diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 139980b..2c53740 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -158,7 +158,7 @@ jobs:
           docker run --rm proxy-workbench:ci clear-data --yes
           docker run --rm --entrypoint python proxy-workbench:ci -c "from proxy_workbench import source_catalog; assert source_catalog.load_bundled()['sources']"
 
-  # The .app users install (F23).  This job builds it on a real macOS runner,
+  # The .app users install.  This job builds it on a real macOS runner,
   # starts it, and checks the page it serves, its per-user data folder, a second
   # start and the untouched bundle.  It is unsigned - no identity exists in
   # this project - and the manifest says so.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2613984..a1e4b66 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -99,7 +99,7 @@ jobs:
           tag_name: ${{ env.TAG }}
           files: dist/*.whl
 
-  # The two Windows binaries F23 asks for: a windowed GUI and a separate
+  # The two Windows binaries: a windowed GUI and a separate
   # console CLI, plus the per-user installer.  Nothing here is signed - a
   # certificate would have to exist in the runner's certificate store and be
   # named by PROXY_WORKBENCH_SIGN_THUMBPRINT, and until one does the manifest
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 93809a7..137cf58 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -1,6 +1,6 @@
 name: Windows desktop artifact
 
-# The Windows half of F23.  A .exe can only be built and started on Windows,
+# The Windows delivery.  A .exe can only be built and started on Windows,
 # so a macOS or Linux build never proves anything about this one: the job below
 # is what makes the claim checkable by whoever has a Windows machine, and by
 # everyone else through the run log.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1c9621c..a8b8d2e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,56 +1,78 @@
 # Changelog / История изменений
 
-Формат следует Keep a Changelog и semantic versioning.
+The format follows Keep a Changelog and semantic versioning.
 
-## [Unreleased]
+## [3.0.0] — 2026-09-27
 
-### Added
+The biggest release so far: a new interface, a source catalog of 150 lists, a desktop app that lives in the menu bar, persistent proxy pools with schedules, API keys, diagnostics that explain an empty result, and backups you can preview before restoring. Existing data folders are upgraded in place, with an automatic copy taken first.
 
-- **Точка входа доходит до фонового слоя.** `proxy-workbench` и `python -m proxy_workbench` без аргументов запускают приложение (`proxy_workbench.desktop`): меню-бар на macOS, один экземпляр, запуск при входе по желанию, сон/пробуждение. `gui` и `--no-desktop` открывают только интерфейс; всё остальное уходит в CLI, как и раньше. Раньше обычный запуск уходил в `gui.main`, и фоновый слой не работал в том виде, в котором его запускает пользователь.
-- **Меню-бар входит в собранный `.app`.** Helper на Swift компилируется сборкой (`packaging/tray_helper.py`) и кладётся в bundle; spec без него прерывает сборку. Раньше приложение запускалось и не имело меню-бара.
-- **Замороженная сборка умеет выполнять проверку.** Worker — это повторный запуск того же исполняемого файла с командой `scan`; frozen launcher маршрутизирует командные слова в CLI тем же правилом, что и консольный скрипт. Раньше такая попытка заканчивалась `unrecognized arguments: scan`, то есть установленное приложение не могло проверить ни одного прокси.
-- **`packaging/verify_delivery.py`** — per-user пути, portable mode и перенос старой папки, проверенные на настоящем собранном артефакте, а не на коде.
-- **Windows-поставка проверяется сама.** Сборщик читает PE-subsystem из готового `.exe` и отказывается выпускать пару, в которой GUI-бинарник не windowed или CLI не console; запускает GUI-бинарник с пустым `%LOCALAPPDATA%` и проверяет второй запуск; передаёт установщику абсолютные пути и ищет `iscc` в стандартных папках.
-- **CI, который проверяет артефакты.** `.github/workflows/windows.yml` собирает и запускает Windows-поставку на настоящем Windows-runner; job `macos-artifact` в `ci.yml` собирает `.app`, прогоняет smoke по собранному бинарнику и сверяет манифест; `release.yml` отдаёт два Windows-бинарника с per-user installer и macOS-артефакт.
-- **Версия пакета приведена к версии продукта:** `pyproject.toml` был `2.2.1`, `branding.PRODUCT_VERSION` — `2.3.0`, и bundle объявлял одно число, а wheel — другое.
-
-- **Версионированный control API `/v1`** — 82 маршрута: коллекции, источники, профили, задания, результаты, пулы, шлюз, расписания, экспорты, бронирования, импорты и ключи. Машиночитаемое описание — `proxy_workbench/openapi.json`, генерируется из той же таблицы маршрутов, по которой отвечает сервер.
-- **Менеджер API-ключей** в GUI и CLI (`api-key`): именованные ключи, права, resource scope (коллекции и пулы), лимит частоты, параллелизм, срок, ротация с окном Grace, отзыв и журнал аудита. Первый административный ключ выдаёт только локальный доверенный bootstrap.
-- **Именованные профили с ревизиями и пресеты**, **пулы** с реальным циклом поддержания, **расписания**, **менеджер источников** с отчётами по каждому источнику.
-- **`diagnose funnel|zero|control|health|bundle`** — счётчики воронки, объяснение нулевого результата, контроль устройства и целей, редактированный диагностический пакет. Слой диагностики существовал и был недостижим.
-- **`backup verify|preview|restore|rollback|retention|cleanup|rebind`** — вторая половина F24. Каждое изменяющее действие сначала печатает, что сделает, и выполняется только с `--apply`.
-- **Подписки** как узкое, ограниченное по сроку и отзываемое identity, и настольная поставка для macOS (`.app`/`.dmg`), Windows и Linux с per-user путями данных и portable-режимом.
-- `include_secrets` публикует **ссылку** на запись хранилища, а не значение секрета.
+### Highlights
 
-### Fixed
+- **Redesigned interface.** A new dark-first design layer with a reworked light theme, consistent typography, micro-animations and a live feed of the running check. The layout adapts to phones and tablets (a side rail on tablets, a compact layout on phones), and heavy tables stay smooth on large result sets.
+- **12 interface languages.** English and Russian are joined by German, Spanish, French, Italian, Japanese, Polish, Portuguese, Turkish, Ukrainian and Chinese, every one of them complete.
+- **Source catalog: 150 sources, 117 of them fully free and public; 106 feeds are collected out of the box.** Every entry says who publishes it, what it serves (proxy list, subscription config, API), whether an account is needed, which protocols it carries and how it was verified. Ready-made sets (quick, all supported, extended, by protocol), one-click enable/disable, per-source reports and a comparison that spots lists which republish each other. Only sources marked safe to collect are fetched; commercial, trial and rejected entries are shown for reference.
+- **Desktop app.** Starting `proxy-workbench` without arguments now launches the desktop app: a macOS menu-bar icon, a single running instance, optional start at login, and correct recovery after sleep/wake. `proxy-workbench gui` (or `--no-desktop`) opens only the web interface, as before.
+- **Proper installers.** A macOS `.app`/`.dmg` (Apple Silicon and Intel) and Windows GUI and CLI executables with a per-user installer; Linux installs with `pipx` or Docker. Data lives in per-user folders, with a portable mode and automatic migration of an old `data/` folder.
 
-- **Поколение снова множество адресов.** Повторная проверка добавляла вторую строку того же адреса, каждый потребитель судил строки независимо, и адрес попадал дважды в `proxies.txt`, `ranked.json`, `ranked.csv`, `proxy.pac`, `clash.yaml`, `singbox.json` и в `/proxies`. Теперь у `results` одна строка на (профиль, доступ, адрес), схлопнутая история суммируется, `job_id` остаётся колонкой последнего измерения. Версия схемы 15.
-- **Свежий провал отменяет старый успех.** Строка с ошибкой отвергалась, а устаревшая сохраняла свой не истёкший `valid_until`, и опубликованный набор продолжал отдавать адрес, который последнее измерение только что отвергло.
-- **Обновление промежуточной сборки обратимо.** Техническая копия с manifest берётся перед любой неаддитивной миграцией, а не только для legacy-файла с `user_version = 0`: сборка линии 1.x переписывала `results` без страховки, и `list_backups()` показывал пусто.
-- **Legacy-результаты остаются читаемыми.** Миграция 13 писала восстановленное происхождение в колонки, которые никто не читает, и каждая historic-строка отказывала по коллекции, в которой не измерялась. Теперь оно доходит до payload; то, чего файл 2.x не содержал (сеть, lifetime), отсутствует по-прежнему, и отказ называет эту настоящую причину.
-- **Штатная retention-политика выполняется.** Она удаляла `observations` раньше ссылающихся на них `results`, SQLite отвергал, откат оставлял данные на месте — после того, как preview уже пообещал удаление.
-- **Object-level scope проверяется.** Чтение и скачивание артефакта чужой коллекции отвечали 200; список заданий, профилей, источников или расписаний возвращался ключу, ограниченному одной коллекцией, потому что фильтр спрашивал вид scope, которого у ключа нет. Один объект вне scope — 404; список теряет только чужие строки.
-- **Чувствительный экспорт работает.** `include_secrets` передавал имя режима вне словаря движка, запрос отвергался после уже пройденной проверки права, а отказ выдавался за «операция не подключена к сервисному слою». Доменный отказ теперь отвечает своим кодом.
-- **Пароль шлюза не равен токену API.** `serve` и `gateway` использовали одно значение `--api-token` и как пароль ротирующего прокси, и как read-only bearer. У шлюза свой `--gateway-token` / `PROXY_WORKBENCH_GATEWAY_TOKEN`; поставляемый compose использует обе переменные.
-- **`POST /v1/pools/{id}/refill` наполняет пул.** Он не читал путь, ставил в очередь проверку коллекции из тела и оставлял пул на 0/desired, отвечая «job queued». `/start` теперь запускает пул, `/recheck` измеряет его собственную коллекцию, а `/start`, `/pause` и `/members` больше не отвечают 500.
-- **`/v1/results/{id}` и `/v1/results/{id}/observations` возвращают данные.** Сегмент пути не может нести полный адрес, а строка не публиковала `endpoint_id`, поэтому detail был всегда 404, а observations — пустым списком.
-- **`--max-requests` и `--run-max-bytes` считают.** Ресурсный шлюз не начислял потраченное измерением, и оба лимита были молчаливыми no-op. Исчерпанный бюджет теперь останавливает прогон, а не записывает нетронутый адрес как недостижимый.
-- **N endpoint, N уникальных IP и N подтверждённых exit-IP — три разных числа.** Последние два были одним выражением и всегда давали 0, потому что подтверждённый адрес выхода искали не там. Прогон, закончившийся недобором `--want`, называет недостижимую единицу вместо `complete`.
+### Added
+
+- **Pools.** A named pool keeps N working proxies for a profile, with a reserve, quotas and resource budgets; it refills and re-checks itself, and tells you why it is short.
+- **Schedules.** Re-check collections or pools on an interval, in your time zone, with quiet hours, request/byte budgets and notifications when a proxy's state changes.
+- **Named profiles with revisions and presets.** Target rules, success criteria and settings are saved as profiles; every change is a revision, and profiles can be shared without secrets.
+- **Collections and import.** Bring your own lists from TXT, URI, CSV, JSON, Clash or sing-box files with a preview, column mapping and a report of every rejected line; imports are transactional and merge or replace.
+- **Service catalog.** Ready-made checks for popular services, grouped into sets, with an explicit rule for which fields a preset overwrites.
+- **Geography and exit country.** Filter by the proxy's own country, the country traffic actually exits from, or either; exclude countries; choose how unknown locations are treated.
+- **Rotating gateway, upgraded.** Bind the gateway to a pool from the GUI, serve it on your LAN (`--lan`, `--gateway-interface`), and use upstream proxies that need a login (HTTP Basic, SOCKS5 username/password). The gateway has its own password (`--gateway-token`), separate from the API token.
+- **API keys.** Create named keys with permissions, collection/pool scope, rate and concurrency limits, expiry, rotation with a grace window, revocation and an audit log — in the GUI (Keys page) and the CLI (`api-key`). A secret is shown exactly once.
+- **Secret store and access identities.** Proxy credentials are stored separately and referenced, never copied into exports or diagnostics.
+- **Diagnostics.** A funnel shows where candidates were lost; "why 0 results" explains an empty run in plain words; a health check; and a redacted diagnostic bundle you can review before saving (`diagnose funnel|zero|control|health|bundle`).
+- **Backup, restore and retention with preview.** `backup create|list|verify|preview|restore|rollback|retention|cleanup|rebind`; every change is previewed first and runs only with `--apply` (or the confirm button in the GUI).
+- **Run budgets and "find N".** `--want N` with `--count-what endpoint|ip|exit`, `--deadline`, `--max-requests`, `--run-max-bytes`; a run that falls short says which unit it could not reach.
+- **Export targets.** `--client-target` / `--client-binary` validate sing-box output for a specific client version.
+- **Versioned control API `/v1`** for scripts and integrations: collections, sources, profiles, jobs, results, pools, gateway, schedules, exports, imports and keys. A machine-readable description ships as `proxy_workbench/openapi.json`.
 
 ### Changed
 
-- Схема базы на версии 15; за ней следуют константа настольной поставки и `openapi.json`.
-- Лимиты по умолчанию на источник — 32 МиБ и 500 000 кандидатов, чтобы крупнейшие публичные списки не обрезались.
+- **Breaking:** running `proxy-workbench` / `python -m proxy_workbench` with no arguments opens the desktop app instead of only the web interface. Use `proxy-workbench gui` for the old behaviour. All CLI commands are unchanged.
+- **Breaking:** the database schema moves to version 20. Older data folders (1.x and 2.x) are migrated on first start; a backup is taken before any non-additive step and can be restored with `backup rollback`. Do not open an upgraded folder with 2.x.
+- **Breaking:** the rotating gateway no longer accepts the API token as its password; set `--gateway-token` / `PROXY_WORKBENCH_GATEWAY_TOKEN`. The bundled `compose.yml` already does.
+- Each proxy address is now one row per profile and access identity, so an address no longer appears twice in `proxies.txt`, `ranked.*`, `proxy.pac`, `clash.yaml`, `singbox.json` or `/proxies`.
+- Python 3.11 or newer; CI tests 3.11, 3.12 and 3.14 on Linux, macOS and Windows.
 
-### Known gaps
+### Fixed
 
-- Аутентификация на прокси (HTTP Basic и SOCKS5 username/password) не реализована ни в одном движке проб: credentials в URL отвергаются, а идентичность доступа записывается, но сам секрет не отправляется. Поэтому `results.access_id` всегда называет identity, под которым строка измерена, а для встроенного скана это публичная, без пароля.
-- **Windows-поставка не собрана и не запущена.** Машина сборки — macOS, а PyInstaller собирает под свою машину. Проверено без Windows: разбор и фактический запуск всех spec'ов, entry point, `console=False`/`console=True`, наличие ресурсов, чтение PE-subsystem, передача путей установщику, поиск `iscc`. Воспроизводимая проверка добавлена в `.github/workflows/windows.yml`, но ещё ни разу не выполнялась. Матрица сборок и точные команды — в `docs/packaging/RELEASE-NOTES.ru.md`.
-- **Артефакты не подписаны и не нотарифицированы.** Signing credentials у проекта нет, и пайплайн их не создаёт; macOS-сборка получает ad-hoc подпись, Windows остаётся без Authenticode. Пайплайн подхватит уже имеющийся Developer ID и учётные данные нотаризации, когда они появятся.
-- Меню-бар есть только на macOS. Sleep/wake на Windows не определяется: сон входит в монотонные часы, а нативного наблюдателя для Windows в слое нет. На Linux работает сравнение часов, но и оно не проверялось на живой машине.
-- Автоматической загрузки обновлений нет: есть проверка происхождения, backup, проверка схемы, откат и `--update-notice`. Публикующего сервера у проекта нет.
-- Карточка сравнения источников и провайдеров (F21) не реализована.
-- `pipeline.Pipeline`/`run_pipeline` проверяются своими бенчмарками, но продукт сканирует через `proxytool.scan`, который делит с ними бюджеты, шлюз, ledger и политику find-N.
+- **Checks are much faster on real-world lists.** A scan no longer waits on its own database lock for every job item, and dead proxies no longer push the number of parallel checks down to one: 3,000 mostly dead candidates now take seconds instead of hours. Running out of file descriptors is no longer recorded as a dead proxy.
+- **The database no longer grows without limit under `--watch`.** Each source keeps its last three downloaded lists; older ones are pruned right after a collection, and `backup retention` cleans up history left by earlier versions. A list the server reports as unchanged is re-applied to collections that lost it, and a retry after a broken download no longer counts the first attempt against the size limit.
+- **Collecting is faster and reads more lists.** Addresses are written in batches (a full collection of the 106 default feeds went from 133 s to 79 s); four sources that returned nothing (hideip.me, spys.me and others with `ip:port` lines and comments) now return addresses; a list that exceeds the size limit is reported as a partial read instead of a failing provider and is no longer put into backoff; a list without country data no longer erases a country learned elsewhere; cached lists are re-read after a failed or refused download.
+- **Control API checked operation by operation.** The audit log is written; a key limited to one collection or pool can no longer act on others through body or query fields; event streams deliver events; result paging moves past the first page and every declared filter and sort works; unknown jobs, pools and sources answer 404; refreshing a source returns a job; PUT and wrong methods get JSON errors; `localhost` reaches `/v1`.
+- The web interface no longer puts the administrator key in a URL.
+- Collections can be renamed, archived and restored through the API with revision checks; merge and replace work; members are validated; pools and schedules refuse unknown profiles and collections; gateway settings and bindings set through the API are stored and listed; an active key must be revoked before it is deleted; with `serve --host 0.0.0.0` the API accepts the machine's own addresses and hostname.
+- **Stopping and resuming works.** A stopped or crashed check no longer leaves its job running, which made every later check fail with “Busy”; running the same command again continues where it stopped without re-measuring finished addresses.
+- **`--watch` really re-checks.** Every round now measures the passing proxies again; before, rounds after the first measured nothing and republished old results.
+- **A busy host no longer holds up other hosts**, and `--want` stops as soon as the target is reached even when workers waited for a host (30 ports on one IP with `--want 5`: 8 measured instead of 30).
+- `hostport.txt` lists an address once even when it passed as several protocols; a speed test sample below 1 MiB is refused because it can never give a result.
+- The chosen interface language is kept after a restart; before, ten of the twelve languages fell back to English on the next start.
+- Results table cells stay under their own headers when some columns are hidden.
+- Results table text is readable in the light theme.
+- A fresh failure now withdraws an older success, so a published list no longer serves an address the latest check rejected.
+- Retention cleanup runs instead of being rolled back by SQLite.
+- Keys limited to one collection can no longer read other collections' jobs, profiles, sources, schedules or artifacts.
+- `--max-requests` and `--run-max-bytes` actually limit a run.
+- Pool refill, start, pause and member listing through the API work.
+- Collecting treats HTTP 304 as a cached answer, not an empty list; oversized sources are capped without losing already parsed data.
+- Windows: time zones, HTTP handling and coarse-clock timing issues.
+- Windows installer: the “Command line” shortcuts open a console with the CLI instead of doing nothing, and a new PATH entry works in new consoles without signing out.
+- Windows: the app can be quit from the Start menu (“Quit Proxy Workbench”, or `proxy-workbench --quit`), and uninstalling quits a running app first.
+
+### Known limitations
+
+- Checking your own proxies that require a login is not supported yet: the checker refuses credentials in proxy URLs (the gateway can use them).
+- The menu-bar icon exists on macOS only; sleep/wake is not detected natively on Windows.
+- Builds are not code-signed or notarized: macOS will ask you to confirm the first launch, Windows SmartScreen may warn.
+- There is no automatic updater; the app can tell you an update exists.
+- Gateway settings saved through the API are stored and listed but not yet applied when the gateway starts; the command line and interface options are used.
+- The Windows uninstaller leaves the optional PATH entry in place.
+- Figures in this release come from local tests and mock services; the quality of public proxies was not measured.
 
 ## [2.2.1] — 2026-09-25
 
diff --git a/README.md b/README.md
index d90d56f..0907c0c 100644
--- a/README.md
+++ b/README.md
@@ -4,9 +4,11 @@
 
 # Proxy Workbench
 
-**Collect free public proxies from a catalog of 150 entries with 106 collectable feeds, test every one against _your_ services, and keep only the fast, stable, clean and anonymous ones.**
+### Finds free proxies that actually work — on the sites you need
 
-Local browser GUI (English / Russian) + CLI · HTTP / HTTPS (CONNECT) / SOCKS5 · anonymity levels · resumable · no accounts, no telemetry
+Proxy Workbench collects free proxies from **150 public sources**, tests every one against the sites and services **you** care about, and keeps only the ones that work. You get ready-made lists, one **rotating proxy** for your browser, Telegram and any app, or an **API** for your scripts.
+
+Runs on your own computer: macOS and Windows app, command line, Docker · HTTP, HTTPS, SOCKS4, SOCKS5 · 12 languages · no sign-up, no telemetry
 
 ![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB?logo=python&logoColor=white)
 ![License: MIT](https://img.shields.io/badge/license-MIT-2ea44f)
@@ -16,27 +18,25 @@ Local browser GUI (English / Russian) + CLI · HTTP / HTTPS (CONNECT) / SOCKS5 
 
 **English** · [Русский](README.ru.md)
 
-[Quick start](#-quick-start) · [Features](#-features) · [How it works](#-how-it-works) · [CLI](#-command-line) · [FAQ](#-faq) · [Roadmap](#-roadmap) · [Contributing](CONTRIBUTING.md)
+[Quick start](#-quick-start) · [Features](#-features) · [How it works](#-how-it-works) · [CLI](#-command-line) · [FAQ](#-faq) · [Roadmap](#-roadmap)
 
 <br>
 
 <img src="docs/assets/demo.gif" alt="Proxy Workbench demo: scan, rank, filter elite proxies" width="100%">
 
-<sub>15-second tour: start a scan → ranking → “Elite only” filter → per-attempt details → EN/RU switch (synthetic data).</sub>
+<sub>Quick tour: set up a check → ranking → “Elite only” filter → per-attempt details → sources → switching language (synthetic data).</sub>
 
 </div>
 
 ---
 
-## Why
-
-Free proxy lists are everywhere, but most of what they contain is dead, slow, or blocked by the site you actually care about. A proxy that answers `example.com` may still fail your API, return a captcha page with status `200`, or sit on a spam blacklist.
+## What it does
 
-**Proxy Workbench answers one practical question: _which of these proxies really work for my service, right now, and how well?_**
+Free proxy lists are everywhere, but most addresses in them are dead, slow or blocked by exactly the site you care about. Proxy Workbench does the tedious part for you:
 
-- It gathers candidates from dozens of public lists (or your own files) and de-duplicates them.
-- It sends **real HTTP(S) requests through each proxy** to every service you specify — several times — and checks status codes, body text, or even a SHA-256 of the response.
-- It ranks survivors by **median latency, jitter and success rate**, flags **blacklisted IPs** (local denylist + optional DNSBL), rates **anonymity** (transparent / anonymous / elite) and exports TXT / CSV / JSON plus ready-to-use `host:port` lists per protocol.
+1. **Collect.** Downloads addresses from 150 public sources (106 enabled out of the box) or your own files and removes duplicates.
+2. **Check.** Sends real requests through every proxy to your sites — several times — and checks the status code, required text on the page and speed. It also finds the country, the anonymity level (transparent / anonymous / elite) and whether the IP is blacklisted.
+3. **Deliver.** The best proxies land in TXT / CSV / JSON files, browser, Clash and sing-box configs, a rotating proxy at `127.0.0.1:8899`, and an API. Pools and schedules keep the list fresh on their own.
 
 Everything runs on your machine. The GUI binds to `127.0.0.1` only.
 
@@ -53,7 +53,7 @@ Everything runs on your machine. The GUI binds to `127.0.0.1` only.
 </tr>
 </table>
 
-<sub>Screenshots use synthetic data from documentation IP ranges (RFC 5737). The interface is available in English and Russian (EN/RU toggle in the header).</sub>
+<sub>Screenshots use synthetic data from documentation IP ranges (RFC 5737). The interface speaks 12 languages (language menu in the header).</sub>
 
 ## ✨ Features
 
@@ -83,8 +83,15 @@ Everything runs on your machine. The GUI binds to `127.0.0.1` only.
 | **Exit country** | The anonymity judge also reports the address the traffic really leaves from; the table shows `DE → NL` when it differs from the proxy's own country. |
 | **Local API for your code** | The GUI (or `serve` on a server) answers `GET /random?protocol=socks5&country=DE` or `/proxies?max_latency=800&format=txt` with the freshest working proxies, so scripts, scrapers and bots can pick a proxy with one HTTP request. |
 | **Safe by default** | Loopback-only GUI with a per-session token, CSRF/Host checks, SSRF-hardened source fetching (no private/metadata IPs, validated redirects, size limits), credential-like headers rejected. |
-| **English & Russian UI** | Switch with the EN/RU button; defaults to your browser language. Dark and light themes. |
-| **Zero setup** | A Windows `.exe` that needs nothing else, `pipx install`, Docker Compose, or a double-click launcher that creates its own virtual environment. |
+| **Desktop app** | Runs in the macOS menu bar with pause/start, optional start at login and one running instance; recovers correctly after sleep. The browser interface opens from it. |
+| **Pools** | A named pool keeps N working proxies for a profile, with a reserve, quotas and budgets; it refills and re-checks itself and says why it is short. |
+| **Schedules** | Re-check a collection or a pool on an interval in your time zone, with quiet hours, request/byte budgets and notifications when a proxy changes state. |
+| **Profiles and import** | Save targets and rules as named profiles with revisions. Import your own lists from TXT, URI, CSV, JSON, Clash or sing-box with a preview, column mapping and a report of every rejected line. |
+| **API keys** | Named keys with permissions, collection/pool scope, rate and concurrency limits, expiry, rotation and an audit log — on the **Keys** page or with `api-key`. |
+| **Diagnostics** | A funnel shows where candidates were lost, “why 0 results” explains an empty run in plain words, and a redacted diagnostic bundle can be reviewed before saving. |
+| **Backup and restore** | Backups, restore, rollback and retention cleanup, each previewed before it runs; data folders from older versions are upgraded automatically with a backup taken first. |
+| **12 languages** | English, Russian, Ukrainian, German, Spanish, French, Italian, Portuguese, Polish, Turkish, Japanese and Chinese; defaults to your system language. Redesigned dark and light themes that adapt to phones and tablets. |
+| **Zero setup** | A macOS `.dmg`, a Windows installer (or portable `.zip`), `pipx install`, Docker Compose, or a double-click launcher that creates its own virtual environment. |
 
 ## 🚀 Quick start
 
@@ -92,7 +99,7 @@ Pick one way to install:
 
 | Way | How | Needs |
 | --- | --- | --- |
-| **macOS app** | Download `proxy-workbench-…-macos-arm64.dmg` from the [latest release](https://github.com/DavidVoitenko/proxy-workbench/releases/latest) and drag `Proxy Workbench.app` into Applications | macOS 11+, Apple Silicon |
+| **macOS app** | Download `proxy-workbench-…-macos-arm64.dmg` from the [latest release](https://github.com/DavidVoitenko/proxy-workbench/releases/latest) and drag `Proxy Workbench.app` into Applications | macOS 11+, Apple Silicon (`arm64`) or Intel (`x86_64`) |
 | **Windows app** | Download `proxy-workbench-…-windows-x64-setup.exe` from the [latest release](https://github.com/DavidVoitenko/proxy-workbench/releases/latest) and run it; there is a portable `.zip` too, and a separate `proxy-workbench-cli.exe` for the command line | nothing else |
 | **pipx** (Windows, macOS, Linux) | `pipx install git+https://github.com/DavidVoitenko/proxy-workbench` then `proxy-workbench` | Python 3.11+ and [pipx](https://pypa.io/pipx/) |
 | **Source folder** | Download the code (**Code → Download ZIP** or `git clone`), then double-click `Start.bat` (Windows) / `Start.command` (macOS) or run `./run.sh` (Linux) | Python 3.11+ |
@@ -107,7 +114,7 @@ proxy-workbench --no-desktop     # the same, spelled the other way
 proxy-workbench --print-paths    # which data/cache/log folders this launch would use
 ```
 
-Installed builds keep their data in your own per-user folders (`%LOCALAPPDATA%\proxy-workbench`, `~/Library/Application Support/proxy-workbench` or `~/.local/share/proxy-workbench`) and never write into their own program folder; a source checkout keeps `data/` next to the project; `PROXY_WORKBENCH_DATA` overrides all of it. Portable mode is opt-in — see [docs/packaging/README.md](docs/packaging/README.md).
+Installed builds keep their data in your own per-user folders (`%LOCALAPPDATA%\proxy-workbench`, `~/Library/Application Support/proxy-workbench` or `~/.local/share/proxy-workbench`) and never write into their own program folder; a source checkout keeps `data/` next to the project; `PROXY_WORKBENCH_DATA` overrides all of it. Portable mode is opt-in: put an empty `proxy-workbench-portable.json` next to the program and it keeps its data beside itself.
 
 Release artifacts are **not code-signed**: this project has no signing certificate, and the release notes and the manifest say `signed: false` rather than claiming otherwise. macOS Gatekeeper therefore asks you to confirm the first start, and Windows SmartScreen may too (**More info → Run anyway**). Every release lists its SHA-256 checksum, which proves the file is the one that was published — it does not identify a publisher.
 
@@ -283,7 +290,7 @@ curl -x socks5h://127.0.0.1:8899 https://example.org/
 
 On a server, start it with `./run.sh gateway` and narrow the pool with the usual filters, for example `gateway --protocol socks5 --country DE --max-latency 1500`. Binding to a network address (`--host 0.0.0.0`) requires a password: `--gateway-token <secret>`, or the `PROXY_WORKBENCH_GATEWAY_TOKEN` variable; when it is not given the gateway makes one and prints it. Clients then log in with any user name and that password, over HTTP Basic or SOCKS5 user/password.
 
-**The gateway password is not the API token.** They are separate identities on purpose (`CONTRACTS §5.1`): whoever knows the password you handed to a phone must not be able to read the published snapshot, and a leaked API token must not be a working proxy. Pass `--api-token` to `serve` and `--gateway-token` to `gateway`; `compose.yml` shows both variables.
+**The gateway password is not the API token.** They are separate identities on purpose: whoever knows the password you handed to a phone must not be able to read the published snapshot, and a leaked API token must not be a working proxy. Pass `--api-token` to `serve` and `--gateway-token` to `gateway`; `compose.yml` shows both variables.
 
 Browser without extensions: use `http://127.0.0.1:8765/pac` as the automatic proxy configuration URL. It serves the 10 best matching proxies and accepts the same filters as the API, for example `/pac?country=DE`. `/clash` returns a complete Clash / Mihomo config.
 
@@ -393,7 +400,7 @@ Everything is written to one data folder. Which folder that is depends on how yo
 | Installed build (`.app`, `.exe`) | your own per-user folders: `~/Library/Application Support/proxy-workbench` on macOS, `%LOCALAPPDATA%\proxy-workbench` on Windows, `$XDG_DATA_HOME/proxy-workbench` on Linux |
 | Portable build (only if you ask for it) | next to the program, inside the `.app` or beside the `.exe` |
 
-An installed program **never** writes into its own folder: `.app` bundles and `Program Files` are read-only, and a build that tried would not start. Portable mode is opt-in and never happens just because a folder happens to be writable — see `docs/packaging/README.md`.
+An installed program **never** writes into its own folder: `.app` bundles and `Program Files` are read-only, and a build that tried would not start. Portable mode is opt-in (a `proxy-workbench-portable.json` file next to the program) and never happens just because a folder happens to be writable.
 
 | Path | Content |
 | --- | --- |
@@ -417,7 +424,7 @@ Delete it any time with `./run.sh clear-data --yes` or the button on the **How i
 ## ❓ FAQ
 
 **Does this make me anonymous?**
-No. Proxy Workbench measures _reachability and latency_. A public proxy sees your IP, your destination and — for plain HTTP — your traffic. Never send passwords, cookies or tokens through untrusted public proxies. See [PRIVACY.md](PRIVACY.md).
+No. Proxy Workbench measures _reachability and latency_. A public proxy sees your IP, your destination and — for plain HTTP — your traffic. Never send passwords, cookies or tokens through untrusted public proxies. Proxy Workbench itself sends no telemetry and has no accounts.
 
 **How long does a full scan take?**
 It depends on how many candidates respond. With the defaults (3 attempts, 8 s request timeout, 4 s connect timeout, fail-fast, 128 workers) even ~190,000 completely dead addresses take about 3.5 hours, because each dead proxy is dropped after two short connect failures; in practice most fail much faster. Raise `--workers`, lower `--connect-timeout`, or use fewer sources for quicker runs. You can stop and resume at any time.
@@ -457,8 +464,15 @@ Checking public lists is generally fine, but you are responsible for respecting
 
 ## 🗺 Roadmap
 
-- [x] English interface with an EN/RU switch
-- [ ] `pipx install` / PyPI package and a single `proxy-workbench` command
+- [x] Interface in 12 languages
+- [x] `pipx install` and a single `proxy-workbench` command
+- [x] Desktop app: macOS menu bar, Windows installer, per-user data folders
+- [x] Persistent pools, schedules, profiles with revisions and list import
+- [x] API keys with permissions, scope, rotation and audit
+- [x] Diagnostics funnel, backups and restore with preview
+- [ ] Checking proxies that need a login
+- [ ] Signed and notarized builds, automatic updates
+- [ ] PyPI package
 - [x] Anonymity level detection (transparent / anonymous / elite)
 - [x] Per-protocol `host:port` exports
 - [x] Country column and filters from a local GeoIP database
@@ -471,13 +485,13 @@ Have an idea? Open a [feature request](../../issues/new/choose) or start a [disc
 
 ## 🤝 Contributing
 
-Contributions of every size are welcome — bug reports, new sources, docs, translations and code. Read [CONTRIBUTING.md](CONTRIBUTING.md) to get started. Tests run entirely on local mocks:
+Bug reports, new sources, translations and code are welcome — open an [issue](../../issues) or a pull request. Tests run entirely on local mocks:
 
 ```sh
 python -m unittest discover -s tests -v
 ```
 
-Please also read the [Code of Conduct](CODE_OF_CONDUCT.md). Found a vulnerability? Follow [SECURITY.md](SECURITY.md) and report it privately.
+Found a vulnerability? Please report it privately through [GitHub security advisories](../../security/advisories/new) rather than a public issue.
 
 If Proxy Workbench saved you time, **a ⭐ on GitHub helps other people find it.**
 
diff --git a/README.ru.md b/README.ru.md
index f369889..a5c3a87 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -4,9 +4,11 @@
 
 # Proxy Workbench
 
-**Собирает бесплатные публичные прокси из каталога на 150 записей, включая 98 доступных для сбора лент, проверяет каждый на _ваших_ сервисах и оставляет только быстрые, стабильные, чистые и анонимные.**
+### Находит бесплатные прокси, которые реально работают — на нужных вам сайтах
 
-Локальный GUI в браузере (русский / английский) + CLI · HTTP / HTTPS (CONNECT) / SOCKS5 · уровни анонимности · продолжение после остановки · без аккаунтов и телеметрии
+Программа сама собирает бесплатные прокси из **150 открытых источников**, проверяет каждый на тех сайтах и сервисах, которые нужны **именно вам**, и оставляет только рабочие. Результат — готовые списки, один **ротирующий прокси** для браузера, Telegram и любых программ или **API** для ваших скриптов.
+
+Работает на вашем компьютере: приложение для macOS и Windows, командная строка, Docker · HTTP, HTTPS, SOCKS4, SOCKS5 · 12 языков · без регистрации и телеметрии
 
 ![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB?logo=python&logoColor=white)
 ![License: MIT](https://img.shields.io/badge/license-MIT-2ea44f)
@@ -22,7 +24,7 @@
 
 <img src="docs/assets/demo.gif" alt="Демо Proxy Workbench: проверка, рейтинг, фильтр элитных прокси" width="100%">
 
-<sub>15 секунд: запуск проверки → рейтинг → фильтр «только элитные» → детали попыток → переключение EN/RU (синтетические данные).</sub>
+<sub>Коротко: настройка проверки → рейтинг → фильтр «только элитные» → детали попыток → источники → смена языка (синтетические данные).</sub>
 
 </div>
 
@@ -30,15 +32,13 @@
 
 > **Статус:** публичная beta. Проект измеряет доступность и задержку; он не обещает анонимность, безопасность или стабильную работу сторонних прокси.
 
-## Зачем это нужно
-
-Списков бесплатных прокси много, но большая часть адресов в них мёртвые, медленные или заблокированы именно на том сайте, который вам нужен. Прокси, который открывает `example.com`, может не работать с вашим API, отдавать капчу с кодом `200` или находиться в спам-блеклисте.
+## Что делает программа
 
-**Proxy Workbench отвечает на практический вопрос: _какие из этих прокси действительно работают с моим сервисом прямо сейчас и насколько хорошо?_**
+Списков бесплатных прокси много, но большинство адресов в них мёртвые, медленные или заблокированы как раз на том сайте, который вам нужен. Proxy Workbench делает всю грязную работу за три шага:
 
-- Собирает кандидатов из десятков публичных списков (или ваших файлов) и убирает дубликаты.
-- Делает **настоящие HTTP(S)-запросы через каждый прокси** ко всем указанным сервисам — несколько раз — и проверяет HTTP-код, текст ответа или SHA-256.
-- Ранжирует прошедшие по **медианной задержке, разбросу и доле успехов**, отмечает **адреса из блеклистов** (локальный denylist + опциональные DNSBL), определяет **уровень анонимности** (прозрачный / анонимный / элитный) и экспортирует TXT / CSV / JSON и готовые списки `host:port` по протоколам.
+1. **Собирает.** Скачивает адреса из 150 открытых источников (106 подключены сразу) или из ваших файлов и убирает дубликаты.
+2. **Проверяет.** Отправляет через каждый прокси настоящие запросы к вашим сайтам — по несколько раз — и смотрит код ответа, нужный текст на странице и скорость. Дополнительно определяет страну, анонимность (прозрачный / анонимный / элитный) и чистоту IP.
+3. **Отдаёт готовое.** Лучшие прокси — в файлах TXT / CSV / JSON, в конфигурациях для браузера, Clash и sing-box, через ротирующий прокси `127.0.0.1:8899` или через API. Пулы и расписания держат список свежим сами.
 
 Всё работает на вашем компьютере. Интерфейс слушает только `127.0.0.1`.
 
@@ -86,8 +86,15 @@
 | **Страна выхода** | Judge показывает, с какого адреса трафик на самом деле выходит в интернет; если страна отличается от страны прокси, в таблице видно `DE → NL`. |
 | **Готовые конфиги** | `proxy.pac` для браузера и `clash.yaml` для Clash / Mihomo с автоматическим выбором самого быстрого прокси; над файлами сводка по протоколам и странам. |
 | **Безопасность по умолчанию** | GUI только на loopback с токеном сессии и проверкой Host/Origin, защищённая загрузка источников (без private/metadata IP, проверка redirects, лимиты размера), credential-like заголовки отклоняются. |
-| **Русский и английский интерфейс** | Кнопка EN/RU; по умолчанию язык браузера. Тёмная и светлая темы. |
-| **Без настройки** | `.exe` для Windows без установки Python, `pipx install`, Docker Compose или запуск двойным кликом, который сам создаёт виртуальное окружение. |
+| **Приложение для рабочего стола** | Живёт в меню-баре macOS: пауза и запуск, автозапуск при входе по желанию, один экземпляр, корректное восстановление после сна. Интерфейс в браузере открывается из него. |
+| **Пулы** | Именованный пул держит N рабочих прокси для профиля с резервом, квотами и бюджетами; сам пополняется, перепроверяется и объясняет, почему не хватает. |
+| **Расписания** | Перепроверка коллекции или пула по интервалу в вашем часовом поясе, тихие часы, бюджеты запросов и трафика, уведомления о смене состояния прокси. |
+| **Профили и импорт** | Цели и правила сохраняются как именованные профили с ревизиями. Импорт своих списков из TXT, URI, CSV, JSON, Clash и sing-box с предпросмотром, сопоставлением колонок и отчётом по каждой отклонённой строке. |
+| **API-ключи** | Именованные ключи с правами, областью действия (коллекции и пулы), лимитами, сроком, ротацией и журналом аудита — на странице **Ключи** или командой `api-key`. |
+| **Диагностика** | Воронка показывает, где потерялись кандидаты; «почему 0 результатов» объясняет пустой прогон простыми словами; диагностический пакет без секретов можно просмотреть перед сохранением. |
+| **Резервные копии** | Backup, восстановление, откат и очистка по сроку хранения — каждое действие сначала показывает предпросмотр; папки данных старых версий обновляются автоматически, перед этим делается копия. |
+| **12 языков** | Русский, английский, украинский, немецкий, испанский, французский, итальянский, португальский, польский, турецкий, японский и китайский; по умолчанию язык системы. Переработанные тёмная и светлая темы, адаптация под телефоны и планшеты. |
+| **Без настройки** | `.dmg` для macOS, установщик (или portable `.zip`) для Windows, `pipx install`, Docker Compose или запуск двойным кликом, который сам создаёт виртуальное окружение. |
 
 ## 🚀 Быстрый старт
 
@@ -95,7 +102,7 @@
 
 | Способ | Как | Что нужно |
 | --- | --- | --- |
-| **Программа для macOS** | Скачайте `proxy-workbench-…-macos-arm64.dmg` из [последнего релиза](https://github.com/DavidVoitenko/proxy-workbench/releases/latest) и перетащите `Proxy Workbench.app` в «Программы» | macOS 11+, Apple Silicon |
+| **Программа для macOS** | Скачайте `proxy-workbench-…-macos-arm64.dmg` из [последнего релиза](https://github.com/DavidVoitenko/proxy-workbench/releases/latest) и перетащите `Proxy Workbench.app` в «Программы» | macOS 11+, Apple Silicon (`arm64`) или Intel (`x86_64`) |
 | **Программа для Windows** | Скачайте `proxy-workbench-…-windows-x64-setup.exe` из [последнего релиза](https://github.com/DavidVoitenko/proxy-workbench/releases/latest) и запустите установщик; есть portable-архив `.zip` и отдельный `proxy-workbench-cli.exe` для командной строки | больше ничего |
 | **pipx** (Windows, macOS, Linux) | `pipx install git+https://github.com/DavidVoitenko/proxy-workbench`, затем `proxy-workbench` | Python 3.11+ и [pipx](https://pypa.io/pipx/) |
 | **Папка с кодом** | Скачайте код (**Code → Download ZIP** или `git clone`) и запустите, как в таблице ниже | Python 3.11+ |
@@ -110,7 +117,7 @@ proxy-workbench --no-desktop     # то же самое, другими слов
 proxy-workbench --print-paths    # какие папки data/cache/logs выберет этот запуск
 ```
 
-Установленная сборка хранит данные в персональных папках пользователя (`%LOCALAPPDATA%\proxy-workbench`, `~/Library/Application Support/proxy-workbench` или `~/.local/share/proxy-workbench`) и **никогда** не пишет в собственную папку программы; исходники продолжают использовать `data/` рядом с проектом; переменная `PROXY_WORKBENCH_DATA` задаёт папку явно. Portable mode включается только по явному запросу — см. [docs/packaging/README.md](docs/packaging/README.md).
+Установленная сборка хранит данные в персональных папках пользователя (`%LOCALAPPDATA%\proxy-workbench`, `~/Library/Application Support/proxy-workbench` или `~/.local/share/proxy-workbench`) и **никогда** не пишет в собственную папку программы; исходники продолжают использовать `data/` рядом с проектом; переменная `PROXY_WORKBENCH_DATA` задаёт папку явно. Portable-режим включается только явно: положите пустой файл `proxy-workbench-portable.json` рядом с программой, и она будет хранить данные рядом с собой.
 
 Артефакты релизов **не подписаны сертификатом**: у проекта нет ключа подписи, и в заметках о релизе и в манифесте стоит `signed: false`, а не утверждение о подписи. Поэтому при первом запуске macOS попросит подтвердить открытие, а SmartScreen может попросить то же (**Подробнее → Выполнить в любом случае**). У каждого релиза опубликована контрольная сумма SHA-256: она доказывает, что файл именно тот, что опубликован, но не называет издателя.
 
@@ -374,7 +381,7 @@ curl -x socks5h://127.0.0.1:8899 https://example.org/
 
 На сервере шлюз запускает `./run.sh gateway`; пул сужается обычными фильтрами, например `gateway --protocol socks5 --country DE --max-latency 1500`. Для сетевого адреса (`--host 0.0.0.0`) нужен пароль: `--gateway-token <секрет>` или переменная `PROXY_WORKBENCH_GATEWAY_TOKEN`; если он не задан, шлюз придумывает свой и печатает его. Клиенты входят с любым именем и этим паролем через HTTP Basic или логин/пароль SOCKS5.
 
-**Пароль шлюза — не токен API.** Это разные идентичности намеренно (CONTRACTS §5.1): тот, кому вы дали пароль для телефона в сети, не должен читать опубликованный снапшот, а утёкший токен API не должен работать как прокси. `serve` получает `--api-token`, `gateway` — `--gateway-token`; в `compose.yml` показаны обе переменные.
+**Пароль шлюза — не токен API.** Это разные идентичности намеренно: тот, кому вы дали пароль для телефона в сети, не должен читать опубликованный снапшот, а утёкший токен API не должен работать как прокси. `serve` получает `--api-token`, `gateway` — `--gateway-token`; в `compose.yml` показаны обе переменные.
 
 Браузер без расширений: укажите `http://127.0.0.1:8765/pac` как адрес автоматической настройки прокси. Он отдаёт 10 лучших подходящих прокси и принимает те же фильтры, что API, например `/pac?country=DE`. `/clash` возвращает готовый конфиг Clash / Mihomo.
 
@@ -498,7 +505,7 @@ docker run -d --name pw-gateway -p 127.0.0.1:8899:8899 -e PROXY_WORKBENCH_API_TO
   - `maintenance.py` — блокировка папки `data` и очистка локальных данных;
   - `sources.json` — встроенные источники.
 - `proxytool.py`, `gui.py` — запуск из папки с кодом (их вызывают `Start.bat`, `Start.command`, `run.sh`).
-- `packaging/` — сборка `.app`/`.dmg` для macOS и GUI/CLI `.exe` + per-user installer для Windows (PyInstaller), сборка helper меню-бара, манифест артефактов и сквозные проверки собранного пакета. Подробности и честная матрица проверенных сборок — в [`docs/packaging/README.md`](docs/packaging/README.md).
+- `packaging/` — сборка `.app`/`.dmg` для macOS и GUI/CLI `.exe` + per-user installer для Windows (PyInstaller), сборка helper меню-бара, манифест артефактов и сквозные проверки собранного пакета.
 - `compose.yml` — проверка, API и ротирующий прокси в Docker.
 - `tests/` — isolated unit and local mock tests.
 - `docs/assets/` — скриншоты и изображение для превью.
@@ -524,7 +531,7 @@ docker run -d --name pw-gateway -p 127.0.0.1:8899:8899 -e PROXY_WORKBENCH_API_TO
 ## ❓ Частые вопросы
 
 **Это делает меня анонимным?**
-Нет. Proxy Workbench измеряет _доступность и задержку_. Публичный прокси видит ваш IP, адрес назначения и — для обычного HTTP — сам трафик. Не отправляйте пароли, cookies и токены через непроверенные публичные прокси. См. [PRIVACY.md](PRIVACY.md).
+Нет. Proxy Workbench измеряет _доступность и задержку_. Публичный прокси видит ваш IP, адрес назначения и — для обычного HTTP — сам трафик. Не отправляйте пароли, cookies и токены через непроверенные публичные прокси. Сам Proxy Workbench не отправляет телеметрию и не требует аккаунтов.
 
 **Почему прокси работает в браузере, а здесь не прошёл?**
 Редиректы не выполняются, TLS-сертификаты проверяются, а каждый сервис должен пройти свой порог. Откройте **Детали** — там ошибка каждой попытки.
@@ -546,8 +553,15 @@ IP нет в вашем локальном denylist и (если включен
 
 ## 🗺 Планы
 
-- [x] Английский интерфейс и переключатель EN/RU
-- [ ] Установка через `pipx` / PyPI и единая команда `proxy-workbench`
+- [x] Интерфейс на 12 языках
+- [x] Установка через `pipx` и единая команда `proxy-workbench`
+- [x] Приложение: меню-бар macOS, установщик Windows, персональные папки данных
+- [x] Постоянные пулы, расписания, профили с ревизиями и импорт списков
+- [x] API-ключи с правами, областью действия, ротацией и аудитом
+- [x] Воронка диагностики, резервные копии и восстановление с предпросмотром
+- [ ] Проверка прокси с логином и паролем
+- [ ] Подписанные сборки и автообновление
+- [ ] Пакет на PyPI
 - [x] Определение уровня анонимности (transparent / anonymous / elite)
 - [x] Экспорт `host:port` по протоколам
 - [x] Колонка страны и фильтры по локальной базе GeoIP
@@ -560,7 +574,7 @@ IP нет в вашем локальном denylist и (если включен
 
 ## 🤝 Участие
 
-Рады любому вкладу: баг-репорты, новые источники, документация, переводы и код. Начните с [CONTRIBUTING.md](CONTRIBUTING.md), соблюдайте [Code of Conduct](CODE_OF_CONDUCT.md). Уязвимости сообщайте приватно по [SECURITY.md](SECURITY.md).
+Рады баг-репортам, новым источникам, переводам и коду — откройте [issue](../../issues) или pull request. Об уязвимостях сообщайте приватно через [GitHub security advisories](../../security/advisories/new), а не в публичном issue.
 
 Если проект сэкономил вам время — **поставьте ⭐, это помогает другим его найти.**
 
diff --git a/compose.yml b/compose.yml
index 3877cef..11beccd 100644
--- a/compose.yml
+++ b/compose.yml
@@ -10,8 +10,8 @@
 # the read-only API; `PROXY_WORKBENCH_GATEWAY_TOKEN` is the password a proxy client
 # gives the gateway.  They are deliberately never the same value: whoever knows the
 # gateway password (a phone on the LAN, a QR code) must not be able to read the
-# published snapshot, and a leaked API token must not be a working proxy
-# (CONTRACTS §5.1, defect 18).  Leave the gateway variable unset and the gateway
+# published snapshot, and a leaked API token must not be a working proxy.
+# Leave the gateway variable unset and the gateway
 # makes its own password and prints it in its log.
 #
 # Edit the check command to test your own service: --url https://example.org/health
diff --git a/docs/assets/demo.gif b/docs/assets/demo.gif
index 4da5fb3..1e98757 100644
Binary files a/docs/assets/demo.gif and b/docs/assets/demo.gif differ
diff --git a/docs/assets/screenshots/details-dark.png b/docs/assets/screenshots/details-dark.png
index ce2ca38..ead8005 100644
Binary files a/docs/assets/screenshots/details-dark.png and b/docs/assets/screenshots/details-dark.png differ
diff --git a/docs/assets/screenshots/results-dark.png b/docs/assets/screenshots/results-dark.png
index 02c740b..e606226 100644
Binary files a/docs/assets/screenshots/results-dark.png and b/docs/assets/screenshots/results-dark.png differ
diff --git a/docs/assets/screenshots/results-light.png b/docs/assets/screenshots/results-light.png
index 93c7896..aee9def 100644
Binary files a/docs/assets/screenshots/results-light.png and b/docs/assets/screenshots/results-light.png differ
diff --git a/docs/assets/screenshots/ru/details-dark.png b/docs/assets/screenshots/ru/details-dark.png
index d7b03b5..f9e573f 100644
Binary files a/docs/assets/screenshots/ru/details-dark.png and b/docs/assets/screenshots/ru/details-dark.png differ
diff --git a/docs/assets/screenshots/ru/results-dark.png b/docs/assets/screenshots/ru/results-dark.png
index c534f74..b47d3b9 100644
Binary files a/docs/assets/screenshots/ru/results-dark.png and b/docs/assets/screenshots/ru/results-dark.png differ
diff --git a/docs/assets/screenshots/ru/results-light.png b/docs/assets/screenshots/ru/results-light.png
index 7870c92..d7c58b6 100644
Binary files a/docs/assets/screenshots/ru/results-light.png and b/docs/assets/screenshots/ru/results-light.png differ
diff --git a/docs/assets/screenshots/ru/scan-dark.png b/docs/assets/screenshots/ru/scan-dark.png
index a479c4a..270802f 100644
Binary files a/docs/assets/screenshots/ru/scan-dark.png and b/docs/assets/screenshots/ru/scan-dark.png differ
diff --git a/docs/assets/screenshots/scan-dark.png b/docs/assets/screenshots/scan-dark.png
index 7d85f1f..2201610 100644
Binary files a/docs/assets/screenshots/scan-dark.png and b/docs/assets/screenshots/scan-dark.png differ
diff --git a/docs/assets/social-preview.png b/docs/assets/social-preview.png
index 433ba22..a7f55bb 100644
Binary files a/docs/assets/social-preview.png and b/docs/assets/social-preview.png differ
diff --git a/docs/index.html b/docs/index.html
index 16ce6e9..c2e4cd2 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -4,11 +4,11 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Proxy Workbench — free proxy checker for your own sites</title>
-<meta name="description" content="Open-source proxy checker: collects free HTTP, HTTPS, SOCKS4 and SOCKS5 proxies from 55 public lists, tests each one against your own sites, rates anonymity (elite, anonymous, transparent), filters blacklisted IPs. Local GUI + CLI + Docker.">
+<meta name="description" content="Open-source proxy checker: collects free HTTP, HTTPS, SOCKS4 and SOCKS5 proxies from a catalog of 150 sources, tests each one against your own sites, rates anonymity (elite, anonymous, transparent), filters blacklisted IPs. Local GUI + CLI + Docker.">
 <meta name="keywords" content="proxy checker, free proxy list, socks5 proxy checker, elite proxy, anonymous proxy, proxy scraper, proxy tester, dnsbl, open source">
 <meta property="og:type" content="website">
 <meta property="og:title" content="Proxy Workbench — find free proxies that actually work for your site">
-<meta property="og:description" content="Collect 55 public proxy lists, test every proxy against your services, keep only fast, clean and elite ones. Local GUI + CLI, MIT.">
+<meta property="og:description" content="A catalog of 150 proxy sources, checks against your own services, pools, schedules and a rotating gateway. Desktop app for macOS and Windows, 12 languages, MIT.">
 <meta property="og:image" content="https://davidvoitenko.github.io/proxy-workbench/assets/social-preview.png?v=2">
 <meta property="og:image:width" content="1280">
 <meta property="og:image:height" content="640">
@@ -67,13 +67,13 @@
 
   <header class="hero">
     <h1>Find every free proxy.<br><em>Keep the ones that work.</em></h1>
-    <p>Proxy Workbench collects public HTTP, HTTPS, SOCKS4 and SOCKS5 proxies from 55 open lists and web pages, tests every one against <strong>your own sites</strong>, rates anonymity and drops blacklisted IPs, all on your own machine.</p>
+    <p>Proxy Workbench collects public HTTP, HTTPS, SOCKS4 and SOCKS5 proxies from a catalog of 150 sources (106 collected out of the box), tests every one against <strong>your own sites</strong>, rates anonymity and drops blacklisted IPs, all on your own machine.</p>
     <div class="cta">
       <a class="btn primary" data-repo data-path="/releases/latest" href="#">⬇ Download latest release</a>
       <a class="btn" data-repo href="#">★ Star on GitHub</a>
     </div>
-    <div class="meta">Free &amp; open source (MIT) · Windows · macOS · Linux · Docker · English / Russian</div>
-    <div class="demo"><img src="assets/demo.gif" alt="Proxy Workbench demo: start a scan, see ranked proxies, filter elite ones" width="960" height="570" loading="lazy"></div>
+    <div class="meta">Free &amp; open source (MIT) · Windows · macOS · Linux · Docker · 12 languages</div>
+    <div class="demo"><img src="assets/demo.gif" alt="Proxy Workbench demo: set up a check, see ranked proxies, filter elite ones, open details, switch language" width="960" height="600" loading="lazy"></div>
   </header>
 
   <section id="features">
@@ -89,6 +89,10 @@ <h2>Why people use it</h2>
       <div class="card"><h3>Real speed and provider</h3><p>Optional speed test in Mbit/s; every proxy shows its provider, and hosting or data-centre ranges can be skipped.</p></div>
       <div class="card"><h3>Built for scrapers</h3><p>Pick country, protocol and a sticky session in the proxy user name: <code>country-de-session-1</code>. Or script it: <code>proxy-workbench get --top 5</code>.</p></div>
       <div class="card"><h3>Rotating proxy gateway</h3><p>Point a browser, Telegram or any app at <code>127.0.0.1:8899</code>: every connection goes out through the next working proxy, dead ones are skipped.</p></div>
+      <div class="card"><h3>Desktop app</h3><p>A macOS menu-bar app and a Windows installer. One running instance, optional start at login, correct recovery after sleep.</p></div>
+      <div class="card"><h3>Pools and schedules</h3><p>Keep N working proxies per profile with a reserve and budgets, and re-check them on a schedule in your time zone with quiet hours.</p></div>
+      <div class="card"><h3>12 languages, new design</h3><p>English, Russian, Ukrainian, German, Spanish, French, Italian, Portuguese, Polish, Turkish, Japanese and Chinese. Dark and light themes for desktop, tablet and phone.</p></div>
+      <div class="card"><h3>Keys, diagnostics, backups</h3><p>API keys with permissions and audit, a funnel that explains an empty result, and backups you can preview before restoring.</p></div>
       <div class="card"><h3>Local API for your code</h3><p><code>GET /random?protocol=socks5&amp;country=DE</code> returns a fresh working proxy, so scripts and bots pick one with a single request.</p></div>
     </div>
   </section>
@@ -106,8 +110,8 @@ <h2>What the anonymity levels mean</h2>
   <section id="start">
     <h2>Get started in a minute</h2>
     <div class="steps">
-      <div class="card"><span>1</span><h3>Download</h3><p>Windows: the <code>.exe</code> from the latest release, nothing else needed. Anywhere else: <code>pipx install git+https://github.com/DavidVoitenko/proxy-workbench</code>, or Docker Compose.</p></div>
-      <div class="card"><span>2</span><h3>Start it</h3><p>Double-click the <code>.exe</code> or run <code>proxy-workbench</code>: the interface opens in your browser, together with the local API and the rotating proxy.</p></div>
+      <div class="card"><span>1</span><h3>Download</h3><p>macOS: the <code>.dmg</code>; Windows: the installer or portable <code>.zip</code> from the latest release, nothing else needed. Anywhere else: <code>pipx install git+https://github.com/DavidVoitenko/proxy-workbench</code>, or Docker Compose.</p></div>
+      <div class="card"><span>2</span><h3>Start it</h3><p>Open the app or run <code>proxy-workbench</code>: the interface opens in your browser, together with the local API and the rotating proxy.</p></div>
       <div class="card"><span>3</span><h3>Check &amp; export</h3><p>Add your site, press <em>Find and check</em>, then download the best proxies from the <em>Results</em> tab.</p></div>
     </div>
     <p style="margin:26px 0 10px">Prefer the terminal or a server?</p>
@@ -130,7 +134,7 @@ <h2>Private by design</h2>
 
   <footer>
     <span>Proxy Workbench · MIT License · <a data-repo data-path="/blob/main/README.ru.md" href="#">Документация на русском</a></span>
-    <span><a data-repo data-path="/issues" href="#">Issues</a> · <a data-repo data-path="/blob/main/CONTRIBUTING.md" href="#">Contribute</a> · <a data-repo data-path="/blob/main/SECURITY.md" href="#">Security</a></span>
+    <span><a data-repo data-path="/issues" href="#">Issues</a> · <a data-repo data-path="/releases" href="#">Releases</a></span>
   </footer>
 </div>
 <script>
diff --git a/functional_acceptance.py b/functional_acceptance.py
deleted file mode 100644
index 46cb303..0000000
--- a/functional_acceptance.py
+++ /dev/null
@@ -1,352 +0,0 @@
-#!/usr/bin/env python3
-"""Функциональная приёмка Proxy Workbench.
-
-Это НЕ набор юнит-тестов. Здесь проверяется одно: может ли обычный пользователь
-дойти до заявленной функции снаружи, через реальный интерфейс — CLI, GUI, HTTP.
-
-Каждая проверка отвечает на вопрос «сможет ли человек это сделать», а не
-«есть ли строка кода». Функция, до которой нельзя добраться ни через один
-интерфейс, считается НЕ СДЕЛАННОЙ, даже если её модуль написан и покрыт тестами.
-
-Запуск:  .venv/bin/python functional_acceptance.py [--json]
-"""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import socket
-import subprocess
-import sys
-import tempfile
-import time
-import urllib.error
-import urllib.request
-
-REPO = os.path.dirname(os.path.abspath(__file__))
-PY = sys.executable
-
-results: list[tuple[str, str, str, str]] = []
-
-
-def record(area: str, feature: str, verdict: str, detail: str) -> None:
-    results.append((area, feature, verdict, detail))
-    mark = {"done": "СДЕЛАНО", "partial": "ЧАСТИЧНО", "missing": "НЕ СДЕЛАНО",
-            "broken": "СЛОМАНО", "unknown": "НЕ ПРОВЕРЕНО"}[verdict]
-    print(f"  [{mark:11s}] {feature}\n                 {detail}")
-
-
-def cli(*argv: str, timeout: int = 120) -> subprocess.CompletedProcess:
-    return subprocess.run(
-        [PY, "-m", "proxy_workbench", "--data", DATA, *argv],
-        capture_output=True, text=True, timeout=timeout, cwd=REPO,
-    )
-
-
-class Server:
-    """Реальный запущенный продукт, к которому обращаются по HTTP."""
-
-    def __init__(self, token: str):
-        self.token = token
-        with socket.socket() as reserved:
-            reserved.bind(('127.0.0.1', 0))
-            port = reserved.getsockname()[1]
-        self.proc = subprocess.Popen(
-            [PY, "-m", "proxy_workbench", "serve", "--data", DATA,
-             "--host", "127.0.0.1", "--port", str(port), "--api-token", token],
-            cwd=REPO, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-        )
-        self.base = f"http://127.0.0.1:{port}"
-        self.client = urllib.request.build_opener(urllib.request.ProxyHandler({}))
-
-    def wait_up(self, timeout: float = 30.0) -> bool:
-        deadline = time.monotonic() + timeout
-        while time.monotonic() < deadline and self.proc.poll() is None:
-            code, _ = self.call("/status", token=self.token)
-            if code is not None:
-                return True
-            time.sleep(0.3)
-        return False
-
-    _idem = 0
-
-    def call(self, path, method="GET", body=None, token=None, raw=False):
-        req = urllib.request.Request(self.base + path, method=method)
-        tok = self.token if token is None else token
-        if tok:
-            req.add_header("Authorization", "Bearer " + tok)
-        payload = json.dumps(body).encode() if body is not None else None
-        if payload:
-            req.add_header("Content-Type", "application/json")
-        if method in ("POST", "PATCH", "DELETE"):
-            # Любая мутация требует идемпотентности (CONTRACTS §6.4); приёмка
-            # повторяет один и тот же сценарий, поэтому ключ детерминирован.
-            Server._idem += 1
-            req.add_header("Idempotency-Key", f"functional-acceptance-{Server._idem}")
-        try:
-            with self.client.open(req, data=payload, timeout=10) as r:
-                text = r.read().decode("utf-8", "replace")
-                return (r.status, text) if raw else (r.status, json.loads(text or "{}"))
-        except urllib.error.HTTPError as e:
-            text = e.read().decode("utf-8", "replace")
-            try:
-                return e.code, json.loads(text or "{}")
-            except json.JSONDecodeError:
-                return e.code, text
-        except Exception as e:
-            return None, f"{type(e).__name__}: {e}"
-
-    def stop(self):
-        self.proc.terminate()
-        try:
-            self.proc.wait(timeout=5)
-        except Exception:
-            self.proc.kill()
-            self.proc.wait(timeout=5)
-        if self.proc.stdout:
-            self.proc.stdout.close()
-
-
-# --------------------------------------------------------------------------
-# 1. Достижимость: можно ли дойти до функции снаружи
-# --------------------------------------------------------------------------
-
-def check_reachability(server: Server) -> None:
-    print("\n=== ДОСТИЖИМОСТЬ ФУНКЦИЙ: можно ли добраться снаружи ===")
-
-    code, body = server.call("/v1/capabilities")
-    if code == 200 and isinstance(body, dict) and body.get("permissions"):
-        record("F29", "Список прав у API отдаётся", "done",
-               f"{len(body['permissions'])} прав перечислено в /v1/capabilities")
-    else:
-        record("F29", "Список прав у API отдаётся", "broken", f"HTTP {code}")
-
-    # Ключи администратора должен выдавать локальный bootstrap: CLI или GUI.
-    cli_keys = cli("api-key", "list")
-    cli_issue = cli("api-key", "bootstrap", "--name", "acceptance")
-    has_bootstrap = cli_issue.returncode == 0
-    if has_bootstrap:
-        # Секрет показывается один раз; приёмка забирает его отсюда.
-        _ADMIN["secret"] = (cli_issue.stdout or "").strip().splitlines()[-1].strip()
-    if has_bootstrap:
-        record("F29", "Выдача первого ключа администратора", "done",
-               "CLI-команда api-key bootstrap создаёт ключ; "
-               f"список ключей: exit {cli_keys.returncode}")
-    else:
-        detail = (cli_issue.stderr or cli_issue.stdout or "").strip().splitlines()
-        record("F29", "Выдача первого ключа администратора", "missing",
-               "Нет пользовательского пути: "
-               + (detail[-1][:200] if detail else "команда не найдена")
-               + ". Функция bootstrap_admin() есть только в apikeys.py и вызывается "
-                 "исключительно из тестов — значит через /v1 collections, profiles, "
-                 "sources, jobs, pools, schedules, audit и keys нельзя попасть вовсе.")
-
-
-def last_admin_secret() -> str | None:
-    """Секрет, который напечатал ``api-key bootstrap`` в этой же приёмке."""
-    return _ADMIN.get("secret")
-
-
-_ADMIN: dict[str, str] = {}
-
-
-def check_api_operations(server: Server, admin_token: str | None) -> None:
-    print("\n=== F29: ОПЕРАЦИИ API ===")
-    # Тела запросов — ровно те, что документирует маршрут: приёмка меряет
-    # продукт, а не свою догадку о его API.
-    ops = [
-        ("GET", "/v1/collections", None, "Коллекции: чтение"),
-        ("POST", "/v1/collections", {"name": "acceptance"}, "Коллекции: создание"),
-        ("GET", "/v1/profiles", None, "Профили: чтение"),
-        ("POST", "/v1/profiles",
-         {"name": "acceptance",
-          "targets": [{"id": "t1", "kind": "required", "min_success": 1.0},
-                      {"id": "t2", "kind": "optional", "min_success": 0.5}],
-          "rule": "at_least_k", "k": 1}, "Профили: создание"),
-        ("GET", "/v1/sources", None, "Источники: каталог"),
-        ("GET", "/v1/sources/catalog", None, "Источники: каталог исследований"),
-        ("GET", "/v1/jobs", None, "Задания: список"),
-        ("POST", "/v1/checks/check", {"collection_id": "public-base"}, "Задания: запуск проверки"),
-        ("GET", "/v1/pools", None, "Пулы: список"),
-        ("GET", "/v1/schedules", None, "Расписания: список"),
-        ("GET", "/v1/keys", None, "Ключи: список"),
-        ("GET", "/v1/audit", None, "Журнал аудита"),
-        ("GET", "/v1/results", None, "Результаты с курсором"),
-    ]
-    if not admin_token:
-        for _method, _path, _body, label in ops:
-            record("F29", label, "missing",
-                   "Недостижимо: нет ключа администратора, у пользователя его взять негде")
-        return
-
-    for method, path, body, label in ops:
-        code, payload = server.call(path, method=method, body=body, token=admin_token)
-        if code and code < 400:
-            record("F29", label, "done", f"HTTP {code}")
-        elif code == 403:
-            record("F29", label, "broken", "HTTP 403 — права выданы, но доступ не проходит")
-        else:
-            detail = payload.get("error", {}).get("message") if isinstance(payload, dict) else str(payload)
-            record("F29", label, "broken", f"HTTP {code}: {str(detail)[:150]}")
-
-
-def check_scopes(server: Server, admin_token: str | None) -> None:
-    """Ключ A не должен видеть то, что ему не выдали."""
-    print("\n=== F29: РАЗГРАНИЧЕНИЕ ДОСТУПА МЕЖДУ КЛЮЧАМИ ===")
-    if not admin_token:
-        record("F29", "Ключ A не видит данные ключа B", "unknown",
-               "Нужен рабочий bootstrap для постановки")
-        return
-    code, a = server.call("/v1/keys", method="POST", token=admin_token,
-                          body={"name": "key-a", "permissions": ["read.results"]})
-    code2, b = server.call("/v1/keys", method="POST", token=admin_token,
-                           body={"name": "key-b", "permissions": ["admin.keys"]})
-    if code not in (200, 201) or code2 not in (200, 201):
-        record("F29", "Создание двух ключей с разными правами", "broken",
-               f"HTTP {code} / {code2}")
-        return
-    record("F29", "Создание двух ключей с разными правами", "done", "оба созданы")
-
-    secret_a = (a.get("secret") if isinstance(a, dict) else None)
-    secret_b = (b.get("secret") if isinstance(b, dict) else None)
-    if not secret_a:
-        record("F29", "Секрет ключа показывается один раз при создании", "broken",
-               "Поле secret не вернулось при создании")
-    else:
-        code, listed = server.call("/v1/keys", token=admin_token)
-        leak = json.dumps(listed).find(secret_a) >= 0 if isinstance(listed, dict) else False
-        record("F29", "Секрет ключа показывается один раз при создании",
-               "done" if not leak else "broken",
-               "при последующем чтении секрета нет" if not leak
-               else "секрет утекает в список ключей")
-
-    ca, _ = server.call("/v1/keys", token=secret_a)
-    cb, _ = server.call("/v1/keys", token=secret_b)
-    if ca == 403 and cb in (200, 201):
-        record("F29", "Read-only ключ не получает права администратора", "done",
-               "ключ A получил 403 на административной операции, ключ B — доступ")
-    else:
-        record("F29", "Read-only ключ не получает права администратора", "broken",
-               f"ключ A: HTTP {ca}, ключ B: HTTP {cb}")
-
-    cr, _ = server.call("/v1/keys", method="POST", token=secret_a, body={"name": "self-escalation"})
-    record("F29", "Read-only ключ не может выдать себе новый ключ",
-           "done" if cr == 403 else "broken",
-           f"HTTP {cr}")
-
-
-# --------------------------------------------------------------------------
-# 2. Функции, которые должны работать без API
-# --------------------------------------------------------------------------
-
-def check_cli_features() -> None:
-    print("\n=== ФУНКЦИИ ЧЕРЕЗ CLI ===")
-
-    sample = os.path.join(DATA, "acceptance-list.txt")
-    with open(sample, "w", encoding="utf-8") as fh:
-        fh.write("# список для приёмки\n1.2.3.4:8080\n5.6.7.8:3128\nплохая строка\n1.2.3.4:8080\n")
-
-    r = cli("collect", "--no-sources", "--input", sample, timeout=90)
-    if r.returncode == 0:
-        record("F03", "Импорт собственного списка с плохими строками", "done",
-               "список принят, плохая строка не сломала импорт")
-    else:
-        record("F03", "Импорт собственного списка с плохими строками", "broken",
-               (r.stderr or r.stdout).strip()[-250:])
-
-    r = cli("--help", timeout=30)
-    text = (r.stdout or "") + (r.stderr or "")
-    wanted = {
-        "F05": ["profile"],
-        "F14": ["pool"],
-        "F15": ["schedule"],
-        "F24": ["backup", "migrate"],
-        "F29": ["api-key", "key"],
-    }
-    for area, words in wanted.items():
-        found = [w for w in words if w in text.lower()]
-        if found:
-            record(area, f"Команда в CLI для этого направления ({', '.join(words)})", "done",
-                   f"найдено: {', '.join(found)}")
-        else:
-            record(area, f"Команда в CLI для этого направления ({', '.join(words)})", "missing",
-                   "в --help нет ни одной из этих команд — функция недоступна из CLI")
-
-
-def check_gui_features() -> None:
-    print("\n=== ФУНКЦИИ ЧЕРЕЗ ИНТЕРФЕЙС ===")
-    path = os.path.join(REPO, "proxy_workbench", "ui", "app.js")
-    with open(path, encoding="utf-8") as fh:
-        app = fh.read()
-    with open(os.path.join(REPO, "proxy_workbench", "gui.py"), encoding="utf-8") as fh:
-        gui = fh.read()
-
-    combined = app + gui
-    marks = {
-        "F02": ("коллекц", "Выбор коллекции в интерфейсе"),
-        "F05": ("профил", "Профили в интерфейсе"),
-        "F06": ("набор сервисов|service.?set|serviceSet", "Каталог сервисов в интерфейсе"),
-        "F19": ("bulk|массов", "Массовые операции над строками"),
-        "F29": ("api.?key|apiKey|ключ", "Менеджер ключей в интерфейсе"),
-    }
-    for area, (pattern, label) in marks.items():
-        if any(w in combined.lower() for w in ("коллекц",)):
-            hit = bool(__import__("re").search(pattern, combined, __import__("re").I))
-        else:
-            hit = bool(__import__("re").search(pattern, combined, __import__("re").I))
-        record(area, label, "done" if hit else "missing",
-               "элемент есть в интерфейсе" if hit else
-               "в интерфейсе нет ни одного упоминания — функция недоступна пользователю")
-
-
-def main() -> int:
-    global DATA
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--json", action="store_true")
-    args = parser.parse_args()
-
-    temporary = tempfile.TemporaryDirectory(prefix="pw-accept-")
-    DATA = temporary.name
-    print(f"Функциональная приёмка. Изолированные данные: {DATA}")
-
-    server = Server(token="legacy-readonly-token-for-acceptance")
-    if not server.wait_up():
-        print("Продукт не поднялся — приёмка невозможна.")
-        server.stop()
-        temporary.cleanup()
-        return 2
-    print("Продукт поднялся, обращаемся к нему по HTTP.")
-
-    try:
-        check_reachability(server)
-        # Тот же ключ, что выдал bootstrap: приёмка идёт по нему, а не по
-        # тестовой фикстуре, иначе она доказывает не пользовательский путь.
-        admin_token = last_admin_secret()
-        check_api_operations(server, admin_token)
-        check_scopes(server, admin_token)
-        check_cli_features()
-        check_gui_features()
-    finally:
-        server.stop()
-        temporary.cleanup()
-
-    tally: dict[str, int] = {}
-    for _, _, verdict, _ in results:
-        tally[verdict] = tally.get(verdict, 0) + 1
-
-    print("\n=== ИТОГ ===")
-    for verdict in ("done", "partial", "broken", "missing", "unknown"):
-        if verdict in tally:
-            print(f"  {verdict:8s} {tally[verdict]}")
-
-    if args.json:
-        print(json.dumps([
-            {"area": a, "feature": f, "verdict": v, "detail": d} for a, f, v, d in results
-        ], ensure_ascii=False, indent=2))
-
-    return 0 if tally.get("broken", 0) + tally.get("missing", 0) == 0 else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())
diff --git a/packaging/proxy-workbench-macos.spec b/packaging/proxy-workbench-macos.spec
index c340b25..3971703 100644
--- a/packaging/proxy-workbench-macos.spec
+++ b/packaging/proxy-workbench-macos.spec
@@ -5,12 +5,12 @@
 #
 # The bundle is read-only for a normal user, so nothing may be written next to
 # the executable: proxy_workbench.desktop resolves per-user data/cache/logs and
-# the worker gets a writable working directory.  See docs/packaging/README.md.
+# the worker gets a writable working directory.
 #
 # Two things in here are not decoration, and a build that leaves either out
 # still produces a runnable application that does not do what it promises:
 #
-#   * the menu bar helper (F22).  The status item is a native Swift program
+#   * the menu bar helper.  The status item is a native Swift program
 #     whose source lives in proxy_workbench.desktop.  On a source checkout the
 #     application compiles it on first run, but an installed application has no
 #     swiftc and no writable cache to compile into, so the build compiles it
diff --git a/packaging/smoke.py b/packaging/smoke.py
index 9b01c3b..48db0a6 100644
--- a/packaging/smoke.py
+++ b/packaging/smoke.py
@@ -99,7 +99,7 @@ def main(command):
         # SQL is not an option any more and must not become one again: after the
         # versioned schema the table carries a second column, so a positional
         # INSERT is exactly the "old binary writes into the new schema" failure
-        # F24 requires (CONTRACTS §3.5.2).  A loopback address is only accepted
+        # F24 requires.  A loopback address is only accepted
         # from a list the user handed over locally, hence the flag.
         listing = data / 'smoke-mock.txt'
         listing.write_text(f'http://127.0.0.1:{mock.server_port}\n', encoding='utf-8')
@@ -152,8 +152,8 @@ def checked():
         assert state['export']['passed'] == 1, state['log']
         proxy = httpx.get(f'{state["api"]}/random?format=txt', trust_env=False).text.strip()
         assert proxy == f'http://127.0.0.1:{mock.server_port}', proxy
-        # The rotating proxy has its own password now, not the GUI session token
-        # (defect 18 / F29): an unauthenticated request gets 407, so the client
+        # The rotating proxy has its own password now, not the GUI session token:
+        # an unauthenticated request gets 407, so the client
         # uses the address the GUI itself hands to a phone.  The password is
         # minted per run and is never printed.
         #
diff --git a/packaging/windows-installer.iss b/packaging/windows-installer.iss
index 7f4008f..f366fdc 100644
--- a/packaging/windows-installer.iss
+++ b/packaging/windows-installer.iss
@@ -1,6 +1,6 @@
 ; Per-user installer for the Windows desktop build.
 ;
-;   iscc /DProductVersion=2.3.0 /DOutDir=C:\path\to\dist /DSourceDir=C:\path\to\dist packaging\windows-installer.iss
+;   iscc /DProductVersion=3.0.0 /DOutDir=C:\path\to\dist /DSourceDir=C:\path\to\dist packaging\windows-installer.iss
 ;
 ; PrivilegesRequired=lowest is the whole point: the app writes to per-user
 ; folders, so it never needs an administrator, and it never installs anything
@@ -45,6 +45,10 @@ PrivilegesRequiredOverridesAllowed=
 ArchitecturesAllowed=x64compatible
 ArchitecturesInstallIn64BitMode=x64compatible
 UninstallDisplayIcon={app}\{#AppExeName}
+; The "addtopath" task edits the user's Path. Without this, Explorer is never
+; told about the change and a new console does not find the command until the
+; user signs out and back in.
+ChangesEnvironment=yes
 
 [Languages]
 Name: "english"; MessagesFile: "compiler:Default.isl"
@@ -63,9 +67,17 @@ Source: "{#SourceDir}\portable-README.txt"; DestDir: "{app}"; Flags: ignoreversi
 
 [Icons]
 Name: "{group}\{#AppName}"; Filename: "{app}\{#AppExeName}"
-Name: "{group}\Command line ({#AppExeName})"; Filename: "{app}\{#AppExeName}"; Parameters: "--help"; WorkingDir: "{app}"
+; Windows has no menu bar item and the GUI executable has no console, so this
+; is the way to stop the running application without the Task Manager.
+Name: "{group}\Quit {#AppName}"; Filename: "{app}\{#AppExeName}"; Parameters: "--quit"
+; The command line shortcuts open a console that stays open and show the CLI's
+; help in it.  They must not point at the GUI executable: it is a windowed
+; program, so "--help" there prints to nowhere and the shortcut does nothing
+; visible.  Starting the console CLI directly would close its window as soon as
+; the help has been printed, hence cmd /k.
+Name: "{group}\{#AppName} command line"; Filename: "{cmd}"; Parameters: "/k """"{app}\{#AppCliExeName}"" --help"""; WorkingDir: "{%USERPROFILE}"
 Name: "{autodesktop}\{#AppName}"; Filename: "{app}\{#AppExeName}"; Tasks: desktopicon
-Name: "{autodesktop}\Command line"; Filename: "{app}\{#AppExeName}"; Parameters: "--help"; WorkingDir: "{app}"; Tasks: desktopicon
+Name: "{autodesktop}\{#AppName} command line"; Filename: "{cmd}"; Parameters: "/k """"{app}\{#AppCliExeName}"" --help"""; WorkingDir: "{%USERPROFILE}"; Tasks: desktopicon
 
 [Registry]
 Root: HKCU; Subkey: "Environment"; ValueType: expandsz; ValueName: "Path"; \
@@ -74,6 +86,11 @@ Root: HKCU; Subkey: "Environment"; ValueType: expandsz; ValueName: "Path"; \
 [Run]
 Filename: "{app}\{#AppExeName}"; Description: "Start {#AppName}"; Flags: nowait postinstall skipifsilent
 
+[UninstallRun]
+; A running application holds its executable open and it could not be removed.
+; "--quit" waits until the instance has let go, and does nothing if none runs.
+Filename: "{app}\{#AppExeName}"; Parameters: "--quit"; Flags: runhidden waituntilterminated; RunOnceId: "QuitProxyWorkbench"
+
 [Code]
 function NeedsAddPath(Param: string): boolean;
 var
diff --git a/proxy_workbench/__main__.py b/proxy_workbench/__main__.py
index fd51953..570c7f5 100644
--- a/proxy_workbench/__main__.py
+++ b/proxy_workbench/__main__.py
@@ -26,7 +26,7 @@
 #: too - that is the double-click.
 DESKTOP_ARGS = frozenset({
     # host commands, answered without ever opening the interface
-    '--print-paths', '--portable', '--status', '--update-notice',
+    '--print-paths', '--portable', '--status', '--quit', '--update-notice',
     '--autostart', '--autostart-status', '--migrate-preview',
     # host flags
     '--background', '--no-tray',
diff --git a/proxy_workbench/anonymity.py b/proxy_workbench/anonymity.py
index 3b46441..ad64f63 100644
--- a/proxy_workbench/anonymity.py
+++ b/proxy_workbench/anonymity.py
@@ -112,7 +112,7 @@ def extract_public_ips(text, *, global_only=True):
 
 
 def classify_detail(body, own_ips, *, judge_verified=True, spec=None):
-    """Classify one judge echo through the one classifier (defect 13).
+    """Classify one judge echo through the one classifier.
 
     ``own_ips`` is the bootstrap set from the direct judge request.
     ``judge_verified`` must be ``False`` whenever that direct request did not
diff --git a/proxy_workbench/api.py b/proxy_workbench/api.py
index 813592a..7640248 100644
--- a/proxy_workbench/api.py
+++ b/proxy_workbench/api.py
@@ -15,10 +15,11 @@
 The legacy token keeps exactly the rights it has always had (``read.*`` and
 nothing else).  It is not registered as a key and gains no admin or private
 permission when it meets the new API; it travels as an explicit *compatibility
-path* and says so in a ``Warning`` header (CONTRACTS §5.1, F29).
+path* and says so in a ``Warning`` header.
 """
 from __future__ import annotations
 
+import dataclasses
 import hmac
 import ipaddress
 import json
@@ -64,7 +65,7 @@
 }
 
 #: Reasons a consumer may ask for, kept in one place so CLI, GUI and API answer
-#: with the same vocabulary (CONTRACTS §5.4).
+#: with the same vocabulary.
 FRESHNESS_MODES = ('fresh', 'expired', 'unknown', 'all')
 
 #: The file of a snapshot artifact that answers a requested ``format``.  The
@@ -96,8 +97,7 @@ def public_row(row, now=None):
     The age, the admission reason and the freshness view come from the one
     admission contract (:mod:`proxy_workbench.core`), not from a second
     calculation here: a consumer that recomputed freshness locally would
-    disagree with the engine as soon as the clock or the policy moved
-    (CONTRACTS §2.3, §4.4).
+    disagree with the engine as soon as the clock or the policy moved.
     """
     proxy = row['proxy']
     address = proxy.partition('://')[2]
@@ -148,7 +148,7 @@ def public_row(row, now=None):
         # A legacy row that carries no recorded lifetime is read with a one-time
         # backfill, and the fact that it was backfilled is visible here.  Without
         # these two the API showed a fresh row with no way to tell it apart from
-        # one whose lifetime was really measured (CONTRACTS §2.4).
+        # one whose lifetime was really measured.
         'max_age_seconds': row.get('max_age_seconds') or READ_POLICY.max_age_seconds,
         'ttl_backfilled': bool(time_state_of(row).get('ttl_backfilled')),
         'freshness': freshness_of(row),
@@ -192,7 +192,7 @@ def _flag(query, name):
     return bool(value)
 
 
-#: The stable code of each time state (CONTRACTS §5.4, domain TIME).  ``core``
+#: The stable code of each time state.  ``core``
 #: classifies the clock; this is the one place its names become codes, so the
 #: API, the CLI and the report never spell the same state two ways.
 TIME_STATE_CODES = {
@@ -204,7 +204,7 @@ def _flag(query, name):
     core.CLOCK_ROLLBACK: 'E_TIME_CLOCK_ROLLBACK',
 }
 
-#: The four explicit freshness views a mixed-age table needs (defect 3).
+#: The four explicit freshness views a mixed-age table needs.
 FRESHNESS_BY_STATE = {
     core.TIME_OK: 'fresh', core.TIME_EXPIRED: 'expired', core.TIME_TTL_MISSING: 'unknown',
 }
@@ -226,10 +226,10 @@ def freshness_of(row, now=None):
     """Which freshness view a row belongs to, decided by ``core`` alone.
 
     ``stale`` used to be one boolean meaning "no usable proxy anywhere"; a table
-    of mixed-age rows needs the four explicit views instead (defect 3).  The
+    of mixed-age rows needs the four explicit views instead.  The
     decision itself is :func:`core.time_state_of`, including the documented
     backfill of a legacy row that carries no recorded lifetime -- a reader must
-    not grow its own idea of how long a result is good (CONTRACTS §2.4, §4.3).
+    not grow its own idea of how long a result is good.
     """
     return FRESHNESS_BY_STATE.get(time_state_of(row, now)['state'], 'unknown')
 
@@ -238,10 +238,10 @@ class Exports:
     """One coherent current generation, reloaded when its pointer or files change.
 
     The pointer names a generation and nothing else: a consumer that pinned a
-    generation keeps reading that one, and a new publication does not move it
-    (CONTRACTS §1.2 rule 3, defect 8).  The re-read key is the generation plus
+    generation keeps reading that one, and a new publication does not move it.
+   The re-read key is the generation plus
     its manifest digest, not an mtime, and a generation whose manifest does not
-    verify is *refused* rather than served half-checked (CONTRACTS §4.2).
+    verify is *refused* rather than served half-checked.
     """
 
     def __init__(self, directory, generation=None):
@@ -276,8 +276,7 @@ def load(self):
         """Return the admitted rows of the pinned generation and its status.
 
         A single expired row no longer empties the answer: the set lives as long
-        as its newest member, and every row carries its own reason
-        (defect 3, R02).
+        as its newest member, and every row carries its own reason.
         """
         manifest = proxytool_export_manifest(self.directory)
         pointer_generation = manifest.get('generation') if manifest else None
@@ -291,7 +290,7 @@ def load(self):
                 return self._load_legacy_root(pointer_generation)
             # The re-read key is the generation plus the checksums the pointer
             # published, so a file edited behind the reader's back is a new key
-            # and is then refused by the manifest check (CONTRACTS §4.2).
+            # and is then refused by the manifest check.
             key = (generation, _manifest_digest(manifest),
                    _read_stamp(self.directory, generation))
             if key != self.key:
@@ -394,7 +393,7 @@ def _read_stamp(directory, generation):
     looking at the same bytes it verified last time.  Both are needed: a
     checksum alone would happily keep serving a cached answer after somebody
     edited the file behind the reader's back, and the contract's answer to that
-    is a refusal, not a stale cache hit (CONTRACTS §4.2, defect 9).
+    is a refusal, not a stale cache hit.
     """
     root = Path(directory)/'generations'/generation
     parts = []
@@ -487,7 +486,7 @@ def parse_query(query):
 
 
 def policy_of(query, *, min_success=2/3, strict=False, denylist=None, max_age_seconds=None):
-    """The one admission policy the read paths share (CONTRACTS §2.3, F18)."""
+    """The one admission policy the read paths share."""
     return core.Policy(
         max_age_seconds=float(max_age_seconds or core.DEFAULT_MAX_AGE_SECONDS),
         min_success=min_success, min_anonymity=query.get('anonymity', 'any'),
@@ -572,8 +571,43 @@ def country_matches(row, query, *, now=None, workbench=None):
     return bool(country_selected([row], query, now=now, workbench=workbench))
 
 
+def _number(value, missing):
+    try:
+        return float(value) if value is not None else missing
+    except (TypeError, ValueError):
+        return missing
+
+
+#: The order each ``sort`` names, over the published row: the same keys, in the
+#: same priority, as the engine's own ``EXPORT_ORDERS`` puts them in SQL.
+_SORT_KEYS = {
+    'quality': lambda row: (-_number(row.get('score'), float('-inf')),
+                            _number(row.get('latency_ms'), float('inf')), row.get('proxy') or ''),
+    'speed': lambda row: (_number(row.get('latency_ms'), float('inf')),
+                          -_number(row.get('reliability'), float('-inf')), row.get('proxy') or ''),
+    'stability': lambda row: (_number(row.get('jitter_ms'), float('inf')),
+                              _number(row.get('latency_ms'), float('inf')), row.get('proxy') or ''),
+    'uptime': lambda row: (-_number(row.get('uptime'), float('-inf')),
+                           -_number(row.get('checks'), float('-inf')),
+                           -_number(row.get('score'), float('-inf')), row.get('proxy') or ''),
+    'bandwidth': lambda row: (row.get('mbps') is None, -_number(row.get('mbps'), 0.0),
+                              -_number(row.get('score'), float('-inf')), row.get('proxy') or ''),
+}
+
+
+def sort_rows(rows, sort):
+    """Rows in the order ``sort`` asks for.
+
+    ``recommended`` (or no sort) is the order the snapshot was published in:
+    the recommendation score is computed at export time and is not a field of
+    the published row, so it cannot be recomputed here.
+    """
+    key = _SORT_KEYS.get(str(sort or ''))
+    return sorted(rows, key=key) if key else list(rows)
+
+
 # ---------------------------------------------------------------------------
-# The service layer /v1 is built on (F18)
+# The service layer /v1 is built on
 # ---------------------------------------------------------------------------
 
 
@@ -650,8 +684,7 @@ def rows_for(self, query=None, wanted=None):
 
         ``wanted`` is the set of freshness views the caller asked for; every row
         keeps its own ``freshness`` value and its own reason, so a mixed-age set
-        stays mixed instead of being sorted into "there is nothing here"
-        (CONTRACTS §4.3, defect 3).
+        stays mixed instead of being sorted into "there is nothing here".
         """
         if wanted is None or wanted == {'fresh'}:
             return self.exports.load()
@@ -660,7 +693,12 @@ def rows_for(self, query=None, wanted=None):
         return [row for row in self.exports.rows if row.get('freshness') in views], status
 
     def page(self, items, stream_id, offset=0, limit=None):
-        """One page plus the ``(stream_id, seq)`` cursor the contract defines."""
+        """One page plus the ``(stream_id, seq)`` cursor the contract defines.
+
+        Rows are numbered from 1: ``next_seq`` is the sequence number of the
+        first row of the next page, so the offset it resumes at is one less
+        (:meth:`_offset`).
+        """
         start = max(0, int(offset or 0))
         window = items[start:start + limit] if limit else items[start:]
         return {'items': window, 'stream_id': stream_id,
@@ -668,6 +706,30 @@ def page(self, items, stream_id, offset=0, limit=None):
                 'next_seq': start + len(window) + 1 if window and start + len(window) < len(items) else None,
                 'total': len(items)}
 
+    @staticmethod
+    def _offset(call):
+        """The offset a :meth:`page` cursor resumes at.
+
+        The cursor carries ``next_seq``, the 1-based number of the next row.
+        Reading it as an offset (``schedules.list`` did) skipped one row per
+        page, and ignoring it (every result listing did) served page one again
+        forever.
+        """
+        query = getattr(call, 'query', None) or {}
+        return max(0, int(query.get('cursor_seq') or 0) - 1)
+
+    def _paged(self, call, items, stream_id, **extra):
+        """A whole list cut to the page the caller asked for.
+
+        Most listings used to return every row with ``next_seq: None`` and
+        read no ``limit`` at all, although the route declares both ``limit``
+        and ``cursor``: a declared parameter that is silently ignored.
+        """
+        limit = (getattr(call, 'query', None) or {}).get('limit')
+        body = self.page(list(items), stream_id, self._offset(call), int(limit) if limit else None)
+        body.update(extra)
+        return body
+
     def queue_state(self):
         running = 0
         conn = self.connection()
@@ -718,11 +780,11 @@ def _op_service_capabilities(self, call):
                 'protocols': list(PROTOCOLS), 'formats': list(FORMATS),
                 'freshness': list(FRESHNESS_MODES),
                 'snapshot_schema_versions': list(exportsvc.SUPPORTED_SCHEMA_VERSIONS),
-                # What is really measured, and what is declared unsupported
-                # (F20): a websocket, a long connection, media, UDP or HTTP/3 is
+                # What is really measured, and what is declared unsupported:
+                # a websocket, a long connection, media, UDP or HTTP/3 is
                 # reported as unprobed rather than as a passing GET.
                 'probes': engine.capability_manifest(),
-                # The one country criterion every surface filters with (F08).
+                # The one country criterion every surface filters with.
                 'country': {'basis': 'endpoint', 'unknown': 'exclude',
                             'digest': engine.criterion_digest()},
                 'network': {'bind': 'loopback'}}
@@ -737,9 +799,12 @@ def _op_service_queue(self, call):
 
     # -- results -----------------------------------------------------------
 
-    def _result_page(self, call, rows, status, stream_kind='results'):
-        limit = min(int(call.query.get('limit') or 100), 1000)
-        offset = int(call.query.get('offset') or 0)
+    def _result_page(self, call, rows, status, stream_kind='results', limit=None):
+        limit = min(int(limit or call.query.get('limit') or 100), 1000)
+        # The cursor is the only way a caller can ask for the next page; the
+        # page used to be read from an ``offset`` no route declares, so
+        # following ``next_cursor`` returned the first page again forever.
+        offset = self._offset(call)
         stream_id = f'generation:{status.get("generation") or "none"}'
         page = self.page(list(rows), stream_id, offset, limit)
         page['generation'] = status.get('generation')
@@ -751,8 +816,7 @@ def _result_page(self, call, rows, status, stream_kind='results'):
     def _freshness_view(self, query):
         """Which freshness views a request asked for, from the declared parameters.
 
-        The route declares ``include_stale`` and ``include_unknown`` (CONTRACTS
-        §5.7: "the unknown and stale modes are explicit parameters, not a silent
+        The route declares ``include_stale`` and ``include_unknown`` (the shared contract: "the unknown and stale modes are explicit parameters, not a silent
         exclusion of rows").  It never declared a ``freshness`` parameter, so
         reading one here used to read a value that could not arrive: expired and
         unknown rows were unreachable over ``/v1`` no matter what the caller
@@ -766,29 +830,44 @@ def _freshness_view(self, query):
             wanted.add('unknown')
         return wanted
 
+    def _selected_rows(self, call):
+        """The published rows one results query selects, filtered, guarded and sorted.
+
+        ``results.list`` declares a dozen filters and a sort; the handler read
+        two of them (protocol and country) and answered 200 for the rest, so
+        ``max_latency_ms=100`` or ``sort=speed`` returned the same rows as no
+        parameter at all (F07: a parameter is never silently ignored).
+        """
+        query = call.query or {}
+        rows, status = self.rows_for(query, self._freshness_view(query))
+        wanted = query.get('generation')
+        if wanted and wanted != status.get('generation'):
+            raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404,
+                                 details={'generation': wanted,
+                                          'published': status.get('generation')},
+                                 action=tr('читайте опубликованное поколение',
+                                           'read the published generation'))
+        rows = self._filter_rows(rows, query)
+        rows = self._guard_objects(rows, call, 'collection_id', 'collections')
+        return sort_rows(rows, query.get('sort')), status
+
     def _op_results_list(self, call):
-        wanted = self._freshness_view(call.query)
-        rows, status = self.rows_for(call.query, wanted)
-        rows = [row for row in rows if self._matches(row, call.query)]
-        return self._result_page(call, self._guard_objects(rows, call, 'collection_id', 'collections'),
-                                 status)
+        rows, status = self._selected_rows(call)
+        return self._result_page(call, rows, status)
 
     def _op_results_random(self, call):
-        rows, status = self.rows_for(call.query, self._freshness_view(call.query))
-        rows = [row for row in rows if self._matches(row, call.query)]
-        rows = self._guard_objects(rows, call, 'collection_id', 'collections')
-        limit = min(int(call.query.get('limit') or 1), 1000)
-        picked = random.sample(rows, min(len(rows), limit)) if rows else []
+        rows, status = self._selected_rows(call)
+        # The route declares ``count`` (default 1); ``limit`` is not even a
+        # parameter of this route, so reading it always gave one row.
+        count = min(int(call.query.get('count') or 1), 100)
+        picked = random.sample(rows, min(len(rows), count)) if rows else []
         return {'items': picked, 'stream_id': f'generation:{status.get("generation") or "none"}',
                 'next_seq': None, 'generation': status.get('generation')}
 
     def _op_results_top(self, call):
-        limit = min(int(call.query.get('limit') or 10), 1000)
-        rows, status = self.rows_for(call.query, self._freshness_view(call.query))
-        rows = [row for row in rows if self._matches(row, call.query)]
-        return self._result_page(call,
-                                 self._guard_objects(rows, call, 'collection_id', 'collections')[:limit],
-                                 status)
+        rows, status = self._selected_rows(call)
+        count = min(int(call.query.get('count') or 10), apiv1.MAX_PAGE_LIMIT)
+        return self._result_page(call, rows[:count], status, limit=count)
 
     def _find_row(self, wanted):
         """The published row a path segment names, or ``None``.
@@ -824,7 +903,7 @@ def _guarded_row(self, call, wanted):
             raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': wanted})
         if not self._guard_objects([row], call, 'collection_id', 'collections'):
             # Same code as a missing row: a key must not learn that an
-            # out-of-scope object exists (CONTRACTS §5.3).
+            # out-of-scope object exists.
             raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': wanted})
         return row
 
@@ -859,20 +938,69 @@ def _op_results_observations(self, call):
         return {'items': items, 'stream_id': f'observations:{endpoint}', 'next_seq': None}
 
     def _matches(self, row, query):
+        return bool(self._filter_rows([row], query))
+
+    def _filter_rows(self, rows, query):
+        """The rows a results query keeps, every declared filter applied.
+
+        The country part is the one criterion ``select`` and the export use.
+        It used to be evaluated row by row with a *new* ``Workbench`` each time
+        -- one database connection per published row, none of them closed --
+        so one ``?country=`` request opened as many connections as there were
+        rows.  The whole list now goes through one criterion and one engine.
+        """
+        rows = list(rows)
         if not query:
-            return True
+            return rows
+        now = self.clock()
         protocol = query.get('protocol')
-        if protocol and protocol != 'all' and row.get('protocol') != protocol:
-            return False
-        # A third copy of the country test used to live here, parsing the query
-        # string itself and knowing nothing about an exit country, an exclusion
-        # or an unknown one.  It is the same criterion ``select`` and the export
-        # use, so one row has one country answer in this service.
-        if query.get('country'):
-            return country_matches(
-                row, {'countries': geoip.parse_countries(str(query['country']))},
-                workbench=self.workbench())
-        return True
+        collection = query.get('collection_id')
+        profile = query.get('profile_id')
+        revision = query.get('profile_revision')
+        max_latency = query.get('max_latency_ms')
+        min_mbps = query.get('min_mbps')
+        minimum = query.get('anonymity')
+        max_age = query.get('max_age_seconds')
+        rank = anonymity.LEVEL_RANK
+        kept = []
+        for row in rows:
+            if protocol and protocol != 'all' and row.get('protocol') != protocol:
+                continue
+            if collection and row.get('collection_id') != collection:
+                continue
+            if profile and row.get('profile_id') != profile:
+                continue
+            if revision is not None and row.get('profile_revision') != int(revision):
+                continue
+            if max_latency is not None:
+                latency = row.get('latency_ms')
+                if latency is None or float(latency) > float(max_latency):
+                    continue
+            if min_mbps:
+                mbps = row.get('mbps')
+                if mbps is None or float(mbps) < float(min_mbps):
+                    continue
+            if minimum and minimum != 'any' and \
+                    rank.get(row.get('anonymity') or 'unknown', -1) < rank.get(minimum, 0):
+                continue
+            if _flag(query, 'exclude_hosting') and row.get('hosting'):
+                continue
+            if max_age is not None:
+                checked = row.get('checked_at')
+                try:
+                    if checked is None or now - float(checked) > float(max_age):
+                        continue
+                except (TypeError, ValueError):
+                    continue
+            kept.append(row)
+        if query.get('country') and kept:
+            criterion = {'countries': geoip.parse_countries(str(query['country']))}
+            workbench = self.workbench()
+            try:
+                kept = country_selected(kept, criterion, now=now, workbench=workbench)
+            finally:
+                workbench.close()
+        return kept
 
     # -- status and exports -------------------------------------------------
 
@@ -1034,7 +1162,7 @@ def _op_profiles_update_version(self, call):
             if call.expected_revision is not None and \
                     int(call.expected_revision) != int(current.revision):
                 # The caller edited an older version: refuse instead of
-                # overwriting what it never saw (F05, CONTRACTS §6.4).
+                # overwriting what it never saw.
                 raise apiv1.ApiError(
                     'E_CONFLICT_REVISION',
                     details={'expected': call.expected_revision, 'current': current.revision,
@@ -1063,7 +1191,7 @@ def _op_exports_create(self, call):
         Only ``proxytool.export`` builds a generation, and only it decides
         whether the active pointer moves: ``kind='published'`` publishes,
         ``kind='selection'`` and ``kind='diagnostic'`` are separate artifacts
-        that never touch the active pool (CONTRACTS §4.5, defect 7).
+        that never touch the active pool.
         """
         from . import proxytool as engine
 
@@ -1097,7 +1225,7 @@ def action(workbench):
             # mode name is `reference`, and it was `include` -- a value outside
             # `CREDENTIALS_MODES`, so `ExportOptions` refused the request after the
             # `export.secret` check had already passed and the caller saw a 500
-            # instead of an artifact (F29, F28).
+            # instead of an artifact.
             wants_secrets = bool(body.get('include_secrets'))
             report = engine.export(
                 conn, profile, workbench.data / 'exports',
@@ -1228,52 +1356,84 @@ def _op_collections_create(self, call):
         return {'id': identifier, 'name': name, 'kind': collection_kind(body.get('kind')),
                 'created_at': time.time()}
 
+    @staticmethod
+    def _collection_row(conn, identifier):
+        """One collection with its revision, or 404; an old file reads as revision 1."""
+        row = conn.execute('SELECT * FROM collections WHERE id=?', (identifier,)).fetchone()
+        if row is None:
+            raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': identifier})
+        found = dict(row)
+        found['revision'] = int(found.get('revision') or 1)
+        found['archived'] = found.get('archived_at') is not None
+        return found
+
+    @staticmethod
+    def _check_collection_revision(call, current):
+        """``If-Match`` (or ``revision``) must name the revision that is stored now."""
+        expected = call.expected_revision
+        if expected is not None and int(expected) != current['revision']:
+            raise apiv1.ApiError(
+                'E_CONFLICT_REVISION', status=409,
+                details={'expected': int(expected), 'stored': current['revision']},
+                action=tr('перечитайте коллекцию и повторите с её ревизией',
+                          'read the collection again and retry with its revision'))
+
     def _op_collections_update(self, call):
+        """Rename, archive or restore a collection under its revision.
+
+        The revision is ``collections.revision`` (migration 20); every change
+        moves it by one.  A request that changes nothing leaves it alone.
+        """
         from . import db as schema
         identifier = call.params.get('id')
         body = call.body or {}
         _refuse_unsupported_allow_private(body)
-        expected = call.expected_revision
         conn = self.writable_connection()
         try:
-            row = conn.execute('SELECT id, name FROM collections WHERE id=?',
-                               (identifier,)).fetchone()
-            if row is None:
-                raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': identifier})
-            if expected is not None:
-                # ``collections`` carries no revision column (CONTRACTS §3.3,
-                # migration 2), so a supplied revision cannot be proven current
-                # and is refused rather than assumed.  See the handoff to db.py.
-                raise apiv1.ApiError(
-                    'E_CONFLICT_REVISION',
-                    details={'expected': expected, 'stored': None,
-                             'reason': 'collections has no revision column'},
-                    action=tr('повторите без ревизии или обновите схему',
-                              'retry without a revision, or migrate the schema'))
-            if body.get('name'):
-                schema.rename_collection(conn, identifier, str(body['name']))
-            conn.commit()
-            fresh = conn.execute('SELECT id, name, kind, created_at, archived_at FROM collections '
-                                 'WHERE id=?', (identifier,)).fetchone()
+            conn.execute('BEGIN IMMEDIATE')
+            current = self._collection_row(conn, identifier)
+            self._check_collection_revision(call, current)
+            if body.get('name') is not None:
+                name = str(body['name']).strip()
+                if not name:
+                    raise apiv1.field_error('name', tr('имя не может быть пустым',
+                                                        'the name must not be blank'))
+                if name != current['name']:
+                    schema.rename_collection(conn, identifier, name)
+            archived = body.get('archived')
+            if archived is True and not current['archived']:
+                schema.archive_collection(conn, identifier)
+            elif archived is False and current['archived']:
+                schema.unarchive_collection(conn, identifier)
+            conn.execute('COMMIT')
+            return self._collection_row(conn, identifier)
         except schema.DbError as exc:
             raise apiv1.ApiError('E_VALIDATION_FIELD', action=str(exc)) from None
         finally:
+            if conn.in_transaction:
+                conn.execute('ROLLBACK')
             _close(conn)
-        return dict(fresh)
 
     def _op_collections_archive(self, call):
         from . import db as schema
         identifier = call.params.get('id')
         conn = self.writable_connection()
         try:
-            schema.archive_collection(conn, identifier)
-            conn.commit()
+            conn.execute('BEGIN IMMEDIATE')
+            current = self._collection_row(conn, identifier)
+            self._check_collection_revision(call, current)
+            if not current['archived']:
+                schema.archive_collection(conn, identifier)
+            conn.execute('COMMIT')
+            fresh = self._collection_row(conn, identifier)
         except schema.DbError as exc:
             raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404,
                                  details={'id': identifier}, action=str(exc)) from None
         finally:
+            if conn.in_transaction:
+                conn.execute('ROLLBACK')
             _close(conn)
-        return {'id': identifier, 'archived': True}
+        return {'id': identifier, 'archived': True, 'revision': fresh['revision']}
 
     def _op_collections_members(self, call):
         wanted = call.params.get('id')
@@ -1288,13 +1448,16 @@ def _op_collections_members(self, call):
             items = []
         finally:
             _close(conn)
-        return {'items': self._guard_objects(items, call, 'endpoint_id', 'collections'),
-                'stream_id': f'collection:{wanted}', 'next_seq': None}
+        # The route already refused a collection outside the key's scope.  The
+        # rows used to be filtered once more by comparing each *endpoint id*
+        # with the allowed *collection ids*, so a scoped key always saw an
+        # empty member list of its own collection.
+        return self._paged(call, items, f'collection:{wanted}')
 
     def _guard_objects(self, items, call, field, kind, collection_field='collection_id'):
         """Never reveal an object the caller's resource scope does not name.
 
-        A key's scope names collections and pools (CONTRACTS §5.3).  An object of
+        A key's scope names collections and pools.  An object of
         any other kind -- a job, a schedule -- is visible when the collection it
         belongs to is in the scope.  Before this rule the filter asked
         :func:`_scope_values` for a kind the principal does not carry, was told
@@ -1490,17 +1653,26 @@ def _op_pools_status(self, call):
         return _status_dict(status)
 
     def _op_pools_members(self, call):
+        pool_id = call.params.get('id')
         store, conn = self._pool_store()
         try:
+            spec = store.get(pool_id) if store is not None else None
+            # A pool that does not exist, or whose collection the key cannot
+            # see, is not found -- it used to answer 200 with an empty list.
+            if spec is None or not self._guard_objects([_pool_dict(spec)], call, 'id', 'pools'):
+                raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': pool_id})
+            if _scope_values(call.principal, 'pools') is None and \
+                    not self._guard_objects([_pool_dict(spec)], call, 'id', 'jobs'):
+                raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': pool_id})
             # `pools.Member` is a dataclass, not a mapping: `dict(member)` raised
             # `TypeError` and the route answered 500 for every pool, so the
             # membership a refill had just written was never visible over /v1.
-            items = [_member_dict(member)
-                     for member in store.members(call.params.get('id'))] if store is not None else []
+            items = [_member_dict(member) for member in store.members(pool_id)]
         finally:
             _close(conn)
-        return {'items': self._guard_objects(items, call, 'endpoint_id', 'pools'),
-                'stream_id': f'pool:{call.params.get("id")}', 'next_seq': None}
+        # Members are filtered by the pool, which was checked above; comparing
+        # member endpoint ids with allowed pool ids emptied every scoped list.
+        return self._paged(call, items, f'pool:{pool_id}')
 
 
     # -- the service layer the modules are reached through ------------------
@@ -1520,7 +1692,7 @@ def _with_workbench(self, action):
 
         A module exception never reaches the client: it becomes the stable
         ``E_*`` code the CLI prints, so one refusal reads the same in a terminal
-        and in a JSON body (CONTRACTS §5.4).
+        and in a JSON body.
         """
         from . import proxytool as engine
         workbench = self.workbench()
@@ -1537,6 +1709,14 @@ def _with_workbench(self, action):
         except (sqlite3.Error, OSError) as exc:
             raise apiv1.ApiError('E_STATE_SNAPSHOT_STATIC', status=503,
                                  message=f'{type(exc).__name__}') from None
+        except ValueError as exc:
+            # The engine refuses a bad value with ``ValueError`` (an export
+            # selection it cannot normalize, a profile it does not know).  That
+            # is the caller's input, not an outage: it used to surface as
+            # ``500 E_SERVICE_UNAVAILABLE``.
+            raise apiv1.ApiError('E_VALIDATION_FIELD', status=400,
+                                 message=str(exc) or 'invalid value',
+                                 details={'reason': str(exc)[:300]}) from None
         finally:
             workbench.close()
 
@@ -1568,7 +1748,7 @@ def _import_format(self, call):
         return wanted if wanted in importer.FORMATS else None
 
     def _import_policy(self, call):
-        """The endpoint policy of an import, from the request body (defect 10).
+        """The endpoint policy of an import, from the request body.
 
         ``importer.DEFAULT_POLICY`` refuses hostnames, private addresses and the
         RFC 5737 documentation ranges.  The CLI has ``--allow-private-endpoints``
@@ -1629,7 +1809,7 @@ def action(workbench):
                                      details={'needs_mapping': True})
             report = workbench.import_commit(plan, allow_partial=bool((call.body or {}).get('allow_partial')))
             # The route is an async job: a long operation answers with a job id
-            # and never holds the request open (R18).
+            # and never holds the request open.
             body = report.to_dict()
             body['allow_private_endpoints'] = not policy.public_only
             body['job_id'] = self._record_job(workbench, 'import', collection, len(report.added or ()))
@@ -1641,7 +1821,7 @@ def _record_job(self, workbench, kind, collection_id, items):
 
         The work itself already happened; the job exists so the caller can ask
         after it with the same cursor schema as every other stream, and so a
-        repeated idempotency key returns the same id (CONTRACTS §5.7, §6.4).
+        repeated idempotency key returns the same id.
         """
         from . import jobs as jobs_module
         scope = jobs_module.Scope(collection_id=collection_id,
@@ -1676,43 +1856,104 @@ def _membership(self, call, workbench, *, add):
         values = list(dict.fromkeys(values))
         if not values:
             raise apiv1.field_error('endpoint', tr('нужен адрес', 'an address is required'))
+        from . import proxytool as engine
         conn = workbench.conn
+        if conn.execute('SELECT 1 FROM collections WHERE id=?', (collection,)).fetchone() is None:
+            raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': collection})
         changed = []
+        if add:
+            # The one normalizer decides what an address is; a value it cannot
+            # read ("not an endpoint") used to be stored verbatim as a member.
+            # Credentials are refused structurally by it.  Every value is
+            # checked before the first one is written.
+            values = [engine.normalize_custom(value) or value for value in values]
+            bad = [value for value in values if engine.normalize_custom(value) != value]
+            if bad:
+                raise apiv1.ApiError(
+                    'E_VALIDATION_FIELD', status=400,
+                    details={'field': 'endpoint', 'reason': 'not a proxy address',
+                             'value': str(bad[0])[:128]},
+                    action=tr('укажите scheme://host:port', 'send scheme://host:port'))
         for value in values:
             if add:
-                # Adding a member may introduce an address the engine has never
-                # seen; the one normalizer still decides what it is.
-                endpoint = schema.upsert_endpoint(conn, value)
-            else:
-                endpoint = schema.endpoint_id(value)
-                row = conn.execute('SELECT canonical FROM endpoints WHERE id=?', (endpoint,)).fetchone()
-                if row is None:
-                    raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404,
-                                         details={'endpoint_id': value})
-            if add:
+                canonical = value
+                endpoint = schema.upsert_endpoint(conn, canonical)
                 schema.add_member(conn, collection, endpoint,
                                   origin=str(body.get('origin') or 'manual'), now=workbench.clock())
-            else:
-                conn.execute('DELETE FROM membership WHERE collection_id=? AND endpoint_id=?',
-                             (collection, endpoint))
-            changed.append(value)
+                changed.append(canonical)
+                continue
+            # The path names an endpoint *id*; hashing it again as if it were
+            # an address never matched a row.  An address is still accepted
+            # and resolved through the normalizer.
+            endpoint = value
+            if conn.execute('SELECT 1 FROM endpoints WHERE id=?', (endpoint,)).fetchone() is None:
+                canonical = engine.normalize_custom(value)
+                endpoint = schema.endpoint_id(canonical) if canonical else None
+            if endpoint is None or not schema.remove_member(conn, collection, endpoint):
+                raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404,
+                                     details={'endpoint_id': value, 'collection_id': collection})
+            changed.append(endpoint)
         conn.commit()
         return {'collection_id': collection, 'changed': changed, 'added': bool(add)}
 
     def _op_collections_merge(self, call):
-        return self._apply_collection_mode(call, 'merge')
+        """Copy the members of ``from_collection_id`` into this collection.
+
+        The route declares ``from_collection_id`` and no content; the handler
+        used to run an import and demand ``content``, so the documented body
+        was always refused.  Nothing is removed from either collection.
+        """
+        def action(workbench):
+            conn = workbench.conn
+            target = str(call.params.get('id') or '')
+            source = str((call.body or {}).get('from_collection_id') or '').strip()
+            if not source:
+                raise apiv1.field_error('from_collection_id', tr('укажите исходную коллекцию',
+                                                                  'name the source collection'))
+            if source == target:
+                raise apiv1.field_error('from_collection_id',
+                                        tr('коллекция не сливается сама с собой',
+                                           'a collection cannot be merged into itself'))
+            self._check_collection_revision(call, self._collection_row(conn, target))
+            self._collection_row(conn, source)
+
+            def count():
+                return conn.execute('SELECT count(*) FROM membership WHERE collection_id=?',
+                                    (target,)).fetchone()[0]
+            before = count()
+            conn.execute('INSERT OR IGNORE INTO membership(collection_id, endpoint_id, added_at, origin) '
+                         "SELECT ?, endpoint_id, ?, 'import' FROM membership WHERE collection_id=?",
+                         (target, workbench.clock(), source))
+            conn.commit()
+            after = count()
+            return {'collection_id': target, 'from_collection_id': source,
+                    'added': after - before, 'members': after,
+                    'job_id': self._record_job(workbench, 'merge', target, after - before)}
+        return self._with_workbench(action)
 
     def _op_collections_replace(self, call):
-        return self._apply_collection_mode(call, 'replace')
+        """Replace the members of one collection with a list, as a job.
 
-    def _apply_collection_mode(self, call, mode):
+        The route is ``async_job``; the report carried no ``job_id``, so a
+        successful replace was answered with 503.
+        """
         def action(workbench):
-            source = self._import_source(call, workbench)
             collection = str(call.params.get('id') or schema_public_collection())
-            plan = workbench.import_preview(source, collection, mode=mode,
+            self._check_collection_revision(call, self._collection_row(workbench.conn, collection))
+            source = self._import_source(call, workbench)
+            policy = self._import_policy(call)
+            self._audit_import_policy(workbench, call, collection, policy)
+            plan = workbench.import_preview(source, collection, mode='replace',
+                                            fmt=self._import_format(call), policy=policy,
                                             idempotency_key=call.idempotency_key)
-            report = workbench.import_commit(plan, allow_partial=bool((call.body or {}).get('allow_partial')))
-            return report.to_dict()
+            if plan.needs_mapping:
+                raise apiv1.ApiError('E_VALIDATION_SCHEMA', status=400,
+                                     details={'needs_mapping': True})
+            report = workbench.import_commit(plan)
+            body = report.to_dict()
+            body['job_id'] = self._record_job(workbench, 'replace', collection,
+                                              len(report.added or ()))
+            return body
         return self._with_workbench(action)
 
     # -- jobs ---------------------------------------------------------------
@@ -1798,20 +2039,52 @@ def action(workbench):
         return self._with_workbench(action)
 
     def _op_events_system(self, call):
-        """The system stream, read the same way as a job stream (CONTRACTS §5.7)."""
-        from . import jobs as jobs_module
-        def action(workbench):
-            store = self._job_store_of(workbench)
-            events = []
-            for job in store.jobs(limit=50):
-                events.extend(store.events(job.id, after_seq=int(call.query.get('cursor') or 0),
-                                           limit=int(call.query.get('limit') or 200)))
-            events.sort(key=lambda item: item.seq)
-            items = [_event_dict(event) for event in events]
-            return {'items': items, 'stream_id': 'system', 'next_seq': None,
-                    'last_seq': items[-1]['seq'] if items else 0}
-        del jobs_module
-        return self._with_workbench(action)
+        """The system stream, read the same way as a job stream."""
+        """Every job's events in one stream, numbered by the order they were written.
+
+        The old handler read ``int(cursor)`` of an opaque base64 cursor (a 500
+        on every resume) and merged per-job ``seq`` values, which repeat from
+        one job to the next, so the stream broke on the second job.  The system
+        stream's ``seq`` is now the row order of ``job_event``, which is global
+        and increasing, and an event of a collection the key cannot see is not
+        in it.
+        """
+        stream = str(call.query.get('stream') or 'system')
+        if stream.startswith('job:'):
+            return self._op_jobs_events(dataclasses.replace(
+                call, params={**dict(call.params or {}), 'id': stream[4:]}))
+        if stream != 'system':
+            raise apiv1.field_error('stream', tr('system или job:<id>', 'system or job:<id>'))
+        after = int(call.query.get('cursor_seq') or 0)
+        limit = min(int(call.query.get('limit') or 200), 1000)
+        allowed = _scope_values(call.principal, 'collections')
+        conn = self.connection()
+        items = []
+        try:
+            rows = conn.execute(
+                'SELECT e.rowid AS rid, e.job_id, e.seq, e.at, e.type, e.code, e.data_json, '
+                'j.collection_id FROM job_event e LEFT JOIN job j ON j.id = e.job_id '
+                'WHERE e.rowid > ? ORDER BY e.rowid LIMIT ?',
+                (after, limit if allowed is None else limit * 20)).fetchall() \
+                if conn is not None else []
+        except sqlite3.Error:
+            rows = []
+        finally:
+            _close(conn)
+        for row in rows:
+            if allowed is not None and row['collection_id'] not in allowed:
+                continue
+            try:
+                data = json.loads(row['data_json'] or '{}')
+            except (TypeError, ValueError):
+                data = {}
+            items.append({'seq': int(row['rid']), 'at': row['at'], 'type': row['type'],
+                          'job_id': row['job_id'], 'item_id': data.get('item_id'),
+                          'code': row['code'], 'data': dict(data, job_seq=row['seq'])})
+            if len(items) >= limit:
+                break
+        return {'items': items, 'stream_id': 'system', 'next_seq': None,
+                'last_seq': items[-1]['seq'] if items else after}
 
     # -- checks as jobs -----------------------------------------------------
 
@@ -1881,25 +2154,60 @@ def action(workbench):
 
     # -- pools as jobs ------------------------------------------------------
 
-    def _op_pools_create(self, call):
-        from . import pools as pools_module
+    def _pool_profile(self, workbench, wanted):
+        """The profile a new pool is measured under, and its revision.
 
+        ``profile_id`` is optional on the route; the default is the one the
+        GUI uses -- the profile of the last check (``last-profile.txt``).  A
+        profile that does not exist is refused here: the pool used to be
+        created and then failed on its first recheck.
+        """
+        from . import proxytool as engine
+        profile_id = str(wanted or '').strip()
+        if not profile_id:
+            profile_id = engine.active_profile_id(workbench) or ''
+            if not profile_id:
+                raise apiv1.field_error(
+                    'profile_id', tr('профиль не указан, а проверок ещё не было',
+                                     'no profile was given and no check has run yet'),
+                    action=tr('укажите profile_id или сначала выполните проверку',
+                              'send profile_id, or run a check first'))
+            return profile_id, 1
+        conn = workbench.conn
+        if conn.execute('SELECT 1 FROM profiles WHERE id=?', (profile_id,)).fetchone() is not None:
+            return profile_id, 1
+        head = conn.execute("SELECT revision FROM profiles WHERE id GLOB ? "
+                            'ORDER BY revision DESC LIMIT 1',
+                            (profile_id.replace('[', '[[]').replace('*', '[*]')
+                             .replace('?', '[?]') + '@*',)).fetchone() \
+            if 'revision' in {row[1] for row in conn.execute('PRAGMA table_info(profiles)')} else None
+        if head is not None:
+            return profile_id, int(head[0] or 1)
+        raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404,
+                             details={'field': 'profile_id', 'profile_id': profile_id},
+                             action=tr('выберите профиль из GET /v1/profiles',
+                                       'pick a profile from GET /v1/profiles'))
+
+    def _op_pools_create(self, call):
         def action(workbench):
             body = call.body or {}
             pool_id = str(body.get('name') or body.get('id') or '').strip()
             if not pool_id:
                 raise apiv1.field_error('name', tr('имя пула обязательно', 'a pool needs a name'))
+            if workbench.pools().get(pool_id) is not None:
+                raise apiv1.ApiError('E_CONFLICT_IDEMPOTENCY', status=409,
+                                     details={'id': pool_id},
+                                     action=tr('выберите другое имя', 'choose another name'))
+            profile_id, profile_revision = self._pool_profile(workbench, body.get('profile_id'))
             spec = workbench.pools().create(
                 pool_id, collection_id=str(body.get('collection_id') or schema_public_collection()),
-                profile_id=str(body.get('profile_id') or ''),
+                profile_id=profile_id, profile_revision=profile_revision,
                 desired=int(body.get('desired') or 0), minimum=int(body.get('minimum') or 0),
                 reserve=int(body.get('reserve') or 0), policy=body.get('policy') or None)
             return _pool_dict(spec)
         return self._with_workbench(action)
 
     def _op_pools_update(self, call):
-        from . import pools as pools_module
-
         def action(workbench):
             store = workbench.pools()
             pool_id = str(call.params.get('id') or '')
@@ -1912,9 +2220,16 @@ def action(workbench):
                                      details={'expected': call.expected_revision,
                                               'stored': getattr(spec, 'revision', 1)})
             body = call.body or {}
-            if body.get('desired') is not None:
-                spec = pools_module.evict(spec, int(body['desired']), pool_id=pool_id) \
-                    if False else spec
+            name = body.get('name')
+            if name is not None and str(name).strip() != pool_id:
+                # A pool's name is its id: members, leases, schedules and
+                # gateway bindings all refer to it.  Renaming it used to be
+                # accepted and silently dropped.
+                raise apiv1.field_error(
+                    'name', tr('имя пула — его идентификатор и не меняется',
+                               'the name of a pool is its id and cannot be changed'),
+                    action=tr('создайте новый пул с нужным именем',
+                              'create a new pool with the name you want'))
             if body.get('policy'):
                 store.set_policy(pool_id, body['policy'])
             if body.get('desired') is not None or body.get('reserve') is not None or \
@@ -2057,8 +2372,7 @@ def action(workbench):
             engine = self._scheduler(workbench)
             items = [_schedule_dict(spec) for spec in engine.list()
                      if self._schedule_visible(spec, call, workbench)]
-            return self.page(items, 'schedules', offset=call.query.get('cursor_seq', 0),
-                             limit=call.query.get('limit'))
+            return self._paged(call, items, 'schedules')
         return self._with_workbench(action)
 
     def _op_schedules_get(self, call):
@@ -2103,6 +2417,13 @@ def action(workbench):
                 payload['collection_id'] = pool.collection_id
             else:
                 payload['collection_id'] = payload.get('collection_id') or schema_public_collection()
+                if workbench.conn.execute('SELECT 1 FROM collections WHERE id=?',
+                                          (payload['collection_id'],)).fetchone() is None:
+                    # A schedule on a collection that does not exist was
+                    # stored and then failed on every run.
+                    raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404,
+                                         details={'field': 'collection_id',
+                                                  'collection_id': payload['collection_id']})
             from . import scheduler
             spec = scheduler.ScheduleSpec.from_dict(payload)
             if not self._schedule_visible(spec, call, workbench):
@@ -2113,7 +2434,7 @@ def action(workbench):
 
     #: The API's schedule vocabulary mapped onto the module's own names.  A
     #: field the module does not know is dropped *here*, on purpose, and never
-    #: passed through as if it had been understood (CONTRACTS §5.4).
+    #: passed through as if it had been understood.
     SCHEDULE_KINDS = {'check': 'interval', 'refill': 'interval', 'recheck': 'interval',
                       'export': 'interval', 'source': 'interval'}
 
@@ -2231,7 +2552,7 @@ def _source_settings(self):
 
         It is a separate file from the bundled catalog on purpose: a catalog is
         read-only research, this file is the user's choice, and neither is
-        rewritten by an update (F13, F27).
+        rewritten by an update.
         """
         return read_source_settings(self.data)
 
@@ -2256,6 +2577,10 @@ def _op_sources_catalog(self, call):
         view = self._source_view(call)
         rows = view.get('sources') or []
         end = view.get('offset', 0) + len(rows)
+        # One read of the catalog for the three header fields: an accepted
+        # catalog in the data folder is ~650 KB of JSON that ``_catalog`` parses
+        # and validates on every call, and this used to be done three times.
+        catalog = self._catalog()
         return {'items': self._guard_objects(rows, call, 'id', 'sources'),
                 'stream_id': 'sources-catalog',
                 'next_seq': end if end < view.get('total', len(rows)) else None,
@@ -2266,9 +2591,9 @@ def _op_sources_catalog(self, call):
                 'facets': view.get('facets'),
                 'access_groups': view.get('access_groups'),
                 'sets': view.get('sets'),
-                'schema_version': self._catalog().get('schema_version'),
-                'published_at': self._catalog().get('published_at'),
-                'revision': self._catalog().get('revision')}
+                'schema_version': catalog.get('schema_version'),
+                'published_at': catalog.get('published_at'),
+                'revision': catalog.get('revision')}
 
     def _source_view(self, call, *, source_ids=None, query=None):
         """``source_management.build_view`` over the local database."""
@@ -2465,7 +2790,7 @@ def _source_flag(self, call, *, enabled):
                 'selected': list(result.get('selected_ids', ()))}
 
     def _op_sources_refresh_preview(self, call):
-        """What a refresh would decide, with its own reasons (F27).
+        """What a refresh would decide, with its own reasons.
 
         The decision comes from ``sourcedesk`` and the *state* comes from the
         ``source_feed`` row the last collection wrote.  The old handler
@@ -2475,7 +2800,33 @@ def _op_sources_refresh_preview(self, call):
         return self._source_refresh_state(call, refresh=False)
 
     def _op_sources_refresh(self, call):
-        return self._source_refresh_state(call, refresh=True)
+        """The refresh decision, reported under a job id as the route promises.
+
+        The route is an async job and the transport requires a ``job_id``; the
+        handler returned the plan without one, so every call answered
+        ``503 E_SERVICE_UNAVAILABLE``.  The decision is recorded as a finished
+        job, the same way imports report, so a client can follow it.
+        """
+        body = self._source_refresh_state(call, refresh=True)
+
+        def action(workbench):
+            return self._record_job(workbench, 'source_refresh',
+                                    str((call.body or {}).get('collection_id')
+                                        or schema_public_collection()), 0)
+        body['job_id'] = self._with_workbench(action)
+        return body
+
+    def _known_source(self, source_id):
+        """Whether a source id names a catalog entry or one of the user's own."""
+        catalog = self._catalog()
+        if any(isinstance(item, dict) and item.get('id') == source_id
+               for item in catalog.get('sources') or ()):
+            return True
+        selection = self._catalog_settings().get('source_selection', {})
+        known = set(selection.get('selected_ids', ())) | set(selection.get('download_disabled_ids', ()))
+        known |= {item.get('id') for item in selection.get('custom_sources') or ()
+                  if isinstance(item, dict)}
+        return source_id in known
 
     def _feed_state_of(self, source_id, collection_id):
         """The real ``source_feed`` row of one source, or a state that says so."""
@@ -2524,6 +2875,9 @@ def listed(name):
     def _source_refresh_state(self, call, *, refresh):
         from . import sourcedesk
         wanted = str(call.params.get('id') or '')
+        if not self._known_source(wanted):
+            # An unknown id used to get a plan of its own ("never fetched").
+            raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': wanted})
         state = self._feed_state_of(wanted, schema_public_collection())
         fetched = bool(state.active or state.last_good or state.last_attempt_at)
         if not fetched:
@@ -2568,6 +2922,8 @@ def _source_refresh_state(self, call, *, refresh):
     def _op_sources_refresh_status(self, call):
         from . import sourcedesk
         wanted = str(call.params.get('id') or '')
+        if not self._known_source(wanted):
+            raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'id': wanted})
         state = self._feed_state_of(wanted, schema_public_collection())
         diagnostics = sourcedesk.feed_diagnostics(state, now=self.clock())
         return {'source_id': wanted, 'job_id': str(call.params.get('job_id') or ''),
@@ -2586,15 +2942,18 @@ def _last_collect_report(self):
         except (OSError, UnicodeError, ValueError):
             return None
 
-    # -- source comparison (F21) --------------------------------------------
+    # -- source comparison --------------------------------------------
 
     def _op_sources_compare(self, call):
+        _require_compare_scope(call)
         return self._with_workbench(lambda workbench: self._compare_sources(workbench, call))
 
     def _op_sources_compare_suppliers(self, call):
+        _require_compare_scope(call)
         return self._with_workbench(lambda workbench: self._compare_suppliers(workbench, call))
 
     def _op_sources_compare_cohorts(self, call):
+        _require_compare_scope(call)
         return self._with_workbench(lambda workbench: self._compare_cohorts(workbench, call))
 
     def _comparison_cohort(self, workbench, call, sources, *, default_label=''):
@@ -2681,24 +3040,51 @@ def _compare_cohorts(self, workbench, call):
     # -- gateway ------------------------------------------------------------
 
     def _op_gateway_bindings(self, call):
-        return {'items': self._gateway_bindings(), 'stream_id': 'gateway', 'next_seq': None}
+        items = self._gateway_bindings()
+        allowed = _scope_values(call.principal, 'pools')
+        if allowed is not None:
+            items = [item for item in items if item.get('pool_id') in allowed]
+        return {'items': items, 'stream_id': 'gateway', 'next_seq': None,
+                'published': self._gateway_published()}
 
     def _gateway_bindings(self):
+        """The bindings ``gateway.bind`` stored, one per listener.
+
+        They are written as ``export_artifact`` rows of kind ``binding``; this
+        listing used to describe the published snapshot only, so a binding
+        that had just been accepted never appeared in it.
+        """
+        conn = self.connection()
+        try:
+            rows = conn.execute("SELECT manifest_json FROM export_artifact WHERE kind='binding' "
+                                'ORDER BY id').fetchall() if conn is not None else []
+        except sqlite3.Error:
+            rows = []
+        finally:
+            _close(conn)
+        items = []
+        for row in rows:
+            try:
+                item = json.loads(row[0] or '{}')
+            except (TypeError, ValueError):
+                continue
+            if isinstance(item, dict) and item.get('listener'):
+                items.append(item)
+        return items
+
+    def _gateway_published(self):
         rows, status = self.exports.load()
-        return [{'generation': status.get('generation'),
-                 'collection_id': status.get('collection_id'),
-                 'profile': status.get('profile'),
-                 'profile_revision': status.get('profile_revision'),
-                 'listeners': self._gateway_listeners(),
-                 'available': len(rows)}]
+        return {'generation': status.get('generation'),
+                'collection_id': status.get('collection_id'),
+                'profile': status.get('profile'),
+                'profile_revision': status.get('profile_revision'),
+                'available': len(rows)}
 
     def _gateway_listeners(self):
-        try:
-            from . import gateway
-            return [{'host': gateway.DEFAULT_HOST, 'port': gateway.DEFAULT_PORT,
-                     'running': False}]
-        except Exception:
-            return []
+        config = self._gateway_config()
+        return [{'host': config['listen_host'], 'port': config['listen_port'],
+                 'listen_host': config['listen_host'], 'listen_port': config['listen_port'],
+                 'running': False}]
 
     def _op_gateway_listeners(self, call):
         return {'items': self._gateway_listeners(), 'stream_id': 'gateway-listeners', 'next_seq': None}
@@ -2707,55 +3093,135 @@ def _op_gateway_sessions(self, call):
         return {'items': [], 'stream_id': 'gateway-sessions', 'next_seq': None, 'total': 0,
                 'note': tr('сессии живут в процессе шлюза, а не в файле', 'sessions live in the gateway process, not in a file')}
 
-    def _op_gateway_config_get(self, call):
+    #: Where the control API keeps the gateway configuration it is given.
+    GATEWAY_CONFIG_FILE = 'api-gateway-config.json'
+    GATEWAY_CONFIG_FIELDS = ('listen_host', 'listen_port', 'transports', 'max_per_proxy',
+                             'connect_timeout_s', 'handshake_deadline_s', 'session_ttl_s')
+
+    def _gateway_config(self):
+        """The stored configuration over the gateway's own defaults, with its revision."""
         from . import gateway
-        return {'host': gateway.DEFAULT_HOST, 'port': gateway.DEFAULT_PORT,
-                'transports': ['http', 'socks5'], 'bind': 'loopback'}
+        config = {'listen_host': gateway.DEFAULT_HOST, 'listen_port': gateway.DEFAULT_PORT,
+                  'transports': ['http', 'socks5'], 'max_per_proxy': None,
+                  'connect_timeout_s': 8, 'handshake_deadline_s': 30, 'session_ttl_s': 600,
+                  'revision': 1}
+        try:
+            stored = json.loads((self.data / self.GATEWAY_CONFIG_FILE).read_text(encoding='utf-8'))
+        except (OSError, UnicodeError, ValueError):
+            stored = {}
+        if isinstance(stored, dict):
+            config.update({name: stored[name] for name in (*self.GATEWAY_CONFIG_FIELDS, 'revision')
+                           if name in stored})
+        config['revision'] = int(config.get('revision') or 1)
+        return config
+
+    def _op_gateway_config_get(self, call):
+        config = self._gateway_config()
+        loopback = is_loopback(str(config['listen_host']))
+        return {**config, 'host': config['listen_host'], 'port': config['listen_port'],
+                'bind': 'loopback' if loopback else 'network'}
 
     def _op_gateway_bind(self, call):
-        """Record a binding in the snapshot's own scope; it does not start a process.
+        """Record a binding of one listener; it does not start a process.
 
         A binding is a decision, and a decision that started a listener from an
-        HTTP request would be a surprise the user never asked for.
+        HTTP request would be a surprise the user never asked for.  One
+        listener has one binding; its revision starts at 1 and moves by one on
+        every change, and a stale ``If-Match`` is refused.
         """
-        from . import db as schema
         body = call.body or {}
+        listener = str(body.get('listener') or 'default')
         conn = self.writable_connection()
         try:
+            conn.execute('BEGIN IMMEDIATE')
             pool_id = str(body.get('pool_id') or '')
             row = conn.execute('SELECT id, collection_id, profile_id, profile_revision FROM pools WHERE id=?',
                                (pool_id,)).fetchone()
             if row is None:
                 raise apiv1.ApiError('E_STATE_NOT_FOUND', status=404, details={'pool_id': pool_id})
-            binding = {'listener': str(body.get('listener') or 'default'), 'pool_id': pool_id,
-                       'collection_id': row['collection_id'], 'profile_id': row['profile_id'],
+            key = f'bind:{listener}'
+            stored = conn.execute('SELECT manifest_json FROM export_artifact WHERE id=?',
+                                  (key,)).fetchone()
+            try:
+                current = int(json.loads(stored[0] or '{}').get('revision') or 1) if stored else None
+            except (TypeError, ValueError, AttributeError):
+                current = 1
+            expected = call.expected_revision
+            if expected is not None and int(expected) != (current or 1):
+                raise apiv1.ApiError('E_CONFLICT_REVISION', status=409,
+                                     details={'expected': int(expected), 'stored': current or 1},
+                                     action=tr('перечитайте привязки и повторите',
+                                               'read the bindings again and retry'))
+            binding = {'listener': listener, 'pool_id': pool_id,
+                       'collection_id': row['collection_id'],
+                       'profile_id': body.get('profile_id') or row['profile_id'],
                        'profile_revision': row['profile_revision'],
-                       'generation': body.get('generation'), 'revision': self.clock()}
+                       'generation': body.get('generation'),
+                       'session_ttl_s': body.get('session_ttl_s'),
+                       'revision': 1 if current is None else current + 1,
+                       'updated_at': self.clock()}
             conn.execute(
                 'INSERT OR REPLACE INTO export_artifact(id, kind, collection_id, profile_id, '
                 'profile_revision, generation, published_at, state, manifest_json) '
                 'VALUES (?,?,?,?,?,?,?,?,?)',
-                (f'bind:{pool_id}', 'binding', row['collection_id'], row['profile_id'],
+                (key, 'binding', row['collection_id'], binding['profile_id'],
                  row['profile_revision'], body.get('generation') or '', self.clock(), 'ready',
                  json.dumps(binding, ensure_ascii=False)))
-            conn.commit()
+            conn.execute('COMMIT')
             return binding
         except sqlite3.Error as exc:
             raise apiv1.ApiError('E_STATE_SNAPSHOT_STATIC', status=503,
                                  message=type(exc).__name__) from None
         finally:
+            if conn.in_transaction:
+                conn.execute('ROLLBACK')
             _close(conn)
 
     def _op_gateway_config_set(self, call):
+        """Store a new gateway configuration under its revision.
+
+        The body used to be ignored and ``applied: false`` returned whatever it
+        said, so a stale revision or an unknown transport was accepted.  The
+        stored configuration is what ``GET /v1/gateway/config`` and the
+        listener listing report; a running gateway keeps its settings until it
+        is started again.
+        """
+        from . import gateway
         body = call.body or {}
         if call.expected_revision is None:
             raise apiv1.ApiError('E_VALIDATION_FIELD',
                                  details={'field': 'revision', 'required': 'If-Match'},
                                  message=tr('конфигурация шлюза меняется с ревизией',
                                             'gateway config changes carry a revision'))
-        return {'revision': call.expected_revision, 'applied': False,
-                'reason': tr('шлюз перечитывает конфигурацию при следующем запуске',
-                             'the gateway reads its configuration on the next start')}
+        with _GATEWAY_CONFIG_LOCK:
+            current = self._gateway_config()
+            if int(call.expected_revision) != current['revision']:
+                raise apiv1.ApiError('E_CONFLICT_REVISION', status=409,
+                                     details={'expected': int(call.expected_revision),
+                                              'stored': current['revision']},
+                                     action=tr('перечитайте конфигурацию и повторите',
+                                               'read the configuration again and retry'))
+            if 'transports' in body:
+                transports = body['transports']
+                if not isinstance(transports, list) or not transports or \
+                        not all(isinstance(item, str) for item in transports):
+                    raise apiv1.field_error('transports', tr('нужен непустой список',
+                                                             'a non-empty list is required'))
+                unknown = sorted({item for item in transports if item not in gateway.SUPPORTED})
+                if unknown:
+                    raise apiv1.ApiError(
+                        'E_VALIDATION_FIELD', status=400,
+                        details={'field': 'transports', 'reason': 'unknown transport',
+                                 'unknown': unknown, 'supported': list(gateway.SUPPORTED)})
+                body = dict(body, transports=list(dict.fromkeys(transports)))
+            changed = {name: body[name] for name in self.GATEWAY_CONFIG_FIELDS if name in body}
+            updated = {**current, **changed}
+            if any(current.get(name) != value for name, value in changed.items()):
+                updated['revision'] = current['revision'] + 1
+                stored = {name: updated[name] for name in (*self.GATEWAY_CONFIG_FIELDS, 'revision')}
+                proxytool.atomic(self.data / self.GATEWAY_CONFIG_FILE,
+                            json.dumps(stored, ensure_ascii=False, indent=1))
+        return {**updated, 'applied': True, 'restart_required': True}
 
     # -- profiles -----------------------------------------------------------
 
@@ -2857,8 +3323,7 @@ def _op_reservations_feedback(self, call):
         puts it back in service, a negative one parks it in cooldown.  The
         per-target detail the route accepts has nowhere to live -- there is no
         feedback table -- so it is echoed back as ``stored: false`` with the
-        reason instead of being dropped in silence (F07).  See the handoff to
-        ``db.py`` for the table this is waiting on.
+        reason instead of being dropped in silence.
         """
         from . import pools as pools_module
         body = call.body or {}
@@ -2894,8 +3359,7 @@ def _op_reservations_feedback(self, call):
                 'note': tr('отзыв применён к пулу, глобальная репутация не меняется',
                            'the feedback was applied to the pool; global reputation is unchanged'),
                 'not_stored': ({'fields': sorted(unstored),
-                                'reason': 'no feedback table in the schema; see docs/integration/'
-                                          'HANDOFF/fix-api.md'} if unstored else {})}
+                                'reason': 'no feedback table in the schema'} if unstored else {})}
 
     def _pool_candidates(self, call, pool_id):
         """The addresses *this* pool can serve right now, best first.
@@ -2904,7 +3368,7 @@ def _pool_candidates(self, call, pool_id):
         the published snapshot and used ``pool_id`` for nothing but the scope
         check, so a lease over a pool of collection B handed out addresses of
         collection A.  The rows are the pool's own members and the admission is
-        the shared contract's, never a second calculation here (CONTRACTS §2.3).
+        the shared contract's, never a second calculation here.
         """
         from . import core
         from . import pools as pools_module
@@ -3002,7 +3466,13 @@ def _op_results_selection(self, call):
         rows, status = self.exports.load()
         if not wanted:
             return self._result_page(call, [], status, stream_kind='selection')
-        picked = [row for row in rows if row.get('proxy') in wanted or row.get('endpoint_id') in wanted]
+        # The same three spellings ``results.detail`` accepts: an endpoint id,
+        # a full URL, or ``host:port`` (a path- and comma-safe form).
+        names = set(wanted)
+        picked = [row for row in rows
+                  if row.get('proxy') in names or row.get('endpoint_id') in names
+                  or str(row.get('proxy') or '').partition('://')[2] in names]
+        picked = sort_rows(picked, call.query.get('sort'))
         return self._result_page(call, self._guard_objects(picked, call, 'collection_id', 'collections'),
                                  status, stream_kind='selection')
 
@@ -3092,7 +3562,7 @@ def _artifact_is_secret(directory, name):
 
 
 def _error_status(code):
-    """The HTTP status the code canonically carries (CONTRACTS §5.4).
+    """The HTTP status the code canonically carries.
 
     One table, so a refusal never answers 200 with an error body and never
     answers 500 for a plain validation problem.
@@ -3100,6 +3570,10 @@ def _error_status(code):
     name = str(code or '')
     if name.startswith(('E_AUTH_', 'E_CONFLICT_ACCESS')):
         return 401 if 'EXPIRED' in name or 'FAILED' in name else 403
+    if name.startswith('E_STATE_') and name.endswith('NOT_FOUND'):
+        # ``E_STATE_JOB_NOT_FOUND`` is a missing object: 404, like every other
+        # one, not the 409 of a state conflict.
+        return 404
     if name.startswith(('E_CONFLICT_', 'E_STATE_')):
         return 409
     if name.startswith(('E_POOL_', 'E_EXPORT_', 'E_IMPORT_')):
@@ -3109,8 +3583,12 @@ def _error_status(code):
         return 409 if name != 'E_POOL_UNKNOWN' else 404
     if name.startswith(('E_LIMIT_',)):
         return 429
-    if name.startswith(('E_VALIDATION_', 'E_SECRET_')):
-        return 422
+    if name.startswith('E_VALIDATION_'):
+        # The documented status of a validation error (``openapi.json`` lists
+        # 400, never 422), the same one the transport's own checks answer.
+        return 400
+    if name.startswith('E_SECRET_'):
+        return 409
     if name.startswith('E_SERVICE_'):
         return 503
     return 400
@@ -3157,7 +3635,7 @@ def pool_candidate_source(conn, *, min_success=1.0):
     collection rows that already carry a measurement, and `sources` is the rest --
     offered with ``allowed=False``, which is what puts them in ``recheck_due``
     instead of pretending they work.  The admission verdict is the shared
-    contract's, never a second calculation here (CONTRACTS §2.3).
+    contract's, never a second calculation here.
 
     Nothing is dialled: a candidate is a stored row, and the measurement that
     turns `sources` into `known` is the `pool_recheck` job.
@@ -3430,12 +3908,41 @@ def _compare_source_ids(call):
     return wanted
 
 
+_GATEWAY_CONFIG_LOCK = threading.Lock()
+
+
+def _require_compare_scope(call):
+    """Every collection a comparison names must be inside the key's scope.
+
+    The comparison routes take ``collection_id`` at the top level, inside
+    ``cohort`` and inside each of ``cohorts``; none of them was checked, so a
+    key limited to one collection could read the numbers of any other.  A
+    scoped key that names no collection would compare across all of them, so
+    it has to name one of its own.
+    """
+    allowed = _scope_values(call.principal, 'collections')
+    if allowed is None:
+        return
+    body = call.body or {}
+    cohorts = [item for item in body.get('cohorts') or () if isinstance(item, dict)]
+    named = [body.get('collection_id'), (body.get('cohort') or {}).get('collection_id')]
+    named += [item.get('collection_id') for item in cohorts]
+    named = [str(value) for value in named if value]
+    if not named or (not body.get('collection_id')
+                     and any(not item.get('collection_id') for item in cohorts)):
+        raise apiv1.field_error(
+            'collection_id', tr('ключ ограничен коллекциями: укажите одну из них',
+                                'the key is limited to collections: name one of them'))
+    for value in named:
+        apiv1.require_scope(call.principal, 'collection', value)
+
+
 def _refuse_unsupported_allow_private(body):
     """Refuse a collection-level ``allow_private`` instead of dropping it.
 
     ``allow_private`` was declared on ``POST /v1/collections`` and
     ``PATCH /v1/collections/{id}`` while the ``collections`` table has no such
-    column (CONTRACTS section 3.3, migration 2).  The handlers read ``name``
+    column .  The handlers read ``name``
     and ``kind``, ignored the flag and answered 200, so a client that sent
     ``{"name": "priv", "kind": "own", "allow_private": true}`` was told the
     collection was created and then kept sending private addresses to an import
@@ -3471,7 +3978,7 @@ def _refuse_unsupported_allow_private(body):
                   f'`POST /v1/collections/{{id}}/imports/preview` instead'))
 
 
-#: The kinds a key's resource scope is expressed in (CONTRACTS §5.3: a key is
+#: The kinds a key's resource scope is expressed in (the shared contract: a key is
 #: limited to named `collection_id` and `pool_id`).  Every other kind is filtered
 #: by the collection the object belongs to, never by a scope list that cannot exist.
 SCOPE_KINDS = ('collections', 'pools')
@@ -3502,7 +4009,7 @@ def _scope_values(principal, kind):
     -- answers with the *collections*, because that is the only thing such an object
     can be inside.  Returning ``None`` there used to read as "this key is
     unrestricted": the principal carries no ``jobs`` attribute, so a key scoped to
-    one collection received every other collection's object list (F29).  The same
+    one collection received every other collection's object list.  The same
     rule withholds the shared configuration a scoped key has no claim to: a source
     row carries the provider URL verbatim, credential included.
     """
@@ -3563,7 +4070,7 @@ class Reservations:
 
     The registry lives in the service, which is the process that hands the
     addresses out.  A restart forgets it, so two servers on one database would
-    still both lease; see the handoff for the durable table in ``db.py``.
+    still both lease.
     """
 
     def __init__(self, clock=None):
@@ -3701,8 +4208,7 @@ class LegacyKeyStore(apiv1.KeyStore):
 
     It is deliberately *not* registered as an API key: it keeps exactly the
     permissions it had in 2.x (``read.*``), it is never upgraded to admin, and
-    the pipeline marks every use as a deprecated compatibility path
-    (CONTRACTS §5.1, F29).
+    the pipeline marks every use as a deprecated compatibility path.
     """
 
     REQUIRED = apiv1.KeyStore.REQUIRED
@@ -3769,7 +4275,7 @@ def key_manager(data, db_path=None):
 
     A database that does not exist yet is created through the one migrator, so a
     fresh installation can still be given its first administrator key: refusing
-    here would leave the user with no way into ``/v1`` at all (F29).
+    here would leave the user with no way into ``/v1`` at all.
     """
     from . import proxytool as engine
     path = Path(db_path) if db_path else Path(data) / 'proxies.sqlite3'
@@ -3817,6 +4323,37 @@ def make_control_api(data, host='127.0.0.1', port=V1_DEFAULT_PORT, token=None,
     return _with_job_runner(server, data) if execute_jobs else server
 
 
+#: A bind on every interface.  The address itself is never what a client dials.
+WILDCARD_HOSTS = ('0.0.0.0', '::', '')
+
+
+def accepted_host_names(host):
+    """The ``Host`` names ``/v1`` answers for a server bound to ``host``.
+
+    A loopback bind is reached as ``localhost`` as often as by its number, and
+    a network bind (``serve --host 0.0.0.0 --api-token ...``) is reached by the
+    machine's own name and addresses -- before this, the wildcard bind only
+    accepted ``Host: 0.0.0.0``, which no client sends.  Every other name is
+    still refused, which is what keeps DNS rebinding out.  Nothing here
+    resolves a name: the addresses come from the local routing table.
+    """
+    names = [str(host or '').strip('[]'), *apiv1.LOOPBACK_HOSTS]
+    if not is_loopback(str(host or '')):
+        import socket
+        try:
+            hostname = socket.gethostname().strip().rstrip('.')
+        except OSError:
+            hostname = ''
+        if hostname:
+            short = hostname.split('.')[0]
+            names += [hostname, short, short + '.local']
+        if str(host or '').strip('[]') in WILDCARD_HOSTS:
+            from .local_network import route_addresses
+            names += list(route_addresses())
+    return tuple(dict.fromkeys(name.lower() for name in names
+                               if name and name not in WILDCARD_HOSTS))
+
+
 def make_api_server(data, host='127.0.0.1', port=DEFAULT_PORT, token=None, v1=True,
                     execute_jobs=False):
     """The 2.x read-only server, with ``/v1`` served from the same socket.
@@ -3835,8 +4372,11 @@ def make_api_server(data, host='127.0.0.1', port=DEFAULT_PORT, token=None, v1=Tr
     service = WorkbenchService(data, exports=exports, key_store=manager)
     # ``port=0`` means "any free port"; the config wants the real number, and a
     # loopback bind needs no host allow-list beyond itself.
+    # A loopback bind is reached as ``localhost`` as often as by its number;
+    # naming only the bind address made ``http://localhost:8765/v1/...`` answer
+    # ``E_AUTH_ORIGIN`` while the legacy paths on the same socket answered it.
     control = apiv1.ApiV1(service, LegacyKeyStore(token, manager),
-                          apiv1.ApiConfig(host=host, allowed_hosts=(host,),
+                          apiv1.ApiConfig(host=host, allowed_hosts=accepted_host_names(host),
                                           allowed_bind_hosts=(host,),
                                           allow_remote_bind=bool(token)))
 
@@ -3896,6 +4436,9 @@ def do_PATCH(self):
         def do_DELETE(self):
             self.do_GET()
 
+        def do_PUT(self):
+            self.do_GET()
+
         def do_OPTIONS(self):
             self.do_GET()
 
@@ -3924,16 +4467,49 @@ def discard_legacy_body(self):
 
         def _control(self):
             url = urlsplit(self.path)
-            length = int(self.headers.get('Content-Length') or 0)
-            body = self.rfile.read(min(length, control.config.max_body_bytes + 1)) if length else b''
+            try:
+                length = max(0, int(self.headers.get('Content-Length') or 0))
+            except ValueError:
+                # A malformed length used to raise out of the handler and drop
+                # the connection with no answer at all.
+                self.close_connection = True
+                return self.send_json(400, {'error': {
+                    'code': 'E_VALIDATION_SCHEMA',
+                    'message': 'the Content-Length header is not a number'}})
+            capped = min(length, control.config.max_body_bytes + 1)
+            body = self.rfile.read(capped) if capped else b''
+            if length > capped:
+                self.close_connection = True
             response = control.handle(apiv1.Request(
                 method=self.command, path=url.path, query=url.query,
                 headers=dict(self.headers.items()), body=body,
                 client_host=self.client_address[0]))
-            self.send(response.status, response.body, response.content_type, tuple(response.headers))
-            if response.stream is not None:
-                for chunk in response.stream:
-                    self.wfile.write(chunk)
+            if response.stream is None:
+                return self.send(response.status, response.body, response.content_type,
+                                 tuple(response.headers))
+            # An event stream has no length known in advance.  It used to be
+            # sent with ``Content-Length: 0`` and its frames written as ``str``,
+            # so the client read an empty body and the thread died on the
+            # first frame.  This handler speaks HTTP/1.0: the body is the
+            # frames, and the end of the stream is the end of the connection.
+            self.close_connection = True
+            self.send_response(response.status)
+            self.send_header('Content-Type', response.content_type)
+            self.send_header('X-Content-Type-Options', 'nosniff')
+            for name, value in response.headers:
+                self.send_header(name, value)
+            if not any(name.lower() == 'cache-control' for name, _ in response.headers):
+                self.send_header('Cache-Control', 'no-store')
+            self.send_header('Connection', 'close')
+            self.end_headers()
+            if self.command == 'HEAD':
+                return
+            try:
+                for frame in response.stream:
+                    self.wfile.write(frame.encode('utf-8') if isinstance(frame, str) else frame)
+                    self.wfile.flush()
+            except OSError:
+                pass  # the subscriber went away; the stream releases its slot itself
 
         def do_GET(self):
             url = urlsplit(self.path)
@@ -3944,11 +4520,14 @@ def do_GET(self):
             allowed, notice = self.authorized(url.query)
             if not allowed:
                 return self.send_json(401, {'error': 'missing or wrong token'}, headers=notice)
+            if self.command not in ('GET', 'HEAD'):
+                # Every legacy path is a read.  Only the source paths used to
+                # say so; ``POST /proxies`` or ``DELETE /status`` answered 200
+                # with the data, as if the method had meant something.
+                self.discard_legacy_body()
+                return self.send_json(405, {'error': 'read-only endpoint'},
+                                      headers=(('Allow', 'GET, HEAD'), *notice))
             if url.path == '/source-sets' or url.path == '/sources' or url.path.startswith('/sources/'):
-                if self.command not in ('GET', 'HEAD'):
-                    self.discard_legacy_body()
-                    return self.send_json(405, {'error': 'read-only endpoint'},
-                                          headers=(('Allow', 'GET, HEAD'), *notice))
                 from . import source_management
                 source_id = url.path.removeprefix('/sources/') if url.path.startswith('/sources/') else None
                 if source_id is not None and (not source_id or '/' in source_id):
diff --git a/proxy_workbench/apikeys.py b/proxy_workbench/apikeys.py
index 314ef4f..3c173a8 100644
--- a/proxy_workbench/apikeys.py
+++ b/proxy_workbench/apikeys.py
@@ -1,6 +1,6 @@
 """API key manager: one-way verifiers, permissions, resource scope, quotas and audit log.
 
-Implements the key part of F29 (MASTER-PROMPT §5) and CONTRACTS.ru.md §5.1-§5.3:
+Implements the key part of F29 and the shared contract:
 one identity per role, a secret that is shown exactly once, a one-way verifier in
 the database, an object-level permission check, rate/concurrency quotas and a local
 audit log that never receives a full key, a password or a response body.
@@ -59,10 +59,12 @@
 MAX_PURPOSE_LENGTH = 400
 DEFAULT_TOUCH_INTERVAL_S = 60.0
 AUDIT_RETENTION = 5000
+#: How many audit inserts a manager trusts its own row count before counting again.
+AUDIT_RECOUNT_EVERY = 1000
 STREAM_RECHECK_INTERVAL_S = 30.0
 GRACE_SWEEP_INTERVAL_S = 60.0
 
-# --- one-shot delivery (CONTRACTS §5.1) -------------------------------------
+# --- one-shot delivery -------------------------------------
 
 #: A response body may carry a value that is shown exactly once and is never
 #: stored anywhere else.  :meth:`IssuedKey.as_json` puts the full secret in the
@@ -73,14 +75,13 @@
 #: is in ``apiv1.py`` and has to ask before it keeps an answer.  There are two
 #: strippers because there are two shapes: :func:`without_one_shot` works on the
 #: body before it is serialized, :func:`without_one_shot_response` on the
-#: finished response the cache actually stores.  See
-#: docs/integration/HANDOFF/fix-keys.md and docs/integration/HANDOFF/area-secrets.md.
+#: finished response the cache actually stores.
 ONE_SHOT_FIELDS = ('secret',)
 #: The flag a body that no longer carries the value answers with, so a caller
 #: reads "already delivered, rotate" instead of "this key has no secret".
 ONE_SHOT_NOTE_FIELD = 'secret_already_shown'
 
-# --- permissions (CONTRACTS §5.2) --------------------------------------------
+# --- permissions --------------------------------------------
 
 READ_PERMISSIONS = frozenset({
     'read.status', 'read.results', 'read.results.detail', 'read.export.artifact',
@@ -97,7 +98,7 @@
 PERMISSIONS = READ_PERMISSIONS | WRITE_PERMISSIONS | SENSITIVE_PERMISSIONS | ADMIN_PERMISSIONS
 BOOTSTRAP_PERMISSIONS = READ_PERMISSIONS | ADMIN_PERMISSIONS
 
-# --- error codes (CONTRACTS §5.4) ---------------------------------------------
+# --- error codes ---------------------------------------------
 
 E_MISSING = 'E_AUTH_MISSING'
 E_INVALID = 'E_AUTH_INVALID'
@@ -128,8 +129,8 @@
 
 # --- schema of migrations 8 and 10 --------------------------------------------
 
-# The first fifteen columns are CONTRACTS §3.3 verbatim.  The last four are an
-# additive request to db.py (see docs/integration/HANDOFF/apikeys.md): a
+# The first fifteen columns are the original key schema.  The last four are an
+# additive migration in db.py: a
 # reversible disable flag and the superseded verifier of a narrow rotation
 # window, which cannot be expressed by the three verifier columns without
 # keeping two secrets valid in one row.
@@ -207,7 +208,7 @@ def ensure_schema(conn):
 
 
 class ApiKeyError(Exception):
-    """A refusal that carries a machine code from CONTRACTS §5.4 and a next action."""
+    """A refusal that carries a machine code from the shared contract and a next action."""
 
     def __init__(self, code, *, detail=None, action=None, retry_after=None, state=None):
         self.code = code
@@ -616,8 +617,7 @@ def without_one_shot_response(response):
     holds something else (a secret reference, a boolean) is not touched, so the
     export artifact and the diagnostics answers keep working.
 
-    The caller is expected to keep the original and store the returned copy; see
-    docs/integration/HANDOFF/area-secrets.md for the one-line call site.
+    The caller is expected to keep the original and store the returned copy.
     """
     body = getattr(response, 'body', None)
     if not isinstance(body, (bytes, bytearray)) or not body:
@@ -772,7 +772,7 @@ def object_visible(principal, kind, object_id, *, collection_id=None, pool_id=No
     """True only for an object inside the key's own scope.
 
     A foreign object and a missing object both answer False, so a client cannot
-    tell the difference between them (CONTRACTS §5.3).  An object that belongs to
+    tell the difference between them.  An object that belongs to
     a collection or a pool — a result row, an export artifact, a job, a batch, a
     stream — is visible only when the key is unscoped or when the object names
     its own collection and that collection is in scope.  An object whose owner
@@ -861,11 +861,13 @@ def __init__(self, conn, *, now=time.time, iterations=PBKDF2_ITERATIONS,
         self._lock = threading.RLock()
         self._touched = {}
         self._grace_swept_at = None
+        self._audit_rows = None
+        self._audit_inserts = 0
         conn.row_factory = sqlite3.Row
         self._columns = {row[1] for row in conn.execute('PRAGMA table_info(api_keys)')}
         if 'id' not in self._columns:
             raise ApiKeyError(E_INVALID, detail='table api_keys is missing',
-                              action='run the migrations of CONTRACTS §3.3 before using keys')
+                              action='run the database migrations before using keys')
 
     # -- clock ----------------------------------------------------------------
 
@@ -1331,11 +1333,33 @@ def _audit(self, key_id, operation, *, object_kind=None, object_id=None, scope=N
             self.conn.execute('INSERT INTO audit_log(at, key_id, operation, object_kind, object_id,'
                               ' scope_json, result, error_code) VALUES (?,?,?,?,?,?,?,?)', row)
             if self.audit_retention > 0:
-                self.conn.execute('DELETE FROM audit_log WHERE rowid NOT IN'
-                                  ' (SELECT rowid FROM audit_log ORDER BY at DESC, rowid DESC'
-                                  ' LIMIT ?)', (self.audit_retention,))
+                self._prune_audit()
             self.conn.commit()
 
+    def _prune_audit(self):
+        """Keep the newest ``audit_retention`` rows without scanning the table.
+
+        The retention used to run ``DELETE ... WHERE rowid NOT IN (SELECT ...
+        LIMIT n)`` after every insert, which reads the whole log each time.
+        The row count is now counted once and then kept by this manager; it is
+        counted again every :data:`AUDIT_RECOUNT_EVERY` inserts, so rows
+        written by another connection are caught up with.  The excess is
+        removed oldest first through the ``audit_log_at`` index.
+        """
+        self._audit_inserts += 1
+        if self._audit_rows is None or self._audit_inserts >= AUDIT_RECOUNT_EVERY:
+            self._audit_rows = self.conn.execute('SELECT count(*) FROM audit_log').fetchone()[0]
+            self._audit_inserts = 0
+        else:
+            self._audit_rows += 1
+        excess = self._audit_rows - self.audit_retention
+        if excess <= 0:
+            return
+        removed = self.conn.execute(
+            'DELETE FROM audit_log WHERE rowid IN (SELECT rowid FROM audit_log'
+            ' ORDER BY at, rowid LIMIT ?)', (excess,)).rowcount
+        self._audit_rows -= max(0, removed)
+
     def read_audit(self, *, actor, key_id=None, operation=None, since=None, limit=200):
         principal = self._as_principal(actor)
         principal.require('admin.audit').raise_if_denied()
@@ -1609,7 +1633,7 @@ def __exit__(self, *exc_info):
 class StreamSessions:
     """Registry of open SSE/stream sessions with a written expiry policy.
 
-    Policy (CONTRACTS §5.2): a new subscription is checked at once against
+    Policy: a new subscription is checked at once against
     ``admin``/key state; an open session re-reads the key at least every
     ``recheck_interval_s`` and again before each emitted event; a revoke or an
     expiry closes the session with ``E_AUTH_REVOKED`` or ``E_AUTH_EXPIRED`` and
diff --git a/proxy_workbench/apiv1.py b/proxy_workbench/apiv1.py
index 3de5b8a..763a1f1 100644
--- a/proxy_workbench/apiv1.py
+++ b/proxy_workbench/apiv1.py
@@ -8,10 +8,9 @@
 
 * ``keys``    -- a key store (see :class:`KeyStore`), implemented by
   ``proxy_workbench.apikeys``; the secret is hashed there and never kept here.
-* ``service`` -- the shared service layer used by CLI and GUI as well (F18),
+* ``service`` -- the shared service layer used by CLI and GUI as well,
   reached through :class:`Service`; one ``invoke`` call is one operation.
 
-Integration contract: CONTRACTS.ru.md 5 (version 1).
 Requirements: F29 (API and key manager surface), F18 (one management layer),
 F07 (no silently ignored parameter), R03, R12, R17, R18.
 
@@ -61,7 +60,7 @@
 MAX_PAGE_LIMIT = 1000
 MAX_BODY_BYTES = 8 * 1024 * 1024
 
-# --- permissions: the canon of CONTRACTS.ru.md 5.2.  Nothing is allowed by default.
+# --- permissions: the canon of the shared contract.  Nothing is allowed by default.
 READ_PERMISSIONS = frozenset({
     'read.status', 'read.results', 'read.results.detail', 'read.export.artifact',
 })
@@ -89,7 +88,7 @@
     'gateway_password', 'verifier', 'verifier_salt', 'authorization',
 })
 
-# --- error codes: CONTRACTS.ru.md 5.4, plus the three this surface adds.
+# --- error codes: the shared contract, plus the three this surface adds.
 ERROR_DOMAIN_STATUS = {
     'AUTH': 401, 'VALIDATION': 400, 'CONFLICT': 409, 'STATE': 409, 'TIME': 409,
     'DATA': 409, 'IMPORT': 400, 'SECRET': 409, 'LIMIT': 413, 'GATEWAY': 502,
@@ -135,6 +134,8 @@
     'E_STATE_NO_SNAPSHOT': ('Нет опубликованного снимка.', 'no published snapshot exists'),
     'E_STATE_SNAPSHOT_STALE': ('Снимок истёк.', 'the snapshot has expired'),
     'E_STATE_JOB_RUNNING': ('Задание уже выполняется.', 'the job is already running'),
+    'E_STATE_KEY_NOT_REVOKED': ('Удалить можно только отозванный ключ.',
+                                'only a revoked key can be deleted'),
     'E_TIME_UNKNOWN': ('Время измерения неизвестно.', 'the measurement time is unknown'),
     'E_DATA_DB_VERSION_AHEAD': ('База создана более новой версией программы.',
                                 'the database was created by a newer program version'),
@@ -155,7 +156,10 @@
     500: 'E_SERVICE_UNAVAILABLE', 502: 'E_GATEWAY_NO_UPSTREAM', 504: 'E_GATEWAY_DEADLINE',
 }
 
-ID_PATTERN = re.compile(r'^[A-Za-z0-9._:-]{1,128}$')
+#: A path segment.  ``@`` is allowed because a profile revision is addressed as
+#: ``<profile_id>@<revision>`` (``GET /v1/profiles/{id}``); without it the
+#: documented spelling could not even reach the handler that parses it.
+ID_PATTERN = re.compile(r'^[A-Za-z0-9._:@-]{1,128}$')
 FILE_CHARS = re.compile(r'[^A-Za-z0-9._-]')
 
 
@@ -473,7 +477,7 @@ def audit(self, record):  # pragma: no cover - interface
 
 
 class Service:
-    """The shared service layer (F18).  One ``invoke`` per API operation."""
+    """The shared service layer.  One ``invoke`` per API operation."""
 
     REQUIRED = ('invoke', 'queue_state')
 
@@ -574,7 +578,7 @@ def create_key(self, principal, spec):
         window = spec.get('rate_limit_window_seconds')
         rate = ({'requests': requests, 'window_s': window}
                 if requests is not None and window is not None else None)
-        # ``apikeys`` speaks the structured quotas of CONTRACTS §5.2
+        # ``apikeys`` speaks the structured quotas of the shared contract
         # (``{"requests": N, "window_s": S}``, ``{"max_active": N}``), while the
         # route declares the flat shape a user edits.  The translation belongs
         # here: both quotas used to be passed through as bare values, so
@@ -607,6 +611,15 @@ def enable_key(self, principal, key_id, **kwargs):
         return info.as_dict(self.manager.now()) if info is not None else {'id': key_id}
 
     def delete_key(self, principal, key_id, **kwargs):
+        # The route deletes a *revoked* key.  An active, disabled or expired
+        # key used to be deleted as well, which erased a working credential
+        # without the revoke step (and its audit entry) ever happening.
+        info = self._call('get_key', not_found=True, key_id=key_id, actor=principal.key_id)
+        if info.revoked_at is None:
+            raise ApiError('E_STATE_KEY_NOT_REVOKED', status=409,
+                           details={'id': key_id, 'state': info.state},
+                           action=tr('сначала отзовите ключ: POST /v1/keys/{id}/revoke',
+                                     'revoke the key first: POST /v1/keys/{id}/revoke'))
         self._call('delete', not_found=True, key_id=key_id, actor=principal.key_id)
         return {'id': key_id, 'deleted': True}
 
@@ -626,13 +639,19 @@ def read_audit(self, principal, **filters):
         return {'items': rows, 'stream_id': 'audit', 'next_seq': None}
 
     def audit(self, record):
-        """One audit row per answered mutation; never a body, never a secret."""
-        record = getattr(self.manager, 'record_audit', None) or self.manager._audit
-        record(record['key_id'], record['operation'],
-               object_kind=record.get('object_kind'), object_id=record.get('object_id'),
-               scope={k: v for k, v in record.items()
-                      if k in ('collection_id', 'pool_id') and v},
-               result=record.get('result') or 'ok', error_code=record.get('error_code'))
+        """One audit row per answered mutation; never a body, never a secret.
+
+        The writer used to be bound to the name ``record`` as well, so the row
+        was read out of a bound method, the ``TypeError`` was swallowed by the
+        pipeline and no mutation or refusal answered over ``/v1`` ever reached
+        the audit log.
+        """
+        write = getattr(self.manager, 'record_audit', None) or self.manager._audit
+        write(record['key_id'], record['operation'],
+              object_kind=record.get('object_kind'), object_id=record.get('object_id'),
+              scope={k: v for k, v in record.items()
+                     if k in ('collection_id', 'pool_id') and v} or None,
+              result=record.get('result') or 'ok', error_code=record.get('error_code'))
 
 
 # --------------------------------------------------------------------------
@@ -669,6 +688,16 @@ def loopback_only(self):
         return not self.allow_remote_bind
 
 
+def host_header_name(host):
+    """The name part of a ``Host`` header: no port, no IPv6 brackets, lower case."""
+    name = (host or '').strip()
+    if name.startswith('['):
+        return (name[1:name.index(']')] if ']' in name else name[1:]).lower()
+    if name.count(':') == 1:
+        name = name.rsplit(':', 1)[0]
+    return name.lower()
+
+
 def is_loopback_host(host):
     """True for localhost, 127.0.0.1 and ::1, with or without a port."""
     name = (host or '').strip()
@@ -794,14 +823,17 @@ def get(self, bucket, key, digest):
             record = self._records.get((bucket, key))
             if record is None:
                 return None
+            # An expired key is forgotten before it is compared: once its TTL
+            # is over it may carry a new request, so a different body is a new
+            # mutation and not a conflict with an answer nobody keeps anymore.
+            if self._clock() - record['at'] > self.ttl_s:
+                self._records.pop((bucket, key), None)
+                return None
             if record['digest'] != digest:
                 raise ApiError('E_CONFLICT_IDEMPOTENCY', status=409,
                                details={'idempotency_key': key},
                                action=tr('используйте новый ключ или тот же запрос',
                                          'use a new key or repeat the same request'))
-            if self._clock() - record['at'] > self.ttl_s:
-                self._records.pop((bucket, key), None)
-                return None
             return record['response']
 
     def put(self, bucket, key, digest, response):
@@ -848,7 +880,7 @@ def known(self, stream_id, seq):
 
 
 # --------------------------------------------------------------------------
-# cursors: one scheme for pagination and for events (CONTRACTS.ru.md 5.7)
+# cursors: one scheme for pagination and for events
 # --------------------------------------------------------------------------
 
 def digest_of(value):
@@ -1231,8 +1263,8 @@ def sort_fields():
     # ``allow_private_endpoints`` is the same explicit, recorded choice the CLI
     # has as ``--allow-private-endpoints``: without it ``importer.DEFAULT_POLICY``
     # refuses hostnames, private addresses and the RFC 5737 ranges, so a user's
-    # own gateway list was accepted by the form and dropped by the importer
-    # (defect 10).  The choice is written to the audit log.
+    # own gateway list was accepted by the form and dropped by the importer.
+    # The choice is written to the audit log.
     Route('POST', '/v1/collections/{id}/imports/preview', 'imports.preview', 'import.read',
           'validate an import without changing anything', scope=(('collection', 'id'),),
           body=(Field('format', 'string', choices=('txt', 'uri', 'csv', 'json'), default='txt'),
@@ -1253,7 +1285,7 @@ def sort_fields():
           tags=('collections',)),
     Route('POST', '/v1/collections/{id}/merge', 'collections.merge', 'collections.write',
           'merge the members of another collection into this one', mutating=True, async_job=True,
-          scope=(('collection', 'id'),),
+          scope=(('collection', 'id'), ('collection', 'from_collection_id')),
           body=(Field('from_collection_id', 'string', required=True, max_len=128),
                 Field('revision', 'int', minimum=1)), tags=('collections',)),
     Route('POST', '/v1/collections/{id}/replace', 'collections.replace', 'collections.write',
@@ -1261,6 +1293,7 @@ def sort_fields():
           scope=(('collection', 'id'),),
           body=(Field('format', 'string', choices=('txt', 'uri', 'csv', 'json'), default='txt'),
                 Field('content', 'string', required=True, max_len=8 * 1024 * 1024),
+                Field('allow_private_endpoints', 'bool'),
                 Field('revision', 'int', minimum=1)), tags=('collections',)),
 
     # --- sources ------------------------------------------------------------
@@ -1609,7 +1642,7 @@ def sort_fields():
 )
 
 
-# Key management belongs to the key store, not to the service layer (CONTRACTS 5.2).
+# Key management belongs to the key store, not to the service layer.
 KEY_METHODS = {
     'keys.list': 'list_keys', 'keys.get': 'get_key', 'keys.create': 'create_key',
     'keys.update': 'update_key', 'keys.rotate': 'rotate_key', 'keys.revoke': 'revoke_key',
@@ -1699,7 +1732,7 @@ def _redact(value, principal):
 #: The envelopes a service answer may put the object in.  The guard looks inside
 #: them: the three artifact reads and every list answer `{"item": {...}}` or
 #: `{"items": [...]}`, so a guard that only inspected the top level saw no
-#: `collection_id` at all and let another collection's object through (F29).
+#: `collection_id` at all and let another collection's object through.
 #: The list is explicit -- the walk is one level deep on purpose, not a search.
 SCOPE_ENVELOPES = ('item', 'items')
 
@@ -1728,7 +1761,7 @@ def _redact_file(data, content_type, principal):
     identity -- a subscription or the legacy token -- received bytes the rest of
     the API would have scrubbed: ``GET /v1/exports/{id}/download/ranked.json``
     handed back a row carrying ``access_secret`` while the identical field of
-    ``GET /v1/results`` was stripped (F29).
+    ``GET /v1/results`` was stripped.
 
     Only a JSON payload can be rewritten field by field, and it is the only
     snapshot format that carries row fields at all: every other file of an
@@ -1847,6 +1880,11 @@ def do_POST(self):
             def do_PATCH(self):
                 self._dispatch('PATCH')
 
+            def do_PUT(self):
+                # No route takes PUT; the pipeline answers the documented 405
+                # with an Allow header instead of the stock HTML 501 page.
+                self._dispatch('PUT')
+
             def do_DELETE(self):
                 self._dispatch('DELETE')
 
@@ -1856,7 +1894,9 @@ def do_OPTIONS(self):
             def _dispatch(self, method):
                 url = urlsplit(self.path)
                 try:
-                    length = int(self.headers.get('Content-Length') or 0)
+                    # A negative length would make ``read`` wait for EOF and
+                    # hold the worker thread until the client gave up.
+                    length = max(0, int(self.headers.get('Content-Length') or 0))
                 except ValueError:
                     length = 0
                 # an oversized body is refused without being buffered in full
@@ -1961,7 +2001,7 @@ def _check_network(self, request):
         """Host, Origin and CORS follow the real model, not convenience."""
         host = (request.header('Host') or '').strip()
         if self.config.allowed_hosts:
-            name = host.rsplit(':', 1)[0].strip('[]').lower()
+            name = host_header_name(host)
             if name not in {allowed.lower() for allowed in self.config.allowed_hosts}:
                 raise ApiError('E_AUTH_ORIGIN', status=403, details={'host': name},
                                action=tr('добавьте это имя в allowed_hosts',
@@ -2067,6 +2107,7 @@ def _invoke(self, request, route, params, principal, idem_key):
                 return cached
         body = self._parse_body(request, route)
         query = self._parse_query(route, request)
+        self._check_field_scope(route, principal, params, body, query)
         self._check_sensitive(route, principal, body, query)
         self._apply_guard(route, body)
         expected = self._expected_revision(request, body, route)
@@ -2110,7 +2151,7 @@ def _invoke(self, request, route, params, principal, idem_key):
             # cache is the second and last place the value can be taken out.
             # Storing the untouched response here is what let a replay of the
             # same `POST /v1/keys` hand the full `pwk_...` secret out a second
-            # time, long after the one moment CONTRACTS §5.1 allows it.
+            # time, long after the one moment the shared contract allows it.
             self.idempotency.put(bucket, idem_key, digest,
                                  apikeys.without_one_shot_response(response))
         self._audit(route, request, params, principal, 'ok', None, body)
@@ -2123,6 +2164,25 @@ def _key_call(self, route, call, principal):
         method = KEY_METHODS[route.operation]
         key_id = call.params.get('id')
         if route.operation == 'keys.create':
+            pair = ('rate_limit_requests', 'rate_limit_window_seconds')
+            given = [name for name in pair if call.body.get(name) is not None]
+            if len(given) == 1:
+                # A rate limit is a count *per window*: half of it used to be
+                # dropped without a word and the key was issued unlimited.
+                missing = next(name for name in pair if name not in given)
+                raise field_error(missing, tr('лимит задаётся парой: число запросов и окно',
+                                              'a rate limit needs both the request count '
+                                              'and the window'),
+                                  action=tr('передайте оба поля или ни одного',
+                                            'send both fields or neither'))
+            if call.body.get('rotation_grace_seconds'):
+                # The grace window belongs to one rotation and is given to
+                # ``POST /v1/keys/{id}/rotate``; a new key has no old secret.
+                raise field_error('rotation_grace_seconds',
+                                  tr('окно ротации задаётся при ротации',
+                                     'the grace window is set when the key is rotated'),
+                                  action=tr('передайте его в POST /v1/keys/{id}/rotate',
+                                            'send it to POST /v1/keys/{id}/rotate'))
             return self.keys.create_key(principal, dict(call.body, purpose=call.body.get('purpose')))
         if route.operation == 'subscriptions.create':
             spec = dict(call.body, permissions=sorted(SUBSCRIPTION_PERMISSIONS),
@@ -2146,6 +2206,15 @@ def _key_call(self, route, call, principal):
             return self.keys.read_audit(principal, limit=call.query.get('limit'))
         if route.operation == 'keys.get':
             return self.keys.get_key(principal, key_id)
+        if route.operation == 'subscriptions.revoke':
+            # The subscription route acts on subscription secrets only; any
+            # other key id is not a subscription and is not found here, the
+            # same way ``subscriptions.list`` never shows it.
+            current = self.keys.get_key(principal, key_id)
+            if not isinstance(current, Mapping) or current.get('purpose') != SUBSCRIPTION_PURPOSE:
+                raise ApiError('E_STATE_NOT_FOUND', status=404, details={'id': key_id},
+                               action=tr('это не секрет подписки: используйте /v1/keys/{id}/revoke',
+                                         'not a subscription secret: use /v1/keys/{id}/revoke'))
         return getattr(self.keys, method)(principal, key_id)
 
     def _check_queue(self):
@@ -2199,6 +2268,26 @@ def filter_digest(self, path, query):
                                      if k not in ('cursor', 'limit', 'cursor_stream',
                                                   'cursor_seq')}})[:16]
 
+    @staticmethod
+    def _check_field_scope(route, principal, params, body, query):
+        """The resource scope a route names in its body or query, not its path.
+
+        ``route.scope`` was only ever looked up among the *path* parameters, so
+        every entry that names a body field -- ``pool_id`` of the reservation
+        routes, of ``gateway.bind`` and of ``schedules.create`` -- was checked
+        against ``None`` and passed: a key limited to one pool could lease,
+        bind and schedule any other pool.  The path check still runs first,
+        before the body is read; this one runs once the body is validated.
+        """
+        for kind, source in route.scope:
+            if source in params:
+                continue
+            value = body.get(source) if isinstance(body, dict) else None
+            if value is None and isinstance(query, dict):
+                value = query.get(source)
+            if isinstance(value, str) and value:
+                require_scope(principal, kind, value)
+
     def _check_sensitive(self, route, principal, body, query):
         """A sensitive option is a separate permission, never a parameter of convenience."""
         for name, permission in route.sensitive:
@@ -2250,7 +2339,7 @@ def _response(self, route, request, result, principal, extra_headers, query=None
             # A raw file used to be returned straight out of `result`, so a
             # redacted identity (a subscription) got a file the rest of the API
             # would have scrubbed, and a body naming another collection was
-            # never noticed at all (F29).
+            # never noticed at all.
             result = _redact(result, principal)
             _guard_scope(principal, result)
             if result.get('secrets') and principal is not None and principal.redacted:
@@ -2320,7 +2409,11 @@ def _response(self, route, request, result, principal, extra_headers, query=None
 
     def _stream(self, request, route, params, principal):
         query = parse_query_fields(route.query, request.query)
-        stream_id = query.get('stream') or f"job:{params.get('id', 'system')}"
+        # The job route names its stream by the job; the system route is the
+        # ``system`` stream unless the caller picks one.  It used to default to
+        # ``job:system``, a name no service answer carries, so a cursor the
+        # server itself had handed out could never be used to resume.
+        stream_id = query.get('stream') or (f"job:{params['id']}" if 'id' in params else 'system')
         seq = 0
         cursor = query.get('cursor')
         if cursor:
@@ -2355,8 +2448,17 @@ def _stream(self, request, route, params, principal):
             raise ApiError('E_SERVICE_UNAVAILABLE',
                            status=503 if isinstance(exc, NotImplementedError) else 500,
                            details={'reason': type(exc).__name__}) from exc
-        # a service may return (stream_id, events) when it chose the stream itself
-        declared, events = source if isinstance(source, tuple) else (stream_id, source)
+        # a service may return (stream_id, events) when it chose the stream itself,
+        # or the same page object every listing returns: ``{"items": [...],
+        # "stream_id": ...}``.  The page used to be iterated as it stood, which
+        # walks the *keys* of a dict, so every event stream answered one
+        # ``error`` frame ("event needs seq and type") and nothing else.
+        if isinstance(source, tuple):
+            declared, events = source
+        elif isinstance(source, Mapping) and isinstance(source.get('items'), list):
+            declared, events = source.get('stream_id') or stream_id, source['items']
+        else:
+            declared, events = stream_id, source
         limit = int(query.get('limit') or self.config.max_limit)
         stream = EventStream(str(declared or stream_id),
                              self._guarded(events, limit, request, key_slot), self.clock,
diff --git a/proxy_workbench/branding.py b/proxy_workbench/branding.py
index 8d1c238..4f58e6b 100644
--- a/proxy_workbench/branding.py
+++ b/proxy_workbench/branding.py
@@ -11,7 +11,7 @@
 
 PRODUCT_NAME = "Proxy Workbench"
 PRODUCT_ID = "ProxyWorkbench"
-PRODUCT_VERSION = "2.3.0"
+PRODUCT_VERSION = "3.0.0"
 DEFAULT_REQUEST_PROFILE = "workbench"
 PROJECT_URL = "https://github.com/DavidVoitenko/proxy-workbench"
 # Newest built-in source list, fetched only when the user asks for it.  This is
diff --git a/proxy_workbench/core.py b/proxy_workbench/core.py
index f2ee1c8..02df2c5 100644
--- a/proxy_workbench/core.py
+++ b/proxy_workbench/core.py
@@ -1,6 +1,6 @@
 """Unified admission contract: which measured endpoint a consumer may use right now.
 
-This module is the single place that decides admission.  CONTRACTS.ru.md §2
+This module is the single place that decides admission.  the shared contract
 specifies it, F09 and R01 require it, and every surface (CLI, GUI, API,
 gateway, export) is supposed to call the same function instead of keeping its
 own selection logic.
@@ -22,9 +22,9 @@
 * The check order is fixed and therefore the ``reason_code`` is reproducible:
   identity → observation → clock → time → exclusions → quality → capabilities.
 * A row is judged on its own.  Selection never takes ``min()`` across rows, so
-  one expired member cannot hide the rest of a set (defect 3).
+  one expired member cannot hide the rest of a set.
 * The last completed measurement is never dropped and history is only ever
-  appended; a fresh failure cannot be masked by an older success (F09).
+  appended; a fresh failure cannot be masked by an older success.
 
 The module is a leaf: standard library only, no database, no DDL, no network
 and no import of ``proxytool``.  Proxy normalization, denylist matching and
@@ -97,7 +97,7 @@
 STATIC_TTL_NOTICE = 'E_STATE_SNAPSHOT_STATIC_TTL'
 
 # Capability names this module can derive.  A requirement outside the closed set
-# is a bug in the caller and is rejected, not ignored (F07).
+# is a bug in the caller and is rejected, not ignored.
 CAPABILITIES = frozenset({'tcp', 'http', 'https', 'socks4', 'socks5', 'udp',
                           'anonymity:transparent', 'anonymity:anonymous',
                           'anonymity:elite', 'speed', 'exit_ip'})
@@ -186,7 +186,7 @@ class Policy:
     """Everything a profile revision fixes about admission.
 
     All thresholds live here and not in a read-time argument, so one snapshot
-    cannot be a pass for one caller and empty for another (CONTRACTS §2.3).
+    cannot be a pass for one caller and empty for another.
     """
     max_age_seconds: float = DEFAULT_MAX_AGE_SECONDS
     min_success: float = 2 / 3
@@ -195,7 +195,7 @@ class Policy:
     protocol: str | None = None
     countries: frozenset[str] = frozenset()
     unknown_country: str = 'exclude'
-    #: The one country rule, as ``geo.CountryCriterion`` builds it (F08).
+    #: The one country rule, as ``geo.CountryCriterion`` builds it.
     #: ``core`` is a leaf with no database and no DDL, so the object is *given*
     #: to it, not constructed here: ``basis`` (endpoint / exit / either), the
     #: deliberate "never here" ``exclude`` set and the three ``unknown``
diff --git a/proxy_workbench/db.py b/proxy_workbench/db.py
index b8d78d3..c17b049 100644
--- a/proxy_workbench/db.py
+++ b/proxy_workbench/db.py
@@ -2,8 +2,7 @@
 
 This module is the only place in the package that writes DDL. Every other module
 calls :func:`migrate` (or :func:`open_db`) in its own tests and works with the
-tables the migrations created -- nobody declares a schema in prose
-(``docs/integration/CONTRACTS.ru.md`` §3.2, §3.3).
+tables the migrations created -- nobody declares a schema in prose.
 
 Public API
 ----------
@@ -71,12 +70,14 @@
     "connect", "probe", "read_header", "migrate", "open_db", "current_version",
     "assert_current", "describe", "tables", "columns", "indexes", "primary_key",
     "database_bytes", "table_bytes", "endpoint_id", "upsert_endpoint",
-    "create_collection", "rename_collection", "archive_collection", "get_collection",
+    "create_collection", "rename_collection", "archive_collection", "unarchive_collection",
+    "get_collection",
     "list_collections", "add_member", "remove_member", "collection_members",
     "endpoint_collections", "legacy_summary", "add_scope_exclusion", "scope_exclusions",
     "excluded_addresses", "clear_scope_exclusions", "create_backup", "verify_backup",
     "list_backups", "manifest_path", "restore_preview", "restore", "rollback",
     "migrate_data_path", "retention_preview", "apply_retention", "cleanup_preview",
+    "source_history_preview", "prune_source_history", "SOURCE_GENERATION_KEEP",
     "cleanup", "secret_bindings", "rebind_secrets", "write_json", "read_json",
     "sha256_file",
 ]
@@ -85,7 +86,7 @@
 # version identity
 # ---------------------------------------------------------------------------
 
-SCHEMA_VERSION = 19
+SCHEMA_VERSION = 20
 #: Magic number of this package. 0 means "no application id yet" (pre-versioning file).
 APPLICATION_ID = 0x50574231
 DB_FILENAME = "proxies.sqlite3"
@@ -104,7 +105,7 @@
 COLLECTION_KINDS = ("public", "private")
 COLLECTION_ORIGINS = ("legacy", "public", "manual", "import", "gateway")
 
-# Error codes from CONTRACTS §5.4 (domains DATA and VALIDATION).
+# Error codes from the shared contract (domains DATA and VALIDATION).
 E_VERSION_AHEAD = "E_DATA_DB_VERSION_AHEAD"
 E_FOREIGN_DB = "E_DATA_DB_FOREIGN"
 E_MIGRATION_FAILED = "E_DATA_MIGRATION_FAILED"
@@ -314,7 +315,7 @@ def __post_init__(self):
             raise RetentionError(E_PATH_CONFLICT, "keep_newest must not be negative")
 
 
-#: Time column each retention target is aged by (CONTRACTS §3.6).
+#: Time column each retention target is aged by.
 #: `observations` has no `checked_at` column -- migration 4 defines `started_at`/`finished_at`.
 RETENTION_TIME_COLUMN = {"observations": "finished_at", "results": "checked_at"}
 
@@ -330,6 +331,10 @@ class RetentionPreview:
     database_bytes: int = 0
     target_bytes: int = 0
     blocked: tuple = ()                 # ((table, (blocker, ...), rows), ...)
+    #: Source fetch history past its bound (:func:`source_history_preview`).
+    #: Always pruned by :func:`apply_retention`, whatever the policy names:
+    #: it is bounded by count, not by age, and no reader needs it.
+    source_history: "dict | None" = None
 
     def rows_for(self, table):
         """The rows retention can actually remove. Blocked rows are not counted."""
@@ -376,6 +381,7 @@ def to_dict(self):
                  "oldest": oldest, "newest": newest}
                 for name, column, rows, oldest, newest in self.targets
             ],
+            "source_history": dict(self.source_history or {}),
         }
 
 
@@ -608,8 +614,8 @@ class Migration:
 def _m0(conn, context):
     """application_id, the migration journal, and the pre-versioning tables.
 
-    The five tables at the bottom are what the unversioned ``open_db`` created
-    (CONTRACTS §3.1). ``IF NOT EXISTS`` gives a fresh database the same starting
+    The five tables at the bottom are what the unversioned ``open_db`` created.
+   ``IF NOT EXISTS`` gives a fresh database the same starting
     point as a migrated legacy one, and migration 5 then breaks the positional
     writes into three of them (§3.5.2).
     """
@@ -861,9 +867,9 @@ def _m12(conn, context):
 RESULTS_NEW_KEY = ("profile_id", "profile_revision", "access_id", "access_revision",
                    "endpoint_id", "job_id")
 #: The key of one measurement of record.  A row is the address, not the run: two
-#: access revisions of one address are two rows (F04), a repeat check in a new job is
+#: access revisions of one address are two rows, a repeat check in a new job is
 #: the *same* row -- `job_id` stays a column naming the last job that measured the
-#: address, and the per-job item lives in `job_item(job_id, item_id)` (F28, F09).
+#: address, and the per-job item lives in `job_item(job_id, item_id)`.
 RESULTS_KEY = ("profile_id", "profile_revision", "access_id", "access_revision", "endpoint_id")
 RESULTS_NEW_SQL = """CREATE TABLE results_new(
     profile TEXT NOT NULL,
@@ -900,7 +906,7 @@ def _m13(conn, context):
     GUI table read `results.payload` and never the identity columns, so a payload left
     untouched made every historic row fail admission on a scope it was never measured
     in -- the migration claimed the rows stayed "readable" while nothing could read
-    them (F02, F24).  The identity is therefore written into the payload too, and only
+    them.  The identity is therefore written into the payload too, and only
     where it is recoverable from the legacy file itself: `proxy`, `profile` and the
     legacy collection the candidates were imported into.  What a 2.x file simply does
     not record -- the network the check ran on, a lifetime -- is left absent on
@@ -1014,7 +1020,7 @@ def _collapse_payload(newest, group):
 
     Collapsing must not forget what was measured: `checks`/`passes` are the counters
     ranked.csv and the GUI publish, so they are added over the whole group while the
-    verdict itself stays the newest one (F28, F12).
+    verdict itself stays the newest one.
     """
     if len(group) < 2:
         return newest["payload"]
@@ -1061,7 +1067,7 @@ def _m15(conn, context):
     address standing beside the first, every consumer judged the rows independently,
     and the endpoint appeared twice in every artifact (F28, §7.10). It also meant a
     fresh failure could not cancel the older success: the failed row was rejected
-    while the stale one kept its own, unexpired `valid_until` (F09, defect 2).
+    while the stale one kept its own, unexpired `valid_until`.
 
     The newest measurement of an address therefore *replaces* the row -- the
     per-check history it carried is summed in, so nothing measured is lost -- and
@@ -1111,17 +1117,17 @@ def _m15(conn, context):
 #:
 #: `source_feed` and `membership_source` are :data:`sourcedesk.REQUESTED_DDL`
 #: verbatim.  That constant is the contract between the module and the
-#: migrator, and HANDOFF/sources-handoff.ru.md §3.1.2 asks for it to stay a
+#: migrator, and it has to stay a
 #: string nobody outside this file executes -- so the shape is repeated here and
 #: `tests/test_area_ddl_sourcedesk.py` compares the migrated table against a
 #: database built from the constant itself, so the two cannot drift.
 #:
 #: The other five come from the generation DDL of the sources branch, moved
 #: here as migrations instead of an `executescript` in that branch's `open_db`
-#: (§3.1 п. 5).  One translation was applied: the branch keys its rows by the
+#: One translation was applied: the branch keys its rows by the
 #: address *string* (`source_generation_entry(generation_id, proxy)`), while
-#: CONTRACTS §1.1 makes `endpoints(id, canonical)` the one address entity, so
-#: that column is `endpoint_id` (§1.2 п. 6).
+#: the shared contract makes `endpoints(id, canonical)` the one address entity, so
+#: that column is `endpoint_id`.
 #:
 #: Foreign keys are declared only where the parent is unconditionally written
 #: first: a generation exists before its entries, an observation before the
@@ -1129,8 +1135,7 @@ def _m15(conn, context):
 #: declared DDL has none, and `SourceDesk.apply_plan` writes the *canonical
 #: address* it got from `ImportedEndpoint.endpoint` into `endpoint_id`, so a
 #: reference to `endpoints(id)` would reject the module's own writes.  That
-#: two-address-models conflict is `HANDOFF/sources-handoff.ru.md` §2 C7 and it
-#: belongs to `sourcedesk.py`, not to a constraint invented here.
+#: two-address-models conflict belongs to `sourcedesk.py`, not to a constraint invented here.
 SOURCE_TABLES_DDL = (
     """CREATE TABLE IF NOT EXISTS source_observation(
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1274,12 +1279,12 @@ def _m16(conn, context):
 
 #: Columns `schedules` needs so that a pause and a period budget survive a
 #: restart, plus the spec columns `SqliteScheduleStore.save_spec` writes only
-#: when they exist (`HANDOFF/scheduler.md` §1.1; the same names are the
-#: scheduler's own `REQUESTED_COLUMNS`).
+#: when they exist (the same names are the scheduler's own
+#: `REQUESTED_COLUMNS`).
 #:
 #: `paused` and `counters_json` are the two the contract is really about: without
 #: them a restart hands the whole daily limit back, so the user reads a
-#: counter, trusts it, and gets more than the limit allows (F15).
+#: counter, trusts it, and gets more than the limit allows.
 SCHEDULE_RUNTIME_COLUMNS = (
     ("last_run_at", "REAL"),
     ("paused", "INTEGER NOT NULL DEFAULT 0"),
@@ -1372,6 +1377,19 @@ def _m19(conn, context):
     _add_column(conn, "schedules", "collection_id", "TEXT")
 
 
+def _m20(conn, context):
+    """Collections learn a revision; the audit log gets its time index.
+
+    ``PATCH /v1/collections/{id}`` needs ``If-Match``, and a collection had
+    nothing to compare it with, so every rename was refused.  Existing rows
+    start at revision 1, the value a reader of an old file sees.  The index
+    lets the audit retention delete the oldest rows without a full scan.
+    Both changes are additive.
+    """
+    _add_column(conn, "collections", "revision", "INTEGER NOT NULL DEFAULT 1")
+    conn.execute("CREATE INDEX IF NOT EXISTS audit_log_at ON audit_log(at)")
+
+
 MIGRATIONS = (
     Migration(0, "application_id_and_journal", _m0),
     Migration(1, "endpoints", _m1),
@@ -1393,6 +1411,7 @@ def _m19(conn, context):
     Migration(17, "schedule_runtime_columns", _m17),
     Migration(18, "candidate_scope_exclusion", _m18),
     Migration(19, "schedule_activation_and_catch_up", _m19),
+    Migration(20, "collection_revision_and_audit_index", _m20),
 )
 
 #: Migrations that rewrite data they did not create: a `DROP TABLE` plus a copy, so
@@ -1878,7 +1897,7 @@ def _retention_where(table, policy, now):
         clauses.append(f"{_ident(column)} IS NOT NULL"
                        f" AND {_ident(column)} <= {_sql_literal(now - policy.max_age_seconds)}")
     if table == "results" and policy.expired_only:
-        # A row without valid_until is inconsistent (defect 1) and is never deleted by
+        # A row without valid_until is inconsistent and is never deleted by
         # age: retention removes old proof, it does not fix a missing TTL for a row.
         clauses.append(f"valid_until IS NOT NULL AND valid_until <= {_sql_literal(now)}")
     return " AND ".join(clauses) if clauses else None
@@ -1924,7 +1943,7 @@ def _retention_order(conn, tables):
     ``foreign_keys=ON`` (:func:`connect`) mean a `DELETE FROM observations` is refused
     while a result still points at the row.  The default policy names both tables and
     listed them in the wrong order, so the stock cleanup deleted nothing and then
-    raised -- while the preview had already reported both tables (F24).  The order
+    raised -- while the preview had already reported both tables.  The order
     comes from the live foreign keys, not from a hand-written list.
     """
     remaining = list(dict.fromkeys(tables))
@@ -1956,7 +1975,7 @@ def _retention_targets(conn, policy, now):
     deletion that :func:`apply_retention` then refuses to perform -- the exact
     disagreement between "what is reported" and "what is removed" this module
     promises never to have.  So the preview reports the block and the apply
-    refuses on the same computed fact (F24).
+    refuses on the same computed fact.
 
     The blockers are read against the tables the plan has already *scheduled*,
     not against the tables that happened to delete a row: a referrer that the
@@ -1993,6 +2012,144 @@ def _retention_targets(conn, policy, now):
                                  for table, (blockers, rows) in blocked.items()), total
 
 
+#: Source generations kept per source, entries included.  Every reader needs
+#: only the newest one -- the contribution/overlap views read the active
+#: generation, a 304 re-applies the last good one -- so a short history is kept
+#: for the cache view and nothing older: one generation of the full catalog is
+#: hundreds of thousands of entry rows, and a watched collection used to add
+#: one per run forever.
+SOURCE_GENERATION_KEEP = 3
+#: Fetch observations kept per source: the detail view shows the last 20.
+SOURCE_OBSERVATION_KEEP = 50
+#: Entry rows deleted per statement, so a prune never holds the write lock long.
+SOURCE_PRUNE_BATCH = 20_000
+
+
+def _excess_source_generations(conn, keep, source_ids=None):
+    """Ids of the generations past the newest ``keep`` of each source.
+
+    A generation the source state still names (current or last good) is never
+    excess, whatever its age: it is the answer a 304 or an outage serves.
+    """
+    if not (_table_exists(conn, "source_generation") and _table_exists(conn, "source_generation_entry")):
+        return []
+    if source_ids is None:
+        source_ids = [row[0] for row in conn.execute("SELECT DISTINCT source_id FROM source_generation")]
+    protected = set()
+    if _table_exists(conn, "source_state"):
+        for current, last_good in conn.execute(
+                "SELECT current_generation, last_good_generation FROM source_state"):
+            protected.update(value for value in (current, last_good) if value)
+    excess = []
+    for source_id in dict.fromkeys(source_ids):
+        excess.extend(row[0] for row in conn.execute(
+            "SELECT id FROM source_generation WHERE source_id=? ORDER BY id DESC LIMIT -1 OFFSET ?",
+            (source_id, max(1, int(keep)))) if row[0] not in protected)
+    return excess
+
+
+def _excess_source_observations_sql(keep, source_ids=None, held=True):
+    """WHERE clause (and its parameters) of observations past the newest ``keep`` per source.
+
+    ``held=True`` also leaves out every observation a generation points at.
+    """
+    ids = list(dict.fromkeys(source_ids)) if source_ids is not None else None
+    scope = ""
+    params = []
+    if ids is not None:
+        scope = "o.source_id IN (%s) AND " % ",".join("?" * len(ids))
+        params.extend(ids)
+    where = (scope + "o.id NOT IN (SELECT n.id FROM source_observation n WHERE n.source_id=o.source_id"
+             " ORDER BY n.id DESC LIMIT ?)")
+    params.append(max(1, int(keep)))
+    if held:
+        where += (" AND o.id NOT IN (SELECT observation_id FROM source_generation"
+                  " WHERE observation_id IS NOT NULL)")
+    return where, params
+
+
+def source_history_preview(conn, *, keep_generations=None, keep_observations=None, source_ids=None):
+    """What :func:`prune_source_history` would delete, counted without deleting."""
+    keep_generations = SOURCE_GENERATION_KEEP if keep_generations is None else keep_generations
+    keep_observations = SOURCE_OBSERVATION_KEEP if keep_observations is None else keep_observations
+    result = {"keep_generations": int(keep_generations), "keep_observations": int(keep_observations),
+              "generations": 0, "entries": 0, "observations": 0}
+    if source_ids is not None and not list(source_ids):
+        return result
+    excess = _excess_source_generations(conn, keep_generations, source_ids)
+    result["generations"] = len(excess)
+    for start in range(0, len(excess), 500):
+        chunk = excess[start:start + 500]
+        result["entries"] += conn.execute(
+            "SELECT count(*) FROM source_generation_entry WHERE generation_id IN (%s)"
+            % ",".join("?" * len(chunk)), chunk).fetchone()[0]
+    if _table_exists(conn, "source_observation") and _table_exists(conn, "source_generation"):
+        where, params = _excess_source_observations_sql(keep_observations, source_ids, held=False)
+        candidates = {row[0] for row in conn.execute(
+            "SELECT o.id FROM source_observation o WHERE " + where, params)}
+        if candidates:
+            # Observations that only an excess generation holds go with it.
+            dropping = set(excess)
+            candidates -= {observation for generation, observation in conn.execute(
+                "SELECT id, observation_id FROM source_generation WHERE observation_id IS NOT NULL")
+                if generation not in dropping}
+        result["observations"] = len(candidates)
+    return result
+
+
+def prune_source_history(conn, *, keep_generations=None, keep_observations=None, source_ids=None,
+                         batch=None):
+    """Bound the per-source fetch history: old generations, their entries, old observations.
+
+    Deletes, per source, the generations past the newest ``keep_generations``
+    (never one the source state still names), their entries in batches of
+    ``batch`` rows with a commit after each, and the observations past the
+    newest ``keep_observations`` that no remaining generation points at.
+    ``source_ids`` limits the work to those sources -- the collector passes the
+    one it just wrote.  Returns ``{"generations", "entries", "observations"}``.
+    """
+    keep_generations = SOURCE_GENERATION_KEEP if keep_generations is None else keep_generations
+    keep_observations = SOURCE_OBSERVATION_KEEP if keep_observations is None else keep_observations
+    batch = max(1, int(batch or SOURCE_PRUNE_BATCH))
+    deleted = {"generations": 0, "entries": 0, "observations": 0}
+    if source_ids is not None:
+        source_ids = list(dict.fromkeys(source_ids))
+        if not source_ids:
+            return deleted
+    if conn.in_transaction:
+        raise DbError(E_MIGRATION_FAILED, "prune_source_history needs a connection outside a transaction")
+
+    def write(sql, params=()):
+        conn.execute("BEGIN IMMEDIATE")
+        try:
+            changed = conn.execute(sql, params).rowcount
+            conn.execute("COMMIT")
+        except BaseException:
+            conn.execute("ROLLBACK")
+            raise
+        return max(0, changed)
+
+    for generation in _excess_source_generations(conn, keep_generations, source_ids):
+        while True:
+            changed = write(
+                "DELETE FROM source_generation_entry WHERE generation_id=? AND endpoint_id IN"
+                " (SELECT endpoint_id FROM source_generation_entry WHERE generation_id=? LIMIT ?)",
+                (generation, generation, batch))
+            deleted["entries"] += changed
+            if changed < batch:
+                break
+        deleted["generations"] += write("DELETE FROM source_generation WHERE id=?", (generation,))
+    if _table_exists(conn, "source_observation") and _table_exists(conn, "source_generation"):
+        where, params = _excess_source_observations_sql(keep_observations, source_ids)
+        while True:
+            changed = write("DELETE FROM source_observation WHERE id IN (SELECT o.id FROM source_observation o"
+                            " WHERE " + where + " LIMIT ?)", params + [batch])
+            deleted["observations"] += changed
+            if changed < batch:
+                break
+    return deleted
+
+
 def retention_preview(conn, policy=None, *, now=None):
     """Count what retention would delete, plus the data size behind it.
 
@@ -2007,7 +2164,7 @@ def retention_preview(conn, policy=None, *, now=None):
     return RetentionPreview(policy, now, targets, total,
                             database_bytes(_database_file(conn)),
                             sum(table_bytes(conn, target[0]) or 0 for target in targets),
-                            blocked)
+                            blocked, source_history_preview(conn))
 
 
 def apply_retention(conn, policy=None, *, now=None, vacuum=False):
@@ -2028,7 +2185,7 @@ def apply_retention(conn, policy=None, *, now=None, vacuum=False):
         # A table the plan could not free is refused before anything is deleted, and
         # the refusal comes from the preview's own map -- the same computed fact the
         # caller already saw, so a cleanup never fails on something the preview did
-        # not warn about (F24).
+        # not warn about.
         blockers = blocked.get(table)
         if blockers and preview.blocked_rows(table):
             raise RetentionError(
@@ -2046,6 +2203,13 @@ def apply_retention(conn, policy=None, *, now=None, vacuum=False):
             conn.execute("ROLLBACK")
             raise RetentionError(E_MIGRATION_FAILED, str(exc)) from exc
         deleted.append((table, rows))
+    # Source generations are bounded by count, so the same cleanup that ages
+    # measurements out also trims a history an older version let grow.
+    history = prune_source_history(conn)
+    for table, key in (("source_generation_entry", "entries"), ("source_generation", "generations"),
+                       ("source_observation", "observations")):
+        if history[key]:
+            deleted.append((table, history[key]))
     vacuumed = False
     if vacuum and deleted:
         conn.execute("VACUUM")
@@ -2186,7 +2350,7 @@ def rebind_secrets(source, mapping, *, dry_run=True, now=None):
     A rebind is a rotation in meaning, and it moves the row the same way
     :meth:`secrets.Coordinator.rotate` does: ``access_revision`` goes up by one and
     ``rotated_at`` gets the moment.  Admission is keyed on the exact
-    ``(access_id, access_revision)`` pair (F09), so without the bump every result
+    ``(access_id, access_revision)`` pair, so without the bump every result
     measured with the credential the access used *before* the rebind stayed
     admissible afterwards -- the restored password inherited a successful check it
     had never earned.  A restore that pointed an access back at a different vault
@@ -2201,8 +2365,7 @@ def rebind_secrets(source, mapping, *, dry_run=True, now=None):
     resolved is visibly broken, while an access that resolves against a superseded
     revision silently keeps trusting measurements taken with a password the user
     has replaced.  Note that ``reconcile()`` does not fix it -- it finalises a
-    *staged* entry and leaves a ready one at its own revision alone; see
-    docs/integration/HANDOFF/fix-keys.md.
+    *staged* entry and leaves a ready one at its own revision alone.
     """
     mapping = dict(mapping)
     for old_ref, new_ref in mapping.items():
@@ -2297,19 +2460,31 @@ def create_collection(conn, name, *, kind="private", collection_id=None, now=Non
     return identifier
 
 
+def _revision_bump(conn):
+    """The SET clause that moves a collection revision, when the column exists."""
+    return ", revision = revision + 1" if "revision" in columns(conn, "collections") else ""
+
+
 def rename_collection(conn, collection_id, name):
     name = str(name).strip()
     if not name:
         raise DbError(E_PATH_CONFLICT, "collection name must not be empty")
-    if not conn.execute("UPDATE collections SET name = ? WHERE id = ?",
+    if not conn.execute("UPDATE collections SET name = ?" + _revision_bump(conn) + " WHERE id = ?",
                         (name, collection_id)).rowcount:
         raise DbError(E_PATH_CONFLICT, f"unknown collection: {collection_id!r}")
     return collection_id
 
 
 def archive_collection(conn, collection_id, *, now=None):
-    if not conn.execute("UPDATE collections SET archived_at = ? WHERE id = ?",
-                        (_now(now), collection_id)).rowcount:
+    if not conn.execute("UPDATE collections SET archived_at = ?" + _revision_bump(conn)
+                        + " WHERE id = ?", (_now(now), collection_id)).rowcount:
+        raise DbError(E_PATH_CONFLICT, f"unknown collection: {collection_id!r}")
+    return collection_id
+
+
+def unarchive_collection(conn, collection_id):
+    if not conn.execute("UPDATE collections SET archived_at = NULL" + _revision_bump(conn)
+                        + " WHERE id = ?", (collection_id,)).rowcount:
         raise DbError(E_PATH_CONFLICT, f"unknown collection: {collection_id!r}")
     return collection_id
 
@@ -2339,7 +2514,7 @@ def add_member(conn, collection_id, endpoint_id, *, origin="manual", now=None):
 
 
 def remove_member(conn, collection_id, endpoint_id):
-    """Remove one membership. The address stays in every other list it belongs to (F02)."""
+    """Remove one membership. The address stays in every other list it belongs to."""
     return bool(conn.execute("DELETE FROM membership WHERE collection_id = ? AND endpoint_id = ?",
                              (collection_id, endpoint_id)).rowcount)
 
diff --git a/proxy_workbench/desktop.py b/proxy_workbench/desktop.py
index 4a24f43..b42a261 100644
--- a/proxy_workbench/desktop.py
+++ b/proxy_workbench/desktop.py
@@ -59,7 +59,7 @@
 # Mirrors db.SCHEMA_VERSION.  The real number is read from db at run time; this
 # value is only the fallback for a tree where the storage layer is absent, and
 # tests/test_desktop_signing.py fails when the two disagree.
-FALLBACK_SCHEMA_VERSION = 19
+FALLBACK_SCHEMA_VERSION = 20
 UPDATE_STATE_NAME = 'update-state.json'
 BACKUP_PREFIX = 'pre-update-'
 READ_CHUNK = 1024 * 1024
@@ -71,6 +71,9 @@
 CONTROL_SOCKET_NAME = 'desktop-control.sock'
 CONTROL_MAX_LINE = 64 * 1024
 CONTROL_TIMEOUT_S = 5.0
+#: How long ``--quit`` waits for the instance to let go: the interface gives a
+#: running worker up to 45 seconds to stop before it exits.
+QUIT_WAIT_S = 60.0
 TRAY_HELPER_NAME = 'proxy-workbench-tray'
 TRAY_READY_TIMEOUT_S = 25.0
 PLATFORM_POLL_S = 5.0
@@ -347,7 +350,7 @@ def child_environment(layout, base=None):
 
     The language variable is deliberately absent: ``gui.CHILD_ENV`` owns it and
     the integration contract makes that binding part of the interface
-    contract (CONTRACTS §5.4).
+    contract.
     """
     env = dict(os.environ if base is None else base)
     env[DATA_ENV] = str(layout.data)
@@ -1150,7 +1153,7 @@ def publish_label(status, notarized=False):
 
 
 # --------------------------------------------------------------------------
-# platform layer (F22): the process that owns the instance
+# platform layer: the process that owns the instance
 # --------------------------------------------------------------------------
 #
 # Everything below is a host around the same interface the browser already uses.
@@ -2365,8 +2368,8 @@ def ensure_tray_helper(layout, *, platform=None, finder=None, runner=None):
         packaged = resource_path('tray', TRAY_HELPER_NAME)
         if packaged.is_file() and os.access(packaged, os.X_OK):
             return packaged, tr('меню-бар взят из сборки', 'the menu bar helper came from the bundle')
-        return None, tr('в сборке нет helper меню-бара; см. docs/integration/HANDOFF/fix-desktop.md',
-                        'the bundle has no menu bar helper; see docs/integration/HANDOFF/fix-desktop.md')
+        return None, tr('в сборке нет helper меню-бара',
+                        'the bundle has no menu bar helper')
     target = tray_helper_target(layout)
     if target.is_file() and os.access(target, os.X_OK):
         return target, tr('меню-бар уже собран', 'the menu bar helper is already built')
@@ -3311,7 +3314,7 @@ def main(argv=None):
         os.environ[DATA_ENV] = str(Path(options.data).expanduser().resolve())
     argv = host_argv
     if argv and argv[0] in ('--print-paths', '--portable', '--update-notice', '--autostart',
-                            '--autostart-status', '--status', '--migrate-preview'):
+                            '--autostart-status', '--status', '--quit', '--migrate-preview'):
         return _host_command(argv)
     if any(token in ('-h', '--help', '--version') for token in argv):
         # `--help` and `--version` ask a question and change nothing, so they
@@ -3393,6 +3396,8 @@ def _host_command(argv):
         answer.pop('layout', None)
         print(json.dumps(answer, ensure_ascii=False, indent=2, default=str), flush=True)
         return 0 if answer.get('ok') else 2
+    if command == '--quit':
+        return _quit_running(layout)
     location = os.environ.get(UPDATE_MANIFEST_ENV)
     if not location:
         print(tr(f'Укажите файл манифеста обновления или переменную {UPDATE_MANIFEST_ENV}.',
@@ -3414,6 +3419,36 @@ def _host_command(argv):
     return 0
 
 
+def _quit_running(layout, *, timeout=QUIT_WAIT_S):
+    """Ask the running instance to quit, and wait until it has let go of its folder.
+
+    The menu bar's Quit item does the same over the same channel.  Windows has
+    no menu bar and the GUI executable has no console, so without this command
+    the only way to stop the application there was the Task Manager.  The
+    uninstaller uses it too: files a running program holds cannot be removed.
+    Nothing running is not an error - the wanted state already holds.
+    """
+    running = read_instance(layout)
+    if running is None:
+        print(tr('Приложение не запущено.', 'The application is not running.'), flush=True)
+        return 0
+    answer = control_request(running.control, running.token, dict(action='quit', reason='command'))
+    if not answer.get('bye'):
+        print(tr(f'Приложение не ответило на запрос выхода: {answer.get("error") or answer}',
+                 f'The application did not accept the quit request: {answer.get("error") or answer}'),
+              file=sys.stderr, flush=True)
+        return 2
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if read_instance(layout) is None:
+            print(tr('Приложение закрыто.', 'The application has quit.'), flush=True)
+            return 0
+        time.sleep(0.2)
+    print(tr(f'Приложение ещё не закрылось за {timeout:.0f} с.',
+             f'The application has not quit within {timeout:.0f}s.'), file=sys.stderr, flush=True)
+    return 2
+
+
 # --------------------------------------------------------------------------
 # shared file helpers
 # --------------------------------------------------------------------------
diff --git a/proxy_workbench/diagnostics.py b/proxy_workbench/diagnostics.py
index 80bdd42..c797740 100644
--- a/proxy_workbench/diagnostics.py
+++ b/proxy_workbench/diagnostics.py
@@ -5,7 +5,7 @@
 imports no engine, opens no socket on import, and writes nothing unless the
 caller explicitly saves a bundle.
 
-Contract notes (docs/integration/CONTRACTS.ru.md):
+Contract notes:
 
 * §5.4 — codes are machine-readable and the text is translated separately
   through ``i18n.tr``, so a translation change never renames a code.  Set-level
@@ -57,11 +57,11 @@
 
 #: A legacy row without a recorded lifetime is read with this synthetic max-age,
 #: mirroring ``proxytool.MIN_FRESHNESS_SECONDS``.  It is a parameter, not an
-#: optimum: CONTRACTS §2.4 only promises a visible, configurable max-age.
+#: optimum: the shared contract only promises a visible, configurable max-age.
 LEGACY_MAX_AGE_SECONDS = 2 * 60 * 60
 
 #: How far a ``checked_at`` may sit in the future before the row is suspicious
-#: rather than very fresh (CONTRACTS §2.4, ``time_future``).
+#: rather than very fresh (the shared contract, ``time_future``).
 CLOCK_SKEW_SECONDS = 60.0
 
 #: Time states of a row.  These are the same strings as ``core.TIME_STATES`` on
@@ -352,7 +352,7 @@ def _register(*entries: Code) -> None:
           action_en='A sample list (status and code per attempt) is required to reproduce a measurement honestly.'),
 )
 
-# The canonical `E_<DOMAIN>_<REASON>` codes of CONTRACTS §5.4 that the diagnostics
+# The canonical `E_<DOMAIN>_<REASON>` codes of the shared contract that the diagnostics
 # layer can itself produce.  Codes owned by other modules (keys, gateway, db
 # migrations) are documented in the contract and are not duplicated here.
 _register(
@@ -424,7 +424,7 @@ def _register(*entries: Code) -> None:
           action_en='The shortfall is shown with a number and a reason. A direct fallback is forbidden: refill from reserve and sources.'),
 )
 
-#: Every `E_<DOMAIN>_<REASON>` code the contract fixes (CONTRACTS §5.4).  The
+#: Every `E_<DOMAIN>_<REASON>` code the contract fixes.  The
 #: diagnostics layer may describe any of them, but it must not mint a new one:
 #: codes owned by keys, gateway or migrations stay where the contract puts them.
 CONTRACT_CODES = (
@@ -448,7 +448,7 @@ def _register(*entries: Code) -> None:
 CODE_STAGES: dict[str, str] = {code: entry.stage for code, entry in CODES.items()}
 
 #: Exception class names produced by the engine today, mapped to the code that
-#: says what actually happened.  CONTRACTS §5.4 records that ``ConnectError``,
+#: says what actually happened.  the shared contract records that ``ConnectError``,
 #: ``ConnectTimeout``, ``ReadTimeout``, ``ProxyError`` and ``SSLError`` used to
 #: collapse into one value; this table is what separates them.
 EXCEPTION_CODES: dict[str, tuple[str, str]] = {
@@ -490,7 +490,7 @@ def _register(*entries: Code) -> None:
 CONTROL_CONNECT_REASON = 'Устройство не может выйти в интернет: сеть или файрвол блокируют исходящие соединения.'
 
 #: Exception classes this module raises.  Useful errors carry an action, a code
-#: and the parameters of the code, not only a class name (F25).
+#: and the parameters of the code, not only a class name.
 class ActionableError(Exception):
     """An error that carries a documented code and a recovery action."""
 
@@ -898,7 +898,7 @@ def to_dict(self) -> dict[str, Any]:
 def _time_state(row: Mapping[str, Any], now: float, last_seen: Mapping[str, Any] | None, *,
                 backfill_legacy_ttl: bool = True, future_tolerance_s: float = CLOCK_SKEW_SECONDS,
                 legacy_max_age_s: float = LEGACY_MAX_AGE_SECONDS) -> tuple[str, str | None]:
-    """The time state of one row (CONTRACTS §2.4), plus its code when not ok.
+    """The time state of one row, plus its code when not ok.
 
     The state names are the same strings as `core.TIME_STATES`, so the funnel
     and the admission contract cannot drift apart; `core` stays the authority
@@ -935,7 +935,7 @@ def data_state(row: Mapping[str, Any], now: float, *, last_seen: Mapping[str, An
 
 
 def _blocked(row: Mapping[str, Any]) -> tuple[str, str] | None:
-    """A policy block decided before any measurement (CONTRACTS §6.3)."""
+    """A policy block decided before any measurement."""
     verdict = row.get('reputation')
     if not isinstance(verdict, Mapping):
         return None
@@ -1009,7 +1009,7 @@ def build_funnel(rows: Iterable[Mapping[str, Any]] = (), *, status: Mapping[str,
     """Build the funnel from stored result rows.
 
     `rows` are the payloads the engine already stores (`results.payload` /
-    the observation of CONTRACTS §2.1): `error`, `samples`, `reputation`,
+    the observation of the shared contract): `error`, `samples`, `reputation`,
     `checked_at`, `valid_until`.  `status` is the export `status.json`, `sources`
     the `collect()` reports, `control` an optional device/target control verdict
     and `admitted` the result of the admission contract — `core.admit` bound to
@@ -1814,7 +1814,7 @@ def fixture_recipe(row: Mapping[str, Any], config: Mapping[str, Any] | None = No
     as the client sent it, and an engine error message repeats the target URL,
     so both are redacted again on the way into :meth:`FixtureRecipe.to_dict`:
     this is the shape a help page or an API serves, and a recipe must never be
-    the place where an upstream password reappears (F25).
+    the place where an upstream password reappears.
     """
     samples = tuple({'target': sample.get('target'), 'attempt': sample.get('attempt'),
                      'status': sample.get('status'), 'error': sample.get('error'), 'ok': bool(sample.get('ok')),
diff --git a/proxy_workbench/exportsvc.py b/proxy_workbench/exportsvc.py
index 50e3393..b710eaa 100644
--- a/proxy_workbench/exportsvc.py
+++ b/proxy_workbench/exportsvc.py
@@ -1,6 +1,6 @@
 """One snapshot contract for every export artifact and every reader.
 
-CONTRACTS.ru.md §4 and F28 ask for the same five things everywhere: ``rows``,
+the shared contract and F28 ask for the same five things everywhere: ``rows``,
 ``status``, ``scope``, ``profile``, ``policy``, plus an immutable publication
 behind an atomic pointer.  This module is the only place that writes them, so
 API, gateway, GUI and CLI stop keeping their own copies of the rule.
@@ -11,13 +11,13 @@
   selection, a top-N slice or a search result is written with
   :func:`write_snapshot` and never moves the active pool.  Only
   :func:`publish` moves it, only for ``kind='published'`` and only with an
-  explicit confirmation (defect 7, R04).
+  explicit confirmation.
 * **A published generation is immutable.**  It is written once, checksummed
   into a manifest, and read through a pointer swap that either happens or does
   not.  A failure leaves the previous generation as the only published one.
 * **A set has a lifetime of its own.**  ``expires_at`` is the newest admitted
   member's deadline, never ``min()`` over rows, so one expired member cannot
-  hide the rest (defect 3).
+  hide the rest.
 
 The admission decision itself is **not** here: thresholds, denylist, anonymity
 and the clock belong to :mod:`proxy_workbench.core`, and this module calls it
@@ -105,9 +105,8 @@
     'access_id', 'access_revision',
 )
 
-# Codes outside the §5.4 canon.  They are proposed here and listed for the
-# contract owner in docs/integration/HANDOFF/exportsvc.md; the ones already in
-# the canon are reused unchanged.
+# Codes outside the shared canon are defined here; the ones already in the
+# canon are reused unchanged.
 EXPORT_CODES = {
     'E_EXPORT_PROTOCOL_UNSUPPORTED': (
         'Формат {format} не поддерживает протокол {protocol}.',
@@ -414,7 +413,7 @@ class CompatReport:
 
     ``client_check`` is the result of running the pinned client against the
     generated file: ``passed``, ``failed`` or ``not_run``.  It is never reported
-    as ``passed`` on the strength of a JSON parse alone (R14, defect 20).
+    as ``passed`` on the strength of a JSON parse alone.
     """
 
     fmt: str
@@ -647,7 +646,7 @@ def singbox_target(version: str | None) -> SingBoxTarget:
     version produces the version-independent shape, and the artifact says the
     target was unconfigured and that no client check ran.  An unparsable or
     unverified version is refused: falling back silently would mean shipping a
-    config for a client nobody checked (R14).  ``legacy-block`` is the one
+    config for a client nobody checked.  ``legacy-block`` is the one
     named exception, and it is only a named exception.
     """
     raw = (version or '').strip()
@@ -748,7 +747,7 @@ def render_singbox(rows: Sequence[Mapping[str, Any]], *, options: ExportOptions
     explicit ``legacy-block`` request.  From 1.11.0 on that outbound is
     deprecated and the same refusal is a route rule with ``action: reject``.
     Nothing here ever emits a ``direct`` outbound, so an empty or
-    unsupported-only set cannot turn into an unproxied connection (defect 20),
+    unsupported-only set cannot turn into an unproxied connection,
     and a set with usable outbounds is version-independent, so it is written
     even when no target was pinned - marked unverified, never marked checked.
     """
@@ -949,7 +948,13 @@ def render_txt(rows: Sequence[Mapping[str, Any]]) -> str:
 
 
 def render_hostport(rows: Sequence[Mapping[str, Any]]) -> str:
-    return ''.join(f"{_address(row.get('proxy'))}\n" for row in rows if row.get('proxy'))
+    """``host:port`` once each, in rank order.
+
+    The list carries no protocol, so one port that works as both HTTP and
+    SOCKS5 (a mixed proxy, or ``--detect-protocols``) is one line, not two.
+    """
+    addresses = dict.fromkeys(_address(row.get('proxy')) for row in rows if row.get('proxy'))
+    return ''.join(f'{address}\n' for address in addresses)
 
 
 def render_snapshot_txt(rows: Sequence[Mapping[str, Any]], *, status: Mapping[str, Any]) -> str:
@@ -1284,7 +1289,13 @@ def status_from_dict(data: Mapping[str, Any]) -> SnapshotStatus:
         source_binding=data.get('source_binding'))
     policy = core.Policy(max_age_seconds=_as_float(data.get('max_age_seconds'),
                                                    core.DEFAULT_MAX_AGE_SECONDS),
-                         min_success=_as_float(data.get('min_success'), 2 / 3),
+                         # ``--min-success 0`` is recorded as 0 ("no threshold");
+                         # the policy is defined on (0, 1], so it is read with
+                         # the same clamp the exporter applied.  Reading 0 as is
+                         # refused the whole generation: every reader (API, GUI,
+                         # gateway) reported a broken snapshot.
+                         min_success=(_as_float(data.get('min_success'), 2 / 3)
+                                      if _as_float(data.get('min_success'), 2 / 3) > 0 else 1e-9),
                          min_anonymity=_as_text(data.get('min_anonymity') or 'any'))
     options = ExportOptions(sort=_as_text(data.get('sort') or 'quality'), top=_as_int(data.get('top'), 0),
                             credentials=_as_text(data.get('credentials') or CREDENTIALS_REDACT),
@@ -1406,7 +1417,7 @@ class LoadedSnapshot:
     """One coherent generation, read through a pinned name.
 
     ``rows`` keeps expired members and ``fresh_rows`` does not, so a consumer
-    chooses; the reader never empties a set because of one stale row (defect 3).
+    chooses; the reader never empties a set because of one stale row.
     """
 
     generation: str
@@ -1492,7 +1503,7 @@ def write_snapshot(directory: Any, rows: Sequence[Mapping[str, Any]], *, scope:
 
     Nothing here can change the active pool: that is :func:`publish`'s job, and
     only for ``kind='published'``.  A selection, a top-N slice and a search
-    result all land here (defect 7).
+    result all land here.
 
     ``client`` is the resolved target version and client binary.  Left out, it
     is resolved from the options, the environment and ``client.json`` beside
@@ -1594,7 +1605,7 @@ def _singbox_with_report(rows: Sequence[Mapping[str, Any]], options: ExportOptio
     carries every other file, the sing-box entry is marked as not written, and
     the reason plus the action are in ``status.json`` where a GUI or an API can
     show them.  That is a fail-closed generation error, not a silent choice of
-    a deprecated shape (defect 20).
+    a deprecated shape.
     """
     if not target.supported:
         raise ExportError(target.reason or 'E_EXPORT_TARGET_UNVERIFIED', target=target.version,
diff --git a/proxy_workbench/gateway.py b/proxy_workbench/gateway.py
index f565602..c93b7ac 100644
--- a/proxy_workbench/gateway.py
+++ b/proxy_workbench/gateway.py
@@ -9,20 +9,19 @@
 Rules this module keeps, because each of them was a defect or a requirement:
 
 * a concurrency slot is **reserved before** the first ``await`` that can block
-  and is released on success, on error and on cancellation (defect 16);
+  and is released on success, on error and on cancellation;
 * one absolute deadline covers the whole client handshake, not just the first
-  byte, and the number of accepted clients is bounded (defect 16, R11);
+  byte, and the number of accepted clients is bounded;
 * an open TCP stream is never moved to another upstream: the request that was
-  already written to one upstream is never written to another (F16, defect 17);
+  already written to one upstream is never written to another;
 * ``connected`` is not ``working``: only bytes from the target prove an HTTP
   upstream works, and a target that refused is not the proxy's fault
-  (defect 17);
 * the local denylist is applied **before** any network call, and a new rule
   revokes new admissions immediately; the fate of already open streams is a
-  separate, explicit ``on_deny`` policy (defect 19, R13);
+  separate, explicit ``on_deny`` policy;
 * the gateway password is a separate identity from the GUI session token and
   the API token, and the default bind stays on loopback (defect 18, R12,
-  CONTRACTS §5.1);
+  the shared contract);
 * an upstream credential is produced only by :mod:`proxy_workbench.secrets`
   and lives only for the handshake that needs it, and a rejected credential is
   **indistinguishable** from a missing one and from a dead proxy (F04, defect 1
@@ -93,8 +92,7 @@
 #: not be able to learn *why* one address is unusable, because "the proxy asked
 #: for a password we do not have" and "the proxy rejected the password we have"
 #: are the same kind of secret - whether the gateway holds a credential for a
-#: given address (see ``AccessCredentials``, and the ``407`` section of
-#: docs/integration/HANDOFF/area-gateway.md for the client-visible half).
+#: given address (see ``AccessCredentials``).
 UNUSABLE = 'unusable'
 #: The wildcard a LAN listener binds when no address was named.  It is never a
 #: published address: :func:`display_host` replaces it with a real interface.
@@ -110,7 +108,7 @@ def new_gateway_token():
     """A fresh password for gateway clients.
 
     The gateway password is a separate identity from the GUI session token and
-    from the API token (CONTRACTS §5.1, defect 18).  This function never reads
+    from the API token.  This function never reads
     either of them, so a LAN phone password can never become a control secret.
     """
     return secrets.token_urlsafe(24)
@@ -121,7 +119,7 @@ def resolve_token(bind, token=None):
 
     On a LAN bind a password is mandatory, and when the caller did not supply
     one the gateway makes its own.  It never reads the GUI session token and
-    never reads the API token: those are different identities (CONTRACTS §5.1,
+    never reads the API token: those are different identities (the shared contract,
     defect 18).  A loopback listener keeps the old behaviour, where a token is
     used when given and none is invented when not.
     """
@@ -247,7 +245,7 @@ class Binding:
     """Which pool, generation, profile and policy one listener or client serves.
 
     A binding pins the generation and profile so publishing another run does
-    not silently move an already connected client (defect 8).  ``policy`` holds
+    not silently move an already connected client.  ``policy`` holds
     per-binding knobs: ``max_per_proxy``, ``sticky``, ``strategy`` and the
     scoping filters ``protocol``/``countries``/``anonymity``/``max_latency``,
     which narrow the rows a client may ever be offered.
@@ -296,7 +294,7 @@ class AccessCredentials:
       a superseded revision is refused rather than sent;
     * an endpoint with *several* usable access identities is ambiguous, and an
       ambiguous row gets no credential at all.  Two credentials of one address
-      are two identities (CONTRACTS §1.2(1)); merging them would be worse than
+      are two identities; merging them would be worse than
       not authenticating.
 
     Nothing here raises into the relay path.  A locked vault, a missing secret,
@@ -372,7 +370,7 @@ class Lease:
     """A held concurrency slot for one proxy.
 
     Released exactly once, whether the connection succeeded, failed or was
-    cancelled (defect 16).  ``with lease:`` is the safe form.  ``credentials``
+    cancelled.  ``with lease:`` is the safe form.  ``credentials``
     rides along only until the request that needs it has been written.
     """
 
@@ -410,7 +408,7 @@ class ReplayGuard:
     A gateway may try several upstreams while nothing of the request has been
     sent.  The moment the first byte of the request goes out, the request
     belongs to that upstream: a non-idempotent request is never repeated on
-    another one (defect 17).  The guard makes that structural - there is no
+    another one.  The guard makes that structural - there is no
     code path that can write the same request twice.
     """
 
@@ -521,7 +519,7 @@ def set_denylist(self, denylist):
         and it is never dialled.  Removing a rule puts the proxy back, because
         the servable list is always *derived* from the export instead of being
         edited in place - a one-way ratchet that only a new publication could
-        undo would silently shrink the pool for good (defect 19).
+        undo would silently shrink the pool for good.
         Streams that are already open are a separate decision - see
         ``on_deny`` and :meth:`revoke_streams`.
         """
@@ -674,8 +672,8 @@ def row_for(self, proxy):
         """The published row behind one chosen proxy, or None.
 
         Selection deals in addresses, but a credential belongs to the *access
-        identity* a row was measured with, so the relay looks the row up here
-        (F04).  Pure in-memory and O(1); a row that is not servable is not
+        identity* a row was measured with, so the relay looks the row up here.
+       Pure in-memory and O(1); a row that is not servable is not
         served, so a denied proxy resolves to nothing.
         """
         with self.lock:
@@ -757,8 +755,8 @@ def reserve(self, request=None, exclude=(), session=None, sticky=None, binding=N
 
         Doing both together is what keeps parallel connects under
         ``max_per_proxy``: there is no await between the check and the
-        reservation, so two clients can never observe the same free slot
-        (defect 16).  The caller owns the returned :class:`Lease`.
+        reservation, so two clients can never observe the same free slot.
+       The caller owns the returned :class:`Lease`.
         """
         return self._pick(exclude, request, session, sticky, binding, reserve=True)
 
@@ -814,7 +812,7 @@ def connected(self, proxy, connect_ms=0.0):
         """The upstream accepted a connection and finished its handshake.
 
         This is deliberately *not* a success and it does not clear a failure
-        streak: nothing of the target has been proved yet (defect 17).  Only an
+        streak: nothing of the target has been proved yet.  Only an
         outcome that carried traffic does that.
         """
         with self.lock:
@@ -1468,8 +1466,7 @@ def sent_bytes(total):
                     # difference a client can see is against a proxy that is
                     # simply not reachable, and that is a property of the
                     # upstream address itself, which any observer could establish
-                    # without asking this listener.  See the handoff note
-                    # ``407`` for the stronger variant and what it would cost.
+                    # without asking this listener.
                     score('upstream_refused')
                 elif status >= 500:
                     # The upstream answered and the target did not.  Resting the
@@ -1562,7 +1559,7 @@ async def handle(self, reader, writer):
         loop = asyncio.get_running_loop()
         # One absolute deadline for the whole handshake: the first byte, the
         # request line, the SOCKS5 negotiation and the upstream tunnel all have
-        # to fit into it (defect 16, R11).  The relayed connection is not part
+        # to fit into it.  The relayed connection is not part
         # of the handshake and is governed by idle_timeout / max_session.
         deadline = loop.time() + self.handshake_timeout
         try:
@@ -1639,7 +1636,7 @@ async def handle_http(self, first, reader, writer):
         # The slot is ours from here until the relay takes it.  Telling the
         # client "connection established" is still an await, and a shutdown, a
         # handshake deadline or a client that hangs up in exactly that window
-        # must not leave the slot taken (defect 16).
+        # must not leave the slot taken.
         try:
             if path is None:
                 writer.write(b'HTTP/1.1 200 Connection established\r\n\r\n')
@@ -1707,7 +1704,7 @@ async def handle_socks5(self, reader, writer):
             return await writer.drain()
         # Same rule as the HTTP path: the grant is an await, so a cancellation
         # or a client that hangs up while it is written must give the slot back
-        # rather than leak it (defect 16).
+        # rather than leak it.
         try:
             writer.write(b'\x05\x00\x00\x01' + bytes(6))
             await writer.drain()
diff --git a/proxy_workbench/geo.py b/proxy_workbench/geo.py
index 9c43306..7f7135a 100644
--- a/proxy_workbench/geo.py
+++ b/proxy_workbench/geo.py
@@ -72,7 +72,7 @@
 DEFAULT_UNKNOWN_POLICY = UNKNOWN_EXCLUDE
 
 # --- Reason codes ----------------------------------------------------------------
-# Stable machine codes (CONTRACTS §5.4 style).  Text lives with i18n.tr, not here.
+# Stable machine codes (style).  Text lives with i18n.tr, not here.
 
 REASON_NO_CRITERION = 'geo_no_country_criterion'
 REASON_MATCHED = 'geo_country_matched'
@@ -1013,7 +1013,7 @@ def from_row(self, row):
         return endpoint, exit_fact, self.provider_fact(proxy)
 
     def describe(self, row, criterion=None, now=None):
-        """One row as the fields of CONTRACTS §4.4 plus the provenance F08 adds."""
+        """One row as the fields of the shared contract plus the provenance F08 adds."""
         endpoint, exit_fact, provider = self.from_row(row)
         moment = self.now if now is None else float(now)
         verdict = evaluate(criterion, endpoint, exit_fact, moment) if criterion is not None else None
diff --git a/proxy_workbench/gui.py b/proxy_workbench/gui.py
index 90f01e9..9828757 100644
--- a/proxy_workbench/gui.py
+++ b/proxy_workbench/gui.py
@@ -130,7 +130,7 @@ def jobs_state_names():
 PAGE_SIZE = 50
 PAGE_SIZE_MAX = 200
 # A quick row test is diagnostic.  It gets its own whole-call deadline so one
-# click cannot run for minutes (defect 23).
+# click cannot run for minutes.
 QUICK_TEST_DEADLINE_S = 45.0
 QUICK_TEST_TIMEOUT_CAP_S = 10.0
 QUICK_TEST_MAX_BYTES = 1024 * 1024
@@ -141,7 +141,7 @@ def jobs_state_names():
 HISTORY_LIMIT = 50
 EVENTS_FILE = 'gui-events.jsonl'
 EVENT_RETENTION = 2000
-# The user's own service sets (F06).  A pinned set is a snapshot of definitions
+# The user's own service sets.  A pinned set is a snapshot of definitions
 # the catalog published once: later catalog updates must not change it silently,
 # so the pin lives beside the user's other documents, not in the worker runtime.
 SERVICE_SETS_FILE = 'gui-service-sets.json'
@@ -156,7 +156,7 @@ def jobs_state_names():
 # after that.
 SCOPE_EXCLUSIONS_FILE = 'gui-scope-exclusions.json'
 SCOPE_EXCLUSION_LIMIT = 20_000
-#: The country criterion the table applies (F08).  These are the values the
+#: The country criterion the table applies.  These are the values the
 #: CLI already accepts in ``--country-basis`` / ``--country-unknown``; the page
 #: takes them in the query so a link to a scoped table can be shared.
 COUNTRY_BASES = ('endpoint', 'exit', 'either')
@@ -571,7 +571,7 @@ def read_snapshot(data, *, now=None):
         except (OSError, UnicodeError, ValueError):
             # A published generation never changes; a generation that cannot be
             # read is a broken publication, not a licence to serve database
-            # rows the reader itself would reject (defect 9, R05).
+            # rows the reader itself would reject.
             return Snapshot(SNAPSHOT_BROKEN, generation=generation, directory=exports,
                             detail='generation_unreadable')
         if not isinstance(rows, list) or not isinstance(status, dict):
@@ -796,7 +796,7 @@ def __init__(self, data, *, execute_jobs=False):
             raise OSError('GUI already running') from None
         self.token = secrets.token_urlsafe(32)
         # The gateway password is a separate secret: the GUI session token must
-        # never travel into a QR code or a phone profile (defect 18, R12).
+        # never travel into a QR code or a phone profile.
         self.gateway_token = secrets.token_urlsafe(24)
         self.geo_cache = (None, None)
         self.asn_cache = (None, None)
@@ -909,7 +909,7 @@ def source_document(self):
         """Last accepted remote catalog, or the bundled one when there is none.
 
         Named apart from :meth:`catalog` on purpose: that one is the *service*
-        catalog (F06), this one is the *source* catalog (F13).  Both were
+        catalog, this one is the *source* catalog.  Both were
         called `catalog`, and the later definition silently won, so every
         source page and every source preview was handed the service manifest
         and `source_catalog.source_by_id` raised `KeyError: 'sources'`.
@@ -1354,10 +1354,10 @@ def scope_exclusions(self, query=None):
                     limit=SCOPE_EXCLUSION_LIMIT, truncated=len(rows) > SCOPE_EXCLUSION_LIMIT,
                     storage='database')
 
-    # -- source comparison (F21) --------------------------------------------
+    # -- source comparison --------------------------------------------
 
     def source_comparison(self, payload):
-        """Publishers compared on what was actually measured (F21).
+        """Publishers compared on what was actually measured.
 
         The sources page is where the catalog lives, so it is also where the
         question "which of these actually adds anything?" is asked.  The
@@ -1384,7 +1384,7 @@ def source_comparison(self, payload):
             # ``WorkbenchError`` is a ``RuntimeError``, which the GET handler
             # does not name -- it escaped, the worker thread died mid-response
             # and the page saw a dropped connection instead of the sentence the
-            # refusal carries.  A rejected control is a message (F25).
+            # refusal carries.  A rejected control is a message.
             raise ValueError(str(exc)) from None
 
     def _source_comparison(self, wanted, payload, windows):
@@ -1559,7 +1559,7 @@ def snapshot(self, now=None):
         return read_snapshot(self.data, now=now)
 
     def export_status(self, snapshot=None, now=None):
-        """Coherent status for the published generation, per-row (defect 3).
+        """Coherent status for the published generation, per-row.
 
         The published ``status.json`` carries one set-wide ``valid_until``.  Using
         it as "the snapshot expired" is exactly the defect that empties a
@@ -1572,7 +1572,7 @@ def export_status(self, snapshot=None, now=None):
         if not status:
             if snapshot.state in (SNAPSHOT_BROKEN, SNAPSHOT_MISSING):
                 # An unreadable publication is named as such.  Silently serving
-                # database rows the reader itself rejects is defect 9 (R05).
+                # database rows the reader itself rejects is defect 9.
                 return dict(state='error', state_detail=snapshot.detail or 'no_snapshot',
                             published=False, reader_state=snapshot.state, available=0,
                             expired_count=0, stale=False, empty_export=False)
@@ -1928,12 +1928,12 @@ def start(self, payload, max_selection=MAX_SELECTION):
                 command.extend(['--selection-file', str(selection_path)])
             if scope_collection and action in ('run', 'scan', 'recheck', 'recheck_passing'):
                 # A check is a measurement of one collection; the worker reads
-                # membership as the candidate set (F02, CONTRACTS §1.2).
+                # membership as the candidate set.
                 command.extend(['--collection', scope_collection])
             if action == 'export':
                 if scope_collection:
                     # The published generation is a statement about the same
-                    # collection the check measured (F02).
+                    # collection the check measured.
                     command.extend(['--collection', scope_collection])
                 if 'q' in payload:
                     command.extend(['--export-query', export_query])
@@ -2107,13 +2107,13 @@ def state(self):
                 state['log'] = ''
             return state
 
-    # -- collections (F02) -------------------------------------------------
+    # -- collections -------------------------------------------------
     #
     # A collection is the scope of a check: the public base, the migrated
     # legacy list and a personal list are different rows of the same table, so
     # choosing one cannot show the others.  Membership is the scope, and a
     # collection with no members yields nothing rather than falling back to
-    # every address ever collected (defect 11).
+    # every address ever collected.
 
     def collection_items(self, conn):
         """Every collection with the number of its own members.
@@ -2145,7 +2145,7 @@ def collection_row(conn, collection_id):
                             (collection_id,)).fetchone()
 
     def collections(self, query=None):
-        """The list the interface needs to offer an explicit scope (F02)."""
+        """The list the interface needs to offer an explicit scope."""
         selected = str((query or {}).get('selected', [''])[0] or '').strip()
         conn = self.read_connection()
         if conn is None:
@@ -2188,7 +2188,7 @@ def collection_members(self, payload):
         return dict(collection=wanted, members=rows, total=len(rows))
 
     def create_collection(self, payload):
-        """Create a personal list. It starts empty and stays separate (defect 11)."""
+        """Create a personal list. It starts empty and stays separate."""
         payload = payload or {}
         name = payload.get('name')
         if not isinstance(name, str) or not name.strip() or len(name) > 160:
@@ -2248,7 +2248,7 @@ def add_collection_members(self, payload):
                     members=self.collection_members({'collection': wanted}))
 
     def remove_collection_member(self, payload):
-        """Drop one address from one collection; every other list keeps it (F02)."""
+        """Drop one address from one collection; every other list keeps it."""
         payload = payload or {}
         value = payload.get('proxy')
         if not isinstance(value, str) or not value.strip():
@@ -2304,12 +2304,12 @@ def collection_scope(self, plan):
         finally:
             conn.close()
 
-    # -- service catalog (F06) ---------------------------------------------
+    # -- service catalog ---------------------------------------------
     #
     # The catalog is a shipped manifest with an id, a version, a maintainer and
     # a real pass condition per service.  A set is a combination of services
     # with a rule, and applying one writes a complete field inventory, so no
-    # judge or threshold of the previous set survives the switch (defect 24).
+    # judge or threshold of the previous set survives the switch.
 
     def catalog(self, query=None):
         """Categories, services and sets, with search and multi-selection."""
@@ -2473,7 +2473,7 @@ def resolve_set(self, catalog, set_id, payload):
             required_ids=payload.get('required_ids'))
 
     def save_service_set(self, payload):
-        """Save the current selection as the user's own set (F06)."""
+        """Save the current selection as the user's own set."""
         payload = payload or {}
         set_id = str(payload.get('id') or '').strip()
         title = str(payload.get('title') or '').strip()
@@ -2683,7 +2683,7 @@ def provider_resolver(self):
         return core.provider_resolver(self.asn())
 
     def result_policy(self, plan, cfg, *, denylist):
-        """The admission policy of this read, assembled in one place (F18)."""
+        """The admission policy of this read, assembled in one place."""
         reputation = cfg.get('reputation', {}) if isinstance(cfg, dict) else {}
         strict = bool(reputation.get('strict', False))
         if not (cfg or {}).get('anonymity'):
@@ -3364,7 +3364,7 @@ def bulk(self, payload):
                                     count=changed)
         return dict(common, changed=changed, history=entry)
 
-    # -- real measurement events (defect 25, R17) -------------------------
+    # -- real measurement events -------------------------
 
     def _event_seq(self, stream):
         return self.event_seq.get(stream, 0)
@@ -3520,7 +3520,7 @@ def event_code(body):
         return 'E_STATE_NO_OBSERVATION'
 
     def events(self, query):
-        """New events after a cursor, in cursor order (CONTRACTS §5.7)."""
+        """New events after a cursor, in cursor order."""
         self._load_events()
         stream = query.get('stream', [''])[0]
         cursor = str(query.get('after', ['0'])[0] or '0')
@@ -3568,7 +3568,7 @@ def events(self, query):
                     cursor=(f'{last["stream"]}:{last["seq"]}' if last else cursor),
                     oldest_seq=oldest, source='measurements', truncated=len(found) > limit)
 
-    # --- API keys (F29) -----------------------------------------------------
+    # --- API keys -----------------------------------------------------
     #
     # `apikeys` was fully written and reachable only from the CLI: `grep` for
     # "key" in this file found nothing, so a user who launched the application
@@ -3592,7 +3592,7 @@ def api_key_banner(self):
         a secret scrolls away, and the page is the place where a secret is shown
         once on purpose.  The banner only counts the keys, so a user who starts
         the application with no arguments is told that the door exists and where
-        the key is (F29).
+        the key is.
         """
         try:
             admins = self.key_admins()
@@ -3782,7 +3782,7 @@ def key_action(self, payload):
             raise ValueError(self.key_error(exc)) from None
         return info.as_dict(manager.now())
 
-    # --- import (F03) -------------------------------------------------------
+    # --- import -------------------------------------------------------
     #
     # `importer.py` is 1162 lines of a transactionally committing, previewing,
     # mapping-aware importer and the interface could not reach any of it: the
@@ -3932,7 +3932,7 @@ def import_batches(self, query=None):
         return dict(batches=rows, report=None, limits=dict(
             modes=list(importer.MODES), formats=list(importer.FORMATS)))
 
-    # --- pools and schedules (F14, F15) ------------------------------------
+    # --- pools and schedules ------------------------------------
     #
     # `pools.py` and `scheduler.py` are complete and were reachable only from
     # the CLI and `/v1`.  The routes below are the same calls the API makes
@@ -4093,7 +4093,7 @@ def pool_action(self, payload):
                 raise ValueError(str(exc) or 'Пул отклонил изменение.') from None
 
     def pool_recheck(self, pool_id, payload):
-        """Queue a measurement of the pool's own collection (F14)."""
+        """Queue a measurement of the pool's own collection."""
         from . import jobs as jobs_module
         with core.Workbench(self.data) as workbench:
             spec = workbench.pools().require(pool_id)
@@ -4352,7 +4352,7 @@ def gateway_configure(self, payload):
                     empty=bool(applied) and not applied.get('rows'),
                     gateway=self.gateway_state())
 
-    # --- storage maintenance (F24) -----------------------------------------
+    # --- storage maintenance -----------------------------------------
     #
     # `db.cleanup_preview`, `db.retention_preview`, `db.restore_preview` and
     # `db.migrate_data_path` were called from tests only.  The page therefore
@@ -4495,7 +4495,7 @@ def data_path_migrate(self, payload):
             body['backup_path'] = str(getattr(backup, 'path', '') or '')
         return body
 
-    # --- diagnostics (F10) -------------------------------------------------
+    # --- diagnostics -------------------------------------------------
     #
     # `diagnostics.py` knows how to read a run as a funnel -- what entered
     # each stage, what was lost and whose fault it was -- and how to explain an
@@ -4676,7 +4676,7 @@ def diagnostics_bundle(self, payload):
                     truncated=bundle.truncated, describe=bundle.describe(),
                     canary_clean=True, canary_checked=len(self.diagnostic_needles()))
 
-    # --- jobs (F11) --------------------------------------------------------
+    # --- jobs --------------------------------------------------------
     #
     # `jobs.py` keeps a durable job, its items, structured progress and a
     # gapless event stream per job.  None of it had a route: the page showed
@@ -4759,7 +4759,7 @@ def job_action(self, payload):
                     job=dict(id=job.id, kind=job.kind, state=job.state,
                              started_at=job.started_at, finished_at=job.finished_at))
 
-    # --- desktop layer (F22) -----------------------------------------------
+    # --- desktop layer -----------------------------------------------
     #
     # `desktop.py` runs the menu bar, the single instance, the login item and
     # sleep/wake, and it keeps a journal of what it did.  The interface had no
@@ -5036,8 +5036,9 @@ def do_GET(self):
             if path.path == '/api/sources/update-status':
                 return self.respond(200, self.app.catalog_update_status())
             if path.path == '/api/api-keys':
-                return self.respond(200, self.app.keys_view(
-                    {'admin_secret': (query.get('admin_secret') or [''])[0]}))
+                # The administrator secret never travels in a URL: the page
+                # posts it to /api/api-keys/list.  A GET lists what needs no key.
+                return self.respond(200, self.app.keys_view({}))
             if path.path == '/api/import/batches':
                 return self.respond(200, self.app.import_batches(query))
             if path.path == '/api/pools':
@@ -5090,7 +5091,7 @@ def do_GET(self):
             self.respond(404, dict(error='Не найдено.'))
         except ValueError as exc:
             # A rejected control is a message with an action in it, not a
-            # generic "try again" (F25).
+            # generic "try again".
             message = str(exc) if str(exc) and not str(exc).startswith(('0x', 'not')) else \
                 'Неверные параметры запроса.'
             self.respond(400, dict(error=message))
@@ -5207,6 +5208,9 @@ def do_POST(self):
                 return self.respond(200, self.app.gateway_configure(payload))
             if path == '/api/api-keys':
                 return self.respond(200, self.app.key_create(payload))
+            if path == '/api/api-keys/list':
+                return self.respond(200, self.app.keys_view(
+                    {'admin_secret': str((payload or {}).get('admin_secret') or '')}))
             if path == '/api/api-keys/bootstrap':
                 return self.respond(200, self.app.key_bootstrap(payload))
             if path == '/api/api-keys/action':
@@ -5322,7 +5326,7 @@ def main(argv=None):
             threading.Thread(target=api_server.serve_forever, daemon=True).start()
             # The old line named the deprecated `/proxies` and said nothing about
             # `/v1` or about the key that door needs, so a user who launched the
-            # application without arguments was never told how to get in (F29).
+            # application without arguments was never told how to get in.
             print(tr(f'API для своих программ: {server.app.api_url}/v1 '
                      f'(ключ — на странице «Ключи» в интерфейсе, {url}#keys)',
                      f'API for your programs: {server.app.api_url}/v1 '
@@ -5350,7 +5354,7 @@ def main(argv=None):
             # never carry the secret that administers this interface.
             gateway_token = server.app.gateway_token
         if args.lan and api.is_loopback(args.gateway_host):
-            # LAN mode is an explicit opt-in with a visible state (defect 18).
+            # LAN mode is an explicit opt-in with a visible state.
             print(tr('Внимание: ротирующий прокси открыт в локальной сети; пароль доступа есть в QR.',
                      'Warning: the rotating proxy is open on the local network; its password is in the QR.'), flush=True)
         try:
diff --git a/proxy_workbench/i18n.py b/proxy_workbench/i18n.py
index 740b246..db6ada9 100644
--- a/proxy_workbench/i18n.py
+++ b/proxy_workbench/i18n.py
@@ -43,7 +43,7 @@ def tr(ru, en):
     return ru if LANG == 'ru' else en
 
 
-# Canonical machine codes of the shared contract (CONTRACTS §5.4, §5.6).
+# Canonical machine codes of the shared contract.
 # The code never changes with the language; only the text next to it does.
 CODES = {
     'OK': ('измерение пройдено', 'measurement passed'),
@@ -94,9 +94,9 @@ def code_text(code, lang=None):
     return entry[0] if language == 'ru' else entry[1]
 
 
-# ``state_detail`` of a published set (CONTRACTS §4.3).  It answers the one
+# ``state_detail`` of a published set.  It answers the one
 # question a user actually has when a list is empty: "nothing matched" and
-# "everything expired" are different reasons (defect 3), so they get different
+# "everything expired" are different reasons, so they get different
 # words.  The values come from ``core.STATE_DETAILS`` plus the two reader
 # states the interface adds when the pointer cannot be read at all.
 STATE_DETAILS = {
diff --git a/proxy_workbench/importer.py b/proxy_workbench/importer.py
index 3a9ce4d..4d61800 100644
--- a/proxy_workbench/importer.py
+++ b/proxy_workbench/importer.py
@@ -1,6 +1,6 @@
 """Import of proxy lists: adapters, preview, transactional commit, report.
 
-CONTRACTS.ru.md: F03 (§7.1), error codes (§5.4), schema migrations 1, 2 and 12
+Schema: migrations 1, 2 and 12
 (`endpoints`, `collections`, `membership`, `import_batch`).
 
 The module owns no DDL.  The caller passes a connection already migrated by
@@ -17,9 +17,9 @@
   `E_IMPORT_REVISION` instead of overwriting somebody else's work;
 * every path (file, drag-and-drop, clipboard) and every adapter runs the same
   endpoint check, so a hostname, a private address or credentials are refused
-  immediately and with the same code everywhere (defect 10, R06);
+  immediately and with the same code everywhere;
 * raw input is never stored: rows are reported by line number and redacted
-  sample, never by their original text (F03, F04).
+  sample, never by their original text.
 """
 
 from __future__ import annotations
@@ -63,8 +63,7 @@
 
 # --- codes ------------------------------------------------------------------
 # E_IMPORT_REVISION / E_IMPORT_FORMAT / E_IMPORT_PARTIAL are the IMPORT domain
-# of CONTRACTS §5.4.  The rest are additions this module needs; they are
-# requested in docs/integration/HANDOFF/importer.md §5.
+# of the shared contract.  The rest are additions this module needs.
 CODE_FORMAT = 'E_IMPORT_FORMAT'
 CODE_ENCODING = 'E_IMPORT_ENCODING'
 CODE_SIZE = 'E_IMPORT_SIZE'
@@ -118,7 +117,7 @@
 class ImportProblem(Exception):
     """Base class of every refusal this module raises.
 
-    `code` is the stable machine code (CONTRACTS §5.4); `detail` carries the
+    `code` is the stable machine code; `detail` carries the
     machine context an API layer needs to answer a conflict without parsing
     the message.
     """
@@ -204,7 +203,7 @@ def redact(value: str, *, whole: bool = True) -> str:
     Everything but the scheme and the credential-free authority is dropped: a
     password in `user:pass@host`, in a query string, in a `host:port:password`
     triple or simply trailing on the line must not survive into a report, a log
-    line or provenance (F03, F04).
+    line or provenance.
 
     `whole` says that `value` is a complete record rather than one cell of a
     row.  A record keeps a token that carries a dot (a hostname or an address);
@@ -570,7 +569,7 @@ def _is_json(text: str) -> bool:
 
 
 def _country(value: str) -> str | None:
-    """Country code from a mapped column, or None.  Never invented (F02, F08)."""
+    """Country code from a mapped column, or None.  Never invented."""
     if not value:
         return None
     value = value.strip().upper()
diff --git a/proxy_workbench/jobs.py b/proxy_workbench/jobs.py
index 24777e4..00f149e 100644
--- a/proxy_workbench/jobs.py
+++ b/proxy_workbench/jobs.py
@@ -7,7 +7,7 @@
 with: it never widens the scope and never re-uses membership that has since
 left the collection.
 
-State lives in the four tables of CONTRACTS.ru.md §3.3 migration 6 (``job``,
+State lives in the four tables of the shared contract (``job``,
 ``job_item``, ``job_event``, ``checkpoint``), which this module co-owns with
 ``db.py``: :func:`install_schema` is the single DDL statement set for them, so
 the migrator and the store cannot drift apart. Nothing outside those tables is
@@ -18,7 +18,7 @@
 This module owns state only. Driving items (claiming, probing, publishing) is
 `pipeline.py`'s job; a second worker loop is deliberately not introduced here.
 
-Contract: CONTRACTS.ru.md §6 (job and item states), §3.3 (migration 6),
+Contract: the shared contract (job and item states), §3.3 (migration 6),
 §5.4 (error codes), §5.6 (structured events), §6.4 (one DB writer).
 """
 from __future__ import annotations
@@ -35,7 +35,7 @@
 from types import MappingProxyType
 from typing import Any, Iterable, Mapping, Sequence
 
-#: Migration number that owns the four tables below (CONTRACTS §3.3).
+#: Migration number that owns the four tables below.
 MIGRATION = 6
 
 SCHEMA = (
@@ -71,7 +71,7 @@
 TERMINAL_ITEM_STATES = frozenset({'done', 'unreachable', 'blocked', 'partial', 'failed'})
 UNFINISHED_ITEM_STATES = tuple(state for state in ITEM_STATES if state not in TERMINAL_ITEM_STATES)
 
-#: Job state machine of CONTRACTS §6.2.
+#: Job state machine of the shared contract.
 JOB_TRANSITIONS = {
     'created': frozenset({'queued', 'cancelled', 'failed'}),
     'queued': frozenset({'running', 'paused', 'cancelled', 'timed_out', 'failed'}),
@@ -84,7 +84,7 @@
     'timed_out': frozenset(),
 }
 
-#: Item state machine of CONTRACTS §6.3.  Terminal states are absorbing here:
+#: Item state machine of the shared contract.  Terminal states are absorbing here:
 #: a repeated check is a new item of a new job, never a rewritten one.
 ITEM_TRANSITIONS = {
     'pending': frozenset({'prefiltered', 'probing', 'blocked'}),
@@ -97,7 +97,7 @@
     'failed': frozenset(),
 }
 
-#: `state_detail` values shared with the snapshot contract (CONTRACTS §4.3).
+#: `state_detail` values shared with the snapshot contract.
 DETAIL_COMPLETE = 'complete'
 DETAIL_EMPTY = 'empty_no_match'
 DETAIL_ALL_FAILED = 'all_failed'
@@ -119,8 +119,8 @@
 DEFAULT_HEARTBEAT_TIMEOUT_S = 300.0
 
 #: Payload keys refused in events and checkpoints: an event is persisted in
-#: cleartext and travels to every consumer, so credentials never enter it
-#: (CONTRACTS §5.6, F29).  `access_id` and `secret_ref` stay allowed.
+#: cleartext and travels to every consumer, so credentials never enter it.
+#: `access_id` and `secret_ref` stay allowed.
 FORBIDDEN_PAYLOAD_KEYS = frozenset({
     'password', 'passwd', 'secret', 'token', 'credentials', 'credential', 'api_key',
     'authorization', 'auth', 'userinfo', 'proxy_auth', 'bearer',
@@ -274,7 +274,7 @@ def __post_init__(self) -> None:
 
     @property
     def timeout_s(self) -> float | None:
-        """Whole-job deadline in seconds (CONTRACTS §6.2), not a per-request one."""
+        """Whole-job deadline in seconds, not a per-request one."""
         value = self.budgets.get('timeout_s') if 'timeout_s' in self.budgets else None
         if value is None:
             return None
@@ -476,7 +476,7 @@ def install_schema(conn: sqlite3.Connection) -> None:
 
 
 class WriterGate:
-    """At most one DB-writing executor at a time (CONTRACTS §6.4).
+    """At most one DB-writing executor at a time.
 
     In process this is a plain non-reentrant lock.  Across processes the
     integrator passes the existing `workbench.lock` callback as ``os_lock``, so
@@ -721,7 +721,7 @@ def create_job(self, kind: str, scope: Scope, items: Iterable[QueueItem] = (), *
                    idempotency_key: str | None = None, job_id: str | None = None) -> Job:
         """Create a ``created`` job with its scope and queue fixed.
 
-        With an ``idempotency_key`` the request is idempotent (F11): the same
+        With an ``idempotency_key`` the request is idempotent: the same
         key and the same input return the same job, the same key with a
         different input is ``E_CONFLICT_IDEMPOTENCY``.
         """
@@ -800,7 +800,7 @@ def start(self, job_id: str, *, reason_code: str | None = None) -> Job:
         """``queued`` -> ``running``.  Refused while another job is running.
 
         The refusal is ``E_CONFLICT_BUSY`` rather than a second writer on the
-        same database (CONTRACTS §6.4).
+        same database.
         """
         with self._write() as conn:
             job = self._job(conn, job_id)
@@ -847,7 +847,7 @@ def resume(self, job_id: str, *, scope: Scope | None = None, member_ids: Iterabl
         ``scope`` is accepted only to be checked: a different scope is
         ``E_CONFLICT_REVISION``, because a changed profile is a new job (§6.2),
         not a continuation.  ``member_ids`` marks queued items that have left
-        the collection as ``blocked`` (defect 6) instead of measuring them.
+        the collection as ``blocked`` instead of measuring them.
         """
         with self._write() as conn:
             job = self._job(conn, job_id)
@@ -893,7 +893,7 @@ def retry(self, job_id: str, *, items: Iterable[str] | None = None, scope: Scope
         """Start a new job from what a finished one did not complete (§6.2).
 
         The old job is never touched: its history, its last completed result and
-        its queue stay readable, and the new job gets new items (defect 6).
+        its queue stay readable, and the new job gets new items.
         """
         with self._write() as conn:
             job = self._job(conn, job_id)
@@ -1002,7 +1002,7 @@ def sync_membership(self, job_id: str, member_ids: Iterable[str], *,
 
         Only removals are applied: ``resume`` never gains items it did not have
         (scope is fixed) and never measures an address that is no longer a
-        member (defect 6).  Returns the blocked items and the counts behind it.
+        member.  Returns the blocked items and the counts behind it.
         """
         with self._write() as conn:
             job = self._job(conn, job_id)
diff --git a/proxy_workbench/openapi.json b/proxy_workbench/openapi.json
index 8960e8c..8014a6f 100644
--- a/proxy_workbench/openapi.json
+++ b/proxy_workbench/openapi.json
@@ -3665,6 +3665,9 @@
                     "description": "required",
                     "maxLength": 8388608
                   },
+                  "allow_private_endpoints": {
+                    "type": "boolean"
+                  },
                   "revision": {
                     "type": "integer",
                     "minimum": 1
@@ -12871,6 +12874,7 @@
                   "E_SECRET_UPSTREAM_AUTH_REQUIRED",
                   "E_SERVICE_UNAVAILABLE",
                   "E_STATE_JOB_RUNNING",
+                  "E_STATE_KEY_NOT_REVOKED",
                   "E_STATE_NOT_FOUND",
                   "E_STATE_NO_SNAPSHOT",
                   "E_STATE_SNAPSHOT_STALE",
@@ -12946,6 +12950,7 @@
     "E_SECRET_UPSTREAM_AUTH_REQUIRED",
     "E_SERVICE_UNAVAILABLE",
     "E_STATE_JOB_RUNNING",
+    "E_STATE_KEY_NOT_REVOKED",
     "E_STATE_NOT_FOUND",
     "E_STATE_NO_SNAPSHOT",
     "E_STATE_SNAPSHOT_STALE",
diff --git a/proxy_workbench/pipeline.py b/proxy_workbench/pipeline.py
index c847240..7a8e848 100644
--- a/proxy_workbench/pipeline.py
+++ b/proxy_workbench/pipeline.py
@@ -6,7 +6,7 @@
 (``proxytool.normalize``, see :func:`normalize_default`), and every measurement
 goes through an injected runner whose contract is documented on
 :class:`Runners`.  The integration wires ``probes.run_plan`` and the existing
-HTTP transport to that contract (CONTRACTS.ru.md §1.2, HANDOFF §2.2).
+HTTP transport to that contract.
 
 The shape of the chain is the one F12 asks for::
 
@@ -116,7 +116,7 @@
 
 RUN_STATES = ('complete', 'partial', 'want_reached', 'paused', 'cancelled', 'budget')
 
-#: A subset of ``jobs.ITEM_STATES`` (CONTRACTS §6.3).  The pipeline emits only
+#: A subset of ``jobs.ITEM_STATES``.  The pipeline emits only
 #: the three it can justify, so ``jobs`` maps a result onto its own state
 #: machine without a second table.  ``partial`` and ``blocked`` stay reserved.
 ITEM_STATES = ('unreachable', 'done', 'failed', 'partial', 'blocked')
@@ -128,7 +128,7 @@
 STOP_REASONS = ('items_exhausted', 'want_reached', 'paused', 'cancelled',
                 'budget_exhausted', 'deadline_exceeded', 'stopped')
 
-# Codes come from the LIMIT and VALIDATION domains of CONTRACTS §5.4; the
+# Codes come from the LIMIT and VALIDATION domains of the shared contract; the
 # pipeline introduces no new domain.  A deadline is a budget, so it carries the
 # bare measurement-style reason the run stopped rather than a TIME code that
 # belongs to a row.
@@ -222,7 +222,7 @@ def cpu(self) -> float:
 
 @dataclass(frozen=True)
 class Budgets:
-    """Every ceiling and total of a run, in one place with its unit (CONTRACTS §5.5)."""
+    """Every ceiling and total of a run, in one place with its unit."""
 
     # ceilings — hitting them blocks, it never ends the run
     max_inflight: int = 64
@@ -280,7 +280,7 @@ def ram_ceiling(self) -> int:
         return self.max_ram_bytes // self.ram_per_inflight_bytes
 
     def worker_ceiling(self) -> int:
-        """The worker count, derived — never configured directly (F12)."""
+        """The worker count, derived — never configured directly."""
         return max(1, min(self.max_inflight, self.fd_ceiling, self.ram_ceiling))
 
     def to_public(self) -> dict:
@@ -686,6 +686,10 @@ def observe(self, ok: bool, latency_s: float | None = None) -> bool:
                 self._decreases += 1
         return self._limit != before
 
+    def observe_outcome(self, outcome: 'StageOutcome') -> bool:
+        """Feed one stage outcome; a subclass decides what counts as overload."""
+        return self.observe(outcome.ok, outcome.latency_s)
+
     def snapshot(self) -> ConcurrencySample:
         success = sum(1 for item in self._results if item) / len(self._results) if self._results else None
         latency = sum(self._latencies) / len(self._latencies) if self._latencies else None
@@ -715,6 +719,17 @@ def free_now(self, host: str) -> bool:
         last = self._last.get(host)
         return last is None or self.clock.monotonic() - last >= self.min_interval_s
 
+    def held(self, host: str) -> bool:
+        """Whether a measurement of ``host`` is in flight right now."""
+        return self._busy.get(host, 0) > 0
+
+    def try_acquire(self, host: str) -> bool:
+        """Take a slot without waiting; False when the host is not free now."""
+        if not self.free_now(host):
+            return False
+        self._busy[host] = self._busy.get(host, 0) + 1
+        return True
+
     async def acquire(self, host: str) -> None:
         waited = False
         async with self._cond:
@@ -1160,7 +1175,7 @@ def parse_delimited(data: bytes, *, sep: str = ',') -> Iterator[str]:
 def normalize_default(value: str) -> str | None:
     """The project's single normaliser, imported lazily.
 
-    The pipeline deliberately has no second proxy normaliser (HANDOFF §2.2): it
+    The pipeline deliberately has no second proxy normaliser: it
     calls ``proxytool.normalize`` for public addresses.  A caller that needs a
     different scope passes its own callable as ``config.normalize`` — for
     instance ``proxytool.normalize_custom`` for a user's own hostnames.
@@ -1587,6 +1602,9 @@ def __init__(self, config: PipelineConfig, *, clock: PipelineClock | None = None
         self._gate: ResourceGate | None = None
         self._hosts = HostLimiter(max_per_host=config.limits.max_per_host,
                                   min_interval_s=config.limits.min_host_interval_s, clock=self.clock)
+        #: Items set aside because their host was busy, per host (``_park``).
+        self._parked: dict[str, deque] = {}
+        self._parked_count = 0
         self._target_policies = {item.target_id: item for item in config.limits.targets}
         self._target_inflight: dict[str, int] = {}
         self._target_used: dict[str, int] = {}
@@ -1779,6 +1797,8 @@ async def _execute(self, emit) -> RunResult:
         self._measured = 0
         self._queue_high_water = 0
         self._queue = asyncio.Queue(maxsize=config.budgets.max_queue_items)
+        self._parked = {}
+        self._parked_count = 0
         # A resumed run continues the same N: the unit counts are projections of
         # the cumulative sets, so an N that was already satisfied stays satisfied
         # instead of being counted a second time.
@@ -1973,7 +1993,7 @@ async def _feed_source(self, source: SourceSpec, emit) -> bool:
 
     def _truncate(self) -> None:
         """A source hit its byte budget.  That is a budget stop, not an
-        interruption, and it carries the BODY code of CONTRACTS §5.4."""
+        interruption, and it carries the BODY code of the shared contract."""
         self._counters.sources_truncated += 1
         self._stop('budget_exhausted', E_LIMIT_BODY)
 
@@ -2078,24 +2098,74 @@ async def _worker(self, emit) -> None:
             item = await self._next_item()
             if item is None:
                 return
+            # The worker that frees a host takes the next item parked on it, so
+            # a parked item always has a worker that comes back for it.
+            while item is not None:
+                host = item.address
+                item = self._unpark(host) if await self._measure_item(item, emit) else None
+
+    async def _measure_item(self, item: Item, emit) -> bool:
+        """Measure one item under its host limit; False when it was parked.
+
+        A worker used to wait for a busy host with the item in hand.  A list
+        with many ports on one address then put every worker in that one wait
+        while the items of every other host sat in the queue behind them.  An
+        item whose host is busy is now set aside for the worker that holds the
+        host, and this worker takes the next item instead.  The parked set is
+        bounded like the queue; past that bound the old wait applies.
+        """
+        parked = False
+        try:
+            if self._stopped.is_set() or not self._check_control():
+                self.ledger.release(item.endpoint)
+                return True
+            if not self._hosts.try_acquire(item.address):
+                if self._park(item):
+                    parked = True
+                    return False
+                await self._hosts.acquire(item.address)
             try:
+                # The wait for the host may have outlived the run: an N that was
+                # reached or a budget that ran out meanwhile must not be followed
+                # by one more measurement.
                 if self._stopped.is_set() or not self._check_control():
                     self.ledger.release(item.endpoint)
-                    continue
-                await self._hosts.acquire(item.address)
-                try:
-                    await self._check(item, emit)
-                finally:
-                    await self._hosts.release(item.address)
-            except asyncio.CancelledError:
-                raise
-            except BudgetExhausted:
-                raise
-            except Exception as exc:  # one item must never take a worker down
-                self._counters.stage_failures.setdefault('worker', type(exc).__name__)
-                self.ledger.finish(item.endpoint, type(exc).__name__)
+                    return True
+                await self._check(item, emit)
             finally:
+                await self._hosts.release(item.address)
+        except asyncio.CancelledError:
+            raise
+        except BudgetExhausted:
+            raise
+        except Exception as exc:  # one item must never take a worker down
+            self._counters.stage_failures.setdefault('worker', type(exc).__name__)
+            self.ledger.finish(item.endpoint, type(exc).__name__)
+        finally:
+            if not parked:
                 self._queue.task_done()
+        return True
+
+    def _park(self, item: Item) -> bool:
+        """Set an item aside until its host is free.  Only while somebody holds
+        the host (so somebody will come back for it) and only up to the queue's
+        own bound."""
+        if not self._hosts.held(item.address) or self._parked_count >= self.config.budgets.max_queue_items:
+            return False
+        self._parked.setdefault(item.address, deque()).append(item)
+        self._parked_count += 1
+        self._hosts.waits += 1
+        return True
+
+    def _unpark(self, host: str) -> Item | None:
+        waiting = self._parked.get(host)
+        if not waiting:
+            return None
+        item = waiting.popleft()
+        self._parked_count -= 1
+        if not waiting:
+            del self._parked[host]
+        return item
 
     async def _check(self, item: Item, emit) -> None:
         if self._carries(item):
@@ -2149,7 +2219,7 @@ def _carried(self, item: Item) -> ItemResult:
                           started_at=now, finished_at=now, requests=0, bytes=0)
 
     def _wants_expensive(self, item: Item, stages: Sequence[StageOutcome]) -> bool:
-        """Whether this item needs the expensive probe at all (F12).
+        """Whether this item needs the expensive probe at all.
 
         ``all_passing`` charges every passing item.  ``until_n`` charges only the
         ones that can still move the number the caller asked for: an item whose
@@ -2239,7 +2309,7 @@ async def _measure(self, item: Item, stage: str, runner, gate, target_id, taken)
                 # existing scan does with a transport exception.
                 code = exc.code if isinstance(exc, PipelineError) else type(exc).__name__
                 outcome = StageOutcome(stage, False, code=code, detail=str(exc)[:200])
-            self.concurrency.observe(outcome.ok, outcome.latency_s)
+            self.concurrency.observe_outcome(outcome)
         finally:
             if budget.active:
                 reservation = replace(reservation, requests=0)
diff --git a/proxy_workbench/pools.py b/proxy_workbench/pools.py
index 22eb677..618bee3 100644
--- a/proxy_workbench/pools.py
+++ b/proxy_workbench/pools.py
@@ -5,7 +5,7 @@
 ``source`` callable and health verdicts through :func:`report_health` or a
 ``verify`` callable, so a pool can be driven and tested without a scan.
 
-Storage is exactly the pair of tables from CONTRACTS.ru.md §3.3 migration 7
+Storage is exactly the pair of tables from the shared contract
 (``pools``, ``pool_member``). This module never writes DDL: the schema comes
 from ``db.migrate()`` and :meth:`PoolStore.open` refuses to work without the
 columns it needs.
@@ -100,15 +100,15 @@
 UNKNOWN_IGNORE = 'ignore'
 UNKNOWN_MODES = (UNKNOWN_REJECT, UNKNOWN_IGNORE)
 
-# A measurement stamped in the future is suspicious, not "very fresh"
-# (CONTRACTS §2.4). The contract names no number, so it is named here.
+# A measurement stamped in the future is suspicious, not "very fresh".
+# The contract names no number, so it is named here.
 CLOCK_TOLERANCE_SECONDS = 60.0
 
 # Deficit reasons, in root-cause order: a supply-side failure explains a quota
 # rejection, so it wins the tie when both are reported. The time and scope codes
-# are the ones core.REASON_CODES already publishes (CONTRACTS §2.3), so a reason
+# are the ones core.REASON_CODES already publishes, so a reason
 # means the same thing in admission, in a pool and in the report. Codes with the
-# POOL domain are this module's own and are listed in HANDOFF/pools.md.
+# POOL domain are this module's own.
 REASON_SOURCE_ERROR = 'E_POOL_SOURCE_ERROR'
 REASON_UNKNOWN_COLLECTION = 'E_POOL_UNKNOWN_COLLECTION'
 REASON_UNKNOWN_POOL = 'E_POOL_UNKNOWN'
@@ -157,7 +157,7 @@
 # --- errors -----------------------------------------------------------------
 
 class PoolError(Exception):
-    """A pool operation refused; ``code`` is a machine-readable CONTRACTS §5.4 code."""
+    """A pool operation refused; ``code`` is a machine-readable the shared contract code."""
 
     def __init__(self, code: str, message: str = ''):
         super().__init__(message or code)
@@ -336,7 +336,7 @@ class Candidate:
     """One endpoint offered to a pool.
 
     ``allowed`` and ``admission_reason`` come from the shared admission
-    contract (CONTRACTS §2.3); this module does not re-admit a row. Country,
+    contract; this module does not re-admit a row. Country,
     ASN and exit IP stay ``None`` when they are unknown - an unknown value is
     reported as unknown instead of being guessed.
     """
@@ -386,10 +386,10 @@ class FindRequest:
     This is the pool's half of the answer ``pipeline.FindPolicy`` needs, and it
     exists because the two sides must not each guess the unit.  A pool keeps
     *members*; a member is a row of ``pool_member`` and nothing else — the table
-    of CONTRACTS §3.3 migration 7 holds no exit address and no measured country,
+    of the shared contract holds no exit address and no measured country,
     so a count of anything but members cannot survive the next restart.  That is
     the whole reason the unit is derived and named here instead of the pool
-    simply asking the engine for exits (HANDOFF/pipeline.md §1.5).
+    simply asking the engine for exits.
 
     What the user may still want is *distinctness*, and that is what a quota is
     for: ``quota={'exit_ip': 1}`` with ``desired=5`` is exactly "five proxies that
@@ -415,7 +415,7 @@ def find_policy(self, find_policy_cls: type) -> Any:
         return find_policy_cls(n=self.n, what=self.what)
 
 
-#: The three units of "N" (F12, CONTRACTS §1.1).  ``ip`` counts the address of a
+#: The three units of "N".  ``ip`` counts the address of a
 #: proxy; for a pool it is never the right unit, so it is rejected by name rather
 #: than silently treated as an endpoint.
 FIND_UNITS = ('endpoint', 'ip', 'exit')
@@ -595,7 +595,7 @@ class PoolStore:
 
     The store holds no pool logic: it stores a target state, the members and
     the last status. Every statement names its columns explicitly, as
-    CONTRACTS §3.2 requires, so an additive migration cannot break it.
+    the shared contract requires, so an additive migration cannot break it.
 
     ``add_member``, ``set_member_state`` and ``save_status`` do not commit on
     their own: the refill controller and the health helpers wrap them in a
@@ -959,7 +959,7 @@ def _promote(self) -> None:
         """The reserve restores service without waiting for any new measurement.
 
         The promotion does not refresh ``admitted_at``: the age of a proof is
-        measured from the measurement that produced it (CONTRACTS §2.2), and the
+        measured from the measurement that produced it, and the
         freshness check has already run in this call.
         """
         for member in self._ordered(state=MEMBER_RESERVE):
@@ -976,7 +976,7 @@ def measure(self) -> list:
         This is the only part of a refill that does I/O, so it is deliberately
         callable *outside* a write transaction: a measurement is a network round
         trip, and holding SQLite's write lock across one would refuse every other
-        writer of the database for the length of the round trip (CONTRACTS §6.4
+        writer of the database for the length of the round trip (the shared contract
         is about a bounded number of DB-writing executors, not about making the
         rest of the program wait for a proxy answer).  It reads state, changes
         nothing, and returns the verdicts :meth:`apply_measurements` commits.
@@ -1365,7 +1365,7 @@ def watch(store: PoolStore, pool_id: str, source: Callable[..., Sequence[Candida
     """Refill a pool once per ``interval_seconds``, ``ticks`` times or until stopped.
 
     This replaces the watch cycle that only re-checked the rows that already
-    worked (defect 12): every tick re-evaluates the target, re-admits members
+    worked: every tick re-evaluates the target, re-admits members
     that came back, and reports the reason for any shortfall.
 
     A tick that arrives before the pool's own ``next_attempt_at`` is not a
diff --git a/proxy_workbench/probes.py b/proxy_workbench/probes.py
index a735a0f..b46359e 100644
--- a/proxy_workbench/probes.py
+++ b/proxy_workbench/probes.py
@@ -3,7 +3,7 @@
 This module is a leaf.  It owns no database, no source fetching and no network
 code of its own: every socket call goes through an injected ``Transport`` and
 every duration through an injected ``Clock``.  ``proxytool.py`` stays the single
-network entry point (CONTRACTS.ru.md §1.2, HANDOFF §2.2), and the integration
+network entry point, and the integration
 wires its own transport to :func:`run_plan` / :func:`run_speed_test`.
 
 Scope: F01 (check modes), F07 (advanced parameters), F20 (measurements) and
@@ -64,10 +64,10 @@
     'reverse_host', 'reveal_signals', 'looks_like_challenge', 'labelled_exit_address', 'STAGES',
     # recheck
     'RecheckItem', 'plan_recheck',
-    # capability matrix and the self-hosted reference probe (F20)
+    # capability matrix and the self-hosted reference probe
     'CAPABILITIES', 'capability_matrix', 'serve_reference_probe',
     'REFERENCE_PROBE_MAX_BYTES', 'reference_probe_targets', 'time_budget',
-    # bounded capabilities (F20)
+    # bounded capabilities
     'CAPABILITY_KINDS', 'CAPABILITY_LIMITS', 'CAPABILITY_DEFAULTS', 'CAPABILITY_STATES',
     'CapabilitySpec', 'validate_capability', 'validate_capabilities', 'capabilities_manifest',
     'CapabilityOutcome', 'WsTrace', 'HoldTrace', 'parse_media_manifest',
@@ -81,7 +81,7 @@
 # errors
 # --------------------------------------------------------------------------
 
-# Configuration errors carry the E_* form of CONTRACTS.ru.md §5.4: the
+# Configuration errors carry the E_* form of the shared contract: the
 # VALIDATION domain already exists, so no new domain is introduced here.
 E_VALIDATION_SCHEMA = 'E_VALIDATION_SCHEMA'
 E_VALIDATION_FIELD = 'E_VALIDATION_FIELD'
@@ -93,7 +93,7 @@
 E_LIMIT_BUDGET = 'E_LIMIT_BUDGET'
 
 # Measurement codes stay bare, exactly like the ones already stored in
-# ``results.payload.error`` (CONTRACTS §5.4, row UPSTREAM).  This catalogue is
+# ``results.payload.error``.  This catalogue is
 # the reference the diagnostics surface needs for the probe half of it.
 UNREACHABLE = 'UNREACHABLE'
 CONNECT_TIMEOUT = 'CONNECT_TIMEOUT'
@@ -364,7 +364,7 @@ def is_working(outcome) -> bool:
 
 @dataclass(frozen=True)
 class Limit:
-    """One parameter's unit and range, in a single place (CONTRACTS §5.5)."""
+    """One parameter's unit and range, in a single place."""
 
     unit: str
     minimum: float
@@ -405,7 +405,7 @@ def describe(self) -> str:
 
 # F07 presets: "быстро / баланс / тщательно / экономно".  A preset is a full
 # set of values, not a patch: switching from "тщательно" to "быстро" cannot
-# leave a previous scenario's backoff or redirect limit behind (defect 24).
+# leave a previous scenario's backoff or redirect limit behind.
 # Explicit keys always win over the preset and are reported in ``overrides``.
 PRESETS = {
     'fast': {
@@ -533,7 +533,7 @@ def visible_overrides(self, supplied=()) -> dict:
 
 
 def validate_options(data=None) -> ProbeOptions:
-    """The single validation GUI, CLI and API all go through (F07, F18)."""
+    """The single validation GUI, CLI and API all go through."""
     if data is None:
         data = {}
     if not isinstance(data, dict):
@@ -630,7 +630,7 @@ def build_ssl_context(ca_bundle=None):
 
     ``verify=False`` is not reachable from any option in this module: enabling
     a custom CA, a header, a redirect or an API key never disables TLS
-    verification (F07 acceptance).
+    verification.
     """
     context = ssl.create_default_context(cafile=ca_bundle) if ca_bundle else ssl.create_default_context()
     context.check_hostname = True
@@ -757,7 +757,7 @@ def validate_target(data, *, own_profile=False) -> TargetProfile:
                'dns_mode', 'scope', 'own', 'body', 'auth', 'kind', 'definition_version', 'verified_at',
                # Derived read-only view fields, so a stored or exported target
                # can be fed back in.  A value that contradicts the real profile
-               # is refused rather than quietly dropped (F07).
+               # is refused rather than quietly dropped.
                'body_bytes', 'auth_configured')
     _reject_unknown(data, allowed, 'Цель проверки')
     url = _validate_url(data.get('url'), 'Цель: url')
@@ -970,7 +970,7 @@ def fallback_chain(profiles, limit=2) -> tuple[TargetProfile, ...]:
 
 
 def probes_manifest() -> dict:
-    """What the built-in probes are and how well they are confirmed (F01, F06)."""
+    """What the built-in probes are and how well they are confirmed."""
     items = []
     for profile in basic_profiles():
         value = profile.to_public()
@@ -1454,11 +1454,11 @@ def plan_digest(plan: ProbePlan) -> str:
 
 
 def build_plan(settings) -> ProbePlan:
-    """The one validation entry for GUI, CLI and API (F07, F18).
+    """The one validation entry for GUI, CLI and API.
 
     Unknown keys are rejected, every number is range-checked against
     :data:`LIMITS`, and a required anonymity level without a judge raises
-    instead of being dropped to ``any`` (defect 13).
+    instead of being dropped to ``any``.
     """
     if not isinstance(settings, dict):
         raise ProbeError(E_VALIDATION_SCHEMA, 'Настройки проверки: ожидается объект.')
@@ -1489,7 +1489,7 @@ def build_plan(settings) -> ProbePlan:
         if options.attempts > 1 and any(target.method not in IDEMPOTENT_METHODS for target in targets):
             raise ProbeError(E_VALIDATION_RETRY_UNSAFE,
                              'Метод, меняющий состояние, нельзя повторять: attempts должен быть 1. '
-                             'Небезопасный повтор POST/PUT/PATCH/DELETE запрещён (F07).')
+                             'Небезопасный повтор POST/PUT/PATCH/DELETE запрещён.')
     elif raw_targets:
         raise ProbeError(E_VALIDATION_FIELD, f'Режим {mode.name} не измеряет цели: уберите targets.')
     else:
@@ -1531,7 +1531,7 @@ async def run_plan(plan: ProbePlan, transport, *, endpoint='', fail_fast=True, c
     stage = None if ok else (failed[0].stage if failed else None)
     # ``mode`` says what the user picked, ``base`` says which ladder produced
     # the evidence.  A ``recheck`` therefore never files a row it cannot back
-    # up, and ``monitor`` stays a job mode (F01).
+    # up, and ``monitor`` stays a job mode.
     outcome = PlanOutcome(endpoint=endpoint, mode=plan.mode.name, base=plan.mode.base or plan.mode.name,
                           evidence='none', ok=ok,
                           targets=tuple(outcomes), code=code, stage=stage, monitoring=plan.mode.monitoring,
@@ -1627,13 +1627,13 @@ def summarize_basic(outcomes, *, evidence='transfer_ok', target_check=()) -> Bas
 
 
 # --------------------------------------------------------------------------
-# speed measurement (defect 15)
+# speed measurement
 # --------------------------------------------------------------------------
 
 
 @dataclass(frozen=True)
 class SpeedLimits:
-    """Minimum sample for an honest number (CONTRACTS §5.5, defect 15)."""
+    """Minimum sample for an honest number."""
 
     min_bytes: int = 1 << 20
     min_seconds: float = 0.25
@@ -1657,7 +1657,7 @@ class TransferTrace:
     plausible-looking number out of a single chunk.  ``connection`` says whether
     the bytes travelled over a connection that was opened for this transfer or
     over a reused one: a reused connection has no connect or handshake in its
-    timings, so the two kinds are never averaged together (F20).
+    timings, so the two kinds are never averaged together.
     """
 
     url: str = ''
@@ -1742,7 +1742,7 @@ def measure_speed(trace: TransferTrace, limits: SpeedLimits = SPEED_LIMITS) -> S
 
     A failed or unfinished transfer is ``error``/``insufficient``; a finished
     but too small, too short or single-chunk transfer is ``insufficient``.  A
-    number appears only when all minimums hold (defect 15, R10).  The window
+    number appears only when all minimums hold.  The window
     is first byte to last byte, so the first chunk's arrival time never leaks
     into the divisor.
     """
@@ -1814,7 +1814,7 @@ async def run_speed_test(target: SpeedTarget, options: ProbeOptions, transport,
     The transport provides ``download(target, options=options) -> TransferTrace``
     and owns the socket, mirroring how ``proxytool.measure_speed`` is wired.
     ``reuse=True`` asks for a kept-alive connection; the measurement then says
-    so, and must not be compared with cold ones (F20).
+    so, and must not be compared with cold ones.
     """
     if target is None:
         raise ProbeError(E_VALIDATION_FIELD, 'Нужна цель измерения скорости.')
@@ -1849,7 +1849,7 @@ async def run_speed_test(target: SpeedTarget, options: ProbeOptions, transport,
 
 
 # --------------------------------------------------------------------------
-# anonymity (defect 13)
+# anonymity
 # --------------------------------------------------------------------------
 
 ANONYMITY_LEVELS = ('transparent', 'anonymous', 'elite', 'unknown')
@@ -1927,7 +1927,7 @@ def validate_min_level(value) -> str:
 
 
 def require_anonymity(minimum: str, judge: JudgeSpec | None) -> JudgeSpec | None:
-    """Return the judge a required level needs, or raise (defect 13).
+    """Return the judge a required level needs, or raise.
 
     A required anonymity level is never silently downgraded to ``any``: the user
     either configures a judge or gets an error that says what to do.
@@ -2058,7 +2058,7 @@ def anonymity_allows(value, minimum) -> bool:
 
 
 # --------------------------------------------------------------------------
-# DNSBL (defect 14)
+# DNSBL
 # --------------------------------------------------------------------------
 
 DNSBL_STATUSES = ('listed', 'clear', 'unknown')
@@ -2069,7 +2069,7 @@ def reverse_ip(address) -> str:
 
     IPv4 is reversed octet by octet.  IPv6 is reversed nibble by nibble as
     ``x.y.z....ip6.arpa``; the old code reversed the ``address.exploded`` string
-    with the colons still in it, which can never match a real zone (defect 14).
+    with the colons still in it, which can never match a real zone.
     """
     try:
         parsed = ipaddress.ip_address(str(address).strip())
@@ -2367,7 +2367,7 @@ def plan_recheck(rows, *, now, max_age_s, limit=0, remeasure_passing=False, pass
     A row with no usable measurement time is re-measured instead of being
     treated as fresh, and passing rows are only re-measured when the caller
     asked for it — which is what "повторно проверять истёкшие" means
-    (defect 2) without a second scan engine.
+   without a second scan engine.
     """
     items = []
     for row in rows or ():
@@ -2418,7 +2418,7 @@ def plan_recheck(rows, *, now, max_age_s, limit=0, remeasure_passing=False, pass
 
 
 # --------------------------------------------------------------------------
-# bounded capabilities (F20)
+# bounded capabilities
 # --------------------------------------------------------------------------
 #
 # Each of these has a controlled endpoint, an explicit budget, and its own
@@ -2546,7 +2546,7 @@ def validate_capabilities(data) -> tuple[CapabilitySpec, ...]:
 
 
 def capabilities_manifest() -> dict:
-    """Every kind with its units, defaults and distinct outcomes (F20)."""
+    """Every kind with its units, defaults and distinct outcomes."""
     items = []
     for kind in CAPABILITY_KINDS:
         items.append({
@@ -2886,7 +2886,7 @@ async def run_capabilities(specs, options: ProbeOptions, transport, *, fail_fast
 
 
 # --------------------------------------------------------------------------
-# capability matrix and the self-hosted reference probe (F20)
+# capability matrix and the self-hosted reference probe
 # --------------------------------------------------------------------------
 
 # Every measurement kind gets a row, whether or not this module implements it.
@@ -2940,7 +2940,7 @@ async def run_capabilities(specs, options: ProbeOptions, transport, *, fail_fast
     {'id': 'calls_video_any_service', 'supported': False, 'kind': 'target',
      'capability': 'claim',
      'endpoint': '—', 'budget': '—',
-     'outcome': 'нет: измерения выше — отдельные bounded-проверки; общее обещание запрещено (F20)'},
+     'outcome': 'нет: измерения выше — отдельные bounded-проверки; общее обещание запрещено'},
 )
 
 
diff --git a/proxy_workbench/profiles.py b/proxy_workbench/profiles.py
index 154f491..8f557de 100644
--- a/proxy_workbench/profiles.py
+++ b/proxy_workbench/profiles.py
@@ -14,8 +14,7 @@
     ref = store.create('API проекта', spec)
     payload = export_profile(store, ref)       # secret-free document
 
-Model taken from ``docs/requirements/product-research/01-product-model.ru.md``
-("Правила принятия результатов") and from F05 of MASTER-PROMPT:
+Acceptance model:
 
 * the mandatory set ``M`` is always mandatory - no rule can drop it;
 * the optional set ``O`` carries an explicit ``all``/``any``/``at_least(K)``/``none``
@@ -29,15 +28,15 @@
 
 1. Evidence carries the thresholds it was measured under.  Evidence from another
    threshold set is not evidence for this revision, so lowering a threshold can
-   never buy a pass for measurements that were never run under it (F05).
+   never buy a pass for measurements that were never run under it.
 2. ``RunState.stop()`` only reports a stop when *no* completion of the remaining
-   probes could pass, so fail-fast can never disagree with the rule (F05).
+   probes could pass, so fail-fast can never disagree with the rule.
 3. A revision row is immutable.  ``update`` appends a row and links it with
    ``parent_id``; the previous revision and its results stay readable
-   (CONTRACTS §3.3, migration 9).
+   .
 
 Storage is the ``profiles`` table of the workbench database in the shape declared
-by CONTRACTS §3.3 (migration 9): one row per revision, ``name`` groups the
+by the shared contract (migration 9): one row per revision, ``name`` groups the
 revisions, ``parent_id`` chains them, ``digest`` fixes the content.  The row key
 is ``<profile_id>@<revision>`` because the declared primary key is the single
 column ``id``; ``ProfileRef`` is what the rest of the code should pass around.
@@ -96,8 +95,8 @@
 # wildcard: ``_`` is literal in GLOB, ``*``, ``?`` and ``[`` are not.
 _PROFILE_ID_RE = re.compile(r'^[A-Za-z0-9_.:@-]{1,128}$')
 
-# Error codes.  The first five are shared with CONTRACTS §5.4 and core.py; the
-# rest are proposed there (docs/integration/HANDOFF/profiles.md).
+# Error codes.  The first five are shared with core.py; the rest are this
+# module's own.
 E_VALIDATION_SCHEMA = 'E_VALIDATION_SCHEMA'
 E_VALIDATION_FIELD = 'E_VALIDATION_FIELD'
 E_VALIDATION_UNKNOWN_FIELD = 'E_VALIDATION_UNKNOWN_FIELD'
@@ -202,7 +201,7 @@ def _mapping(value: Any, what: str) -> Mapping[str, Any]:
 
 
 def _reject_unknown(data: Mapping[str, Any], allowed: Iterable[str], what: str) -> None:
-    """An unrecognised field is a caller bug and is refused, not ignored (F07)."""
+    """An unrecognised field is a caller bug and is refused, not ignored."""
     unknown = sorted(set(data) - set(allowed))
     if unknown:
         raise _fail(E_VALIDATION_UNKNOWN_FIELD, f'{what}: неизвестные поля {unknown}')
@@ -285,7 +284,7 @@ def __post_init__(self) -> None:
         # K is only an integer here.  ``K <= 0`` is refused where the decision is
         # made - ``ProfileSpec.validate`` on the way in, ``evaluate`` on a document
         # a foreign writer left behind - so the guarantee is visible as a verdict
-        # and not only as a parse error (F05).
+        # and not only as a parse error.
         object.__setattr__(self, 'k', _integer(self.k))
 
     @classmethod
@@ -910,10 +909,10 @@ def _as_spec(spec: Any) -> ProfileSpec:
 # Storage
 # --------------------------------------------------------------------------- #
 
-# CONTRACTS §3.3, migration 9, is the owner of this table.  ``id`` and ``config``
+# the shared contract is the owner of this table.  ``id`` and ``config``
 # are the columns proxytool.open_db() has always created; migration 9 adds the
 # rest.  The tuple below is a *verification* list, never a DDL statement set:
-# this module writes no DDL and calls ``db.migrate()`` instead (HANDOFF §2.2).
+# this module writes no DDL and calls ``db.migrate()`` instead.
 MIGRATION = 9
 CONTRACT_COLUMNS = ('id', 'config', 'name', 'revision', 'parent_id', 'digest',
                     'created_at', 'archived_at', 'is_default')
@@ -1113,7 +1112,7 @@ def list(self, *, include_archived: bool = False) -> list[ProfileRecord]:
         """Head revision of every named profile, ordered by name.
 
         Rows without a name are the legacy content-addressed ones; they stay out
-        of the library, because naming them would be inventing an origin (F02).
+        of the library, because naming them would be inventing an origin.
         """
         sql = f'{_SELECT} WHERE name IS NOT NULL'
         if not include_archived:
diff --git a/proxy_workbench/proxytool.py b/proxy_workbench/proxytool.py
index ca3177c..9a7dbd1 100644
--- a/proxy_workbench/proxytool.py
+++ b/proxy_workbench/proxytool.py
@@ -7,6 +7,7 @@
 import contextlib
 from contextlib import asynccontextmanager, contextmanager
 import csv
+import errno
 import hashlib
 import ipaddress
 import json
@@ -39,6 +40,7 @@
 from . import formats
 from .i18n import tr, utf8_output
 from . import paths
+from .pipeline import AdaptiveConcurrency
 
 # ``exportsvc`` imports a handful of constants from this module, so it is
 # imported where it is used instead of here.  One contract, one implementation:
@@ -72,6 +74,8 @@
 MAX_SOURCE_CANDIDATES = 10_000_000
 MAX_SOURCE_REDIRECTS = 20
 MAX_SOURCE_PAGES = 5_000
+#: Addresses ``collect`` buffers before one set-based write and commit.
+COLLECT_WRITE_BATCH = 10_000
 SOURCE_REDIRECT_STATUSES = frozenset({301, 302, 303, 307, 308})
 SOURCE_METADATA_HOSTS = frozenset({
     'metadata', 'metadata.google.internal', 'metadata.goog', 'metadata.azure.internal',
@@ -241,7 +245,7 @@ async def _source_stream(client, url, allow_private=False, headers=None):
     _, hostname, _, address = await _validate_source_destination(url, allow_private)
     # ``If-None-Match``/``If-Modified-Since`` are how a 304 happens at all, so
     # the conditional headers travel with the very first request of a source
-    # whose validators were stored by the previous fetch (F13).
+    # whose validators were stored by the previous fetch.
     request_headers = dict(headers or {})
     if address is None:
         async with client.stream('GET', url, headers=request_headers) as response:
@@ -278,6 +282,9 @@ def _declared_response_length(response):
 
 
 COLLECT_BUDGET_ERRORS = frozenset(('SOURCE_REQUEST_BUDGET', 'SOURCE_ITEM_BUDGET', 'SOURCE_BYTE_BUDGET'))
+#: One source's own limits: the origin answered, the answer did not fit.
+SOURCE_LIMIT_ERRORS = frozenset(('SOURCE_TOO_LARGE', 'SOURCE_LINE_TOO_LARGE', 'SOURCE_CANDIDATE_LIMIT',
+                                 'SOURCE_RECORD_LIMIT', 'SOURCE_PAGE_LIMIT', 'SOURCE_TRUNCATED'))
 
 
 def _collection_budget_error(budget, code):
@@ -420,8 +427,34 @@ async def _read_bounded_lines(response, budget, max_bytes, max_line_bytes, on_li
         budget['truncated'] = True
 
 
+_OCTET = r'(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])'
+#: The shape almost every public list uses: an optional scheme, a dotted IPv4
+#: address without leading zeros and a port.  ASCII digits only, so it accepts
+#: nothing the general parser below would refuse.
+_FAST_IPV4_PROXY = re.compile(
+    r'(?:(http|https|socks4|socks5|socks5h)://)?(' + _OCTET + r'(?:\.' + _OCTET + r'){3}):([0-9]{1,5})/?')
+
+
 def _normalize_proxy(value, *, public_only):
     """Shared proxy URL parser for public collection and private GUI imports."""
+    if not isinstance(value, str):
+        return None
+    # Fast path for the common ``scheme://a.b.c.d:port`` line; it returns what
+    # the general parser returns for the same input (see the tests).
+    match = _FAST_IPV4_PROXY.fullmatch(value.strip())
+    if match is not None:
+        scheme, host, port = match.groups()
+        port = int(port)
+        if not 1 <= port <= 65535:
+            return None
+        if public_only and not ipaddress.IPv4Address(host).is_global:
+            return None
+        return f'{scheme or "http"}://{host}:{port}'
+    return _normalize_proxy_general(value, public_only=public_only)
+
+
+def _normalize_proxy_general(value, *, public_only):
+    """The complete parser: IPv6, hostnames and every other spelling."""
     if not isinstance(value, str):
         return None
     raw = value.strip()
@@ -546,7 +579,7 @@ def atomic(path, content):
 MIN_FRESHNESS_SECONDS = 2 * 60 * 60
 #: An address with no credentials still has an access identity, and a named one:
 #: an empty id is indistinguishable from a row that never recorded who measured
-#: it, and admission refuses that (CONTRACTS §1.2 rule 1, §2.3).  The web
+#: it, and admission refuses that.  The web
 #: surface reads the same identity (``gui.App.snapshot_access``); the two have to
 #: name the same thing or the table and the engine disagree about which rows
 #: exist at all.
@@ -562,7 +595,7 @@ def as_access(value):
     raise `AttributeError: 'Access' object has no attribute 'access_id'` at the
     first row: a caller that had a real credential identity could not measure
     with it.  The credential value is never touched here -- only the identity and
-    its revision travel into a row (F04).
+    its revision travel into a row.
     """
     if value is None:
         return PUBLIC_ACCESS
@@ -578,7 +611,7 @@ def as_access(value):
 PROTOCOL_EXPORTS = {'http': 'http.txt', 'https': 'https.txt', 'socks4': 'socks4.txt', 'socks5': 'socks5.txt'}
 PROTOCOL_ALIASES = {'socks5h': 'socks5'}
 
-# The measurement row is written with every key column named (CONTRACTS §3.2):
+# The measurement row is written with every key column named:
 # a positional insert breaks the moment a migration adds a column, which is
 # exactly how a stale binary is stopped from writing into a newer schema.
 INSERT_RESULT = '''INSERT OR REPLACE INTO results(
@@ -631,10 +664,10 @@ def meta_columns(conn):
 def collection_candidates(conn, collection_id):
     """Canonical addresses that belong to one collection, in address order.
 
-    Membership is the scope (CONTRACTS §1.2 rule 2).  A collection with no
+    Membership is the scope.  A collection with no
     membership rows yields nothing rather than silently falling back to every
     address ever collected -- that fallback is how a private list turned into
-    the public base (defect 11).
+    the public base.
     """
     return conn.execute(
         'SELECT e.canonical FROM membership m JOIN endpoints e ON e.id = m.endpoint_id '
@@ -774,8 +807,8 @@ def open_db(path, **kwargs):
     This function used to own the schema.  It no longer writes DDL: the
     versioned migrator checks ``user_version``/``application_id`` before any
     write, takes a technical backup of a pre-versioning file and refuses a
-    database that belongs to another application or to a newer program
-    (CONTRACTS §3.2, §3.4, §3.5).  The old contract -- a bare connection -- is
+    database that belongs to another application or to a newer program.
+   The old contract -- a bare connection -- is
     kept so every existing caller keeps working; callers that want the migration
     report call :func:`open_db_with_report`.
     """
@@ -800,7 +833,7 @@ def ensure_public_collection(conn):
 
     Creating it here (and not in a migration) keeps a fresh database usable
     without a second code path: ``db.create_collection`` refuses a duplicate id,
-    so this is a no-op on every open after the first (defect 11, F02).
+    so this is a no-op on every open after the first.
     """
     row = conn.execute('SELECT 1 FROM collections WHERE id=?', (schema.PUBLIC_COLLECTION_ID,)).fetchone()
     if not row:
@@ -938,6 +971,10 @@ async def wait(self):
 SOURCE_KINDS = ('http', 'https', 'socks4', 'socks5', 'socks5h', 'auto', 'text', 'geonode',
                 'http-fields', LINE_KIND) + CATALOG_ADAPTER_KINDS
 DETECT_PROTOCOLS = ('http', 'socks4', 'socks5')
+#: "ip:port:Country Name"; the country is any word of letters, "Türkiye" included.
+HTTP_FIELDS_LINE = re.compile(r"(\d{1,3}(?:\.\d{1,3}){3}:\d{1,5}):[^\W\d_](?:[^\W\d_]|[ .'-])*")
+#: A comment after an address, separated from it by whitespace.
+INLINE_COMMENT = re.compile(r'\s+#')
 # ip:port inside free text: "1.2.3.4:8080", "1.2.3.4 8080", CSV and HTML table cells.
 LOOSE_ADDRESS = re.compile(r'(?<![\d.])(?:(https?|socks[45]h?)://)?(\d{1,3}(?:\.\d{1,3}){3})'
                            r'(?::|\s*(?:</t[dh]>\s*<t[dh][^>]*>|[\s,;|])\s*)(\d{2,5})(?!\d)', re.I)
@@ -1060,7 +1097,7 @@ def source_selection_view(data_dir=None, catalog=None, *, query='', db=None, now
 
     The CLI, the GUI and ``/v1/sources`` all answer from this, so a source's
     support status, dataset group, access kind and runtime state are the same
-    numbers everywhere (F13, F21).
+    numbers everywhere.
     """
     from . import source_management
     catalog = catalog if catalog is not None else sources_catalog(data_dir)
@@ -1080,7 +1117,7 @@ def source_catalog_for(data_dir):
 
 
 def catalog_source_plans(settings, catalog=None, *, include_disabled=False):
-    """The user's selection, resolved into fetchable plans (F13).
+    """The user's selection, resolved into fetchable plans.
 
     ``source_catalog.migrate_settings`` first, so a tree that still holds the
     old flat URL list keeps every URL and every *pause* -- a source that was in
@@ -1549,8 +1586,8 @@ def record_source_generation(db, plan, observation_id, endpoints, *, state, now,
 
 def record_source_state(db, plan, endpoint_url, *, now, etag=None, last_modified=None,
                         final_url=None, success=False, error=None, retry_after=None,
-                        previous=None, generation=None, not_modified=False):
-    """Cache validators, backoff and quarantine of one source (F13).
+                        previous=None, generation=None, not_modified=False, limited=False):
+    """Cache validators, backoff and quarantine of one source.
 
     A successful fetch clears the backoff and the quarantine; three failures in
     a row quarantine the source, so a provider that has gone away is asked
@@ -1563,8 +1600,20 @@ def record_source_state(db, plan, endpoint_url, *, now, etag=None, last_modified
     # failure budget: counting it as a failure quarantined a perfectly healthy
     # source after three collections, and every collection after that stopped
     # asking it at all.
-    healthy = bool(success or not_modified)
+    answered = bool(success or not_modified)
+    # A body past the user's own limits came from a working transport: it is
+    # neither backed off nor quarantined, so raising the limit takes effect on
+    # the next collection.
+    healthy = answered or bool(limited)
     failures = 0 if healthy else int(previous.get('consecutive_failures') or 0) + 1
+    # Validators describe the body they came with.  Only a body that was read
+    # whole may replace them; otherwise a later 304 would vouch for a body
+    # that was never stored.  A 304 without validators keeps the stored ones.
+    if not_modified:
+        etag = etag or previous.get('etag')
+        last_modified = last_modified or previous.get('last_modified')
+    elif not success:
+        etag, last_modified = previous.get('etag'), previous.get('last_modified')
     backoff_until = None
     quarantine_until = None if healthy else previous.get('quarantine_until')
     if not healthy:
@@ -1578,7 +1627,7 @@ def record_source_state(db, plan, endpoint_url, *, now, etag=None, last_modified
     if success and generation:
         current, last_good = generation, generation
     values = (plan.source_id, '', final_url or endpoint_url, etag, last_modified, now,
-              now if healthy else previous.get('last_success_at'),
+              now if answered else previous.get('last_success_at'),
               now if success else previous.get('last_body_at'),
               now if not_modified else previous.get('last_304_at'),
               current, last_good, failures, backoff_until, quarantine_until,
@@ -1617,7 +1666,7 @@ def record_source_identity(db, plan):
 
 
 def source_contributions(db, source_ids=()):
-    """What each source actually contributed, for the source views (F21).
+    """What each source actually contributed, for the source views.
 
     ``source_management.attach_contributions`` calls this by name and checks
     that it exists, so an exclusive set and a shared set are computed from the
@@ -1686,7 +1735,8 @@ def _write_source_provenance(db, run_id, plan, url, *, started_at, clock, http_s
     if error not in COLLECT_BUDGET_ERRORS:
         record_source_state(db, plan, url, now=ended, etag=etag, last_modified=last_modified,
                             final_url=final_url, success=delivered, error=error, previous=previous,
-                            generation=generation, not_modified=not_modified, retry_after=retry_after)
+                            generation=generation, not_modified=not_modified, retry_after=retry_after,
+                            limited=error in SOURCE_LIMIT_ERRORS)
     return {'observation_id': observation_id, 'generation_id': generation,
             'cache_state': cache_state, 'outcome': outcome}
 
@@ -1711,7 +1761,7 @@ async def collect(db, urls, inputs, timeout=60, on_progress=None, denylist=None,
 
     What a source offered is recorded, not just consumed: an observation with
     its counters, a generation (an immutable answer), and the cache validators
-    plus backoff and quarantine of the next attempt (F13, F21).
+    plus backoff and quarantine of the next attempt.
 
     ``preview`` runs the identical fetch/adapter/limit path against a private
     temporary database, so a check of a source can answer every question a real
@@ -1819,41 +1869,110 @@ def add(value, protocol='http', country=None, source=None, public_only=True, see
                 _collection_budget_error(collection_budget, 'SOURCE_ITEM_BUDGET')
         if not (isinstance(country, str) and geoip.COUNTRY_CODE.fullmatch(country.upper())):
             country = None
-        # The migrated connection uses autocommit. Without an explicit BEGIN,
-        # each membership statement fsyncs separately and collecting a large
-        # list costs minutes. A short batch also releases other GUI writers.
+        if source and seen is not None:
+            seen['values'].add(proxy)
+        pending.append((proxy, schema.endpoint_id(proxy), country and country.upper(), source,
+                        seen if source else None))
+        pending_writes += 1
+        # An item budget is decided per address, so it is written at once.
+        if max_items is not None or len(pending) >= COLLECT_WRITE_BATCH:
+            flush()
+        if pending_writes >= COLLECT_WRITE_BATCH:
+            commit()
+        return 'accepted'
+
+    pending = []
+    country_columns = [name for name in ('country', 'country_at', 'country_source')
+                       if name in endpoint_columns(db)]
+    meta_has_source = 'source' in meta_columns(db)
+
+    def flush():
+        """Write the buffered addresses with one statement per table.
+
+        The same rows and the same conflict rules as one address at a time,
+        in a single short transaction: a row-by-row writer spent most of a
+        large collection in SQLite call overhead and page writes.
+        """
+        nonlocal pending
+        if not pending:
+            return
+        rows, pending = pending, []
+        ids = list(dict.fromkeys(row[1] for row in rows))
+        existing = set()
+        for start in range(0, len(ids), 500):
+            chunk = ids[start:start + 500]
+            existing.update(row[0] for row in db.execute(
+                f'SELECT id FROM endpoints WHERE id IN ({",".join("?" * len(chunk))})', chunk))
+        for _proxy, endpoint, _country, source, seen in rows:
+            if endpoint not in existing:
+                existing.add(endpoint)
+                if seen is not None:
+                    seen['new'] = seen.get('new', 0) + 1
+        # Key order keeps the B-tree writes local; the conflict rules do not
+        # depend on the order within one batch.
+        rows.sort(key=lambda row: row[1])
+        # The migrated connection uses autocommit; one explicit transaction
+        # per batch keeps the write lock short for other GUI writers.
         if not db.in_transaction:
             db.execute('BEGIN')
+        stamp = clock()
         # One endpoint entity per canonical address; the collection membership
         # is the scope, and the legacy ``candidates`` row keeps the old readers
-        # working (CONTRACTS §1.2 rule 2, §3.3 migrations 1-2).
-        existed = db.execute('SELECT 1 FROM endpoints WHERE canonical=?', (proxy,)).fetchone() is not None
-        endpoint = upsert_endpoint(db, proxy, country=country,
-                                   country_at=time.time() if country else None,
-                                   country_source='source' if country else None)
-        db.execute('INSERT OR IGNORE INTO candidates(proxy, endpoint_id) VALUES (?, ?)', (proxy, endpoint))
+        # working.
+        db.executemany('INSERT OR IGNORE INTO endpoints(id, canonical) VALUES (?,?)',
+                       [(endpoint, proxy) for proxy, endpoint, *_ in rows])
+        if country_columns:
+            # A publisher's country claim is written when there is one; a list
+            # without countries leaves what an earlier source or import said.
+            values = {'country': None, 'country_at': time.time(), 'country_source': 'source'}
+            assignments = ', '.join(f'"{name}" = ?' for name in country_columns)
+            db.executemany(f'UPDATE endpoints SET {assignments} WHERE id = ?',
+                           [[country if name == 'country' else values[name] for name in country_columns]
+                            + [endpoint] for _proxy, endpoint, country, *_ in rows if country])
+        db.executemany('INSERT OR IGNORE INTO candidates(proxy, endpoint_id) VALUES (?, ?)',
+                       [(proxy, endpoint) for proxy, endpoint, *_ in rows])
         before_membership = db.total_changes
-        schema.add_member(db, collection_id, endpoint, origin=origin)
-        collection_budget['items'] += int(db.total_changes > before_membership)
-        if source:
+        # ``db.add_member``, set-based.
+        db.executemany('INSERT OR IGNORE INTO membership(collection_id, endpoint_id, added_at, origin)'
+                       ' VALUES (?,?,?,?)', [(collection_id, endpoint, stamp, origin)
+                                             for _proxy, endpoint, *_ in rows])
+        collection_budget['items'] += db.total_changes - before_membership
+        sourced = [row for row in rows if row[3]]
+        if sourced:
             # How many lists offer an address: rare ones are less crowded and tend to live longer.
-            db.execute('INSERT OR IGNORE INTO candidate_seen(proxy, source, endpoint_id) VALUES (?, ?, ?)',
-                       (proxy, source, endpoint))
-            db.execute('INSERT OR REPLACE INTO membership_source(collection_id, endpoint_id, source_id,'
-                       ' origin, added_at, last_seen_at) VALUES (?,?,?,?,?,?)'
-                       ' ON CONFLICT(collection_id, endpoint_id, source_id) DO UPDATE SET'
-                       ' last_seen_at=excluded.last_seen_at',
-                       (collection_id, endpoint, source, origin, clock(), clock()))
-            if seen is not None:
-                seen['new'] = seen.get('new', 0) + (0 if existed else 1)
-                seen['values'].add(proxy)
-        if country or source:
-            record_candidate_meta(db, proxy, country and country.upper(), source)
-        pending_writes += 1
-        if pending_writes >= 1000:
-            db.commit()
-            pending_writes = 0
-        return 'accepted'
+            db.executemany('INSERT OR IGNORE INTO candidate_seen(proxy, source, endpoint_id) VALUES (?, ?, ?)',
+                           [(proxy, source, endpoint) for proxy, endpoint, _country, source, _seen in sourced])
+            db.executemany('INSERT OR REPLACE INTO membership_source(collection_id, endpoint_id, source_id,'
+                           ' origin, added_at, last_seen_at) VALUES (?,?,?,?,?,?)'
+                           ' ON CONFLICT(collection_id, endpoint_id, source_id) DO UPDATE SET'
+                           ' last_seen_at=excluded.last_seen_at',
+                           [(collection_id, endpoint, source, origin, stamp, stamp)
+                            for _proxy, endpoint, _country, source, seen in sourced
+                            if not (seen or {}).get('replay')])
+            # A replayed generation (a 304) restores what is missing and leaves
+            # the rest as it was: nothing was seen again, so nothing is dated.
+            db.executemany('INSERT OR IGNORE INTO membership_source(collection_id, endpoint_id, source_id,'
+                           ' origin, added_at, last_seen_at) VALUES (?,?,?,?,?,?)',
+                           [(collection_id, endpoint, source, origin, stamp, stamp)
+                            for _proxy, endpoint, _country, source, seen in sourced
+                            if (seen or {}).get('replay')])
+        # ``record_candidate_meta``, set-based.
+        if meta_has_source:
+            db.executemany('''INSERT INTO candidate_meta(proxy, country, source) VALUES (?, ?, ?)
+                ON CONFLICT(proxy) DO UPDATE SET country=COALESCE(excluded.country, candidate_meta.country),
+                source=COALESCE(candidate_meta.source, excluded.source)''',
+                           [(proxy, country, source) for proxy, _endpoint, country, source, _seen in rows
+                            if country or source])
+        else:
+            db.executemany('''INSERT INTO candidate_meta(proxy, country) VALUES (?, ?)
+                ON CONFLICT(proxy) DO UPDATE SET country=COALESCE(excluded.country, candidate_meta.country)''',
+                           [(proxy, country) for proxy, _endpoint, country, *_ in rows if country])
+
+    def commit():
+        nonlocal pending_writes
+        flush()
+        db.commit()
+        pending_writes = 0
 
 
     def add_detected(value, source=None, public_only=True, seen=None):
@@ -1892,7 +2011,7 @@ def add_detected(value, source=None, public_only=True, seen=None):
         reports.append(dict(input=f'local-input-{input_index}', rows=count, invalid=invalid,
                             blocked=blocked, complete=input_error is None, error=input_error))
         total_rows += count
-        db.commit()
+        commit()
         if input_error:
             break
     gate = asyncio.Semaphore(8)
@@ -1951,7 +2070,7 @@ async def fetch(index, kind, url, plan=None):
                                     error='SOURCE_QUARANTINED',
                                     quarantine_until=state.get('quarantine_until'),
                                     next_attempt_at=state.get('quarantine_until')))
-                db.commit()
+                commit()
                 publish()
                 return
             next_attempt = max((state or {}).get('backoff_until') or 0,
@@ -1965,19 +2084,67 @@ async def fetch(index, kind, url, plan=None):
                                     cache_state='stale_last_good' if cached else 'none',
                                     outcome='unavailable', retry_after=(state or {}).get('retry_after'),
                                     next_attempt_at=next_attempt))
-                db.commit()
+                commit()
                 publish()
                 return
 
+            def reapply_generation(generation_id):
+                """Write a stored generation into the target collection again.
+
+                The same writer as a fetched list -- denylist, item budget and
+                per-source membership included -- but on a counter of its own:
+                nothing was read, so the report's read counters stay at zero.
+                """
+                replay = {'values': set(), 'new': 0, 'duplicate': 0, 'metadata': {}, 'replay': True}
+                after = ''
+                while True:
+                    # Keyset pages, each read whole before it is written: the
+                    # writer commits, and a statement still reading across a
+                    # commit is not something to rely on.
+                    rows = db.execute('SELECT g.endpoint_id, e.canonical FROM source_generation_entry g'
+                                      ' JOIN endpoints e ON e.id=g.endpoint_id'
+                                      ' WHERE g.generation_id=? AND g.endpoint_id>?'
+                                      ' ORDER BY g.endpoint_id LIMIT ?',
+                                      (generation_id, after, COLLECT_WRITE_BATCH)).fetchall()
+                    if not rows:
+                        return
+                    after = rows[-1][0]
+                    for _endpoint, canonical in rows:
+                        add(canonical, source=key, seen=replay)
+
+            def attempt_checkpoint():
+                """The per-source counters a page read starts from."""
+                # Only a streamed list adds addresses while it is being read;
+                # a document is parsed after its read succeeded.
+                streamed = kind not in CATALOG_ADAPTER_KINDS and kind != 'geonode'
+                return (dict(budget), count, invalid, blocked, recognized, candidate_count,
+                        endpoint_count, seen['duplicate'], set(seen['values']) if streamed else None)
+
+            def restore_attempt(checkpoint):
+                nonlocal count, invalid, blocked, recognized, candidate_count, endpoint_count, parse_state
+                (saved_budget, count, invalid, blocked, recognized, candidate_count,
+                 endpoint_count, seen['duplicate'], values) = checkpoint
+                budget.clear()
+                budget.update(saved_budget)
+                if values is not None:
+                    seen['values'] = set(values)
+                if parse_state == 'empty':
+                    parse_state = 'pending'
+
             def consume_candidate():
                 nonlocal candidate_count
                 if candidate_count >= max_source_candidates:
                     raise SourceFetchError('SOURCE_CANDIDATE_LIMIT')
                 candidate_count += 1
 
+            line_config = ((plan.profile or {}).get('config') or {}) if kind == 'line' else {}
+            # The catalog's `line` adapter carries the flat format it replaced
+            # in `legacy_kind`; that is how a line of the list is read.
+            line_kind = line_config.get('legacy_kind') if kind == 'line' else kind
+
             def consume_line(raw):
                 nonlocal count, invalid, blocked, recognized
-                if kind == 'text':
+                if line_kind == 'text':
                     # Web pages may use any encoding and are mostly markup: keep only addresses.
                     for address in loose_addresses(raw.decode('utf-8', errors='replace')):
                         consume_candidate()
@@ -1993,11 +2160,14 @@ def consume_line(raw):
                     raise SourceFetchError('SOURCE_INVALID_UTF8') from exc
                 if not line.strip() or line.lstrip().startswith('#'):
                     return
+                if '#' in line:
+                    # "1.2.3.4:8080 # HTTP [ID]": a trailing comment is a note.
+                    line = INLINE_COMMENT.split(line, 1)[0]
                 consume_candidate()
                 count += 1
                 recognized += 1
-                if kind == 'http-fields':
-                    match = re.fullmatch(r"(\d{1,3}(?:\.\d{1,3}){3}:\d{1,5}):[A-Za-z][A-Za-z .'-]*", line.strip())
+                if line_kind == 'http-fields':
+                    match = HTTP_FIELDS_LINE.fullmatch(line.strip())
                     outcome = add(match[1], source=key, seen=seen) if match else 'invalid'
                 elif kind == 'auto':
                     outcome = add_detected(line, source=key, seen=seen)
@@ -2011,7 +2181,7 @@ def consume_line(raw):
                     # whether the list is unlabelled.  Reading the record
                     # instead of assuming HTTP is what makes a SOCKS5 list
                     # arrive as SOCKS5 rather than as 5000 unusable HTTP rows.
-                    config = (plan.profile or {}).get('config') or {}
+                    config = line_config
                     if config.get('line_address') == 'first-token':
                         # "address<tab>free-form note" is the one shape a line
                         # list uses; only the leading token is the address.
@@ -2237,6 +2407,15 @@ async def request_source(request_url, expected_page=None, headers=None):
                             fallback_used = True
                             final_url = candidate
                         for retry in range(2):
+                            if retry or candidate is not candidates[0]:
+                                # A new attempt reads the page from its first
+                                # byte: the bytes and candidates the failed one
+                                # counted are not this source's, and keeping
+                                # them made a large list fail its own size
+                                # limit on the retry.
+                                restore_attempt(checkpoint)
+                            else:
+                                checkpoint = attempt_checkpoint()
                             try:
                                 async with asyncio.timeout(timeout):
                                     data = await request_source(candidate, page, headers)
@@ -2258,6 +2437,10 @@ async def request_source(request_url, expected_page=None, headers=None):
                                 retry_after is not None and retry_after > clock()):
                             break
                     if not succeeded:
+                        if error == 'SOURCE_CANDIDATE_LIMIT' and seen['values']:
+                            # A streamed page cut off by the candidate limit
+                            # was read, and what it delivered is kept.
+                            pages += 1
                         break
                     pages += 1
                     if not_modified:
@@ -2298,7 +2481,7 @@ async def request_source(request_url, expected_page=None, headers=None):
                         try:
                             result = source_adapters.parse_page(
                                 data, plan.profile or {'kind': kind},
-                                page_context={'page': page}, limits=limits)
+                                page_context={'page': page, 'keep_document': True}, limits=limits)
                         except source_adapters.AdapterError as exc:
                             error = exc.args[0] if exc.args else 'SOURCE_ADAPTER_ERROR'
                             # A document that is refused for exceeding its
@@ -2331,10 +2514,17 @@ async def request_source(request_url, expected_page=None, headers=None):
                         # was read as its first page and reported as complete:
                         # a source that publishes 162 records over two pages
                         # contributed 100 and looked finished.
+                        # The JSON adapters hand back the document they parsed;
+                        # only a format that is not JSON itself (a table inside
+                        # a JSON envelope) is parsed again, and only when the
+                        # body can be JSON at all.
+                        document = result.pop('document', None)
                         try:
-                            info = source_adapters.page_info(
-                                json.loads(data.decode('utf-8')), plan.profile or {'kind': kind})
-                        except (source_adapters.AdapterError, UnicodeDecodeError, ValueError):
+                            if document is None and data.lstrip()[:1] in (b'{', b'['):
+                                document = json.loads(data.decode('utf-8'))
+                            info = (source_adapters.page_info(document, plan.profile or {'kind': kind})
+                                    if document is not None else {})
+                        except (source_adapters.AdapterError, UnicodeDecodeError, ValueError, RecursionError):
                             info = {}
                         if max_pages is not None and pages >= max_pages:
                             if info.get('total') is not None and count < int(info['total']):
@@ -2356,7 +2546,7 @@ async def request_source(request_url, expected_page=None, headers=None):
                             break
                         page_url = following
                         page += 1
-                        db.commit()
+                        commit()
                         await asyncio.sleep(.1)
                         continue
                     if kind != 'geonode':
@@ -2389,7 +2579,7 @@ async def request_source(request_url, expected_page=None, headers=None):
                         error = 'INVALID_PAGINATION'
                         break
                     page += 1
-                    db.commit()
+                    commit()
                     await asyncio.sleep(.1)
             total_rows += count
             if bounded_prefix and budget.get('truncated'):
@@ -2399,6 +2589,8 @@ async def request_source(request_url, expected_page=None, headers=None):
                 error, parse_state = 'SOURCE_TRUNCATED', 'partial'
             elif not not_modified and error is None and parse_state == 'pending':
                 parse_state = 'complete'
+            elif error in SOURCE_LIMIT_ERRORS and parse_state == 'pending':
+                parse_state = 'partial' if seen['values'] else 'budget_exceeded'
             # The three fetch states the source views know
             # (``source_management.FETCH_STATES``) are named here, not invented
             # per report: a 200 with no addresses and a 200 that failed to parse
@@ -2408,15 +2600,30 @@ async def request_source(request_url, expected_page=None, headers=None):
             elif error is None:
                 http_state = 'empty_body' if parse_state == 'empty' else 'http_2xx_nonempty'
             elif parse_state == 'budget_exceeded' or status_code == 429 or error in (
-                    'SOURCE_TRUNCATED', 'SOURCE_PAGE_LIMIT', 'SOURCE_RECORD_LIMIT'):
+                    'SOURCE_TRUNCATED', 'SOURCE_PAGE_LIMIT', 'SOURCE_RECORD_LIMIT') or (
+                    error in SOURCE_LIMIT_ERRORS and 200 <= (status_code or 0) < 300):
                 # The transport worked; the budget did not fit.  Reporting it as
                 # `http_error` would send the user to look at a provider that
                 # answered perfectly.
                 http_state = 'http_429' if status_code == 429 else 'http_2xx_nonempty'
             else:
                 http_state = 'http_error' if status_code else 'error'
-            delivered = not not_modified and error is None and bool(seen['values'])
             served = stored_generation(db, key, clock) if not_modified else None
+            if served is not None:
+                # "Not modified" means the list is still the last good one, so
+                # the target collection gets that list, exactly as a 200 with
+                # the same body would have given it: a second collection, or
+                # one a member was removed from, is otherwise left without it
+                # until the provider happens to change the file.
+                try:
+                    reapply_generation(served['generation_id'])
+                except SourceFetchError as exc:
+                    if exc.code not in COLLECT_BUDGET_ERRORS:
+                        raise
+                    error = exc.code
+            # Buffered rows first: the report's "new" counter is decided there.
+            flush()
+            delivered = not not_modified and error is None and bool(seen['values'])
             if served is not None:
                 # 304 is an answer, not the absence of one.  The source still
                 # offers everything its last good generation holds, so the run
@@ -2436,7 +2643,9 @@ async def request_source(request_url, expected_page=None, headers=None):
                           rejected=invalid, reject_reasons=reject_reasons,
                           bytes=budget.get('used', 0),
                           partial=error in COLLECT_BUDGET_ERRORS or error in (
-                              'SOURCE_TRUNCATED', 'SOURCE_PAGE_LIMIT', 'SOURCE_RECORD_LIMIT'),
+                              'SOURCE_TRUNCATED', 'SOURCE_PAGE_LIMIT', 'SOURCE_RECORD_LIMIT')
+                          # The addresses before the candidate limit were stored.
+                          or (error == 'SOURCE_CANDIDATE_LIMIT' and bool(seen['values'])),
                           truncated=bool(budget.get('truncated')),
                           fallback_used=fallback_used,
                           retry_after=retry_after,
@@ -2445,7 +2654,7 @@ async def request_source(request_url, expected_page=None, headers=None):
                 report['served_from_cache'] = True
                 report['cache_age_seconds'] = served['age_seconds']
                 report['cache_generation'] = served['generation_id']
-                report['complete'] = True
+                report['complete'] = error is None
             if record_provenance:
                 # A fetch that failed while a previous answer is still on disk
                 # serves that answer rather than reporting an empty source.
@@ -2476,15 +2685,28 @@ async def request_source(request_url, expected_page=None, headers=None):
             # source views filter on and it must agree with the error.
             report['outcome'] = source_outcome(report)
             reports.append(report)
-            db.commit()
+            commit()
+            if record_provenance:
+                # Right after the new generation is committed, the ones past the
+                # bound go: every run used to add a full copy of every list.
+                # Housekeeping never fails a collection; the next run retries.
+                with contextlib.suppress(sqlite3.Error, schema.DbError):
+                    schema.prune_source_history(db, source_ids=[key])
             publish()
             if not quiet:
                 print(tr(f'Источник {index}: строк {count}, заблокировано {blocked}, страниц {pages}, ошибка {error or "нет"}',
                          f'Source {index}: rows {count}, blocked {blocked}, pages {pages}, error {error or "none"}'), flush=True)
-        async with asyncio.TaskGroup() as group:
-            for index, (kind, url, plan) in enumerate(specs, 1):
-                group.create_task(fetch(index, kind, url, plan))
-    db.commit()
+        try:
+            async with asyncio.TaskGroup() as group:
+                for index, (kind, url, plan) in enumerate(specs, 1):
+                    group.create_task(fetch(index, kind, url, plan))
+        except BaseException:
+            # A stopped run keeps the addresses it already read, as it did
+            # when every batch was committed on its own.
+            with contextlib.suppress(sqlite3.Error):
+                commit()
+            raise
+    commit()
     publish()
     return dict(raw_rows=total_rows, unique=db.execute('SELECT count(*) FROM candidates').fetchone()[0],
                 blocked=sum(r.get('blocked', 0) for r in reports), denylist_error=denylist.error,
@@ -2731,7 +2953,7 @@ def _ws_frames(buffer, max_frame_bytes=None):
 
 
 class Transport:
-    """The network seam ``probes.py`` measures through (F20, F01).
+    """The network seam ``probes.py`` measures through.
 
     ``probes`` never opens a socket: it builds a request, hands it to one of
     these four methods and interprets what comes back.  Everything the probe
@@ -3136,10 +3358,13 @@ async def request_once(proxy, target, config, rate):
     except chain.BudgetExhausted:
         raise
     except Exception as exc:
+        if local_os_error(exc) is not None:
+            # This machine ran out of sockets: no verdict about the proxy.
+            raise
         # Broken proxies raise more than httpx errors (socksio parses raw replies).
         # The stage and the stable code come from the one classifier, so the
         # funnel in a diagnostic packet can tell "the proxy died at the TCP
-        # stage" from "the target answered 503" (F10, F25).
+        # stage" from "the target answered 503".
         result['error'] = str(exc) if isinstance(exc, ValueError) and str(exc) == 'BODY_TOO_LARGE' else type(exc).__name__
         result['error_stage'], result['error_code'] = diagnostics.classification(exc)
     finally:
@@ -3238,7 +3463,7 @@ def allowed_failures(config):
 
 
 def probe_plan(config):
-    """The check mode and its limits, from the modes module (F01, F07).
+    """The check mode and its limits, from the modes module.
 
     One place decides what "recheck" or "monitor" means and how long a single
     probe may take; the engine asks it instead of re-deriving the numbers, so a
@@ -3260,7 +3485,7 @@ def probe_plan(config):
         # The whole-probe budget is what one endpoint may cost in this run:
         # every attempt of every target, worst case each.  It is not
         # ``attempts x targets`` implicit in the per-request timeouts -- it is
-        # one number, and it is the job's own (defect 23, F12).
+        # one number, and it is the job's own.
         'whole_probe_timeout_s': (connect + connect + read) * attempts * targets,
         'max_body_bytes': int(config.get('max_bytes') or 262144),
     })
@@ -3268,7 +3493,7 @@ def probe_plan(config):
 
 
 def capability_manifest():
-    """What is really measured, and what is declared unsupported (F20).
+    """What is really measured, and what is declared unsupported.
 
     A websocket, a long connection, a media segment, UDP or HTTP/3 is not
     measured here, so it is reported as unsupported rather than as a passing
@@ -3361,7 +3586,7 @@ def _stamp_evidence(row, outcome):
 
 
 async def check_capabilities(proxy, config, transport=None):
-    """Run the declared capability kinds and file one state per kind (F20).
+    """Run the declared capability kinds and file one state per kind.
 
     Each kind is measured by :mod:`probes` against the very same
     :class:`Transport` the basic ladder uses, so "websocket supported" means a
@@ -3389,7 +3614,7 @@ async def measure_speed(proxy, config, rate):
     :mod:`probes`' -- this function only supplies the bytes.  A transfer that is
     too small, too short or unfinished therefore comes back
     ``state='insufficient'`` **without a number**, instead of the old hand-made
-    arithmetic that divided a single chunk by an arbitrary window (defect 15).
+    arithmetic that divided a single chunk by an arbitrary window.
     """
     from . import probes
     await rate.wait()
@@ -3459,7 +3684,7 @@ async def judge_proxy(proxy, config, rate, own_ips):
         return anonymity.result('unknown', error=str(exc), started=started)
     except Exception as exc:
         # An anonymity check that failed is unknown, never a pass: the level the
-        # user asked for is not granted on a failed request (defect 13).
+        # user asked for is not granted on a failed request.
         return anonymity.result('unknown', error=diagnostics.classification(exc)[1], started=started)
     # ``judge_verified`` says the direct bootstrap really did show one of our
     # addresses.  Without that baseline an echo that leaks nothing proves
@@ -3492,12 +3717,50 @@ def fit_prefilter(workers, requested):
     return max(1, min(requested, fit_workers(workers + requested) - workers))
 
 
+#: Connect errors that describe this machine running out of something, not the
+#: proxy being dead.  They are raised instead of becoming ``UNREACHABLE``: a
+#: verdict about the proxy would be wrong, and the adaptive limit must see them.
+LOCAL_CONNECT_ERRNOS = frozenset(getattr(errno, name) for name in
+                                 ('EMFILE', 'ENFILE', 'ENOBUFS', 'EADDRNOTAVAIL', 'ENOMEM')
+                                 if hasattr(errno, name))
+
+
+def local_os_error(exc):
+    """The local-resource ``OSError`` behind ``exc`` (httpx wraps it), or None."""
+    seen = set()
+    while exc is not None and id(exc) not in seen:
+        seen.add(id(exc))
+        if isinstance(exc, OSError) and exc.errno in LOCAL_CONNECT_ERRNOS:
+            return exc
+        exc = exc.__cause__ or exc.__context__
+    return None
+
+
+class EndpointConcurrency(AdaptiveConcurrency):
+    """The scan's adaptive limit: only local trouble counts as overload.
+
+    A proxy that refuses, times out or answers garbage is a verdict about that
+    proxy.  Counting it as a failed measurement walked the limit down to one
+    in-flight check on any real corpus -- most public addresses are dead -- and
+    the run crawled through its timeouts one by one.  Outcomes that carry the
+    measurement stage they failed at are verdicts; an outcome without one (a
+    runner that raised, e.g. out of descriptors) still shrinks the limit.
+    """
+
+    def observe_outcome(self, outcome):
+        return self.observe(outcome.ok or bool(outcome.failed_stage), outcome.latency_s)
+
+
 async def reachable(proxy, timeout):
     """Whether anything accepts a TCP connection at the proxy's address."""
     _, host, port = formats.split(proxy)
     try:
         _, writer = await asyncio.wait_for(asyncio.open_connection(host, port), timeout)
-    except (OSError, asyncio.TimeoutError, ValueError):
+    except (asyncio.TimeoutError, ValueError):
+        return False
+    except OSError as exc:
+        if local_os_error(exc) is not None:
+            raise
         return False
     writer.close()
     with contextlib.suppress(OSError):
@@ -3572,7 +3835,7 @@ def measurement_bytes(row):
 #: One page of the candidate source.  The corpus is read page by page instead of
 #: with a single ``fetchall``: a half-million addresses is a list of a hundred
 #: megabytes the engine would hold for the whole run, and the front half of a
-#: scan is supposed to be bounded (F12).  Each page is a fresh statement, so the
+#: scan is supposed to be bounded.  Each page is a fresh statement, so the
 #: commit the store path makes every batch cannot invalidate a half-read
 #: cursor of the corpus.
 CANDIDATE_PAGE = 4096
@@ -3659,7 +3922,7 @@ def newest_measurements(conn, profile, *, scope=None, access=None, policy=None):
 def candidate_pages(conn, collection_id, *, page=CANDIDATE_PAGE):
     """The addresses of one collection, in address order, one page at a time.
 
-    Membership is the scope (CONTRACTS §1.2 rule 2) and the order is the address
+    Membership is the scope and the order is the address
     order, which is also the order that makes inserting the results cheapest.
     Pagination is by address, not by offset, so a page stays correct however many
     rows the sweep has written since.
@@ -3746,7 +4009,7 @@ def _already_canonical(value):
 
     ``collect`` already ran the project's one normaliser, and the collection
     stores what it returned; normalising a second time would be a second
-    grammar for the same address (CONTRACTS §1.2).  The chain still refuses
+    grammar for the same address.  The chain still refuses
     anything it cannot split into a scheme, a host and a port, so a corrupt
     candidate is rejected and counted rather than measured.
     """
@@ -3773,7 +4036,8 @@ async def scan(db, config, *, workers=128, rate=100, recheck=False, probe=check_
                collection_id=None, profile_revision=1, max_age_seconds=None, profile_id=None,
                access=None, job_id=None, job_store=None, deadline_s=None,
                max_requests=None, max_bytes=None, count_what='endpoint',
-               max_per_host=1, min_host_interval_s=0.0, target_inflight=2, expensive_probe=None):
+               max_per_host=1, min_host_interval_s=0.0, target_inflight=2, expensive_probe=None,
+               open_job=None):
     """Check every pending candidate of the profile.
 
     The run *is* the chain of ``pipeline.py`` — the same ``Pipeline``,
@@ -3784,7 +4048,7 @@ async def scan(db, config, *, workers=128, rate=100, recheck=False, probe=check_
     RAM budgets rather than taken from ``--workers`` as a constant, the request
     and byte totals are reserved before a measurement and charged with what it
     really spent, per-host and per-target limits hold, and the three units of
-    ``--want`` are three different numbers (F12).
+    ``--want`` are three different numbers.
 
     The stages, from cheap to expensive:
 
@@ -3805,10 +4069,15 @@ async def scan(db, config, *, workers=128, rate=100, recheck=False, probe=check_
     ``job_store`` hands the run to the persistent lifecycle of ``jobs.py``: the
     queue, the per-item states and the events come from there, so a cancel, a
     crash or a restart keeps the last completed result and the queue of
-    unfinished items (defect 6).  ``deadline_s``, ``max_requests`` and
+    unfinished items.  ``deadline_s``, ``max_requests`` and
     ``max_bytes`` are the resource budgets of ``pipeline.py`` -- one global
     time and one request/byte ceiling instead of ``attempts x targets`` per
-    address (F12, defect 23).
+    address.
+
+    ``open_job`` registers the job once the scope is known, for a run whose
+    queue only this function can name (a ``--watch`` round re-checks the
+    addresses that pass): it is called with the addresses the run will measure
+    and returns the job id.
     """
     denylist = denylist or Denylist.empty()
     policy = config.get('reputation', {})
@@ -3824,13 +4093,12 @@ async def scan(db, config, *, workers=128, rate=100, recheck=False, probe=check_
     country_of = country_of or (lambda proxy: None)
     # The scope is fixed here and pinned into every row: the same collection, the
     # same profile revision and the same access revision must be visible to the
-    # GUI, the API and the gateway, or a consumer could mix two measurements
-    # (CONTRACTS §1.2 rules 1-2).
+    # GUI, the API and the gateway, or a consumer could mix two measurements.
     collection_id = ensure_collection(db, collection_id)
     access = as_access(access)
     network_id = snapshot_network(config)
     # The same criterion the export uses, so a row the check narrows and a row
-    # the export drops are the same row for the same reason (F08).
+    # the export drops are the same row for the same reason.
     criterion = country_criterion(countries, country_exclude, country_basis, country_unknown)
     admission_policy = core.Policy(
         max_age_seconds=float(max_age_seconds if max_age_seconds else MIN_FRESHNESS_SECONDS),
@@ -3884,7 +4152,7 @@ def counts_as_passed(row):
 
     # ``--want`` counts endpoints unless the user asks for another unit: N
     # endpoints, N IPs and N confirmed exit IPs are different numbers, and the
-    # caller names the one it means (F12, CONTRACTS §1.1).  The chain owns the
+    # caller names the one it means.  The chain owns the
     # arithmetic of the three units; what this function does is fill the other
     # two so the report can show them beside the one that was asked for.
     find = chain.FindPolicy(n=want, what=count_what)
@@ -3946,7 +4214,7 @@ def counted(row):
         # trustworthy.  In particular, UNREACHABLE and expired rows are pending on
         # the next scan; treating every row as done made a dead proxy permanent.
         # "Trustworthy" is the one admission contract, not a local freshness test:
-        # a row with no recorded lifetime is never assumed fresh (defects 1, 2, 4).
+        # a row with no recorded lifetime is never assumed fresh.
         if (core.observation_state(row) != core.OBSERVATION_MISSING and not row.get('error')
                 and core.time_state_of(row, now, admission_policy)['state'] == core.TIME_OK):
             done.add(proxy)
@@ -3984,12 +4252,17 @@ def counted(row):
     # half-million addresses has to have a denominator before the first probe.
     total = 0
     initial = 0
+    queue = [] if open_job is not None and job_id is None else None
     for proxy in candidate_pages(db, collection_id):
         if (only is not None and proxy not in only) or not selected(proxy):
             continue
         total += 1
         if proxy in done:
             initial += 1
+        elif queue is not None:
+            queue.append(proxy)
+    if queue is not None:
+        job_id = open_job(queue)
 
     # Addresses that already worked in another profile go first. In find-N mode
     # the rest is shuffled so early results are not all from one subnet or
@@ -4035,7 +4308,7 @@ def counted(row):
     # The budgets of the run.  ``--workers`` is the ceiling the user asks for, not
     # the number of workers: the chain derives its own from the descriptors the
     # process really has and from the RAM each in-flight measurement may hold,
-    # and moves that number with the observed success rate (F12).  ``--max-requests``
+    # and moves that number with the observed success rate.  ``--max-requests``
     # and ``--run-max-bytes`` are the totals a stage is charged against, and the
     # probes reserve every request and its body allowance before I/O.
     ram_per_inflight = max(int(config.get('max_bytes') or 0), DEFAULT_RAM_PER_INFLIGHT)
@@ -4091,7 +4364,7 @@ def store(proxy, row, passed_ok):
         # One measurement folded into the row by the one admission contract:
         # ``valid_until`` is written here, once, from the measurement time and
         # the policy of this profile revision, and is never recomputed at export
-        # time (defects 1 and 2, CONTRACTS §2.1).
+        # time.
         measurement = core.Measurement(
             endpoint_id=endpoint, checked_at=row.get('checked_at'), verdict=row,
             error=row.get('error'), job_id=job_id, network_id=network_id,
@@ -4101,8 +4374,8 @@ def store(proxy, row, passed_ok):
                                         profile=(profile, int(profile_revision or 1)))
         merged.setdefault('proxy', proxy)
         # The measurement of record is written first and the result row points
-        # at it, so no stop can leave a result without an observation behind it
-        # (CONTRACTS §2.1).  It exists only when the run is a tracked job.
+        # at it, so no stop can leave a result without an observation behind it.
+        # It exists only when the run is a tracked job.
         if job_store is not None and job_id:
             observation_id[0] = record_observation(
                 db, merged, job_id=job_id, endpoint_id=endpoint, access=access,
@@ -4273,9 +4546,12 @@ async def basic_stage(item, *, stage, limit):
         except chain.BudgetExhausted:
             raise
         except Exception as exc:
+            if local_os_error(exc) is not None:
+                # Not a verdict: the chain records a failed stage, the limit
+                # shrinks and the address stays pending for the next run.
+                raise
             # One malformed proxy must never stop the whole scan, and the reason
-            # it died is recorded with a stage so the funnel can count it
-            # (F10, F25).
+            # it died is recorded with a stage so the funnel can count it.
             row = unreachable_result(proxy)
             row['error'] = type(exc).__name__
             row['error_stage'], row['error_code'] = diagnostics.classification(exc)
@@ -4356,7 +4632,7 @@ async def expensive_stage(item, *, stage, limit):
         expensive_policy=chain.EXPENSIVE_ALL_PASSING,
         carry_fresh_prior=False)
     engine = chain.Pipeline(config_chain, clock=chain.SystemClock(),
-                            concurrency=chain.AdaptiveConcurrency(
+                            concurrency=EndpointConcurrency(
                                 minimum=1, maximum=budgets.worker_ceiling(),
                                 target_success=0.8, window=16, increase=2, decrease_factor=0.5))
 
@@ -4494,7 +4770,7 @@ def anonymous_access(db, endpoint_id, scheme):
     says so: ``observations.access_id`` points at a real ``accesses`` row.  The
     identity is created through the secret store, so a credentialed endpoint and
     a public one differ only by the mode recorded there -- not by two parallel
-    notions of "who measured this" (CONTRACTS §1.2 rule 1).
+    notions of "who measured this".
     """
     from . import secrets as secretstore
     store = secretstore.AccessStore(db, secretstore.vault_for_database(db), commit=False)
@@ -4508,7 +4784,7 @@ def record_observation(db, row, *, job_id, endpoint_id, access, profile, profile
     """Write one finished measurement as an ``observations`` row and return its id.
 
     The observation is the measurement of record: the row the item refers to and
-    the payload the result keeps are the same instant (CONTRACTS §2.1).  It is
+    the payload the result keeps are the same instant.  It is
     written before the job item is finished so a stop between "measured" and
     "judged" still leaves the measurement recoverable.
 
@@ -4542,7 +4818,7 @@ def finish_job_item(store, job_id, endpoint_id, row, observation_id):
     The order is the contract: the item leaves the queue only when a measurement
     with an explicit time exists, so a cancelled re-check keeps the previous
     payload and the queue of unfinished items survives a crash (defect 6,
-    CONTRACTS §6.3).  A lifecycle that refuses the transition must never cost
+    the shared contract).  A lifecycle that refuses the transition must never cost
     the measurement itself -- it is already written -- so the refusal is
     contained here and the job state stays the honest record of what happened.
     """
@@ -4564,12 +4840,20 @@ def finish_job_item(store, job_id, endpoint_id, row, observation_id):
 
 
 def submit_scan_job(workbench, db, kind, *, profile, profile_revision, collection_id,
-                    candidates, filters=None, budgets=None, idempotency_key=None):
+                    candidates, filters=None, budgets=None, idempotency_key=None,
+                    continue_interrupted=False):
     """Register a scan in the persistent lifecycle and return its job id.
 
     ``idempotency_key`` makes a repeated request return the same job instead of
-    starting a second one (CONTRACTS §6.4).  Every queue item is created here, so
+    starting a second one.  Every queue item is created here, so
     a restart knows what was still unfinished.
+
+    ``continue_interrupted`` is for a caller that holds ``workbench.lock``, so
+    no other process can be measuring: a job of this kind still ``running`` was
+    left by a process that died, and it is paused instead of blocking every
+    later run with ``E_CONFLICT_BUSY``.  A paused job asked for exactly the same
+    work is then resumed rather than started again, so its finished items --
+    the dead addresses included -- are not measured a second time.
     """
     from . import jobs
     store = workbench.jobs()
@@ -4580,13 +4864,40 @@ def submit_scan_job(workbench, db, kind, *, profile, profile_revision, collectio
                             access_id=PUBLIC_ACCESS_ID, access_revision=1)
              for value in candidates]
     db.commit()
+    if continue_interrupted:
+        for stale in store.jobs(kind=kind, state='running'):
+            store.pause(stale.id, reason_code=jobs.CODE_INTERRUPTED)
+        digest = jobs._input_digest(kind, scope, items)
+        for paused in reversed(store.jobs(kind=kind, state='paused')):
+            if paused.input_digest == digest:
+                store.resume(paused.id)
+                store.start(paused.id)
+                return paused.id
     job = store.submit(kind, scope, items, idempotency_key=idempotency_key)
     # ``queued`` -> ``running`` before the first claim; refused with
-    # E_CONFLICT_BUSY while another job is already measuring (CONTRACTS §6.4).
-    store.start(job.id)
+    # E_CONFLICT_BUSY while another job is already measuring.
+    try:
+        store.start(job.id)
+    except jobs.JobError as exc:
+        # A queued job nobody runs would be picked up later by the background
+        # runner as work the user never asked it to do.
+        if job.state == 'queued' and not idempotency_key:
+            store.cancel(job.id, reason_code=getattr(exc, 'code', None))
+        raise
     return job.id
 
 
+def pause_scan_job(store, job_id):
+    """Leave an interrupted job resumable; a refusal is not an error here."""
+    from . import jobs
+    if not job_id:
+        return None
+    try:
+        return store.pause(job_id, reason_code=jobs.CODE_INTERRUPTED)
+    except (jobs.JobError, sqlite3.Error):
+        return None
+
+
 def finish_scan_job(store, job_id, state, reason_code):
     """Close a job with its honest state; a refusal is not an error here."""
     from . import jobs
@@ -4780,7 +5091,7 @@ def proxy_protocol(proxy):
 
 
 def country_criterion(countries=(), exclude=(), basis='endpoint', unknown='exclude'):
-    """The one country criterion every surface filters with (F08).
+    """The one country criterion every surface filters with.
 
     The object is built by :mod:`proxy_workbench.geo` and nowhere else, so a
     country chosen by name, and the explicit "unknown" policy, mean the same
@@ -4895,12 +5206,12 @@ def export(db, profile, directory, *, top=0, sort='quality', min_success=2/3, de
     the scope, the policy and the rows the current filters select.  Three kinds
     of artifact exist and only one of them may switch the active pool -- an
     exported selection, a top-N slice and a search result all stay separate
-    files until the user publishes them explicitly (defects 3, 7, R04).
+    files until the user publishes them explicitly.
 
     ``diagnostic=True`` never touches the active pointer; ``allowed_proxies``
     makes the artifact a ``selection``.  A re-export with a different ``--watch``
     cannot change the lifetime of an already measured address, because
-    ``valid_until`` was written at measurement time (defects 1, 2).
+    ``valid_until`` was written at measurement time.
     """
     from . import exportsvc
 
@@ -5058,8 +5369,8 @@ def export(db, profile, directory, *, top=0, sort='quality', min_success=2/3, de
         published_row['checks'] = history['checks']
         published_row['passes'] = history['passes']
         published_row['mbps'] = (row.get('speed') or {}).get('mbps') if isinstance(row.get('speed'), dict) else None
-        # An access identity is published only when it points at a credential
-        # (CONTRACTS §4.4).  The credential-free public identity is how the row
+        # An access identity is published only when it points at a credential.
+        # The credential-free public identity is how the row
         # was *measured*; carrying it as an access reference would make every
         # plain proxy look password-protected and the compatibility report would
         # drop it from PAC, Clash and sing-box.  The stored row keeps it either
@@ -5089,7 +5400,7 @@ def export(db, profile, directory, *, top=0, sort='quality', min_success=2/3, de
         # The state describes the set, not the sweep: nothing matched is
         # "empty", everything expired is "stale", and a set that lost members
         # is "partial".  Calling all three "complete" is what made one dead
-        # address indistinguishable from a finished run (CONTRACTS §4.3, defect 3).
+        # address indistinguishable from a finished run.
         run_state['state'] = selection.state
         run_state.setdefault('state_detail', selection.state_detail)
         run_state.setdefault('stop_reason', 'complete')
@@ -5123,7 +5434,7 @@ def export(db, profile, directory, *, top=0, sort='quality', min_success=2/3, de
     # ``complete`` answers a different question from ``state``: it says the run
     # covered its whole scope.  A sweep that finished and rejected a few rows is
     # still complete -- conflating the two is what made "everything expired" and
-    # "every check finished" look alike (CONTRACTS §4.3, defect 3).
+    # "every check finished" look alike.
     report['complete'] = bool(
         run_state.get('state') in (core.SELECTION_COMPLETE, core.SELECTION_PARTIAL)
         and int(run_state.get('checked') or 0) >= int(run_state.get('scope_candidates') or 0)
@@ -5144,8 +5455,8 @@ def export(db, profile, directory, *, top=0, sort='quality', min_success=2/3, de
         db.rollback()
     # Only a published run may repoint an already connected client.  A selected
     # slice, a top-N cut and a search result are files the user downloads; they
-    # never move the active pool, and they never touch ``last-profile.txt``
-    # (defect 7, R04, CONTRACTS §4.5).  ``exportsvc.publish`` refuses a
+    # never move the active pool, and they never touch ``last-profile.txt``.
+    # ``exportsvc.publish`` refuses a
     # selection outright -- the branch below exists so a published run still
     # gets the legacy compatibility files and the pointer in one rollback-safe
     # step.
@@ -5197,7 +5508,7 @@ def uptime_of(row):
 
 
 class Workbench:
-    """The one service layer behind the CLI, the API and the GUI (F18).
+    """The one service layer behind the CLI, the API and the GUI.
 
     Every module built in this wave -- ``jobs``, ``importer``, ``profiles``,
     ``probes``, ``pools``, ``scheduler``, ``sourcedesk``, ``geo``, ``pipeline``,
@@ -5213,11 +5524,15 @@ class Workbench:
     exception of a module leaks past this boundary.
     """
 
-    def __init__(self, data, *, db_path=None, clock=None):
+    def __init__(self, data, *, db_path=None, clock=None, conn=None):
         self.data = Path(data)
         self.db_path = Path(db_path) if db_path else self.data / 'proxies.sqlite3'
         self.clock = clock or time.time
-        self._conn = None
+        # A caller that already holds the migrated connection (the scan) lends
+        # it: a second writer on the same file would wait on the scan's open
+        # batch for the whole busy timeout, with the event loop blocked.
+        self._conn = conn
+        self._owns_conn = conn is None
         self._report = None
         self._stores = {}
         self._counter = 0
@@ -5247,7 +5562,8 @@ def migration_report(self):
     def close(self):
         conn, self._conn = self._conn, None
         self._stores.clear()
-        if conn is not None:
+        owned, self._owns_conn = self._owns_conn, True
+        if conn is not None and owned:
             try:
                 conn.commit()
             finally:
@@ -5308,15 +5624,14 @@ def sources(self):
         from . import sourcedesk
         return self._store('sources', lambda: sourcedesk.SourceDesk(self.conn))
 
-    # -- source comparison (F21) -------------------------------------------
+    # -- source comparison -------------------------------------------
 
     def source_dataset_groups(self, source_ids):
         """``{source_id: dataset group}`` the catalog already records.
 
         The research pass compared full snapshots and found that some
         publishers serve byte-identical payloads under different ids
-        (``docs/requirements/sources-research/overlap.md``: ``hookzof`` and
-        ``proxifly``, 21 036 identical SOCKS5 endpoints).  That verdict is in
+        (``hookzof`` and ``proxifly``, 21 036 identical SOCKS5 endpoints).  That verdict is in
         the catalog, so the comparison does not have to rediscover it by
         downloading and comparing two lists again -- and an uncollected pair
         still reads as one dataset rather than as a second opinion.
@@ -5432,7 +5747,7 @@ def country_criterion(self, include=(), exclude=(), basis='endpoint',
                                     max_age_seconds=max_age_seconds)
 
     def filter_by_country(self, rows, criterion, resolver=None, now=None):
-        """The GUI list, the read-only API and the export, one country rule (F08).
+        """The GUI list, the read-only API and the export, one country rule.
 
         This method had no caller: each of the three surfaces had written its
         own include-only ``row['country'] in wanted`` test, so none of them
@@ -5521,7 +5836,7 @@ def pool_refill(self, pool_id, source, budget=None, now=None):
     # -- schedules ---------------------------------------------------------
 
     def schedule_plan(self, spec_id, now=None):
-        """Next run of one schedule, with its timezone and window (F15)."""
+        """Next run of one schedule, with its timezone and window."""
         from . import scheduler
         engine = scheduler.Scheduler(self.schedules(), clock=self.clock)
         spec = next((item for item in engine.list() if item.id == spec_id), None)
@@ -5557,7 +5872,7 @@ def pipeline_priors(self, collection_id, profile_id, max_age_s):
         """Known-good rows of one scope as pipeline priors, ages kept intact.
 
         A carried-over prior keeps its own ``checked_at``: re-exporting or
-        changing ``--watch`` must not mint a new measurement time (defect 2).
+        changing ``--watch`` must not mint a new measurement time.
         """
         from . import pipeline
         now = self.clock()
@@ -5580,7 +5895,7 @@ def key_bootstrap(self, name='administrator', permissions=None, ttl_s=None):
         """Issue the first administrative key through a local trusted bootstrap.
 
         This is the only way an administrator comes into existence, and it needs
-        a locally trusted caller, not a secret from the network (F29).
+        a locally trusted caller, not a secret from the network.
 
         The default permission set is *this machine's* administrator: key
         administration plus every write the control API offers.  Anything less
@@ -5649,7 +5964,7 @@ def local_admin_permissions():
 
     Key administration on its own is not administration: a key that may only
     read keys cannot create a collection, import a list, submit a check or
-    export, and the user would see 403 for every action they took it for (F29).
+    export, and the user would see 403 for every action they took it for.
     """
     from . import apikeys
     return tuple(sorted(set(apikeys.ADMIN_PERMISSIONS) | set(apikeys.WRITE_PERMISSIONS)
@@ -5661,7 +5976,7 @@ class WorkbenchError(RuntimeError):
 
     Module exceptions stay inside :class:`Workbench`; this is the single
     boundary both surfaces share, so a refusal reads the same in a terminal and
-    in a JSON body (CONTRACTS §5.4).
+    in a JSON body.
     """
 
     def __init__(self, message, code='E_STATE_SNAPSHOT_STATIC'):
@@ -5865,8 +6180,8 @@ def parser():
                    help=tr('serve: токен доступа к API (или переменная PROXY_WORKBENCH_API_TOKEN); '
                         'обязателен, если API слушает не loopback-адрес', 'serve: API access token (or PROXY_WORKBENCH_API_TOKEN); '
                         'required when the API listens on a non-loopback address'))
-    # The gateway password is a different identity from the API token (CONTRACTS
-    # §5.1, defect 18).  `gateway` used to read `--api-token`, so one value was
+    # The gateway password is a different identity from the API token.
+    # `gateway` used to read `--api-token`, so one value was
     # both the rotating-proxy password and the read-only bearer token: whoever
     # knew the password from a phone in the LAN could read the whole published
     # snapshot, and a leaked API token was a working proxy.
@@ -5988,7 +6303,7 @@ def parser():
     p.add_argument('--include-secret', action='store_true',
                    help=tr('source redact: показать искомую строку, если она утёкла; по умолчанию только факт',
                            'source redact: show the searched string if it leaked; by default only the fact'))
-    # source catalog (F13).  `--sources` stays the flat URL list and still wins;
+    # source catalog.  `--sources` stays the flat URL list and still wins;
     # these are for the catalog half, which addresses a source by its stable id.
     p.add_argument('--id', default='', dest='id',
                    help=tr('source: идентификатор источника в каталоге', 'source: catalog source id'))
@@ -6128,7 +6443,7 @@ def run_gateway(args, countries):
     filters = dict(protocol=args.protocol, countries=countries, anonymity=args.min_anonymity,
                    max_latency=args.max_latency)
     # `args.api_token` is deliberately not read for the gateway: the password is a
-    # separate identity (CONTRACTS §5.1, defect 18).  On a LAN bind the gateway makes
+    # separate identity.  On a LAN bind the gateway makes
     # its own and prints it, so a password a phone was given is never a control
     # secret and a leaked API token is never a working proxy.
     gateway_token = getattr(args, 'gateway_token', None)
@@ -6284,7 +6599,7 @@ def management_command(args):
         return 2
     except importer_error() as exc:
         # Every refusal of the importer is a subclass of ``ImportProblem``, and
-        # each one names its own ``E_*`` code (CONTRACTS §5.4).  Enumerating a
+        # each one names its own ``E_*`` code.  Enumerating a
         # few of them here is how a ``ImportPartialBlocked`` or a
         # ``ImportBusy`` escaped as a traceback instead of a message.
         print(tr(f'Ошибка импорта: {exc}', f'Import error: {exc}'), file=sys.stderr)
@@ -6374,8 +6689,8 @@ def _import_policy(args):
     The public base takes globally routable addresses only.  A private
     collection may name a hostname or a private address, but only because the
     user said so with ``--allow-private-endpoints`` -- an explicit, recorded
-    choice rather than a form that accepts what the collector later drops
-    (F04, defect 10).  Credentials are refused either way: the importer refuses
+    choice rather than a form that accepts what the collector later drops.
+   Credentials are refused either way: the importer refuses
     them structurally, and no flag turns that off.
     """
     from . import importer
@@ -6385,7 +6700,7 @@ def _import_policy(args):
 
 
 def _cmd_import(workbench, args, action):
-    """``import preview|commit|list`` -- the transactional importer (F03)."""
+    """``import preview|commit|list`` -- the transactional importer."""
     if action == 'list':
         rows = workbench.conn.execute(
             'SELECT id, collection_id, state, revision, created_at FROM import_batch '
@@ -6448,8 +6763,8 @@ def _busy_collection(workbench, collection_id):
     return f'collection {collection_id} is being checked by job {running[0].id}'
 
 
-#: Everything ``source`` can do.  The catalog half (F13), the redaction half
-#: (F27) and the comparison half (F21) answer different questions about the
+#: Everything ``source`` can do.  The catalog half, the redaction half
+#: and the comparison half answer different questions about the
 #: same objects, so they share one command instead of two that disagree about
 #: what a source is.
 SOURCE_SUBCOMMANDS = ('list', 'show', 'sets', 'set', 'enable', 'disable', 'add', 'remove',
@@ -6486,7 +6801,7 @@ def _cmd_source(workbench, args, action):
 
 
 def _source_command(workbench, args, action):
-    """``source <subcommand>`` -- the source catalog and the subscriptions (F13, F27).
+    """``source <subcommand>`` -- the source catalog and the subscriptions.
 
     The catalog half reads and writes the *selection* (``source_catalog``), the
     runtime half reports what the last collection actually did
@@ -7153,7 +7468,7 @@ def active_profile_id(workbench):
 
 
 def _cmd_pool(workbench, args, action):
-    """``pool list|create|status|members|refill|recheck`` -- a steady pool of proxies (F14).
+    """``pool list|create|status|members|refill|recheck`` -- a steady pool of proxies.
 
     ``refill`` and ``recheck`` are the two halves of keeping a pool up: the
     first re-admits from what is already measured, the second measures the
@@ -7187,7 +7502,7 @@ def _cmd_pool(workbench, args, action):
             raise WorkbenchError(tr('Укажите имя пула: --name ИМЯ', 'name the pool: --name NAME'))
         # A pool is bound to one scope: a collection *and* a profile revision.
         # Both are required, because a pool that could drift to another profile
-        # would serve rows the user never asked for (CONTRACTS §1.2).
+        # would serve rows the user never asked for.
         profile_id = args.profile_id or active_profile_id(workbench)
         if not profile_id:
             raise WorkbenchError(tr('Пул привязан к профилю проверки: укажите --profile-id '
@@ -7345,7 +7660,7 @@ def _cmd_schedule(workbench, args, action):
                 raise WorkbenchError(tr(f'Окно запуска неверно: {exc}',
                                         f'the run window is invalid: {exc}'), 'E_VALIDATION_FIELD') from None
         # The store owns the serialisation: the schedule is given as the plain
-        # mapping its schema defines, never as a runtime object (CONTRACTS §5.5).
+        # mapping its schema defines, never as a runtime object.
         payload = {'id': schedule_id, 'kind': 'interval', 'interval_minutes': args.interval,
                    'timezone': args.timezone,
                    'budgets': {'requests': args.budget_requests, 'bytes': args.budget_bytes}}
@@ -7395,7 +7710,7 @@ def _cmd_schedule(workbench, args, action):
 
 
 def _cmd_profile(workbench, args, action):
-    """``profile list|show`` -- named check profiles (F05)."""
+    """``profile list|show`` -- named check profiles."""
     store = workbench.profiles()
     if action in ('', 'list'):
         rows = [item.as_dict() if hasattr(item, 'as_dict') else str(item) for item in store.list()]
@@ -7408,7 +7723,7 @@ def _cmd_profile(workbench, args, action):
 
 
 def _cmd_preset(workbench, args, action):
-    """``preset [поиск]`` -- versioned service sets and their probes (F06).
+    """``preset [поиск]`` -- versioned service sets and their probes.
 
     The list is deliberately one line per preset with its verification state:
     a preset whose definition was never checked against a live response says so
@@ -7553,7 +7868,7 @@ def _cmd_backup_cleanup(workbench, args, action):
 
 
 def _cmd_backup_rebind(workbench, args):
-    """Re-point the vault after a restore into a new data path (F24, F18)."""
+    """Re-point the vault after a restore into a new data path."""
     from . import db as store
     mapping = json.loads(Path(args.mapping).read_text(encoding='utf-8')) \
         if getattr(args, 'mapping', None) else {}
@@ -7698,7 +8013,7 @@ def _cmd_diagnose(workbench, args, action):
 
 
 def _cmd_geo(workbench, args, action):
-    """``geo status`` -- the country and provider databases, honestly (F08)."""
+    """``geo status`` -- the country and provider databases, honestly."""
     from . import geo
     layout = workbench.layout()
     country = geo.database_status(geoip.default_path(workbench.data), 'country', now=workbench.clock())
@@ -7710,7 +8025,7 @@ def _cmd_geo(workbench, args, action):
 
 
 def _database_phrase(status):
-    """One honest sentence about a country/provider database (F08).
+    """One honest sentence about a country/provider database.
 
     A missing or stale database is never reported as a ready one: the age and
     the error, if any, travel with the state.
@@ -7779,6 +8094,13 @@ def main(argv=None):
             or not math.isfinite(args.min_host_interval) or args.min_host_interval < 0
             or not math.isfinite(args.watch) or args.watch < 0):
         p.error(tr('Неверные числовые параметры', 'Invalid numeric options'))
+    if getattr(args, 'speedtest_url', None) and getattr(args, 'speedtest_bytes', None) is not None:
+        from . import probes
+        # Below the smallest honest sample every speed test ends "insufficient":
+        # the run would pay for a download on every proxy and never get a number.
+        if args.speedtest_bytes < probes.SPEED_LIMITS.min_bytes:
+            p.error(tr(f'--speedtest-bytes должен быть не меньше {probes.SPEED_LIMITS.min_bytes}',
+                       f'--speedtest-bytes must be at least {probes.SPEED_LIMITS.min_bytes}'))
     try:
         countries = geoip.parse_countries(args.country)
         country_exclude = geoip.parse_countries(getattr(args, 'country_exclude', '') or '')
@@ -7900,12 +8222,12 @@ def main(argv=None):
     current_published = False
     scan_interrupted = False
     # The run is one job in the persistent lifecycle: a cancel, a crash or a
-    # restart keeps the last completed result and the queue of unfinished items
-    # (defect 6).  It is optional, so a read-only run still works.
+    # restart keeps the last completed result and the queue of unfinished items.
+    # It is optional, so a read-only run still works.
     scan_workbench = None
     current_job_id = ['']
     try:
-        scan_workbench = Workbench(args.data, db_path=args.data / 'proxies.sqlite3')
+        scan_workbench = Workbench(args.data, db_path=args.data / 'proxies.sqlite3', conn=db)
     except (schema.DbError, sqlite3.Error, OSError):
         scan_workbench = None
 
@@ -7917,7 +8239,7 @@ def update_progress(values):
     update_progress(dict(phase='starting', checked=0, candidates=0))
 
     def export_now(*, run_state=None, diagnostic=False, selected=None):
-        # The published generation is a statement about one scope (F02): a row
+        # The published generation is a statement about one scope: a row
         # measured in another collection is not part of it.  Without
         # ``--collection`` the scope is the public base, exactly as before.
         from . import exportsvc  # imported here: it imports constants from this module
@@ -8049,47 +8371,70 @@ def run_scan(**options):
                                                target_inflight=args.judge_concurrency,
                                                expensive_probe=expensive_probe,
                                                job_store=scan_workbench.jobs() if scan_workbench else None,
-                                               job_id=current_job_id[0],
+                                               job_id=current_job_id[0] or None,
                                                run_state=state, **options), args.stop_file))
                 except (KeyboardInterrupt, asyncio.CancelledError):
                     scan_interrupted = True
                     state.update(state='partial', stop_reason='stopped')
                     last_scan_state = state
+                    # Paused, not left ``running``: a job that still looks live
+                    # refused every later run with E_CONFLICT_BUSY, and the same
+                    # command could not continue where this one stopped.
+                    if scan_workbench is not None:
+                        pause_scan_job(scan_workbench.jobs(), current_job_id[0])
                     raise
                 except Exception:
                     scan_interrupted = True
                     state.update(state='error', stop_reason='error')
                     last_scan_state = state
+                    if scan_workbench is not None:
+                        pause_scan_job(scan_workbench.jobs(), current_job_id[0])
                     raise
                 finally:
                     scan_in_progress = False
                 last_scan_state = state
                 return state
 
-            if scan_workbench is not None:
-                # One job per run, with its queue created up front: a stop in the
-                # middle leaves the unfinished items and the finished results
-                # both readable (defect 6, F11).
+            job_filters = dict(protocol=args.protocol, countries=sorted(countries),
+                               min_anonymity=args.min_anonymity, want=args.want,
+                               count_what=args.count_what)
+            job_budgets = dict(deadline_s=args.deadline or None,
+                               max_requests=args.max_requests or None,
+                               max_bytes=args.run_max_bytes or None)
+
+            def open_job(candidates, **extra):
                 current_job_id[0] = submit_scan_job(
                     scan_workbench, db, 'check', profile=profile, profile_revision=1,
                     collection_id=ensure_collection(db, args.collection or None),
-                    candidates=[value for (value,) in collection_candidates(
-                        db, ensure_collection(db, args.collection or None))],
-                    filters=dict(protocol=args.protocol, countries=sorted(countries),
-                                 min_anonymity=args.min_anonymity, want=args.want,
-                                 count_what=args.count_what),
-                    budgets=dict(deadline_s=args.deadline or None,
-                                 max_requests=args.max_requests or None,
-                                 max_bytes=args.run_max_bytes or None))
+                    candidates=candidates, filters=dict(job_filters, **extra),
+                    budgets=job_budgets, continue_interrupted=not extra)
                 print(tr(f'Задание: {current_job_id[0]}', f'job: {current_job_id[0]}'), flush=True)
-            last_scan_state = run_scan(recheck=args.recheck, recheck_passing=args.recheck_passing, want=args.want)
-            if scan_workbench is not None and current_job_id[0]:
+                return current_job_id[0]
+
+            def close_job():
+                if scan_workbench is None or not current_job_id[0]:
+                    return
                 from . import jobs as joblifecycle
-                job_store = scan_workbench.jobs()
                 state_now = last_scan_state or {}
-                terminal = 'succeeded' if state_now.get('state') == 'complete' else 'partial'
-                finish_scan_job(job_store, current_job_id[0], terminal,
-                                state_now.get('stop_reason') or joblifecycle.CODE_OK)
+                reason = state_now.get('stop_reason') or joblifecycle.CODE_OK
+                if state_now.get('state') == 'complete':
+                    terminal = 'succeeded'
+                elif reason == 'recheck_passing':
+                    # A re-check of the passing addresses is complete when its
+                    # own queue is; the items decide.
+                    terminal = None
+                else:
+                    terminal = 'partial'
+                finish_scan_job(scan_workbench.jobs(), current_job_id[0], terminal, reason)
+
+            if scan_workbench is not None:
+                # One job per run, with its queue created up front: a stop in the
+                # middle leaves the unfinished items and the finished results
+                # both readable, and the same command run again continues it.
+                open_job([value for (value,) in collection_candidates(
+                    db, ensure_collection(db, args.collection or None))])
+            last_scan_state = run_scan(recheck=args.recheck, recheck_passing=args.recheck_passing, want=args.want)
+            close_job()
             last_report = export_now(run_state=last_scan_state)
             update_progress(last_report)
             current_published = True
@@ -8102,14 +8447,22 @@ def run_scan(**options):
                 print(tr(f'Сохранено {last_report["exported"]}. Следующая перепроверка рабочих прокси через {args.watch:g} мин.', f'Saved {last_report["exported"]}. Next re-check of working proxies in {args.watch:g} min.'),
                       flush=True)
                 asyncio.run(stoppable(asyncio.sleep(args.watch * 60), args.stop_file))
-                last_scan_state = run_scan(recheck_passing=True)
+                # Every round is its own job.  Reusing the first run's job, which
+                # is closed by now, made every address look finished already, so
+                # a round measured nothing and republished the old verdicts.
+                current_job_id[0] = ''
+                last_scan_state = run_scan(
+                    recheck_passing=True,
+                    open_job=(lambda queue: open_job(queue, watch_round=True))
+                    if scan_workbench is not None else None)
+                close_job()
                 last_report = export_now(run_state=last_scan_state)
                 update_progress(last_report)
                 current_published = True
         elif args.command == 'export':
             profile = (args.data / 'last-profile.txt').read_text(encoding='utf-8').strip()
             # A selected slice is its own artifact and leaves the published
-            # pointer alone (defect 7), so the report is the only place the GUI
+            # pointer alone, so the report is the only place the GUI
             # learns where that artifact is.
             last_report = export_now(selected=allowed_proxies)
             update_progress(last_report)
diff --git a/proxy_workbench/reputation.py b/proxy_workbench/reputation.py
index e7abfd0..2019a00 100644
--- a/proxy_workbench/reputation.py
+++ b/proxy_workbench/reputation.py
@@ -183,7 +183,7 @@ def reverse_ip(address):
     """DNSBL query prefix for one address.
 
     IPv4 is reversed octet by octet.  IPv6 is reversed nibble by nibble into
-    the 32 dotted labels ``ip6.arpa`` expects (defect 14): the previous code
+    the 32 dotted labels ``ip6.arpa`` expects: the previous code
     reversed ``IPv6Address.exploded`` with the colons still inside it, which
     produces ``0:0`` labels no zone can ever answer, so every IPv6 lookup came
     back as a false "clean".  The single implementation lives in ``probes``.
@@ -207,7 +207,7 @@ async def _lookup_dnsbl(query, timeout):
 
 
 def _dnsbl_error_code(exc):
-    """Tell a quota/access refusal from a plain resolver failure (defect 14).
+    """Tell a quota/access refusal from a plain resolver failure.
 
     A resolver that answers "no such name" is NXDOMAIN and proves the address
     is not listed.  A resolver that answers "too many queries", "refused" or
@@ -283,7 +283,7 @@ def _zone_contracts(zones):
 
 
 async def check_dnsbl(address, zones, timeout, resolver=None, *, max_queries=None):
-    """Query every zone and report a distinct outcome per zone (defect 14).
+    """Query every zone and report a distinct outcome per zone.
 
     Each zone answers one of ``listed`` / ``clear`` / ``unknown``, and every
     ``unknown`` carries the code that explains it: ``DNSBL_ACCESS`` for a zone
@@ -317,8 +317,8 @@ async def screen_proxy(proxy, policy, denylist, resolver=None, *, max_queries=No
 
     ``clean`` is reachable only when *every* configured zone really answered
     ``clear``: one zone that said "access denied" or "quota exhausted" leaves
-    the address ``unknown``, because the address was never actually looked up
-    (defect 14).  The roll-up code names the first reason.
+    the address ``unknown``, because the address was never actually looked up.
+   The roll-up code names the first reason.
     """
     denylist = denylist or Denylist.empty()
     verdict = {
diff --git a/proxy_workbench/scheduler.py b/proxy_workbench/scheduler.py
index edbf52e..5c5dd59 100644
--- a/proxy_workbench/scheduler.py
+++ b/proxy_workbench/scheduler.py
@@ -172,7 +172,7 @@
 
 
 def message(code: str, *args: object) -> str:
-    """Localized text for a machine-readable code (CONTRACTS 5.4)."""
+    """Localized text for a machine-readable code."""
     ru, en = MESSAGES.get(code, (code, code))
     try:
         return i18n.tr(ru, en).format(*args)
@@ -186,7 +186,7 @@ def describe(code: str) -> tuple[str, str]:
 
 
 class ScheduleError(Exception):
-    """Configuration problem. `code` is a CONTRACTS 5.4 code, `field` names the offending key."""
+    """Configuration problem. `code` is a the shared contract code, `field` names the offending key."""
 
     def __init__(self, code: str, field_name: str, detail_ru: str, detail_en: str):
         self.code = code
@@ -1653,7 +1653,7 @@ def from_dict(cls, data: object) -> 'ScheduleState':
 
 @dataclass(frozen=True)
 class RunRequest:
-    """An instruction to run something. The job layer (F11) executes it.
+    """An instruction to run something. The job layer executes it.
 
     `run_id` is derived from the schedule and the planned instant, so a repeated
     tick produces the same id and the caller can treat it as idempotent.
@@ -1742,7 +1742,7 @@ def to_dict(self) -> dict:
 
 class ScheduleStore(Protocol):
     """Persistence seam. The module writes no DDL: an implementation stores what
-    `db.migrate()` already created (CONTRACTS 3.3, migration 7)."""
+    `db.migrate()` already created ."""
 
     def save_spec(self, spec: ScheduleSpec) -> None: ...
 
@@ -1797,8 +1797,8 @@ def recent_runs(self, schedule_id: str, limit: int = 10) -> list[dict]:
         return list(reversed(self.runs.get(schedule_id, [])))[:limit]
 
 
-#: Columns of migration 7 that this module needs but CONTRACTS 3.3 does not define yet.
-#: `db.py` owns the DDL; the request itself lives in docs/integration/HANDOFF/scheduler.md.
+#: Columns of migration 7 that this module needs but the shared contract does not define yet.
+#: `db.py` owns the DDL.
 REQUESTED_COLUMNS = {
     'schedules': ('last_run_at', 'paused', 'pause_reason', 'resume_at', 'dst_policy', 'catch_up',
                   'max_catch_up', 'wake_gap_s', 'power_json', 'notify_json', 'notifications_json',
@@ -1808,13 +1808,13 @@ def recent_runs(self, schedule_id: str, limit: int = 10) -> list[dict]:
 
 
 class SqliteScheduleStore:
-    """Adapter over the tables `db.migrate()` creates (CONTRACTS 3.3, migration 7).
+    """Adapter over the tables `db.migrate()` creates .
 
     It issues no DDL. Columns the contract does not define yet are used when
     present and ignored when absent, so the module works both before and after
     the migration gains them. `persists_runtime_state` and `persists_counters`
     say which case applies; until `counters_json` exists a restart restarts the
-    period counters, which is stated in the handoff rather than hidden here.
+    period counters.
     """
 
     def __init__(self, connection, table_prefix: str = ''):
@@ -2034,7 +2034,7 @@ class Scheduler:
     """Decides when a schedule may run and how much it may spend.
 
     The module never runs the work itself: a tick returns `RunRequest` objects
-    for the job layer (F11) to execute. A tick is a pure function of the current
+    for the job layer to execute. A tick is a pure function of the current
     time and the stored state, so the same instant always produces the same
     `run_id`.
     """
@@ -2193,7 +2193,7 @@ def resume(self, schedule_id: str, at: Optional[float] = None) -> Decision:
     def mark_wake(self, at: Optional[float] = None) -> float:
         """Tell the scheduler the machine just woke up. The next tick coalesces what is overdue.
 
-        The platform layer (F22) calls this when it sees a resume, so a wake is
+        The platform layer calls this when it sees a resume, so a wake is
         not guessed from a tick gap alone.
         """
         self._woke_pending = True
@@ -2481,7 +2481,7 @@ def persistence(self) -> dict:
         rather than quietly defaulted, and the caller can say so instead of
         claiming a limit that is not being enforced across a restart.  The module
         writes no DDL, so the fix belongs to the migrator that owns `schedules`
-        (HANDOFF/scheduler.md §1.1; the columns are in :data:`REQUESTED_COLUMNS`).
+        (the columns are in :data:`REQUESTED_COLUMNS`).
         """
         runtime = bool(getattr(self.store, 'persists_runtime_state', False))
         counters = bool(getattr(self.store, 'persists_counters', False))
diff --git a/proxy_workbench/secrets.py b/proxy_workbench/secrets.py
index 263119e..b1c67ef 100644
--- a/proxy_workbench/secrets.py
+++ b/proxy_workbench/secrets.py
@@ -1,6 +1,6 @@
 """Own proxy credentials: a vault-backed secret store, access identities and rotation.
 
-Implements F04. Contract references: CONTRACTS.ru.md §1.2(1) (an access is not an
+Implements F04. Contract references: the shared contract (an access is not an
 endpoint, so two passwords of one address are two access identities), §3.3
 migration 3 (the `accesses` table this module reads and writes, and only those
 columns), §5.1 (`upstream_credential` is a fourth identity, separate from
@@ -34,7 +34,7 @@
 from urllib.parse import quote, unquote, urlsplit
 
 # Access modes. NTLM, Kerberos, SOCKS4 password and HTTP Digest are out of scope
-# by contract (MASTER-PROMPT F04) and are refused explicitly, never silently.
+# by contract and are refused explicitly, never silently.
 MODE_NONE = 'none'
 MODE_HTTP_BASIC = 'http_basic'
 MODE_SOCKS5 = 'socks5'
@@ -57,7 +57,7 @@
 E_NOT_PROVIDED = 'E_SECRET_NOT_PROVIDED'
 E_AUTH_REQUIRED = 'E_SECRET_UPSTREAM_AUTH_REQUIRED'
 E_AUTH_FAILED = 'E_SECRET_UPSTREAM_AUTH_FAILED'
-# Not in the CONTRACTS §5.4 SECRET row yet; requested in the handoff.
+# An addition to the shared SECRET codes.
 E_VAULT_UNAVAILABLE = 'E_SECRET_VAULT_UNAVAILABLE'
 E_VALIDATION = 'E_VALIDATION_FIELD'
 E_CONFLICT = 'E_CONFLICT_REVISION'
@@ -73,7 +73,7 @@
 
 
 class SecretError(Exception):
-    """Base error. `code` is one of the E_* values from CONTRACTS §5.4."""
+    """Base error. `code` is one of the E_* values from the shared contract."""
 
     code = E_NOT_PROVIDED
 
@@ -82,7 +82,7 @@ def __init__(self, message, *, code=None, action=None, detail=None):
         self.message = message
         if code is not None:
             self.code = code
-        # Every useful error names the next step, not only its class (F25).
+        # Every useful error names the next step, not only its class.
         self.action = action
         self.detail = detail
 
@@ -567,7 +567,7 @@ def canonical(self):
     def url(self, resolved=None):
         """Canonical URL, with credentials only when a caller explicitly asks.
 
-        F04 and CONTRACTS §4.4: an exported or published row must never carry
+        F04 and the shared contract: an exported or published row must never carry
         userinfo, so the plain form is what every default caller gets. The
         userinfo form exists for a transport that needs it (httpx takes proxy
         credentials in the URL) and for an explicitly authorized secret export.
@@ -744,7 +744,7 @@ def classify_upstream(status=None, *, state=None, credentials_sent=False, detail
     """Turn an upstream outcome into one of the distinguishable F04 failures.
 
     Returns the error to raise, or None when the outcome is not a credential
-    problem. The four cases stay apart on purpose (MASTER-PROMPT F04): a proxy
+    problem. The four cases stay apart on purpose: a proxy
     that wants auth we did not send, a credential it rejected, a store we could
     not read, and a credential we never had.
     """
@@ -763,7 +763,7 @@ def classify_upstream(status=None, *, state=None, credentials_sent=False, detail
 
 
 # --------------------------------------------------------------------------- #
-# Access records (CONTRACTS §3.3, migration 3)
+# Access records 
 # --------------------------------------------------------------------------- #
 
 @dataclass(frozen=True)
@@ -967,7 +967,7 @@ def transport_credentials(access, resolved, *, scheme=None):
 def admission_key(access, access_revision):
     """The pair an observation must carry to stay valid.
 
-    CONTRACTS §1.2(1): a new `access_revision` is a different subject, so the old
+    the shared contract: a new `access_revision` is a different subject, so the old
     successful check cannot be read as evidence for the new credential.
     """
     return (access.id, int(access_revision))
@@ -1416,7 +1416,7 @@ def authorize_endpoint(policy, endpoint, *, resolver=None, resolved=()):
 def describe(access, *, state=None):
     """The only shape an access may take in a log line, an event or an API row.
 
-    CONTRACTS §4.4 and §5.6: `access_id` travels without the credential, and the
+    the shared contract: `access_id` travels without the credential, and the
     reference is an opaque random handle, not an encoded secret.
     """
     return {
diff --git a/proxy_workbench/servicecatalog.py b/proxy_workbench/servicecatalog.py
index 4d59aed..d5543f0 100644
--- a/proxy_workbench/servicecatalog.py
+++ b/proxy_workbench/servicecatalog.py
@@ -1,7 +1,6 @@
 """Service catalog: versioned service presets and the sets that combine them.
 
-Closes F06 (docs/requirements/MASTER-PROMPT.ru.md:178) and defect 24
-(MASTER-PROMPT.ru.md:136).  A preset states exactly what one HTTP probe proves.
+A preset states exactly what one HTTP probe proves.
 Three rules are enforced by the parser, not left to the author:
 
 * ``not_proved`` is mandatory and never empty, so no set title can promise calls,
@@ -12,7 +11,7 @@
 * Every set declares the complete field inventory of a scenario.  Anything not
   declared is a user field and is never touched, so switching from an Elite
   scenario to a video one cannot leave a judge, a strict flag or an anonymity
-  requirement behind (defect 24).
+  requirement behind.
 
 The catalog is data only.  It opens no socket, reads no database and writes no
 file: measurement belongs to ``probes.py`` and persistence to ``profiles.py``.
@@ -677,9 +676,9 @@ def _parse_service_set(raw, where, presets, scenario_fields, derived_fields, use
     if combination == 'at_least':
         if not 1 <= min_passes <= len(optional):
             _fail(tr(f'{where}.min_passes: от 1 до {len(optional)} для at_least; '
-                     f'K=0 и K>размера дают проход без измерений (F05)',
+                     f'K=0 и K>размера дают проход без измерений',
                      f'{where}.min_passes: 1..{len(optional)} for at_least; '
-                     f'K=0 and K>size would pass without measurements (F05)'))
+                     f'K=0 and K>size would pass without measurements'))
     elif combination == 'any' and not optional:
         _fail(tr(f'{where}: any при пустом дополнительном наборе даёт проход без измерений',
                  f'{where}: any with an empty optional set would pass without measurements'))
@@ -696,7 +695,7 @@ def _parse_service_set(raw, where, presets, scenario_fields, derived_fields, use
         _fail(tr(f'{where}.scenario: не заданы поля {missing}; набор обязан объявлять полный состав '
                  f'(дефект 24), иначе условия прошлого сценария останутся',
                  f'{where}.scenario: fields {missing} are not declared; a set must declare the full '
-                 f'field inventory (defect 24), otherwise the previous scenario survives'))
+                 f'field inventory, otherwise the previous scenario survives'))
     extra = sorted(set(scenario_raw) - expected)
     if extra:
         _fail(f'{where}.scenario: поля {extra} либо производные, либо принадлежат пользователю')
@@ -1299,7 +1298,7 @@ def new_user_set(catalog: Catalog, set_id: str, title_ru: str, title_en: str, pr
     copies of the presets, so a later catalog update leaves it untouched.  The
     caller owns persistence of the returned snapshot.  When ``required_ids`` is
     omitted the first selected service becomes mandatory, because a set with no
-    mandatory probe could pass without any measurement (F05).
+    mandatory probe could pass without any measurement.
     """
     presets = select_presets(catalog, preset_ids)
     if combination not in COMBINATION_IDS:
@@ -1318,7 +1317,7 @@ def new_user_set(catalog: Catalog, set_id: str, title_ru: str, title_en: str, pr
             raise CatalogError(tr(f'у поля {field!r} нет значения сброса в SCENARIO_DEFAULTS',
                                  f'field {field!r} has no reset value in SCENARIO_DEFAULTS'))
     if required_ids is None:
-        # A set with no mandatory probe could pass without any measurement (F05).
+        # A set with no mandatory probe could pass without any measurement.
         required = (presets[0].preset_id,)
         optional = tuple(preset.preset_id for preset in presets[1:])
     else:
diff --git a/proxy_workbench/source_adapters.py b/proxy_workbench/source_adapters.py
index e842eec..dd2a897 100644
--- a/proxy_workbench/source_adapters.py
+++ b/proxy_workbench/source_adapters.py
@@ -337,7 +337,8 @@ def _json_records(body, profile, page_context, limits):
     if not isinstance(container, list):
         raise AdapterError("SOURCE_JSON_SHAPE")
     if not container:
-        return dict(state="empty", records=[], rejects={}, pages=1, metadata={})
+        return _with_document(dict(state="empty", records=[], rejects={}, pages=1, metadata={}),
+                              data, page_context)
     default = cfg.get("default_protocol")
     default_list = _protocol(default, default=default) if isinstance(default, str) else []
     default_protocol = default_list[0] if default_list else None
@@ -414,6 +415,17 @@ def reject(reason):
     if truncated:
         result["truncated"] = True
         result["reason"] = "SOURCE_RECORD_LIMIT"
+    return _with_document(result, data, page_context)
+
+
+def _with_document(result, data, page_context):
+    """Hand the parsed document back when the caller asked for it.
+
+    The collector reads pagination from the same document; without it every
+    JSON page was decoded and parsed a second time.
+    """
+    if isinstance(page_context, dict) and page_context.get("keep_document"):
+        result["document"] = data
     return result
 
 
@@ -886,12 +898,15 @@ def _line(body, profile, page_context, limits):
         value = raw.strip()
         if not value or value.startswith("#"):
             continue
+        if "#" in value:
+            # "1.2.3.4:8080 # HTTP [ID]": a trailing comment is a note.
+            value = re.split(r"\s+#", value, maxsplit=1)[0]
         if first_token:
             # "address<tab>free-form note" is the one shape a line list uses;
             # only the leading token is the address.
             value = value.split(None, 1)[0]
         if legacy_kind == "http-fields":
-            match = re.fullmatch(r"(\d{1,3}(?:\.\d{1,3}){3}:\d{1,5}):[A-Za-z][A-Za-z .'-]*", value)
+            match = re.fullmatch(r"(\d{1,3}(?:\.\d{1,3}){3}:\d{1,5}):[^\W\d_](?:[^\W\d_]|[ .'-])*", value)
             if not match:
                 rejects["invalid_address"] = rejects.get("invalid_address", 0) + 1
                 continue
@@ -1054,11 +1069,17 @@ def next_page_url(base_url, page, profile, page_number):
             next_parsed = urlsplit(next_value)
             if (next_parsed.scheme, next_parsed.hostname) != (parsed.scheme, parsed.hostname):
                 raise AdapterError("SOURCE_PAGINATION_NEXT_INVALID")
-        next_path = urlsplit(next_value).path or "/"
+        next_parts = urlsplit(next_value)
+        next_path = next_parts.path or "/"
         prefix = config.get("path_prefix")
         if prefix and not next_path.startswith(str(prefix)):
             raise AdapterError("SOURCE_PAGINATION_NEXT_INVALID")
-        return urlunsplit((parsed.scheme, parsed.netloc, next_value if next_value.startswith("/") else "/" + next_value, urlencode(query), ""))
+        # Path and query of the link; an absolute link used to be pasted into
+        # the path whole ("/https://host/...").
+        if not next_path.startswith("/"):
+            next_path = "/" + next_path
+        return urlunsplit((parsed.scheme, parsed.netloc, next_path,
+                           next_parts.query if next_parts.query else urlencode(query), ""))
     else:
         raise AdapterError("SOURCE_PAGINATION_MODE_INVALID")
     return urlunsplit((parsed.scheme, parsed.netloc, parsed.path, urlencode(query), ""))
diff --git a/proxy_workbench/sourcedesk.py b/proxy_workbench/sourcedesk.py
index f795415..523dc7c 100644
--- a/proxy_workbench/sourcedesk.py
+++ b/proxy_workbench/sourcedesk.py
@@ -29,7 +29,7 @@
 comparison   :class:`Cohort`, :func:`compare_sources`, :func:`compare_suppliers`,
               :func:`compare_cohorts`, :func:`survival_across_windows`,
               :func:`provider_inventory`, :func:`wilson_interval`,
-              :func:`classify_measurement` (F21)
+              :func:`classify_measurement`
 """
 from __future__ import annotations
 
@@ -75,7 +75,7 @@
 
 
 class SourceDeskError(ValueError):
-    """A refused operation with a stable ``E_*`` code from CONTRACTS.ru.md 5.4."""
+    """A refused operation with a stable ``E_*`` code from the shared contract."""
 
     def __init__(self, code, message):
         super().__init__(message)
@@ -351,7 +351,7 @@ def user_source(*, binding_id, url, name=None, source_format='text', headers=Non
 
 
 # --------------------------------------------------------------------------
-# Supported subscription imports (F27)
+# Supported subscription imports
 # --------------------------------------------------------------------------
 #
 # A Clash or sing-box document is data, never a program.  Only the endpoint
@@ -1140,7 +1140,7 @@ def plan_refresh(state, result, *, policy=None, now=None, foreign=()):
 
     1. a failure never removes a membership and never moves last-good;
     2. an empty body never removes a membership either -- a working collection
-       survives an empty update (F27 acceptance);
+       survives an empty update;
     3. a truncated (``partial``) fetch never removes a membership, because a
        truncated document cannot prove that an endpoint is gone;
     4. a removal only ever drops the rows *this* source owns, so an endpoint
@@ -1257,7 +1257,7 @@ def _code_for_outcome(outcome):
 @dataclass(frozen=True)
 class RotationPlan:
     """A credential change.  The new revision invalidates exactly the proofs
-    that were made with the old one (CONTRACTS 1.2(1), F04)."""
+    that were made with the old one."""
 
     source_id: str
     collection_id: str
@@ -1694,7 +1694,7 @@ def apply_import(self, result, *, source_id, collection_id, mode='merge', now=0.
 
 
 # --------------------------------------------------------------------------
-# Comparison of sources and suppliers (F21)
+# Comparison of sources and suppliers
 # --------------------------------------------------------------------------
 #
 # Everything in this section is read back out of the rows this application
diff --git a/proxy_workbench/ui/app.js b/proxy_workbench/ui/app.js
index 1a3e62d..a58192c 100644
--- a/proxy_workbench/ui/app.js
+++ b/proxy_workbench/ui/app.js
@@ -457,7 +457,7 @@ const messages = {
     'cat.shown': 'Showing {shown} of {total}',
     'cat.empty': 'Nothing matches these filters.',
     'cat.loading': 'Loading the catalog…',
-    // Service catalog and sets (F06)
+    // Service catalog and sets
     'svc.title': 'Service catalog',
     'svc.lead': 'Every service names its id, version, maintainer, real probe and pass condition. A set is a rule over services: all, any, at least K, or only the required ones.',
     'svc.open': 'Open catalog',
@@ -522,7 +522,7 @@ const messages = {
     'svc.capability': 'Proves',
     'svc.ruleLabel': 'Rule: {rule}, minimum {min}',
     'svc.loadFailed': 'The service catalog could not be read',
-    // Collections: the scope of a check and of the results view (F02)
+    // Collections: the scope of a check and of the results view
     'col.title': 'Collections and the scope of the check',
     'col.lead': 'The public base, the migrated list and your own lists are separate lists. The scope decides which of them a check measures and which rows the results table shows; nothing is ever copied from one list into another.',
     'col.scope': 'Scope of the check',
@@ -937,7 +937,7 @@ const messages = {
     'help.pipelineBadge': 'WORKFLOW',
     'region.cis': '🌐 CIS',
 
-    // --- import with a preview (F03), pools, schedules, keys, storage ---
+    // --- import with a preview, pools, schedules, keys, storage ---
     'nav.pools': 'Pools & Schedules',
     'nav.keys': 'API Keys',
     'common.cancel': 'Cancel',
@@ -1758,7 +1758,7 @@ const messages = {
     'cat.shown': 'Показано {shown} из {total}',
     'cat.empty': 'По этим фильтрам ничего нет.',
     'cat.loading': 'Каталог загружается…',
-    // Каталог сервисов и наборы (F06)
+    // Каталог сервисов и наборы
     'svc.title': 'Каталог сервисов',
     'svc.lead': 'У каждого сервиса указаны идентификатор, версия, кто ведёт определение, реальная проба и условие прохождения. Набор — это правило над сервисами: все, любой, не менее K или только обязательные.',
     'svc.open': 'Открыть каталог',
@@ -1823,7 +1823,7 @@ const messages = {
     'svc.capability': 'Доказывает',
     'svc.ruleLabel': 'Правило: {rule}, минимум {min}',
     'svc.loadFailed': 'Каталог сервисов не прочитан',
-    // Коллекции: область проверки и таблицы результатов (F02)
+    // Коллекции: область проверки и таблицы результатов
     'col.title': 'Коллекции и область проверки',
     'col.lead': 'Публичная база, перенесённый список и ваши собственные списки — это разные списки. Область решает, какой из них измеряет проверка и какие строки показывает таблица результатов; ничего не копируется из одного списка в другой.',
     'col.scope': 'Область проверки',
@@ -2237,7 +2237,7 @@ const messages = {
     'help.pipelineBadge': 'ПРОЦЕСС',
     'region.cis': '🌐 СНГ',
 
-    // --- импорт с предпросмотром (F03), пулы, расписания, ключи, хранение ---
+    // --- импорт с предпросмотром, пулы, расписания, ключи, хранение ---
     'nav.pools': 'Пулы и расписания',
     'nav.keys': 'Ключи API',
     'common.cancel': 'Отмена',
@@ -2681,6 +2681,10 @@ async function setLang(code) {
   if (!ok) { toast(t('error.langPack'), true); return; }
   lang = code;
   try { localStorage.setItem(LANG_KEY, lang); } catch {}
+  repaintLanguage();
+}
+
+function repaintLanguage() {
   renderLang();
   // Re-render the dynamic areas that cache translated strings.
   try { renderState(state); } catch (e) { console.error(e); }
@@ -2691,6 +2695,17 @@ async function setLang(code) {
   if (detailRow) { try { renderDetails(detailRow); } catch (e) { console.error(e); } }
 }
 
+// A saved or system language outside `messages` lives in a lazy pack.  It has
+// to be loaded at start too, or after a restart the page claims that language
+// while every string falls back to English.
+function loadStartLanguage() {
+  if (langDict(lang)) return;
+  ensureLangPack(lang).then(ok => {
+    if (!ok) lang = 'en';
+    repaintLanguage();
+  });
+}
+
 function buildLangMenu() {
   const menu = $('lang-menu');
   if (!menu) return;
@@ -4590,7 +4605,7 @@ function snapshotTime(value) {
 }
 
 // ---------------------------------------------------------------------------
-// Live feed: real measurement events (defect 25, R17)
+// Live feed: real measurement events
 // ---------------------------------------------------------------------------
 // The previous implementation searched the aggregated scan log for
 // OK/PASS/FAIL.  That text is a progress summary: it does not say which proxy
@@ -4837,7 +4852,7 @@ function renderState(value) {
 
   // Live ticker: real measurement events, never a regex over the log.
   // The log is an aggregate progress text; a line that happens to contain
-  // "OK" says nothing about which proxy was measured (defect 25, R17).
+  // "OK" says nothing about which proxy was measured.
   renderLiveFeed(value);
 
   const passedCount = progress.passed ?? exportReport.passed ?? 0;
@@ -5413,6 +5428,10 @@ function renderResults(data) {
       await bulkAction('recheck', {scope: 'selected', proxies: [btn.dataset.recheckProxy], button: btn});
     });
   }
+
+  // The rows were just rebuilt, so the hidden columns have to be hidden in the
+  // new cells too; otherwise the cells slide under the wrong headers.
+  applyColumns(resultState.columns);
 }
 
 let pendingLoadResults = false;
@@ -6470,7 +6489,7 @@ async function downloadFile(name, node) {
 document.querySelectorAll('[data-download]').forEach(node => node.onclick = () => downloadFile(node.dataset.download, node));
 
 // ---------------------------------------------------------------------------
-// Result list: views, scopes, bulk actions, tags, saved views, matrix (F19)
+// Result list: views, scopes, bulk actions, tags, saved views, matrix
 // ---------------------------------------------------------------------------
 const COLUMN_LABELS = {
   check: 'col.check', num: 'col.num', proxy: 'col.proxy', score: 'col.quality', latency: 'col.latency',
@@ -6762,7 +6781,7 @@ function renderSavedViews(views) {
 }
 
 // ---------------------------------------------------------------------------
-// Connection path (F17)
+// Connection path
 // ---------------------------------------------------------------------------
 function splitGatewayAddress(address) {
   // The listener may sit on an IPv6 literal, so the host is the part before the
@@ -6851,7 +6870,7 @@ function renderConnectPath(value) {
     if (binding.generation) shown.push(String(binding.generation).replace(/^\.generation-/, '').slice(0, 12));
     if (binding.state) shown.push(binding.state);
     // ``state_detail`` is a machine value; the page says the reason in words
-    // and keeps the code beside it (CONTRACTS §5.4).  Defect 3: "nothing
+    // and keeps the code beside it.  Defect 3: "nothing
     // matched" and "everything expired" must not read the same.
     if (binding.state_detail) {
       const label = binding.state_detail_label;
@@ -7062,7 +7081,7 @@ function renderLang() {
     renderCollections({collections: collectionsState.items, selected: collectionsState.selected});
   }
 }
-// Scenario presets with an explicit, complete field set (defect 24, R17).
+// Scenario presets with an explicit, complete field set.
 //
 // A scenario used to change only some fields, so the judge, the DNSBL zones,
 // the strict flag and the anonymity minimum of the previous scenario survived
@@ -7923,7 +7942,7 @@ function setupCatalogListeners() {
   }
 }
 
-// Collections (F02): the scope of a check and of the results view.
+// Collections: the scope of a check and of the results view.
 //
 // A collection is a named list of addresses in the local database.  The public
 // base, the migrated list and a personal list are different rows, so choosing
@@ -8157,7 +8176,7 @@ function setupCollectionListeners() {
   }
 }
 
-// Service catalog (F06): versioned definitions, sets, and the user's own set.
+// Service catalog: versioned definitions, sets, and the user's own set.
 //
 // A preset carries its probes and its pass condition, so the page never claims
 // a service works because a request merely answered.  A set is a rule over
@@ -8536,7 +8555,7 @@ function setupServiceCatalogListeners() {
 }
 
 // ---------------------------------------------------------------------------
-// Import with a preview (F03)
+// Import with a preview
 //
 // The own-list box writes membership straight through the collections route,
 // so a file never reached `importer.preview`/`importer.commit`: there was no
@@ -8829,7 +8848,7 @@ function setupImportListeners() {
 }
 
 // ---------------------------------------------------------------------------
-// Pools and schedules (F14, F15)
+// Pools and schedules
 // ---------------------------------------------------------------------------
 
 let poolsState = {pools: [], selected: null, collections: [], profiles: []};
@@ -9168,7 +9187,7 @@ function setupScheduleListeners() {
 }
 
 // ---------------------------------------------------------------------------
-// Jobs (F11): the durable record of a run
+// Jobs: the durable record of a run
 // ---------------------------------------------------------------------------
 //
 // A button is enabled only from a state the action is legal from, so the page
@@ -9415,7 +9434,7 @@ function setupGatewayBindingListeners() {
 }
 
 // ---------------------------------------------------------------------------
-// API keys (F29)
+// API keys
 // ---------------------------------------------------------------------------
 
 let keysState = {view: null, permissions: [], groups: {}};
@@ -9579,8 +9598,9 @@ function keyAdminSecret() {
 async function loadKeys() {
   const secret = keyAdminSecret();
   try {
-    const query = secret ? '?admin_secret=' + encodeURIComponent(secret) : '';
-    renderKeys(await api('/api/api-keys' + query));
+    // The secret goes in the request body, never in the URL.
+    renderKeys(secret ? await api('/api/api-keys/list', {admin_secret: secret})
+                      : await api('/api/api-keys'));
   } catch (error) {
     toast(error.message, true);
   }
@@ -9794,7 +9814,7 @@ try { setupKeyListeners(); } catch (e) { console.error(e); }
 try { setupCatalogListeners(); } catch (e) { console.error(e); }
 try { setupScopeDialog(); } catch (e) { console.error(e); }
 // ---------------------------------------------------------------------------
-// Diagnostics (F10): the funnel, the one reason, and the local bundle
+// Diagnostics: the funnel, the one reason, and the local bundle
 // ---------------------------------------------------------------------------
 
 let diagState = {view: null, bundleText: ''};
@@ -9951,7 +9971,7 @@ function setupDiagnosticsListeners() {
 }
 
 // ---------------------------------------------------------------------------
-// The background layer (F22)
+// The background layer
 // ---------------------------------------------------------------------------
 
 let deskState = {view: null};
@@ -10058,6 +10078,7 @@ function setupDesktopListeners() {
 
 
 try { renderLang(); } catch (e) { console.error(e); }
+try { loadStartLanguage(); } catch (e) { console.error(e); }
 try { renderSavedViews(resultState.views); } catch (e) { console.error(e); }
 requestAnimationFrame(updateSegmentedGlider);
 setTimeout(updateSegmentedGlider, 100);
diff --git a/proxy_workbench/ui/index.html b/proxy_workbench/ui/index.html
index 6900fe2..b250691 100644
--- a/proxy_workbench/ui/index.html
+++ b/proxy_workbench/ui/index.html
@@ -273,7 +273,7 @@ <h2>
             <div class="quick-services-chips" id="quick-services-chips"></div>
           </section>
 
-          <!-- Service catalog: versioned service definitions and ready sets (F06) -->
+          <!-- Service catalog: versioned service definitions and ready sets -->
           <section class="card catalog-card service-catalog-card" id="service-catalog">
             <div class="card-title">
               <div class="geo-title-wrap">
@@ -1490,7 +1490,7 @@ <h2 data-i18n="own.title">Add your own list</h2>
         </section>
       </div>
 
-      <!-- Import with a preview (F03): the file path, not the paste path -->
+      <!-- Import with a preview: the file path, not the paste path -->
       <section class="card catalog-card" id="import-card">
         <div class="card-title">
           <div class="geo-title-wrap">
@@ -1561,7 +1561,7 @@ <h3 data-i18n="imp.mapping">Which column is which</h3>
         <div class="catalog-detail" id="import-history" hidden></div>
       </section>
 
-      <!-- Collections: the scope of a check and of the results view (F02) -->
+      <!-- Collections: the scope of a check and of the results view -->
       <section class="card catalog-card" id="collections">
         <div class="card-title">
           <div class="geo-title-wrap">
@@ -1852,7 +1852,7 @@ <h2 data-i18n="sched.title">Schedules</h2>
         <p class="hint" id="sched-persistence"></p>
       </section>
 
-      <!-- Jobs: structured progress and a gapless event stream (F11) -->
+      <!-- Jobs: structured progress and a gapless event stream -->
       <section class="card catalog-card" id="jobs-card">
         <div class="card-title">
           <div class="geo-title-wrap">
@@ -2320,7 +2320,7 @@ <h2 data-i18n="help.manageData">Storage Maintenance</h2>
           <button class="button danger full" id="clear-data" data-action="clear-data" data-i18n="help.clear">Delete local results</button>
           <p class="hint" data-i18n="help.clearHint">Deletes the database, profiles and exports but keeps settings and the denylist. Local results cannot be restored.</p>
 
-          <!-- What a cleanup removes, before it removes it (F24) -->
+          <!-- What a cleanup removes, before it removes it -->
           <div class="maint-block" id="cleanup-preview-box" hidden>
             <h3 data-i18n="maint.previewTitle">What will be deleted</h3>
             <div class="maint-list" id="cleanup-preview-list"></div>
@@ -2333,7 +2333,7 @@ <h3 data-i18n="maint.previewTitle">What will be deleted</h3>
         </section>
       </div>
 
-      <!-- Retention, restore and the data folder: every one describes first (F24) -->
+      <!-- Retention, restore and the data folder: every one describes first -->
       <section class="card" id="retention-card">
         <div class="card-title">
           <div class="geo-title-wrap">
@@ -2419,7 +2419,7 @@ <h3 data-i18n="maint.moveTitle">Move the data folder</h3>
         </div>
       </section>
 
-      <!-- Why there is nothing to show, and what to do about it (F10) -->
+      <!-- Why there is nothing to show, and what to do about it -->
       <section class="card catalog-card" id="diagnostics-card">
         <div class="card-title">
           <div class="geo-title-wrap">
diff --git a/proxy_workbench/ui/style.css b/proxy_workbench/ui/style.css
index 95202ef..7b0d3e4 100644
--- a/proxy_workbench/ui/style.css
+++ b/proxy_workbench/ui/style.css
@@ -3326,7 +3326,7 @@ tbody tr:hover td.td-num {
 }
 
 /* The full re-check is offered next to the quick test, not inside it: the
-   quick test is diagnostic and never refreshes the stored row (defect 23). */
+   quick test is diagnostic and never refreshes the stored row. */
 .recheck-btn {
   width: 26px;
   height: 26px;
@@ -8099,7 +8099,7 @@ td.empty {
 }
 
 /* ==========================================================================
-   Result list: views, scopes, bulk actions, columns, matrix, history (F19)
+   Result list: views, scopes, bulk actions, columns, matrix, history
    Same cards, chips and buttons as the rest of the interface; only the new
    controls are added here.
    ========================================================================== */
@@ -8401,7 +8401,7 @@ td.empty {
 }
 
 /* ==========================================================================
-   Connection path (F17)
+   Connection path
    ========================================================================== */
 
 .connect-card {
@@ -8804,7 +8804,7 @@ td.empty {
   }
 }
 
-/* Service catalog (F06) and collections (F02).
+/* Service catalog and collections.
    Same tokens, same density and the same catalog shapes as the source catalog
    above: a service row is a list row, and a definition diff is a table. */
 .service-catalog-card .catalog-filters {
@@ -16447,7 +16447,7 @@ tbody tr:nth-child(even) td,
   font-size: 12px;
   vertical-align: middle;
   border-bottom: 1px solid var(--pw-bold-hairline, rgba(255, 255, 255, 0.05)) !important;
-  color: #cbd5e1;
+  color: var(--ink-secondary, #cbd5e1);
 }
 
 .results-table tbody tr:last-child td {
@@ -22241,7 +22241,7 @@ summary {
 }
 
 /* ═══════════════════════════════════════════════════════════════════════════
-   ALIGNMENT & TYPOGRAPHY HUNT — 2026-09-26 (round 8, Gemini)
+   ALIGNMENT & TYPOGRAPHY HUNT — 2026-09-26
    Button height tiers (28/34/40), baseline-locked captions and unit badges,
    gauge/stat-tile centering, hardened text blocks. Verified visually.
    ═══════════════════════════════════════════════════════════════════════════ */
diff --git a/pyproject.toml b/pyproject.toml
index beb8a89..84fa8c1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 name = "proxy-workbench"
 # Must equal proxy_workbench.branding.PRODUCT_VERSION: the binary advertised one
 # number and the wheel another.
-version = "2.3.0"
+version = "3.0.0"
 description = "Collect free public proxies and keep only the ones that work for your services: local GUI + CLI checker for HTTP, HTTPS and SOCKS5"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/tests/fixtures/admission.py b/tests/fixtures/admission.py
index fd2d9f7..7ccbe52 100644
--- a/tests/fixtures/admission.py
+++ b/tests/fixtures/admission.py
@@ -1,4 +1,4 @@
-"""Shared admission fixture for every module's tests (CONTRACTS §2.3, HANDOFF §2.1).
+"""Shared admission fixture for every module's tests.
 
 Seventeen modules work against one admission contract, so they must work against
 one fixture too. Import this instead of assembling an observation row by hand --
@@ -23,8 +23,7 @@
 here are the `E_*` ones and :data:`REASON_ALIASES` translates the §2.4 spelling.
 Two literals are *not* error codes and are marked as such below: ``admitted`` for an
 included row (no positive code exists in §5.4) and ``blocked`` for a policy denial
-that happens before admission. Both are open questions for the integrator; see
-``docs/integration/HANDOFF/db.md``.
+that happens before admission.
 """
 from __future__ import annotations
 
diff --git a/tests/pools_support.py b/tests/pools_support.py
index ab215a1..3373285 100644
--- a/tests/pools_support.py
+++ b/tests/pools_support.py
@@ -1,6 +1,6 @@
 """Shared fixtures for the pools tests.
 
-The pool tables belong to ``db.py`` (CONTRACTS §3.3 migration 7), and the
+The pool tables belong to ``db.py``, and the
 contract says a module reaches its schema through ``db.migrate()`` instead of
 declaring DDL, so every test here migrates a temporary database with the real
 migrator and works with what it created.
diff --git a/tests/test_acceptance.py b/tests/test_acceptance.py
index 24f1938..c31cb25 100644
--- a/tests/test_acceptance.py
+++ b/tests/test_acceptance.py
@@ -1,4 +1,4 @@
-"""Full cross-surface acceptance (MASTER-PROMPT §7).
+"""Full cross-surface acceptance.
 
 Every test here drives the *product*: the engine writes rows through its own
 ``store()``, the export goes through the snapshot service, the API answers over
@@ -334,7 +334,7 @@ def test_a_credentialed_endpoint_is_never_put_in_a_public_artifact(self):
         rows = api.Exports(self.home / 'exports').load()[0]
         self.assertNotIn(canary, json.dumps(rows))
         # Changing the access revision is a different row: the previous verdict
-        # is not inherited by the new password (F04, CONTRACTS §1.2 rule 1).
+        # is not inherited by the new password.
         row = measured_row(address, checked_at=self.now)
         store_result(self.db, (PROFILE, address, json.dumps(row)), access_id='acc-1',
                      access_revision=2, max_age_seconds=p.MIN_FRESHNESS_SECONDS)
@@ -363,7 +363,7 @@ def test_a_re_export_cannot_move_a_measurement_time(self):
         after = json.loads(self.db.execute(
             'SELECT payload FROM results WHERE profile=? AND proxy=?', (PROFILE, first)).fetchone()[0])
         self.assertEqual((after['checked_at'], after['valid_until']), before,
-                         'the lifetime was written at measurement time (defect 1, R01)')
+                         'the lifetime was written at measurement time')
 
     def test_one_expired_row_does_not_empty_the_set(self):
         fresh = self.address('http://11.6.6.1:80')
@@ -421,7 +421,7 @@ def test_exporting_selected_rows_does_not_switch_the_active_pool(self):
         self.assertEqual(selection['kind'], 'selection')
         self.assertEqual(_text_list(selection), [keep])
         self.assertEqual(p.current_generation_name(self.home / 'exports'), before,
-                         'the active pool did not move (defect 7, R04)')
+                         'the active pool did not move')
         _server, client = self.serve()
         self.assertEqual(client.get('/proxies').json()['count'], 2,
                          'the rest of the results is not hidden')
@@ -601,7 +601,7 @@ def test_a_protected_export_needs_its_own_permission(self):
         """``export.secret`` is a separate right, not a variation of read.
 
         Even a full administrator does not hold it: a secret in an artifact is
-        the one thing that must be asked for by name (CONTRACTS §5.2).
+        the one thing that must be asked for by name.
         """
         body = {'collection_id': 'public-base', 'include_secrets': True, 'kind': 'diagnostic'}
         denied = self.call('POST', '/v1/exports', key=self.reader_secret, body=body,
@@ -780,7 +780,7 @@ def test_expired_and_unknown_rows_are_reachable_by_name(self):
         undeclared ``freshness`` parameter meant both flags were ignored and a
         row that expired after publication could never be asked for.  The set
         itself stays alive because a newer member's lifetime is the set's
-        lifetime (CONTRACTS §2.2, defect 3) -- that is what makes a mixed-age
+        lifetime -- that is what makes a mixed-age
         answer possible at all.
         """
         short = 'http://11.11.11.2:80'
diff --git a/tests/test_anonymity.py b/tests/test_anonymity.py
index fab371e..48d48fb 100644
--- a/tests/test_anonymity.py
+++ b/tests/test_anonymity.py
@@ -16,7 +16,7 @@
 from proxy_workbench.reputation import result_allowed
 
 #: A result fixture describes a measurement that just happened; the
-#: admission contract has no "fresh forever" state (CONTRACTS §2.4).
+#: admission contract has no "fresh forever" state.
 _NOW = time.time()
 
 # Synthetic public address standing in for "this machine"; no traffic leaves loopback.
diff --git a/tests/test_api.py b/tests/test_api.py
index 464d82d..3f0de9b 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -13,7 +13,7 @@
 from proxy_workbench import proxytool as p
 
 #: A result fixture describes a measurement that just happened; the
-#: admission contract has no "fresh forever" state (CONTRACTS §2.4).
+#: admission contract has no "fresh forever" state.
 _NOW = time.time()
 
 
@@ -123,7 +123,7 @@ def test_snapshot_contract_ttl_and_deleted_current_file(self):
             # A generation carries a manifest with a checksum per file.  Editing
             # one after publication is not "an expired snapshot", it is a
             # publication that no longer verifies, and the reader refuses it
-            # instead of serving what it finds (CONTRACTS §4.2, defect 9).
+            # instead of serving what it finds.
             ranked = json.loads(ranked_path.read_text(encoding='utf-8'))
             for row in ranked:
                 row['valid_until'] = time.time() - 1
@@ -153,7 +153,7 @@ def test_legacy_status_is_partial_instead_of_contradictory(self):
         self.assertEqual(len(rows), 1)
         # A pre-generation installation has no scope counts of its own, so the
         # state says "partial" instead of claiming a completed export it cannot
-        # prove (CONTRACTS §4.3).
+        # prove.
         self.assertEqual(status['state'], 'partial')
         self.assertEqual(status['stop_reason'], 'legacy')
         self.assertIsNone(status['scope_candidates'])
diff --git a/tests/test_api_audit_regressions.py b/tests/test_api_audit_regressions.py
new file mode 100644
index 0000000..70f10a5
--- /dev/null
+++ b/tests/test_api_audit_regressions.py
@@ -0,0 +1,282 @@
+"""Regressions found by calling every /v1 operation on a real loopback server.
+
+Everything runs on 127.0.0.1 against a temporary data folder whose rows use the
+RFC 5737 documentation ranges; nothing is fetched and no proxy is contacted.
+"""
+from __future__ import annotations
+
+import json
+import shutil
+import threading
+import time
+import unittest
+import uuid
+
+import httpx
+
+from proxy_workbench import api, apikeys, apiv1, exportsvc, proxytool
+from tests import web_support as ws
+
+ADDRESSES = ['192.0.2.%d' % i for i in range(1, 9)] + ['198.51.100.%d' % i for i in range(1, 5)]
+
+
+def rows():
+    now = time.time()
+    protocols = ('http', 'socks5', 'https', 'socks4')
+    countries = ('DE', 'US', 'NL', 'FR')
+    return [ws.measurement(f'{protocols[i % 4]}://{address}:{8000 + i}', latency=50 + i * 30,
+                           age=30 + i, now=now, country=countries[i % 4])
+            for i, address in enumerate(ADDRESSES)]
+
+
+def build(min_success=2 / 3):
+    home = ws.build_data(rows(), publish=False)
+    conn = proxytool.open_db(home / 'proxies.sqlite3')
+    try:
+        proxytool.export(conn, ws.profile_id(), home / 'exports', collection_id='public-base',
+                         min_success=min_success, active_profile_path=home / 'last-profile.txt')
+    finally:
+        conn.close()
+    return home
+
+
+class LiveServerCase(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.home = build()
+        manager = api.key_manager(cls.home)
+        try:
+            issued = manager.bootstrap_admin(local_trusted=True, name='admin',
+                                             permissions=sorted(apikeys.PERMISSIONS))
+            cls.admin = issued.secret
+        finally:
+            manager.conn.close()
+        cls.server = api.make_api_server(cls.home, '127.0.0.1', 0)
+        cls.thread = threading.Thread(target=cls.server.serve_forever, daemon=True)
+        cls.thread.start()
+        cls.base = f'http://127.0.0.1:{cls.server.server_port}'
+        cls.client = httpx.Client(base_url=cls.base, trust_env=False, timeout=30)
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.client.close()
+        cls.server.shutdown()
+        cls.server.server_close()
+        cls.thread.join(5)
+        shutil.rmtree(cls.home, ignore_errors=True)
+
+    def call(self, method, path, body=None, token=None, params=None, headers=None):
+        sent = {'Authorization': 'Bearer ' + (token or self.admin)}
+        if method in ('POST', 'PATCH', 'DELETE'):
+            sent['Idempotency-Key'] = uuid.uuid4().hex
+        sent.update(headers or {})
+        return self.client.request(method, path, json=body, params=params, headers=sent)
+
+    def key(self, permissions, **extra):
+        response = self.call('POST', '/v1/keys', {'name': 'k-' + uuid.uuid4().hex[:6],
+                                                  'permissions': permissions, **extra})
+        self.assertEqual(response.status_code, 200, response.text)
+        return response.json()['secret']
+
+
+class ResultsTests(LiveServerCase):
+    def proxies(self, response):
+        self.assertEqual(response.status_code, 200, response.text)
+        return [row['proxy'] for row in response.json()['items']]
+
+    def test_following_the_cursor_walks_every_row_once(self):
+        seen, cursor = [], None
+        for _ in range(20):
+            params = {'limit': 5, **({'cursor': cursor} if cursor else {})}
+            body = self.call('GET', '/v1/results', params=params).json()
+            seen += [row['proxy'] for row in body['items']]
+            cursor = body.get('next_cursor')
+            if not cursor:
+                break
+        everything = self.proxies(self.call('GET', '/v1/results'))
+        self.assertEqual(seen, everything)
+        self.assertEqual(len(set(seen)), len(ADDRESSES))
+
+    def test_declared_filters_are_applied(self):
+        fast = self.call('GET', '/v1/results', params={'max_latency_ms': 100}).json()['items']
+        self.assertTrue(fast)
+        self.assertTrue(all(row['latency_ms'] <= 100 for row in fast))
+        self.assertEqual(self.proxies(self.call('GET', '/v1/results',
+                                                params={'collection_id': 'nope'})), [])
+        self.assertEqual(self.proxies(self.call('GET', '/v1/results',
+                                                params={'anonymity': 'elite'})), [])
+        self.assertEqual(self.call('GET', '/v1/results',
+                                   params={'generation': '.generation-other'}).status_code, 404)
+
+    def test_sort_orders_the_rows(self):
+        rows = self.call('GET', '/v1/results', params={'sort': 'speed'}).json()['items']
+        latencies = [row['latency_ms'] for row in rows]
+        self.assertEqual(latencies, sorted(latencies))
+
+    def test_count_is_honoured_by_random_and_top(self):
+        self.assertEqual(len(self.call('GET', '/v1/results/random',
+                                       params={'count': 4}).json()['items']), 4)
+        self.assertEqual(len(self.call('GET', '/v1/results/top',
+                                       params={'count': 2}).json()['items']), 2)
+
+    def test_selection_accepts_host_and_port(self):
+        first = self.proxies(self.call('GET', '/v1/results'))[0]
+        picked = self.proxies(self.call('GET', '/v1/results/selection',
+                                        params={'endpoint_ids': first.partition('://')[2]}))
+        self.assertEqual(picked, [first])
+
+    def test_country_filter_does_not_open_a_connection_per_row(self):
+        opened = []
+        original = api.WorkbenchService.workbench
+
+        def counting(service):
+            opened.append(1)
+            return original(service)
+        with unittest.mock.patch.object(api.WorkbenchService, 'workbench', counting):
+            rows = self.call('GET', '/v1/results', params={'country': 'DE'}).json()['items']
+        self.assertTrue(rows)
+        self.assertLessEqual(len(opened), 1)
+
+
+class TransportTests(LiveServerCase):
+    def test_localhost_host_header_reaches_v1(self):
+        response = self.call('GET', '/v1/service', headers={'Host': 'localhost'})
+        self.assertEqual(response.status_code, 200, response.text)
+
+    def test_unsupported_method_is_a_documented_405(self):
+        response = self.client.put('/v1/keys', headers={'Authorization': 'Bearer ' + self.admin})
+        self.assertEqual(response.status_code, 405)
+        self.assertEqual(response.json()['error']['code'], 'E_VALIDATION_METHOD')
+
+    def test_legacy_reads_refuse_other_methods(self):
+        for method in ('POST', 'DELETE', 'PATCH'):
+            response = self.client.request(method, '/proxies', content=b'{}')
+            self.assertEqual(response.status_code, 405, method)
+            self.assertIn('GET', response.headers['Allow'])
+
+    def test_event_streams_carry_frames(self):
+        job = self.call('POST', '/v1/checks/collect', {'collection_id': 'public-base'}).json()
+        store = api.WorkbenchService(self.home)._job_store()
+        try:
+            store[0].emit(job['job_id'], 'job.note', data={'n': 1})
+            store[1].commit()
+        finally:
+            store[1].close()
+        response = self.call('GET', f'/v1/jobs/{job["job_id"]}/events')
+        self.assertEqual(response.status_code, 200)
+        self.assertIn('event: job.note', response.text)
+        system = self.call('GET', '/v1/events')
+        self.assertEqual(system.status_code, 200)
+        frames = [json.loads(line[6:]) for line in system.text.splitlines()
+                  if line.startswith('data: ')]
+        self.assertTrue(frames)
+        self.assertNotIn('error', [frame['type'] for frame in frames])
+        last_id = [line[4:] for line in system.text.splitlines() if line.startswith('id: ')][-1]
+        resumed = self.call('GET', '/v1/events', params={'cursor': last_id})
+        self.assertEqual(resumed.status_code, 200, resumed.text)
+
+
+class ScopeAndKeyTests(LiveServerCase):
+    def test_scoped_key_sees_the_members_of_its_own_collection(self):
+        own = self.call('POST', '/v1/collections', {'name': 'own'}).json()['id']
+        self.call('POST', f'/v1/collections/{own}/imports',
+                  {'content': '192.0.2.200:8080', 'allow_private_endpoints': True})
+        secret = self.key(['collections.read'], collections=[own])
+        members = self.call('GET', f'/v1/collections/{own}/members', token=secret).json()
+        self.assertEqual([item['canonical'] for item in members['items']],
+                         ['http://192.0.2.200:8080'])
+
+    def test_pool_scope_in_a_body_field_is_enforced(self):
+        secret = self.key(['pools.read'], pools=['mine'])
+        response = self.call('POST', '/v1/reservations/acquire',
+                             {'pool_id': 'someone-else', 'ttl_s': 10}, token=secret)
+        self.assertEqual(response.status_code, 404)
+        self.assertEqual(response.json()['error']['code'], 'E_STATE_NOT_FOUND')
+
+    def test_members_of_a_missing_pool_are_not_found(self):
+        self.assertEqual(self.call('GET', '/v1/pools/no-such-pool/members').status_code, 404)
+
+    def test_mutations_reach_the_audit_log(self):
+        self.call('POST', '/v1/collections', {'name': 'audited'})
+        entries = self.call('GET', '/v1/audit', params={'limit': 50}).json()['items']
+        self.assertIn('collections.create', [entry['operation'] for entry in entries])
+
+    def test_subscription_revoke_refuses_an_ordinary_key(self):
+        created = self.call('POST', '/v1/keys', {'name': 'plain',
+                                                  'permissions': ['read.status']}).json()
+        response = self.call('POST', f'/v1/subscriptions/{created["id"]}/revoke')
+        self.assertEqual(response.status_code, 404)
+        self.assertEqual(self.call('GET', f'/v1/keys/{created["id"]}').json()['state'], 'active')
+
+    def test_half_a_rate_limit_is_refused(self):
+        response = self.call('POST', '/v1/keys', {'name': 'half', 'permissions': ['read.status'],
+                                                   'rate_limit_requests': 5})
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.json()['error']['details']['field'], 'rate_limit_window_seconds')
+
+    def test_profile_revision_is_addressable(self):
+        created = self.call('POST', '/v1/profiles', {
+            'name': 'rev-' + uuid.uuid4().hex[:6],
+            'targets': [{'id': 't1', 'kind': 'required', 'min_success': 1.0}]}).json()
+        response = self.call('GET', f'/v1/profiles/{created["id"]}@1')
+        self.assertEqual(response.status_code, 200, response.text)
+        self.assertEqual(response.json()['revision'], 1)
+
+
+class ServiceErrorTests(LiveServerCase):
+    def test_unknown_job_is_404(self):
+        response = self.call('POST', '/v1/jobs/job-missing/cancel')
+        self.assertEqual(response.status_code, 404)
+
+    def test_source_refresh_answers_with_a_job(self):
+        source = self.call('GET', '/v1/sources', params={'limit': 1}).json()['items'][0]['id']
+        response = self.call('POST', f'/v1/sources/{source}/refresh', {})
+        self.assertEqual(response.status_code, 202, response.text)
+        self.assertTrue(response.json()['job_id'])
+        self.assertEqual(self.call('POST', '/v1/sources/nope/refresh/preview').status_code, 404)
+
+    def test_an_engine_value_error_is_a_400(self):
+        response = self.call('POST', '/v1/exports', {'endpoint_ids': 'http://192.0.2.1:8000'})
+        self.assertEqual(response.status_code, 400, response.text)
+
+
+class UnitTests(unittest.TestCase):
+    def test_expired_idempotency_key_accepts_a_new_body(self):
+        now = [0.0]
+        store = apiv1.IdempotencyStore(10, 10, lambda: now[0])
+        store.put('b', 'k', 'first', 'answer')
+        with self.assertRaises(apiv1.ApiError):
+            store.get('b', 'k', 'second')
+        now[0] = 11
+        self.assertIsNone(store.get('b', 'k', 'second'))
+
+    def test_validation_and_missing_job_statuses(self):
+        self.assertEqual(api._error_status('E_VALIDATION_FIELD'), 400)
+        self.assertEqual(api._error_status('E_STATE_JOB_NOT_FOUND'), 404)
+        self.assertEqual(api._error_status('E_STATE_JOB_TRANSITION'), 409)
+
+    def test_a_snapshot_published_with_min_success_zero_is_readable(self):
+        home = build(min_success=0)
+        try:
+            rows, status = api.Exports(home / 'exports').load()
+            self.assertEqual(status['reader_state'], 'ok')
+            self.assertTrue(rows)
+        finally:
+            shutil.rmtree(home, ignore_errors=True)
+
+    def test_audit_adapter_writes_the_row(self):
+        written = []
+
+        class Manager:
+            def record_audit(self, *args, **kwargs):
+                written.append((args, kwargs))
+        apiv1.ApiKeyStore(Manager()).audit({'key_id': 'k', 'operation': 'x.y',
+                                            'collection_id': 'c', 'result': 'ok'})
+        self.assertEqual(written[0][0], ('k', 'x.y'))
+        self.assertEqual(written[0][1]['scope'], {'collection_id': 'c'})
+
+
+import unittest.mock  # noqa: E402
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/test_api_control_defects.py b/tests/test_api_control_defects.py
new file mode 100644
index 0000000..a604e88
--- /dev/null
+++ b/tests/test_api_control_defects.py
@@ -0,0 +1,292 @@
+"""Regressions of the /v1 control operations that answered wrongly on a real server.
+
+Same set-up as ``test_api_audit_regressions``: a loopback server on a temporary
+data folder whose rows use the RFC 5737 documentation ranges.  Nothing is
+fetched and no proxy is contacted.
+"""
+from __future__ import annotations
+
+import json
+import shutil
+import socket
+import sqlite3
+import tempfile
+import unittest
+import uuid
+from pathlib import Path
+
+from proxy_workbench import api, apikeys, apiv1, db
+from tests import web_support as ws
+from tests.test_api_audit_regressions import LiveServerCase
+
+
+def unique(prefix):
+    return prefix + '-' + uuid.uuid4().hex[:8]
+
+
+class CollectionTests(LiveServerCase):
+    def create(self):
+        response = self.call('POST', '/v1/collections', {'name': unique('col')})
+        self.assertEqual(response.status_code, 200, response.text)
+        return response.json()['id']
+
+    def members(self, collection):
+        response = self.call('GET', f'/v1/collections/{collection}/members')
+        self.assertEqual(response.status_code, 200, response.text)
+        return response.json()['items']
+
+    def test_patch_renames_archives_and_restores_under_a_revision(self):
+        collection = self.create()
+        self.assertEqual(self.call('GET', f'/v1/collections/{collection}').json()['revision'], 1)
+        renamed = self.call('PATCH', f'/v1/collections/{collection}', {'name': 'renamed'},
+                            headers={'If-Match': '1'})
+        self.assertEqual(renamed.status_code, 200, renamed.text)
+        self.assertEqual((renamed.json()['name'], renamed.json()['revision']), ('renamed', 2))
+        stale = self.call('PATCH', f'/v1/collections/{collection}', {'name': 'again'},
+                          headers={'If-Match': '1'})
+        self.assertEqual(stale.status_code, 409)
+        self.assertEqual(stale.json()['error']['code'], 'E_CONFLICT_REVISION')
+        archived = self.call('PATCH', f'/v1/collections/{collection}',
+                             {'archived': True, 'revision': 2})
+        self.assertEqual(archived.status_code, 200, archived.text)
+        self.assertTrue(archived.json()['archived'])
+        self.assertIsNotNone(self.call('GET', f'/v1/collections/{collection}').json()['archived_at'])
+        restored = self.call('PATCH', f'/v1/collections/{collection}',
+                             {'archived': False, 'revision': 3})
+        self.assertEqual(restored.status_code, 200, restored.text)
+        self.assertFalse(restored.json()['archived'])
+        self.assertEqual(restored.json()['revision'], 4)
+
+    def test_merge_copies_the_other_collection(self):
+        target, source = self.create(), self.create()
+        self.call('POST', f'/v1/collections/{source}/imports',
+                  {'content': '192.0.2.201:8080', 'allow_private_endpoints': True})
+        merged = self.call('POST', f'/v1/collections/{target}/merge',
+                           {'from_collection_id': source})
+        self.assertEqual(merged.status_code, 202, merged.text)
+        self.assertTrue(merged.json()['job_id'])
+        self.assertEqual(merged.json()['added'], 1)
+        self.assertEqual([item['canonical'] for item in self.members(target)],
+                         ['http://192.0.2.201:8080'])
+        self.assertEqual(self.call('POST', f'/v1/collections/{target}/merge',
+                                   {'from_collection_id': 'no-such'}).status_code, 404)
+
+    def test_merge_source_must_be_in_the_key_scope(self):
+        target, source = self.create(), self.create()
+        secret = self.key(['collections.write', 'collections.read'], collections=[target])
+        response = self.call('POST', f'/v1/collections/{target}/merge',
+                             {'from_collection_id': source}, token=secret)
+        self.assertEqual(response.status_code, 404)
+
+    def test_replace_answers_with_a_job(self):
+        collection = self.create()
+        response = self.call('POST', f'/v1/collections/{collection}/replace',
+                             {'content': 'http://192.0.2.202:8080\n',
+                              'allow_private_endpoints': True})
+        self.assertEqual(response.status_code, 202, response.text)
+        self.assertTrue(response.json()['job_id'])
+        self.assertEqual([item['canonical'] for item in self.members(collection)],
+                         ['http://192.0.2.202:8080'])
+
+    def test_member_add_refuses_garbage_and_remove_takes_the_endpoint_id(self):
+        collection = self.create()
+        garbage = self.call('POST', f'/v1/collections/{collection}/members',
+                            {'endpoint': 'not an endpoint'})
+        self.assertEqual(garbage.status_code, 400, garbage.text)
+        self.assertEqual(garbage.json()['error']['details']['field'], 'endpoint')
+        self.assertEqual(self.members(collection), [])
+        added = self.call('POST', f'/v1/collections/{collection}/members',
+                          {'endpoint': 'socks5://192.0.2.203:1080'})
+        self.assertEqual(added.status_code, 200, added.text)
+        [member] = self.members(collection)
+        removed = self.call('DELETE',
+                            f'/v1/collections/{collection}/members/{member["endpoint_id"]}')
+        self.assertEqual(removed.status_code, 200, removed.text)
+        self.assertEqual(self.members(collection), [])
+        again = self.call('DELETE', f'/v1/collections/{collection}/members/{member["endpoint_id"]}')
+        self.assertEqual(again.status_code, 404)
+
+
+class ScopeTests(LiveServerCase):
+    def test_compare_refuses_a_collection_outside_the_key_scope(self):
+        own = self.call('POST', '/v1/collections', {'name': unique('own')}).json()['id']
+        secret = self.key(['sources.read'], collections=[own])
+        body = {'sources': ['src-a']}
+        for path, extra in (('/v1/sources/compare', {}),
+                            ('/v1/sources/compare/suppliers', {'left': 'a', 'right': 'b'}),
+                            ('/v1/sources/compare/cohorts',
+                             {'cohorts': [{'label': 'x'}, {'label': 'y'}]})):
+            outside = self.call('POST', path, {**body, **extra, 'collection_id': 'public-base'},
+                                token=secret)
+            self.assertEqual(outside.status_code, 404, (path, outside.text))
+            nothing = self.call('POST', path, {**body, **extra}, token=secret)
+            self.assertEqual(nothing.status_code, 400, (path, nothing.text))
+        nested = self.call('POST', '/v1/sources/compare',
+                           {**body, 'collection_id': own,
+                            'cohort': {'collection_id': 'public-base'}}, token=secret)
+        self.assertEqual(nested.status_code, 404, nested.text)
+
+
+class PoolAndScheduleTests(LiveServerCase):
+    def test_pool_profile_defaults_like_the_gui_and_must_exist(self):
+        name = unique('pool')
+        created = self.call('POST', '/v1/pools', {'name': name})
+        self.assertEqual(created.status_code, 200, created.text)
+        self.assertEqual(created.json()['profile_id'], ws.profile_id())
+        missing = self.call('POST', '/v1/pools', {'name': unique('pool'), 'profile_id': 'nope'})
+        self.assertEqual(missing.status_code, 404, missing.text)
+        self.assertEqual(missing.json()['error']['details']['field'], 'profile_id')
+
+    def test_pool_update_does_not_drop_the_name(self):
+        name = unique('pool')
+        self.assertEqual(self.call('POST', '/v1/pools', {'name': name}).status_code, 200)
+        renamed = self.call('PATCH', f'/v1/pools/{name}', {'name': 'other', 'revision': 1})
+        self.assertEqual(renamed.status_code, 400, renamed.text)
+        self.assertEqual(renamed.json()['error']['details']['field'], 'name')
+        same = self.call('PATCH', f'/v1/pools/{name}', {'name': name, 'desired': 3,
+                                                          'revision': 1})
+        self.assertEqual(same.status_code, 200, same.text)
+        self.assertEqual(same.json()['desired'], 3)
+
+    def test_schedule_on_an_unknown_collection_is_refused(self):
+        response = self.call('POST', '/v1/schedules', {'name': unique('s'), 'kind': 'check',
+                                                        'interval_minutes': 30,
+                                                        'collection_id': 'no-such'})
+        self.assertEqual(response.status_code, 404, response.text)
+        ok = self.call('POST', '/v1/schedules', {'name': unique('s'), 'kind': 'check',
+                                                  'interval_minutes': 30,
+                                                  'collection_id': 'public-base'})
+        self.assertEqual(ok.status_code, 200, ok.text)
+
+
+class GatewayTests(LiveServerCase):
+    def test_config_is_stored_under_its_revision(self):
+        current = self.call('GET', '/v1/gateway/config').json()
+        revision = current['revision']
+        unknown = self.call('PATCH', '/v1/gateway/config', {'transports': ['carrier-pigeon']},
+                            headers={'If-Match': str(revision)})
+        self.assertEqual(unknown.status_code, 400, unknown.text)
+        self.assertEqual(unknown.json()['error']['details']['field'], 'transports')
+        changed = self.call('PATCH', '/v1/gateway/config',
+                            {'max_per_proxy': 3, 'transports': ['http', 'socks5h']},
+                            headers={'If-Match': str(revision)})
+        self.assertEqual(changed.status_code, 200, changed.text)
+        self.assertTrue(changed.json()['applied'])
+        self.assertEqual(changed.json()['revision'], revision + 1)
+        stale = self.call('PATCH', '/v1/gateway/config', {'max_per_proxy': 5},
+                          headers={'If-Match': str(revision)})
+        self.assertEqual(stale.status_code, 409, stale.text)
+        stored = self.call('GET', '/v1/gateway/config').json()
+        self.assertEqual((stored['max_per_proxy'], stored['transports'], stored['revision']),
+                         (3, ['http', 'socks5h'], revision + 1))
+
+    def test_a_binding_is_listed_and_revisioned(self):
+        pool = unique('gw')
+        self.assertEqual(self.call('POST', '/v1/pools', {'name': pool}).status_code, 200)
+        listener = unique('l')
+        bound = self.call('POST', '/v1/gateway/bindings',
+                          {'listener': listener, 'pool_id': pool, 'revision': 1})
+        self.assertEqual(bound.status_code, 200, bound.text)
+        listed = self.call('GET', '/v1/gateway/bindings').json()['items']
+        self.assertIn((listener, pool, 1),
+                      [(item['listener'], item['pool_id'], item['revision']) for item in listed])
+        again = self.call('POST', '/v1/gateway/bindings',
+                          {'listener': listener, 'pool_id': pool, 'revision': 1})
+        self.assertEqual(again.json()['revision'], 2)
+        stale = self.call('POST', '/v1/gateway/bindings',
+                          {'listener': listener, 'pool_id': pool, 'revision': 1})
+        self.assertEqual(stale.status_code, 409, stale.text)
+
+
+class KeyDeleteTests(LiveServerCase):
+    def test_only_a_revoked_key_is_deleted(self):
+        created = self.call('POST', '/v1/keys', {'name': unique('k'),
+                                                  'permissions': ['read.status']}).json()
+        refused = self.call('DELETE', f'/v1/keys/{created["id"]}')
+        self.assertEqual(refused.status_code, 409, refused.text)
+        self.assertEqual(refused.json()['error']['code'], 'E_STATE_KEY_NOT_REVOKED')
+        self.assertEqual(self.call('GET', f'/v1/keys/{created["id"]}').json()['state'], 'active')
+        self.assertEqual(self.call('POST', f'/v1/keys/{created["id"]}/revoke').status_code, 200)
+        deleted = self.call('DELETE', f'/v1/keys/{created["id"]}')
+        self.assertEqual(deleted.status_code, 200, deleted.text)
+        self.assertEqual(self.call('GET', f'/v1/keys/{created["id"]}').status_code, 404)
+
+
+class _NoKeys(apiv1.KeyStore):
+    def verify(self, secret):
+        return None
+
+
+class _NoService(apiv1.Service):
+    def invoke(self, operation, call):
+        return {}
+
+    def queue_state(self):
+        return {'depth': 0}
+
+
+class HostHeaderTests(unittest.TestCase):
+    def control(self, host):
+        return apiv1.ApiV1(_NoService(), _NoKeys(),
+                           apiv1.ApiConfig(host=host, allowed_hosts=api.accepted_host_names(host),
+                                           allow_remote_bind=True))
+
+    def code(self, control, host_header):
+        response = control.handle(apiv1.Request('GET', '/v1/service',
+                                                headers={'Host': host_header},
+                                                client_host='127.0.0.1'))
+        return json.loads(response.body)['error']['code']
+
+    def test_a_wildcard_bind_accepts_the_machine_and_refuses_other_names(self):
+        names = api.accepted_host_names('0.0.0.0')
+        hostname = socket.gethostname().lower()
+        self.assertIn('localhost', names)
+        self.assertIn('127.0.0.1', names)
+        self.assertIn(hostname, names)
+        self.assertNotIn('0.0.0.0', names)
+        control = self.control('0.0.0.0')
+        for accepted in ('localhost:8765', '127.0.0.1:8765', '[::1]:8765', f'{hostname}:8765'):
+            self.assertNotEqual(self.code(control, accepted), 'E_AUTH_ORIGIN', accepted)
+        self.assertEqual(self.code(control, 'attacker.example:8765'), 'E_AUTH_ORIGIN')
+
+    def test_a_named_bind_accepts_its_own_address(self):
+        control = self.control('192.0.2.10')
+        self.assertNotEqual(self.code(control, '192.0.2.10:8765'), 'E_AUTH_ORIGIN')
+        self.assertEqual(self.code(control, 'rebound.example'), 'E_AUTH_ORIGIN')
+
+
+class AuditPruningTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, self.tmp, True)
+        path = Path(self.tmp) / db.DB_FILENAME
+        db.migrate(path)
+        self.conn = sqlite3.connect(path, isolation_level=None, check_same_thread=False)
+        self.addCleanup(self.conn.close)
+
+    def test_migration_20_adds_the_revision_and_the_index(self):
+        self.assertEqual(db.SCHEMA_VERSION, 20)
+        self.assertIn('revision', db.columns(self.conn, 'collections'))
+        indexes = [row[1] for row in self.conn.execute('PRAGMA index_list(audit_log)')]
+        self.assertIn('audit_log_at', indexes)
+
+    def test_retention_is_exact_without_a_scan_per_insert(self):
+        manager = apikeys.ApiKeyManager(self.conn, audit_retention=10)
+        for index in range(5):
+            manager._audit(None, 'warm-up')
+        statements = []
+        self.conn.set_trace_callback(statements.append)
+        for index in range(40):
+            manager._audit(None, 'probe')
+        self.conn.set_trace_callback(None)
+        self.assertEqual(self.conn.execute('SELECT count(*) FROM audit_log').fetchone()[0], 10)
+        joined = '\n'.join(statements).lower()
+        self.assertNotIn('not in', joined)
+        self.assertNotIn('count(*)', joined)
+        plan = ' '.join(str(row[-1]) for row in self.conn.execute(
+            'EXPLAIN QUERY PLAN SELECT rowid FROM audit_log ORDER BY at, rowid LIMIT 5'))
+        self.assertIn('audit_log_at', plan)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/test_area_ddl_sourcedesk.py b/tests/test_area_ddl_sourcedesk.py
index 4b579b3..0f39940 100644
--- a/tests/test_area_ddl_sourcedesk.py
+++ b/tests/test_area_ddl_sourcedesk.py
@@ -1,4 +1,4 @@
-"""The source tables of db.py against the contract sourcedesk declares (F13, F27).
+"""The source tables of db.py against the contract sourcedesk declares.
 
 `sourcedesk.REQUESTED_DDL` is a string constant the module never executes: it is
 the request the migrator has to answer.  Every test here is a comparison between
@@ -46,7 +46,7 @@
 #: below fails on a *new* one instead of quietly accepting a growing list.
 #: `apikeys.ensure_schema()` re-declares migrations 8/10/14 so the module can be
 #: exercised before the migrator lands; it is idempotent and belongs to the
-#: apikeys owner -- see docs/integration/HANDOFF/area-ddl.md.
+#: apikeys module.
 KNOWN_SCHEMA_WRITERS = {"apikeys.py"}
 
 
@@ -106,8 +106,7 @@ def test_source_identity_carries_the_family_and_publisher_columns(self):
         self.assertEqual(db.columns(self.conn, "source_identity"), list(IDENTITY_COLUMNS))
 
     def test_source_generation_entry_is_keyed_by_endpoint_id_not_by_a_second_address_model(self):
-        # CONTRACTS 1.1 plus HANDOFF/sources-handoff.ru.md 1.2 p.6: one address
-        # entity.  The sources branch keyed it by the address string (`proxy`).
+        # One address entity.  The sources branch keyed it by the address string (`proxy`).
         columns, key = shape(self.conn, "source_generation_entry")
         self.assertIn("endpoint_id", columns)
         self.assertNotIn("proxy", columns)
@@ -225,7 +224,7 @@ def test_the_module_still_executes_no_ddl(self):
                 self.fail(f"sourcedesk.py must not execute DDL, found: {stripped[:60]}")
 
     def test_nothing_outside_db_py_executes_a_create_statement(self):
-        # HANDOFF/sources-handoff.ru.md 3.1 p.2.  A string constant is fine; a
+        # A string constant is fine; a
         # call that runs one is not.  A `TEMP` table is excluded: it lives on
         # the connection and is gone when it closes, so it is scratch space and
         # not this package's schema.  The exceptions below are recorded findings
diff --git a/tests/test_area_gateway_credentials.py b/tests/test_area_gateway_credentials.py
index aa8482e..400425e 100644
--- a/tests/test_area_gateway_credentials.py
+++ b/tests/test_area_gateway_credentials.py
@@ -422,10 +422,9 @@ async def test_a_rotated_password_is_the_one_that_is_sent(self):
         self.assertEqual(up.auth_headers, [up.expected.encode()])
 
     async def test_a_row_of_a_superseded_revision_sends_nothing(self):
-        # CONTRACTS §1.2(1): the old revision's evidence is not the new
+        # the shared contract: the old revision's evidence is not the new
         # credential's evidence, and the old secret must not go back on the wire.
-        # The row the listener reads today carries no revision - see the
-        # `public_row` item in the handoff - so the rule is pinned where the
+        # The row the listener reads today carries no revision, so the rule is pinned where the
         # field exists, on the resolver itself, and the end-to-end effect is
         # pinned through an ambiguous row in the test above.
         store = self.store()
diff --git a/tests/test_area_reach_collections.py b/tests/test_area_reach_collections.py
index fa9e8df..61b9dcf 100644
--- a/tests/test_area_reach_collections.py
+++ b/tests/test_area_reach_collections.py
@@ -4,7 +4,7 @@
 ``kind``.  A client that sent ``{"name": "priv", "kind": "own",
 "allow_private": true}`` got 201 and a collection id, and believed private
 addresses were allowed there.  Nothing was allowed: ``collections`` has no such
-column (CONTRACTS section 3.3, migration 2) and the real control,
+column  and the real control,
 ``allow_private_endpoints``, lives on the import routes and is enforced by
 ``importer.DEFAULT_POLICY``.
 
@@ -212,7 +212,7 @@ def test_the_patch_route_declares_the_field(self):
     def test_the_handler_refuses_it_when_the_request_reaches_it(self):
         from proxy_workbench import api
         # ``PATCH`` is behind ``If-Match`` and ``collections`` has no revision
-        # column (CONTRACTS 3.3), so the transport refuses every PATCH before
+        # column, so the transport refuses every PATCH before
         # the handler runs.  The handler still refuses the field itself, which
         # is what a future revision column would meet.
         response = call(self.client, 'PATCH', f'/v1/collections/{self.collection}',
diff --git a/tests/test_area_reach_sources.py b/tests/test_area_reach_sources.py
index 2495f9b..21a1bd4 100644
--- a/tests/test_area_reach_sources.py
+++ b/tests/test_area_reach_sources.py
@@ -8,8 +8,7 @@
 
 So every test here goes the way a person goes: through the argument parser,
 through a live HTTP request, and through the page the GUI serves.  The
-headline is the research fact from
-``docs/requirements/sources-research/overlap.md``: two publishers hand out the
+headline is a known fact about the catalog: two publishers hand out the
 same 21 036 addresses, the second's unique contribution is zero, and the report
 says so on every surface.
 
diff --git a/tests/test_areajobs_jobs.py b/tests/test_areajobs_jobs.py
index 8769bdf..551b66b 100644
--- a/tests/test_areajobs_jobs.py
+++ b/tests/test_areajobs_jobs.py
@@ -1,6 +1,6 @@
 """F11 / defect 6 acceptance, run against the real migrator.
 
-MASTER-PROMPT F11: «остановка на любой стадии не теряет завершённые
+Requirement: «остановка на любой стадии не теряет завершённые
 observations, повторный запрос не создаёт дубликат job, resume не расширяет
 scope и не использует obsolete membership».
 
@@ -220,7 +220,7 @@ def test_the_scope_of_a_finished_job_still_names_the_revision_it_ran_under(self)
 
 
 class BoundedWritersTest(JobFixture):
-    """F11: «ограничение числа одновременно изменяющих БД исполнителей» (CONTRACTS §6.4)."""
+    """F11: «ограничение числа одновременно изменяющих БД исполнителей»."""
 
     def test_a_second_job_may_not_start_while_one_is_running(self):
         first = self.submit('ep-01')
diff --git a/tests/test_areajobs_pools.py b/tests/test_areajobs_pools.py
index 715fedc..7c945a9 100644
--- a/tests/test_areajobs_pools.py
+++ b/tests/test_areajobs_pools.py
@@ -1,6 +1,6 @@
 """F14 acceptance and defect 12, run literally.
 
-MASTER-PROMPT F14: «N=5 → два отказа → восстановление до 5; отсутствие резерва →
+Requirement: «N=5 → два отказа → восстановление до 5; отсутствие резерва →
 честное 3/5; budget=0 останавливает refill; после crash сохраняется целевое
 состояние», plus the quotas with honest unknown, the degraded report and the
 find-N unit the pool asks the measuring engine for.
@@ -247,7 +247,7 @@ def broken(spec, member):
 
 
 class QuotaTest(PoolTestCase):
-    """Country / protocol / ASN / unique exit-IP with honest unknown (F14)."""
+    """Country / protocol / ASN / unique exit-IP with honest unknown."""
 
     def create(self, **kwargs) -> pools.PoolSpec:
         values = dict(POLICY)
@@ -366,7 +366,7 @@ def test_an_empty_pool_reports_a_number_a_reason_and_a_next_attempt(self):
 class FindUnitTest(PoolTestCase):
     """Which of the three N the pool asks the measuring engine for.
 
-    HANDOFF/pipeline.md §1.5 asked for ``FindPolicy(n=pool.desired, what='exit')``.
+    ``FindPolicy(n=pool.desired, what='exit')`` looks natural here.
     It is not what this module does, and the reason is in the schema: a member is
     a row of ``pool_member``, which holds no exit address, so a count of exits
     cannot survive the next restart.  The unit is therefore *derived* — exits when
diff --git a/tests/test_areajobs_scheduler.py b/tests/test_areajobs_scheduler.py
index 54a77f3..4245155 100644
--- a/tests/test_areajobs_scheduler.py
+++ b/tests/test_areajobs_scheduler.py
@@ -1,7 +1,7 @@
 """F15 acceptance: intervals, windows with timezone and DST, budgets, quiet
 hours, no-catchup after sleep, power policy and deduplicated notifications.
 
-MASTER-PROMPT F15 in full: intervals and time windows with timezone and correct
+In full: intervals and time windows with timezone and correct
 DST handling, pause and resume, request/byte/time budgets, quiet hours, no
 catch-up after sleep, optional metered/battery policy where the OS provides a
 signal, meaningful state-change notifications with dedup and hysteresis,
@@ -182,7 +182,7 @@ def test_an_unknown_timezone_is_refused_by_name(self):
 
 
 class WindowAndQuietHoursTest(unittest.TestCase):
-    """Windows, quiet hours, pause and resume (F15)."""
+    """Windows, quiet hours, pause and resume."""
 
     def _engine(self, clock, **extra):
         payload = {'id': 'day', 'kind': 'interval', 'interval_minutes': 30,
diff --git a/tests/test_areasecrets_path.py b/tests/test_areasecrets_path.py
index 99f2bfd..aaa877d 100644
--- a/tests/test_areasecrets_path.py
+++ b/tests/test_areasecrets_path.py
@@ -140,7 +140,7 @@ def test_an_idna_name_and_its_punycode_form_are_one_address(self):
 
 
 class TwoCredentialsOneEndpointTests(AccessPathTestCase):
-    """CONTRACTS §1.2(1): an access is not an endpoint."""
+    """the shared contract: an access is not an endpoint."""
 
     def test_two_passwords_of_one_address_are_two_rows_and_two_refs(self):
         first = self.make_access('http://%s:8080' % HOSTNAME, username='alice',
diff --git a/tests/test_areasources_catalog.py b/tests/test_areasources_catalog.py
index 5fe581a..eb7173a 100644
--- a/tests/test_areasources_catalog.py
+++ b/tests/test_areasources_catalog.py
@@ -18,8 +18,7 @@
 from proxy_workbench import source_management as sm
 
 # Pairs the source research proved carry the same bytes.  The numbers and the
-# pairs are taken from docs/requirements/sources-research/overlap.md; they are
-# file comparisons made by that pass, not results of this application.
+# pairs are file comparisons made by the source research, not results of this application.
 # ``different_publishers`` says what the copy actually is: hookzof and proxifly
 # are two people serving one list, while dinoz0rg serves one list under two
 # formats of the same repository.
diff --git a/tests/test_areasources_compare.py b/tests/test_areasources_compare.py
index e19fb70..225ca7e 100644
--- a/tests/test_areasources_compare.py
+++ b/tests/test_areasources_compare.py
@@ -2,8 +2,7 @@
 
 The headline scenario is the one in the research: two publishers hand out
 *the same* address set, exactly like ``hookzof/socks5_list`` and
-``proxifly/free-proxy-list`` (21 036 identical endpoints, Jaccard 1.0 in
-``docs/requirements/sources-research/overlap.md``).  The comparison has to see
+``proxifly/free-proxy-list`` (21 036 identical endpoints, Jaccard 1.0).  The comparison has to see
 the copy and give the second publisher a unique contribution of zero, before
 any proxy is contacted.
 
diff --git a/tests/test_bandwidth.py b/tests/test_bandwidth.py
index b93bedc..7ccfea3 100644
--- a/tests/test_bandwidth.py
+++ b/tests/test_bandwidth.py
@@ -14,7 +14,7 @@
 from proxy_workbench import proxytool as p
 
 #: A result fixture describes a measurement that just happened; the
-#: admission contract has no "fresh forever" state (CONTRACTS §2.4).
+#: admission contract has no "fresh forever" state.
 _NOW = time.time()
 
 BIG = 400_000
diff --git a/tests/test_collect_pipeline.py b/tests/test_collect_pipeline.py
new file mode 100644
index 0000000..1f1541c
--- /dev/null
+++ b/tests/test_collect_pipeline.py
@@ -0,0 +1,429 @@
+"""Collection path: line formats, batched writes, limits and validators."""
+import asyncio
+import contextlib
+import ipaddress
+from pathlib import Path
+import random
+import sys
+import tempfile
+import unittest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+from proxy_workbench import proxytool as p
+from proxy_workbench import source_adapters
+
+
+def line_record(url, source_id, config):
+    return {'id': source_id, 'name': source_id, 'publisher': {'id': 'local', 'name': 'local'},
+            'family_id': source_id, 'category': 'custom', 'endpoints': [
+                {'id': 'primary', 'url': url, 'role': 'primary', 'relation': 'custom'}],
+            'data_urls': [url], 'fallback_urls': [], 'protocols': [], 'protocol_hints': [],
+            'adapter': {'kind': 'line', 'profile': 'line-v1', 'config': config},
+            'access': {'kind': 'public'}, 'collection_allowed': True, 'payload_role': 'proxy_list',
+            'evidence': {}, 'limits': {}, 'rights': {}, 'tags': []}
+
+
+class NormalizeFastPathTests(unittest.TestCase):
+    def test_fast_path_matches_the_general_parser(self):
+        rng = random.Random(7)
+        octets = ['0', '1', '9', '10', '01', '99', '100', '127', '169', '172', '192', '224', '254', '255', '256', '999']
+        ports = ['0', '1', '80', '080', '8080', '65535', '65536', '99999', '000080', '']
+        schemes = ['', 'http://', 'https://', 'socks4://', 'socks5://', 'socks5h://', 'HTTP://', 'ftp://']
+        values = []
+        for _ in range(20_000):
+            host = '.'.join(rng.choice(octets) for _ in range(rng.choice((3, 4, 4, 4, 5))))
+            port = rng.choice(ports)
+            value = rng.choice(schemes) + host + (':' + port if port else '') + rng.choice(('', '', '/', ' ', '/x'))
+            values.append(value)
+        values += ['8.8.8.8:80', ' 8.8.8.8:80 ', '١.٢.٣.٤:80', '8.8.8.8:８０', '[2001:4860::8888]:80',
+                   '100.64.0.1:80', '198.18.0.1:80', 'socks4://8.8.8.8:1080']
+        for value in values:
+            for public_only in (True, False):
+                self.assertEqual(p._normalize_proxy(value, public_only=public_only),
+                                 p._normalize_proxy_general(value, public_only=public_only), value)
+
+    def test_fast_path_answers(self):
+        self.assertEqual(p.normalize('8.8.8.8:0080'), 'http://8.8.8.8:80')
+        self.assertIsNone(p.normalize('10.0.0.1:80'))
+        self.assertEqual(p.normalize_custom('10.0.0.1:80'), 'http://10.0.0.1:80')
+        self.assertTrue(ipaddress.ip_address('8.8.8.8').is_global)
+
+
+class CollectFixture(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.db = p.open_db(Path(self.temp.name) / 'collect.sqlite3')
+
+    def tearDown(self):
+        self.db.close()
+        self.temp.cleanup()
+
+    @contextlib.asynccontextmanager
+    async def serve(self, pages, headers=None, statuses=None, seen=None):
+        async def handler(reader, writer):
+            try:
+                request = await reader.readuntil(b'\r\n\r\n')
+                path = request.split(b' ', 2)[1].decode('ascii')
+                if seen is not None:
+                    seen.append(request.decode('latin-1'))
+                status = (statuses or {}).get(path, 200)
+                body = pages.get(path, b'') if status == 200 else b''
+                extra = ''.join(f'{name}: {value}\r\n' for name, value in (headers or {}).get(path, {}).items())
+                reason = {200: 'OK', 304: 'Not Modified'}.get(status, 'X')
+                writer.write(f'HTTP/1.1 {status} {reason}\r\n{extra}Content-Length: {len(body)}\r\n'
+                             'Connection: close\r\n\r\n'.encode() + body)
+                await writer.drain()
+            except (ConnectionError, asyncio.IncompleteReadError):
+                pass
+            finally:
+                writer.close()
+                with contextlib.suppress(ConnectionError):
+                    await writer.wait_closed()
+        server = await asyncio.start_server(handler, '127.0.0.1', 0)
+        try:
+            yield f'http://127.0.0.1:{server.sockets[0].getsockname()[1]}'
+        finally:
+            server.close()
+            await server.wait_closed()
+
+    def candidates(self):
+        return sorted(row[0] for row in self.db.execute('SELECT proxy FROM candidates'))
+
+
+class CollectPipelineTests(CollectFixture):
+    async def test_line_records_honor_their_legacy_kind_and_inline_comments(self):
+        pages = {
+            '/fields': '11.5.5.1:8080:Germany\n11.5.5.2:3128:Türkiye\n11.5.5.3:80:\n'.encode(),
+            '/text': b'Proxy list header\n11.6.6.1:80 HK-H - \n11.6.6.2:8080 US-N-S +\n',
+            '/commented': b'11.7.7.1:8085 # HTTP [ID]\n# whole comment\n11.7.7.2:80\n',
+        }
+        async with self.serve(pages) as base:
+            report = await p.collect(self.db, [], [], plans=[
+                line_record(base + '/fields', 'fields', {'legacy_kind': 'http-fields'}),
+                line_record(base + '/text', 'text', {'legacy_kind': 'text'}),
+                line_record(base + '/commented', 'commented', {'legacy_kind': 'http', 'default_protocol': 'http'}),
+            ], allow_private_sources=True, quiet=True)
+        by_id = {entry['source_id']: entry for entry in report['sources']}
+        self.assertEqual(by_id['fields']['accepted'], 2)
+        self.assertEqual(by_id['fields']['invalid'], 1)
+        self.assertEqual(by_id['text']['accepted'], 2)
+        self.assertEqual(by_id['commented']['accepted'], 2)
+        self.assertEqual(self.candidates(), [
+            'http://11.5.5.1:8080', 'http://11.5.5.2:3128', 'http://11.6.6.1:80',
+            'http://11.6.6.2:8080', 'http://11.7.7.1:8085', 'http://11.7.7.2:80'])
+        parsed = source_adapters.parse_line(pages['/fields'], {'config': {'legacy_kind': 'http-fields'}})
+        self.assertEqual([record['value'] for record in parsed['records']], ['11.5.5.1:8080', '11.5.5.2:3128'])
+        parsed = source_adapters.parse_line(pages['/commented'], {'config': {'legacy_kind': 'http'}})
+        self.assertEqual([record['value'] for record in parsed['records']], ['11.7.7.1:8085', '11.7.7.2:80'])
+
+    async def test_batched_writer_keeps_counts_membership_and_provenance(self):
+        first = ''.join(f'11.1.{index // 250}.{index % 250 + 1}:8080\n' for index in range(2500))
+        second = ''.join(f'11.1.{index // 250}.{index % 250 + 1}:8080\n' for index in range(2000, 3000))
+        pages = {'/a': (first + first[:200]).encode(), '/b': second.encode()}
+        original = p.COLLECT_WRITE_BATCH
+        p.COLLECT_WRITE_BATCH = 300  # several flushes per source
+        try:
+            async with self.serve(pages) as base:
+                report = await p.collect(self.db, [f'http {base}/a'], [], allow_private_sources=True, quiet=True)
+                later = await p.collect(self.db, [f'http {base}/b'], [], allow_private_sources=True, quiet=True)
+        finally:
+            p.COLLECT_WRITE_BATCH = original
+        entry, other = report['sources'][0], later['sources'][0]
+        self.assertEqual((entry['accepted'], entry['new'], entry['duplicate']), (2500, 2500, 14))
+        self.assertEqual((other['accepted'], other['new']), (1000, 500))
+        self.assertEqual(later['unique'], 3000)
+        for table in ('endpoints', 'membership'):
+            self.assertEqual(self.db.execute(f'SELECT count(*) FROM {table}').fetchone()[0], 3000)
+        self.assertEqual(self.db.execute('SELECT count(*) FROM candidate_seen').fetchone()[0], 3500)
+        self.assertEqual(self.db.execute('SELECT count(*) FROM membership_source').fetchone()[0], 3500)
+        # The first source that named an address stays its first-seen source.
+        self.assertEqual(self.db.execute('SELECT count(DISTINCT source) FROM candidate_meta').fetchone()[0], 2)
+        self.assertEqual(self.db.execute(
+            'SELECT count(*) FROM candidate_meta WHERE source=?', (entry['source_id'],)).fetchone()[0], 2500)
+        self.assertEqual(self.db.execute(
+            'SELECT count(*) FROM source_generation_entry').fetchone()[0], 3500)
+
+    async def test_a_list_without_countries_keeps_an_earlier_country(self):
+        self.db.execute("INSERT INTO endpoints(id, canonical, country, country_source) VALUES (?,?,?,?)",
+                        (p.schema.endpoint_id('http://11.8.8.1:80'), 'http://11.8.8.1:80', 'DE', 'import'))
+        self.db.commit()
+        async with self.serve({'/l': b'11.8.8.1:80\n'}) as base:
+            await p.collect(self.db, [f'http {base}/l'], [], allow_private_sources=True, quiet=True)
+        self.assertEqual(tuple(self.db.execute(
+            'SELECT country, country_source FROM endpoints WHERE canonical=?', ('http://11.8.8.1:80',)).fetchone()),
+            ('DE', 'import'))
+
+    async def test_item_budget_still_stops_at_the_exact_address(self):
+        body = ''.join(f'11.2.0.{index}:80\n' for index in range(1, 51)).encode()
+        async with self.serve({'/l': body}) as base:
+            report = await p.collect(self.db, [f'http {base}/l'], [], allow_private_sources=True,
+                                     quiet=True, max_items=7)
+        self.assertEqual(report['budget']['items'], 7)
+        self.assertEqual(self.db.execute('SELECT count(*) FROM membership').fetchone()[0], 7)
+
+    async def test_candidate_limit_is_a_partial_read_not_a_provider_failure(self):
+        body = ''.join(f'11.3.0.{index}:80\n' for index in range(1, 21)).encode()
+        async with self.serve({'/l': body}, headers={'/l': {'ETag': '"big"'}}) as base:
+            spec = f'http {base}/l'
+            for _ in range(p.SOURCE_QUARANTINE_AFTER + 1):
+                report = await p.collect(self.db, [spec], [], allow_private_sources=True,
+                                         quiet=True, max_source_candidates=5)
+                entry = report['sources'][0]
+                self.assertEqual(entry['error'], 'SOURCE_CANDIDATE_LIMIT')
+                self.assertEqual(entry['http_state'], 'http_2xx_nonempty')
+                self.assertEqual(entry['parse_state'], 'partial')
+                self.assertTrue(entry['partial'])
+        state = p._source_state_row(self.db, entry['source_id'])
+        self.assertEqual(state['consecutive_failures'], 0)
+        self.assertIsNone(state['quarantine_until'])
+        self.assertIsNone(state['backoff_until'])
+        # The body was not read whole, so its validator is not stored.
+        self.assertIsNone(state['etag'])
+
+    async def test_validators_survive_a_304_without_them_and_a_failed_fetch(self):
+        requests = []
+        pages = {'/l': b'11.4.0.1:80\n'}
+        headers = {'/l': {'ETag': '"v1"', 'Last-Modified': 'Sat, 26 Sep 2026 00:00:00 GMT'}}
+        async with self.serve(pages, headers=headers, seen=requests) as base:
+            spec = f'http {base}/l'
+            await p.collect(self.db, [spec], [], allow_private_sources=True, quiet=True)
+        key = p.source_key(spec)
+        self.assertEqual(p._source_state_row(self.db, key)['etag'], '"v1"')
+        async with self.serve(pages, statuses={'/l': 304}, seen=requests) as base2:
+            # The same source id, now answering 304 without any validator.
+            report = await p.collect(self.db, [], [], plans=[p.SourcePlan(key, base2 + '/l', 'http')],
+                                     allow_private_sources=True, quiet=True)
+        self.assertTrue(report['sources'][0].get('served_from_cache'))
+        self.assertIn('If-None-Match: "v1"', requests[-1])
+        state = p._source_state_row(self.db, key)
+        self.assertEqual((state['etag'], state['last_modified']), ('"v1"', 'Sat, 26 Sep 2026 00:00:00 GMT'))
+        # A body the collector refused must not replace the stored validator.
+        bad = {'/l': b'\xff\xfe not utf-8\n'}
+        async with self.serve(bad, headers={'/l': {'ETag': '"broken"'}}) as base3:
+            report = await p.collect(self.db, [], [], plans=[p.SourcePlan(key, base3 + '/l', 'http')],
+                                     allow_private_sources=True, quiet=True)
+        self.assertEqual(report['sources'][0]['error'], 'SOURCE_INVALID_UTF8')
+        self.assertEqual(p._source_state_row(self.db, key)['etag'], '"v1"')
+
+
+class SourceHistoryTests(CollectFixture):
+    """Generations stay bounded; 304 re-applies; retries and pages count per attempt."""
+
+    def entries(self):
+        return self.db.execute('SELECT count(*) FROM source_generation_entry').fetchone()[0]
+
+    def generations(self, source_id):
+        return [row[0] for row in self.db.execute(
+            'SELECT id FROM source_generation WHERE source_id=? ORDER BY id', (source_id,))]
+
+    @staticmethod
+    def listing(run, count, offset=0):
+        # One address changes per run, so every run is a new answer (a 200, not a 304).
+        rows = [f'11.20.{(offset + index) // 250}.{(offset + index) % 250 + 1}:8080' for index in range(count)]
+        rows[-1] = f'11.21.{run // 250}.{run % 250 + 1}:8080'
+        return ('\n'.join(rows) + '\n').encode()
+
+    async def test_generations_stay_bounded_across_many_runs_and_comparisons_hold(self):
+        keep = p.schema.SOURCE_GENERATION_KEEP
+        pages = {}
+        async with self.serve(pages) as base:
+            specs = [f'http {base}/a', f'http {base}/b']
+            ids = [p.source_key(spec) for spec in specs]
+            for run in range(keep + 6):
+                pages['/a'] = self.listing(run, 300)            # 11.20.0.1 .. 11.20.1.50
+                pages['/b'] = self.listing(1000 + run, 200, offset=200)  # overlaps /a by 99
+                report = await p.collect(self.db, specs, [], allow_private_sources=True, quiet=True)
+                self.assertTrue(all(entry['generation_id'] for entry in report['sources']), report)
+                for source_id in ids:
+                    self.assertLessEqual(len(self.generations(source_id)), keep)
+                # Entries of at most `keep` generations of each list, whatever the run count.
+                self.assertLessEqual(self.entries(), keep * (300 + 200))
+        self.assertEqual(self.entries(), keep * (300 + 200))
+        for source_id in ids:
+            state = p._source_state_row(self.db, source_id)
+            self.assertEqual(state['last_good_generation'], self.generations(source_id)[-1])
+            self.assertEqual(p.stored_generation(self.db, source_id)['generation_id'],
+                             state['last_good_generation'])
+        # The comparison reads the newest generation only and still adds up.
+        contributions = p.source_contributions(self.db, ids)
+        self.assertEqual(contributions[ids[0]]['accepted'], 300)
+        self.assertEqual(contributions[ids[1]]['accepted'], 200)
+        self.assertEqual(contributions[ids[0]]['shared'], 99)
+        self.assertEqual(contributions[ids[1]]['shared'], 99)
+        self.assertEqual(contributions[ids[0]]['exclusive'], 201)
+        # Observations are bounded as well, and those a kept generation cites stay.
+        self.assertEqual(p.schema.prune_source_history(self.db, keep_observations=2),
+                         {'generations': 0, 'entries': 0, 'observations': 2 * (keep + 6) - 2 * keep})
+        cited = {row[0] for row in self.db.execute('SELECT observation_id FROM source_generation')}
+        remaining = {row[0] for row in self.db.execute('SELECT id FROM source_observation')}
+        self.assertLessEqual(cited, remaining)
+
+    async def test_retention_covers_history_left_by_an_older_version(self):
+        pages = {}
+        original = p.schema.SOURCE_GENERATION_KEEP
+        p.schema.SOURCE_GENERATION_KEEP = 100   # an unbounded writer, as before
+        try:
+            async with self.serve(pages) as base:
+                for run in range(6):
+                    pages['/a'] = self.listing(run, 50)
+                    await p.collect(self.db, [f'http {base}/a'], [], allow_private_sources=True, quiet=True)
+        finally:
+            p.schema.SOURCE_GENERATION_KEEP = original
+        source_id = p.source_key(f'http {base}/a')
+        self.assertEqual(len(self.generations(source_id)), 6)
+        preview = p.schema.retention_preview(self.db)
+        history = preview.to_dict()['source_history']
+        self.assertEqual((history['generations'], history['entries']), (6 - original, (6 - original) * 50))
+        self.assertEqual(self.entries(), 300)   # a preview deletes nothing
+        report = p.schema.apply_retention(self.db)
+        deleted = report.to_dict()['deleted']
+        self.assertEqual(deleted['source_generation_entry'], (6 - original) * 50)
+        self.assertEqual(deleted['source_generation'], 6 - original)
+        self.assertEqual(len(self.generations(source_id)), original)
+        self.assertEqual(p.schema.retention_preview(self.db).to_dict()['source_history']['entries'], 0)
+        self.assertEqual(p.source_contributions(self.db, [source_id])[source_id]['accepted'], 50)
+
+    async def test_304_reapplies_the_last_good_list_to_the_target_collection(self):
+        body = b'11.30.0.1:80\n11.30.0.2:80\n11.30.0.3:80\n'
+        headers = {'/l': {'ETag': '"v1"'}}
+        async with self.serve({'/l': body}, headers=headers) as base:
+            spec = f'http {base}/l'
+            await p.collect(self.db, [spec], [], allow_private_sources=True, quiet=True)
+        key = p.source_key(spec)
+        public = p.ensure_collection(self.db, None)
+        second = p.schema.create_collection(self.db, 'second')
+        removed = p.schema.endpoint_id('http://11.30.0.2:80')
+        p.schema.remove_member(self.db, public, removed)
+        self.db.commit()
+
+        def members(collection):
+            return sorted(row[0] for row in self.db.execute(
+                'SELECT e.canonical FROM membership m JOIN endpoints e ON e.id=m.endpoint_id'
+                ' WHERE m.collection_id=?', (collection,)))
+
+        expected = ['http://11.30.0.1:80', 'http://11.30.0.2:80', 'http://11.30.0.3:80']
+        generations = len(self.generations(key))
+        async with self.serve({'/l': body}, statuses={'/l': 304}) as base2:
+            plan = p.SourcePlan(key, base2 + '/l', 'http')
+            into_second = await p.collect(self.db, [], [], plans=[plan], collection_id=second,
+                                          allow_private_sources=True, quiet=True)
+            into_public = await p.collect(self.db, [], [], plans=[plan],
+                                          allow_private_sources=True, quiet=True)
+        for report in (into_second, into_public):
+            entry = report['sources'][0]
+            self.assertTrue(entry['served_from_cache'])
+            self.assertEqual((entry['rows'], entry['accepted'], entry['recognized']), (3, 0, 0))
+            self.assertTrue(entry['complete'])
+        self.assertEqual(members(second), expected)
+        self.assertEqual(members(public), expected)
+        self.assertEqual(self.db.execute('SELECT count(*) FROM membership_source WHERE collection_id=?',
+                                         (second,)).fetchone()[0], 3)
+        self.assertEqual(len(self.generations(key)), generations, 'a 304 is not a new generation')
+
+    async def test_304_reapply_respects_the_item_budget(self):
+        body = ''.join(f'11.31.0.{index}:80\n' for index in range(1, 11)).encode()
+        async with self.serve({'/l': body}, headers={'/l': {'ETag': '"v1"'}}) as base:
+            spec = f'http {base}/l'
+            await p.collect(self.db, [spec], [], allow_private_sources=True, quiet=True)
+        key = p.source_key(spec)
+        second = p.schema.create_collection(self.db, 'second')
+        self.db.commit()
+        async with self.serve({'/l': body}, statuses={'/l': 304}) as base2:
+            report = await p.collect(self.db, [], [], plans=[p.SourcePlan(key, base2 + '/l', 'http')],
+                                     collection_id=second, allow_private_sources=True, quiet=True,
+                                     max_items=4)
+        entry = report['sources'][0]
+        self.assertEqual(entry['error'], 'SOURCE_ITEM_BUDGET')
+        self.assertFalse(entry['complete'])
+        self.assertEqual(self.db.execute('SELECT count(*) FROM membership WHERE collection_id=?',
+                                         (second,)).fetchone()[0], 4)
+
+    async def test_a_retry_after_a_broken_download_starts_its_counters_again(self):
+        body = ''.join(f'11.40.0.{index}:80\n' for index in range(1, 201)).encode()
+        calls = []
+
+        async def handler(reader, writer):
+            try:
+                await reader.readuntil(b'\r\n\r\n')
+                calls.append(1)
+                head = f'HTTP/1.1 200 OK\r\nContent-Length: {len(body)}\r\nConnection: close\r\n\r\n'.encode()
+                # The first answer breaks off two thirds into the list.
+                writer.write(head + (body[:len(body) * 2 // 3] if len(calls) == 1 else body))
+                await writer.drain()
+            finally:
+                writer.close()
+                with contextlib.suppress(ConnectionError):
+                    await writer.wait_closed()
+
+        async def no_sleep(_seconds):
+            return None
+
+        server = await asyncio.start_server(handler, '127.0.0.1', 0)
+        try:
+            url = f'http://127.0.0.1:{server.sockets[0].getsockname()[1]}/l'
+            # Room for the list once, not for the broken attempt plus the list.
+            report = await p.collect(self.db, [f'http {url}'], [], allow_private_sources=True, quiet=True,
+                                     max_source_bytes=len(body) + 10, max_source_candidates=250,
+                                     sleep=no_sleep)
+        finally:
+            server.close()
+            await server.wait_closed()
+        entry = report['sources'][0]
+        self.assertEqual(len(calls), 2)
+        self.assertIsNone(entry['error'], entry)
+        self.assertEqual((entry['rows'], entry['accepted'], entry['duplicate']), (200, 200, 0))
+        self.assertEqual(entry['bytes'], len(body))
+        self.assertEqual(entry['pages'], 1)
+
+    async def test_a_source_cut_off_by_the_candidate_limit_reports_its_page(self):
+        body = ''.join(f'11.41.0.{index}:80\n' for index in range(1, 21)).encode()
+        async with self.serve({'/l': body}) as base:
+            report = await p.collect(self.db, [f'http {base}/l'], [], allow_private_sources=True,
+                                     quiet=True, max_source_candidates=5)
+        entry = report['sources'][0]
+        self.assertEqual(entry['error'], 'SOURCE_CANDIDATE_LIMIT')
+        self.assertEqual((entry['pages'], entry['accepted']), (1, 5))
+
+    async def test_a_json_page_is_parsed_once(self):
+        import json
+        from unittest import mock
+        pages = {
+            '/p?page=1': json.dumps({'data': [{'ip': '11.42.0.1', 'port': 80, 'protocol': 'http'}],
+                                     'page': 1, 'total': 2, 'marker': 'page-body'}).encode(),
+            '/p?page=2': json.dumps({'data': [{'ip': '11.42.0.2', 'port': 80, 'protocol': 'http'}],
+                                     'page': 2, 'total': 2, 'marker': 'page-body'}).encode(),
+        }
+        profile = {'kind': 'page-json', 'profile': 'page-number-v1',
+                   'config': {'records_path': 'data', 'page_path': 'page', 'total_path': 'total'}}
+        real = json.loads
+        parsed = []
+
+        def counting(text, *args, **kwargs):
+            if 'page-body' in (text.decode('utf-8', 'replace') if isinstance(text, bytes) else str(text)):
+                parsed.append(1)
+            return real(text, *args, **kwargs)
+
+        async with self.serve(pages) as base:
+            with mock.patch('json.loads', counting):
+                report = await p.collect(self.db, [], [], plans=[
+                    p.SourcePlan('paged', base + '/p?page=1', 'page-json', profile)],
+                    allow_private_sources=True, quiet=True)
+        entry = report['sources'][0]
+        self.assertEqual((entry['accepted'], entry['pages'], entry['error']), (2, 2, None), entry)
+        self.assertEqual(len(parsed), 2)
+
+
+class NextUrlPaginationTests(unittest.TestCase):
+    def test_absolute_and_relative_links_keep_their_path_and_query(self):
+        profile = {'config': {'mode': 'next-url'}}
+        base = 'https://example.test/api?page=1'
+        self.assertEqual(source_adapters.next_page_url(base, {'next': 'https://example.test/api?page=2'}, profile, 2),
+                         'https://example.test/api?page=2')
+        self.assertEqual(source_adapters.next_page_url(base, {'next': '/api?page=3'}, profile, 3),
+                         'https://example.test/api?page=3')
+        with self.assertRaises(source_adapters.AdapterError):
+            source_adapters.next_page_url(base, {'next': 'https://other.test/api?page=2'}, profile, 2)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/test_db_fixtures.py b/tests/test_db_fixtures.py
index af1bf8e..8410780 100644
--- a/tests/test_db_fixtures.py
+++ b/tests/test_db_fixtures.py
@@ -1,7 +1,7 @@
 """The shared admission fixture must stay usable by every other module.
 
 `tests/fixtures/admission.py` is the one place where the observation rows and the
-`(canonical, admission_reason)` expectations are defined (CONTRACTS §2.3). Seventeen
+`(canonical, admission_reason)` expectations are defined. Seventeen
 modules import it, so it is tested here: a broken fixture would otherwise fail in
 their suites, one at a time, with no obvious cause.
 """
diff --git a/tests/test_db_migrations.py b/tests/test_db_migrations.py
index b90f472..ea26848 100644
--- a/tests/test_db_migrations.py
+++ b/tests/test_db_migrations.py
@@ -10,7 +10,7 @@
 from proxy_workbench import db
 from tests.workbench_support import legacy_database as legacy_file  # noqa: E402
 
-#: Every table CONTRACTS §3.3 declares, including the five pre-versioning ones,
+#: Every table the shared contract declares, including the five pre-versioning ones,
 #: plus the eight the source desk, the source generations and the scope
 #: exclusions need.  Those eight arrived with migration 16 and 18; the list was
 #: not extended, so the assertion "a new database is exactly the contract"
@@ -122,7 +122,7 @@ def test_legacy_database_without_version_opens_and_migrates(self):
         # The recovered identity reached the payload, which is the only thing
         # `export()` and the GUI table read.  Without this the row failed admission
         # on a collection it was never measured in, and every historic result was
-        # lost from the export until a full recheck (F02, F24).
+        # lost from the export until a full recheck.
         payload = json.loads(row["payload"])
         self.assertEqual(payload["score"], 80)
         self.assertEqual(payload["proxy"], LEGACY_ROWS[0])
@@ -347,8 +347,8 @@ def test_rebuilt_key_separates_two_access_revisions_of_one_address(self):
                          ['{"rev": 1}', '{"rev": 2}'])
         # A repeat measurement in a new job replaces the row of the same
         # (profile, access, endpoint): one address is one row, so a fresh failure
-        # cannot leave a stale success standing beside it in every artifact
-        # (F28, F09).  The per-job item is `job_item(job_id, item_id)`, not this key.
+        # cannot leave a stale success standing beside it in every artifact.
+        # The per-job item is `job_item(job_id, item_id)`, not this key.
         conn.execute(
             "INSERT OR REPLACE INTO results(profile, proxy, payload, endpoint_id, access_id,"
             " access_revision, profile_id, profile_revision, job_id, checked_at)"
diff --git a/tests/test_db_retention.py b/tests/test_db_retention.py
index afd7c0d..220862d 100644
--- a/tests/test_db_retention.py
+++ b/tests/test_db_retention.py
@@ -38,7 +38,7 @@ def seed(self):
 
         Every row names the endpoint of its own `proxy`: a result row is one
         address, so a row whose `proxy` and `endpoint_id` disagree would be six
-        measurements of one address and would be refused by the key (F28).
+        measurements of one address and would be refused by the key.
         """
         self.expires_in = [(0.5, None), (1, self.now + HOUR), (3, self.now + HOUR),
                            (10, self.now - HOUR), (11, self.now - HOUR), (12, self.now - HOUR)]
diff --git a/tests/test_db_secrets.py b/tests/test_db_secrets.py
index 9ae392b..29b8f99 100644
--- a/tests/test_db_secrets.py
+++ b/tests/test_db_secrets.py
@@ -63,7 +63,7 @@ def test_rebind_moves_the_reference_and_advances_the_revision(self):
         # A rebind is a credential change, not a rename: it must retire the
         # evidence measured with the old secret, so the revision moves on.
         # Leaving access_revision alone is what let a restored old password
-        # inherit a successful check (F04/F09).
+        # inherit a successful check.
         report = db.rebind_secrets(self.conn, {VAULT_REF: OTHER_VAULT_REF}, dry_run=False)
         self.assertFalse(report.dry_run)
         self.assertEqual(len(report.changed), 1)
diff --git a/tests/test_db_write_guard.py b/tests/test_db_write_guard.py
index 9fe52bb..7279ab7 100644
--- a/tests/test_db_write_guard.py
+++ b/tests/test_db_write_guard.py
@@ -1,6 +1,6 @@
 """F24: an old binary must not be able to write into the new schema.
 
-CONTRACTS §3.5: the new schema breaks the old positional INSERTs immediately and
+the shared contract: the new schema breaks the old positional INSERTs immediately and
 without a write, on the whole collection path -- `results`, `candidates` and
 `candidate_seen` -- while `candidate_meta` is a deliberate exception.
 """
diff --git a/tests/test_desktop_migration.py b/tests/test_desktop_migration.py
index cc01321..c8427ac 100644
--- a/tests/test_desktop_migration.py
+++ b/tests/test_desktop_migration.py
@@ -1,6 +1,6 @@
 """Moving the folder an older build wrote into.
 
-F23 asks for a migration of the old folder; CONTRACTS §3.4 requires that a data
+F23 asks for a migration of the old folder; the shared contract requires that a data
 path change happen only after the user agrees and with a backup of the old
 folder.  So the default here is a preview that writes nothing.
 """
diff --git a/tests/test_diagnose_cli.py b/tests/test_diagnose_cli.py
index a6c465e..999a62d 100644
--- a/tests/test_diagnose_cli.py
+++ b/tests/test_diagnose_cli.py
@@ -1,4 +1,4 @@
-"""`diagnose` — the diagnostic layer the product could not reach (F10, F25).
+"""`diagnose` — the diagnostic layer the product could not reach.
 
 `diagnostics.build_funnel`, `explain_zero`, `check_control`, `build_bundle` and
 `health_report` had tests and no caller: `grep` over the product found only
diff --git a/tests/test_diagnostics_bundle.py b/tests/test_diagnostics_bundle.py
index 4ec267b..7484846 100644
--- a/tests/test_diagnostics_bundle.py
+++ b/tests/test_diagnostics_bundle.py
@@ -1,4 +1,4 @@
-"""Redaction, the local bundle, health and the reproduction recipe (F25).
+"""Redaction, the local bundle, health and the reproduction recipe.
 
 The canary below is a fake secret: it must not survive into the bundle payload,
 the preview, or the file on disk.  Every test here is local; the one subprocess
diff --git a/tests/test_diagnostics_codes.py b/tests/test_diagnostics_codes.py
index 9682dc4..de3fde9 100644
--- a/tests/test_diagnostics_codes.py
+++ b/tests/test_diagnostics_codes.py
@@ -1,4 +1,4 @@
-"""Codes, help and classification of the diagnostics layer (F10, F25).
+"""Codes, help and classification of the diagnostics layer.
 
 The tests below check the behaviour a user and a consumer depend on: a code
 stays the same in every language, every code says what to do, and the engine's
@@ -42,7 +42,7 @@ def test_every_code_says_what_to_do(self):
     def test_no_error_code_outside_the_contract_canon(self):
         invented = {code for code in d.CODES if code.startswith('E_') and code not in d.CONTRACT_CODES}
         self.assertEqual(invented, set(),
-                         'E_* codes must come from CONTRACTS §5.4, not from this module')
+                         'E_* codes must come from the shared contract, not from this module')
 
     def test_codes_keep_their_documented_shape(self):
         for code in d.CODES:
diff --git a/tests/test_diagnostics_funnel.py b/tests/test_diagnostics_funnel.py
index 1e84cb2..d38b63d 100644
--- a/tests/test_diagnostics_funnel.py
+++ b/tests/test_diagnostics_funnel.py
@@ -1,4 +1,4 @@
-"""The zero-result funnel, its stages and the device/target control (F10).
+"""The zero-result funnel, its stages and the device/target control.
 
 Every scenario here is local: rows are plain dicts in the shape the engine
 stores, sources are the reports `collect()` already returns, and the control
diff --git a/tests/test_exportsvc_contract.py b/tests/test_exportsvc_contract.py
index ab74cda..04e5e63 100644
--- a/tests/test_exportsvc_contract.py
+++ b/tests/test_exportsvc_contract.py
@@ -1,6 +1,6 @@
 """Snapshot contract: scope, profile, policy, status, schema version.
 
-CONTRACTS.ru.md §4.2-§4.3: what a snapshot says, what a reader may accept, and
+the shared contract: what a snapshot says, what a reader may accept, and
 which legacy names must keep working.
 """
 import json
diff --git a/tests/test_exportsvc_reader.py b/tests/test_exportsvc_reader.py
index e797e91..24b6b7f 100644
--- a/tests/test_exportsvc_reader.py
+++ b/tests/test_exportsvc_reader.py
@@ -159,7 +159,7 @@ def test_a_reader_that_uses_core_admission_gets_its_reason_into_the_rows(self):
 class SharedFixtureTests(unittest.TestCase):
     """The snapshot contract on the rows every other module tests against.
 
-    The fixture is the agreed vocabulary (HANDOFF §2.1), so a divergence between
+    The fixture is the agreed vocabulary, so a divergence between
     this module and ``core`` shows up here rather than in an integration run.
     """
 
diff --git a/tests/test_extras.py b/tests/test_extras.py
index 9c8d2cc..5c317b9 100644
--- a/tests/test_extras.py
+++ b/tests/test_extras.py
@@ -17,7 +17,7 @@
 from proxy_workbench import proxytool as p
 
 #: A result fixture describes a measurement that just happened; the
-#: admission contract has no "fresh forever" state (CONTRACTS §2.4).
+#: admission contract has no "fresh forever" state.
 _NOW = time.time()
 
 
diff --git a/tests/test_freshness.py b/tests/test_freshness.py
index b548853..b919c89 100644
--- a/tests/test_freshness.py
+++ b/tests/test_freshness.py
@@ -205,7 +205,7 @@ def test_empty_formats_and_publication_fail_closed(self):
         out = self.home / 'empty-out'
         report = p.export(self.db, 'empty', out, min_success=1)
         # "Nothing matched" and "everything expired" are different situations and
-        # now have different states (CONTRACTS §4.3, defect 3).
+        # now have different states.
         self.assertEqual((report['state'], report['state_detail'], report['exported'],
                           report['complete'], report['stale']),
                          ('empty', 'nothing_in_scope', 0, False, False))
@@ -271,14 +271,13 @@ def test_snapshot_schema_and_watch_freshness(self):
         rows = json.loads(p.export_file(out, 'ranked.json').read_text(encoding='utf-8'))
         self.assertTrue(all(row['valid_until'] > row['checked_at'] for row in rows))
         # The lifetime was written at measurement time, so a re-export with
-        # another --watch cannot move it (defect 1, R01)...
+        # another --watch cannot move it...
         again = p.export(self.db, 'fresh', out, min_success=1, watch_minutes=5)
         self.assertEqual([row['valid_until'] for row in
                           json.loads(p.export_file(out, 'ranked.json').read_text(encoding='utf-8'))],
                          [row['valid_until'] for row in rows])
         self.assertEqual(again['expires_at'], report['expires_at'])
-        # ...and the set lives as long as its newest member, not its oldest
-        # (defect 3, R02).
+        # ...and the set lives as long as its newest member, not its oldest.
         self.assertAlmostEqual(report['expires_at'], max(row['valid_until'] for row in rows), places=3)
 
 
@@ -308,8 +307,7 @@ async def test_collect_records_first_source_and_migrates_old_databases(self):
                 # A base written before the 1.6 `source` column keeps its shape and
                 # stays collectable: the many-to-many `candidate_seen` carries the
                 # provenance, and the first-seen mirror is filled only where the
-                # column exists.  See the handoff to db.py: migration 0 could
-                # backfill it instead of the engine having to know about it.
+                # column exists.
                 seen = {proxy for (proxy,) in db.execute('SELECT proxy FROM candidate_seen')}
                 self.assertEqual(seen, {'http://11.0.0.9:80', 'http://11.0.0.10:80'})
                 self.assertEqual(p.source_key('socks5 https://example.org/list.txt'),
diff --git a/tests/test_gateway.py b/tests/test_gateway.py
index 309100f..b9e5aae 100644
--- a/tests/test_gateway.py
+++ b/tests/test_gateway.py
@@ -21,7 +21,7 @@ def row(proxy, latency=100, country=None):
 
     ``checked_at=0`` is an *unknown* measurement time under the admission
     contract, and a row the engine can never produce; the gateway is right to
-    refuse it (CONTRACTS §2.4).
+    refuse it.
     """
     now = time.time()
     return dict(proxy=proxy, reliability=1, min_target_reliability=1, latency_ms=latency, jitter_ms=1, score=90,
diff --git a/tests/test_gateway_bind.py b/tests/test_gateway_bind.py
index f83679e..d0678b8 100644
--- a/tests/test_gateway_bind.py
+++ b/tests/test_gateway_bind.py
@@ -1,4 +1,4 @@
-"""Defect 18 / R12 / CONTRACTS §5.1: the gateway password is its own identity and LAN is opt-in.
+"""Defect 18 / R12 / the shared contract: the gateway password is its own identity and LAN is opt-in.
 
 The old code let the GUI hand its session token to the gateway listener and
 bound ``0.0.0.0`` by default, so the secret printed into a phone QR was also the
diff --git a/tests/test_geo_compat.py b/tests/test_geo_compat.py
index 317e914..e35280c 100644
--- a/tests/test_geo_compat.py
+++ b/tests/test_geo_compat.py
@@ -1,4 +1,4 @@
-"""The new criterion does not change what the existing picker selects (F08).
+"""The new criterion does not change what the existing picker selects.
 
 F08 adds semantics on top of the country picker, it does not replace it.  The
 only way to claim that is to run both decisions over the same rows and compare:
diff --git a/tests/test_geo_criterion.py b/tests/test_geo_criterion.py
index f0677a5..1810484 100644
--- a/tests/test_geo_criterion.py
+++ b/tests/test_geo_criterion.py
@@ -1,4 +1,4 @@
-"""One country criterion, applied the same way everywhere (F08).
+"""One country criterion, applied the same way everywhere.
 
 The cases below are the acceptance lines of F08: a German endpoint wanted for a
 Dutch exit, unknown never passing for "not in NL", names in RU and EN resolving
diff --git a/tests/test_geo_databases.py b/tests/test_geo_databases.py
index 4a3936b..ee29347 100644
--- a/tests/test_geo_databases.py
+++ b/tests/test_geo_databases.py
@@ -1,4 +1,4 @@
-"""GeoIP database status, version and installation (F08).
+"""GeoIP database status, version and installation.
 
 The databases are fixtures written to a temporary folder.  The point of these
 cases is the bookkeeping the picker never had: which version is installed, how
diff --git a/tests/test_geo_filter.py b/tests/test_geo_filter.py
index 7caca5f..0b8f17e 100644
--- a/tests/test_geo_filter.py
+++ b/tests/test_geo_filter.py
@@ -1,4 +1,4 @@
-"""One criterion in GUI, API and export, and a read-only filter that starts nothing (F08).
+"""One criterion in GUI, API and export, and a read-only filter that starts nothing.
 
 The three surfaces are represented here by the three shapes a caller actually
 has: a settings/query mapping, the keyword arguments of the export, and an API
diff --git a/tests/test_geo_picker_parity.py b/tests/test_geo_picker_parity.py
index 986625e..4c74492 100644
--- a/tests/test_geo_picker_parity.py
+++ b/tests/test_geo_picker_parity.py
@@ -1,4 +1,4 @@
-"""The backend country list and the picker in ui/app.js are the same list (F08).
+"""The backend country list and the picker in ui/app.js are the same list.
 
 The country picker is the user's existing control and this module does not
 replace it.  What it does add is a second copy of the codes and names on the
diff --git a/tests/test_geo_resolver.py b/tests/test_geo_resolver.py
index 310f8a3..360fca8 100644
--- a/tests/test_geo_resolver.py
+++ b/tests/test_geo_resolver.py
@@ -1,4 +1,4 @@
-"""Geographical knowledge and endpoint characteristics, from local files only (F08).
+"""Geographical knowledge and endpoint characteristics, from local files only.
 
 Every case runs against synthetic CSV databases written to a temporary folder -
 no proxy list, no public GeoIP service, no DNS.  What is checked here is the
diff --git a/tests/test_geo_schema.py b/tests/test_geo_schema.py
index 5de888d..2740860 100644
--- a/tests/test_geo_schema.py
+++ b/tests/test_geo_schema.py
@@ -1,4 +1,4 @@
-"""The geographical columns of migration 1 are the ones this module fills (F08).
+"""The geographical columns of migration 1 are the ones this module fills.
 
 ``geo.py`` owns no table and writes no DDL, so the contract it depends on is the
 one ``db.py`` creates.  These cases run the real migrator on a temporary
@@ -6,7 +6,7 @@
 is the check that the two agree.
 
 The columns this module asks for and does not have yet are listed in
-``docs/integration/HANDOFF/geo.md`` §1.3.  While they are missing, the test that
+``REQUESTED`` below.  While they are missing, the test that
 looks for them skips and says so; it does not pretend they exist and it does not
 fail for a column the owner has not added yet.
 """
@@ -32,7 +32,7 @@
     'hosting': 'hosting',
     'cidr': 'cidr',
 }
-# Requested in HANDOFF geo.md §1.3, not declared by the migrator yet.
+# Requested by the geo module, not declared by the migrator yet.
 REQUESTED = (
     ('endpoints', 'hosting_basis'),
     ('observations', 'exit_ip'),
@@ -100,7 +100,7 @@ def test_the_requested_columns_are_reported_until_the_owner_adds_them(self):
         missing = ['%s.%s' % (table, column) for table, column in REQUESTED
                    if column not in self.columns(table)]
         if missing:
-            self.skipTest('not in the schema yet, requested in HANDOFF geo.md §1.3: %s'
+            self.skipTest('not in the schema yet: %s'
                           % ', '.join(missing))
         for table, column in REQUESTED:
             self.assertIn(column, self.columns(table))
diff --git a/tests/test_gui.py b/tests/test_gui.py
index ed44916..b34300e 100644
--- a/tests/test_gui.py
+++ b/tests/test_gui.py
@@ -99,8 +99,7 @@ def test_quick_filters_apply_real_clean_speed_and_http_conditions(self):
             store_result(db, ('fixture', proxy, json.dumps(row)))
         db.commit()
         # The published snapshot is what names the collection and the profile for
-        # every reader; without one there is nothing for the surfaces to agree on
-        # (CONTRACTS §1.2 rule 2).
+        # every reader; without one there is nothing for the surfaces to agree on.
         p.export(db, 'fixture', self.home / 'exports', min_success=1)
         db.close()
         (self.home / 'last-profile.txt').write_text('fixture', encoding='utf-8')
@@ -288,7 +287,7 @@ def test_collect_job_dedup_and_empty_profile_scan(self):
 
         # A published generation is immutable and carries a manifest, so the only
         # honest way to have an expired one is to publish one whose row lifetime
-        # has passed (CONTRACTS §4.2).
+        # has passed.
         db = p.open_db(self.home/'proxies.sqlite3')
         active = (self.home/'last-profile.txt').read_text(encoding='utf-8').strip()
         proxy = 'http://11.1.1.1:80'
@@ -303,7 +302,7 @@ def test_collect_job_dedup_and_empty_profile_scan(self):
         state = self.client.get('/api/state').json()
         # A row whose lifetime has passed is not served: the table is empty and
         # the download yields an empty file, not an expired address.  The set
-        # state names the reason instead of calling it "complete" (defect 3).
+        # state names the reason instead of calling it "complete".
         # The published set is empty because its only row had expired, and the
         # status says so instead of claiming a completed export.
         self.assertEqual(state['export']['state'], 'empty')
diff --git a/tests/test_importer_fixtures.py b/tests/test_importer_fixtures.py
index 91c2f70..6679f7f 100644
--- a/tests/test_importer_fixtures.py
+++ b/tests/test_importer_fixtures.py
@@ -2,7 +2,7 @@
 
 The schema is the one `db.migrate()` creates -- the importer writes no DDL of
 its own, and its tests prove behaviour against the real migrator rather than
-against a private copy of the contract (HANDOFF/README.ru.md §2.2).
+against a private copy of the contract.
 """
 
 import sys
@@ -14,7 +14,7 @@
 from proxy_workbench import db
 from proxy_workbench import importer as imp
 
-#: the four tables this module reads and writes (CONTRACTS.ru.md §3.3, 1, 2, 12)
+#: the four tables this module reads and writes
 TABLES = ('endpoints', 'collections', 'membership', 'import_batch')
 
 
diff --git a/tests/test_integration_contracts.py b/tests/test_integration_contracts.py
index db23b14..683593d 100644
--- a/tests/test_integration_contracts.py
+++ b/tests/test_integration_contracts.py
@@ -24,7 +24,7 @@ def _workbench(home):
 
 
 class OneShotSecretTests(unittest.TestCase):
-    """CONTRACTS §5.1: a full secret is shown once, and an idempotent replay is
+    """the shared contract: a full secret is shown once, and an idempotent replay is
     not a second issuance."""
 
     def setUp(self):
diff --git a/tests/test_jobs_events.py b/tests/test_jobs_events.py
index f35848f..716df6d 100644
--- a/tests/test_jobs_events.py
+++ b/tests/test_jobs_events.py
@@ -1,6 +1,6 @@
 """Structured events and progress, and the secrets that must never reach them.
 
-CONTRACTS.ru.md §5.6 (events), §3.3 (migration 6), F29 (canary secrets).
+the shared contract (events), §3.3 (migration 6), F29 (canary secrets).
 """
 from __future__ import annotations
 
diff --git a/tests/test_jobs_items.py b/tests/test_jobs_items.py
index a636477..1174185 100644
--- a/tests/test_jobs_items.py
+++ b/tests/test_jobs_items.py
@@ -1,6 +1,6 @@
 """Queue, item states, and what pause, cancel and retry must never destroy.
 
-CONTRACTS.ru.md §6.3, F11 acceptance, defect 6.
+the shared contract, F11 acceptance, defect 6.
 """
 from __future__ import annotations
 
diff --git a/tests/test_jobs_lifecycle.py b/tests/test_jobs_lifecycle.py
index 370198b..e670289 100644
--- a/tests/test_jobs_lifecycle.py
+++ b/tests/test_jobs_lifecycle.py
@@ -1,6 +1,6 @@
 """Job lifecycle: fixed input, one writer, honest transitions, honest progress.
 
-CONTRACTS.ru.md §6.2 and F11.
+the shared contract and F11.
 """
 from __future__ import annotations
 
diff --git a/tests/test_jobs_recovery.py b/tests/test_jobs_recovery.py
index e54042c..ae5f437 100644
--- a/tests/test_jobs_recovery.py
+++ b/tests/test_jobs_recovery.py
@@ -1,6 +1,6 @@
 """Checkpoints, crash recovery and sleep: a stop is resumable, never lossy.
 
-CONTRACTS.ru.md §6.2, F11 «журнал, checkpoint, crash recovery и обработка сна».
+the shared contract, F11 «журнал, checkpoint, crash recovery и обработка сна».
 """
 from __future__ import annotations
 
diff --git a/tests/test_jobs_support.py b/tests/test_jobs_support.py
index 6d6c67d..773e2bf 100644
--- a/tests/test_jobs_support.py
+++ b/tests/test_jobs_support.py
@@ -43,7 +43,7 @@ class JobFixture(unittest.TestCase):
 
     The schema comes from `db.migrate()` when the migrator is in the tree, so
     these tests run against the real migration 6 and not against a private
-    copy of it (HANDOFF §2.2).  `jobs.install_schema` is the fallback and the
+    copy of it.  `jobs.install_schema` is the fallback and the
     second source of the same four tables.
     """
 
diff --git a/tests/test_packaging_release.py b/tests/test_packaging_release.py
index cfc054f..9512afa 100644
--- a/tests/test_packaging_release.py
+++ b/tests/test_packaging_release.py
@@ -91,6 +91,35 @@ def test_the_installer_is_per_user_and_never_elevates(self):
     def test_the_installer_refuses_to_build_without_a_version(self):
         self.assertIn('#error ProductVersion is required', self.spec('windows-installer.iss'))
 
+    def test_command_line_shortcuts_open_the_console_cli(self):
+        # The GUI executable is windowed: "--help" on it prints nowhere.  A
+        # command line shortcut has to run the console binary in a console
+        # that stays open.
+        lines = [line for line in self.spec('windows-installer.iss').splitlines()
+                 if line.startswith('Name:') and 'Filename:' in line and 'command line' in line.lower()]
+        self.assertEqual(len(lines), 2, lines)
+        for line in lines:
+            self.assertIn('Filename: "{cmd}"', line)
+            self.assertIn('/k ', line)
+            self.assertIn('{#AppCliExeName}', line)
+            self.assertNotIn('{#AppExeName}', line)
+
+    def test_the_installed_application_can_be_quit_without_the_task_manager(self):
+        # No menu bar on Windows and no console on the GUI build: the Start
+        # menu and the uninstaller use the host's --quit command instead.
+        text = self.spec('windows-installer.iss')
+        self.assertIn('Filename: "{app}\\{#AppExeName}"; Parameters: "--quit"', text)
+        uninstall = text.split('[UninstallRun]', 1)[1].split('\n[', 1)[0]
+        self.assertIn('Parameters: "--quit"', uninstall)
+        self.assertIn('RunOnceId:', uninstall)
+        from proxy_workbench import __main__ as entry
+        self.assertEqual(entry.resolve(['--quit'])[0], 'desktop')
+
+    def test_an_installer_that_edits_path_announces_the_change(self):
+        text = self.spec('windows-installer.iss')
+        self.assertIn('ValueName: "Path"', text)
+        self.assertIn('ChangesEnvironment=yes', text)
+
 
 class ManifestTests(unittest.TestCase):
     def test_an_artifact_entry_records_size_digest_and_signature_state(self):
diff --git a/tests/test_paths.py b/tests/test_paths.py
index f251cfc..34684c9 100644
--- a/tests/test_paths.py
+++ b/tests/test_paths.py
@@ -35,7 +35,7 @@ def test_entry_point_dispatch(self):
 
         This test used to expect an empty command line to open the interface.
         That was true before the background layer existed, and it stopped being
-        true the moment the shipped entry point became the desktop host (F22/F23):
+        true the moment the shipped entry point became the desktop host:
         the application a user double-clicks is the process that owns the menu
         bar, the single instance and the login item.  Routing it straight to the
         page is exactly what a shipped product must not do -- the window would
diff --git a/tests/test_platform_runtime.py b/tests/test_platform_runtime.py
index 8513be9..0fa44f1 100644
--- a/tests/test_platform_runtime.py
+++ b/tests/test_platform_runtime.py
@@ -128,6 +128,55 @@ def test_data_before_status_reads_only_the_selected_workspace(self):
         self.assertEqual(json.loads(output.getvalue()), {'running': False, 'data': str(self.layout.data)})
         self.assertFalse(self.layout.data.exists())
 
+    def test_quit_routes_to_the_host_and_is_a_no_op_when_nothing_runs(self):
+        self.assertEqual(entry.resolve(['--quit'])[0], 'desktop')
+        self.assertEqual(entry.resolve(['--data', 'folder', '--quit'])[0], 'desktop')
+        output = io.StringIO()
+        with mock.patch.dict(os.environ, {'HOME': str(self.root), 'USERPROFILE': str(self.root)}, clear=True), \
+                mock.patch.object(desktop, 'tr', side_effect=lambda ru, en: en), \
+                mock.patch.object(desktop, 'control_request') as request, contextlib.redirect_stdout(output):
+            self.assertEqual(entry.main(['--data', str(self.layout.data), '--quit']), 0)
+        request.assert_not_called()
+        self.assertIn('not running', output.getvalue())
+        self.assertFalse(self.layout.data.exists())
+
+    def test_quit_asks_the_running_instance_and_waits_until_it_lets_go(self):
+        owner = desktop.InstanceLock(self.layout)
+        self.addCleanup(owner.release)
+        self.assertTrue(owner.acquire())
+        owner.publish(desktop.Instance(os.getpid(), 'tcp://127.0.0.1:12345', 'local-test-token'))
+        sent = []
+
+        def answer(address, token, request, **_):
+            sent.append((address, token, request))
+            owner.release()           # what the host does once its listeners are down
+            return {'ok': True, 'bye': True}
+
+        with mock.patch.object(desktop, 'control_request', side_effect=answer), \
+                mock.patch.object(desktop, 'tr', side_effect=lambda ru, en: en), \
+                contextlib.redirect_stdout(io.StringIO()) as output:
+            self.assertEqual(desktop._quit_running(self.layout, timeout=5), 0)
+        self.assertEqual(sent, [('tcp://127.0.0.1:12345', 'local-test-token',
+                                 {'action': 'quit', 'reason': 'command'})])
+        self.assertIn('has quit', output.getvalue())
+
+    def test_quit_reports_an_instance_that_does_not_go_away(self):
+        owner = desktop.InstanceLock(self.layout)
+        self.addCleanup(owner.release)
+        self.assertTrue(owner.acquire())
+        owner.publish(desktop.Instance(os.getpid(), 'tcp://127.0.0.1:12345', 'local-test-token'))
+        english = mock.patch.object(desktop, 'tr', side_effect=lambda ru, en: en)
+        english.start()
+        self.addCleanup(english.stop)
+        with mock.patch.object(desktop, 'control_request', return_value={'ok': True, 'bye': True}), \
+                contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()) as errors:
+            self.assertEqual(desktop._quit_running(self.layout, timeout=0.5), 2)
+        self.assertIn('not quit', errors.getvalue())
+        with mock.patch.object(desktop, 'control_request', return_value={'ok': False, 'error': 'gone'}), \
+                contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()) as errors:
+            self.assertEqual(desktop._quit_running(self.layout, timeout=0.5), 2)
+        self.assertIn('gone', errors.getvalue())
+
     def test_no_browser_is_preserved_on_second_launch(self):
         host = desktop.DesktopHost(self.layout, ['--no-browser'], tray=False)
         record = desktop.Instance(os.getpid(), 'tcp://127.0.0.1:12345', 'local-test-token')
diff --git a/tests/test_pools_lifecycle.py b/tests/test_pools_lifecycle.py
index e591da2..9c00f5d 100644
--- a/tests/test_pools_lifecycle.py
+++ b/tests/test_pools_lifecycle.py
@@ -13,7 +13,7 @@
 
 
 class AcceptanceScenarioTest(PoolTestCase):
-    """The four scenarios MASTER-PROMPT F14 asks for, plus their neighbours."""
+    """The four required pool scenarios, plus their neighbours."""
 
     def test_two_failures_are_replaced_from_the_reserve_back_to_five(self):
         self.create_pool(desired=5, minimum=3, reserve=2)
diff --git a/tests/test_probes_reference.py b/tests/test_probes_reference.py
index 48f97b3..45ba3b2 100644
--- a/tests/test_probes_reference.py
+++ b/tests/test_probes_reference.py
@@ -1,4 +1,4 @@
-"""End-to-end probe scenarios against the local reference probe (F20).
+"""End-to-end probe scenarios against the local reference probe.
 
 Every byte here travels over loopback to the reference endpoint this module
 ships.  No public proxy, DNSBL or third-party service is contacted.
diff --git a/tests/test_profiles_spec.py b/tests/test_profiles_spec.py
index 2dbe082..80a4abf 100644
--- a/tests/test_profiles_spec.py
+++ b/tests/test_profiles_spec.py
@@ -87,7 +87,7 @@ def test_optional_rule_needs_a_number_above_zero(self):
 
 
 class NonEmptyGuaranteeTests(unittest.TestCase):
-    """MASTER-PROMPT F05: all(empty), K=0 and all-disabled probes never pass."""
+    """all(empty), K=0 and all-disabled probes never pass."""
 
     def assert_refused(self, code, build):
         with self.assertRaises(profiles.ProfileError) as raised:
@@ -297,7 +297,7 @@ def test_copy_of_validates_the_change(self):
             original.copy_of(targets=[])
 
     def test_every_emitted_reason_code_is_documented(self):
-        """i18n needs one closed list, so no verdict may invent a code (CONTRACTS §5.4)."""
+        """i18n needs one closed list, so no verdict may invent a code."""
         emitted = set()
         cases = [
             (support.spec(), [support.ok(support.spec(), support.BASIC)]),
diff --git a/tests/test_profiles_store.py b/tests/test_profiles_store.py
index 2827a81..18236b8 100644
--- a/tests/test_profiles_store.py
+++ b/tests/test_profiles_store.py
@@ -1,7 +1,7 @@
 """The named profile library: create, copy, revisions, archive, default, diff.
 
 All of it runs on a temporary SQLite file that `db.migrate()` brought to the
-contract schema (CONTRACTS §3.3, migration 9).  This module writes no DDL, and
+contract schema .  This module writes no DDL, and
 one test proves it by tracing every statement the store issues.
 """
 from pathlib import Path
@@ -294,7 +294,7 @@ def test_a_diff_of_a_revision_against_itself_reports_no_change(self):
 
 class NoDdlTests(support.StoreFixture):
     def test_the_store_issues_no_ddl_of_its_own(self):
-        """CONTRACTS §3.3: `db.py` owns every DDL statement in the project."""
+        """the shared contract: `db.py` owns every DDL statement in the project."""
         statements = []
         self.conn.set_trace_callback(statements.append)
         try:
@@ -354,7 +354,7 @@ def test_migration_keeps_the_legacy_row_and_adds_named_profiles(self):
         self.assertEqual([(row['id'], row['name'], row['revision']) for row in legacy_rows],
                          [('profile0001', None, 1)])
         # db.migrate backfills the digest from the content hash, and the name stays
-        # NULL: naming a legacy profile would be inventing an origin (F02).
+        # NULL: naming a legacy profile would be inventing an origin.
         self.assertEqual(legacy_rows[0]['digest'], 'profile0001')
         self.assertEqual(self.store.list(), [])
         spec = support.spec()
diff --git a/tests/test_providers.py b/tests/test_providers.py
index e7dc1cd..d8352a9 100644
--- a/tests/test_providers.py
+++ b/tests/test_providers.py
@@ -15,7 +15,7 @@
 from proxy_workbench import proxytool as p
 
 #: A result fixture describes a measurement that just happened; the
-#: admission contract has no "fresh forever" state (CONTRACTS §2.4).
+#: admission contract has no "fresh forever" state.
 _NOW = time.time()
 
 ASN_CSV = ('11.0.0.0,11.0.0.255,64500,Example Home Broadband\n'
@@ -101,7 +101,7 @@ def test_gui_results_column_and_filter(self):
         db.close()
         # The table, the API and the engine only agree on which rows exist once a
         # snapshot is published: the collection and the profile come from the
-        # published status, not from a guess (CONTRACTS §1.2 rule 2).
+        # published status, not from a guess.
         (self.home / 'last-profile.txt').write_text('fx')
         server = gui.make_server(self.home)
         thread = threading.Thread(target=server.serve_forever, daemon=True)
diff --git a/tests/test_scan_budgets.py b/tests/test_scan_budgets.py
index 283c4bf..98fc7f3 100644
--- a/tests/test_scan_budgets.py
+++ b/tests/test_scan_budgets.py
@@ -9,13 +9,13 @@
 
 * `gate.acquire()`/`gate.release()` were called without `requests=`/`bytes=`, so
   `ResourceGate._requests`/`_bytes` stayed 0 and `--max-requests`/`--run-max-bytes`
-  were silent no-ops (F12, defect 23).
+  were silent no-ops.
 * `counted()` answered `1 if row.get('exit_ip')` for both `ip` and `exit`, and
   looked for the exit address at the top level while the judge writes
   `anonymity.exit_ip`: N unique IPs and N confirmed exit IPs were the same number,
   and both were always zero.
 * A sweep that finished short of `--want` reported `stop_reason='complete'`, so
-  an unreachable unit looked like an empty corpus (F12, F10).
+  an unreachable unit looked like an empty corpus.
 
 Everything runs on documentation addresses (RFC 5737) against a temporary
 database. No socket is opened.
diff --git a/tests/test_scan_engine_regressions.py b/tests/test_scan_engine_regressions.py
new file mode 100644
index 0000000..04f23e6
--- /dev/null
+++ b/tests/test_scan_engine_regressions.py
@@ -0,0 +1,379 @@
+"""Checking-engine regressions, on local mock proxies only.
+
+* The CLI scan opened a second SQLite connection for its job store while the
+  scan held an open write batch on the first one.  Every ``claim`` then waited
+  the whole busy timeout with the event loop blocked (about 5 s per result),
+  gave up, and left the job item ``pending``: a run of 130 candidates took
+  minutes and a finished job still looked unfinished.
+* The adaptive limit counted a dead proxy as overload, so a corpus that is
+  mostly dead walked the scan down to one check at a time.
+* A connect that failed because this machine ran out of descriptors was
+  recorded as the proxy being ``UNREACHABLE``.
+"""
+import asyncio
+import contextlib
+import errno
+import io
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+import socket
+import sqlite3
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+from proxy_workbench import pipeline, proxytool
+
+
+class _Healthy(BaseHTTPRequestHandler):
+    def log_message(self, *args):
+        pass
+
+    def do_GET(self):
+        body = b'healthy'
+        self.send_response(200)
+        self.send_header('Content-Length', str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+
+def _closed_port():
+    with socket.socket() as probe:
+        probe.bind(('127.0.0.1', 0))
+        return probe.getsockname()[1]
+
+
+class CliScanJobTests(unittest.TestCase):
+    def test_a_cli_scan_finishes_every_job_item_without_waiting_on_itself(self):
+        server = ThreadingHTTPServer(('127.0.0.1', 0), _Healthy)
+        threading.Thread(target=server.serve_forever, daemon=True).start()
+        self.addCleanup(server.server_close)
+        self.addCleanup(server.shutdown)
+        with tempfile.TemporaryDirectory() as tmp:
+            data = Path(tmp)
+            listing = data / 'list.txt'
+            dead = sorted({_closed_port() for _ in range(6)})
+            listing.write_text('\n'.join([f'http://127.0.0.1:{server.server_port}']
+                                         + [f'http://127.0.0.1:{port}' for port in dead]) + '\n')
+            out = io.StringIO()
+            with contextlib.redirect_stdout(out), contextlib.redirect_stderr(out), \
+                    mock.patch.dict('os.environ', {'HTTP_PROXY': '', 'HTTPS_PROXY': '', 'ALL_PROXY': ''}):
+                self.assertEqual(proxytool.main(['collect', '--no-sources', '--data', str(data),
+                                                 '--input', str(listing), '--allow-private-endpoints']), 0,
+                                 out.getvalue())
+                started = time.monotonic()
+                code = proxytool.main(['scan', '--data', str(data), '--url', 'http://service.invalid/health',
+                                       '--attempts', '1', '--timeout', '3', '--connect-timeout', '2',
+                                       '--max-per-host', '16', '--rate', '0'])
+                elapsed = time.monotonic() - started
+            self.assertEqual(code, 0, out.getvalue())
+            # One busy-timeout wait per result was ~5 s each; seven of them
+            # would be over half a minute.
+            self.assertLess(elapsed, 15, out.getvalue())
+            with contextlib.closing(sqlite3.connect(data / 'proxies.sqlite3')) as conn:
+                states = dict(conn.execute('SELECT state, count(*) FROM job_item GROUP BY state'))
+                passing = conn.execute("SELECT count(*) FROM results WHERE error_code IS NULL "
+                                       "AND json_extract(payload, '$.successes') > 0").fetchone()[0]
+            self.assertEqual(states, {'done': 1, 'unreachable': len(dead)})
+            self.assertEqual(passing, 1)
+
+    def test_a_lent_connection_is_not_closed_by_the_workbench(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            conn = proxytool.open_db(Path(tmp) / 'proxies.sqlite3')
+            try:
+                bench = proxytool.Workbench(tmp, conn=conn)
+                self.assertIs(bench.conn, conn)
+                bench.close()
+                conn.execute('SELECT 1')  # still open
+            finally:
+                conn.close()
+
+
+class EndpointConcurrencyTests(unittest.TestCase):
+    def test_dead_proxies_do_not_walk_the_limit_down(self):
+        controller = proxytool.EndpointConcurrency(minimum=1, maximum=64, window=8, increase=4)
+        before = controller.limit
+        for _ in range(64):
+            controller.observe_outcome(pipeline.StageOutcome('cheap', False, code='UNREACHABLE',
+                                                             failed_stage='tcp'))
+        self.assertGreater(controller.limit, before)
+        self.assertEqual(controller.snapshot().decreases, 0)
+
+    def test_local_failures_still_shrink_it(self):
+        controller = proxytool.EndpointConcurrency(minimum=1, maximum=64, window=8)
+        for _ in range(32):
+            controller.observe_outcome(pipeline.StageOutcome('basic', False, code='OSError'))
+        self.assertEqual(controller.limit, 1)
+
+    def test_a_mostly_dead_scan_keeps_its_workers(self):
+        dead = sorted({_closed_port() for _ in range(80)})
+
+        async def run():
+            config = pipeline.PipelineConfig(
+                sources=(pipeline.fixture_source('s', [f'http://127.0.0.1:{p}' for p in dead]),),
+                budgets=pipeline.Budgets(max_inflight=32, max_open_fds=1000, max_requests=None,
+                                         max_bytes=None),
+                limits=pipeline.Limits(max_per_host=64),
+                runners=pipeline.Runners(cheap=cheap, basic=None, expensive=None),
+                run_cheap=True, run_basic=False, run_expensive=False,
+                normalize=lambda value: value or None)
+            return await pipeline.Pipeline(config, concurrency=proxytool.EndpointConcurrency(
+                minimum=1, maximum=32, window=8, increase=4)).run()
+
+        async def cheap(item, *, stage, limit):
+            await asyncio.sleep(0.002)
+            ok = await proxytool.reachable(item.endpoint, 1)
+            return pipeline.StageOutcome(stage, ok, code=None if ok else 'UNREACHABLE',
+                                         failed_stage=None if ok else 'tcp')
+
+        result = asyncio.run(run())
+        self.assertEqual(result.metrics.measured, len(dead))
+        self.assertEqual(result.metrics.concurrency['decreases'], 0)
+        self.assertGreater(result.metrics.peak_inflight, 8)
+
+
+class _Counting(BaseHTTPRequestHandler):
+    """A healthy proxy that records every request and can raise the stop file."""
+
+    def log_message(self, *args):
+        pass
+
+    def do_GET(self):
+        self.server.world.hit(self.server.server_port)
+        time.sleep(self.server.world.delay)
+        body = b'healthy'
+        self.send_response(200)
+        self.send_header('Content-Length', str(len(body)))
+        self.end_headers()
+        with contextlib.suppress(OSError):
+            self.wfile.write(body)
+
+
+class _World:
+    def __init__(self, test, count, delay=0.0):
+        self.delay = delay
+        self.hits = []
+        self.lock = threading.Lock()
+        self.stop_at = None
+        self.stop_file = None
+        self.servers = []
+        for _ in range(count):
+            server = ThreadingHTTPServer(('127.0.0.1', 0), _Counting)
+            server.daemon_threads = True
+            server.world = self
+            threading.Thread(target=server.serve_forever, daemon=True).start()
+            test.addCleanup(server.server_close)
+            test.addCleanup(server.shutdown)
+            self.servers.append(server)
+
+    def hit(self, port):
+        with self.lock:
+            self.hits.append(port)
+            if self.stop_at is not None and len(self.hits) >= self.stop_at:
+                self.stop_file.write_text('stop')
+
+    def proxies(self):
+        return [f'http://127.0.0.1:{server.server_port}' for server in self.servers]
+
+
+def _cli(argv):
+    out = io.StringIO()
+    with contextlib.redirect_stdout(out), contextlib.redirect_stderr(out), \
+            mock.patch.dict('os.environ', {'HTTP_PROXY': '', 'HTTPS_PROXY': '', 'ALL_PROXY': ''}):
+        return proxytool.main(argv), out.getvalue()
+
+
+def _collect(test, data, proxies):
+    listing = data / 'list.txt'
+    listing.write_text('\n'.join(proxies) + '\n')
+    code, out = _cli(['collect', '--no-sources', '--data', str(data), '--input', str(listing),
+                      '--allow-private-endpoints'])
+    test.assertEqual(code, 0, out)
+
+
+def _scan_args(data, *extra):
+    return ['scan', '--data', str(data), '--url', 'http://service.invalid/health', '--attempts', '1',
+            '--timeout', '3', '--connect-timeout', '1', '--rate', '0', *extra]
+
+
+class StopAndContinueTests(unittest.TestCase):
+    def test_the_same_command_continues_a_stopped_scan(self):
+        # A stopped run left its job ``running``; every later run was refused
+        # with E_CONFLICT_BUSY ("Error: Busy") and nothing could continue it.
+        world = _World(self, 10, delay=0.3)
+        with tempfile.TemporaryDirectory() as tmp:
+            data = Path(tmp)
+            dead = sorted({_closed_port() for _ in range(4)})
+            _collect(self, data, world.proxies() + [f'http://127.0.0.1:{port}' for port in dead])
+            world.stop_file, world.stop_at = data / 'stop', 3
+            argv = _scan_args(data, '--max-per-host', '2', '--stop-file', str(world.stop_file))
+            code, out = _cli(argv)
+            self.assertEqual(code, 130, out)
+            with contextlib.closing(sqlite3.connect(data / 'proxies.sqlite3')) as conn:
+                jobs = conn.execute('SELECT id, state FROM job').fetchall()
+                finished = {row[0] for row in conn.execute(
+                    "SELECT e.canonical FROM job_item j JOIN endpoints e ON e.id=j.endpoint_id "
+                    "WHERE j.state IN ('done', 'unreachable')")}
+            self.assertEqual([state for _, state in jobs], ['paused'])
+            self.assertTrue(finished)
+            self.assertLess(len(finished), 14)
+
+            world.stop_file.unlink()
+            world.stop_at = None
+            first_run = len(world.hits)
+            code, out = _cli(argv)
+            self.assertEqual(code, 0, out)
+            self.assertIn(jobs[0][0], out)
+            with contextlib.closing(sqlite3.connect(data / 'proxies.sqlite3')) as conn:
+                self.assertEqual(conn.execute('SELECT id, state FROM job').fetchall(),
+                                 [(jobs[0][0], 'succeeded')])
+                states = dict(conn.execute('SELECT state, count(*) FROM job_item GROUP BY state'))
+            self.assertEqual(states, {'done': 10, 'unreachable': len(dead)})
+            # Nothing the stopped run finished was measured a second time.
+            again = {f'http://127.0.0.1:{port}' for port in world.hits[first_run:]}
+            self.assertFalse(again & finished)
+
+    def test_a_job_that_cannot_start_is_not_left_queued(self):
+        from proxy_workbench import jobs
+        with tempfile.TemporaryDirectory() as tmp:
+            conn = proxytool.open_db(Path(tmp) / 'proxies.sqlite3')
+            bench = proxytool.Workbench(tmp, conn=conn)
+            try:
+                store = bench.jobs()
+                scope = jobs.Scope(collection_id='c', profile_id='p', profile_revision=1, profile_digest='p')
+                store.start(store.submit('pool_recheck', scope).id)
+                with self.assertRaises(jobs.Busy):
+                    proxytool.submit_scan_job(bench, conn, 'check', profile='p', profile_revision=1,
+                                              collection_id=proxytool.ensure_collection(conn, None),
+                                              candidates=['http://203.0.113.9:8080'])
+                self.assertEqual(store.jobs(state='queued'), [])
+            finally:
+                # Windows cannot delete the temporary folder while the database is open.
+                bench.close()
+                conn.close()
+
+
+class WatchRoundTests(unittest.TestCase):
+    def test_every_watch_round_measures_the_passing_proxies_under_its_own_job(self):
+        # Each round reused the first run's closed job, so every address looked
+        # finished and a round measured nothing at all.
+        world = _World(self, 3)
+        with tempfile.TemporaryDirectory() as tmp:
+            data = Path(tmp)
+            _collect(self, data, world.proxies() + [f'http://127.0.0.1:{_closed_port()}'])
+            # First run and one full round, then stop at the first hit of the next round.
+            world.stop_file, world.stop_at = data / 'stop', 7
+            # A round that measures nothing never reaches the stop; end it anyway.
+            safety = threading.Timer(20, lambda: world.stop_file.write_text('stop'))
+            safety.start()
+            self.addCleanup(safety.cancel)
+            code, out = _cli(_scan_args(data, '--max-per-host', '4', '--watch', '0.01',
+                                        '--stop-file', str(world.stop_file)))
+            self.assertEqual(code, 130, out)
+            with contextlib.closing(sqlite3.connect(data / 'proxies.sqlite3')) as conn:
+                jobs = conn.execute('SELECT id, state FROM job ORDER BY created_at').fetchall()
+                round_items = dict(conn.execute(
+                    'SELECT state, count(*) FROM job_item WHERE job_id=? GROUP BY state', (jobs[1][0],)))
+                observations = conn.execute('SELECT count(*) FROM observations WHERE job_id=?',
+                                            (jobs[1][0],)).fetchone()[0]
+        self.assertGreaterEqual(len(jobs), 3)
+        self.assertEqual(jobs[0][1], 'succeeded')
+        self.assertEqual(jobs[1][1], 'succeeded')
+        self.assertEqual(round_items, {'done': 3})
+        self.assertEqual(observations, 3)
+        self.assertTrue(all(world.hits.count(server.server_port) >= 2 for server in world.servers))
+
+
+class HostParkingTests(unittest.TestCase):
+    def _run(self, endpoints, *, want=0, workers=8, delay=0.05):
+        started = []
+        inflight = set()
+        peak = [0]
+
+        async def basic(item, *, stage, limit):
+            started.append(item.endpoint)
+            inflight.add(item.endpoint)
+            peak[0] = max(peak[0], len(inflight))
+            await asyncio.sleep(delay)
+            inflight.discard(item.endpoint)
+            return pipeline.StageOutcome(stage, True)
+
+        async def run():
+            config = pipeline.PipelineConfig(
+                sources=(pipeline.fixture_source('s', endpoints),),
+                budgets=pipeline.Budgets(max_inflight=workers, max_open_fds=1000, max_requests=None,
+                                         max_bytes=None),
+                limits=pipeline.Limits(max_per_host=1), find=pipeline.FindPolicy(n=want, what='endpoint'),
+                runners=pipeline.Runners(cheap=None, basic=basic, expensive=None),
+                run_cheap=False, run_basic=True, run_expensive=False,
+                normalize=lambda value: value or None)
+            return await pipeline.Pipeline(config).run()
+
+        return asyncio.run(run()), started, peak[0]
+
+    def test_a_busy_host_does_not_hold_the_other_hosts_back(self):
+        # Ten ports on each of four addresses, in address order: the workers all
+        # waited on the first address while the other three sat in the queue.
+        endpoints = [f'http://10.0.{host}.1:{8000 + port}' for host in range(4) for port in range(10)]
+        result, started, peak = self._run(endpoints)
+        self.assertEqual(result.reason, 'items_exhausted')
+        self.assertEqual(sorted(started), sorted(endpoints))
+        self.assertEqual(peak, 4)
+        # Every address had started before the first one's third measurement.
+        first = {endpoint.split(':')[1] for endpoint in started[:4]}
+        self.assertEqual(len(first), 4)
+
+    def test_a_reached_want_is_not_followed_by_the_items_waiting_for_their_host(self):
+        endpoints = [f'http://10.0.0.1:{8000 + port}' for port in range(20)]
+        result, started, _ = self._run(endpoints, want=3)
+        self.assertEqual(result.reason, 'want_reached')
+        self.assertEqual(len(started), 3)
+
+    def test_a_parked_item_still_runs_once_its_host_is_free(self):
+        endpoints = [f'http://10.0.0.1:{8000 + port}' for port in range(6)] + ['http://10.0.0.2:80']
+        result, started, _ = self._run(endpoints, workers=2, delay=0.01)
+        self.assertEqual(result.reason, 'items_exhausted')
+        self.assertEqual(sorted(started), sorted(endpoints))
+
+
+class ExportAndOptionTests(unittest.TestCase):
+    def test_hostport_lists_a_mixed_port_once(self):
+        from proxy_workbench import exportsvc
+        rows = [{'proxy': 'http://203.0.113.7:8080'}, {'proxy': 'socks5://203.0.113.7:8080'},
+                {'proxy': 'socks5://[2001:db8::1]:1080'}, {'proxy': 'http://[2001:db8::1]:1080'}]
+        self.assertEqual(exportsvc.render_hostport(rows), '203.0.113.7:8080\n[2001:db8::1]:1080\n')
+
+    def test_a_speed_test_smaller_than_the_minimum_sample_is_refused(self):
+        with tempfile.TemporaryDirectory() as tmp, self.assertRaises(SystemExit):
+            _cli(_scan_args(Path(tmp), '--speedtest-url', 'http://speed.invalid/f',
+                            '--speedtest-bytes', '400000'))
+
+
+class LocalResourceErrorTests(unittest.TestCase):
+    def test_running_out_of_descriptors_is_not_an_unreachable_proxy(self):
+        async def refuse(*args, **kwargs):
+            raise OSError(errno.EMFILE, 'Too many open files')
+
+        with mock.patch('asyncio.open_connection', refuse), self.assertRaises(OSError):
+            asyncio.run(proxytool.reachable('http://127.0.0.1:9', 1))
+
+    def test_a_refused_connect_is_still_unreachable(self):
+        self.assertFalse(asyncio.run(proxytool.reachable(f'http://127.0.0.1:{_closed_port()}', 1)))
+
+    def test_the_wrapped_local_error_is_found(self):
+        try:
+            try:
+                raise OSError(errno.EMFILE, 'Too many open files')
+            except OSError as inner:
+                raise RuntimeError('wrapped') from inner
+        except RuntimeError as outer:
+            self.assertIsNotNone(proxytool.local_os_error(outer))
+        self.assertIsNone(proxytool.local_os_error(ConnectionRefusedError(errno.ECONNREFUSED, 'no')))
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/test_scheduler_budgets.py b/tests/test_scheduler_budgets.py
index f65df59..74f527b 100644
--- a/tests/test_scheduler_budgets.py
+++ b/tests/test_scheduler_budgets.py
@@ -1,4 +1,4 @@
-"""Budgets, traffic classes and the metered/battery policy (F15)."""
+"""Budgets, traffic classes and the metered/battery policy."""
 from datetime import datetime, timezone
 from pathlib import Path
 import sys
diff --git a/tests/test_scheduler_notifications.py b/tests/test_scheduler_notifications.py
index a1613b1..67ec724 100644
--- a/tests/test_scheduler_notifications.py
+++ b/tests/test_scheduler_notifications.py
@@ -1,4 +1,4 @@
-"""State-change notifications: dedup, hysteresis and who may receive them (F15)."""
+"""State-change notifications: dedup, hysteresis and who may receive them."""
 from pathlib import Path
 import json
 import sys
diff --git a/tests/test_scheduler_plans.py b/tests/test_scheduler_plans.py
index 947e236..03bb188 100644
--- a/tests/test_scheduler_plans.py
+++ b/tests/test_scheduler_plans.py
@@ -1,4 +1,4 @@
-"""What the scheduler decides: intervals, windows, pause, quiet hours, no catch-up (F15)."""
+"""What the scheduler decides: intervals, windows, pause, quiet hours, no catch-up."""
 from datetime import datetime, timezone
 from pathlib import Path
 import sys
diff --git a/tests/test_scheduler_store.py b/tests/test_scheduler_store.py
index cab4b4c..9a92cd6 100644
--- a/tests/test_scheduler_store.py
+++ b/tests/test_scheduler_store.py
@@ -1,6 +1,6 @@
-"""Persistence seam: the in-memory store and the adapter over migration 7 (F15).
+"""Persistence seam: the in-memory store and the adapter over migration 7.
 
-The tables below are the DDL of CONTRACTS 3.3, migration 7, copied here so the
+The tables below are the DDL of the shared contract copied here so the
 adapter can be exercised before `db.migrate()` exists. It is a fixture, not a
 second source of truth: the module under test issues no DDL of its own, and when
 `db.py` lands these two statements are replaced by one `db.migrate()` call.
@@ -24,7 +24,7 @@
     counters_json TEXT);
 """
 
-# The same tables plus the columns this module needs and CONTRACTS 3.3 does not define yet.
+# The same tables plus the columns this module needs and the shared contract does not define yet.
 EXTENDED_DDL = CONTRACT_DDL.replace(
     'enabled INTEGER);',
     'enabled INTEGER, last_run_at REAL, paused INTEGER, pause_reason TEXT, resume_at REAL,'
diff --git a/tests/test_scheduler_windows.py b/tests/test_scheduler_windows.py
index 4bedb30..4091674 100644
--- a/tests/test_scheduler_windows.py
+++ b/tests/test_scheduler_windows.py
@@ -1,4 +1,4 @@
-"""Windows, slots, DST and the reset boundary (F15)."""
+"""Windows, slots, DST and the reset boundary."""
 from datetime import datetime, timezone
 from pathlib import Path
 import sys
diff --git a/tests/test_secrets_access.py b/tests/test_secrets_access.py
index 1c4692f..55f053c 100644
--- a/tests/test_secrets_access.py
+++ b/tests/test_secrets_access.py
@@ -1,6 +1,6 @@
 """Access identities, credential rotation and the vault/SQLite staging protocol.
 
-The schema comes from db.py, which owns the migrator (CONTRACTS.ru.md §3.3):
+The schema comes from db.py, which owns the migrator:
 migration 1 creates `endpoints` and migration 3 creates `accesses`. The inline
 mirror below is only a fallback for a tree where db.py has not landed yet, and
 `SchemaContractTests` checks it against the declared column list either way.
@@ -22,7 +22,7 @@
 CANARY = 'canary-secret-3f7a'
 CANARY_NEW = 'canary-secret-9c2d'
 
-#: CONTRACTS.ru.md §3.3, migration 3, verbatim.
+#: the shared contract verbatim.
 ACCESS_COLUMNS = ['id', 'endpoint_id', 'mode', 'secret_ref', 'access_revision', 'created_at', 'rotated_at']
 CONTRACT_SCHEMA = """
 CREATE TABLE endpoints (id TEXT PRIMARY KEY, canonical TEXT UNIQUE NOT NULL, host TEXT, port INTEGER,
diff --git a/tests/test_selection.py b/tests/test_selection.py
index 6406454..20a16db 100644
--- a/tests/test_selection.py
+++ b/tests/test_selection.py
@@ -154,7 +154,7 @@ def exported(self, **options):
         """Export and read the artifact the export itself produced.
 
         A selected slice is its own artifact and never republishes the active
-        pool (defect 7), so the rows are read from the artifact directory the
+        pool, so the rows are read from the artifact directory the
         report names rather than from the export root.
         """
         out = self.home / 'out'
@@ -196,7 +196,7 @@ def test_server_side_selection_reports_missing_and_keeps_all_formats(self):
         self.assertEqual(p.export_manifest(self.home / 'out'), None)
 
     def test_stale_selection_is_missing_instead_of_falling_back_to_full_export(self):
-        # A lifetime is written once, at measurement time (CONTRACTS §2.1), so
+        # A lifetime is written once, at measurement time, so
         # expiring a row means moving that recorded deadline, not the clock back.
         self.db.execute("UPDATE results SET payload=json_set(payload, '$.valid_until', 1) "
                         "WHERE proxy='http://11.0.0.1:80'")
diff --git a/tests/test_servicecatalog_catalog.py b/tests/test_servicecatalog_catalog.py
index 4450f50..4aa97fa 100644
--- a/tests/test_servicecatalog_catalog.py
+++ b/tests/test_servicecatalog_catalog.py
@@ -16,7 +16,7 @@
 from proxy_workbench import proxytool as core
 
 # Девять работающих presets, которые каталог обязан сохранить с тем же уровнем
-# доказательства (MASTER-PROMPT.ru.md:180, F06).
+# доказательства.
 LEGACY_PRESETS = {
     'google-204': ('https://www.google.com/generate_204', (204,)),
     'youtube-204': ('https://www.youtube.com/generate_204', (204,)),
@@ -388,7 +388,7 @@ def test_at_least_zero_would_pass_without_measurements(self):
         item['min_passes'] = 0
         with self.assertRaises(sc.ManifestError) as caught:
             sc.parse_catalog(data)
-        self.assertIn('F05', str(caught.exception))
+        self.assertIn('would pass without measurements', str(caught.exception))
 
     def test_at_least_above_the_optional_size_is_refused(self):
         data = manifest()
diff --git a/tests/test_servicecatalog_scenario.py b/tests/test_servicecatalog_scenario.py
index 9eae50f..aa7e3dd 100644
--- a/tests/test_servicecatalog_scenario.py
+++ b/tests/test_servicecatalog_scenario.py
@@ -99,7 +99,7 @@ def test_manifest_missing_one_scenario_field_is_rejected(self):
         with self.assertRaises(sc.ManifestError) as caught:
             sc.parse_catalog(data)
         self.assertIn('reputation.strict', str(caught.exception))
-        self.assertIn('24', str(caught.exception))
+        self.assertIn('full field inventory', str(caught.exception))
 
     def test_manifest_setting_a_user_field_is_rejected(self):
         data = sc.load_manifest()
diff --git a/tests/test_sourcedesk_import.py b/tests/test_sourcedesk_import.py
index b14c83c..3585084 100644
--- a/tests/test_sourcedesk_import.py
+++ b/tests/test_sourcedesk_import.py
@@ -1,4 +1,4 @@
-"""Supported subscription imports: Clash and sing-box (F27).
+"""Supported subscription imports: Clash and sing-box.
 
 The rule under test is narrow: a configuration document is data.  Only the
 endpoint list is read, nothing that steers traffic is followed, and nothing in
diff --git a/tests/test_sourcedesk_secrets.py b/tests/test_sourcedesk_secrets.py
index 4f70419..d4e6e28 100644
--- a/tests/test_sourcedesk_secrets.py
+++ b/tests/test_sourcedesk_secrets.py
@@ -1,4 +1,4 @@
-"""Secret references and redaction for user sources (F27).
+"""Secret references and redaction for user sources.
 
 A canary value is used throughout: the point of these tests is that it can
 never reach the database, a serialized structure, a log line or a public view.
diff --git a/tests/test_sourcedesk_store.py b/tests/test_sourcedesk_store.py
index 7d7b289..4e09d48 100644
--- a/tests/test_sourcedesk_store.py
+++ b/tests/test_sourcedesk_store.py
@@ -1,4 +1,4 @@
-"""Collection binding and persistence for user sources (F27).
+"""Collection binding and persistence for user sources.
 
 The three acceptance scenarios of F27 live here, on a real SQLite database
 built from the schema this module asks ``db.migrate()`` for:
diff --git a/tests/test_web_bundle_init.py b/tests/test_web_bundle_init.py
index 4a6a943..b74b0fa 100644
--- a/tests/test_web_bundle_init.py
+++ b/tests/test_web_bundle_init.py
@@ -173,6 +173,22 @@ def test_the_detail_dialog_close_button_is_declared_before_use(self):
             "кнопка закрытия карточки должна быть объявлена до того, как к ней обращаются",
         )
 
+    def test_a_saved_lazy_language_is_loaded_at_start(self):
+        # Ten of the twelve languages live in lazy packs.  Loading one only from
+        # the language menu left a restarted page in English under `lang="de"`.
+        self.assertRegex(self.source, r"\n\s*try\s*\{\s*loadStartLanguage\(\);",
+                         "сохранённый язык из пакета должен подгружаться при запуске страницы")
+        body = re.search(r"function loadStartLanguage\(\)\s*\{(.*?)\n\}", self.source, re.S)
+        self.assertTrue(body and "ensureLangPack(lang)" in body.group(1))
+
+    def test_rebuilt_result_rows_get_the_hidden_columns(self):
+        # Rows are rebuilt on every render; without re-applying the column choice
+        # the new cells stay visible under hidden headers and slide out of place.
+        body = re.search(r"function renderResults\(data\)\s*\{(.*?)\n\}", self.source, re.S)
+        self.assertTrue(body, "renderResults должна существовать")
+        self.assertIn("applyColumns(resultState.columns)", body.group(1),
+                      "после перерисовки строк скрытые колонки должны скрываться и в новых ячейках")
+
     def test_every_id_the_script_reaches_for_is_built_somewhere(self):
         html = INDEX_HTML.read_text(encoding="utf-8")
         present = set(re.findall(r'id="([^"]+)"', html))
diff --git a/tests/test_web_i18n.py b/tests/test_web_i18n.py
index 946c14a..6a5d0a5 100644
--- a/tests/test_web_i18n.py
+++ b/tests/test_web_i18n.py
@@ -58,7 +58,7 @@ def test_the_guarded_child_environment_is_unchanged(self):
 
 
 class StateDetailTranslationTests(unittest.TestCase):
-    """CONTRACTS §5.4: ``state_detail`` is a machine value with a text next to it."""
+    """the shared contract: ``state_detail`` is a machine value with a text next to it."""
 
     def test_every_reason_the_engine_can_report_has_text(self):
         from proxy_workbench import core
diff --git a/tests/test_web_readpath.py b/tests/test_web_readpath.py
index f18f90c..a1922c5 100644
--- a/tests/test_web_readpath.py
+++ b/tests/test_web_readpath.py
@@ -143,7 +143,7 @@ def test_a_broken_pointer_is_reported_broken_and_never_falls_back_to_rows(self):
         self.assertEqual(download.status_code, 409)
 
     def test_the_reason_travels_to_the_page_in_words_and_as_a_code(self):
-        """CONTRACTS §5.4: ``state_detail`` is translated, the code stays."""
+        """the shared contract: ``state_detail`` is translated, the code stays."""
         from proxy_workbench import i18n
         answer = self.get('/api/results', min_success=0, view='all')
         self.assertIn(answer['state_detail'], i18n.STATE_DETAILS)
diff --git a/tests/web_support.py b/tests/web_support.py
index e647a50..4f1e83d 100644
--- a/tests/web_support.py
+++ b/tests/web_support.py
@@ -69,8 +69,8 @@ def measurement(proxy, *, latency=120.0, reliability=1.0, age=60.0, now=None, er
         ],
     }
     # A row the engine could actually have written carries its scope: the
-    # collection, the profile revision, the network and the access identity
-    # (CONTRACTS §1.2, §2.3).  A fixture without them describes a measurement no
+    # collection, the profile revision, the network and the access identity.
+    # A fixture without them describes a measurement no
     # reader would admit.
     body['collection_id'] = 'public-base'
     body['profile_id'] = profile_id()
@@ -169,14 +169,18 @@ def js_slice(start_marker, end_marker, source=None):
     return text[start:end]
 
 
-def run_node(script, *, timeout=30, cwd=None, executable='node'):
-    """Run CommonJS over stdin, without OS command-line size or locale limits."""
+def run_node(script, *, timeout=90, cwd=None, executable='node'):
+    """Run CommonJS over stdin, without OS command-line size or locale limits.
+
+    The script carries the whole interface bundle; a cold node start on a busy
+    Windows runner has taken longer than 30 s, so the ceiling is generous.
+    """
     return subprocess.run([executable, '--input-type=commonjs', '-'], input=script,
                           capture_output=True, text=True, encoding='utf-8',
                           timeout=timeout, cwd=cwd)
 
 
-def node_ok(script, *, timeout=30):
+def node_ok(script, *, timeout=90):
     done = run_node(script, timeout=timeout)
     if done.returncode != 0:
         raise AssertionError('node failed: ' + (done.stderr or done.stdout)[-4000:])
diff --git a/tests/workbench_support.py b/tests/workbench_support.py
index 776de2e..54f91c8 100644
--- a/tests/workbench_support.py
+++ b/tests/workbench_support.py
@@ -1,6 +1,6 @@
 """Shared fixtures for the engine tests: a measurement row needs its whole key.
 
-The schema is versioned (CONTRACTS §3.3).  ``results`` is keyed by
+The schema is versioned.  ``results`` is keyed by
 ``(profile_id, profile_revision, access_id, access_revision, endpoint_id, job_id)``
 and ``candidates``/``candidate_seen`` carry a mandatory ``endpoint_id``, so the
 old positional inserts this repository used everywhere no longer describe a row:
@@ -114,7 +114,7 @@ def store_result(conn, values, *, profile_id=None, profile_revision=1,
     collection_id = collection_id or db.PUBLIC_COLLECTION_ID
     body['collection_id'] = collection_id
     # The scope is part of the row, not of the read: a row without it cannot be
-    # admitted against any scope (CONTRACTS §1.2 rules 1-2).
+    # admitted against any scope.
     body['profile_id'] = profile_id or profile
     body['profile_revision'] = int(profile_revision)
     body['access_id'] = access_id