| | |
+|---|---|
+| **Ingestion does not check for a deleted document** | Neither the managed consumer nor the legacy handler checks whether a `DOC#` row is `deleting` before ingesting. If an S3 object lands *after* a delete, the document is indexed and its status overwritten to `complete` — so deleted content becomes answerable again and its vectors are orphaned in the knowledge base past the cleanup that already ran. **Retrieval is not the hole**: `_filter_vectors_by_document_status` serves only `complete` and fails closed, so a `deleting` row is already invisible to queries. The bug is that ingestion *promotes the row back* to a state the filter accepts. Not reachable from a single-tab device upload (the delete control only appears after the S3 PUT resolves) but plainly reachable from a connector import or a web crawl, where rows appear with delete controls while staging is still in flight, and from a page refresh mid-upload |
+| **Cancelling a large upload may be impossible** | The delete control appears only once the row joins the document list, which is after the S3 PUT resolves. So there may be no way to abandon a wrong or oversized file mid-flight. Unconfirmed; worth a look |
+| **Chunking strategy is not configurable** | Managed KBs accept `DEFAULT` / `FIXED_SIZE` / `NONE` via `vectorIngestionConfiguration` (semantic is refused, hierarchical is not offered), and it is **immutable after the data source is created**. We send no configuration, so every KB gets the default 300 tokens / 20% overlap — which is why a single image's generated description is split across chunks, the second half orphaned from its subject. A per-agent selector at creation time is the natural shape, since creation is the only moment it can be chosen. Deferred by decision, not forgotten |
 
 ### Open, in rough order
 
diff --git a/.kiro/specs/managed-kb-migration/born-managed-provision-then-ingest.md b/.kiro/specs/managed-kb-migration/born-managed-provision-then-ingest.md
index 49a9b7289..6f5c9275f 100644
--- a/.kiro/specs/managed-kb-migration/born-managed-provision-then-ingest.md
+++ b/.kiro/specs/managed-kb-migration/born-managed-provision-then-ingest.md
@@ -1,8 +1,12 @@
 # Born-managed: provision-then-ingest on first upload
 
-**Status:** Draft (supersedes the enroll-reuse design in `new-default-wiring.md`) ·
-**Part of:** `managed-kb-migration` (rollout ladder step 2) ·
-**Supersedes the approach in:** PR #1027 (keeps its flag reader + infra wiring)
+**Status:** **BUILT AND MERGED** ([PR #1027](https://github.com/Boise-State-Development/agentcore-public-stack/pull/1027), `f1e11bd3`, 2026-09-10).
+Tasks 1–7 complete; task 8 is a turn-on gate, not build work.
+**Armed in dev 2026-09-14** — until that date the feature had never executed, in any
+environment. Still dark in production. ·
+**Part of:** `managed-kb-migration` (rollout ladder rung 2) ·
+**Supersedes the approach in:** `new-default-wiring.md` (kept, banner-marked, for the
+record of why)
 
 ## Decision
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1612dfc1b..f908cdc9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,61 @@ All notable changes to this project are documented in this file. Format follows
 
 For narrative release notes written for operators and product owners, see [RELEASE_NOTES.md](RELEASE_NOTES.md).
 
+## [1.22.0] - 2026-09-14
+
+The agent can stop guessing. **Clarifying questions** ship end to end: when a request is genuinely ambiguous the agent pauses the turn, the SPA renders a multiple-choice picker in the transcript, and the answer resumes that same tool call — surviving a page refresh. The tool worked from PR-2 but the model reached for it 4 times in 24 ambiguous requests; a measured system-prompt clause takes that to 24/24 while leaving clear requests at 0/18. On the admin side, the **cost drill-down** closes the gap between "top users by cost" and the per-session anatomy: an admin walks user → conversations → session profile with 15 diagnosis rules, a context trajectory chart and a copyable diagnostic JSON — all **content-free by construction**, enforced by a denylist test and a moto test that seeds content and proves none returns. Two silent data bugs are fixed: deleting a knowledge-base document mid-upload **permanently leaked its byte reservation**, and born-managed provisioning **mistook an established legacy agent for a new one** and stranded its corpus. And an `@`-mention now **binds the conversation** instead of borrowing one turn — measured on prod, 247 of 247 mentions started the conversation, so the borrow was paying an invisible tool-loss failure for a case that has never occurred. **No CDK deploy required.** One operator step: enable the Clarifying Questions tool in each existing environment's catalog — the seed skips a tool row that already exists.
+
+### 🚀 Added
+
+- **Clarifying questions (`ask_user_question`)** — the agent pauses a turn to ask structured multiple-choice questions. The interrupt is raised by the tool itself via `ToolContext` rather than a `BeforeToolCall` hook, so Strands' `_stop_for_interrupts` carries the `PausedTurnSnapshot`, the resume route and the `PendingInterrupt` breadcrumb with no special case. New `user_question_required` SSE event; gated by `ASK_USER_QUESTION_ENABLED` (default on with a kill switch) (#1100)
+- **Clarifying-questions picker in the chat transcript** — renders the questions inline, always offers Other + Skip (so the model must not supply them; model-supplied duplicates are stripped server-side), and resumes the same turn by POSTing an `interrupt_responses` entry whose `response` is always an object — a null would re-raise the interrupt forever (#1102, #1105)
+- **The picker survives a refresh** — pending prompts rehydrate from the `user_question` `PendingInterrupt` breadcrumb on `GET /messages`, so a reload lands back on the question instead of a dead turn (#1103)
+- **System-prompt guidance that makes the tool actually fire** — appended only when `ask_user_question` is in the turn's **post-filter** effective tool list (the request's `enabled_tools` and the registered set diverge), and applied to the prompt handed to the agent, never to `self.system_prompt`, which is snapshotted for resume and hashed into the agent cache key. ~63 tokens, constant per configuration. Catalog seed flips to `enabledByDefault: True` (#1106)
+- **Admin cost drill-down** — `GET /admin/costs/users/{id}/sessions` and `GET /admin/costs/sessions/{id}/profile` (scope `admin.costs`), plus `apis/shared/observability/content_policy.py`: a denylist of every content-bearing attribute on the session/cost/upload row families with three aliased allowlist projections. Unrecorded cost renders `costKnown=false`, never `$0`. No new table, no GSI operation, no feature flag (#1093)
+- **15 cost diagnosis rules** — `admin/costs/diagnoses.py` encodes the classifications prior quota investigations reached by hand (prefix spiral, partial-miss heavy, over-threshold, summary over budget, prompt/`toolConfig` mutation, agent-cache bypass, attachment-heavy…), each with numeric evidence and the fix (#1093)
+- **Conversations section on `/admin/users/:userId`** — period/sort controls, per-row model, tools on, context bar against the window, cost with share of the user's month, cache waste, and a severity dot for the diagnoses that fired; row links to the anatomy. Top-users table now shows email / tier / quota %, replacing a hard-coded `None` (#1094)
+- **Session profile band + context trajectory chart** on `/admin/costs/sessions/:id` — messages, model calls and mix, tool calls, attachments, compactions, peak context of window, write:read ratio (each "not tracked" wherever a counter predates the session), an expandable Diagnoses list, and "Copy diagnostic JSON" meant to be handed to a model for a second opinion (#1094)
+- **Content-free tool census and compaction counter** — `ToolCensusHook` tallies tool name → `{calls, errors}` per model call and the stream coordinator attaches each tally to that call's `C#` cost row as `toolCalls`; `toolCallCount`/`toolErrorCount` ride the existing session-aggregate `UpdateItem` and a monotonic `compactionCount` rides the compaction-state update (the persisted `compaction` map is last-write-wins and cannot count occurrences). Additive attributes only — no table, no index, no backfill. Gated by `COST_DIAGNOSTICS_ENABLED` (default on with a kill switch) (#1095)
+- **`GET /files/{uploadId}/download`** — cookie-authed, owner-scoped, 302 to a freshly minted presigned URL with `Cache-Control: no-store`. A link to it keeps working for as long as the file does (#1101)
+- **Knowledge-base storage usage bar** — new `KbUsage` (`engine`, `storedBytes`, `reservedBytes`, `cap`, `elevated`) on `DocumentsListResponse`. Managed KBs show "X of Y used" against the binding's effective cap (min of owner tier and per-KB ceiling), green/yellow/red at <75 / 75–90 / ≥90%. Best-effort: a record-read failure never breaks the documents list (#1108)
+
+### ⚠️ Changed
+
+- **An `@`-mention now binds the conversation instead of running one turn.** Two outcomes, no third: mentioning into an **empty** thread binds the Agent to it, exactly like launching from its card; mentioning into a thread that **has messages** opens a **new** conversation with that Agent, and the SPA says so. This reverses decision D11 on new evidence — of **247 prod mentions, 247 started the conversation** (dev: 60 of 61), so the borrow bought nothing and cost an invisible failure. The SPA now carries the binding in the `assistantId` query param and stops sending `agent_mention`; the backend still honours that flag for older clients, and `binds_conversation` gains `thread_is_empty` so a stale tab lands where a current one does. Retires the ~$0.12-per-mention prefix re-write and the history fork (#1115)
+- **Send button is an up arrow**, not a paper airplane (#1114)
+
+### 🐛 Fixed
+
+- **A mentioned Agent silently lost its tools after the first turn.** The thread still looked like the Agent's while its tools, skills and model were gone, and nothing surfaced it — not the UI, and not the model, which cannot know its own toolset shrank. Asked for a tool it had used a moment earlier it returned `Unknown tool: create_rubric` and told the user to toggle a setting that was already correct (#1115)
+- **"Continue" after a `max_tokens` truncation dropped the Agent entirely.** The SPA was already resending `rag_assistant_id` — only a `not is_continuation` guard discarded it — so a properly launched Agent finished its reply with none of its tools, skills, model or instructions. The block now runs for a continuation, with binding validation, persistence and RAG skipped (#1115)
+- **Generated-document download links were dead on arrival and dead on reload.** The tool result handed the model a ~1,400-character presigned S3 URL and the model re-emitted it in prose truncated at the `?` — signature gone, `AccessDenied` (observed twice in one prod session). The card's own button was on a clock too: the signature expired an hour after the message was written. The office tools and `workspace_write` now put `upload_id` in the card payload and tell the model the card is already on screen, dropping the tool result from ~1,500 to ~330 characters **in the cacheable prefix, for the life of the session**. The SPA resolves through the new download route, recovers the upload id from a legacy `download_url`'s S3 key so persisted cards heal on render, and the global `marked` link renderer rewrites raw user-files S3 hrefs — fixing links already sitting in shipped conversations (#1101)
+- **Deleting a document mid-upload leaked its byte reservation, permanently.** The request-time reservation is released on every abandon path except deletion, so each cancelled upload shaved bytes off that assistant's allowance forever — surfacing months later as "uploads stopped working", with no failure anywhere near the deletes that caused it. `soft_delete_document` now releases through `release_reservation_if_managed`, whose `settle_once` stamp makes it exactly-once against the other three paths (#1059)
+- **The same delete popped five "Not found" dialogs.** The poll tolerates five consecutive 404s and the component handled `DOCUMENT_NOT_FOUND` cleanly, but the global `errorInterceptor` pops a dialog for every failed request *before* any caller's catch runs. The poll's reads now set `SUPPRESS_ERROR_TOAST`, and the loop is finally stoppable — `deleteDocument` already dropped the id from `pollingDocuments`, but that signal was display-only and the running loop never read it (#1059)
+- **Born-managed provisioned over an established legacy agent.** Legacy KBs share one S3-Vectors index and never write a `KB_Record`, so an established legacy agent looked identical to a new one — its *next* upload was mistaken for a first upload, flipping retrieval to an empty managed KB and stranding the existing corpus. The record-is-`None` branch is now guarded on a cheap existing-documents probe (`Limit=1` COUNT), and fails toward legacy on any probe error (#1109)
+- **The storage usage bar showed for legacy (Classic) KBs**, which are uncapped and have no denominator to show (#1110)
+- **19 of 51 chat greetings wrapped to a second line** in the 616px text column, and because the greeting types out a character at a time the wrap happened in full view and pushed the composer down mid-animation. Twenty offenders rewritten shorter; a new `greeting-line-length.spec.ts` sums per-character advance widths captured from the real InterVariable woff2 (jsdom has no font metrics), tracking browser layout to within ±7px across 455 name/greeting combinations. Two of the offenders were `DEFAULT_GREETING_TEMPLATES` entries a golden spec pinned verbatim — the pin was preserving the bug (#1116)
+- **Cost diagnostics crashed the scheduled-runs image** — `feature_flags` was not shipped in `Dockerfile.scheduled-runs` (#1095)
+
+### 🔒 Security
+
+- **Remaining log-injection sinks sanitized** — user-controlled values reaching `logger` calls in admin role pins, model icons, fine-tuning, sessions, skills (routes, service, user service), tool discovery and the inference-api chat routes now pass through `scrub_log()` (#1098)
+- **Nightly workflow ref allowlist guarded by a test** — `tests/supply_chain/test_nightly_ref_allowlist.py` pins which refs the nightly build may check out (#1098)
+
+### 📦 Dependencies
+
+- Backend (dev): `pytest-xdist` 3.6.1 added — the suite is xdist-safe (moto mocks and hypothesis are per-worker; no test mutates shared on-disk state)
+
+### 🔧 CI/CD
+
+- **Backend pytest runs in parallel** — `pytest -n auto` on the PR gate fans ~3k tests across all runner cores instead of running single-threaded. `-v` dropped from `pytest.ini` (thousands of `PASSED` lines with no diagnostic value); the nightly coverage run stays serial on purpose (#1111)
+- **Infra jest is transpile-only** — `isolatedModules` stops each jest worker re-type-checking the whole project, which was the dominant cost of the infra suite once backend went parallel. Type safety is preserved by a single `tsc --noEmit` step added to the infra CI job, where previously only ts-jest enforced it on PRs. Workers stay at 2 — the `--maxWorkers` bump regressed 2.5× in #1112 (#1113)
+
+### 📚 Docs
+
+- **Authenticated web assessment via browser takeover** — a 468-line spec for the browser-takeover surface (#1107)
+- **Managed-KB specs closed out**, with `MANAGED_KB_NEW_DEFAULT` armed in dev recorded (#1104)
+- **Backfill instructions corrected across all six `backfill_*.py` scripts** — give the backend venv's interpreter (a bare `python` fails on `boto3` before doing anything), and stop naming `describe-table` `ItemCount` as the verification: DynamoDB refreshes those counts roughly every six hours, so a correct backfill reads as a failure (#1098)
+
 ## [1.21.0] - 2026-09-13
 
 Global preferences get a home. **Customize** (`/customize/{tools,skills,connectors}`) replaces the composer's settings drawer, which had been presenting durable, account-wide state as "settings for this conversation" — a user who enabled a tool to get through one question had changed the `toolConfig` of every future turn, and nothing said so. Tools and skills gain full detail pages, an MCP server's sub-tools can be switched one at a time, and `/skill-name` in the composer invokes a skill for a single message the way `@agent` already did. Chat itself stops guessing: a four-tool answer now renders as **one** card instead of five, the loading indicator states what the agent is actually doing (`Running browse_web · 4s`) from a new `agent_status` event, and each finished tool batch gets a model-written summary line off a Nova Micro side-channel that never touches the cacheable prefix. On the cost side, the tool catalog moves off a full-table Scan onto a new `EntityTypeIndex` (95 items read to return 24, before), four tenant-global catalogs gain a TTL + single-flight cache, and the per-request user-profile upsert is throttled — together roughly 24 DynamoDB writes and four uncached scans removed from every SPA first load. **Requires a CDK deploy, and a backfill must be run — see the deployment notes.** ⚠️ **This release removes the only way to select a Conversation Mode**; prod uses one (Guided Learning, ~60 sessions in the first 12 days of September).
diff --git a/CLAUDE.MD b/CLAUDE.MD
index 9f1a4181e..8ba379a7d 100644
--- a/CLAUDE.MD
+++ b/CLAUDE.MD
@@ -63,6 +63,7 @@ npx cdk deploy {prefix}-PlatformStack
 | `steering_applied` | A follow-up the user typed **while the turn was still streaming** was injected into that running turn at a tool boundary — payload `{type, sessionId, entryId, text}`. PR #916 queues a mid-stream Enter in the composer and flushes it on the turn's falling edge; mid-turn steering lands it at the next tool boundary instead, appended as a `{"text": ...}` block on the same user-role message that carries the tool results, so the agent reads it before choosing its next action. Emitted after that batch's `tool_result` events (so the thread renders in the order the model will see) and never after `done`. The transport in is the session's single-flight **lease row** — `steerQueue` + `steerFor`, owner-scoped exactly like `cancelRequestedFor`, armed by app-api's `POST /sessions/{id}/steer` and deleted with the lease at turn end. Consumption is **commit-on-append**: the hook peeks at `AfterToolsEvent` and clears the inbox entry only on the `MessageAddedEvent` for that same message, because `AfterToolsEvent` fires from a `finally` and so also fires on the interrupt path, where the mutated message is discarded — a hook that consumed on read would destroy the user's words whenever a steer landed on the same tool batch as an OAuth consent. Absence of this event is the fallback, not an error: a turn that calls no tools has no boundary to inject at, and a steer can lose the race with the turn's end — in both cases the entry stays queued and #916's end-of-turn flush sends it as a normal turn. Append-only against the cached prefix (the injection lands inside the segment the `strategy="auto"` message-level cachePoint covers), so it never rewrites the prefix. Gated by `MID_TURN_STEERING_ENABLED` (default on with a kill switch); while off the steer endpoint 404s and the hook returns immediately. See `docs/specs/mid-turn-steering.md` |
 | `stream_error` | Conversational error |
 | `oauth_required` | External MCP tool needs user consent — payload `{providerId, authorizationUrl, interruptId?}`, one event per provider emitted after `message_stop`. Two flavors. **Interrupt-driven** (`interruptId` present): `OAuthConsentHook` paused a tool call mid-turn; the SPA resumes that exact turn by POSTing the id back. **Pre-flight** (`interruptId` *absent*): the tool never registered because the MCP server refused the pre-flight `tools/list` — since the consent hook is `BeforeToolCall`, it can't fire for an unregistered tool, so without this event the tool vanishes with no explanation. Nothing is paused, so the SPA shows the Connect affordance and must NOT resume; a synthetic id would be worse than none, because the resume guard in `inference_api/chat/routes.py` 400s on unknown ids and the user would hit an error right after consenting. Pre-flight events are re-emitted each turn that rebuilds the agent (the pre-flight keeps failing until consent lands) and are deliberately not persisted as `pending_interrupt` breadcrumbs — those are keyed by interrupt id for the resume path. The SPA dedupes by `providerId` and suppresses a dismissed pre-flight prompt for the tab session. Before emitting, the runtime asks the AgentCore vault directly: a vaulted token is warmed into `oauth_token_cache` and the pre-flight retried, so a user who already consented gets the tool back instead of losing it for the life of the process |
+| `user_question_required` | The agent paused to ask the user structured clarifying questions — payload `{type, interruptId, toolUseId, questions}`, where each question is `{header, question, multiSelect, options: [{label, description?}]}`. Emitted after `message_stop` in the same `done` block as `oauth_required` / `tool_approval_required`, one event per pending prompt. Unlike those two the interrupt is raised by the **tool itself** (`ask_user_question`, via `ToolContext`) rather than by a `BeforeToolCall` hook; Strands routes both through `_stop_for_interrupts`, so the `PausedTurnSnapshot`, the resume route and the `PendingInterrupt` breadcrumb (`kind: "user_question"`, questions JSON-encoded) need no special case. The SPA renders a picker and resumes the same turn by POSTing an `interrupt_responses` entry whose `response` is `{answers: {"<header>": {selected, text}}}` — always an object, **never null**: `ToolContext.interrupt` only treats a non-None response as an answer, so a null would re-raise the interrupt forever ("Skip" sends `{skipped: true}`). The picker always offers Other + Skip, so the model must not include them as options. Cost: the tool spec is a constant in the cacheable `toolConfig` prefix and the questions travel on the SSE channel only — just the one-line formatted answer block re-enters the conversation. Gated by `ASK_USER_QUESTION_ENABLED` (default on with a kill switch); while off the tool is never registered, so the model falls back to asking in prose |
 | `compaction` | Backend rolled older turns into a summary on this turn — payload `{previousCheckpoint, newCheckpoint, summarizedTurns, inputTokens}`, emitted after the final `metadata` event so the badge updates first, before `done` |
 | `done` | Stream complete |
 
diff --git a/README.md b/README.md
index 87588267f..6b49d63d3 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 **An open-source, production-ready Generative AI platform for institutions**
 *Built by Boise State University, designed for everyone.*
 
-[![Release](https://img.shields.io/badge/Release-v1.21.0-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
+[![Release](https://img.shields.io/badge/Release-v1.22.0-6366f1?style=flat&logo=github&logoColor=white)](RELEASE_NOTES.md)
 [![Nightly](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml/badge.svg)](https://github.com/Boise-State-Development/agentcore-public-stack/actions/workflows/nightly.yml)
 
 ![Python](https://img.shields.io/badge/Python-3.13+-3776AB?style=flat&logo=python&logoColor=white)
@@ -296,7 +296,7 @@ agentcore-public-stack/
 
 See [RELEASE_NOTES.md](RELEASE_NOTES.md) for the full changelog, including new features, bug fixes, platform upgrades, and deployment notes for each release.
 
-**Current release:** v1.21.0
+**Current release:** v1.22.0
 
 ---
 
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index c93ec87e2..33fd9f27f 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,3 +1,254 @@
+# Release Notes — v1.22.0
+
+**Release Date:** September 14, 2026
+**Previous Release:** v1.21.0 (September 13, 2026)
+
+---
+
+> ✅ **No CDK deploy required.** The only infrastructure changes in this release are a jest config and a version bump. Deploy `backend.yml` then `frontend-deploy.yml`. No new AWS resources, no GSI operation, no SSM parameter, no IAM change, no data backfill.
+>
+> 🛠️ **One operator step, per environment: enable the Clarifying Questions tool.** `seed_bootstrap_data.py` **skips any tool row that already exists**, so flipping `enabledByDefault: True` in the seed reaches a fresh bootstrap only. Wherever an `ask_user_question` row is already in the catalog, an admin has to turn it on; wherever the row has never existed, the seed will create it enabled — but a role whose `grantedTools` is not `*` still needs the grant added. Without this, the feature ships invisible: the model simply keeps asking in prose, exactly as before. See Deployment notes.
+>
+> ⚠️ **An `@`-mention now binds the conversation.** Mentioning an Agent into an **empty** thread binds it, like launching from its card; mentioning into a thread that **already has messages** opens a **new** conversation with that Agent. There is no third outcome — the mention no longer runs one turn and reverts. This reverses design decision D11 on measured evidence, and it retires a failure mode where the Agent's tools vanished silently after the first turn. See Breaking changes.
+>
+> 🗂️ **Nothing carries forward from v1.21.0's backfill note if you have already run it.** If you have *not*, `backend/scripts/backfill_tool_catalog_index.py` is still required in that environment — it is unaffected by this release, but the tool catalog's sparse-index read still answers "nothing matched" rather than "something is wrong".
+
+---
+
+## Highlights
+
+The agent can stop guessing. **Clarifying questions** ship end to end: when a request is genuinely ambiguous, the agent pauses the turn, the SPA renders a multiple-choice picker inline in the transcript, and the answer resumes that same tool call — surviving a page refresh. The tool itself worked from the second PR; the interesting part is that the model almost never reached for it — 4 times in 24 deliberately ambiguous requests. Rewording the tool description and moving it in the tool list both stayed inside the noise band. A short system-prompt clause, added only when the tool is actually in the turn's effective list, took it to **24/24 on ambiguous requests while leaving clear requests at 0/18** — it asks when asking helps, and does not turn direct questions into interrogations.
+
+Administrators can now follow a cost number to its cause. The **cost drill-down** closes the gap between "top users by cost" and the per-session anatomy: user → conversations → session profile, with 15 diagnosis rules that encode classifications prior quota investigations reached by hand, a per-call context trajectory chart with the compaction threshold always in view, and a "Copy diagnostic JSON" button meant to be handed to a model for a second opinion. It is **content-free by construction** — a denylist of every content-bearing attribute on the session, cost and upload row families, enforced by a test that walks every admin cost response model and a moto test that seeds real content and proves none of it comes back.
+
+Two silent data bugs are fixed, both of the worst shape: invisible, cumulative, and delayed. Deleting a knowledge-base document **while it was still uploading permanently stranded its byte reservation** — every cancelled upload shaved bytes off that assistant's allowance forever, and would have surfaced months later as "uploads stopped working" with no failure anywhere near the deletes that caused it. And **born-managed provisioning could not tell an established legacy agent from a new one** — legacy KBs share one S3-Vectors index and never write a `KB_Record` — so an established agent's *next* upload was mistaken for its first, flipping retrieval to an empty managed KB and stranding the existing corpus.
+
+Generated documents are downloadable again. A `.docx` from `create_word_document` rendered a card whose button worked while the markdown link beside it returned `AccessDenied`: the tool result handed the model a ~1,400-character presigned S3 URL, and the model re-emitted it in prose truncated at the `?`. Signed URLs no longer go anywhere they can be copied or persisted, which also drops that tool result from ~1,500 to ~330 characters **inside the cacheable prefix, for the life of the session**.
+
+---
+
+## Clarifying questions
+
+When a request is genuinely ambiguous, the agent stops and asks instead of guessing — and the user answers with two clicks rather than by retyping the request.
+
+### Backend
+
+- `agents/builtin_tools/ask_user_question.py` — the tool. Unlike `oauth_required` and `tool_approval_required`, the interrupt is raised by the **tool itself** through `ToolContext`, not by a `BeforeToolCall` hook. Strands routes both through `_stop_for_interrupts`, so the `PausedTurnSnapshot`, the resume route and the `PendingInterrupt` breadcrumb (`kind: "user_question"`, questions JSON-encoded) needed no special case.
+- `apis/shared/user_questions/models.py` — the question schema, and the normalizer that **strips model-supplied Other/Skip options**. The picker always offers both, so a model that includes them produces duplicates. The same module discourages a second round of questions.
+- New `user_question_required` SSE event, emitted after `message_stop` in the same `done` block as `oauth_required`. Payload `{type, interruptId, toolUseId, questions}`, each question `{header, question, multiSelect, options: [{label, description?}]}`.
+- The resume contract has one sharp edge, and it is pinned by tests: the POSTed `response` must **always be an object**, never `null`. `ToolContext.interrupt` only treats a non-`None` response as an answer, so a null re-raises the interrupt forever. "Skip" sends `{skipped: true}`.
+- `apis/shared/sessions/metadata.py` — the breadcrumb that lets a pending prompt survive a reload.
+- `chat_agent.py` — `_system_prompt_for(tools)` appends the guidance clause. Three deliberate choices: gated on the tool so a user without it never carries an instruction to call it; keyed on the **post-filter** tool list rather than the request's `enabled_tools`, because the two diverge (`ToolFilter` drops a catalog id the registry does not know — `canvas_faculty` does this in dev today) and keying on the request would advertise a tool absent from `toolConfig`; and applied to the prompt handed to the agent, **never** to `self.system_prompt`, which is snapshotted for resume and hashed into the agent cache key.
+
+Three approaches were measured and ruled out, recorded so they are not retried: rewording the tool description (44–56%, inside a 17–44% baseline band), moving the tool's position in the list (25–38%), and removing the prompt's "Cost Awareness" clause (38%). Only the system-prompt clause escapes the noise, so the text is load-bearing in that position and ships byte-identical to what was measured, with a test pinning it.
+
+### Frontend
+
+- `services/user-question/user-question.service.ts` and `user-question-prompt.component.ts` — the picker in the transcript: full-width, one stroke on a selected option, Other and Skip always offered.
+- `stream-parser-core.ts` / `stream-parser-types.ts` — `user_question_required` parsing.
+- `session/user-question-hydration` — rehydrates a pending prompt from `GET /messages` after a refresh, so a reload lands back on the question rather than a turn that can never finish.
+
+### Cost
+
+The tool spec is a constant in the cacheable `toolConfig` prefix (~630 tokens) and the questions travel on the SSE channel only — just the one-line formatted answer block re-enters the conversation. The system-prompt clause is ~63 tokens, constant per configuration. Gated by `ASK_USER_QUESTION_ENABLED` (default on with a kill switch); while off the tool is never registered, so the model falls back to asking in prose.
+
+Spec: `docs/specs/ask-user-question.md`.
+
+---
+
+## Admin cost drill-down
+
+An admin can start from a user, list their conversations **without reading any of them**, and open one for the diagnostic profile a developer — or a model handed the JSON — needs to find cost-effectiveness work.
+
+### Backend
+
+- `apis/shared/observability/content_policy.py` — the denylist of every content-bearing attribute on the session/cost/upload row families, three aliased allowlist projections, and the walkers. Enforced two ways: a test that walks **every** admin cost response model (one named exemption, `TopSessionCost.title`, kept by decision) and a moto test that seeds content and proves none of it returns.
+- `GET /admin/costs/users/{id}/sessions` and `GET /admin/costs/sessions/{id}/profile`, scope `admin.costs`. Unrecorded cost renders `costKnown=false` — never `$0`, which would read as "this conversation was free."
+- `admin/costs/diagnoses.py` — 15 pure rules with numeric evidence and a stated fix: prefix spiral, partial-miss heavy, over-threshold, summary over budget, prompt/`toolConfig` mutation, agent-cache bypass, attachment-heavy, and more.
+- `get_session_cost_records` now projects the twelve attributes the anatomy consumes, which closes the `citations[].text` read on the existing path.
+- Top-users enrichment (email, tier, quota %) replaces a hard-coded `None`.
+
+No new table, no GSI operation, no feature flag — read-only, admin-only, and it degrades to "not tracked" wherever a counter predates the session.
+
+### Frontend
+
+- `/admin/users/:userId` gains a **Conversations** section (owned by the costs feature, rendered only for admins holding `admin.costs`): period and sort controls, per-row model, tools on, a context bar against the window, cost with share of the user's month, cache waste, and a severity dot for the diagnoses that fired. A row opens the anatomy.
+- `/admin/costs/sessions/:id` gains a **profile band** (messages, model calls and mix, tool calls, attachments, compactions, peak context of window, write:read), an expandable **Diagnoses** list (severity chip, headline, code, suggestion, evidence, ref), a **context trajectory chart** with the compaction threshold always in view, a back-to-user link, and **Copy diagnostic JSON**. The profile loads independently of the anatomy, so one failing does not hide the other.
+
+Verified in-browser against dev data: 93 conversations listed for September's top user, profile + diagnoses + chart rendered, dark mode through both levers, and the copy produced a 15.8 KB document with no denylisted keys.
+
+### The one signal that had to be recorded
+
+Which tools a conversation called, how often, and how often they failed could not be derived from existing rows. `ToolCensusHook` tallies tool name → `{calls, errors}` per model call using the same cycle counter `AgentStatusHook` uses; the stream coordinator attaches each call's tally to that call's `C#` cost row as `toolCalls`. `toolCallCount` / `toolErrorCount` ride the existing session-aggregate `UpdateItem` alongside `totalCost`, and a monotonic `compactionCount` rides the compaction-state update — the persisted `compaction` map is last-write-wins and cannot count occurrences.
+
+Everything here is **additive attributes on rows the turn already writes**: no table, no index, no backfill, and nothing reaches the prompt, so the cacheable prefix is untouched. Sessions that predate it read "not tracked" rather than `0`. Gated by `COST_DIAGNOSTICS_ENABLED` (default on with a kill switch).
+
+Spec: `docs/specs/admin-cost-drilldown.md`.
+
+---
+
+## Knowledge base — storage usage, and two silent data bugs
+
+### Storage usage on the KB card
+
+The agent's knowledge-base card now shows how much of the byte cap is in use. `_resolve_kb_usage` reads the `KB_Record` once: managed KBs report their bytes and the binding's effective cap (the min of owner tier and per-KB ceiling); legacy S3-Vectors KBs are uncapped and show "X stored" with no denominator and no colour ramp. Green / yellow / red at <75 / 75–90 / ≥90%. Best-effort throughout — a record-read failure never breaks the documents list.
+
+### Deleting mid-upload leaked bytes, permanently
+
+The request-time byte reservation is released on every abandon path except one: deletion. Ingestion reaching terminal, a client-reported upload failure and the stale sweep all release; a deleted document reached none of them, so its reservation was stranded forever. Each cancelled upload permanently shaved bytes off that assistant's allowance — surfacing months later as "uploads stopped working", with no failure anywhere near the deletes that caused it, which is exactly what `byte_cap.release`'s own docstring warns about. `soft_delete_document` now releases through `release_reservation_if_managed`, whose `settle_once` stamp makes it exactly-once against the other three paths.
+
+The same delete also popped **five "Not found" dialogs**. The polling loop tolerates five consecutive 404s and the component already handled `DOCUMENT_NOT_FOUND` cleanly — but the global `errorInterceptor` pops a dialog for every failed request *before* any caller's catch runs, so correct handling was invisible and the user got one dialog per tolerated retry. The poll's reads now set `SUPPRESS_ERROR_TOAST`, and the loop is finally stoppable: `deleteDocument` had always dropped the id from `pollingDocuments`, but that signal was display-only and the running loop never read it.
+
+**Known and deliberately not fixed here:** neither ingestion pipeline checks whether a document is `deleting`. If the S3 PUT completes after the delete, the managed consumer ingests it and writes `complete` over `deleting` — deleted content becomes answerable again and the row returns. That is a data-correctness bug on the live ingest path and needs its own change with its own mutation guards.
+
+### Born-managed provisioned over an established legacy agent
+
+Born-managed treated the absence of a `KB_Record` as "brand-new agent". But legacy KBs are not first-class — they share one S3-Vectors index and never write a record — so an established legacy agent looked identical to a new one. Its **next** upload was therefore mistaken for a first upload, flipping retrieval to an empty managed KB and stranding the existing corpus on the legacy index. The record-is-`None` branch is now guarded on an existing-documents check (`assistant_has_documents`: cheap COUNT, `Limit=1`), provisioning only at zero documents and failing toward legacy on any probe error.
+
+---
+
+## Generated documents download reliably
+
+A `.docx` produced by `create_word_document` rendered a download card whose button worked, while the markdown link the model wrote underneath it returned S3 `AccessDenied` (reported on prod session `6b247682`). The conversation shows why: the tool result handed the model a ~1,400-character presigned S3 URL, and the model re-emitted it in prose **truncated at the `?`** — signature gone. Two turns in that one session did it. The card's own button was on a clock too: the signature expired an hour after the message was written, so reopening an older thread would have failed the same way.
+
+Signed URLs no longer go anywhere they can be copied or persisted:
+
+- The office tools and `workspace_write` put `upload_id` in the card payload instead of a presigned URL, and the summary tells the model the card is already on screen so it does not compose a link of its own. **The tool result drops from ~1,500 to ~330 characters — per document, in the cacheable prefix, for the life of the session.**
+- New `GET /files/{uploadId}/download` on app-api: cookie-authed, owner-scoped, 302 to a freshly minted presigned URL with `Cache-Control: no-store`. A link to it works for as long as the file does.
+- The SPA card resolves `upload_id` through that route and falls back to recovering the upload id out of a legacy `download_url`'s S3 key, so cards already persisted in conversations heal on render. The global `marked` `renderer.link` rewrites raw user-files S3 hrefs the same way — which fixes the links already sitting in shipped conversations.
+
+Verified against dev: the route 302s for an owned file and 404s otherwise, the minted URL serves 200 while the truncated form is 403, and the exact link from the bug report renders as `/api/files/{uploadId}/download` while unrelated links are untouched.
+
+---
+
+## 🐛 Bug fixes
+
+- **A mentioned Agent silently lost its tools after the first turn.** The thread still looked like the Agent's while its tools, skills and model were gone, and nothing surfaced the change — not the UI, and not the model, which cannot know its own toolset shrank. Asked to use a tool it had used a moment earlier it got `Unknown tool: create_rubric`, and told the user to toggle that tool in the picker: a confident wrong diagnosis sending them to fix a setting that was already correct. Fixed by the binding change under Breaking changes.
+- **"Continue" after a `max_tokens` truncation dropped the Agent entirely** — on the path users are explicitly told to use. The SPA was already resending `rag_assistant_id` (`continueTruncatedTurn`'s own comment says "so the backend rebuilds the same model/tools/assistant agent"); only a `not is_continuation` guard discarded it, so a properly launched Agent finished its reply with none of its tools, skills, model or instructions. The block now runs for a continuation, with binding validation and persistence skipped (it binds nothing new) and RAG skipped (the turn carries an empty message, so a KB search would spend a query on `""`).
+- **19 of 51 chat greetings wrapped to a second line.** The greeting heading sits in a 616px text column at `text-4xl/tight`, and because it types out a character at a time, the wrap happened in full view and pushed the composer down mid-animation. Twenty offenders rewritten shorter, keeping the voice. Two were stock `DEFAULT_GREETING_TEMPLATES` entries pinned verbatim by a golden spec — "How can I help you today, {name}?" wrapped for any first name of 8 characters or more, so the pin was preserving a bug. A new `greeting-line-length.spec.ts` holds the line: jsdom has no font metrics, so it sums per-character advance widths captured from the real InterVariable woff2 in the app's own `<h1>`, which tracks browser layout to within ±7px across 455 name/greeting combinations. Narrow viewports are deliberately out of scope — below ~720px the column is the viewport, and no greeting worth writing fits a phone on one line.
+- **The KB storage usage bar showed for legacy (Classic) KBs**, which are uncapped and have no denominator to show.
+- **Cost diagnostics crashed the scheduled-runs image** — `feature_flags` was not shipped in `Dockerfile.scheduled-runs`.
+
+---
+
+## 🔒 Security
+
+- **The remaining log-injection sinks are sanitized.** User-controlled values reaching `logger` calls in admin role pins, model icons, fine-tuning routes, sessions, skills (routes, service and user service), tool discovery, and the inference-api chat routes now pass through `scrub_log()`.
+- **The nightly workflow's ref allowlist is guarded by a test** — `tests/supply_chain/test_nightly_ref_allowlist.py` pins which refs the nightly build may check out, so widening it is a reviewed change rather than an edit nobody notices.
+
+---
+
+## ⚠️ Breaking changes
+
+### An `@`-mention binds the conversation instead of borrowing one turn
+
+Mentioning an Agent used to run **that turn** as the Agent and silently revert the next one. A mention now *means* "talk to this Agent", with two outcomes and no third:
+
+| Thread state | What a mention does |
+|---|---|
+| **Empty** | The Agent **binds** the conversation, exactly like launching it from its card. Safe, because there is no history for the binding to misrepresent. |
+| **Has messages** | The message opens a **new conversation** with that Agent, and the SPA says so. The Agent cannot be bound to history written under other instructions. |
+
+This reverses design decision D11 rather than repairing an oversight — D11 chose the per-turn reading deliberately. **What changed is the evidence.** Measured on prod `sessions-metadata` via `turnAgentId` on the `C#` rows: of **247 mentions, 247 started the conversation.** Zero were mid-thread consults; zero mentioned a second Agent inside a thread bound to a first. (Dev: 60 of 61.) The borrow was paying an invisible failure mode for a case that has never occurred.
+
+**Migration:** none required. Persisting `preferences.assistant_id` is necessary but not sufficient — every turn's Agent is resolved from the request, the SPA's only carrier is the `assistantId` query param, and the self-heal that refills it from preferences runs on session *load*. So the SPA now sets the param and stops sending `agent_mention` at all. The backend still honours that flag for clients that predate this change, and `binds_conversation` gains `thread_is_empty` so a stale tab mentioning into a fresh thread lands where a current one does. The thread lookup runs only for mention turns, so no bound-Agent turn pays a query it cannot act on.
+
+**Two known costs retire with the borrow:** the ~$0.12-per-mention prefix re-write (a bound conversation swaps once and stays, instead of swapping back), and the history fork, where the mention agent and the plain agent were two cached instances that never saw each other's turns.
+
+A resume still skips the binding block, and always did keep its tools — it rebuilds from `PausedTurnSnapshot`, replaying the original turn's exact `enabled_tools` / `system_prompt` / `enabled_skills` to reconstruct the same prompt-cache key. Worth stating because resume rows carry no `turnAgentId`, so a census of "turns with no Agent" reads them as losses and overcounts badly.
+
+The rule lives in one testable place at each end — `mention-routing.ts` on the client, `agent_binding_policy.py` on the server.
+
+Spec: `docs/specs/agent-marketplace.md` (D11 + Phase 7 notes).
+
+### The chat send button is an up arrow
+
+Cosmetic, listed only because it changes a control users reach for without looking.
+
+---
+
+## 🏗️ Infrastructure
+
+**No CDK deploy is required for this release.** The only files that changed under `infrastructure/` are `jest.config.js` and the version in `package.json`. No new AWS resources, no GSI operation, no SSM parameter, no IAM change.
+
+Two new environment variables are read by the backend, and **both default to enabled when unset**, so neither needs to be plumbed to ship the features:
+
+| Variable | Default | Effect when `false` |
+|---|---|---|
+| `ASK_USER_QUESTION_ENABLED` | on | The tool is never registered, never reaches `toolConfig`, and the agent falls back to asking in prose |
+| `COST_DIAGNOSTICS_ENABLED` | on | No census / counter attributes are written; the admin profile reads "not tracked" rather than `0` |
+
+Flipping `ASK_USER_QUESTION_ENABLED` changes `toolConfig` and therefore re-writes the cacheable prefix once for each session in flight at the time — the ordinary cost of a deploy-time tool change, not a per-turn one.
+
+---
+
+## 🔧 CI/CD
+
+The PR gate got meaningfully faster, without giving up any coverage or type safety.
+
+- **Backend pytest runs in parallel.** `pytest -n auto` fans ~3k tests across all runner cores instead of running single-threaded. The suite is xdist-safe: moto mocks and hypothesis are per-worker, and no test mutates shared on-disk state. `-v` is dropped from `backend/pytest.ini`, which had produced thousands of `PASSED` lines with no diagnostic value. The nightly coverage run (`scripts/backend/test.sh`) stays serial on purpose.
+- **Infra jest is transpile-only.** `isolatedModules` stops each jest worker re-type-checking the whole project — the dominant cost of the infra suite, and the long pole once backend went parallel. Type safety is preserved by adding a single `tsc --noEmit` step to the infra CI job; previously only ts-jest enforced it on PRs, with `tsc` running only in `teardown.yml`. Workers stay at 2 — the `--maxWorkers` bump regressed 2.5×. There is no `const enum` in the tree, so `isolatedModules` is safe.
+
+---
+
+## 📦 Dependencies
+
+| Component | Package | From | To |
+|---|---|---|---|
+| Backend (dev) | `pytest-xdist` | — | 3.6.1 |
+
+---
+
+## 🧪 Test coverage
+
+**5,500+ lines of new tests**, including 17 new backend test modules and 9 new frontend specs:
+
+- **Clarifying questions** — the tool, the question models and the Other/Skip normalizer, the SSE events, an end-to-end interrupt/resume integration test, the system-prompt guidance (pinned byte-identical to what was measured), the SPA service, and refresh rehydration.
+- **Cost drill-down** — the content policy walked across every admin cost response model, a moto test that seeds content and proves none returns, the diagnosis rules, the drill-down routes, the session-profile and user-sessions services, top-users enrichment, and content-free projections; plus the trajectory chart, the conversations component and the profile util on the frontend.
+- **Tool census** — the hook, the stream-coordinator attach, persistence, and the session-manager rollups.
+- **Knowledge base** — 6 tests covering reservation release on delete across the paths that must not double-settle, and the born-managed mutation guards.
+- **Downloads** — the new route (owned / not-owned / legacy-key recovery), the download URL util, and the card renderer.
+- **Mention routing** — the client-side rule, matched against the server-side `agent_binding_policy` tests.
+- **Greetings** — 455 name/greeting combinations measured against real font advance widths.
+- **Supply chain** — the nightly ref allowlist.
+
+---
+
+## 🚀 Deployment notes
+
+**Deploy order:** `backend.yml` → `frontend-deploy.yml`. **Skip `platform.yml`** — there is no infrastructure change in this release.
+
+### Required: enable the Clarifying Questions tool, per environment
+
+The feature is otherwise invisible. `seed_bootstrap_data.py` **skips any tool row that already exists** (`Tool '…' already exists — skipped`), so the seed's `enabledByDefault: True` only takes effect on a fresh bootstrap.
+
+1. Check whether the environment's tool catalog already has an `ask_user_question` row.
+   - **It does** (any environment where the seed has run since this release's first PR): flip it on in the admin tool catalog. The seed will not do it for you.
+   - **It does not**: run `seed_bootstrap_data.py`, which creates it enabled.
+2. Confirm the grant. The tool ships `isPublic: False`. The `default` role carries `grantedTools: ["*"]` and so picks it up automatically; **any role with an explicit tool list needs `ask_user_question` added.** Per the RBAC rule in `CLAUDE.md`, the grant lives on the role record — listing the role on the tool grants nothing.
+3. Verify by sending a deliberately ambiguous request and confirming the picker renders.
+
+To opt an environment out entirely instead, set `ASK_USER_QUESTION_ENABLED=false`.
+
+### No backfill in this release
+
+No `backend/scripts/backfill_*.py` script was added, and the release guard confirms it. The cost-diagnostics counters are additive attributes on rows the turn already writes — sessions that predate them read "not tracked", by design, so there is nothing to populate retroactively.
+
+If v1.21.0's `backfill_tool_catalog_index.py` has **not** yet been run in an environment, it is still outstanding there. Nothing in this release changes it, but the tool catalog's sparse-index read still answers "nothing matched" rather than "something is wrong":
+
+```bash
+AWS_PROFILE=<env> backend/.venv/bin/python backend/scripts/backfill_tool_catalog_index.py \
+    --table <prefix>-app-roles --region us-west-2 --apply
+```
+
+Verify `skipped=0 failed=0`, then confirm with a live `query … --select COUNT` on the index — **not** `describe-table` `ItemCount`, which DynamoDB refreshes roughly every six hours and which therefore reports `0` right after a correct backfill.
+
+### Rollback
+
+Every new surface in this release is additive and read-tolerant. The two kill switches (`ASK_USER_QUESTION_ENABLED=false`, `COST_DIAGNOSTICS_ENABLED=false`) disable the clarifying-questions tool and the cost counters without a redeploy of the previous image. The `@`-mention binding change has no kill switch — it is a code path, and reverting it means reverting the release.
+
+---
+
 # Release Notes — v1.21.0
 
 **Release Date:** September 13, 2026
@@ -363,18 +614,43 @@ aws dynamodb describe-table --table-name <prefix>-app-roles \
 Populates `GSI5PK`/`GSI5SK` on tool rows written before the keys existed. **Dry-run by default; idempotent; guarded by `attribute_not_exists(GSI5PK)` and `attribute_exists(SK)`, so it never resurrects a deleted row and never overwrites one the writer has since stamped.** It touches only tool metadata rows — `CAPABILITIES` snapshots, skills, roles and user preferences are left alone.
 
 ```bash
-AWS_PROFILE=<env> python backend/scripts/backfill_tool_catalog_index.py \
+AWS_PROFILE=<env> backend/.venv/bin/python backend/scripts/backfill_tool_catalog_index.py \
     --table <prefix>-app-roles --region us-west-2
 ```
 
+> Use the backend venv's interpreter, not the system `python` — the script needs `boto3`
+> and a bare `python` fails with `ModuleNotFoundError: No module named 'boto3'`.
+> `uv run --project backend python …` works equally well.
+
 Then, once the dry run looks right:
 
 ```bash
-AWS_PROFILE=<env> python backend/scripts/backfill_tool_catalog_index.py \
+AWS_PROFILE=<env> backend/.venv/bin/python backend/scripts/backfill_tool_catalog_index.py \
     --table <prefix>-app-roles --region us-west-2 --apply
 ```
 
-**Verify `skipped=0 failed=0` and that the index item count matches the tool count before considering the deploy complete.** Run against dev first, then prod. If the backfill is skipped, the Query returns zero rows, the zero-result fallback re-reads via Scan and logs an ERROR naming this script — so the catalog still serves, but at Scan cost and with a standing error in the logs.
+**Verify `skipped=0 failed=0`, then confirm the index is populated with a live Query.** Run against dev first, then prod.
+
+```bash
+aws dynamodb query --table-name <prefix>-app-roles --index-name EntityTypeIndex \
+  --key-condition-expression "GSI5PK = :pk" \
+  --expression-attribute-values '{":pk":{"S":"ENTITY#TOOL"}}' --select COUNT
+```
+
+> ⚠️ **Do not verify with `describe-table` `ItemCount`.** DynamoDB refreshes table and index
+> item counts roughly every **six hours**, so immediately after a successful backfill it still
+> reads `0` and looks like a failure. A Query is the only live check.
+
+Pair it with a scan for rows the backfill missed — a **partial** backfill is the one case the
+read path's zero-result fallback deliberately does not cover, so it is silent:
+
+```bash
+aws dynamodb scan --table-name <prefix>-app-roles \
+  --filter-expression "begins_with(PK, :p) AND SK = :s AND attribute_not_exists(GSI5PK)" \
+  --expression-attribute-values '{":p":{"S":"TOOL#"},":s":{"S":"METADATA"}}' --select COUNT
+```
+
+That must return `Count: 0`. If the backfill is skipped, the Query returns zero rows, the zero-result fallback re-reads via Scan and logs an ERROR naming this script — so the catalog still serves, but at Scan cost and with a standing error in the logs.
 
 ### 4. Decide on the Conversation Mode regression
 
diff --git a/VERSION b/VERSION
index 3500250a4..57807d6d0 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.21.0
+1.22.0
diff --git a/backend/Dockerfile.scheduled-runs b/backend/Dockerfile.scheduled-runs
index d8b486ba9..10d99fa17 100644
--- a/backend/Dockerfile.scheduled-runs
+++ b/backend/Dockerfile.scheduled-runs
@@ -33,6 +33,9 @@ RUN pip install --no-cache-dir -r /tmp/requirements.txt
 # content-hash tag notices changes.
 COPY backend/src/apis/shared/__init__.py ${LAMBDA_TASK_ROOT}/apis/shared/__init__.py
 COPY backend/src/apis/shared/errors.py ${LAMBDA_TASK_ROOT}/apis/shared/errors.py
+# Leaf module (imports only os); reached via apis/shared/sessions/metadata.py,
+# which reads the COST_DIAGNOSTICS_ENABLED kill switch at aggregate-bump time.
+COPY backend/src/apis/shared/feature_flags.py ${LAMBDA_TASK_ROOT}/apis/shared/feature_flags.py
 COPY backend/src/apis/shared/harness/ ${LAMBDA_TASK_ROOT}/apis/shared/harness/
 COPY backend/src/apis/shared/scheduled_prompts/ ${LAMBDA_TASK_ROOT}/apis/shared/scheduled_prompts/
 COPY backend/src/apis/shared/sessions_bff/ ${LAMBDA_TASK_ROOT}/apis/shared/sessions_bff/
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index 7b838145c..2f96e6fb0 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentcore-stack"
-version = "1.21.0"
+version = "1.22.0"
 requires-python = ">=3.10"
 description = "Multi-agent conversational AI system with AWS Bedrock AgentCore"
 readme = "README.md"
@@ -85,6 +85,10 @@ dev = [
     "pytest==9.0.3",
     "pytest-asyncio==1.3.0",
     "pytest-cov==7.1.0",
+    # Parallelises the suite across CPU cores (CI runs `pytest -n auto`). The
+    # tests are xdist-safe: moto mocks and hypothesis are per-worker, and no
+    # test mutates shared on-disk state.
+    "pytest-xdist==3.6.1",
     "hypothesis==6.152.3",
     "moto[dynamodb,cognitoidp]==5.1.22",
     "black==26.3.1",
diff --git a/backend/pytest.ini b/backend/pytest.ini
index 1eeaee232..2ecf32809 100644
--- a/backend/pytest.ini
+++ b/backend/pytest.ini
@@ -5,7 +5,6 @@ python_files = test_*.py
 python_classes = Test*
 python_functions = test_*
 addopts = 
-    -v
     --tb=short
     --strict-markers
     --disable-warnings
diff --git a/backend/scripts/backfill_artifact_tool_merge.py b/backend/scripts/backfill_artifact_tool_merge.py
index f8d205463..0c5f57cfa 100644
--- a/backend/scripts/backfill_artifact_tool_merge.py
+++ b/backend/scripts/backfill_artifact_tool_merge.py
@@ -48,10 +48,10 @@
 
 Run against dev first, then prod::
 
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_artifact_tool_merge.py \\
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_artifact_tool_merge.py \\
         --table dev-boisestateai-v2-app-roles \\
         --assistants-table dev-boisestateai-v2-assistants          # dry-run
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_artifact_tool_merge.py \\
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_artifact_tool_merge.py \\
         --table dev-boisestateai-v2-app-roles \\
         --assistants-table dev-boisestateai-v2-assistants --apply
 """
diff --git a/backend/scripts/backfill_artifact_user_index_keys.py b/backend/scripts/backfill_artifact_user_index_keys.py
index 6f72950bf..63efe6f19 100644
--- a/backend/scripts/backfill_artifact_user_index_keys.py
+++ b/backend/scripts/backfill_artifact_user_index_keys.py
@@ -52,9 +52,9 @@
 
 Run against dev first, then prod::
 
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_artifact_user_index_keys.py \\
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_artifact_user_index_keys.py \\
         --table dev-boisestateai-v2-user-artifacts --region us-west-2
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_artifact_user_index_keys.py \\
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_artifact_user_index_keys.py \\
         --table dev-boisestateai-v2-user-artifacts --region us-west-2 --apply
 """
 
diff --git a/backend/scripts/backfill_false_interrupted_markers.py b/backend/scripts/backfill_false_interrupted_markers.py
index eebec127b..09ae2da07 100644
--- a/backend/scripts/backfill_false_interrupted_markers.py
+++ b/backend/scripts/backfill_false_interrupted_markers.py
@@ -42,10 +42,10 @@
 * Idempotent: a second run finds nothing left to do.
 
 USAGE
-    python scripts/backfill_false_interrupted_markers.py \
+    backend/.venv/bin/python backend/scripts/backfill_false_interrupted_markers.py \
         --table boisestateai-v2-sessions-metadata --profile prod-ai
     # …review the dry-run summary, then:
-    python scripts/backfill_false_interrupted_markers.py \
+    backend/.venv/bin/python backend/scripts/backfill_false_interrupted_markers.py \
         --table boisestateai-v2-sessions-metadata --profile prod-ai --apply
 """
 
diff --git a/backend/scripts/backfill_session_static_sk.py b/backend/scripts/backfill_session_static_sk.py
index 4d54b4d59..2ade9e16e 100644
--- a/backend/scripts/backfill_session_static_sk.py
+++ b/backend/scripts/backfill_session_static_sk.py
@@ -21,9 +21,9 @@
 
 Run against dev first, then prod::
 
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_session_static_sk.py \
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_session_static_sk.py \
         --table dev-boisestateai-v2-sessions-metadata            # dry-run
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_session_static_sk.py \
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_session_static_sk.py \
         --table dev-boisestateai-v2-sessions-metadata --apply --set-marker
 """
 
diff --git a/backend/scripts/backfill_skill_bundles.py b/backend/scripts/backfill_skill_bundles.py
index ce3e73e3e..ae01e1a20 100644
--- a/backend/scripts/backfill_skill_bundles.py
+++ b/backend/scripts/backfill_skill_bundles.py
@@ -31,10 +31,10 @@
 
 Run against dev first, then prod::
 
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_skill_bundles.py \\
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_skill_bundles.py \\
         --table dev-boisestateai-v2-app-roles \\
         --bucket dev-boisestateai-v2-skill-resources            # dry-run
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_skill_bundles.py \\
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_skill_bundles.py \\
         --table dev-boisestateai-v2-app-roles \\
         --bucket dev-boisestateai-v2-skill-resources --apply
 """
diff --git a/backend/scripts/backfill_tool_catalog_index.py b/backend/scripts/backfill_tool_catalog_index.py
index 6963c2d9c..e2842e09d 100644
--- a/backend/scripts/backfill_tool_catalog_index.py
+++ b/backend/scripts/backfill_tool_catalog_index.py
@@ -49,11 +49,16 @@
 * **Invents nothing.** Both key values derive from the row's own PK, so a
   stamped row is byte-identical to what the writer would have written.
 
-Run against dev first, then prod::
-
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_tool_catalog_index.py \\
+Run from the repo root, against dev first, then prod. The interpreter is the
+backend venv's, not the system ``python`` — this script needs ``boto3``, and a
+bare ``python`` fails with ``ModuleNotFoundError: No module named 'boto3'``
+(hit for real during the v1.21.0 prod run). Nothing here imports ``apis.*``, so
+the venv's interpreter is the only requirement; ``uv run --project backend
+python …`` works too::
+
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_tool_catalog_index.py \\
         --table dev-boisestateai-v2-app-roles --region us-west-2
-    AWS_PROFILE=dev-ai python backend/scripts/backfill_tool_catalog_index.py \\
+    AWS_PROFILE=dev-ai backend/.venv/bin/python backend/scripts/backfill_tool_catalog_index.py \\
         --table dev-boisestateai-v2-app-roles --region us-west-2 --apply
 """
 
diff --git a/backend/scripts/seed_bootstrap_data.py b/backend/scripts/seed_bootstrap_data.py
index c2f471ae0..d6a273926 100644
--- a/backend/scripts/seed_bootstrap_data.py
+++ b/backend/scripts/seed_bootstrap_data.py
@@ -402,6 +402,24 @@ def seed_default_models(
         "isPublic": False,
         "forwardAuthToken": False,
     },
+    {
+        "toolId": "ask_user_question",
+        "displayName": "Clarifying Questions",
+        "description": (
+            "Pause and ask the user multiple-choice questions when a request "
+            "is ambiguous, then continue with their answer."
+        ),
+        "category": "utility",
+        # On by default. The picker ships, survives a refresh, and the turn
+        # resumes into the same tool call; and the model only reaches for it on
+        # genuinely ambiguous requests — measured 24/24 on ambiguous prompts
+        # and 0/18 on clear ones, so it does not turn direct questions into
+        # interrogations. Its spec is ~630 tokens in the cacheable prefix.
+        "enabledByDefault": True,
+        "protocol": "local",
+        "isPublic": False,
+        "forwardAuthToken": False,
+    },
     {
         "toolId": "browse_web",
         "displayName": "Web Browser",
diff --git a/backend/src/agents/builtin_tools/ask_user_question.py b/backend/src/agents/builtin_tools/ask_user_question.py
new file mode 100644
index 000000000..9ce0e4fc0
--- /dev/null
+++ b/backend/src/agents/builtin_tools/ask_user_question.py
@@ -0,0 +1,234 @@
+"""Ask the user structured clarifying questions and wait for the answer.
+
+The agent calls this when a request is genuinely ambiguous and guessing would
+send the whole turn in the wrong direction. The tool pauses the turn on a
+Strands interrupt; the SPA renders a picker; the user's selections come back as
+this call's return value and the turn continues in place.
+
+Why a tool interrupt rather than a hook
+---------------------------------------
+``MCPExternalApprovalHook`` gates *someone else's* tool, so it has to interrupt
+from ``BeforeToolCallEvent``. Here the pause **is** the tool, so it raises its
+own interrupt through ``ToolContext`` (which implements ``_Interruptible``,
+``strands/types/tools.py``). Same machinery downstream — Strands routes both
+through ``_stop_for_interrupts``, so the paused-turn snapshot, the SSE
+extraction and the resume route need no special case for this flavor.
+
+Cost notes (CLAUDE.md token-effectiveness tenet)
+------------------------------------------------
+* The tool spec is a **constant** in ``toolConfig``. It is registered once at
+  startup, never injected per-turn, so it is part of the stable cacheable
+  prefix and never re-writes it. Do not make its presence conditional on
+  conversation state.
+* This is a **static** registry tool, not an ``extra_tools`` injection: it
+  captures no session/user identity, so it does not touch the injected-tool
+  agent-cache bypass.
+* The questions themselves ride the SSE channel, not the prompt. Only the
+  compact formatted answer block re-enters the conversation.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any, Dict, List
+
+from strands import tool
+from strands.types.tools import ToolContext
+
+from apis.shared.feature_flags import ask_user_question_enabled
+from apis.shared.user_questions.models import (
+    MAX_OPTIONS,
+    MAX_QUESTIONS,
+    MIN_OPTIONS,
+    UserQuestionError,
+    format_answers,
+    normalize_questions,
+    parse_answers,
+)
+
+logger = logging.getLogger(__name__)
+
+# Appended to the system prompt of any turn whose effective tool list contains
+# this tool. Measured, not guessed: with the app's real system prompt and a
+# production-shaped tool set, the model called this tool on 4/24 deliberately
+# ambiguous requests. With these sentences added it called it on 24/24, and
+# still on 0/18 unambiguous ones — the lift comes without turning clear
+# requests into interrogations.
+#
+# ⚠️ Do not reword without re-running the harness. The same *idea* placed in
+# this tool's own description measured no better than baseline (44-56% across
+# variants, against a baseline band of 17-44%), so the effect belongs to these
+# sentences in this position, not to the concept. Nor is it explained by the
+# story a model tells about itself: removing the system prompt's "Cost
+# Awareness" clause — the thing the model blamed when asked — moved the rate
+# far less than this does.
+SYSTEM_PROMPT_GUIDANCE = (
+    "When gathering structured input upfront would be more efficient than "
+    "presenting multiple scenarios and hoping the user clarifies, use the "
+    "ask_user_question tool. Prefer it over long prose when the user's answer "
+    "would let you skip 50%+ of your response."
+)
+
+# Interrupt name. Scoped by toolUseId upstream — `ToolContext._interrupt_id`
+# builds `v1:tool_call:{toolUseId}:{uuid5(name)}` — so two parallel calls in one
+# turn produce distinct interrupts the SPA can correlate per prompt.
+INTERRUPT_NAME = "ask_user_question"
+
+# Hand-written because Strands' generated schema drops `$defs` when it cleans
+# the Pydantic output (`_clean_pydantic_schema`), which would leave nested
+# models as dangling `$ref`s. Writing it out keeps the nesting intact and lets
+# the descriptions carry the usage guidance the model actually needs.
+_INPUT_SCHEMA: Dict[str, Any] = {
+    "json": {
+        "type": "object",
+        "properties": {
+            "questions": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": MAX_QUESTIONS,
+                "description": (
+                    f"One to {MAX_QUESTIONS} questions to ask at once. Ask "
+                    "everything you need in a single call — several calls in a "
+                    "row read as an interrogation."
+                ),
+                "items": {
+                    "type": "object",
+                    "properties": {
+                        "header": {
+                            "type": "string",
+                            "description": (
+                                "Very short label shown as a chip, max 12 "
+                                'characters. Examples: "Scope", "Format", '
+                                '"Audience".'
+                            ),
+                        },
+                        "question": {
+                            "type": "string",
+                            "description": (
+                                "The full question. Be specific and end with a "
+                                "question mark."
+                            ),
+                        },
+                        "multiSelect": {
+                            "type": "boolean",
+                            "description": (
+                                "True when the choices are not mutually "
+                                "exclusive and the user may pick several."
+                            ),
+                        },
+                        "options": {
+                            "type": "array",
+                            "minItems": MIN_OPTIONS,
+                            "maxItems": MAX_OPTIONS,
+                            "description": (
+                                f"{MIN_OPTIONS}-{MAX_OPTIONS} distinct choices. "
+                                "Do not add an 'Other' or 'Skip' choice — the "
+                                "interface always offers both."
+                            ),
+                            "items": {
+                                "type": "object",
+                                "properties": {
+                                    "label": {
+                                        "type": "string",
+                                        "description": "Concise choice text, 1-5 words.",
+                                    },
+                                    "description": {
+                                        "type": "string",
+                                        "description": (
+                                            "One line on what this choice means "
+                                            "or what happens if it is picked."
+                                        ),
+                                    },
+                                },
+                                "required": ["label"],
+                            },
+                        },
+                    },
+                    "required": ["header", "question", "options"],
+                },
+            }
+        },
+        "required": ["questions"],
+    }
+}
+
+
+def _error(text: str) -> Dict[str, Any]:
+    return {"content": [{"text": text}], "status": "error"}
+
+
+def _success(text: str) -> Dict[str, Any]:
+    return {"content": [{"text": text}], "status": "success"}
+
+
+@tool(inputSchema=_INPUT_SCHEMA, context=True)
+def ask_user_question(
+    questions: List[Dict[str, Any]], tool_context: ToolContext
+) -> Dict[str, Any]:
+    """Ask the user multiple-choice questions and wait for their answer.
+
+    Use this only when you are blocked on a decision that is genuinely the
+    user's to make — one you cannot resolve from the request, the conversation,
+    or a sensible default. Prefer picking the obvious option and saying so.
+
+    Good reasons to ask: the request has two plausible readings that lead to
+    materially different work; a choice depends on preference or context you
+    cannot see. Bad reasons: confirming something already stated, asking for
+    permission to continue, or offering a menu when one answer is clearly
+    right.
+
+    The interface adds an "Other" free-text field and a "Skip" control to every
+    question, so never include those as options — an "Other" you supply
+    yourself records no free text and tells you nothing. If the user skips,
+    proceed on your best judgement and say what you assumed.
+
+    Ask once. Put everything you need in this one call, then do the work with
+    what you get back. Do not call this tool again in the same turn to refine
+    an answer you just received: a second round reads as an interrogation, and
+    the user came here for the work, not the questionnaire.
+
+    Args:
+        questions: The questions to ask. Each needs a short `header`, the full
+            `question` text, and 2-4 `options` with a `label` and an optional
+            `description`. Set `multiSelect` when several answers may apply.
+
+    Returns:
+        The user's selections, one line per question.
+    """
+    if not ask_user_question_enabled():
+        return _error(
+            "Asking the user structured questions is disabled in this "
+            "environment. Ask your question in your reply instead."
+        )
+
+    try:
+        normalized = normalize_questions(questions)
+    except UserQuestionError as exc:
+        logger.info("ask_user_question rejected a malformed payload: %s", exc)
+        return _error(
+            f"{exc} Fix the arguments and call again, or just ask in your reply."
+        )
+
+    tool_use_id = (tool_context.tool_use or {}).get("toolUseId", "")
+    logger.info(
+        "Pausing for user questions: count=%d tool_use_id=%s",
+        len(normalized),
+        tool_use_id,
+    )
+
+    # Raises InterruptException on the first pass; returns the client's payload
+    # when the turn resumes. Strands only treats a **non-None** response as an
+    # answer, so the SPA must always post something — "Skip" sends
+    # `{"skipped": true}`, never null, or the interrupt would re-raise forever.
+    response = tool_context.interrupt(
+        name=INTERRUPT_NAME,
+        reason={
+            "type": "user_question_required",
+            "toolUseId": tool_use_id,
+            "questions": [
+                q.model_dump(by_alias=True, exclude_none=True) for q in normalized
+            ],
+        },
+    )
+
+    return _success(format_answers(parse_answers(normalized, response)))
diff --git a/backend/src/agents/builtin_tools/excel_spreadsheet_tool.py b/backend/src/agents/builtin_tools/excel_spreadsheet_tool.py
index 77f8e416f..a7c5cd5e5 100644
--- a/backend/src/agents/builtin_tools/excel_spreadsheet_tool.py
+++ b/backend/src/agents/builtin_tools/excel_spreadsheet_tool.py
@@ -328,14 +328,14 @@ async def create_excel_spreadsheet(
             return _error(f"❌ Failed to create '{filename}': {exc}")
 
         try:
-            _id, download_url, size_kb = await _store_document(
+            upload_id, size_kb = await _store_document(
                 user_id, session_id, filename, file_bytes, _XLSX_MIME
             )
         except Exception as exc:  # noqa: BLE001 - storage failure is terminal
             logger.error(f"create_excel_spreadsheet storage error: {exc}")
             return _error(f"❌ Created '{filename}' but failed to save it: {exc}")
 
-        return _download_card(filename, download_url, size_kb, "Created")
+        return _download_card(filename, upload_id, size_kb, "Created")
 
     return create_excel_spreadsheet
 
@@ -424,7 +424,7 @@ async def modify_excel_spreadsheet(
             return _error(f"❌ Failed to modify '{source.filename}': {exc}")
 
         try:
-            _id, download_url, size_kb = await _store_document(
+            upload_id, size_kb = await _store_document(
                 user_id, session_id, output_filename, file_bytes, _XLSX_MIME
             )
         except Exception as exc:  # noqa: BLE001 - storage failure is terminal
@@ -433,7 +433,7 @@ async def modify_excel_spreadsheet(
                 f"❌ Modified '{source.filename}' but failed to save it: {exc}"
             )
 
-        return _download_card(output_filename, download_url, size_kb, "Updated")
+        return _download_card(output_filename, upload_id, size_kb, "Updated")
 
     return modify_excel_spreadsheet
 
diff --git a/backend/src/agents/builtin_tools/office/_storage.py b/backend/src/agents/builtin_tools/office/_storage.py
index 87c6b85f8..306a7c209 100644
--- a/backend/src/agents/builtin_tools/office/_storage.py
+++ b/backend/src/agents/builtin_tools/office/_storage.py
@@ -5,7 +5,7 @@
 persist it to the existing user-files store (``apis.shared.files``): the file
 lands in ``S3_USER_FILES_BUCKET_NAME`` with a ``FileMetadata`` row (status
 READY) in ``DYNAMODB_USER_FILES_TABLE_NAME``, so it appears in the chat's Files
-panel and is downloadable via the app-api ``/files/{id}/preview-url`` route.
+panel and is downloadable via the app-api ``/files/{id}/download`` route.
 
 The two toolsets differ only in the document format (``.docx`` vs ``.xlsx``)
 and the library used inside the sandbox (python-docx vs openpyxl); everything
@@ -44,9 +44,6 @@
 
 logger = logging.getLogger(__name__)
 
-# Presigned download links are short-lived; long enough for the user to click.
-_DOWNLOAD_URL_TTL = 60 * 60  # 1 hour
-
 
 class _DocGenError(Exception):
     """Raised when Code Interpreter fails to run the document code."""
@@ -277,11 +274,20 @@ async def _store_document(
     filename: str,
     file_bytes: bytes,
     mime_type: str,
-) -> Tuple[str, str, str]:
-    """Persist a generated file to the user-files store and mint a download URL.
-
-    Returns ``(upload_id, download_url, size_kb)``. ``mime_type`` is stored on
-    the ``FileMetadata`` row and used for the download ``Content-Type``.
+) -> Tuple[str, str]:
+    """Persist a generated file to the user-files store.
+
+    Returns ``(upload_id, size_kb)``. ``mime_type`` is stored on the
+    ``FileMetadata`` row and used for the download ``Content-Type``.
+
+    Deliberately does NOT mint a presigned URL. The tool result is the model's
+    context as well as the UI's payload, and a presigned S3 URL there was a
+    double defect: ~1,400 characters of signature sitting in the cacheable
+    prefix for the life of the session, and a URL the model would re-emit in
+    prose — truncated at the ``?``, so the link it wrote 404'd with S3
+    AccessDenied while the card's own button worked. The card now carries the
+    ``upload_id`` and the SPA resolves it through
+    ``GET /api/files/{uploadId}/download``, which mints a fresh URL per click.
     """
     from apis.shared.files import (
         FileMetadata,
@@ -317,23 +323,11 @@ async def _store_document(
     )
     await get_file_upload_repository().create_file(metadata)
 
-    download_url = await asyncio.to_thread(
-        _s3().generate_presigned_url,
-        "get_object",
-        Params={
-            "Bucket": bucket,
-            "Key": s3_key,
-            "ResponseContentType": mime_type,
-            "ResponseContentDisposition": f'attachment; filename="{filename}"',
-        },
-        ExpiresIn=_DOWNLOAD_URL_TTL,
-    )
-
     size_kb = f"{len(file_bytes) / 1024:.1f} KB"
-    return upload_id, download_url, size_kb
+    return upload_id, size_kb
 
 
-def _download_card(filename: str, download_url: str, size_kb: str, verb: str) -> str:
+def _download_card(filename: str, upload_id: str, size_kb: str, verb: str) -> str:
     """Build the promoted inline-download-card tool result (JSON string).
 
     The ``ui_type``/``ui_display: inline`` discriminators make the frontend
@@ -341,6 +335,12 @@ def _download_card(filename: str, download_url: str, size_kb: str, verb: str) ->
     ``file_download``) instead of burying the link in the collapsed tool card.
     The renderer picks its icon from the filename extension, so a single
     ``file_download`` ui_type serves Word, Excel, and any future office file.
+
+    ``upload_id`` — not a URL — is what the payload carries; the SPA composes
+    ``{appApiUrl}/files/{uploadId}/download`` from it. The summary tells the
+    model the card is already on screen, because the model reads this same
+    JSON and will otherwise helpfully write its own download link out of
+    whatever URL-shaped text it finds here.
     """
     return json.dumps(
         {
@@ -349,11 +349,14 @@ def _download_card(filename: str, download_url: str, size_kb: str, verb: str) ->
             "ui_display": "inline",
             "payload": {
                 "filename": filename,
-                "download_url": download_url,
+                "upload_id": upload_id,
                 "size_kb": size_kb,
             },
             "summary": (
-                f"{verb} {filename} ({size_kb}). Also saved to this chat's Files."
+                f"{verb} {filename} ({size_kb}). Also saved to this chat's Files. "
+                "A download card with a working Download button is already "
+                "displayed to the user — do not write a download link or URL "
+                "for this file in your reply."
             ),
         }
     )
diff --git a/backend/src/agents/builtin_tools/powerpoint_presentation_tool.py b/backend/src/agents/builtin_tools/powerpoint_presentation_tool.py
index b64d988e3..3dedddadc 100644
--- a/backend/src/agents/builtin_tools/powerpoint_presentation_tool.py
+++ b/backend/src/agents/builtin_tools/powerpoint_presentation_tool.py
@@ -477,14 +477,14 @@ async def create_powerpoint_presentation(
             return _error(f"❌ Failed to create '{filename}': {exc}")
 
         try:
-            _id, download_url, size_kb = await _store_document(
+            upload_id, size_kb = await _store_document(
                 user_id, session_id, filename, file_bytes, _PPTX_MIME
             )
         except Exception as exc:  # noqa: BLE001 - storage failure is terminal
             logger.error(f"create_powerpoint_presentation storage error: {exc}")
             return _error(f"❌ Created '{filename}' but failed to save it: {exc}")
 
-        return _download_card(filename, download_url, size_kb, "Created")
+        return _download_card(filename, upload_id, size_kb, "Created")
 
     return create_powerpoint_presentation
 
@@ -578,7 +578,7 @@ async def modify_powerpoint_presentation(
             return _error(f"❌ Failed to modify '{source.filename}': {exc}")
 
         try:
-            _id, download_url, size_kb = await _store_document(
+            upload_id, size_kb = await _store_document(
                 user_id, session_id, output_filename, file_bytes, _PPTX_MIME
             )
         except Exception as exc:  # noqa: BLE001 - storage failure is terminal
@@ -587,7 +587,7 @@ async def modify_powerpoint_presentation(
                 f"❌ Modified '{source.filename}' but failed to save it: {exc}"
             )
 
-        return _download_card(output_filename, download_url, size_kb, "Updated")
+        return _download_card(output_filename, upload_id, size_kb, "Updated")
 
     return modify_powerpoint_presentation
 
diff --git a/backend/src/agents/builtin_tools/word_document_tool.py b/backend/src/agents/builtin_tools/word_document_tool.py
index fc6d7ba49..3c2e45b56 100644
--- a/backend/src/agents/builtin_tools/word_document_tool.py
+++ b/backend/src/agents/builtin_tools/word_document_tool.py
@@ -314,14 +314,14 @@ async def create_word_document(
             return _error(f"❌ Failed to create '{filename}': {exc}")
 
         try:
-            _id, download_url, size_kb = await _store_document(
+            upload_id, size_kb = await _store_document(
                 user_id, session_id, filename, file_bytes, _DOCX_MIME
             )
         except Exception as exc:  # noqa: BLE001 - storage failure is terminal
             logger.error(f"create_word_document storage error: {exc}")
             return _error(f"❌ Created '{filename}' but failed to save it: {exc}")
 
-        return _download_card(filename, download_url, size_kb, "Created")
+        return _download_card(filename, upload_id, size_kb, "Created")
 
     return create_word_document
 
@@ -405,7 +405,7 @@ async def modify_word_document(
             return _error(f"❌ Failed to modify '{source.filename}': {exc}")
 
         try:
-            _id, download_url, size_kb = await _store_document(
+            upload_id, size_kb = await _store_document(
                 user_id, session_id, output_filename, file_bytes, _DOCX_MIME
             )
         except Exception as exc:  # noqa: BLE001 - storage failure is terminal
@@ -414,7 +414,7 @@ async def modify_word_document(
                 f"❌ Modified '{source.filename}' but failed to save it: {exc}"
             )
 
-        return _download_card(output_filename, download_url, size_kb, "Updated")
+        return _download_card(output_filename, upload_id, size_kb, "Updated")
 
     return modify_word_document
 
diff --git a/backend/src/agents/builtin_tools/workspace_tools.py b/backend/src/agents/builtin_tools/workspace_tools.py
index 1b15e8e54..0b99520a1 100644
--- a/backend/src/agents/builtin_tools/workspace_tools.py
+++ b/backend/src/agents/builtin_tools/workspace_tools.py
@@ -177,12 +177,15 @@ async def workspace_write(
                 "ui_display": "inline",
                 "payload": {
                     "filename": result["filename"],
-                    "download_url": result["download_url"],
+                    "upload_id": result["upload_id"],
                     "size_kb": result["size_kb"],
                 },
                 "summary": (
                     f"Saved {result['filename']} ({result['size_kb']}). "
-                    "Also saved to this chat's Files."
+                    "Also saved to this chat's Files. A download card with a "
+                    "working Download button is already displayed to the user "
+                    "— do not write a download link or URL for this file in "
+                    "your reply."
                 ),
             }
         )
diff --git a/backend/src/agents/main_agent/base_agent.py b/backend/src/agents/main_agent/base_agent.py
index 79043d3fe..281d45c27 100644
--- a/backend/src/agents/main_agent/base_agent.py
+++ b/backend/src/agents/main_agent/base_agent.py
@@ -14,6 +14,7 @@
 from agents.main_agent.session import SessionFactory
 from agents.main_agent.session.hooks import (
     AgentStatusHook,
+    ToolCensusHook,
     DisplayTextHook,
     SteeringHook,
     StopHook,
@@ -340,6 +341,15 @@ def _create_hooks(self) -> List:
         self.agent_status_hook = AgentStatusHook()
         hooks.append(self.agent_status_hook)
 
+        # Content-free tool census (tool name → calls/errors per model call).
+        # Held on the wrapper so the stream coordinator can read each call's
+        # tally at turn end and persist it on that call's cost row for the
+        # admin session profile. Non-drained, per-turn only. Registered
+        # unconditionally; the callbacks return immediately when
+        # COST_DIAGNOSTICS_ENABLED=false.
+        self.tool_census_hook = ToolCensusHook()
+        hooks.append(self.tool_census_hook)
+
         # Per-model-call prompt-cache prefix fingerprints (toolConfig /
         # system prompt / history hashes). Best-effort; the stream
         # coordinator persists them on each call's metadata row so avoidable
diff --git a/backend/src/agents/main_agent/chat_agent.py b/backend/src/agents/main_agent/chat_agent.py
index efeaaaf8c..2e72e608f 100644
--- a/backend/src/agents/main_agent/chat_agent.py
+++ b/backend/src/agents/main_agent/chat_agent.py
@@ -68,7 +68,7 @@ def _create_agent(self) -> None:
 
             self.agent = AgentFactory.create_agent(
                 model_config=self.model_config,
-                system_prompt=self.system_prompt,
+                system_prompt=self._system_prompt_for(tools),
                 tools=tools,
                 session_manager=self.session_manager,
                 hooks=hooks,
@@ -79,6 +79,45 @@ def _create_agent(self) -> None:
             logger.error(f"Error creating agent: {e}")
             raise
 
+    def _system_prompt_for(self, tools: List[Any]) -> str:
+        """The system prompt this turn actually sends.
+
+        Adds ``ask_user_question``'s guidance when that tool is in the turn's
+        effective tool list. Without it the model overwhelmingly answers an
+        ambiguous request in prose instead of asking (measured 4/24 vs 24/24);
+        see ``SYSTEM_PROMPT_GUIDANCE`` for why the text is load-bearing.
+
+        Three deliberate choices:
+
+        * **Gated on the tool, not shipped to everyone.** A user without the
+          tool would otherwise carry an instruction to call something they do
+          not have.
+        * **Keyed on the POST-FILTER list**, not the request's
+          ``enabled_tools``. The two diverge — a tool id the catalog knows but
+          the registry does not is dropped by ``ToolFilter`` with a log line
+          (``canvas_faculty`` does this today) — and keying on the request
+          would advertise a tool absent from ``toolConfig``. It also picks up
+          the ``ASK_USER_QUESTION_ENABLED`` kill switch for free: while off the
+          tool is never registered, so it cannot appear here.
+        * **Applied to the prompt handed to the agent, not to
+          ``self.system_prompt``.** That field is snapshotted for resume and
+          hashed into the agent cache key; this text is derived from
+          ``enabled_tools``, which the cache key already covers via
+          ``tools_hash``, so mutating it would change resume's cache slot for
+          no benefit. ``PrefixFingerprintHook`` reads the prompt off the built
+          agent, so ``systemPromptHash`` still reflects what was really sent.
+
+        Cost: ~70 tokens, constant per configuration, inside the cacheable
+        prefix — it is written once per session, never re-written per turn.
+        """
+        from agents.builtin_tools.ask_user_question import SYSTEM_PROMPT_GUIDANCE
+
+        for tool in tools:
+            spec = getattr(tool, "tool_spec", None)
+            if isinstance(spec, dict) and spec.get("name") == "ask_user_question":
+                return f"{self.system_prompt}\n\n{SYSTEM_PROMPT_GUIDANCE}"
+        return self.system_prompt
+
     async def stream_async(
         self,
         message: str,
diff --git a/backend/src/agents/main_agent/session/hooks/__init__.py b/backend/src/agents/main_agent/session/hooks/__init__.py
index 88efadd8e..1080adc59 100644
--- a/backend/src/agents/main_agent/session/hooks/__init__.py
+++ b/backend/src/agents/main_agent/session/hooks/__init__.py
@@ -8,6 +8,7 @@
 from agents.main_agent.session.hooks.steering import SteeringHook
 from agents.main_agent.session.hooks.stop import StopHook
 from agents.main_agent.session.hooks.tool_approval import MCPExternalApprovalHook
+from agents.main_agent.session.hooks.tool_census import ToolCensusHook
 
 __all__ = [
     "AgentStatusHook",
@@ -18,4 +19,5 @@
     "SteeringHook",
     "StopHook",
     "MCPExternalApprovalHook",
+    "ToolCensusHook",
 ]
diff --git a/backend/src/agents/main_agent/session/hooks/tool_census.py b/backend/src/agents/main_agent/session/hooks/tool_census.py
new file mode 100644
index 000000000..a60d87211
--- /dev/null
+++ b/backend/src/agents/main_agent/session/hooks/tool_census.py
@@ -0,0 +1,127 @@
+"""Hook that tallies tool calls per model call, for the content-free cost profile.
+
+The admin cost console can say what a conversation *cost* down to the model
+call, but until now nothing recorded what the user was *doing* in it — which
+tools ran, how often, how often they failed. That signal lives only inside
+message content, which the console must never read. This hook counts it out
+of band: tool name → ``{calls, errors}``, attributed to the model call whose
+output requested the tools, and the stream coordinator writes the tally onto
+that call's ``C#`` cost row as ``toolCalls`` (the same way ``turnAgentId``
+and ``prefixFingerprints`` ride that row).
+
+Tool names are catalog ids and MCP tool names — structural, not content.
+Nothing here reads a tool's input or result beyond ``status``.
+
+Attribution uses the same cycle counter ``AgentStatusHook`` uses: ``cycle``
+increments on every ``BeforeModelCallEvent``, and a tool that runs during
+cycle *N* was requested by model call *N* — the coordinator's ``call_index``
+``N-1`` (0-based). ``tally_for_call`` does that translation so the caller
+does not have to.
+
+Deliberately **non-drained** (unlike ``AgentStatusHook``, whose lists the
+coordinator empties mid-turn): the tally is read once at turn end, per call,
+and reset at the next turn's ``BeforeInvocationEvent``. Per-turn state only —
+never anything a later turn could inherit (CLAUDE.md: never cache session
+state on an agent instance).
+
+Costs nothing against the model: it runs on hook events the loop already
+crosses and writes to an in-process dict. Gated by
+``COST_DIAGNOSTICS_ENABLED`` (default on, ``=false`` kill switch); while off
+every callback returns immediately and ``tally_for_call`` is always ``None``,
+so the row simply has no ``toolCalls`` and the profile reads "not tracked".
+"""
+
+from __future__ import annotations
+
+import copy
+import logging
+from typing import Any, Dict, Optional
+
+from strands.hooks import (
+    AfterToolCallEvent,
+    BeforeInvocationEvent,
+    BeforeModelCallEvent,
+    HookProvider,
+    HookRegistry,
+)
+
+from apis.shared.feature_flags import cost_diagnostics_enabled
+
+logger = logging.getLogger(__name__)
+
+#: Upper bound on distinct tool names tallied per model call. A single call
+#: that requests more than this many *distinct* tools is not a shape the
+#: platform produces; the cap only guards the row size.
+_MAX_TOOLS_PER_CALL = 64
+
+
+def _tool_name(event: Any) -> Optional[str]:
+    tool_use = getattr(event, "tool_use", None) or {}
+    if not isinstance(tool_use, dict):
+        return None
+    name = tool_use.get("name")
+    return str(name) if name else None
+
+
+def _call_failed(event: Any) -> bool:
+    """A raised exception OR a result reporting ``status == "error"`` —
+    the same definition ``AgentStatusHook`` uses for ``ok=False``."""
+    if getattr(event, "exception", None) is not None:
+        return True
+    result = getattr(event, "result", None)
+    return isinstance(result, dict) and result.get("status") == "error"
+
+
+class ToolCensusHook(HookProvider):
+    """Per-turn, per-model-call tool tally: ``{cycle: {tool: {calls, errors}}}``."""
+
+    def __init__(self) -> None:
+        self._cycle = 0
+        self._tally: Dict[int, Dict[str, Dict[str, int]]] = {}
+
+    def register_hooks(self, registry: HookRegistry, **kwargs: Any) -> None:
+        registry.add_callback(BeforeInvocationEvent, self._on_turn_start)
+        registry.add_callback(BeforeModelCallEvent, self._on_before_model_call)
+        registry.add_callback(AfterToolCallEvent, self._on_after_tool_call)
+
+    # -- reads (called by the stream coordinator at turn end) ---------------
+
+    def tally_for_call(self, call_index: int) -> Optional[Dict[str, Dict[str, int]]]:
+        """The tools requested by model call ``call_index`` (0-based), or
+        ``None`` when that call requested none — or the census is off.
+
+        Returns a copy so the caller can hand it to the persistence layer
+        without aliasing per-turn state.
+        """
+        if not cost_diagnostics_enabled():
+            return None
+        entry = self._tally.get(call_index + 1)
+        return copy.deepcopy(entry) if entry else None
+
+    # -- callbacks ----------------------------------------------------------
+
+    def _on_turn_start(self, event: BeforeInvocationEvent) -> None:
+        self._cycle = 0
+        self._tally = {}
+
+    def _on_before_model_call(self, event: BeforeModelCallEvent) -> None:
+        self._cycle += 1
+
+    def _on_after_tool_call(self, event: AfterToolCallEvent) -> None:
+        if not cost_diagnostics_enabled():
+            return
+        try:
+            name = _tool_name(event)
+            if not name:
+                return
+            per_call = self._tally.setdefault(self._cycle, {})
+            slot = per_call.get(name)
+            if slot is None:
+                if len(per_call) >= _MAX_TOOLS_PER_CALL:
+                    return
+                slot = per_call[name] = {"calls": 0, "errors": 0}
+            slot["calls"] += 1
+            if _call_failed(event):
+                slot["errors"] += 1
+        except Exception as e:  # noqa: BLE001 - a census must never break a turn
+            logger.debug("Tool census skipped a call: %s", e)
diff --git a/backend/src/agents/main_agent/session/turn_based_session_manager.py b/backend/src/agents/main_agent/session/turn_based_session_manager.py
index 025e598fb..b889a0630 100644
--- a/backend/src/agents/main_agent/session/turn_based_session_manager.py
+++ b/backend/src/agents/main_agent/session/turn_based_session_manager.py
@@ -564,8 +564,17 @@ def _adopt_persisted_compaction_state(self) -> None:
         )
         self.compaction_state = persisted
 
-    def _save_compaction_state(self, state: CompactionState) -> None:
-        """Save compaction state to DynamoDB session metadata."""
+    def _save_compaction_state(self, state: CompactionState, record_event: bool = False) -> None:
+        """Save compaction state to DynamoDB session metadata.
+
+        ``record_event=True`` means this save *is* a compaction (a new
+        checkpoint was cut), and bumps the session's ``compactionCount`` in
+        the same update. That counter is what the admin profile reads for
+        "how many times did compaction fire" — the persisted ``compaction``
+        map is last-write-wins and cannot answer it. A top-level ``ADD`` is
+        monotonic and race-free: two Agents serving one session can each
+        increment, and neither can move it backwards.
+        """
         if not self.user_id or not self.compaction_config or not self.compaction_config.enabled:
             return
 
@@ -585,10 +594,18 @@ def _save_compaction_state(self, state: CompactionState) -> None:
                 return
 
             state.updated_at = datetime.now(timezone.utc).isoformat()
+            update_expression = "SET compaction = :state"
+            values: Dict[str, Any] = {":state": state.to_dict()}
+            if record_event:
+                from apis.shared.feature_flags import cost_diagnostics_enabled
+
+                if cost_diagnostics_enabled():
+                    update_expression += " ADD compactionCount :one"
+                    values[":one"] = 1
             table.update_item(
                 Key={"PK": pk, "SK": sk},
-                UpdateExpression="SET compaction = :state",
-                ExpressionAttributeValues={":state": state.to_dict()},
+                UpdateExpression=update_expression,
+                ExpressionAttributeValues=values,
             )
             logger.debug(f"Saved compaction state: checkpoint={state.checkpoint}")
         except Exception as e:
@@ -812,7 +829,8 @@ async def update_after_turn(
         # Running total persisted alongside the rest of the compaction state
         # so a refresh can rehydrate the end-of-conversation summary indicator.
         self.compaction_state.total_summarized_turns += summarized_turns
-        self._save_compaction_state(self.compaction_state)
+        # This save is the compaction event itself — count it.
+        self._save_compaction_state(self.compaction_state, record_event=True)
 
         logger.info(
             f"Compaction checkpoint set: {new_checkpoint}, "
diff --git a/backend/src/agents/main_agent/streaming/stream_coordinator.py b/backend/src/agents/main_agent/streaming/stream_coordinator.py
index 0ffd89b3b..477b9707d 100644
--- a/backend/src/agents/main_agent/streaming/stream_coordinator.py
+++ b/backend/src/agents/main_agent/streaming/stream_coordinator.py
@@ -619,6 +619,12 @@ async def stream_response(
                         user_id=user_id,
                     ):
                         yield sse
+                    for sse in await self._extract_user_question_required_events(
+                        agent,
+                        session_id=session_id,
+                        user_id=user_id,
+                    ):
+                        yield sse
                     for sse in self._extract_preflight_consent_events(user_id):
                         yield sse
 
@@ -1171,6 +1177,11 @@ async def stream_response(
             message_ids_to_store = assistant_message_ids if assistant_message_ids else ([message_id] if message_id is not None else [])
 
             if message_ids_to_store:
+                # Content-free tool census, read (not drained) per call so each
+                # cost row carries the tools that call requested. None when the
+                # wrapper has no hook (tests, older agents) or the census is off.
+                tool_census_hook = getattr(main_agent_wrapper, "tool_census_hook", None)
+
                 # Build list of metadata storage tasks for parallel execution
                 metadata_tasks = []
                 for idx, msg_id in enumerate(message_ids_to_store):
@@ -1222,6 +1233,10 @@ async def stream_response(
                             citations=citations_for_message,  # Pass citations for persistence
                             call_index=idx,  # Nth model call of this turn (prefix fingerprint lookup)
                             turn_agent_id=turn_agent_id,  # Which Agent ran this turn (#756)
+                            tool_calls=(
+                                tool_census_hook.tally_for_call(idx)
+                                if tool_census_hook is not None else None
+                            ),
                         )
                     )
 
@@ -1920,6 +1935,96 @@ async def _extract_tool_approval_required_events(
             )
         return events
 
+    async def _extract_user_question_required_events(
+        self,
+        agent: Any,
+        session_id: Optional[str] = None,
+        user_id: Optional[str] = None,
+    ) -> List[str]:
+        """Yield one SSE-formatted `user_question_required` event per pending
+        ``ask_user_question`` interrupt, persisting each one so the picker
+        rehydrates after a refresh.
+
+        Structurally identical to
+        :meth:`_extract_tool_approval_required_events` — the difference is only
+        where the interrupt came from. That one is raised by a hook before
+        someone else's tool; this one is raised by the ``ask_user_question``
+        tool itself through ``ToolContext``. Strands routes both through
+        ``_stop_for_interrupts``, so by the time we read
+        ``agent._interrupt_state`` the two are indistinguishable and the
+        ``PausedTurnSnapshot`` written on this same ``done`` event covers both.
+
+        Persistence is best-effort: a DynamoDB write failure logs but does not
+        break the live SSE flow — the user still sees the prompt, they just
+        lose it on a refresh.
+        """
+        from apis.shared.sessions.metadata import add_pending_interrupt
+        from apis.shared.sessions.models import PendingInterrupt
+        from apis.shared.user_questions.models import (
+            UserQuestion,
+            UserQuestionRequiredEvent,
+            encode_questions,
+        )
+
+        interrupt_state = getattr(agent, "_interrupt_state", None)
+        if not interrupt_state or not getattr(interrupt_state, "activated", False):
+            return []
+
+        events: List[str] = []
+        for interrupt in interrupt_state.interrupts.values():
+            reason = interrupt.reason or {}
+            if not isinstance(reason, dict) or reason.get("type") != "user_question_required":
+                continue
+
+            raw_questions = reason.get("questions") or []
+            try:
+                questions = [UserQuestion.model_validate(q) for q in raw_questions]
+            except Exception as e:  # noqa: BLE001 - never break the stream
+                logger.warning(
+                    "User-question interrupt carries unrenderable questions "
+                    "(id=%s): %s",
+                    interrupt.id, e,
+                )
+                continue
+            if not questions:
+                logger.warning(
+                    "User-question interrupt has no questions: id=%s", interrupt.id
+                )
+                continue
+
+            tool_use_id = reason.get("toolUseId", "")
+
+            # Persist the breadcrumb before yielding so a client that refreshes
+            # mid-prompt can rehydrate the picker.
+            if session_id and user_id:
+                try:
+                    await add_pending_interrupt(
+                        session_id=session_id,
+                        user_id=user_id,
+                        interrupt=PendingInterrupt(
+                            interrupt_id=interrupt.id,
+                            kind="user_question",
+                            tool_use_id=tool_use_id,
+                            tool_name="ask_user_question",
+                            questions=encode_questions(questions),
+                            created_at=datetime.now(timezone.utc).isoformat(),
+                        ),
+                    )
+                except Exception as e:
+                    logger.error(
+                        "Failed to persist user_question pending_interrupt %s: %s",
+                        interrupt.id, e, exc_info=True,
+                    )
+
+            events.append(
+                UserQuestionRequiredEvent(
+                    interrupt_id=interrupt.id,
+                    tool_use_id=tool_use_id,
+                    questions=questions,
+                ).to_sse_format()
+            )
+        return events
+
     async def _extract_artifact_events(
         self,
         session_id: Optional[str],
@@ -2711,6 +2816,7 @@ async def _store_message_metadata(
         citations: Optional[List] = None,
         call_index: Optional[int] = None,
         turn_agent_id: Optional[str] = None,
+        tool_calls: Optional[Dict[str, Dict[str, int]]] = None,
     ) -> None:
         """
         Store message-level metadata (token usage, latency, model info, citations)
@@ -2882,6 +2988,14 @@ async def _store_message_metadata(
                 if turn_agent_id:
                     metadata_kwargs["turnAgentId"] = turn_agent_id
 
+                # Content-free tool census for this call (tool name → calls /
+                # errors), another extra field. Read by the admin session
+                # profile to show what the user was doing; tool names are
+                # catalog ids, never content. Absent when the call requested
+                # no tools or COST_DIAGNOSTICS_ENABLED=false.
+                if tool_calls:
+                    metadata_kwargs["toolCalls"] = tool_calls
+
                 message_metadata = MessageMetadata(**metadata_kwargs)
 
                 # Store metadata
diff --git a/backend/src/agents/main_agent/tools/tool_catalog.py b/backend/src/agents/main_agent/tools/tool_catalog.py
index a7ab56174..639f230b2 100644
--- a/backend/src/agents/main_agent/tools/tool_catalog.py
+++ b/backend/src/agents/main_agent/tools/tool_catalog.py
@@ -74,6 +74,13 @@ def to_dict(self) -> dict:
         category=ToolCategory.UTILITIES,
         icon="calculator",
     ),
+    "ask_user_question": ToolMetadata(
+        tool_id="ask_user_question",
+        name="Clarifying Questions",
+        description="Pause and ask the user multiple-choice questions when a request is ambiguous, then continue with their answer.",
+        category=ToolCategory.UTILITIES,
+        icon="question-mark-circle",
+    ),
 
     # --- Built-in Tools (Browser) ---
     "browse_web": ToolMetadata(
diff --git a/backend/src/agents/main_agent/tools/tool_registry.py b/backend/src/agents/main_agent/tools/tool_registry.py
index 5d5756957..972cd7e9d 100644
--- a/backend/src/agents/main_agent/tools/tool_registry.py
+++ b/backend/src/agents/main_agent/tools/tool_registry.py
@@ -92,6 +92,8 @@ def create_default_registry() -> ToolRegistry:
     """
     from strands_tools.calculator import calculator
     from agents import local_tools, builtin_tools
+    from agents.builtin_tools.ask_user_question import ask_user_question
+    from apis.shared.feature_flags import ask_user_question_enabled
 
     registry = ToolRegistry()
 
@@ -104,5 +106,12 @@ def create_default_registry() -> ToolRegistry:
     # Register builtin tools (AWS SDK tools)
     registry.register_module_tools(builtin_tools)
 
+    # Registered explicitly rather than via `builtin_tools.__all__` so the kill
+    # switch can withhold it: an unregistered tool never reaches `toolConfig`,
+    # so with the flag off the model cannot pause a turn behind a prompt the
+    # client has no renderer for.
+    if ask_user_question_enabled():
+        registry.register_tool("ask_user_question", ask_user_question)
+
     logger.info(f"Default registry created with {registry.get_tool_count()} tools")
     return registry
diff --git a/backend/src/apis/app_api/admin/costs/diagnoses.py b/backend/src/apis/app_api/admin/costs/diagnoses.py
new file mode 100644
index 000000000..61d92aa21
--- /dev/null
+++ b/backend/src/apis/app_api/admin/costs/diagnoses.py
@@ -0,0 +1,529 @@
+"""Diagnosis rules for the admin session profile.
+
+Every quota investigation on this platform so far ended in a *named,
+computable* classification — "partial prefix miss", "the compaction summary is
+40% of the window", "`extra_tools` agent-cache bypass cohort" — and a concrete
+cost-effectiveness fix. Each took an afternoon of hand-written DynamoDB queries
+to reach. These rules encode those classifications so a conversation arrives
+pre-labelled: the evidence is numbers already on the session's rows, the
+suggestion is the fix the investigation landed on, and ``ref`` points at the
+document that argued it.
+
+Design rules, in order of how expensive they are to get wrong:
+
+1. **Pure.** A rule is ``ProfileFacts -> Optional[Diagnosis]``. No I/O, no
+   clock, no env reads inside a rule — the one environment-dependent value
+   (the compaction threshold) is resolved once by the caller and passed in.
+   That is what makes each rule a one-line unit test.
+2. **Content-free by construction.** ``ProfileFacts`` carries counts, tokens,
+   hashes-as-counts, dollars and tool *ids*. Nothing here can see text.
+3. **Evidence over adjectives.** A diagnosis that says "heavy" without the
+   number is an opinion; every ``evidence`` dict carries the values the rule
+   compared and the threshold it compared them to.
+4. **Thresholds come from where they live.** The compaction threshold is the
+   runtime's, resolved exactly as ``CompactionConfig.from_env`` resolves it;
+   the write:read ratio is the shipped ``partial_miss`` classifier's. Values
+   that exist only as a proposal (the summary budget) say so in a comment.
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, field
+from typing import Any, Callable, Dict, List, Optional
+
+from agents.main_agent.config.constants import Defaults, EnvVars
+from apis.shared.observability.prompt_cache import PARTIAL_MISS_WRITE_READ_RATIO
+from apis.shared.tools.injected import (
+    INJECTED_TOOL_IDS,
+    KEY_DESCRIBED_INJECTED_TOOL_IDS,
+)
+
+# ---------------------------------------------------------------------------
+# Thresholds
+# ---------------------------------------------------------------------------
+
+#: #833 PR-2's proposed cap on the persisted compaction summary. Not yet a
+#: runtime constant — the spec's §4.1 scan found 32% of compacting sessions
+#: already over it. Promote to `constants.py` when PR-2 lands and import it.
+SUMMARY_TOKEN_BUDGET = 8_000
+CHARS_PER_TOKEN = 4
+
+#: Enabled catalog ids at or above which the tool set is flagged. Every
+#: enabled tool's schema is read on every call, so this is a context-share
+#: signal, not a cost-per-tool one.
+LARGE_TOOLSET_MIN_IDS = 8
+
+ATTACHMENT_HEAVY_BYTES = 5 * 1024 * 1024
+ATTACHMENT_HEAVY_COUNT = 5
+
+#: A single conversation at or above this share of the user's period spend is
+#: the one whose anatomy is worth reading first.
+DOMINANT_SESSION_SHARE_PCT = 50.0
+
+#: Partial-miss dollars at or above this share of a session's cost means the
+#: session is paying mostly for prefix re-writes that read as "hit".
+PARTIAL_MISS_SHARE_OF_COST = 0.5
+
+TOOL_ERROR_RATE = 0.25
+TOOL_ERROR_MIN_CALLS = 4
+TOOL_HEAVY_CALLS = 40
+AGENT_SWITCH_CHURN_MIN = 3
+
+REF_SPIRAL = "docs/specs/compaction-over-threshold-cache-spiral.md"
+REF_FLEET = "docs/one-pagers/fleet-prefix-spend-anatomy.md"
+REF_BYPASS = "docs/specs/agent-cache-extra-tools-bypass.md"
+REF_ROADMAP = "docs/one-pagers/cost-effectiveness-roadmap.md"
+
+SEVERITY_ORDER: Dict[str, int] = {"high": 0, "warn": 1, "info": 2}
+
+
+def compaction_token_threshold() -> int:
+    """The live compaction threshold, resolved as ``CompactionConfig.from_env`` does.
+
+    Read here rather than imported as a constant so an environment that tunes
+    ``AGENTCORE_MEMORY_COMPACTION_TOKEN_THRESHOLD`` diagnoses against the value
+    its runtime actually uses. Malformed or empty falls back to the default,
+    never raises — a diagnosis must not 500 a page.
+    """
+    raw = os.environ.get(EnvVars.COMPACTION_TOKEN_THRESHOLD, "").strip()
+    if not raw:
+        return Defaults.COMPACTION_TOKEN_THRESHOLD
+    try:
+        return int(raw)
+    except ValueError:
+        return Defaults.COMPACTION_TOKEN_THRESHOLD
+
+
+# ---------------------------------------------------------------------------
+# Inputs and outputs
+# ---------------------------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class Diagnosis:
+    """One named finding about a conversation. Serializes to the API as-is."""
+
+    code: str
+    severity: str  # "high" | "warn" | "info"
+    # `headline`, not `title`: `title` is a denylisted attribute name on the
+    # session row and the content-policy test walks every response model.
+    headline: str
+    evidence: Dict[str, Any]
+    suggestion: str
+    ref: str
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "code": self.code,
+            "severity": self.severity,
+            "headline": self.headline,
+            "evidence": dict(self.evidence),
+            "suggestion": self.suggestion,
+            "ref": self.ref,
+        }
+
+
+@dataclass
+class ProfileFacts:
+    """Everything a rule may look at. All content-free; all optional-tolerant.
+
+    ``None`` means "not recorded" (a row written before the field shipped),
+    which every rule treats as "cannot fire", never as zero.
+    """
+
+    cost_known: bool = False
+    total_cost: float = 0.0
+    call_count: int = 0
+
+    peak_context_tokens: Optional[int] = None
+    context_window: Optional[int] = None
+    compaction_threshold: int = Defaults.COMPACTION_TOKEN_THRESHOLD
+
+    cache_read_tokens: int = 0
+    cache_write_tokens: int = 0
+    wasted_usd: float = 0.0
+    partial_miss_usd: float = 0.0
+    partial_miss_count: int = 0
+
+    summary_approx_tokens: Optional[int] = None
+    checkpoint: Optional[int] = None
+    truncation_anchor: Optional[int] = None
+
+    #: Distinct fingerprint hashes among calls that did NOT switch Agent — an
+    #: `@`-mention re-writes the prefix on purpose and is counted separately.
+    distinct_system_prompt_hashes: int = 0
+    distinct_tool_config_hashes: int = 0
+    agent_switch_count: int = 0
+
+    enabled_tools: List[str] = field(default_factory=list)
+
+    attachment_count: int = 0
+    attachment_bytes: int = 0
+
+    share_of_user_period: Optional[float] = None
+
+    tool_call_count: Optional[int] = None
+    tool_error_count: Optional[int] = None
+
+    @property
+    def write_read_ratio(self) -> Optional[float]:
+        """cacheWrite / cacheRead, or None when nothing was ever read."""
+        if self.cache_read_tokens <= 0:
+            return None
+        return self.cache_write_tokens / self.cache_read_tokens
+
+
+Rule = Callable[[ProfileFacts], Optional[Diagnosis]]
+
+
+# ---------------------------------------------------------------------------
+# Rules
+# ---------------------------------------------------------------------------
+
+
+def cost_unknown(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.cost_known:
+        return None
+    return Diagnosis(
+        code="COST_UNKNOWN",
+        severity="info",
+        headline="Cost is unknown for this conversation",
+        evidence={"callCount": f.call_count},
+        suggestion=(
+            "The session's cost aggregate was never written or backfilled. It is "
+            "not $0 — it is unrecorded. Fleet-wide, 20% of session rows are in "
+            "this state; treat totals that include this session as a floor."
+        ),
+        ref=REF_FLEET,
+    )
+
+
+def over_compaction_threshold(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.peak_context_tokens is None or f.peak_context_tokens <= f.compaction_threshold:
+        return None
+    return Diagnosis(
+        code="OVER_COMPACTION_THRESHOLD",
+        severity="warn",
+        headline="Context crossed the compaction threshold",
+        evidence={
+            "peakContextTokens": f.peak_context_tokens,
+            "compactionThreshold": f.compaction_threshold,
+            "contextWindow": f.context_window,
+        },
+        suggestion=(
+            "Above the threshold every turn re-writes the prefix unless compaction "
+            "actually shrinks what is sent to the model. Look for a plateau above "
+            "the line in the context trajectory; 9% of sessions in this state "
+            "carried 70% of a month's spend."
+        ),
+        ref=REF_SPIRAL,
+    )
+
+
+def prefix_spiral(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.peak_context_tokens is None or f.peak_context_tokens <= f.compaction_threshold:
+        return None
+    ratio = f.write_read_ratio
+    writes_without_reads = f.cache_read_tokens <= 0 and f.cache_write_tokens > 0
+    if not writes_without_reads and (ratio is None or ratio <= PARTIAL_MISS_WRITE_READ_RATIO):
+        return None
+    return Diagnosis(
+        code="PREFIX_SPIRAL",
+        severity="high",
+        headline="Over threshold and re-writing the prefix on every call",
+        evidence={
+            "writeReadRatio": round(ratio, 2) if ratio is not None else None,
+            "cacheWriteTokens": f.cache_write_tokens,
+            "cacheReadTokens": f.cache_read_tokens,
+            "peakContextTokens": f.peak_context_tokens,
+            "ratioThreshold": PARTIAL_MISS_WRITE_READ_RATIO,
+        },
+        suggestion=(
+            "The #833 shape: the tools+system segment hits while the history "
+            "segment is re-written at the cache-write premium on every call. One "
+            "conversation like this spent a monthly quota in five days. Bound the "
+            "compaction summary and make compaction act on the live message list."
+        ),
+        ref=REF_SPIRAL,
+    )
+
+
+def partial_miss_heavy(f: ProfileFacts) -> Optional[Diagnosis]:
+    if not f.cost_known or f.total_cost <= 0:
+        return None
+    share = f.partial_miss_usd / f.total_cost
+    if share < PARTIAL_MISS_SHARE_OF_COST:
+        return None
+    return Diagnosis(
+        code="PARTIAL_MISS_HEAVY",
+        severity="high",
+        headline="Most of the spend is prefix re-writes that read as hits",
+        evidence={
+            "partialMissUsd": round(f.partial_miss_usd, 4),
+            "totalCost": round(f.total_cost, 4),
+            "shareOfCost": round(share, 3),
+            "partialMissCount": f.partial_miss_count,
+        },
+        suggestion=(
+            "Open the anatomy and diff toolConfigHash / systemPromptHash / "
+            "historyHash between consecutive partial_miss rows — the hash that "
+            "changed names the cache-buster."
+        ),
+        ref=REF_SPIRAL,
+    )
+
+
+def summary_over_budget(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.summary_approx_tokens is None or f.summary_approx_tokens <= SUMMARY_TOKEN_BUDGET:
+        return None
+    return Diagnosis(
+        code="SUMMARY_OVER_BUDGET",
+        severity="warn",
+        headline="Persisted compaction summary exceeds its budget",
+        evidence={
+            "summaryApproxTokens": f.summary_approx_tokens,
+            "budgetTokens": SUMMARY_TOKEN_BUDGET,
+            "contextWindow": f.context_window,
+        },
+        suggestion=(
+            "A summary that is a large share of the window guarantees compaction "
+            "can never get back under the threshold (#833 D2) — it is a log of the "
+            "conversation, not a compression of it. Cap or re-summarize."
+        ),
+        ref=REF_SPIRAL,
+    )
+
+
+def anchor_mismatch(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.checkpoint is None or f.truncation_anchor is None:
+        return None
+    if f.checkpoint == f.truncation_anchor:
+        return None
+    return Diagnosis(
+        code="ANCHOR_MISMATCH",
+        severity="info",
+        headline="Compaction checkpoint and truncation anchor disagree",
+        evidence={"checkpoint": f.checkpoint, "truncationAnchor": f.truncation_anchor},
+        suggestion=(
+            "One coordinate is window-relative and the other absolute (#833 D3); "
+            "the restored prefix may not be byte-stable turn to turn. Compare "
+            "historyHash across consecutive calls in the anatomy."
+        ),
+        ref=REF_SPIRAL,
+    )
+
+
+def system_prompt_mutated(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.distinct_system_prompt_hashes <= 1:
+        return None
+    return Diagnosis(
+        code="SYSTEM_PROMPT_MUTATED",
+        severity="warn",
+        headline="System prompt changed mid-conversation",
+        evidence={
+            "distinctSystemPromptHashes": f.distinct_system_prompt_hashes,
+            "callCount": f.call_count,
+            "agentSwitchesExcluded": f.agent_switch_count,
+        },
+        suggestion=(
+            "On calls that did not switch Agent the system prompt still changed — "
+            "a memory-augmented prompt or an unstable skill list re-writes the "
+            "cached prefix (#833 D4, the most general defect found). Pin the prompt "
+            "per session visit."
+        ),
+        ref=REF_SPIRAL,
+    )
+
+
+def toolconfig_mutated(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.distinct_tool_config_hashes <= 1:
+        return None
+    return Diagnosis(
+        code="TOOLCONFIG_MUTATED",
+        severity="warn",
+        headline="Tool configuration changed mid-conversation",
+        evidence={
+            "distinctToolConfigHashes": f.distinct_tool_config_hashes,
+            "callCount": f.call_count,
+            "agentSwitchesExcluded": f.agent_switch_count,
+        },
+        suggestion=(
+            "toolConfig is the first cache segment; a change re-writes everything "
+            "behind it. Either the tool set changed between turns or a tool list "
+            "is not deterministically ordered at its source."
+        ),
+        ref=REF_FLEET,
+    )
+
+
+def agent_switch_churn(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.agent_switch_count < AGENT_SWITCH_CHURN_MIN:
+        return None
+    return Diagnosis(
+        code="AGENT_SWITCH_CHURN",
+        severity="info",
+        headline="Repeated Agent switches",
+        evidence={"agentSwitchCount": f.agent_switch_count, "callCount": f.call_count},
+        suggestion=(
+            "An @-mention hands a turn to a different Agent and re-writes the prefix "
+            "by design. This is the cost of that feature, not a regression — but it "
+            "is a subset of wastedUsd, so subtract it before hunting for one."
+        ),
+        ref=REF_FLEET,
+    )
+
+
+def agent_cache_bypass(f: ProfileFacts) -> Optional[Diagnosis]:
+    enabled = set(f.enabled_tools)
+    bypassing = sorted((enabled & INJECTED_TOOL_IDS) - KEY_DESCRIBED_INJECTED_TOOL_IDS)
+    if not bypassing:
+        return None
+    return Diagnosis(
+        code="AGENT_CACHE_BYPASS",
+        severity="info",
+        headline="Enabled tools bypass the agent cache",
+        evidence={"bypassingToolIds": bypassing},
+        suggestion=(
+            "These injected tools capture request scope the agent-cache key does "
+            "not describe, so every turn builds a fresh Agent (full initialize + "
+            "memory restore). 76% of sessions were in this cohort. Promote the "
+            "family once its closures are key-described, or disable it if unused."
+        ),
+        ref=REF_BYPASS,
+    )
+
+
+def large_toolset(f: ProfileFacts) -> Optional[Diagnosis]:
+    if len(f.enabled_tools) < LARGE_TOOLSET_MIN_IDS:
+        return None
+    return Diagnosis(
+        code="LARGE_TOOLSET",
+        severity="info",
+        headline="Large enabled tool set",
+        evidence={
+            "enabledToolCount": len(f.enabled_tools),
+            "threshold": LARGE_TOOLSET_MIN_IDS,
+            "enabledToolIds": sorted(f.enabled_tools),
+        },
+        suggestion=(
+            "Every enabled tool's schema is read by the model before the user's "
+            "question; an MCP server can contribute dozens. This spends the working "
+            "budget before the first word and degrades tool selection."
+        ),
+        ref=REF_ROADMAP,
+    )
+
+
+def attachment_heavy(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.attachment_count < ATTACHMENT_HEAVY_COUNT and f.attachment_bytes < ATTACHMENT_HEAVY_BYTES:
+        return None
+    return Diagnosis(
+        code="ATTACHMENT_HEAVY",
+        severity="warn",
+        headline="Attachment-heavy conversation",
+        evidence={
+            "attachmentCount": f.attachment_count,
+            "attachmentBytes": f.attachment_bytes,
+            "countThreshold": ATTACHMENT_HEAVY_COUNT,
+            "bytesThreshold": ATTACHMENT_HEAVY_BYTES,
+        },
+        suggestion=(
+            "Attachments are 11% of sessions and 31% of spend. Long-document "
+            "iteration belongs in artifacts or an offloaded store, not inline in "
+            "the prefix where it is re-read — or re-written — every turn."
+        ),
+        ref=REF_ROADMAP,
+    )
+
+
+def dominant_session(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.share_of_user_period is None or f.share_of_user_period < DOMINANT_SESSION_SHARE_PCT:
+        return None
+    return Diagnosis(
+        code="DOMINANT_SESSION",
+        severity="info",
+        headline="This conversation dominates the user's period spend",
+        evidence={
+            "shareOfUserPeriodPct": round(f.share_of_user_period, 1),
+            "threshold": DOMINANT_SESSION_SHARE_PCT,
+        },
+        suggestion=(
+            "A quota exhaustion is usually one thread, not a busy month. This is the "
+            "one to read the anatomy of."
+        ),
+        ref=REF_SPIRAL,
+    )
+
+
+def tool_error_rate(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.tool_call_count is None or f.tool_error_count is None:
+        return None
+    if f.tool_call_count < TOOL_ERROR_MIN_CALLS:
+        return None
+    rate = f.tool_error_count / f.tool_call_count
+    if rate < TOOL_ERROR_RATE:
+        return None
+    return Diagnosis(
+        code="TOOL_ERROR_RATE",
+        severity="warn",
+        headline="High tool failure rate",
+        evidence={
+            "toolCallCount": f.tool_call_count,
+            "toolErrorCount": f.tool_error_count,
+            "errorRate": round(rate, 3),
+            "threshold": TOOL_ERROR_RATE,
+        },
+        suggestion=(
+            "Each failed call still costs a model round-trip plus the error payload "
+            "in context, and the model usually retries. Check the tool census for "
+            "which tool is failing."
+        ),
+        ref=REF_ROADMAP,
+    )
+
+
+def tool_heavy(f: ProfileFacts) -> Optional[Diagnosis]:
+    if f.tool_call_count is None or f.tool_call_count < TOOL_HEAVY_CALLS:
+        return None
+    return Diagnosis(
+        code="TOOL_HEAVY",
+        severity="info",
+        headline="Tool-heavy conversation",
+        evidence={"toolCallCount": f.tool_call_count, "threshold": TOOL_HEAVY_CALLS},
+        suggestion=(
+            "Tool results are the unbounded per-turn payload. Check the census for "
+            "a tool whose results should be bounded or offloaded."
+        ),
+        ref=REF_ROADMAP,
+    )
+
+
+RULES: List[Rule] = [
+    cost_unknown,
+    prefix_spiral,
+    partial_miss_heavy,
+    over_compaction_threshold,
+    summary_over_budget,
+    system_prompt_mutated,
+    toolconfig_mutated,
+    attachment_heavy,
+    tool_error_rate,
+    anchor_mismatch,
+    agent_switch_churn,
+    agent_cache_bypass,
+    large_toolset,
+    dominant_session,
+    tool_heavy,
+]
+
+
+def run_diagnoses(facts: ProfileFacts) -> List[Diagnosis]:
+    """Apply every rule; return findings ordered high → warn → info, then by code."""
+    findings = [d for d in (rule(facts) for rule in RULES) if d is not None]
+    findings.sort(key=lambda d: (SEVERITY_ORDER.get(d.severity, 99), d.code))
+    return findings
+
+
+def top_severity(findings: List[Diagnosis]) -> Optional[str]:
+    return findings[0].severity if findings else None
diff --git a/backend/src/apis/app_api/admin/costs/models.py b/backend/src/apis/app_api/admin/costs/models.py
index 07941b389..ec5fc5ab2 100644
--- a/backend/src/apis/app_api/admin/costs/models.py
+++ b/backend/src/apis/app_api/admin/costs/models.py
@@ -6,7 +6,7 @@
 """
 
 from pydantic import BaseModel, Field, ConfigDict
-from typing import Optional, List, Dict
+from typing import Any, Optional, List, Dict
 
 
 class TopUserCost(BaseModel):
@@ -241,3 +241,170 @@ class AdminCostDashboard(BaseModel):
 
     # Historical daily trends (optional)
     daily_trends: Optional[List[CostTrend]] = Field(None, alias="dailyTrends")
+
+
+# =============================================================================
+# Per-user conversation list + session profile (content-free drill-down)
+#
+# Every field below is a count, a token figure, a dollar figure, a timestamp,
+# a hash-derived count, or a catalog/tool *id*. No field may carry user text
+# or model-generated prose — `tests/.../test_content_policy.py` walks these
+# models against `apis.shared.observability.content_policy.CONTENT_BEARING`.
+# The single exemption on this surface is `TopSessionCost.title`, above.
+# =============================================================================
+
+
+class SessionDiagnosis(BaseModel):
+    """One named finding from `diagnoses.run_diagnoses`."""
+    model_config = ConfigDict(populate_by_name=True)
+
+    code: str
+    severity: str  # high | warn | info
+    headline: str
+    evidence: Dict[str, Any] = Field(default_factory=dict)
+    suggestion: str
+    ref: str
+
+
+class UserSessionSummary(BaseModel):
+    """One conversation in a user's content-free conversation list.
+
+    ``costKnown=False`` means the session's cost aggregate was never written —
+    the cost is *unrecorded*, not zero — and ``totalCost`` is then ``None``.
+    Optional counters (``toolCallCount``, ``toolErrorCount``,
+    ``compactionCount``) are ``None`` on rows written before they shipped, so
+    a UI can say "not tracked" rather than "0".
+    """
+    model_config = ConfigDict(populate_by_name=True)
+
+    session_id: str = Field(..., alias="sessionId")
+    created_at: Optional[str] = Field(None, alias="createdAt")
+    last_message_at: Optional[str] = Field(None, alias="lastMessageAt")
+    status: Optional[str] = None
+    message_count: Optional[int] = Field(None, alias="messageCount")
+
+    model_id: Optional[str] = Field(None, alias="modelId")
+    enabled_tool_count: Optional[int] = Field(None, alias="enabledToolCount")
+    agent_bound: bool = Field(False, alias="agentBound")
+
+    last_context_tokens: Optional[int] = Field(None, alias="lastContextTokens")
+    context_window: Optional[int] = Field(None, alias="contextWindow")
+    # lastContextTokens / contextWindow, 0..1, when both are known
+    context_share: Optional[float] = Field(None, alias="contextShare")
+
+    total_cost: Optional[float] = Field(None, alias="totalCost")
+    cost_known: bool = Field(False, alias="costKnown")
+    share_of_user_period: Optional[float] = Field(None, alias="shareOfUserPeriod")
+
+    cache_efficiency: Optional[float] = Field(None, alias="cacheEfficiency")
+    wasted_usd: Optional[float] = Field(None, alias="wastedUsd")
+    partial_miss_usd: Optional[float] = Field(None, alias="partialMissUsd")
+
+    summarized_turns: Optional[int] = Field(None, alias="summarizedTurns")
+    summary_approx_tokens: Optional[int] = Field(None, alias="summaryApproxTokens")
+
+    tool_call_count: Optional[int] = Field(None, alias="toolCallCount")
+    tool_error_count: Optional[int] = Field(None, alias="toolErrorCount")
+    compaction_count: Optional[int] = Field(None, alias="compactionCount")
+
+    diagnosis_count: int = Field(0, alias="diagnosisCount")
+    top_diagnosis_severity: Optional[str] = Field(None, alias="topDiagnosisSeverity")
+
+
+class UserSessionsResponse(BaseModel):
+    """A user's conversations, content-free, for the admin user page."""
+    model_config = ConfigDict(populate_by_name=True)
+
+    user_id: str = Field(..., alias="userId")
+    # The period the list was scoped to (YYYY-MM), or None for all time.
+    period: Optional[str] = None
+    # The user's recorded cost for `period`, when scoped; the denominator of
+    # each row's `shareOfUserPeriod`.
+    user_period_cost: Optional[float] = Field(None, alias="userPeriodCost")
+    sessions: List[UserSessionSummary]
+    # Rows before `limit` was applied, so the page can say "showing 50 of 212".
+    total: int = 0
+    # Sessions excluded because their cost is unrecorded (they are still listed,
+    # with costKnown=False, when sort != "cost"; under cost-sort they trail).
+    unknown_cost_count: int = Field(0, alias="unknownCostCount")
+
+
+class AttachmentProfile(BaseModel):
+    """Per-session upload stats. Never filenames."""
+    model_config = ConfigDict(populate_by_name=True)
+
+    count: int = 0
+    total_bytes: int = Field(0, alias="totalBytes")
+    by_mime: Dict[str, int] = Field(default_factory=dict, alias="byMime")
+
+
+class ContextTrajectoryPoint(BaseModel):
+    """One model call's context occupancy (input + cacheRead + cacheWrite)."""
+    model_config = ConfigDict(populate_by_name=True)
+
+    call_index: int = Field(..., alias="callIndex")
+    timestamp: str
+    context_tokens: int = Field(..., alias="contextTokens")
+    cache_status: Optional[str] = Field(None, alias="cacheStatus")
+    model_id: Optional[str] = Field(None, alias="modelId")
+    cost: Optional[float] = None
+    # Per-call tool census when recorded (PR-3): tool name -> calls
+    tool_calls: Optional[Dict[str, int]] = Field(None, alias="toolCalls")
+
+
+class FingerprintChanges(BaseModel):
+    """How often each cached-prefix component changed between consecutive calls."""
+    model_config = ConfigDict(populate_by_name=True)
+
+    system_prompt: int = Field(0, alias="systemPrompt")
+    tool_config: int = Field(0, alias="toolConfig")
+    # The subset of the two figures above that an Agent switch explains.
+    explained_by_agent_switch: int = Field(0, alias="explainedByAgentSwitch")
+
+
+class ToolCensusEntry(BaseModel):
+    model_config = ConfigDict(populate_by_name=True)
+
+    calls: int = 0
+    errors: int = 0
+
+
+class DataCoverage(BaseModel):
+    """Which optional signals this session actually has, so the UI can say
+    "not tracked" instead of rendering an honest-looking zero."""
+    model_config = ConfigDict(populate_by_name=True)
+
+    tool_census: bool = Field(False, alias="toolCensus")
+    compaction_count: bool = Field(False, alias="compactionCount")
+    fingerprints: bool = False
+    cost: bool = False
+
+
+class SessionProfile(BaseModel):
+    """The content-free diagnostic profile of one conversation."""
+    model_config = ConfigDict(populate_by_name=True)
+
+    session_id: str = Field(..., alias="sessionId")
+    user_id: Optional[str] = Field(None, alias="userId")
+    session: UserSessionSummary
+
+    call_count: int = Field(0, alias="callCount")
+    peak_context_tokens: Optional[int] = Field(None, alias="peakContextTokens")
+    compaction_threshold: int = Field(..., alias="compactionThreshold")
+    write_read_ratio: Optional[float] = Field(None, alias="writeReadRatio")
+
+    attachments: AttachmentProfile
+    context_trajectory: List[ContextTrajectoryPoint] = Field(
+        default_factory=list, alias="contextTrajectory"
+    )
+    model_mix: Dict[str, int] = Field(default_factory=dict, alias="modelMix")
+    fingerprint_changes: FingerprintChanges = Field(
+        default_factory=FingerprintChanges, alias="fingerprintChanges"
+    )
+    tool_census: Dict[str, ToolCensusEntry] = Field(
+        default_factory=dict, alias="toolCensus"
+    )
+    enabled_tool_ids: List[str] = Field(default_factory=list, alias="enabledToolIds")
+
+    diagnoses: List[SessionDiagnosis] = Field(default_factory=list)
+    data_coverage: DataCoverage = Field(default_factory=DataCoverage, alias="dataCoverage")
diff --git a/backend/src/apis/app_api/admin/costs/routes.py b/backend/src/apis/app_api/admin/costs/routes.py
index 12e45d882..f2b1dde0f 100644
--- a/backend/src/apis/app_api/admin/costs/routes.py
+++ b/backend/src/apis/app_api/admin/costs/routes.py
@@ -24,6 +24,8 @@
     CostTrend,
     AdminCostDashboard,
     SessionCostAnatomy,
+    SessionProfile,
+    UserSessionsResponse,
 )
 from .service import AdminCostService
 
@@ -252,6 +254,123 @@ async def get_session_cost_anatomy(
     return anatomy
 
 
+@router.get("/users/{user_id}/sessions", response_model=UserSessionsResponse)
+async def get_user_sessions(
+    user_id: str,
+    period: Optional[str] = Query(
+        None,
+        description="Period (YYYY-MM) to scope the list to; defaults to the current month",
+        pattern=r"^\d{4}-\d{2}$",
+    ),
+    all_time: bool = Query(
+        False,
+        alias="allTime",
+        description="List every conversation regardless of period (period is then ignored)",
+    ),
+    sort: str = Query(
+        "cost",
+        pattern=r"^(cost|recent|context|messages)$",
+        description="cost (desc), recent (lastMessageAt desc), context (desc), messages (desc)",
+    ),
+    limit: int = Query(100, ge=1, le=500, description="Maximum rows to return"),
+    admin_user: User = Depends(require_costs_admin),
+    service: AdminCostService = Depends(get_cost_service),
+):
+    """
+    One user's conversations, content-free, for the admin user page.
+
+    The drill-down that was missing between "top users by cost" and the
+    per-session cost anatomy: it starts from a *user* — the person support is
+    looking at because they hit their quota — and lists what they were doing
+    without reading any of it. Each row is counts, tokens, dollars, timestamps,
+    a model id, a tool count, an agent-binding flag and the diagnoses that
+    fired on the row's own numbers; nothing on it carries user text or
+    model-generated prose (no title, no summary).
+
+    ⚠️ **`costKnown=false` rows are unrecorded, not free.** 20% of session rows
+    fleet-wide have never had a cost aggregate written. They are listed, they
+    trail under cost-sort, and `unknownCostCount` says how many there are so a
+    total over this list is understood as a floor.
+
+    Period semantics match `/top-sessions`: `period` selects which sessions
+    are listed (active in it) and supplies the denominator for
+    `shareOfUserPeriod`; a row's `totalCost` is the conversation's **lifetime**
+    cost, because a runaway thread usually spans period boundaries.
+
+    Raises:
+        HTTPException:
+            - 401 if not authenticated
+            - 403 if user lacks the admin.costs scope
+            - 500 if server error
+    """
+    logger.info("Admin requesting a user's conversation list")
+
+    try:
+        return await service.get_user_sessions(
+            user_id=user_id,
+            period=None if all_time else period,
+            all_time=all_time,
+            sort=sort,
+            limit=limit,
+        )
+    except Exception as e:
+        logger.error(f"Error getting user sessions: {e}", exc_info=True)
+        raise HTTPException(
+            status_code=500,
+            detail="Failed to retrieve user sessions"
+        )
+
+
+@router.get("/sessions/{session_id}/profile", response_model=SessionProfile)
+async def get_session_profile(
+    session_id: str,
+    admin_user: User = Depends(require_costs_admin),
+    service: AdminCostService = Depends(get_cost_service),
+):
+    """
+    The content-free diagnostic profile of one conversation.
+
+    Sits beside `/sessions/{id}/calls` (the cost anatomy) and answers the
+    question that view cannot: *what was the user doing?* Attachments (count
+    and bytes, never names), the context-token trajectory per model call with
+    the compaction threshold to read it against, the model mix, how often each
+    cached-prefix component changed, the tool census when recorded, and the
+    diagnoses that fired — each a named, computable classification with its
+    evidence and the fix a prior investigation landed on.
+
+    `dataCoverage` says which optional signals this session actually has; a
+    session written before a counter shipped reads "not tracked", never "0".
+
+    The whole payload is safe to paste into a model for a second opinion — it
+    is content-free by construction (`apis.shared.observability.content_policy`).
+
+    Raises:
+        HTTPException:
+            - 401 if not authenticated
+            - 403 if user lacks the admin.costs scope
+            - 404 if the session has no metadata row
+            - 500 if server error
+    """
+    logger.info("Admin requesting a session profile")
+
+    try:
+        profile = await service.get_session_profile(session_id)
+    except Exception as e:
+        logger.error(f"Error getting session profile: {e}", exc_info=True)
+        raise HTTPException(
+            status_code=500,
+            detail="Failed to retrieve session profile"
+        )
+
+    if profile is None:
+        raise HTTPException(
+            status_code=404,
+            detail=f"No session found for {session_id}"
+        )
+
+    return profile
+
+
 @router.get("/top-users", response_model=List[TopUserCost])
 async def get_top_users(
     period: Optional[str] = Query(
diff --git a/backend/src/apis/app_api/admin/costs/service.py b/backend/src/apis/app_api/admin/costs/service.py
index 0b7df9db6..be484cadb 100644
--- a/backend/src/apis/app_api/admin/costs/service.py
+++ b/backend/src/apis/app_api/admin/costs/service.py
@@ -4,12 +4,29 @@
 model usage breakdowns, and cost trends for the admin dashboard.
 """
 
+import asyncio
 import logging
+from collections import Counter
 from datetime import datetime, timedelta, timezone
-from typing import Optional, List
+from typing import Any, Dict, Optional, List
 
 from apis.shared.storage.dynamodb_storage import DynamoDBStorage
+from .diagnoses import (
+    CHARS_PER_TOKEN,
+    Diagnosis,
+    ProfileFacts,
+    compaction_token_threshold,
+    run_diagnoses,
+    top_severity,
+)
 from .models import (
+    AttachmentProfile,
+    ContextTrajectoryPoint,
+    DataCoverage,
+    FingerprintChanges,
+    SessionDiagnosis,
+    SessionProfile,
+    ToolCensusEntry,
     TopUserCost,
     TopSessionCost,
     TopSessionsResponse,
@@ -21,23 +38,108 @@
     PrefixFingerprints,
     SessionCallRow,
     SessionCostAnatomy,
+    UserSessionSummary,
+    UserSessionsResponse,
 )
 
 logger = logging.getLogger(__name__)
 
+# Bound on concurrent per-user lookups when enriching the top-users table.
+_ENRICH_CONCURRENCY = 10
+
+
+def _as_int(value: Any) -> Optional[int]:
+    if value is None:
+        return None
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return None
+
+
+def _as_float(value: Any) -> Optional[float]:
+    if value is None:
+        return None
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return None
+
+
+def _record_cost(record: Dict[str, Any]) -> Optional[float]:
+    """A C# row's cost: a breakdown dict on the streaming path, a bare float on
+    the legacy path, or absent (unknown — never zero)."""
+    raw = record.get("cost")
+    if isinstance(raw, dict):
+        raw = raw.get("total")
+    return _as_float(raw)
+
+
+def _context_tokens(record: Dict[str, Any]) -> int:
+    """True context occupancy of one call: uncached input + cached prefix +
+    newly cached tokens (Bedrock reports the three disjointly)."""
+    usage = record.get("tokenUsage") or {}
+    return (
+        int(usage.get("inputTokens") or 0)
+        + int(usage.get("cacheReadInputTokens") or 0)
+        + int(usage.get("cacheWriteInputTokens") or 0)
+    )
+
 
 class AdminCostService:
     """Service for admin cost dashboard operations."""
 
-    def __init__(self, storage: Optional[DynamoDBStorage] = None):
+    def __init__(
+        self,
+        storage: Optional[DynamoDBStorage] = None,
+        user_repository: Any = None,
+        quota_resolver: Any = None,
+        file_repository: Any = None,
+    ):
         """
         Initialize the admin cost service.
 
         Args:
             storage: Optional DynamoDB storage instance. If not provided,
                      a new instance will be created.
+            user_repository: Optional ``UserRepository`` for top-users
+                     enrichment (email). Resolved lazily when omitted.
+            quota_resolver: Optional ``QuotaResolver`` for top-users
+                     enrichment (tier, quota %). Resolved lazily when omitted.
+            file_repository: Optional ``FileUploadRepository`` for the session
+                     profile's attachment stats. Resolved lazily when omitted.
         """
         self.storage = storage or DynamoDBStorage()
+        self._user_repository = user_repository
+        self._quota_resolver = quota_resolver
+        self._file_repository = file_repository
+
+    # Lazy collaborators. `getattr` defaults so a test that builds the service
+    # with `__new__` and sets only `storage` still works.
+
+    def _users(self):
+        repo = getattr(self, "_user_repository", None)
+        if repo is None:
+            from apis.shared.users.repository import UserRepository
+            repo = UserRepository()
+            self._user_repository = repo
+        return repo
+
+    def _quota(self):
+        resolver = getattr(self, "_quota_resolver", None)
+        if resolver is None:
+            from apis.shared.quota import get_quota_resolver
+            resolver = get_quota_resolver()
+            self._quota_resolver = resolver
+        return resolver
+
+    def _files(self):
+        repo = getattr(self, "_file_repository", None)
+        if repo is None:
+            from apis.shared.files.repository import get_file_upload_repository
+            repo = get_file_upload_repository()
+            self._file_repository = repo
+        return repo
 
     def _get_current_period(self) -> str:
         """Get the current month period in YYYY-MM format."""
@@ -112,13 +214,14 @@ async def get_top_users(
                     total_cost=user_data.get("totalCost", 0.0),
                     total_requests=user_data.get("totalRequests", 0),
                     last_updated=user_data.get("lastUpdated", ""),
-                    # TODO: Enrich with email, tier info from user service
                     email=None,
                     tier_name=None,
                     quota_limit=None,
                     quota_percentage=None
                 ))
 
+            await self._enrich_top_users(result)
+
             logger.info("Retrieved top users for period")
             return result
 
@@ -126,6 +229,59 @@ async def get_top_users(
             logger.error(f"Error getting top users: {e}")
             raise
 
+    async def _enrich_top_users(self, rows: List[TopUserCost]) -> None:
+        """Fill in ``email`` / ``tierName`` / ``quotaLimit`` / ``quotaPercentage``.
+
+        The table's job is to make the user who is about to hit their quota
+        visible without opening every row, so the quota share matters more
+        than the email. Best-effort throughout: the users table may be
+        unconfigured (a fork without the BFF user store), and one user's
+        lookup failing must not blank the column for the rest. Bounded
+        concurrency so a 100-row page is ~10 round-trips deep, not 100.
+        """
+        try:
+            users = self._users()
+        except Exception as e:  # noqa: BLE001 - enrichment is optional
+            logger.debug("Top-users enrichment unavailable: %s", e)
+            return
+        if not getattr(users, "enabled", False) or not rows:
+            return
+
+        from apis.shared.auth import User
+
+        quota = self._quota()
+        semaphore = asyncio.Semaphore(_ENRICH_CONCURRENCY)
+
+        async def enrich(row: TopUserCost) -> None:
+            async with semaphore:
+                try:
+                    profile = await users.get_user_by_user_id(row.user_id)
+                    if profile is None:
+                        return
+                    row.email = profile.email
+                    resolved = await quota.resolve_user_quota(User(
+                        user_id=profile.user_id,
+                        email=profile.email,
+                        name=profile.name,
+                        roles=profile.roles,
+                    ))
+                    tier = getattr(resolved, "tier", None) if resolved else None
+                    if tier is None:
+                        return
+                    row.tier_name = getattr(tier, "tier_name", None)
+                    limit = getattr(tier, "monthly_cost_limit", None)
+                    if limit is None or limit == float("inf"):
+                        return
+                    limit = float(limit)
+                    if limit <= 0:
+                        return
+                    row.quota_limit = limit
+                    row.quota_percentage = round(row.total_cost / limit * 100, 1)
+                except Exception as e:  # noqa: BLE001 - one user must not blank the page
+                    logger.debug("Top-users enrichment skipped for a user: %s", e)
+
+        await asyncio.gather(*(enrich(row) for row in rows))
+
     async def get_system_summary(
         self,
         period: Optional[str] = None,
@@ -547,6 +703,345 @@ async def get_session_cost_anatomy(self, session_id: str) -> SessionCostAnatomy:
             cache_efficiency=cache_efficiency,
         )
 
+    # =========================================================================
+    # Content-free drill-down: user → conversations → conversation profile
+    # =========================================================================
+
+    async def _user_period_cost(self, user_id: str, period: Optional[str]) -> Optional[float]:
+        """The user's recorded cost for ``period`` — the denominator for a
+        conversation's share — or ``None`` when unscoped or unrecorded."""
+        if not period:
+            return None
+        try:
+            summary = await self.storage.get_user_cost_summary(user_id, period)
+        except Exception as e:  # noqa: BLE001 - a missing denominator is not an error
+            logger.debug("User period cost unavailable: %s", e)
+            return None
+        total = _as_float((summary or {}).get("totalCost")) if isinstance(summary, dict) else None
+        return total if total and total > 0 else None
+
+    @staticmethod
+    def _row_facts(row: Dict[str, Any], threshold: int, share: Optional[float]) -> ProfileFacts:
+        """Facts derivable from the session row alone — what the list view
+        diagnoses on. The profile refines these with per-call data."""
+        preferences = row.get("preferences") or {}
+        compaction = row.get("compaction") or {}
+        enabled = preferences.get("enabledTools")
+        summary_chars = _as_int(compaction.get("summaryChars"))
+        total_cost = _as_float(row.get("totalCost"))
+        return ProfileFacts(
+            cost_known=total_cost is not None,
+            total_cost=total_cost or 0.0,
+            call_count=0,
+            peak_context_tokens=_as_int(row.get("lastContextTokens")),
+            context_window=_as_int(row.get("contextWindow")),
+            compaction_threshold=threshold,
+            cache_read_tokens=_as_int(row.get("totalCacheReadTokens")) or 0,
+            cache_write_tokens=_as_int(row.get("totalCacheWriteTokens")) or 0,
+            wasted_usd=_as_float(row.get("wastedUsd")) or 0.0,
+            partial_miss_usd=_as_float(row.get("partialMissUsd")) or 0.0,
+            partial_miss_count=_as_int(row.get("partialMissCount")) or 0,
+            summary_approx_tokens=(
+                summary_chars // CHARS_PER_TOKEN if summary_chars is not None else None
+            ),
+            checkpoint=_as_int(compaction.get("checkpoint")),
+            truncation_anchor=_as_int(compaction.get("truncationAnchor")),
+            enabled_tools=list(enabled) if isinstance(enabled, list) else [],
+            share_of_user_period=share,
+            tool_call_count=_as_int(row.get("toolCallCount")),
+            tool_error_count=_as_int(row.get("toolErrorCount")),
+        )
+
+    @staticmethod
+    def _session_summary(
+        row: Dict[str, Any],
+        findings: List[Diagnosis],
+        share: Optional[float],
+    ) -> UserSessionSummary:
+        """Map a content-free session row to the list/profile summary model."""
+        preferences = row.get("preferences") or {}
+        compaction = row.get("compaction") or {}
+        total_cost = _as_float(row.get("totalCost"))
+        read = _as_int(row.get("totalCacheReadTokens")) or 0
+        write = _as_int(row.get("totalCacheWriteTokens")) or 0
+        traffic = read + write
+        last_context = _as_int(row.get("lastContextTokens"))
+        window = _as_int(row.get("contextWindow"))
+        summary_chars = _as_int(compaction.get("summaryChars"))
+        enabled = preferences.get("enabledTools")
+        wasted = _as_float(row.get("wastedUsd"))
+        partial = _as_float(row.get("partialMissUsd"))
+
+        return UserSessionSummary(
+            session_id=row.get("sessionId", ""),
+            created_at=row.get("createdAt"),
+            last_message_at=row.get("lastMessageAt"),
+            status=row.get("status"),
+            message_count=_as_int(row.get("messageCount")),
+            model_id=preferences.get("lastModel"),
+            enabled_tool_count=len(enabled) if isinstance(enabled, list) else None,
+            agent_bound=bool(preferences.get("assistantId")),
+            last_context_tokens=last_context,
+            context_window=window,
+            context_share=(
+                round(last_context / window, 4)
+                if last_context is not None and window else None
+            ),
+            total_cost=round(total_cost, 6) if total_cost is not None else None,
+            cost_known=total_cost is not None,
+            share_of_user_period=share,
+            cache_efficiency=round(read / traffic, 4) if traffic > 0 else None,
+            wasted_usd=round(wasted, 6) if wasted is not None else None,
+            partial_miss_usd=round(partial, 6) if partial is not None else None,
+            summarized_turns=_as_int(compaction.get("totalSummarizedTurns")),
+            summary_approx_tokens=(
+                summary_chars // CHARS_PER_TOKEN if summary_chars is not None else None
+            ),
+            tool_call_count=_as_int(row.get("toolCallCount")),
+            tool_error_count=_as_int(row.get("toolErrorCount")),
+            compaction_count=_as_int(row.get("compactionCount")),
+            diagnosis_count=len(findings),
+            top_diagnosis_severity=top_severity(findings),
+        )
+
+    @staticmethod
+    def _share(total_cost: Optional[float], user_period_cost: Optional[float]) -> Optional[float]:
+        if total_cost is None or not user_period_cost:
+            return None
+        return round(total_cost / user_period_cost * 100, 2)
+
+    async def get_user_sessions(
+        self,
+        user_id: str,
+        period: Optional[str] = None,
+        all_time: bool = False,
+        sort: str = "cost",
+        limit: int = 100,
+    ) -> UserSessionsResponse:
+        """One user's conversations, content-free, diagnosed on their own rows.
+
+        Period semantics match :meth:`get_top_sessions`: ``period`` selects
+        which sessions are listed (active in it) and supplies the share
+        denominator; each row's ``totalCost`` is the conversation's lifetime
+        cost. ``all_time`` lists everything and reports no share.
+
+        Rows with no recorded cost are *listed*, flagged ``costKnown=False``,
+        and trail under cost-sort — they are unrecorded, not free.
+        """
+        period = None if all_time else (period or self._get_current_period())
+        active_since = self._get_period_date_range(period)[0] if period else None
+
+        rows = await self.storage.get_user_session_diagnostics(
+            user_id=user_id,
+            active_since=active_since,
+        )
+        user_period_cost = await self._user_period_cost(user_id, period)
+        threshold = compaction_token_threshold()
+
+        summaries: List[UserSessionSummary] = []
+        for row in rows:
+            share = self._share(_as_float(row.get("totalCost")), user_period_cost)
+            findings = run_diagnoses(self._row_facts(row, threshold, share))
+            summaries.append(self._session_summary(row, findings, share))
+
+        def recent_key(s: UserSessionSummary) -> str:
+            return s.last_message_at or ""
+
+        if sort == "recent":
+            summaries.sort(key=recent_key, reverse=True)
+        elif sort == "context":
+            summaries.sort(key=lambda s: (s.last_context_tokens or -1, recent_key(s)), reverse=True)
+        elif sort == "messages":
+            summaries.sort(key=lambda s: (s.message_count or -1, recent_key(s)), reverse=True)
+        else:  # cost — known first by cost desc, unknown trailing by recency
+            summaries.sort(
+                key=lambda s: (s.cost_known, s.total_cost or 0.0, recent_key(s)),
+                reverse=True,
+            )
+
+        unknown = sum(1 for s in summaries if not s.cost_known)
+        logger.info(
+            f"User sessions: {len(summaries)} rows ({unknown} unknown-cost), "
+            f"returning {min(limit, len(summaries))}"
+        )
+        return UserSessionsResponse(
+            user_id=user_id,
+            period=period,
+            user_period_cost=round(user_period_cost, 6) if user_period_cost else None,
+            sessions=summaries[:limit],
+            total=len(summaries),
+            unknown_cost_count=unknown,
+        )
+
+    async def _attachment_profile(self, session_id: str) -> AttachmentProfile:
+        """Per-session upload stats. Best-effort: a fork without the uploads
+        table, or a transient error, yields an empty profile, never a 500."""
+        try:
+            stats = await self._files().list_session_file_stats(session_id)
+        except Exception as e:  # noqa: BLE001 - attachments are one signal of several
+            logger.debug("Attachment stats unavailable for session: %s", e)
+            return AttachmentProfile()
+        by_mime: Counter = Counter()
+        total_bytes = 0
+        for item in stats:
+            by_mime[item.get("mimeType") or "unknown"] += 1
+            total_bytes += _as_int(item.get("sizeBytes")) or 0
+        return AttachmentProfile(
+            count=len(stats),
+            total_bytes=total_bytes,
+            by_mime=dict(by_mime),
+        )
+
+    async def get_session_profile(self, session_id: str) -> Optional[SessionProfile]:
+        """The content-free diagnostic profile of one conversation, or ``None``
+        when the session has no metadata row.
+
+        Three reads — the session row (by session id, via the lookup index),
+        the per-call cost rows the anatomy already uses, and the session's
+        upload stats — then pure arithmetic: context trajectory, model mix,
+        fingerprint churn, tool census, and the diagnosis rules over all of it.
+        """
+        row = await self.storage.get_session_diagnostic_row(session_id)
+        if row is None:
+            return None
+        user_id = row.get("userId")
+
+        records = await self.storage.get_session_cost_records(session_id)
+        attachments = await self._attachment_profile(session_id)
+        user_period_cost = (
+            await self._user_period_cost(user_id, self._get_current_period())
+            if user_id else None
+        )
+
+        # ── per-call derivations ──
+        trajectory: List[ContextTrajectoryPoint] = []
+        model_mix: Counter = Counter()
+        census: Dict[str, ToolCensusEntry] = {}
+        system_changes = tool_changes = explained = 0
+        system_hashes: set = set()
+        tool_hashes: set = set()
+        agent_switches = 0
+        read_total = write_total = 0
+        any_fingerprints = any_census = False
+        previous_fp: Optional[Dict[str, Any]] = None
+
+        for index, record in enumerate(records):
+            usage = record.get("tokenUsage") or {}
+            read_total += int(usage.get("cacheReadInputTokens") or 0)
+            write_total += int(usage.get("cacheWriteInputTokens") or 0)
+            model_id = (record.get("modelInfo") or {}).get("modelId")
+            if model_id:
+                model_mix[model_id] += 1
+            switched = bool(record.get("agentSwitched"))
+            if switched:
+                agent_switches += 1
+
+            fp = record.get("prefixFingerprints")
+            if isinstance(fp, dict):
+                any_fingerprints = True
+                if not switched:
+                    if fp.get("systemPromptHash"):
+                        system_hashes.add(fp["systemPromptHash"])
+                    if fp.get("toolConfigHash"):
+                        tool_hashes.add(fp["toolConfigHash"])
+                if isinstance(previous_fp, dict):
+                    changed = False
+                    if fp.get("systemPromptHash") != previous_fp.get("systemPromptHash"):
+                        system_changes += 1
+                        changed = True
+                    if fp.get("toolConfigHash") != previous_fp.get("toolConfigHash"):
+                        tool_changes += 1
+                        changed = True
+                    if changed and switched:
+                        explained += 1
+                previous_fp = fp
+
+            tool_calls_raw = record.get("toolCalls")
+            point_tool_calls: Optional[Dict[str, int]] = None
+            if isinstance(tool_calls_raw, dict):
+                any_census = True
+                point_tool_calls = {}
+                for name, entry in tool_calls_raw.items():
+                    calls = _as_int(entry.get("calls") if isinstance(entry, dict) else entry) or 0
+                    errors = _as_int(entry.get("errors")) or 0 if isinstance(entry, dict) else 0
+                    point_tool_calls[name] = calls
+                    slot = census.setdefault(name, ToolCensusEntry())
+                    slot.calls += calls
+                    slot.errors += errors
+
+            trajectory.append(ContextTrajectoryPoint(
+                call_index=index,
+                timestamp=record.get("timestamp", ""),
+                context_tokens=_context_tokens(record),
+                cache_status=record.get("cacheStatus"),
+                model_id=model_id,
+                cost=_record_cost(record),
+                tool_calls=point_tool_calls,
+            ))
+
+        # Cache totals: the rows are authoritative when present, else the
+        # session rollups (which cover calls written before fingerprints).
+        if not records:
+            read_total = _as_int(row.get("totalCacheReadTokens")) or 0
+            write_total = _as_int(row.get("totalCacheWriteTokens")) or 0
+
+        peak = max((p.context_tokens for p in trajectory), default=None)
+        if peak is None:
+            peak = _as_int(row.get("lastContextTokens"))
+
+        total_cost = _as_float(row.get("totalCost"))
+        share = self._share(total_cost, user_period_cost)
+        threshold = compaction_token_threshold()
+
+        facts = self._row_facts(row, threshold, share)
+        facts.call_count = len(records)
+        facts.peak_context_tokens = peak
+        facts.cache_read_tokens = read_total
+        facts.cache_write_tokens = write_total
+        facts.distinct_system_prompt_hashes = len(system_hashes)
+        facts.distinct_tool_config_hashes = len(tool_hashes)
+        facts.agent_switch_count = agent_switches
+        facts.attachment_count = attachments.count
+        facts.attachment_bytes = attachments.total_bytes
+        if any_census:
+            facts.tool_call_count = sum(e.calls for e in census.values())
+            facts.tool_error_count = sum(e.errors for e in census.values())
+
+        findings = run_diagnoses(facts)
+        summary = self._session_summary(row, findings, share)
+        if any_census and summary.tool_call_count is None:
+            summary.tool_call_count = facts.tool_call_count
+            summary.tool_error_count = facts.tool_error_count
+
+        return SessionProfile(
+            session_id=session_id,
+            user_id=user_id,
+            session=summary,
+            call_count=len(records),
+            peak_context_tokens=peak,
+            compaction_threshold=threshold,
+            write_read_ratio=(
+                round(write_total / read_total, 3) if read_total > 0 else None
+            ),
+            attachments=attachments,
+            context_trajectory=trajectory,
+            model_mix=dict(model_mix),
+            fingerprint_changes=FingerprintChanges(
+                system_prompt=system_changes,
+                tool_config=tool_changes,
+                explained_by_agent_switch=explained,
+            ),
+            tool_census=census,
+            enabled_tool_ids=sorted(facts.enabled_tools),
+            diagnoses=[SessionDiagnosis(**d.to_dict()) for d in findings],
+            data_coverage=DataCoverage(
+                tool_census=any_census or row.get("toolCallCount") is not None,
+                compaction_count=row.get("compactionCount") is not None,
+                fingerprints=any_fingerprints,
+                cost=total_cost is not None,
+            ),
+        )
+
     async def get_dashboard(
         self,
         period: Optional[str] = None,
diff --git a/backend/src/apis/app_api/admin/roles/agent_pins.py b/backend/src/apis/app_api/admin/roles/agent_pins.py
index f07e8ba59..02673a0a6 100644
--- a/backend/src/apis/app_api/admin/roles/agent_pins.py
+++ b/backend/src/apis/app_api/admin/roles/agent_pins.py
@@ -124,7 +124,7 @@ async def put_role_agent_pins(
             f"Admin {scrub_log(admin.email)} set {len(request.pins)} default pin(s) on role {scrub_log(role_id)}",
             extra={
                 "event": "role_agent_pins_updated",
-                "role_id": role_id,
+                "role_id": scrub_log(role_id),
                 "pin_count": len(request.pins),
                 "admin_user_id": admin.user_id,
             },
diff --git a/backend/src/apis/app_api/admin/services/model_icons.py b/backend/src/apis/app_api/admin/services/model_icons.py
index f253ee4d6..8fcba9f77 100644
--- a/backend/src/apis/app_api/admin/services/model_icons.py
+++ b/backend/src/apis/app_api/admin/services/model_icons.py
@@ -24,6 +24,7 @@
     model_icon_version,
     normalize_icon,
 )
+from apis.shared.security.log_sanitize import scrub_log
 
 logger = logging.getLogger(__name__)
 
@@ -68,7 +69,9 @@ async def upload_model_icon(model_id: str, content: bytes) -> Tuple[Optional[str
     try:
         key = store.put(model_id=model_id, content=data, ext=ext, content_type=content_type)
     except IconStoreError as e:
-        logger.error(f"Icon storage unavailable for model {model_id}: {e}")
+        logger.error(
+            f"Icon storage unavailable for model {scrub_log(model_id)}: {scrub_log(e)}"
+        )
         raise ModelIconError("Icon storage is unavailable.", status_code=503) from e
 
     previous = model.icon_key
@@ -76,7 +79,7 @@ async def upload_model_icon(model_id: str, content: bytes) -> Tuple[Optional[str
     if previous and previous != key:
         store.delete(previous)
 
-    logger.info(f"🖼️ model-icons: uploaded icon for model {model_id}")
+    logger.info(f"🖼️ model-icons: uploaded icon for model {scrub_log(model_id)}")
     return key, model_icon_url(model_id, key)
 
 
@@ -90,7 +93,7 @@ async def remove_model_icon(model_id: str) -> Tuple[Optional[str], Optional[str]
     if previous:
         get_model_icon_store().delete(previous)
 
-    logger.info(f"🖼️ model-icons: removed icon for model {model_id}")
+    logger.info(f"🖼️ model-icons: removed icon for model {scrub_log(model_id)}")
     return None, None
 
 
diff --git a/backend/src/apis/app_api/documents/models.py b/backend/src/apis/app_api/documents/models.py
index bb29eef61..bc4d78880 100644
--- a/backend/src/apis/app_api/documents/models.py
+++ b/backend/src/apis/app_api/documents/models.py
@@ -122,6 +122,33 @@ class DocumentResponse(BaseModel):
     last_synced_at: Optional[str] = Field(None, alias="lastSyncedAt", description="ISO 8601 timestamp of last successful sync run")
 
 
+class KbUsage(BaseModel):
+    """Storage usage for the assistant's knowledge base, for the UI usage bar.
+
+    Only managed knowledge bases are byte-capped (Requirement 12.11). A managed
+    KB reports its committed and in-flight reserved bytes and the binding cap —
+    ``effective_cap``, the smaller of the owner tier and the per-KB ceiling. A
+    legacy (S3-Vectors) KB is uncapped and tracks no bytes, so it reports
+    ``cap=None`` with zeroed counters and the UI renders an uncapped indicator.
+
+    ``elevated`` is READ from the KB record's ``elevatedByteCap`` flag; granting
+    the elevated tier is a separate feature and nothing writes it here.
+    """
+
+    model_config = ConfigDict(populate_by_name=True)
+
+    engine: str = Field(..., description="Engine serving this KB: 'managed' or 's3vectors'")
+    stored_bytes: int = Field(0, alias="storedBytes", description="Bytes committed to the KB")
+    reserved_bytes: int = Field(
+        0, alias="reservedBytes", description="Bytes reserved by in-flight uploads"
+    )
+    cap: Optional[int] = Field(
+        None,
+        description="Binding byte cap (min of owner tier and per-KB ceiling); null for uncapped legacy KBs",
+    )
+    elevated: bool = Field(False, description="Whether the elevated owner tier applies")
+
+
 class DocumentsListResponse(BaseModel):
     """Response for listing documents with pagination support"""
 
@@ -129,6 +156,11 @@ class DocumentsListResponse(BaseModel):
 
     documents: List[DocumentResponse] = Field(..., description="List of documents for the assistant")
     next_token: Optional[str] = Field(None, alias="nextToken", description="Pagination token for next page")
+    kb_usage: Optional[KbUsage] = Field(
+        None,
+        alias="kbUsage",
+        description="Storage usage + cap for the assistant's knowledge base; null when not resolved",
+    )
 
 
 class DownloadUrlResponse(BaseModel):
diff --git a/backend/src/apis/app_api/documents/routes.py b/backend/src/apis/app_api/documents/routes.py
index 831d0cfdd..21dfb74e8 100644
--- a/backend/src/apis/app_api/documents/routes.py
+++ b/backend/src/apis/app_api/documents/routes.py
@@ -18,6 +18,7 @@
     ExtractedChunksResponse,
     ImportDocumentsRequest,
     ImportDocumentsResponse,
+    KbUsage,
     ReportUploadFailureRequest,
     UploadUrlResponse,
 )
@@ -42,6 +43,7 @@
     get_provider_repository,
 )
 from apis.shared.rbac.service import AppRoleService, get_app_role_service
+from apis.shared.security.log_sanitize import scrub_log
 from apis.shared.kb_backend.byte_cap import ByteCapExceeded
 
 logger = logging.getLogger(__name__)
@@ -87,6 +89,52 @@ async def _resolve_managed_kb(assistant_id: str) -> tuple[bool, bool]:
     return True, bool((record or {}).get("elevatedByteCap"))
 
 
+async def _resolve_kb_usage(assistant_id: str) -> Optional[KbUsage]:
+    """Storage usage + binding cap for this assistant's knowledge base.
+
+    Read once from the KB_Record and shaped for the UI usage bar. A managed KB
+    reports its committed and reserved bytes plus the binding cap
+    (``effective_cap``, the smaller of the owner tier and the per-KB ceiling). A
+    legacy S3-Vectors KB — an absent record, or one whose engine is not the exact
+    managed literal — is uncapped and tracks no bytes (the cap is scoped to
+    managed KBs by Requirement 12.11), so it reports ``cap=None`` with zeroed
+    counters and the UI renders an uncapped indicator. The elevated tier is READ
+    from ``elevatedByteCap``, never written here.
+
+    Best-effort: the usage bar is enrichment, not the point of the endpoint, so a
+    failed record read returns ``None`` (the bar is simply not shown) rather than
+    failing the whole documents list.
+    """
+    from apis.shared.kb_backend import byte_cap
+    from apis.shared.kb_backend.records import (
+        ENGINE_LEGACY,
+        ENGINE_MANAGED,
+        get_kb_record,
+        resolve_engine,
+    )
+
+    try:
+        # app_kb_id == assistant_id this phase. get_kb_record is a blocking boto3 call.
+        record = await asyncio.to_thread(get_kb_record, assistant_id, assistant_id)
+        if resolve_engine(record) != ENGINE_MANAGED:
+            return KbUsage(engine=ENGINE_LEGACY)
+        elevated = bool((record or {}).get("elevatedByteCap"))
+        return KbUsage(
+            engine=ENGINE_MANAGED,
+            storedBytes=int((record or {}).get("storedBytes") or 0),
+            reservedBytes=int((record or {}).get("reservedBytes") or 0),
+            cap=byte_cap.effective_cap(elevated),
+            elevated=elevated,
+        )
+    except Exception as exc:  # noqa: BLE001 — enrichment must not fail the list
+        logger.warning(
+            "Could not resolve KB usage for %s: %s",
+            scrub_log(assistant_id),
+            scrub_log(exc),
+        )
+        return None
+
+
 async def _reserve_managed_upload(assistant_id: str, size_bytes: int) -> int:
     """Provisionally reserve a declared upload size against the managed-KB cap.
 
@@ -406,7 +454,14 @@ async def list_documents(
         # Convert to response models
         document_responses = [DocumentResponse.model_validate(doc.model_dump(by_alias=True)) for doc in documents]
 
-        return DocumentsListResponse(documents=document_responses, nextToken=next_page_token)
+        # Storage usage + cap for the assistant's knowledge base, so the UI can
+        # render the usage bar without a second round-trip (Requirement 12.11
+        # visibility). Legacy KBs return cap=None and the bar shows uncapped.
+        kb_usage = await _resolve_kb_usage(assistant_id)
+
+        return DocumentsListResponse(
+            documents=document_responses, nextToken=next_page_token, kbUsage=kb_usage
+        )
 
     except HTTPException:
         raise
diff --git a/backend/src/apis/app_api/documents/services/document_service.py b/backend/src/apis/app_api/documents/services/document_service.py
index 94b01bb28..417f86eb7 100644
--- a/backend/src/apis/app_api/documents/services/document_service.py
+++ b/backend/src/apis/app_api/documents/services/document_service.py
@@ -516,6 +516,60 @@ async def update_document_import_metadata(
         return None
 
 
+async def assistant_has_documents(assistant_id: str) -> bool:
+    """Whether this assistant already has any ``DOC#`` rows.
+
+    A cheap existence probe — ``Select='COUNT'`` with ``Limit=1`` so DynamoDB
+    stops at the first match and returns no item bodies. Deliberately does NOT run
+    the ownership check ``list_assistant_documents`` does: the only caller
+    (born-managed) has already authorised the upload, and this answers a question
+    about the data, not about access.
+
+    Born-managed uses this to tell a genuinely new agent (no documents → provision
+    a managed knowledge base) apart from an established legacy agent (already has
+    documents on the shared S3-Vectors index → must stay legacy). Legacy knowledge
+    bases are not first-class and carry no ``KB_Record``, so the absence of a
+    record cannot make that distinction on its own.
+
+    Fails toward "has documents" (returns ``True``) on any error or missing table
+    config. That is the safe direction: wrongly provisioning managed on an
+    established legacy agent silently breaks retrieval of its existing corpus,
+    whereas wrongly staying legacy on a new agent is benign (it can still Upgrade).
+    """
+    import asyncio
+
+    table_name = os.environ.get('DYNAMODB_ASSISTANTS_TABLE_NAME')
+    if not table_name:
+        logger.error(
+            "assistant_has_documents: DYNAMODB_ASSISTANTS_TABLE_NAME unset; "
+            "assuming documents exist so born-managed stays on legacy"
+        )
+        return True
+
+    def _count() -> bool:
+        import boto3
+        from boto3.dynamodb.conditions import Key
+
+        table = boto3.resource('dynamodb').Table(table_name)
+        resp = table.query(
+            KeyConditionExpression=Key('PK').eq(f'AST#{assistant_id}')
+            & Key('SK').begins_with('DOC#'),
+            Select='COUNT',
+            Limit=1,
+        )
+        return int(resp.get('Count', 0)) > 0
+
+    try:
+        return await asyncio.to_thread(_count)
+    except Exception as e:  # noqa: BLE001 — fail toward legacy, never fail the upload
+        logger.warning(
+            f"assistant_has_documents: existence probe for {assistant_id} failed "
+            f"({e}); assuming documents exist so born-managed stays on legacy",
+            exc_info=True,
+        )
+        return True
+
+
 async def list_assistant_documents(
     assistant_id: str,
     owner_id: str,
@@ -759,11 +813,27 @@ async def soft_delete_document(
 
         if 'Attributes' in response:
             try:
-                return Document.model_validate(response['Attributes'])
+                document = Document.model_validate(response['Attributes'])
             except Exception as e:
                 logger.warning(f"Failed to parse document from DynamoDB response: {e}")
                 return None
 
+            # Deleting a document that never finished ingesting leaves its
+            # request-time byte reservation stranded. Nothing else settles it: the
+            # release paths are ingestion reaching a terminal state, a
+            # client-reported upload failure, and the stale sweep — and a deleted
+            # document reaches none of them.
+            #
+            # Left unreleased the leak is invisible and cumulative. Every cancelled
+            # upload permanently shaves bytes off that assistant's allowance until
+            # uploads start failing for no reason the owner can see, months after
+            # the deletes that caused it. `settle_once` makes this exactly-once
+            # against the other paths, so releasing here cannot double-credit a
+            # document that some other path also settles.
+            await release_reservation_if_managed(document)
+
+            return document
+
         return None
 
     except ClientError as e:
diff --git a/backend/src/apis/app_api/files/routes.py b/backend/src/apis/app_api/files/routes.py
index 9985ee865..beb6ccc55 100644
--- a/backend/src/apis/app_api/files/routes.py
+++ b/backend/src/apis/app_api/files/routes.py
@@ -9,7 +9,7 @@
 from typing import Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query, status
-from fastapi.responses import Response
+from fastapi.responses import RedirectResponse, Response
 
 from apis.shared.auth import User, get_current_user_from_session
 from apis.shared.files.repository import InvalidCursorError
@@ -166,6 +166,44 @@ async def get_preview_url(
         )
 
 
+@router.get("/{upload_id}/download", response_class=RedirectResponse)
+async def download_file(
+    upload_id: str,
+    user: User = Depends(get_current_user_from_session),
+    service: FileUploadService = Depends(get_file_upload_service),
+):
+    """
+    Redirect to a freshly minted presigned GET URL that downloads the file.
+
+    This is the *durable* download link. Presigned S3 URLs expire in minutes,
+    so any URL that gets written into a conversation — the inline download
+    card on a generated .docx, a link in an assistant message — is dead by the
+    time the user reopens the thread. This route is a stable, owner-scoped
+    path (`/api/files/{uploadId}/download`) that mints the presigned URL at
+    click time, so a persisted link keeps working for as long as the file does.
+
+    A 302 rather than a proxied body: the bytes still come straight from S3,
+    and the response carries `Content-Disposition: attachment` from the
+    presigned request.
+    """
+    try:
+        url = await service.get_download_url(user.user_id, upload_id)
+    except FileNotFoundError:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"File {upload_id} not found or not owned by you",
+        )
+
+    # 302 (not 307): this is a GET-only redirect to a different origin, and
+    # `no-store` keeps a browser or intermediary from reusing the Location
+    # after the signature it carries has expired.
+    return RedirectResponse(
+        url=url,
+        status_code=status.HTTP_302_FOUND,
+        headers={"Cache-Control": "no-store"},
+    )
+
+
 @router.get("/{upload_id}/text-snippet", response_model=TextSnippetResponse)
 async def get_text_snippet(
     upload_id: str,
diff --git a/backend/src/apis/app_api/files/service.py b/backend/src/apis/app_api/files/service.py
index 39474b745..6dcd151ab 100644
--- a/backend/src/apis/app_api/files/service.py
+++ b/backend/src/apis/app_api/files/service.py
@@ -425,6 +425,52 @@ async def get_preview_url(
             filename=file_meta.filename,
         )
 
+    async def get_download_url(self, user_id: str, upload_id: str) -> str:
+        """Mint a short-lived presigned GET URL that forces a download.
+
+        Same ownership + READY gate as `get_preview_url`, but the response
+        headers carry `Content-Disposition: attachment` so the browser saves
+        the file instead of rendering it. Minted per request and immediately
+        redirected to, so the caller never holds an expiring URL — that is the
+        whole point of the `/files/{id}/download` route: a stable, durable link
+        that can be persisted in a conversation and still work a week later.
+
+        Args:
+            user_id: The owner's user ID
+            upload_id: The upload identifier
+
+        Returns:
+            A presigned S3 GET URL with an attachment disposition.
+
+        Raises:
+            FileNotFoundError: If file not found, not owned by user, or not ready
+        """
+        file_meta = await self.repository.get_file(user_id, upload_id)
+        if not file_meta:
+            raise FileNotFoundError(f"File {upload_id} not found")
+
+        if file_meta.status != FileStatus.READY:
+            raise FileNotFoundError(
+                f"File {upload_id} is not ready (status: {file_meta.status})"
+            )
+
+        try:
+            return self._s3_client.generate_presigned_url(
+                "get_object",
+                Params={
+                    "Bucket": self.bucket_name,
+                    "Key": file_meta.s3_key,
+                    "ResponseContentType": file_meta.mime_type,
+                    "ResponseContentDisposition": (
+                        f'attachment; filename="{file_meta.filename}"'
+                    ),
+                },
+                ExpiresIn=self.preview_url_expiration,
+            )
+        except ClientError as e:
+            logger.error(f"Failed to generate download URL: {e}")
+            raise
+
     async def get_text_snippet(
         self, user_id: str, upload_id: str
     ) -> TextSnippetResponse:
diff --git a/backend/src/apis/app_api/fine_tuning/routes.py b/backend/src/apis/app_api/fine_tuning/routes.py
index 4e94bc903..f357440db 100644
--- a/backend/src/apis/app_api/fine_tuning/routes.py
+++ b/backend/src/apis/app_api/fine_tuning/routes.py
@@ -42,6 +42,7 @@
 from .inference_repository import InferenceRepository, get_inference_repository
 from .script_packaging_service import ScriptPackagingService, get_script_packaging_service
 from .dependencies import require_fine_tuning_access
+from apis.shared.security.log_sanitize import scrub_log
 
 logger = logging.getLogger(__name__)
 
@@ -285,7 +286,9 @@ async def preflight_huggingface_model(hf_id: str, spec) -> None:
         async with httpx.AsyncClient(timeout=10.0) as client:
             response = await client.get(f"https://huggingface.co/api/models/{hf_id}")
     except httpx.HTTPError as e:
-        logger.warning(f"HuggingFace pre-flight unavailable for {hf_id}: {e}")
+        logger.warning(
+            f"HuggingFace pre-flight unavailable for {scrub_log(hf_id)}: {scrub_log(e)}"
+        )
         return
 
     if response.status_code == 404:
@@ -298,7 +301,7 @@ async def preflight_huggingface_model(hf_id: str, spec) -> None:
         )
     if response.status_code >= 400:
         logger.warning(
-            f"HuggingFace pre-flight returned {response.status_code} for {hf_id}"
+            f"HuggingFace pre-flight returned {response.status_code} for {scrub_log(hf_id)}"
         )
         return
 
@@ -425,7 +428,7 @@ def _budgeted_runtime(
     if effective < requested_seconds:
         logger.info(
             f"Clamped max runtime from {requested_seconds}s to {effective}s "
-            f"to fit ${remaining_usd:.2f} remaining on {instance_type}"
+            f"to fit ${remaining_usd:.2f} remaining on {scrub_log(instance_type)}"
         )
     return effective
 
diff --git a/backend/src/apis/app_api/kb_upgrade/born_managed.py b/backend/src/apis/app_api/kb_upgrade/born_managed.py
index beedb1226..c20517377 100644
--- a/backend/src/apis/app_api/kb_upgrade/born_managed.py
+++ b/backend/src/apis/app_api/kb_upgrade/born_managed.py
@@ -115,6 +115,24 @@ async def begin_born_managed(
         # app_kb_id == assistant_id this phase.
         record = await asyncio.to_thread(r.get_kb_record, assistant_id, assistant_id)
         if record is None:
+            # No KB_Record. A brand-new agent has none — but so does an ESTABLISHED
+            # LEGACY agent: legacy knowledge bases are not first-class, share one
+            # S3-Vectors index, and never wrote a record. Absence of a record
+            # therefore cannot, on its own, mean "new". Guard on the corpus: if the
+            # agent has already ingested any document, it is a legacy KB and must
+            # stay legacy — provisioning managed here would strand its existing
+            # documents on the legacy index (retrieval flips to the empty managed
+            # KB) and only re-ingest the one being uploaded now.
+            from apis.app_api.documents.services.document_service import (
+                assistant_has_documents,
+            )
+
+            if await assistant_has_documents(assistant_id):
+                logger.info(
+                    f"kb {assistant_id}: existing documents present and no managed "
+                    f"record — established legacy agent, staying on legacy"
+                )
+                return False
             return await _start(assistant_id, owner_user_id, visibility)
         return await _join(assistant_id, record)
     except Exception as exc:  # noqa: BLE001 — born-managed must never fail an upload
diff --git a/backend/src/apis/app_api/sessions/routes.py b/backend/src/apis/app_api/sessions/routes.py
index 69ad4e80b..47c01fee4 100644
--- a/backend/src/apis/app_api/sessions/routes.py
+++ b/backend/src/apis/app_api/sessions/routes.py
@@ -724,7 +724,7 @@ async def signal_turn_interrupted_endpoint(
             if not await is_session_lease_held(session_id, user_id):
                 logger.info(
                     "Ignoring navigated_away for session %s — no turn in flight",
-                    session_id,
+                    scrub_log(session_id),
                 )
                 return Response(status_code=204)
 
diff --git a/backend/src/apis/app_api/skills/routes.py b/backend/src/apis/app_api/skills/routes.py
index 487c5dbb7..e528f1b92 100644
--- a/backend/src/apis/app_api/skills/routes.py
+++ b/backend/src/apis/app_api/skills/routes.py
@@ -62,6 +62,7 @@
     UserSkillNotFoundError,
     get_user_skill_service,
 )
+from apis.shared.security.log_sanitize import scrub_log
 
 logger = logging.getLogger(__name__)
 
@@ -548,7 +549,9 @@ async def get_accessible_skill(
     user: User = Depends(get_current_user_from_session),
 ) -> SkillDetailResponse:
     """Read one skill the current user can reach, catalog or self-authored."""
-    logger.info(f"User {user.name} reading skill '{skill_id}'")
+    logger.info(
+        f"User {scrub_log(user.name)} reading skill '{scrub_log(skill_id)}'"
+    )
 
     skill = await _require_accessible_skill(skill_id, user)
 
diff --git a/backend/src/apis/app_api/skills/service.py b/backend/src/apis/app_api/skills/service.py
index 5eae8f35f..8b4efeaa8 100644
--- a/backend/src/apis/app_api/skills/service.py
+++ b/backend/src/apis/app_api/skills/service.py
@@ -144,7 +144,7 @@ async def get_catalog_skill(self, skill_id: str) -> Optional[SkillDefinition]:
                 "as not found",
                 extra={
                     "event": "admin_skill_cross_tier_denied",
-                    "skill_id": skill_id,
+                    "skill_id": scrub_log(skill_id),
                 },
             )
             return None
@@ -237,7 +237,7 @@ async def update_skill(
                 f"Admin {scrub_log(admin.email)} updated skill: {scrub_log(skill_id)}",
                 extra={
                     "event": "skill_updated",
-                    "skill_id": skill_id,
+                    "skill_id": scrub_log(skill_id),
                     "admin_user_id": admin.user_id,
                     "admin_email": admin.email,
                     "changes": list(updates.keys()),
@@ -279,7 +279,7 @@ async def delete_skill(
                 f"Admin {scrub_log(admin.email)} deleted skill: {scrub_log(skill_id)}",
                 extra={
                     "event": "skill_deleted",
-                    "skill_id": skill_id,
+                    "skill_id": scrub_log(skill_id),
                     "admin_user_id": admin.user_id,
                     "admin_email": admin.email,
                     "soft_delete": soft,
@@ -401,10 +401,10 @@ async def add_resource(
             f"Admin {scrub_log(admin.email)} uploaded reference file to skill {scrub_log(skill_id)}",
             extra={
                 "event": "skill_resource_added",
-                "skill_id": skill_id,
+                "skill_id": scrub_log(skill_id),
                 # NB: not "filename" — that key is reserved on LogRecord and
                 # raises KeyError when the record is actually emitted.
-                "resource_filename": filename,
+                "resource_filename": scrub_log(filename),
                 "size": len(content),
                 "admin_user_id": admin.user_id,
             },
@@ -460,9 +460,9 @@ async def delete_resource(
             f"Admin {scrub_log(admin.email)} deleted reference file from skill {scrub_log(skill_id)}",
             extra={
                 "event": "skill_resource_deleted",
-                "skill_id": skill_id,
+                "skill_id": scrub_log(skill_id),
                 # NB: not "filename" — reserved on LogRecord (see add_resource).
-                "resource_filename": filename,
+                "resource_filename": scrub_log(filename),
                 "admin_user_id": admin.user_id,
             },
         )
@@ -632,7 +632,7 @@ async def set_roles_for_skill(
             f"Admin {scrub_log(admin.email)} set roles for skill {scrub_log(skill_id)}",
             extra={
                 "event": "skill_roles_updated",
-                "skill_id": skill_id,
+                "skill_id": scrub_log(skill_id),
                 "admin_user_id": admin.user_id,
                 "roles_added": list(to_add),
                 "roles_removed": list(to_remove),
diff --git a/backend/src/apis/app_api/skills/user_service.py b/backend/src/apis/app_api/skills/user_service.py
index 672748215..bcbfe3a7f 100644
--- a/backend/src/apis/app_api/skills/user_service.py
+++ b/backend/src/apis/app_api/skills/user_service.py
@@ -183,7 +183,7 @@ async def create_my_skill(
             f"User {scrub_log(user.email)} created skill: {scrub_log(skill_id)}",
             extra={
                 "event": "user_skill_created",
-                "skill_id": skill_id,
+                "skill_id": scrub_log(skill_id),
                 "owner_user_id": user.user_id,
             },
         )
@@ -213,7 +213,7 @@ async def update_my_skill(
             f"User {scrub_log(user.email)} updated skill: {scrub_log(skill_id)}",
             extra={
                 "event": "user_skill_updated",
-                "skill_id": skill_id,
+                "skill_id": scrub_log(skill_id),
                 "owner_user_id": user.user_id,
                 "changes": list(updates.keys()),
             },
@@ -242,7 +242,7 @@ async def delete_my_skill(self, skill_id: str, user: User) -> None:
             f"User {scrub_log(user.email)} deleted skill: {scrub_log(skill_id)}",
             extra={
                 "event": "user_skill_deleted",
-                "skill_id": skill_id,
+                "skill_id": scrub_log(skill_id),
                 "owner_user_id": user.user_id,
             },
         )
diff --git a/backend/src/apis/app_api/tools/discovery.py b/backend/src/apis/app_api/tools/discovery.py
index 9fec082d9..a88db7b73 100644
--- a/backend/src/apis/app_api/tools/discovery.py
+++ b/backend/src/apis/app_api/tools/discovery.py
@@ -38,6 +38,7 @@
     ToolDefinition,
     _clip,
 )
+from apis.shared.security.log_sanitize import scrub_log
 
 logger = logging.getLogger(__name__)
 
@@ -367,7 +368,10 @@ def _get() -> ResolvedPrompt:
         return await asyncio.to_thread(_get)
     except Exception as exc:  # noqa: BLE001 - surfaced as a 502 by the route
         logger.warning(
-            "prompts/get failed for %s/%s: %s", tool.tool_id, prompt_name, exc
+            "prompts/get failed for %s/%s: %s",
+            scrub_log(tool.tool_id),
+            scrub_log(prompt_name),
+            scrub_log(exc),
         )
         raise RuntimeError(f"The server could not compose that prompt: {exc}") from exc
 
diff --git a/backend/src/apis/inference_api/chat/agent_binding_policy.py b/backend/src/apis/inference_api/chat/agent_binding_policy.py
index 648da2e86..f43195caa 100644
--- a/backend/src/apis/inference_api/chat/agent_binding_policy.py
+++ b/backend/src/apis/inference_api/chat/agent_binding_policy.py
@@ -12,15 +12,29 @@
 * it is **persisted** — ``preferences.assistant_id`` is what the SPA self-heals its
   ``assistantId`` query param from, so a written binding survives reload forever.
 
-Two kinds of turn run an Agent without binding, and they must skip *both* halves together
-— validating without persisting would refuse the second mention in a thread, and
-persisting without validating would let a mention quietly annex the conversation:
+⚠️ **Persisting is necessary but not sufficient, and that trips people up.** Every turn's
+Agent is resolved from the *request*; the SPA's only carrier is the ``assistantId`` query
+param, and the self-heal effect that refills it from preferences runs on session *load*.
+So a turn that binds must also leave the param on the URL, or the very next message in the
+same live page arrives with no Agent at all.
 
-* **`@`-mention** (Marketplace D11) — the user handed this one turn to an Agent from the
-  composer. Mentioning inside a thread that already has messages is the normal case, not
-  the error case, and the next unmentioned message is plain chat again.
-* **preview** — the Agent/assistant editor's own scratch session, which persists nothing
-  by design.
+**A mention on an empty thread binds** (changed 2026-09-14). D11 originally read the
+`@`-mention as borrowing the Agent for one turn and nothing more, which left the next
+message plain. Measured against real traffic that reading was backwards: of 247 mentions in
+prod, **247 began the conversation** and none was a mid-thread consult. The per-turn
+borrow's failure mode is also invisible — the turn after a mention silently loses the
+Agent's tools, skills and model, and the model, having no idea its toolset changed,
+explains a missing tool as something the user should fix in the tool picker. So a mention
+that *starts* a thread is a launch and binds like one.
+
+The SPA no longer sends ``agent_mention`` at all: a mention sets the ``assistantId`` param,
+and mentioning inside a thread that already has messages opens a **new** conversation with
+that Agent rather than borrowing it for a turn. The flag is still honoured here for clients
+that predate that change — and a stale tab mentioning into a fresh thread now gets a bound
+conversation like everyone else, which is the case that actually happens.
+
+The one remaining non-binding Agent turn is **preview** — the Agent/assistant editor's own
+scratch session, which persists nothing by design.
 
 ⚠️ This decides *binding*, never *authorization*. The Agent itself is still resolved
 through ``get_assistant_with_access_check`` on every turn, so a client that lies about
@@ -31,11 +45,24 @@
 from __future__ import annotations
 
 
-def binds_conversation(*, is_agent_mention: bool, is_preview: bool) -> bool:
+def binds_conversation(
+    *,
+    is_agent_mention: bool,
+    is_preview: bool,
+    thread_is_empty: bool = False,
+) -> bool:
     """True when this turn's Agent should be validated against, and written to, the session.
 
     Args:
-        is_agent_mention: The Agent was ``@``-mentioned for this turn only (D11).
+        is_agent_mention: The Agent was ``@``-mentioned for this turn only (D11). Only
+            legacy clients still send this; the current SPA turns a mention into a bound
+            conversation before the request is built.
         is_preview: The session is an editor preview, which persists nothing.
+        thread_is_empty: The session has no messages yet, so binding an Agent to it is the
+            same act as launching one — there is no history produced under other
+            instructions for the binding to contradict. Defaults False so a caller that
+            cannot cheaply answer it keeps the conservative pre-existing behaviour.
     """
-    return not is_agent_mention and not is_preview
+    if is_preview:
+        return False
+    return not is_agent_mention or thread_is_empty
diff --git a/backend/src/apis/inference_api/chat/models.py b/backend/src/apis/inference_api/chat/models.py
index b56321d85..928ac1b6a 100644
--- a/backend/src/apis/inference_api/chat/models.py
+++ b/backend/src/apis/inference_api/chat/models.py
@@ -128,13 +128,24 @@ class InvocationRequest(BaseModel):
     # Marketplace D11: this turn was handed to the Agent by an `@`-mention in
     # the composer, rather than the whole conversation being bound to it.
     #
-    # A mention borrows the Agent for ONE turn: the route skips the
-    # bind-once-per-session validation (a mention is legitimate in a thread
-    # that already has messages, and in a thread bound to a different Agent),
-    # and skips writing `preferences.assistant_id`, so the next plain turn is
-    # plain again. Everything else — access check, RAG, binding resolution,
-    # memory injection — is identical to a bound turn, because the same Agent
-    # is running with the same governance.
+    # ⚠️ **LEGACY as of 2026-09-14 — the current SPA never sends this.** A mention now
+    # means "talk to this Agent": on an empty thread it binds like a launch, and in a
+    # thread that already has messages the SPA opens a *new* conversation with the Agent
+    # instead of sending a borrowed turn. The one-turn borrow this flag requests failed
+    # silently — the next message lost the Agent's tools, skills and model with no signal
+    # to the user or the model — and prod said nobody used what it was protecting (247 of
+    # 247 mentions started their conversation). See D11 in docs/specs/agent-marketplace.md.
+    #
+    # Still honoured for clients that predate the change, with one correction:
+    # `binds_conversation` now BINDS such a mention when the thread is empty, so a stale
+    # tab lands in the same place a current one does. A mention into a thread that already
+    # has messages keeps the old borrow semantics — that path is unreachable from the
+    # current SPA, and changing it for old clients would annex their conversation.
+    #
+    # A borrowed turn skips the bind-once-per-session validation and skips writing
+    # `preferences.assistant_id`. Everything else — access check, RAG, binding resolution,
+    # memory injection — is identical to a bound turn, because the same Agent is running
+    # with the same governance.
     #
     # ⚠️ It is the *client's* claim about intent, never an access decision:
     # `get_assistant_with_access_check` still gates the Agent itself, so the
diff --git a/backend/src/apis/inference_api/chat/routes.py b/backend/src/apis/inference_api/chat/routes.py
index 3bc00454f..eadd580fc 100644
--- a/backend/src/apis/inference_api/chat/routes.py
+++ b/backend/src/apis/inference_api/chat/routes.py
@@ -195,6 +195,22 @@ async def _do() -> None:
         logger.debug("lease-release shield cancelled; inner release continues")
 
 
+async def _session_has_messages(*, session_id: str, user_id: str) -> bool:
+    """True when the session already carries at least one persisted message.
+
+    Both binding rules turn on this: an Agent may only be attached to a thread that
+    has no history, because history produced under other instructions, tools and
+    skills is exactly what a binding would misrepresent.
+
+    Deliberately `limit=1` — the question is existence, not count, and this runs on
+    the invocation path.
+    """
+    from apis.shared.sessions.messages import get_messages
+
+    response = await get_messages(session_id=session_id, user_id=user_id, limit=1)
+    return bool(response.messages)
+
+
 def is_preview_session(session_id: str) -> bool:
     """Check if a session ID is a preview session (should skip persistence).
 
@@ -1601,8 +1617,19 @@ async def invocations(request: InvocationRequest, current_user: User = Depends(g
     if not is_resume and not is_continuation:
         is_new_session = await ensure_session_metadata_exists(input_data.session_id, user_id)
         try:
-            from apis.shared.sessions.metadata import clear_paused_turn
+            from apis.shared.sessions.metadata import (
+                clear_paused_turn,
+                clear_pending_interrupts,
+            )
             await clear_paused_turn(input_data.session_id, user_id)
+            # The snapshot's breadcrumbs go with it. They are the other half of
+            # the same record, and a breadcrumb that outlives the snapshot
+            # re-renders a prompt the user can no longer answer: the resume
+            # route 400s on an interrupt id the rebuilt agent never saw. Safe
+            # here specifically because this runs at the *head* of a non-resume
+            # turn — any breadcrumb this turn goes on to write lands later, on
+            # its own `done` event.
+            await clear_pending_interrupts(input_data.session_id, user_id)
         except Exception as e:
             logger.error("Failed to clear stale paused_turn on new turn: %s", e, exc_info=True)
 
@@ -1762,7 +1789,26 @@ async def invocations(request: InvocationRequest, current_user: User = Depends(g
         "Invocation request - processing with assistant context"
     )
 
-    if input_data.rag_assistant_id and not is_resume and not is_continuation:
+    # A **continuation** runs this block too, and that is the fix for a long-standing
+    # invisible failure: "Continue" after a max_tokens truncation used to skip the whole
+    # block, so a properly launched Agent conversation finished its reply with none of the
+    # Agent's tools, skills, model or instructions — the same silent capability loss the
+    # `@`-mention used to cause, on the path users are told to use. The SPA already resends
+    # `rag_assistant_id` on a continuation for exactly this reason; only this guard
+    # discarded it.
+    #
+    # Three steps inside stay gated on `not is_continuation`, each for its own reason:
+    # binding **validation** and **persistence** (steps 1 and 6) because a continuation
+    # binds nothing new — it is finishing a turn the binding already governs — and **RAG**
+    # (steps 3/4) because a continuation carries an empty message, so a knowledge-base
+    # search would spend a query on "" and augment nothing. The context the original turn
+    # retrieved is already in the history being continued.
+    #
+    # A **resume** still skips the block entirely: it rebuilds from its `PausedTurnSnapshot`,
+    # which replays the original turn's exact `enabled_tools` / `system_prompt` /
+    # `enabled_skills` in order to reconstruct the same prompt-cache key. Re-resolving here
+    # would risk a different effective set and orphan the paused agent.
+    if input_data.rag_assistant_id and not is_resume:
         # Local imports to avoid circular dependency
         from apis.shared.assistants.kb_access import granted
         from apis.shared.assistants.rag_service import (
@@ -1779,7 +1825,6 @@ async def invocations(request: InvocationRequest, current_user: User = Depends(g
             resolve_invocation_agent,
             resolve_review_agent,
         )
-        from apis.shared.sessions.messages import get_messages
         from apis.shared.sessions.metadata import (
             get_session_metadata,
             store_session_metadata,
@@ -1792,21 +1837,39 @@ async def invocations(request: InvocationRequest, current_user: User = Depends(g
         logger.info("Assistant RAG requested")
         logger.info("Processing for authenticated user")
 
+        # Does the thread already have messages? Only a *mention* turn needs the
+        # answer — for every other turn `binds_conversation` says True regardless —
+        # so this read stays off the hot path rather than costing every bound Agent
+        # turn a query it cannot act on. `None` means "not looked up yet"; the
+        # validation below reuses the value when it is already known.
+        thread_is_empty: Optional[bool] = None
+        if (
+            is_agent_mention
+            and not is_continuation
+            and not is_preview_session(input_data.session_id)
+        ):
+            thread_is_empty = not await _session_has_messages(
+                session_id=input_data.session_id, user_id=user_id
+            )
+
         # 1. Check if session already has an assistant attached
         # If it does, verify it's the same assistant (can't change assistants mid-session)
         # If it doesn't, verify session has no messages (can only attach to new sessions)
         # Skip validation for preview sessions (they don't persist state)
         #
-        # Marketplace D11: an `@`-mention turn skips BOTH rules on purpose. It
-        # borrows the Agent for one turn without binding the conversation, so
-        # "you already have a different Agent" and "this thread already has
-        # messages" are the normal case rather than the error case. The Agent's
-        # own access check below is untouched — skipping this block relaxes
-        # *binding* semantics, never authorization. Rule in
-        # ``agent_binding_policy`` so it is testable without this stack.
-        if binds_conversation(
+        # A mention that *starts* a thread binds it, exactly like launching the Agent:
+        # there is no history produced under other instructions for either rule to
+        # protect, and leaving it unbound is what made the next message silently lose
+        # the Agent's tools. A mention into a thread that already has messages still
+        # skips both rules — the current SPA opens a new conversation instead of
+        # sending one, so this is the legacy-client path. The Agent's own access check
+        # below is untouched either way: this relaxes *binding* semantics, never
+        # authorization. Rule in ``agent_binding_policy`` so it is testable without
+        # this stack.
+        if not is_continuation and binds_conversation(
             is_agent_mention=is_agent_mention,
             is_preview=is_preview_session(input_data.session_id),
+            thread_is_empty=bool(thread_is_empty),
         ):
             try:
                 existing_metadata = await get_session_metadata(input_data.session_id, user_id)
@@ -1825,12 +1888,12 @@ async def invocations(request: InvocationRequest, current_user: User = Depends(g
                     logger.info("Continuing with existing assistant in session")
                 else:
                     # No assistant attached - verify session has no messages (can only attach to new sessions)
-                    messages_response = await get_messages(
-                        session_id=input_data.session_id,
-                        user_id=user_id,
-                        limit=1,  # Only need to check if any messages exist
-                    )
-                    if messages_response.messages and len(messages_response.messages) > 0:
+                    # Reuse the mention path's lookup rather than repeating it.
+                    if thread_is_empty is None:
+                        thread_is_empty = not await _session_has_messages(
+                            session_id=input_data.session_id, user_id=user_id
+                        )
+                    if not thread_is_empty:
                         logger.warning(
                             "Attempted to attach assistant to session with existing messages"
                         )
@@ -2001,7 +2064,10 @@ async def invocations(request: InvocationRequest, current_user: User = Depends(g
                 if await bump_last_used_at(input_data.rag_assistant_id):
                     await resume_inactive_policies(input_data.rag_assistant_id)
             except Exception as bump_err:
-                logger.warning(f"lastUsedAt bump failed for assistant {input_data.rag_assistant_id}: {bump_err}")
+                logger.warning(
+                    f"lastUsedAt bump failed for assistant "
+                    f"{scrub_log(input_data.rag_assistant_id)}: {scrub_log(bump_err)}"
+                )
 
         # 2b. Agent Designer Phase 3 — resolve the Agent's governed capabilities
         # for the INVOKING user (D5), before the expensive KB search. v1 blocks
@@ -2030,39 +2096,43 @@ async def invocations(request: InvocationRequest, current_user: User = Depends(g
                     headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no", "X-Session-ID": input_data.session_id},
                 )
 
-        # 3. Search assistant knowledge base
-        logger.info("Starting knowledge base search for assistant...")
-        try:
-            logger.info("Searching knowledge base for assistant...")
-            context_chunks = await search_assistant_knowledgebase_with_formatting(
-                assistant_id=input_data.rag_assistant_id,
-                query=input_data.message,
-                top_k=5,
-                access=granted(input_data.rag_assistant_id, user_id, assistant_permission),
-            )
-            logger.info(f"Knowledge base search returned {len(context_chunks) if context_chunks else 0} chunks")
-            if context_chunks:
-                for i, chunk in enumerate(context_chunks):
-                    logger.info(f"Chunk {i + 1} retrieved")
-                    logger.info(f"Chunk {i + 1} metadata retrieved")
-
-            # 4. Augment message with context
-            if context_chunks:
-                # Engine-aware cap (Requirement 3.2): managed gets 8,000 so
-                # reranking's top_k chunks actually reach the model; legacy keeps
-                # 2,000. See rag_service.resolve_context_cap / HANDOFF §5.40.
-                cap = resolve_context_cap(input_data.rag_assistant_id)
-                augmented_message = augment_prompt_with_context(user_message=input_data.message, context_chunks=context_chunks, max_context_length=cap)
-                logger.info(
-                    f"Augmented message with {len(context_chunks)} context chunks"
+        # Skipped on a continuation: the turn carries an empty message, so a
+        # knowledge-base search would spend a query on "" and augment nothing. The
+        # context the original turn retrieved is already in the history being continued.
+        if not is_continuation:
+            # 3. Search assistant knowledge base
+            logger.info("Starting knowledge base search for assistant...")
+            try:
+                logger.info("Searching knowledge base for assistant...")
+                context_chunks = await search_assistant_knowledgebase_with_formatting(
+                    assistant_id=input_data.rag_assistant_id,
+                    query=input_data.message,
+                    top_k=5,
+                    access=granted(input_data.rag_assistant_id, user_id, assistant_permission),
                 )
-                logger.info("Augmented message preview available")
-            else:
-                logger.info("No context chunks found for assistant - using original message without augmentation")
-        except Exception as e:
-            logger.error("Error searching assistant knowledge base", exc_info=True)
-            logger.error(f"Exception type: {type(e).__name__}")
-            # Continue without RAG context rather than failing
+                logger.info(f"Knowledge base search returned {len(context_chunks) if context_chunks else 0} chunks")
+                if context_chunks:
+                    for i, chunk in enumerate(context_chunks):
+                        logger.info(f"Chunk {i + 1} retrieved")
+                        logger.info(f"Chunk {i + 1} metadata retrieved")
+
+                # 4. Augment message with context
+                if context_chunks:
+                    # Engine-aware cap (Requirement 3.2): managed gets 8,000 so
+                    # reranking's top_k chunks actually reach the model; legacy keeps
+                    # 2,000. See rag_service.resolve_context_cap / HANDOFF §5.40.
+                    cap = resolve_context_cap(input_data.rag_assistant_id)
+                    augmented_message = augment_prompt_with_context(user_message=input_data.message, context_chunks=context_chunks, max_context_length=cap)
+                    logger.info(
+                        f"Augmented message with {len(context_chunks)} context chunks"
+                    )
+                    logger.info("Augmented message preview available")
+                else:
+                    logger.info("No context chunks found for assistant - using original message without augmentation")
+            except Exception as e:
+                logger.error("Error searching assistant knowledge base", exc_info=True)
+                logger.error(f"Exception type: {type(e).__name__}")
+                # Continue without RAG context rather than failing
 
         # 5. Append assistant's instructions to the base system prompt (don't replace)
         # For preview sessions, prefer the system_prompt from the request (live form edits)
@@ -2128,19 +2198,19 @@ async def invocations(request: InvocationRequest, current_user: User = Depends(g
                 logger.error("Failed to hydrate bound Memory Space; continuing", exc_info=True)
 
         # 6. Save assistant_id to session preferences (persist for future loads)
-        # Skip persistence for preview sessions
+        # Skip persistence for preview sessions and for continuations (a continuation
+        # binds nothing new — it is finishing a turn the binding already governs).
         #
-        # Marketplace D11: a mention turn deliberately writes nothing. Persisting
-        # here would silently convert the whole conversation to the Agent — the
-        # SPA self-heals its `assistantId` query param from these preferences on
-        # reload — so one `@` would bind the thread forever, which is the exact
-        # behavior the per-turn design rejects. Same predicate as the validation
-        # above, deliberately: validating without persisting would refuse the
-        # second mention in a thread, and persisting without validating would let
-        # a mention annex the conversation.
-        if binds_conversation(
+        # ⚠️ Must use the SAME predicate, with the same arguments, as the validation
+        # above. Validating without persisting refuses the second mention in a thread;
+        # persisting without validating lets a mention annex a conversation whose
+        # history was produced under other instructions. `thread_is_empty` is the
+        # argument that makes a thread-starting mention bind, so it has to be passed
+        # here too — dropping it is a silent one-turn Agent all over again.
+        if not is_continuation and binds_conversation(
             is_agent_mention=is_agent_mention,
             is_preview=is_preview_session(input_data.session_id),
+            thread_is_empty=bool(thread_is_empty),
         ):
             try:
                 existing_metadata = await get_session_metadata(input_data.session_id, user_id)
diff --git a/backend/src/apis/shared/feature_flags.py b/backend/src/apis/shared/feature_flags.py
index 0c2be954b..31555cb95 100644
--- a/backend/src/apis/shared/feature_flags.py
+++ b/backend/src/apis/shared/feature_flags.py
@@ -284,6 +284,30 @@ def tool_summaries_enabled() -> bool:
     return os.environ.get("TOOL_SUMMARIES_ENABLED", "").strip().lower() != "false"
 
 
+def cost_diagnostics_enabled() -> bool:
+    """Whether the content-free behavioral counters are written at turn end.
+
+    Covers the ``ToolCensusHook`` tally (tool name → calls/errors per model
+    call, persisted as ``toolCalls`` on the call's ``C#`` cost row), the
+    ``toolCallCount`` / ``toolErrorCount`` session rollups, and the
+    ``compactionCount`` session counter. These are what the admin session
+    profile reads to say *what the user was doing* without reading the
+    conversation. **Default ON with a kill switch** (house style): unset or
+    empty resolves to enabled; only the literal ``"false"`` disables.
+
+    Read-side surfaces (``GET /admin/costs/.../profile``) are not gated —
+    they tolerate the attributes' absence and report "not tracked", which is
+    exactly what an environment with this switched off should see.
+
+    Cost note (CLAUDE.md token-effectiveness tenet): every write here is
+    additive to rows the turn already writes (one extra attribute on the
+    ``C#`` put, two ``ADD`` terms on the existing session-aggregate
+    ``UpdateItem``, one ``ADD`` on the existing compaction-state update).
+    Nothing reaches the prompt; the cacheable prefix is untouched.
+    """
+    return os.environ.get("COST_DIAGNOSTICS_ENABLED", "").strip().lower() != "false"
+
+
 def config_cache_enabled() -> bool:
     """Whether tenant-global config catalogs are served from the in-process cache.
 
@@ -303,3 +327,28 @@ def config_cache_enabled() -> bool:
     within ``CONFIG_CACHE_TTL_SECONDS`` (default 60).
     """
     return os.environ.get("CONFIG_CACHE_ENABLED", "").strip().lower() != "false"
+
+
+def ask_user_question_enabled() -> bool:
+    """Whether the agent can pause a turn to ask the user structured questions.
+
+    Covers the ``ask_user_question`` built-in tool, its Strands interrupt, the
+    ``user_question_required`` SSE event and the ``user_question``
+    ``PendingInterrupt`` breadcrumb. **Default ON with a kill switch** (house
+    style): unset or empty resolves to enabled; only the literal ``"false"``
+    (case-insensitive) disables.
+
+    While off the tool is never registered, so it never reaches ``toolConfig``
+    and the model cannot call it; the agent falls back to asking in prose,
+    which is what it did before this shipped. The tool also re-checks the flag
+    at call time so a registry built before a flip cannot pause a turn behind
+    a prompt no client is listening for.
+
+    Cost note (CLAUDE.md token-effectiveness tenet): flipping this flag changes
+    ``toolConfig`` and therefore re-writes the cacheable prefix once per
+    session in flight at the time — the ordinary cost of a deploy-time tool
+    change, not a per-turn one. Do **not** derive this flag from conversation
+    state to "only offer questions sometimes": that would re-write the prefix
+    every time it flipped.
+    """
+    return os.environ.get("ASK_USER_QUESTION_ENABLED", "").strip().lower() != "false"
diff --git a/backend/src/apis/shared/files/repository.py b/backend/src/apis/shared/files/repository.py
index 51f3ebfc5..cce1a1dc5 100644
--- a/backend/src/apis/shared/files/repository.py
+++ b/backend/src/apis/shared/files/repository.py
@@ -287,6 +287,51 @@ async def list_session_files(
             logger.error(f"Error listing files for session {session_id}: {e}")
             raise
 
+    async def list_session_file_stats(self, session_id: str) -> List[dict]:
+        """Content-free upload stats for one session — admin diagnostics.
+
+        Same ``SessionIndex`` query as :meth:`list_session_files`, but projects
+        only ``uploadId, sessionId, sizeBytes, mimeType, source, status,
+        createdAt``. ``filename``, ``s3Key`` and ``s3Uri`` carry the user's
+        chosen file name and never leave DynamoDB on this path. Returns plain
+        dicts (``sizeBytes`` as ``int``), not ``FileMetadata``, because that
+        model requires the very fields this read refuses to fetch.
+        """
+        from apis.shared.observability.content_policy import (
+            FILE_ROW_PROJECTION,
+            build_projection,
+            strip_content,
+        )
+
+        projection, names = build_projection(FILE_ROW_PROJECTION)
+        try:
+            query_params = {
+                "IndexName": "SessionIndex",
+                "KeyConditionExpression": "GSI1PK = :pk",
+                "ExpressionAttributeValues": {":pk": f"CONV#{session_id}"},
+                "ProjectionExpression": projection,
+                "ExpressionAttributeNames": names,
+            }
+            response = self._table.query(**query_params)
+            items = response.get("Items", [])
+            while "LastEvaluatedKey" in response:
+                query_params["ExclusiveStartKey"] = response["LastEvaluatedKey"]
+                response = self._table.query(**query_params)
+                items.extend(response.get("Items", []))
+
+            stats: List[dict] = []
+            for item in items:
+                row = strip_content(dict(item))
+                size = row.get("sizeBytes")
+                if isinstance(size, Decimal):
+                    row["sizeBytes"] = int(size)
+                stats.append(row)
+            return stats
+
+        except ClientError as e:
+            logger.error(f"Error listing file stats for session {session_id}: {e}")
+            raise
+
     # =========================================================================
     # Quota Operations
     # =========================================================================
diff --git a/backend/src/apis/shared/files/workspace.py b/backend/src/apis/shared/files/workspace.py
index f230fa927..d6a8dc7a6 100644
--- a/backend/src/apis/shared/files/workspace.py
+++ b/backend/src/apis/shared/files/workspace.py
@@ -404,27 +404,19 @@ async def write_workspace_file(
     await repo.create_file(metadata)
     await repo.increment_quota(user_id, len(data))
 
-    download_url = await asyncio.to_thread(
-        _s3().generate_presigned_url,
-        "get_object",
-        Params={
-            "Bucket": bucket,
-            "Key": s3_key,
-            "ResponseContentType": mime_type,
-            "ResponseContentDisposition": f'attachment; filename="{final_name}"',
-        },
-        ExpiresIn=_DOWNLOAD_URL_TTL,
-    )
-
     logger.info(
         f"[workspace_write] {len(data)} bytes → {final_name} "
         f"(upload_id={upload_id}, source={source})"
     )
+    # No presigned URL here: the caller's tool result is the model's context as
+    # well as the UI payload, and a signed URL in it is both ~1,400 tokens of
+    # permanent prefix and something the model re-emits in prose with the query
+    # string truncated. The SPA resolves `upload_id` through
+    # `GET /api/files/{uploadId}/download`, which mints a fresh URL per click.
     return {
         "upload_id": upload_id,
         "filename": final_name,
         "mime_type": mime_type,
         "size_bytes": len(data),
         "size_kb": f"{len(data) / 1024:.1f} KB",
-        "download_url": download_url,
     }
diff --git a/backend/src/apis/shared/observability/content_policy.py b/backend/src/apis/shared/observability/content_policy.py
new file mode 100644
index 000000000..795485d28
--- /dev/null
+++ b/backend/src/apis/shared/observability/content_policy.py
@@ -0,0 +1,251 @@
+"""Content-free projections for the admin cost surfaces.
+
+An admin diagnosing a conversation's spend must be able to do it without
+reading the conversation. That is a property of the *data path*, not of the
+page: if a storage read pulls ``citations[].text`` and the response model just
+happens not to render it, the text still crossed the wire, sat in a log
+line's ``%r``, and is one refactor away from a column. So the rule is enforced
+where the bytes leave DynamoDB — every read behind the per-user conversation
+list and the session profile projects an explicit attribute allowlist, and a
+test walks both the projections and the response models against the denylist
+below.
+
+The denylist is the inventory of every attribute on the ``sessions-metadata``,
+``user-file-uploads`` row families that carries user text or model-generated
+prose. It is deliberately a list of *paths*, not a heuristic: a new attribute
+is content-bearing when someone says so here, and the test fails until they do.
+
+Two readers deliberately read one denylisted attribute — ``compaction.summary``
+— because its **length** is a diagnostic (a summary that is 40% of the window
+guarantees the compaction spiral, #833 D2). They measure it and drop the string
+before returning, the same discipline ``scripts/scan_fleet_prefix_spend.py``
+uses. The contract the test enforces is therefore on what the reader *returns*,
+not only on what it requests: no dict that leaves these readers contains a
+content-bearing path.
+
+Lives in ``apis.shared`` because both the storage layer and the admin service
+need it, and ``apis.shared`` may import neither.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, FrozenSet, Iterable, List, Sequence, Tuple
+
+# ---------------------------------------------------------------------------
+# Denylist — attribute paths that carry user text or model-generated prose.
+# A path denies itself and everything beneath it (``pausedTurn`` denies
+# ``pausedTurn.modelId``); a dotted path denies only that leaf
+# (``compaction.summary`` leaves ``compaction.checkpoint`` alone).
+# ---------------------------------------------------------------------------
+CONTENT_BEARING: FrozenSet[str] = frozenset({
+    # S# session rows
+    "title",                          # LLM-generated from the first user message
+    "tags",                           # user-typed
+    "preferences.customPromptText",   # user-authored system prompt
+    "compaction.summary",             # model-generated conversation summary
+    "pendingInterrupts",              # tool_input + prompt text
+    "pausedTurn",                     # turn-construction snapshot, may carry prompt context
+    "exportReceipts",                 # fileName + webViewLink
+    # C# per-call cost rows
+    "citations",                      # text (≤500 chars of a KB document) + fileName
+    "displayText",                    # the user's original message
+    # TSUM# / APPCARD# / UIRES# / LEASE# / SCHEDPROMPT# / RUN#
+    "summary",                        # tool-batch prose
+    "content",                        # tool-result blocks
+    "arguments",                      # tool arguments
+    "htmlGz",                         # model-produced App HTML
+    "steerQueue",                     # mid-turn follow-up text
+    "promptText",
+    "label",
+    "stateReason",
+    "lastError",
+    "errorDetail",
+    # FILE# upload rows
+    "filename",                       # user-chosen
+    "s3Key",                          # embeds the filename
+    "s3Uri",
+})
+
+#: The one path a content-free reader may *request* but must never *return*.
+MEASURED_ONLY: FrozenSet[str] = frozenset({"compaction.summary"})
+
+
+def is_content_bearing(path: str) -> bool:
+    """True if any contiguous run of ``path``'s segments is a denylisted path.
+
+    Rows get embedded under arbitrary keys on the way out (``calls[]`` in the
+    anatomy, ``sessions[]`` in a list response), so ``calls.citations.text``
+    must be caught by the ``citations`` entry and ``sessions.title`` by
+    ``title``. A denied path also denies everything beneath it
+    (``pausedTurn.modelId``), while a dotted entry denies only that leaf
+    (``compaction.summary`` leaves ``compaction.checkpoint`` alone).
+    """
+    parts = path.split(".")
+    for start in range(len(parts)):
+        for end in range(start + 1, len(parts) + 1):
+            if ".".join(parts[start:end]) in CONTENT_BEARING:
+                return True
+    return False
+
+
+# ---------------------------------------------------------------------------
+# Allowlisted projections. Tuples of attribute paths; ``build_projection``
+# turns them into a DynamoDB ProjectionExpression with every segment aliased,
+# so reserved words (``status``, ``timestamp``, ``cost``, ``source``) never
+# need case-by-case handling.
+# ---------------------------------------------------------------------------
+
+#: S# rows for the per-user conversation list and the session profile.
+SESSION_ROW_PROJECTION: Tuple[str, ...] = (
+    "sessionId",
+    "userId",
+    "status",
+    "deleted",
+    "createdAt",
+    "lastMessageAt",
+    "messageCount",
+    "totalCost",
+    "lastContextTokens",
+    "contextWindow",
+    "totalCacheReadTokens",
+    "totalCacheWriteTokens",
+    "avoidableMissCount",
+    "partialMissCount",
+    "wastedUsd",
+    "partialMissUsd",
+    "preferences.lastModel",
+    "preferences.enabledTools",
+    "preferences.assistantId",
+    "preferences.agentType",
+    "compaction.checkpoint",
+    "compaction.truncationAnchor",
+    "compaction.totalSummarizedTurns",
+    "compaction.lastInputTokens",
+    "compaction.updatedAt",
+    "compaction.summary",   # MEASURED_ONLY — length reported as summaryChars, string dropped
+    # Behavioral counters (optional; absent on rows written before they shipped)
+    "toolCallCount",
+    "toolErrorCount",
+    "compactionCount",
+)
+
+#: C# rows for the cost anatomy and the session profile's trajectory.
+CALL_ROW_PROJECTION: Tuple[str, ...] = (
+    "sessionId",
+    "messageId",
+    "timestamp",
+    "modelInfo.modelId",
+    "tokenUsage",
+    "cost",
+    "cacheStatus",
+    "cacheGapSeconds",
+    "cachePrefixGapSeconds",
+    "wastedUsd",
+    "agentSwitched",
+    "turnAgentId",
+    "prefixFingerprints",
+    "contextWindow",
+    "toolCalls",            # per-call census, optional (PR-3)
+)
+
+#: FILE# rows for the session profile's attachment summary.
+FILE_ROW_PROJECTION: Tuple[str, ...] = (
+    "uploadId",
+    "sessionId",
+    "sizeBytes",
+    "mimeType",
+    "source",
+    "status",
+    "createdAt",
+)
+
+ALL_PROJECTIONS: Dict[str, Tuple[str, ...]] = {
+    "SESSION_ROW_PROJECTION": SESSION_ROW_PROJECTION,
+    "CALL_ROW_PROJECTION": CALL_ROW_PROJECTION,
+    "FILE_ROW_PROJECTION": FILE_ROW_PROJECTION,
+}
+
+
+def build_projection(paths: Sequence[str]) -> Tuple[str, Dict[str, str]]:
+    """Render ``paths`` as ``(ProjectionExpression, ExpressionAttributeNames)``.
+
+    Every path segment is aliased (``#p0.#p1``) so the expression is valid
+    regardless of DynamoDB reserved words. Aliases are shared across paths that
+    reuse a segment (``preferences.lastModel`` and ``preferences.enabledTools``
+    share ``#preferences``), keeping the names map small and deterministic.
+    """
+    names: Dict[str, str] = {}
+    aliases: Dict[str, str] = {}
+    rendered: List[str] = []
+    for path in paths:
+        parts = []
+        for segment in path.split("."):
+            alias = aliases.get(segment)
+            if alias is None:
+                alias = f"#cf{len(aliases)}"
+                aliases[segment] = alias
+                names[alias] = segment
+            parts.append(alias)
+        rendered.append(".".join(parts))
+    return ", ".join(rendered), names
+
+
+def content_bearing_paths(obj: Any, prefix: str = "") -> List[str]:
+    """Walk a dict/list payload and return every content-bearing path found.
+
+    Used by the test suite against both raw storage results and serialized
+    response models, and by the readers' own post-processing as a belt-and-
+    braces check in debug builds. Lists are walked without indexing so a
+    finding reads as ``citations`` rather than ``citations.3``.
+    """
+    found: List[str] = []
+    if isinstance(obj, dict):
+        for key, value in obj.items():
+            path = f"{prefix}.{key}" if prefix else str(key)
+            if is_content_bearing(path):
+                found.append(path)
+                continue
+            found.extend(content_bearing_paths(value, path))
+    elif isinstance(obj, list):
+        for value in obj:
+            found.extend(content_bearing_paths(value, prefix))
+    return found
+
+
+def strip_content(obj: Any, prefix: str = "") -> Any:
+    """Return a deep copy of ``obj`` with every content-bearing path removed.
+
+    Defensive final step for the content-free readers: even if a projection is
+    widened by mistake, nothing denylisted leaves the storage layer.
+    """
+    if isinstance(obj, dict):
+        out: Dict[str, Any] = {}
+        for key, value in obj.items():
+            path = f"{prefix}.{key}" if prefix else str(key)
+            if is_content_bearing(path):
+                continue
+            out[key] = strip_content(value, path)
+        return out
+    if isinstance(obj, list):
+        return [strip_content(value, prefix) for value in obj]
+    return obj
+
+
+def measure_compaction_summary(item: Dict[str, Any]) -> Dict[str, Any]:
+    """Replace ``compaction.summary`` with its length as ``compaction.summaryChars``.
+
+    Mutates and returns ``item``. A missing or non-string summary yields no
+    ``summaryChars`` key, so a reader can tell "never compacted" from "empty".
+    """
+    compaction = item.get("compaction")
+    if isinstance(compaction, dict):
+        summary = compaction.pop("summary", None)
+        if isinstance(summary, str):
+            compaction["summaryChars"] = len(summary)
+    return item
+
+
+def allowlisted_keys(paths: Iterable[str], parent: str) -> FrozenSet[str]:
+    """The leaf names allowlisted directly under ``parent`` (e.g. ``preferences``)."""
+    prefix = parent + "."
+    return frozenset(p[len(prefix):] for p in paths if p.startswith(prefix) and "." not in p[len(prefix):])
diff --git a/backend/src/apis/shared/sessions/metadata.py b/backend/src/apis/shared/sessions/metadata.py
index 93ae58864..8d336ae80 100644
--- a/backend/src/apis/shared/sessions/metadata.py
+++ b/backend/src/apis/shared/sessions/metadata.py
@@ -1729,6 +1729,20 @@ async def _bump_session_aggregates(
         # A split of :wasted, not a deduction from it.
         values[":partialWasted"] = wasted_decimal if is_partial_miss else Decimal("0")
 
+        # Content-free behavioral rollups for the admin session profile: how
+        # many tool calls this session has made and how many failed, summed
+        # from the per-call census the coordinator attached as `toolCalls`.
+        # Only written while the census is on — an absent attribute is what
+        # lets the profile say "not tracked" instead of an honest-looking 0.
+        from apis.shared.feature_flags import cost_diagnostics_enabled
+
+        if cost_diagnostics_enabled():
+            tool_calls_total, tool_errors_total = _tool_census_totals(message_metadata)
+            update_parts_add.append("toolCallCount :toolCalls")
+            update_parts_add.append("toolErrorCount :toolErrors")
+            values[":toolCalls"] = tool_calls_total
+            values[":toolErrors"] = tool_errors_total
+
         update_expression = (
             "ADD " + ", ".join(update_parts_add) + " SET " + ", ".join(update_parts_set)
         )
@@ -1750,6 +1764,29 @@ async def _bump_session_aggregates(
         logger.debug("bump_session_aggregates failed (will be backfilled on read): %s", e)
 
 
+def _tool_census_totals(message_metadata: Any) -> tuple[int, int]:
+    """``(calls, errors)`` summed over the call's ``toolCalls`` extra field.
+
+    The field is ``{tool_name: {"calls": n, "errors": e}}`` when the
+    coordinator attached one, and absent otherwise; malformed entries count as
+    zero rather than raising — the aggregate bump must never fail on it.
+    """
+    extra = getattr(message_metadata, "model_extra", None)
+    tool_calls = extra.get("toolCalls") if isinstance(extra, dict) else None
+    if not isinstance(tool_calls, dict):
+        return 0, 0
+    calls = errors = 0
+    for entry in tool_calls.values():
+        if not isinstance(entry, dict):
+            continue
+        try:
+            calls += int(entry.get("calls") or 0)
+            errors += int(entry.get("errors") or 0)
+        except (TypeError, ValueError):
+            continue
+    return calls, errors
+
+
 def _emit_session_cache_rollup_metrics(
     session_id: str,
     update_response: Optional[Dict[str, Any]],
@@ -2743,6 +2780,67 @@ async def remove_pending_interrupts(
         logger.error("Failed to remove pending_interrupts: %s", e, exc_info=True)
 
 
+async def clear_pending_interrupts(session_id: str, user_id: str) -> None:
+    """Drop every pending-interrupt breadcrumb for a session.
+
+    Distinct from :func:`remove_pending_interrupts`, which drops specific ids
+    as they are resolved. This is the "supersede" form, for when a fresh turn
+    abandons a paused one: the breadcrumbs are one of only two records of that
+    turn, and once its ``pausedTurn`` snapshot is gone the turn can no longer
+    be resumed at all.
+
+    A breadcrumb that outlives its snapshot re-renders a prompt whose only
+    working action is dismissal — the resume route 400s on an interrupt id the
+    rebuilt agent has never heard of, so the user gets an error for answering
+    the question the app just asked them. Nothing used to clear them on
+    abandonment: the two ``remove_pending_interrupts`` call sites are resume
+    cleanup and the explicit dismiss endpoint, neither of which a user reaches
+    by simply typing something else.
+
+    Deliberately NOT folded into ``clear_paused_turn``. That function clears
+    only the snapshot, which ``test_paused_turn_independent_of_pending_interrupts``
+    pins on purpose, and it is also called on the resume-success and
+    expired-snapshot paths where the narrower cleanup is already correct. The
+    supersede policy belongs at the call site that owns it, next to
+    ``clear_interrupted_turn`` and ``clear_truncated_turn``.
+
+    Best-effort: a write failure logs but never breaks the turn.
+    """
+    sessions_metadata_table = os.environ.get("DYNAMODB_SESSIONS_METADATA_TABLE_NAME")
+    if not sessions_metadata_table:
+        return
+
+    try:
+        import boto3
+
+        dynamodb = boto3.resource("dynamodb")
+        table = dynamodb.Table(sessions_metadata_table)
+
+        existing = await _get_session_by_gsi(session_id, user_id, table)
+        if not existing:
+            return
+
+        sk = existing.get("SK")
+        if not sk:
+            return
+
+        current = existing.get("pendingInterrupts") or []
+        if not current:
+            return  # Already clear
+
+        table.update_item(
+            Key={"PK": f"USER#{user_id}", "SK": sk},
+            UpdateExpression="REMOVE #pi",
+            ExpressionAttributeNames={"#pi": "pendingInterrupts"},
+        )
+        logger.info(
+            "Cleared %d superseded pending_interrupt(s) for session %s",
+            len(current), session_id,
+        )
+    except Exception as e:
+        logger.error("Failed to clear pending_interrupts: %s", e, exc_info=True)
+
+
 async def get_pending_interrupts(session_id: str, user_id: str) -> List[PendingInterrupt]:
     """Return the current pending OAuth interrupts for a session.
 
diff --git a/backend/src/apis/shared/sessions/models.py b/backend/src/apis/shared/sessions/models.py
index 40c11d4d0..82dc611b0 100644
--- a/backend/src/apis/shared/sessions/models.py
+++ b/backend/src/apis/shared/sessions/models.py
@@ -27,7 +27,7 @@ class PendingInterrupt(BaseModel):
     reload — without it, a browser refresh leaves the prompt stuck and the
     tool call orphaned in ``pending`` forever.
 
-    Two variants share this shape (discriminated by ``kind``):
+    Three variants share this shape (discriminated by ``kind``):
 
     - ``oauth`` — written by ``OAuthConsentHook``. Carries ``provider_id``;
       the frontend re-fetches a fresh consent URL via ``initiate-consent``
@@ -38,6 +38,12 @@ class PendingInterrupt(BaseModel):
       ``tool_input`` is stored as a JSON-encoded string to avoid DynamoDB's
       Decimal/float coercion when the agent's tool input contains nested
       objects with floats.
+    - ``user_question`` — written for the ``ask_user_question`` tool's own
+      interrupt. Carries ``questions`` (JSON-encoded, same reasoning as
+      ``tool_input``) so the picker rehydrates with the questions the user was
+      already looking at. Unlike the other two this interrupt is raised by the
+      tool itself via ``ToolContext``, not by a hook — the persisted shape and
+      the resume path are identical either way.
 
     Default ``kind`` is ``oauth`` for backward compatibility with rows
     written before per-tool approval shipped.
@@ -45,7 +51,7 @@ class PendingInterrupt(BaseModel):
 
     model_config = ConfigDict(populate_by_name=True)
     interrupt_id: str = Field(..., alias="interruptId", description="Strands interrupt id used to resume the paused turn")
-    kind: Literal["oauth", "tool_approval"] = Field(
+    kind: Literal["oauth", "tool_approval", "user_question"] = Field(
         default="oauth",
         description="Discriminator: which variant this interrupt represents",
     )
@@ -84,6 +90,12 @@ class PendingInterrupt(BaseModel):
         description="(tool_approval) Admin-supplied or default approval message",
     )
 
+    # user_question-only fields
+    questions: Optional[str] = Field(
+        default=None,
+        description="(user_question) JSON-encoded list of questions to re-render",
+    )
+
 
 class PausedTurnSnapshot(BaseModel):
     """Frozen agent-construction context for a turn that paused on OAuth consent.
diff --git a/backend/src/apis/shared/storage/dynamodb_storage.py b/backend/src/apis/shared/storage/dynamodb_storage.py
index 101e6653b..8faaf08af 100644
--- a/backend/src/apis/shared/storage/dynamodb_storage.py
+++ b/backend/src/apis/shared/storage/dynamodb_storage.py
@@ -292,6 +292,17 @@ async def get_session_cost_records(
                 GSI_SK: begins_with C#  (C#<timestamp> — chronological sort)
         """
         from boto3.dynamodb.conditions import Key
+        from apis.shared.observability.content_policy import (
+            CALL_ROW_PROJECTION,
+            build_projection,
+            strip_content,
+        )
+
+        # Content-free at the storage boundary: the anatomy consumes token
+        # splits, cost, cache status and fingerprint hashes. `citations[].text`
+        # (retrieved document excerpts) and `displayText` live on the same
+        # item and must not leave DynamoDB on an admin read.
+        projection, names = build_projection(CALL_ROW_PROJECTION)
 
         try:
             items: List[Dict[str, Any]] = []
@@ -304,6 +315,8 @@ async def get_session_cost_records(
                         & Key("GSI_SK").begins_with("C#")
                     ),
                     "ScanIndexForward": True,
+                    "ProjectionExpression": projection,
+                    "ExpressionAttributeNames": names,
                 }
                 if last_evaluated_key:
                     query_kwargs["ExclusiveStartKey"] = last_evaluated_key
@@ -318,12 +331,50 @@ async def get_session_cost_records(
                 item_float = self._convert_decimal_to_float(item)
                 for key in ["PK", "SK", "GSI_PK", "GSI_SK", "GSI1PK", "GSI1SK", "ttl"]:
                     item_float.pop(key, None)
-                results.append(item_float)
+                results.append(strip_content(item_float))
             return results
 
         except ClientError as e:
             raise Exception(f"Failed to get session cost records: {e}")
 
+    async def get_session_diagnostic_row(
+        self,
+        session_id: str,
+    ) -> Optional[Dict[str, Any]]:
+        """One session's metadata row by session id, content-free — admin scope.
+
+        Resolves the row through ``SessionLookupIndex`` (``GSI_PK=SESSION#<id>``,
+        ``GSI_SK=META``) because an admin holds the session id, not the owner's
+        user id. Applies the same projection and post-processing as
+        :meth:`get_user_session_diagnostics`, so the two can never disagree
+        about what leaves the storage layer. Returns ``None`` when the session
+        has no metadata row.
+        """
+        from boto3.dynamodb.conditions import Key
+        from apis.shared.observability.content_policy import (
+            SESSION_ROW_PROJECTION,
+            build_projection,
+        )
+
+        projection, names = build_projection(SESSION_ROW_PROJECTION)
+        try:
+            response = self.sessions_metadata_table.query(
+                IndexName="SessionLookupIndex",
+                KeyConditionExpression=(
+                    Key("GSI_PK").eq(f"SESSION#{session_id}") & Key("GSI_SK").eq("META")
+                ),
+                ProjectionExpression=projection,
+                ExpressionAttributeNames=names,
+                Limit=1,
+            )
+        except ClientError as e:
+            raise Exception(f"Failed to get session diagnostic row: {e}")
+
+        items = response.get("Items", [])
+        if not items:
+            return None
+        return self._content_free_session_row(self._convert_decimal_to_float(items[0]))
+
     async def get_user_cost_summary(
         self,
         user_id: str,
@@ -754,6 +805,66 @@ async def get_user_session_costs(
         Returns:
             Session dicts with cost/context aggregates, unsorted.
         """
+        # `title` is deliberately part of this projection: the "most expensive
+        # conversations" table shows it by decision. It is the one
+        # content-bearing attribute on the admin cost surface; the per-user
+        # list and the session profile read through
+        # `get_user_session_diagnostics` instead and do not inherit it.
+        return await self._query_user_session_rows(
+            user_id=user_id,
+            active_since=active_since,
+            projection=(
+                "sessionId, userId, title, totalCost, lastMessageAt, "
+                "createdAt, messageCount, lastContextTokens, "
+                "partialMissCount, partialMissUsd, deleted"
+            ),
+            names=None,
+        )
+
+    async def get_user_session_diagnostics(
+        self,
+        user_id: str,
+        active_since: Optional[str] = None,
+    ) -> List[Dict[str, Any]]:
+        """One user's session rows, content-free, with everything a diagnostic
+        list needs: cost/cache rollups, context, model, enabled tool ids, agent
+        binding, compaction coordinates and the behavioral counters.
+
+        Same bounded base-table query as :meth:`get_user_session_costs`; the
+        difference is the projection (``SESSION_ROW_PROJECTION``) and the
+        post-processing: ``compaction.summary`` is measured into
+        ``compaction.summaryChars`` and dropped, ``preferences`` is reduced to
+        its allowlisted keys, and a final ``strip_content`` guarantees no
+        denylisted path leaves this method even if the projection is widened.
+        """
+        from apis.shared.observability.content_policy import (
+            SESSION_ROW_PROJECTION,
+            build_projection,
+        )
+
+        projection, names = build_projection(SESSION_ROW_PROJECTION)
+        items = await self._query_user_session_rows(
+            user_id=user_id,
+            active_since=active_since,
+            projection=projection,
+            names=names,
+        )
+        return [self._content_free_session_row(item) for item in items]
+
+    async def _query_user_session_rows(
+        self,
+        user_id: str,
+        active_since: Optional[str],
+        projection: str,
+        names: Optional[Dict[str, str]],
+    ) -> List[Dict[str, Any]]:
+        """Shared body of the two per-user session readers.
+
+        ``PK = USER#<id>``, ``SK begins_with S#`` — matches both the static
+        (``S#<id>``) and legacy (``S#ACTIVE#…``) schemes and no other row
+        family. Paginates, converts Decimals, drops soft-deleted rows, and
+        applies ``active_since`` client-side (``lastMessageAt`` is not a key).
+        """
         from boto3.dynamodb.conditions import Key
 
         try:
@@ -764,12 +875,10 @@ async def get_user_session_costs(
                     "KeyConditionExpression": (
                         Key("PK").eq(f"USER#{user_id}") & Key("SK").begins_with("S#")
                     ),
-                    "ProjectionExpression": (
-                        "sessionId, userId, title, totalCost, lastMessageAt, "
-                        "createdAt, messageCount, lastContextTokens, "
-                        "partialMissCount, partialMissUsd, deleted"
-                    ),
+                    "ProjectionExpression": projection,
                 }
+                if names:
+                    query_kwargs["ExpressionAttributeNames"] = names
                 if last_evaluated_key:
                     query_kwargs["ExclusiveStartKey"] = last_evaluated_key
                 response = self.sessions_metadata_table.query(**query_kwargs)
@@ -793,6 +902,25 @@ async def get_user_session_costs(
         except ClientError as e:
             raise Exception(f"Failed to get session costs for user: {e}")
 
+    @staticmethod
+    def _content_free_session_row(item: Dict[str, Any]) -> Dict[str, Any]:
+        """Post-process one projected session row so nothing content-bearing
+        survives: measure-and-drop the compaction summary, keep only the
+        allowlisted preference keys, then strip defensively."""
+        from apis.shared.observability.content_policy import (
+            SESSION_ROW_PROJECTION,
+            allowlisted_keys,
+            measure_compaction_summary,
+            strip_content,
+        )
+
+        measure_compaction_summary(item)
+        preferences = item.get("preferences")
+        if isinstance(preferences, dict):
+            keep = allowlisted_keys(SESSION_ROW_PROJECTION, "preferences")
+            item["preferences"] = {k: v for k, v in preferences.items() if k in keep}
+        return strip_content(item)
+
     # ============================================================
     # SystemCostRollup Table Methods
     # ============================================================
diff --git a/backend/src/apis/shared/user_questions/__init__.py b/backend/src/apis/shared/user_questions/__init__.py
new file mode 100644
index 000000000..4e2a4f606
--- /dev/null
+++ b/backend/src/apis/shared/user_questions/__init__.py
@@ -0,0 +1,6 @@
+"""Structured clarifying questions the agent can ask mid-turn.
+
+See :mod:`apis.shared.user_questions.models` for the wire contract shared by
+the ``ask_user_question`` tool (producer), the streaming layer (transport),
+and the session-metadata breadcrumb (reload recovery).
+"""
diff --git a/backend/src/apis/shared/user_questions/models.py b/backend/src/apis/shared/user_questions/models.py
new file mode 100644
index 000000000..9938462b3
--- /dev/null
+++ b/backend/src/apis/shared/user_questions/models.py
@@ -0,0 +1,443 @@
+"""Wire contract for the ``ask_user_question`` mid-turn clarification prompt.
+
+The agent asks the user one to four multiple-choice questions, the turn pauses
+on a Strands interrupt, the SPA renders a picker, and the user's selections
+come back as the tool's result. Three components share these shapes:
+
+- ``agents.builtin_tools.ask_user_question`` — raises the interrupt with a
+  normalized ``questions`` payload and formats the answers for the model.
+- ``agents.main_agent.streaming.stream_coordinator`` — turns a pending
+  interrupt into the ``user_question_required`` SSE event.
+- ``apis.shared.sessions.models.PendingInterrupt`` — persists the same
+  questions (JSON-encoded) so a browser refresh rehydrates the picker.
+
+Design notes
+------------
+* **The model's payload is untrusted input.** ``normalize_questions`` clamps
+  counts, trims strings, drops malformed entries and de-duplicates option
+  labels, raising :class:`UserQuestionError` when nothing renderable survives.
+  A tool-visible error is strictly better than an SSE event the SPA cannot
+  render — that would strand the turn paused with no prompt on screen.
+* **Answers arrive in whatever shape the client sent.** ``parse_answers`` is
+  deliberately tolerant (dict-keyed, positional, or a bare string) because a
+  strict parser that rejects an answer leaves the user's only route out of a
+  paused turn broken. Anything unrecognized degrades to "skipped", never to an
+  exception.
+* **Cost.** The tool spec is a constant in ``toolConfig`` and the questions
+  travel on the SSE channel, not in the prompt. Only the formatted answer
+  block re-enters the conversation, which is why ``format_answers`` writes one
+  compact line per question rather than echoing the option catalog back.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from typing import Any, Dict, List, Optional
+
+from pydantic import BaseModel, ConfigDict, Field
+
+logger = logging.getLogger(__name__)
+
+# Bounds mirror the rendered UI: the SPA paginates questions ("1 of 4") and
+# lays options out vertically. Beyond these the picker stops being a quick
+# choice and the model should just ask in prose instead.
+MAX_QUESTIONS = 4
+MIN_OPTIONS = 2
+MAX_OPTIONS = 4
+MAX_HEADER_CHARS = 12
+MAX_QUESTION_CHARS = 200
+MAX_LABEL_CHARS = 80
+MAX_DESCRIPTION_CHARS = 240
+# Free-text ("Other") answers are user-authored and land in the prompt. Bounded
+# for the same reason every other per-turn payload is (CLAUDE.md token tenet).
+MAX_FREE_TEXT_CHARS = 2000
+
+# The picker always renders its own "Other" (with a free-text field) and
+# "Skip". A model-supplied lookalike is worse than a duplicate: picking it
+# records the bare string "Other" as the answer with no way to say what, so the
+# model learns nothing and the user cannot tell the two chips apart. The tool
+# description says not to emit these; measured against real models it is not
+# reliably obeyed (Haiku 4.5 added "Other" on roughly half of sampled turns),
+# so they are stripped here rather than trusted away.
+BANNED_OPTION_LABELS = frozenset(
+    {
+        "other",
+        "other (please specify)",
+        "something else",
+        "skip",
+        "skip this",
+        "none",
+        "none of the above",
+        "no preference",
+        "not sure",
+        "let you decide",
+        "you decide",
+    }
+)
+
+
+class UserQuestionError(ValueError):
+    """The model's ``questions`` argument could not be rendered as a prompt."""
+
+
+class QuestionOption(BaseModel):
+    """One selectable answer."""
+
+    model_config = ConfigDict(populate_by_name=True)
+
+    label: str = Field(..., description="Short display text for the choice")
+    description: Optional[str] = Field(
+        default=None,
+        description="Optional one-line explanation of what the choice means",
+    )
+
+
+class UserQuestion(BaseModel):
+    """One question in the prompt.
+
+    ``header`` is the short chip label the SPA shows above the question and the
+    key answers are correlated by; ``question`` is the full sentence.
+    """
+
+    model_config = ConfigDict(populate_by_name=True)
+
+    header: str = Field(..., description="Short chip label, <= 12 chars")
+    question: str = Field(..., description="The full question text")
+    multi_select: bool = Field(
+        default=False,
+        alias="multiSelect",
+        description="Whether more than one option may be chosen",
+    )
+    options: List[QuestionOption] = Field(..., description="2-4 choices")
+
+
+class UserQuestionAnswer(BaseModel):
+    """The user's response to one question, as parsed from the resume payload."""
+
+    model_config = ConfigDict(populate_by_name=True)
+
+    header: str
+    selected: List[str] = Field(default_factory=list)
+    text: Optional[str] = Field(
+        default=None,
+        description='Free-text answer from the "Other" affordance',
+    )
+    skipped: bool = Field(default=False)
+
+
+class UserQuestionRequiredEvent(BaseModel):
+    """SSE event telling the SPA to render the picker for a paused turn.
+
+    Mirrors ``apis.shared.tool_approval.models.ToolApprovalRequiredEvent``: the
+    SPA renders the prompt, the user answers, and the decision POSTs back to
+    ``/invocations`` as an ``interrupt_responses`` entry keyed by
+    ``interruptId``.
+    """
+
+    model_config = ConfigDict(populate_by_name=True)
+
+    type: str = "user_question_required"
+    interrupt_id: str = Field(..., alias="interruptId")
+    tool_use_id: str = Field(..., alias="toolUseId")
+    questions: List[UserQuestion]
+
+    def to_sse_format(self) -> str:
+        payload = self.model_dump(by_alias=True, exclude_none=True)
+        return (
+            f"event: user_question_required\n"
+            f"data: {json.dumps(payload)}\n\n"
+        )
+
+
+# ---------------------------------------------------------------------------
+# Normalization (model output -> renderable questions)
+# ---------------------------------------------------------------------------
+
+
+def _clean(value: Any, limit: int) -> str:
+    """Coerce to a trimmed, length-capped single-line string."""
+    if value is None:
+        return ""
+    text = str(value).strip()
+    if not text:
+        return ""
+    return text[:limit]
+
+
+def _clean_header(value: Any) -> str:
+    """Trim a header to the chip budget without cutting mid-word.
+
+    A hard slice is what shipped "DASHBOARD PU" to the UI when the model wrote
+    "Dashboard Purpose" — the chip is a label the user reads, and a severed
+    word reads as a rendering bug. Drop whole trailing words instead, and fall
+    back to the hard slice only when the very first word is itself over budget.
+    """
+    text = str(value).strip() if value is not None else ""
+    if not text or len(text) <= MAX_HEADER_CHARS:
+        return text
+
+    words = text.split()
+    kept: List[str] = []
+    for word in words:
+        candidate = " ".join([*kept, word])
+        if len(candidate) > MAX_HEADER_CHARS:
+            break
+        kept.append(word)
+
+    return " ".join(kept) if kept else text[:MAX_HEADER_CHARS]
+
+
+def _normalize_options(raw: Any) -> List[QuestionOption]:
+    """Build the option list, dropping blanks, duplicates and Other/Skip clones.
+
+    Duplicate labels are dropped rather than renamed: two identical choices are
+    indistinguishable to the user, and the answer payload correlates by label.
+
+    Options that restate the picker's own Other/Skip affordances are dropped
+    too — see :data:`BANNED_OPTION_LABELS`. A question that falls below
+    ``MIN_OPTIONS`` as a result is discarded by the caller: the model padded a
+    binary choice with an escape hatch the interface already provides, and the
+    real question is one the picker can still express.
+    """
+    if not isinstance(raw, list):
+        return []
+
+    options: List[QuestionOption] = []
+    seen: set[str] = set()
+    for entry in raw:
+        if isinstance(entry, str):
+            label, description = _clean(entry, MAX_LABEL_CHARS), None
+        elif isinstance(entry, dict):
+            label = _clean(entry.get("label"), MAX_LABEL_CHARS)
+            description = _clean(entry.get("description"), MAX_DESCRIPTION_CHARS) or None
+        else:
+            continue
+
+        if not label:
+            continue
+        folded = label.casefold()
+        if folded in seen:
+            continue
+        if folded.rstrip(".!") in BANNED_OPTION_LABELS:
+            logger.debug("Dropped model-supplied escape-hatch option: %r", label)
+            continue
+        seen.add(folded)
+        options.append(QuestionOption(label=label, description=description))
+        if len(options) == MAX_OPTIONS:
+            break
+
+    return options
+
+
+def normalize_questions(raw: Any) -> List[UserQuestion]:
+    """Validate and clamp the model's ``questions`` argument.
+
+    Args:
+        raw: The tool's ``questions`` parameter, as the model produced it.
+
+    Returns:
+        Between 1 and ``MAX_QUESTIONS`` renderable questions.
+
+    Raises:
+        UserQuestionError: If no question survives normalization. The tool
+            surfaces this to the model as a tool error so it can retry or fall
+            back to asking in prose — far better than pausing the turn behind
+            a prompt the SPA cannot draw.
+    """
+    if not isinstance(raw, list) or not raw:
+        raise UserQuestionError(
+            "`questions` must be a non-empty list of question objects."
+        )
+
+    questions: List[UserQuestion] = []
+    headers: set[str] = set()
+    for entry in raw:
+        if not isinstance(entry, dict):
+            continue
+
+        question_text = _clean(entry.get("question"), MAX_QUESTION_CHARS)
+        if not question_text:
+            continue
+
+        options = _normalize_options(entry.get("options"))
+        if len(options) < MIN_OPTIONS:
+            continue
+
+        # Header is a display convenience; fall back to a positional label so a
+        # model that omits it still gets a renderable (and correlatable) prompt.
+        header = _clean_header(entry.get("header"))
+        if not header:
+            header = f"Q{len(questions) + 1}"
+        # Answers correlate by header, so collisions must not survive.
+        base, suffix = header, 2
+        while header.casefold() in headers:
+            header = f"{base[: MAX_HEADER_CHARS - 2]} {suffix}"
+            suffix += 1
+        headers.add(header.casefold())
+
+        questions.append(
+            UserQuestion(
+                header=header,
+                question=question_text,
+                multi_select=bool(entry.get("multiSelect") or entry.get("multi_select")),
+                options=options,
+            )
+        )
+        if len(questions) == MAX_QUESTIONS:
+            break
+
+    if not questions:
+        raise UserQuestionError(
+            "No renderable question found: each entry needs a `question` string "
+            f"and at least {MIN_OPTIONS} options with non-empty labels."
+        )
+
+    return questions
+
+
+# ---------------------------------------------------------------------------
+# Answer parsing (client resume payload -> answers)
+# ---------------------------------------------------------------------------
+
+
+def _coerce_one_answer(header: str, raw: Any) -> UserQuestionAnswer:
+    """Interpret a single question's answer, however the client shaped it."""
+    if raw is None:
+        return UserQuestionAnswer(header=header, skipped=True)
+
+    if isinstance(raw, str):
+        text = _clean(raw, MAX_FREE_TEXT_CHARS)
+        return UserQuestionAnswer(
+            header=header, selected=[text] if text else [], skipped=not text
+        )
+
+    if isinstance(raw, list):
+        selected = [s for s in (_clean(v, MAX_LABEL_CHARS) for v in raw) if s]
+        return UserQuestionAnswer(
+            header=header, selected=selected, skipped=not selected
+        )
+
+    if isinstance(raw, dict):
+        if raw.get("skipped"):
+            return UserQuestionAnswer(header=header, skipped=True)
+
+        raw_selected = raw.get("selected", raw.get("labels"))
+        if isinstance(raw_selected, str):
+            raw_selected = [raw_selected]
+        selected = [
+            s
+            for s in (
+                _clean(v, MAX_LABEL_CHARS)
+                for v in (raw_selected if isinstance(raw_selected, list) else [])
+            )
+            if s
+        ]
+        text = _clean(raw.get("text", raw.get("other")), MAX_FREE_TEXT_CHARS) or None
+        return UserQuestionAnswer(
+            header=header,
+            selected=selected,
+            text=text,
+            skipped=not selected and not text,
+        )
+
+    return UserQuestionAnswer(header=header, skipped=True)
+
+
+def parse_answers(
+    questions: List[UserQuestion], response: Any
+) -> List[UserQuestionAnswer]:
+    """Map a resume payload onto the questions that were asked.
+
+    Accepted shapes, in the order they are tried:
+
+    * ``{"answers": {"<header>": ...}}`` — the canonical form the SPA sends.
+    * ``{"answers": [...]}`` — positional, aligned with ``questions``.
+    * ``{"skipped": true}`` / ``"skipped"`` — the user dismissed the prompt.
+    * a bare string — a free-text reply, attributed to the first question.
+
+    Never raises. An unrecognized payload yields all-skipped answers, so the
+    turn always resumes: the user's escape hatch out of a pause must not be
+    able to fail on a shape mismatch.
+    """
+    headers = [q.header for q in questions]
+
+    if isinstance(response, str):
+        stripped = response.strip()
+        if stripped.casefold() in {"skipped", "skip", ""}:
+            return [UserQuestionAnswer(header=h, skipped=True) for h in headers]
+        return [
+            _coerce_one_answer(headers[0], stripped),
+            *(UserQuestionAnswer(header=h, skipped=True) for h in headers[1:]),
+        ]
+
+    if not isinstance(response, dict):
+        return [UserQuestionAnswer(header=h, skipped=True) for h in headers]
+
+    if response.get("skipped") and "answers" not in response:
+        return [UserQuestionAnswer(header=h, skipped=True) for h in headers]
+
+    answers = response.get("answers", response)
+
+    if isinstance(answers, dict):
+        lowered = {str(k).casefold(): v for k, v in answers.items()}
+        return [
+            _coerce_one_answer(h, lowered.get(h.casefold()))
+            for h in headers
+        ]
+
+    if isinstance(answers, list):
+        return [
+            _coerce_one_answer(h, answers[i] if i < len(answers) else None)
+            for i, h in enumerate(headers)
+        ]
+
+    return [UserQuestionAnswer(header=h, skipped=True) for h in headers]
+
+
+def format_answers(answers: List[UserQuestionAnswer]) -> str:
+    """Render the answers as the tool result the model reads.
+
+    One line per question, and nothing else: the option catalog the model
+    already wrote is not echoed back, because this text re-enters the
+    conversation and is paid for on every subsequent turn.
+    """
+    lines: List[str] = []
+    for answer in answers:
+        if answer.skipped:
+            lines.append(f"- {answer.header}: (no answer — the user skipped this)")
+            continue
+        parts = list(answer.selected)
+        if answer.text:
+            parts.append(f'"{answer.text}"')
+        lines.append(f"- {answer.header}: {', '.join(parts)}")
+
+    if all(a.skipped for a in answers):
+        return (
+            "The user skipped the questions. Proceed with your best judgement "
+            "and state the assumptions you made; do not ask again.\n"
+            + "\n".join(lines)
+        )
+
+    return "The user answered:\n" + "\n".join(lines)
+
+
+def encode_questions(questions: List[UserQuestion]) -> str:
+    """JSON-encode questions for DynamoDB persistence.
+
+    Stored as a string for the same reason ``PendingInterrupt.tool_input`` is:
+    DynamoDB coerces floats to ``Decimal`` on the way in, and the SPA renders
+    the decoded payload verbatim.
+    """
+    return json.dumps([q.model_dump(by_alias=True, exclude_none=True) for q in questions])
+
+
+def decode_questions(encoded: Optional[str]) -> List[Dict[str, Any]]:
+    """Best-effort inverse of :func:`encode_questions` for the reload path."""
+    if not encoded:
+        return []
+    try:
+        decoded = json.loads(encoded)
+    except (TypeError, ValueError):
+        return []
+    return decoded if isinstance(decoded, list) else []
diff --git a/backend/tests/agents/builtin_tools/test_ask_user_question.py b/backend/tests/agents/builtin_tools/test_ask_user_question.py
new file mode 100644
index 000000000..43c5a58ff
--- /dev/null
+++ b/backend/tests/agents/builtin_tools/test_ask_user_question.py
@@ -0,0 +1,149 @@
+"""The `ask_user_question` tool: pause, then answer.
+
+The tool raises its own Strands interrupt through `ToolContext` rather than
+from a hook, because here the pause *is* the tool. `ToolContext.interrupt`
+re-raises until a response is present and returns it afterwards, so a single
+call site covers both passes — these tests drive each pass separately.
+
+Coverage is the reason payload (the SSE contract downstream reads it verbatim),
+the fail-fast on malformed model output, and the kill switch.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+from unittest.mock import MagicMock
+
+import pytest
+
+from agents.builtin_tools.ask_user_question import (
+    INTERRUPT_NAME,
+    ask_user_question,
+)
+
+# The @tool decorator wraps the function; call the original for unit tests.
+_fn = ask_user_question._tool_func  # type: ignore[attr-defined]
+
+
+def _context(interrupt_response: Any = None, tool_use_id: str = "tu-1"):
+    context = MagicMock()
+    context.tool_use = {"toolUseId": tool_use_id, "name": "ask_user_question"}
+    context.interrupt = MagicMock(return_value=interrupt_response)
+    return context
+
+
+VALID = [
+    {
+        "header": "Scope",
+        "question": "How much should this cover?",
+        "options": [
+            {"label": "Just the API", "description": "Routes only"},
+            {"label": "Everything"},
+        ],
+    }
+]
+
+
+class TestPause:
+    """Req: a valid call pauses the turn with a renderable reason payload."""
+
+    def test_interrupt_is_raised_with_the_tool_scoped_name(self):
+        context = _context(interrupt_response={"skipped": True})
+        _fn(questions=VALID, tool_context=context)
+
+        context.interrupt.assert_called_once()
+        assert context.interrupt.call_args.kwargs["name"] == INTERRUPT_NAME
+
+    def test_reason_payload_is_the_sse_contract(self):
+        """`_extract_user_question_required_events` reads these keys verbatim;
+        a rename here silently stops the prompt from ever reaching the SPA."""
+        context = _context(interrupt_response={"skipped": True})
+        _fn(questions=VALID, tool_context=context)
+
+        reason = context.interrupt.call_args.kwargs["reason"]
+        assert reason["type"] == "user_question_required"
+        assert reason["toolUseId"] == "tu-1"
+        [question] = reason["questions"]
+        assert question["header"] == "Scope"
+        assert question["multiSelect"] is False
+        assert question["options"][0]["label"] == "Just the API"
+        # exclude_none: an option with no description must not ship a null the
+        # SPA would have to special-case.
+        assert "description" not in question["options"][1]
+
+    def test_malformed_questions_never_pause_the_turn(self):
+        """The worst outcome is a pause behind a prompt nothing can draw, so
+        rejection happens before the interrupt, while the model can still fix
+        it."""
+        context = _context()
+        result = _fn(questions=[{"question": "no options?"}], tool_context=context)
+
+        context.interrupt.assert_not_called()
+        assert result["status"] == "error"
+
+
+class TestResume:
+    """Req: the client's answer becomes the model-visible tool result."""
+
+    def test_selections_reach_the_model(self):
+        context = _context(
+            interrupt_response={"answers": {"Scope": {"selected": ["Everything"]}}}
+        )
+        result = _fn(questions=VALID, tool_context=context)
+
+        assert result["status"] == "success"
+        assert "- Scope: Everything" in result["content"][0]["text"]
+
+    def test_skip_resolves_the_call_instead_of_erroring(self):
+        """A skip is an answer, not a failure: the turn continues and the model
+        is told to proceed on its own judgement."""
+        context = _context(interrupt_response={"skipped": True})
+        result = _fn(questions=VALID, tool_context=context)
+
+        assert result["status"] == "success"
+        assert "skipped" in result["content"][0]["text"]
+
+    def test_unrecognized_response_still_resolves(self):
+        """Fail *open*, unlike tool approval. There the safe default is to not
+        run the tool; here the safe default is to not leave the user stuck."""
+        context = _context(interrupt_response={"totally": "unexpected"})
+        result = _fn(questions=VALID, tool_context=context)
+
+        assert result["status"] == "success"
+
+
+class TestKillSwitch:
+    def test_disabled_returns_an_error_without_pausing(self, monkeypatch):
+        monkeypatch.setenv("ASK_USER_QUESTION_ENABLED", "false")
+        context = _context()
+
+        result = _fn(questions=VALID, tool_context=context)
+
+        context.interrupt.assert_not_called()
+        assert result["status"] == "error"
+        assert "disabled" in result["content"][0]["text"]
+
+    @pytest.mark.parametrize("value", ["", "true", "TRUE", "1", "anything"])
+    def test_anything_but_false_is_enabled(self, monkeypatch, value):
+        monkeypatch.setenv("ASK_USER_QUESTION_ENABLED", value)
+        context = _context(interrupt_response={"skipped": True})
+
+        _fn(questions=VALID, tool_context=context)
+
+        context.interrupt.assert_called_once()
+
+
+class TestRegistration:
+    """Req: the kill switch keeps the tool out of `toolConfig` entirely."""
+
+    def test_registered_by_default(self, monkeypatch):
+        monkeypatch.delenv("ASK_USER_QUESTION_ENABLED", raising=False)
+        from agents.main_agent.tools.tool_registry import create_default_registry
+
+        assert create_default_registry().has_tool("ask_user_question")
+
+    def test_absent_when_disabled(self, monkeypatch):
+        monkeypatch.setenv("ASK_USER_QUESTION_ENABLED", "false")
+        from agents.main_agent.tools.tool_registry import create_default_registry
+
+        assert not create_default_registry().has_tool("ask_user_question")
diff --git a/backend/tests/agents/builtin_tools/test_workspace_tools.py b/backend/tests/agents/builtin_tools/test_workspace_tools.py
index 9b63f0e1d..3552679ff 100644
--- a/backend/tests/agents/builtin_tools/test_workspace_tools.py
+++ b/backend/tests/agents/builtin_tools/test_workspace_tools.py
@@ -124,7 +124,6 @@ async def test_returns_workspace_file_download_card(self, monkeypatch):
                 "mime_type": "text/markdown",
                 "size_bytes": 4,
                 "size_kb": "0.0 KB",
-                "download_url": "https://signed.example/f",
             }
         )
         monkeypatch.setattr(f"{MODULE}.write_workspace_file", svc)
@@ -137,9 +136,13 @@ async def test_returns_workspace_file_download_card(self, monkeypatch):
         assert card["ui_display"] == "inline"
         assert card["payload"] == {
             "filename": "report.md",
-            "download_url": "https://signed.example/f",
+            "upload_id": "up1",
             "size_kb": "0.0 KB",
         }
+        # The model reads this same JSON; a signed URL in it gets re-emitted in
+        # prose with the query string truncated (S3 AccessDenied).
+        assert "download_url" not in card["payload"]
+        assert "do not write a download link" in card["summary"]
         svc.assert_awaited_once_with(
             "u1", "s1", "report.md", "# Hi", mime_type="text/markdown"
         )
diff --git a/backend/tests/agents/main_agent/session/test_compaction_stability.py b/backend/tests/agents/main_agent/session/test_compaction_stability.py
index bef500736..ef386e602 100644
--- a/backend/tests/agents/main_agent/session/test_compaction_stability.py
+++ b/backend/tests/agents/main_agent/session/test_compaction_stability.py
@@ -99,7 +99,7 @@ def _restore(state_store: dict, stored_messages: list):
             state_store.get("compaction")
         )
 
-        def _save(state: CompactionState) -> None:
+        def _save(state: CompactionState, record_event: bool = False) -> None:
             state.updated_at = _iso(_now())
             state_store["compaction"] = state.to_dict()
 
@@ -141,7 +141,7 @@ def _make(state_store: dict):
             state_store.get("compaction")
         )
 
-        def _save(state: CompactionState) -> None:
+        def _save(state: CompactionState, record_event: bool = False) -> None:
             state.updated_at = _iso(_now())
             state_store["compaction"] = state.to_dict()
 
diff --git a/backend/tests/agents/main_agent/session/test_tool_census_hook.py b/backend/tests/agents/main_agent/session/test_tool_census_hook.py
new file mode 100644
index 000000000..5916cee0f
--- /dev/null
+++ b/backend/tests/agents/main_agent/session/test_tool_census_hook.py
@@ -0,0 +1,131 @@
+"""Tests for ToolCensusHook — the content-free per-call tool tally.
+
+Properties, in order of how expensive they are to get wrong:
+
+1. **Attribution.** A tool that runs during model-call cycle N belongs to
+   coordinator call index N-1. Off by one and every tool lands on the wrong
+   cost row, and the trajectory view lies about which call requested what.
+2. **Per-turn reset.** The interrupt path unwinds without a turn end; without
+   the ``BeforeInvocationEvent`` reset the next turn inherits a stale tally.
+3. **Non-drained reads.** The coordinator reads each call's tally once at turn
+   end; a read must not empty it (the same call could be read twice on a
+   retry) and must not alias the hook's state.
+4. **Failure counting** matches ``AgentStatusHook``: an exception OR a result
+   with ``status == "error"``.
+5. Fail-soft: the kill switch yields ``None`` everywhere, a malformed event
+   never raises, and the per-call distinct-tool cap holds.
+"""
+
+from unittest.mock import MagicMock
+
+import pytest
+
+from agents.main_agent.session.hooks.tool_census import _MAX_TOOLS_PER_CALL, ToolCensusHook
+
+
+@pytest.fixture(autouse=True)
+def census_enabled(monkeypatch):
+    monkeypatch.delenv("COST_DIAGNOSTICS_ENABLED", raising=False)
+
+
+@pytest.fixture
+def hook():
+    return ToolCensusHook()
+
+
+def _after(name="list_courses", *, exception=None, status="success"):
+    event = MagicMock()
+    event.tool_use = {"toolUseId": "t", "name": name, "input": {}}
+    event.exception = exception
+    event.result = {"status": status, "content": []}
+    return event
+
+
+def _turn(hook: ToolCensusHook, *cycles):
+    """Drive a turn: each element of ``cycles`` is the list of after-tool
+    events that run after that model call."""
+    hook._on_turn_start(MagicMock())
+    for events in cycles:
+        hook._on_before_model_call(MagicMock())
+        for event in events:
+            hook._on_after_tool_call(event)
+
+
+def test_tools_are_attributed_to_the_model_call_that_requested_them(hook):
+    _turn(
+        hook,
+        [_after("list_courses"), _after("list_courses"), _after("get_syllabus")],  # after call 0
+        [],                                                                       # call 1 ran no tools
+        [_after("calculator", status="error")],                                   # after call 2
+    )
+    assert hook.tally_for_call(0) == {
+        "list_courses": {"calls": 2, "errors": 0},
+        "get_syllabus": {"calls": 1, "errors": 0},
+    }
+    assert hook.tally_for_call(1) is None
+    assert hook.tally_for_call(2) == {"calculator": {"calls": 1, "errors": 1}}
+    assert hook.tally_for_call(3) is None  # the final answer call requested nothing
+
+
+def test_a_new_turn_forgets_the_previous_one(hook):
+    _turn(hook, [_after("a")])
+    assert hook.tally_for_call(0) is not None
+    _turn(hook, [])
+    assert hook.tally_for_call(0) is None
+
+
+def test_reads_do_not_drain_and_do_not_alias(hook):
+    _turn(hook, [_after("a")])
+    first = hook.tally_for_call(0)
+    first["a"]["calls"] = 99  # mutate the copy
+    second = hook.tally_for_call(0)
+    assert second == {"a": {"calls": 1, "errors": 0}}
+
+
+def test_failures_count_on_exception_or_error_status(hook):
+    _turn(hook, [
+        _after("t", exception=RuntimeError("boom")),
+        _after("t", status="error"),
+        _after("t"),
+    ])
+    assert hook.tally_for_call(0) == {"t": {"calls": 3, "errors": 2}}
+
+
+def test_kill_switch_records_nothing_and_reads_none(monkeypatch):
+    monkeypatch.setenv("COST_DIAGNOSTICS_ENABLED", "false")
+    hook = ToolCensusHook()
+    _turn(hook, [_after("a")])
+    assert hook.tally_for_call(0) is None
+    assert hook._tally == {}
+
+
+def test_empty_string_flag_means_on(monkeypatch):
+    # A GitHub Actions variable that is unset arrives as "", which must not disable.
+    monkeypatch.setenv("COST_DIAGNOSTICS_ENABLED", "")
+    hook = ToolCensusHook()
+    _turn(hook, [_after("a")])
+    assert hook.tally_for_call(0) == {"a": {"calls": 1, "errors": 0}}
+
+
+def test_malformed_events_never_raise(hook):
+    hook._on_turn_start(MagicMock())
+    hook._on_before_model_call(MagicMock())
+    bad = MagicMock()
+    bad.tool_use = "not-a-dict"
+    hook._on_after_tool_call(bad)
+    nameless = MagicMock()
+    nameless.tool_use = {"toolUseId": "t"}
+    hook._on_after_tool_call(nameless)
+    assert hook.tally_for_call(0) is None
+
+
+def test_distinct_tool_cap_holds_but_known_tools_keep_counting(hook):
+    hook._on_turn_start(MagicMock())
+    hook._on_before_model_call(MagicMock())
+    for i in range(_MAX_TOOLS_PER_CALL + 5):
+        hook._on_after_tool_call(_after(f"tool_{i}"))
+    hook._on_after_tool_call(_after("tool_0"))
+    tally = hook.tally_for_call(0)
+    assert len(tally) == _MAX_TOOLS_PER_CALL
+    assert tally["tool_0"]["calls"] == 2
+    assert f"tool_{_MAX_TOOLS_PER_CALL + 1}" not in tally
diff --git a/backend/tests/agents/main_agent/session/test_turn_based_session_manager.py b/backend/tests/agents/main_agent/session/test_turn_based_session_manager.py
index d943cbae7..f7f337065 100644
--- a/backend/tests/agents/main_agent/session/test_turn_based_session_manager.py
+++ b/backend/tests/agents/main_agent/session/test_turn_based_session_manager.py
@@ -388,6 +388,43 @@ def test_save_noop_when_compaction_disabled(self, make_session_manager, compacti
         # Should not raise
         mgr._save_compaction_state(CompactionState(checkpoint=5))
 
+    def test_record_event_bumps_a_monotonic_compaction_count(
+        self, make_session_manager, compaction_config, dynamodb_sessions_table, monkeypatch
+    ):
+        # The persisted `compaction` map is last-write-wins and cannot say how
+        # many times compaction fired; the top-level counter can, and only a
+        # save that *is* a compaction (record_event=True) moves it.
+        monkeypatch.setenv("DYNAMODB_SESSIONS_METADATA_TABLE_NAME", TABLE_NAME)
+        monkeypatch.delenv("COST_DIAGNOSTICS_ENABLED", raising=False)
+        mgr = make_session_manager(compaction_config=compaction_config)
+        from agents.main_agent.session.turn_based_session_manager import TurnBasedSessionManager
+        TurnBasedSessionManager._dynamodb_table = dynamodb_sessions_table
+        seed_session_record(dynamodb_sessions_table, TEST_SESSION_ID, TEST_USER_ID)
+
+        mgr._save_compaction_state(CompactionState(checkpoint=3), record_event=True)
+        mgr._save_compaction_state(CompactionState(checkpoint=3))  # bookkeeping save, no event
+        mgr._save_compaction_state(CompactionState(checkpoint=7), record_event=True)
+
+        row = mgr._get_session_via_gsi(dynamodb_sessions_table)
+        assert row["compactionCount"] == 2
+        assert row["compaction"]["checkpoint"] == 7
+
+    def test_record_event_respects_the_kill_switch(
+        self, make_session_manager, compaction_config, dynamodb_sessions_table, monkeypatch
+    ):
+        monkeypatch.setenv("DYNAMODB_SESSIONS_METADATA_TABLE_NAME", TABLE_NAME)
+        monkeypatch.setenv("COST_DIAGNOSTICS_ENABLED", "false")
+        mgr = make_session_manager(compaction_config=compaction_config)
+        from agents.main_agent.session.turn_based_session_manager import TurnBasedSessionManager
+        TurnBasedSessionManager._dynamodb_table = dynamodb_sessions_table
+        seed_session_record(dynamodb_sessions_table, TEST_SESSION_ID, TEST_USER_ID)
+
+        mgr._save_compaction_state(CompactionState(checkpoint=3), record_event=True)
+
+        row = mgr._get_session_via_gsi(dynamodb_sessions_table)
+        assert "compactionCount" not in row
+        assert row["compaction"]["checkpoint"] == 3  # the state itself still saves
+
 
 # ===========================================================================
 # Task 6 — LTM summary retrieval
diff --git a/backend/tests/agents/main_agent/session/test_user_question_interrupt_integration.py b/backend/tests/agents/main_agent/session/test_user_question_interrupt_integration.py
new file mode 100644
index 000000000..4d79c5e86
--- /dev/null
+++ b/backend/tests/agents/main_agent/session/test_user_question_interrupt_integration.py
@@ -0,0 +1,261 @@
+"""The integration that de-risks the whole feature: a **tool-scoped** interrupt.
+
+Every interrupt this codebase has shipped so far — OAuth consent, per-tool
+approval — is raised from a `BeforeToolCallEvent` hook. `ask_user_question`
+raises its own from `ToolContext`, and the resume path it depends on
+(`PausedTurnSnapshot` → rebuilt agent → restored `_interrupt_state` →
+`pending_tool_execution` replayed) was built and proven against the hook
+flavor only.
+
+A mocked `interrupt()` proves nothing about that. The question is whether
+Strands' event loop treats a tool-raised interrupt identically — whether
+`_stop_for_interrupts` captures the same `pending_tool_execution`, and whether
+resuming feeds the response back into the *same* tool call rather than
+re-invoking it or dropping the batch. So this drives the real loop: a real
+`Agent`, the real `@tool`, the real interrupt protocol. Only the model is
+scripted.
+
+If this ever fails, the SSE event and the breadcrumb are beside the point — the
+turn cannot be resumed at all.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any, AsyncIterable
+
+import pytest
+from strands import Agent
+from strands.models.model import Model
+
+from agents.builtin_tools.ask_user_question import ask_user_question
+
+QUESTIONS = [
+    {
+        "header": "Scope",
+        "question": "How much should this cover?",
+        "options": [{"label": "Just the API"}, {"label": "Everything"}],
+    }
+]
+
+
+class _ScriptedModel(Model):
+    """Calls `ask_user_question` once, then answers in text if resumed."""
+
+    def __init__(self) -> None:
+        self.calls = 0
+
+    def update_config(self, **model_config: Any) -> None:  # pragma: no cover
+        pass
+
+    def get_config(self) -> Any:  # pragma: no cover
+        return {}
+
+    def structured_output(self, *args: Any, **kwargs: Any):  # pragma: no cover
+        raise NotImplementedError
+
+    async def stream(self, *args: Any, **kwargs: Any) -> AsyncIterable[dict]:
+        self.calls += 1
+        if self.calls == 1:
+            yield {"messageStart": {"role": "assistant"}}
+            yield {
+                "contentBlockStart": {
+                    "start": {
+                        "toolUse": {"name": "ask_user_question", "toolUseId": "tu-1"}
+                    },
+                    "contentBlockIndex": 0,
+                }
+            }
+            yield {
+                "contentBlockDelta": {
+                    "delta": {"toolUse": {"input": json.dumps({"questions": QUESTIONS})}},
+                    "contentBlockIndex": 0,
+                }
+            }
+            yield {"contentBlockStop": {"contentBlockIndex": 0}}
+            yield {"messageStop": {"stopReason": "tool_use"}}
+        else:
+            yield {"messageStart": {"role": "assistant"}}
+            yield {"contentBlockStart": {"start": {}, "contentBlockIndex": 0}}
+            yield {
+                "contentBlockDelta": {
+                    "delta": {"text": "Covering everything, then."},
+                    "contentBlockIndex": 0,
+                }
+            }
+            yield {"contentBlockStop": {"contentBlockIndex": 0}}
+            yield {"messageStop": {"stopReason": "end_turn"}}
+
+
+def _agent() -> Agent:
+    return Agent(
+        model=_ScriptedModel(),
+        tools=[ask_user_question],
+        callback_handler=None,
+    )
+
+
+async def _run(agent: Agent, prompt: Any) -> None:
+    async for _ in agent.stream_async(prompt):
+        pass
+
+
+def _tool_results(messages) -> list[dict]:
+    return [
+        block["toolResult"]
+        for message in messages
+        for block in (message.get("content") or [])
+        if isinstance(block, dict) and "toolResult" in block
+    ]
+
+
+def _all_text(messages) -> str:
+    return "\n".join(
+        block.get("text", "")
+        for message in messages
+        for block in (message.get("content") or [])
+        if isinstance(block, dict)
+    )
+
+
+def _the_interrupt(agent: Agent):
+    return next(iter(agent._interrupt_state.interrupts.values()))
+
+
+class TestToolScopedInterruptPauses:
+    @pytest.mark.asyncio
+    async def test_the_turn_really_pauses(self):
+        agent = _agent()
+        await _run(agent, "write me a summary")
+
+        assert agent._interrupt_state.activated, "expected a paused turn"
+
+    @pytest.mark.asyncio
+    async def test_pending_tool_execution_is_captured(self):
+        """The state the resume path replays. A hook-raised interrupt gets this
+        from `_stop_for_interrupts`; this asserts a tool-raised one does too."""
+        agent = _agent()
+        await _run(agent, "write me a summary")
+
+        pending = agent._interrupt_state.pending_tool_execution
+        assert pending is not None
+        assert any(
+            block.get("toolUse", {}).get("toolUseId") == "tu-1"
+            for block in pending.assistant_message["content"]
+        )
+
+    @pytest.mark.asyncio
+    async def test_the_interrupt_id_is_tool_scoped(self):
+        """`ToolContext._interrupt_id` folds the toolUseId in, which is what
+        lets the SPA correlate a prompt with its tool card and what keeps two
+        parallel calls distinct."""
+        agent = _agent()
+        await _run(agent, "write me a summary")
+
+        assert _the_interrupt(agent).id.startswith("v1:tool_call:tu-1:")
+
+    @pytest.mark.asyncio
+    async def test_the_reason_carries_the_questions(self):
+        agent = _agent()
+        await _run(agent, "write me a summary")
+
+        reason = _the_interrupt(agent).reason
+        assert reason["type"] == "user_question_required"
+        assert reason["questions"][0]["header"] == "Scope"
+
+    @pytest.mark.asyncio
+    async def test_no_tool_result_is_recorded_while_paused(self):
+        """The call is genuinely suspended, not completed with a placeholder."""
+        agent = _agent()
+        await _run(agent, "write me a summary")
+
+        assert _tool_results(agent.messages) == []
+
+
+class TestResume:
+    @pytest.mark.asyncio
+    async def test_the_answer_becomes_the_tool_result(self):
+        """The property that matters: the response feeds back into the *same*
+        tool call, so the model reads the user's choice as that call's result."""
+        agent = _agent()
+        await _run(agent, "write me a summary")
+
+        await _run(
+            agent,
+            [
+                {
+                    "interruptResponse": {
+                        "interruptId": _the_interrupt(agent).id,
+                        "response": {"answers": {"Scope": ["Everything"]}},
+                    }
+                }
+            ],
+        )
+
+        [result] = _tool_results(agent.messages)
+        assert result["toolUseId"] == "tu-1"
+        assert result["status"] == "success"
+        assert "- Scope: Everything" in result["content"][0]["text"]
+
+    @pytest.mark.asyncio
+    async def test_the_turn_completes_after_resuming(self):
+        agent = _agent()
+        await _run(agent, "write me a summary")
+        await _run(
+            agent,
+            [
+                {
+                    "interruptResponse": {
+                        "interruptId": _the_interrupt(agent).id,
+                        "response": {"answers": {"Scope": ["Everything"]}},
+                    }
+                }
+            ],
+        )
+
+        assert not agent._interrupt_state.activated
+        assert "Covering everything, then." in _all_text(agent.messages)
+
+    @pytest.mark.asyncio
+    async def test_the_tool_is_not_invoked_twice(self):
+        """A resume that re-ran the tool would ask the same question again —
+        an infinite prompt loop the user could not escape."""
+        agent = _agent()
+        await _run(agent, "write me a summary")
+        await _run(
+            agent,
+            [
+                {
+                    "interruptResponse": {
+                        "interruptId": _the_interrupt(agent).id,
+                        "response": {"answers": {"Scope": ["Everything"]}},
+                    }
+                }
+            ],
+        )
+
+        assert len(_tool_results(agent.messages)) == 1
+
+    @pytest.mark.asyncio
+    async def test_a_skip_also_resumes(self):
+        """The escape hatch. `ToolContext.interrupt` only treats a non-None
+        response as an answer, so "Skip" must post a payload rather than null —
+        a null would re-raise the interrupt forever."""
+        agent = _agent()
+        await _run(agent, "write me a summary")
+
+        await _run(
+            agent,
+            [
+                {
+                    "interruptResponse": {
+                        "interruptId": _the_interrupt(agent).id,
+                        "response": {"skipped": True},
+                    }
+                }
+            ],
+        )
+
+        assert not agent._interrupt_state.activated
+        [result] = _tool_results(agent.messages)
+        assert "skipped" in result["content"][0]["text"]
diff --git a/backend/tests/agents/main_agent/streaming/test_tool_census_attach.py b/backend/tests/agents/main_agent/streaming/test_tool_census_attach.py
new file mode 100644
index 000000000..5618c4343
--- /dev/null
+++ b/backend/tests/agents/main_agent/streaming/test_tool_census_attach.py
@@ -0,0 +1,85 @@
+"""The coordinator → cost-row seam for the tool census.
+
+`_store_message_metadata` gained a `tool_calls` argument; the tally it
+receives must land on the persisted `MessageMetadata` as the `toolCalls`
+extra field (the same mechanism `turnAgentId` uses), and must be *absent* —
+not an empty dict — when the call requested no tools, so the profile's
+coverage flag stays honest.
+"""
+
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from agents.main_agent.streaming.stream_coordinator import StreamCoordinator
+
+
+def _coordinator() -> StreamCoordinator:
+    return object.__new__(StreamCoordinator)
+
+
+def _usage_metadata():
+    return {"usage": {"inputTokens": 100, "outputTokens": 20, "totalTokens": 120}}
+
+
+@pytest.mark.asyncio
+async def test_tool_calls_are_attached_to_the_stored_metadata():
+    store = AsyncMock()
+    with patch("apis.shared.sessions.metadata.store_message_metadata", store):
+        await _coordinator()._store_message_metadata(
+            session_id="s1",
+            user_id="u1",
+            message_id=3,
+            accumulated_metadata=_usage_metadata(),
+            stream_start_time=0.0,
+            stream_end_time=1.0,
+            first_token_time=0.5,
+            agent=None,
+            call_index=0,
+            tool_calls={"list_courses": {"calls": 2, "errors": 0}},
+        )
+
+    store.assert_awaited_once()
+    stored = store.await_args.kwargs["message_metadata"]
+    assert stored.model_extra["toolCalls"] == {"list_courses": {"calls": 2, "errors": 0}}
+    # And it serializes onto the row exactly as the profile reads it.
+    assert stored.model_dump(by_alias=True)["toolCalls"]["list_courses"]["calls"] == 2
+
+
+@pytest.mark.asyncio
+async def test_no_tools_means_no_field_at_all():
+    store = AsyncMock()
+    with patch("apis.shared.sessions.metadata.store_message_metadata", store):
+        await _coordinator()._store_message_metadata(
+            session_id="s1",
+            user_id="u1",
+            message_id=3,
+            accumulated_metadata=_usage_metadata(),
+            stream_start_time=0.0,
+            stream_end_time=1.0,
+            first_token_time=None,
+            agent=None,
+            call_index=0,
+            tool_calls=None,
+        )
+
+    stored = store.await_args.kwargs["message_metadata"]
+    assert "toolCalls" not in (stored.model_extra or {})
+    assert "toolCalls" not in stored.model_dump(by_alias=True)
+
+
+@pytest.mark.asyncio
+async def test_the_argument_is_optional_for_the_interrupt_path():
+    # `_persist_interruption` calls without tool_calls; the default must hold.
+    store = AsyncMock()
+    with patch("apis.shared.sessions.metadata.store_message_metadata", store):
+        await _coordinator()._store_message_metadata(
+            session_id="s1",
+            user_id="u1",
+            message_id=1,
+            accumulated_metadata=_usage_metadata(),
+            stream_start_time=0.0,
+            stream_end_time=1.0,
+            first_token_time=None,
+        )
+    store.assert_awaited_once()
diff --git a/backend/tests/agents/main_agent/streaming/test_user_question_events.py b/backend/tests/agents/main_agent/streaming/test_user_question_events.py
new file mode 100644
index 000000000..fde5cc54d
--- /dev/null
+++ b/backend/tests/agents/main_agent/streaming/test_user_question_events.py
@@ -0,0 +1,193 @@
+"""`user_question_required` extraction from a paused turn.
+
+The extractor reads `agent._interrupt_state` at the `done` event, exactly like
+`_extract_tool_approval_required_events`. What makes this flavor worth its own
+tests is that the interrupt is raised by the *tool* rather than by a hook — so
+these assert the flavor filter both ways, and that a payload the SPA could not
+draw is dropped rather than emitted.
+
+Persistence is best-effort by design: the live prompt must survive a DynamoDB
+failure. Losing the breadcrumb costs a refresh, losing the event costs the turn.
+"""
+
+from __future__ import annotations
+
+import json
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from agents.main_agent.streaming.stream_coordinator import StreamCoordinator
+
+
+def _parse(sse: str) -> dict:
+    data_line = next(line for line in sse.splitlines() if line.startswith("data: "))
+    return json.loads(data_line[len("data: ") :])
+
+
+def _coordinator() -> StreamCoordinator:
+    return StreamCoordinator.__new__(StreamCoordinator)
+
+
+QUESTIONS = [
+    {
+        "header": "Scope",
+        "question": "How much should this cover?",
+        "multiSelect": False,
+        "options": [{"label": "Just the API", "description": "Routes only"},
+                    {"label": "Everything"}],
+    }
+]
+
+
+def _agent(*interrupts, activated: bool = True):
+    return SimpleNamespace(
+        _interrupt_state=SimpleNamespace(
+            activated=activated,
+            interrupts={f"i-{n}": i for n, i in enumerate(interrupts)},
+        )
+    )
+
+
+def _interrupt(reason, interrupt_id: str = "v1:tool_call:tu-1:abc"):
+    return SimpleNamespace(id=interrupt_id, reason=reason)
+
+
+_DEFAULT = object()
+
+
+def _user_question_reason(questions=_DEFAULT, tool_use_id: str = "tu-1"):
+    return {
+        "type": "user_question_required",
+        "toolUseId": tool_use_id,
+        "questions": QUESTIONS if questions is _DEFAULT else questions,
+    }
+
+
+@pytest.fixture
+def add_pending():
+    """Patch the breadcrumb writer at its definition site."""
+    with patch(
+        "apis.shared.sessions.metadata.add_pending_interrupt",
+        new_callable=AsyncMock,
+    ) as mock:
+        yield mock
+
+
+class TestEventEmission:
+    @pytest.mark.asyncio
+    async def test_emits_one_event_carrying_the_questions(self, add_pending):
+        events = await _coordinator()._extract_user_question_required_events(
+            _agent(_interrupt(_user_question_reason())),
+            session_id="s1",
+            user_id="u1",
+        )
+
+        assert len(events) == 1
+        assert events[0].startswith("event: user_question_required\n")
+        payload = _parse(events[0])
+        assert payload["interruptId"] == "v1:tool_call:tu-1:abc"
+        assert payload["toolUseId"] == "tu-1"
+        [question] = payload["questions"]
+        assert question["header"] == "Scope"
+        assert question["multiSelect"] is False
+        assert question["options"][0]["description"] == "Routes only"
+        assert "description" not in question["options"][1]
+
+    @pytest.mark.asyncio
+    async def test_one_event_per_pending_prompt(self, add_pending):
+        """Two parallel calls in one turn get distinct tool-scoped ids, and the
+        SPA correlates prompts by them."""
+        events = await _coordinator()._extract_user_question_required_events(
+            _agent(
+                _interrupt(_user_question_reason(tool_use_id="tu-1"), "v1:tool_call:tu-1:a"),
+                _interrupt(_user_question_reason(tool_use_id="tu-2"), "v1:tool_call:tu-2:b"),
+            ),
+            session_id="s1",
+            user_id="u1",
+        )
+
+        assert {_parse(e)["toolUseId"] for e in events} == {"tu-1", "tu-2"}
+
+    @pytest.mark.asyncio
+    async def test_ignores_other_interrupt_flavors(self, add_pending):
+        """OAuth and tool-approval interrupts share the same state dict."""
+        events = await _coordinator()._extract_user_question_required_events(
+            _agent(
+                _interrupt({"type": "tool_approval_required", "toolName": "send_email"}),
+                _interrupt({"type": "oauth_required", "providerId": "github"}),
+            ),
+            session_id="s1",
+            user_id="u1",
+        )
+
+        assert events == []
+        add_pending.assert_not_awaited()
+
+    @pytest.mark.asyncio
+    async def test_no_events_when_the_turn_is_not_paused(self, add_pending):
+        events = await _coordinator()._extract_user_question_required_events(
+            _agent(_interrupt(_user_question_reason()), activated=False),
+            session_id="s1",
+            user_id="u1",
+        )
+
+        assert events == []
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("questions", [[], None, [{"question": "no options"}], "junk"])
+    async def test_unrenderable_questions_are_dropped_not_emitted(
+        self, add_pending, questions
+    ):
+        """An event the SPA cannot draw would leave the turn paused with no
+        prompt on screen — worse than no event at all."""
+        events = await _coordinator()._extract_user_question_required_events(
+            _agent(_interrupt(_user_question_reason(questions=questions))),
+            session_id="s1",
+            user_id="u1",
+        )
+
+        assert events == []
+
+
+class TestPersistence:
+    @pytest.mark.asyncio
+    async def test_breadcrumb_is_written_for_reload_recovery(self, add_pending):
+        await _coordinator()._extract_user_question_required_events(
+            _agent(_interrupt(_user_question_reason())),
+            session_id="s1",
+            user_id="u1",
+        )
+
+        add_pending.assert_awaited_once()
+        interrupt = add_pending.await_args.kwargs["interrupt"]
+        assert interrupt.kind == "user_question"
+        assert interrupt.tool_use_id == "tu-1"
+        # JSON-encoded, like `tool_input`: DynamoDB would otherwise coerce
+        # numbers in the payload to Decimal on the way back out.
+        assert json.loads(interrupt.questions)[0]["header"] == "Scope"
+
+    @pytest.mark.asyncio
+    async def test_write_failure_does_not_cost_the_live_prompt(self, add_pending):
+        add_pending.side_effect = RuntimeError("dynamo down")
+
+        events = await _coordinator()._extract_user_question_required_events(
+            _agent(_interrupt(_user_question_reason())),
+            session_id="s1",
+            user_id="u1",
+        )
+
+        assert len(events) == 1
+
+    @pytest.mark.asyncio
+    async def test_anonymous_flows_emit_without_persisting(self, add_pending):
+        """Preview / anonymous turns have no metadata row to write to."""
+        events = await _coordinator()._extract_user_question_required_events(
+            _agent(_interrupt(_user_question_reason())),
+            session_id=None,
+            user_id=None,
+        )
+
+        assert len(events) == 1
+        add_pending.assert_not_awaited()
diff --git a/backend/tests/agents/main_agent/test_question_guidance.py b/backend/tests/agents/main_agent/test_question_guidance.py
new file mode 100644
index 000000000..2b5196a75
--- /dev/null
+++ b/backend/tests/agents/main_agent/test_question_guidance.py
@@ -0,0 +1,210 @@
+"""The system-prompt guidance that makes `ask_user_question` actually fire.
+
+Without it the model answers an ambiguous request in prose instead of asking:
+measured 4/24 against a production-shaped tool set, 24/24 with it, and 0/18 on
+unambiguous requests either way. The same words placed in the tool's own
+description measured no better than baseline, so the text is load-bearing in
+this position specifically.
+
+These tests pin the wiring, not the wording — the wording is pinned by the
+harness and by the warning on the constant. What can silently regress here is
+the *gating*: appending for a user who does not have the tool, keying off the
+request instead of the filtered list, or mutating `self.system_prompt` (which
+is snapshotted for resume and hashed into the agent cache key).
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+from agents.builtin_tools.ask_user_question import SYSTEM_PROMPT_GUIDANCE
+from agents.main_agent.chat_agent import ChatAgent
+
+
+def _tool(name: str):
+    return SimpleNamespace(tool_spec={"name": name, "description": "", "inputSchema": {}})
+
+
+def _agent(base_prompt: str = "BASE PROMPT") -> ChatAgent:
+    """A ChatAgent shell with just enough state for the prompt helper.
+
+    `__new__` rather than a constructor: BaseAgent.__init__ builds a registry,
+    a session manager and a Strands agent, none of which this unit needs.
+    """
+    agent = ChatAgent.__new__(ChatAgent)
+    agent.system_prompt = base_prompt
+    return agent
+
+
+class TestGating:
+    """Req: the clause appears exactly when the tool does."""
+
+    def test_appended_when_the_tool_is_present(self):
+        prompt = _agent()._system_prompt_for([_tool("browse_web"), _tool("ask_user_question")])
+
+        assert prompt.startswith("BASE PROMPT")
+        assert SYSTEM_PROMPT_GUIDANCE in prompt
+
+    def test_absent_when_the_tool_is_not(self):
+        """A user without the tool must not be told to call it."""
+        prompt = _agent()._system_prompt_for([_tool("browse_web"), _tool("calculator")])
+
+        assert prompt == "BASE PROMPT"
+        assert SYSTEM_PROMPT_GUIDANCE not in prompt
+
+    def test_absent_for_a_turn_with_no_tools(self):
+        assert _agent()._system_prompt_for([]) == "BASE PROMPT"
+
+    def test_appended_only_once(self):
+        """Guards a duplicate slipping in if the list ever carries the tool
+        twice — the clause is prefix bytes, and two copies is waste."""
+        prompt = _agent()._system_prompt_for(
+            [_tool("ask_user_question"), _tool("ask_user_question")]
+        )
+
+        assert prompt.count(SYSTEM_PROMPT_GUIDANCE) == 1
+
+    def test_tolerates_tools_without_a_spec(self):
+        """Injected/factory tools are ordinary objects; a malformed entry must
+        not take down agent construction."""
+        prompt = _agent()._system_prompt_for(
+            [object(), SimpleNamespace(tool_spec=None), _tool("ask_user_question")]
+        )
+
+        assert SYSTEM_PROMPT_GUIDANCE in prompt
+
+
+class TestItKeysOnTheFilteredList:
+    """Req: keyed on what reaches `toolConfig`, not on what was requested.
+
+    `ToolFilter` drops a catalog id the registry does not know — `canvas_faculty`
+    does this in dev today, with a "not a known tool id, skipping" log line. A
+    check against the request's `enabled_tools` would advertise a tool that is
+    not in the turn's `toolConfig` at all.
+    """
+
+    def test_a_requested_but_dropped_tool_does_not_add_the_clause(self):
+        agent = _agent()
+        # What the request asked for is irrelevant; only the filtered list counts.
+        agent.enabled_tools = ["ask_user_question", "canvas_faculty"]
+
+        prompt = agent._system_prompt_for([_tool("browse_web")])
+
+        assert SYSTEM_PROMPT_GUIDANCE not in prompt
+
+
+class TestItDoesNotDisturbResumeOrTheCacheKey:
+    """Req: `self.system_prompt` is left alone.
+
+    That field is snapshotted into `PausedTurnSnapshot` and hashed into the
+    agent cache key. The clause is derived from `enabled_tools`, which the key
+    already covers via `tools_hash`, so mutating it would move resume onto a
+    different cache slot for no benefit — the bug class called out in
+    `base_agent.py`'s snapshot comment.
+    """
+
+    def test_self_system_prompt_is_unchanged(self):
+        agent = _agent()
+
+        agent._system_prompt_for([_tool("ask_user_question")])
+
+        assert agent.system_prompt == "BASE PROMPT"
+
+    def test_repeated_calls_do_not_accumulate(self):
+        agent = _agent()
+
+        first = agent._system_prompt_for([_tool("ask_user_question")])
+        second = agent._system_prompt_for([_tool("ask_user_question")])
+
+        assert first == second
+        assert second.count(SYSTEM_PROMPT_GUIDANCE) == 1
+
+
+class TestKillSwitch:
+    """Req: `ASK_USER_QUESTION_ENABLED=false` silences the guidance too.
+
+    No second flag check is needed — while off the tool is never registered, so
+    it cannot appear in the filtered list. This pins that the two stay coupled.
+    """
+
+    def test_disabled_registry_yields_no_tool_and_so_no_guidance(self, monkeypatch):
+        monkeypatch.setenv("ASK_USER_QUESTION_ENABLED", "false")
+        from agents.main_agent.tools.tool_registry import create_default_registry
+        from agents.main_agent.tools.tool_filter import ToolFilter
+
+        registry = create_default_registry()
+        tools, _ = ToolFilter(registry).filter_tools(["calculator", "ask_user_question"])
+
+        assert all(t.tool_spec["name"] != "ask_user_question" for t in tools)
+        assert SYSTEM_PROMPT_GUIDANCE not in _agent()._system_prompt_for(tools)
+
+
+class TestTheTextItself:
+    """Req: the wording is what was measured.
+
+    Not a style assertion — the measured lift (4/24 -> 24/24) belongs to these
+    sentences in this position. The same idea in the tool description scored at
+    baseline, so a well-meant reword can silently cost the whole feature.
+    """
+
+    def test_names_the_tool_so_the_model_can_act_on_it(self):
+        assert "ask_user_question" in SYSTEM_PROMPT_GUIDANCE
+
+    def test_is_short_enough_to_be_free(self):
+        # ~70 tokens against a prefix measured at ~24k. If this grows into a
+        # paragraph, re-price it before shipping.
+        assert len(SYSTEM_PROMPT_GUIDANCE) < 400
+
+    def test_is_guidance_not_a_mandate(self):
+        """"Prefer" and "when" keep it conditional. An unconditional "always
+        ask" is what the 0/18 clear-prompt result would have lost."""
+        assert "Prefer" in SYSTEM_PROMPT_GUIDANCE
+        assert "always" not in SYSTEM_PROMPT_GUIDANCE.lower()
+
+
+class TestItReachesTheStrandsAgent:
+    """Req: `_create_agent` actually hands the augmented prompt to the factory.
+
+    The unit tests above prove the helper computes the right string; this proves
+    the string is the one the model receives. A refactor that reverts the call
+    site to `self.system_prompt` would leave every test above green while the
+    feature quietly stops working.
+    """
+
+    def _build(self, monkeypatch, tool_names):
+        from agents.main_agent.core import AgentFactory
+
+        captured = {}
+
+        def fake_create_agent(**kwargs):
+            captured.update(kwargs)
+            return MagicMock()
+
+        monkeypatch.setattr(AgentFactory, "create_agent", staticmethod(fake_create_agent))
+
+        agent = ChatAgent.__new__(ChatAgent)
+        agent.system_prompt = "BASE PROMPT"
+        agent.model_config = MagicMock()
+        agent.session_manager = MagicMock()
+        agent._accessible_skill_ids = None
+        monkeypatch.setattr(
+            ChatAgent, "_build_filtered_tools",
+            lambda self: [_tool(n) for n in tool_names], raising=False,
+        )
+        monkeypatch.setattr(ChatAgent, "_create_hooks", lambda self: [], raising=False)
+
+        agent._create_agent()
+        return captured
+
+    def test_factory_receives_the_guidance_when_the_tool_is_present(self, monkeypatch):
+        captured = self._build(monkeypatch, ["browse_web", "ask_user_question"])
+
+        assert SYSTEM_PROMPT_GUIDANCE in captured["system_prompt"]
+
+    def test_factory_receives_the_plain_prompt_otherwise(self, monkeypatch):
+        captured = self._build(monkeypatch, ["browse_web"])
+
+        assert captured["system_prompt"] == "BASE PROMPT"
diff --git a/backend/tests/apis/app_api/admin/costs/test_content_policy.py b/backend/tests/apis/app_api/admin/costs/test_content_policy.py
new file mode 100644
index 000000000..0ea4279db
--- /dev/null
+++ b/backend/tests/apis/app_api/admin/costs/test_content_policy.py
@@ -0,0 +1,177 @@
+"""The admin cost surface is content-free by construction — proven, not promised.
+
+Three things are pinned here, in cost-of-getting-it-wrong order:
+
+1. **No response model on the admin cost surface has a content-bearing field**,
+   with exactly one named exemption (`TopSessionCost.title`, kept by decision).
+   A new field named `summary`, `content`, `displayText` … fails this test until
+   someone either renames it or adds it to the exemption set on purpose.
+2. **Every storage projection is a subset of the allowlist**, except the one
+   path a reader may request-but-never-return (`compaction.summary`, measured
+   into a length).
+3. The helpers behave: reserved words are aliased, nested and list content is
+   stripped, the summary is measured then dropped.
+"""
+
+from __future__ import annotations
+
+import inspect
+import typing
+from typing import Any, List, Set, Tuple
+
+import pytest
+from pydantic import BaseModel
+
+from apis.app_api.admin.costs import models as cost_models
+from apis.shared.observability import content_policy as cp
+
+#: The single decided exemption on the admin cost surface. The "most expensive
+#: conversations" table shows the LLM-generated session title; the per-user
+#: list and the session profile deliberately do not inherit it. Widening this
+#: set is a product decision, not a refactor.
+EXEMPT: Set[Tuple[str, str]] = {("TopSessionCost", "title")}
+
+
+def _unwrap(annotation: Any) -> List[type]:
+    """Every pydantic model class reachable from a field annotation."""
+    origin = typing.get_origin(annotation)
+    if origin is None:
+        return [annotation] if inspect.isclass(annotation) and issubclass(annotation, BaseModel) else []
+    found: List[type] = []
+    for arg in typing.get_args(annotation):
+        found.extend(_unwrap(arg))
+    return found
+
+
+def _declared_fields(model: type, seen: Set[type] | None = None) -> List[Tuple[str, str]]:
+    """``(owning model name, wire alias)`` for every field reachable from
+    ``model``, attributing each field to the model that declares it — so a
+    nested model's field is reported once, under its own name, however many
+    parents embed it."""
+    seen = seen or set()
+    if model in seen:
+        return []
+    seen = seen | {model}
+    fields: List[Tuple[str, str]] = []
+    for name, field in model.model_fields.items():
+        alias = field.alias or name
+        fields.append((model.__name__, alias))
+        for nested in _unwrap(field.annotation):
+            fields.extend(_declared_fields(nested, seen))
+    return fields
+
+
+def _all_models() -> List[type]:
+    return [
+        obj for _, obj in inspect.getmembers(cost_models, inspect.isclass)
+        if issubclass(obj, BaseModel) and obj is not BaseModel
+        and obj.__module__ == cost_models.__name__
+    ]
+
+
+def test_response_models_are_content_free_except_the_one_decided_exemption():
+    offenders: Set[Tuple[str, str]] = set()
+    for model in _all_models():
+        for owner, alias in _declared_fields(model):
+            if cp.is_content_bearing(alias):
+                offenders.add((owner, alias))
+    assert offenders == EXEMPT, (
+        f"content-bearing field(s) on the admin cost surface: {sorted(offenders - EXEMPT)}. "
+        "Rename the field, or — if the product decision is to show content — add it to "
+        "EXEMPT with a reason."
+    )
+
+
+def test_the_exemption_still_exists_so_it_cannot_rot_silently():
+    # If someone removes `title` from TopSessionCost, the exemption set must be
+    # trimmed too — otherwise a future re-addition would pass unnoticed.
+    assert "title" in cost_models.TopSessionCost.model_fields
+
+
+def test_every_projection_is_allowlisted_or_measured_only():
+    for name, projection in cp.ALL_PROJECTIONS.items():
+        for path in projection:
+            if cp.is_content_bearing(path):
+                assert path in cp.MEASURED_ONLY, (
+                    f"{name} requests content-bearing path {path!r} that is not measured-only"
+                )
+
+
+def test_a_denied_prefix_denies_everything_beneath_it():
+    assert cp.is_content_bearing("pausedTurn.modelId")
+    assert cp.is_content_bearing("compaction.summary")
+    assert not cp.is_content_bearing("compaction.checkpoint")
+    assert not cp.is_content_bearing("preferences.lastModel")
+    assert cp.is_content_bearing("preferences.customPromptText")
+
+
+def test_a_denied_path_is_caught_wherever_a_row_is_embedded():
+    # Rows travel under arbitrary keys (`calls[]`, `sessions[]`); the matcher
+    # must find the row-relative denylist entry inside the longer path.
+    assert cp.is_content_bearing("calls.citations.text")
+    assert cp.is_content_bearing("sessions.title")
+    assert cp.is_content_bearing("session.compaction.summary")
+    assert not cp.is_content_bearing("session.compaction.summaryChars")
+    # Segment matching is exact — a name that merely *contains* a denied word is fine.
+    assert not cp.is_content_bearing("contextWindow")
+    assert not cp.is_content_bearing("evidence.summaryApproxTokens")
+
+
+def test_build_projection_aliases_every_segment_and_shares_them():
+    expr, names = cp.build_projection(("status", "preferences.lastModel", "preferences.enabledTools"))
+    # No bare reserved word survives in the expression.
+    assert "status" not in expr and "preferences" not in expr
+    assert set(names.values()) == {"status", "preferences", "lastModel", "enabledTools"}
+    # `preferences` appears once in the names map even though two paths use it.
+    assert list(names.values()).count("preferences") == 1
+    assert expr.count(".") == 2
+
+
+def test_strip_content_removes_nested_and_list_content():
+    item = {
+        "sessionId": "s1",
+        "title": "SECRET",
+        "compaction": {"checkpoint": 3, "summary": "SECRET"},
+        "calls": [{"cost": 1.0, "citations": [{"text": "SECRET"}]}],
+        "preferences": {"lastModel": "m", "customPromptText": "SECRET"},
+    }
+    out = cp.strip_content(item)
+    assert cp.content_bearing_paths(out) == []
+    assert out == {
+        "sessionId": "s1",
+        "compaction": {"checkpoint": 3},
+        "calls": [{"cost": 1.0}],
+        "preferences": {"lastModel": "m"},
+    }
+    # The input is untouched — strip returns a copy.
+    assert item["title"] == "SECRET"
+
+
+def test_measure_compaction_summary_replaces_the_string_with_its_length():
+    item = {"compaction": {"checkpoint": 1, "summary": "x" * 1234}}
+    cp.measure_compaction_summary(item)
+    assert item["compaction"] == {"checkpoint": 1, "summaryChars": 1234}
+
+
+def test_measure_compaction_summary_distinguishes_missing_from_empty():
+    assert "summaryChars" not in cp.measure_compaction_summary({"compaction": {}})["compaction"]
+    assert cp.measure_compaction_summary({"compaction": {"summary": ""}})["compaction"] == {"summaryChars": 0}
+    assert cp.measure_compaction_summary({}) == {}
+
+
+def test_content_bearing_paths_reports_list_members_without_indices():
+    rows = [{"cost": 1}, {"citations": [{"text": "x"}], "displayText": "y"}]
+    assert sorted(cp.content_bearing_paths(rows)) == ["citations", "displayText"]
+
+
+def test_allowlisted_keys_returns_direct_children_only():
+    keys = cp.allowlisted_keys(cp.SESSION_ROW_PROJECTION, "preferences")
+    assert keys == {"lastModel", "enabledTools", "assistantId", "agentType"}
+    assert "customPromptText" not in keys
+
+
+@pytest.mark.parametrize("model", _all_models(), ids=lambda m: m.__name__)
+def test_each_model_serializes_by_alias_without_content(model):
+    # Belt and braces for the walker: instantiate nothing, just confirm every
+    # model opts into alias population so the wire names are the ones checked.
+    assert model.model_config.get("populate_by_name") is True
diff --git a/backend/tests/apis/app_api/admin/costs/test_diagnoses.py b/backend/tests/apis/app_api/admin/costs/test_diagnoses.py
new file mode 100644
index 000000000..306d18819
--- /dev/null
+++ b/backend/tests/apis/app_api/admin/costs/test_diagnoses.py
@@ -0,0 +1,181 @@
+"""Diagnosis rules — one test per classification, pure in, pure out.
+
+Each rule encodes a finding a prior quota investigation reached by hand. The
+tests pin the *threshold* the rule fires at and the *evidence* it carries, so a
+future tweak to a number is a visible diff here rather than a silent change in
+what an admin is told.
+"""
+
+from __future__ import annotations
+
+
+from apis.app_api.admin.costs import diagnoses as dg
+from apis.app_api.admin.costs.diagnoses import ProfileFacts, run_diagnoses
+
+
+def _codes(facts: ProfileFacts) -> list[str]:
+    return [d.code for d in run_diagnoses(facts)]
+
+
+def _known(**overrides) -> ProfileFacts:
+    base = dict(cost_known=True, total_cost=1.0, call_count=10, cache_read_tokens=100_000, cache_write_tokens=10_000)
+    base.update(overrides)
+    return ProfileFacts(**base)
+
+
+# ── threshold resolution ─────────────────────────────────────────────────────
+
+
+def test_compaction_threshold_defaults_when_unset(monkeypatch):
+    monkeypatch.delenv(dg.EnvVars.COMPACTION_TOKEN_THRESHOLD, raising=False)
+    assert dg.compaction_token_threshold() == dg.Defaults.COMPACTION_TOKEN_THRESHOLD
+
+
+def test_compaction_threshold_reads_env_and_tolerates_garbage(monkeypatch):
+    monkeypatch.setenv(dg.EnvVars.COMPACTION_TOKEN_THRESHOLD, "50000")
+    assert dg.compaction_token_threshold() == 50_000
+    monkeypatch.setenv(dg.EnvVars.COMPACTION_TOKEN_THRESHOLD, "not-a-number")
+    assert dg.compaction_token_threshold() == dg.Defaults.COMPACTION_TOKEN_THRESHOLD
+    monkeypatch.setenv(dg.EnvVars.COMPACTION_TOKEN_THRESHOLD, "   ")
+    assert dg.compaction_token_threshold() == dg.Defaults.COMPACTION_TOKEN_THRESHOLD
+
+
+# ── individual rules ─────────────────────────────────────────────────────────
+
+
+def test_cost_unknown_fires_only_when_cost_is_unrecorded():
+    assert "COST_UNKNOWN" in _codes(ProfileFacts(cost_known=False))
+    assert "COST_UNKNOWN" not in _codes(_known())
+
+
+def test_over_threshold_uses_the_facts_threshold_not_a_constant():
+    facts = _known(peak_context_tokens=60_000, compaction_threshold=50_000)
+    d = dg.over_compaction_threshold(facts)
+    assert d is not None and d.severity == "warn"
+    assert d.evidence["compactionThreshold"] == 50_000
+    assert dg.over_compaction_threshold(_known(peak_context_tokens=50_000, compaction_threshold=50_000)) is None
+    assert dg.over_compaction_threshold(_known(peak_context_tokens=None)) is None
+
+
+def test_prefix_spiral_requires_over_threshold_and_write_heavy_ratio():
+    over = dict(peak_context_tokens=150_000)
+    # Over threshold but healthy 1:10 → not a spiral.
+    assert dg.prefix_spiral(_known(**over, cache_read_tokens=100_000, cache_write_tokens=10_000)) is None
+    # Over threshold and writes 4× reads → spiral.
+    d = dg.prefix_spiral(_known(**over, cache_read_tokens=10_000, cache_write_tokens=40_000))
+    assert d is not None and d.severity == "high"
+    assert d.evidence["writeReadRatio"] == 4.0
+    # Writes with no reads at all is the degenerate spiral.
+    d = dg.prefix_spiral(_known(**over, cache_read_tokens=0, cache_write_tokens=40_000))
+    assert d is not None and d.evidence["writeReadRatio"] is None
+    # Under threshold, the same ratio is not a spiral (it is a partial-miss question).
+    assert dg.prefix_spiral(_known(peak_context_tokens=50_000, cache_read_tokens=10_000, cache_write_tokens=40_000)) is None
+
+
+def test_partial_miss_heavy_is_a_share_of_known_cost():
+    assert dg.partial_miss_heavy(_known(total_cost=10.0, partial_miss_usd=4.9)) is None
+    d = dg.partial_miss_heavy(_known(total_cost=10.0, partial_miss_usd=5.0, partial_miss_count=7))
+    assert d is not None and d.severity == "high"
+    assert d.evidence["shareOfCost"] == 0.5 and d.evidence["partialMissCount"] == 7
+    # Unknown cost cannot fire it — there is no denominator.
+    assert dg.partial_miss_heavy(ProfileFacts(cost_known=False, partial_miss_usd=99.0)) is None
+
+
+def test_summary_over_budget_fires_above_the_proposed_budget():
+    assert dg.summary_over_budget(_known(summary_approx_tokens=dg.SUMMARY_TOKEN_BUDGET)) is None
+    d = dg.summary_over_budget(_known(summary_approx_tokens=dg.SUMMARY_TOKEN_BUDGET + 1))
+    assert d is not None and d.evidence["budgetTokens"] == dg.SUMMARY_TOKEN_BUDGET
+    assert dg.summary_over_budget(_known(summary_approx_tokens=None)) is None
+
+
+def test_anchor_mismatch_needs_both_coordinates():
+    assert dg.anchor_mismatch(_known(checkpoint=3, truncation_anchor=None)) is None
+    assert dg.anchor_mismatch(_known(checkpoint=3, truncation_anchor=3)) is None
+    d = dg.anchor_mismatch(_known(checkpoint=34, truncation_anchor=68))
+    assert d is not None and d.evidence == {"checkpoint": 34, "truncationAnchor": 68}
+
+
+def test_prefix_mutation_rules_count_distinct_hashes_beyond_one():
+    assert dg.system_prompt_mutated(_known(distinct_system_prompt_hashes=1)) is None
+    assert dg.system_prompt_mutated(_known(distinct_system_prompt_hashes=2)) is not None
+    assert dg.toolconfig_mutated(_known(distinct_tool_config_hashes=1)) is None
+    assert dg.toolconfig_mutated(_known(distinct_tool_config_hashes=3)).evidence["distinctToolConfigHashes"] == 3
+
+
+def test_agent_switch_churn_threshold():
+    assert dg.agent_switch_churn(_known(agent_switch_count=2)) is None
+    assert dg.agent_switch_churn(_known(agent_switch_count=3)).severity == "info"
+
+
+def test_agent_cache_bypass_names_only_the_non_key_described_injected_ids():
+    # create_artifact is key-described (promoted); analyze_spreadsheet is not.
+    facts = _known(enabled_tools=["calculator", "create_artifact", "analyze_spreadsheet", "workspace_files"])
+    d = dg.agent_cache_bypass(facts)
+    assert d is not None
+    assert d.evidence["bypassingToolIds"] == ["analyze_spreadsheet", "workspace_files"]
+    assert dg.agent_cache_bypass(_known(enabled_tools=["calculator", "create_artifact"])) is None
+
+
+def test_large_toolset_counts_catalog_ids():
+    assert dg.large_toolset(_known(enabled_tools=[f"t{i}" for i in range(dg.LARGE_TOOLSET_MIN_IDS - 1)])) is None
+    d = dg.large_toolset(_known(enabled_tools=[f"t{i}" for i in range(dg.LARGE_TOOLSET_MIN_IDS)]))
+    assert d is not None and d.evidence["enabledToolCount"] == dg.LARGE_TOOLSET_MIN_IDS
+
+
+def test_attachment_heavy_fires_on_count_or_bytes():
+    assert dg.attachment_heavy(_known(attachment_count=4, attachment_bytes=1)) is None
+    assert dg.attachment_heavy(_known(attachment_count=5)) is not None
+    assert dg.attachment_heavy(_known(attachment_count=1, attachment_bytes=dg.ATTACHMENT_HEAVY_BYTES)) is not None
+
+
+def test_dominant_session_share():
+    assert dg.dominant_session(_known(share_of_user_period=49.9)) is None
+    assert dg.dominant_session(_known(share_of_user_period=50.0)).evidence["shareOfUserPeriodPct"] == 50.0
+    assert dg.dominant_session(_known(share_of_user_period=None)) is None
+
+
+def test_tool_rules_stay_silent_when_the_census_was_never_recorded():
+    assert dg.tool_error_rate(_known(tool_call_count=None, tool_error_count=None)) is None
+    assert dg.tool_heavy(_known(tool_call_count=None)) is None
+
+
+def test_tool_error_rate_needs_a_minimum_sample():
+    assert dg.tool_error_rate(_known(tool_call_count=3, tool_error_count=3)) is None
+    assert dg.tool_error_rate(_known(tool_call_count=4, tool_error_count=0)) is None
+    d = dg.tool_error_rate(_known(tool_call_count=4, tool_error_count=1))
+    assert d is not None and d.evidence["errorRate"] == 0.25
+
+
+def test_tool_heavy_threshold():
+    assert dg.tool_heavy(_known(tool_call_count=dg.TOOL_HEAVY_CALLS - 1)) is None
+    assert dg.tool_heavy(_known(tool_call_count=dg.TOOL_HEAVY_CALLS)) is not None
+
+
+# ── composition ──────────────────────────────────────────────────────────────
+
+
+def test_run_diagnoses_orders_high_then_warn_then_info_then_code():
+    facts = _known(
+        peak_context_tokens=150_000,
+        cache_read_tokens=10_000,
+        cache_write_tokens=40_000,   # spiral (high) + over-threshold (warn)
+        agent_switch_count=5,        # info
+        share_of_user_period=90.0,   # info
+    )
+    findings = run_diagnoses(facts)
+    severities = [d.severity for d in findings]
+    assert severities == sorted(severities, key=lambda s: dg.SEVERITY_ORDER[s])
+    infos = [d.code for d in findings if d.severity == "info"]
+    assert infos == sorted(infos)
+    assert dg.top_severity(findings) == "high"
+    assert dg.top_severity([]) is None
+
+
+def test_a_healthy_short_conversation_has_no_findings():
+    assert run_diagnoses(_known(peak_context_tokens=20_000, enabled_tools=["calculator"])) == []
+
+
+def test_to_dict_is_the_wire_shape():
+    d = dg.cost_unknown(ProfileFacts())
+    assert set(d.to_dict()) == {"code", "severity", "headline", "evidence", "suggestion", "ref"}
+    assert d.to_dict()["evidence"] is not d.evidence  # a copy, not the frozen instance's dict
diff --git a/backend/tests/apis/app_api/admin/costs/test_drilldown_routes.py b/backend/tests/apis/app_api/admin/costs/test_drilldown_routes.py
new file mode 100644
index 000000000..7f05d0798
--- /dev/null
+++ b/backend/tests/apis/app_api/admin/costs/test_drilldown_routes.py
@@ -0,0 +1,133 @@
+"""Routes for the content-free drill-down.
+
+- GET /admin/costs/users/{user_id}/sessions  → 200, query params reach the service
+- GET /admin/costs/sessions/{session_id}/profile → 200 / 404 / 500 mapping
+
+Auth is satisfied via `override_admin_auth` (the scope closure by qualname);
+the service is swapped through the router's own `get_cost_service` dependency.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from apis.app_api.admin.costs import routes as cost_routes
+from apis.app_api.admin.costs.models import (
+    AttachmentProfile,
+    SessionProfile,
+    UserSessionSummary,
+    UserSessionsResponse,
+)
+from tests.conftest import override_admin_auth
+
+
+def _app(service):
+    app = FastAPI()
+    app.include_router(cost_routes.router)
+    override_admin_auth(app, lambda: SimpleNamespace(user_id="admin", email="a@x", roles=["system_admin"]))
+    app.dependency_overrides[cost_routes.get_cost_service] = lambda: service
+    return app
+
+
+def _summary(session_id="s1"):
+    return UserSessionSummary(session_id=session_id, cost_known=True, total_cost=0.5)
+
+
+def _profile():
+    return SessionProfile(
+        session_id="s1",
+        user_id="u1",
+        session=_summary(),
+        call_count=0,
+        compaction_threshold=100_000,
+        attachments=AttachmentProfile(),
+    )
+
+
+def test_user_sessions_returns_200_and_forwards_query_params():
+    service = SimpleNamespace(get_user_sessions=AsyncMock(return_value=UserSessionsResponse(
+        user_id="u1", period="2026-09", sessions=[_summary()], total=1,
+    )))
+    client = TestClient(_app(service))
+
+    resp = client.get("/costs/users/u1/sessions", params={"period": "2026-09", "sort": "recent", "limit": 7})
+
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["userId"] == "u1" and body["sessions"][0]["sessionId"] == "s1"
+    assert body["sessions"][0]["costKnown"] is True
+    service.get_user_sessions.assert_awaited_once_with(
+        user_id="u1", period="2026-09", all_time=False, sort="recent", limit=7,
+    )
+
+
+def test_all_time_overrides_the_period():
+    service = SimpleNamespace(get_user_sessions=AsyncMock(return_value=UserSessionsResponse(
+        user_id="u1", period=None, sessions=[], total=0,
+    )))
+    client = TestClient(_app(service))
+
+    resp = client.get("/costs/users/u1/sessions", params={"period": "2026-09", "allTime": "true"})
+
+    assert resp.status_code == 200
+    service.get_user_sessions.assert_awaited_once_with(
+        user_id="u1", period=None, all_time=True, sort="cost", limit=100,
+    )
+
+
+def test_user_sessions_rejects_an_unknown_sort_and_a_bad_period():
+    service = SimpleNamespace(get_user_sessions=AsyncMock())
+    client = TestClient(_app(service))
+    assert client.get("/costs/users/u1/sessions", params={"sort": "title"}).status_code == 422
+    assert client.get("/costs/users/u1/sessions", params={"period": "Sept 2026"}).status_code == 422
+    service.get_user_sessions.assert_not_awaited()
+
+
+def test_user_sessions_maps_service_failure_to_500():
+    service = SimpleNamespace(get_user_sessions=AsyncMock(side_effect=RuntimeError("boom")))
+    client = TestClient(_app(service))
+    resp = client.get("/costs/users/u1/sessions")
+    assert resp.status_code == 500
+    assert "boom" not in resp.text  # no internal detail leaks
+
+
+def test_session_profile_returns_200():
+    service = SimpleNamespace(get_session_profile=AsyncMock(return_value=_profile()))
+    client = TestClient(_app(service))
+    resp = client.get("/costs/sessions/s1/profile")
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["sessionId"] == "s1" and body["compactionThreshold"] == 100_000
+    assert body["dataCoverage"] == {"toolCensus": False, "compactionCount": False, "fingerprints": False, "cost": False}
+    service.get_session_profile.assert_awaited_once_with("s1")
+
+
+def test_session_profile_404s_when_the_session_has_no_row():
+    service = SimpleNamespace(get_session_profile=AsyncMock(return_value=None))
+    client = TestClient(_app(service))
+    assert client.get("/costs/sessions/missing/profile").status_code == 404
+
+
+def test_session_profile_maps_service_failure_to_500():
+    service = SimpleNamespace(get_session_profile=AsyncMock(side_effect=RuntimeError("boom")))
+    client = TestClient(_app(service))
+    assert client.get("/costs/sessions/s1/profile").status_code == 500
+
+
+def test_both_routes_are_denied_without_the_scope():
+    app = FastAPI()
+    app.include_router(cost_routes.router)
+
+    def deny():
+        from fastapi import HTTPException
+        raise HTTPException(status_code=403, detail="Access denied.")
+
+    override_admin_auth(app, deny)
+    app.dependency_overrides[cost_routes.get_cost_service] = lambda: SimpleNamespace()
+    client = TestClient(app)
+    assert client.get("/costs/users/u1/sessions").status_code == 403
+    assert client.get("/costs/sessions/s1/profile").status_code == 403
diff --git a/backend/tests/apis/app_api/admin/costs/test_session_profile_service.py b/backend/tests/apis/app_api/admin/costs/test_session_profile_service.py
new file mode 100644
index 000000000..83a10ab11
--- /dev/null
+++ b/backend/tests/apis/app_api/admin/costs/test_session_profile_service.py
@@ -0,0 +1,208 @@
+"""`AdminCostService.get_session_profile` — the per-conversation diagnostic.
+
+Pins the derivations an admin (or a model handed the JSON) reasons from:
+the context trajectory, fingerprint churn with its agent-switch explanation,
+the attachment and tool censuses, the coverage flags, and that the diagnoses
+are computed on the refined per-call facts rather than the row's rollups.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock
+
+import pytest
+
+from apis.app_api.admin.costs.service import AdminCostService
+
+
+def _row(**overrides):
+    row = {
+        "sessionId": "s1",
+        "userId": "u1",
+        "status": "active",
+        "messageCount": 8,
+        "totalCost": 1.0,
+        "lastContextTokens": 50_000,
+        "contextWindow": 200_000,
+        "totalCacheReadTokens": 1,
+        "totalCacheWriteTokens": 1,
+        "preferences": {"lastModel": "m1", "enabledTools": ["calculator", "analyze_spreadsheet"]},
+        "compaction": {"checkpoint": 3, "truncationAnchor": 3, "totalSummarizedTurns": 1, "summaryChars": 800},
+    }
+    row.update(overrides)
+    return row
+
+
+def _call(i, *, ctx_in=100, read=0, write=0, status="hit", model="m1", switched=False, fp=None, tool_calls=None, cost=0.01):
+    rec = {
+        "timestamp": f"2026-09-02T00:00:{i:02d}Z",
+        "messageId": i,
+        "tokenUsage": {"inputTokens": ctx_in, "outputTokens": 5, "cacheReadInputTokens": read, "cacheWriteInputTokens": write},
+        "modelInfo": {"modelId": model},
+        "cost": {"total": cost},
+        "cacheStatus": status,
+        "agentSwitched": switched,
+    }
+    if fp is not None:
+        rec["prefixFingerprints"] = fp
+    if tool_calls is not None:
+        rec["toolCalls"] = tool_calls
+    return rec
+
+
+def _service(row, records, files=None, period_cost=None):
+    service = AdminCostService.__new__(AdminCostService)
+    service.storage = AsyncMock()
+    service.storage.get_session_diagnostic_row = AsyncMock(return_value=row)
+    service.storage.get_session_cost_records = AsyncMock(return_value=records)
+    service.storage.get_user_cost_summary = AsyncMock(
+        return_value={"totalCost": period_cost} if period_cost is not None else None
+    )
+    service._file_repository = AsyncMock()
+    service._file_repository.list_session_file_stats = AsyncMock(return_value=files or [])
+    return service
+
+
+@pytest.mark.asyncio
+async def test_none_when_the_session_has_no_row():
+    assert await _service(None, []).get_session_profile("nope") is None
+
+
+@pytest.mark.asyncio
+async def test_trajectory_is_the_three_bucket_sum_in_call_order():
+    records = [
+        _call(0, ctx_in=1_000, read=0, write=4_000, status="first_write"),
+        _call(1, ctx_in=200, read=4_000, write=300, status="hit"),
+        _call(2, ctx_in=150, read=4_300, write=200, status="hit"),
+    ]
+    p = await _service(_row(), records).get_session_profile("s1")
+    assert [pt.context_tokens for pt in p.context_trajectory] == [5_000, 4_500, 4_650]
+    assert [pt.call_index for pt in p.context_trajectory] == [0, 1, 2]
+    assert p.peak_context_tokens == 5_000
+    assert p.call_count == 3
+    assert p.write_read_ratio == round(4_500 / 8_300, 3)
+    assert p.context_trajectory[0].cost == 0.01
+
+
+@pytest.mark.asyncio
+async def test_peak_falls_back_to_the_row_when_there_are_no_call_rows():
+    p = await _service(_row(lastContextTokens=77_000, totalCacheReadTokens=10, totalCacheWriteTokens=5), []).get_session_profile("s1")
+    assert p.peak_context_tokens == 77_000
+    assert p.write_read_ratio == 0.5  # from the rollups
+    assert p.context_trajectory == []
+
+
+@pytest.mark.asyncio
+async def test_model_mix_and_fingerprint_churn_with_agent_switch_explanation():
+    fp_a = {"systemPromptHash": "sA", "toolConfigHash": "tA", "historyHash": "h", "messageCount": 1}
+    fp_b = {"systemPromptHash": "sB", "toolConfigHash": "tB", "historyHash": "h", "messageCount": 2}
+    fp_c = {"systemPromptHash": "sC", "toolConfigHash": "tA", "historyHash": "h", "messageCount": 3}
+    records = [
+        _call(0, model="m1", fp=fp_a),
+        _call(1, model="m2", fp=fp_b, switched=True),   # explained: an @-mention
+        _call(2, model="m1", fp=fp_c),                  # unexplained system-prompt change
+    ]
+    p = await _service(_row(), records).get_session_profile("s1")
+    assert p.model_mix == {"m1": 2, "m2": 1}
+    assert p.fingerprint_changes.system_prompt == 2
+    assert p.fingerprint_changes.tool_config == 2
+    assert p.fingerprint_changes.explained_by_agent_switch == 1
+    assert p.data_coverage.fingerprints is True
+    # Distinct hashes among NON-switched calls: sA, sC → SYSTEM_PROMPT_MUTATED fires;
+    # tool hashes among non-switched calls are both tA → TOOLCONFIG_MUTATED does not.
+    codes = {d.code for d in p.diagnoses}
+    assert "SYSTEM_PROMPT_MUTATED" in codes
+    assert "TOOLCONFIG_MUTATED" not in codes
+
+
+@pytest.mark.asyncio
+async def test_attachments_are_counted_by_mime_and_bytes_never_named():
+    files = [
+        {"uploadId": "a", "mimeType": "application/pdf", "sizeBytes": 3_000_000},
+        {"uploadId": "b", "mimeType": "application/pdf", "sizeBytes": 2_500_000},
+        {"uploadId": "c", "mimeType": "text/csv", "sizeBytes": 10},
+    ]
+    p = await _service(_row(), [], files=files).get_session_profile("s1")
+    assert p.attachments.count == 3
+    assert p.attachments.total_bytes == 5_500_010
+    assert p.attachments.by_mime == {"application/pdf": 2, "text/csv": 1}
+    assert "ATTACHMENT_HEAVY" in {d.code for d in p.diagnoses}
+    assert "filename" not in p.model_dump(by_alias=True)["attachments"]
+
+
+@pytest.mark.asyncio
+async def test_a_failing_file_repository_degrades_to_an_empty_profile():
+    service = _service(_row(), [])
+    service._file_repository.list_session_file_stats = AsyncMock(side_effect=RuntimeError("no table"))
+    p = await service.get_session_profile("s1")
+    assert p.attachments.count == 0 and p.attachments.total_bytes == 0
+
+
+@pytest.mark.asyncio
+async def test_tool_census_aggregates_per_call_entries_and_sets_coverage():
+    records = [
+        _call(0, tool_calls={"list_assignments": {"calls": 2, "errors": 0}}),
+        _call(1, tool_calls={"list_assignments": {"calls": 1, "errors": 1}, "calculator": {"calls": 1, "errors": 0}}),
+        _call(2),  # a call with no tools
+    ]
+    p = await _service(_row(), records).get_session_profile("s1")
+    assert p.tool_census["list_assignments"].calls == 3
+    assert p.tool_census["list_assignments"].errors == 1
+    assert p.tool_census["calculator"].calls == 1
+    assert p.context_trajectory[1].tool_calls == {"list_assignments": 1, "calculator": 1}
+    assert p.context_trajectory[2].tool_calls is None
+    assert p.data_coverage.tool_census is True
+    assert p.session.tool_call_count == 4 and p.session.tool_error_count == 1
+
+
+@pytest.mark.asyncio
+async def test_coverage_flags_are_honest_when_nothing_optional_was_recorded():
+    p = await _service(_row(), [_call(0)]).get_session_profile("s1")
+    assert p.data_coverage.tool_census is False
+    assert p.data_coverage.compaction_count is False
+    assert p.data_coverage.fingerprints is False
+    assert p.data_coverage.cost is True
+    assert p.tool_census == {}
+    assert p.session.tool_call_count is None
+
+
+@pytest.mark.asyncio
+async def test_diagnoses_use_the_refined_peak_not_the_rows_last_context(monkeypatch):
+    monkeypatch.delenv("AGENTCORE_MEMORY_COMPACTION_TOKEN_THRESHOLD", raising=False)
+    # The row's last context is under the threshold, but an earlier call peaked over it.
+    records = [
+        _call(0, ctx_in=1_000, read=0, write=150_000, status="first_write"),
+        _call(1, ctx_in=500, read=10_000, write=140_000, status="partial_miss"),
+        _call(2, ctx_in=500, read=10_000, write=140_000, status="partial_miss"),
+    ]
+    p = await _service(_row(lastContextTokens=20_000), records).get_session_profile("s1")
+    assert p.peak_context_tokens == 151_000
+    codes = [d.code for d in p.diagnoses]
+    assert codes[0] == "PREFIX_SPIRAL"  # high sorts first
+    assert "OVER_COMPACTION_THRESHOLD" in codes
+    assert p.session.diagnosis_count == len(p.diagnoses)
+    assert p.session.top_diagnosis_severity == "high"
+    assert p.compaction_threshold == 100_000
+
+
+@pytest.mark.asyncio
+async def test_share_of_user_period_uses_the_current_month():
+    p = await _service(_row(totalCost=6.0), [], period_cost=8.0).get_session_profile("s1")
+    assert p.session.share_of_user_period == 75.0
+    assert "DOMINANT_SESSION" in {d.code for d in p.diagnoses}
+
+
+@pytest.mark.asyncio
+async def test_agent_cache_bypass_names_the_offending_ids():
+    p = await _service(_row(), []).get_session_profile("s1")
+    bypass = next(d for d in p.diagnoses if d.code == "AGENT_CACHE_BYPASS")
+    assert bypass.evidence["bypassingToolIds"] == ["analyze_spreadsheet"]
+    assert p.enabled_tool_ids == ["analyze_spreadsheet", "calculator"]
+
+
+@pytest.mark.asyncio
+async def test_the_whole_profile_serializes_without_content_bearing_keys():
+    from apis.shared.observability.content_policy import content_bearing_paths
+    files = [{"uploadId": "a", "mimeType": "application/pdf", "sizeBytes": 1}]
+    p = await _service(_row(), [_call(0, tool_calls={"t": {"calls": 1, "errors": 0}})], files=files).get_session_profile("s1")
+    assert content_bearing_paths(p.model_dump(by_alias=True)) == []
diff --git a/backend/tests/apis/app_api/admin/costs/test_top_users_enrichment.py b/backend/tests/apis/app_api/admin/costs/test_top_users_enrichment.py
new file mode 100644
index 000000000..c07560de9
--- /dev/null
+++ b/backend/tests/apis/app_api/admin/costs/test_top_users_enrichment.py
@@ -0,0 +1,110 @@
+"""Top-users enrichment — email, tier and quota share on the cost table.
+
+The table exists so the user about to hit their quota is visible without
+opening every row, so `quotaPercentage` is the column that matters. The
+enrichment is best-effort by design: a fork without the users table, an
+unlimited tier, or one failing lookup must each degrade to `None` on that
+row and leave the rest of the page intact.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+import pytest
+
+from apis.app_api.admin.costs.service import AdminCostService
+
+
+def _profile(user_id, email="u@x.edu"):
+    return SimpleNamespace(user_id=user_id, email=email, name="U", roles=["faculty"])
+
+
+def _resolved(limit):
+    return SimpleNamespace(tier=SimpleNamespace(tier_name="Faculty", monthly_cost_limit=limit))
+
+
+def _service(users, *, enabled=True, profiles=None, resolver=None):
+    service = AdminCostService.__new__(AdminCostService)
+    service.storage = AsyncMock()
+    service.storage.get_top_users_by_cost = AsyncMock(return_value=[
+        {"userId": uid, "totalCost": cost, "totalRequests": 1, "lastUpdated": "t"}
+        for uid, cost in users
+    ])
+    profiles = profiles or {}
+    service._user_repository = SimpleNamespace(
+        enabled=enabled,
+        get_user_by_user_id=AsyncMock(side_effect=lambda uid: profiles.get(uid)),
+    )
+    service._quota_resolver = resolver or SimpleNamespace(
+        resolve_user_quota=AsyncMock(return_value=_resolved(30.0))
+    )
+    return service
+
+
+@pytest.mark.asyncio
+async def test_rows_gain_email_tier_and_quota_share():
+    service = _service([("u1", 22.5), ("u2", 3.0)], profiles={"u1": _profile("u1"), "u2": _profile("u2", "b@x.edu")})
+    rows = await service.get_top_users(period="2026-09")
+    by_id = {r.user_id: r for r in rows}
+    assert by_id["u1"].email == "u@x.edu" and by_id["u1"].tier_name == "Faculty"
+    assert by_id["u1"].quota_limit == 30.0 and by_id["u1"].quota_percentage == 75.0
+    assert by_id["u2"].quota_percentage == 10.0
+    # Cost ordering from storage is untouched by enrichment.
+    assert [r.user_id for r in rows] == ["u1", "u2"]
+
+
+@pytest.mark.asyncio
+async def test_an_unlimited_tier_reports_no_share():
+    service = _service([("u1", 22.5)], profiles={"u1": _profile("u1")},
+                       resolver=SimpleNamespace(resolve_user_quota=AsyncMock(return_value=_resolved(float("inf")))))
+    row = (await service.get_top_users())[0]
+    assert row.email == "u@x.edu" and row.tier_name == "Faculty"
+    assert row.quota_limit is None and row.quota_percentage is None
+
+
+@pytest.mark.asyncio
+async def test_a_disabled_users_table_leaves_every_row_unenriched():
+    service = _service([("u1", 22.5)], enabled=False, profiles={"u1": _profile("u1")})
+    row = (await service.get_top_users())[0]
+    assert row.email is None and row.tier_name is None and row.quota_percentage is None
+    service._user_repository.get_user_by_user_id.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_an_unknown_user_id_is_skipped_not_fatal():
+    service = _service([("ghost", 1.0), ("u1", 2.0)], profiles={"u1": _profile("u1")})
+    rows = await service.get_top_users()
+    by_id = {r.user_id: r for r in rows}
+    assert by_id["ghost"].email is None
+    assert by_id["u1"].quota_percentage == pytest.approx(6.7)
+
+
+@pytest.mark.asyncio
+async def test_one_failing_lookup_does_not_blank_the_others():
+    profiles = {"u1": _profile("u1"), "u2": _profile("u2")}
+    service = _service([("u1", 3.0), ("u2", 6.0)], profiles=profiles)
+
+    async def resolve(user):
+        if user.user_id == "u1":
+            raise RuntimeError("quota table hiccup")
+        return _resolved(30.0)
+
+    service._quota_resolver = SimpleNamespace(resolve_user_quota=AsyncMock(side_effect=resolve))
+    rows = await service.get_top_users()
+    by_id = {r.user_id: r for r in rows}
+    assert by_id["u1"].email == "u@x.edu" and by_id["u1"].quota_percentage is None
+    assert by_id["u2"].quota_percentage == 20.0
+
+
+@pytest.mark.asyncio
+async def test_an_unconstructible_user_repository_is_not_an_error():
+    service = _service([("u1", 1.0)])
+    # Simulate a fork where constructing the repository itself blows up.
+    def boom():
+        raise RuntimeError("no boto3 session")
+    service._user_repository = None
+    service._users = boom  # type: ignore[method-assign]
+    rows = await service.get_top_users()
+    assert rows[0].email is None
diff --git a/backend/tests/apis/app_api/admin/costs/test_user_sessions_service.py b/backend/tests/apis/app_api/admin/costs/test_user_sessions_service.py
new file mode 100644
index 000000000..811926d4e
--- /dev/null
+++ b/backend/tests/apis/app_api/admin/costs/test_user_sessions_service.py
@@ -0,0 +1,162 @@
+"""`AdminCostService.get_user_sessions` — the per-user conversation list.
+
+Storage is stubbed with the exact dict shape the content-free reader returns,
+so these tests pin the *mapping* and the *sorting contract*; the reader's own
+content-freedom is proven separately against moto.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock
+
+import pytest
+
+from apis.app_api.admin.costs.service import AdminCostService
+
+
+def _row(session_id="s1", **overrides):
+    row = {
+        "sessionId": session_id,
+        "userId": "u1",
+        "status": "active",
+        "createdAt": "2026-09-01T00:00:00Z",
+        "lastMessageAt": "2026-09-02T00:00:00Z",
+        "messageCount": 6,
+        "totalCost": 0.5,
+        "lastContextTokens": 20_000,
+        "contextWindow": 200_000,
+        "totalCacheReadTokens": 100_000,
+        "totalCacheWriteTokens": 10_000,
+        "partialMissCount": 0,
+        "partialMissUsd": 0.0,
+        "wastedUsd": 0.0,
+        "preferences": {
+            "lastModel": "us.anthropic.claude-haiku-4-5-20251001-v1:0",
+            "enabledTools": ["calculator", "browse_web"],
+        },
+        "compaction": {"checkpoint": 0, "truncationAnchor": 0, "totalSummarizedTurns": 0, "summaryChars": 400},
+    }
+    row.update(overrides)
+    return row
+
+
+def _service(rows, period_cost=None):
+    service = AdminCostService.__new__(AdminCostService)
+    service.storage = AsyncMock()
+    service.storage.get_user_session_diagnostics = AsyncMock(return_value=rows)
+    service.storage.get_user_cost_summary = AsyncMock(
+        return_value={"totalCost": period_cost} if period_cost is not None else None
+    )
+    return service
+
+
+@pytest.mark.asyncio
+async def test_a_row_maps_to_a_content_free_summary():
+    resp = await _service([_row()], period_cost=2.0).get_user_sessions("u1", period="2026-09")
+    s = resp.sessions[0]
+    assert s.session_id == "s1"
+    assert s.model_id.startswith("us.anthropic")
+    assert s.enabled_tool_count == 2 and s.agent_bound is False
+    assert s.context_share == 0.1
+    assert s.cost_known and s.total_cost == 0.5
+    assert s.share_of_user_period == 25.0
+    assert s.cache_efficiency == pytest.approx(100_000 / 110_000, abs=1e-4)
+    assert s.summary_approx_tokens == 100
+    assert s.tool_call_count is None and s.compaction_count is None  # not tracked
+    assert resp.user_period_cost == 2.0 and resp.period == "2026-09"
+    # Nothing content-bearing exists on the model to leak; a dump proves the shape.
+    assert "title" not in s.model_dump(by_alias=True)
+
+
+@pytest.mark.asyncio
+async def test_unknown_cost_rows_are_listed_flagged_and_trail_under_cost_sort():
+    rows = [
+        _row("cheap", totalCost=0.1),
+        _row("unknown", totalCost=None, lastMessageAt="2026-09-09T00:00:00Z"),
+        _row("pricey", totalCost=3.0),
+    ]
+    resp = await _service(rows).get_user_sessions("u1", sort="cost")
+    assert [s.session_id for s in resp.sessions] == ["pricey", "cheap", "unknown"]
+    unknown = resp.sessions[-1]
+    assert unknown.cost_known is False and unknown.total_cost is None
+    assert unknown.share_of_user_period is None
+    assert resp.unknown_cost_count == 1 and resp.total == 3
+    # The list carries counts and a top severity, not codes (those are on the
+    # profile). An otherwise-healthy row with no cost fires exactly COST_UNKNOWN.
+    assert unknown.diagnosis_count == 1 and unknown.top_diagnosis_severity == "info"
+    assert resp.sessions[0].diagnosis_count == 0
+
+
+@pytest.mark.asyncio
+async def test_sort_modes():
+    rows = [
+        _row("a", lastMessageAt="2026-09-01T00:00:00Z", lastContextTokens=5, messageCount=1),
+        _row("b", lastMessageAt="2026-09-03T00:00:00Z", lastContextTokens=50, messageCount=9),
+        _row("c", lastMessageAt="2026-09-02T00:00:00Z", lastContextTokens=500, messageCount=3),
+    ]
+    assert [s.session_id for s in (await _service(rows).get_user_sessions("u1", sort="recent")).sessions] == ["b", "c", "a"]
+    assert [s.session_id for s in (await _service(rows).get_user_sessions("u1", sort="context")).sessions] == ["c", "b", "a"]
+    assert [s.session_id for s in (await _service(rows).get_user_sessions("u1", sort="messages")).sessions] == ["b", "c", "a"]
+
+
+@pytest.mark.asyncio
+async def test_limit_applies_after_sorting_and_total_reports_the_universe():
+    rows = [_row(f"s{i}", totalCost=float(i)) for i in range(5)]
+    resp = await _service(rows).get_user_sessions("u1", sort="cost", limit=2)
+    assert [s.session_id for s in resp.sessions] == ["s4", "s3"]
+    assert resp.total == 5
+
+
+@pytest.mark.asyncio
+async def test_all_time_drops_the_period_and_the_share():
+    service = _service([_row()], period_cost=2.0)
+    resp = await service.get_user_sessions("u1", period="2026-09", all_time=True)
+    assert resp.period is None and resp.user_period_cost is None
+    assert resp.sessions[0].share_of_user_period is None
+    # No period → no active_since filter reaches storage.
+    service.storage.get_user_session_diagnostics.assert_awaited_once_with(user_id="u1", active_since=None)
+    service.storage.get_user_cost_summary.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_period_scoping_passes_the_month_start_to_storage():
+    service = _service([])
+    await service.get_user_sessions("u1", period="2026-09")
+    service.storage.get_user_session_diagnostics.assert_awaited_once_with(
+        user_id="u1", active_since="2026-09-01"
+    )
+
+
+@pytest.mark.asyncio
+async def test_row_level_diagnoses_fire_on_the_rollups(monkeypatch):
+    monkeypatch.delenv("AGENTCORE_MEMORY_COMPACTION_TOKEN_THRESHOLD", raising=False)
+    spiral = _row(
+        "spiral",
+        lastContextTokens=150_000,
+        totalCacheReadTokens=10_000,
+        totalCacheWriteTokens=400_000,
+        totalCost=30.0,
+        partialMissUsd=27.0,
+    )
+    resp = await _service([spiral]).get_user_sessions("u1")
+    s = resp.sessions[0]
+    assert s.top_diagnosis_severity == "high"
+    assert s.diagnosis_count >= 3  # spiral, partial-miss heavy, over threshold
+
+
+@pytest.mark.asyncio
+async def test_agent_bound_and_missing_preferences_are_tolerated():
+    rows = [_row("bound", preferences={"assistantId": "agent-9"}), _row("bare", preferences=None)]
+    resp = await _service(rows).get_user_sessions("u1", sort="recent")
+    by_id = {s.session_id: s for s in resp.sessions}
+    assert by_id["bound"].agent_bound is True and by_id["bound"].enabled_tool_count is None
+    assert by_id["bare"].agent_bound is False and by_id["bare"].model_id is None
+
+
+@pytest.mark.asyncio
+async def test_a_broken_period_cost_lookup_degrades_to_no_share():
+    service = _service([_row()])
+    service.storage.get_user_cost_summary = AsyncMock(side_effect=RuntimeError("ddb down"))
+    resp = await service.get_user_sessions("u1", period="2026-09")
+    assert resp.user_period_cost is None
+    assert resp.sessions[0].share_of_user_period is None
diff --git a/backend/tests/apis/inference_api/test_agent_binding_policy.py b/backend/tests/apis/inference_api/test_agent_binding_policy.py
index 98aba6d20..3b675c5a4 100644
--- a/backend/tests/apis/inference_api/test_agent_binding_policy.py
+++ b/backend/tests/apis/inference_api/test_agent_binding_policy.py
@@ -1,4 +1,4 @@
-"""Agent Marketplace Phase 7 — does this turn's Agent bind the conversation? (D11)
+"""Agent Marketplace Phase 7 (D11, revised) — does this turn's Agent bind the conversation?
 
 The rule is small; what it guards is not. Binding does two things that must move together:
 it *refuses* a second Agent (and any Agent at all once the thread has messages), and it
@@ -12,7 +12,14 @@
 * persist but don't validate → one `@` annexes the whole conversation, and every later
   message goes to the mentioned Agent whether the user wanted that or not.
 
-So both call sites in ``routes.py`` ask this one question.
+So both call sites in ``routes.py`` ask this one question — and, since the thread-empty
+case was added, they must ask it with the *same arguments*.
+
+**Why a mention on an empty thread now binds.** The original per-turn reading left the next
+message plain, which silently stripped the Agent's tools, skills and model from a
+conversation the user still believed was the Agent's. Measured in prod: of 247 mentions,
+247 started the conversation and none was a mid-thread consult, so the per-turn borrow was
+paying a real failure mode for a case nobody used.
 """
 
 import pytest
@@ -21,31 +28,62 @@
 
 
 @pytest.mark.parametrize(
-    "is_agent_mention,is_preview,expected",
+    "is_agent_mention,is_preview,thread_is_empty,expected",
     [
-        # An ordinary Agent conversation: validated and persisted.
-        (False, False, True),
-        # A mention borrows the Agent for one turn (D11).
-        (True, False, False),
-        # An editor preview persists nothing by design.
-        (False, True, False),
-        # A mention inside a preview is still not a binding.
-        (True, True, False),
+        # An ordinary Agent conversation: validated and persisted, empty or not.
+        (False, False, True, True),
+        (False, False, False, True),
+        # A mention that STARTS a thread is a launch — it binds.
+        (True, False, True, True),
+        # A mention into a thread that already has messages does not (legacy clients
+        # only; the SPA opens a new conversation instead of sending this).
+        (True, False, False, False),
+        # An editor preview persists nothing by design — including on an empty thread,
+        # which every preview session is.
+        (False, True, True, False),
+        (False, True, False, False),
+        (True, True, True, False),
+        (True, True, False, False),
     ],
 )
-def test_binding_matrix(is_agent_mention, is_preview, expected):
+def test_binding_matrix(is_agent_mention, is_preview, thread_is_empty, expected):
     assert (
-        binds_conversation(is_agent_mention=is_agent_mention, is_preview=is_preview)
+        binds_conversation(
+            is_agent_mention=is_agent_mention,
+            is_preview=is_preview,
+            thread_is_empty=thread_is_empty,
+        )
         is expected
     )
 
 
-def test_a_plain_agent_turn_is_the_only_thing_that_binds():
-    """Stated positively, because this is the case the two guards exist for."""
-    assert binds_conversation(is_agent_mention=False, is_preview=False) is True
+def test_preview_never_binds_whatever_else_is_true():
+    """Preview is the one unconditional no: it is a scratch session by construction."""
+    for mention in (True, False):
+        for empty in (True, False):
+            assert not binds_conversation(
+                is_agent_mention=mention, is_preview=True, thread_is_empty=empty
+            )
+
+
+def test_a_thread_starting_mention_binds():
+    """The case the change exists for, stated positively.
+
+    Before this, the turn ran as the Agent and the *next* one did not — with no signal
+    to the user and none to the model, which then explained a vanished tool as something
+    to fix in the tool picker.
+    """
+    assert binds_conversation(
+        is_agent_mention=True, is_preview=False, thread_is_empty=True
+    )
+
 
+def test_thread_is_empty_defaults_to_the_conservative_answer():
+    """Omitting the argument must not silently upgrade a mention into a binding.
 
-def test_a_mention_never_binds_however_it_is_combined():
-    """A mention is the user naming who answers *this* message — never a commitment."""
+    The default exists for callers that cannot cheaply answer it; it has to mean "assume
+    there is history", because the opposite default would let a mid-thread mention annex
+    a conversation whenever someone forgot to pass it.
+    """
     assert not binds_conversation(is_agent_mention=True, is_preview=False)
-    assert not binds_conversation(is_agent_mention=True, is_preview=True)
+    assert binds_conversation(is_agent_mention=False, is_preview=False)
diff --git a/backend/tests/costs/test_content_free_projections.py b/backend/tests/costs/test_content_free_projections.py
new file mode 100644
index 000000000..ffaf7085f
--- /dev/null
+++ b/backend/tests/costs/test_content_free_projections.py
@@ -0,0 +1,159 @@
+"""The content-free storage readers, against a real (moto) table.
+
+Seeds rows that *carry* every kind of content the denylist names — a title, a
+custom prompt, a compaction summary, citation text, display text — and asserts
+none of it comes back through the three admin readers, while the numbers next
+to it do. The one reader that keeps `title` by decision is pinned too, so a
+future "harden everything" sweep does not change it by accident.
+"""
+
+from __future__ import annotations
+
+from decimal import Decimal
+
+import pytest
+
+from apis.shared.observability.content_policy import content_bearing_paths
+
+SESSION_ID = "sess-diag-1"
+USER_ID = "user-diag-1"
+SUMMARY = "s" * 2_000
+
+
+def _seed(storage):
+    table = storage.sessions_metadata_table
+    table.put_item(Item={
+        "PK": f"USER#{USER_ID}",
+        "SK": f"S#{SESSION_ID}",
+        "GSI_PK": f"SESSION#{SESSION_ID}",
+        "GSI_SK": "META",
+        "sessionId": SESSION_ID,
+        "userId": USER_ID,
+        "title": "SECRET TITLE",
+        "tags": ["secret-tag"],
+        "status": "active",
+        "createdAt": "2026-09-01T00:00:00Z",
+        "lastMessageAt": "2026-09-02T00:00:00Z",
+        "messageCount": Decimal(4),
+        "totalCost": Decimal("1.25"),
+        "lastContextTokens": Decimal(120_000),
+        "contextWindow": Decimal(200_000),
+        "totalCacheReadTokens": Decimal(10_000),
+        "totalCacheWriteTokens": Decimal(40_000),
+        "partialMissCount": Decimal(2),
+        "partialMissUsd": Decimal("0.9"),
+        "wastedUsd": Decimal("0.9"),
+        "preferences": {
+            "lastModel": "us.anthropic.claude-haiku-4-5-20251001-v1:0",
+            "enabledTools": ["calculator", "analyze_spreadsheet"],
+            "customPromptText": "SECRET PROMPT",
+            "assistantId": "agent-1",
+        },
+        "compaction": {
+            "checkpoint": Decimal(34),
+            "truncationAnchor": Decimal(68),
+            "totalSummarizedTurns": Decimal(12),
+            "summary": SUMMARY,
+        },
+        "pausedTurn": {"modelId": "m", "prompt": "SECRET"},
+    })
+    table.put_item(Item={
+        "PK": f"USER#{USER_ID}",
+        "SK": "C#2026-09-02T00:00:00Z#abc",
+        "GSI_PK": f"SESSION#{SESSION_ID}",
+        "GSI_SK": "C#2026-09-02T00:00:00Z",
+        "GSI1PK": f"USER#{USER_ID}",
+        "GSI1SK": "2026-09-02T00:00:00Z",
+        "sessionId": SESSION_ID,
+        "messageId": Decimal(3),
+        "timestamp": "2026-09-02T00:00:00Z",
+        "tokenUsage": {
+            "inputTokens": Decimal(100),
+            "outputTokens": Decimal(50),
+            "cacheReadInputTokens": Decimal(10_000),
+            "cacheWriteInputTokens": Decimal(40_000),
+        },
+        "modelInfo": {
+            "modelId": "us.anthropic.claude-haiku-4-5-20251001-v1:0",
+            "modelName": "Claude Haiku 4.5",
+            "pricingSnapshot": {"inputPricePerMtok": Decimal("1.1")},
+        },
+        "cost": {"total": Decimal("0.05")},
+        "cacheStatus": "partial_miss",
+        "wastedUsd": Decimal("0.04"),
+        "agentSwitched": False,
+        "prefixFingerprints": {"toolConfigHash": "abc", "systemPromptHash": "def", "historyHash": "ghi", "messageCount": Decimal(3)},
+        "citations": [{"text": "SECRET CITATION", "fileName": "secret.pdf", "documentId": "d1"}],
+        "displayText": "SECRET USER MESSAGE",
+    })
+
+
+@pytest.mark.asyncio
+async def test_user_session_diagnostics_returns_numbers_and_no_content(storage):
+    _seed(storage)
+    rows = await storage.get_user_session_diagnostics(USER_ID)
+    assert len(rows) == 1
+    row = rows[0]
+
+    assert content_bearing_paths(row) == []
+    assert "title" not in row and "tags" not in row and "pausedTurn" not in row
+    # The summary was measured, then dropped.
+    assert row["compaction"]["summaryChars"] == len(SUMMARY)
+    assert "summary" not in row["compaction"]
+    assert row["compaction"]["checkpoint"] == 34 and row["compaction"]["truncationAnchor"] == 68
+    # Preferences reduced to the allowlisted keys — the custom prompt is gone.
+    assert row["preferences"] == {
+        "lastModel": "us.anthropic.claude-haiku-4-5-20251001-v1:0",
+        "enabledTools": ["calculator", "analyze_spreadsheet"],
+        "assistantId": "agent-1",
+    }
+    # And the numbers came through as floats/ints.
+    assert row["totalCost"] == 1.25 and row["lastContextTokens"] == 120_000
+
+
+@pytest.mark.asyncio
+async def test_session_diagnostic_row_resolves_by_session_id_only(storage):
+    _seed(storage)
+    row = await storage.get_session_diagnostic_row(SESSION_ID)
+    assert row is not None and row["userId"] == USER_ID
+    assert content_bearing_paths(row) == []
+    assert row["compaction"]["summaryChars"] == len(SUMMARY)
+    assert await storage.get_session_diagnostic_row("no-such-session") is None
+
+
+@pytest.mark.asyncio
+async def test_session_cost_records_no_longer_carry_citation_text(storage):
+    _seed(storage)
+    records = await storage.get_session_cost_records(SESSION_ID)
+    assert len(records) == 1
+    rec = records[0]
+    assert content_bearing_paths(rec) == []
+    assert "citations" not in rec and "displayText" not in rec
+    # Only the model id survives from modelInfo — pricing is not the anatomy's business.
+    assert rec["modelInfo"] == {"modelId": "us.anthropic.claude-haiku-4-5-20251001-v1:0"}
+    # Everything the anatomy reads is still there.
+    assert rec["cacheStatus"] == "partial_miss"
+    assert rec["tokenUsage"]["cacheWriteInputTokens"] == 40_000
+    assert rec["prefixFingerprints"]["systemPromptHash"] == "def"
+    assert rec["cost"] == {"total": 0.05}
+
+
+@pytest.mark.asyncio
+async def test_top_sessions_reader_keeps_title_by_decision(storage):
+    # Pinned on purpose: the "most expensive conversations" table shows the
+    # title. If this ever changes it should change in a PR that says so.
+    _seed(storage)
+    rows = await storage.get_user_session_costs(USER_ID)
+    assert rows[0]["title"] == "SECRET TITLE"
+    assert "compaction" not in rows[0]  # and it never widened into the diagnostic fields
+
+
+@pytest.mark.asyncio
+async def test_deleted_sessions_are_excluded_from_the_diagnostic_list(storage):
+    _seed(storage)
+    storage.sessions_metadata_table.put_item(Item={
+        "PK": f"USER#{USER_ID}", "SK": "S#gone", "GSI_PK": "SESSION#gone", "GSI_SK": "META",
+        "sessionId": "gone", "userId": USER_ID, "deleted": True, "totalCost": Decimal("9"),
+    })
+    rows = await storage.get_user_session_diagnostics(USER_ID)
+    assert [r["sessionId"] for r in rows] == [SESSION_ID]
diff --git a/backend/tests/lambdas/test_kb_born_managed.py b/backend/tests/lambdas/test_kb_born_managed.py
index cd696892b..2b1b38490 100644
--- a/backend/tests/lambdas/test_kb_born_managed.py
+++ b/backend/tests/lambdas/test_kb_born_managed.py
@@ -149,7 +149,35 @@ async def test_first_upload_declares_managed_and_queues_the_job(self, table, fla
         assert record["upgradeNoticeDismissedAt"]
 
     @pytest.mark.asyncio
-    async def test_a_second_upload_during_provisioning_also_waits(self, table, flag_on):
+    async def test_established_legacy_agent_with_documents_stays_legacy(self, table, flag_on):
+        """MUTATION GUARD: the bug this file's fix addresses. An established legacy
+        agent has documents but NO ``KB_Record`` — legacy knowledge bases are not
+        first-class, share one S3-Vectors index, and never wrote a record. So the
+        absence of a record looks identical to a brand-new agent's. Without the
+        existing-documents guard, the agent's *next* upload is mistaken for a first
+        upload and provisions a managed knowledge base: retrieval flips to the empty
+        managed KB and the existing corpus is stranded on the legacy index, never
+        re-ingested. Remove the guard and this fails — a managed record appears."""
+        _seed_doc(table, document_id="DOC-existing", status="complete")
+
+        assert await bm.begin_born_managed(ASSISTANT_ID, owner_user_id=OWNER) is False
+        # Untouched: no record written, so the next upload takes the legacy pipeline.
+        assert _kb(table) is None
+
+    @pytest.mark.asyncio
+    async def test_probe_that_cannot_tell_keeps_the_agent_on_legacy(self, table, flag_on):
+        """Fail-safe direction. When existence cannot be determined, born-managed
+        must NOT provision. Wrongly provisioning on a legacy agent loses its corpus
+        from retrieval; wrongly staying legacy is benign (Upgrade still works). The
+        helper returns True on any error, so this asserts the trigger honours that."""
+        from unittest.mock import AsyncMock as _AsyncMock
+
+        with patch(
+            "apis.app_api.documents.services.document_service.assistant_has_documents",
+            new=_AsyncMock(return_value=True),
+        ):
+            assert await bm.begin_born_managed(ASSISTANT_ID, owner_user_id=OWNER) is False
+        assert _kb(table) is None
         await bm.begin_born_managed(ASSISTANT_ID, owner_user_id=OWNER)
         before = _kb(table)["GSI7_SK"]
 
@@ -613,3 +641,41 @@ def test_the_two_halves_agree_on_the_status_string():
     They live in different Lambda images, so the constant is defined once and
     re-exported rather than spelled twice."""
     assert bm.STATUS_PROVISIONING == ic.STATUS_PROVISIONING == "provisioning"
+
+
+# ── 8. The existing-documents existence probe ────────────────────────────────
+class TestAssistantHasDocuments:
+    """The cheap COUNT probe born-managed uses to tell a new agent apart from an
+    established legacy one. It must not consult ownership (the caller already
+    authorised the upload) and must fail toward 'has documents' so uncertainty
+    keeps an agent on legacy rather than provisioning over its corpus."""
+
+    @pytest.mark.asyncio
+    async def test_true_when_a_document_row_exists(self, table):
+        from apis.app_api.documents.services.document_service import (
+            assistant_has_documents,
+        )
+
+        _seed_doc(table, document_id="DOC-x", status="complete")
+        assert await assistant_has_documents(ASSISTANT_ID) is True
+
+    @pytest.mark.asyncio
+    async def test_false_when_no_document_rows_exist(self, table):
+        from apis.app_api.documents.services.document_service import (
+            assistant_has_documents,
+        )
+
+        # A KB_Record is not a DOC# row: a record-only agent still counts as empty.
+        table.put_item(Item={"PK": r.kb_pk(ASSISTANT_ID), "SK": r.kb_sk(ASSISTANT_ID)})
+        assert await assistant_has_documents(ASSISTANT_ID) is False
+
+    @pytest.mark.asyncio
+    async def test_fails_toward_legacy_when_the_table_is_unconfigured(self, monkeypatch):
+        """No table name means the probe cannot answer — it returns True so
+        born-managed stays on legacy rather than provisioning blind."""
+        from apis.app_api.documents.services.document_service import (
+            assistant_has_documents,
+        )
+
+        monkeypatch.delenv("DYNAMODB_ASSISTANTS_TABLE_NAME", raising=False)
+        assert await assistant_has_documents(ASSISTANT_ID) is True
diff --git a/backend/tests/routes/test_document_delete_releases_bytes.py b/backend/tests/routes/test_document_delete_releases_bytes.py
new file mode 100644
index 000000000..a06066baa
--- /dev/null
+++ b/backend/tests/routes/test_document_delete_releases_bytes.py
@@ -0,0 +1,204 @@
+"""Deleting a document mid-upload must not strand its byte reservation.
+
+Feature: managed-kb-migration Requirement 12.6 (release on every abandon path).
+
+Found by deleting an `uploading` document in dev. Three defects surfaced; this file
+covers the byte-cap one, which is the invisible and cumulative one.
+
+The request-time reservation is taken when the upload URL is issued, and it is
+released by whichever terminal path the document reaches: a client-reported upload
+failure, the stale sweep, or the ingestion consumer's own terminal paths. **A deleted
+document reaches none of them.** Its row goes to `deleting` and nothing settles the
+bytes.
+
+Left unfixed the leak has the worst possible shape: silent, cumulative, and delayed.
+Every cancelled upload permanently shaves bytes off that assistant's allowance, and it
+presents months later as "uploads stopped working" with no failure anywhere near the
+deletes that caused it — precisely what `byte_cap.release`'s own docstring warns about.
+"""
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, patch
+
+import boto3
+import pytest
+from moto import mock_aws
+
+from apis.app_api.documents.services.document_service import soft_delete_document
+
+REGION = "us-east-1"
+TABLE = "test-delete-releases-bytes"
+ASSISTANT_ID = "ast-del01"
+DOCUMENT_ID = "DOC-del01"
+OWNER = "user-del01"
+SIZE = 4096
+
+
+@pytest.fixture()
+def table(monkeypatch):
+    monkeypatch.setenv("AWS_DEFAULT_REGION", REGION)
+    monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
+    monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
+    monkeypatch.setenv("AWS_SESSION_TOKEN", "testing")
+    monkeypatch.setenv("DYNAMODB_ASSISTANTS_TABLE_NAME", TABLE)
+
+    with mock_aws():
+        ddb = boto3.client("dynamodb", region_name=REGION)
+        ddb.create_table(
+            TableName=TABLE,
+            KeySchema=[
+                {"AttributeName": "PK", "KeyType": "HASH"},
+                {"AttributeName": "SK", "KeyType": "RANGE"},
+            ],
+            AttributeDefinitions=[
+                {"AttributeName": "PK", "AttributeType": "S"},
+                {"AttributeName": "SK", "AttributeType": "S"},
+            ],
+            BillingMode="PAY_PER_REQUEST",
+        )
+        yield boto3.resource("dynamodb", region_name=REGION).Table(TABLE)
+
+
+@pytest.fixture()
+def owned(table):
+    """`soft_delete_document` verifies ownership via `assistants.service.get_assistant`.
+
+    Patched rather than seeded: that lookup reads the assistant METADATA row and its
+    own permission model, none of which this suite is about. Stubbing it keeps the
+    test aimed at the byte accounting.
+    """
+    with patch(
+        "apis.shared.assistants.service.get_assistant",
+        new_callable=AsyncMock,
+        return_value=SimpleNamespace(assistant_id=ASSISTANT_ID, owner_id=OWNER),
+    ):
+        yield table
+
+
+def _seed(table, *, engine="managed", status="uploading", size=SIZE, reserved=SIZE):
+    """A managed KB holding a reservation, plus the uploading document that took it."""
+    item = {
+        "PK": f"AST#{ASSISTANT_ID}",
+        "SK": f"KB#{ASSISTANT_ID}",
+        "appKbId": ASSISTANT_ID,
+        "ownerUserId": OWNER,
+        "storedBytes": 0,
+        "reservedBytes": reserved,
+        "totalBytes": reserved,
+    }
+    if engine == "managed":
+        item["retrievalEngine"] = "managed"
+    table.put_item(Item=item)
+    table.put_item(
+        Item={
+            "PK": f"AST#{ASSISTANT_ID}",
+            "SK": f"DOC#{DOCUMENT_ID}",
+            "documentId": DOCUMENT_ID,
+            "assistantId": ASSISTANT_ID,
+            "filename": "half-uploaded.pdf",
+            "contentType": "application/pdf",
+            "sizeBytes": size,
+            "s3Key": f"assistants/{ASSISTANT_ID}/documents/{DOCUMENT_ID}/half-uploaded.pdf",
+            "status": status,
+            "createdAt": "2026-09-11T00:00:00Z",
+            "updatedAt": "2026-09-11T00:00:00Z",
+        }
+    )
+
+
+def _kb(table):
+    return table.get_item(
+        Key={"PK": f"AST#{ASSISTANT_ID}", "SK": f"KB#{ASSISTANT_ID}"}
+    )["Item"]
+
+
+def _doc(table):
+    return table.get_item(
+        Key={"PK": f"AST#{ASSISTANT_ID}", "SK": f"DOC#{DOCUMENT_ID}"}
+    )["Item"]
+
+
+class TestDeleteReleasesTheReservation:
+    @pytest.mark.asyncio
+    async def test_deleting_an_uploading_document_returns_its_bytes(self, owned, table):
+        """MUTATION GUARD: remove the `release_reservation_if_managed` call from
+        `soft_delete_document` and this fails with reservedBytes still at 4096 — the
+        allowance permanently smaller for a document that never stored a byte."""
+        _seed(table)
+
+        document = await soft_delete_document(ASSISTANT_ID, DOCUMENT_ID, OWNER)
+
+        assert document is not None
+        assert _doc(table)["status"] == "deleting"
+        assert int(_kb(table)["reservedBytes"]) == 0
+        assert int(_kb(table)["totalBytes"]) == 0
+
+    @pytest.mark.asyncio
+    async def test_the_release_is_exactly_once(self, owned, table):
+        """A second settlement would over-credit the allowance, letting an owner
+        exceed their cap by deleting repeatedly. `settle_once` stamps the DOC# row, so
+        a re-delete (idempotent by design) releases nothing further."""
+        _seed(table)
+
+        await soft_delete_document(ASSISTANT_ID, DOCUMENT_ID, OWNER)
+        await soft_delete_document(ASSISTANT_ID, DOCUMENT_ID, OWNER)
+
+        assert int(_kb(table)["reservedBytes"]) == 0
+        assert int(_kb(table)["totalBytes"]) == 0
+        assert _doc(table).get("byteCapSettled")
+
+    @pytest.mark.asyncio
+    async def test_a_legacy_knowledge_base_is_untouched(self, owned, table):
+        """Legacy KBs are uncapped, so they hold no reservation to return. Touching
+        their counters here would invent accounting for a backend that has none."""
+        _seed(table, engine="s3vectors")
+
+        await soft_delete_document(ASSISTANT_ID, DOCUMENT_ID, OWNER)
+
+        assert int(_kb(table)["reservedBytes"]) == SIZE
+        assert not _doc(table).get("byteCapSettled")
+
+    @pytest.mark.asyncio
+    async def test_a_completed_document_already_settled_is_not_double_credited(self, owned, table):
+        """The ordinary case: ingestion finished, so the reservation was already
+        committed to storedBytes. Deleting must not now ALSO release it — that would
+        drive the counters negative. The stamp from the earlier settlement is what
+        stops it."""
+        _seed(table, status="complete", reserved=0)
+        table.update_item(
+            Key={"PK": f"AST#{ASSISTANT_ID}", "SK": f"DOC#{DOCUMENT_ID}"},
+            UpdateExpression="SET byteCapSettled = :t",
+            ExpressionAttributeValues={":t": True},
+        )
+        table.update_item(
+            Key={"PK": f"AST#{ASSISTANT_ID}", "SK": f"KB#{ASSISTANT_ID}"},
+            UpdateExpression="SET storedBytes = :s, totalBytes = :s",
+            ExpressionAttributeValues={":s": SIZE},
+        )
+
+        await soft_delete_document(ASSISTANT_ID, DOCUMENT_ID, OWNER)
+
+        kb = _kb(table)
+        assert int(kb["reservedBytes"]) == 0
+        assert int(kb["totalBytes"]) == SIZE
+        assert int(kb["storedBytes"]) == SIZE
+
+    @pytest.mark.asyncio
+    async def test_a_zero_size_row_is_a_no_op(self, owned, table):
+        """Imported documents are created with sizeBytes=0 — nothing was reserved at
+        request time, so there is nothing to give back."""
+        _seed(table, size=0, reserved=0)
+
+        await soft_delete_document(ASSISTANT_ID, DOCUMENT_ID, OWNER)
+
+        assert int(_kb(table)["reservedBytes"]) == 0
+        assert not _doc(table).get("byteCapSettled")
+
+    @pytest.mark.asyncio
+    async def test_a_missing_document_is_none_and_changes_nothing(self, owned, table):
+        _seed(table)
+
+        result = await soft_delete_document(ASSISTANT_ID, "DOC-does-not-exist", OWNER)
+
+        assert result is None
+        assert int(_kb(table)["reservedBytes"]) == SIZE
diff --git a/backend/tests/routes/test_documents.py b/backend/tests/routes/test_documents.py
index 9eef52bf2..7bbf25b5b 100644
--- a/backend/tests/routes/test_documents.py
+++ b/backend/tests/routes/test_documents.py
@@ -8,7 +8,7 @@
 """
 
 from types import SimpleNamespace
-from unittest.mock import AsyncMock, patch
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 from fastapi import FastAPI
@@ -126,6 +126,93 @@ def test_returns_200_with_empty_list(self, app):
         assert body["documents"] == []
 
 
+# ---------------------------------------------------------------------------
+# Requirement 12.11 visibility: kbUsage folded into the documents-list response
+# ---------------------------------------------------------------------------
+
+RECORDS_MODULE = "apis.shared.kb_backend.records"
+BYTE_CAP_MODULE = "apis.shared.kb_backend.byte_cap"
+
+
+class TestListDocumentsKbUsage:
+    """GET /assistants/{id}/documents returns kbUsage for the storage bar."""
+
+    def _list(self, app, kb_record=None, get_record_side_effect=None, cap=100 * 1024 * 1024):
+        _override_user_id(app)
+        # get_kb_record is a SYNC boto3 call run via asyncio.to_thread, so it is
+        # mocked with a plain MagicMock (an AsyncMock would leave an un-awaited
+        # coroutine for to_thread to return).
+        get_record = MagicMock(return_value=kb_record)
+        if get_record_side_effect is not None:
+            get_record = MagicMock(side_effect=get_record_side_effect)
+
+        with patch(
+            f"{ROUTES_MODULE}.resolve_assistant_permission",
+            new_callable=AsyncMock,
+            return_value=_owner_resolve(),
+        ), patch(
+            f"{ROUTES_MODULE}.list_assistant_documents",
+            new_callable=AsyncMock,
+            return_value=([_make_document()], None),
+        ), patch(
+            f"{RECORDS_MODULE}.get_kb_record", get_record
+        ), patch(
+            f"{BYTE_CAP_MODULE}.effective_cap", return_value=cap
+        ):
+            client = TestClient(app)
+            resp = client.get(f"/assistants/{ASSISTANT_ID}/documents")
+        return resp
+
+    def test_managed_kb_reports_usage_and_cap(self, app):
+        """A managed KB returns engine=managed, its bytes, and the binding cap."""
+        from decimal import Decimal
+
+        record = {
+            "retrievalEngine": "managed",
+            "storedBytes": Decimal(30 * 1024 * 1024),
+            "reservedBytes": Decimal(5 * 1024 * 1024),
+            "elevatedByteCap": False,
+        }
+        resp = self._list(app, kb_record=record, cap=100 * 1024 * 1024)
+
+        assert resp.status_code == 200
+        usage = resp.json()["kbUsage"]
+        assert usage["engine"] == "managed"
+        assert usage["storedBytes"] == 30 * 1024 * 1024
+        assert usage["reservedBytes"] == 5 * 1024 * 1024
+        assert usage["cap"] == 100 * 1024 * 1024
+        assert usage["elevated"] is False
+
+    def test_elevated_flag_is_read_from_record(self, app):
+        """elevatedByteCap on the record surfaces as elevated=true."""
+        record = {"retrievalEngine": "managed", "elevatedByteCap": True}
+        resp = self._list(app, kb_record=record, cap=1024 * 1024 * 1024)
+
+        usage = resp.json()["kbUsage"]
+        assert usage["elevated"] is True
+        assert usage["cap"] == 1024 * 1024 * 1024
+
+    def test_legacy_kb_is_uncapped(self, app):
+        """A legacy KB (no record) returns cap=null and zeroed counters."""
+        resp = self._list(app, kb_record=None)
+
+        assert resp.status_code == 200
+        usage = resp.json()["kbUsage"]
+        assert usage["engine"] == "s3vectors"
+        assert usage["cap"] is None
+        assert usage["storedBytes"] == 0
+        assert usage["reservedBytes"] == 0
+
+    def test_usage_read_failure_does_not_break_the_list(self, app):
+        """A KB-record read error yields kbUsage=null but still returns the docs."""
+        resp = self._list(app, get_record_side_effect=RuntimeError("dynamo down"))
+
+        assert resp.status_code == 200
+        body = resp.json()
+        assert body["kbUsage"] is None
+        assert len(body["documents"]) == 1
+
+
 # ---------------------------------------------------------------------------
 # Requirement 14.2: Documents endpoint returns 401 for unauthenticated
 # ---------------------------------------------------------------------------
diff --git a/backend/tests/routes/test_files.py b/backend/tests/routes/test_files.py
index 5bf6e1f70..22879b5eb 100644
--- a/backend/tests/routes/test_files.py
+++ b/backend/tests/routes/test_files.py
@@ -321,3 +321,51 @@ def test_returns_401_for_unauthenticated(self, app, unauthenticated_client):
         client = unauthenticated_client(app)
         resp = client.get("/files/quota")
         assert resp.status_code == 401
+
+
+# ---------------------------------------------------------------------------
+# GET /files/{upload_id}/download — the durable download link
+# ---------------------------------------------------------------------------
+
+
+class TestDownloadFile:
+    """GET /files/{upload_id}/download endpoint tests.
+
+    This route exists because presigned S3 URLs expire in minutes, so any URL
+    written into a conversation (a download card, a link in an assistant
+    message) is dead when the thread is reopened. The route is the stable path;
+    the signature is minted per click.
+    """
+
+    def test_redirects_to_a_freshly_minted_presigned_url(
+        self, app, make_user, authenticated_client, mock_file_service
+    ):
+        client = authenticated_client(app, make_user())
+        mock_file_service.get_download_url.return_value = (
+            "https://bucket.s3.us-west-2.amazonaws.com/user-files/u/s/up1/plan.docx"
+            "?X-Amz-Signature=deadbeef"
+        )
+
+        resp = client.get("/files/up1/download", follow_redirects=False)
+
+        assert resp.status_code == 302
+        assert resp.headers["location"].endswith("X-Amz-Signature=deadbeef")
+        # Never cached: the Location carries a signature that expires.
+        assert resp.headers["cache-control"] == "no-store"
+
+    def test_returns_404_for_unowned_or_missing_file(
+        self, app, make_user, authenticated_client, mock_file_service
+    ):
+        client = authenticated_client(app, make_user())
+        mock_file_service.get_download_url.side_effect = ServiceFileNotFoundError(
+            "nope"
+        )
+
+        resp = client.get("/files/ghost/download", follow_redirects=False)
+
+        assert resp.status_code == 404
+
+    def test_returns_401_for_unauthenticated(self, app, unauthenticated_client):
+        client = unauthenticated_client(app)
+        resp = client.get("/files/up1/download", follow_redirects=False)
+        assert resp.status_code == 401
diff --git a/backend/tests/shared/test_sessions_metadata.py b/backend/tests/shared/test_sessions_metadata.py
index 2b46d8694..cf659cf2e 100644
--- a/backend/tests/shared/test_sessions_metadata.py
+++ b/backend/tests/shared/test_sessions_metadata.py
@@ -1113,6 +1113,116 @@ async def test_paused_turn_independent_of_pending_interrupts(self, sessions_meta
         assert interrupts[0].interrupt_id == "i1"
 
 
+class TestClearPendingInterrupts:
+    """The "supersede" clear: a fresh turn abandons a paused one.
+
+    Separate from ``remove_pending_interrupts`` (drop resolved ids) because a
+    breadcrumb that outlives its ``pausedTurn`` snapshot re-renders a prompt
+    the user can no longer answer — the resume route 400s on an interrupt id
+    the rebuilt agent has never heard of.
+    """
+
+    @pytest.mark.asyncio
+    async def test_clears_every_breadcrumb(self, sessions_metadata_table):
+        from apis.shared.sessions.metadata import (
+            ensure_session_metadata_exists, add_pending_interrupt,
+            get_pending_interrupts, clear_pending_interrupts,
+        )
+        from apis.shared.sessions.models import PendingInterrupt
+
+        await ensure_session_metadata_exists("s1", "u1")
+        for n in ("i1", "i2"):
+            await add_pending_interrupt(
+                "s1", "u1",
+                PendingInterrupt(
+                    interruptId=n, providerId="calendar",
+                    createdAt="2026-04-25T00:00:00Z",
+                ),
+            )
+        assert len(await get_pending_interrupts("s1", "u1")) == 2
+
+        await clear_pending_interrupts("s1", "u1")
+
+        assert await get_pending_interrupts("s1", "u1") == []
+
+    @pytest.mark.asyncio
+    async def test_clears_a_user_question_breadcrumb(self, sessions_metadata_table):
+        """The flavor this shipped for: the picker's primary action is Submit,
+        so a stale prompt hands the user a guaranteed error rather than a
+        dismissible notice."""
+        from apis.shared.sessions.metadata import (
+            ensure_session_metadata_exists, add_pending_interrupt,
+            get_pending_interrupts, clear_pending_interrupts,
+        )
+        from apis.shared.sessions.models import PendingInterrupt
+
+        await ensure_session_metadata_exists("s1", "u1")
+        await add_pending_interrupt(
+            "s1", "u1",
+            PendingInterrupt(
+                interruptId="v1:tool_call:tu-1:abc", kind="user_question",
+                toolUseId="tu-1", toolName="ask_user_question",
+                questions='[{"header":"Scope","question":"Which?","options":[{"label":"a"}]}]',
+                createdAt="2026-04-25T00:00:00Z",
+            ),
+        )
+
+        await clear_pending_interrupts("s1", "u1")
+
+        assert await get_pending_interrupts("s1", "u1") == []
+
+    @pytest.mark.asyncio
+    async def test_noop_when_already_clear(self, sessions_metadata_table):
+        from apis.shared.sessions.metadata import (
+            ensure_session_metadata_exists, clear_pending_interrupts,
+            get_pending_interrupts,
+        )
+
+        await ensure_session_metadata_exists("s1", "u1")
+        await clear_pending_interrupts("s1", "u1")
+        assert await get_pending_interrupts("s1", "u1") == []
+
+    @pytest.mark.asyncio
+    async def test_noop_when_session_missing(self, sessions_metadata_table):
+        from apis.shared.sessions.metadata import clear_pending_interrupts
+
+        await clear_pending_interrupts("never-created", "u1")
+
+    @pytest.mark.asyncio
+    async def test_leaves_the_paused_turn_snapshot_alone(self, sessions_metadata_table):
+        """The inverse of ``test_paused_turn_independent_of_pending_interrupts``.
+
+        Each clear stays in its own lane; the routes layer calls both when a
+        fresh turn supersedes a paused one, and that ordering is its policy to
+        own — not something either function should assume.
+        """
+        from apis.shared.sessions.metadata import (
+            ensure_session_metadata_exists, set_paused_turn, get_paused_turn,
+            add_pending_interrupt, clear_pending_interrupts,
+        )
+        from apis.shared.sessions.models import PausedTurnSnapshot, PendingInterrupt
+
+        await ensure_session_metadata_exists("s1", "u1")
+        await set_paused_turn(
+            "s1", "u1",
+            PausedTurnSnapshot(
+                enabledTools=["calendar"], capturedAt="2026-04-25T00:00:00Z",
+                expiresAt="2026-04-25T01:00:00Z",
+            ),
+        )
+        await add_pending_interrupt(
+            "s1", "u1",
+            PendingInterrupt(
+                interruptId="i1", providerId="calendar",
+                createdAt="2026-04-25T00:00:00Z",
+            ),
+        )
+
+        await clear_pending_interrupts("s1", "u1")
+
+        assert await get_paused_turn("s1", "u1") is not None
+
+
 class TestCoerceCostTotal:
     """Normalize ``MessageMetadata.cost`` (float | dict | None) to a finite float total.
 
diff --git a/backend/tests/shared/test_tool_census_persistence.py b/backend/tests/shared/test_tool_census_persistence.py
new file mode 100644
index 000000000..3137b8efe
--- /dev/null
+++ b/backend/tests/shared/test_tool_census_persistence.py
@@ -0,0 +1,98 @@
+"""The tool census reaches DynamoDB the way the profile reads it.
+
+`toolCalls` rides the per-call `C#` cost row as an extra field (like
+`turnAgentId`), and the session row's `toolCallCount` / `toolErrorCount` are
+bumped in the same aggregate update as `totalCost`. With the kill switch off,
+neither attribute exists at all — that absence is what lets the admin profile
+say "not tracked" rather than render an honest-looking zero.
+"""
+
+from decimal import Decimal
+
+import pytest
+
+from apis.shared.sessions.models import MessageMetadata, ModelInfo, TokenUsage
+
+
+def _meta(tool_calls=None):
+    kwargs = dict(
+        token_usage=TokenUsage(inputTokens=100, outputTokens=50, totalTokens=150),
+        model_info=ModelInfo(modelId="claude-haiku-4-5", modelName="Claude Haiku 4.5"),
+        cost=0.01,
+    )
+    if tool_calls is not None:
+        kwargs["toolCalls"] = tool_calls
+    return MessageMetadata(**kwargs)
+
+
+def _seed_session(table, session_id="s1", user_id="u1"):
+    table.put_item(Item={
+        "PK": f"USER#{user_id}",
+        "SK": f"S#{session_id}",
+        "GSI_PK": f"SESSION#{session_id}",
+        "GSI_SK": "META",
+        "sessionId": session_id,
+        "userId": user_id,
+        "status": "active",
+        "createdAt": "2026-09-01T00:00:00Z",
+        "lastMessageAt": "2026-09-01T00:00:00Z",
+        "messageCount": Decimal(0),
+    })
+
+
+def _session_row(table, session_id="s1", user_id="u1"):
+    return table.get_item(Key={"PK": f"USER#{user_id}", "SK": f"S#{session_id}"})["Item"]
+
+
+@pytest.mark.asyncio
+async def test_tool_calls_land_on_the_cost_row_and_roll_up_on_the_session(sessions_metadata_table, monkeypatch):
+    monkeypatch.delenv("COST_DIAGNOSTICS_ENABLED", raising=False)
+    from apis.shared.sessions.metadata import store_message_metadata
+
+    _seed_session(sessions_metadata_table)
+    census = {"list_courses": {"calls": 2, "errors": 0}, "calculator": {"calls": 1, "errors": 1}}
+    await store_message_metadata(session_id="s1", user_id="u1", message_id=1, message_metadata=_meta(census))
+    await store_message_metadata(session_id="s1", user_id="u1", message_id=2, message_metadata=_meta())
+
+    cost_rows = [i for i in sessions_metadata_table.scan()["Items"] if i["SK"].startswith("C#")]
+    assert len(cost_rows) == 2
+    with_census = [r for r in cost_rows if "toolCalls" in r]
+    assert len(with_census) == 1
+    assert with_census[0]["toolCalls"]["calculator"] == {"calls": Decimal(1), "errors": Decimal(1)}
+
+    row = _session_row(sessions_metadata_table)
+    assert row["toolCallCount"] == Decimal(3)
+    assert row["toolErrorCount"] == Decimal(1)
+
+
+@pytest.mark.asyncio
+async def test_kill_switch_leaves_no_trace(sessions_metadata_table, monkeypatch):
+    monkeypatch.setenv("COST_DIAGNOSTICS_ENABLED", "false")
+    from apis.shared.sessions.metadata import store_message_metadata
+
+    _seed_session(sessions_metadata_table)
+    # The coordinator would not attach toolCalls with the flag off; even if a
+    # stale row carries one, the session rollups must not be written.
+    await store_message_metadata(
+        session_id="s1", user_id="u1", message_id=1,
+        message_metadata=_meta({"a": {"calls": 1, "errors": 0}}),
+    )
+    row = _session_row(sessions_metadata_table)
+    assert "toolCallCount" not in row and "toolErrorCount" not in row
+    # The unrelated aggregates still bump — the switch is scoped to the census.
+    assert row["totalCost"] == Decimal("0.01")
+
+
+@pytest.mark.asyncio
+async def test_malformed_census_entries_count_as_zero_not_as_a_failure(sessions_metadata_table, monkeypatch):
+    monkeypatch.delenv("COST_DIAGNOSTICS_ENABLED", raising=False)
+    from apis.shared.sessions.metadata import store_message_metadata
+
+    _seed_session(sessions_metadata_table)
+    await store_message_metadata(
+        session_id="s1", user_id="u1", message_id=1,
+        message_metadata=_meta({"ok": {"calls": 2, "errors": 0}, "weird": "not-a-dict", "half": {"calls": "x"}}),
+    )
+    row = _session_row(sessions_metadata_table)
+    assert row["toolCallCount"] == Decimal(2)
+    assert row["toolErrorCount"] == Decimal(0)
diff --git a/backend/tests/shared/test_user_question_models.py b/backend/tests/shared/test_user_question_models.py
new file mode 100644
index 000000000..a45529879
--- /dev/null
+++ b/backend/tests/shared/test_user_question_models.py
@@ -0,0 +1,287 @@
+"""Normalization and answer parsing for `ask_user_question`.
+
+Two asymmetric contracts meet in this module, and the asymmetry is the point.
+
+**Questions come from the model**, so they are validated strictly: a payload
+that cannot be drawn is rejected at the tool boundary, where the model still
+has a turn left to fix it. Emitting an unrenderable prompt instead would pause
+the turn behind a picker the SPA cannot draw — a hang with no affordance.
+
+**Answers come from the client**, so they are parsed leniently: whatever shape
+arrives, the turn resumes. A strict parser here would break the user's only
+route out of a paused turn.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from apis.shared.user_questions.models import (
+    MAX_OPTIONS,
+    MAX_QUESTIONS,
+    UserQuestion,
+    UserQuestionError,
+    decode_questions,
+    encode_questions,
+    format_answers,
+    normalize_questions,
+    parse_answers,
+)
+
+
+def _question(header: str = "Scope", n_options: int = 2) -> dict:
+    return {
+        "header": header,
+        "question": f"What {header.lower()}?",
+        "options": [{"label": f"opt{i}"} for i in range(n_options)],
+    }
+
+
+class TestNormalizeQuestions:
+    """Req: the model's payload is untrusted; only renderable prompts pass."""
+
+    def test_minimal_valid_question_survives(self):
+        [question] = normalize_questions([_question()])
+        assert question.header == "Scope"
+        assert [o.label for o in question.options] == ["opt0", "opt1"]
+        assert question.multi_select is False
+
+    def test_multi_select_accepted_in_either_casing(self):
+        camel = normalize_questions([{**_question(), "multiSelect": True}])
+        snake = normalize_questions([{**_question(), "multi_select": True}])
+        assert camel[0].multi_select is True
+        assert snake[0].multi_select is True
+
+    def test_bare_string_options_are_accepted(self):
+        """Models reach for a plain list of strings; render it rather than fail."""
+        [question] = normalize_questions(
+            [{"header": "Fmt", "question": "Which?", "options": ["json", "yaml"]}]
+        )
+        assert [o.label for o in question.options] == ["json", "yaml"]
+
+    def test_question_with_too_few_options_is_dropped(self):
+        with pytest.raises(UserQuestionError):
+            normalize_questions([{**_question(), "options": [{"label": "only"}]}])
+
+    def test_duplicate_option_labels_are_dropped(self):
+        """Answers correlate by label, so two identical choices cannot coexist."""
+        with pytest.raises(UserQuestionError):
+            normalize_questions(
+                [
+                    {
+                        "header": "Fmt",
+                        "question": "Which?",
+                        "options": [{"label": "json"}, {"label": "JSON"}],
+                    }
+                ]
+            )
+
+    def test_counts_are_clamped_not_rejected(self):
+        raw = [_question(header=f"H{i}", n_options=MAX_OPTIONS + 3) for i in range(9)]
+        questions = normalize_questions(raw)
+        assert len(questions) == MAX_QUESTIONS
+        assert all(len(q.options) == MAX_OPTIONS for q in questions)
+
+    def test_missing_header_gets_a_positional_fallback(self):
+        [question] = normalize_questions(
+            [{"question": "Which?", "options": ["a", "b"]}]
+        )
+        assert question.header == "Q1"
+
+    def test_colliding_headers_are_disambiguated(self):
+        """Header is the answer key — a collision would silently drop an answer."""
+        questions = normalize_questions([_question("Scope"), _question("Scope")])
+        headers = [q.header for q in questions]
+        assert len(set(headers)) == 2
+
+    @pytest.mark.parametrize("raw", [None, [], "questions", [{}], [{"question": ""}]])
+    def test_unrenderable_payloads_raise(self, raw):
+        with pytest.raises(UserQuestionError):
+            normalize_questions(raw)
+
+
+class TestParseAnswers:
+    """Req: any client payload resumes the turn; nothing here may raise."""
+
+    @pytest.fixture
+    def questions(self) -> list[UserQuestion]:
+        return normalize_questions([_question("Scope"), _question("Depth")])
+
+    def test_canonical_keyed_payload(self, questions):
+        answers = parse_answers(
+            questions,
+            {"answers": {"Scope": {"selected": ["opt0"]}, "Depth": {"selected": ["opt1"]}}},
+        )
+        assert [a.selected for a in answers] == [["opt0"], ["opt1"]]
+        assert not any(a.skipped for a in answers)
+
+    def test_header_matching_is_case_insensitive(self, questions):
+        answers = parse_answers(questions, {"answers": {"scope": ["opt0"]}})
+        assert answers[0].selected == ["opt0"]
+
+    def test_positional_payload(self, questions):
+        answers = parse_answers(questions, {"answers": [["opt0"], ["opt1"]]})
+        assert [a.selected for a in answers] == [["opt0"], ["opt1"]]
+
+    def test_free_text_other(self, questions):
+        answers = parse_answers(
+            questions, {"answers": {"Scope": {"text": "something else"}}}
+        )
+        assert answers[0].text == "something else"
+        assert answers[0].skipped is False
+
+    def test_explicit_skip(self, questions):
+        answers = parse_answers(questions, {"skipped": True})
+        assert all(a.skipped for a in answers)
+
+    def test_unanswered_question_is_skipped_not_dropped(self, questions):
+        answers = parse_answers(questions, {"answers": {"Scope": ["opt0"]}})
+        assert len(answers) == 2
+        assert answers[1].skipped is True
+
+    def test_bare_string_is_attributed_to_the_first_question(self, questions):
+        answers = parse_answers(questions, "just do the simple one")
+        assert answers[0].selected == ["just do the simple one"]
+        assert answers[1].skipped is True
+
+    @pytest.mark.parametrize(
+        "response", [None, 42, [], {}, {"answers": 7}, {"answers": None}, object()]
+    )
+    def test_junk_degrades_to_skipped_and_never_raises(self, questions, response):
+        answers = parse_answers(questions, response)
+        assert len(answers) == 2
+        assert all(a.skipped for a in answers)
+
+
+class TestFormatAnswers:
+    """Req: the only part of this feature that re-enters the prompt stays small."""
+
+    def test_selections_render_one_line_each(self):
+        questions = normalize_questions([_question("Scope"), _question("Depth")])
+        text = format_answers(
+            parse_answers(
+                questions,
+                {"answers": {"Scope": ["opt0", "opt1"], "Depth": {"text": "brief"}}},
+            )
+        )
+        assert "- Scope: opt0, opt1" in text
+        assert '- Depth: "brief"' in text
+        # The option catalog the model already wrote is not echoed back — this
+        # string is paid for on every subsequent turn of the conversation.
+        assert text.count("\n") == 2
+
+    def test_all_skipped_tells_the_model_to_proceed(self):
+        questions = normalize_questions([_question("Scope")])
+        text = format_answers(parse_answers(questions, {"skipped": True}))
+        assert "skipped" in text
+        assert "do not ask again" in text
+
+
+class TestPersistenceRoundTrip:
+    def test_encode_decode_preserves_the_rendered_shape(self):
+        questions = normalize_questions(
+            [{**_question("Scope"), "multiSelect": True}]
+        )
+        decoded = decode_questions(encode_questions(questions))
+        assert decoded[0]["header"] == "Scope"
+        assert decoded[0]["multiSelect"] is True
+        # Round-trips back through the model the SSE event uses.
+        assert UserQuestion.model_validate(decoded[0]).multi_select is True
+
+    @pytest.mark.parametrize("encoded", [None, "", "not json", "{}"])
+    def test_undecodable_payload_yields_no_questions(self, encoded):
+        assert decode_questions(encoded) == []
+
+
+class TestEscapeHatchOptionsAreStripped:
+    """Req: the picker owns Other/Skip; a model-supplied lookalike is dropped.
+
+    Measured against real models, the tool description alone does not hold —
+    Haiku 4.5 added an "Other" option on roughly half of sampled turns. A
+    supplied "Other" is worse than a duplicate: selecting it records the bare
+    string with no free text, so the model learns nothing from the answer.
+    """
+
+    @pytest.mark.parametrize(
+        "label",
+        ["Other", "other", "Other (please specify)", "Skip", "None of the above",
+         "Something else", "No preference", "Not sure", "You decide"],
+    )
+    def test_escape_hatch_labels_are_dropped(self, label):
+        [question] = normalize_questions(
+            [
+                {
+                    "header": "Fmt",
+                    "question": "Which format?",
+                    "options": ["json", "yaml", "toml", label],
+                }
+            ]
+        )
+        assert [o.label for o in question.options] == ["json", "yaml", "toml"]
+
+    def test_real_options_named_like_a_hatch_are_kept(self):
+        """Only exact matches are dropped — "No preference shown" is a real
+        answer to a real question and must survive."""
+        [question] = normalize_questions(
+            [
+                {
+                    "header": "Sort",
+                    "question": "Which order?",
+                    "options": ["Other repositories first", "No preference shown"],
+                }
+            ]
+        )
+        assert len(question.options) == 2
+
+    def test_a_question_padded_down_below_the_minimum_is_dropped(self):
+        """The model turned a binary choice into "A or Other". The picker
+        already expresses that, so the question is not worth a round trip."""
+        with pytest.raises(UserQuestionError):
+            normalize_questions(
+                [{"header": "Go", "question": "Proceed?", "options": ["Yes", "Other"]}]
+            )
+
+    def test_stripping_does_not_starve_a_full_question(self):
+        [question] = normalize_questions(
+            [
+                {
+                    "header": "Scope",
+                    "question": "How much?",
+                    "options": ["Just the API", "Everything", "Skip"],
+                }
+            ]
+        )
+        assert [o.label for o in question.options] == ["Just the API", "Everything"]
+
+
+class TestHeaderTrimming:
+    """Req: the chip is a label the user reads — never a severed word.
+
+    Found in the browser: the model wrote "Dashboard Purpose" and a hard
+    12-char slice rendered "DASHBOARD PU", which reads as a rendering bug.
+    """
+
+    def test_long_header_trims_on_a_word_boundary(self):
+        [q] = normalize_questions(
+            [{"header": "Dashboard Purpose", "question": "Which?", "options": ["a", "b"]}]
+        )
+        assert q.header == "Dashboard"
+
+    def test_header_within_budget_is_untouched(self):
+        [q] = normalize_questions(
+            [{"header": "Scope", "question": "Which?", "options": ["a", "b"]}]
+        )
+        assert q.header == "Scope"
+
+    def test_single_overlong_word_still_falls_back_to_a_hard_cut(self):
+        [q] = normalize_questions(
+            [{"header": "Internationalization", "question": "Which?", "options": ["a", "b"]}]
+        )
+        assert q.header == "Internationa"
+        assert len(q.header) == 12
+
+    def test_multi_word_header_keeps_as_many_whole_words_as_fit(self):
+        [q] = normalize_questions(
+            [{"header": "Key Data Points", "question": "Which?", "options": ["a", "b"]}]
+        )
+        assert q.header == "Key Data"
diff --git a/backend/tests/shared/test_workspace.py b/backend/tests/shared/test_workspace.py
index d930d3b7b..22c418c19 100644
--- a/backend/tests/shared/test_workspace.py
+++ b/backend/tests/shared/test_workspace.py
@@ -223,8 +223,12 @@ async def test_happy_path_follows_store_document_contract(self, repo, s3):
         repo.increment_quota.assert_awaited_once_with(USER, len(b"# Hi"))
 
         assert result["filename"] == "report.md"
-        assert result["download_url"] == "https://signed.example/f"
         assert result["size_bytes"] == 4
+        assert result["upload_id"]
+        # No presigned URL in the write result — it would land in the model's
+        # context and be re-emitted, truncated, as a dead link.
+        assert "download_url" not in result
+        s3.generate_presigned_url.assert_not_called()
 
     @pytest.mark.asyncio
     async def test_extension_appended_when_missing(self, repo, s3):
diff --git a/backend/tests/supply_chain/test_nightly_ref_allowlist.py b/backend/tests/supply_chain/test_nightly_ref_allowlist.py
new file mode 100644
index 000000000..2f4d47c82
--- /dev/null
+++ b/backend/tests/supply_chain/test_nightly_ref_allowlist.py
@@ -0,0 +1,131 @@
+"""Guard the nightly workflow's branch allowlist.
+
+``nightly.yml`` runs on ``schedule``/``workflow_dispatch``, so its jobs execute
+in the context of the default branch and hold a token that can **write** the
+default-branch GitHub Actions cache scope. Checking out an arbitrary ref there
+would let unreviewed code run while holding that token and poison cache entries
+that privileged workflows later restore (CWE-349; CodeQL
+``actions/cache-poisoning/*``).
+
+The workflow defends against this by resolving track tokens through a ``case``
+statement that assigns **literal** ``"main"`` / ``"develop"`` strings, and by
+refusing any other branch with a hard ``exit 1``. CodeQL cannot see through a
+shell ``case``, so it still reports the checkout steps — which means the only
+thing standing between this repo and that finding being real is the allowlist
+itself, with nothing asserting it stays intact.
+
+These tests are that assertion. They fail if someone widens the allowlist,
+drops the deny branch, or lets attacker-influenced text reach a ``ref:``.
+"""
+
+import re
+from pathlib import Path
+
+import pytest
+import yaml
+
+# Repository root is 3 levels up from backend/tests/supply_chain/
+REPO_ROOT = Path(__file__).resolve().parents[3]
+NIGHTLY = REPO_ROOT / ".github" / "workflows" / "nightly.yml"
+
+# The only branches a privileged nightly run may check out. Both are
+# protected/PR-only, so anything running from them has been reviewed.
+ALLOWED_REFS = {"main", "develop"}
+
+# `<name>_ref="<value>"` assignments in the resolve-tracks shell step.
+_REF_ASSIGNMENT = re.compile(r'^\s*(\w*_ref)="([^"]*)"', re.MULTILINE)
+
+
+@pytest.fixture(scope="module")
+def nightly_text() -> str:
+    assert NIGHTLY.is_file(), f"missing workflow: {NIGHTLY}"
+    return NIGHTLY.read_text()
+
+
+@pytest.fixture(scope="module")
+def nightly_yaml(nightly_text: str) -> dict:
+    return yaml.safe_load(nightly_text)
+
+
+def test_ref_assignments_are_allowlisted_literals(nightly_text: str) -> None:
+    """Every `*_ref=` assignment is a literal branch name from the allowlist.
+
+    The empty string is permitted: it is the "track not selected" initializer,
+    and an unselected track's job never runs.
+    """
+    assignments = _REF_ASSIGNMENT.findall(nightly_text)
+    assert assignments, "found no *_ref= assignments — has the parser moved?"
+
+    offenders = {
+        f"{name}={value!r}"
+        for name, value in assignments
+        if value != "" and value not in ALLOWED_REFS
+    }
+    assert not offenders, (
+        "nightly.yml assigns a ref outside the allowlist "
+        f"{sorted(ALLOWED_REFS)}: {sorted(offenders)}. "
+        "A privileged nightly run must only check out reviewed branches — see "
+        "the security note at the top of nightly.yml."
+    )
+
+
+def test_no_ref_is_interpolated_from_a_track_token(nightly_text: str) -> None:
+    """Refs are assigned as literals, never sliced out of the track token.
+
+    A parser that did `ref="${token#test-backend-}"` would pass the allowlist
+    test above (no literal to see) while feeding attacker-influenced text
+    straight to `ref:`.
+    """
+    interpolated = [
+        line.strip()
+        for line in nightly_text.splitlines()
+        if re.search(r'^\s*\w*_ref="?\$', line)
+    ]
+    assert not interpolated, (
+        "nightly.yml derives a ref from a shell expansion rather than a "
+        f"literal: {interpolated}. Keep refs literal — see nightly.yml's "
+        "security note."
+    )
+
+
+def test_unknown_branch_is_rejected_not_ignored(nightly_text: str) -> None:
+    """A track naming a non-allowlisted branch fails the run.
+
+    Falling through to the `*)` warning branch instead would leave the track
+    silently unselected — safe today, but it removes the signal that tells an
+    operator why their branch did not run, and invites "just add a default".
+    """
+    deny_arm = re.search(
+        r"test-backend-\*\|.*?;;",
+        nightly_text,
+        re.DOTALL,
+    )
+    assert deny_arm, "the wildcard deny arm for unknown branches is gone"
+    assert "exit 1" in deny_arm.group(0), (
+        "the wildcard branch arm no longer fails the run; an unreviewed "
+        "branch name must be rejected, not warned about"
+    )
+
+
+def test_checkout_refs_come_only_from_the_resolver(nightly_yaml: dict) -> None:
+    """No checkout step reads a ref straight from workflow inputs or event data.
+
+    The resolver is the choke point; a `ref:` naming `github.event.*` or
+    `inputs.*` would route around it.
+    """
+    forbidden = ("github.event", "inputs.", "github.head_ref")
+    offenders: list[str] = []
+
+    for job_name, job in (nightly_yaml.get("jobs") or {}).items():
+        for step in job.get("steps") or []:
+            uses = str(step.get("uses", ""))
+            if "actions/checkout" not in uses:
+                continue
+            ref = str((step.get("with") or {}).get("ref", ""))
+            if any(token in ref for token in forbidden):
+                offenders.append(f"{job_name}: ref={ref!r}")
+
+    assert not offenders, (
+        "a nightly checkout takes its ref from untrusted input rather than "
+        f"the resolve-tracks allowlist: {offenders}"
+    )
diff --git a/backend/uv.lock b/backend/uv.lock
index 679f9dcee..a0c57cb55 100644
--- a/backend/uv.lock
+++ b/backend/uv.lock
@@ -15,7 +15,7 @@ constraints = [{ name = "mcp", specifier = "<2" }]
 
 [[package]]
 name = "agentcore-stack"
-version = "1.21.0"
+version = "1.22.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiofiles" },
@@ -66,6 +66,7 @@ all = [
     { name = "pytest" },
     { name = "pytest-asyncio" },
     { name = "pytest-cov" },
+    { name = "pytest-xdist" },
     { name = "ruff" },
     { name = "strands-agents", extra = ["bidi"] },
     { name = "strands-agents-tools" },
@@ -85,6 +86,7 @@ dev = [
     { name = "pytest" },
     { name = "pytest-asyncio" },
     { name = "pytest-cov" },
+    { name = "pytest-xdist" },
     { name = "ruff" },
     { name = "tiktoken" },
     { name = "types-aiofiles" },
@@ -121,6 +123,7 @@ requires-dist = [
     { name = "pytest", marker = "extra == 'dev'", specifier = "==9.0.3" },
     { name = "pytest-asyncio", marker = "extra == 'dev'", specifier = "==1.3.0" },
     { name = "pytest-cov", marker = "extra == 'dev'", specifier = "==7.1.0" },
+    { name = "pytest-xdist", marker = "extra == 'dev'", specifier = "==3.6.1" },
     { name = "python-dotenv", specifier = "==1.2.2" },
     { name = "python-multipart", specifier = "==0.0.31" },
     { name = "ruff", marker = "extra == 'dev'", specifier = "==0.15.12" },
@@ -1177,6 +1180,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/8a/0e/97c33bf5009bdbac74fd2beace167cab3f978feb69cc36f1ef79360d6c4e/exceptiongroup-1.3.1-py3-none-any.whl", hash = "sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598", size = 16740, upload-time = "2025-11-21T23:01:53.443Z" },
 ]
 
+[[package]]
+name = "execnet"
+version = "2.1.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bf/89/780e11f9588d9e7128a3f87788354c7946a9cbb1401ad38a48c4db9a4f07/execnet-2.1.2.tar.gz", hash = "sha256:63d83bfdd9a23e35b9c6a3261412324f964c2ec8dcd8d3c6916ee9373e0befcd", size = 166622, upload-time = "2025-11-12T09:56:37.75Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ab/84/02fc1827e8cdded4aa65baef11296a9bbe595c474f0d6d758af082d849fd/execnet-2.1.2-py3-none-any.whl", hash = "sha256:67fba928dd5a544b783f6056f449e5e3931a5c378b128bc18501f7ea79e296ec", size = 40708, upload-time = "2025-11-12T09:56:36.333Z" },
+]
+
 [[package]]
 name = "fastapi"
 version = "0.136.1"
@@ -4036,6 +4048,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9d/7a/d968e294073affff457b041c2be9868a40c1c71f4a35fcc1e45e5493067b/pytest_cov-7.1.0-py3-none-any.whl", hash = "sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678", size = 22876, upload-time = "2026-03-21T20:11:14.438Z" },
 ]
 
+[[package]]
+name = "pytest-xdist"
+version = "3.6.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "execnet" },
+    { name = "pytest" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/41/c4/3c310a19bc1f1e9ef50075582652673ef2bfc8cd62afef9585683821902f/pytest_xdist-3.6.1.tar.gz", hash = "sha256:ead156a4db231eec769737f57668ef58a2084a34b2e55c4a8fa20d861107300d", size = 84060, upload-time = "2024-04-28T19:29:54.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/6d/82/1d96bf03ee4c0fdc3c0cbe61470070e659ca78dc0086fb88b66c185e2449/pytest_xdist-3.6.1-py3-none-any.whl", hash = "sha256:9ed4adfb68a016610848639bb7e02c9352d5d9f03d04809919e2dafc3be4cca7", size = 46108, upload-time = "2024-04-28T19:29:52.813Z" },
+]
+
 [[package]]
 name = "python-dateutil"
 version = "2.9.0.post0"
diff --git a/docs/specs/admin-cost-drilldown.md b/docs/specs/admin-cost-drilldown.md
new file mode 100644
index 000000000..7504f1e44
--- /dev/null
+++ b/docs/specs/admin-cost-drilldown.md
@@ -0,0 +1,155 @@
+# Admin cost drill-down: user → conversations → conversation diagnostics
+
+**Status:** PR-1 (API) built · PR-2 (SPA) next · PR-3 (behavioral census) after.
+**Scope:** `admin.costs` (delegated admin scope). **Schema:** additive attributes only; **no new table, no GSI operation.**
+
+## 1. Why
+
+Every quota investigation on this platform so far was done by hand-querying DynamoDB (the
+`5801a350` write:read audit, 2026-07-27; the compaction spiral, 2026-08-05 — see
+`compaction-over-threshold-cache-spiral.md`). Each ended in a *named, computable* classification
+and a concrete cost-effectiveness fix, and each took an afternoon. The admin console could not
+start the investigation from the place it always starts — **a user who hit their quota** — and it
+recorded *what a conversation cost* but never *what the user was doing* in it.
+
+This feature adds the missing path and makes the classifications rules:
+
+```
+/admin/costs  Top Users (now with email + quota %)
+   └─ /admin/users/:userId            Conversations section (content-free list)
+        └─ /admin/costs/sessions/:id  Anatomy (existing) + Profile + Diagnoses (new)
+```
+
+## 2. The content-free contract
+
+An admin diagnoses a conversation's spend **without reading it**. That is a property of the data
+path, enforced in code:
+
+- `apis/shared/observability/content_policy.py` — `CONTENT_BEARING`, the denylist of every
+  attribute on the `sessions-metadata` and `user-file-uploads` row families that carries user
+  text or model-generated prose (title, tags, custom prompt, compaction summary, pending
+  interrupts, paused turn, export receipts, citations, display text, tool summaries, App cards
+  and HTML, steer queue, scheduled prompts, run errors, filenames and S3 keys). A path denies
+  everything beneath it; a dotted path denies only that leaf. Matching recognises a denylisted
+  path anywhere in a longer one (`calls.citations.text`, `sessions.title`).
+- Three allowlisted projections (`SESSION_ROW_PROJECTION`, `CALL_ROW_PROJECTION`,
+  `FILE_ROW_PROJECTION`) rendered with every segment aliased, so DynamoDB reserved words never
+  need case-by-case handling.
+- `compaction.summary` is the one path a reader may *request* but never *return*: its **length**
+  is a diagnostic (a summary that is 40% of the window guarantees the spiral). Readers measure
+  it into `compaction.summaryChars` and drop the string — the `scan_fleet_prefix_spend.py`
+  discipline.
+- `tests/apis/app_api/admin/costs/test_content_policy.py` walks every response model in
+  `admin/costs/models.py` against the denylist, with **exactly one named exemption**:
+  `TopSessionCost.title` (the "Most Expensive Conversations" table keeps titles by decision).
+  `tests/costs/test_content_free_projections.py` seeds rows carrying every kind of content and
+  proves none of it comes back through the readers.
+- Hardening of an existing path: `get_session_cost_records` (the anatomy's read) previously
+  fetched whole `C#` items including `citations[].text`; it now projects the twelve attributes
+  the anatomy consumes.
+
+## 3. Endpoints (both `require_costs_admin`)
+
+### `GET /admin/costs/users/{userId}/sessions?period&allTime&sort&limit`
+
+`UserSessionsResponse { userId, period?, userPeriodCost?, sessions[], total, unknownCostCount }`.
+
+Each `UserSessionSummary`: `sessionId, createdAt, lastMessageAt, status, messageCount, modelId,
+enabledToolCount, agentBound, lastContextTokens, contextWindow, contextShare, totalCost,
+costKnown, shareOfUserPeriod, cacheEfficiency, wastedUsd, partialMissUsd, summarizedTurns,
+summaryApproxTokens, toolCallCount?, toolErrorCount?, compactionCount?, diagnosisCount,
+topDiagnosisSeverity`.
+
+- Period semantics match `/top-sessions`: `period` selects sessions *active in it* and supplies
+  the share denominator; `totalCost` is the conversation's **lifetime** cost.
+- **`costKnown=false` means unrecorded, not free.** 20% of session rows fleet-wide have never
+  had a cost aggregate written. They are listed, trail under cost-sort, and are counted in
+  `unknownCostCount` so a total over the list is read as a floor.
+- Sorts: `cost` (known first, desc; unknown trailing by recency), `recent`, `context`, `messages`.
+- Reads the base table (`PK=USER#<id>`, `SK begins_with S#`) — the same bounded query
+  `/top-sessions` fans out over. No index.
+
+### `GET /admin/costs/sessions/{sessionId}/profile`
+
+`SessionProfile { sessionId, userId, session, callCount, peakContextTokens,
+compactionThreshold, writeReadRatio, attachments {count, totalBytes, byMime}, contextTrajectory[]
+{callIndex, timestamp, contextTokens, cacheStatus, modelId, cost, toolCalls?}, modelMix,
+fingerprintChanges {systemPrompt, toolConfig, explainedByAgentSwitch}, toolCensus {name: {calls,
+errors}}, enabledToolIds, diagnoses[], dataCoverage {toolCensus, compactionCount, fingerprints,
+cost} }`.
+
+- Resolves the session row by session id through `SessionLookupIndex` (`GSI_SK = META`) — an
+  admin holds the session id, not the owner's user id.
+- `contextTrajectory[].contextTokens` is the disjoint three-bucket sum
+  (`inputTokens + cacheReadInputTokens + cacheWriteInputTokens`) — true context occupancy.
+- `dataCoverage` says which optional signals this session *has*; a session written before a
+  counter shipped reads "not tracked", never "0".
+- 404 when the session has no metadata row.
+
+### `GET /admin/costs/top-users` (existing, enriched)
+
+`email`, `tierName`, `quotaLimit`, `quotaPercentage` are now populated (previously hard-coded
+`null`). Best-effort with bounded concurrency: a fork without the users table, an unlimited
+tier, or one failing lookup each degrade to `null` on that row.
+
+## 4. Diagnosis rules (`admin/costs/diagnoses.py`)
+
+Pure functions `ProfileFacts → Optional[Diagnosis]`; `Diagnosis = {code, severity, headline,
+evidence, suggestion, ref}`. Evidence is the numbers the rule compared and the threshold it
+compared them to. Thresholds are imported from where they live (the runtime's compaction
+threshold via the same env resolution as `CompactionConfig.from_env`; the shipped
+`partial_miss` classifier's write:read ratio); values that exist only as a proposal say so.
+
+| code | severity | fires when | ref |
+|---|---|---|---|
+| `PREFIX_SPIRAL` | high | peak context > threshold **and** cacheWrite:cacheRead > 3 (or writes with no reads) | spiral spec §1 |
+| `PARTIAL_MISS_HEAVY` | high | `partialMissUsd ≥ 50%` of known cost | spiral spec D1 |
+| `OVER_COMPACTION_THRESHOLD` | warn | peak context > `AGENTCORE_MEMORY_COMPACTION_TOKEN_THRESHOLD` (100k) | spiral spec |
+| `SUMMARY_OVER_BUDGET` | warn | `summaryApproxTokens > 8 000` (PR-2's proposed budget) | spiral spec D2 |
+| `SYSTEM_PROMPT_MUTATED` | warn | > 1 distinct `systemPromptHash` among non-agent-switched calls | spiral spec D4 |
+| `TOOLCONFIG_MUTATED` | warn | > 1 distinct `toolConfigHash` among non-agent-switched calls | fleet one-pager |
+| `ATTACHMENT_HEAVY` | warn | ≥ 5 uploads or ≥ 5 MB | roadmap |
+| `TOOL_ERROR_RATE` | warn | ≥ 25% of ≥ 4 tool calls failed (needs PR-3 census) | roadmap |
+| `COST_UNKNOWN` | info | no cost aggregate on the row | fleet one-pager |
+| `ANCHOR_MISMATCH` | info | `truncationAnchor ≠ checkpoint` | spiral spec D3 |
+| `AGENT_SWITCH_CHURN` | info | ≥ 3 `@`-mention switches | fleet one-pager |
+| `AGENT_CACHE_BYPASS` | info | enabled ids ∩ `INJECTED_TOOL_IDS` − `KEY_DESCRIBED_INJECTED_TOOL_IDS` ≠ ∅ | bypass spec |
+| `LARGE_TOOLSET` | info | ≥ 8 enabled catalog ids | roadmap |
+| `DOMINANT_SESSION` | info | ≥ 50% of the user's period spend | spiral spec |
+| `TOOL_HEAVY` | info | ≥ 40 tool calls (needs PR-3 census) | roadmap |
+
+The list view diagnoses on the session row's rollups; the profile refines with per-call data
+(true peak, distinct hashes, attachments, census) and its findings are the authoritative ones.
+
+## 5. Decisions
+
+- **Titles stay on Most Expensive Conversations.** The new list and profile are content-free; the
+  one exemption is named in the test so it cannot widen silently.
+- **Section scope is `admin.costs`, not `admin.users`.** It is cost data and its drill-down
+  target is `admin.costs`-gated. The SPA renders the section on the user page only for admins
+  holding that scope; a users-only delegate sees the page without it rather than a 403 inside it.
+- **No new index.** `get_user_session_costs`'s base-table query already served the need; a
+  content-free sibling (`get_user_session_diagnostics`) shares its body.
+- **Read endpoints carry no feature flag.** Admin-only, read-only, degrade to "not tracked". Only
+  PR-3's writers get a kill switch.
+- **The tool census will live on the `C#` row per model call** (PR-3), not as a map on `S#`:
+  one write that already happens, no parent-map `ADD` problem, and the trajectory gets "which
+  tools ran on which call" for free.
+
+## 6. Verification
+
+- Backend: `cd backend && uv run python -m pytest tests/apis/app_api/admin/costs/ tests/costs/test_content_free_projections.py tests/architecture/`.
+- Live, against dev data, without touching Phil's `:8000`: `.claude/launch.json` defines
+  `app-api-branch` (uvicorn on `:8010`, cwd `backend/src`). The signed-in in-app browser's BFF
+  cookie is host-scoped, so `http://localhost:8010/admin/costs/users/<id>/sessions` authenticates
+  as-is. Verified 2026-09-13: 93 sessions listed for September's top user, zero content-bearing
+  keys, shares computed; a 13-call profile with trajectory, coverage flags and two diagnoses;
+  top-users rows carrying email, tier and quota share (51.2% for the top user).
+
+## 7. Follow-ups (not in this epic)
+
+- "Users who hit their quota this period" — needs a scan or an index on quota events.
+- Fleet-level diagnosis rollup (which rule fires most, weighted by dollars) — the real
+  cost-effectiveness backlog view; trivial once rules exist, needs a scan or a nightly job.
+- Per-sub-tool token cost / a tools-page "enabled tools = tokens" meter — decide from the
+  `LARGE_TOOLSET` and `AGENT_CACHE_BYPASS` frequencies this ships.
diff --git a/docs/specs/agent-marketplace.md b/docs/specs/agent-marketplace.md
index 5ded68ddd..db06a2d13 100644
--- a/docs/specs/agent-marketplace.md
+++ b/docs/specs/agent-marketplace.md
@@ -415,8 +415,42 @@ a fixed partition, per-item records with an explicit `order: int`, sorted on rea
 ## D11 — `@`-mention is scoped to your own and pinned Agents
 
 Typing `@` in the composer offers the user's own Agents plus everything pinned (including role-seeded
-pins), grouped, with the publisher as secondary text. Mentioning one hands that turn to the Agent's
-model, tools and skills without leaving the thread.
+pins), grouped, with the publisher as secondary text. Mentioning one starts a conversation with that
+Agent's model, tools and skills.
+
+> **Revised 2026-09-14 — a mention binds; it is no longer a one-turn borrow.** This paragraph
+> originally read "hands **that turn** to the Agent … without leaving the thread", and the phase-7
+> notes below record how much that one sentence cost to implement. It was also wrong about how the
+> feature would be used, and the per-turn reading had an invisible failure mode:
+>
+> - **It broke silently.** The mentioned turn ran as the Agent; the next one did not. The thread
+>   still looked like the Agent's while its tools, skills and model were gone. Nothing surfaced the
+>   change — not the UI, and not the model, which has no way to know its own toolset shrank. Asked
+>   to use a tool it had used a moment earlier, it got `Unknown tool: create_rubric` and told the
+>   user to toggle the tool in the picker, sending them to fix a setting that was already correct.
+> - **Nobody used what it was protecting.** Of **247 mentions in prod, 247 started the
+>   conversation**; zero were mid-thread consults, and zero mentioned a second Agent inside a thread
+>   bound to a first. (Dev: 60 of 61 started the conversation.) The borrow was paying that failure
+>   mode for a case that has never occurred.
+>
+> So an `@`-mention now means "talk to this Agent", with exactly two outcomes and no third:
+>
+> | Thread state | Behaviour |
+> |---|---|
+> | No messages yet | The Agent **binds** the conversation, exactly as launching it from its card does. Safe because there is no history for the binding to misrepresent. |
+> | Already has messages | The message opens a **new** conversation with that Agent, and the SPA says so. The Agent cannot be bound to history written under other instructions, and must not be borrowed either. |
+>
+> The SPA no longer sends `agent_mention` at all — a mention sets the `assistantId` query param, so
+> the Agent rides every following turn like any bound Agent. The backend still honours the flag for
+> clients that predate the change, and now binds when such a client mentions into an **empty**
+> thread, which is the case that actually happens. Client rule in
+> `session/services/chat/mention-routing.ts`, server rule in `chat/agent_binding_policy.py`; they
+> mirror each other and their tests say so.
+>
+> **This also retires two known costs.** The prefix re-write measured below (~$0.12 per mention) was
+> the price of swapping the Agent in and back out; a bound conversation swaps once and stays. And
+> the history fork — the mention agent and the plain agent being two cached instances that never saw
+> each other's turns — cannot arise when one Agent runs every turn.
 
 Scope is deliberately narrow. Making the `@` menu search the whole store turns an autocomplete into a
 directory query, which is what the store page is for, and it exposes every user to every Agent's name
@@ -916,6 +950,24 @@ thread" in one sentence, and that sentence turned out to be the whole phase:
   "Continue" after a max_tokens truncation runs without the Agent — true for bound Agent
   conversations before this phase, and unchanged by it.
 
+  **Fixed 2026-09-14**, alongside the D11 revision above, because it is the same invisible
+  capability loss on the path users are *told* to use: a properly launched Agent finished its
+  reply with none of its tools, skills, model or instructions. The SPA was already resending
+  `rag_assistant_id` on a continuation for exactly this reason (`continueTruncatedTurn` passes
+  it, and its comment says "so the backend rebuilds the same model/tools/assistant agent");
+  only the `not is_continuation` guard on the block discarded it. The block now runs for a
+  continuation, with binding **validation** and **persistence** still skipped (a continuation
+  binds nothing new) and **RAG** still skipped (the turn carries an empty message, so a
+  knowledge-base search would spend a query on `""` and augment nothing — the original turn's
+  context is already in the history being continued).
+
+  ⚠️ **A resume is a different animal and still skips the block.** It rebuilds from its
+  `PausedTurnSnapshot`, replaying the original turn's exact `enabled_tools` / `system_prompt` /
+  `enabled_skills` so the prompt-cache key is reconstructed and the paused agent is not
+  orphaned. Tool-approval, OAuth and `ask_user_question` resumes therefore never lost their
+  tools — worth stating because `turnAgentId` is *not* stamped on those rows, so a census of
+  "turns with no Agent" reads them as losses and overcounts badly.
+
 **Phase 8 notes (as built).** Six, the first of which is a contradiction inside this spec
 and the fourth of which was a live trap:
 
diff --git a/docs/specs/ask-user-question.md b/docs/specs/ask-user-question.md
new file mode 100644
index 000000000..0dbb2acdb
--- /dev/null
+++ b/docs/specs/ask-user-question.md
@@ -0,0 +1,190 @@
+# Structured clarifying questions (`ask_user_question`)
+
+Status: **Complete.** PR-1 (backend), PR-2 (picker), PR-3 (rehydration), PR-4 (trigger rate + default on).
+
+The agent pauses mid-turn to ask the user one to four multiple-choice
+questions, the SPA renders a picker, and the turn continues in place with the
+user's answer as the tool's result.
+
+## Why this shape
+
+The mechanism already existed. Per-tool approval (`MCPExternalApprovalHook`) is
+this same thing with one question and two fixed options: a Strands interrupt
+pauses the turn, an SSE event drives an inline prompt, and the user's decision
+POSTs back as an `interrupt_responses` entry. Generalizing the payload was
+cheaper than inventing a second pause mechanism, and it inherits the paused-turn
+snapshot, the resume guard and the reload breadcrumbs for free.
+
+Two alternatives were considered and rejected:
+
+- **An MCP App (`ui_resource`).** App frames render *alongside* a running turn;
+  they do not pause it. Building the handshake inside an iframe would reinvent
+  the interrupt protocol and inherit the sandbox-origin dependency — an empty
+  `sandboxOrigin` means the SPA cannot frame the App at all.
+- **A client-side heuristic** that detects ambiguity and prompts without the
+  model asking. The model is the only party that knows what it is blocked on.
+
+## The one real risk, and how it was closed
+
+Every interrupt shipped before this one is raised from a `BeforeToolCallEvent`
+hook. `ask_user_question` raises its own from `ToolContext` (which implements
+`_Interruptible`, `strands/types/tools.py`), because here the pause *is* the
+tool. The resume path — `PausedTurnSnapshot` → rebuilt agent → restored
+`_interrupt_state` → `pending_tool_execution` replayed — was built and proven
+against the hook flavor only.
+
+`tests/agents/main_agent/session/test_user_question_interrupt_integration.py`
+drives the real Strands event loop (real `Agent`, real `@tool`, scripted model
+only) and proves the tool-scoped flavor behaves identically: the turn pauses,
+`pending_tool_execution` is captured, the interrupt id is
+`v1:tool_call:{toolUseId}:{uuid5(name)}`, resuming feeds the response back into
+the *same* tool call, and the tool is not re-invoked.
+
+## Contract
+
+**Tool input** (hand-written `inputSchema`; Strands' generated schema drops
+`$defs`, which would leave nested models as dangling `$ref`s):
+
+```jsonc
+{ "questions": [ {
+    "header": "Scope",             // <= 12 chars, the chip label AND the answer key
+    "question": "How much should this cover?",
+    "multiSelect": false,
+    "options": [ { "label": "Just the API", "description": "Routes only" } ]
+} ] }
+```
+
+1–4 questions, 2–4 options each. The model must **not** supply "Other" or
+"Skip" options — the picker always offers both.
+
+**SSE**: `user_question_required`, payload `{type, interruptId, toolUseId,
+questions}`. See the event table in `CLAUDE.md`.
+
+**Reload**: the event fires once and never re-streams, so a refresh mid-prompt
+would otherwise orphan the turn — picker gone, agent still paused. `GET
+/messages` replays the `PendingInterrupt` breadcrumb (`kind: "user_question"`,
+questions JSON-encoded) and `hydratePendingInterrupts` re-renders the picker.
+Both paths validate questions through the same `validateUserQuestions`, so the
+live and replayed prompts cannot drift.
+
+**Abandonment**: a breadcrumb that outlives its `pausedTurn` snapshot renders a
+prompt the user can no longer answer — the resume route 400s on an interrupt id
+the rebuilt agent never saw, so Submit is a guaranteed error. Nothing used to
+clear them: the two `remove_pending_interrupts` call sites are resume cleanup
+and the explicit dismiss endpoint, neither of which a user reaches by simply
+typing something else. `clear_pending_interrupts` is now called beside
+`clear_paused_turn` at the head of every non-resume turn. It is deliberately a
+separate function rather than folded into `clear_paused_turn`, which clears only
+the snapshot on purpose (`test_paused_turn_independent_of_pending_interrupts`)
+and is also called on the resume-success and expired-snapshot paths where the
+narrower cleanup is already right.
+
+**Resume**: `POST /invocations` with
+
+```jsonc
+{ "session_id": "...", "message": "",
+  "interrupt_responses": [ { "interruptId": "v1:tool_call:...",
+    "response": { "answers": { "Scope": { "selected": ["Everything"], "text": null } } } } ] }
+```
+
+`response` must **never be null**. `ToolContext.interrupt` only treats a
+non-None response as an answer, so a null re-raises the interrupt forever.
+"Skip" sends `{"skipped": true}`.
+
+`parse_answers` also accepts a positional list, a bare string, and label-only
+lists. That tolerance is deliberate: this payload is the user's only route out
+of a paused turn, so a shape mismatch must never be able to strand them. The
+inverse asymmetry applies to `normalize_questions`, which is strict — a prompt
+the SPA cannot draw would pause the turn with nothing on screen, so it is
+rejected at the tool boundary while the model still has a turn left to fix it.
+
+## Cost
+
+- The tool spec is a **constant** in `toolConfig` — registered once at startup,
+  never injected per-turn, so it sits in the stable cacheable prefix. **Do not
+  make its presence conditional on conversation state**; a flag that flipped
+  mid-session would re-write a 30k–150k-token prefix at the cache-write premium.
+- It is a **static registry tool, not an `extra_tools` injection** — it captures
+  no session/user identity, so it does not touch the injected-tool agent-cache
+  bypass (`agent-cache-extra-tools-bypass.md` §6).
+- Questions ride the SSE channel, not the prompt. Only the compact formatted
+  answer block re-enters the conversation, which is why `format_answers` writes
+  one line per question instead of echoing the option catalog back.
+
+## Flag
+
+`ASK_USER_QUESTION_ENABLED`, default on with a kill switch (house style). While
+off the tool is never registered, so the model cannot pause a turn behind a
+prompt no client is listening for; it falls back to asking in prose. The tool
+re-checks the flag at call time so a registry built before a flip cannot pause.
+
+The catalog seed ships `enabledByDefault: False` until PR-2 lands the renderer —
+a paused turn with no picker is a worse failure than a guessed assumption.
+
+## Remaining work
+
+| PR | Scope |
+|----|-------|
+| ~~1~~ | ~~Tool, interrupt, SSE event, `PendingInterrupt` kind, integration proof~~ |
+| ~~2~~ | ~~`UserQuestionService`, stream-parser wiring, the picker (pager + multi-select + Other + Skip), object-carrying resume~~ |
+| ~~3~~ | ~~Reload rehydration, and clearing breadcrumbs for abandoned prompts~~ |
+| ~~4~~ | ~~Trigger-rate guidance, `enabledByDefault` on~~ |
+
+## Trigger rate: what actually moved it
+
+The tool worked end to end from PR-2 but the model rarely reached for it — 4/24
+on deliberately ambiguous requests against a production-shaped tool set. Four
+interventions were measured against that baseline, 16-24 trials each, Haiku 4.5:
+
+| Intervention | Ambiguous | Clear |
+|---|---|---|
+| Baseline | 4/24 (17%) | 0/18 |
+| Reword the tool **description** | 44-56% — within noise | — |
+| Change the tool's position in the list | 25-38% — no effect | — |
+| Remove the prompt's "Cost Awareness" clause | 38% — small, not significant | — |
+| **Clause in the system prompt** | **24/24 (100%)** | **0/18** |
+
+Only the last escapes the noise band, and it buys the ambiguous case without
+turning clear requests into interrogations — the result that decided it was
+shippable.
+
+Three findings worth keeping:
+
+* **The description is a weak vehicle.** The *same sentences* in the tool's own
+  description measured no better than baseline. Position matters, not just
+  wording — which is why `SYSTEM_PROMPT_GUIDANCE` carries a do-not-reword
+  warning and a byte-equality test against the measured text.
+* **Baseline is noisy.** Six nominally identical baselines measured 17-44%.
+  Anything under ~25 points of separation at n≈16 is not a result. Two earlier
+  conclusions in this epic were drawn from n=4 and had to be withdrawn.
+* **A model's account of its own behaviour is a hypothesis, not evidence.**
+  Asked why it wasn't calling the tool, the platform's own model gave a fluent
+  explanation (its "be concise / every token costs the university" principle
+  was fighting the tool) and proposed a fix. The fix worked. The explanation
+  did not survive testing — removing that exact clause moved the rate far less
+  than the fix did. Take the suggestion, test the story.
+
+## Cost
+
+Measured on real sessions via `GET /admin/costs/sessions/{id}/calls`:
+
+* The tool's spec is ~630 tokens, **2.6%** of the ~24k prefix a turn carries
+  here, and it sits in the cacheable segment.
+* `SYSTEM_PROMPT_GUIDANCE` is ~63 tokens, constant per configuration, likewise
+  cached.
+* The real cost is structural: a question turn is **two** model calls, not one.
+  Both cached, the extra call is ~$0.005. If the pause outlives the cache TTL
+  the resume re-writes the prefix at ~$0.036 — about 7x.
+* For scale, the ~24k prefix is dominated by the seven per-request injected
+  tools (artifact/Office/workspace), not by anything in this feature. With them
+  disabled the prefix fell to 2,766 tokens and stopped being cached at all.
+
+Open decisions for PR-2/3:
+
+- **Typing instead of answering** should resume with the typed text as a
+  free-text answer, not start a new turn. A new turn hits
+  `reset_stale_interrupt_state`, discards the paused tool call and re-sends the
+  whole prompt — more expensive, and it routes through the abandoned-pause path.
+- **Steering interplay.** A follow-up queued during the pause and an answer can
+  land together; the `carried steering` path on the resume request already
+  exists, so this is a UX decision about ordering, not new plumbing.
diff --git a/docs/specs/authenticated-web-assessment.md b/docs/specs/authenticated-web-assessment.md
new file mode 100644
index 000000000..0b72bf9e8
--- /dev/null
+++ b/docs/specs/authenticated-web-assessment.md
@@ -0,0 +1,468 @@
+# Authenticated web assessment (browser takeover, profiles, axe)
+
+**Status:** PROPOSED — no code written. Sized for four PRs.
+**Driver:** Two user requests, both blocked on the same missing capability:
+a Library agent that evaluates the accessibility of the databases they renew
+annually (subscription-gated), and a VPAT-evaluation agent that must test
+vendor demo instances that are not public.
+**Refs:** `backend/src/agents/builtin_tools/browser/`,
+`docs/specs/ask-user-question.md` (interrupt pattern),
+`docs/kaizen/scoping/mcp-apps-host-renderer.md` (sandbox-proxy pattern),
+PR #1101 (never put a presigned URL in a tool result)
+
+## Problem
+
+`browse_web` can read any page that a logged-out, AWS-hosted Chromium can
+reach. Every target in both requests fails at least one of those conditions:
+
+- **Login-gated, publicly routable.** A subscription database; a vendor's demo
+  tenant behind a username and password. This is the bulk of the Library's
+  renewal list.
+- **Network-gated.** Campus-IP-only, VPN, or a vendor IP allowlist.
+- **Private TLS.** A staging instance with an internal CA.
+
+There is no path for a user to *authenticate* a browsing session today. The
+naive fix — let the user paste credentials into the composer so the agent can
+type them — is the one option that must never ship: the secret would land in
+the prompt, in AgentCore Memory, and in the cacheable prefix, and be re-read on
+every subsequent turn for the life of the conversation.
+
+## What already exists
+
+Nearly all of it. This is a wiring spec, not a capability spec.
+
+**Human takeover is in the pinned SDK.** `bedrock-agentcore==1.21.0` ships the
+pair that swaps the browser between agent control and human control, both thin
+wrappers over `UpdateBrowserStream`:
+
+```
+browser_client.py:636   def take_control(self):     self.update_stream("DISABLED")
+browser_client.py:648   def release_control(self):  self.update_stream("ENABLED")
+```
+
+**The IAM is already granted.** `UpdateBrowserStream` and
+`ConnectBrowserLiveViewStream` are both on the Runtime execution role
+(`infrastructure/lib/constructs/inference-api/inference-agentcore-construct.ts:227`).
+Nothing calls them.
+
+**Persistent login is a `start()` argument.** `profile_configuration=
+{"profileIdentifier": ...}` (`browser_client.py:320`) persists browser state —
+cookies, local storage — across sessions. This is what turns "log in every
+conversation" into "log in once per vendor, per year."
+
+**Network and TLS are `create_browser` arguments.** `network_configuration`
+(`PUBLIC` | `VPC` + `vpcConfig`), `certificates` (root CAs from Secrets
+Manager), `recording` (session capture to S3), `enterprise_policies` (up to ten
+Chromium managed-policy JSON files from S3), and `extensions`
+(`browser_client.py:117`, `:320`).
+
+**The framing pattern is built.** MCP Apps already solve "embed a hostile-ish
+document at a separate origin that only the SPA may frame": a CloudFront
+distribution over S3 serving a static shell, with a response
+`Content-Security-Policy: frame-ancestors <SPA origin only>`
+(`infrastructure/lib/constructs/mcp-sandbox/mcp-sandbox-distribution-construct.ts`).
+
+**An interrupt that pauses a turn and resumes it** is shipped twice over —
+`OAuthConsentHook` and `ask_user_question`. Both route through Strands'
+`_stop_for_interrupts`, a `PausedTurnSnapshot`, a `PendingInterrupt`
+breadcrumb, and the resume route in `inference_api/chat/routes.py`.
+
+## What is missing or broken
+
+1. **No takeover action.** `browse_web` exposes `live_view` only, documented as
+   "a URL where the user can **watch**" (`browse_tool.py:148`).
+
+2. **`live_view` is broken in the way PR #1101 already diagnosed.**
+   `generate_live_view_url` signs with `SigV4QueryAuth`
+   (`browser_client.py:597`) — the signature lives in the query string — and
+   `browse_tool.py:288` returns that URL as text in the tool result. The model
+   will re-emit it truncated at the `?`. Same failure as the `.docx` download
+   link. **Max expiry is 300 seconds**, which is also far too short for a human
+   to read a message, find their credentials, and log in.
+
+3. **The session reaper will kill a takeover mid-login.**
+   `IDLE_REAP_SECONDS = 600` and `SESSION_TIMEOUT_SECONDS = 900`
+   (`session_pool.py:39`, `:43`). "Idle" is measured by agent tool calls, and
+   during a takeover there are none by construction.
+
+4. **Live View is DCV, and AWS ships only a React component.** Per the
+   [Live View docs](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-dcv-integration.html),
+   the stream is AWS DCV and the supported embed is `<BrowserLiveView>` from the
+   `bedrock-agentcore` **TypeScript/React** SDK, which wraps the DCV Web Client.
+   Our SPA is Angular. This is the single biggest design constraint here.
+
+5. **Our browser is `networkMode: 'PUBLIC'`** (`browser-construct.ts:62`), and
+   `executionRoleArn` on `CfnBrowserCustom` is create-only — the construct
+   already carries scar tissue about replacement collisions.
+
+6. **No accessibility tooling.** `evaluate` can run JS, but `MAX_EVAL_CHARS =
+   4000` (`browse_tool.py:40`) truncates any real axe report, and enterprise
+   apps with a strict CSP will block a CDN-injected axe-core outright.
+
+## Decision summary
+
+| # | Decision |
+|---|----------|
+| D1 | Takeover is a **separately grantable tool** (`request_user_login`), not an action on `browse_web` — RBAC granularity is per `tool_id` |
+| D1b | Takeover is an **interrupt**, not a new endpoint — reuse `ask_user_question`'s machinery |
+| D2 | The live-view URL is **never** model-visible; it is minted on demand by app-api |
+| D3 | DCV is embedded via a **static viewer page at the sandbox origin**, framed by the SPA — not a React island in the Angular app |
+| D4 | Browser session identity moves to the **DynamoDB session-metadata row** so app-api can act on it |
+| D5 | Profiles are keyed `user + assessment target`, with an explicit user-facing "forget this login" |
+| D6 | A **second** `CfnBrowserCustom` for assessment; never mutate the fleet's browser |
+| D7 | axe-core ships as a **browser extension**, and the full report goes to the workspace, never to the model |
+| D8 | Everything rides `BROWSER_TAKEOVER_ENABLED` (default on, kill switch) |
+| D9 | A 40-target sweep is **40 sessions, not one turn** — the cost hazard is session shape, not takeover |
+
+## Design
+
+### D1 — Takeover is its own tool, not a `browse_web` action
+
+**This is a correction to an earlier draft of this spec**, which made takeover an
+action on `browse_web`. That is not grantable.
+
+RBAC granularity in this codebase is exactly one `tool_id`. A role's
+`grantedTools` holds catalog keys (`apis/shared/rbac/models.py:72`), those roll
+up through parents in `_compute_effective_permissions`
+(`apis/shared/rbac/admin_service.py:411`), and the result becomes
+`enabled_tool_ids` for `ToolFilter`. There is no sub-tool granularity and no
+per-action gate. An action on `browse_web` therefore ships to **everyone who can
+browse** — which is the opposite of what is wanted: students should be able to
+browse, and should not be able to take over a browser inside our AWS account.
+
+So `request_user_login` and `accessibility_scan` are each **registered tools with
+their own `TOOL_CATALOG` entries**, granted independently, exactly like
+`ask_user_question`. A user without the grant never has the tool registered, so
+it never reaches `toolConfig` and the model cannot offer it. A student who hits a
+login wall gets a clean "I can't get past this sign-in" instead of a capability
+they shouldn't have.
+
+⚠️ Per the RBAC rule in CLAUDE.md, the admin UI must write **through** to each
+role's `grantedTools` (`add_tool_to_role` / `set_roles_for_tool`) and then run
+`sync_effective_permissions`. A tool list persisted on the resource alone grants
+nothing, silently.
+
+`live_view` is removed from `browse_web`'s action enum — it is superseded by the
+interrupt flow and is broken today (see "What is missing or broken" #2).
+
+Suggested default posture:
+
+| Tool | Who |
+|---|---|
+| `browse_web` | broad, including students |
+| `accessibility_scan` | broad — cheap and useful on any public page |
+| `request_user_login` | restricted to staff/evaluator roles |
+
+### D1b — Takeover is an interrupt
+
+The tool:
+
+1. calls `client.take_control()` — the agent's automation stream goes
+   `DISABLED`, so the agent provably cannot act while the human is driving;
+2. pins the session against the reaper (D4);
+3. raises an interrupt via `ToolContext.interrupt`, exactly as
+   `ask_user_question` does, with `kind: "browser_login"` and a payload of
+   `{sessionId, browserId, viewport: {width, height}, targetUrl}` — **no URL**;
+4. on resume, calls `client.release_control()` and continues the turn.
+
+Why an interrupt rather than a new endpoint: the turn genuinely must stop. The
+agent has nothing to do until a human finishes, and a turn that polls for login
+completion burns model calls to learn nothing. The pause/snapshot/resume path is
+built, tested, and already survives the container-reassignment problem.
+
+A new SSE event `browser_login_required` is emitted after `message_stop`, in the
+same `done` block as `oauth_required` and `user_question_required`. Payload:
+`{type, interruptId, toolUseId, sessionId, browserId, viewport, targetUrl}`.
+
+Resume contract mirrors `user_question_required`: the SPA POSTs an
+`interrupt_responses` entry whose `response` is **always an object, never null**
+— `{completed: true}` or `{skipped: true}`. `ToolContext.interrupt` only treats
+a non-None response as an answer; a null re-raises the interrupt forever.
+
+⚠️ **Abandonment is the known hazard here.** A user who opens the live view and
+walks away leaves both a paused turn (which bricks later turns —
+see the stale-interrupt failure mode) and a browser session billing until TTL.
+Mitigation: the interrupt carries a deadline; when it lapses, the tool releases
+control, stops the session, and returns an ordinary error result so the turn
+completes normally rather than staying pinned.
+
+### D2 — The live-view URL is never model-visible
+
+**Rule, inherited from PR #1101: no presigned URL in a tool result, ever.**
+
+The 300-second cap makes this not merely a style rule but a correctness one — a
+URL minted at tool time is dead before a human reacts, and dead again on every
+reload of the thread.
+
+New app-api route:
+
+```
+POST /sessions/{session_id}/browser/live-view
+  → { url, expiresAt, viewport: { width, height } }
+```
+
+`Depends(get_current_user_from_session)`, owner-scoped to the conversation. The
+SPA sends **only** the conversation id; app-api looks the browser session up
+server-side (D4) and mints a fresh URL per call. The viewer page re-requests on
+expiry, so a login that takes twenty minutes works fine.
+
+Per the inference-api boundary rule this route belongs on app-api, not
+inference-api — the Runtime data plane proxies only `/invocations` and `/ping`,
+so a route added there would 404 in cloud.
+
+app-api's task role needs `ConnectBrowserLiveViewStream`, `UpdateBrowserStream`
+and `GetBrowserSession` on the assessment browser ARN.
+
+### D3 — DCV embeds via a viewer page at the sandbox origin
+
+AWS ships React; we are Angular. Three options were considered:
+
+| Option | Verdict |
+|---|---|
+| Drive the DCV Web Client SDK directly from Angular | Reimplements connection setup, SigV4 handling and frame rendering; carries the maintenance forever |
+| Mount a React island inside the Angular SPA | Adds React to the SPA bundle for one component; poor trade |
+| **Static viewer page at a separate origin, framed by the SPA** | **Chosen** |
+
+The third is what MCP Apps already do. A `live-view.html` asset built against
+`bedrock-agentcore`'s `BrowserLiveView`, deployed to the same CloudFront/S3
+origin pattern with `frame-ancestors <SPA origin only>`. React stays entirely
+outside the SPA bundle. The SPA frames it and passes the conversation id; the
+page calls the D2 route for its own URL and refreshes it on expiry.
+
+`remoteWidth`/`remoteHeight` **must** match the session viewport or the stream
+crops. `DEFAULT_VIEWPORT` is currently `1280x800` (`session_pool.py:45`); the
+viewport must be carried on the event rather than duplicated as a constant in
+the frontend, so the two cannot drift.
+
+⚠️ `bedrock-agentcore` (npm) is a **new dependency** and needs explicit
+approval before anyone installs it. Exact-pin, no `^`.
+
+### D4 — Browser session identity in the session-metadata row
+
+Today the browser session id lives in `agent.state`, which the Strands session
+manager restores from AgentCore Memory — app-api cannot read it, and app-api is
+where the live-view route must live (D2).
+
+Write `{browserSessionId, browserId, viewport, controlState, expiresAt}` onto
+the conversation's session-metadata row in DynamoDB, which app-api already owns
+and scopes by owner. `agent.state` stays the agent-side source for the in-loop
+path; the metadata row is the projection app-api reads. Per the
+"one session, more than one agent" rule, neither may be cached on an agent
+instance — the row is re-read per turn.
+
+This row is also what lets the reaper know a takeover is in progress: while
+`controlState == "user"`, `IDLE_REAP_SECONDS` does not apply.
+
+### D5 — Profiles keyed by user and target
+
+`profileIdentifier` = a stable hash of `(userId, assessmentTargetId)`. A
+"target" is a named vendor/product in the assessment config, not a bare
+hostname, so a vendor whose login and app live on different domains is one
+profile.
+
+The profile is what makes the annual sweep viable: log in once per vendor, and
+next year's run resumes authenticated.
+
+It also means **a durable credential-equivalent now exists per user per vendor**,
+which needs a lifecycle:
+
+- a Customize-surface list of saved logins with a per-row "forget this login";
+- deletion on user deactivation;
+- an expiry, so an abandoned profile does not hold a session cookie forever.
+
+Profiles are per-user by default. A shared institutional account (one Library
+subscription, several evaluators) is a genuinely different model with a
+different blast radius and is **out of scope** for v1.
+
+### D6 — A second browser resource
+
+Add `browser-assessment` (`CfnBrowserCustom`) alongside the existing one:
+
+- `networkMode: 'VPC'` with subnets/SGs, for campus-reachable targets;
+- `recording: { enabled: true, s3Location: ... }` — for a VPAT, evidence that a
+  test ran against a specific build is often worth more than the findings;
+- `enterprise_policies` carrying a Chromium `URLAllowlist` restricted to the
+  targets under evaluation (see Security);
+- `certificates` for internal CAs.
+
+Never mutate the existing browser. `executionRoleArn` is create-only and the
+construct documents the replacement collision; assume `networkConfiguration` is
+create-only too rather than discover it during a deploy. `BROWSER_ID` already
+selects the browser per environment (`session_pool.py:64`), so routing
+assessment sessions to the second resource is a config change.
+
+### D7 — axe-core as an extension; report to the workspace
+
+Two failures if axe is injected via `evaluate` from a CDN: enterprise apps with
+a strict CSP block the injected script — i.e. it fails precisely on the serious
+vendor products — and a full axe report vastly exceeds `MAX_EVAL_CHARS = 4000`.
+
+So: axe-core ships as an S3-hosted browser extension (`start(extensions=[...])`),
+which runs outside page CSP. New action `accessibility_scan`:
+
+- returns to the model **only** a bounded summary — violation ids, impact,
+  node counts, and the page URL;
+- writes the **full JSON** to the user's workspace via the existing
+  workspace-write path, and surfaces it as a download card.
+
+This is the cost tenet applied directly: a forty-database sweep that pipes raw
+axe output through the prompt is exactly the unbounded per-turn payload the rule
+exists to catch.
+
+### D8 — Feature flag
+
+`BROWSER_TAKEOVER_ENABLED`, default on with a kill switch, following the
+house pattern (an empty-string var means on). While off, `request_user_login`
+and `accessibility_scan` are never registered — an unregistered tool never
+reaches `toolConfig`, so the model cannot pause a turn behind a prompt the
+client has no renderer for.
+
+## Cost analysis
+
+All figures measured against the real serialized tool specs, not estimated.
+
+**Prefix (`toolConfig`), per user who is granted the tool:**
+
+| Tool | Tokens |
+|---|---|
+| `browse_web` (today) | 493 |
+| `request_user_login` (new) | ~206 |
+| `accessibility_scan` (new) | ~191 |
+
+Because D1 makes these separate tools, **a user who is not granted them pays
+zero** — the prefix is built from that user's filtered tool list. Removing
+`live_view` from `browse_web`'s enum claws a little back. So the marginal prefix
+cost for a student is negative, and for an evaluator is ~400 tokens, paid once
+per cache write.
+
+**Per turn.** A complete human login round trip costs about **one short tool
+result** — on the order of 30–40 tokens. Everything expensive about it travels
+outside the model's context by construction: the live-view URL is never
+model-visible (D2), the DCV stream is a video stream the model never sees, the
+user's keystrokes and the login page itself never enter the prompt, and the full
+axe report goes to the workspace (D7). `accessibility_scan`'s summary is capped
+at `max_violations` (default 25), so roughly 350 tokens worst case.
+
+Takeover is, in prompt terms, one of the cheapest features in this codebase.
+
+**The real spend is elsewhere, and it is worth being blunt about it.** For these
+two agents the cost driver is ordinary browsing, not takeover:
+
+- `screenshot` produces vision tokens — the single most expensive output the
+  browser tool can generate. An accessibility agent is precisely the agent most
+  tempted to screenshot every page. The tool docstring already discourages it;
+  the assessment *skill* should forbid it except where layout is genuinely the
+  question.
+- `extract_text` is capped at `MAX_TEXT_CHARS = 8000` ≈ 2k tokens **per call**,
+  and every one of those accumulates in conversation history for the rest of the
+  session.
+
+**Browser session wall-clock** is the non-token cost, and takeover lengthens
+sessions by design — a human login is minutes. Two controls: the abandonment
+deadline (D1b), and profiles (D5) making takeover once-per-vendor rather than
+once-per-conversation. The second matters more, and is why D5 is not deferred.
+
+### D9 — A sweep is many sessions, not one turn
+
+The naive shape of "evaluate all 40 databases we renew" is one enormous
+conversation. At ~2k tokens of page text per read and ten pages per target,
+that is several hundred thousand tokens of transcript accumulating in a single
+session — which then triggers compaction, which is its own cost event, and does
+it repeatedly.
+
+The assessment workflow must therefore be **one session per target**, with
+results written to the workspace and aggregated at the end. This is a skill and
+UX decision more than a code one, but it belongs in this spec because it is
+where the actual money is, and because getting it wrong would make the feature
+look expensive when the feature itself is nearly free.
+
+## Security
+
+**An interactive browser inside our AWS account is the headline risk.** During
+takeover the user has a fully interactive Chromium with our egress. Controls:
+
+1. **`URLAllowlist` Chromium enterprise policy** on the assessment browser,
+   scoped to the targets under evaluation. This is the primary control.
+2. **Session recording to S3** — every takeover is recorded. This must be
+   disclosed to users in the UI before control is handed over; silent recording
+   of a session in which someone types a password is not acceptable.
+3. **Takeover is gated by the same RBAC as `browse_web`**, and the assessment
+   browser is a separate resource so it can be granted separately.
+4. **`frame-ancestors`** on the viewer origin, so only the SPA can frame it.
+5. **The agent provably cannot act while the human holds control** — the
+   automation stream is `DISABLED` at the service, not by convention in our code.
+
+**Credentials never enter the conversation.** The whole point of D1 is that the
+user types their password into a real browser with their own hands. Nothing in
+this design should ever accept a credential as a tool argument.
+
+**Recording captures the login.** A recorded session includes the user typing
+into a password field. DCV will mask nothing. The S3 bucket needs the same
+treatment as any credential store — encryption, tight access policy, a
+retention window — and users must be told before they take control.
+
+**Authorization to test is a real precondition, not a formality.** Automated
+scanning of a vendor's non-public demo instance may breach that vendor's terms.
+For a Library procurement workflow this is fixable at the source — ask for
+scanning rights in the renewal terms, or request an evaluation tenant. Worth
+having in writing before forty scans run, not after.
+
+## PR breakdown
+
+| PR | Scope | Notes |
+|----|-------|-------|
+| **1** | Backend takeover: `request_user_login`, take/release control, interrupt + `browser_login_required` SSE event, D4 metadata row, reaper pinning, abandonment deadline, flag | Testable end to end with a curl-minted live-view URL — no frontend needed |
+| **2** | app-api live-view route + IAM; `live-view.html` viewer at the sandbox origin; SPA framing and resume | Needs the `bedrock-agentcore` npm dependency approved first |
+| **3** | Profiles (D5) + the Customize-surface "saved logins" list with forget/expiry | The PR that makes the annual sweep actually repeatable |
+| **4** | `browser-assessment` CDK resource (D6) + axe extension and `accessibility_scan` (D7) | D6 needs campus network decisions from whoever owns routing |
+
+PR 1 alone unblocks a developer-driven demo. PRs 1+2 unblock the Library user
+for anything login-gated and publicly routable, which is most of the renewal
+list. PR 3 is what makes it worth doing annually. PR 4 covers campus-only
+targets and turns the output into VPAT-grade evidence.
+
+## Testing
+
+- **Unit:** interrupt raise/resume round trip; null-response guard (the
+  re-raise-forever trap); abandonment deadline releases control and stops the
+  session; reaper does not reap while `controlState == "user"`; `evaluate` and
+  `accessibility_scan` truncation budgets.
+- **Contract:** `browser_login_required` in `stream-parser-core`; no URL-shaped
+  string anywhere in the tool result (assert it, as PR #1101 did).
+- **Integration (dev):** real takeover against a known login-gated target —
+  confirm the automation stream is `DISABLED` while the human drives, that the
+  agent resumes authenticated, and that a second conversation with the same
+  profile starts already logged in.
+- **Manual:** viewport match (no crop/letterbox), URL refresh across the
+  300-second boundary, light and dark, and phone width.
+
+## Risks and open questions
+
+1. **Is `networkConfiguration` create-only on `CfnBrowserCustom`?** Assumed yes.
+   Confirm before planning PR 4; if it is not, D6 could collapse to a config
+   change on the existing resource — though a separate resource is still the
+   better design for blast radius.
+2. **Does `profileConfiguration` survive a browser *resource* replacement?**
+   If profiles are scoped to the browser id rather than the account, a PR-4
+   deploy could invalidate every saved login. Verify before shipping PR 3.
+3. **Does the DCV viewer work inside a cross-origin iframe with our CSP?**
+   MCP Apps proved the pattern for `srcdoc` content; DCV opens a WebSocket and
+   may need `connect-src` allowances the current policy does not grant.
+4. **Mobile.** DCV interaction on a phone, for a login form in a 1280x800
+   remote viewport, is likely poor. May need an explicit "open in a new tab"
+   escape hatch rather than pretending the frame works everywhere.
+5. **Concurrency.** Two evaluators sharing a Library account, both taking
+   control of different sessions against the same vendor, may collide on a
+   single-session-per-login vendor. Out of scope for v1, but it will come up.
+
+## Out of scope
+
+- Shared/institutional profiles (D5 is per-user).
+- Any credential-as-tool-argument path, including Secrets Manager injection. If
+  a shared account genuinely needs automation later, that is its own spec with
+  its own security review.
+- Replaying recordings in the SPA. Recordings land in S3 and are read out of
+  band for v1.
+- Remediation advice quality — this spec gets the agent *to* the page. What it
+  concludes about WCAG conformance is a prompt and skill problem, not a tooling
+  one.
diff --git a/frontend/ai.client/package-lock.json b/frontend/ai.client/package-lock.json
index 1de6380db..412235071 100644
--- a/frontend/ai.client/package-lock.json
+++ b/frontend/ai.client/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "ai.client",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ai.client",
-      "version": "1.21.0",
+      "version": "1.22.0",
       "dependencies": {
         "@angular/cdk": "21.2.14",
         "@angular/common": "21.2.19",
diff --git a/frontend/ai.client/package.json b/frontend/ai.client/package.json
index c75284bdc..232ba65b1 100644
--- a/frontend/ai.client/package.json
+++ b/frontend/ai.client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ai.client",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "scripts": {
     "ng": "ng",
     "prestart": "tsx scripts/branding/generate-brand-theme.ts && tsx scripts/branding/generate-surface-theme.ts && tsx scripts/branding/generate-surface-colors.ts && tsx scripts/branding/generate-favicons.ts",
diff --git a/frontend/ai.client/src/app/admin/costs/components/context-trajectory-chart.component.spec.ts b/frontend/ai.client/src/app/admin/costs/components/context-trajectory-chart.component.spec.ts
new file mode 100644
index 000000000..483e0eb86
--- /dev/null
+++ b/frontend/ai.client/src/app/admin/costs/components/context-trajectory-chart.component.spec.ts
@@ -0,0 +1,71 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { TestBed } from '@angular/core/testing';
+import { ContextTrajectoryChartComponent } from './context-trajectory-chart.component';
+import { ContextTrajectoryPoint } from '../models';
+
+function points(n: number, tokens: (i: number) => number): ContextTrajectoryPoint[] {
+  return Array.from({ length: n }, (_, i) => ({
+    callIndex: i,
+    timestamp: `2026-09-02T00:00:${String(i).padStart(2, '0')}Z`,
+    contextTokens: tokens(i),
+    cacheStatus: i === 0 ? 'first_write' : 'hit',
+    modelId: 'm',
+    cost: 0.01,
+  }));
+}
+
+describe('ContextTrajectoryChartComponent', () => {
+  function setup(pts: ContextTrajectoryPoint[], threshold = 100_000, window: number | null = 200_000) {
+    TestBed.resetTestingModule();
+    TestBed.configureTestingModule({});
+    const fixture = TestBed.createComponent(ContextTrajectoryChartComponent);
+    fixture.componentRef.setInput('points', pts);
+    fixture.componentRef.setInput('threshold', threshold);
+    fixture.componentRef.setInput('contextWindow', window);
+    fixture.detectChanges();
+    return fixture;
+  }
+
+  afterEach(() => TestBed.resetTestingModule());
+
+  it('renders one column per call, capped at 24px with a surface gap', () => {
+    const fixture = setup(points(5, (i) => 10_000 * (i + 1)));
+    // The chart SVG is the figure's direct child; legend swatches are SVGs of their own.
+    const rects = fixture.nativeElement.querySelectorAll('figure > svg rect');
+    expect(rects.length).toBe(5);
+    expect(fixture.componentInstance.barWidth()).toBe(24);
+    // Many calls: the column shrinks to fit its slot but never below 2px.
+    const dense = setup(points(400, () => 1_000));
+    expect(dense.componentInstance.barWidth()).toBeGreaterThanOrEqual(2);
+    expect(dense.componentInstance.barWidth()).toBeLessThan(24);
+  });
+
+  it('always draws the compaction threshold and labels it', () => {
+    const fixture = setup(points(2, () => 5_000));
+    const text: string = fixture.nativeElement.textContent;
+    expect(text).toContain('compaction threshold 100K');
+    // Window is far above the data → named in the caption, not drawn.
+    expect(text).toContain('window 200K');
+  });
+
+  it('draws a legend only when more than one cache status is present', () => {
+    const single = setup([{ callIndex: 0, timestamp: 't', contextTokens: 100, cacheStatus: 'hit' }]);
+    expect(single.nativeElement.querySelector('ul[aria-label="Cache status legend"]')).toBeNull();
+    const multi = setup(points(3, () => 100));
+    expect(multi.nativeElement.querySelector('ul[aria-label="Cache status legend"]')).not.toBeNull();
+  });
+
+  it('exposes the numbers to assistive tech and hover', () => {
+    const fixture = setup(points(3, (i) => 1_000 * (i + 1)));
+    const svg = fixture.nativeElement.querySelector('svg');
+    expect(svg.getAttribute('aria-label')).toContain('3 calls, peak 3.0K');
+    const title = fixture.nativeElement.querySelector('figure > svg rect title').textContent;
+    expect(title).toContain('Call 1: 1,000 tokens in context');
+    expect(title).toContain('cache: first_write');
+  });
+
+  it('says so when there are no calls', () => {
+    const fixture = setup([]);
+    expect(fixture.nativeElement.textContent).toContain('No model calls recorded');
+  });
+});
diff --git a/frontend/ai.client/src/app/admin/costs/components/context-trajectory-chart.component.ts b/frontend/ai.client/src/app/admin/costs/components/context-trajectory-chart.component.ts
new file mode 100644
index 000000000..25d894e56
--- /dev/null
+++ b/frontend/ai.client/src/app/admin/costs/components/context-trajectory-chart.component.ts
@@ -0,0 +1,210 @@
+import { ChangeDetectionStrategy, Component, computed, input } from '@angular/core';
+import { ContextTrajectoryPoint } from '../models';
+import {
+  formatTokensShort,
+  legendFor,
+  scaleTrajectory,
+  trajectoryFillClass,
+} from '../pages/session-profile.util';
+
+/**
+ * Context occupancy per model call, read against the compaction threshold.
+ *
+ * One column per call (input + cacheRead + cacheWrite — true context
+ * occupancy), colored by the call's cache status so the *shape* of a
+ * conversation's spend is visible at a glance: a staircase of green hits is
+ * healthy; a plateau above the threshold line painted partial-miss is the
+ * spiral. The threshold is always in view because it is what the reader is
+ * judging against; the context window is drawn only when it would not
+ * flatten the bars, and is named in the caption otherwise.
+ *
+ * Marks follow the house chart rules: columns capped at 24px with a 2px
+ * surface gap, hairline gridlines, a legend whenever more than one status is
+ * present, text in text tokens (never the series color). The calls table on
+ * the same page is the table view; each bar also carries an SVG title so the
+ * numbers are reachable on hover and by assistive tech.
+ */
+@Component({
+  selector: 'app-context-trajectory-chart',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  host: { class: 'block' },
+  template: `
+    @if (scale().bars.length === 0) {
+      <p class="text-sm/6 text-gray-500 dark:text-gray-400">No model calls recorded.</p>
+    } @else {
+      <figure>
+        <svg
+          [attr.viewBox]="'0 0 ' + width + ' ' + height"
+          class="h-48 w-full"
+          role="img"
+          [attr.aria-label]="ariaLabel()"
+        >
+          <!-- gridlines + y ticks -->
+          @for (tick of scale().ticks; track tick) {
+            <line
+              [attr.x1]="padLeft"
+              [attr.x2]="width - padRight"
+              [attr.y1]="yFor(tick / scale().yMax)"
+              [attr.y2]="yFor(tick / scale().yMax)"
+              class="stroke-gray-200 dark:stroke-gray-700"
+              stroke-width="1"
+            />
+            <text
+              [attr.x]="padLeft - 6"
+              [attr.y]="yFor(tick / scale().yMax) + 3"
+              text-anchor="end"
+              class="fill-gray-500 text-[10px] dark:fill-gray-400"
+            >
+              {{ tokens(tick) }}
+            </text>
+          }
+
+          <!-- bars -->
+          @for (bar of scale().bars; track bar.point.callIndex) {
+            <rect
+              [attr.x]="xFor(bar.point.callIndex)"
+              [attr.y]="yFor(bar.height)"
+              [attr.width]="barWidth()"
+              [attr.height]="plotHeight * bar.height"
+              rx="3"
+              [class]="fillClass(bar.point)"
+            >
+              <title>{{ barTitle(bar.point) }}</title>
+            </rect>
+          }
+
+          <!-- compaction threshold -->
+          @if (scale().thresholdY; as ty) {
+            <line
+              [attr.x1]="padLeft"
+              [attr.x2]="width - padRight"
+              [attr.y1]="yFor(ty)"
+              [attr.y2]="yFor(ty)"
+              class="stroke-state-danger-500"
+              stroke-width="1.5"
+              stroke-dasharray="4 3"
+            />
+            <text
+              [attr.x]="width - padRight"
+              [attr.y]="yFor(ty) - 4"
+              text-anchor="end"
+              class="fill-gray-600 text-[10px] font-medium dark:fill-gray-300"
+            >
+              compaction threshold {{ tokens(threshold()) }}
+            </text>
+          }
+
+          <!-- context window, only when it fits -->
+          @if (scale().windowY; as wy) {
+            <line
+              [attr.x1]="padLeft"
+              [attr.x2]="width - padRight"
+              [attr.y1]="yFor(wy)"
+              [attr.y2]="yFor(wy)"
+              class="stroke-gray-400 dark:stroke-gray-500"
+              stroke-width="1"
+              stroke-dasharray="2 3"
+            />
+            <text
+              [attr.x]="width - padRight"
+              [attr.y]="yFor(wy) - 4"
+              text-anchor="end"
+              class="fill-gray-500 text-[10px] dark:fill-gray-400"
+            >
+              context window {{ tokens(contextWindow() ?? 0) }}
+            </text>
+          }
+
+          <!-- baseline -->
+          <line
+            [attr.x1]="padLeft"
+            [attr.x2]="width - padRight"
+            [attr.y1]="yFor(0)"
+            [attr.y2]="yFor(0)"
+            class="stroke-gray-300 dark:stroke-gray-600"
+            stroke-width="1"
+          />
+        </svg>
+
+        <figcaption class="mt-2 flex flex-wrap items-center gap-x-4 gap-y-1 text-xs/5 text-gray-500 dark:text-gray-400">
+          <span>{{ scale().bars.length }} {{ scale().bars.length === 1 ? 'call' : 'calls' }}, left to right</span>
+          @if (!scale().windowY && contextWindow()) {
+            <span>window {{ tokens(contextWindow() ?? 0) }}</span>
+          }
+          @if (legend().length > 1) {
+            <ul class="flex flex-wrap items-center gap-x-3 gap-y-1" aria-label="Cache status legend">
+              @for (entry of legend(); track entry.status) {
+                <li class="inline-flex items-center gap-1.5">
+                  <svg class="size-2.5" viewBox="0 0 10 10" aria-hidden="true">
+                    <rect width="10" height="10" rx="2" [class]="fillClass({ cacheStatus: entry.status })" />
+                  </svg>
+                  {{ entry.label }}
+                </li>
+              }
+            </ul>
+          }
+        </figcaption>
+      </figure>
+    }
+  `,
+})
+export class ContextTrajectoryChartComponent {
+  readonly points = input.required<ContextTrajectoryPoint[]>();
+  readonly threshold = input.required<number>();
+  readonly contextWindow = input<number | null | undefined>(null);
+
+  // Fixed drawing frame; the SVG scales to its container via viewBox.
+  readonly width = 720;
+  readonly height = 192;
+  readonly padLeft = 44;
+  readonly padRight = 8;
+  readonly padTop = 18;
+  readonly padBottom = 8;
+  readonly plotHeight = this.height - this.padTop - this.padBottom;
+
+  readonly scale = computed(() => scaleTrajectory(this.points(), this.threshold(), this.contextWindow()));
+  readonly legend = computed(() => legendFor(this.points()));
+
+  /** Column width: fill the slot up to the 24px cap, leaving a 2px surface gap. */
+  readonly barWidth = computed(() => {
+    const n = Math.max(1, this.scale().bars.length);
+    const slot = (this.width - this.padLeft - this.padRight) / n;
+    return Math.max(2, Math.min(24, slot - 2));
+  });
+
+  readonly ariaLabel = computed(() => {
+    const s = this.scale();
+    const peak = s.bars.reduce((m, b) => Math.max(m, b.point.contextTokens), 0);
+    return `Context tokens per model call: ${s.bars.length} calls, peak ${formatTokensShort(peak)}, compaction threshold ${formatTokensShort(this.threshold())}.`;
+  });
+
+  xFor(callIndex: number): number {
+    const n = Math.max(1, this.scale().bars.length);
+    const slot = (this.width - this.padLeft - this.padRight) / n;
+    // Center the column in its slot so the gap is symmetric.
+    return this.padLeft + callIndex * slot + (slot - this.barWidth()) / 2;
+  }
+
+  /** Map a 0..1 share of the plot to a y pixel (SVG y grows downward). */
+  yFor(share: number): number {
+    return this.padTop + this.plotHeight * (1 - Math.max(0, Math.min(1, share)));
+  }
+
+  tokens(value: number): string {
+    return formatTokensShort(Math.round(value));
+  }
+
+  fillClass(point: Pick<ContextTrajectoryPoint, 'cacheStatus'>): string {
+    return trajectoryFillClass(point.cacheStatus);
+  }
+
+  barTitle(point: ContextTrajectoryPoint): string {
+    const parts = [
+      `Call ${point.callIndex + 1}: ${new Intl.NumberFormat('en-US').format(point.contextTokens)} tokens in context`,
+      point.cacheStatus ? `cache: ${point.cacheStatus}` : null,
+      point.modelId ? `model: ${point.modelId}` : null,
+      point.cost != null ? `cost: $${point.cost.toFixed(4)}` : null,
+    ];
+    return parts.filter(Boolean).join(' · ');
+  }
+}
diff --git a/frontend/ai.client/src/app/admin/costs/components/index.ts b/frontend/ai.client/src/app/admin/costs/components/index.ts
index b0f63d979..8abd8e5c0 100644
--- a/frontend/ai.client/src/app/admin/costs/components/index.ts
+++ b/frontend/ai.client/src/app/admin/costs/components/index.ts
@@ -4,3 +4,5 @@ export * from './top-users-table.component';
 export * from './top-sessions-table.component';
 export * from './cost-trends-chart.component';
 export * from './model-breakdown.component';
+export * from './user-conversations.component';
+export * from './context-trajectory-chart.component';
diff --git a/frontend/ai.client/src/app/admin/costs/components/user-conversations.component.spec.ts b/frontend/ai.client/src/app/admin/costs/components/user-conversations.component.spec.ts
new file mode 100644
index 000000000..1977435fd
--- /dev/null
+++ b/frontend/ai.client/src/app/admin/costs/components/user-conversations.component.spec.ts
@@ -0,0 +1,115 @@
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { TestBed } from '@angular/core/testing';
+import { Router, provideRouter } from '@angular/router';
+import { of, throwError } from 'rxjs';
+import { UserConversationsComponent } from './user-conversations.component';
+import { AdminCostHttpService } from '../services/admin-cost-http.service';
+import { UserSessionsResponse } from '../models';
+
+const RESPONSE: UserSessionsResponse = {
+  userId: 'u1',
+  period: '2026-09',
+  userPeriodCost: 5.12,
+  total: 93,
+  unknownCostCount: 2,
+  sessions: [
+    {
+      sessionId: 'bb7c0571-afec-481d-96fb',
+      createdAt: '2026-09-01T00:00:00Z',
+      lastMessageAt: '2026-09-04T14:33:00Z',
+      messageCount: 3,
+      modelId: 'us.anthropic.claude-haiku-4-5-20251001-v1:0',
+      enabledToolCount: 7,
+      agentBound: false,
+      lastContextTokens: 42_772,
+      contextWindow: 200_000,
+      contextShare: 0.2139,
+      totalCost: 0.29,
+      costKnown: true,
+      shareOfUserPeriod: 5.61,
+      wastedUsd: 0,
+      diagnosisCount: 0,
+      topDiagnosisSeverity: null,
+    },
+    {
+      sessionId: 'deadbeef-0000',
+      agentBound: true,
+      costKnown: false,
+      totalCost: null,
+      diagnosisCount: 1,
+      topDiagnosisSeverity: 'info',
+      lastContextTokens: 120_000,
+      contextWindow: 200_000,
+      contextShare: 0.6,
+    },
+  ],
+};
+
+describe('UserConversationsComponent', () => {
+  let getUserSessions: ReturnType<typeof vi.fn>;
+
+  function setup(mock: ReturnType<typeof vi.fn>) {
+    getUserSessions = mock;
+    TestBed.resetTestingModule();
+    TestBed.configureTestingModule({
+      providers: [provideRouter([]), { provide: AdminCostHttpService, useValue: { getUserSessions } }],
+    });
+    TestBed.overrideComponent(UserConversationsComponent, { set: { template: '<div></div>' } });
+    const fixture = TestBed.createComponent(UserConversationsComponent);
+    fixture.componentRef.setInput('userId', 'u1');
+    fixture.detectChanges();
+    return fixture;
+  }
+
+  afterEach(() => TestBed.resetTestingModule());
+
+  it('loads the user’s sessions with the default scope and sort', async () => {
+    const fixture = setup(vi.fn().mockReturnValue(of(RESPONSE)));
+    const c = fixture.componentInstance;
+    await vi.waitFor(() => expect(c.sessionsResource.hasValue()).toBe(true));
+    expect(getUserSessions).toHaveBeenCalledWith('u1', { allTime: false, sort: 'cost', limit: 100 });
+    expect(c.summaryLine()).toBe('Showing 2 of 93 conversations · $5.12 recorded this month · 2 with unrecorded cost');
+  });
+
+  it('reloads when the scope or sort changes', async () => {
+    const fixture = setup(vi.fn().mockReturnValue(of(RESPONSE)));
+    const c = fixture.componentInstance;
+    await vi.waitFor(() => expect(c.sessionsResource.hasValue()).toBe(true));
+
+    c.onScopeChange({ target: { value: 'all' } } as unknown as Event);
+    fixture.detectChanges();
+    await vi.waitFor(() => expect(getUserSessions).toHaveBeenCalledWith('u1', { allTime: true, sort: 'cost', limit: 100 }));
+
+    c.onSortChange({ target: { value: 'recent' } } as unknown as Event);
+    fixture.detectChanges();
+    await vi.waitFor(() => expect(getUserSessions).toHaveBeenCalledWith('u1', { allTime: true, sort: 'recent', limit: 100 }));
+  });
+
+  it('navigates to the session anatomy on open', () => {
+    const fixture = setup(vi.fn().mockReturnValue(of(RESPONSE)));
+    const router = TestBed.inject(Router);
+    const navigate = vi.spyOn(router, 'navigate').mockResolvedValue(true);
+    fixture.componentInstance.open(RESPONSE.sessions[0]);
+    expect(navigate).toHaveBeenCalledWith(['/admin/costs/sessions', 'bb7c0571-afec-481d-96fb']);
+  });
+
+  it('formats cells content-free: short id, model tail, context bar, severity dot', () => {
+    const c = setup(vi.fn().mockReturnValue(of(RESPONSE))).componentInstance;
+    const [known, unknown] = RESPONSE.sessions;
+    expect(c.short(known.sessionId)).toBe('bb7c0571');
+    expect(c.modelShort(known.modelId)).toBe('claude-haiku-4-5');
+    expect(c.modelShort(null)).toBe('—');
+    expect(c.tokens(42_772)).toBe('42.8K');
+    expect(c.contextWidth(known)).toBe(21);
+    expect(c.contextBarClass(known)).toContain('success');
+    expect(c.contextBarClass(unknown)).toContain('danger');
+    expect(c.dot(unknown.topDiagnosisSeverity)).toContain('info');
+    expect(c.currency(0.29)).toBe('$0.29');
+  });
+
+  it('surfaces a load error', async () => {
+    const fixture = setup(vi.fn().mockReturnValue(throwError(() => new Error('boom'))));
+    await vi.waitFor(() => expect(fixture.componentInstance.sessionsResource.error()).toBeTruthy());
+    expect(fixture.componentInstance.summaryLine()).toBe('');
+  });
+});
diff --git a/frontend/ai.client/src/app/admin/costs/components/user-conversations.component.ts b/frontend/ai.client/src/app/admin/costs/components/user-conversations.component.ts
new file mode 100644
index 000000000..7c9055bf2
--- /dev/null
+++ b/frontend/ai.client/src/app/admin/costs/components/user-conversations.component.ts
@@ -0,0 +1,280 @@
+import {
+  ChangeDetectionStrategy,
+  Component,
+  computed,
+  inject,
+  input,
+  resource,
+  signal,
+} from '@angular/core';
+import { DatePipe, DecimalPipe } from '@angular/common';
+import { Router } from '@angular/router';
+import { firstValueFrom } from 'rxjs';
+import { AdminCostHttpService } from '../services/admin-cost-http.service';
+import { UserSessionSummary, UserSessionsSort } from '../models';
+import { SpinnerComponent } from '../../../components/spinner/spinner.component';
+import {
+  formatTokensShort,
+  severityDotClass,
+  shortSessionId,
+} from '../pages/session-profile.util';
+
+/**
+ * A user's conversations, content-free, for the admin user page.
+ *
+ * The hop that was missing between "top users by cost" and the per-session
+ * anatomy: start from the person, see what they were doing without reading
+ * any of it. Every cell is a count, a token figure, a dollar figure, a date,
+ * a model id or a flag — no titles, no summaries. The row's flags dot is the
+ * top severity of the diagnoses that fired on the row's own numbers; the
+ * full findings are on the session page.
+ *
+ * `costKnown=false` rows render "unknown", not "$0.00": 20% of session rows
+ * fleet-wide have never had a cost aggregate written, and a zero there would
+ * be a lie an admin acts on.
+ *
+ * Owned by the costs feature (scope `admin.costs`) even though it renders on
+ * the user page (scope `admin.users`) — the host page decides whether the
+ * viewer may see it; this component assumes it may.
+ */
+@Component({
+  selector: 'app-user-conversations',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [DatePipe, DecimalPipe, SpinnerComponent],
+  host: { class: 'block' },
+  template: `
+    <div class="p-6 bg-white border border-gray-300 rounded-sm dark:bg-gray-800 dark:border-gray-600">
+      <div class="mb-4 flex flex-wrap items-start justify-between gap-3">
+        <div>
+          <h3 class="font-semibold">Conversations</h3>
+          <p class="mt-0.5 text-xs/5 text-gray-500 dark:text-gray-400">
+            Content-free: what each conversation cost and consumed, never what was said.
+          </p>
+        </div>
+        <div class="flex items-center gap-2">
+          <label class="sr-only" for="user-conversations-scope">Period</label>
+          <select
+            id="user-conversations-scope"
+            [value]="allTime() ? 'all' : 'month'"
+            (change)="onScopeChange($event)"
+            class="rounded-2xl border border-gray-300 bg-white px-3 py-1.5 text-sm/6 text-gray-900 focus:border-primary-500 focus:outline-none focus:ring-2 focus:ring-primary-500 dark:border-gray-600 dark:bg-gray-800 dark:text-white"
+          >
+            <option value="month">This month</option>
+            <option value="all">All time</option>
+          </select>
+          <label class="sr-only" for="user-conversations-sort">Sort</label>
+          <select
+            id="user-conversations-sort"
+            [value]="sort()"
+            (change)="onSortChange($event)"
+            class="rounded-2xl border border-gray-300 bg-white px-3 py-1.5 text-sm/6 text-gray-900 focus:border-primary-500 focus:outline-none focus:ring-2 focus:ring-primary-500 dark:border-gray-600 dark:bg-gray-800 dark:text-white"
+          >
+            <option value="cost">Most expensive</option>
+            <option value="recent">Most recent</option>
+            <option value="context">Largest context</option>
+            <option value="messages">Most messages</option>
+          </select>
+        </div>
+      </div>
+
+      @if (sessionsResource.isLoading()) {
+        <div class="flex items-center gap-3 py-6 text-sm/6 text-gray-500 dark:text-gray-400">
+          <app-spinner size="sm" label="Loading conversations" />
+          Loading conversations…
+        </div>
+      } @else if (sessionsResource.error()) {
+        <div
+          role="alert"
+          class="rounded-2xl border border-state-danger-200 bg-state-danger-50 px-4 py-3 text-sm/6 text-state-danger-800 dark:border-state-danger-900 dark:bg-state-danger-900/20 dark:text-state-danger-300"
+        >
+          Couldn't load this user's conversations.
+          <button type="button" (click)="sessionsResource.reload()" class="ml-2 font-medium underline hover:no-underline">
+            Retry
+          </button>
+        </div>
+      } @else if (sessionsResource.hasValue()) {
+        @if (sessionsResource.value().sessions.length === 0) {
+          <p class="py-6 text-center text-sm/6 text-gray-500 dark:text-gray-400">
+            {{ allTime() ? 'No conversations recorded for this user.' : 'No conversations active this month.' }}
+          </p>
+        } @else {
+          <p class="mb-3 text-xs/5 text-gray-500 dark:text-gray-400" aria-live="polite">
+            {{ summaryLine() }}
+          </p>
+          <div class="overflow-x-auto">
+            <table class="min-w-full divide-y divide-gray-200 dark:divide-gray-700">
+              <thead>
+                <tr class="text-left text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                  <th scope="col" class="py-2 pr-3">Conversation</th>
+                  <th scope="col" class="px-3 py-2">Last active</th>
+                  <th scope="col" class="px-3 py-2 text-right">Messages</th>
+                  <th scope="col" class="px-3 py-2">Model</th>
+                  <th scope="col" class="px-3 py-2 text-right">Tools on</th>
+                  <th scope="col" class="px-3 py-2">Context</th>
+                  <th scope="col" class="px-3 py-2 text-right">Cost</th>
+                  <th scope="col" class="px-3 py-2 text-right">Waste</th>
+                  <th scope="col" class="px-3 py-2">Flags</th>
+                </tr>
+              </thead>
+              <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
+                @for (s of sessionsResource.value().sessions; track s.sessionId) {
+                  <tr
+                    class="cursor-pointer text-sm/6 text-gray-700 transition-colors hover:bg-gray-50 dark:text-gray-300 dark:hover:bg-gray-700/50"
+                    (click)="open(s)"
+                    (keydown.enter)="open(s)"
+                    tabindex="0"
+                    [attr.aria-label]="'Open session ' + s.sessionId"
+                  >
+                    <td class="py-2 pr-3">
+                      <span class="font-mono text-xs/5 text-gray-900 dark:text-white" [title]="s.sessionId">{{ short(s.sessionId) }}</span>
+                      @if (s.createdAt) {
+                        <span class="ml-2 text-xs/5 text-gray-500 dark:text-gray-400">started {{ s.createdAt | date: 'MMM d' }}</span>
+                      }
+                      @if (s.agentBound) {
+                        <span class="ml-2 rounded-sm bg-gray-100 px-1.5 font-mono text-[10px]/5 text-gray-600 dark:bg-white/10 dark:text-gray-300">agent</span>
+                      }
+                    </td>
+                    <td class="whitespace-nowrap px-3 py-2 tabular-nums">
+                      {{ s.lastMessageAt ? (s.lastMessageAt | date: 'MMM d, HH:mm') : '—' }}
+                    </td>
+                    <td class="whitespace-nowrap px-3 py-2 text-right tabular-nums">{{ s.messageCount ?? '—' }}</td>
+                    <td class="max-w-40 truncate px-3 py-2 font-mono text-xs/5" [title]="s.modelId ?? ''">
+                      {{ modelShort(s.modelId) }}
+                    </td>
+                    <td class="whitespace-nowrap px-3 py-2 text-right tabular-nums">{{ s.enabledToolCount ?? '—' }}</td>
+                    <td class="whitespace-nowrap px-3 py-2">
+                      @if (s.lastContextTokens != null) {
+                        <div class="flex items-center gap-2">
+                          <div class="h-1.5 w-20 overflow-hidden rounded-full bg-gray-200 dark:bg-gray-700" aria-hidden="true">
+                            <div class="h-full rounded-full" [class]="contextBarClass(s)" [style.width.%]="contextWidth(s)"></div>
+                          </div>
+                          <span class="tabular-nums text-xs/5" [title]="contextTitle(s)">{{ tokens(s.lastContextTokens) }}</span>
+                        </div>
+                      } @else {
+                        <span class="text-gray-400 dark:text-gray-500">—</span>
+                      }
+                    </td>
+                    <td class="whitespace-nowrap px-3 py-2 text-right tabular-nums">
+                      @if (s.costKnown && s.totalCost != null) {
+                        <span class="font-medium text-gray-900 dark:text-white">{{ currency(s.totalCost) }}</span>
+                        @if (s.shareOfUserPeriod != null) {
+                          <span class="ml-1 text-xs/5 text-gray-500 dark:text-gray-400">{{ s.shareOfUserPeriod | number: '1.0-0' }}%</span>
+                        }
+                      } @else {
+                        <span class="text-gray-400 dark:text-gray-500" title="No cost aggregate was ever recorded for this conversation — it is unrecorded, not free">unknown</span>
+                      }
+                    </td>
+                    <td class="whitespace-nowrap px-3 py-2 text-right tabular-nums" [class.text-state-danger-600]="(s.wastedUsd ?? 0) > 0" [class.dark:text-state-danger-400]="(s.wastedUsd ?? 0) > 0">
+                      {{ (s.wastedUsd ?? 0) > 0 ? currency(s.wastedUsd!, 4) : '—' }}
+                    </td>
+                    <td class="whitespace-nowrap px-3 py-2">
+                      @if (s.diagnosisCount > 0) {
+                        <span class="inline-flex items-center gap-1.5 text-xs/5">
+                          <span class="size-2 rounded-full" [class]="dot(s.topDiagnosisSeverity)" aria-hidden="true"></span>
+                          {{ s.diagnosisCount }} {{ s.diagnosisCount === 1 ? 'finding' : 'findings' }}
+                        </span>
+                      } @else {
+                        <span class="text-gray-400 dark:text-gray-500">—</span>
+                      }
+                    </td>
+                  </tr>
+                }
+              </tbody>
+            </table>
+          </div>
+        }
+      }
+    </div>
+  `,
+})
+export class UserConversationsComponent {
+  private readonly costHttp = inject(AdminCostHttpService);
+  private readonly router = inject(Router);
+
+  readonly userId = input.required<string>();
+
+  readonly allTime = signal(false);
+  readonly sort = signal<UserSessionsSort>('cost');
+
+  readonly sessionsResource = resource({
+    params: () => ({ userId: this.userId(), allTime: this.allTime(), sort: this.sort() }),
+    loader: ({ params }) =>
+      firstValueFrom(
+        this.costHttp.getUserSessions(params.userId, {
+          allTime: params.allTime,
+          sort: params.sort,
+          limit: 100,
+        }),
+      ),
+  });
+
+  readonly summaryLine = computed(() => {
+    if (!this.sessionsResource.hasValue()) return '';
+    const v = this.sessionsResource.value();
+    const shown = v.sessions.length;
+    const parts = [
+      shown < v.total ? `Showing ${shown} of ${v.total} conversations` : `${v.total} ${v.total === 1 ? 'conversation' : 'conversations'}`,
+    ];
+    if (v.userPeriodCost != null) parts.push(`${this.currency(v.userPeriodCost)} recorded this month`);
+    if (v.unknownCostCount > 0) parts.push(`${v.unknownCostCount} with unrecorded cost`);
+    return parts.join(' · ');
+  });
+
+  onScopeChange(event: Event): void {
+    this.allTime.set((event.target as HTMLSelectElement).value === 'all');
+  }
+
+  onSortChange(event: Event): void {
+    this.sort.set((event.target as HTMLSelectElement).value as UserSessionsSort);
+  }
+
+  open(s: UserSessionSummary): void {
+    void this.router.navigate(['/admin/costs/sessions', s.sessionId]);
+  }
+
+  short(id: string): string {
+    return shortSessionId(id);
+  }
+
+  tokens(n: number): string {
+    return formatTokensShort(n);
+  }
+
+  dot(severity: UserSessionSummary['topDiagnosisSeverity']): string {
+    return severityDotClass(severity);
+  }
+
+  modelShort(modelId: string | null | undefined): string {
+    if (!modelId) return '—';
+    // "us.anthropic.claude-haiku-4-5-20251001-v1:0" → "claude-haiku-4-5"
+    const tail = modelId.split('.').pop() ?? modelId;
+    return tail.replace(/-\d{8}.*$/, '').replace(/:.*$/, '');
+  }
+
+  contextWidth(s: UserSessionSummary): number {
+    if (s.contextShare == null) return 0;
+    return Math.min(100, Math.round(s.contextShare * 100));
+  }
+
+  contextBarClass(s: UserSessionSummary): string {
+    const share = s.contextShare ?? 0;
+    if (share >= 0.5) return 'bg-state-danger-500';
+    if (share >= 0.25) return 'bg-state-warning-500';
+    return 'bg-state-success-500';
+  }
+
+  contextTitle(s: UserSessionSummary): string {
+    if (s.lastContextTokens == null) return '';
+    const window = s.contextWindow ? ` of ${formatTokensShort(s.contextWindow)} window` : '';
+    return `${new Intl.NumberFormat('en-US').format(s.lastContextTokens)} tokens in context at the last call${window}`;
+  }
+
+  currency(value: number, maxFractionDigits = 2): string {
+    return new Intl.NumberFormat('en-US', {
+      style: 'currency',
+      currency: 'USD',
+      minimumFractionDigits: 2,
+      maximumFractionDigits: maxFractionDigits,
+    }).format(value);
+  }
+}
diff --git a/frontend/ai.client/src/app/admin/costs/models/admin-cost.models.ts b/frontend/ai.client/src/app/admin/costs/models/admin-cost.models.ts
index a36686a0f..af0158d44 100644
--- a/frontend/ai.client/src/app/admin/costs/models/admin-cost.models.ts
+++ b/frontend/ai.client/src/app/admin/costs/models/admin-cost.models.ts
@@ -217,6 +217,141 @@ export interface TopSessionsResponse {
   truncated: boolean;
 }
 
+// ========== Content-free drill-down: user → conversations → profile ==========
+//
+// Nothing below carries user text or model-generated prose. The backend enforces
+// that at the storage boundary (`apis.shared.observability.content_policy`) and
+// walks its response models in a test; these interfaces mirror those models.
+
+export type DiagnosisSeverity = 'high' | 'warn' | 'info';
+
+/** One named finding from the backend's diagnosis rules. */
+export interface SessionDiagnosis {
+  code: string;
+  severity: DiagnosisSeverity;
+  headline: string;
+  /** The numbers the rule compared and the threshold it compared them to. */
+  evidence: Record<string, unknown>;
+  suggestion: string;
+  /** Repo-relative path of the spec or one-pager that argued the rule. */
+  ref: string;
+}
+
+/**
+ * One conversation in a user's content-free conversation list.
+ *
+ * `costKnown=false` means the cost aggregate was never written — the cost is
+ * *unrecorded*, not zero. Optional counters are `null` on rows written before
+ * they shipped, so the UI says "not tracked" rather than "0".
+ */
+export interface UserSessionSummary {
+  sessionId: string;
+  createdAt?: string | null;
+  lastMessageAt?: string | null;
+  status?: string | null;
+  messageCount?: number | null;
+  modelId?: string | null;
+  enabledToolCount?: number | null;
+  agentBound: boolean;
+  lastContextTokens?: number | null;
+  contextWindow?: number | null;
+  /** lastContextTokens / contextWindow, 0..1, when both are known. */
+  contextShare?: number | null;
+  totalCost?: number | null;
+  costKnown: boolean;
+  shareOfUserPeriod?: number | null;
+  cacheEfficiency?: number | null;
+  wastedUsd?: number | null;
+  partialMissUsd?: number | null;
+  summarizedTurns?: number | null;
+  summaryApproxTokens?: number | null;
+  toolCallCount?: number | null;
+  toolErrorCount?: number | null;
+  compactionCount?: number | null;
+  diagnosisCount: number;
+  topDiagnosisSeverity?: DiagnosisSeverity | null;
+}
+
+export interface UserSessionsResponse {
+  userId: string;
+  /** The period the list was scoped to (YYYY-MM), or null for all time. */
+  period?: string | null;
+  /** The user's recorded cost for `period` — the denominator of each row's share. */
+  userPeriodCost?: number | null;
+  sessions: UserSessionSummary[];
+  /** Rows before `limit` was applied. */
+  total: number;
+  /** Rows whose cost is unrecorded (listed, flagged, trailing under cost-sort). */
+  unknownCostCount: number;
+}
+
+export type UserSessionsSort = 'cost' | 'recent' | 'context' | 'messages';
+
+export interface UserSessionsRequestOptions {
+  period?: string;
+  allTime?: boolean;
+  sort?: UserSessionsSort;
+  limit?: number;
+}
+
+/** Per-session upload stats. Never filenames. */
+export interface AttachmentProfile {
+  count: number;
+  totalBytes: number;
+  byMime: Record<string, number>;
+}
+
+/** One model call's context occupancy (input + cacheRead + cacheWrite). */
+export interface ContextTrajectoryPoint {
+  callIndex: number;
+  timestamp: string;
+  contextTokens: number;
+  cacheStatus?: CacheStatus | null;
+  modelId?: string | null;
+  cost?: number | null;
+  /** Per-call tool census when recorded: tool name → calls. */
+  toolCalls?: Record<string, number> | null;
+}
+
+export interface FingerprintChanges {
+  systemPrompt: number;
+  toolConfig: number;
+  /** The subset of the two figures above that an Agent switch explains. */
+  explainedByAgentSwitch: number;
+}
+
+export interface ToolCensusEntry {
+  calls: number;
+  errors: number;
+}
+
+/** Which optional signals this session actually has ("not tracked" vs "0"). */
+export interface DataCoverage {
+  toolCensus: boolean;
+  compactionCount: boolean;
+  fingerprints: boolean;
+  cost: boolean;
+}
+
+/** The content-free diagnostic profile of one conversation. */
+export interface SessionProfile {
+  sessionId: string;
+  userId?: string | null;
+  session: UserSessionSummary;
+  callCount: number;
+  peakContextTokens?: number | null;
+  compactionThreshold: number;
+  writeReadRatio?: number | null;
+  attachments: AttachmentProfile;
+  contextTrajectory: ContextTrajectoryPoint[];
+  modelMix: Record<string, number>;
+  fingerprintChanges: FingerprintChanges;
+  toolCensus: Record<string, ToolCensusEntry>;
+  enabledToolIds: string[];
+  diagnoses: SessionDiagnosis[];
+  dataCoverage: DataCoverage;
+}
+
 // ========== API Request Options ==========
 
 export interface DashboardRequestOptions {
diff --git a/frontend/ai.client/src/app/admin/costs/pages/session-cost-anatomy.page.spec.ts b/frontend/ai.client/src/app/admin/costs/pages/session-cost-anatomy.page.spec.ts
index 2621f53f2..ad3de553f 100644
--- a/frontend/ai.client/src/app/admin/costs/pages/session-cost-anatomy.page.spec.ts
+++ b/frontend/ai.client/src/app/admin/costs/pages/session-cost-anatomy.page.spec.ts
@@ -5,7 +5,7 @@ import { HttpErrorResponse } from '@angular/common/http';
 import { of, throwError } from 'rxjs';
 import { SessionCostAnatomyPage } from './session-cost-anatomy.page';
 import { AdminCostHttpService } from '../services/admin-cost-http.service';
-import { SessionCostAnatomy } from '../models';
+import { SessionCostAnatomy, SessionProfile } from '../models';
 
 const MOCK_ANATOMY: SessionCostAnatomy = {
   sessionId: 'sess-1',
@@ -51,16 +51,73 @@ const MOCK_ANATOMY: SessionCostAnatomy = {
   ],
 };
 
+const MOCK_PROFILE: SessionProfile = {
+  sessionId: 'sess-1',
+  userId: 'user-9',
+  session: {
+    sessionId: 'sess-1',
+    messageCount: 8,
+    modelId: 'us.anthropic.claude-haiku-4-5-20251001-v1:0',
+    enabledToolCount: 3,
+    agentBound: false,
+    lastContextTokens: 24_000,
+    contextWindow: 200_000,
+    totalCost: 0.42,
+    costKnown: true,
+    toolCallCount: null,
+    compactionCount: null,
+    diagnosisCount: 2,
+    topDiagnosisSeverity: 'warn',
+  },
+  callCount: 2,
+  peakContextTokens: 24_000,
+  compactionThreshold: 100_000,
+  writeReadRatio: 0.25,
+  attachments: { count: 1, totalBytes: 2_048, byMime: { 'application/pdf': 1 } },
+  contextTrajectory: [
+    { callIndex: 0, timestamp: '2026-07-19T10:00:00Z', contextTokens: 5_100, cacheStatus: 'first_write' },
+    { callIndex: 1, timestamp: '2026-07-19T10:01:00Z', contextTokens: 24_000, cacheStatus: 'miss_avoidable' },
+  ],
+  modelMix: { 'us.anthropic.claude-haiku-4-5-20251001-v1:0': 2 },
+  fingerprintChanges: { systemPrompt: 0, toolConfig: 1, explainedByAgentSwitch: 0 },
+  toolCensus: {},
+  enabledToolIds: ['browse_web', 'calculator', 'create_artifact'],
+  diagnoses: [
+    {
+      code: 'TOOLCONFIG_MUTATED',
+      severity: 'warn',
+      headline: 'Tool configuration changed mid-conversation',
+      evidence: { distinctToolConfigHashes: 2, callCount: 2 },
+      suggestion: 'Check the ordering of the tool list.',
+      ref: 'docs/one-pagers/fleet-prefix-spend-anatomy.md',
+    },
+    {
+      code: 'LARGE_TOOLSET',
+      severity: 'info',
+      headline: 'Large enabled tool set',
+      evidence: { enabledToolCount: 3 },
+      suggestion: 'Trim.',
+      ref: 'docs/one-pagers/cost-effectiveness-roadmap.md',
+    },
+  ],
+  dataCoverage: { toolCensus: false, compactionCount: false, fingerprints: true, cost: true },
+};
+
 describe('SessionCostAnatomyPage', () => {
   let getSessionCostAnatomy: ReturnType<typeof vi.fn>;
+  let getSessionProfile: ReturnType<typeof vi.fn>;
 
-  function setup(mock: ReturnType<typeof vi.fn>) {
+  function setup(
+    mock: ReturnType<typeof vi.fn>,
+    profileMock: ReturnType<typeof vi.fn> = vi.fn().mockReturnValue(of(MOCK_PROFILE)),
+  ) {
     getSessionCostAnatomy = mock;
+    getSessionProfile = profileMock;
     TestBed.resetTestingModule();
     TestBed.configureTestingModule({
       providers: [
         provideRouter([]),
-        { provide: AdminCostHttpService, useValue: { getSessionCostAnatomy } },
+        { provide: AdminCostHttpService, useValue: { getSessionCostAnatomy, getSessionProfile } },
       ],
     });
     TestBed.overrideComponent(SessionCostAnatomyPage, {
@@ -174,6 +231,93 @@ describe('SessionCostAnatomyPage', () => {
     expect(page.getStatusLabel('hit')).toBe('Hit');
   });
 
+  // ── Profile: what the user was doing, loaded independently of the anatomy ────
+  describe('profile', () => {
+    it('loads the profile for the routed id and exposes the owning user for the back link', async () => {
+      const page = setup(vi.fn().mockReturnValue(of(MOCK_ANATOMY))).componentInstance;
+      await vi.waitFor(() => expect(page.profileResource.hasValue()).toBe(true));
+      expect(getSessionProfile).toHaveBeenCalledWith('sess-1');
+      expect(page.profileUserId()).toBe('user-9');
+      expect(page.modelMixLine()).toBe('2 × claude-haiku-4-5');
+      expect(page.profileNotFound()).toBe(false);
+    });
+
+    it('survives a missing profile without touching the anatomy', async () => {
+      const page = setup(
+        vi.fn().mockReturnValue(of(MOCK_ANATOMY)),
+        vi.fn().mockReturnValue(throwError(() => new HttpErrorResponse({ status: 404 }))),
+      ).componentInstance;
+      await vi.waitFor(() => expect(page.profileResource.error()).toBeTruthy());
+      await vi.waitFor(() => expect(page.anatomyResource.hasValue()).toBe(true));
+      expect(page.profileNotFound()).toBe(true);
+      expect(page.profileUserId()).toBeNull();
+      expect(page.rows()).toHaveLength(2);
+    });
+
+    it('toggles a diagnosis open and closed', () => {
+      const page = setup(vi.fn().mockReturnValue(of(MOCK_ANATOMY))).componentInstance;
+      expect(page.isDiagnosisOpen('LARGE_TOOLSET')).toBe(false);
+      page.toggleDiagnosis('LARGE_TOOLSET');
+      expect(page.isDiagnosisOpen('LARGE_TOOLSET')).toBe(true);
+      page.toggleDiagnosis('LARGE_TOOLSET');
+      expect(page.isDiagnosisOpen('LARGE_TOOLSET')).toBe(false);
+    });
+
+    it('renders evidence as humanized label + formatted value', () => {
+      const page = setup(vi.fn().mockReturnValue(of(MOCK_ANATOMY))).componentInstance;
+      const entries = page.evidenceEntries(MOCK_PROFILE.diagnoses[0]);
+      expect(entries).toEqual([
+        { key: 'distinctToolConfigHashes', label: 'Distinct tool config hashes', value: '2' },
+        { key: 'callCount', label: 'Call count', value: '2' },
+      ]);
+      expect(page.severityLabel('warn')).toBe('Warning');
+      expect(page.chipClass('high')).toContain('danger');
+      expect(page.bytes(2_048)).toBe('2.0 KB');
+    });
+
+    // ⚠️ Never replace the `navigator` global here (e.g. `vi.stubGlobal('navigator',
+    // {...navigator, clipboard})`): a spread drops prototype getters such as
+    // `userAgent`, and with the suite running `isolate: false` Angular's forms
+    // `DefaultValueAccessor` in a *later* spec file then throws on
+    // `navigator.userAgent.toLowerCase()`. Override only the `clipboard`
+    // property and put it back.
+    function withClipboard<T>(clipboard: unknown, run: () => Promise<T>): Promise<T> {
+      const original = Object.getOwnPropertyDescriptor(navigator, 'clipboard');
+      Object.defineProperty(navigator, 'clipboard', { value: clipboard, configurable: true });
+      return run().finally(() => {
+        if (original) Object.defineProperty(navigator, 'clipboard', original);
+        else delete (navigator as unknown as { clipboard?: unknown }).clipboard;
+      });
+    }
+
+    it('copies profile + anatomy as one JSON document and flips the button label', async () => {
+      const writeText = vi.fn().mockResolvedValue(undefined);
+      await withClipboard({ writeText }, async () => {
+        const page = setup(vi.fn().mockReturnValue(of(MOCK_ANATOMY))).componentInstance;
+        await vi.waitFor(() => expect(page.profileResource.hasValue()).toBe(true));
+        await vi.waitFor(() => expect(page.anatomyResource.hasValue()).toBe(true));
+
+        await page.copyDiagnosticJson();
+
+        expect(writeText).toHaveBeenCalledTimes(1);
+        const doc = JSON.parse(writeText.mock.calls[0][0]);
+        expect(doc.profile.sessionId).toBe('sess-1');
+        expect(doc.anatomy.calls).toHaveLength(2);
+        expect(doc._about).toContain('Content-free');
+        expect(page.copied()).toBe(true);
+      });
+    });
+
+    it('does not throw when the clipboard is unavailable', async () => {
+      await withClipboard(undefined, async () => {
+        const page = setup(vi.fn().mockReturnValue(of(MOCK_ANATOMY))).componentInstance;
+        await vi.waitFor(() => expect(page.profileResource.hasValue()).toBe(true));
+        await expect(page.copyDiagnosticJson()).resolves.toBeUndefined();
+        expect(page.copied()).toBe(false);
+      });
+    });
+  });
+
   // ── #756 — explained vs unexplained avoidable misses ──────────────────────────
   describe('agent-switch split', () => {
     async function loadWith(overrides: Partial<SessionCostAnatomy>) {
diff --git a/frontend/ai.client/src/app/admin/costs/pages/session-cost-anatomy.page.ts b/frontend/ai.client/src/app/admin/costs/pages/session-cost-anatomy.page.ts
index b793aec69..18e290b55 100644
--- a/frontend/ai.client/src/app/admin/costs/pages/session-cost-anatomy.page.ts
+++ b/frontend/ai.client/src/app/admin/costs/pages/session-cost-anatomy.page.ts
@@ -12,10 +12,16 @@ import { HttpErrorResponse } from '@angular/common/http';
 import { RouterLink } from '@angular/router';
 import { firstValueFrom } from 'rxjs';
 import { NgIcon, provideIcons } from '@ng-icons/core';
-import { heroArrowLeft, heroChevronDown } from '@ng-icons/heroicons/outline';
+import {
+  heroArrowLeft,
+  heroCheck,
+  heroChevronDown,
+  heroClipboardDocument,
+} from '@ng-icons/heroicons/outline';
 import { AdminCostHttpService } from '../services/admin-cost-http.service';
 import { SpinnerComponent } from '../../../components/spinner/spinner.component';
-import { CacheStatus } from '../models';
+import { ContextTrajectoryChartComponent } from '../components/context-trajectory-chart.component';
+import { CacheStatus, DiagnosisSeverity, SessionDiagnosis } from '../models';
 import {
   AnatomyRow,
   FINGERPRINT_KEYS,
@@ -24,6 +30,14 @@ import {
   buildAnatomyRows,
   truncateHash,
 } from './session-cost-anatomy.util';
+import {
+  SEVERITY_LABELS,
+  buildDiagnosticJson,
+  formatBytes,
+  formatEvidenceValue,
+  humanizeKey,
+  severityChipClass,
+} from './session-profile.util';
 
 /**
  * Admin drill-down: per-model-call cost anatomy for one session.
@@ -40,28 +54,218 @@ import {
  */
 @Component({
   selector: 'app-session-cost-anatomy',
-  imports: [RouterLink, NgIcon, DatePipe, SpinnerComponent],
-  providers: [provideIcons({ heroArrowLeft, heroChevronDown })],
+  imports: [RouterLink, NgIcon, DatePipe, SpinnerComponent, ContextTrajectoryChartComponent],
+  providers: [provideIcons({ heroArrowLeft, heroCheck, heroChevronDown, heroClipboardDocument })],
   changeDetection: ChangeDetectionStrategy.OnPush,
   template: `
     <div>
-      <!-- Back link -->
-      <a
-        routerLink="/admin/costs"
-        class="mb-6 inline-flex items-center gap-2 rounded-2xl text-sm/6 font-medium text-gray-600 hover:text-gray-900 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary-500 dark:text-gray-400 dark:hover:text-white"
-      >
-        <ng-icon name="heroArrowLeft" class="size-4" aria-hidden="true" />
-        Back to Cost Analytics
-      </a>
+      <!-- Back links: to the user when the profile knows them, else to analytics -->
+      <div class="mb-6 flex flex-wrap items-center gap-x-6 gap-y-2">
+        @if (profileUserId(); as userId) {
+          <a
+            [routerLink]="['/admin/users', userId]"
+            class="inline-flex items-center gap-2 rounded-2xl text-sm/6 font-medium text-gray-600 hover:text-gray-900 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary-500 dark:text-gray-400 dark:hover:text-white"
+          >
+            <ng-icon name="heroArrowLeft" class="size-4" aria-hidden="true" />
+            Back to user
+          </a>
+        }
+        <a
+          routerLink="/admin/costs"
+          class="inline-flex items-center gap-2 rounded-2xl text-sm/6 font-medium text-gray-600 hover:text-gray-900 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary-500 dark:text-gray-400 dark:hover:text-white"
+        >
+          @if (!profileUserId()) {
+            <ng-icon name="heroArrowLeft" class="size-4" aria-hidden="true" />
+          }
+          Cost Analytics
+        </a>
+      </div>
 
       <!-- Page Header -->
-      <div class="mb-6">
-        <h1 class="text-2xl/8 font-bold text-gray-900 dark:text-white">Session Cost Anatomy</h1>
-        <p class="mt-1 truncate font-mono text-sm/6 text-gray-600 dark:text-gray-400" [title]="id()">
-          {{ id() }}
-        </p>
+      <div class="mb-6 flex flex-wrap items-start justify-between gap-4">
+        <div class="min-w-0">
+          <h1 class="text-2xl/8 font-bold text-gray-900 dark:text-white">Session Cost Anatomy</h1>
+          <p class="mt-1 truncate font-mono text-sm/6 text-gray-600 dark:text-gray-400" [title]="id()">
+            {{ id() }}
+          </p>
+        </div>
+        @if (profileResource.hasValue()) {
+          <!--
+            The whole payload is content-free by construction (server-enforced),
+            so it is safe to hand to a model for a second opinion — that is the
+            literal purpose of this button.
+          -->
+          <button
+            type="button"
+            (click)="copyDiagnosticJson()"
+            class="inline-flex items-center gap-2 rounded-2xl border border-gray-300 bg-white px-3 py-1.5 text-sm/6 font-medium text-gray-700 hover:bg-gray-50 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary-500 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200 dark:hover:bg-gray-700"
+            [attr.aria-live]="'polite'"
+          >
+            <ng-icon [name]="copied() ? 'heroCheck' : 'heroClipboardDocument'" class="size-4" aria-hidden="true" />
+            {{ copied() ? 'Copied' : 'Copy diagnostic JSON' }}
+          </button>
+        }
       </div>
 
+      <!-- ── Profile: what the user was doing, content-free ── -->
+      @if (profileResource.hasValue()) {
+        @let profile = profileResource.value();
+        <section class="mb-6" aria-labelledby="profile-heading">
+          <h2 id="profile-heading" class="sr-only">Conversation profile</h2>
+          <div class="grid grid-cols-2 gap-4 sm:grid-cols-3 xl:grid-cols-7">
+            <div class="rounded-2xl border border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800">
+              <p class="text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">Messages</p>
+              <p class="mt-1 text-lg/7 font-semibold text-gray-900 dark:text-white">{{ profile.session.messageCount ?? '—' }}</p>
+            </div>
+            <div class="rounded-2xl border border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800">
+              <p class="text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">Model calls</p>
+              <p class="mt-1 text-lg/7 font-semibold text-gray-900 dark:text-white">{{ profile.callCount }}</p>
+              @if (modelMixLine(); as mix) {
+                <p class="mt-1 truncate text-xs/5 text-gray-500 dark:text-gray-400" [title]="mix">{{ mix }}</p>
+              }
+            </div>
+            <div class="rounded-2xl border border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800">
+              <p class="text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">Tool calls</p>
+              @if (profile.dataCoverage.toolCensus) {
+                <p class="mt-1 text-lg/7 font-semibold text-gray-900 dark:text-white">{{ profile.session.toolCallCount ?? 0 }}</p>
+                @if ((profile.session.toolErrorCount ?? 0) > 0) {
+                  <p class="mt-1 text-xs/5 text-state-danger-600 dark:text-state-danger-400">{{ profile.session.toolErrorCount }} failed</p>
+                }
+              } @else {
+                <p class="mt-1 text-lg/7 font-semibold text-gray-400 dark:text-gray-500">—</p>
+                <p class="mt-1 text-xs/5 text-gray-500 dark:text-gray-400">not tracked</p>
+              }
+            </div>
+            <div class="rounded-2xl border border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800">
+              <p class="text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">Attachments</p>
+              <p class="mt-1 text-lg/7 font-semibold text-gray-900 dark:text-white">{{ profile.attachments.count }}</p>
+              @if (profile.attachments.count > 0) {
+                <p class="mt-1 text-xs/5 text-gray-500 dark:text-gray-400">{{ bytes(profile.attachments.totalBytes) }}</p>
+              }
+            </div>
+            <div class="rounded-2xl border border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800">
+              <p class="text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">Compactions</p>
+              @if (profile.dataCoverage.compactionCount) {
+                <p class="mt-1 text-lg/7 font-semibold text-gray-900 dark:text-white">{{ profile.session.compactionCount ?? 0 }}</p>
+              } @else {
+                <p class="mt-1 text-lg/7 font-semibold text-gray-400 dark:text-gray-500">—</p>
+                <p class="mt-1 text-xs/5 text-gray-500 dark:text-gray-400">
+                  {{ profile.session.summarizedTurns ? profile.session.summarizedTurns + ' turns summarized' : 'not tracked' }}
+                </p>
+              }
+            </div>
+            <div class="rounded-2xl border border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800">
+              <p class="text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">Peak context</p>
+              <p
+                class="mt-1 text-lg/7 font-semibold"
+                [class]="
+                  (profile.peakContextTokens ?? 0) > profile.compactionThreshold
+                    ? 'text-state-danger-600 dark:text-state-danger-400'
+                    : 'text-gray-900 dark:text-white'
+                "
+              >
+                {{ profile.peakContextTokens != null ? formatTokens(profile.peakContextTokens) : '—' }}
+              </p>
+              @if (profile.session.contextWindow) {
+                <p class="mt-1 text-xs/5 text-gray-500 dark:text-gray-400">of {{ formatTokens(profile.session.contextWindow) }} window</p>
+              }
+            </div>
+            <div class="rounded-2xl border border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800">
+              <p class="text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">Write : read</p>
+              <p
+                class="mt-1 text-lg/7 font-semibold"
+                [class]="
+                  (profile.writeReadRatio ?? 0) > 3
+                    ? 'text-state-danger-600 dark:text-state-danger-400'
+                    : 'text-gray-900 dark:text-white'
+                "
+              >
+                {{ profile.writeReadRatio != null ? profile.writeReadRatio.toFixed(2) : '—' }}
+              </p>
+              <p class="mt-1 text-xs/5 text-gray-500 dark:text-gray-400">healthy ≈ 0.1</p>
+            </div>
+          </div>
+        </section>
+
+        <!-- ── Diagnoses ── -->
+        <section class="mb-6" aria-labelledby="diagnoses-heading">
+          <div class="rounded-2xl border border-gray-200 bg-white dark:border-gray-700 dark:bg-gray-800">
+            <div class="flex items-center justify-between border-b border-gray-200 px-4 py-3 dark:border-gray-700">
+              <h2 id="diagnoses-heading" class="text-sm/6 font-semibold text-gray-900 dark:text-white">
+                Diagnoses
+                <span class="ml-2 font-normal text-gray-500 dark:text-gray-400">{{ profile.diagnoses.length }}</span>
+              </h2>
+              <p class="text-xs/5 text-gray-500 dark:text-gray-400">Named, computable findings — evidence is the row's own numbers</p>
+            </div>
+            @if (profile.diagnoses.length === 0) {
+              <p class="px-4 py-6 text-sm/6 text-gray-500 dark:text-gray-400">Nothing fired. This conversation looks healthy on every rule.</p>
+            } @else {
+              <ul class="divide-y divide-gray-200 dark:divide-gray-700">
+                @for (d of profile.diagnoses; track d.code) {
+                  <li>
+                    <button
+                      type="button"
+                      (click)="toggleDiagnosis(d.code)"
+                      [attr.aria-expanded]="isDiagnosisOpen(d.code)"
+                      [attr.aria-controls]="'diag-' + d.code"
+                      class="flex w-full items-start gap-3 px-4 py-3 text-left hover:bg-gray-50 focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-primary-500 dark:hover:bg-gray-700/40"
+                    >
+                      <span [class]="chipClass(d.severity)">{{ severityLabel(d.severity) }}</span>
+                      <span class="min-w-0 flex-1">
+                        <span class="block text-sm/6 font-medium text-gray-900 dark:text-white">{{ d.headline }}</span>
+                        <span class="block font-mono text-xs/5 text-gray-500 dark:text-gray-400">{{ d.code }}</span>
+                      </span>
+                      <ng-icon
+                        name="heroChevronDown"
+                        class="mt-1 size-4 shrink-0 text-gray-400 transition-transform duration-150"
+                        [class.rotate-180]="isDiagnosisOpen(d.code)"
+                        aria-hidden="true"
+                      />
+                    </button>
+                    @if (isDiagnosisOpen(d.code)) {
+                      <div [id]="'diag-' + d.code" class="bg-gray-50 px-4 py-3 dark:bg-gray-900/40">
+                        <p class="text-sm/6 text-gray-700 dark:text-gray-300">{{ d.suggestion }}</p>
+                        <dl class="mt-3 grid grid-cols-1 gap-x-8 gap-y-2 sm:grid-cols-2 lg:grid-cols-3">
+                          @for (entry of evidenceEntries(d); track entry.key) {
+                            <div>
+                              <dt class="text-xs/5 font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">{{ entry.label }}</dt>
+                              <dd class="mt-0.5 break-words font-mono text-xs/5 text-gray-700 dark:text-gray-300">{{ entry.value }}</dd>
+                            </div>
+                          }
+                        </dl>
+                        <p class="mt-3 font-mono text-xs/5 text-gray-500 dark:text-gray-400">ref: {{ d.ref }}</p>
+                      </div>
+                    }
+                  </li>
+                }
+              </ul>
+            }
+          </div>
+        </section>
+
+        <!-- ── Context trajectory ── -->
+        <section class="mb-6" aria-labelledby="trajectory-heading">
+          <div class="rounded-2xl border border-gray-200 bg-white p-4 dark:border-gray-700 dark:bg-gray-800">
+            <h2 id="trajectory-heading" class="text-sm/6 font-semibold text-gray-900 dark:text-white">Context per call</h2>
+            <p class="mb-3 text-xs/5 text-gray-500 dark:text-gray-400">
+              Tokens the model had to read on each call, against the compaction threshold. A plateau above the line painted as partial misses is the spiral.
+            </p>
+            <app-context-trajectory-chart
+              [points]="profile.contextTrajectory"
+              [threshold]="profile.compactionThreshold"
+              [contextWindow]="profile.session.contextWindow"
+            />
+          </div>
+        </section>
+      } @else if (profileResource.error() && !profileNotFound()) {
+        <div
+          class="mb-6 rounded-2xl border border-state-warning-200 bg-state-warning-50 px-4 py-3 text-sm/6 text-state-warning-800 dark:border-state-warning-800 dark:bg-state-warning-900/20 dark:text-state-warning-200"
+        >
+          The conversation profile could not be loaded; the call anatomy below is unaffected.
+          <button type="button" (click)="profileResource.reload()" class="ml-2 font-medium underline hover:no-underline">Retry</button>
+        </div>
+      }
+
       @if (anatomyResource.isLoading()) {
         <!-- Loading State -->
         <div class="flex h-64 items-center justify-center">
@@ -398,6 +602,85 @@ export class SessionCostAnatomyPage {
   /** True when the backend returned 404 — the session has no cost rows. */
   readonly notFound = computed(() => this.errorStatus(this.anatomyResource.error()) === 404);
 
+  /**
+   * The content-free profile — what the user was doing. Loaded independently
+   * of the anatomy: a session can have a metadata row and no cost rows (or,
+   * for rows that predate cost tracking, the reverse), and one half failing
+   * must not hide the other.
+   */
+  readonly profileResource = resource({
+    params: () => ({ id: this.id() }),
+    loader: ({ params }) => firstValueFrom(this.costHttp.getSessionProfile(params.id)),
+  });
+
+  readonly profileNotFound = computed(() => this.errorStatus(this.profileResource.error()) === 404);
+
+  /** The owning user, for the back link — only the profile knows it. */
+  readonly profileUserId = computed(() =>
+    this.profileResource.hasValue() ? (this.profileResource.value().userId ?? null) : null,
+  );
+
+  /** "13 × gpt-5.4" or "9 × claude-haiku-4-5, 4 × gpt-5.4" — models by call count, desc. */
+  readonly modelMixLine = computed(() => {
+    if (!this.profileResource.hasValue()) return '';
+    const mix = this.profileResource.value().modelMix;
+    return Object.entries(mix)
+      .sort((a, b) => b[1] - a[1])
+      .map(([model, calls]) => `${calls} × ${model.split('.').pop()?.replace(/-\d{8}.*$/, '').replace(/:.*$/, '') ?? model}`)
+      .join(', ');
+  });
+
+  private expandedDiagnoses = signal<ReadonlySet<string>>(new Set());
+  readonly copied = signal(false);
+
+  isDiagnosisOpen(code: string): boolean {
+    return this.expandedDiagnoses().has(code);
+  }
+
+  toggleDiagnosis(code: string): void {
+    this.expandedDiagnoses.update((current) => {
+      const next = new Set(current);
+      if (next.has(code)) next.delete(code);
+      else next.add(code);
+      return next;
+    });
+  }
+
+  chipClass(severity: DiagnosisSeverity): string {
+    return severityChipClass(severity);
+  }
+
+  severityLabel(severity: DiagnosisSeverity): string {
+    return SEVERITY_LABELS[severity] ?? severity;
+  }
+
+  evidenceEntries(d: SessionDiagnosis): Array<{ key: string; label: string; value: string }> {
+    return Object.entries(d.evidence).map(([key, value]) => ({
+      key,
+      label: humanizeKey(key),
+      value: formatEvidenceValue(value),
+    }));
+  }
+
+  bytes(n: number): string {
+    return formatBytes(n);
+  }
+
+  /** The profile + anatomy as one JSON document on the clipboard. */
+  async copyDiagnosticJson(): Promise<void> {
+    if (!this.profileResource.hasValue()) return;
+    const anatomy = this.anatomyResource.hasValue() ? this.anatomyResource.value() : null;
+    const json = buildDiagnosticJson(this.profileResource.value(), anatomy);
+    try {
+      await navigator.clipboard.writeText(json);
+      this.copied.set(true);
+      setTimeout(() => this.copied.set(false), 2000);
+    } catch {
+      // Clipboard unavailable (insecure context, permissions) — leave the
+      // button as-is; nothing to recover, the data is still on the page.
+    }
+  }
+
   /**
    * Avoidable misses with no explanation — the number that should never move (#756).
    *
diff --git a/frontend/ai.client/src/app/admin/costs/pages/session-profile.util.spec.ts b/frontend/ai.client/src/app/admin/costs/pages/session-profile.util.spec.ts
new file mode 100644
index 000000000..7e7114cc6
--- /dev/null
+++ b/frontend/ai.client/src/app/admin/costs/pages/session-profile.util.spec.ts
@@ -0,0 +1,139 @@
+import { describe, it, expect } from 'vitest';
+import {
+  buildDiagnosticJson,
+  cleanCeiling,
+  formatBytes,
+  formatEvidenceValue,
+  formatTokensShort,
+  humanizeKey,
+  legendFor,
+  scaleTrajectory,
+  severityChipClass,
+  severityDotClass,
+  shortSessionId,
+  trajectoryFillClass,
+} from './session-profile.util';
+import { ContextTrajectoryPoint, SessionProfile } from '../models';
+
+function point(callIndex: number, contextTokens: number, cacheStatus: ContextTrajectoryPoint['cacheStatus'] = 'hit'): ContextTrajectoryPoint {
+  return { callIndex, timestamp: `2026-09-02T00:00:${callIndex}Z`, contextTokens, cacheStatus };
+}
+
+describe('session-profile.util', () => {
+  describe('cleanCeiling', () => {
+    it('rounds up to a 1/2/2.5/5/10 step of the magnitude', () => {
+      expect(cleanCeiling(0)).toBe(1);
+      expect(cleanCeiling(7)).toBe(10);
+      expect(cleanCeiling(12_000)).toBe(20_000);
+      expect(cleanCeiling(21_000)).toBe(25_000);
+      expect(cleanCeiling(40_000)).toBe(50_000);
+      expect(cleanCeiling(108_000)).toBe(200_000);
+    });
+  });
+
+  describe('scaleTrajectory', () => {
+    it('keeps the compaction threshold in view even when every bar is below it', () => {
+      const s = scaleTrajectory([point(0, 5_000), point(1, 8_000)], 100_000, 200_000);
+      expect(s.thresholdY).not.toBeNull();
+      expect(s.yMax).toBeGreaterThanOrEqual(100_000);
+      // The window is 2× the tallest thing drawn → not drawn, named in the caption instead.
+      expect(s.windowY).toBeNull();
+    });
+
+    it('draws the window when the conversation is close to it', () => {
+      const s = scaleTrajectory([point(0, 150_000)], 100_000, 200_000);
+      expect(s.windowY).not.toBeNull();
+      expect(s.windowY!).toBeLessThanOrEqual(1);
+      expect(s.thresholdY!).toBeLessThan(s.windowY!);
+    });
+
+    it('scales bar heights as a share of yMax and yields five ascending ticks', () => {
+      const s = scaleTrajectory([point(0, 50_000)], 100_000, null);
+      expect(s.bars[0].height).toBeCloseTo(50_000 / s.yMax, 6);
+      expect(s.ticks).toHaveLength(5);
+      expect(s.ticks[0]).toBe(0);
+      expect(s.ticks[4]).toBe(s.yMax);
+    });
+
+    it('handles an empty trajectory', () => {
+      const s = scaleTrajectory([], 100_000, 200_000);
+      expect(s.bars).toEqual([]);
+      expect(s.thresholdY).not.toBeNull();
+    });
+  });
+
+  describe('legendFor', () => {
+    it('lists only the statuses present, in canonical order', () => {
+      const legend = legendFor([point(0, 1, 'partial_miss'), point(1, 1, 'hit'), point(2, 1, null)]);
+      expect(legend.map((e) => e.status)).toEqual(['hit', 'partial_miss', 'uncached']);
+    });
+  });
+
+  describe('fill and chip classes', () => {
+    it('mirrors the anatomy badge palette', () => {
+      expect(trajectoryFillClass('hit')).toContain('success');
+      expect(trajectoryFillClass('partial_miss')).toContain('partial-miss');
+      expect(trajectoryFillClass('miss_avoidable')).toContain('danger');
+      expect(trajectoryFillClass(null)).toContain('gray');
+      expect(severityChipClass('high')).toContain('danger');
+      expect(severityChipClass('warn')).toContain('warning');
+      expect(severityChipClass('info')).toContain('info');
+      expect(severityDotClass(undefined)).toContain('gray');
+    });
+  });
+
+  describe('formatting', () => {
+    it('formats bytes across units', () => {
+      expect(formatBytes(512)).toBe('512 B');
+      expect(formatBytes(2_048)).toBe('2.0 KB');
+      expect(formatBytes(5 * 1024 * 1024)).toBe('5.0 MB');
+      expect(formatBytes(3 * 1024 ** 3)).toBe('3.00 GB');
+    });
+
+    it('formats tokens compactly', () => {
+      expect(formatTokensShort(999)).toBe('999');
+      expect(formatTokensShort(8_400)).toBe('8.4K');
+      expect(formatTokensShort(150_000)).toBe('150K');
+      expect(formatTokensShort(1_200_000)).toBe('1.2M');
+    });
+
+    it('shortens session ids and humanizes camelCase keys', () => {
+      expect(shortSessionId('bb7c0571-afec-481d')).toBe('bb7c0571');
+      expect(shortSessionId('abc')).toBe('abc');
+      expect(humanizeKey('peakContextTokens')).toBe('Peak context tokens');
+      expect(humanizeKey('writeReadRatio')).toBe('Write read ratio');
+    });
+
+    it('renders evidence values for display', () => {
+      expect(formatEvidenceValue(150_000)).toBe('150,000');
+      expect(formatEvidenceValue(4.1234567)).toBe('4.1235');
+      expect(formatEvidenceValue(['a', 'b'])).toBe('a, b');
+      expect(formatEvidenceValue(null)).toBe('—');
+      expect(formatEvidenceValue(true)).toBe('yes');
+    });
+  });
+
+  describe('buildDiagnosticJson', () => {
+    it('wraps profile and anatomy with a preamble and is valid JSON', () => {
+      const profile = {
+        sessionId: 's1',
+        session: { sessionId: 's1', agentBound: false, costKnown: true, diagnosisCount: 0 },
+        callCount: 0,
+        compactionThreshold: 100_000,
+        attachments: { count: 0, totalBytes: 0, byMime: {} },
+        contextTrajectory: [],
+        modelMix: {},
+        fingerprintChanges: { systemPrompt: 0, toolConfig: 0, explainedByAgentSwitch: 0 },
+        toolCensus: {},
+        enabledToolIds: [],
+        diagnoses: [],
+        dataCoverage: { toolCensus: false, compactionCount: false, fingerprints: false, cost: true },
+      } as SessionProfile;
+      const parsed = JSON.parse(buildDiagnosticJson(profile, null));
+      expect(parsed._about).toContain('Content-free');
+      expect(parsed.profile.sessionId).toBe('s1');
+      expect(parsed.anatomy).toBeNull();
+      expect(typeof parsed.generatedAt).toBe('string');
+    });
+  });
+});
diff --git a/frontend/ai.client/src/app/admin/costs/pages/session-profile.util.ts b/frontend/ai.client/src/app/admin/costs/pages/session-profile.util.ts
new file mode 100644
index 000000000..3b909ef90
--- /dev/null
+++ b/frontend/ai.client/src/app/admin/costs/pages/session-profile.util.ts
@@ -0,0 +1,209 @@
+import {
+  CacheStatus,
+  ContextTrajectoryPoint,
+  DiagnosisSeverity,
+  SessionCostAnatomy,
+  SessionProfile,
+} from '../models';
+
+/**
+ * Pure helpers for the session profile band, the context-trajectory chart and
+ * the diagnostic-JSON export. Kept out of the page so each is a one-line test.
+ */
+
+// ── severity ────────────────────────────────────────────────────────────────
+
+export const SEVERITY_ORDER: Record<DiagnosisSeverity, number> = { high: 0, warn: 1, info: 2 };
+
+export const SEVERITY_LABELS: Record<DiagnosisSeverity, string> = {
+  high: 'High',
+  warn: 'Warning',
+  info: 'Info',
+};
+
+/** Chip classes for a diagnosis severity. Status colors, never series colors. */
+export function severityChipClass(severity: DiagnosisSeverity): string {
+  const base = 'inline-flex items-center gap-1 rounded-2xl px-2.5 py-0.5 text-xs/5 font-medium';
+  switch (severity) {
+    case 'high':
+      return `${base} bg-state-danger-100 text-state-danger-800 dark:bg-state-danger-900/30 dark:text-state-danger-300`;
+    case 'warn':
+      return `${base} bg-state-warning-100 text-state-warning-800 dark:bg-state-warning-900/30 dark:text-state-warning-300`;
+    case 'info':
+    default:
+      return `${base} bg-state-info-100 text-state-info-800 dark:bg-state-info-900/30 dark:text-state-info-300`;
+  }
+}
+
+/** Dot classes for a row's top severity in the conversation list. */
+export function severityDotClass(severity: DiagnosisSeverity | null | undefined): string {
+  switch (severity) {
+    case 'high':
+      return 'bg-state-danger-500';
+    case 'warn':
+      return 'bg-state-warning-500';
+    case 'info':
+      return 'bg-state-info-500';
+    default:
+      return 'bg-gray-300 dark:bg-gray-600';
+  }
+}
+
+// ── formatting ──────────────────────────────────────────────────────────────
+
+export function formatBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+}
+
+export function formatTokensShort(tokens: number): string {
+  if (tokens >= 1_000_000) return `${(tokens / 1_000_000).toFixed(1)}M`;
+  if (tokens >= 1_000) return `${(tokens / 1_000).toFixed(tokens >= 100_000 ? 0 : 1)}K`;
+  return tokens.toString();
+}
+
+/** A compact id for a session in a table cell: first 8 chars. */
+export function shortSessionId(sessionId: string): string {
+  return sessionId.length > 8 ? sessionId.slice(0, 8) : sessionId;
+}
+
+/** Render an evidence value for display: numbers with grouping, arrays joined. */
+export function formatEvidenceValue(value: unknown): string {
+  if (value === null || value === undefined) return '—';
+  if (typeof value === 'number') {
+    return Number.isInteger(value)
+      ? new Intl.NumberFormat('en-US').format(value)
+      : new Intl.NumberFormat('en-US', { maximumFractionDigits: 4 }).format(value);
+  }
+  if (Array.isArray(value)) return value.map(String).join(', ');
+  if (typeof value === 'boolean') return value ? 'yes' : 'no';
+  return String(value);
+}
+
+/** `peakContextTokens` → "peakContextTokens" reads badly; space the camelCase. */
+export function humanizeKey(key: string): string {
+  return key
+    .replace(/([a-z0-9])([A-Z])/g, (_, a: string, b: string) => `${a} ${b.toLowerCase()}`)
+    .replace(/^./, (c) => c.toUpperCase());
+}
+
+// ── context trajectory chart ────────────────────────────────────────────────
+
+export interface TrajectoryBar {
+  point: ContextTrajectoryPoint;
+  /** 0..1 share of the plot height. */
+  height: number;
+}
+
+export interface TrajectoryScale {
+  /** Y-axis maximum in tokens — clean-rounded above the tallest thing drawn. */
+  yMax: number;
+  bars: TrajectoryBar[];
+  /** 0..1 position of the compaction threshold, or null if above yMax. */
+  thresholdY: number | null;
+  /** 0..1 position of the context window, or null if not drawn (usually far above). */
+  windowY: number | null;
+  /** Clean tick values for the y-axis, ascending. */
+  ticks: number[];
+}
+
+/** Round up to a clean axis maximum (1/2/5 × 10^n). */
+export function cleanCeiling(value: number): number {
+  if (value <= 0) return 1;
+  const magnitude = 10 ** Math.floor(Math.log10(value));
+  for (const step of [1, 2, 2.5, 5, 10]) {
+    if (step * magnitude >= value) return step * magnitude;
+  }
+  return 10 * magnitude;
+}
+
+/**
+ * Scale the trajectory so the tallest bar *and* the compaction threshold are
+ * both in view — the threshold is the line the reader is judging the bars
+ * against, so it must never be off the top. The context window is drawn only
+ * when it is within 1.5× of the tallest bar; otherwise it would flatten every
+ * ordinary conversation into a sliver and is named in the caption instead.
+ */
+export function scaleTrajectory(
+  points: ContextTrajectoryPoint[],
+  threshold: number,
+  contextWindow: number | null | undefined,
+): TrajectoryScale {
+  const peak = points.reduce((m, p) => Math.max(m, p.contextTokens), 0);
+  const drawWindow = !!contextWindow && contextWindow <= Math.max(peak, threshold) * 1.5;
+  const tallest = Math.max(peak, threshold, drawWindow ? (contextWindow ?? 0) : 0);
+  const yMax = cleanCeiling(tallest * 1.08);
+  const bars = points.map((point) => ({ point, height: yMax > 0 ? point.contextTokens / yMax : 0 }));
+  const tickStep = yMax / 4;
+  const ticks = [0, 1, 2, 3, 4].map((i) => i * tickStep);
+  return {
+    yMax,
+    bars,
+    thresholdY: threshold <= yMax ? threshold / yMax : null,
+    windowY: drawWindow && contextWindow ? contextWindow / yMax : null,
+    ticks,
+  };
+}
+
+/** Tailwind fill class for a trajectory bar by cache status. Mirrors the anatomy badges. */
+export function trajectoryFillClass(status: CacheStatus | null | undefined): string {
+  switch (status) {
+    case 'hit':
+      return 'fill-state-success-500';
+    case 'first_write':
+      return 'fill-state-info-500';
+    case 'miss_ttl_expired':
+      return 'fill-state-warning-500';
+    case 'miss_avoidable':
+      return 'fill-state-danger-500';
+    case 'partial_miss':
+      return 'fill-category-accent-partial-miss-500';
+    case 'uncached':
+    default:
+      return 'fill-gray-400 dark:fill-gray-500';
+  }
+}
+
+export const TRAJECTORY_LEGEND: ReadonlyArray<{ status: CacheStatus; label: string }> = [
+  { status: 'hit', label: 'Hit' },
+  { status: 'first_write', label: 'First write' },
+  { status: 'partial_miss', label: 'Partial miss' },
+  { status: 'miss_avoidable', label: 'Avoidable miss' },
+  { status: 'miss_ttl_expired', label: 'TTL miss' },
+  { status: 'uncached', label: 'Uncached' },
+];
+
+/** Only the legend entries that actually appear in the data. */
+export function legendFor(points: ContextTrajectoryPoint[]): ReadonlyArray<{ status: CacheStatus; label: string }> {
+  const present = new Set(points.map((p) => p.cacheStatus ?? 'uncached'));
+  return TRAJECTORY_LEGEND.filter((e) => present.has(e.status));
+}
+
+// ── diagnostic JSON ─────────────────────────────────────────────────────────
+
+/**
+ * The payload a developer pastes into a model for a second opinion. Both
+ * halves are content-free by construction (server-enforced), so the whole
+ * object is safe to share. Includes a one-line preamble so the recipient
+ * knows what it is looking at without the page.
+ */
+export function buildDiagnosticJson(
+  profile: SessionProfile,
+  anatomy: SessionCostAnatomy | null,
+): string {
+  return JSON.stringify(
+    {
+      _about:
+        'Content-free cost diagnostic for one conversation on the AgentCore Public Stack. ' +
+        'No user text or model output is included; numbers, tokens, hashes-as-counts, ' +
+        'dollars, timestamps and tool/catalog ids only. Diagnose the dominant cost driver.',
+      generatedAt: new Date().toISOString(),
+      profile,
+      anatomy,
+    },
+    null,
+    2,
+  );
+}
diff --git a/frontend/ai.client/src/app/admin/costs/services/admin-cost-http.service.spec.ts b/frontend/ai.client/src/app/admin/costs/services/admin-cost-http.service.spec.ts
index 82ad514d2..6d99951c0 100644
--- a/frontend/ai.client/src/app/admin/costs/services/admin-cost-http.service.spec.ts
+++ b/frontend/ai.client/src/app/admin/costs/services/admin-cost-http.service.spec.ts
@@ -86,6 +86,40 @@ describe('AdminCostHttpService', () => {
     req.flush(mockAnatomy);
   });
 
+  it('should get a user’s sessions with scope and sort params', () => {
+    const mock = { userId: 'u1', sessions: [], total: 0, unknownCostCount: 0 };
+
+    service.getUserSessions('u1', { allTime: true, sort: 'recent', limit: 50 }).subscribe(resp => {
+      expect(resp).toEqual(mock);
+    });
+
+    const req = httpMock.expectOne(
+      'http://localhost:8000/admin/costs/users/u1/sessions?allTime=true&sort=recent&limit=50'
+    );
+    expect(req.request.method).toBe('GET');
+    req.flush(mock);
+  });
+
+  it('should URL-encode the user id and send period when scoped', () => {
+    service.getUserSessions('a/b', { period: '2026-09' }).subscribe();
+
+    const req = httpMock.expectOne('http://localhost:8000/admin/costs/users/a%2Fb/sessions?period=2026-09');
+    expect(req.request.method).toBe('GET');
+    req.flush({ userId: 'a/b', sessions: [], total: 0, unknownCostCount: 0 });
+  });
+
+  it('should get a session profile', () => {
+    const mock = { sessionId: 'sess-1', diagnoses: [] };
+
+    service.getSessionProfile('sess-1').subscribe(profile => {
+      expect(profile).toEqual(mock);
+    });
+
+    const req = httpMock.expectOne('http://localhost:8000/admin/costs/sessions/sess-1/profile');
+    expect(req.request.method).toBe('GET');
+    req.flush(mock);
+  });
+
   it('should URL-encode the session id in the anatomy request', () => {
     service.getSessionCostAnatomy('a/b c').subscribe();
 
diff --git a/frontend/ai.client/src/app/admin/costs/services/admin-cost-http.service.ts b/frontend/ai.client/src/app/admin/costs/services/admin-cost-http.service.ts
index c962af23a..ede99f4da 100644
--- a/frontend/ai.client/src/app/admin/costs/services/admin-cost-http.service.ts
+++ b/frontend/ai.client/src/app/admin/costs/services/admin-cost-http.service.ts
@@ -15,6 +15,9 @@ import {
   TopSessionsResponse,
   TrendsRequestOptions,
   SessionCostAnatomy,
+  SessionProfile,
+  UserSessionsRequestOptions,
+  UserSessionsResponse,
 } from '../models';
 
 /**
@@ -167,6 +170,49 @@ export class AdminCostHttpService {
     );
   }
 
+  /**
+   * One user's conversations, content-free, for the admin user page.
+   *
+   * `period` scopes which sessions are listed and supplies the share
+   * denominator; each row's cost is the conversation's lifetime cost.
+   * `allTime` lists everything (period is then ignored server-side).
+   */
+  getUserSessions(
+    userId: string,
+    options: UserSessionsRequestOptions = {},
+  ): Observable<UserSessionsResponse> {
+    let params = new HttpParams();
+
+    if (options.period) {
+      params = params.set('period', options.period);
+    }
+    if (options.allTime !== undefined) {
+      params = params.set('allTime', options.allTime);
+    }
+    if (options.sort) {
+      params = params.set('sort', options.sort);
+    }
+    if (options.limit !== undefined) {
+      params = params.set('limit', options.limit);
+    }
+
+    return this.http.get<UserSessionsResponse>(
+      `${this.baseUrl()}/users/${encodeURIComponent(userId)}/sessions`,
+      { params },
+    );
+  }
+
+  /**
+   * The content-free diagnostic profile of one session — attachments,
+   * context trajectory, model mix, fingerprint churn, tool census and the
+   * diagnoses that fired. 404 when the session has no metadata row.
+   */
+  getSessionProfile(sessionId: string): Observable<SessionProfile> {
+    return this.http.get<SessionProfile>(
+      `${this.baseUrl()}/sessions/${encodeURIComponent(sessionId)}/profile`,
+    );
+  }
+
   /**
    * Export cost data for a period.
    * Returns blob for download.
diff --git a/frontend/ai.client/src/app/admin/users/pages/user-detail/user-detail.page.ts b/frontend/ai.client/src/app/admin/users/pages/user-detail/user-detail.page.ts
index 20c9c78ea..d36304e8f 100644
--- a/frontend/ai.client/src/app/admin/users/pages/user-detail/user-detail.page.ts
+++ b/frontend/ai.client/src/app/admin/users/pages/user-detail/user-detail.page.ts
@@ -20,11 +20,13 @@ import { UserStateService } from '../../services/user-state.service';
 import { QuotaEventSummary } from '../../models';
 import { parseIso } from '../../../../utils/date';
 import { SpinnerComponent } from '../../../../components/spinner/spinner.component';
+import { UserService } from '../../../../auth/user.service';
+import { UserConversationsComponent } from '../../../costs/components/user-conversations.component';
 
 @Component({
   selector: 'app-user-detail',
   changeDetection: ChangeDetectionStrategy.OnPush,
-  imports: [NgIcon, SpinnerComponent],
+  imports: [NgIcon, SpinnerComponent, UserConversationsComponent],
   providers: [
     provideIcons({
       heroArrowLeft,
@@ -266,6 +268,18 @@ import { SpinnerComponent } from '../../../../components/spinner/spinner.compone
         }
       </div>
 
+      <!--
+        Conversations — the cost drill-down. Gated on the *costs* scope, not
+        this page's: it is cost data and its drill-down target is
+        admin.costs-gated, so a users-only delegate sees the page without the
+        section rather than a 403 inside it.
+      -->
+      @if (canSeeCosts()) {
+        <div class="mt-6">
+          <app-user-conversations [userId]="detail.profile.userId" />
+        </div>
+      }
+
       <!-- Admin Actions -->
       <div class="flex gap-4 mt-6">
         <button
@@ -288,9 +302,13 @@ export class UserDetailPage implements OnInit {
   state = inject(UserStateService);
   private route = inject(ActivatedRoute);
   private router = inject(Router);
+  private userService = inject(UserService);
 
   user = computed(() => this.state.selectedUser());
 
+  /** Whether the viewer may see cost data (system_admin or the admin.costs scope). */
+  canSeeCosts = computed(() => this.userService.hasAdminScope('admin.costs'));
+
   ngOnInit(): void {
     const userId = this.route.snapshot.paramMap.get('userId');
     if (userId) {
diff --git a/frontend/ai.client/src/app/app.config.ts b/frontend/ai.client/src/app/app.config.ts
index 15753e14f..86d710b78 100644
--- a/frontend/ai.client/src/app/app.config.ts
+++ b/frontend/ai.client/src/app/app.config.ts
@@ -11,13 +11,24 @@ import { SessionService } from './auth/session.service';
 import { ThemeService } from './components/topnav/components/theme-toggle/theme.service';
 import { provideBuiltInToolRenderers } from './session/components/message-list/components/tool-use/built-in-renderers';
 import { AnnouncementModalService } from './services/announcements/announcement-modal.service';
+import { ConfigService } from './services/config.service';
+import { durableDownloadUrlFromHref } from './shared/utils/file-download-url';
 
-function markedOptionsFactory(): MarkedOptions {
+function markedOptionsFactory(config: ConfigService): MarkedOptions {
   const renderer = new MarkedRenderer();
   const renderLink = renderer.link;
 
   renderer.link = function (link) {
-    const html = renderLink.call(this, link);
+    // A raw user-files S3 URL in assistant prose is always broken. The model
+    // reads the same tool-result JSON the download card does, and when that
+    // JSON carried a presigned URL it would compose its own "[Download](...)"
+    // link from it — truncated at the `?`, so the signature was gone and S3
+    // answered AccessDenied while the card's own button worked. The backend no
+    // longer puts signed URLs in tool results; this rewrite heals the links
+    // already persisted in conversations, routing them to the durable
+    // `/files/{uploadId}/download` endpoint.
+    const durable = durableDownloadUrlFromHref(config.appApiUrl(), link.href);
+    const html = renderLink.call(this, durable ? { ...link, href: durable } : link);
     return html.replace(/^<a /, '<a target="_blank" rel="noopener noreferrer" ');
   };
 
@@ -38,6 +49,7 @@ export const appConfig: ApplicationConfig = {
       markedOptions: {
         provide: MARKED_OPTIONS,
         useFactory: markedOptionsFactory,
+        deps: [ConfigService],
       },
     }),
     provideRouter(routes, withComponentInputBinding()),
diff --git a/frontend/ai.client/src/app/assistants/models/document.model.ts b/frontend/ai.client/src/app/assistants/models/document.model.ts
index 299d73c33..1adb2df42 100644
--- a/frontend/ai.client/src/app/assistants/models/document.model.ts
+++ b/frontend/ai.client/src/app/assistants/models/document.model.ts
@@ -79,12 +79,35 @@ export interface Document {
   lastSyncedAt?: string | null;
 }
 
+/**
+ * Knowledge-base storage usage, returned alongside the documents list.
+ *
+ * Only managed KBs are byte-capped (Requirement 12.11): `cap` is the binding
+ * limit (the smaller of the owner tier and the per-KB ceiling). A legacy
+ * (S3-Vectors) KB is uncapped and tracks no bytes, so `cap` is null and the
+ * counters are 0 — the UI renders an uncapped indicator.
+ */
+export interface KbUsage {
+  /** 'managed' | 's3vectors'. */
+  engine: string;
+  /** Bytes committed to the KB. */
+  storedBytes: number;
+  /** Bytes reserved by in-flight uploads. */
+  reservedBytes: number;
+  /** Binding byte cap, or null for an uncapped legacy KB. */
+  cap: number | null;
+  /** Whether the elevated owner tier applies. */
+  elevated: boolean;
+}
+
 /**
  * Response from GET /assistants/{assistantId}/documents
  */
 export interface DocumentsListResponse {
   documents: Document[];
   nextToken?: string;
+  /** Storage usage + cap for the assistant's KB; absent when not resolved. */
+  kbUsage?: KbUsage | null;
 }
 
 /**
diff --git a/frontend/ai.client/src/app/assistants/services/document.service.ts b/frontend/ai.client/src/app/assistants/services/document.service.ts
index f9db16d6e..3445648e8 100644
--- a/frontend/ai.client/src/app/assistants/services/document.service.ts
+++ b/frontend/ai.client/src/app/assistants/services/document.service.ts
@@ -1,7 +1,8 @@
 import { Injectable, inject, computed } from '@angular/core';
-import { HttpClient, HttpErrorResponse } from '@angular/common/http';
+import { HttpClient, HttpContext, HttpErrorResponse } from '@angular/common/http';
 import { firstValueFrom } from 'rxjs';
 import { ConfigService } from '../../services/config.service';
+import { SUPPRESS_ERROR_TOAST } from '../../auth/error.interceptor';
 import {
   CreateDocumentRequest,
   UploadUrlResponse,
@@ -200,10 +201,24 @@ export class DocumentService {
    * @returns Promise resolving to document
    * @throws DocumentUploadError on API failure
    */
-  async getDocument(assistantId: string, documentId: string): Promise<Document> {
+  async getDocument(
+    assistantId: string,
+    documentId: string,
+    options?: { suppressErrorToast?: boolean },
+  ): Promise<Document> {
     try {
       return await firstValueFrom(
-        this.http.get<Document>(`${this.baseUrl()}/${assistantId}/documents/${documentId}`),
+        this.http.get<Document>(`${this.baseUrl()}/${assistantId}/documents/${documentId}`, {
+          // The global error interceptor pops a dialog for every failed request
+          // BEFORE any caller's catch runs, so a caller that handles its own
+          // failures has to say so here or the user sees both. The polling loop
+          // tolerates up to five consecutive 404s by design — a document deleted
+          // mid-upload produced five "Not found" dialogs, one per tolerated retry,
+          // even though the code was handling it correctly all along.
+          context: options?.suppressErrorToast
+            ? new HttpContext().set(SUPPRESS_ERROR_TOAST, true)
+            : undefined,
+        }),
       );
     } catch (err) {
       throw this.handleApiError(err, 'Failed to get document');
@@ -339,6 +354,15 @@ export class DocumentService {
     maxPollTime: number = 5 * 60 * 1000, // 5 minutes
     initialInterval: number = 500, // 500ms - start fast to catch quick status changes
     maxInterval: number = 10000, // 10 seconds
+    /**
+     * Asked before every request. Return true to abandon the poll immediately.
+     *
+     * Without this the loop keeps asking about a document the user has just
+     * deleted: it has no way to know, so it runs until its 404 tolerance is spent.
+     * The caller knows the moment the row goes away, which is why the decision
+     * belongs to it and not to a timeout in here.
+     */
+    isCancelled?: () => boolean,
   ): Promise<Document> {
     const startTime = Date.now();
     let currentInterval = initialInterval;
@@ -349,8 +373,17 @@ export class DocumentService {
     const STALE_THRESHOLD_MS = STALE_DOCUMENT_THRESHOLD_MS;
 
     while (Date.now() - startTime < maxPollTime) {
+      if (isCancelled?.()) {
+        throw new DocumentUploadError(
+          'Polling cancelled — the document is no longer being tracked',
+          'POLL_CANCELLED',
+          { documentId, assistantId },
+        );
+      }
       try {
-        const document = await this.getDocument(assistantId, documentId);
+        const document = await this.getDocument(assistantId, documentId, {
+          suppressErrorToast: true,
+        });
 
         // Reset 404 counter on successful response
         consecutive404Count = 0;
@@ -415,7 +448,9 @@ export class DocumentService {
     }
 
     // Timeout - get final status
-    const finalDocument = await this.getDocument(assistantId, documentId);
+    const finalDocument = await this.getDocument(assistantId, documentId, {
+      suppressErrorToast: true,
+    });
     if (onStatusUpdate) {
       onStatusUpdate(finalDocument);
     }
diff --git a/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.html b/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.html
index 5682c9403..f5b4f0f33 100644
--- a/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.html
+++ b/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.html
@@ -496,6 +496,37 @@ <h3 class="text-sm/6 font-medium text-gray-700 dark:text-gray-300">Uploaded Docu
           </span>
         }
       </div>
+      @if (showUsageBar()) {
+        <!-- KB storage usage (byte-cap visibility, Requirement 12.11). Managed
+             KBs are byte-capped, so the bar shows usage against the binding cap
+             and moves green→yellow→red as it fills. A legacy KB is uncapped, so
+             it shows only what is stored and stays green. Both arrive on the
+             documents-list response (kbUsage), so there is no extra request. -->
+        <div class="mb-3">
+          <div class="mb-1 flex items-center justify-between text-xs/5 text-gray-600 dark:text-gray-400">
+            <span>{{ kbUsageLabel() }}</span>
+            @if (kbHasCap()) {
+              <span class="tabular-nums">{{ kbUsagePercentLabel() }}</span>
+            }
+          </div>
+          <div
+            class="h-1.5 w-full overflow-hidden rounded-full bg-gray-200 dark:bg-gray-700"
+            role="progressbar"
+            [attr.aria-valuenow]="kbHasCap() ? kbUsedBytes() : null"
+            [attr.aria-valuemin]="0"
+            [attr.aria-valuemax]="kbUsage()?.cap ?? null"
+            [attr.aria-label]="kbUsageLabel()"
+          >
+            <div
+              class="h-full rounded-full transition-all"
+              [class.bg-state-success-500]="kbUsageLevel() === 'green'"
+              [class.bg-state-warning-500]="kbUsageLevel() === 'yellow'"
+              [class.bg-state-danger-500]="kbUsageLevel() === 'red'"
+              [style.width]="kbUsageBarWidth()"
+            ></div>
+          </div>
+        </div>
+      }
       <ul class="divide-y divide-gray-200 overflow-hidden rounded-2xl border border-gray-200 bg-white dark:divide-gray-700 dark:border-gray-700 dark:bg-gray-800">
         @for (doc of uploadedDocuments(); track doc.documentId) {
           <li class="flex items-start gap-3 px-3 py-2.5 sm:px-4">
diff --git a/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.spec.ts b/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.spec.ts
index ba5d6abaf..0dcc6a05d 100644
--- a/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.spec.ts
+++ b/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.spec.ts
@@ -5,7 +5,7 @@ import { provideHttpClient } from '@angular/common/http';
 import { provideHttpClientTesting } from '@angular/common/http/testing';
 import { KnowledgeBaseSectionComponent } from './knowledge-base-section.component';
 import { KbUpgradeService, UpgradeStatus, DocumentNotCarried } from './kb-upgrade.service';
-import { Document, PROCESSING_STATUSES } from '../assistants/models/document.model';
+import { Document, KbUsage, PROCESSING_STATUSES } from '../assistants/models/document.model';
 import { ConfigService } from '../services/config.service';
 import { ToastService } from '../services/toast/toast.service';
 import { DocumentService } from '../assistants/services/document.service';
@@ -615,4 +615,99 @@ describe('KnowledgeBaseSectionComponent — upgrade card', () => {
       });
     });
   });
+
+  describe('storage usage bar (Requirement 12.11)', () => {
+    function usage(overrides: Partial<KbUsage> = {}): KbUsage {
+      return {
+        engine: 'managed',
+        storedBytes: 0,
+        reservedBytes: 0,
+        cap: 100 * 1024 * 1024,
+        elevated: false,
+        ...overrides,
+      };
+    }
+
+    function doc(): Document {
+      return {
+        documentId: 'doc-1',
+        assistantId: 'ast-1',
+        filename: 'notes.pdf',
+        contentType: 'application/pdf',
+        sizeBytes: 1234,
+        status: 'complete',
+        createdAt: '2026-09-01T00:00:00Z',
+        updatedAt: '2026-09-01T00:00:00Z',
+      } as Document;
+    }
+
+    it('is green well under the cap and shows "of the cap" copy', () => {
+      const c = fixture.componentInstance;
+      c.kbUsage.set(usage({ storedBytes: 10 * 1024 * 1024 })); // 10%
+      expect(c.kbHasCap()).toBe(true);
+      expect(c.kbUsageLevel()).toBe('green');
+      expect(c.kbUsageLabel()).toContain('of');
+      expect(c.kbUsagePercentLabel()).toBe('10%');
+    });
+
+    it('turns yellow at 75% of the cap', () => {
+      const c = fixture.componentInstance;
+      c.kbUsage.set(usage({ storedBytes: 80 * 1024 * 1024 })); // 80%
+      expect(c.kbUsageLevel()).toBe('yellow');
+    });
+
+    it('turns red at 90% of the cap', () => {
+      const c = fixture.componentInstance;
+      c.kbUsage.set(usage({ storedBytes: 95 * 1024 * 1024 })); // 95%
+      expect(c.kbUsageLevel()).toBe('red');
+    });
+
+    it('counts in-flight reserved bytes toward usage', () => {
+      const c = fixture.componentInstance;
+      // 70 MB stored + 20 MB reserved = 90 MB of 100 MB → red.
+      c.kbUsage.set(usage({ storedBytes: 70 * 1024 * 1024, reservedBytes: 20 * 1024 * 1024 }));
+      expect(c.kbUsedBytes()).toBe(90 * 1024 * 1024);
+      expect(c.kbUsageLevel()).toBe('red');
+    });
+
+    it('is uncapped and always green for a legacy knowledge base', () => {
+      const c = fixture.componentInstance;
+      c.kbUsage.set(usage({ engine: 's3vectors', cap: null, storedBytes: 42 * 1024 * 1024 }));
+      expect(c.kbHasCap()).toBe(false);
+      expect(c.kbUsageLevel()).toBe('green');
+      expect(c.kbUsageLabel()).toContain('stored');
+      expect(c.kbUsageLabel()).not.toContain('of');
+      expect(c.kbUsagePercentLabel()).toBe('');
+    });
+
+    it('renders the bar alongside the documents list for a managed KB', async () => {
+      await render(status({ phase: 'succeeded', engine: 'managed' }));
+      fixture.componentInstance.uploadedDocuments.set([doc()]);
+      fixture.componentInstance.kbUsage.set(usage({ storedBytes: 50 * 1024 * 1024 }));
+      fixture.detectChanges();
+      expect(fixture.componentInstance.showUsageBar()).toBe(true);
+      expect(fixture.nativeElement.querySelector('[role="progressbar"]')).not.toBeNull();
+      expect(text()).toContain('used');
+    });
+
+    it('hides the bar for a legacy KB, whose "0 B stored" beside real docs confuses', async () => {
+      // A Classic KB is uncapped and tracks no bytes, so the bar would read
+      // "0 B stored" next to actual documents. Hidden entirely; the per-document
+      // sizes are the only storage signal for legacy.
+      await render(status({ phase: 'none', engine: 'classic' }));
+      fixture.componentInstance.uploadedDocuments.set([doc()]);
+      fixture.componentInstance.kbUsage.set(
+        usage({ engine: 's3vectors', cap: null, storedBytes: 0 }),
+      );
+      fixture.detectChanges();
+      expect(fixture.componentInstance.showUsageBar()).toBe(false);
+      expect(fixture.nativeElement.querySelector('[role="progressbar"]')).toBeNull();
+    });
+
+    it('does not render the bar in create mode, where there is no record', () => {
+      // No entityId set → create mode, so nothing is stored yet.
+      fixture.componentInstance.kbUsage.set(usage());
+      expect(fixture.componentInstance.showUsageBar()).toBe(false);
+    });
+  });
 });
diff --git a/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.ts b/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.ts
index a20e92ca9..0034ba3d2 100644
--- a/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.ts
+++ b/frontend/ai.client/src/app/knowledge-base/knowledge-base-section.component.ts
@@ -29,6 +29,7 @@ import { DocumentService, DocumentUploadError } from '../assistants/services/doc
 import {
   Document,
   DocumentStatus,
+  KbUsage,
   PROCESSING_STATUSES,
   STALE_DOCUMENT_THRESHOLD_MS,
 } from '../assistants/models/document.model';
@@ -249,6 +250,84 @@ export class KnowledgeBaseSectionComponent implements OnDestroy {
     () => this.mode() === 'edit' && this.uploadedDocuments().length > 0,
   );
 
+  // ── KB storage usage bar (byte-cap visibility, Requirement 12.11) ────────
+  //
+  // Managed knowledge bases are byte-capped, so the fleet's managed-storage
+  // cost stays bounded — but a cap the user cannot see is a cap they cannot act
+  // on. The usage bar makes their consumption visible against the binding cap
+  // and turns green→yellow→red as it fills. A legacy KB is uncapped: it shows
+  // only what is stored and stays green. Both come back on the documents list
+  // (`kbUsage`), so there is no extra round-trip.
+
+  /** Storage usage for this KB, from the documents-list response. `null` until read. */
+  readonly kbUsage = signal<KbUsage | null>(null);
+
+  /** Committed + in-flight reserved bytes — what the owner is actually consuming. */
+  readonly kbUsedBytes = computed(() => {
+    const usage = this.kbUsage();
+    if (!usage) return 0;
+    return (usage.storedBytes ?? 0) + (usage.reservedBytes ?? 0);
+  });
+
+  /** Managed KBs carry a cap; a legacy KB returns `cap: null` (uncapped). */
+  readonly kbHasCap = computed(() => (this.kbUsage()?.cap ?? null) !== null);
+
+  /** Show the bar only for an existing record whose usage we have resolved. */
+  // The bar visualises stored bytes against a cap — both of which exist only for
+  // a managed KB (byte tracking is scoped to managed by Requirement 12.11). A
+  // legacy/Classic KB is uncapped and reports zeroed counters, so the bar would
+  // read "0 B stored" beside real documents, which reads as a bug to the user.
+  // Show it only for the managed engine; the per-document sizes carry the rest.
+  readonly showUsageBar = computed(
+    () => this.mode() === 'edit' && this.kbUsage()?.engine === 'managed',
+  );
+
+  /** Fraction of the cap used, clamped 0–1. 0 for an uncapped KB (no denominator). */
+  readonly kbUsageFraction = computed(() => {
+    const usage = this.kbUsage();
+    if (!usage || usage.cap == null || usage.cap <= 0) return 0;
+    return Math.min(this.kbUsedBytes() / usage.cap, 1);
+  });
+
+  /** Percent label ("83%"), shown only when there is a cap. */
+  readonly kbUsagePercentLabel = computed(() =>
+    this.kbHasCap() ? `${Math.round(this.kbUsageFraction() * 100)}%` : '',
+  );
+
+  /**
+   * Bar colour: green under 75%, yellow 75–<90%, red at 90%+ of the cap. An
+   * uncapped legacy KB has no meaningful ratio, so it is always green.
+   */
+  readonly kbUsageLevel = computed<'green' | 'yellow' | 'red'>(() => {
+    if (!this.kbHasCap()) return 'green';
+    const fraction = this.kbUsageFraction();
+    if (fraction >= 0.9) return 'red';
+    if (fraction >= 0.75) return 'yellow';
+    return 'green';
+  });
+
+  /**
+   * Bar fill width. Capped KBs fill to the used fraction (with a 2% floor so a
+   * tiny non-zero usage is still visible). An uncapped legacy KB has no
+   * denominator, so it renders a small fixed sliver rather than a misleading
+   * full or empty bar.
+   */
+  readonly kbUsageBarWidth = computed(() => {
+    if (!this.kbHasCap()) return '8%';
+    const used = this.kbUsedBytes();
+    if (used <= 0) return '0%';
+    return `${Math.max(this.kbUsageFraction() * 100, 2)}%`;
+  });
+
+  /** Caption under the bar: "12 MB of 100 MB used", or uncapped "12 MB stored". */
+  readonly kbUsageLabel = computed(() => {
+    const usage = this.kbUsage();
+    if (!usage) return '';
+    const used = this.formatBytes(this.kbUsedBytes());
+    if (usage.cap == null) return `${used} stored`;
+    return `${used} of ${this.formatBytes(usage.cap)} used`;
+  });
+
   /**
    * The user-facing label for a document's processing status, in the vocabulary
    * of the knowledge base's engine (task 16.4, HANDOFF §6).
@@ -933,6 +1012,7 @@ export class KnowledgeBaseSectionComponent implements OnDestroy {
     }
     try {
       const response = await this.documentService.listDocuments(recordId);
+      this.kbUsage.set(response.kbUsage ?? null);
       const existing = new Set(this.uploadedDocuments().map((doc) => doc.documentId));
       const newDocs = response.documents.filter((doc) => !existing.has(doc.documentId));
       if (newDocs.length === 0) {
@@ -1044,6 +1124,7 @@ export class KnowledgeBaseSectionComponent implements OnDestroy {
     try {
       const response = await this.documentService.listDocuments(recordId);
       this.uploadedDocuments.set(response.documents);
+      this.kbUsage.set(response.kbUsage ?? null);
 
       // Start polling for any documents that are still processing (and not stale)
       for (const doc of response.documents) {
@@ -1476,20 +1557,36 @@ export class KnowledgeBaseSectionComponent implements OnDestroy {
     this.pollingDocuments.update((set) => new Set(set).add(documentId));
 
     try {
-      await this.documentService.pollDocumentStatus(recordId, documentId, (document) => {
-        // Update the document in the list
-        this.uploadedDocuments.update((docs) =>
-          docs.map((doc) => (doc.documentId === documentId ? document : doc)),
-        );
-      });
+      await this.documentService.pollDocumentStatus(
+        recordId,
+        documentId,
+        (document) => {
+          // Update the document in the list
+          this.uploadedDocuments.update((docs) =>
+            docs.map((doc) => (doc.documentId === documentId ? document : doc)),
+          );
+        },
+        undefined,
+        undefined,
+        undefined,
+        // Deleting a row already drops it from this set, so this turns that into
+        // real cancellation instead of a display-only flag. Before it, deleting a
+        // document mid-upload left the loop asking about a row that no longer
+        // existed until its 404 tolerance ran out — five "Not found" dialogs.
+        () => !this.pollingDocuments().has(documentId),
+      );
 
       // Polling completed - reload full list to ensure consistency
       await this.loadDocuments();
     } catch (error) {
       // Handle document/record deletion gracefully
-      if (error instanceof DocumentUploadError && error.code === 'DOCUMENT_NOT_FOUND') {
-        console.warn('Document or record was deleted during polling:', documentId);
-        // Remove the document from the local list immediately
+      if (
+        error instanceof DocumentUploadError &&
+        (error.code === 'DOCUMENT_NOT_FOUND' || error.code === 'POLL_CANCELLED')
+      ) {
+        // Cancelled or gone. Both are ordinary outcomes, not faults: the row has
+        // already been removed from the list by whoever cancelled it, and a reload
+        // here would race the optimistic delete and flash the row back.
         this.uploadedDocuments.update((docs) =>
           docs.filter((doc) => doc.documentId !== documentId),
         );
diff --git a/frontend/ai.client/src/app/services/user-question/user-question.service.spec.ts b/frontend/ai.client/src/app/services/user-question/user-question.service.spec.ts
new file mode 100644
index 000000000..30756556c
--- /dev/null
+++ b/frontend/ai.client/src/app/services/user-question/user-question.service.spec.ts
@@ -0,0 +1,166 @@
+import { TestBed } from '@angular/core/testing';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  UserQuestionResponse,
+  UserQuestionService,
+} from './user-question.service';
+import type { UserQuestion } from '../../shared/utils/stream-parser/stream-parser-types';
+
+/**
+ * The service owns one fact: a prompt is surfaced once, resolved once, and the
+ * resolution reaches the chat layer. The subtlety is that its queue is global
+ * while prompts belong to a session — the message list filters on that, and
+ * this suite pins the `sessionId` the filter depends on being carried.
+ */
+const QUESTIONS: UserQuestion[] = [
+  {
+    header: 'Scope',
+    question: 'How much should this cover?',
+    multiSelect: false,
+    options: [{ label: 'Just the API' }, { label: 'Everything' }],
+  },
+];
+
+function request(overrides: Partial<Parameters<UserQuestionService['requestAnswers']>[0]> = {}) {
+  return {
+    interruptId: 'v1:tool_call:tu-1:abc',
+    toolUseId: 'tu-1',
+    questions: QUESTIONS,
+    sessionId: 's1',
+    ...overrides,
+  };
+}
+
+describe('UserQuestionService', () => {
+  let service: UserQuestionService;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({ providers: [UserQuestionService] });
+    service = TestBed.inject(UserQuestionService);
+  });
+
+  describe('surfacing', () => {
+    it('exposes a registered prompt as pending', () => {
+      service.requestAnswers(request());
+
+      expect(service.hasPending()).toBe(true);
+      const [pending] = service.pending();
+      expect(pending.interruptId).toBe('v1:tool_call:tu-1:abc');
+      expect(pending.questions).toEqual(QUESTIONS);
+      // The message list filters the global queue on this; without it a
+      // prompt would render in whichever pane happened to be mounted.
+      expect(pending.sessionId).toBe('s1');
+    });
+
+    it('is idempotent for the same interrupt id', () => {
+      service.requestAnswers(request());
+      service.requestAnswers(request());
+
+      expect(service.pending()).toHaveLength(1);
+    });
+
+    it('does not resurrect a resolved prompt on stream replay', async () => {
+      service.setResumeHandler(vi.fn());
+      service.requestAnswers(request());
+      await service.resolve('v1:tool_call:tu-1:abc', { answers: {} });
+
+      service.requestAnswers(request());
+
+      expect(service.hasPending()).toBe(false);
+    });
+
+    it('surfaces a genuine second round (fresh interrupt id)', () => {
+      service.requestAnswers(request());
+      service.requestAnswers(
+        request({ interruptId: 'v1:tool_call:tu-2:def', toolUseId: 'tu-2' }),
+      );
+
+      expect(service.pending()).toHaveLength(2);
+    });
+
+    it('ignores a prompt with no questions', () => {
+      service.requestAnswers(request({ questions: [] }));
+
+      expect(service.hasPending()).toBe(false);
+    });
+
+    it('orders prompts by arrival', () => {
+      service.requestAnswers(request({ interruptId: 'a' }));
+      service.requestAnswers(request({ interruptId: 'b' }));
+
+      expect(service.pending().map((r) => r.interruptId)).toEqual(['a', 'b']);
+    });
+  });
+
+  describe('resolution', () => {
+    it('forwards answers to the resume handler with the session', async () => {
+      const handler = vi.fn();
+      service.setResumeHandler(handler);
+      service.requestAnswers(request());
+
+      const response: UserQuestionResponse = {
+        answers: { Scope: { selected: ['Everything'] } },
+      };
+      await service.resolve('v1:tool_call:tu-1:abc', response);
+
+      expect(handler).toHaveBeenCalledWith('v1:tool_call:tu-1:abc', response, {
+        sessionId: 's1',
+      });
+      expect(service.hasPending()).toBe(false);
+    });
+
+    it('skip posts an object, never null', async () => {
+      const handler = vi.fn();
+      service.setResumeHandler(handler);
+      service.requestAnswers(request());
+
+      await service.skip('v1:tool_call:tu-1:abc');
+
+      // The backend's ToolContext.interrupt only treats a non-null response
+      // as an answer — a null would re-raise the same interrupt forever and
+      // strand the user in a paused turn.
+      const [, response] = handler.mock.calls[0];
+      expect(response).toEqual({ skipped: true });
+      expect(response).not.toBeNull();
+    });
+
+    it('a second resolve is a no-op', async () => {
+      const handler = vi.fn();
+      service.setResumeHandler(handler);
+      service.requestAnswers(request());
+
+      await service.resolve('v1:tool_call:tu-1:abc', { skipped: true });
+      await service.resolve('v1:tool_call:tu-1:abc', { skipped: true });
+
+      expect(handler).toHaveBeenCalledTimes(1);
+    });
+
+    it('drops the prompt even when no handler is registered', async () => {
+      service.requestAnswers(request());
+
+      await service.resolve('v1:tool_call:tu-1:abc', { skipped: true });
+
+      expect(service.hasPending()).toBe(false);
+    });
+
+    it('a throwing handler does not resurrect the prompt', async () => {
+      service.setResumeHandler(vi.fn().mockRejectedValue(new Error('network')));
+      service.requestAnswers(request());
+
+      await service.resolve('v1:tool_call:tu-1:abc', { skipped: true });
+
+      // The turn may be stuck server-side, but re-rendering a prompt whose
+      // answers were already sent would double-post on the retry.
+      expect(service.hasPending()).toBe(false);
+    });
+
+    it('resolving an unknown id does not call the handler', async () => {
+      const handler = vi.fn();
+      service.setResumeHandler(handler);
+
+      await service.resolve('nope', { skipped: true });
+
+      expect(handler).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/frontend/ai.client/src/app/services/user-question/user-question.service.ts b/frontend/ai.client/src/app/services/user-question/user-question.service.ts
new file mode 100644
index 000000000..f977e15a6
--- /dev/null
+++ b/frontend/ai.client/src/app/services/user-question/user-question.service.ts
@@ -0,0 +1,164 @@
+import { Injectable, computed, signal } from '@angular/core';
+import type {
+  UserQuestion,
+} from '../../shared/utils/stream-parser/stream-parser-types';
+
+/**
+ * A pending set of clarifying questions the agent paused its turn to ask.
+ *
+ * Sibling of `ToolApprovalRequest`, and the flow is identical: the agent's
+ * tool call is paused (Strands interrupt), the chat UI renders an inline
+ * picker, and the user's answers resume the same turn through
+ * {@link UserQuestionResumeHandler}.
+ *
+ * One difference worth knowing: the tool-approval interrupt is raised by a
+ * hook gating someone else's tool, while this one is raised by the
+ * `ask_user_question` tool itself — so `toolUseId` identifies the prompt's own
+ * tool card in the transcript.
+ */
+export interface UserQuestionRequest {
+  interruptId: string;
+  toolUseId: string;
+  questions: UserQuestion[];
+  receivedAt: number;
+  /** Id of the assistant message whose tool call triggered this prompt;
+   *  used by the inline message renderer to anchor the prompt. */
+  messageId?: string;
+  sessionId?: string;
+}
+
+/** One question's answer, keyed back to its question by `header`. */
+export interface UserQuestionAnswer {
+  /** Labels the user picked. Empty when they only typed free text. */
+  selected: string[];
+  /** Free text from the "Other" field. */
+  text?: string;
+}
+
+/**
+ * The payload posted back to resume the turn.
+ *
+ * `{ skipped: true }` is the dismissal form. It is deliberately an object and
+ * never `null`: the backend's `ToolContext.interrupt` only treats a non-null
+ * response as an answer, so posting null would re-raise the same interrupt
+ * forever and strand the user in a paused turn.
+ */
+export type UserQuestionResponse =
+  | { answers: Record<string, UserQuestionAnswer> }
+  | { skipped: true };
+
+/**
+ * Handler the chat layer registers to resume a paused agent turn once the
+ * user has answered. Receives the interrupt id and the response payload; the
+ * handler POSTs to `/invocations` with the matching `interrupt_responses`
+ * entry.
+ */
+export type UserQuestionResumeHandler = (
+  interruptId: string,
+  response: UserQuestionResponse,
+  context?: { sessionId?: string },
+) => void | Promise<void>;
+
+/**
+ * Tracks clarifying-question prompts surfaced by the SSE stream and
+ * coordinates their resolution. The stream parser calls {@link requestAnswers}
+ * when a `user_question_required` event arrives; components render a picker
+ * bound to {@link pending}. Submitting or skipping calls {@link resolve},
+ * which drops the request locally and asks the registered
+ * {@link UserQuestionResumeHandler} to fire the resume request.
+ */
+@Injectable({ providedIn: 'root' })
+export class UserQuestionService {
+  private readonly requests = signal<Map<string, UserQuestionRequest>>(new Map());
+
+  // Interrupt ids already surfaced this session, so a re-emission (stream
+  // replay, network retry) doesn't resurrect a resolved prompt. Every new
+  // tool call carries a fresh interrupt id, so a genuine second round of
+  // questions is not suppressed by this.
+  private readonly seenInterruptIds = new Set<string>();
+
+  private resumeHandler: UserQuestionResumeHandler | null = null;
+
+  readonly pending = computed<UserQuestionRequest[]>(() =>
+    Array.from(this.requests().values()).sort(
+      (a, b) => a.receivedAt - b.receivedAt,
+    ),
+  );
+
+  readonly hasPending = computed<boolean>(() => this.requests().size > 0);
+
+  /**
+   * Register a prompt coming off the SSE stream. Idempotent for the same
+   * interruptId.
+   */
+  requestAnswers(input: {
+    interruptId: string;
+    toolUseId: string;
+    questions: UserQuestion[];
+    messageId?: string;
+    sessionId?: string;
+  }): void {
+    if (this.seenInterruptIds.has(input.interruptId)) {
+      return;
+    }
+    if (!input.questions.length) {
+      return;
+    }
+    this.seenInterruptIds.add(input.interruptId);
+    this.requests.update((map) => {
+      const next = new Map(map);
+      next.set(input.interruptId, { ...input, receivedAt: Date.now() });
+      return next;
+    });
+  }
+
+  /**
+   * Resolve a pending prompt. Drops it locally and forwards the response to
+   * the registered resume handler. No-op if the request is unknown (already
+   * resolved), which makes a double-submit from a double-click harmless.
+   */
+  async resolve(
+    interruptId: string,
+    response: UserQuestionResponse,
+  ): Promise<void> {
+    const request = this.requests().get(interruptId);
+    if (!request) {
+      return;
+    }
+
+    this.requests.update((map) => {
+      const next = new Map(map);
+      next.delete(interruptId);
+      return next;
+    });
+
+    if (!this.resumeHandler) {
+      console.warn(
+        'UserQuestionService: no resume handler registered; answers dropped',
+        { interruptId },
+      );
+      return;
+    }
+
+    try {
+      await this.resumeHandler(interruptId, response, {
+        sessionId: request.sessionId,
+      });
+    } catch (err) {
+      console.error('UserQuestionService: resume handler failed', err);
+    }
+  }
+
+  /** Convenience for the picker's Skip control. */
+  async skip(interruptId: string): Promise<void> {
+    await this.resolve(interruptId, { skipped: true });
+  }
+
+  /**
+   * Register the chat layer's resume callback. Replaces any existing handler;
+   * the chat layer is the single owner.
+   */
+  setResumeHandler(handler: UserQuestionResumeHandler | null): void {
+    this.resumeHandler = handler;
+  }
+}
diff --git a/frontend/ai.client/src/app/session/components/chat-input/chat-input.component.html b/frontend/ai.client/src/app/session/components/chat-input/chat-input.component.html
index a69f695e4..ba8c3c561 100644
--- a/frontend/ai.client/src/app/session/components/chat-input/chat-input.component.html
+++ b/frontend/ai.client/src/app/session/components/chat-input/chat-input.component.html
@@ -336,7 +336,7 @@
               <ng-icon name="heroStopSolid" class="size-5" aria-hidden="true" />
             } @else {
               <!-- Send Icon -->
-              <ng-icon name="heroPaperAirplaneSolid" class="size-5" aria-hidden="true" />
+              <ng-icon name="heroArrowUpSolid" class="size-5" aria-hidden="true" />
             }
           </button>
         </div>
diff --git a/frontend/ai.client/src/app/session/components/chat-input/chat-input.component.ts b/frontend/ai.client/src/app/session/components/chat-input/chat-input.component.ts
index fd82b293f..76126636a 100644
--- a/frontend/ai.client/src/app/session/components/chat-input/chat-input.component.ts
+++ b/frontend/ai.client/src/app/session/components/chat-input/chat-input.component.ts
@@ -22,7 +22,7 @@ import {
   heroMicrophone,
   heroXMark,
 } from '@ng-icons/heroicons/outline';
-import { heroPaperAirplaneSolid, heroStopSolid } from '@ng-icons/heroicons/solid';
+import { heroArrowUpSolid, heroStopSolid } from '@ng-icons/heroicons/solid';
 import { ModelDropdownComponent } from '../../../components/model-dropdown/model-dropdown.component';
 import { AnnouncementBannerComponent } from '../../../components/announcement-banner/announcement-banner.component';
 import { QuotaWarningBannerComponent } from '../../../components/quota-warning-banner/quota-warning-banner.component';
@@ -147,7 +147,7 @@ interface MentionToken {
       heroMicrophone,
       heroXMark,
       heroStopSolid,
-      heroPaperAirplaneSolid
+      heroArrowUpSolid
     })
   ],
   templateUrl: './chat-input.component.html',
diff --git a/frontend/ai.client/src/app/session/components/message-list/components/inline-visual/renderers/file-download-renderer.component.spec.ts b/frontend/ai.client/src/app/session/components/message-list/components/inline-visual/renderers/file-download-renderer.component.spec.ts
new file mode 100644
index 000000000..89191abb4
--- /dev/null
+++ b/frontend/ai.client/src/app/session/components/message-list/components/inline-visual/renderers/file-download-renderer.component.spec.ts
@@ -0,0 +1,56 @@
+import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { describe, it, expect, beforeEach } from 'vitest';
+import { ConfigService } from '../../../../../../services/config.service';
+import { FileDownloadRendererComponent } from './file-download-renderer.component';
+
+describe('FileDownloadRendererComponent', () => {
+  let fixture: ComponentFixture<FileDownloadRendererComponent>;
+
+  beforeEach(async () => {
+    await TestBed.configureTestingModule({
+      imports: [FileDownloadRendererComponent],
+    }).compileComponents();
+
+    TestBed.inject(ConfigService).appApiUrl.set('/api');
+    fixture = TestBed.createComponent(FileDownloadRendererComponent);
+  });
+
+  function render(payload: unknown): HTMLAnchorElement | null {
+    fixture.componentRef.setInput('payload', payload);
+    fixture.detectChanges();
+    return fixture.nativeElement.querySelector('a');
+  }
+
+  it('links an upload_id payload at the durable download route', () => {
+    const anchor = render({
+      filename: 'plan.docx',
+      upload_id: '1a098460e41_ba6e8f342f1744e2',
+      size_kb: '51.0 KB',
+    });
+
+    expect(anchor?.getAttribute('href')).toBe(
+      '/api/files/1a098460e41_ba6e8f342f1744e2/download',
+    );
+    expect(fixture.nativeElement.textContent).toContain('plan.docx');
+    expect(fixture.nativeElement.textContent).toContain('51.0 KB');
+  });
+
+  it('routes a legacy presigned download_url through the same durable route', () => {
+    // Cards persisted before the backend stopped emitting signed URLs carry a
+    // download_url whose signature expired an hour after it was written.
+    const anchor = render({
+      filename: 'plan.docx',
+      download_url:
+        'https://bucket.s3.us-west-2.amazonaws.com/user-files/u1/s1/up9/plan.docx' +
+        '?X-Amz-Signature=deadbeef',
+    });
+
+    expect(anchor?.getAttribute('href')).toBe('/api/files/up9/download');
+  });
+
+  it('renders nothing when neither an upload id nor a usable URL is present', () => {
+    expect(render({ filename: 'plan.docx' })).toBeNull();
+    expect(render({ upload_id: 'up1' })).toBeNull();
+    expect(render(null)).toBeNull();
+  });
+});
diff --git a/frontend/ai.client/src/app/session/components/message-list/components/inline-visual/renderers/file-download-renderer.component.ts b/frontend/ai.client/src/app/session/components/message-list/components/inline-visual/renderers/file-download-renderer.component.ts
index 5b135ea58..0c0132ee3 100644
--- a/frontend/ai.client/src/app/session/components/message-list/components/inline-visual/renderers/file-download-renderer.component.ts
+++ b/frontend/ai.client/src/app/session/components/message-list/components/inline-visual/renderers/file-download-renderer.component.ts
@@ -1,15 +1,26 @@
-import { ChangeDetectionStrategy, Component, computed, input } from '@angular/core';
+import { ChangeDetectionStrategy, Component, computed, inject, input } from '@angular/core';
+import { ConfigService } from '../../../../../../services/config.service';
+import {
+  downloadUrlFor,
+  durableDownloadUrlFromHref,
+} from '../../../../../../shared/utils/file-download-url';
 
 /**
  * Payload for the file_download inline visual, produced by the office document
- * tools (create_word_document, create_excel_spreadsheet, ...). download_url is
- * a short-lived presigned S3 GET URL whose response forces
- * Content-Disposition: attachment, so a plain click downloads the file (no new
- * tab / navigation needed).
+ * tools (create_word_document, create_excel_spreadsheet, ...) and by
+ * workspace_write.
+ *
+ * `upload_id` is the current contract; the card resolves it to the durable
+ * `/files/{uploadId}/download` route, which mints a presigned URL per click.
+ * `download_url` is the legacy field — a presigned S3 URL that expired an hour
+ * after the message was written — and is kept only so cards already persisted
+ * in old conversations still work: the upload id is recovered from the S3 key
+ * and routed the same way.
  */
 interface FileDownloadPayload {
   filename: string;
-  download_url: string;
+  upload_id?: string;
+  download_url?: string;
   size_kb?: string;
 }
 
@@ -111,7 +122,7 @@ function styleForFilename(filename: string): FileKindStyle {
                  text-sm/5 font-semibold text-white! no-underline! transition-colors
                  hover:brightness-95
                  focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary-500"
-          [href]="f.download_url"
+          [href]="f.href"
           [attr.download]="f.filename"
           rel="noopener noreferrer"
         >
@@ -133,15 +144,26 @@ export class FileDownloadRendererComponent {
   /** The payload data from the backend tool result. */
   payload = input.required<unknown>();
 
+  private readonly config = inject(ConfigService);
+
   /** Narrowed, validated payload with resolved icon styling (null when malformed). */
-  file = computed<(FileDownloadPayload & FileKindStyle) | null>(() => {
+  file = computed<(FileDownloadPayload & FileKindStyle & { href: string }) | null>(() => {
     const raw = this.payload();
     if (!raw || typeof raw !== 'object') return null;
     const p = raw as Partial<FileDownloadPayload>;
-    if (!p.filename || !p.download_url) return null;
+    if (!p.filename) return null;
+
+    const appApiUrl = this.config.appApiUrl();
+    const href = p.upload_id
+      ? downloadUrlFor(appApiUrl, p.upload_id)
+      : p.download_url
+        ? durableDownloadUrlFromHref(appApiUrl, p.download_url)
+        : null;
+    if (!href) return null;
+
     return {
       filename: p.filename,
-      download_url: p.download_url,
+      href,
       size_kb: p.size_kb,
       ...styleForFilename(p.filename),
     };
diff --git a/frontend/ai.client/src/app/session/components/message-list/components/user-question-prompt/user-question-prompt.component.ts b/frontend/ai.client/src/app/session/components/message-list/components/user-question-prompt/user-question-prompt.component.ts
new file mode 100644
index 000000000..f680f58f3
--- /dev/null
+++ b/frontend/ai.client/src/app/session/components/message-list/components/user-question-prompt/user-question-prompt.component.ts
@@ -0,0 +1,652 @@
+import {
+  ChangeDetectionStrategy,
+  Component,
+  computed,
+  inject,
+  input,
+  signal,
+} from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { NgIcon, provideIcons } from '@ng-icons/core';
+import {
+  heroArrowRight,
+  heroCheck,
+  heroChevronLeft,
+  heroChevronRight,
+  heroPencil,
+} from '@ng-icons/heroicons/outline';
+import {
+  UserQuestionAnswer,
+  UserQuestionRequest,
+  UserQuestionService,
+} from '../../../../../services/user-question/user-question.service';
+import { SpinnerComponent } from '../../../../../components/spinner/spinner.component';
+
+/**
+ * Inline picker for the clarifying questions the agent paused its turn to ask.
+ *
+ * **Full width, soft, and unhurried** — deliberately NOT the visual language of
+ * `ToolApprovalPromptComponent`, which it was first modelled on. That component
+ * is a narrow pill with a hard 2px accent bar and hairline dividers, and it is
+ * right for what it does: a two-button yes/no that should stay out of the way.
+ * This one is a form the reader has to think about, so it takes the assistant
+ * column's full width and trades the boxy chrome for rounded surfaces, roomy
+ * hit areas and a calm ground. No border on the card at all — a soft ring and
+ * a faint tint carry the edge instead.
+ *
+ * **One question at a time, with a pager.** Measured against real models, both
+ * Haiku 4.5 and Sonnet 4.6 routinely ask three or four questions in a single
+ * call, so rendering them stacked would drop a wall of radio groups into the
+ * transcript.
+ *
+ * **The picker owns "Other" and "Skip".** The backend strips any model-supplied
+ * lookalike (a supplied "Other" carries no free-text field, so selecting it
+ * would record a bare string that teaches the model nothing), which is why they
+ * are added here rather than rendered from `options`.
+ *
+ * Two house traps this component has already been bitten by — don't reintroduce
+ * either when editing:
+ * - Dark rules use `:host-context(.dark)`. Angular's emulated encapsulation
+ *   stamps `[_ngcontent-…]` inside `:where()`, so `:where(.dark, .dark *)`
+ *   compiles to `.dark[_ngcontent-…]` and silently never matches.
+ * - Utility classes set directly on an `<ng-icon>` element do not apply. Put
+ *   colour on the wrapper and let the icon inherit `currentColor`.
+ */
+@Component({
+  selector: 'app-user-question-prompt',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [NgIcon, FormsModule, SpinnerComponent],
+  providers: [
+    provideIcons({
+      heroArrowRight,
+      heroCheck,
+      heroChevronLeft,
+      heroChevronRight,
+      heroPencil,
+    }),
+  ],
+  host: { class: 'block' },
+  template: `
+    <section
+      class="question-card w-full rounded-2xl bg-gray-50/80 p-5 ring-1 ring-gray-200/70 dark:bg-white/[0.035] dark:ring-white/10"
+      [attr.aria-label]="'Clarifying question ' + (index() + 1) + ' of ' + total()"
+    >
+      <!-- Heading: eyebrow + question. The pager sits with the eyebrow so the
+           question line is never crowded by controls. -->
+      <header class="mb-4 flex items-start justify-between gap-4">
+        <div class="min-w-0">
+          <p class="eyebrow">{{ current().header }}</p>
+          <h3 class="mt-2 text-sm/6 font-medium text-balance text-gray-900 dark:text-gray-50">
+            {{ current().question }}
+          </h3>
+        </div>
+
+        @if (total() > 1) {
+          <div class="flex shrink-0 items-center gap-1 pt-0.5">
+            <button
+              type="button"
+              class="pager-btn"
+              (click)="back()"
+              [disabled]="index() === 0 || resolving()"
+              aria-label="Previous question"
+            >
+              <ng-icon name="heroChevronLeft" />
+            </button>
+            <span class="pager-count" aria-live="polite">
+              {{ index() + 1 }} / {{ total() }}
+            </span>
+            <button
+              type="button"
+              class="pager-btn"
+              (click)="next()"
+              [disabled]="index() === total() - 1 || resolving()"
+              aria-label="Next question"
+            >
+              <ng-icon name="heroChevronRight" />
+            </button>
+          </div>
+        }
+      </header>
+
+      <!-- Options: discrete rounded rows with air between them, rather than a
+           divided list. Selection reads from the tinted surface and the filled
+           marker together, never from colour alone. -->
+      <div
+        class="grid gap-2"
+        [attr.role]="current().multiSelect ? 'group' : 'radiogroup'"
+        [attr.aria-label]="current().question"
+      >
+        @for (option of current().options; track option.label) {
+          <button
+            type="button"
+            class="option"
+            [class.option--on]="isSelected(option.label)"
+            [attr.role]="current().multiSelect ? 'checkbox' : 'radio'"
+            [attr.aria-checked]="isSelected(option.label)"
+            [disabled]="resolving()"
+            (click)="toggle(option.label)"
+          >
+            <span
+              class="marker"
+              [class.marker--multi]="current().multiSelect"
+              [class.marker--on]="isSelected(option.label)"
+              aria-hidden="true"
+            >
+              <ng-icon name="heroCheck" />
+            </span>
+            <span class="min-w-0 flex-1">
+              <span class="block text-sm/6 font-medium text-gray-900 dark:text-gray-50">
+                {{ option.label }}
+              </span>
+              @if (option.description) {
+                <span class="mt-0.5 block text-xs/5 text-gray-600 dark:text-gray-300">
+                  {{ option.description }}
+                </span>
+              }
+            </span>
+          </button>
+        }
+
+        <!-- "Other": always offered, never supplied by the model. Shares the
+             option row's shape so it reads as one more choice. -->
+        <label class="option option--other">
+          <span class="marker marker--quiet" aria-hidden="true">
+            <ng-icon name="heroPencil" />
+          </span>
+          <input
+            type="text"
+            class="other-input"
+            placeholder="Something else…"
+            [ngModel]="otherText()"
+            (ngModelChange)="setOther($event)"
+            [disabled]="resolving()"
+            [attr.aria-label]="'Other answer for ' + current().header"
+            (keydown.enter)="submitIfReady()"
+          />
+        </label>
+      </div>
+
+      <!-- Footer -->
+      <footer class="mt-4 flex items-center justify-between gap-3">
+        <button type="button" class="ghost-btn" (click)="skip()" [disabled]="resolving()">
+          Skip
+        </button>
+
+        <div class="flex items-center gap-3">
+          @if (answeredCount() > 0 && total() > 1) {
+            <span class="text-xs tabular-nums text-gray-600 dark:text-gray-300">
+              {{ answeredCount() }} of {{ total() }} answered
+            </span>
+          }
+          @if (index() < total() - 1) {
+            <button type="button" class="primary-btn" (click)="next()" [disabled]="resolving()">
+              <span>Next</span>
+              <ng-icon name="heroArrowRight" />
+            </button>
+          } @else {
+            <button
+              type="button"
+              class="primary-btn"
+              (click)="submit()"
+              [disabled]="resolving() || answeredCount() === 0"
+            >
+              @if (resolving()) {
+                <app-spinner size="sm" variant="on-solid" label="Working" />
+                <span>Working…</span>
+              } @else {
+                <span>Submit</span>
+              }
+            </button>
+          }
+        </div>
+      </footer>
+    </section>
+  `,
+  styles: `
+    @reference "../../../../../../styles/theme.css";
+
+    :host {
+      display: block;
+    }
+
+    .question-card {
+      animation: card-rise 0.36s cubic-bezier(0.16, 1, 0.3, 1);
+    }
+
+    /* The global \`.message-block p\` rule adds 16px below prose paragraphs;
+       inside the card the eyebrow is a label, not a paragraph. */
+    .question-card p {
+      margin-bottom: 0;
+    }
+
+    /* Deliberately unadorned. An icon here would be pure decoration — the
+       card already announces itself by shape and position, and a little
+       glyph on an AI prompt is the first thing that makes it look generated. */
+    .eyebrow {
+      font-size: 0.6875rem;
+      font-weight: 600;
+      letter-spacing: 0.06em;
+      text-transform: uppercase;
+      color: var(--color-primary-accessible);
+    }
+
+    :host-context(.dark) .eyebrow {
+      color: var(--color-primary-50);
+    }
+
+    /* ---- options ---- */
+
+    .option {
+      display: flex;
+      align-items: flex-start;
+      gap: 0.75rem;
+      width: 100%;
+      padding: 0.75rem 0.875rem;
+      border-radius: 0.875rem;
+      text-align: left;
+      background: var(--color-white);
+      box-shadow: inset 0 0 0 1px var(--color-gray-200);
+      transition:
+        background-color 140ms ease,
+        box-shadow 140ms ease;
+    }
+
+    .option:hover:not(:disabled):not(.option--on) {
+      background: var(--color-gray-50);
+      box-shadow: inset 0 0 0 1px var(--color-gray-300);
+    }
+
+    .option:focus-visible {
+      outline: 2px solid var(--color-secondary-500);
+      outline-offset: 2px;
+    }
+
+    /* Only the "Other" row needs this: it is a <label>, so the thing that
+       actually takes focus is the input inside it. Applying it to every
+       option also matched a plain MOUSE click on a button (:focus-within is
+       true after one), stacking an outline outside the row. */
+    .option--other:focus-within {
+      outline: 2px solid var(--color-secondary-500);
+      outline-offset: 2px;
+    }
+
+    .option:disabled {
+      opacity: 0.55;
+      cursor: default;
+    }
+
+    /* Selection is a fill change, never an added stroke. Every row carries
+       exactly one hairline whatever its state, so a selected row cannot read
+       as a double stroke — which is what stacking a coloured ring under the
+       focus outline produced. The warm tint and the filled marker carry the
+       state together, so it is never colour alone. */
+    .option--on {
+      background: color-mix(in oklab, var(--color-secondary-500) 10%, var(--color-white));
+      box-shadow: inset 0 0 0 1px
+        color-mix(in oklab, var(--color-secondary-500) 38%, transparent);
+    }
+
+    .option--other {
+      cursor: text;
+    }
+
+    :host-context(.dark) .option {
+      background: rgb(255 255 255 / 0.04);
+      box-shadow: inset 0 0 0 1px rgb(255 255 255 / 0.08);
+    }
+
+    :host-context(.dark) .option:hover:not(:disabled):not(.option--on) {
+      background: rgb(255 255 255 / 0.07);
+      box-shadow: inset 0 0 0 1px rgb(255 255 255 / 0.14);
+    }
+
+    :host-context(.dark) .option--on {
+      background: color-mix(in oklab, var(--color-secondary-500) 20%, transparent);
+      box-shadow: inset 0 0 0 1px
+        color-mix(in oklab, var(--color-secondary-500) 52%, transparent);
+    }
+
+    /* ---- selection marker ---- */
+
+    .marker {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      flex-shrink: 0;
+      width: 1.25rem;
+      height: 1.25rem;
+      margin-top: 0.1875rem;
+      border-radius: 9999px;
+      background: transparent;
+      box-shadow: inset 0 0 0 1.5px var(--color-gray-300);
+      color: transparent;
+      font-size: 0.75rem;
+      transition:
+        background-color 140ms ease,
+        box-shadow 140ms ease,
+        color 140ms ease;
+    }
+
+    /* Multi-select reads as a checkbox, single-select as a radio. */
+    .marker--multi {
+      border-radius: 0.4375rem;
+    }
+
+    .marker--on {
+      background: var(--color-secondary-500);
+      box-shadow: inset 0 0 0 1.5px var(--color-secondary-500);
+      color: white;
+    }
+
+    .marker--quiet {
+      color: var(--color-gray-500);
+      box-shadow: inset 0 0 0 1.5px transparent;
+    }
+
+    :host-context(.dark) .marker {
+      box-shadow: inset 0 0 0 1.5px rgb(255 255 255 / 0.22);
+    }
+
+    :host-context(.dark) .marker--on {
+      background: var(--color-secondary-500);
+      box-shadow: inset 0 0 0 1.5px var(--color-secondary-500);
+      color: white;
+    }
+
+    :host-context(.dark) .marker--quiet {
+      color: var(--color-gray-400);
+      box-shadow: inset 0 0 0 1.5px transparent;
+    }
+
+    /* ---- other ---- */
+
+    .other-input {
+      flex: 1 1 auto;
+      min-width: 0;
+      align-self: center;
+      background: transparent;
+      border: 0;
+      padding: 0;
+      font-size: 0.875rem;
+      line-height: 1.5rem;
+      color: var(--color-gray-900);
+    }
+
+    .other-input::placeholder {
+      color: var(--color-gray-500);
+    }
+
+    .other-input:focus {
+      outline: none;
+    }
+
+    :host-context(.dark) .other-input {
+      color: var(--color-gray-50);
+    }
+
+    :host-context(.dark) .other-input::placeholder {
+      color: var(--color-gray-400);
+    }
+
+    /* ---- pager ---- */
+
+    .pager-btn {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      width: 1.75rem;
+      height: 1.75rem;
+      border-radius: 9999px;
+      font-size: 0.875rem;
+      color: var(--color-gray-600);
+      transition:
+        background-color 140ms ease,
+        color 140ms ease;
+    }
+
+    .pager-btn:hover:not(:disabled) {
+      background: var(--color-gray-200);
+      color: var(--color-gray-900);
+    }
+
+    .pager-btn:disabled {
+      opacity: 0.3;
+      cursor: default;
+    }
+
+    .pager-btn:focus-visible {
+      outline: 2px solid var(--color-secondary-500);
+      outline-offset: 2px;
+    }
+
+    .pager-count {
+      font-size: 0.75rem;
+      font-variant-numeric: tabular-nums;
+      color: var(--color-gray-600);
+    }
+
+    :host-context(.dark) .pager-btn {
+      color: var(--color-gray-300);
+    }
+
+    :host-context(.dark) .pager-btn:hover:not(:disabled) {
+      background: rgb(255 255 255 / 0.1);
+      color: white;
+    }
+
+    :host-context(.dark) .pager-count {
+      color: var(--color-gray-300);
+    }
+
+    /* ---- actions ---- */
+
+    .primary-btn {
+      display: inline-flex;
+      align-items: center;
+      gap: 0.375rem;
+      border-radius: 1rem;
+      padding: 0.5rem 1rem;
+      font-size: 0.8125rem;
+      font-weight: 600;
+      color: white;
+      background: var(--color-secondary-500);
+      transition:
+        background-color 140ms ease,
+        transform 140ms ease;
+    }
+
+    .primary-btn:hover:not(:disabled) {
+      background: var(--color-secondary-600);
+    }
+
+    .primary-btn:active:not(:disabled) {
+      transform: translateY(1px);
+    }
+
+    .primary-btn:focus-visible {
+      outline: 2px solid var(--color-secondary-500);
+      outline-offset: 2px;
+    }
+
+    .primary-btn:disabled {
+      opacity: 0.45;
+      cursor: default;
+    }
+
+    .ghost-btn {
+      border-radius: 1rem;
+      padding: 0.5rem 0.875rem;
+      font-size: 0.8125rem;
+      font-weight: 500;
+      color: var(--color-gray-600);
+      background: transparent;
+      transition:
+        background-color 140ms ease,
+        color 140ms ease;
+    }
+
+    .ghost-btn:hover:not(:disabled) {
+      background: var(--color-gray-200);
+      color: var(--color-gray-900);
+    }
+
+    .ghost-btn:focus-visible {
+      outline: 2px solid var(--color-gray-400);
+      outline-offset: 2px;
+    }
+
+    .ghost-btn:disabled {
+      opacity: 0.5;
+      cursor: default;
+    }
+
+    :host-context(.dark) .ghost-btn {
+      color: var(--color-gray-300);
+    }
+
+    :host-context(.dark) .ghost-btn:hover:not(:disabled) {
+      background: rgb(255 255 255 / 0.1);
+      color: white;
+    }
+
+    @keyframes card-rise {
+      from {
+        opacity: 0;
+        transform: translateY(8px);
+      }
+      to {
+        opacity: 1;
+        transform: translateY(0);
+      }
+    }
+
+    @media (prefers-reduced-motion: reduce) {
+      .question-card {
+        animation: none;
+      }
+      .option,
+      .marker,
+      .primary-btn,
+      .ghost-btn,
+      .pager-btn {
+        transition: none;
+      }
+    }
+  `,
+})
+export class UserQuestionPromptComponent {
+  request = input.required<UserQuestionRequest>();
+
+  private questionService = inject(UserQuestionService);
+
+  protected index = signal(0);
+  protected resolving = signal(false);
+
+  /** Answers accumulated across the pager, keyed by question header. */
+  private readonly answers = signal<Record<string, UserQuestionAnswer>>({});
+
+  protected total = computed<number>(() => this.request().questions.length);
+
+  protected current = computed(() => {
+    const questions = this.request().questions;
+    // Clamp rather than index blindly: `request` is an input and could in
+    // principle be swapped for a shorter set while the pager sits past its end.
+    return questions[Math.min(this.index(), questions.length - 1)];
+  });
+
+  protected answeredCount = computed<number>(
+    () =>
+      Object.values(this.answers()).filter(
+        (a) => a.selected.length > 0 || !!a.text?.trim(),
+      ).length,
+  );
+
+  protected otherText = computed<string>(
+    () => this.answers()[this.current().header]?.text ?? '',
+  );
+
+  protected isSelected(label: string): boolean {
+    return !!this.answers()[this.current().header]?.selected.includes(label);
+  }
+
+  /**
+   * Select an option. Multi-select toggles; single-select replaces, so a
+   * second click on a different option moves the choice rather than adding to
+   * it — and a second click on the SAME option clears it, which is the only
+   * way to undo a misclick on a question the user would rather leave blank.
+   */
+  protected toggle(label: string): void {
+    const header = this.current().header;
+    const multi = this.current().multiSelect;
+    this.answers.update((all) => {
+      const existing = all[header] ?? { selected: [] };
+      const has = existing.selected.includes(label);
+      const selected = multi
+        ? has
+          ? existing.selected.filter((l) => l !== label)
+          : [...existing.selected, label]
+        : has
+          ? []
+          : [label];
+      return { ...all, [header]: { ...existing, selected } };
+    });
+  }
+
+  protected setOther(text: string): void {
+    const header = this.current().header;
+    this.answers.update((all) => {
+      const existing = all[header] ?? { selected: [] };
+      return { ...all, [header]: { ...existing, text } };
+    });
+  }
+
+  protected back(): void {
+    this.index.update((i) => Math.max(0, i - 1));
+  }
+
+  protected next(): void {
+    this.index.update((i) => Math.min(this.total() - 1, i + 1));
+  }
+
+  /** Enter in the "Other" field advances, or submits on the last question. */
+  protected submitIfReady(): void {
+    if (this.index() < this.total() - 1) {
+      this.next();
+      return;
+    }
+    if (this.answeredCount() > 0) {
+      void this.submit();
+    }
+  }
+
+  protected async submit(): Promise<void> {
+    if (this.resolving()) return;
+    this.resolving.set(true);
+    try {
+      // Only answered questions are sent. The backend marks the rest skipped,
+      // which is the honest record: the user chose not to answer them, and
+      // inventing a default here would put words in their mouth.
+      const answers: Record<string, UserQuestionAnswer> = {};
+      for (const [header, answer] of Object.entries(this.answers())) {
+        const text = answer.text?.trim();
+        if (answer.selected.length === 0 && !text) continue;
+        answers[header] = text
+          ? { selected: answer.selected, text }
+          : { selected: answer.selected };
+      }
+      await this.questionService.resolve(this.request().interruptId, { answers });
+    } finally {
+      this.resolving.set(false);
+    }
+  }
+
+  protected async skip(): Promise<void> {
+    if (this.resolving()) return;
+    this.resolving.set(true);
+    try {
+      await this.questionService.skip(this.request().interruptId);
+    } finally {
+      this.resolving.set(false);
+    }
+  }
+}
diff --git a/frontend/ai.client/src/app/session/components/message-list/message-list.component.html b/frontend/ai.client/src/app/session/components/message-list/message-list.component.html
index 0aacaea32..c4426dc55 100644
--- a/frontend/ai.client/src/app/session/components/message-list/message-list.component.html
+++ b/frontend/ai.client/src/app/session/components/message-list/message-list.component.html
@@ -202,6 +202,15 @@
     </div>
   }
 
+  <!-- Clarifying questions the agent paused to ask (ask_user_question).
+       Unlike the approval prompts above this is a form, not a yes/no, so it
+       takes the assistant column's full width rather than sitting in a
+       left-aligned pill. Survives a refresh: the backend's PendingInterrupt
+       breadcrumb is replayed by MessageMapService.hydratePendingInterrupts. -->
+  @for (request of pendingUserQuestions(); track request.interruptId) {
+    <app-user-question-prompt [request]="request" />
+  }
+
   <!-- Loading indicator -->
   @if (isChatLoading()) {
     <div class="py-4">
diff --git a/frontend/ai.client/src/app/session/components/message-list/message-list.component.ts b/frontend/ai.client/src/app/session/components/message-list/message-list.component.ts
index 12e1ac00d..7bb30f35c 100644
--- a/frontend/ai.client/src/app/session/components/message-list/message-list.component.ts
+++ b/frontend/ai.client/src/app/session/components/message-list/message-list.component.ts
@@ -10,6 +10,7 @@ import { CitationDisplayComponent } from '../citation-display/citation-display.c
 import { PulsatingLoaderComponent } from '../../../components/pulsating-loader.component';
 import { OAuthConsentPromptComponent } from './components/oauth-consent-prompt/oauth-consent-prompt.component';
 import { ToolApprovalPromptComponent } from './components/tool-approval-prompt/tool-approval-prompt.component';
+import { UserQuestionPromptComponent } from './components/user-question-prompt/user-question-prompt.component';
 import { CompactionSummaryComponent } from './components/compaction-summary/compaction-summary.component';
 import { ArtifactCardComponent } from './components/artifact/artifact-card.component';
 import { ArtifactPanelComponent } from './components/artifact/artifact-panel.component';
@@ -31,6 +32,10 @@ import {
   ToolApprovalRequest,
   ToolApprovalService,
 } from '../../../services/tool-approval/tool-approval.service';
+import {
+  UserQuestionRequest,
+  UserQuestionService,
+} from '../../../services/user-question/user-question.service';
 import { CompactionSummaryService } from '../../services/chat/compaction-summary.service';
 import { ChatStateService } from '../../services/chat/chat-state.service';
 import { ToolInsightService } from '../../services/chat/tool-insight.service';
@@ -116,6 +121,7 @@ function segmentTurn(messages: readonly Message[]): TurnSegment[] {
     PulsatingLoaderComponent,
     OAuthConsentPromptComponent,
     ToolApprovalPromptComponent,
+    UserQuestionPromptComponent,
     CompactionSummaryComponent,
     ArtifactCardComponent,
     ArtifactPanelComponent,
@@ -192,6 +198,7 @@ export class MessageListComponent {
 
   private consentService = inject(OAuthConsentService);
   private toolApprovalService = inject(ToolApprovalService);
+  private userQuestionService = inject(UserQuestionService);
   private compactionSummary = inject(CompactionSummaryService);
   private artifactState = inject(ArtifactStateService);
   private mcpAppCardState = inject(McpAppCardStateService);
@@ -578,6 +585,17 @@ export class MessageListComponent {
     return this.toolApprovalService.pending().filter((r) => r.sessionId === sessionId);
   });
 
+  /** Clarifying-question prompts for THIS list's session, for the same reason
+   *  the approvals above are filtered: the service queue is global, and the
+   *  agent-designer preview and marketplace review pane stream through the
+   *  same interrupt protocol. Answering one pane's prompt in another pane's
+   *  transcript would resume a turn the reader isn't looking at. */
+  protected pendingUserQuestions = computed<UserQuestionRequest[]>(() => {
+    const sessionId = this.sessionId();
+    if (!sessionId) return [];
+    return this.userQuestionService.pending().filter((r) => r.sessionId === sessionId);
+  });
+
   /** Messages grouped into turns: each user message starts a group and the
    *  assistant messages that follow it belong to that group. Keyed by the
    *  first message's id so a group's identity (and its DOM subtree — which
diff --git a/frontend/ai.client/src/app/session/services/chat/chat-request.service.ts b/frontend/ai.client/src/app/session/services/chat/chat-request.service.ts
index d6d890469..f3e967693 100644
--- a/frontend/ai.client/src/app/session/services/chat/chat-request.service.ts
+++ b/frontend/ai.client/src/app/session/services/chat/chat-request.service.ts
@@ -17,6 +17,10 @@ import {
   ToolApprovalDecision,
   ToolApprovalService,
 } from '../../../services/tool-approval/tool-approval.service';
+import {
+  UserQuestionResponse,
+  UserQuestionService,
+} from '../../../services/user-question/user-question.service';
 import { ErrorService } from '../../../services/error/error.service';
 import { SystemPromptsService } from '../../../services/system-prompts/system-prompts.service';
 import { isPreviewSession } from '../../../shared/constants/session.constants';
@@ -45,6 +49,7 @@ export class ChatRequestService implements OnDestroy {
   private fileUploadService = inject(FileUploadService);
   private oauthConsentService = inject(OAuthConsentService);
   private toolApprovalService = inject(ToolApprovalService);
+  private userQuestionService = inject(UserQuestionService);
   private steering = inject(SteeringService);
   private errorService = inject(ErrorService);
   private systemPromptsService = inject(SystemPromptsService);
@@ -58,11 +63,15 @@ export class ChatRequestService implements OnDestroy {
     this.toolApprovalService.setResumeHandler((interruptId, decision, context) =>
       this.resumeFromToolApproval(interruptId, decision, context?.sessionId),
     );
+    this.userQuestionService.setResumeHandler((interruptId, response, context) =>
+      this.resumeFromUserQuestion(interruptId, response, context?.sessionId),
+    );
   }
 
   ngOnDestroy(): void {
     this.oauthConsentService.setResumeHandler(null);
     this.toolApprovalService.setResumeHandler(null);
+    this.userQuestionService.setResumeHandler(null);
   }
 
   async submitChatRequest(
@@ -533,6 +542,55 @@ export class ChatRequestService implements OnDestroy {
     }
   }
 
+  /**
+   * Resume the paused agent turn after the user answers (or skips) the
+   * clarifying questions.
+   *
+   * Identical in shape to `resumeFromToolApproval`; the only difference is the
+   * response payload, which is a structured object rather than a decision
+   * string. It must never be null — the backend's `ToolContext.interrupt`
+   * only treats a non-null response as an answer, so a null would re-raise the
+   * same interrupt forever. `UserQuestionService` guarantees an object (Skip
+   * sends `{ skipped: true }`).
+   */
+  private async resumeFromUserQuestion(
+    interruptId: string,
+    response: UserQuestionResponse,
+    sessionId?: string,
+  ): Promise<void> {
+    if (!sessionId) {
+      return;
+    }
+
+    this.messageMapService.beginContinuationStreaming(sessionId);
+    this.chatStateService.setChatLoading(sessionId, true);
+
+    const resumeRequest: Record<string, unknown> = {
+      session_id: sessionId,
+      message: '',
+      interrupt_responses: [{ interruptId, response }],
+    };
+
+    this.attachCarriedSteering(resumeRequest, sessionId);
+
+    try {
+      await this.chatHttpService.sendChatRequest(resumeRequest);
+      await this.reconcileAfterResume(sessionId);
+    } catch (error) {
+      this.chatStateService.setChatLoading(sessionId, false);
+      this.messageMapService.endStreaming(sessionId);
+
+      if (this.isExpiredInterruptError(error)) {
+        this.errorService.addError(
+          'Question expired',
+          'The agent paused too long ago to resume this turn automatically. Please send your message again.',
+        );
+        return;
+      }
+      throw error;
+    }
+  }
+
   /**
    * After a resume, re-read the turn from persisted memory so the paused tool
    * card flips from "Running…" to its result — except for a preview session,
diff --git a/frontend/ai.client/src/app/session/services/chat/mention-routing.spec.ts b/frontend/ai.client/src/app/session/services/chat/mention-routing.spec.ts
new file mode 100644
index 000000000..011e4cdab
--- /dev/null
+++ b/frontend/ai.client/src/app/session/services/chat/mention-routing.spec.ts
@@ -0,0 +1,121 @@
+import { describe, expect, it } from 'vitest';
+import { routeMention } from './mention-routing';
+
+/**
+ * The SPA half of the `@`-mention binding rule, and the mirror of the backend's
+ * `binds_conversation`. What these tests protect is a failure that was invisible from both
+ * ends: the mentioned turn ran as the Agent, the next one did not, and the user was left in
+ * a thread that still looked like the Agent's with its tools, skills and model gone.
+ */
+describe('routeMention', () => {
+  const SESSION = 'sess-1';
+
+  it('leaves an ordinary message alone', () => {
+    expect(
+      routeMention({
+        boundAssistantId: undefined,
+        sessionId: SESSION,
+        threadHasMessages: true,
+      }),
+    ).toEqual({ sessionId: SESSION, assistantId: undefined, handedOff: false });
+  });
+
+  it('keeps a bound conversation bound when no one is mentioned', () => {
+    expect(
+      routeMention({
+        boundAssistantId: 'ast-rubric',
+        sessionId: SESSION,
+        threadHasMessages: true,
+      }),
+    ).toEqual({ sessionId: SESSION, assistantId: 'ast-rubric', handedOff: false });
+  });
+
+  describe('mentioning into an empty thread', () => {
+    it('binds the Agent to this conversation — mentioning is launching', () => {
+      expect(
+        routeMention({
+          mentionedAgentId: 'ast-rubric',
+          boundAssistantId: undefined,
+          sessionId: SESSION,
+          threadHasMessages: false,
+        }),
+      ).toEqual({ sessionId: SESSION, assistantId: 'ast-rubric', handedOff: false });
+    });
+
+    it('binds on a conversation that does not exist yet', () => {
+      expect(
+        routeMention({
+          mentionedAgentId: 'ast-rubric',
+          sessionId: null,
+          threadHasMessages: false,
+        }),
+      ).toEqual({ sessionId: null, assistantId: 'ast-rubric', handedOff: false });
+    });
+
+    it('lets the mention win over an Agent the empty thread merely pointed at', () => {
+      // Launched Agent A from its card, then typed `@B` before ever sending. Nothing has
+      // happened yet, so there is no history for B's binding to misrepresent.
+      expect(
+        routeMention({
+          mentionedAgentId: 'ast-b',
+          boundAssistantId: 'ast-a',
+          sessionId: SESSION,
+          threadHasMessages: false,
+        }),
+      ).toEqual({ sessionId: SESSION, assistantId: 'ast-b', handedOff: false });
+    });
+  });
+
+  describe('mentioning into a thread that already has history', () => {
+    it('hands the message to a NEW conversation with that Agent', () => {
+      // The case that produced "Unknown tool: create_rubric". The Agent cannot be bound to
+      // history written under other instructions, and must not be borrowed for one turn,
+      // so it gets a conversation of its own.
+      expect(
+        routeMention({
+          mentionedAgentId: 'ast-rubric',
+          boundAssistantId: undefined,
+          sessionId: SESSION,
+          threadHasMessages: true,
+        }),
+      ).toEqual({ sessionId: null, assistantId: 'ast-rubric', handedOff: true });
+    });
+
+    it('hands off out of a thread bound to a different Agent too', () => {
+      expect(
+        routeMention({
+          mentionedAgentId: 'ast-b',
+          boundAssistantId: 'ast-a',
+          sessionId: SESSION,
+          threadHasMessages: true,
+        }),
+      ).toEqual({ sessionId: null, assistantId: 'ast-b', handedOff: true });
+    });
+
+    it('does NOT hand off when the mention names the Agent already running the thread', () => {
+      // Re-mentioning the bound Agent is emphasis, not a request for a new thread.
+      expect(
+        routeMention({
+          mentionedAgentId: 'ast-rubric',
+          boundAssistantId: 'ast-rubric',
+          sessionId: SESSION,
+          threadHasMessages: true,
+        }),
+      ).toEqual({ sessionId: SESSION, assistantId: 'ast-rubric', handedOff: false });
+    });
+  });
+
+  it('never returns the mentioned Agent without also making it the bound assistant', () => {
+    // The invariant the old behaviour broke: an Agent ran a turn that no later turn could
+    // reproduce, because nothing carried it forward.
+    for (const threadHasMessages of [true, false]) {
+      const routed = routeMention({
+        mentionedAgentId: 'ast-rubric',
+        boundAssistantId: 'ast-other',
+        sessionId: SESSION,
+        threadHasMessages,
+      });
+      expect(routed.assistantId).toBe('ast-rubric');
+    }
+  });
+});
diff --git a/frontend/ai.client/src/app/session/services/chat/mention-routing.ts b/frontend/ai.client/src/app/session/services/chat/mention-routing.ts
new file mode 100644
index 000000000..21f5b6ac2
--- /dev/null
+++ b/frontend/ai.client/src/app/session/services/chat/mention-routing.ts
@@ -0,0 +1,69 @@
+/**
+ * Where an `@`-mentioned Agent's message goes (the SPA half of the binding rule).
+ *
+ * This lives outside `session.page.ts` for the same reason `agent_binding_policy` lives
+ * outside `chat/routes.py`: the rule is a handful of lines, the component around it has
+ * thirty injected services, and a rule nobody can reach from a test is a rule that drifts.
+ * It is the client-side mirror of `binds_conversation`, and the two must agree — the
+ * backend decides whether a turn *binds*, this decides which conversation the turn is even
+ * sent to.
+ *
+ * **A mention means "talk to this Agent", and it always yields a conversation where the
+ * Agent keeps its tools.** It used to mean "borrow this Agent for one turn": the mentioned
+ * turn ran as the Agent, and the next one silently did not. Nothing surfaced that — the
+ * thread still looked like the Agent's, and the model, unaware its toolset had changed,
+ * explained a vanished tool as something the user should fix in the tool picker. Measured
+ * in prod, the borrow bought nothing to offset it: of 247 mentions, 247 *started* the
+ * conversation and none was a mid-thread consult.
+ *
+ * So there are two outcomes and no third:
+ *
+ * - **Empty thread** — mentioning is launching. The Agent becomes the conversation's bound
+ *   assistant. Safe precisely because there is no history for the binding to misrepresent.
+ * - **Thread with history** — the Agent cannot be bound to history produced under other
+ *   instructions, tools and skills, and it must not be borrowed either. The message opens a
+ *   **new** conversation with the Agent, and the caller tells the user so.
+ */
+
+/** What the composer should actually submit, after a mention is taken into account. */
+export interface MentionRouting {
+  /** `null` asks `submitChatRequest` to create a conversation. */
+  readonly sessionId: string | null;
+  /** The conversation's bound Agent — goes on the URL and into `rag_assistant_id`. */
+  readonly assistantId: string | undefined;
+  /** True when the message was moved to a new conversation, so the caller can say so. */
+  readonly handedOff: boolean;
+}
+
+export interface MentionRoutingInput {
+  /** The Agent picked from the `@` menu, if any. */
+  readonly mentionedAgentId?: string;
+  /** The Agent this conversation is already bound to, if any. */
+  readonly boundAssistantId?: string;
+  /** The conversation being typed into; `null` when none exists yet. */
+  readonly sessionId: string | null;
+  /** Whether that conversation already has messages. */
+  readonly threadHasMessages: boolean;
+}
+
+export function routeMention({
+  mentionedAgentId,
+  boundAssistantId,
+  sessionId,
+  threadHasMessages,
+}: MentionRoutingInput): MentionRouting {
+  // No mention, or a mention of the Agent already running this conversation. The second
+  // case matters: re-mentioning the bound Agent is a no-op, and opening a new thread for
+  // it would be an obnoxious answer to "yes, you, again".
+  if (!mentionedAgentId || mentionedAgentId === boundAssistantId) {
+    return { sessionId, assistantId: boundAssistantId, handedOff: false };
+  }
+
+  if (threadHasMessages) {
+    return { sessionId: null, assistantId: mentionedAgentId, handedOff: true };
+  }
+
+  // Empty thread — including one already pointed at a *different* Agent the user never
+  // sent to. The last name typed wins, because nothing has happened yet to contradict it.
+  return { sessionId, assistantId: mentionedAgentId, handedOff: false };
+}
diff --git a/frontend/ai.client/src/app/session/services/chat/stream-parser.service.ts b/frontend/ai.client/src/app/session/services/chat/stream-parser.service.ts
index 2d5eb73ae..f470b91b2 100644
--- a/frontend/ai.client/src/app/session/services/chat/stream-parser.service.ts
+++ b/frontend/ai.client/src/app/session/services/chat/stream-parser.service.ts
@@ -18,6 +18,7 @@ import {
 } from '../../../services/quota/quota-warning.service';
 import { OAuthConsentService } from '../../../services/oauth-consent/oauth-consent.service';
 import { ToolApprovalService } from '../../../services/tool-approval/tool-approval.service';
+import { UserQuestionService } from '../../../services/user-question/user-question.service';
 import { CompactionSummaryService } from './compaction-summary.service';
 import { SteeringService } from './steering.service';
 import { buildSteeringMessage } from './steering';
@@ -28,6 +29,7 @@ import { SessionService } from '../session/session.service';
 import type {
   OAuthRequiredEvent,
   ToolApprovalRequiredEvent,
+  UserQuestionRequiredEvent,
   CompactionEvent,
   ArtifactEvent,
   UiResourceEvent,
@@ -162,6 +164,7 @@ export class StreamParserService {
   private quotaWarningService = inject(QuotaWarningService);
   private oauthConsentService = inject(OAuthConsentService);
   private toolApprovalService = inject(ToolApprovalService);
+  private userQuestionService = inject(UserQuestionService);
   private compactionSummary = inject(CompactionSummaryService);
   private steering = inject(SteeringService);
   private artifactState = inject(ArtifactStateService);
@@ -646,6 +649,17 @@ export class StreamParserService {
         });
       },
 
+      onUserQuestionRequired: (data: UserQuestionRequiredEvent) => {
+        const lastAssistantId = this.findLastAssistantId(state);
+        this.userQuestionService.requestAnswers({
+          interruptId: data.interruptId,
+          toolUseId: data.toolUseId,
+          questions: data.questions,
+          messageId: lastAssistantId,
+          sessionId: state.sessionId,
+        });
+      },
+
       onError: (data) => this.handleError(state, data),
       onStreamError: (data) => {
         const streamError = data as ConversationalStreamError;
diff --git a/frontend/ai.client/src/app/session/services/session/message-map.service.ts b/frontend/ai.client/src/app/session/services/session/message-map.service.ts
index 27dbcbcc5..3fb882d0c 100644
--- a/frontend/ai.client/src/app/session/services/session/message-map.service.ts
+++ b/frontend/ai.client/src/app/session/services/session/message-map.service.ts
@@ -6,6 +6,8 @@ import { PendingInterrupt, SessionService } from './session.service';
 import { FileUploadService, FileMetadata } from '../../../services/file-upload';
 import { OAuthConsentService } from '../../../services/oauth-consent/oauth-consent.service';
 import { ToolApprovalService } from '../../../services/tool-approval/tool-approval.service';
+import { UserQuestionService } from '../../../services/user-question/user-question.service';
+import { validateUserQuestions } from '../../../shared/utils/stream-parser';
 import { McpAppStateService } from '../mcp-apps/mcp-app-state.service';
 import { ToolInsightService } from '../chat/tool-insight.service';
 import { normalizeSteeringMessages } from '../chat/steering';
@@ -69,6 +71,7 @@ export class MessageMapService {
   private fileUploadService = inject(FileUploadService);
   private oauthConsentService = inject(OAuthConsentService);
   private toolApprovalService = inject(ToolApprovalService);
+  private userQuestionService = inject(UserQuestionService);
   private mcpAppState = inject(McpAppStateService);
   private toolInsight = inject(ToolInsightService);
   private injector = inject(Injector);
@@ -474,6 +477,50 @@ export class MessageMapService {
    * anchor to the most recent assistant message, mirroring the live-stream
    * behavior in stream-parser.service.ts.
    */
+  /**
+   * Re-render a clarifying-question picker from its persisted breadcrumb.
+   *
+   * The questions arrive as a JSON string (DynamoDB would otherwise coerce
+   * numbers nested inside them), so this is the one place in the SPA that
+   * parses untrusted stored JSON back into questions. Both failure modes —
+   * unparseable text and a parsed payload that is not renderable — drop the
+   * prompt rather than render a broken one: a picker with no options is a
+   * dead end the user cannot answer or dismiss, whereas a missing picker
+   * leaves them able to retype their request.
+   */
+  private hydrateUserQuestion(
+    sessionId: string,
+    interrupt: PendingInterrupt,
+    messageId: string | undefined,
+  ): void {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(interrupt.questions ?? '');
+    } catch {
+      console.warn(
+        'Skipping user_question interrupt with unparseable questions',
+        interrupt.interruptId,
+      );
+      return;
+    }
+
+    if (!validateUserQuestions(parsed)) {
+      console.warn(
+        'Skipping user_question interrupt with unrenderable questions',
+        interrupt.interruptId,
+      );
+      return;
+    }
+
+    this.userQuestionService.requestAnswers({
+      interruptId: interrupt.interruptId,
+      toolUseId: interrupt.toolUseId ?? '',
+      questions: parsed,
+      messageId,
+      sessionId,
+    });
+  }
+
   private hydratePendingInterrupts(
     sessionId: string,
     interrupts: PendingInterrupt[] | undefined,
@@ -493,6 +540,11 @@ export class MessageMapService {
       const messageId = interrupt.triggeringMessageId ?? lastAssistantId;
       const kind = interrupt.kind ?? 'oauth';
 
+      if (kind === 'user_question') {
+        this.hydrateUserQuestion(sessionId, interrupt, messageId);
+        continue;
+      }
+
       if (kind === 'tool_approval') {
         if (!interrupt.toolName) {
           console.warn(
diff --git a/frontend/ai.client/src/app/session/services/session/session.service.ts b/frontend/ai.client/src/app/session/services/session/session.service.ts
index 2cbf9c474..afd1533fc 100644
--- a/frontend/ai.client/src/app/session/services/session/session.service.ts
+++ b/frontend/ai.client/src/app/session/services/session/session.service.ts
@@ -44,7 +44,7 @@ export interface PendingInterrupt {
    * written before per-tool approval shipped omit this — backend defaults
    * to "oauth" on read.
    */
-  kind?: 'oauth' | 'tool_approval';
+  kind?: 'oauth' | 'tool_approval' | 'user_question';
   /** Id of the assistant message whose tool call triggered this interrupt, if known */
   triggeringMessageId?: string | null;
   /** ISO 8601 timestamp when the interrupt was recorded */
@@ -59,6 +59,16 @@ export interface PendingInterrupt {
   toolInput?: string | null;
   /** (tool_approval) Message to display in the approval prompt */
   message?: string | null;
+  /**
+   * (user_question) JSON-encoded list of questions to re-render.
+   *
+   * A string rather than a structured field for the same reason `toolInput`
+   * is: DynamoDB coerces numbers inside nested objects to Decimal on the way
+   * out, so the backend stores the payload pre-serialized and the client
+   * parses it back. Validate with `validateUserQuestions` after parsing —
+   * never trust it to be renderable.
+   */
+  questions?: string | null;
 }
 
 /**
diff --git a/frontend/ai.client/src/app/session/services/session/user-question-hydration.spec.ts b/frontend/ai.client/src/app/session/services/session/user-question-hydration.spec.ts
new file mode 100644
index 000000000..beb10f6e1
--- /dev/null
+++ b/frontend/ai.client/src/app/session/services/session/user-question-hydration.spec.ts
@@ -0,0 +1,168 @@
+import { TestBed } from '@angular/core/testing';
+import { provideHttpClient } from '@angular/common/http';
+import { provideHttpClientTesting } from '@angular/common/http/testing';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { MessageMapService } from './message-map.service';
+import { SessionService } from './session.service';
+import { FileUploadService } from '../../../services/file-upload';
+import { OAuthConsentService } from '../../../services/oauth-consent/oauth-consent.service';
+import { ToolApprovalService } from '../../../services/tool-approval/tool-approval.service';
+import { UserQuestionService } from '../../../services/user-question/user-question.service';
+
+/**
+ * Replaying a paused clarifying-question prompt after a page refresh.
+ *
+ * The `user_question_required` SSE event fires once and never re-streams, so
+ * without this a refresh mid-prompt orphans the turn: the picker is gone but
+ * the agent is still paused waiting for an answer.
+ *
+ * The questions arrive as a JSON *string* (DynamoDB would coerce numbers
+ * nested inside them), which makes this the one place in the SPA that parses
+ * untrusted stored JSON back into a renderable prompt — so the failure modes
+ * get as much attention as the happy path.
+ */
+const QUESTIONS = [
+  {
+    header: 'Scope',
+    question: 'How much should this cover?',
+    multiSelect: false,
+    options: [{ label: 'Just the API' }, { label: 'Everything' }],
+  },
+];
+
+function interrupt(overrides: Record<string, unknown> = {}) {
+  return {
+    interruptId: 'v1:tool_call:tu-1:abc',
+    kind: 'user_question',
+    toolUseId: 'tu-1',
+    toolName: 'ask_user_question',
+    questions: JSON.stringify(QUESTIONS),
+    createdAt: '2026-09-14T00:00:00Z',
+    ...overrides,
+  };
+}
+
+describe('MessageMapService — user_question hydration', () => {
+  let service: MessageMapService;
+  let sessionService: { getMessages: ReturnType<typeof vi.fn> };
+  let questionService: UserQuestionService;
+
+  async function hydrate(pendingInterrupts: unknown[], messages: unknown[] = []) {
+    sessionService.getMessages.mockResolvedValue({ messages, pendingInterrupts });
+    await service.loadMessagesForSession('s1');
+  }
+
+  beforeEach(() => {
+    TestBed.resetTestingModule();
+    sessionService = {
+      getMessages: vi.fn().mockResolvedValue({ messages: [] }),
+      isNewSession: vi.fn().mockReturnValue(false),
+      updateSessionTitleInCache: vi.fn(),
+    } as never;
+    TestBed.configureTestingModule({
+      providers: [
+        provideHttpClient(),
+        provideHttpClientTesting(),
+        MessageMapService,
+        UserQuestionService,
+        { provide: SessionService, useValue: sessionService },
+        { provide: FileUploadService, useValue: { listSessionFiles: vi.fn().mockResolvedValue([]) } },
+        { provide: OAuthConsentService, useValue: { requestConsent: vi.fn() } },
+        { provide: ToolApprovalService, useValue: { requestApproval: vi.fn() } },
+      ],
+    });
+    service = TestBed.inject(MessageMapService);
+    questionService = TestBed.inject(UserQuestionService);
+  });
+
+  describe('the happy path', () => {
+    it('re-renders the picker from the breadcrumb', async () => {
+      await hydrate([interrupt()]);
+
+      const [pending] = questionService.pending();
+      expect(pending).toBeDefined();
+      expect(pending.interruptId).toBe('v1:tool_call:tu-1:abc');
+      expect(pending.toolUseId).toBe('tu-1');
+      expect(pending.questions).toEqual(QUESTIONS);
+      // The message list filters the global queue on this.
+      expect(pending.sessionId).toBe('s1');
+    });
+
+    it('anchors to the triggering message when the backend recorded one', async () => {
+      await hydrate([interrupt({ triggeringMessageId: 'm-7' })]);
+
+      expect(questionService.pending()[0].messageId).toBe('m-7');
+    });
+
+    it('falls back to the last assistant message', async () => {
+      await hydrate(
+        [interrupt()],
+        [
+          { id: 'm-1', role: 'user', content: [{ text: 'hi' }] },
+          { id: 'm-2', role: 'assistant', content: [{ text: 'thinking' }] },
+        ],
+      );
+
+      expect(questionService.pending()[0].messageId).toBe('m-2');
+    });
+  });
+
+  describe('payloads that must not render', () => {
+    it('drops an unparseable questions string', async () => {
+      await hydrate([interrupt({ questions: 'not json' })]);
+
+      expect(questionService.hasPending()).toBe(false);
+    });
+
+    it('drops a missing questions field', async () => {
+      await hydrate([interrupt({ questions: undefined })]);
+
+      expect(questionService.hasPending()).toBe(false);
+    });
+
+    it.each([
+      ['empty list', '[]'],
+      ['not a list', '{"header":"Scope"}'],
+      ['question with no options', '[{"header":"S","question":"Which?","options":[]}]'],
+      ['option with no label', '[{"header":"S","question":"Which?","options":[{}]}]'],
+      ['question with no text', '[{"header":"S","question":"","options":[{"label":"a"}]}]'],
+    ])('drops a payload that is %s', async (_label, questions) => {
+      await hydrate([interrupt({ questions })]);
+
+      // A picker with no answerable option is a dead end: the user can
+      // neither answer nor dismiss it, and the turn stays paused. Rendering
+      // nothing at least leaves them able to retype their request.
+      expect(questionService.hasPending()).toBe(false);
+    });
+  });
+
+  describe('coexistence with the other interrupt flavors', () => {
+    it('ignores oauth and tool_approval rows', async () => {
+      await hydrate([
+        { interruptId: 'o1', kind: 'oauth', providerId: 'google', createdAt: 'x' },
+        { interruptId: 't1', kind: 'tool_approval', toolName: 'send_email', createdAt: 'x' },
+      ]);
+
+      expect(questionService.hasPending()).toBe(false);
+    });
+
+    it('hydrates a user_question alongside them', async () => {
+      await hydrate([
+        { interruptId: 'o1', kind: 'oauth', providerId: 'google', createdAt: 'x' },
+        interrupt(),
+      ]);
+
+      expect(questionService.pending()).toHaveLength(1);
+      expect(questionService.pending()[0].interruptId).toBe('v1:tool_call:tu-1:abc');
+    });
+
+    it('does not re-add a prompt the user already answered this session', async () => {
+      await hydrate([interrupt()]);
+      await questionService.resolve('v1:tool_call:tu-1:abc', { skipped: true });
+
+      await hydrate([interrupt()]);
+
+      expect(questionService.hasPending()).toBe(false);
+    });
+  });
+});
diff --git a/frontend/ai.client/src/app/session/session.page.ts b/frontend/ai.client/src/app/session/session.page.ts
index 29456210b..64961a579 100644
--- a/frontend/ai.client/src/app/session/session.page.ts
+++ b/frontend/ai.client/src/app/session/session.page.ts
@@ -27,6 +27,9 @@ import { Dialog } from '@angular/cdk/dialog';
 import { AssistantService } from '../assistants/services/assistant.service';
 import { Assistant } from '../assistants/models/assistant.model';
 import { AgentService } from '../agents/services/agent.service';
+import { AgentMentionService } from '../agents/services/agent-mention.service';
+import { routeMention } from './services/chat/mention-routing';
+import { ToastService } from '../services/toast/toast.service';
 import { Agent, AgentRunnability } from '../agents/models/agent.model';
 import { ToolService } from '../services/tool/tool.service';
 import { SkillService } from '../services/skill/skill.service';
@@ -77,6 +80,8 @@ export class ConversationPage implements OnDestroy {
   private systemPromptsService = inject(SystemPromptsService);
   private greetingProvider = inject(GreetingProvider);
   private scrollPositions = inject(ScrollPositionService);
+  private agentMentionService = inject(AgentMentionService);
+  private toast = inject(ToastService);
   private platformId = inject(PLATFORM_ID);
   private isBrowser = isPlatformBrowser(this.platformId);
 
@@ -590,22 +595,40 @@ export class ConversationPage implements OnDestroy {
     // `assistant()` signal guards the brief window during the `/` → `/s/:id`
     // route transition where the component is recreated and the query
     // param hasn't yet propagated to the new instance.
-    const assistantIdToUse =
+    const boundAssistantId =
       this.assistantIdFromQuery() || this.assistant()?.assistantId || undefined;
 
+    // An `@`-mention means "talk to this Agent", and always yields a conversation the
+    // Agent keeps its tools in — never the one-turn borrow that used to leave the *next*
+    // message agent-less with no signal to the user or the model. Rule in
+    // `mention-routing.ts` so it is testable without this component's ~30 injections.
+    const routed = routeMention({
+      mentionedAgentId: message.mentionAgentId,
+      boundAssistantId,
+      sessionId: sessionIdToUse,
+      threadHasMessages: this.hasMessages(),
+    });
+
+    if (routed.handedOff && message.mentionAgentId) {
+      this.toast.info(
+        `Starting a new conversation with ${this.mentionedAgentName(message.mentionAgentId)}`,
+        'Agents keep their tools and knowledge in their own conversation, so this message opens one.',
+      );
+    }
+
     // Loading state is set inside submitChatRequest once the (possibly
     // freshly generated) session id is known — it's per-session now.
 
-    // Submit the chat request with file upload IDs and assistant ID if present.
-    // A `@`-mention (Marketplace D11) rides alongside rather than replacing the bound
-    // assistant: it runs this one turn, the URL keeps whatever the conversation is bound
-    // to, and the next unmentioned message goes back to that.
+    // `mentionAgentId` is deliberately not forwarded any more: the backend's
+    // `agent_mention` flag exists only to suppress binding, which is the behaviour being
+    // removed. Sending the Agent as the bound `assistantId` is what puts it on the URL
+    // and keeps it on every following turn.
     this.chatRequestService.submitChatRequest(
       message.content,
-      sessionIdToUse,
+      routed.sessionId,
       message.fileUploadIds,
-      assistantIdToUse,
-      message.mentionAgentId,
+      routed.assistantId,
+      undefined,
       message.invokedSkillIds
     ).catch((error) => {
       console.error('Error sending chat request:', error);
@@ -617,6 +640,19 @@ export class ConversationPage implements OnDestroy {
     }
   }
 
+  /**
+   * Display name for a mentioned Agent, for the hand-off notice.
+   *
+   * Falls back to a generic noun rather than an id: the toast explains what just happened
+   * to the user's message, and a raw `ast-…` in that sentence is worse than no name.
+   */
+  private mentionedAgentName(agentId: string): string {
+    const match = this.agentMentionService
+      .mentionable()
+      .find((candidate) => candidate.agentId === agentId);
+    return match?.name || 'this agent';
+  }
+
   /**
    * "Continue" affordance on a max_tokens-truncated assistant message.
    * NOT a new user turn: it resumes the truncated assistant message via the
diff --git a/frontend/ai.client/src/app/shared/utils/file-download-url.spec.ts b/frontend/ai.client/src/app/shared/utils/file-download-url.spec.ts
new file mode 100644
index 000000000..5ddba26e6
--- /dev/null
+++ b/frontend/ai.client/src/app/shared/utils/file-download-url.spec.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest';
+import { downloadUrlFor, durableDownloadUrlFromHref } from './file-download-url';
+
+const API = '/api';
+
+/** A realistic presigned URL for a generated .docx in the user-files bucket. */
+const SIGNED =
+  'https://boisestateai-v2-user-file-uploads-897729136999.s3.us-west-2.amazonaws.com' +
+  '/user-files/887113c0-70d1-7044-c305-191dbe255583/6b247682-b8fa-4797-95a5-ee06969380a7' +
+  '/1a098460e41_ba6e8f342f1744e2/plan.docx' +
+  '?response-content-type=application%2Fpdf&X-Amz-Algorithm=AWS4-HMAC-SHA256' +
+  '&X-Amz-Signature=deadbeef';
+
+/** The same URL after the model re-emitted it in prose — signature dropped. */
+const TRUNCATED = SIGNED.split('?')[0];
+
+describe('downloadUrlFor', () => {
+  it('builds the durable app-api download path', () => {
+    expect(downloadUrlFor(API, 'up1')).toBe('/api/files/up1/download');
+  });
+
+  it('encodes the upload id', () => {
+    expect(downloadUrlFor(API, 'a/b')).toBe('/api/files/a%2Fb/download');
+  });
+});
+
+describe('durableDownloadUrlFromHref', () => {
+  it('rewrites a truncated user-files S3 link to the durable route', () => {
+    expect(durableDownloadUrlFromHref(API, TRUNCATED)).toBe(
+      '/api/files/1a098460e41_ba6e8f342f1744e2/download',
+    );
+  });
+
+  it('rewrites a still-signed user-files link too (it expires within the hour)', () => {
+    expect(durableDownloadUrlFromHref(API, SIGNED)).toBe(
+      '/api/files/1a098460e41_ba6e8f342f1744e2/download',
+    );
+  });
+
+  it('honours a cross-origin app-api base', () => {
+    expect(durableDownloadUrlFromHref('http://localhost:8000', TRUNCATED)).toBe(
+      'http://localhost:8000/files/1a098460e41_ba6e8f342f1744e2/download',
+    );
+  });
+
+  it.each([
+    ['an unrelated https link', 'https://docs.google.com/document/d/abc/edit'],
+    ['an S3 URL that is not a user-files object key', 'https://bucket.s3.us-west-2.amazonaws.com/other/x.txt'],
+    ['a user-files path on a non-S3 host', 'https://evil.example/user-files/u/s/up1/x.docx'],
+    ['a non-absolute href', '/files/up1/download'],
+    ['a javascript: URL', 'javascript:alert(1)'],
+    ['garbage', 'not a url'],
+  ])('leaves %s alone', (_label, href) => {
+    expect(durableDownloadUrlFromHref(API, href)).toBeNull();
+  });
+});
diff --git a/frontend/ai.client/src/app/shared/utils/file-download-url.ts b/frontend/ai.client/src/app/shared/utils/file-download-url.ts
new file mode 100644
index 000000000..ce8e55258
--- /dev/null
+++ b/frontend/ai.client/src/app/shared/utils/file-download-url.ts
@@ -0,0 +1,55 @@
+/**
+ * Durable download links for user-files objects.
+ *
+ * Presigned S3 URLs expire in minutes. Anything that writes one into a
+ * conversation — the inline download card on a generated .docx, or a link the
+ * model composed from a tool result — is dead by the time the thread is
+ * reopened, and worse: a model re-emitting a ~1,400-character signed URL in
+ * prose truncates it at the `?`, producing an unsigned link that S3 answers
+ * with `AccessDenied` even while the card's own button still works.
+ *
+ * The fix is to never render a signed URL. `downloadUrlFor` builds the stable,
+ * cookie-authed app-api path, which mints a fresh presigned URL per click and
+ * 302s to it. `durableDownloadUrlFromHref` recovers that same path from an
+ * already-persisted raw S3 URL, so conversations written before the backend
+ * stopped emitting signed URLs heal on render.
+ */
+
+/**
+ * Object keys in the user-files bucket are
+ * `user-files/{userId}/{sessionId}/{uploadId}/{filename}` — see
+ * `apis/shared/files/workspace.py` and `agents/builtin_tools/office/_storage.py`,
+ * which both compose the key that way. The upload id is the fourth segment.
+ */
+const USER_FILES_KEY = /^\/?user-files\/[^/]+\/[^/]+\/([^/]+)\/[^/]+$/;
+
+/** Hosts that serve the user-files bucket directly (virtual-hosted style). */
+const S3_HOST = /(^|\.)s3[.-][a-z0-9-]+\.amazonaws\.com$/i;
+
+/** The durable, owner-scoped download path for an uploaded file. */
+export function downloadUrlFor(appApiUrl: string, uploadId: string): string {
+  return `${appApiUrl}/files/${encodeURIComponent(uploadId)}/download`;
+}
+
+/**
+ * Rewrite a raw user-files S3 URL to the durable download route.
+ *
+ * Returns `null` for every other href — including S3 URLs that don't match the
+ * user-files key shape — so callers leave unrelated links untouched.
+ */
+export function durableDownloadUrlFromHref(
+  appApiUrl: string,
+  href: string,
+): string | null {
+  let url: URL;
+  try {
+    url = new URL(href);
+  } catch {
+    return null;
+  }
+
+  if (url.protocol !== 'https:' || !S3_HOST.test(url.hostname)) return null;
+
+  const uploadId = USER_FILES_KEY.exec(url.pathname)?.[1];
+  return uploadId ? downloadUrlFor(appApiUrl, decodeURIComponent(uploadId)) : null;
+}
diff --git a/frontend/ai.client/src/app/shared/utils/stream-parser/index.ts b/frontend/ai.client/src/app/shared/utils/stream-parser/index.ts
index 875ef720b..ef9680929 100644
--- a/frontend/ai.client/src/app/shared/utils/stream-parser/index.ts
+++ b/frontend/ai.client/src/app/shared/utils/stream-parser/index.ts
@@ -58,6 +58,8 @@ export {
   validateCitation,
   validateOAuthRequiredEvent,
   validateToolApprovalRequiredEvent,
+  validateUserQuestionRequiredEvent,
+  validateUserQuestions,
   validateCompactionEvent,
   validateArtifactEvent,
   validateUiResourceEvent,
@@ -88,6 +90,9 @@ export type {
   ConversationalStreamErrorEvent,
   OAuthRequiredEvent,
   ToolApprovalRequiredEvent,
+  UserQuestionRequiredEvent,
+  UserQuestion,
+  QuestionOption,
   CompactionEvent,
   ArtifactEvent,
   UiResourceEvent,
diff --git a/frontend/ai.client/src/app/shared/utils/stream-parser/stream-parser-core.ts b/frontend/ai.client/src/app/shared/utils/stream-parser/stream-parser-core.ts
index 6ef321aa2..d5ce3b722 100644
--- a/frontend/ai.client/src/app/shared/utils/stream-parser/stream-parser-core.ts
+++ b/frontend/ai.client/src/app/shared/utils/stream-parser/stream-parser-core.ts
@@ -41,6 +41,9 @@ import type {
   ConversationalStreamErrorEvent,
   OAuthRequiredEvent,
   ToolApprovalRequiredEvent,
+  UserQuestionRequiredEvent,
+  UserQuestion,
+  QuestionOption,
   CompactionEvent,
   ArtifactEvent,
   UiResourceEvent,
@@ -92,6 +95,9 @@ export interface StreamParserCallbacks {
   // Tool approval required (catalog flagged this MCP tool needs_approval)
   onToolApprovalRequired?: (data: ToolApprovalRequiredEvent) => void;
 
+  // The agent paused to ask the user structured clarifying questions
+  onUserQuestionRequired?: (data: UserQuestionRequiredEvent) => void;
+
   // What the agent is doing right now (model/tool boundaries from the
   // runtime's AgentStatusHook). Drives the live status line and supplies the
   // event-loop-measured duration for each finished tool row.
@@ -443,6 +449,69 @@ export function validateToolApprovalRequiredEvent(
   );
 }
 
+/**
+ * Validate a list of clarifying questions.
+ *
+ * Extracted so the two paths that receive questions — the live SSE event and
+ * the persisted `PendingInterrupt` breadcrumb replayed on reload — cannot
+ * drift apart. They arrive by different transports (one a parsed SSE frame,
+ * one a JSON string out of DynamoDB) but must agree on what is renderable;
+ * two hand-written copies of this predicate would eventually disagree, and
+ * the failure mode is a prompt that renders on one path and vanishes on the
+ * other.
+ *
+ * Stricter than the sibling event validators because the payload drives a
+ * whole interactive form rather than a fixed two-button prompt: a question
+ * with no options, or an option with no label, renders an unanswerable prompt
+ * and leaves the turn paused with no way forward.
+ */
+export function validateUserQuestions(value: unknown): value is UserQuestion[] {
+  if (!Array.isArray(value) || value.length === 0) {
+    return false;
+  }
+
+  return value.every(
+    (question) =>
+      !!question &&
+      typeof question === 'object' &&
+      typeof question.header === 'string' &&
+      question.header.length > 0 &&
+      typeof question.question === 'string' &&
+      question.question.length > 0 &&
+      Array.isArray(question.options) &&
+      question.options.length > 0 &&
+      question.options.every(
+        (option: unknown) =>
+          !!option &&
+          typeof option === 'object' &&
+          typeof (option as QuestionOption).label === 'string' &&
+          (option as QuestionOption).label.length > 0,
+      ),
+  );
+}
+
+/**
+ * Validate UserQuestionRequiredEvent structure. Question-shape checks live in
+ * {@link validateUserQuestions}, shared with the reload path.
+ */
+export function validateUserQuestionRequiredEvent(
+  data: unknown,
+): data is UserQuestionRequiredEvent {
+  if (!data || typeof data !== 'object') {
+    return false;
+  }
+
+  const event = data as Partial<UserQuestionRequiredEvent>;
+
+  return (
+    event.type === 'user_question_required' &&
+    typeof event.interruptId === 'string' &&
+    event.interruptId.length > 0 &&
+    typeof event.toolUseId === 'string' &&
+    validateUserQuestions(event.questions)
+  );
+}
+
 /**
  * Validate CompactionEvent structure
  */
@@ -829,6 +898,14 @@ export function processStreamEvent(
         }
         break;
 
+      case 'user_question_required':
+        if (validateUserQuestionRequiredEvent(data)) {
+          callbacks.onUserQuestionRequired?.(data);
+        } else {
+          callbacks.onParseError?.('user_question_required: invalid data structure');
+        }
+        break;
+
       case 'compaction':
         if (validateCompactionEvent(data)) {
           callbacks.onCompaction?.(data);
diff --git a/frontend/ai.client/src/app/shared/utils/stream-parser/stream-parser-types.ts b/frontend/ai.client/src/app/shared/utils/stream-parser/stream-parser-types.ts
index 33a853fde..9b0a07b8a 100644
--- a/frontend/ai.client/src/app/shared/utils/stream-parser/stream-parser-types.ts
+++ b/frontend/ai.client/src/app/shared/utils/stream-parser/stream-parser-types.ts
@@ -155,6 +155,47 @@ export interface ToolApprovalRequiredEvent {
   message: string;
 }
 
+/** One selectable answer in a {@link UserQuestion}. */
+export interface QuestionOption {
+  label: string;
+  /** Optional one-line explanation of what the choice means. */
+  description?: string;
+}
+
+/**
+ * One question in an {@link UserQuestionRequiredEvent}.
+ *
+ * `header` is both the short chip label shown above the question AND the key
+ * the answer is correlated by on resume — the backend de-duplicates colliding
+ * headers before emitting, so it is safe to use as a map key.
+ */
+export interface UserQuestion {
+  header: string;
+  question: string;
+  /** More than one option may be chosen. */
+  multiSelect: boolean;
+  options: QuestionOption[];
+}
+
+/**
+ * The agent paused to ask the user structured clarifying questions.
+ *
+ * Sibling of {@link ToolApprovalRequiredEvent}, with one difference worth
+ * knowing: that interrupt is raised by a `BeforeToolCall` hook gating someone
+ * else's tool, while this one is raised by the `ask_user_question` tool itself
+ * — so `toolUseId` identifies the prompt's own tool card in the transcript.
+ *
+ * The picker owns the "Other" free-text field and the "Skip" control; the
+ * backend strips any model-supplied lookalike, so `options` never contains
+ * them and the UI must always add them itself.
+ */
+export interface UserQuestionRequiredEvent {
+  type: 'user_question_required';
+  interruptId: string;
+  toolUseId: string;
+  questions: UserQuestion[];
+}
+
 /**
  * Compaction event — emitted after the final `metadata` event (so the badge
  * updates first) and before `done` when the backend rolls older turns into
diff --git a/frontend/ai.client/src/branding/README.md b/frontend/ai.client/src/branding/README.md
index da59aa2c7..1728ed6b6 100644
--- a/frontend/ai.client/src/branding/README.md
+++ b/frontend/ai.client/src/branding/README.md
@@ -76,6 +76,12 @@ Each bucket follows the same rules as the flat arrays (1–50 entries, 1–500 c
 - Both objects are **optional**. Omit either one, or any single bucket, and the built-in defaults apply for what you left out.
 - An **explicitly empty** bucket (`night: []`) is honoured as "stay quiet at that hour" rather than replaced with the defaults — it is the only way to turn a bucket off.
 
+### Keep each greeting to one line
+
+The 500-character bound is a validation limit, not a design budget. The greeting is set at `text-4xl` beside the logo, which leaves it a **616px text column** — about 35 characters once a long first name is substituted in. Longer than that and it wraps to a second line, in full view, because the greeting is typed out one character at a time.
+
+`greeting-line-length.spec.ts` measures every greeting in `brand.config.ts` (and in the worked example) against that column using the real font's advance widths, with an 11-character stress name standing in for `{name}`. If you add a greeting that would wrap, that test fails and names the string. Write short lines — "Good morning, {name}!" survives a long name; "Good morning, {name} — what shall we work on today?" does not.
+
 ## 4. Surface colors (page background, dark background, raised surfaces)
 
 Three additional anchors — `surfaces.light`, `surfaces.dark`, and `surfaces.raised` — control the app's neutral (`gray-*`/`white`) surfaces: the light-mode page background, the dark-mode page background, and the light-mode raised surface (cards, dropdowns, dialogs, table zebra-striping). Edit them alongside `colors` in `brand.config.ts`:
diff --git a/frontend/ai.client/src/branding/brand.defaults.golden.spec.ts b/frontend/ai.client/src/branding/brand.defaults.golden.spec.ts
index ad796e227..6cb0ce969 100644
--- a/frontend/ai.client/src/branding/brand.defaults.golden.spec.ts
+++ b/frontend/ai.client/src/branding/brand.defaults.golden.spec.ts
@@ -30,13 +30,20 @@ describe('Default_Branding golden regression (logo paths + greetings)', () => {
     });
   });
 
-  it('DEFAULT_GREETING_TEMPLATES matches the historical session.page.ts greetingTemplates array', () => {
-    // Historical `greetingTemplates` array from session.page.ts (removed in
-    // task 7.3, superseded by GreetingProvider.resolveGreeting), preserved
-    // here as the Default_Branding golden value per Requirement 7.4.
+  it('DEFAULT_GREETING_TEMPLATES matches the committed Default_Branding greetings', () => {
+    // Originally the historical `greetingTemplates` array from session.page.ts
+    // (removed in task 7.3, superseded by GreetingProvider.resolveGreeting),
+    // pinned here as the Default_Branding golden value per Requirement 7.4.
+    //
+    // The first two entries were deliberately shortened: at `text-4xl` in the
+    // Chat_Greeting_Block's 616px text column, "How can I help you today,
+    // {name}?" wrapped to a second line for any first name of 8 characters or
+    // more, and "What would you like to know, {name}?" for 6 or more. The rest
+    // of the array is unchanged, and the one-line budget is enforced for every
+    // greeting by `greeting-line-length.spec.ts`.
     expect(DEFAULT_GREETING_TEMPLATES).toEqual([
-      'How can I help you today, {name}?',
-      'What would you like to know, {name}?',
+      'How can I help, {name}?',
+      "What's on your mind, {name}?",
       'Ready to assist you, {name}!',
       'What can I do for you, {name}?',
       "Let's get started, {name}!",
diff --git a/frontend/ai.client/src/branding/brand.defaults.ts b/frontend/ai.client/src/branding/brand.defaults.ts
index 20ff43e0d..6bf201e8e 100644
--- a/frontend/ai.client/src/branding/brand.defaults.ts
+++ b/frontend/ai.client/src/branding/brand.defaults.ts
@@ -27,12 +27,23 @@ export const DEFAULT_ALT_LABEL = 'Logo';
 
 /**
  * Default greeting templates (use {name} as placeholder for first name).
- * Copied verbatim from the current `greetingTemplates` array in
- * `session.page.ts`.
+ *
+ * **Every greeting in this file has to fit the Chat_Greeting_Block on one
+ * line.** That block is a 720px column with 1rem of side padding, a 56px
+ * logo and a 1rem gap, which leaves the `text-4xl/tight` heading a 616px
+ * text column — and `AnimatedTextComponent` types it out a character at a
+ * time, so a line that wraps does it visibly, mid-animation. Every greeting
+ * below was checked in a browser against that column with a 12-character
+ * first name substituted for `{name}`, and `greeting-line-length.spec.ts`
+ * holds the line from here using the font's own advance widths. Keep new
+ * greetings short, and prefer a terse line to a clever one that wraps.
+ *
+ * Originally copied verbatim from the `greetingTemplates` array in
+ * `session.page.ts`; the first two entries were shortened to fit the budget.
  */
 export const DEFAULT_GREETING_TEMPLATES: readonly string[] = Object.freeze([
-  'How can I help you today, {name}?',
-  'What would you like to know, {name}?',
+  'How can I help, {name}?',
+  "What's on your mind, {name}?",
   'Ready to assist you, {name}!',
   'What can I do for you, {name}?',
   "Let's get started, {name}!",
@@ -59,9 +70,8 @@ export const DEFAULT_FALLBACK_GREETINGS: readonly string[] = Object.freeze([
  * Pooling rather than replacing is what keeps the app from feeling like it has
  * exactly one thing to say each morning.
  *
- * The two arrays above are deliberately left alone — they are pinned verbatim
- * by `brand.defaults.golden.spec.ts` as the pre-branding-refactor greetings,
- * and that guard is worth more than tidiness.
+ * Like every greeting here, these are written to the 616px one-line budget
+ * documented on `DEFAULT_GREETING_TEMPLATES`.
  */
 export const DEFAULT_TIME_OF_DAY_GREETING_TEMPLATES: Readonly<
   Record<PartOfDay, readonly string[]>
@@ -69,30 +79,30 @@ export const DEFAULT_TIME_OF_DAY_GREETING_TEMPLATES: Readonly<
   morning: Object.freeze([
     'Good morning, {name}!',
     'Bright and early, {name}.',
-    "Morning, {name} — what's first today?",
-    "Coffee's on. What are we working on, {name}?",
-    'Fresh start, {name}. Where do we begin?',
+    "Morning, {name}. What's first?",
+    "Coffee's on, {name}.",
+    'Fresh start, {name}. Where to?',
   ]),
   afternoon: Object.freeze([
     'Good afternoon, {name}!',
-    'Afternoon, {name}. What are we working on?',
+    "Afternoon, {name}. What's up?",
     'Back at it, {name}?',
-    "What's next on the list, {name}?",
-    'Afternoon, {name} — where should we pick up?',
+    "What's next, {name}?",
+    'Where were we, {name}?',
   ]),
   evening: Object.freeze([
     'Good evening, {name}!',
-    'Evening, {name}. What can I take off your plate?',
-    'One more thing before you log off, {name}?',
-    'Still going, {name}? What do you need?',
-    'Evening, {name}. Where should we start?',
+    'Need a hand, {name}?',
+    'One more thing, {name}?',
+    'Still going, {name}?',
+    "Evening, {name}. What's left?",
   ]),
   night: Object.freeze([
-    'Burning the midnight oil, {name}?',
+    'Midnight oil, {name}?',
     'Working late tonight, {name}?',
-    'The quiet hours, {name}. What are we tackling?',
+    'The quiet hours, {name}.',
     'Still up, {name}? Let me help.',
-    'Late one, {name}. Where should we start?',
+    "Late one, {name}. What's up?",
   ]),
 });
 
@@ -104,19 +114,19 @@ export const DEFAULT_TIME_OF_DAY_FALLBACK_GREETINGS: Readonly<
     'Good morning!',
     'Bright and early.',
     "Morning — what's first today?",
-    "Coffee's on. What are we working on?",
+    "Coffee's on. What's first?",
     'Fresh start. Where do we begin?',
   ]),
   afternoon: Object.freeze([
     'Good afternoon!',
-    'What are we working on this afternoon?',
+    'What are we working on?',
     'Back at it?',
     "What's next on the list?",
-    'Afternoon — where should we pick up?',
+    'Where should we pick up?',
   ]),
   evening: Object.freeze([
     'Good evening!',
-    'What can I take off your plate tonight?',
+    'What can I take off your plate?',
     'One more thing before you log off?',
     'Still going? What do you need?',
     'Evening. Where should we start?',
@@ -124,7 +134,7 @@ export const DEFAULT_TIME_OF_DAY_FALLBACK_GREETINGS: Readonly<
   night: Object.freeze([
     'Burning the midnight oil?',
     'Working late tonight?',
-    'The quiet hours. What are we tackling?',
+    'What are we tackling tonight?',
     'Still up? Let me help.',
     'Late one. Where should we start?',
   ]),
diff --git a/frontend/ai.client/src/branding/example-custom-brand.config.ts b/frontend/ai.client/src/branding/example-custom-brand.config.ts
index abe78fcba..debf5a8a4 100644
--- a/frontend/ai.client/src/branding/example-custom-brand.config.ts
+++ b/frontend/ai.client/src/branding/example-custom-brand.config.ts
@@ -23,8 +23,8 @@ export const BRAND_CONFIG: BrandConfig = {
   },
   appName: "Athletic Club Boise Logo",
   greetingTemplates: [
-  'How can I help you today, {name}?',
-  'What would you like to know, {name}?',
+  'How can I help, {name}?',
+  "What's on your mind, {name}?",
   'Ready to assist you, {name}!',
   'What can I do for you, {name}?',
   "Let's get started, {name}!",
@@ -42,7 +42,7 @@ export const BRAND_CONFIG: BrandConfig = {
   // bucket set to [] stays quiet at that hour — here, nobody is at the club at
   // 3am, so the night bucket says nothing club-specific.
   timeOfDayGreetings: {
-    morning: ['Good morning, {name}! Ready to train?', 'Early session, {name}?'],
+    morning: ['Ready to train, {name}?', 'Early session, {name}?'],
     afternoon: ['Good afternoon, {name}!', 'Squeezing one in, {name}?'],
     evening: ['Good evening, {name}!', 'Evening session, {name}?'],
     night: [],
diff --git a/frontend/ai.client/src/branding/greeting-line-length.spec.ts b/frontend/ai.client/src/branding/greeting-line-length.spec.ts
new file mode 100644
index 000000000..23c472d8f
--- /dev/null
+++ b/frontend/ai.client/src/branding/greeting-line-length.spec.ts
@@ -0,0 +1,164 @@
+// greeting-line-length.spec.ts
+//
+// Every greeting has to fit the Chat_Greeting_Block on ONE line.
+//
+// The block (`chat-container.component.html`, full-page empty state) is a
+// 720px column with 1rem of side padding holding a 56px logo, a 1rem gap and
+// the `text-4xl/tight` heading — so the heading gets a 616px text column.
+// `AnimatedTextComponent` types the greeting out a character at a time and
+// appends a `|` cursor while it runs, so a greeting that overflows does not
+// just look cramped: it visibly reflows onto a second line mid-animation, and
+// the block below it jumps. Nothing truncates, so the failure mode is always
+// the wrap.
+//
+// jsdom has no font metrics, so this measures with a table of per-character
+// advance widths captured from the real `InterVariable` woff2 at
+// `600 36px` with the app's `font-feature-settings`, in the app's own styled
+// heading. Summed advances track the browser's own layout of these strings to
+// within [-5.2px, +7.0px] across 455 name/greeting combinations (kerning is
+// what the table cannot see), which MEASUREMENT_TOLERANCE_PX covers.
+//
+// The stress name is 11 characters. The committed greetings were verified in
+// a real browser to hold one line at 12 ("Konstantinos"); the test asks for 11
+// plus tolerance so a new greeting has to clear the bar with room to spare
+// rather than land on it.
+//
+// Narrow viewports are deliberately out of scope: below ~720px the column is
+// the viewport, and no greeting worth writing fits a phone on one line.
+import { describe, it, expect } from 'vitest';
+
+import { BRAND_CONFIG } from './brand.config';
+import { BRAND_CONFIG as EXAMPLE_BRAND_CONFIG } from './example-custom-brand.config';
+import {
+  DEFAULT_GREETING,
+  DEFAULT_GREETING_TEMPLATES,
+  DEFAULT_FALLBACK_GREETINGS,
+  DEFAULT_TIME_OF_DAY_GREETING_TEMPLATES,
+  DEFAULT_TIME_OF_DAY_FALLBACK_GREETINGS,
+} from './brand.defaults';
+import type { PartOfDay, TimeOfDayGreetings } from './brand.types';
+
+/** 720px column − 2×1rem padding − 56px logo − 1rem gap. */
+const GREETING_TEXT_COLUMN_PX = 616;
+
+/** Longest first name the greetings are required to hold one line for. */
+const STRESS_NAME = 'Christopher';
+
+/** Kerning the advance table cannot see; measured worst case was 5.2px. */
+const MEASUREMENT_TOLERANCE_PX = 8;
+
+/**
+ * Per-character advance widths for InterVariable at `600 36px` with
+ * `font-feature-settings: 'cv02','cv03','cv04','cv11'`, measured in the
+ * browser against the app's own `<h1>`. Regenerate if the heading's font,
+ * weight or size changes.
+ */
+const ADVANCE_PX: Readonly<Record<string, number>> = Object.freeze({
+  ' ': 8.14, '!': 8.56, '"': 16.18, '#': 22.19, $: 23.03, '%': 32.63, '&': 22.83,
+  "'": 9.56, '(': 11.54, ')': 11.54, '*': 18.48, '+': 23.25, ',': 8.51, '-': 15.83,
+  '.': 8.51, '/': 12.63, ':': 8.51, ';': 8.59, '<': 23.25, '=': 23.25, '>': 23.25,
+  '?': 19.91, '@': 35.85, '[': 11.54, '\\': 10.35, ']': 11.54, '^': 16.36, _: 16.85,
+  '`': 9.97, '{': 15.16, '|': 11.87, '}': 15.16, '~': 23.25,
+  '0': 22.96, '1': 13.7, '2': 21.1, '3': 22.06, '4': 23.18,
+  '5': 21.32, '6': 21.24, '7': 20.05, '8': 21.73, '9': 21.24,
+  A: 25.35, B: 23.13, C: 26.09, D: 25.1, E: 21.54, F: 20.61, G: 26.42, H: 25.73,
+  I: 9, J: 19.91, K: 24.06, L: 19.78, M: 31.74, N: 25.93, O: 26.93, P: 22.49,
+  Q: 26.93, R: 23.19, S: 23.03, T: 22.57, U: 25.34, V: 25.49, W: 35.87, X: 24.48,
+  Y: 24.27, Z: 22.58,
+  a: 21.11, b: 21.13, c: 19.6, d: 21.13, e: 19.91, f: 11.03, g: 21.13, h: 20.61,
+  i: 8.37, j: 8.38, k: 19.3, l: 8.37, m: 31.28, n: 20.61, o: 20.52, p: 21.13,
+  q: 21.13, r: 13, s: 18.17, t: 11.23, u: 20.61, v: 19.43, w: 28.67, x: 18.97,
+  y: 19.43, z: 18.29,
+  '—': 36, '–': 18, '‘': 7.72, '’': 7.72, '“': 14.46, '”': 14.29,
+});
+
+/** Widest glyph in the table, charged for anything the table does not cover. */
+const WIDEST_ADVANCE_PX = Math.max(...Object.values(ADVANCE_PX));
+
+/** The `|` the animation appends while it is still typing. */
+const CURSOR_PX = ADVANCE_PX['|'];
+
+function renderedWidthPx(text: string): number {
+  let width = CURSOR_PX;
+  for (const char of text) width += ADVANCE_PX[char] ?? WIDEST_ADVANCE_PX;
+  return width;
+}
+
+/** The greeting as a user named `STRESS_NAME` sees it. */
+function resolved(greeting: string): string {
+  return greeting.replaceAll('{name}', STRESS_NAME);
+}
+
+function expectFitsOneLine(greeting: string): void {
+  const text = resolved(greeting);
+  const width = renderedWidthPx(text);
+  expect(
+    width + MEASUREMENT_TOLERANCE_PX,
+    `"${text}" needs ${width.toFixed(0)}px but the greeting column is ${GREETING_TEXT_COLUMN_PX}px — it will wrap. Shorten it.`,
+  ).toBeLessThanOrEqual(GREETING_TEXT_COLUMN_PX);
+}
+
+const PARTS_OF_DAY: readonly PartOfDay[] = ['morning', 'afternoon', 'evening', 'night'];
+
+function describeByPart(
+  label: string,
+  pools: Readonly<Record<PartOfDay, readonly string[]>> | TimeOfDayGreetings | undefined,
+): void {
+  describe(label, () => {
+    for (const part of PARTS_OF_DAY) {
+      const pool = pools?.[part] ?? [];
+      for (const greeting of pool) {
+        it(`${part}: ${greeting}`, () => expectFitsOneLine(greeting));
+      }
+    }
+  });
+}
+
+describe('greetings fit the Chat_Greeting_Block on one line', () => {
+  it('measures the animation cursor as part of the line', () => {
+    // Guard on the premise: an empty greeting is not zero-width on screen,
+    // because the cursor is already there before the first character lands.
+    expect(renderedWidthPx('')).toBe(CURSOR_PX);
+  });
+
+  describe('DEFAULT_GREETING_TEMPLATES', () => {
+    for (const greeting of DEFAULT_GREETING_TEMPLATES) {
+      it(greeting, () => expectFitsOneLine(greeting));
+    }
+  });
+
+  describe('DEFAULT_FALLBACK_GREETINGS', () => {
+    for (const greeting of DEFAULT_FALLBACK_GREETINGS) {
+      it(greeting, () => expectFitsOneLine(greeting));
+    }
+  });
+
+  describeByPart('DEFAULT_TIME_OF_DAY_GREETING_TEMPLATES', DEFAULT_TIME_OF_DAY_GREETING_TEMPLATES);
+  describeByPart('DEFAULT_TIME_OF_DAY_FALLBACK_GREETINGS', DEFAULT_TIME_OF_DAY_FALLBACK_GREETINGS);
+
+  it('DEFAULT_GREETING', () => expectFitsOneLine(DEFAULT_GREETING));
+
+  // The live config and the worked example are what a rebrand actually ships
+  // and what a Forker copies, so both are held to the same budget.
+  describe('BRAND_CONFIG', () => {
+    for (const greeting of [...BRAND_CONFIG.greetingTemplates, ...BRAND_CONFIG.fallbackGreetings]) {
+      it(greeting, () => expectFitsOneLine(greeting));
+    }
+  });
+  describeByPart('BRAND_CONFIG time-of-day', BRAND_CONFIG.timeOfDayGreetings);
+  describeByPart('BRAND_CONFIG time-of-day fallbacks', BRAND_CONFIG.timeOfDayFallbackGreetings);
+
+  describe('example-custom-brand.config', () => {
+    for (const greeting of [
+      ...EXAMPLE_BRAND_CONFIG.greetingTemplates,
+      ...EXAMPLE_BRAND_CONFIG.fallbackGreetings,
+    ]) {
+      it(greeting, () => expectFitsOneLine(greeting));
+    }
+  });
+  describeByPart('example-custom-brand time-of-day', EXAMPLE_BRAND_CONFIG.timeOfDayGreetings);
+  describeByPart(
+    'example-custom-brand time-of-day fallbacks',
+    EXAMPLE_BRAND_CONFIG.timeOfDayFallbackGreetings,
+  );
+});
diff --git a/infrastructure/jest.config.js b/infrastructure/jest.config.js
index e9a420407..15b3c4cbb 100644
--- a/infrastructure/jest.config.js
+++ b/infrastructure/jest.config.js
@@ -4,6 +4,12 @@ module.exports = {
   testMatch: ['**/*.test.ts'],
   transform: {
     '^.+\\.tsx?$': ['ts-jest', {
+      // Transpile-only: skip per-worker type-checking (each jest worker
+      // otherwise re-type-checks the whole project with no shared cache, the
+      // dominant cost of this suite). Type safety is enforced once by the
+      // `tsc --noEmit` step in the CI job (.github/workflows/tests.yml) and by
+      // `npm run build` locally. Safe here: no `const enum` in the tree.
+      isolatedModules: true,
       diagnostics: {
         ignoreCodes: [151002],
       },
diff --git a/infrastructure/package-lock.json b/infrastructure/package-lock.json
index 80def59b6..5f9634d68 100644
--- a/infrastructure/package-lock.json
+++ b/infrastructure/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "infrastructure",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "infrastructure",
-      "version": "1.21.0",
+      "version": "1.22.0",
       "dependencies": {
         "aws-cdk-lib": "2.265.0",
         "constructs": "10.6.0"
diff --git a/infrastructure/package.json b/infrastructure/package.json
index f2eb8c252..4503d8f14 100644
--- a/infrastructure/package.json
+++ b/infrastructure/package.json
@@ -1,6 +1,6 @@
 {
   "name": "infrastructure",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "bin": {
     "infrastructure": "bin/infrastructure.js"
   },
diff --git a/scripts/build/build-one.sh b/scripts/build/build-one.sh
index bfd4f1114..075bd3361 100755
--- a/scripts/build/build-one.sh
+++ b/scripts/build/build-one.sh
@@ -200,6 +200,7 @@ case "$SERVICE" in
         MANIFESTS=(
             "backend/src/apis/shared/__init__.py"
             "backend/src/apis/shared/errors.py"
+            "backend/src/apis/shared/feature_flags.py"
         )
         # Both scheduled-runs Lambdas are arm64 (see the scheduled-runs
         # CDK construct).
diff --git a/tui/pyproject.toml b/tui/pyproject.toml
index 47d6e34b0..9abf01b7d 100644
--- a/tui/pyproject.toml
+++ b/tui/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentcore-tui"
-version = "1.21.0"
+version = "1.22.0"
 requires-python = ">=3.11"
 description = "Terminal client for the AgentCore Public Stack — streaming AI chat in your terminal"
 readme = "README.md"
diff --git a/tui/src/agentcore_tui/__init__.py b/tui/src/agentcore_tui/__init__.py
index 936799a82..7b9dbb23a 100644
--- a/tui/src/agentcore_tui/__init__.py
+++ b/tui/src/agentcore_tui/__init__.py
@@ -7,6 +7,6 @@
 
 from __future__ import annotations
 
-__version__ = "1.21.0"
+__version__ = "1.22.0"
 
 __all__ = ["__version__"]
diff --git a/tui/uv.lock b/tui/uv.lock
index fc46e4f7b..27f110eb1 100644
--- a/tui/uv.lock
+++ b/tui/uv.lock
@@ -8,7 +8,7 @@ resolution-markers = [
 
 [[package]]
 name = "agentcore-tui"
-version = "1.21.0"
+version = "1.22.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },