diff --git a/RELEASING.md b/RELEASING.md
index 0a48eef..e9f294f 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -213,13 +213,14 @@ passing evidence record for each target.
 
 The frozen Chat production source remains
 `0da8c4749f57e63601b29d66032f80c9bbac1cb5` with its reviewed native deltas.
-This binding selects merged Chat #251 producer `c487e29492c2fee5d02d630ab26cb1c6dd277f67`,
-pinning executable harness `debeeecf54770c033f65f5b4d2dd1061d3cd3ad3`
+This binding selects merged Chat #254 producer `9a750513f3ffc7a09242993b6b1fac9e2ff88207`,
+pinning harness source revision `e7b9d73cfb3c067333bb2c78194b2cad6e16a34c`
 and merged Cave OpenCoven/coven-cave#5378 at
-`cb3d22d1f403dd3b94b02668a599a2bf94999e8b`. All ten checks passed in pre-merge CI `34732434401` at head
-`00b3c75339f20467bf15e30fb5f7a050f8bae381`. The signed actual merge
-retains that tested tree and the frozen source ancestry. This ordinary CI run
-does not replace fresh protected evidence for the merged producer.
+`cb3d22d1f403dd3b94b02668a599a2bf94999e8b`. The actual merge preserves the tested tree and signed frozen source ancestry. The diagnostic source
+adds bounded pairing failure categories without changing pairing behavior or
+resource limits. Prior protected run `34734409422` passed Linux and macOS but
+failed Windows at the generic pairing stage; validation, aggregation, and
+attestation were skipped. Fresh protected evidence remains required.
 
 Both harness clients give `cave_launch` a 40-second response budget around
 Rust's 30-second readiness deadline. Other RPCs retain their 10-second bound.
diff --git a/conformance/client-v1-cross-repository-lock.json b/conformance/client-v1-cross-repository-lock.json
index ea94d94..3dea9ab 100644
--- a/conformance/client-v1-cross-repository-lock.json
+++ b/conformance/client-v1-cross-repository-lock.json
@@ -165,8 +165,8 @@
   "evidenceProducer": {
     "status": "compatible",
     "repository": "OpenCoven/chat",
-    "commit": "c487e29492c2fee5d02d630ab26cb1c6dd277f67",
-    "tree": "53ff360420859771de52130e7cdbef2bdf9a492a",
+    "commit": "9a750513f3ffc7a09242993b6b1fac9e2ff88207",
+    "tree": "96c132953431c6ba627a2d3a1ac40ae5c1fd0c84",
     "packageManifest": {
       "path": "package.json",
       "size": 4044,
@@ -175,8 +175,8 @@
     "harness": {
       "path": "scripts/phase1-conformance.mjs",
       "version": "2.0.0",
-      "size": 212537,
-      "sha256": "7d805d55ad5c8e78aa4e2fd5b8eaf751b936ccabc733e24d5291035e7523a92d"
+      "size": 216688,
+      "sha256": "fe709d61b677dcbe6c201cce3cd096b76484d2b47876b91c4546ff572b34fe4c"
     },
     "command": "test:phase1-conformance",
     "recordSchemaVersion": 2,
@@ -184,7 +184,7 @@
       "name": "client-v1 conformance",
       "path": ".github/workflows/client-v1-conformance.yml",
       "size": 166054,
-      "sha256": "56d9d912a152e3c4d281fa8260040eae3bfd29a6ea67bc2cc71b924850e72273",
+      "sha256": "31f401bf12d257636b3043658074a4433856c308bf6d33534b65587d3c1f00ef",
       "job": "platform-conformance",
       "jobNameTemplate": "platform-conformance ({platform})",
       "aggregationJob": "aggregate-conformance",
@@ -219,11 +219,11 @@
       ],
       "downloadArtifactAction": "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c",
       "attestationAction": "actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8",
-      "windowsBootstrapScriptSha256": "db8c956c06bd0968c3351d99fc0dbd60fb47f9a23d6f2a6923834fe46811c2b4",
+      "windowsBootstrapScriptSha256": "e97f1e6c0225dd041b2150e355f968ed06cc6d56bef285b2849a22b1bdf14509",
       "validatorRevisionScriptSha256": "9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9",
       "phase1RevisionsScriptSha256": "507ce777b643d97154472eb23135f7965fd55cf0fcedcec30e93b23e6472d225",
       "linuxKeyringSetupScriptSha256": "7b1ff87ab5d2230950632560230899cc450458a800a630c2788b53be8b13d200",
-      "unixSupervisorPreparationScriptSha256": "3d486717e471c739612ce00db2c69b620530e67bf230b04aec37cf68625ef428",
+      "unixSupervisorPreparationScriptSha256": "6623fe3ddafd4126acec6e194d5cc34069ddbe49a94a861cc13312d53122a03e",
       "unixToolPathSource": {
         "path": "scripts/executable-resolution.mjs",
         "size": 9154,
@@ -249,8 +249,8 @@
         ]
       },
       "signerWorkflow": "OpenCoven/chat/.github/workflows/client-v1-conformance.yml",
-      "signerDigest": "c487e29492c2fee5d02d630ab26cb1c6dd277f67",
-      "sourceDigest": "c487e29492c2fee5d02d630ab26cb1c6dd277f67",
+      "signerDigest": "9a750513f3ffc7a09242993b6b1fac9e2ff88207",
+      "sourceDigest": "9a750513f3ffc7a09242993b6b1fac9e2ff88207",
       "predicateType": "https://slsa.dev/provenance/v1",
       "denySelfHostedRunners": true
     }
diff --git a/docs/workflows/client-v1-cross-repository-conformance.md b/docs/workflows/client-v1-cross-repository-conformance.md
index 3576422..6755c0c 100644
--- a/docs/workflows/client-v1-cross-repository-conformance.md
+++ b/docs/workflows/client-v1-cross-repository-conformance.md
@@ -27,13 +27,14 @@ publication primitives needed to support the aggregator safely on Windows.
 There is no passing aggregate in this repository yet. The SDK candidate remains
 `1597835325cf3762b51408ff0a565037eeb25f64`, with frozen Chat production
 `0da8c4749f57e63601b29d66032f80c9bbac1cb5` and its reviewed native deltas.
-This binding selects merged Chat #251 producer `c487e29492c2fee5d02d630ab26cb1c6dd277f67`,
-pinning executable harness `debeeecf54770c033f65f5b4d2dd1061d3cd3ad3`
+This binding selects merged Chat #254 producer `9a750513f3ffc7a09242993b6b1fac9e2ff88207`,
+pinning harness source revision `e7b9d73cfb3c067333bb2c78194b2cad6e16a34c`
 and merged Cave OpenCoven/coven-cave#5378 at
-`cb3d22d1f403dd3b94b02668a599a2bf94999e8b`. All ten checks passed in pre-merge CI `34732434401` at head
-`00b3c75339f20467bf15e30fb5f7a050f8bae381`. The signed actual merge
-retains that tested tree and the frozen source ancestry. This ordinary CI run
-does not replace fresh protected evidence for the merged producer.
+`cb3d22d1f403dd3b94b02668a599a2bf94999e8b`. The actual merge preserves the tested tree and signed frozen source ancestry. The diagnostic source
+adds bounded pairing failure categories without changing pairing behavior or
+resource limits. Prior protected run `34734409422` passed Linux and macOS but
+failed Windows at the generic pairing stage; validation, aggregation, and
+attestation were skipped. Fresh protected evidence remains required.
 
 Both harness clients give `cave_launch` a 40-second response budget around
 Rust's 30-second readiness deadline. Other RPCs retain their 10-second bound.
@@ -429,7 +430,7 @@ aggregation job has no permissions and can only confirm successful completion
 of the protected matrix; it cannot generate, upload, attest, or replace a
 platform record. This structural template is exercised synthetically in tests
 only. The committed lock marks the reachable Chat producer at
-`c487e29492c2fee5d02d630ab26cb1c6dd277f67` compatible with the reviewed
+`9a750513f3ffc7a09242993b6b1fac9e2ff88207` compatible with the reviewed
 schema-v2 workflow bytes. Release readiness remains blocked until this SDK
 validator merges, `CLIENT_V1_CONFORMANCE_VALIDATOR_REVISION` is rotated to the
 merged revision, and all three protected platform records and their GitHub
diff --git a/scripts/github-conformance-evidence.mjs b/scripts/github-conformance-evidence.mjs
index 49e247f..9ca9345 100644
--- a/scripts/github-conformance-evidence.mjs
+++ b/scripts/github-conformance-evidence.mjs
@@ -52,11 +52,11 @@ const WINDOWS_SUPERVISOR_ARTIFACT = 'phase1-process-supervisor-win32-x64';
 const WINDOWS_SUPERVISOR_JOB_NAME = 'build-windows-supervisor';
 const WINDOWS_SUPERVISOR_RUNNER_LABELS = ['macos-latest'];
 const REVIEWED_WINDOWS_BOOTSTRAP_SCRIPT_SHA256 =
-  'db8c956c06bd0968c3351d99fc0dbd60fb47f9a23d6f2a6923834fe46811c2b4';
+  'e97f1e6c0225dd041b2150e355f968ed06cc6d56bef285b2849a22b1bdf14509';
 const REVIEWED_WINDOWS_CHILD_BOOTSTRAP_SHA256 =
-  '2bcbb2fd519301db5a22686b96c1ad4f322289dd56f10969a8d9939cee6ee8e5';
+  'bb3578715a67e2ff50f432e51353f0db50e95025db4e9484b7bc2bcb7404e79e';
 const REVIEWED_UNIX_SUPERVISOR_PREPARATION_SCRIPT_SHA256 =
-  '3d486717e471c739612ce00db2c69b620530e67bf230b04aec37cf68625ef428';
+  '6623fe3ddafd4126acec6e194d5cc34069ddbe49a94a861cc13312d53122a03e';
 const REVIEWED_UNIX_PRODUCTION_SCRIPT_SHA256 =
   '043066be50d0c3fa66f7151224242734cb2e9f39ffa9cf1c6f8106ab88c75a02';
 const REVIEWED_UNIX_SUPERVISOR_SOURCE_BINDING =
diff --git a/tests/conformance-contract.spec.ts b/tests/conformance-contract.spec.ts
index 62c8462..3389e35 100644
--- a/tests/conformance-contract.spec.ts
+++ b/tests/conformance-contract.spec.ts
@@ -215,7 +215,7 @@ describe('cross-repository conformance contract entrypoints', () => {
       'utf8',
     );
     expect(workflowDocument).toContain(
-      'c487e29492c2fee5d02d630ab26cb1c6dd277f67',
+      '9a750513f3ffc7a09242993b6b1fac9e2ff88207',
     );
     expect(workflowDocument).not.toContain(
       'f6eba8af1f71d4251583cf39d4e5fb5b4797d209',
@@ -230,7 +230,7 @@ describe('cross-repository conformance contract entrypoints', () => {
       '9f073f05241c2d3241b23ed9d73b26c6cd55ce7e',
     );
     expect(workflowDocument).toContain(
-      'debeeecf54770c033f65f5b4d2dd1061d3cd3ad3',
+      'e7b9d73cfb3c067333bb2c78194b2cad6e16a34c',
     );
     expect(workflowDocument).toContain('validator_revision');
     expect(workflowDocument).toContain('20863036831');
diff --git a/tests/conformance-gaps.spec.ts b/tests/conformance-gaps.spec.ts
index c5b4244..7661556 100644
--- a/tests/conformance-gaps.spec.ts
+++ b/tests/conformance-gaps.spec.ts
@@ -1788,8 +1788,8 @@ describe('unresolved SDK #38 conformance gaps', () => {
     expect(lock.evidenceProducer).toEqual({
       status: 'compatible',
       repository: 'OpenCoven/chat',
-      commit: 'c487e29492c2fee5d02d630ab26cb1c6dd277f67',
-      tree: '53ff360420859771de52130e7cdbef2bdf9a492a',
+      commit: '9a750513f3ffc7a09242993b6b1fac9e2ff88207',
+      tree: '96c132953431c6ba627a2d3a1ac40ae5c1fd0c84',
       packageManifest: {
         path: 'package.json',
         size: 4_044,
@@ -1799,9 +1799,9 @@ describe('unresolved SDK #38 conformance gaps', () => {
       harness: {
         path: 'scripts/phase1-conformance.mjs',
         version: '2.0.0',
-        size: 212537,
+        size: 216688,
         sha256:
-          '7d805d55ad5c8e78aa4e2fd5b8eaf751b936ccabc733e24d5291035e7523a92d',
+          'fe709d61b677dcbe6c201cce3cd096b76484d2b47876b91c4546ff572b34fe4c',
       },
       command: 'test:phase1-conformance',
       recordSchemaVersion: 2,
@@ -1810,7 +1810,7 @@ describe('unresolved SDK #38 conformance gaps', () => {
         path: '.github/workflows/client-v1-conformance.yml',
         size: 166_054,
         sha256:
-          '56d9d912a152e3c4d281fa8260040eae3bfd29a6ea67bc2cc71b924850e72273',
+          '31f401bf12d257636b3043658074a4433856c308bf6d33534b65587d3c1f00ef',
         job: 'platform-conformance',
         jobNameTemplate: 'platform-conformance ({platform})',
         aggregationJob: 'aggregate-conformance',
@@ -1829,7 +1829,7 @@ describe('unresolved SDK #38 conformance gaps', () => {
         downloadArtifactAction: DOWNLOAD_ARTIFACT_ACTION,
         attestationAction: ATTEST_BUILD_PROVENANCE_ACTION,
         windowsBootstrapScriptSha256:
-          'db8c956c06bd0968c3351d99fc0dbd60fb47f9a23d6f2a6923834fe46811c2b4',
+          'e97f1e6c0225dd041b2150e355f968ed06cc6d56bef285b2849a22b1bdf14509',
         validatorRevisionScriptSha256:
           '9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9',
         phase1RevisionsScriptSha256:
@@ -1837,7 +1837,7 @@ describe('unresolved SDK #38 conformance gaps', () => {
         linuxKeyringSetupScriptSha256:
           '7b1ff87ab5d2230950632560230899cc450458a800a630c2788b53be8b13d200',
         unixSupervisorPreparationScriptSha256:
-          '3d486717e471c739612ce00db2c69b620530e67bf230b04aec37cf68625ef428',
+          '6623fe3ddafd4126acec6e194d5cc34069ddbe49a94a861cc13312d53122a03e',
         unixToolPathSource: {
           path: 'scripts/executable-resolution.mjs',
           size: 9_154,
@@ -1866,8 +1866,8 @@ describe('unresolved SDK #38 conformance gaps', () => {
         },
         signerWorkflow:
           'OpenCoven/chat/.github/workflows/client-v1-conformance.yml',
-        signerDigest: 'c487e29492c2fee5d02d630ab26cb1c6dd277f67',
-        sourceDigest: 'c487e29492c2fee5d02d630ab26cb1c6dd277f67',
+        signerDigest: '9a750513f3ffc7a09242993b6b1fac9e2ff88207',
+        sourceDigest: '9a750513f3ffc7a09242993b6b1fac9e2ff88207',
         predicateType: 'https://slsa.dev/provenance/v1',
         denySelfHostedRunners: true,
       },
@@ -1895,7 +1895,7 @@ describe('unresolved SDK #38 conformance gaps', () => {
       producer.workflow.windowsBootstrapScriptSha256,
     );
     expect(sha256(TEST_WINDOWS_CHILD_BOOTSTRAP)).toBe(
-      '2bcbb2fd519301db5a22686b96c1ad4f322289dd56f10969a8d9939cee6ee8e5',
+      'bb3578715a67e2ff50f432e51353f0db50e95025db4e9484b7bc2bcb7404e79e',
     );
     expect(() =>
       verifyProtectedWorkflow(
diff --git a/tests/fixtures/chat-8856ad-client-v1-conformance.yml.br b/tests/fixtures/chat-8856ad-client-v1-conformance.yml.br
index e25827d..765ac7f 100644
Binary files a/tests/fixtures/chat-8856ad-client-v1-conformance.yml.br and b/tests/fixtures/chat-8856ad-client-v1-conformance.yml.br differ
diff --git a/tests/fixtures/chat-8856ad-unix-supervisor-preparation.sh.br b/tests/fixtures/chat-8856ad-unix-supervisor-preparation.sh.br
index bd47e2b..109d23f 100644
Binary files a/tests/fixtures/chat-8856ad-unix-supervisor-preparation.sh.br and b/tests/fixtures/chat-8856ad-unix-supervisor-preparation.sh.br differ
diff --git a/tests/fixtures/chat-8856ad-windows-bootstrap.ps1.br b/tests/fixtures/chat-8856ad-windows-bootstrap.ps1.br
index 379ba5a..c6ad805 100644
Binary files a/tests/fixtures/chat-8856ad-windows-bootstrap.ps1.br and b/tests/fixtures/chat-8856ad-windows-bootstrap.ps1.br differ