diff --git a/.github/workflows/sbom-provenance.yml b/.github/workflows/sbom-provenance.yml
index 04742847..51287427 100644
--- a/.github/workflows/sbom-provenance.yml
+++ b/.github/workflows/sbom-provenance.yml
@@ -123,50 +123,6 @@ jobs:
           echo "components=$JSON" >> "$GITHUB_OUTPUT"
           echo "Selected components: $JSON"
 
-  test-web-readiness:
-    needs: detect-components
-    if: contains(needs.detect-components.outputs.components, 'web')
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        readiness-scenario: [healthy, database-degraded, database-timeout, horizon-degraded, horizon-timeout, dependencies-unavailable, mixed-dependency-timeout]
-    env:
-      TZ: UTC
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.0.0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-
-      - name: Install dependencies
-        run: |
-          cd ${{ github.workspace }}
-          pnpm install --frozen-lockfile
-
-      - name: Run web tests (readiness/liveness focus)
-        run: pnpm --dir web exec vitest run src/app/api/health/health.test.ts
-        env:
-          READINESS_SCENARIO: ${{ matrix.readiness-scenario }}
-          MOCK_CLOCK_ISO: "2024-01-01T00:00:00.000Z"
-
   generate-sdk:
     needs: detect-components
     if: contains(needs.detect-components.outputs.components, 'sdk')
@@ -268,7 +224,7 @@ jobs:
             }
 
           echo "cdx-json=${BASE}.cdx.json" >> "$GITHUB_OUTPUT"
-          echo "cdx-name=talos-sdk-${GITHUB_REF_NAME:-$SHA}-$TS" >> "$GITHUB_OUTPUT"
+          echo "cdx-name=talos-sdk-${SHA}-$TS" >> "$GITHUB_OUTPUT"
 
       - name: Validate CycloneDX SBOM
         shell: bash
@@ -456,7 +412,7 @@ jobs:
                   builder: { id: 'https://github.com/actions/runner/github-hosted' },
                   metadata: {
                     invocationId: '${{ github.run_id }}-${{ github.run_attempt }}',
-                    startedOn: '${{ github.event.head_commit.timestamp || new Date().toISOString() }}',
+                    startedOn: new Date().toISOString(),
                     completedOn: new Date().toISOString()
                   }
                 }
@@ -471,9 +427,9 @@ jobs:
         shell: bash
         run: |
           SHA="${GITHUB_SHA:0:7}"
-          echo "cyclonedx-artifact=sbom-sdk-cyclonedx-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "spdx-artifact=sbom-sdk-spdx-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "signature-artifact=sbom-sdk-signatures-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
+          echo "cyclonedx-artifact=sbom-sdk-cyclonedx-${SHA}" >> "$GITHUB_OUTPUT"
+          echo "spdx-artifact=sbom-sdk-spdx-${SHA}" >> "$GITHUB_OUTPUT"
+          echo "signature-artifact=sbom-sdk-signatures-${SHA}" >> "$GITHUB_OUTPUT"
 
       - name: Upload CycloneDX SBOM
         uses: actions/upload-artifact@v4
@@ -605,7 +561,7 @@ jobs:
             }
 
           echo "cdx-json=${BASE}.cdx.json" >> "$GITHUB_OUTPUT"
-          echo "cdx-name=talos-agent-${GITHUB_REF_NAME:-$SHA}-$TS" >> "$GITHUB_OUTPUT"
+          echo "cdx-name=talos-agent-${SHA}-$TS" >> "$GITHUB_OUTPUT"
 
       - name: Generate SPDX SBOM
         id: spdx
@@ -731,9 +687,9 @@ jobs:
         shell: bash
         run: |
           SHA="${GITHUB_SHA:0:7}"
-          echo "cyclonedx-artifact=sbom-agent-cyclonedx-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "spdx-artifact=sbom-agent-spdx-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "signature-artifact=sbom-agent-signatures-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
+          echo "cyclonedx-artifact=sbom-agent-cyclonedx-${SHA}" >> "$GITHUB_OUTPUT"
+          echo "spdx-artifact=sbom-agent-spdx-${SHA}" >> "$GITHUB_OUTPUT"
+          echo "signature-artifact=sbom-agent-signatures-${SHA}" >> "$GITHUB_OUTPUT"
 
       - name: Upload CycloneDX
         uses: actions/upload-artifact@v4
@@ -860,7 +816,7 @@ jobs:
           fi
 
           echo "cdx-json=${BASE}.cdx.json" >> "$GITHUB_OUTPUT"
-          echo "cdx-name=talos-contracts-${GITHUB_REF_NAME:-$SHA}-$TS" >> "$GITHUB_OUTPUT"
+          echo "cdx-name=talos-contracts-${SHA}-$TS" >> "$GITHUB_OUTPUT"
 
       - name: Generate SPDX SBOM
         id: spdx
@@ -968,7 +924,7 @@ jobs:
             ];
             const wasms=fs.readdirSync('contracts/target/wasm32-unknown-unknown/release').filter(f=>f.endsWith('.wasm'));
             for (const w of wasms) subjects.push({name:w,digest:{sha256:sha256('contracts/target/wasm32-unknown-unknown/release/'+w)}});
-            const pred={'_type':'https://in-toto.io/Statement/v1',subject,
+            const pred={'_type':'https://in-toto.io/Statement/v1',subject: subjects,
               predicateType:'https://slsa.dev/provenance/v1',
               predicate:{buildDefinition:{
                 buildType:'https://github.com/slsa-framework/slsa-github-generator/generic@v1',
@@ -986,9 +942,9 @@ jobs:
         shell: bash
         run: |
           SHA="${GITHUB_SHA:0:7}"
-          echo "cyclonedx-artifact=sbom-contracts-cyclonedx-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "spdx-artifact=sbom-contracts-spdx-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "signature-artifact=sbom-contracts-signatures-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
+          echo "cyclonedx-artifact=sbom-contracts-cyclonedx-${SHA}" >> "$GITHUB_OUTPUT"
+          echo "spdx-artifact=sbom-contracts-spdx-${SHA}" >> "$GITHUB_OUTPUT"
+          echo "signature-artifact=sbom-contracts-signatures-${SHA}" >> "$GITHUB_OUTPUT"
 
       - name: Upload CycloneDX
         uses: actions/upload-artifact@v4
@@ -1110,7 +1066,7 @@ jobs:
             "
           }
           echo "cdx-json=${BASE}.cdx.json" >> "$GITHUB_OUTPUT"
-          echo "cdx-name=talos-web-${GITHUB_REF_NAME:-$SHA}-$TS" >> "$GITHUB_OUTPUT"
+          echo "cdx-name=talos-web-${SHA}-$TS" >> "$GITHUB_OUTPUT"
 
       - name: Generate SPDX SBOM
         id: spdx
@@ -1214,9 +1170,9 @@ jobs:
         shell: bash
         run: |
           SHA="${GITHUB_SHA:0:7}"
-          echo "cyclonedx-artifact=sbom-web-cyclonedx-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "spdx-artifact=sbom-web-spdx-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
-          echo "signature-artifact=sbom-web-signatures-${GITHUB_REF_NAME:-$SHA}" >> "$GITHUB_OUTPUT"
+          echo "cyclonedx-artifact=sbom-web-cyclonedx-${SHA}" >> "$GITHUB_OUTPUT"
+          echo "spdx-artifact=sbom-web-spdx-${SHA}" >> "$GITHUB_OUTPUT"
+          echo "signature-artifact=sbom-web-signatures-${SHA}" >> "$GITHUB_OUTPUT"
 
       - name: Upload CycloneDX
         uses: actions/upload-artifact@v4
@@ -1291,7 +1247,7 @@ jobs:
           echo "| Component | CycloneDX | SPDX | Provenance | Signatures |" >> "$GITHUB_STEP_SUMMARY"
           echo "|-----------|-----------|------|------------|------------|" >> "$GITHUB_STEP_SUMMARY"
           for comp in sdk agent contracts web; do
-            res="SKIPPED"
+            need="generate-$comp"
             case "$comp" in
               sdk) res="${{ needs.generate-sdk.result }}" ;;
               agent) res="${{ needs.generate-agent.result }}" ;;
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 24a6dae3..94db0de2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -202,159 +202,6 @@ If you are iterating on contract behavior, also run the Wasm-target test path us
 cargo test --target wasm32-unknown-unknown
 ```
 
-## Focused Test Selection and CI Triage
-
-Run the smallest test set that covers the files you touched before falling back to a full suite. The commands below avoid database resets and hidden local state. Run them after installing dependencies with `pnpm install` at the repository root, `uv sync --extra dev` in `packages/prime-agent/`, or the Rust setup from the prerequisites. In this section, commands that call package scripts use `pnpm run <script>` so the script name can be checked directly in the package's `package.json`.
-
-### Web changes
-
-Use the web package scripts for Next.js, API, database, and DevX changes. The main test artifact is the Vitest report in stdout. Benchmark jobs also upload `.benchmarks/` as the `benchmark-artifacts` workflow artifact.
-
-```bash
-# POSIX shells
-pnpm --dir web exec vitest run tests/health.test.ts
-pnpm --dir web exec vitest run tests/*.unit.test.ts
-pnpm --dir web exec vitest run tests/openapi-snapshot.test.ts
-pnpm --dir web exec vitest run src/area/devx/__tests__/runner.test.ts
-pnpm --dir web run lint
-pnpm --dir web exec tsc --noEmit
-```
-
-```powershell
-# Windows PowerShell
-pnpm --dir web exec vitest run tests\health.test.ts
-pnpm --dir web exec vitest run tests\*.unit.test.ts
-pnpm --dir web exec vitest run tests/openapi-snapshot.test.ts
-pnpm --dir web exec vitest run src/area/devx/__tests__/runner.test.ts
-pnpm --dir web run lint
-pnpm --dir web exec tsc --noEmit
-```
-
-Choose the focused command by area:
-
-| Changed files | Focused command | CI workflow |
-| --- | --- | --- |
-| `web/src/app/api/**`, `web/src/lib/openapi.ts`, `web/tests/fixtures/openapi.snapshot.json` | `pnpm --dir web exec vitest run tests/openapi-snapshot.test.ts` | `Web OpenAPI CI` |
-| `web/drizzle/**`, `web/src/db/**`, `web/drizzle.config.ts` | `pnpm --dir web run db:migrate`, then the specific DB test with `pnpm --dir web exec vitest run tests/<name>.test.ts` | `Web Migrations CI` |
-| `web/src/area/devx/**` | `pnpm --dir web exec vitest run src/area/devx/__tests__/runner.test.ts` | `Benchmark CI - regression gates` |
-| API route or library unit tests | `pnpm --dir web exec vitest run tests/<name>.test.ts` | `Deploy Web -> Vercel` |
-| Backup or restore paths | `pnpm --dir web exec vitest run tests/backup-crypto.test.ts tests/backup-types.test.ts` | `Web Backups CI` |
-
-Use `pnpm --dir web run test:e2e` only when API route behavior depends on the running app or cross-route state. Use the local stack with `pnpm stack:up` when you need Postgres plus the mock Stellar provider, and clean it up with `pnpm stack:down`. Do not use `pnpm stack:reset` unless you intentionally want to destroy and recreate local stack data.
-
-### SDK changes
-
-The TypeScript SDK lives in `packages/sdk/`. The expected build artifact is `packages/sdk/dist/`, including the browser bundle at `packages/sdk/dist/browser/sdk.bundle.js`.
-
-```bash
-# POSIX shells
-pnpm --filter @talos-protocol/sdk exec vitest run tests/client.test.ts
-pnpm --filter @talos-protocol/sdk run build
-pnpm --filter @talos-protocol/sdk exec tsc --noEmit
-```
-
-```powershell
-# Windows PowerShell
-pnpm --filter @talos-protocol/sdk exec vitest run tests\client.test.ts
-pnpm --filter @talos-protocol/sdk run build
-pnpm --filter @talos-protocol/sdk exec tsc --noEmit
-```
-
-Choose the focused command by area:
-
-| Changed files | Focused command | CI workflow |
-| --- | --- | --- |
-| `packages/sdk/src/**`, `packages/sdk/tests/**` | `pnpm --filter @talos-protocol/sdk exec vitest run tests/<name>.test.ts` | `SDK Compatibility Tests` |
-| `packages/sdk/src/generated-types.ts`, `web/tests/fixtures/openapi.snapshot.json` | `pnpm --filter @talos-protocol/sdk run build`, then verify `git diff` | `SDK Types CI` |
-| SDK build, packaging, or browser bundle files | `pnpm --filter @talos-protocol/sdk run build` | `SDK Compatibility Tests` |
-
-If `SDK Compatibility Tests` reports a missing `compat:*` script, check `.github/workflows/sdk-compatibility.yml` and `packages/sdk/package.json` together. The workflow invokes smoke-test script names, while the package manifest is the source of available local scripts.
-
-### Prime Agent changes
-
-The Python agent uses `uv` from `packages/prime-agent/`. The expected artifacts are pytest and ruff output in the CI log.
-
-```bash
-# POSIX shells
-cd packages/prime-agent
-uv run pytest tests/test_scheduler.py -v
-uv run pytest tests/ -v
-uv run ruff check src tests
-```
-
-```powershell
-# Windows PowerShell
-Set-Location packages\prime-agent
-uv run pytest tests\test_scheduler.py -v
-uv run pytest tests\ -v
-uv run ruff check src tests
-Set-Location ..\..
-```
-
-Choose the focused command by area:
-
-| Changed files | Focused command | CI workflow |
-| --- | --- | --- |
-| `packages/prime-agent/src/talos_agent/scheduler.py` | `uv run pytest tests/test_scheduler.py -v` | `Prime Agent CI` |
-| `packages/prime-agent/src/talos_agent/backup_service.py`, `packages/prime-agent/tests/test_backup_service.py` | `uv run pytest tests/test_backup_service.py -v` | `Web Backups CI`, `Prime Agent CI` |
-| Any other agent module | `uv run pytest tests/test_<area>.py -v`, plus `uv run ruff check src tests` | `Prime Agent CI` |
-
-Some integration tests need external credentials or services such as Stellar, browser adapters, social adapters, or AI providers. If a failure is caused by a missing environment variable or refused network connection, document it as environment-dependent in your PR instead of replacing it with a broad unrelated suite.
-
-### Contract changes
-
-The Soroban contracts live in `contracts/`. The expected build artifacts are Wasm files under `contracts/target/wasm32-unknown-unknown/release/`.
-
-```bash
-# POSIX shells
-cd contracts
-cargo test -p talos-registry
-cargo test
-cargo build --target wasm32-unknown-unknown --release
-pnpm --dir contracts exec tsc --noEmit
-pnpm --dir contracts exec vitest run fixtures
-```
-
-```powershell
-# Windows PowerShell
-Set-Location contracts
-cargo test -p talos-registry
-cargo test
-cargo build --target wasm32-unknown-unknown --release
-pnpm --dir contracts exec tsc --noEmit
-pnpm --dir contracts exec vitest run fixtures
-Set-Location ..
-```
-
-Choose the focused command by area:
-
-| Changed files | Focused command | CI workflow |
-| --- | --- | --- |
-| `contracts/talos_registry/**` | `cargo test -p talos-registry` | `Contracts CI` |
-| `contracts/talos_name_service/**` | `cargo test -p talos-name-service` | `Contracts CI` |
-| `contracts/talos_governance/**` | `cargo test -p talos-governance` | `Contracts CI` |
-| `contracts/ttl_manager/**` | `cargo test -p ttl-manager` | `Contracts CI` |
-| `contracts/storage_migration/**` | `cargo test -p storage-migration` | `Contracts CI` |
-| `contracts/fixtures/**` | `pnpm --dir contracts exec tsc --noEmit; pnpm --dir contracts exec vitest run fixtures` | `Contracts CI` |
-| Contract release output or Wasm compatibility | `cargo build --target wasm32-unknown-unknown --release` | `Contracts CI` |
-
-Deploy commands such as `pnpm --dir contracts run deploy:testnet` and `./deploy.sh testnet` require configured Stellar credentials and network access. Treat failures from missing signers, RPC timeouts, Horizon rate limits, or Soroban testnet availability as deployment-environment issues unless local `cargo test` or Wasm build also fails.
-
-### Common failure messages
-
-| Message | Usually means | Next step |
-| --- | --- | --- |
-| `ERR_PNPM_OUTDATED_LOCKFILE` or frozen lockfile failures | `package.json` and lockfile are out of sync | Re-run the same install command locally and commit lockfile changes only when dependency changes are intentional. |
-| `No test files found` | The path or glob does not match from the package working directory | Re-run from the package root or use `pnpm --dir <package> exec vitest run <path>`. |
-| `DATABASE_URL` or `DIRECT_URL` is missing | The command needs a Postgres-backed environment | Copy `web/.env.example` to `web/.env.local` or use `pnpm stack:up` for local integration work. |
-| `ECONNREFUSED`, `ENOTFOUND`, Horizon/RPC timeout, or preview URL missing | External service, local server, mock provider, or Vercel preview is unavailable | Check the named workflow logs first. If local unit tests pass and only the external service failed, note it as environment-dependent. |
-| `schema.ts is out of sync with committed migration files` | Drizzle schema and migrations diverged | Run `pnpm --dir web run db:generate`, inspect the generated SQL, and commit it only when the schema change is intended. |
-| `Generated types differ from committed version` | OpenAPI snapshot and SDK generated types drifted | Run the repository's generated-type workflow and review `packages/sdk/src/generated-types.ts`. |
-| `Browser bundle not built` or missing `packages/sdk/dist/browser/sdk.bundle.js` | SDK build did not produce the expected browser artifact | Run `pnpm --filter @talos-protocol/sdk run build:browser` or the full SDK build. |
-| `ruff` violations | Python formatting or lint rule failures | Run `uv run ruff check src tests` in `packages/prime-agent/` and fix the reported files. |
-| `wasm32-unknown-unknown` target not installed | Rust cannot build Soroban Wasm artifacts | Run `rustup target add wasm32-unknown-unknown`. |
-| PR preview comment is present but Vercel URL is absent | The repo preview workflow provisions the mock DB; Vercel attaches previews separately | Check Vercel's GitHub integration/status before treating it as an application failure. |
-
 ## Code Style
 
 - Keep changes small and focused
@@ -524,7 +371,7 @@ pnpm --dir web env:provision 123 my-feature-branch
 # Teardown the mock environment
 pnpm --dir web env:teardown 123
 ```
-Unit tests for the environment lifecycle logic reside in `web/src/area/devx/__tests__/environments.test.ts` (or similar tests). Make sure tests pass locally by running the relevant Vitest file directly, for example `pnpm --dir web exec vitest run src/area/devx/__tests__/environments.test.ts`.
+Unit tests for the environment lifecycle logic reside in `web/src/area/devx/__tests__/environments.test.ts` (or similar tests). Make sure tests pass locally by running `pnpm --dir web test:bench` or your standard test suites.
 
 ### Rollback and Teardown
 
diff --git a/contracts/Cargo.lock b/contracts/Cargo.lock
index e6ecdc56..0c4e831d 100644
--- a/contracts/Cargo.lock
+++ b/contracts/Cargo.lock
@@ -1528,6 +1528,7 @@ dependencies = [
 name = "talos-registry"
 version = "0.1.0"
 dependencies = [
+ "pause-control",
  "soroban-sdk",
  "storage-migration",
  "ttl-manager",
diff --git a/contracts/fixtures/event-query.test.ts b/contracts/fixtures/event-query.test.ts
index 8ac94810..08a96e3f 100644
--- a/contracts/fixtures/event-query.test.ts
+++ b/contracts/fixtures/event-query.test.ts
@@ -312,36 +312,3 @@ describe("malformed payloads", () => {
     ).toThrow(UnknownEventError);
   });
 });
-
-describe("malformed-fixture failure-path check", () => {
-  it("rejects fixture set with missing format", () => {
-    const bad = { ...raw };
-    delete (bad as any).format;
-    expect(() => parseFixtureSet(bad)).toThrow(MalformedEventError);
-  });
-
-  it("rejects fixture set with invalid bounds min/max page size", () => {
-    const bad = {
-      ...raw,
-      bounds: {
-        min_page_size: 10,
-        max_page_size: 5,
-        max_ledger_span: 100,
-      },
-    };
-    expect(() => parseFixtureSet(bad)).toThrow(MalformedEventError);
-  });
-
-  it("rejects an invalid event fixture with mismatched topic[0] symbol value", () => {
-    const badFixture = {
-      id: "bad.mismatched_symbol",
-      family: "creation",
-      event: "tls_crt",
-      contract: "talos_registry",
-      ledger_sequence: 100,
-      topics: [{ type: "symbol", value: "wrong_symbol_name" }],
-      data: [],
-    };
-    expect(() => parseEventFixture(badFixture, set)).toThrow(MalformedEventError);
-  });
-});
diff --git a/contracts/package.json b/contracts/package.json
index eeabfffc..8c371424 100644
--- a/contracts/package.json
+++ b/contracts/package.json
@@ -12,7 +12,7 @@
     "deploy:name-service:testnet": "soroban contract deploy --wasm target/wasm32-unknown-unknown/release/talos_name_service.wasm --network testnet",
     "invoke:registry": "soroban contract invoke --source-account alice --network testnet",
     "invoke:name-service": "soroban contract invoke --source-account alice --network testnet",
-    "test:fixtures": "tsc --noEmit && vitest run fixtures"
+    "test:fixtures": "vitest run fixtures"
   },
   "devDependencies": {
     "typescript": "^5.7.0",
diff --git a/contracts/pause_control/src/lib.rs b/contracts/pause_control/src/lib.rs
index 10ebc066..1f3b1ec3 100644
--- a/contracts/pause_control/src/lib.rs
+++ b/contracts/pause_control/src/lib.rs
@@ -146,163 +146,226 @@ fn emit_domain_expired(env: &Env, domain_id: DomainId) {
 mod tests {
     use super::*;
     use soroban_sdk::testutils::{Address as _, Ledger};
+    use soroban_sdk::{contract, contractimpl};
 
-    fn setup_env() -> (Env, Address) {
+    #[contract]
+    pub struct DummyContract;
+
+    #[contractimpl]
+    impl DummyContract {
+        pub fn pause(env: Env, domain_id: u32, admin: Address, duration: u64) {
+            pause_domain(&env, domain_id, &admin, duration);
+        }
+
+        pub fn unpause(env: Env, domain_id: u32, admin: Address) {
+            unpause_domain(&env, domain_id, &admin);
+        }
+    }
+
+    fn setup_env() -> (Env, Address, Address) {
         let env = Env::default();
+        env.mock_all_auths();
         let admin = Address::generate(&env);
+        let contract_id = env.register_contract(None, DummyContract);
         env.ledger().set_timestamp(1_000_000);
-        (env, admin)
+        (env, admin, contract_id)
     }
 
     #[test]
     fn test_is_not_paused_by_default() {
-        let (env, _admin) = setup_env();
-        assert!(!is_paused(&env, 1));
+        let (env, _admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            assert!(!is_paused(&env, 1));
+        });
     }
 
     #[test]
     fn test_get_pause_status_none_by_default() {
-        let (env, _admin) = setup_env();
-        assert!(get_pause_status(&env, 1).is_none());
+        let (env, _admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            assert!(get_pause_status(&env, 1).is_none());
+        });
     }
 
     #[test]
     fn test_require_not_paused_does_not_panic_when_not_paused() {
-        let (env, _admin) = setup_env();
-        require_not_paused(&env, 1);
+        let (env, _admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            require_not_paused(&env, 1);
+        });
     }
 
     #[test]
     fn test_pause_domain() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 0);
-        assert!(is_paused(&env, 1));
+        let (env, admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            pause_domain(&env, 1, &admin, 0);
+            assert!(is_paused(&env, 1));
+        });
     }
 
     #[test]
     #[should_panic(expected = "Domain is paused")]
     fn test_require_not_paused_panics_when_paused() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 0);
-        require_not_paused(&env, 1);
+        let (env, admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            pause_domain(&env, 1, &admin, 0);
+            require_not_paused(&env, 1);
+        });
     }
 
     #[test]
     fn test_unpause_domain() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 0);
-        assert!(is_paused(&env, 1));
-        unpause_domain(&env, 1, &admin);
-        assert!(!is_paused(&env, 1));
+        let (env, admin, contract_id) = setup_env();
+        let client = DummyContractClient::new(&env, &contract_id);
+        client.pause(&1, &admin, &0);
+        env.as_contract(&contract_id, || {
+            assert!(is_paused(&env, 1));
+        });
+        client.unpause(&1, &admin);
+        env.as_contract(&contract_id, || {
+            assert!(!is_paused(&env, 1));
+        });
     }
 
     #[test]
     #[should_panic(expected = "Domain is not paused")]
     fn test_unpause_not_paused_panics() {
-        let (env, admin) = setup_env();
-        unpause_domain(&env, 1, &admin);
+        let (env, admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            unpause_domain(&env, 1, &admin);
+        });
     }
 
     #[test]
     fn test_pause_with_expiry() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 100);
-        assert!(is_paused(&env, 1));
-        env.ledger().set_timestamp(1_000_050);
-        assert!(!expire_if_elapsed(&env, 1));
-        assert!(is_paused(&env, 1));
-        env.ledger().set_timestamp(1_000_100);
-        assert!(expire_if_elapsed(&env, 1));
-        assert!(!is_paused(&env, 1));
+        let (env, admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            pause_domain(&env, 1, &admin, 100);
+            assert!(is_paused(&env, 1));
+            env.ledger().set_timestamp(1_000_050);
+            assert!(!expire_if_elapsed(&env, 1));
+            assert!(is_paused(&env, 1));
+            env.ledger().set_timestamp(1_000_100);
+            assert!(expire_if_elapsed(&env, 1));
+            assert!(!is_paused(&env, 1));
+        });
     }
 
     #[test]
     fn test_expire_after_exact_timestamp() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 100);
-        env.ledger().set_timestamp(1_000_100);
-        assert!(expire_if_elapsed(&env, 1));
-        assert!(!is_paused(&env, 1));
+        let (env, admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            pause_domain(&env, 1, &admin, 100);
+            env.ledger().set_timestamp(1_000_100);
+            assert!(expire_if_elapsed(&env, 1));
+            assert!(!is_paused(&env, 1));
+        });
     }
 
     #[test]
     fn test_expire_before_timestamp_does_not_expire() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 100);
-        env.ledger().set_timestamp(1_000_099);
-        assert!(!expire_if_elapsed(&env, 1));
-        assert!(is_paused(&env, 1));
+        let (env, admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            pause_domain(&env, 1, &admin, 100);
+            env.ledger().set_timestamp(1_000_099);
+            assert!(!expire_if_elapsed(&env, 1));
+            assert!(is_paused(&env, 1));
+        });
     }
 
     #[test]
     fn test_indefinite_pause_does_not_expire() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 0);
-        assert!(!expire_if_elapsed(&env, 1));
-        assert!(is_paused(&env, 1));
+        let (env, admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            pause_domain(&env, 1, &admin, 0);
+            assert!(!expire_if_elapsed(&env, 1));
+            assert!(is_paused(&env, 1));
+        });
     }
 
     #[test]
     fn test_check_not_paused_expires_automatically() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 50);
-        env.ledger().set_timestamp(1_000_100);
-        check_not_paused(&env, 1);
-        assert!(!is_paused(&env, 1));
+        let (env, admin, contract_id) = setup_env();
+        env.as_contract(&contract_id, || {
+            pause_domain(&env, 1, &admin, 50);
+            env.ledger().set_timestamp(1_000_100);
+            check_not_paused(&env, 1);
+            assert!(!is_paused(&env, 1));
+        });
     }
 
     #[test]
     fn test_multiple_domains_independent() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 0);
-        pause_domain(&env, 2, &admin, 0);
-        assert!(is_paused(&env, 1));
-        assert!(is_paused(&env, 2));
-        unpause_domain(&env, 1, &admin);
-        assert!(!is_paused(&env, 1));
-        assert!(is_paused(&env, 2));
+        let (env, admin, contract_id) = setup_env();
+        let client = DummyContractClient::new(&env, &contract_id);
+        client.pause(&1, &admin, &0);
+        client.pause(&2, &admin, &0);
+        env.as_contract(&contract_id, || {
+            assert!(is_paused(&env, 1));
+            assert!(is_paused(&env, 2));
+        });
+        client.unpause(&1, &admin);
+        env.as_contract(&contract_id, || {
+            assert!(!is_paused(&env, 1));
+            assert!(is_paused(&env, 2));
+        });
     }
 
     #[test]
     fn test_pause_then_unpause_then_pause_again() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 0);
-        unpause_domain(&env, 1, &admin);
-        pause_domain(&env, 1, &admin, 100);
-        assert!(is_paused(&env, 1));
+        let (env, admin, contract_id) = setup_env();
+        let client = DummyContractClient::new(&env, &contract_id);
+        client.pause(&1, &admin, &0);
+        client.unpause(&1, &admin);
+        client.pause(&1, &admin, &100);
+        env.as_contract(&contract_id, || {
+            assert!(is_paused(&env, 1));
+        });
     }
 
     #[test]
     fn test_get_pause_status_after_pause() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 1, &admin, 100);
-        let status = get_pause_status(&env, 1).unwrap();
-        assert!(status.paused);
-        assert_eq!(status.paused_by, admin);
-        assert_eq!(status.paused_at, 1_000_000);
-        assert_eq!(status.expires_at, 1_000_100);
+        let (env, admin, contract_id) = setup_env();
+        let client = DummyContractClient::new(&env, &contract_id);
+        client.pause(&1, &admin, &100);
+        env.as_contract(&contract_id, || {
+            let status = get_pause_status(&env, 1).unwrap();
+            assert!(status.paused);
+            assert_eq!(status.paused_by, admin);
+            assert_eq!(status.paused_at, 1_000_000);
+            assert_eq!(status.expires_at, 1_000_100);
+        });
     }
 
     #[test]
     fn test_domains_are_independent() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 5, &admin, 0);
-        pause_domain(&env, 10, &admin, 0);
-        assert!(is_paused(&env, 5));
-        assert!(is_paused(&env, 10));
-        unpause_domain(&env, 5, &admin);
-        assert!(!is_paused(&env, 5));
-        assert!(is_paused(&env, 10));
+        let (env, admin, contract_id) = setup_env();
+        let client = DummyContractClient::new(&env, &contract_id);
+        client.pause(&5, &admin, &0);
+        client.pause(&10, &admin, &0);
+        env.as_contract(&contract_id, || {
+            assert!(is_paused(&env, 5));
+            assert!(is_paused(&env, 10));
+        });
+        client.unpause(&5, &admin);
+        env.as_contract(&contract_id, || {
+            assert!(!is_paused(&env, 5));
+            assert!(is_paused(&env, 10));
+        });
     }
 
     #[test]
     fn test_pause_status_returns_correct_values() {
-        let (env, admin) = setup_env();
-        pause_domain(&env, 42, &admin, 500);
-        let status = get_pause_status(&env, 42).unwrap();
-        assert!(status.paused);
-        assert_eq!(status.paused_by, admin);
-        assert_eq!(status.paused_at, 1_000_000);
-        assert_eq!(status.expires_at, 1_000_500);
+        let (env, admin, contract_id) = setup_env();
+        let client = DummyContractClient::new(&env, &contract_id);
+        client.pause(&42, &admin, &500);
+        env.as_contract(&contract_id, || {
+            let status = get_pause_status(&env, 42).unwrap();
+            assert!(status.paused);
+            assert_eq!(status.paused_by, admin);
+            assert_eq!(status.paused_at, 1_000_000);
+            assert_eq!(status.expires_at, 1_000_500);
+        });
     }
 }
diff --git a/contracts/storage_migration/src/lib.rs b/contracts/storage_migration/src/lib.rs
index c7262dcf..1a99b587 100644
--- a/contracts/storage_migration/src/lib.rs
+++ b/contracts/storage_migration/src/lib.rs
@@ -1,17 +1,39 @@
 //! storage_migration — Versioned storage migration framework for Talos
 //! Protocol Soroban contracts.
 //!
-//! Each contract keeps a single u32 schema version in persistent storage.
-//! Migrations move the version forward one ordered step at a time.
+//! ## Model
 //!
-//! A migration in progress holds a lock so a second migration cannot begin
-//! until the current migration is completed or aborted.
+//! Each contract keeps a single `u32` schema version in its own persistent
+//! storage (via this crate's private [`MigrationKey`] type, which cannot
+//! collide with a host contract's own `DataKey` enum since Soroban storage
+//! keys are typed). Migrations move the version forward **one ordered step
+//! at a time**: `begin_migration(e, current, from, to)` only succeeds when
+//! `current == from` and `to > from`, so steps can never be skipped or
+//! applied out of order, and a step that has already been applied becomes a
+//! no-op rejection rather than a silent double-apply — the caller is
+//! expected to check [`schema_version`] before invoking a step, which makes
+//! a top-level "run all pending migrations" dispatcher naturally idempotent
+//! (see `talos_registry::run_migrations` for the reference integration).
 //!
-//! Every completed migration and rollback is recorded in an on-chain history
-//! log and emits an audit event.
+//! A migration in progress holds a lock (cleared by [`complete_migration`]
+//! or [`abort_migration`]) so a re-entrant or concurrent call cannot begin a
+//! second step while one is uncommitted.
 //!
-//! Rollback only moves the schema-version pointer. It does not undo data
-//! written by a forward migration.
+//! Every applied step and rollback is appended to an on-chain history log
+//! ([`migration_history_len`] / [`migration_record_at`]) and emits an event,
+//! giving operators an audit trail without needing off-chain indexing.
+//!
+//! ## Rollback
+//!
+//! [`rollback`] only moves the version pointer backwards, bounded by a
+//! caller-supplied `max_depth` (see [`validate_rollback`]). It does **not**
+//! undo any data written by forward migrations — schema migrations in this
+//! framework are intentionally not required to be reversible at the data
+//! level. Operators must confirm the target version's data shape is safe to
+//! resume from before relying on old entry-points again.
+//!
+//! See `contracts/storage_migration/README.md` for the full design and an
+//! operator runbook.
 
 #![no_std]
 
@@ -25,19 +47,16 @@ use soroban_sdk::{contracterror, contracttype, symbol_short, Env};
 #[contracterror]
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
 pub enum MigrationError {
-    /// `to <= from`: migrations must move the schema version forward.
+    /// `to <= from`: migrations must move the schema version strictly forward.
     NotForward = 1,
-
-    /// The supplied/current stored version does not match `from`.
+    /// `current != from`: this step does not apply at the contract's current
+    /// version (already applied, or attempted out of order).
     OutOfOrder = 2,
-
-    /// A migration is already in progress.
+    /// A migration was started but never completed or aborted.
     MigrationInProgress = 3,
-
-    /// Rollback target must be below current version.
+    /// Rollback target must be strictly below the current version.
     RollbackNotAllowed = 4,
-
-    /// Rollback is deeper than the allowed depth.
+    /// Rollback target is further back than the allowed depth.
     RollbackTooDeep = 5,
 }
 
@@ -52,7 +71,7 @@ enum MigrationKey {
     History(u32),
 }
 
-/// A single migration or rollback record.
+/// A single applied migration or rollback, in chronological order.
 #[contracttype]
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct MigrationRecord {
@@ -63,54 +82,36 @@ pub struct MigrationRecord {
 }
 
 // ── Events ──────────────────────────────────────────────────────────
+//
+// Event schema (topics → data):
+//   sch_mig : (symbol,) → (from_version: u32, to_version: u32)
+//   sch_rbk : (symbol,) → (from_version: u32, to_version: u32)
 
-fn emit_schema_migrated(
-    env: &Env,
-    from_version: u32,
-    to_version: u32,
-) {
+fn emit_schema_migrated(env: &Env, from_version: u32, to_version: u32) {
     let topics = (symbol_short!("sch_mig"),);
-
-    env.events()
-        .publish(topics, (from_version, to_version));
+    env.events().publish(topics, (from_version, to_version));
 }
 
-fn emit_schema_rolled_back(
-    env: &Env,
-    from_version: u32,
-    to_version: u32,
-) {
+fn emit_schema_rolled_back(env: &Env, from_version: u32, to_version: u32) {
     let topics = (symbol_short!("sch_rbk"),);
-
-    env.events()
-        .publish(topics, (from_version, to_version));
+    env.events().publish(topics, (from_version, to_version));
 }
 
-// ── Internal helpers ────────────────────────────────────────────────
-
-fn append_history(
-    env: &Env,
-    from_version: u32,
-    to_version: u32,
-    rolled_back: bool,
-) {
+fn append_history(env: &Env, from_version: u32, to_version: u32, rolled_back: bool) {
     let len: u32 = env
         .storage()
         .persistent()
         .get(&MigrationKey::HistoryLen)
         .unwrap_or(0);
-
     let record = MigrationRecord {
         from_version,
         to_version,
         applied_at: env.ledger().timestamp(),
         rolled_back,
     };
-
     env.storage()
         .persistent()
         .set(&MigrationKey::History(len), &record);
-
     env.storage()
         .persistent()
         .set(&MigrationKey::HistoryLen, &(len + 1));
@@ -123,220 +124,109 @@ fn is_locked(env: &Env) -> bool {
         .unwrap_or(false)
 }
 
-// ── Pure validation ─────────────────────────────────────────────────
-
-/// Validate a forward migration step.
-///
-/// The migration must:
-/// 1. Increase the version.
-/// 2. Start exactly at the contract's current version.
-pub fn validate_forward_step(
-    current: u32,
-    from: u32,
-    to: u32,
-) -> Result<(), MigrationError> {
+// ── Pure validation (unit-testable without an Env) ─────────────────
+
+/// A forward migration step is valid only when it starts exactly at the
+/// contract's current version and strictly increases the version. This is
+/// what makes step application order-safe: a step whose `from` no longer
+/// matches `current` (because it was already applied, or a later step ran
+/// first) is rejected rather than silently reapplied or skipped.
+pub fn validate_forward_step(current: u32, from: u32, to: u32) -> Result<(), MigrationError> {
     if to <= from {
         return Err(MigrationError::NotForward);
     }
-
     if current != from {
         return Err(MigrationError::OutOfOrder);
     }
-
     Ok(())
 }
 
-/// Validate a rollback.
-///
-/// The target must be strictly below the current version and within
-/// the caller-supplied maximum rollback depth.
-pub fn validate_rollback(
-    current: u32,
-    target: u32,
-    max_depth: u32,
-) -> Result<(), MigrationError> {
+/// A rollback is valid only when the target is strictly below the current
+/// version and within `max_depth` steps of it.
+pub fn validate_rollback(current: u32, target: u32, max_depth: u32) -> Result<(), MigrationError> {
     if target >= current {
         return Err(MigrationError::RollbackNotAllowed);
     }
-
     if current - target > max_depth {
         return Err(MigrationError::RollbackTooDeep);
     }
-
     Ok(())
 }
 
 // ── Public API ──────────────────────────────────────────────────────
 
-/// Read the currently stored schema version.
-///
-/// Returns `None` when the migration framework has not yet been initialized.
+/// Read the on-chain schema version, if one has ever been recorded.
+/// Contracts adopting this framework should treat `None` as their
+/// pre-migration-system genesis version.
 pub fn schema_version(e: &Env) -> Option<u32> {
-    e.storage()
-        .persistent()
-        .get(&MigrationKey::SchemaVersion)
+    e.storage().persistent().get(&MigrationKey::SchemaVersion)
 }
 
-/// Initialize the schema version.
-///
-/// This operation is idempotent. If a schema version already exists,
-/// the existing value is preserved.
+/// Record an explicit genesis version. Idempotent: does nothing if a
+/// version is already recorded (e.g. on re-`initialize` guards, or when
+/// called against a contract instance that already adopted this framework).
 pub fn initialize_schema(e: &Env, genesis: u32) {
     if schema_version(e).is_none() {
         e.storage()
             .persistent()
             .set(&MigrationKey::SchemaVersion, &genesis);
-
         append_history(e, genesis, genesis, false);
     }
 }
 
-/// Begin one ordered migration step.
-///
-/// `current` is retained in the API for compatibility with existing
-/// callers, but the stored schema version is authoritative once the
-/// migration framework has been initialized.
-pub fn begin_migration(
-    e: &Env,
-    current: u32,
-    from: u32,
-    to: u32,
-) -> Result<(), MigrationError> {
-    // The stored value is authoritative.
-    //
-    // For an uninitialized contract, the caller-provided `current`
-    // is used as the initial baseline. Existing integrations can
-    // therefore continue using this API.
-    let stored_current = schema_version(e).unwrap_or(current);
-
-    if stored_current != current {
-        return Err(MigrationError::OutOfOrder);
-    }
-
-    validate_forward_step(stored_current, from, to)?;
-
+/// Begin a single ordered migration step. Must be followed by
+/// [`complete_migration`] (on success) or [`abort_migration`] (to release
+/// the lock without advancing the version).
+pub fn begin_migration(e: &Env, current: u32, from: u32, to: u32) -> Result<(), MigrationError> {
+    validate_forward_step(current, from, to)?;
     if is_locked(e) {
         return Err(MigrationError::MigrationInProgress);
     }
-
     e.storage()
         .persistent()
         .set(&MigrationKey::MigrationLock, &true);
-
     Ok(())
 }
 
-/// Complete a migration that was previously started with
-/// [`begin_migration`].
-///
-/// The schema version is advanced, the migration lock is released,
-/// history is appended, and the migration event is emitted.
-pub fn complete_migration(
-    e: &Env,
-    from_version: u32,
-    to_version: u32,
-) {
-    // Do not silently commit an invalid migration.
-    //
-    // `complete_migration` has historically returned `()`, so a failed
-    // invariant is treated as a contract failure rather than returning
-    // an error that callers could accidentally ignore.
-    let current = schema_version(e).unwrap_or(from_version);
-
-    if current != from_version {
-        panic!("Migration completion version mismatch");
-    }
-
-    if !is_locked(e) {
-        panic!("No migration is currently in progress");
-    }
-
-    if to_version <= from_version {
-        panic!("Migration target must be greater than source");
-    }
-
+/// Commit a migration step started with [`begin_migration`]: advances the
+/// schema version, releases the lock, appends a history record, and emits
+/// `sch_mig`.
+pub fn complete_migration(e: &Env, from_version: u32, to_version: u32) {
     e.storage()
         .persistent()
         .set(&MigrationKey::SchemaVersion, &to_version);
-
     e.storage()
         .persistent()
         .set(&MigrationKey::MigrationLock, &false);
-
-    append_history(
-        e,
-        from_version,
-        to_version,
-        false,
-    );
-
-    emit_schema_migrated(
-        e,
-        from_version,
-        to_version,
-    );
+    append_history(e, from_version, to_version, false);
+    emit_schema_migrated(e, from_version, to_version);
 }
 
-/// Abort the currently running migration.
-///
-/// The schema version remains unchanged and the migration lock is released.
+/// Release the migration lock without advancing the schema version, e.g.
+/// when a step's precondition fails after `begin_migration` succeeded.
 pub fn abort_migration(e: &Env) {
     e.storage()
         .persistent()
         .set(&MigrationKey::MigrationLock, &false);
 }
 
-/// Roll the schema version back to `target`.
-///
-/// This changes only the schema-version pointer. It does not reverse
-/// storage/data changes made by the forward migration.
-pub fn rollback(
-    e: &Env,
-    current: u32,
-    target: u32,
-    max_depth: u32,
-) -> Result<(), MigrationError> {
-    // Stored schema version is authoritative.
-    let stored_current = schema_version(e).unwrap_or(current);
-
-    if stored_current != current {
-        return Err(MigrationError::OutOfOrder);
-    }
-
-    validate_rollback(
-        stored_current,
-        target,
-        max_depth,
-    )?;
-
+/// Roll the schema version back to `target`, bounded by `max_depth` steps.
+/// Only moves the version pointer — see the module docs for why forward
+/// migrations are not required to be reversible at the data level.
+pub fn rollback(e: &Env, current: u32, target: u32, max_depth: u32) -> Result<(), MigrationError> {
+    validate_rollback(current, target, max_depth)?;
     if is_locked(e) {
         return Err(MigrationError::MigrationInProgress);
     }
-
     e.storage()
         .persistent()
-        .set(
-            &MigrationKey::SchemaVersion,
-            &target,
-        );
-
-    append_history(
-        e,
-        stored_current,
-        target,
-        true,
-    );
-
-    emit_schema_rolled_back(
-        e,
-        stored_current,
-        target,
-    );
-
+        .set(&MigrationKey::SchemaVersion, &target);
+    append_history(e, current, target, true);
+    emit_schema_rolled_back(e, current, target);
     Ok(())
 }
 
-/// Number of migration/rollback history records.
+/// Number of entries in the migration/rollback history log.
 pub fn migration_history_len(e: &Env) -> u32 {
     e.storage()
         .persistent()
@@ -344,16 +234,10 @@ pub fn migration_history_len(e: &Env) -> u32 {
         .unwrap_or(0)
 }
 
-/// Fetch a history record by index.
-///
-/// Index `0` is the oldest record.
-pub fn migration_record_at(
-    e: &Env,
-    index: u32,
-) -> Option<MigrationRecord> {
-    e.storage()
-        .persistent()
-        .get(&MigrationKey::History(index))
+/// Fetch a single history entry by index (`0..migration_history_len`),
+/// oldest first.
+pub fn migration_record_at(e: &Env, index: u32) -> Option<MigrationRecord> {
+    e.storage().persistent().get(&MigrationKey::History(index))
 }
 
 // ── Tests ───────────────────────────────────────────────────────────
@@ -363,22 +247,11 @@ pub fn migration_record_at(
 mod tests {
     use super::*;
     use soroban_sdk::testutils::Address as _;
-    use soroban_sdk::Env;
+    use soroban_sdk::{contract, contractimpl, Address};
 
     #[test]
     fn forward_step_accepts_matching_sequential_version() {
-        assert_eq!(
-            validate_forward_step(1, 1, 2),
-            Ok(())
-        );
-    }
-
-    #[test]
-    fn forward_step_accepts_larger_target_version() {
-        assert_eq!(
-            validate_forward_step(1, 1, 5),
-            Ok(())
-        );
+        assert_eq!(validate_forward_step(1, 1, 2), Ok(()));
     }
 
     #[test]
@@ -387,7 +260,6 @@ mod tests {
             validate_forward_step(1, 1, 1),
             Err(MigrationError::NotForward)
         );
-
         assert_eq!(
             validate_forward_step(2, 2, 1),
             Err(MigrationError::NotForward)
@@ -396,11 +268,12 @@ mod tests {
 
     #[test]
     fn forward_step_rejects_out_of_order_current() {
+        // Step is written for from=1, but the contract is already at 2
+        // (already applied) or still at 0 (an earlier step hasn't run yet).
         assert_eq!(
             validate_forward_step(2, 1, 2),
             Err(MigrationError::OutOfOrder)
         );
-
         assert_eq!(
             validate_forward_step(0, 1, 2),
             Err(MigrationError::OutOfOrder)
@@ -409,15 +282,8 @@ mod tests {
 
     #[test]
     fn rollback_accepts_target_within_depth() {
-        assert_eq!(
-            validate_rollback(3, 2, 1),
-            Ok(())
-        );
-
-        assert_eq!(
-            validate_rollback(3, 1, 2),
-            Ok(())
-        );
+        assert_eq!(validate_rollback(3, 2, 1), Ok(()));
+        assert_eq!(validate_rollback(3, 1, 2), Ok(()));
     }
 
     #[test]
@@ -426,7 +292,6 @@ mod tests {
             validate_rollback(3, 3, 5),
             Err(MigrationError::RollbackNotAllowed)
         );
-
         assert_eq!(
             validate_rollback(3, 4, 5),
             Err(MigrationError::RollbackNotAllowed)
@@ -441,275 +306,75 @@ mod tests {
         );
     }
 
-    #[test]
-    fn initialize_schema_is_idempotent() {
-        let env = Env::default();
-
-        let contract_id =
-            soroban_sdk::Address::generate(&env);
-
-        env.as_contract(&contract_id, || {
-            initialize_schema(&env, 1);
-
-            assert_eq!(
-                schema_version(&env),
-                Some(1)
-            );
-
-            assert_eq!(
-                migration_history_len(&env),
-                1
-            );
-
-            // Second initialization must not overwrite
-            // the existing schema version.
-            initialize_schema(&env, 99);
+    #[contract]
+    pub struct DummyContract;
 
-            assert_eq!(
-                schema_version(&env),
-                Some(1)
-            );
-
-            assert_eq!(
-                migration_history_len(&env),
-                1
-            );
-        });
-    }
+    #[contractimpl]
+    impl DummyContract {}
 
     #[test]
     fn full_lifecycle_begin_complete_advances_version_and_history() {
         let env = Env::default();
-
-        let contract_id =
-            soroban_sdk::Address::generate(&env);
-
+        let contract_id = env.register_contract(None, DummyContract);
         env.as_contract(&contract_id, || {
             initialize_schema(&env, 1);
+            assert_eq!(schema_version(&env), Some(1));
+            assert_eq!(migration_history_len(&env), 1);
 
-            assert_eq!(
-                schema_version(&env),
-                Some(1)
-            );
-
-            assert_eq!(
-                migration_history_len(&env),
-                1
-            );
-
-            begin_migration(
-                &env,
-                1,
-                1,
-                2,
-            )
-            .unwrap();
-
-            complete_migration(
-                &env,
-                1,
-                2,
-            );
-
-            assert_eq!(
-                schema_version(&env),
-                Some(2)
-            );
-
-            assert_eq!(
-                migration_history_len(&env),
-                2
-            );
+            begin_migration(&env, 1, 1, 2).unwrap();
+            complete_migration(&env, 1, 2);
 
+            assert_eq!(schema_version(&env), Some(2));
+            assert_eq!(migration_history_len(&env), 2);
             assert!(!is_locked(&env));
 
-            let record =
-                migration_record_at(&env, 1).unwrap();
-
-            assert_eq!(
-                record.from_version,
-                1
-            );
-
-            assert_eq!(
-                record.to_version,
-                2
-            );
-
+            let record = migration_record_at(&env, 1).unwrap();
+            assert_eq!(record.from_version, 1);
+            assert_eq!(record.to_version, 2);
             assert!(!record.rolled_back);
         });
     }
 
-    #[test]
-    fn begin_rejects_stale_caller_version() {
-        let env = Env::default();
-
-        let contract_id =
-            soroban_sdk::Address::generate(&env);
-
-        env.as_contract(&contract_id, || {
-            initialize_schema(&env, 2);
-
-            assert_eq!(
-                begin_migration(
-                    &env,
-                    1,
-                    1,
-                    2,
-                ),
-                Err(MigrationError::OutOfOrder)
-            );
-
-            assert_eq!(
-                schema_version(&env),
-                Some(2)
-            );
-        });
-    }
-
     #[test]
     fn concurrent_begin_is_rejected_until_completed_or_aborted() {
         let env = Env::default();
-
-        let contract_id =
-            soroban_sdk::Address::generate(&env);
-
+        let contract_id = env.register_contract(None, DummyContract);
         env.as_contract(&contract_id, || {
             initialize_schema(&env, 1);
 
-            begin_migration(
-                &env,
-                1,
-                1,
-                2,
-            )
-            .unwrap();
-
+            begin_migration(&env, 1, 1, 2).unwrap();
+            // A second, concurrent/re-entrant attempt must not be able to
+            // start while the first step is uncommitted.
             assert_eq!(
-                begin_migration(
-                    &env,
-                    1,
-                    1,
-                    2,
-                ),
+                begin_migration(&env, 1, 1, 2),
                 Err(MigrationError::MigrationInProgress)
             );
 
             abort_migration(&env);
-
-            assert_eq!(
-                schema_version(&env),
-                Some(1)
-            );
-
-            begin_migration(
-                &env,
-                1,
-                1,
-                2,
-            )
-            .unwrap();
-
-            complete_migration(
-                &env,
-                1,
-                2,
-            );
-
-            assert_eq!(
-                schema_version(&env),
-                Some(2)
-            );
+            // Once aborted (lock released, version unchanged), the same
+            // step can be retried.
+            assert_eq!(schema_version(&env), Some(1));
+            begin_migration(&env, 1, 1, 2).unwrap();
+            complete_migration(&env, 1, 2);
+            assert_eq!(schema_version(&env), Some(2));
         });
     }
 
     #[test]
     fn rollback_then_reapply_round_trips() {
         let env = Env::default();
-
-        let contract_id =
-            soroban_sdk::Address::generate(&env);
-
+        let contract_id = env.register_contract(None, DummyContract);
         env.as_contract(&contract_id, || {
             initialize_schema(&env, 1);
+            begin_migration(&env, 1, 1, 2).unwrap();
+            complete_migration(&env, 1, 2);
 
-            begin_migration(
-                &env,
-                1,
-                1,
-                2,
-            )
-            .unwrap();
-
-            complete_migration(
-                &env,
-                1,
-                2,
-            );
-
-            rollback(
-                &env,
-                2,
-                1,
-                1,
-            )
-            .unwrap();
-
-            assert_eq!(
-                schema_version(&env),
-                Some(1)
-            );
-
-            begin_migration(
-                &env,
-                1,
-                1,
-                2,
-            )
-            .unwrap();
-
-            complete_migration(
-                &env,
-                1,
-                2,
-            );
-
-            assert_eq!(
-                schema_version(&env),
-                Some(2)
-            );
-
-            assert_eq!(
-                migration_history_len(&env),
-                4
-            );
-        });
-    }
-
-    #[test]
-    fn rollback_rejects_stale_caller_version() {
-        let env = Env::default();
-
-        let contract_id =
-            soroban_sdk::Address::generate(&env);
-
-        env.as_contract(&contract_id, || {
-            initialize_schema(&env, 3);
+            rollback(&env, 2, 1, 1).unwrap();
+            assert_eq!(schema_version(&env), Some(1));
 
-            assert_eq!(
-                rollback(
-                    &env,
-                    2,
-                    1,
-                    1,
-                ),
-                Err(MigrationError::OutOfOrder)
-            );
-
-            assert_eq!(
-                schema_version(&env),
-                Some(3)
-            );
+            begin_migration(&env, 1, 1, 2).unwrap();
+            complete_migration(&env, 1, 2);
+            assert_eq!(schema_version(&env), Some(2));
         });
     }
 }
diff --git a/contracts/talos_name_service/src/lib.rs b/contracts/talos_name_service/src/lib.rs
index a9228064..8dfa95d9 100644
--- a/contracts/talos_name_service/src/lib.rs
+++ b/contracts/talos_name_service/src/lib.rs
@@ -99,6 +99,10 @@ pub enum DataKey {
     NextTimelockId,
     LastTouched(u32),
     NameFeeAmount,
+    /// Active pause record for a domain, if any. Absence means unpaused.
+    PauseState(PauseDomain),
+    /// Bounded list of guardian addresses authorized to trigger (but not lift) pauses.
+    Guardians,
 }
 
 #[contracterror]
@@ -178,6 +182,17 @@ fn emit_timelock_config_changed(
         .publish(topics, (old_min_delay, new_min_delay, grace_period));
 }
 
+fn emit_name_fee_paid(
+    env: &Env,
+    talos_id: u32,
+    payer: &Address,
+    asset: &Address,
+    amount: i128,
+) {
+    let topics = (symbol_short!("nm_fee"), talos_id);
+    env.events().publish(topics, (payer.clone(), asset.clone(), amount));
+}
+
 fn emit_pause_set(env: &Env, domain: &PauseDomain, actor: &Address, expires_at: u64) {
     let topics = (symbol_short!("pause_on"), domain.clone());
     env.events().publish(topics, (actor.clone(), expires_at));
@@ -250,7 +265,7 @@ pub const INTERFACE_ID: [u8; 32] = [
     0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, // "eService"
     // (major, minor, patch) big-endian u32s
     0x00, 0x00, 0x00, 0x01, // major = 1
-    0x00, 0x00, 0x00, 0x01, // minor = 1
+    0x00, 0x00, 0x00, 0x03, // minor = 3
     0x00, 0x00, 0x00, 0x00, // patch = 0
     // reserved
     0x00, 0x00, 0x00, 0x00,
@@ -258,7 +273,7 @@ pub const INTERFACE_ID: [u8; 32] = [
 
 /// Expected `INTERFACE_ID` of the configured `RegistryContract`, mirroring
 /// the bytes published by `talos_registry::INTERFACE_ID` (namespace
-/// `"TalosRegistry"`, version `(1, 1, 0)`). Kept as an inline copy rather
+/// `"TalosRegistry"`, version `(1, 3, 0)`). Kept as an inline copy rather
 /// than a crate dependency so this contract's ABI check has no build-time
 /// coupling to the Registry crate; see the golden-vector test for the
 /// independent reproduction of the byte layout.
@@ -267,7 +282,7 @@ pub const EXPECTED_REGISTRY_INTERFACE_ID: [u8; 32] = [
     0x69, 0x73, 0x74, 0x72, 0x79, 0x00, 0x00, 0x00, // "istry" + zero pads
     // (major, minor, patch) big-endian u32s
     0x00, 0x00, 0x00, 0x01, // major = 1
-    0x00, 0x00, 0x00, 0x01, // minor = 1
+    0x00, 0x00, 0x00, 0x03, // minor = 3
     0x00, 0x00, 0x00, 0x00, // patch = 0
     // reserved
     0x00, 0x00, 0x00, 0x00,
@@ -1673,7 +1688,7 @@ mod tests {
     #[test]
     fn version_returns_compile_time_constant() {
         let (_env, _registry_contract, _contract_id, _admin, _registry_client, client) = setup();
-        assert_eq!(client.version(), (1u32, 2u32, 0u32));
+        assert_eq!(client.version(), (1u32, 3u32, 0u32));
     }
 
     #[test]
@@ -1728,7 +1743,7 @@ mod tests {
 
     #[test]
     fn interface_id_returns_expected_bytes() {
-        let (env, _registry_contract, _contract_id, _registry_client, client) = setup();
+        let (env, _registry_contract, _contract_id, _admin, _registry_client, client) = setup();
         let id = client.interface_id();
         let expected = soroban_sdk::BytesN::<32>::from_array(&env, &INTERFACE_ID);
         assert_eq!(id, expected);
@@ -1745,7 +1760,7 @@ mod tests {
 
     #[test]
     fn interface_id_is_unaffected_by_state_changes() {
-        let (env, registry_contract, contract_id, registry_client, client) = setup();
+        let (env, registry_contract, contract_id, _admin, registry_client, client) = setup();
         let before = client.interface_id();
 
         // Register a name — a storage write must not affect the interface ID.
@@ -1779,7 +1794,7 @@ mod tests {
     /// a `major` bump and reviewers should reject the diff.
     #[test]
     fn interface_id_golden_vector_matches_derivation() {
-        let (env, _rc, _cid, _rc2, _cli) = setup();
+        let (env, _rc, _cid, _admin, _rc2, _cli) = setup();
         let expected = soroban_sdk::BytesN::<32>::from_array(&env, &INTERFACE_ID);
 
         let namespace = INTERFACE_NAMESPACE.as_bytes();
@@ -1801,7 +1816,7 @@ mod tests {
     //    call below asserts that interface_features() does not regress it.
     #[test]
     fn interface_features_does_not_register_resolve() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         // capture features once to ensure the call compiles and returns a
         // well-formed Vec; downstream tests already cover name resolution.
         let _ = client.interface_features();
@@ -1811,35 +1826,35 @@ mod tests {
 
     #[test]
     fn supports_version_accepts_exact_match() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         let (maj, min, pat) = CONTRACT_VERSION;
         assert!(client.supports_version(&maj, &min, &pat));
     }
 
     #[test]
     fn supports_version_accepts_lower_minor_and_patch() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         let (maj, _min, _pat) = CONTRACT_VERSION;
         assert!(client.supports_version(&maj, &0, &0));
     }
 
     #[test]
     fn supports_version_rejects_higher_minor() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         let (maj, min, _pat) = CONTRACT_VERSION;
         assert!(!client.supports_version(&maj, &(min + 1), &0));
     }
 
     #[test]
     fn supports_version_rejects_higher_patch_when_minor_matches() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         let (maj, min, pat) = CONTRACT_VERSION;
         assert!(!client.supports_version(&maj, &min, &(pat + 1)));
     }
 
     #[test]
     fn supports_version_rejects_different_major() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         let (_maj, min, pat) = CONTRACT_VERSION;
         assert!(!client.supports_version(&42, &min, &pat));
     }
@@ -1848,7 +1863,7 @@ mod tests {
 
     #[test]
     fn interface_features_lists_known_capabilities() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         let features = client.interface_features();
         let expected: std::vec::Vec<std::string::String> = features_list()
             .iter()
@@ -1864,7 +1879,7 @@ mod tests {
 
     #[test]
     fn interface_features_is_stable_across_calls() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         let a = client.interface_features();
         let b = client.interface_features();
         assert_eq!(a.len(), b.len());
@@ -1875,7 +1890,7 @@ mod tests {
 
     #[test]
     fn deprecated_entry_count_matches_table() {
-        let (_env, _rc, _cid, _rc2, client) = setup();
+        let (_env, _rc, _cid, _admin, _rc2, client) = setup();
         assert_eq!(
             client.deprecated_entry_count(),
             DEPRECATED_DIRECT_ADMIN.len() as u32
@@ -1888,7 +1903,7 @@ mod tests {
     /// succeeds (emits `compat_ok`).
     #[test]
     fn assert_registry_compatible_returns_true_for_real_registry() {
-        let (env, _registry_contract, _contract_id, _registry_client, client) = setup();
+        let (env, _registry_contract, _contract_id, _admin, _registry_client, client) = setup();
         assert!(client.assert_registry_compatible());
 
         // Locate the compat_ok event to confirm telemetry fires.
@@ -1919,19 +1934,9 @@ mod tests {
         let name_service_id = env.register_contract(None, TalosNameService);
         let name_service_client = TalosNameServiceClient::new(&env, &name_service_id);
 
-        // A different registry instance — real TalosRegistry code, but the
-        // bytes we observe via invoke_contract are the same `interface_id()`
-        // of TalosRegistry, which IS the expected ID. To force a mismatch,
-        // point at an address that exists but is not TalosRegistry — the
-        // invoke_contract will still execute the registered code, which is
-        // also TalosRegistry, so the helper succeeds. That's the realistic
-        // case: a wrong pointer still resolves to TalosRegistry WASM and
-        // returns the right ID, so no panic. We assert that to lock the
-        // happy path. A real on-chain mismatch would require a non-Soroban
-        // address — out of scope for the unit harness.
-
         let registry_id = env.register_contract(None, talos_registry::TalosRegistry);
-        name_service_client.initialize(&registry_id);
+        let admin = Address::generate(&env);
+        name_service_client.initialize(&registry_id, &admin, &0i128);
         assert!(name_service_client.assert_registry_compatible());
     }
 
@@ -1939,9 +1944,21 @@ mod tests {
 
     #[test]
     fn set_registry_contract_emits_dep_path_event_when_timelocked() {
-        let (env, _registry_contract, contract_id, _registry_client, client) = setup();
+        let (env, _registry_contract, contract_id, existing_admin, _registry_client, client) =
+            setup();
         let admin = Address::generate(&env);
-        client.set_admin(&admin);
+
+        client
+            .mock_auths(&[MockAuth {
+                address: &existing_admin,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "set_admin",
+                    args: (admin.clone(),).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .set_admin(&admin);
 
         client
             .mock_auths(&[MockAuth {
diff --git a/contracts/talos_registry/Cargo.toml b/contracts/talos_registry/Cargo.toml
index 9fb54982..bf9a683a 100644
--- a/contracts/talos_registry/Cargo.toml
+++ b/contracts/talos_registry/Cargo.toml
@@ -12,10 +12,10 @@ doctest = false
 soroban-sdk = { workspace = true }
 ttl-manager = { path = "../ttl_manager" }
 storage-migration = { path = "../storage_migration" }
+pause-control = { path = "../pause_control" }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
 soroban-sdk = { workspace = true, features = ["testutils"] }
 
 [target.'cfg(target_arch = "wasm32")'.dev-dependencies]
 soroban-sdk = { workspace = true, features = ["alloc"] }
-
diff --git a/contracts/talos_registry/src/lib.rs b/contracts/talos_registry/src/lib.rs
index a2655b5b..c6f13322 100644
--- a/contracts/talos_registry/src/lib.rs
+++ b/contracts/talos_registry/src/lib.rs
@@ -13,7 +13,9 @@ pub mod allowlist;
 #[cfg(all(test, not(target_arch = "wasm32")))]
 extern crate std;
 
-use soroban_sdk::{contract, contractimpl, contracttype, symbol_short, Address, Env, String};
+use soroban_sdk::{
+    contract, contractimpl, contracttype, symbol_short, Address, BytesN, Env, String, Symbol, Vec,
+};
 use storage_migration;
 use ttl_manager;
 use pause_control;
@@ -150,6 +152,10 @@ pub enum DataKey {
     TimelockProposal(u64),
     NextTimelockId,
     LastTouched(u32),
+    /// Active pause record for a domain, if any. Absence means unpaused.
+    PauseState(PauseDomain),
+    /// Bounded list of guardian addresses authorized to trigger (but not lift) pauses.
+    Guardians,
 }
 
 // ── Events ──────────────────────────────────────────────────────────
@@ -245,6 +251,16 @@ fn emit_timelock_config_changed(
         .publish(topics, (old_min_delay, new_min_delay, grace_period));
 }
 
+fn emit_allowlist_added(env: &Env, asset: Address, admin: Address) {
+    let topics = (symbol_short!("al_add"), asset.clone());
+    env.events().publish(topics, admin);
+}
+
+fn emit_allowlist_removed(env: &Env, asset: Address, admin: Address) {
+    let topics = (symbol_short!("al_rem"), asset.clone());
+    env.events().publish(topics, admin);
+}
+
 /// Emitted when a domain is paused (or an existing pause is refreshed/extended).
 fn emit_pause_set(env: &Env, domain: &PauseDomain, actor: &Address, expires_at: u64) {
     let topics = (symbol_short!("pause_on"), domain.clone());
@@ -343,6 +359,103 @@ const MAX_ROLLBACK_DEPTH: u32 = 1;
 /// call, storage write, or cross-contract invocation.
 pub const CONTRACT_VERSION: (u32, u32, u32) = (1, 3, 0);
 
+/// Stable 32-byte interface identifier for TalosRegistry v1.
+///
+/// Derived deterministically from the contract namespace
+/// (`"TalosRegistry"`) and `CONTRACT_VERSION` so that any client or
+/// dependent contract that re-runs the algorithm reproduces the same
+/// bytes (see the golden-vector tests in `mod tests`). The identifier is
+/// recorded in the same WASM binary as `CONTRACT_VERSION` and is
+/// therefore immutable once deployed.
+///
+/// **Do not modify** unless `CONTRACT_VERSION`'s `major` field is being
+/// bumped. A single byte change is a breaking ABI signal to consumers.
+pub const INTERFACE_ID: [u8; 32] = [
+    0x54, 0x61, 0x6C, 0x6F, 0x73, 0x52, 0x65, 0x67, // "TalosReg"
+    0x69, 0x73, 0x74, 0x72, 0x79, 0x00, 0x00, 0x00, // "istry" + zero pads
+    // (major, minor, patch) big-endian u32s
+    0x00, 0x00, 0x00, 0x01, // major = 1
+    0x00, 0x00, 0x00, 0x03, // minor = 3
+    0x00, 0x00, 0x00, 0x00, // patch = 0
+    // reserved (zero padding; future-proofing for any sub-namespace)
+    0x00, 0x00, 0x00, 0x00,
+];
+
+/// Stable namespace string from which `INTERFACE_ID` is derived.
+///
+/// Exposed for tooling (build scripts, SDKs, off-chain indexers) that
+/// need to recompute the identifier for verification. The derivation
+/// algorithm is:
+/// `BytesN<32>::from_array(env, &INTERFACE_NAMESPACE ++
+///  to_be_bytes(maj) ++ to_be_bytes(min) ++ to_be_bytes(patch) ++
+///  [0u8;8])`
+pub const INTERFACE_NAMESPACE: &str = "TalosRegistry";
+
+/// Well-known capability symbols returned by `interface_features()`.
+///
+/// Capability IDs are intended to be **stable**: adding a new capability
+/// is a non-breaking change (bump `minor`, append to this list); removing
+/// or renaming a capability is a breaking change (bump `major`).
+pub fn features_list() -> &'static [&'static str] {
+    &[
+        "create_talos",          // primary mutator — register a Talos
+        "talos_lifecycle",       // update_kernel / update_pulse / update_patron
+        "admin_transfer",        // propose_admin / accept_admin / cancel_admin_transfer
+        "timelock_admin",        // schedule_action / execute_action / cancel_action
+        "protocol_fee",          // set_protocol_fee / calculate_protocol_fee
+        "interface_query",       // version / interface_id / supports_version
+        "fees_collector",        // create-time fee capture (3% default)
+    ]
+}
+
+/// Deprecated entry-point table mapping the runtime panic reason to the
+/// recommended replacement.
+///
+/// Each row records `(deprecated_path, replacement_path)`. The mapping
+/// is referenced by `emit_deprecated_call()` so on-chain telemetry can
+/// tell which legacy entry callers were still trying to use after
+/// timelocks were enabled.
+pub const DEPRECATED_DIRECT_ADMIN: &[(&str, &str)] = &[
+    (
+        "set_protocol_fee (direct, pre-timelock)",
+        "schedule_action(SetProtocolFee, ..) + execute_action",
+    ),
+    (
+        "propose_admin (direct, pre-timelock)",
+        "schedule_action(ProposeAdmin, ..) + execute_action",
+    ),
+];
+
+/// Emit a privacy-safe deprecation event when a deprecated entry-point is
+/// invoked. Only the action name and recommended replacement are
+/// recorded; no caller-identifying or value-carrying data is exposed.
+fn emit_deprecated_call(env: &Env, deprecated: &str, replacement: &str) {
+    let topics = (symbol_short!("dep_path"),);
+    env.events()
+        .publish(topics, (deprecated, replacement));
+}
+
+/// Compatibility helper: returns true if `actual` semver can satisfy a
+/// caller requesting `required`.
+///
+/// SemVer contract for Soroban CLI / SDK clients:
+/// - `major` must match exactly; otherwise clients cannot rely on the
+///   ABI shape.
+/// - `minor` and `patch` of the deployed contract must be `>=` what the
+///   caller requires (clients may pin a feature floor).
+pub fn version_supports(actual: (u32, u32, u32), required: (u32, u32, u32)) -> bool {
+    if actual.0 != required.0 {
+        return false;
+    }
+    if actual.1 > required.1 {
+        return true;
+    }
+    if actual.1 < required.1 {
+        return false;
+    }
+    actual.2 >= required.2
+}
+
 // ── Pause Domains ───────────────────────────────────────────────────
 
 /// Pause domain for Talos creation (create_talos).
@@ -1611,7 +1724,7 @@ mod tests {
     fn version_returns_compile_time_constant() {
         let (env, contract_id) = setup();
         let client = TalosRegistryClient::new(&env, &contract_id);
-        assert_eq!(client.version(), (1u32, 2u32, 0u32));
+        assert_eq!(client.version(), (1u32, 3u32, 0u32));
     }
 
     #[test]
@@ -3215,4 +3328,289 @@ mod tests {
         assert!(res.is_err());
         assert_eq!(client.schema_version(), SCHEMA_TIMELOCK_DEFAULTS);
     }
+
+    // ── Comprehensive Authorization Coverage for Registry Mutations ─────────
+
+    #[test]
+    fn auth_create_talos_unauthorized_fails_and_leaves_storage_and_events_unchanged() {
+        let (env, contract_id) = setup();
+        let client = TalosRegistryClient::new(&env, &contract_id);
+        let creator = Address::generate(&env);
+        let imposter = Address::generate(&env);
+        let protocol_wallet = Address::generate(&env);
+        client.initialize(&protocol_wallet);
+
+        let initial_events_count = env.events().all().len();
+        let name = s(&env, "TestTalos");
+        let category = s(&env, "AI");
+        let description = s(&env, "Test Desc");
+        let patron_cfg = patron(&env, &creator);
+        let kernel_cfg = kernel();
+        let pulse_cfg = pulse(&env);
+
+        // Attempt creation with imposter auth instead of creator auth
+        let res = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "create_talos",
+                    args: (
+                        name.clone(),
+                        category.clone(),
+                        description.clone(),
+                        patron_cfg.clone(),
+                        kernel_cfg.clone(),
+                        pulse_cfg.clone(),
+                        protocol_wallet.clone(),
+                    )
+                        .into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_create_talos(
+                &name,
+                &category,
+                &description,
+                &patron_cfg,
+                &kernel_cfg,
+                &pulse_cfg,
+                &protocol_wallet,
+            );
+
+        assert!(res.is_err(), "Unauthorized creator caller must fail");
+        assert_eq!(client.next_talos_id(), 1, "NextTalosId must not increment on auth rejection");
+        assert!(client.get_talos(&1).is_none(), "No Talos record should be created");
+        assert_eq!(env.events().all().len(), initial_events_count, "No new events should be emitted");
+    }
+
+    #[test]
+    fn auth_update_patron_unauthorized_fails_and_preserves_state_and_events() {
+        let (env, contract_id) = setup();
+        let client = TalosRegistryClient::new(&env, &contract_id);
+        let creator = Address::generate(&env);
+        let imposter = Address::generate(&env);
+        let protocol_wallet = Address::generate(&env);
+        client.initialize(&protocol_wallet);
+
+        let id = create_talos_with_auth(&env, &client, &contract_id, &creator, &protocol_wallet);
+        let original_talos = client.get_talos(&id).expect("talos exists");
+        let events_before = env.events().all().len();
+
+        let new_patron = Patron {
+            creator_share: 40,
+            investor_share: 40,
+            treasury_share: 20,
+            creator_addr: creator.clone(),
+            investor_addr: Address::generate(&env),
+            treasury_addr: Address::generate(&env),
+        };
+
+        // Unauthorized call (imposter auth)
+        let res = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "update_patron",
+                    args: (id, new_patron.clone()).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_update_patron(&id, &new_patron);
+
+        assert!(res.is_err(), "Unauthorized update_patron must fail");
+        let current_talos = client.get_talos(&id).expect("talos exists");
+        assert_eq!(current_talos.patron.creator_share, original_talos.patron.creator_share);
+        assert_eq!(current_talos.patron.investor_share, original_talos.patron.investor_share);
+        assert_eq!(current_talos.patron.treasury_share, original_talos.patron.treasury_share);
+        assert_eq!(env.events().all().len(), events_before, "No events should be emitted on auth failure");
+    }
+
+    #[test]
+    fn auth_update_kernel_unauthorized_fails_and_preserves_state() {
+        let (env, contract_id) = setup();
+        let client = TalosRegistryClient::new(&env, &contract_id);
+        let creator = Address::generate(&env);
+        let imposter = Address::generate(&env);
+        let protocol_wallet = Address::generate(&env);
+        client.initialize(&protocol_wallet);
+
+        let id = create_talos_with_auth(&env, &client, &contract_id, &creator, &protocol_wallet);
+        let original_talos = client.get_talos(&id).expect("talos exists");
+
+        let new_kernel = Kernel {
+            approval_threshold: 999,
+            gtm_budget: 88888,
+            min_patron_pulse: 777,
+        };
+
+        // Unauthorized call with no auth or imposter auth
+        let res = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "update_kernel",
+                    args: (id, new_kernel.clone()).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_update_kernel(&id, &new_kernel);
+
+        assert!(res.is_err(), "Unauthorized update_kernel must fail");
+        let current_talos = client.get_talos(&id).expect("talos exists");
+        assert_eq!(current_talos.kernel.approval_threshold, original_talos.kernel.approval_threshold);
+        assert_eq!(current_talos.kernel.gtm_budget, original_talos.kernel.gtm_budget);
+        assert_eq!(current_talos.kernel.min_patron_pulse, original_talos.kernel.min_patron_pulse);
+    }
+
+    #[test]
+    fn auth_update_pulse_unauthorized_fails_and_preserves_state() {
+        let (env, contract_id) = setup();
+        let client = TalosRegistryClient::new(&env, &contract_id);
+        let creator = Address::generate(&env);
+        let imposter = Address::generate(&env);
+        let protocol_wallet = Address::generate(&env);
+        client.initialize(&protocol_wallet);
+
+        let id = create_talos_with_auth(&env, &client, &contract_id, &creator, &protocol_wallet);
+        let original_talos = client.get_talos(&id).expect("talos exists");
+
+        let new_pulse = Pulse {
+            total_supply: 99_999_999,
+            price_usd_cents: 500,
+            token_symbol: s(&env, "NEWPULSE"),
+        };
+
+        // Unauthorized update_pulse call
+        let res = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "update_pulse",
+                    args: (id, new_pulse.clone()).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_update_pulse(&id, &new_pulse);
+
+        assert!(res.is_err(), "Unauthorized update_pulse must fail");
+        let current_talos = client.get_talos(&id).expect("talos exists");
+        assert_eq!(current_talos.pulse.total_supply, original_talos.pulse.total_supply);
+        assert_eq!(current_talos.pulse.price_usd_cents, original_talos.pulse.price_usd_cents);
+        assert_eq!(current_talos.pulse.token_symbol, original_talos.pulse.token_symbol);
+    }
+
+    #[test]
+    fn auth_deactivate_talos_unauthorized_fails_and_remains_active() {
+        let (env, contract_id) = setup();
+        let client = TalosRegistryClient::new(&env, &contract_id);
+        let creator = Address::generate(&env);
+        let imposter = Address::generate(&env);
+        let protocol_wallet = Address::generate(&env);
+        client.initialize(&protocol_wallet);
+
+        let id = create_talos_with_auth(&env, &client, &contract_id, &creator, &protocol_wallet);
+        assert!(client.is_active(&id));
+
+        // Imposter attempts deactivation
+        let res = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "deactivate_talos",
+                    args: (id,).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_deactivate_talos(&id);
+
+        assert!(res.is_err(), "Unauthorized deactivation must fail");
+        assert!(client.is_active(&id), "Talos must remain active after unauthorized deactivation attempt");
+    }
+
+    #[test]
+    fn auth_governance_and_timelock_unauthorized_mutations_fail() {
+        let (env, contract_id) = setup();
+        let client = TalosRegistryClient::new(&env, &contract_id);
+        let admin = Address::generate(&env);
+        let imposter = Address::generate(&env);
+        client.initialize(&admin);
+
+        // 1. Unauthorized set_timelock_config
+        let res_cfg = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "set_timelock_config",
+                    args: (1000u64, 2000u64).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_set_timelock_config(&1000, &2000);
+        assert!(res_cfg.is_err(), "Unauthorized set_timelock_config must fail");
+
+        // 2. Unauthorized schedule_action
+        let action = AdminAction::SetProtocolFee(500);
+        let res_sch = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "schedule_action",
+                    args: (action.clone(), 100u64).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_schedule_action(&action, &100);
+        assert!(res_sch.is_err(), "Unauthorized schedule_action must fail");
+
+        // Schedule a legitimate action by admin
+        let prop_id = client
+            .mock_auths(&[MockAuth {
+                address: &admin,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "schedule_action",
+                    args: (action.clone(), 0u64).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .schedule_action(&action, &0);
+
+        // 3. Unauthorized cancel_action by non-admin
+        let res_cnl = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "cancel_action",
+                    args: (prop_id,).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_cancel_action(&prop_id);
+        assert!(res_cnl.is_err(), "Unauthorized cancel_action must fail");
+
+        let prop = client.get_timelock_proposal(&prop_id).expect("proposal exists");
+        assert_eq!(prop.status, ProposalStatus::Scheduled, "Proposal must remain Scheduled");
+
+        // 4. Unauthorized touch_batch by non-admin
+        let res_touch = client
+            .mock_auths(&[MockAuth {
+                address: &imposter,
+                invoke: &MockAuthInvoke {
+                    contract: &contract_id,
+                    fn_name: "touch_batch",
+                    args: (1u32, 10u32).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }])
+            .try_touch_batch(&1, &10);
+        assert!(res_touch.is_err(), "Unauthorized touch_batch must fail");
+    }
 }
diff --git a/package.json b/package.json
index 36c6f478..204269b7 100644
--- a/package.json
+++ b/package.json
@@ -12,8 +12,7 @@
     "stack:up": "bash scripts/local-stack.sh up",
     "stack:down": "bash scripts/local-stack.sh down",
     "stack:logs": "bash scripts/local-stack.sh logs",
-    "stack:reset": "bash scripts/local-stack.sh reset",
-    "test:fixtures": "pnpm --dir contracts test:fixtures"
+    "stack:reset": "bash scripts/local-stack.sh reset"
   },
   "dependencies": {
     "next": "16.2.2"
diff --git a/packages/prime-agent/docs/adapter-diagnostics.md b/packages/prime-agent/docs/adapter-diagnostics.md
deleted file mode 100644
index 79453722..00000000
--- a/packages/prime-agent/docs/adapter-diagnostics.md
+++ /dev/null
@@ -1,23 +0,0 @@
-# Adapter diagnostic log schema
-
-The adapter capability sandbox emits only `adapter_sandbox_invocation`,
-`adapter_capability_denied`, and `adapter_resource_limit`. Unknown fields are
-dropped before logging.
-
-| Field | Maximum | Handling |
-| --- | ---: | --- |
-| `adapter` (provider) | 64 chars | identifier characters only |
-| `operation` | 64 chars | built-in adapter operations only |
-| `operation_id` | 128 chars | identifier characters only |
-| `outcome` (status) | 32 chars | `succeeded`, `failed`, `timed_out`, or `denied` |
-| `error_type` / `error` | 256 chars | type is an identifier; text is redacted then capped |
-| `capability` / `resource` | 32 chars | fixed allowlists |
-| `target` | 128 chars | redacted then capped |
-| `duration_ms` | 3,600,000 | locally computed finite number |
-
-Unexpected categorical values become `unknown`. Control characters are replaced
-with spaces so values cannot alter log records. Sensitive keys (tokens,
-secrets, passwords, API keys, cookies, credentials, and similar names) are
-redacted recursively in nested error metadata before truncation. The schema is
-logging-only and does not affect retry, fallback, circuit-breaker, or adapter
-execution decisions.
diff --git a/packages/prime-agent/src/talos_agent/adapters/capability.py b/packages/prime-agent/src/talos_agent/adapters/capability.py
index 944a4527..04424e4d 100644
--- a/packages/prime-agent/src/talos_agent/adapters/capability.py
+++ b/packages/prime-agent/src/talos_agent/adapters/capability.py
@@ -22,7 +22,6 @@
 import httpx
 
 from talos_agent.adapters.base import BaseSocialAdapter, ChannelCapabilities, PublishResult
-from talos_agent.adapters.diagnostics import safe_adapter_diagnostic_fields
 from talos_agent.observability import log
 
 _IDENTIFIER_RE = re.compile(r"^[a-z][a-z0-9_.-]{0,127}$")
@@ -1060,9 +1059,10 @@ def _denied(adapter: str, capability: str, target: str) -> None:
     try:
         log.warning(
             "adapter_capability_denied",
-            **safe_adapter_diagnostic_fields(
-                adapter=adapter, capability=capability, target=target, outcome="denied"
-            ),
+            adapter=adapter,
+            capability=capability,
+            target=target,
+            outcome="denied",
         )
     except Exception:
         pass
@@ -1072,9 +1072,10 @@ def _resource(adapter: str, operation: str, resource: str) -> None:
     try:
         log.warning(
             "adapter_resource_limit",
-            **safe_adapter_diagnostic_fields(
-                adapter=adapter, operation=operation, resource=resource, outcome="denied"
-            ),
+            adapter=adapter,
+            operation=operation,
+            resource=resource,
+            outcome="denied",
         )
     except Exception:
         pass
@@ -1098,7 +1099,7 @@ def _invocation_log(
     if error_type is not None:
         fields["error_type"] = error_type.__name__
     try:
-        log.info("adapter_sandbox_invocation", **safe_adapter_diagnostic_fields(**fields))
+        log.info("adapter_sandbox_invocation", **fields)
     except Exception:
         pass
 
diff --git a/packages/prime-agent/src/talos_agent/adapters/diagnostics.py b/packages/prime-agent/src/talos_agent/adapters/diagnostics.py
deleted file mode 100644
index 75c7a8c6..00000000
--- a/packages/prime-agent/src/talos_agent/adapters/diagnostics.py
+++ /dev/null
@@ -1,86 +0,0 @@
-"""Bounded, redacted schema for adapter structured-log diagnostics."""
-
-from __future__ import annotations
-
-import re
-from collections.abc import Mapping
-from typing import Any
-
-MAX_PROVIDER_LENGTH = 64
-MAX_OPERATION_LENGTH = 64
-MAX_STATUS_LENGTH = 32
-MAX_ERROR_LENGTH = 256
-MAX_OPERATION_ID_LENGTH = 128
-MAX_CAPABILITY_LENGTH = 32
-MAX_TARGET_LENGTH = 128
-MAX_RESOURCE_LENGTH = 32
-
-_CONTROL_CHARS = re.compile(r"[\x00-\x1f\x7f-\x9f]")
-_SAFE_LABEL = re.compile(r"^[A-Za-z][A-Za-z0-9_.-]*$")
-_SENSITIVE_KEY = re.compile(r"(?:token|authorization|secret|api[_-]?key|password|cookie|signature|credential|private[_-]?key|webhook)", re.I)
-_INLINE_SECRET = re.compile(r"(Bearer\s+)[^\s,;]+", re.I)
-_VALID_OPERATIONS = frozenset({"post", "reply", "get_mentions", "search", "get_post_performance", "get_profile_stats", "network", "browser"})
-_VALID_STATUSES = frozenset({"succeeded", "failed", "timed_out", "denied"})
-_VALID_CAPABILITIES = frozenset({"secret", "network", "browser", "browser_host", "filesystem_read", "filesystem_write", "tool", "manifest", "operation"})
-_VALID_RESOURCES = frozenset({"input", "output", "request", "network_requests", "network_response", "browser_actions"})
-
-
-def _redact(value: Any, seen: set[int] | None = None) -> Any:
-    """Redact sensitive keys recursively before a value is rendered or capped."""
-    seen = set() if seen is None else seen
-    if isinstance(value, Mapping):
-        if id(value) in seen:
-            return "[CYCLE]"
-        seen.add(id(value))
-        return {str(key): "[REDACTED]" if _SENSITIVE_KEY.search(str(key)) else _redact(child, seen) for key, child in value.items()}
-    if isinstance(value, (list, tuple, set, frozenset)):
-        if id(value) in seen:
-            return "[CYCLE]"
-        seen.add(id(value))
-        return [_redact(child, seen) for child in value]
-    return _INLINE_SECRET.sub(r"\1[REDACTED]", value) if isinstance(value, str) else value
-
-
-def _text(value: Any, maximum: int) -> str:
-    """Render a redacted value as one bounded, single-line string."""
-    return _CONTROL_CHARS.sub(" ", str(value))[:maximum]
-
-
-def _label(value: Any, maximum: int, allowed: frozenset[str] | None = None) -> str:
-    redacted = _redact(value)
-    raw_text = str(redacted)
-    if len(raw_text) > maximum:
-        return "unknown"
-    text = _text(redacted, maximum)
-    return text if _SAFE_LABEL.fullmatch(text) and (allowed is None or text in allowed) else "unknown"
-
-
-def safe_adapter_diagnostic_fields(**fields: Any) -> dict[str, Any]:
-    """Return only documented, bounded adapter-log fields.
-
-    Unknown fields are dropped. Redaction always occurs before control-character
-    replacement and truncation.
-    """
-    result: dict[str, Any] = {}
-    if "adapter" in fields or "provider" in fields:
-        result["adapter"] = _label(fields.get("adapter", fields.get("provider")), MAX_PROVIDER_LENGTH)
-    if "operation" in fields:
-        result["operation"] = _label(fields["operation"], MAX_OPERATION_LENGTH, _VALID_OPERATIONS)
-    if fields.get("operation_id") is not None:
-        result["operation_id"] = _label(fields["operation_id"], MAX_OPERATION_ID_LENGTH)
-    if "outcome" in fields or "status" in fields:
-        result["outcome"] = _label(fields.get("outcome", fields.get("status")), MAX_STATUS_LENGTH, _VALID_STATUSES)
-    if "error_type" in fields:
-        result["error_type"] = _label(fields["error_type"], MAX_ERROR_LENGTH)
-    if "error" in fields:
-        result["error"] = _text(_redact(fields["error"]), MAX_ERROR_LENGTH)
-    if "capability" in fields:
-        result["capability"] = _label(fields["capability"], MAX_CAPABILITY_LENGTH, _VALID_CAPABILITIES)
-    if "target" in fields:
-        result["target"] = _text(_redact(fields["target"]), MAX_TARGET_LENGTH)
-    if "resource" in fields:
-        result["resource"] = _label(fields["resource"], MAX_RESOURCE_LENGTH, _VALID_RESOURCES)
-    duration = fields.get("duration_ms")
-    if isinstance(duration, (int, float)) and not isinstance(duration, bool):
-        result["duration_ms"] = max(0, min(round(duration, 2), 3_600_000))
-    return result
diff --git a/packages/prime-agent/tests/test_adapter_capability_sandbox.py b/packages/prime-agent/tests/test_adapter_capability_sandbox.py
index a20b9711..38902d8a 100644
--- a/packages/prime-agent/tests/test_adapter_capability_sandbox.py
+++ b/packages/prime-agent/tests/test_adapter_capability_sandbox.py
@@ -34,11 +34,6 @@
     default_manifests,
     load_manifests,
 )
-from talos_agent.adapters.diagnostics import (
-    MAX_ERROR_LENGTH,
-    MAX_PROVIDER_LENGTH,
-    safe_adapter_diagnostic_fields,
-)
 from talos_agent.adapters.registry import AdapterRegistry
 from talos_agent.adapters.telegram import TelegramAdapter, TelegramAdapterConfig
 from talos_agent.config import Settings
@@ -348,67 +343,6 @@ async def test_structured_events_never_include_payloads_or_secret_values(
     db.close()
 
 
-def test_adapter_diagnostic_schema_bounds_and_normalizes_untrusted_labels():
-    fields = safe_adapter_diagnostic_fields(
-        provider="provider-" + "x" * 500,
-        operation="post\nforged",
-        status="succeeded\r\nforged",
-        error_type="Error\x00" + "x" * 500,
-        operation_id="id\n" + "x" * 500,
-        target="target\r\n" + "x" * 500,
-        unexpected="must be dropped",
-    )
-
-    assert fields["adapter"] == "unknown"
-    assert fields["operation"] == "unknown"
-    assert fields["outcome"] == "unknown"
-    assert fields["error_type"] == "unknown"
-    assert fields["operation_id"] == "unknown"
-    assert len(fields["adapter"]) <= MAX_PROVIDER_LENGTH
-    assert "\n" not in repr(fields) and "\r" not in repr(fields)
-    assert "unexpected" not in fields
-
-
-def test_adapter_diagnostic_schema_redacts_nested_secrets_before_truncation():
-    fields = safe_adapter_diagnostic_fields(
-        adapter="telegram",
-        operation="post",
-        outcome="failed",
-        error={"context": {"api_key": "secret-value-that-must-never-appear"}, "message": "x" * 1000},
-    )
-
-    assert fields["adapter"] == "telegram"
-    assert fields["operation"] == "post"
-    assert fields["outcome"] == "failed"
-    assert "secret-value-that-must-never-appear" not in fields["error"]
-    assert "[REDACTED]" in fields["error"]
-    assert len(fields["error"]) <= MAX_ERROR_LENGTH
-
-
-def test_adapter_diagnostic_schema_preserves_normal_diagnostics():
-    assert safe_adapter_diagnostic_fields(
-        adapter="telegram",
-        operation="post",
-        operation_id="delivery-42",
-        outcome="succeeded",
-        error_type="TimeoutError",
-        capability="network",
-        resource="request",
-        target="api.telegram.org",
-        duration_ms=12.345,
-    ) == {
-        "adapter": "telegram",
-        "operation": "post",
-        "operation_id": "delivery-42",
-        "outcome": "succeeded",
-        "error_type": "TimeoutError",
-        "capability": "network",
-        "resource": "request",
-        "target": "api.telegram.org",
-        "duration_ms": 12.35,
-    }
-
-
 @pytest.mark.asyncio
 async def test_network_request_budget_stops_repeated_calls(tmp_path: Path):
     async def handler(request: httpx.Request) -> httpx.Response:
diff --git a/web/src/app/api/health/health.test.ts b/web/src/app/api/health/health.test.ts
deleted file mode 100644
index df12445f..00000000
--- a/web/src/app/api/health/health.test.ts
+++ /dev/null
@@ -1,210 +0,0 @@
-/**
- * Tests for health and readiness probe endpoints.
- *
- * We mock the database and global fetch to simulate healthy, degraded,
- * failing, and timed-out dependency states.  Fake timers are used to verify
- * bounded timeouts without waiting real time.
- */
-
-import { describe, it, expect, vi, beforeEach } from "vitest";
-
-// Mock the database module before importing routes that use it.
-vi.mock("@/db", () => ({
-  db: {
-    execute: vi.fn(),
-  },
-}));
-
-// Mock global fetch before importing the routes so they see the mock.
-const mockFetch = vi.hoisted(() => {
-  const mock = vi.fn();
-  vi.stubGlobal("fetch", mock);
-  return mock;
-});
-
-import { db } from "@/db";
-import { GET as healthGet } from "./route";
-import { GET as readyGet } from "./ready/route";
-import { GET as liveGet } from "./live/route";
-import { DB_TIMEOUT_MS, STELLAR_TIMEOUT_MS } from "./utils";
-
-// A fake request object for the /api/health route.
-function healthRequest() {
-  return { nextUrl: new URL("http://localhost/api/health") } as any;
-}
-
-function isIsoString(value: unknown): boolean {
-  return typeof value === "string" && !Number.isNaN(Date.parse(value));
-}
-
-describe("health probes", () => {
-  beforeEach(() => {
-    vi.resetAllMocks(); // clears calls and resets implementations
-    vi.useRealTimers();
-  });
-
-  describe("liveness probe (GET /api/health/live)", () => {
-    it("returns 200 with ok even when dependencies are unavailable", async () => {
-      vi.mocked(db.execute).mockRejectedValue(new Error("db unavailable"));
-      mockFetch.mockRejectedValue(new Error("horizon unavailable"));
-
-      const response = await liveGet();
-      expect(response.status).toBe(200);
-
-      const body = await response.json();
-      expect(body).toMatchObject({
-        status: "ok",
-      });
-      expect(typeof body.uptime).toBe("number");
-      expect(isIsoString(body.ts)).toBe(true);
-      // Liveness must not include dependency checks.
-      expect(body.checks).toBeUndefined();
-      // Liveness must not touch dependencies.
-      expect(db.execute).not.toHaveBeenCalled();
-      expect(mockFetch).not.toHaveBeenCalled();
-    });
-
-    it("returns no-store cache header", async () => {
-      const response = await liveGet();
-      expect(response.headers.get("Cache-Control")).toBe("no-store");
-    });
-  });
-
-  describe("readiness probe (GET /api/health)", () => {
-    it("returns 200 ok when all dependencies are healthy", async () => {
-      vi.mocked(db.execute).mockResolvedValue({ rows: [] });
-      mockFetch.mockResolvedValue(new Response(null, { status: 200 }));
-
-      const response = await healthGet(healthRequest());
-      expect(response.status).toBe(200);
-      expect(response.headers.get("Cache-Control")).toBe("no-store");
-
-      const body = await response.json();
-      expect(body).toEqual({
-        ok: true,
-        checks: { db: "ok", stellar: "ok" },
-        ts: expect.any(String),
-      });
-      expect(isIsoString(body.ts)).toBe(true);
-    });
-
-    it("returns 503 with db error when the database is down", async () => {
-      vi.mocked(db.execute).mockRejectedValue(new Error("connection refused"));
-      mockFetch.mockResolvedValue(new Response(null, { status: 200 }));
-
-      const response = await healthGet(healthRequest());
-      expect(response.status).toBe(503);
-
-      const body = await response.json();
-      expect(body.ok).toBe(false);
-      expect(body.checks).toEqual({ db: "error", stellar: "ok" });
-    });
-
-    it("returns 503 with stellar error when Horizon fails", async () => {
-      vi.mocked(db.execute).mockResolvedValue({ rows: [] });
-      mockFetch.mockResolvedValue(new Response(null, { status: 503 }));
-
-      const response = await healthGet(healthRequest());
-      expect(response.status).toBe(503);
-
-      const body = await response.json();
-      expect(body.ok).toBe(false);
-      expect(body.checks).toEqual({ db: "ok", stellar: "error" });
-    });
-
-    it("returns 503 with both errors when both dependencies fail", async () => {
-      vi.mocked(db.execute).mockRejectedValue(new Error("database down"));
-      mockFetch.mockRejectedValue(new Error("network error"));
-
-      const response = await healthGet(healthRequest());
-      expect(response.status).toBe(503);
-
-      const body = await response.json();
-      expect(body.ok).toBe(false);
-      expect(body.checks).toEqual({ db: "error", stellar: "error" });
-    });
-
-    it("does not leak secrets or connection strings", async () => {
-      const secret = "postgres://user:hunter2@db.internal:5432/prod";
-      const dbError = new Error(`db connection failed: ${secret}`);
-      const horizonError = new Error(`horizon auth failed: ${secret}`);
-
-      vi.mocked(db.execute).mockRejectedValue(dbError);
-      mockFetch.mockRejectedValue(horizonError);
-
-      const response = await healthGet(healthRequest());
-      const text = await response.text();
-
-      expect(text).not.toContain("postgres://");
-      expect(text).not.toContain("hunter2");
-      expect(text).not.toContain("db.internal");
-    });
-
-    it("returns a bounded response when the database times out", async () => {
-      vi.useFakeTimers();
-      vi.mocked(db.execute).mockImplementation(
-        () => new Promise(() => {}) // never settles
-      );
-      mockFetch.mockResolvedValue(new Response(null, { status: 200 }));
-
-      const pending = healthGet(healthRequest());
-      await vi.advanceTimersByTimeAsync(DB_TIMEOUT_MS + 10);
-      const response = await pending;
-
-      expect(response.status).toBe(503);
-      const body = await response.json();
-      expect(body.checks).toEqual({ db: "error", stellar: "ok" });
-    });
-
-    it("returns a bounded response when Horizon times out", async () => {
-      vi.useFakeTimers();
-      vi.mocked(db.execute).mockResolvedValue({ rows: [] });
-      mockFetch.mockImplementation(
-        () => new Promise(() => {}) // never settles
-      );
-
-      const pending = healthGet(healthRequest());
-      await vi.advanceTimersByTimeAsync(STELLAR_TIMEOUT_MS + 10);
-      const response = await pending;
-
-      expect(response.status).toBe(503);
-      const body = await response.json();
-      expect(body.checks).toEqual({ db: "ok", stellar: "error" });
-    });
-  });
-
-  describe("readiness probe (GET /api/health/ready)", () => {
-    it("matches the main /api/health response contract", async () => {
-      vi.mocked(db.execute).mockResolvedValue({ rows: [] });
-      mockFetch.mockResolvedValue(new Response(null, { status: 200 }));
-
-      const [healthResponse, readyResponse] = await Promise.all([
-        healthGet(healthRequest()),
-        readyGet(),
-      ]);
-
-      expect(readyResponse.status).toBe(healthResponse.status);
-      const healthBody = await healthResponse.json();
-      const readyBody = await readyResponse.json();
-      expect(readyBody.ok).toBe(healthBody.ok);
-      expect(readyBody.checks).toEqual(healthBody.checks);
-      expect(typeof readyBody.ts).toBe("string");
-    });
-
-    it("returns 503 with db error when the database times out", async () => {
-      vi.useFakeTimers();
-      vi.mocked(db.execute).mockImplementation(
-        () => new Promise(() => {})
-      );
-      mockFetch.mockResolvedValue(new Response(null, { status: 200 }));
-
-      const pending = readyGet();
-      await vi.advanceTimersByTimeAsync(DB_TIMEOUT_MS + 10);
-      const response = await pending;
-
-      expect(response.status).toBe(503);
-      const body = await response.json();
-      expect(body.checks).toEqual({ db: "error", stellar: "ok" });
-    });
-  });
-});
diff --git a/web/src/app/api/health/live/route.ts b/web/src/app/api/health/live/route.ts
index 11342fb4..27a671bc 100644
--- a/web/src/app/api/health/live/route.ts
+++ b/web/src/app/api/health/live/route.ts
@@ -1,20 +1,36 @@
+/**
+ * GET /api/health/live — Liveness probe
+ *
+ * Answers the single question: "Is the Node.js process alive?"
+ * It performs NO external I/O — no DB query, no Horizon call.
+ *
+ * Use this probe for:
+ *   - Kubernetes livenessProbe (restart the container when this fails)
+ *   - Docker HEALTHCHECK as a cheap process-alive signal
+ *
+ * A liveness failure means the process itself is broken; the orchestrator
+ * should restart it.  Dependency failures belong in the readiness probe
+ * (GET /api/health/ready) and must NOT affect liveness.
+ *
+ * Response shape:
+ *   200  { status: "ok",   uptime: <seconds>, ts: <ISO-8601> }
+ *
+ * Headers:
+ *   Cache-Control: no-store   (never cache health responses)
+ */
+
 export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-export function buildLivenessResponse(uptime: number, ts: string) {
-  return { status: "ok", uptime, ts };
-}
+
 export function GET() {
   return Response.json(
-    buildLivenessResponse(Math.floor(process.uptime()), new Date().toISOString()),
-    { status: 200, headers: { "Cache-Control": "no-store" } }
+    {
+      status: "ok",
+      uptime: Math.floor(process.uptime()),
+      ts: new Date().toISOString(),
+    },
+    {
+      status: 200,
+      headers: { "Cache-Control": "no-store" },
+    },
   );
 }
-if (import.meta.vitest) {
-  const { describe, it, expect } = import.meta.vitest;
-  describe("liveness", () => {
-    it("returns 200", async () => {
-      const res = GET();
-      expect(res.status).toBe(200);
-    });
-  });
-}
\ No newline at end of file
diff --git a/web/src/app/api/health/ready/route.ts b/web/src/app/api/health/ready/route.ts
index 4fdb4839..99a700b9 100644
--- a/web/src/app/api/health/ready/route.ts
+++ b/web/src/app/api/health/ready/route.ts
@@ -1,10 +1,11 @@
-/** * GET /api/health/ready - Readiness probe
+/**
+ * GET /api/health/ready — Readiness probe
  *
  * Answers: "Is the service ready to accept traffic?"
  * Runs all dependency checks in parallel with bounded timeouts:
  *   - db      SELECT 1 against Postgres           (2 s timeout)
- *   - stellar GET to Stellar Horizon RPC          (3 s timeout)
-
+ *   - stellar GET to Stellar Horizon RPC           (3 s timeout)
+ *
  * Use this probe for:
  *   - Kubernetes readinessProbe (remove pod from load-balancer when degraded)
  *   - UptimeRobot / Better Uptime monitoring (1-minute interval)
@@ -19,9 +20,6 @@
  *
  * Headers:
  *   Cache-Control: no-store   (never cache health responses)
- *
- * Each dependency check is bound by a timeout; if it exceeds the timeout
- * the check is reported as "error" within that bound.
  */
 
 import { db } from "@/db";
@@ -36,48 +34,8 @@ import {
 
 export const runtime = "nodejs";
 
-export type CheckResult = "ok" | "error";
-export type CheckName = "db" | "stellar";
-export type HealthChecks = Record<CheckName, CheckResult>;
-
-export interface HealthCheckResult {
-  ok: boolean;
-  checks: HealthChecks;
-  ts: string;
-}
-
-export interface HealthCheckOptions {
-  /** Database client, must support `.execute(query)` */
-  db: Pick<typeof db, "execute">;
-  /** Fetch-compatible function for making HTTP requests */
-  fetch: typeof fetch;
-  /** Clock function used for the response `ts` field */
-  now: () => Date;
-  /** Timeout for the database check */
-  dbTimeoutMs: number;
-  /** Timeout for the stellar check */
-  stellarTimeoutMs: number;
-  /** Horizon URL to check */
-  stellarUrl: string;
-}
-
-/**
- * Run the readiness dependency checks with the provided options.
- * Exported separately to make the route deterministic and testable.
- */
-export async function performHealthCheck(
-  options: HealthCheckOptions,
-): Promise<HealthCheckResult> {
-  const {
-    db,
-    fetch,
-    now,
-    dbTimeoutMs,
-    stellarTimeoutMs,
-    stellarUrl,
-  } = options;
-
-  const checks: HealthChecks = {
+export async function GET() {
+  const checks: { db: "ok" | "error"; stellar: "ok" | "error" } = {
     db: "error",
     stellar: "error",
   };
@@ -88,37 +46,28 @@ export async function performHealthCheck(
         void signal;
         return db.execute(sql`SELECT 1`);
       },
-      dbTimeoutMs,
+      DB_TIMEOUT_MS,
     ).then(() => {
       checks.db = "ok";
     }),
     withTimeout(
       (signal) =>
-        fetch(stellarUrl, { signal }).then((r) => {
+        fetch(process.env.STELLAR_HORIZON_URL ?? DEFAULT_HORIZON, { signal }).then((r) => {
           if (!r.ok) throw new Error(`HTTP ${r.status}`);
         }),
-      stellarTimeoutMs,
+      STELLAR_TIMEOUT_MS,
     ).then(() => {
       checks.stellar = "ok";
     }),
   ]);
 
   const ok = checks.db === "ok" && checks.stellar === "ok";
-  return { ok, checks, ts: now().toISOString() };
-}
-
-export async function GET() {
-  const result = await performHealthCheck({
-    db,
-    fetch,
-    now: () => new Date(),
-    dbTimeoutMs: DB_TIMEOUT_MS,
-    stellarTimeoutMs: STELLAR_TIMEOUT_MS,
-    stellarUrl: process.env.STELLAR_HORIZON_URL ?? DEFAULT_HORIZON,
-  });
 
-  return NextResponse.json(result, {
-    status: result.ok ? 200 : 503,
-    headers: { "Cache-Control": "no-store" },
-  });
+  return NextResponse.json(
+    { ok, checks, ts: new Date().toISOString() },
+    {
+      status: ok ? 200 : 503,
+      headers: { "Cache-Control": "no-store" },
+    },
+  );
 }
diff --git a/web/src/app/api/health/route.ts b/web/src/app/api/health/route.ts
index 091ac98e..f5933598 100644
--- a/web/src/app/api/health/route.ts
+++ b/web/src/app/api/health/route.ts
@@ -1,6 +1,6 @@
-import { db as defaultDb } from "@/db";
+import { db } from "@/db";
 import { sql } from "drizzle-orm";
-import { NextRequest, NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import {
   DEFAULT_HORIZON,
   DB_TIMEOUT_MS,
@@ -10,105 +10,40 @@ import {
 
 export const runtime = "nodejs";
 
-type Db = {
-  execute: (query: any) => Promise<any>;
-};
-
-/**
- * Health check dependencies that can be injected for testing.
- */
-export type HealthDeps = {
-  db: Db;
-  fetchFn: typeof fetch;
-  now?: () => Date;
-  dbTimeoutMs?: number;
-  stellarTimeoutMs?: number;
-};
-
-/**
- * The readiness state of a single dependency. Only "ok" or "error" is
- * reported; no internal error details or connection strings are exposed.
- */
-export type DependencyStatus = "ok" | "error";
-
-/**
- * Readiness check results with one entry per dependency.
- */
-export type HealthChecks = {
-  db: DependencyStatus;
-  stellar: DependencyStatus;
-};
-
-/**
- * Creates a health check handler for Next.js.
- *
- * The `probe` query parameter controls the behavior:
- * - `?probe=live`: liveness probe, always responds 200 as long as the
- *   process is running. It does not touch any dependencies.
- * - no `probe` (or any other value): readiness probe, checks all
- *   dependencies and responds 200 if healthy, or 503 with a `checks`
- *   object identifying which dependencies failed.
- *
- * Dependencies are checked with a hard timeout; the response is always
- * bounded by the configured timeout values and will never hang.
- *
- * @example
- * Liveness: GET /api/health?probe=live -> 200 { ok: true, ts: ... }
- * Readiness healthy: GET /api/health -> 200 { ok: true, checks: { db: "ok", stellar: "ok" }, ts: ... }
- * Readiness degraded: GET /api/health -> 503 { ok: false, checks: { db: "error", stellar: "ok" }, ts: ... }
- */
-export function createHealthHandler({
-  db,
-  fetchFn,
-  now = () => new Date(),
-  dbTimeoutMs = DB_TIMEOUT_MS,
-  stellarTimeoutMs = STELLAR_TIMEOUT_MS,
-}: HealthDeps) {
-  return async function GET(request: NextRequest) {
-    const probe = request.nextUrl.searchParams.get("probe");
-
-    // Liveness probe: always 200 if the process is running.
-    if (probe === "live") {
-      return NextResponse.json(
-        { ok: true, ts: now().toISOString() },
-        { status: 200, headers: { "Cache-Control": "no-store" } },
-      );
-    }
-
-    // Readiness probe: checks dependencies and returns 503 if any is failing.
-    const checks: HealthChecks = {
-      db: "error",
-      stellar: "error",
-    };
+export async function GET() {
+  const checks: { db: "ok" | "error"; stellar: "ok" | "error" } = {
+    db: "error",
+    stellar: "error",
+  };
 
-    await Promise.allSettled([
-      withTimeout((signal) => {
+  await Promise.allSettled([
+    withTimeout(
+      (signal) => {
         void signal;
         return db.execute(sql`SELECT 1`);
-      }, dbTimeoutMs).then(() => {
-        checks.db = "ok";
-      }),
-      withTimeout(
-        (signal) =>
-          fetchFn(process.env.STELLAR_HORIZON_URL ?? DEFAULT_HORIZON, { signal }).then((r) => {
-            if (!r.ok) throw new Error(`HTTP ${r.status}`);
-          }),
-        stellarTimeoutMs,
-      ).then(() => {
-        checks.stellar = "ok";
-      }),
-    ]);
-
-    const ok = checks.db === "ok" && checks.stellar === "ok";
-
-    return NextResponse.json(
-      { ok, checks, ts: now().toISOString() },
-      { status: ok ? 200 : 503, headers: { "Cache-Control": "no-store" } },
-    );
-  };
+      },
+      DB_TIMEOUT_MS,
+    ).then(() => {
+      checks.db = "ok";
+    }),
+    withTimeout(
+      (signal) =>
+        fetch(process.env.STELLAR_HORIZON_URL ?? DEFAULT_HORIZON, { signal }).then((r) => {
+          if (!r.ok) throw new Error(`HTTP ${r.status}`);
+        }),
+      STELLAR_TIMEOUT_MS,
+    ).then(() => {
+      checks.stellar = "ok";
+    }),
+  ]);
+
+  const ok = checks.db === "ok" && checks.stellar === "ok";
+
+  return NextResponse.json(
+    { ok, checks, ts: new Date().toISOString() },
+    {
+      status: ok ? 200 : 503,
+      headers: { "Cache-Control": "no-store" },
+    },
+  );
 }
-
-export const GET = createHealthHandler({
-  db: defaultDb,
-  fetchFn: fetch,
-});
diff --git a/web/src/app/api/health/utils.ts b/web/src/app/api/health/utils.ts
index f436528a..5a12fed5 100644
--- a/web/src/app/api/health/utils.ts
+++ b/web/src/app/api/health/utils.ts
@@ -10,32 +10,34 @@
  * so no dangling timer is ever leaked.
  */
 
-export const DEFAULT_HORIZON = "https://horizon.stellar.org";
-export const DB_TIMEOUT_MS = 2000;
-export const STELLAR_TIMEOUT_MS = 3000;
+export const DEFAULT_HORIZON = "https://horizon-testnet.stellar.org";
+
+/** DB check timeout — 2 s */
+export const DB_TIMEOUT_MS = 2_000;
+
+/** Stellar Horizon check timeout — 3 s */
+export const STELLAR_TIMEOUT_MS = 3_000;
 
 export function withTimeout<T>(
   fn: (signal: AbortSignal) => Promise<T>,
   ms: number,
 ): Promise<T> {
-  return new Promise<T>((resolve, reject) => {
-    const controller = new AbortController();
-    const timer = setTimeout(() => {
-      controller.abort();
-      reject(new Error(`Timed out after ${ms}ms`));
+  const controller = new AbortController();
+  let timerId: ReturnType<typeof setTimeout> | undefined;
+
+  const timeout = new Promise<never>((_, reject) => {
+    timerId = setTimeout(() => {
+      controller.abort(new Error("timeout"));
+      reject(new Error("timeout"));
     }, ms);
+  });
 
-    Promise.resolve()
-      .then(() => fn(controller.signal))
-      .then(
-        (value) => {
-          clearTimeout(timer);
-          resolve(value);
-        },
-        (error) => {
-          clearTimeout(timer);
-          reject(error);
-        },
-      );
+  const main = Promise.race([fn(controller.signal), timeout]).finally(() => {
+    clearTimeout(timerId);
+    if (!controller.signal.aborted) {
+      controller.abort();
+    }
   });
+
+  return main;
 }
diff --git a/web/src/lib/openapi.ts b/web/src/lib/openapi.ts
index 370af26b..ae0c729e 100644
--- a/web/src/lib/openapi.ts
+++ b/web/src/lib/openapi.ts
@@ -910,12 +910,11 @@ Inter-agent commerce uses the Stellar x402 payment protocol:
       },
       CursorPage: {
         type: "object",
-        required: ["nextCursor"],
         properties: {
           nextCursor: {
             type: "string",
             nullable: true,
-            description: "Opaque cursor for the next page. Pass as `cursor` query param. Will be null if there are no more pages (final page).",
+            description: "Opaque cursor for the next page. Pass as `cursor` query param.",
           },
         },
       },
@@ -1056,7 +1055,7 @@ Inter-agent commerce uses the Stellar x402 payment protocol:
         name: "cursor",
         in: "query",
         schema: { type: "string" },
-        description: "Opaque pagination cursor returned from the previous page's `nextCursor`. Malformed cursors are rejected with a 400 validation error. Only compatible with the default `createdAt` descending sort.",
+        description: "Opaque pagination cursor returned from the previous page's `nextCursor`. Only compatible with the default `createdAt` descending sort.",
       },
       limitParam: {
         name: "limit",
@@ -1212,7 +1211,6 @@ Inter-agent commerce uses the Stellar x402 payment protocol:
                     { $ref: "#/components/schemas/CursorPage" },
                     {
                       type: "object",
-                      required: ["data"],
                       properties: {
                         data: {
                           type: "array",
@@ -1225,7 +1223,6 @@ Inter-agent commerce uses the Stellar x402 payment protocol:
               },
             },
           },
-          "400": { $ref: "#/components/responses/ValidationError" },
           "500": { $ref: "#/components/responses/InternalError" },
         },
       },
diff --git a/web/tests/fixtures/openapi.snapshot.json b/web/tests/fixtures/openapi.snapshot.json
index e98b6719..8eae05a3 100644
--- a/web/tests/fixtures/openapi.snapshot.json
+++ b/web/tests/fixtures/openapi.snapshot.json
@@ -2062,14 +2062,11 @@
       },
       "CursorPage": {
         "type": "object",
-        "required": [
-          "nextCursor"
-        ],
         "properties": {
           "nextCursor": {
             "type": "string",
             "nullable": true,
-            "description": "Opaque cursor for the next page. Pass as `cursor` query param. Will be null if there are no more pages (final page)."
+            "description": "Opaque cursor for the next page. Pass as `cursor` query param."
           }
         }
       },
@@ -2358,7 +2355,7 @@
         "schema": {
           "type": "string"
         },
-        "description": "Opaque pagination cursor returned from the previous page's `nextCursor`. Malformed cursors are rejected with a 400 validation error. Only compatible with the default `createdAt` descending sort."
+        "description": "Opaque pagination cursor returned from the previous page's `nextCursor`. Only compatible with the default `createdAt` descending sort."
       },
       "limitParam": {
         "name": "limit",
@@ -2606,9 +2603,6 @@
                     },
                     {
                       "type": "object",
-                      "required": [
-                        "data"
-                      ],
                       "properties": {
                         "data": {
                           "type": "array",
@@ -2623,9 +2617,6 @@
               }
             }
           },
-          "400": {
-            "$ref": "#/components/responses/ValidationError"
-          },
           "500": {
             "$ref": "#/components/responses/InternalError"
           }
diff --git a/web/tests/pagination-envelope.test.ts b/web/tests/pagination-envelope.test.ts
deleted file mode 100644
index ef28c57c..00000000
--- a/web/tests/pagination-envelope.test.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { openApiSpec } from "../src/lib/openapi";
-
-describe("Pagination Contract", () => {
-    it("defines CursorPage correctly with explicit final-page behavior", () => {
-        const cursorPage = (openApiSpec.components.schemas as any).CursorPage;
-
-        // Explicitly require nextCursor in the envelope
-        expect(cursorPage.required).toContain("nextCursor");
-
-        const nextCursor = cursorPage.properties.nextCursor;
-        // The cursor is nullable for the final page
-        expect(nextCursor.nullable).toBe(true);
-
-        // Description explicitly addresses final-page behavior
-        expect(nextCursor.description).toMatch(/null.*no more pages|null.*final page/i);
-    });
-
-    it("defines cursor query parameter with explicit malformed behavior", () => {
-        const cursorParam = (openApiSpec.components.parameters as any).cursorParam;
-
-        expect(cursorParam.name).toBe("cursor");
-        expect(cursorParam.in).toBe("query");
-
-        // Description makes malformed behavior explicit
-        expect(cursorParam.description).toMatch(/malformed cursors/i);
-    });
-
-    it("adds 400 validation error responses to endpoints", () => {
-        const talosGet = (openApiSpec.paths as any)["/api/talos"].get;
-
-        expect(talosGet.responses["400"]).toBeDefined();
-        expect(talosGet.responses["400"].$ref).toBe("#/components/responses/ValidationError");
-    });
-});