@@ -135,14 +135,21 @@ private static GateEvaluation evaluateGateAfterSearchReset() {
     // candidateSeen bracket honest.
     int[] candidatesBefore = ReferenceChainTestHooks.selectLeakCandidateKlassIds0();
     ReferenceChainTestHooks.resetReferenceChainSearchForTest0();
-    int passesBefore = ReferenceChainTestHooks.referenceChainPassesRunForTest0();
+    // Sampled AFTER the reset, so not a pre-reset baseline: a value > 0 means a pass ENDED
+    // between the reset and this read (the reset zeroes the counter only at pass END, so a
+    // long in-flight pass is still invisible to this read - the candidate bracket plus
+    // checkNoCandidateFreeActivity's retry compensates for that blind spot).
+    int passesAfterReset = ReferenceChainTestHooks.referenceChainPassesRunForTest0();
     GateEvaluation e = new GateEvaluation();
     e.gateOpen = ReferenceChainTestHooks.shouldRunPassForTest0();
     int[] candidatesAfter = ReferenceChainTestHooks.selectLeakCandidateKlassIds0();
+    // Sampled after the gate call: a BFS pass racing between the gate evaluation and this read
+    // is conservatively attributed to the evaluation window (safe direction: it only widens
+    // the observed activity window, never masks a gate violation).
     e.passesAfter = ReferenceChainTestHooks.referenceChainPassesRunForTest0();
     e.candidateSeen = !isEmpty(candidatesBefore) || !isEmpty(candidatesAfter);
     e.detail = "candidatesBefore=" + Arrays.toString(candidatesBefore) + " candidatesAfter="
-        + Arrays.toString(candidatesAfter) + " passesBefore=" + passesBefore
+        + Arrays.toString(candidatesAfter) + " passesAfterReset=" + passesAfterReset
         + " passesAfter=" + e.passesAfter;
     return e;
   }
 
@@ -83,8 +83,8 @@ protected boolean isPlatformSupported() {
    * reading - so a closed result is final and only an open/matching result needs the retry.
    * The same real pass also produces the closed reading on its own, so a closed-direction probe
    * (a negated gate reading) must be bracketed by a check that the seeded state is still in force
-   * (see {@link #rootEnumClosedWithSeedIntact(long)}) - otherwise a closed result caused by a
-   * real pass would be accepted instead of retried.
+   * (see {@link #rootEnumClosedWithSeedIntact(long, Runnable)}) - otherwise a closed result
+   * caused by a real pass would be accepted instead of retried.
    */
   private static boolean eventuallyTrue(String message, Runnable seed,
                                         BooleanSupplier probe)
@@ -102,16 +102,35 @@ private static boolean eventuallyTrue(String message, Runnable seed,
 
   /**
    * Closed-direction root-enum probe (see eventuallyTrue): a closed gate counts only while the
-   * seeded floor is still in force. A concurrent real enumeration also closes the gate (it
-   * refreshes _last_root_enum_ns to "now"), so a bare closed reading cannot tell the seeded floor
-   * apart from that unrelated close. The two JNI calls take the engine lock separately; a real
-   * pass landing between them either changes the floor (the equality fails and the probe
-   * retries) or leaves it unchanged (the closed reading is still what the seeded floor predicts),
-   * so that window can cause a retry, never a false accept.
+   * seeded state is still in force, verified by a floor + pass-counter bracket around the gate
+   * read. A concurrent real enumeration also closes the gate (it refreshes _last_root_enum_ns to
+   * "now"), so a bare closed reading cannot tell the seeded floor apart from that unrelated
+   * close - and a floor-only bracket is not enough either: a real enumeration measuring a cost
+   * that re-derives the same floor (e.g. ~0 ms on a small graph vs the seeded 0 cost) would
+   * reproduce the seeded floor while the closed reading was actually caused by that enumeration.
+   *
+   * <p>The bracket is structurally airtight for pass-driven taint: real root enumeration runs
+   * ONLY inside a BFS pass ({@code runPassSerialized()} holds {@code _engine_lock} across the
+   * whole {@code runPass()}), and {@code _passes_run} increments only after the manual walk
+   * returns - so enumeration state and the pass counter flip together, and the probe's
+   * engine-lock-acquiring gate/floor reads can never observe one without the other: a completed
+   * pass always flips {@code p0 != p1}, and an enumeration whose measured cost shifts the floor
+   * flips {@code f1 != expectedFloorNs}. The probe also re-seeds immediately before reading,
+   * undoing any real enumeration that already completed and clobbered the seeded state, so only
+   * an enumeration landing DURING the read sequence can taint it - a microsecond window instead
+   * of the seed-to-probe gap. Premise: if a future change ever runs root enumeration outside a
+   * pass (outside {@code runPassSerialized()}'s lock hold), the pass-counter premise breaks and
+   * this bracket degrades to probabilistic - revisit it then.
    */
-  private static boolean rootEnumClosedWithSeedIntact(long expectedFloorNs) {
-    return !ReferenceChainTestHooks.shouldRunRootEnumForTest0(false)
-        && ReferenceChainTestHooks.rootEnumIntervalFloorNsForTest0() == expectedFloorNs;
+  private static boolean rootEnumClosedWithSeedIntact(long expectedFloorNs, Runnable seed) {
+    seed.run(); // re-seed immediately before reading: undoes any real enumeration that already
+                // completed and clobbered the seeded state.
+    int p0 = ReferenceChainTestHooks.referenceChainPassesRunForTest0();
+    long f0 = ReferenceChainTestHooks.rootEnumIntervalFloorNsForTest0();
+    boolean closed = !ReferenceChainTestHooks.shouldRunRootEnumForTest0(false);
+    long f1 = ReferenceChainTestHooks.rootEnumIntervalFloorNsForTest0();
+    int p1 = ReferenceChainTestHooks.referenceChainPassesRunForTest0();
+    return closed && p0 == p1 && f0 == expectedFloorNs && f1 == expectedFloorNs;
   }
 
   /** Seed relations the root-enum tests rely on, checked on the Java mirrors themselves. */
@@ -296,10 +315,11 @@ public void rootEnumWaitsForMinimumInterval() throws InterruptedException {
     assertRootEnumSeedAssumptions();
     ReferenceChainTestHooks.resetReferenceChainSearchForTest0();
     try {
+      Runnable seed = () -> ReferenceChainTestHooks.setReferenceChainRootEnumStateForTest0(
+          ROOT_ENUM_BEFORE_BASE_MS, 0);
       eventuallyTrue("Re-enumeration must wait out the base interval since the last attempt",
-          () -> ReferenceChainTestHooks.setReferenceChainRootEnumStateForTest0(
-              ROOT_ENUM_BEFORE_BASE_MS, 0),
-          () -> rootEnumClosedWithSeedIntact(ROOT_ENUM_MIN_INTERVAL_NS));
+          seed,
+          () -> rootEnumClosedWithSeedIntact(ROOT_ENUM_MIN_INTERVAL_NS, seed));
     } finally {
       ReferenceChainTestHooks.resetReferenceChainSearchForTest0();
     }
@@ -353,6 +373,8 @@ public void rootEnumIntervalExtendsWithMeasuredSafepointCost() throws Interrupte
     assertRootEnumSeedAssumptions();
     ReferenceChainTestHooks.resetReferenceChainSearchForTest0();
     try {
+      Runnable seed = () -> ReferenceChainTestHooks.setReferenceChainRootEnumStateForTest0(
+          ROOT_ENUM_PAST_BASE_MS, ROOT_ENUM_EXTENDING_COST_MS);
       // Positive control: the past-base seed alone opens the gate, so the closed reading below
       // is attributable to the cost-extended floor.
       eventuallyTrue("A past-base seed with no measured cost must open the gate",
@@ -369,10 +391,9 @@ public void rootEnumIntervalExtendsWithMeasuredSafepointCost() throws Interrupte
               == ROOT_ENUM_EXTENDING_COST_MS * ROOT_ENUM_NS_PER_COST_MS);
       eventuallyTrue("Re-enumeration must wait out the cost-extended interval even though the "
               + "base interval has elapsed",
-          () -> ReferenceChainTestHooks.setReferenceChainRootEnumStateForTest0(
-              ROOT_ENUM_PAST_BASE_MS, ROOT_ENUM_EXTENDING_COST_MS),
+          seed,
           () -> rootEnumClosedWithSeedIntact(
-              ROOT_ENUM_EXTENDING_COST_MS * ROOT_ENUM_NS_PER_COST_MS));
+              ROOT_ENUM_EXTENDING_COST_MS * ROOT_ENUM_NS_PER_COST_MS, seed));
     } finally {
       ReferenceChainTestHooks.resetReferenceChainSearchForTest0();
     }
@@ -385,6 +406,8 @@ public void rootEnumIntervalCapsAtMaximum() throws InterruptedException {
     assertRootEnumSeedAssumptions();
     ReferenceChainTestHooks.resetReferenceChainSearchForTest0();
     try {
+      Runnable seed = () -> ReferenceChainTestHooks.setReferenceChainRootEnumStateForTest0(
+          ROOT_ENUM_PAST_BASE_MS, ROOT_ENUM_CAPPING_COST_MS);
       // Positive control, as in rootEnumIntervalExtendsWithMeasuredSafepointCost.
       eventuallyTrue("A past-base seed with no measured cost must open the gate",
           () -> ReferenceChainTestHooks.setReferenceChainRootEnumStateForTest0(
@@ -398,9 +421,8 @@ public void rootEnumIntervalCapsAtMaximum() throws InterruptedException {
           () -> ReferenceChainTestHooks.rootEnumIntervalFloorNsForTest0()
               == ROOT_ENUM_MAX_INTERVAL_NS);
       eventuallyTrue("Re-enumeration must wait out the capped interval",
-          () -> ReferenceChainTestHooks.setReferenceChainRootEnumStateForTest0(
-              ROOT_ENUM_PAST_BASE_MS, ROOT_ENUM_CAPPING_COST_MS),
-          () -> rootEnumClosedWithSeedIntact(ROOT_ENUM_MAX_INTERVAL_NS));
+          seed,
+          () -> rootEnumClosedWithSeedIntact(ROOT_ENUM_MAX_INTERVAL_NS, seed));
       // An uncapped floor would still hold this age off.
       eventuallyTrue("Re-enumeration must run once the capped interval has elapsed",
           () -> ReferenceChainTestHooks.setReferenceChainRootEnumStateForTest0(
 
@@ -123,6 +123,15 @@ public class ReferenceChainTrackingTest extends AbstractProfilerTest {
   private static final long ABANDON_DUMP_RETRY_SPACING_MS = 1_000;
   private static final long ABANDON_LAST_DUMP_MIN_DELAY_MS = 8_000;
 
+  // Seam-driven passes are front-loaded onto the first GRACE_DRIVE_ATTEMPTS grace-loop
+  // attempts (8 passes each, 24 total); the remaining grace-loop attempts are poll-only
+  // (organic BFS cadence + 1s sleep + dump + match), so CI load does not scale with the loop
+  // width. Each driven pass serializes against the BFS thread via _engine_lock and feeds the
+  // shared pause-controller cost model (_effective_cadence_ns, _canary_pass_ema_ms,
+  // _cpu_pain_budget), and the deterministic-frontier claim needs only cumulative progress,
+  // which the front-loaded burst far exceeds.
+  private static final int GRACE_DRIVE_ATTEMPTS = 3;
+
   /**
    * The {@code datadog.ReferenceChain} ActiveSetting's {@code id} (flightRecorder.cpp's
    * T_REFERENCE_CHAIN). ActiveSetting events from cpu/wall/memory/nativemem also read
@@ -467,10 +476,15 @@ public void shouldReconstructReferrerChainToGcRoot() throws Exception {
       // for why that is load-bearing; the seam stubs are no-ops in release builds). Ten attempts,
       // matching the cache-leak test's loop: this fixture's ArrayList resizes churn the walked
       // element path just like the cache's HashMap resizes, so late-round discovery needs the
-      // same scheduling-independent margin.
+      // same scheduling-independent margin. The seam burst is capped at the first
+      // GRACE_DRIVE_ATTEMPTS attempts to bound synchronous heap-walk load on shared CI runners
+      // (each pass serializes against the BFS thread via _engine_lock and feeds the
+      // pause-controller cost model); the remaining attempts are poll-only on the organic cadence.
       JfrEvents lastEvents = null;
       for (int attempt = 0; match == null && attempt < 10; attempt++) {
-        driveReferenceChainPasses(8);
+        if (attempt < GRACE_DRIVE_ATTEMPTS) {
+          driveReferenceChainPasses(8);
+        }
         Thread.sleep(1000);
         dump(scratchDumpPath);
         lastEvents = verifyEvents(scratchDumpPath, "datadog.ReferenceChain", false);
@@ -691,10 +705,16 @@ public void shouldReconstructReferrerChainThroughUnboundedCacheLeak() throws Exc
       // duration). Driving passes here makes discovery depend on cumulative frontier progress,
       // which is deterministic, instead of on that scheduling. pollReferenceChainTargets0() after
       // each pass is what tags the candidate's tracked instances and polls the representative -
-      // the same per-iteration tail the BFS thread runs.
+      // the same per-iteration tail the BFS thread runs. The burst is capped at the first
+      // GRACE_DRIVE_ATTEMPTS attempts to bound synchronous heap-walk load on shared CI runners
+      // (each pass serializes against the BFS thread via _engine_lock and feeds the
+      // pause-controller cost model); the remaining attempts are poll-only on the organic
+      // cadence, which keeps this loop's load within the pre-seam 5-attempt shape.
       JfrEvents lastEvents = null;
       for (int attempt = 0; match == null && attempt < 10; attempt++) {
-        driveReferenceChainPasses(8);
+        if (attempt < GRACE_DRIVE_ATTEMPTS) {
+          driveReferenceChainPasses(8);
+        }
         Thread.sleep(1000);
         dump(scratchDumpPath);
         lastEvents = verifyEvents(scratchDumpPath, "datadog.ReferenceChain", false);
@@ -764,7 +784,13 @@ public void shouldReconstructReferrerChainThroughUnboundedCacheLeak() throws Exc
    * flakiness, observed in practice), the shared search can still be {@code RUNNING} with a large,
    * non-fresh frontier when this method starts - the fresh-search precondition is something this
    * method establishes, not something it presumes. Debug-only: the seam does not exist in a
-   * release build.
+   * release build, and the {@code assumeTrue} at the top of the method body skips this test
+   * there - a JUnit assumption failure is reported as SKIPPED, not passed, so coverage reports
+   * must not count it. By design, release-config runs (the {@code test:release} label)
+   * therefore exercise none of the {@code buildAbandonedEvent()} →
+   * {@code FlightRecorder::recordReferenceChainAbandoned()} write path; if the candidate-gate
+   * contract ever changes so a release build could reach {@code ABANDONED} without the debug
+   * population seams, this assumption must be revisited.
    *
    * <p><b>Why this method also seeds a klass population trend, despite requesting no
    * {@code generations=true} of its own:</b> {@code LivenessTracker::_gc_generations} is only ever
@@ -860,20 +886,25 @@ public void shouldReportAbandonedSearchOnTinyFrontierCap() throws Exception {
       // the frontier cap/ttl cutoff inside whatever wall-clock time this shared JVM's scheduling
       // grants it. The abandoned event only reaches the recording through a dump(), so each check
       // needs a fresh dump - and each dump rewrites the whole shared recording. Dumps are
-      // therefore capped at ABANDON_MAX_DUMPS and paced so the last one lands at least
-      // ABANDON_LAST_DUMP_MIN_DELAY_MS after the grace period started; the passesRun probe above
-      // absorbs most of the scheduling slack without any I/O.
+      // therefore capped at ABANDON_MAX_DUMPS and paced so that, when the loop runs to
+      // completion, the last one lands at or after ABANDON_LAST_DUMP_MIN_DELAY_MS after the
+      // grace period started (on the final attempt attemptsLeft == 1, so the sleep is
+      // Math.max(SPACING, full remaining); an early success break can land earlier, which is
+      // fine because the event was already found and the floor is moot); the passesRun probe
+      // above absorbs most of the scheduling slack without any I/O.
       long lastDumpEarliestNs =
           graceStartNs + TimeUnit.MILLISECONDS.toNanos(ABANDON_LAST_DUMP_MIN_DELAY_MS);
       JfrEvents abandoned = null;
       int dumpsTaken = 0;
+      long lastDumpAtNs = 0;
       for (int attempt = 0; attempt < ABANDON_MAX_DUMPS; attempt++) {
         if (attempt > 0) {
           int attemptsLeft = ABANDON_MAX_DUMPS - attempt; // includes the dump about to be taken
           long remainingMs =
               TimeUnit.NANOSECONDS.toMillis(lastDumpEarliestNs - System.nanoTime());
           Thread.sleep(Math.max(ABANDON_DUMP_RETRY_SPACING_MS, remainingMs / attemptsLeft));
         }
+        lastDumpAtNs = System.nanoTime();
         dump(dumpPath);
         dumpsTaken++;
         abandoned = verifyEvents(dumpPath, "datadog.ReferenceChainAbandoned", false);
@@ -885,8 +916,9 @@ public void shouldReportAbandonedSearchOnTinyFrontierCap() throws Exception {
           "Expected a datadog.ReferenceChainAbandoned event within " + dumpsTaken + " of at most "
               + ABANDON_MAX_DUMPS + " dumps (after 3 GCs and a 1500ms grace period; the pass "
               + "probe waited up to " + ABANDON_PASS_WAIT_MS + "ms, passesRun="
-              + ReferenceChainTestHooks.referenceChainPassesRunForTest0() + "; last dump >= "
-              + ABANDON_LAST_DUMP_MIN_DELAY_MS + "ms after grace start)");
+              + ReferenceChainTestHooks.referenceChainPassesRunForTest0() + "; last dump "
+              + TimeUnit.NANOSECONDS.toMillis(lastDumpAtNs - graceStartNs)
+              + "ms after grace start, nominal floor " + ABANDON_LAST_DUMP_MIN_DELAY_MS + "ms)");
     } finally {
       Files.deleteIfExists(dumpPath);
     }