diff --git a/README.md b/README.md
index 490afc03..e3585034 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,9 @@ TinySecurity supplies security policy through a native TinyBus module. Hosts
 compile the transport-free `tinysecurity-bus` contract and load the isolated
 `tinysecurity-module` artifact. The bootstrap implements `Evaluate`, batched
 `Check`, `PolicyInfo`, validated SDK configuration and policy generations.
+Contract 1.23 adds confidential per-frame `DeviceFrame2` calls over the live
+opaque tunnel capability issued by approved `ExecuteDevice2` work; see the
+[device contract](MODULE.md#confidential-device-handles).
 Contract 1.1 also supplies immutable native [filesystem scopes](docs/specs/immutable-path-scopes.md)
 through `RegisterPathPolicy`, `ValidatePath`, `ValidateParent` and `CheckPath`.
 Contract 1.3 adds native `Redact`, `ScanPrompt` and `ScanToolDefinition`, with a
diff --git a/crates/tinysecurity-bus/src/device.rs b/crates/tinysecurity-bus/src/device.rs
index d3ed8d59..64e0c618 100644
--- a/crates/tinysecurity-bus/src/device.rs
+++ b/crates/tinysecurity-bus/src/device.rs
@@ -13,6 +13,11 @@ pub struct DeviceConfig2 {
     pub max_in_flight: u32,
     /// Operations per scope per monotonic minute, in 1..=4096.
     pub operations_per_minute: u32,
+    /// Frames per live tunnel per monotonic minute, in 1..=60000; defaults to 12000
+    /// (200 frames/second). This budget is independent of control-plane
+    /// `operations_per_minute`.
+    #[serde(default = "default_frames_per_minute")]
+    pub frames_per_minute: u32,
     /// Maximum handle and operation lifetime, in 1..=300000 milliseconds.
     pub max_ttl_ms: u32,
     /// Plaintext bound, in 1..=1048576 bytes.
@@ -20,6 +25,10 @@ pub struct DeviceConfig2 {
     /// Authenticated bootstrap nonces retained across the registry, in 1..=4096.
     pub max_bootstrap_nonces: u32,
 }
+/// Default independent tunnel-frame budget: 12,000 frames per monotonic minute.
+fn default_frames_per_minute() -> u32 {
+    12_000
+}
 /// Init-only static credential and immutable approval registration reference.
 #[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
diff --git a/crates/tinysecurity-bus/src/device_frame.rs b/crates/tinysecurity-bus/src/device_frame.rs
new file mode 100644
index 00000000..67bf7dc4
--- /dev/null
+++ b/crates/tinysecurity-bus/src/device_frame.rs
@@ -0,0 +1,61 @@
+//! Confidential per-frame operations over a previously approved native tunnel.
+
+use serde::{Deserialize, Serialize};
+
+/// Seal or open one bounded frame through a tunnel handle returned by approved device work.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum DeviceFrameOperation2 {
+    /// Encrypt plaintext as a version-two tunnel frame.
+    Seal {
+        /// Confidential plaintext, bounded by the configured device limit.
+        plaintext: Vec<u8>,
+    },
+    /// Authenticate and decrypt a version-two tunnel frame.
+    Open {
+        /// Confidential frame, bounded by the configured device limit.
+        frame: Vec<u8>,
+    },
+}
+
+/// Confidential frame request using an opaque tunnel handle from `ExecuteDevice2`.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct DeviceFrameRequest2 {
+    /// Existing registered device scope that owns the handle.
+    pub scope_id: String,
+    /// Opaque tunnel capability returned by an approved `DeviceOperation2::Tunnel`.
+    pub handle: String,
+    /// Exact host execution instance, bounded to 128 bytes.
+    pub call_id: String,
+    /// One seal or open operation; no keys or caller identity are accepted.
+    pub operation: DeviceFrameOperation2,
+}
+
+/// Confidential frame result; opening returns plaintext only over the trusted bus link.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct DeviceFrameResponse2 {
+    /// Sealed frame or authenticated plaintext.
+    pub bytes: Vec<u8>,
+}
+
+impl std::fmt::Debug for DeviceFrameOperation2 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("DeviceFrameOperation2([REDACTED])")
+    }
+}
+impl std::fmt::Debug for DeviceFrameRequest2 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("DeviceFrameRequest2([REDACTED])")
+    }
+}
+impl std::fmt::Debug for DeviceFrameResponse2 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("DeviceFrameResponse2([REDACTED])")
+    }
+}
+
+#[cfg(test)]
+#[path = "device_frame_tests.rs"]
+mod tests;
diff --git a/crates/tinysecurity-bus/src/device_frame_tests.rs b/crates/tinysecurity-bus/src/device_frame_tests.rs
new file mode 100644
index 00000000..9857f3ce
--- /dev/null
+++ b/crates/tinysecurity-bus/src/device_frame_tests.rs
@@ -0,0 +1,74 @@
+use super::*;
+
+#[test]
+fn frame_requests_and_responses_pin_the_confidential_wire_shape()
+-> std::result::Result<(), Box<dyn std::error::Error>> {
+    let request = DeviceFrameRequest2 {
+        scope_id: "registered-device".into(),
+        handle: "opaque-tunnel-handle".into(),
+        call_id: "socket-frame-17".into(),
+        operation: DeviceFrameOperation2::Seal {
+            plaintext: b"device payload".to_vec(),
+        },
+    };
+    let wire = serde_json::json!({
+        "scope_id":"registered-device",
+        "handle":"opaque-tunnel-handle",
+        "call_id":"socket-frame-17",
+        "operation":{"kind":"seal","plaintext":[100,101,118,105,99,101,32,112,97,121,108,111,97,100]}
+    });
+    assert_eq!(serde_json::to_value(&request)?, wire);
+    assert_eq!(
+        serde_json::from_value::<DeviceFrameRequest2>(wire)?,
+        request
+    );
+    assert_eq!(format!("{request:?}"), "DeviceFrameRequest2([REDACTED])");
+
+    let mut forged = serde_json::to_value(&request)?;
+    forged["agent"] = serde_json::json!("model-controlled");
+    assert!(serde_json::from_value::<DeviceFrameRequest2>(forged).is_err());
+
+    let response = DeviceFrameResponse2 {
+        bytes: vec![0, 128, 255],
+    };
+    assert_eq!(
+        serde_json::to_value(&response)?,
+        serde_json::json!({"bytes":[0,128,255]})
+    );
+    assert_eq!(format!("{response:?}"), "DeviceFrameResponse2([REDACTED])");
+    Ok(())
+}
+
+#[test]
+fn frame_operations_redact_both_payloads_without_changing_open_wire_shape()
+-> std::result::Result<(), Box<dyn std::error::Error>> {
+    let seal = DeviceFrameOperation2::Seal {
+        plaintext: b"private seal payload".to_vec(),
+    };
+    let open = DeviceFrameOperation2::Open {
+        frame: b"private open frame".to_vec(),
+    };
+
+    for operation in [&seal, &open] {
+        let debug = format!("{operation:?}");
+        assert_eq!(debug, "DeviceFrameOperation2([REDACTED])");
+        assert!(!debug.contains("private"));
+    }
+
+    let wire = serde_json::to_value(&open)?;
+    assert_eq!(
+        wire,
+        serde_json::json!({
+            "kind": "open",
+            "frame": b"private open frame"
+        })
+    );
+    assert_eq!(serde_json::from_value::<DeviceFrameOperation2>(wire)?, open);
+    Ok(())
+}
+
+#[test]
+fn frame_member_name_is_stable_and_contract_version_is_bumped() {
+    assert_eq!(crate::names::methods::DEVICE_FRAME2, "DeviceFrame2");
+    assert_eq!(crate::CONTRACT_VERSION, (1, 23));
+}
diff --git a/crates/tinysecurity-bus/src/device_tests.rs b/crates/tinysecurity-bus/src/device_tests.rs
index 33b68188..f4c8a2dc 100644
--- a/crates/tinysecurity-bus/src/device_tests.rs
+++ b/crates/tinysecurity-bus/src/device_tests.rs
@@ -205,13 +205,14 @@ fn device_configuration_and_scopes_pin_bounds_origin_and_optional_secret()
                 max_handles: 101,
                 max_in_flight: 7,
                 operations_per_minute: 103,
+                frames_per_minute: 104,
                 max_ttl_ms: 104,
                 max_message_bytes: 105,
                 max_bootstrap_nonces: 106,
             },
             json!({
                 "scopes":[scope_wire],"max_handles":101,"max_in_flight":7,
-                "operations_per_minute":103,"max_ttl_ms":104,"max_message_bytes":105,
+                "operations_per_minute":103,"frames_per_minute":104,"max_ttl_ms":104,"max_message_bytes":105,
                 "max_bootstrap_nonces":106,
             }),
         )?;
@@ -219,6 +220,22 @@ fn device_configuration_and_scopes_pin_bounds_origin_and_optional_secret()
     Ok(())
 }
 
+#[test]
+fn older_device_config_defaults_the_independent_frame_budget()
+-> std::result::Result<(), Box<dyn std::error::Error>> {
+    let config: DeviceConfig2 = serde_json::from_value(serde_json::json!({
+        "scopes": [{"scope_id":"registered-scope","origin":"operator","static_secret":null}],
+        "max_handles": 8,
+        "max_in_flight": 2,
+        "operations_per_minute": 600,
+        "max_ttl_ms": 300_000,
+        "max_message_bytes": 1024,
+        "max_bootstrap_nonces": 8
+    }))?;
+    assert_eq!(config.frames_per_minute, 12_000);
+    Ok(())
+}
+
 #[test]
 fn device_results_pin_optional_handle_public_key_and_byte_arrays()
 -> std::result::Result<(), Box<dyn std::error::Error>> {
diff --git a/crates/tinysecurity-bus/src/lib.rs b/crates/tinysecurity-bus/src/lib.rs
index 5717e46d..64ad8dab 100644
--- a/crates/tinysecurity-bus/src/lib.rs
+++ b/crates/tinysecurity-bus/src/lib.rs
@@ -10,6 +10,8 @@ mod secret;
 pub use secret::*;
 mod device;
 pub use device::*;
+mod device_frame;
+pub use device_frame::*;
 mod sandbox;
 pub use sandbox::*;
 mod sandbox_scopes;
@@ -57,7 +59,7 @@ pub use redact::RedactorConfig;
 pub use scoped_policy::*;
 pub mod names;
 /// Current wire vocabulary version, independent of the artifact version.
-pub const CONTRACT_VERSION: (u32, u32) = (1, 22);
+pub const CONTRACT_VERSION: (u32, u32) = (1, 23);
 /// Whether a remote module's advertised version supplies this host's vocabulary.
 ///
 /// `version` is the provider version received by the host, not a host requirement
diff --git a/crates/tinysecurity-bus/src/names.rs b/crates/tinysecurity-bus/src/names.rs
index f664b323..e35c2f0b 100644
--- a/crates/tinysecurity-bus/src/names.rs
+++ b/crates/tinysecurity-bus/src/names.rs
@@ -23,6 +23,8 @@ pub mod methods {
     pub const EVALUATE_DEVICE2: &str = "EvaluateDevice2";
     /// Execute exact reviewed confidential work using scoped opaque handles.
     pub const EXECUTE_DEVICE2: &str = "ExecuteDevice2";
+    /// Seal or open a frame through a live tunnel handle created by approved device work.
+    pub const DEVICE_FRAME2: &str = "DeviceFrame2";
     /// Trusted legacy history migration without broad grant revival.
     pub const IMPORT_APPROVAL_HISTORY2: &str = "ImportApprovalHistory2";
     /// Durable exact approval evaluation.
@@ -169,6 +171,7 @@ pub const METHODS: &[&str] = &[
     methods::PAIRING_CONTROL2,
     methods::EVALUATE_DEVICE2,
     methods::EXECUTE_DEVICE2,
+    methods::DEVICE_FRAME2,
     methods::PLAN,
     methods::EVALUATE_SANDBOX_APPROVAL2,
     methods::CONSUME_SANDBOX_PLAN2,
diff --git a/crates/tinysecurity-bus/tests/scoped_wire.rs b/crates/tinysecurity-bus/tests/scoped_wire.rs
index 7dfecb2a..aaf4128e 100644
--- a/crates/tinysecurity-bus/tests/scoped_wire.rs
+++ b/crates/tinysecurity-bus/tests/scoped_wire.rs
@@ -74,6 +74,7 @@ fn new_members_are_advertised_and_named_by_contract_constants() {
         names::methods::SCOPED_POLICY_INFO,
         names::methods::EVALUATE_SCOPED_AUDITED,
         names::methods::CHECK_SCOPED_AUDITED,
+        names::methods::DEVICE_FRAME2,
     ] {
         assert!(names::METHODS.contains(&name), "{name}");
     }
@@ -82,10 +83,10 @@ fn new_members_are_advertised_and_named_by_contract_constants() {
 
 #[test]
 fn contract_bump_is_additive_for_older_hosts_and_modules() {
-    assert_eq!(CONTRACT_VERSION, (1, 22));
-    // A host built against 1.22 accepts this module and newer minors, not a 1.21 module.
-    assert!(is_compatible((1, 22)));
+    assert_eq!(CONTRACT_VERSION, (1, 23));
+    // A host built against 1.23 accepts this module and newer minors, not a 1.22 module.
     assert!(is_compatible((1, 23)));
+    assert!(!is_compatible((1, 22)));
     assert!(!is_compatible((1, 21)));
     assert!(!is_compatible((1, 20)));
     assert!(!is_compatible((1, 19)));
diff --git a/crates/tinysecurity-bus/tests/wire.rs b/crates/tinysecurity-bus/tests/wire.rs
index 22b26eae..c326c4dd 100644
--- a/crates/tinysecurity-bus/tests/wire.rs
+++ b/crates/tinysecurity-bus/tests/wire.rs
@@ -343,7 +343,7 @@ fn redactor_init_is_additive_and_secrets_never_enter_public_info()
         serde_json::to_value(&config)?["redactor"]["secrets"][0],
         "literal-private"
     );
-    assert_eq!(CONTRACT_VERSION, (1, 22));
+    assert_eq!(CONTRACT_VERSION, (1, 23));
     for (mode, wire) in [
         (RedactMode::Text, "text"),
         (RedactMode::StructuredArguments, "structured_arguments"),
diff --git a/crates/tinysecurity-crypto/src/device_handles.rs b/crates/tinysecurity-crypto/src/device_handles.rs
index f5fed78a..a0209728 100644
--- a/crates/tinysecurity-crypto/src/device_handles.rs
+++ b/crates/tinysecurity-crypto/src/device_handles.rs
@@ -10,8 +10,9 @@ use std::{
     sync::{Arc, Mutex, MutexGuard},
 };
 use tinysecurity_bus::{
-    ApprovalScope2, DeviceConfig2, DeviceKeyPurpose2, DeviceOperation2, DeviceRequest2,
-    DeviceResponse2, DeviceRole2,
+    ApprovalScope2, DeviceConfig2, DeviceFrameOperation2, DeviceFrameRequest2,
+    DeviceFrameResponse2, DeviceKeyPurpose2, DeviceOperation2, DeviceRequest2, DeviceResponse2,
+    DeviceRole2,
 };
 use zeroize::Zeroizing;
 /// Injected epoch and monotonic milliseconds; neither value comes from an invocation.
@@ -31,7 +32,7 @@ struct Scope {
 }
 enum Native {
     Key(Arc<KeyPair>, DeviceKeyPurpose2),
-    Tunnel(Tunnel, String, String),
+    Tunnel(Arc<Mutex<Tunnel>>, String, String),
 }
 struct TunnelInput<'a> {
     key: &'a str,
@@ -45,6 +46,7 @@ struct Entry {
     epoch: u64,
     expires_wall: u64,
     expires_monotonic: u64,
+    frame_rate: RateCounter,
     native: Native,
 }
 struct State {
@@ -82,9 +84,18 @@ impl std::fmt::Debug for Reservation {
 }
 impl Drop for Reservation {
     fn drop(&mut self) {
-        if let Ok(mut state) = self.registry.0.lock() {
-            state.budget.release();
-        }
+        release_budget(&self.registry);
+    }
+}
+struct InFlightGuard(Registry);
+impl Drop for InFlightGuard {
+    fn drop(&mut self) {
+        release_budget(&self.0);
+    }
+}
+fn release_budget(registry: &Registry) {
+    if let Ok(mut state) = registry.0.lock() {
+        state.budget.release();
     }
 }
 impl Registry {
@@ -158,6 +169,17 @@ impl Registry {
     fn lock(&self) -> Result<MutexGuard<'_, State>> {
         self.0.lock().map_err(|_| Error::DeviceDenied)
     }
+    fn with_clock_sample<F>(state: &mut State, sample: F) -> Result<Time>
+    where
+        F: FnOnce() -> Option<Time>,
+    {
+        let Some(now) = sample() else {
+            state.fail_clock();
+            return Err(Error::DeviceClock);
+        };
+        state.check_time(now)?;
+        Ok(now)
+    }
     /// Validate and reserve rate/work capacity before any callback or cryptographic work.
     /// # Errors
     /// Denies unknown scope, stale generation, rollback, expiry or exhausted bounds.
@@ -167,8 +189,25 @@ impl Registry {
         generation: u64,
         now: Time,
     ) -> Result<Reservation> {
+        self.reserve_with_clock(request, generation, || Some(now))
+    }
+    /// Sample the clock while holding the registry lock, then reserve bounded work.
+    ///
+    /// Production adapters pass their trusted clock through this closure so a concurrently
+    /// sampled older value cannot arrive after a later registry transition.
+    /// # Errors
+    /// Denies unavailable or rolled-back clocks and the same invalid requests as [`Self::reserve`].
+    pub fn reserve_with_clock<F>(
+        &self,
+        request: &DeviceRequest2,
+        generation: u64,
+        sample: F,
+    ) -> Result<Reservation>
+    where
+        F: FnOnce() -> Option<Time>,
+    {
         let mut state = self.lock()?;
-        state.check_time(now)?;
+        let now = Self::with_clock_sample(&mut state, sample)?;
         state.prune(now);
         if generation != state.generation
             || request.ttl_ms == 0
@@ -229,11 +268,25 @@ impl Registry {
     /// # Errors
     /// Rejects cancelled, revoked, expired, stale or rollback-observed work.
     pub fn validate(&self, work: &Reservation, generation: u64, now: Time) -> Result<()> {
+        self.validate_with_clock(work, generation, || Some(now))
+    }
+    /// Revalidate a reservation using a clock sampled under the registry lock.
+    /// # Errors
+    /// Rejects cancelled, revoked, expired, stale, unavailable-clock or rollback-observed work.
+    pub fn validate_with_clock<F>(
+        &self,
+        work: &Reservation,
+        generation: u64,
+        sample: F,
+    ) -> Result<()>
+    where
+        F: FnOnce() -> Option<Time>,
+    {
         if !Arc::ptr_eq(&self.0, &work.registry.0) {
             return Err(Error::DeviceDenied);
         }
         let mut state = self.lock()?;
-        state.check_time(now)?;
+        let now = Self::with_clock_sample(&mut state, sample)?;
         state.live(work, generation, now)
     }
     /// Construct the canonical, content-free approval call from immutable registration.
@@ -283,15 +336,208 @@ impl Registry {
         generation: u64,
         now: Time,
     ) -> Result<DeviceResponse2> {
+        self.execute_with_clock(work, operation, generation, || Some(now))
+    }
+    /// Execute admitted work after sampling time under the registry lock.
+    ///
+    /// Tunnel crypto still runs after the lock is released.
+    /// # Errors
+    /// Rejects stale, expired, revoked, unavailable-clock or rolled-back work.
+    pub fn execute_with_clock<F>(
+        &self,
+        work: &Reservation,
+        operation: &DeviceOperation2,
+        generation: u64,
+        sample: F,
+    ) -> Result<DeviceResponse2>
+    where
+        F: FnOnce() -> Option<Time>,
+    {
         if !Arc::ptr_eq(&self.0, &work.registry.0) {
             return Err(Error::DeviceDenied);
         }
         let mut state = self.lock()?;
-        state.check_time(now)?;
+        let now = Self::with_clock_sample(&mut state, sample)?;
         state.live(work, generation, now)?;
         state.prune(now);
         check_operation(operation, state.limits.max_message_bytes)?;
-        state.execute(work, operation)
+        let tunnel = match operation {
+            DeviceOperation2::Seal { handle, .. } | DeviceOperation2::Open { handle, .. } => {
+                match &state.entry(handle, work)?.native {
+                    Native::Tunnel(tunnel, _, _) => Some(Arc::clone(tunnel)),
+                    Native::Key(..) => return Err(Error::DeviceDenied),
+                }
+            }
+            _ => return state.execute(work, operation),
+        };
+        drop(state);
+        let tunnel = tunnel.ok_or(Error::DeviceDenied)?;
+        let mut tunnel = tunnel.lock().map_err(|_| Error::DeviceDenied)?;
+        let bytes = match operation {
+            DeviceOperation2::Seal { plaintext, .. } => tunnel.seal(plaintext)?,
+            DeviceOperation2::Open { frame, .. } => tunnel.open(frame)?.to_vec(),
+            _ => return Err(Error::DeviceDenied),
+        };
+        Ok(DeviceResponse2 {
+            handle: None,
+            public_key: None,
+            bytes,
+        })
+    }
+    /// Seal or open a frame through a tunnel handle created by an approved device operation.
+    ///
+    /// The opaque tunnel handle is the capability. This fast path accepts no key material and
+    /// cannot create or extend a session; it checks the registered scope, live generation,
+    /// expiry, revocation epoch and message bound. Each tunnel has its own rolling frame
+    /// budget; it is independent of the per-scope control-operation budget. A revoked,
+    /// expired or reconfigured handle is unusable immediately.
+    ///
+    /// # Errors
+    /// Rejects an unknown or stale tunnel, malformed frame, replay, oversized payload or limit.
+    pub fn execute_frame(
+        &self,
+        request: &DeviceFrameRequest2,
+        generation: u64,
+        now: Time,
+    ) -> Result<DeviceFrameResponse2> {
+        self.execute_frame_with_clock(request, generation, || Some(now))
+    }
+    /// Execute one frame after sampling time under the registry lock.
+    ///
+    /// The lock is released before tunnel AEAD and replay processing.
+    /// # Errors
+    /// Rejects an unavailable or rolled-back clock as well as invalid frame authority.
+    pub fn execute_frame_with_clock<F>(
+        &self,
+        request: &DeviceFrameRequest2,
+        generation: u64,
+        sample: F,
+    ) -> Result<DeviceFrameResponse2>
+    where
+        F: FnOnce() -> Option<Time>,
+    {
+        let tunnel = {
+            let mut state = self.lock()?;
+            let now = Self::with_clock_sample(&mut state, sample)?;
+            state.prune(now);
+            if generation != state.generation
+                || request.scope_id.is_empty()
+                || request.scope_id.len() > 128
+                || request.handle.is_empty()
+                || request.handle.len() > 64
+                || request.call_id.is_empty()
+                || request.call_id.len() > 128
+            {
+                return Err(Error::DeviceDenied);
+            }
+            let scope = state
+                .scopes
+                .get(&request.scope_id)
+                .ok_or(Error::DeviceDenied)?;
+            let entry = state
+                .handles
+                .get(&request.handle)
+                .filter(|entry| entry.scope == request.scope_id && entry.epoch == scope.epoch)
+                .ok_or(Error::DeviceDenied)?;
+            let tunnel = match &entry.native {
+                Native::Tunnel(tunnel, _, _) => Arc::clone(tunnel),
+                Native::Key(..) => return Err(Error::DeviceDenied),
+            };
+            match &request.operation {
+                DeviceFrameOperation2::Seal { plaintext } => {
+                    if plaintext.len() > state.limits.max_message_bytes as usize {
+                        return Err(Error::Limit);
+                    }
+                }
+                DeviceFrameOperation2::Open { frame } => {
+                    if frame.len() > state.limits.max_message_bytes as usize + 41 {
+                        return Err(Error::Limit);
+                    }
+                }
+            }
+            let max_in_flight = state.limits.max_in_flight;
+            let max_rate = state.limits.frames_per_minute;
+            let State {
+                budget, handles, ..
+            } = &mut *state;
+            let entry = handles
+                .get_mut(&request.handle)
+                .filter(|entry| entry.scope == request.scope_id)
+                .ok_or(Error::DeviceDenied)?;
+            budget
+                .reserve(
+                    &mut entry.frame_rate,
+                    now.monotonic,
+                    max_in_flight,
+                    max_rate,
+                )
+                .map_err(|error| match error {
+                    BudgetError::Capacity => Error::DeviceCapacity,
+                    BudgetError::Rate => Error::DeviceRate,
+                })?;
+            tunnel
+        };
+        self.with_frame_reservation(|| {
+            tunnel
+                .lock()
+                .map_err(|_| Error::DeviceDenied)
+                .and_then(|mut tunnel| {
+                    let bytes = match &request.operation {
+                        DeviceFrameOperation2::Seal { plaintext } => tunnel.seal(plaintext)?,
+                        DeviceFrameOperation2::Open { frame } => tunnel.open(frame)?.to_vec(),
+                    };
+                    Ok(DeviceFrameResponse2 { bytes })
+                })
+        })
+    }
+    fn with_frame_reservation<T>(&self, operation: impl FnOnce() -> Result<T>) -> Result<T> {
+        let _guard = InFlightGuard(self.clone());
+        operation()
+    }
+    /// Revalidate a completed confidential frame before publishing its bytes.
+    ///
+    /// This checks that the capability stayed live while frame crypto ran outside the module's
+    /// async worker. It does not spend another frame from the per-tunnel budget.
+    /// # Errors
+    /// Rejects changed generations, revoked or expired handles, and unavailable clocks.
+    pub fn validate_frame(
+        &self,
+        scope_id: &str,
+        handle: &str,
+        generation: u64,
+        now: Time,
+    ) -> Result<()> {
+        self.validate_frame_with_clock(scope_id, handle, generation, || Some(now))
+    }
+    /// Revalidate a completed frame using time sampled while holding the registry lock.
+    /// # Errors
+    /// Rejects an unavailable or rolled-back clock and changed or revoked tunnel authority.
+    pub fn validate_frame_with_clock<F>(
+        &self,
+        scope_id: &str,
+        handle: &str,
+        generation: u64,
+        sample: F,
+    ) -> Result<()>
+    where
+        F: FnOnce() -> Option<Time>,
+    {
+        let mut state = self.lock()?;
+        let now = Self::with_clock_sample(&mut state, sample)?;
+        state.prune(now);
+        if generation != state.generation {
+            return Err(Error::DeviceDenied);
+        }
+        let scope = state.scopes.get(scope_id).ok_or(Error::DeviceDenied)?;
+        let entry = state
+            .handles
+            .get(handle)
+            .filter(|entry| entry.scope == scope_id && entry.epoch == scope.epoch)
+            .ok_or(Error::DeviceDenied)?;
+        if !matches!(entry.native, Native::Tunnel(..)) {
+            return Err(Error::DeviceDenied);
+        }
+        Ok(())
     }
     /// Close native authority and drop all owned credentials even if observers remain.
     /// Cleanup recovers a poisoned lock only to destroy state; it never restores authority.
@@ -310,8 +556,7 @@ impl Registry {
     /// Rejects a poisoned registry; it cannot authorize any further work.
     pub fn fail_clock(&self) -> Result<()> {
         let mut state = self.lock()?;
-        state.faulted = true;
-        state.handles.clear();
+        state.fail_clock();
         Ok(())
     }
     /// Return init registrations and current limits without retaining credential inputs.
@@ -404,11 +649,14 @@ impl PreparedReconfiguration<'_> {
     }
 }
 impl State {
+    fn fail_clock(&mut self) {
+        self.faulted = true;
+        self.handles.clear();
+        self.bootstrap.clear();
+    }
     fn check_time(&mut self, now: Time) -> Result<()> {
         if now.wall < self.time.wall || now.monotonic < self.time.monotonic {
-            self.faulted = true;
-            self.handles.clear();
-            self.bootstrap.clear();
+            self.fail_clock();
         }
         self.time = now;
         if self.faulted {
@@ -489,6 +737,7 @@ impl State {
                 epoch: work.epoch,
                 expires_wall: work.expires_wall,
                 expires_monotonic: work.expires_monotonic,
+                frame_rate: RateCounter::new(self.time.monotonic),
                 native,
             },
         );
@@ -563,7 +812,7 @@ impl State {
         self.insert(
             work,
             Native::Tunnel(
-                Tunnel::new(native_role, keys),
+                Arc::new(Mutex::new(Tunnel::new(native_role, keys))),
                 input.key.to_owned(),
                 input.ephemeral.to_owned(),
             ),
@@ -600,22 +849,8 @@ impl State {
                     },
                 )?);
             }
-            Op::Seal { handle, plaintext } => match &self.entry(handle, work)?.native {
-                Native::Tunnel(tunnel, _, _) => response.bytes = tunnel.seal(plaintext)?,
-                Native::Key(..) => return Err(Error::DeviceDenied),
-            },
-            Op::Open { handle, frame } => {
-                self.entry(handle, work)?;
-                match &mut self
-                    .handles
-                    .get_mut(handle)
-                    .ok_or(Error::DeviceDenied)?
-                    .native
-                {
-                    Native::Tunnel(tunnel, _, _) => response.bytes = tunnel.open(frame)?.to_vec(),
-                    Native::Key(..) => return Err(Error::DeviceDenied),
-                }
-            }
+            // Tunnel frame work is dispatched by Registry::execute outside the registry lock.
+            Op::Seal { .. } | Op::Open { .. } => return Err(Error::DeviceDenied),
             Op::SealHandshake {
                 handle,
                 peer,
@@ -680,6 +915,7 @@ fn validate_config(config: &DeviceConfig2) -> Result<()> {
         || !(1..=4096).contains(&config.max_handles)
         || !(1..=32).contains(&config.max_in_flight)
         || !(1..=4096).contains(&config.operations_per_minute)
+        || !(1..=60_000).contains(&config.frames_per_minute)
         || !(1..=300_000).contains(&config.max_ttl_ms)
         || !(1..=1_048_576).contains(&config.max_message_bytes)
         || !(1..=4096).contains(&config.max_bootstrap_nonces)
diff --git a/crates/tinysecurity-crypto/src/device_handles_tests.rs b/crates/tinysecurity-crypto/src/device_handles_tests.rs
index 2dfe12df..4f01118e 100644
--- a/crates/tinysecurity-crypto/src/device_handles_tests.rs
+++ b/crates/tinysecurity-crypto/src/device_handles_tests.rs
@@ -1,5 +1,7 @@
 use super::*;
-use tinysecurity_bus::{AccessTier, DeviceScope2, SubjectScope};
+use tinysecurity_bus::{
+    AccessTier, DeviceFrameOperation2, DeviceFrameRequest2, DeviceScope2, SubjectScope,
+};
 type TestResult = std::result::Result<(), Box<dyn std::error::Error>>;
 fn time(n: u64) -> Time {
     Time {
@@ -39,6 +41,7 @@ fn config() -> DeviceConfig2 {
         max_handles: 16,
         max_in_flight: 2,
         operations_per_minute: 100,
+        frames_per_minute: 12_000,
         max_ttl_ms: 100,
         max_message_bytes: 1000,
         max_bootstrap_nonces: 2,
@@ -593,6 +596,251 @@ fn both_native_tunnel_roles_preserve_direction_replay_and_reflection() -> TestRe
     );
     Ok(())
 }
+
+#[test]
+fn confidential_frames_reuse_only_a_live_approved_tunnel_capability() -> TestResult {
+    let reg = registry()?;
+    let (static_a, public_a) = key(&reg, 'a', DeviceKeyPurpose2::Static)?;
+    let (static_b, public_b) = key(&reg, 'a', DeviceKeyPurpose2::Static)?;
+    let (eph_a, epublic_a) = key(&reg, 'a', DeviceKeyPurpose2::Ephemeral)?;
+    let (eph_b, epublic_b) = key(&reg, 'a', DeviceKeyPurpose2::Ephemeral)?;
+    let client = tunnel(
+        &reg,
+        &static_a,
+        &eph_a,
+        &public_b,
+        &epublic_b,
+        DeviceRole2::Client,
+    )?;
+    let server = tunnel(
+        &reg,
+        &static_b,
+        &eph_b,
+        &public_a,
+        &epublic_a,
+        DeviceRole2::Server,
+    )?;
+    let sealed = reg.execute_frame(
+        &DeviceFrameRequest2 {
+            scope_id: "a".repeat(32),
+            handle: client.clone(),
+            call_id: "socket-send-1".into(),
+            operation: DeviceFrameOperation2::Seal {
+                plaintext: b"confidential socket frame".to_vec(),
+            },
+        },
+        1,
+        time(0),
+    )?;
+    let opened = reg.execute_frame(
+        &DeviceFrameRequest2 {
+            scope_id: "a".repeat(32),
+            handle: server.clone(),
+            call_id: "socket-receive-1".into(),
+            operation: DeviceFrameOperation2::Open {
+                frame: sealed.bytes.clone(),
+            },
+        },
+        1,
+        time(0),
+    )?;
+    assert_eq!(opened.bytes, b"confidential socket frame");
+    assert!(matches!(
+        reg.execute_frame(
+            &DeviceFrameRequest2 {
+                scope_id: "a".repeat(32),
+                handle: server.clone(),
+                call_id: "socket-receive-replay".into(),
+                operation: DeviceFrameOperation2::Open {
+                    frame: sealed.bytes.clone(),
+                },
+            },
+            1,
+            time(0),
+        ),
+        Err(Error::Replay)
+    ));
+    assert!(matches!(
+        reg.execute_frame(
+            &DeviceFrameRequest2 {
+                scope_id: "b".repeat(32),
+                handle: server.clone(),
+                call_id: "wrong-device".into(),
+                operation: DeviceFrameOperation2::Open {
+                    frame: sealed.bytes
+                },
+            },
+            1,
+            time(0),
+        ),
+        Err(Error::DeviceDenied)
+    ));
+    run(
+        &reg,
+        'a',
+        DeviceOperation2::Revoke {
+            handle: server.clone(),
+        },
+    )?;
+    assert!(
+        reg.execute_frame(
+            &DeviceFrameRequest2 {
+                scope_id: "a".repeat(32),
+                handle: server,
+                call_id: "after-revoke".into(),
+                operation: DeviceFrameOperation2::Seal { plaintext: vec![] },
+            },
+            1,
+            time(0),
+        )
+        .is_err()
+    );
+    Ok(())
+}
+
+#[test]
+fn frame_revalidation_rejects_a_tunnel_after_generation_change() -> TestResult {
+    let reg = registry()?;
+    let (static_handle, _) = key(&reg, 'a', DeviceKeyPurpose2::Static)?;
+    let (ephemeral, _) = key(&reg, 'a', DeviceKeyPurpose2::Ephemeral)?;
+    let remote = KeyPair::from_secret(Zeroizing::new([31; 32]))?;
+    let remote_ephemeral = KeyPair::from_secret(Zeroizing::new([32; 32]))?;
+    let handle = tunnel(
+        &reg,
+        &static_handle,
+        &ephemeral,
+        &remote.public_key().encode(),
+        &remote_ephemeral.public_key().encode(),
+        DeviceRole2::Client,
+    )?;
+    assert!(
+        reg.validate_frame(&"a".repeat(32), &handle, 1, time(0))
+            .is_ok()
+    );
+    run(
+        &reg,
+        'a',
+        DeviceOperation2::Revoke {
+            handle: handle.clone(),
+        },
+    )?;
+    assert!(
+        reg.validate_frame(&"a".repeat(32), &handle, 1, time(0))
+            .is_err()
+    );
+    let mut next = config();
+    for scope in &mut next.scopes {
+        scope.static_secret = None;
+    }
+    reg.reconfigure(next, 2)?;
+    assert!(
+        reg.validate_frame(&"a".repeat(32), &handle, 1, time(0))
+            .is_err()
+    );
+    Ok(())
+}
+
+#[test]
+fn confidential_frames_enforce_size_limits_expiry_and_replay() -> TestResult {
+    let mut cfg = config();
+    cfg.max_message_bytes = 4;
+    let reg = Registry::new(
+        cfg,
+        &[registration(&"a".repeat(32)), registration(&"b".repeat(32))],
+        ":1.1",
+        1,
+        time(0),
+    )?;
+    let (static_handle, _) = key(&reg, 'a', DeviceKeyPurpose2::Static)?;
+    let (ephemeral, _) = key(&reg, 'a', DeviceKeyPurpose2::Ephemeral)?;
+    let external = KeyPair::from_secret(Zeroizing::new([9; 32]))?;
+    let remote_ephemeral = KeyPair::from_secret(Zeroizing::new([10; 32]))?;
+    let tunnel_handle = tunnel(
+        &reg,
+        &static_handle,
+        &ephemeral,
+        &external.public_key().encode(),
+        &remote_ephemeral.public_key().encode(),
+        DeviceRole2::Client,
+    )?;
+    let too_large = reg.execute_frame(
+        &DeviceFrameRequest2 {
+            scope_id: "a".repeat(32),
+            handle: tunnel_handle.clone(),
+            call_id: "oversized".into(),
+            operation: DeviceFrameOperation2::Seal {
+                plaintext: b"12345".to_vec(),
+            },
+        },
+        1,
+        time(0),
+    );
+    assert!(matches!(too_large, Err(Error::Limit)));
+    let expired_request = request(
+        'a',
+        DeviceOperation2::Seal {
+            handle: tunnel_handle.clone(),
+            plaintext: vec![],
+        },
+    );
+    assert!(
+        reg.execute_frame(
+            &DeviceFrameRequest2 {
+                scope_id: "a".repeat(32),
+                handle: tunnel_handle,
+                call_id: expired_request.call_id,
+                operation: DeviceFrameOperation2::Seal { plaintext: vec![] },
+            },
+            1,
+            time(101),
+        )
+        .is_err()
+    );
+    Ok(())
+}
+
+#[test]
+fn frame_budget_is_per_tunnel_and_independent_of_control_operations() -> TestResult {
+    let mut cfg = config();
+    cfg.frames_per_minute = 1;
+    cfg.operations_per_minute = 100;
+    let reg = Registry::new(
+        cfg,
+        &[registration(&"a".repeat(32)), registration(&"b".repeat(32))],
+        ":1.1",
+        1,
+        time(0),
+    )?;
+    let (static_handle, _) = key(&reg, 'a', DeviceKeyPurpose2::Static)?;
+    let (ephemeral, _) = key(&reg, 'a', DeviceKeyPurpose2::Ephemeral)?;
+    let external = KeyPair::from_secret(Zeroizing::new([19; 32]))?;
+    let remote_ephemeral = KeyPair::from_secret(Zeroizing::new([20; 32]))?;
+    let handle = tunnel(
+        &reg,
+        &static_handle,
+        &ephemeral,
+        &external.public_key().encode(),
+        &remote_ephemeral.public_key().encode(),
+        DeviceRole2::Client,
+    )?;
+    let frame_request = |call_id: &str| DeviceFrameRequest2 {
+        scope_id: "a".repeat(32),
+        handle: handle.clone(),
+        call_id: call_id.into(),
+        operation: DeviceFrameOperation2::Seal {
+            plaintext: b"x".to_vec(),
+        },
+    };
+    reg.execute_frame(&frame_request("frame-1"), 1, time(0))?;
+    assert!(matches!(
+        reg.execute_frame(&frame_request("frame-2"), 1, time(0)),
+        Err(Error::DeviceRate)
+    ));
+    // The independent control plane remains available after a frame budget is exhausted.
+    key(&reg, 'a', DeviceKeyPurpose2::Static)?;
+    Ok(())
+}
+
 #[test]
 fn invalid_initialization_inputs_and_every_operation_shape_fail_closed() -> TestResult {
     let regs = [registration(&"a".repeat(32)), registration(&"b".repeat(32))];
@@ -605,7 +853,7 @@ fn invalid_initialization_inputs_and_every_operation_shape_fail_closed() -> Test
     let mut duplicate = config();
     duplicate.scopes.push(duplicate.scopes[0].clone());
     assert!(init(duplicate, &regs, ":1.1", 1).is_err());
-    for change in 0..7 {
+    for change in 0..9 {
         let mut cfg = config();
         match change {
             0 => cfg.scopes.clear(),
@@ -614,7 +862,9 @@ fn invalid_initialization_inputs_and_every_operation_shape_fail_closed() -> Test
             3 => cfg.operations_per_minute = 0,
             4 => cfg.max_ttl_ms = 300_001,
             5 => cfg.max_message_bytes = 1_048_577,
-            _ => cfg.max_bootstrap_nonces = 0,
+            6 => cfg.max_bootstrap_nonces = 0,
+            7 => cfg.frames_per_minute = 0,
+            _ => cfg.frames_per_minute = 60_001,
         }
         assert!(init(cfg, &regs, ":1.1", 1).is_err());
     }
@@ -755,3 +1005,128 @@ fn epoch_exhaustion_rejects_reconfiguration_without_partial_mutation() -> TestRe
     assert_eq!(state.limits, cfg);
     Ok(())
 }
+
+#[test]
+fn clock_sampling_is_serialized_with_registry_state_transitions() -> TestResult {
+    use std::sync::mpsc;
+
+    let registry = registry()?;
+    let (sampled_tx, sampled_rx) = mpsc::channel();
+    let (release_tx, release_rx) = mpsc::channel();
+    let earlier_registry = registry.clone();
+    let earlier = std::thread::spawn(move || {
+        earlier_registry.execute_frame_with_clock(
+            &DeviceFrameRequest2 {
+                scope_id: "a".repeat(32),
+                handle: "missing-frame-handle".into(),
+                call_id: "earlier-clock-sample".into(),
+                operation: DeviceFrameOperation2::Seal {
+                    plaintext: b"frame".to_vec(),
+                },
+            },
+            1,
+            || {
+                sampled_tx.send(()).ok()?;
+                release_rx.recv().ok()?;
+                Some(time(1))
+            },
+        )
+    });
+    sampled_rx.recv()?;
+
+    // The old adapter sampled before entering the registry. Prove whether the first callback
+    // still owns the state lock while paused; if it does not, commit the later observation first
+    // to deterministically recreate the old out-of-order transition.
+    let sample_order_was_unlocked = match registry.0.try_lock() {
+        Ok(state) => {
+            drop(state);
+            assert!(matches!(
+                registry.execute_frame_with_clock(
+                    &DeviceFrameRequest2 {
+                        scope_id: "a".repeat(32),
+                        handle: "missing-frame-handle".into(),
+                        call_id: "later-clock-sample".into(),
+                        operation: DeviceFrameOperation2::Seal {
+                            plaintext: b"frame".to_vec(),
+                        },
+                    },
+                    1,
+                    || Some(time(2)),
+                ),
+                Err(Error::DeviceDenied)
+            ));
+            true
+        }
+        Err(std::sync::TryLockError::WouldBlock) => false,
+        Err(std::sync::TryLockError::Poisoned(_)) => return Err(Error::DeviceDenied.into()),
+    };
+    release_tx.send(())?;
+
+    let earlier_result = earlier.join().map_err(|_| Error::DeviceDenied)?;
+    assert!(matches!(earlier_result, Err(Error::DeviceDenied)));
+    assert!(
+        !sample_order_was_unlocked,
+        "clock callback ran outside registry lock"
+    );
+    assert!(matches!(
+        registry.execute_frame_with_clock(
+            &DeviceFrameRequest2 {
+                scope_id: "a".repeat(32),
+                handle: "still-missing".into(),
+                call_id: "after-concurrent-clock-samples".into(),
+                operation: DeviceFrameOperation2::Seal {
+                    plaintext: b"frame".to_vec(),
+                },
+            },
+            1,
+            || Some(time(3)),
+        ),
+        Err(Error::DeviceDenied)
+    ));
+    Ok(())
+}
+
+#[test]
+fn a_genuine_clock_rollback_still_faults_registry_authority() -> TestResult {
+    let registry = registry()?;
+    let request = DeviceFrameRequest2 {
+        scope_id: "a".repeat(32),
+        handle: "missing-frame-handle".into(),
+        call_id: "clock-rollback".into(),
+        operation: DeviceFrameOperation2::Seal {
+            plaintext: b"frame".to_vec(),
+        },
+    };
+    assert!(matches!(
+        registry.execute_frame_with_clock(&request, 1, || Some(time(2))),
+        Err(Error::DeviceDenied)
+    ));
+    assert!(matches!(
+        registry.execute_frame_with_clock(&request, 1, || Some(time(1))),
+        Err(Error::DeviceClock)
+    ));
+    assert!(matches!(
+        registry.execute_frame_with_clock(&request, 1, || Some(time(3))),
+        Err(Error::DeviceClock)
+    ));
+    Ok(())
+}
+
+#[test]
+fn frame_admission_is_released_during_crypto_unwind() -> TestResult {
+    let reg = registry()?;
+    let mut state = reg.lock()?;
+    let State { budget, scopes, .. } = &mut *state;
+    let scope = scopes.get_mut(&"a".repeat(32)).ok_or(Error::DeviceDenied)?;
+    assert!(budget.reserve(&mut scope.rate, 0, 1, 12_000).is_ok());
+    drop(state);
+
+    let unwind = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        let _ = reg.with_frame_reservation(|| -> Result<()> {
+            std::panic::resume_unwind(Box::new("crypto unwind"));
+        });
+    }));
+    assert!(unwind.is_err());
+    assert!(!reg.lock()?.budget.full(1));
+    Ok(())
+}
diff --git a/crates/tinysecurity-module/examples/device_native_contract.rs b/crates/tinysecurity-module/examples/device_native_contract.rs
index f537f4d1..cb1c4547 100644
--- a/crates/tinysecurity-module/examples/device_native_contract.rs
+++ b/crates/tinysecurity-module/examples/device_native_contract.rs
@@ -9,8 +9,9 @@ use std::{
 };
 use tinybus::{Connection, broker::Broker, module::ModuleHost, transport::memory::MemoryBus};
 use tinysecurity_bus::{
-    ApprovalConfig2, ApprovalRow2, DeviceKeyPurpose2, DeviceOperation2, DeviceResponse2,
-    DeviceRole2, EvaluateDeviceRequest2, ExecuteDeviceRequest2, ModuleConfig, PolicyInfo, names,
+    ApprovalConfig2, ApprovalRow2, DeviceFrameOperation2, DeviceFrameRequest2,
+    DeviceFrameResponse2, DeviceKeyPurpose2, DeviceOperation2, DeviceResponse2, DeviceRole2,
+    EvaluateDeviceRequest2, ExecuteDeviceRequest2, ModuleConfig, PolicyInfo, names,
 };
 #[tokio::main]
 async fn main() -> std::result::Result<(), Box<dyn std::error::Error>> {
@@ -43,7 +44,7 @@ async fn main() -> std::result::Result<(), Box<dyn std::error::Error>> {
         trusted_host: host.unique_name().map(|n| n.to_string()),
         approvals: Some(ApprovalConfig2 {
             timeout_ms: 30_000,
-            scopes: vec![fixture::registration()],
+            scopes: vec![fixture::registration(), fixture::other_registration()],
         }),
         audit: Some(fixture::audit_config(Some(
             root.join("audit").to_str().ok_or("fixture path")?.into(),
@@ -62,7 +63,7 @@ async fn main() -> std::result::Result<(), Box<dyn std::error::Error>> {
         .with_timeout(Duration::from_secs(10));
     routing_checks(&proxy, &bus, &module).await?;
     let mut sequence = 1;
-    let key = native_protocols(&proxy, &store, &mut sequence).await?;
+    let (key, stale_tunnel) = native_protocols(&proxy, &store, &mut sequence).await?;
     let observer = generation_boundary(
         &lifecycle,
         &loaded.name,
@@ -70,7 +71,7 @@ async fn main() -> std::result::Result<(), Box<dyn std::error::Error>> {
         &proxy,
         &store,
         &mut sequence,
-        key,
+        (key, stale_tunnel),
     )
     .await?;
     let after: PolicyInfo = proxy.call(names::methods::POLICY_INFO, ()).await?;
@@ -104,7 +105,7 @@ async fn main() -> std::result::Result<(), Box<dyn std::error::Error>> {
     task.abort();
     assert_eq!(hash, tinybus::module::sha256_file(&library)?);
     println!(
-        "native device: SHA256={hash}; verified peer + confidential RPCs + exact human/audit receipts + v2/v3/v4 + replay/revoke/reinit/shutdown passed"
+        "native device: SHA256={hash}; verified peer + confidential DeviceFrame2 Seal/Open + no frame approval rows + cross-scope/replay/revoke/stale-generation denial + existing approved v2/v3/v4 flows + shutdown passed"
     );
     Ok(())
 }
@@ -114,7 +115,7 @@ async fn native_tunnel(
     sequence: &mut u64,
     own: &str,
     public: &str,
-) -> std::result::Result<(), Box<dyn std::error::Error>> {
+) -> std::result::Result<String, Box<dyn std::error::Error>> {
     use tinysecurity::crypto::device::{KeyPair, PublicKey, Role, Tunnel};
     let ephemeral = fixture::run(
         proxy,
@@ -184,13 +185,159 @@ async fn native_tunnel(
             store,
             sequence,
             DeviceOperation2::Open {
-                handle: tunnel,
+                handle: tunnel.clone(),
                 frame: incoming
             }
         )
         .await
         .is_err()
     );
+    verify_frame_dispatch(proxy, store, &tunnel, &mut peer_tunnel).await?;
+    verify_revoked_tunnel(proxy, store, sequence, own).await?;
+    Ok(tunnel)
+}
+
+async fn verify_frame_dispatch(
+    proxy: &tinybus::Proxy,
+    store: &Arc<Mutex<fixture::store::DiskStore>>,
+    tunnel: &str,
+    peer_tunnel: &mut tinysecurity::crypto::device::Tunnel,
+) -> std::result::Result<(), Box<dyn std::error::Error>> {
+    let before = {
+        let store = store
+            .lock()
+            .map_err(|_| tinybus::Error::failed("fixture store"))?;
+        (store.mutations.len(), store.tickets.len())
+    };
+    let sealed: DeviceFrameResponse2 = proxy
+        .call_confidential(
+            names::methods::DEVICE_FRAME2,
+            (DeviceFrameRequest2 {
+                scope_id: "a".repeat(32),
+                handle: tunnel.into(),
+                call_id: "module-frame-seal".into(),
+                operation: DeviceFrameOperation2::Seal {
+                    plaintext: b"private-secret".to_vec(),
+                },
+            },),
+        )
+        .await?;
+    assert_eq!(sealed.bytes.first(), Some(&2));
+    assert_eq!(&*peer_tunnel.open(&sealed.bytes)?, b"private-secret");
+    let incoming = peer_tunnel.seal(b"private-secret")?;
+    let opened: DeviceFrameResponse2 = proxy
+        .call_confidential(
+            names::methods::DEVICE_FRAME2,
+            (DeviceFrameRequest2 {
+                scope_id: "a".repeat(32),
+                handle: tunnel.into(),
+                call_id: "module-frame-open".into(),
+                operation: DeviceFrameOperation2::Open {
+                    frame: incoming.clone(),
+                },
+            },),
+        )
+        .await?;
+    assert_eq!(opened.bytes, b"private-secret");
+    assert!(
+        proxy
+            .call_confidential::<DeviceFrameResponse2>(
+                names::methods::DEVICE_FRAME2,
+                (DeviceFrameRequest2 {
+                    scope_id: "a".repeat(32),
+                    handle: tunnel.into(),
+                    call_id: "module-frame-replay".into(),
+                    operation: DeviceFrameOperation2::Open { frame: incoming },
+                },),
+            )
+            .await
+            .is_err()
+    );
+    assert!(
+        proxy
+            .call_confidential::<DeviceFrameResponse2>(
+                names::methods::DEVICE_FRAME2,
+                (DeviceFrameRequest2 {
+                    scope_id: "b".repeat(32),
+                    handle: tunnel.into(),
+                    call_id: "module-frame-cross-scope".into(),
+                    operation: DeviceFrameOperation2::Seal {
+                        plaintext: b"private-secret".to_vec()
+                    },
+                },),
+            )
+            .await
+            .is_err()
+    );
+    let after = {
+        let store = store
+            .lock()
+            .map_err(|_| tinybus::Error::failed("fixture store"))?;
+        (store.mutations.len(), store.tickets.len())
+    };
+    assert_eq!(
+        after, before,
+        "frame calls must not create approval rows or tickets"
+    );
+    Ok(())
+}
+
+async fn verify_revoked_tunnel(
+    proxy: &tinybus::Proxy,
+    store: &Arc<Mutex<fixture::store::DiskStore>>,
+    sequence: &mut u64,
+    own: &str,
+) -> std::result::Result<(), Box<dyn std::error::Error>> {
+    use tinysecurity::crypto::device::KeyPair;
+    let revoked_ephemeral = fixture::run(
+        proxy,
+        store,
+        sequence,
+        DeviceOperation2::Key {
+            purpose: DeviceKeyPurpose2::Ephemeral,
+        },
+    )
+    .await?;
+    let revoked_peer = KeyPair::generate()?;
+    let revoked_peer_ephemeral = KeyPair::generate()?;
+    let revoked = fixture::run(
+        proxy,
+        store,
+        sequence,
+        DeviceOperation2::Tunnel {
+            key: own.into(),
+            ephemeral: revoked_ephemeral.handle.ok_or("fixture ephemeral")?,
+            peer_static: revoked_peer.public_key().encode(),
+            peer_ephemeral: revoked_peer_ephemeral.public_key().encode(),
+            role: DeviceRole2::Client,
+        },
+    )
+    .await?
+    .handle
+    .ok_or("fixture revoked tunnel")?;
+    fixture::run(
+        proxy,
+        store,
+        sequence,
+        DeviceOperation2::Revoke {
+            handle: revoked.clone(),
+        },
+    )
+    .await?;
+    assert!(
+        proxy
+            .call_confidential::<DeviceFrameResponse2>(
+                names::methods::DEVICE_FRAME2,
+                (DeviceFrameRequest2 {
+                    scope_id: "a".repeat(32),
+                    handle: revoked,
+                    call_id: "module-frame-after-revoke".into(),
+                    operation: DeviceFrameOperation2::Seal { plaintext: vec![] },
+                },),
+            )
+            .await
+            .is_err()
+    );
     Ok(())
 }
 async fn routing_checks(
@@ -204,6 +351,10 @@ async fn routing_checks(
         info.capabilities
             .contains(&names::methods::EXECUTE_DEVICE2.to_owned())
     );
+    assert!(
+        info.capabilities
+            .contains(&names::methods::DEVICE_FRAME2.to_owned())
+    );
     assert!(!serde_json::to_string(&info)?.contains("static_secret"));
     let rejected = EvaluateDeviceRequest2 {
         request: fixture::request(1, DeviceOperation2::Cancel),
@@ -223,6 +374,33 @@ async fn routing_checks(
             .await
             .is_err()
     );
+    let unconfigured_frame = DeviceFrameRequest2 {
+        scope_id: "a".repeat(32),
+        handle: "missing-tunnel".into(),
+        call_id: "untrusted-frame".into(),
+        operation: DeviceFrameOperation2::Seal { plaintext: vec![] },
+    };
+    assert!(
+        proxy
+            .call::<DeviceFrameResponse2>(
+                names::methods::DEVICE_FRAME2,
+                (unconfigured_frame.clone(),),
+            )
+            .await
+            .is_err(),
+        "DeviceFrame2 requires confidential transport"
+    );
+    assert!(
+        attacker
+            .proxy(module.as_str(), names::OBJECT_PATH, names::INTERFACE)?
+            .call_confidential::<DeviceFrameResponse2>(
+                names::methods::DEVICE_FRAME2,
+                (unconfigured_frame,),
+            )
+            .await
+            .is_err(),
+        "untrusted peers cannot use DeviceFrame2"
+    );
     let malformed = serde_json::json!([{"request":{"scope_id":"a","call_id":"private-secret","ttl_ms":1,"operation":{"kind":"seal","handle":"private-secret","plaintext":"private-secret"}},"audit":fixture::audit(1)}]);
     let error = proxy
         .call_confidential::<ApprovalRow2>(names::methods::EVALUATE_DEVICE2, malformed)
@@ -284,7 +462,7 @@ async fn native_protocols(
     proxy: &tinybus::Proxy,
     store: &Arc<Mutex<fixture::store::DiskStore>>,
     sequence: &mut u64,
-) -> std::result::Result<String, Box<dyn std::error::Error>> {
+) -> std::result::Result<(String, String), Box<dyn std::error::Error>> {
     let server = fixture::run(
         proxy,
         store,
@@ -367,7 +545,7 @@ async fn native_protocols(
         .await
         .is_err()
     );
-    let key = fixture::run(
+    let observer = fixture::run(
         proxy,
         store,
         sequence,
@@ -375,10 +553,11 @@ async fn native_protocols(
             purpose: DeviceKeyPurpose2::Static,
         },
     )
-    .await?
-    .handle
-    .ok_or("fixture handle")?;
-    Ok(key)
+    .await?;
+    let observer_public = observer.public_key.ok_or("fixture public")?;
+    let observer = observer.handle.ok_or("fixture handle")?;
+    let stale_tunnel = native_tunnel(proxy, store, sequence, &observer, &observer_public).await?;
+    Ok((observer, stale_tunnel))
 }
 async fn generation_boundary(
     lifecycle: &ModuleHost,
@@ -387,8 +566,9 @@ async fn generation_boundary(
     proxy: &tinybus::Proxy,
     store: &Arc<Mutex<fixture::store::DiskStore>>,
     sequence: &mut u64,
-    key: String,
+    handles: (String, String),
 ) -> std::result::Result<String, Box<dyn std::error::Error>> {
+    let (key, stale_tunnel) = handles;
     // Actual SDK reinit retains the callback peer/registrations while advancing generation.
     for scope in &mut configuration
         .device
@@ -418,6 +598,21 @@ async fn generation_boundary(
         .await
         .is_err()
     );
+    assert!(
+        proxy
+            .call_confidential::<DeviceFrameResponse2>(
+                names::methods::DEVICE_FRAME2,
+                (DeviceFrameRequest2 {
+                    scope_id: "a".repeat(32),
+                    handle: stale_tunnel,
+                    call_id: "module-frame-after-reinit".into(),
+                    operation: DeviceFrameOperation2::Seal { plaintext: vec![] },
+                },),
+            )
+            .await
+            .is_err(),
+        "reinitialization invalidates old tunnel capabilities"
+    );
     let current = fixture::run_at(
         proxy,
         store,
diff --git a/crates/tinysecurity-module/examples/device_native_contract/fixture.rs b/crates/tinysecurity-module/examples/device_native_contract/fixture.rs
index 2aaf4c0e..b4a0ea89 100644
--- a/crates/tinysecurity-module/examples/device_native_contract/fixture.rs
+++ b/crates/tinysecurity-module/examples/device_native_contract/fixture.rs
@@ -32,16 +32,39 @@ pub(crate) fn registration() -> ApprovalScope2 {
         auto_approve_all: false,
     }
 }
+pub(crate) fn other_registration() -> ApprovalScope2 {
+    ApprovalScope2 {
+        scope_id: "b".repeat(32),
+        subject: SubjectScope {
+            user: "fixture-other-user".into(),
+            workspace: "fixture-other-workspace".into(),
+            agent: "fixture-other-agent".into(),
+        },
+        policy_ref: "immutable-other-device-fixture".into(),
+        generation: 1,
+        ceiling: AccessTier::Full,
+        require_approval: true,
+        auto_approve_all: false,
+    }
+}
 pub(crate) fn device_config() -> DeviceConfig2 {
     DeviceConfig2 {
-        scopes: vec![DeviceScope2 {
-            scope_id: "a".repeat(32),
-            origin: Origin::Operator,
-            static_secret: Some([7; 32]),
-        }],
+        scopes: vec![
+            DeviceScope2 {
+                scope_id: "a".repeat(32),
+                origin: Origin::Operator,
+                static_secret: Some([7; 32]),
+            },
+            DeviceScope2 {
+                scope_id: "b".repeat(32),
+                origin: Origin::Operator,
+                static_secret: Some([8; 32]),
+            },
+        ],
         max_handles: 32,
         max_in_flight: 4,
         operations_per_minute: 4096,
+        frames_per_minute: 12_000,
         max_ttl_ms: 300_000,
         max_message_bytes: 1024,
         max_bootstrap_nonces: 64,
diff --git a/crates/tinysecurity-module/src/adapter.rs b/crates/tinysecurity-module/src/adapter.rs
index 5a7e85ae..fc03cee0 100644
--- a/crates/tinysecurity-module/src/adapter.rs
+++ b/crates/tinysecurity-module/src/adapter.rs
@@ -308,6 +308,14 @@ impl PolicyService {
     ) -> BusResult<tinysecurity_bus::DeviceResponse2> {
         self.device_execute(request).await
     }
+    #[tinybus(confidential)]
+    /// Dispatch the no-human-prompt frame member; the adapter rechecks authority after crypto.
+    async fn device_frame2(
+        &self,
+        request: tinysecurity_bus::DeviceFrameRequest2,
+    ) -> BusResult<tinysecurity_bus::DeviceFrameResponse2> {
+        self.device_frame(request).await
+    }
     async fn plan(
         &self,
         _request: tinysecurity_bus::SandboxPlanRequest,
@@ -1944,7 +1952,7 @@ tinybus_module::module_export! {
     config = ModuleConfig,
     worker_threads = 1,
     provides = ["ai.tinyhumans.tinysecurity.Policy"],
-    methods = ["EvaluateSecretCipher2", "ExecuteSecretCipher2", "EvaluateSecret2", "ExecuteSecret2", "PasswordCrypt2", "KeyringAccess2", "PairingControl2", "EvaluateDevice2", "ExecuteDevice2", "Plan", "Plan2", "EvaluateSandboxApproval2", "ConsumeSandboxPlan2", "ImportApprovalHistory2", "ParseReply", "EvaluateApproval2", "Decide2", "ConsumeApproval2", "RecordExecution2", "ListApprovals2", "CancelApproval2", "ExpireApproval2", "PreauthorizeFlow2", "GrantFlowTool2", "RevokeFlowTool2", "ListFlowTrust2", "RegisterApprovalScope2", "ReplaceApprovalScope2", "RetireApprovalScope2", "RegisterSandboxScope2", "RetireSandboxScope2", "Audit2", "RecordAudit2", "Evaluate", "Check", "EvaluateAudited2", "CheckAudited2", "PolicyInfo", "RegisterPolicy", "SupersedePolicy", "EvaluateScoped", "CheckScoped", "ScopedPolicyInfo", "EvaluateScopedAudited", "CheckScopedAudited", "RegisterPathPolicy", "ValidatePath", "ValidateParent", "CheckPath", "CheckPaths2", "ProtectedPath2", "ProtectedFloor2", "SpendAction2", "PeekBudget2", "ClassifyHostAction2", "PrivacyCheck2", "RegisterCommandPolicy", "ClassifyCommand", "CheckCommand", "RegisterEgressPolicy", "ScopedUrlGuard", "ScopedEgressCheck", "ConsumeEgressAuthorization", "UrlGuard", "EgressCheck", "Redact", "RedactWith", "ScanPrompt", "ScanPrompt2", "ScanToolDefinition"],
+    methods = ["EvaluateSecretCipher2", "ExecuteSecretCipher2", "EvaluateSecret2", "ExecuteSecret2", "PasswordCrypt2", "KeyringAccess2", "PairingControl2", "EvaluateDevice2", "ExecuteDevice2", "DeviceFrame2", "Plan", "Plan2", "EvaluateSandboxApproval2", "ConsumeSandboxPlan2", "ImportApprovalHistory2", "ParseReply", "EvaluateApproval2", "Decide2", "ConsumeApproval2", "RecordExecution2", "ListApprovals2", "CancelApproval2", "ExpireApproval2", "PreauthorizeFlow2", "GrantFlowTool2", "RevokeFlowTool2", "ListFlowTrust2", "RegisterApprovalScope2", "ReplaceApprovalScope2", "RetireApprovalScope2", "RegisterSandboxScope2", "RetireSandboxScope2", "Audit2", "RecordAudit2", "Evaluate", "Check", "EvaluateAudited2", "CheckAudited2", "PolicyInfo", "RegisterPolicy", "SupersedePolicy", "EvaluateScoped", "CheckScoped", "ScopedPolicyInfo", "EvaluateScopedAudited", "CheckScopedAudited", "RegisterPathPolicy", "ValidatePath", "ValidateParent", "CheckPath", "CheckPaths2", "ProtectedPath2", "ProtectedFloor2", "SpendAction2", "PeekBudget2", "ClassifyHostAction2", "PrivacyCheck2", "RegisterCommandPolicy", "ClassifyCommand", "CheckCommand", "RegisterEgressPolicy", "ScopedUrlGuard", "ScopedEgressCheck", "ConsumeEgressAuthorization", "UrlGuard", "EgressCheck", "Redact", "RedactWith", "ScanPrompt", "ScanPrompt2", "ScanToolDefinition"],
     signals = ["PolicyChanged"],
     requires = [],
     optional = ["ai.tinyhumans.tinysecurity.KeyringConsent2", "ai.tinyhumans.tinysecurity.SecretCipherConsumer2", "ai.tinyhumans.tinysecurity.SecretBackend2", "ai.tinyhumans.tinysecurity.AuditSink2", "ai.tinyhumans.tinysecurity.ApprovalStore2", "ai.tinyhumans.tinysecurity.ApprovalPrompt2"],
diff --git a/crates/tinysecurity-module/src/adapter_crypto_tests.rs b/crates/tinysecurity-module/src/adapter_crypto_tests.rs
index dc359587..45e74fd8 100644
--- a/crates/tinysecurity-module/src/adapter_crypto_tests.rs
+++ b/crates/tinysecurity-module/src/adapter_crypto_tests.rs
@@ -473,6 +473,7 @@ async fn members_require_confidential_transport_and_the_authenticated_peer()
         names::methods::PASSWORD_CRYPT2,
         names::methods::KEYRING_ACCESS2,
         names::methods::PAIRING_CONTROL2,
+        names::methods::DEVICE_FRAME2,
     ] {
         let member: tinybus::MemberName = name.parse()?;
         assert!(fixture.service.requires_confidential(&member));
diff --git a/crates/tinysecurity-module/src/adapter_device.rs b/crates/tinysecurity-module/src/adapter_device.rs
index 054683d2..1e35b7ef 100644
--- a/crates/tinysecurity-module/src/adapter_device.rs
+++ b/crates/tinysecurity-module/src/adapter_device.rs
@@ -5,8 +5,8 @@ use tinysecurity::crypto::device_handles::{
     ConfidentialConfig, ConfidentialRequest, Registry, Time,
 };
 use tinysecurity_bus::{
-    ApprovalChoice2, ApprovalLifecycle2, DeviceConfig2, DeviceResponse2, EvaluateDeviceRequest2,
-    ExecuteDeviceRequest2,
+    ApprovalChoice2, ApprovalLifecycle2, DeviceConfig2, DeviceFrameOperation2, DeviceFrameRequest2,
+    DeviceFrameResponse2, DeviceResponse2, EvaluateDeviceRequest2, ExecuteDeviceRequest2,
 };
 // A weak reinit lookup does not extend the lifetime of native credentials past shutdown.
 static DEVICE: OnceLock<Option<Weak<Registry>>> = OnceLock::new();
@@ -19,6 +19,26 @@ fn time(clock: &dyn tinysecurity::approval::Clock) -> BusResult<Time> {
         monotonic: clock.monotonic_ms(),
     })
 }
+fn clock_sample(clock: &dyn tinysecurity::approval::Clock) -> Option<Time> {
+    Some(Time {
+        wall: clock.wall_ms()?,
+        monotonic: clock.monotonic_ms(),
+    })
+}
+/// Read the native clock and permanently fail device authority closed if it is unavailable.
+#[cfg(test)]
+fn registry_time(
+    registry: &Registry,
+    clock: &dyn tinysecurity::approval::Clock,
+) -> BusResult<Time> {
+    match time(clock) {
+        Ok(now) => Ok(now),
+        Err(error) => {
+            registry.fail_clock().map_err(|_| denied())?;
+            Err(error)
+        }
+    }
+}
 type Configured = (Option<Arc<Registry>>, Option<DeviceConfig2>);
 struct Initialization<'a> {
     peer: Option<&'a str>,
@@ -146,6 +166,51 @@ impl ConfidentialResponse {
         self.0.take().ok_or_else(denied)
     }
 }
+
+/// Own a frame request so cancellation or rejection zeroizes its handle and payload.
+struct ConfidentialFrameRequest(DeviceFrameRequest2);
+impl ConfidentialFrameRequest {
+    /// Wrap a request whose confidential fields must be cleared when dropped.
+    fn new(request: DeviceFrameRequest2) -> Self {
+        Self(request)
+    }
+}
+impl Drop for ConfidentialFrameRequest {
+    fn drop(&mut self) {
+        use zeroize::Zeroize;
+        self.0.handle.zeroize();
+        match &mut self.0.operation {
+            DeviceFrameOperation2::Seal { plaintext } => {
+                plaintext.zeroize();
+            }
+            DeviceFrameOperation2::Open { frame } => {
+                frame.zeroize();
+            }
+        }
+    }
+}
+
+/// Retain response plaintext until all publication checks pass, then clear it on failure.
+struct ConfidentialFrameResponse(Option<DeviceFrameResponse2>);
+impl ConfidentialFrameResponse {
+    /// Keep worker output under zeroizing ownership until publication.
+    fn new(response: DeviceFrameResponse2) -> Self {
+        Self(Some(response))
+    }
+    /// Transfer validated bytes to the bus response, leaving nothing for `Drop` to clear.
+    fn publish(mut self) -> BusResult<DeviceFrameResponse2> {
+        self.0.take().ok_or_else(denied)
+    }
+}
+impl Drop for ConfidentialFrameResponse {
+    /// Clear plaintext when validation fails or the async caller is cancelled.
+    fn drop(&mut self) {
+        if let Some(response) = &mut self.0 {
+            use zeroize::Zeroize;
+            response.bytes.zeroize();
+        }
+    }
+}
 impl Drop for ConfidentialResponse {
     fn drop(&mut self) {
         if let Some(response) = &mut self.0 {
@@ -159,44 +224,58 @@ impl Drop for ConfidentialResponse {
     }
 }
 impl PolicyService {
+    #[cfg(test)]
     fn device_time(&self) -> BusResult<Time> {
-        match time(self.sandbox_clock.as_ref()) {
-            Ok(now) => Ok(now),
-            Err(error) => {
-                if let Some(registry) = &self.device {
-                    registry.fail_clock().map_err(|_| denied())?;
-                }
-                Err(error)
-            }
-        }
+        let registry = self.device.as_ref().ok_or_else(denied)?;
+        registry_time(registry, self.sandbox_clock.as_ref())
     }
+
     pub(super) async fn device_approval(
         &self,
         request: EvaluateDeviceRequest2,
     ) -> BusResult<tinysecurity_bus::ApprovalRow2> {
         let audit = request.audit;
         let original = ConfidentialRequest::new(request.request);
-        let request = original.request();
-        let registry = self.device.as_ref().ok_or_else(denied)?;
+        let scope_id = original.request().scope_id.clone();
+        let registry = Arc::clone(self.device.as_ref().ok_or_else(denied)?);
         let approvals = self.approvals.as_ref().ok_or_else(denied)?;
         let generation = self.read()?.info().generation;
-        let work = registry
-            .reserve(request, generation, self.device_time()?)
-            .map_err(|_| denied())?;
-        let call = registry.approval_call(request).map_err(|_| denied())?;
+        let ttl_ms = original.request().ttl_ms;
+        let clock = Arc::clone(&self.sandbox_clock);
+        let actual = Arc::clone(&registry);
+        let (work, call) = tokio::task::spawn_blocking(move || {
+            let work = actual
+                .reserve_with_clock(original.request(), generation, || {
+                    clock_sample(clock.as_ref())
+                })
+                .map_err(|_| denied())?;
+            let call = actual
+                .approval_call(original.request())
+                .map_err(|_| denied())?;
+            Ok::<_, tinybus::Error>((work, call))
+        })
+        .await
+        .map_err(|_| denied())??;
         let row = approvals
             .begin(tinysecurity_bus::EvaluateApprovalRequest2 {
-                scope_id: request.scope_id.clone(),
+                scope_id,
                 request: call,
-                ttl_ms: Some(u64::from(request.ttl_ms)),
+                ttl_ms: Some(u64::from(ttl_ms)),
                 summary: "native device cryptographic operation".into(),
                 audit,
             })
             .await
             .map_err(approval_failure)?;
-        registry
-            .validate(&work, self.read()?.info().generation, self.device_time()?)
-            .map_err(|_| denied())?;
+        let clock = Arc::clone(&self.sandbox_clock);
+        tokio::task::spawn_blocking(move || {
+            registry
+                .validate_with_clock(&work, generation, || clock_sample(clock.as_ref()))
+                .map_err(|_| denied())?;
+            drop(work);
+            Ok::<_, tinybus::Error>(())
+        })
+        .await
+        .map_err(|_| denied())??;
         Ok(row)
     }
     pub(super) async fn device_execute(
@@ -207,12 +286,21 @@ impl PolicyService {
         let registry = Arc::clone(self.device.as_ref().ok_or_else(denied)?);
         let approvals = self.approvals.as_ref().ok_or_else(denied)?;
         let generation = self.read()?.info().generation;
-        let work = registry
-            .reserve(original.request(), generation, self.device_time()?)
-            .map_err(|_| denied())?;
-        let call = registry
-            .approval_call(original.request())
-            .map_err(|_| denied())?;
+        let clock = Arc::clone(&self.sandbox_clock);
+        let actual = Arc::clone(&registry);
+        let (original, work, call) = tokio::task::spawn_blocking(move || {
+            let work = actual
+                .reserve_with_clock(original.request(), generation, || {
+                    clock_sample(clock.as_ref())
+                })
+                .map_err(|_| denied())?;
+            let call = actual
+                .approval_call(original.request())
+                .map_err(|_| denied())?;
+            Ok::<_, tinybus::Error>((original, work, call))
+        })
+        .await
+        .map_err(|_| denied())??;
         let row = approvals
             .consume(tinysecurity_bus::ApprovalActionRequest2 {
                 scope_id: original.request().scope_id.clone(),
@@ -222,9 +310,6 @@ impl PolicyService {
             })
             .await
             .map_err(approval_failure)?;
-        registry
-            .validate(&work, self.read()?.info().generation, self.device_time()?)
-            .map_err(|_| denied())?;
         if row.state != ApprovalLifecycle2::Reserved
             || row.choice != Some(ApprovalChoice2::Once)
             || row.decision_ticket_sha256.is_none()
@@ -240,31 +325,68 @@ impl PolicyService {
         );
         let clock = Arc::clone(&self.sandbox_clock);
         let actual = Arc::clone(&registry);
-        let (work, result) = tokio::task::spawn_blocking(move || {
-            let result = time(clock.as_ref())
-                .map_err(|_| {
-                    let _ = actual.fail_clock();
-                    tinysecurity::crypto::Error::DeviceClock
-                })
-                .and_then(|now| {
-                    actual
-                        .execute(&work, &original.request().operation, generation, now)
-                        .map(ConfidentialResponse::new)
-                });
-            (work, result)
+        let result = tokio::task::spawn_blocking(move || {
+            let result = (|| {
+                actual
+                    .validate_with_clock(&work, generation, || clock_sample(clock.as_ref()))
+                    .map_err(|_| denied())?;
+                let response = actual
+                    .execute_with_clock(&work, &original.request().operation, generation, || {
+                        clock_sample(clock.as_ref())
+                    })
+                    .map(ConfidentialResponse::new)
+                    .map_err(|_| denied())?;
+                match actual.validate_with_clock(&work, generation, || clock_sample(clock.as_ref()))
+                {
+                    Ok(()) => Ok(response),
+                    Err(_) if cancellation => Ok(response),
+                    Err(_) => Err(denied()),
+                }
+            })();
+            drop(work);
+            result
         })
         .await
         .map_err(|_| denied())?;
         let response = result.map_err(|_| denied())?;
-        if registry
-            .validate(&work, self.read()?.info().generation, self.device_time()?)
-            .is_err()
-        {
-            // Cancellation/revocation itself intentionally fences this work's epoch.
-            // Those operations return no authority; other stale results never leave the module.
-            if !cancellation {
-                return Err(denied());
-            }
+        // Cancellation/revocation may invalidate its own epoch, but a policy transition may not
+        // publish a response captured under the previous module generation.
+        if self.read()?.info().generation != generation {
+            return Err(denied());
+        }
+        response.publish()
+    }
+
+    /// Reuse only an opaque tunnel capability created by the approved device path.
+    /// Bounded AEAD runs off-worker, and tunnel authority is revalidated before publishing bytes.
+    /// Dropping the async call leaves its request and any unpublished plaintext zeroized.
+    pub(super) async fn device_frame(
+        &self,
+        request: DeviceFrameRequest2,
+    ) -> BusResult<DeviceFrameResponse2> {
+        let request = ConfidentialFrameRequest::new(request);
+        let registry = Arc::clone(self.device.as_ref().ok_or_else(denied)?);
+        let generation = self.read()?.info().generation;
+        let scope_id = zeroize::Zeroizing::new(request.0.scope_id.clone());
+        let handle = zeroize::Zeroizing::new(request.0.handle.clone());
+        let clock = Arc::clone(&self.sandbox_clock);
+        let actual = Arc::clone(&registry);
+        let response = tokio::task::spawn_blocking(move || {
+            let response = actual
+                .execute_frame_with_clock(&request.0, generation, || clock_sample(clock.as_ref()))
+                .map(ConfidentialFrameResponse::new)
+                .map_err(|_| denied())?;
+            actual
+                .validate_frame_with_clock(&scope_id, &handle, generation, || {
+                    clock_sample(clock.as_ref())
+                })
+                .map_err(|_| denied())?;
+            Ok::<_, tinybus::Error>(response)
+        })
+        .await
+        .map_err(|_| denied())??;
+        if self.read()?.info().generation != generation {
+            return Err(denied());
         }
         response.publish()
     }
diff --git a/crates/tinysecurity-module/src/adapter_device_tests.rs b/crates/tinysecurity-module/src/adapter_device_tests.rs
index aada1387..62d5fc94 100644
--- a/crates/tinysecurity-module/src/adapter_device_tests.rs
+++ b/crates/tinysecurity-module/src/adapter_device_tests.rs
@@ -41,9 +41,170 @@ async fn unconfigured_device_service_denies_before_creating_native_authority()
             .await
             .is_err()
     );
+    assert!(
+        service
+            .device_frame(tinysecurity_bus::DeviceFrameRequest2 {
+                scope_id: "a".repeat(32),
+                handle: "missing-tunnel".into(),
+                call_id: "frame-call".into(),
+                operation: tinysecurity_bus::DeviceFrameOperation2::Seal {
+                    plaintext: b"private frame".to_vec(),
+                },
+            })
+            .await
+            .is_err()
+    );
     assert!(time(&FailedClock).is_err());
     Ok(())
 }
+
+#[test]
+fn module_frame_crypto_does_not_block_the_async_worker()
+-> std::result::Result<(), Box<dyn std::error::Error>> {
+    let (service, request) = module_frame_fixture()?;
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .max_blocking_threads(1)
+        .build()?;
+    runtime.block_on(async move {
+        let (blocker_started_tx, blocker_started_rx) = tokio::sync::oneshot::channel();
+        let (release_tx, release_rx) = std::sync::mpsc::channel();
+        let blocker = tokio::task::spawn_blocking(move || {
+            let _ = blocker_started_tx.send(());
+            let _ = release_rx.recv();
+        });
+        blocker_started_rx.await?;
+
+        let (frame_started_tx, frame_started_rx) = tokio::sync::oneshot::channel();
+        let frame = tokio::spawn(async move {
+            let _ = frame_started_tx.send(());
+            service.device_frame(request).await
+        });
+        frame_started_rx.await?;
+
+        // The blocking pool is occupied, so offloaded frame work must remain pending while
+        // the single async worker continues to run unrelated tasks.
+        let (tick_tx, tick_rx) = tokio::sync::oneshot::channel();
+        tokio::spawn(async move {
+            let _ = tick_tx.send(());
+        });
+        tick_rx.await?;
+        let finished_before_release = frame.is_finished();
+        release_tx
+            .send(())
+            .map_err(|_| "blocking worker exited early")?;
+        blocker.await?;
+        let response = frame.await??;
+        assert_eq!(response.bytes.first(), Some(&2));
+        assert_eq!(format!("{response:?}"), "DeviceFrameResponse2([REDACTED])");
+        assert!(
+            !finished_before_release,
+            "frame AEAD must be queued off the async worker"
+        );
+        Ok::<(), Box<dyn std::error::Error>>(())
+    })?;
+    Ok(())
+}
+
+fn module_frame_fixture() -> std::result::Result<
+    (PolicyService, tinysecurity_bus::DeviceFrameRequest2),
+    Box<dyn std::error::Error>,
+> {
+    use tinysecurity_bus::*;
+    let scope_id = "c".repeat(32);
+    let registered = ApprovalScope2 {
+        scope_id: scope_id.clone(),
+        subject: SubjectScope {
+            user: "user".into(),
+            workspace: "workspace".into(),
+            agent: "agent".into(),
+        },
+        policy_ref: "policy".into(),
+        generation: 1,
+        ceiling: AccessTier::Full,
+        require_approval: true,
+        auto_approve_all: false,
+    };
+    let registry = Arc::new(Registry::new(
+        DeviceConfig2 {
+            scopes: vec![DeviceScope2 {
+                scope_id: scope_id.clone(),
+                origin: Origin::Operator,
+                static_secret: Some([11; 32]),
+            }],
+            max_handles: 8,
+            max_in_flight: 2,
+            operations_per_minute: 100,
+            frames_per_minute: 12_000,
+            max_ttl_ms: 100,
+            max_message_bytes: 1024,
+            max_bootstrap_nonces: 8,
+        },
+        &[registered],
+        ":1.1",
+        1,
+        Time {
+            wall: 1000,
+            monotonic: 0,
+        },
+    )?);
+    let execute = |operation| -> std::result::Result<DeviceResponse2, tinysecurity::crypto::Error> {
+        let request = DeviceRequest2 {
+            scope_id: scope_id.clone(),
+            call_id: "approved-tunnel-setup".into(),
+            ttl_ms: 100,
+            operation,
+        };
+        let now = Time {
+            wall: 1000,
+            monotonic: 0,
+        };
+        let work = registry.reserve(&request, 1, now)?;
+        registry.execute(&work, &request.operation, 1, now)
+    };
+    let static_handle = execute(DeviceOperation2::Key {
+        purpose: DeviceKeyPurpose2::Static,
+    })?
+    .handle
+    .ok_or("missing static handle")?;
+    let ephemeral = execute(DeviceOperation2::Key {
+        purpose: DeviceKeyPurpose2::Ephemeral,
+    })?;
+    let remote_static =
+        tinysecurity::crypto::device::KeyPair::from_secret(zeroize::Zeroizing::new([12; 32]))?;
+    let remote_ephemeral =
+        tinysecurity::crypto::device::KeyPair::from_secret(zeroize::Zeroizing::new([13; 32]))?;
+    let tunnel = execute(DeviceOperation2::Tunnel {
+        key: static_handle,
+        ephemeral: ephemeral.handle.ok_or("missing ephemeral handle")?,
+        peer_static: remote_static.public_key().encode(),
+        peer_ephemeral: remote_ephemeral.public_key().encode(),
+        role: DeviceRole2::Client,
+    })?
+    .handle
+    .ok_or("missing tunnel handle")?;
+    let mut service = super::super::service_for(
+        Arc::new(std::sync::RwLock::new(tinysecurity::Policy::new(
+            ModuleConfig::default(),
+        )?)),
+        None,
+    );
+    service.device = Some(registry);
+    service.sandbox_clock = Arc::new(ToggleClock(std::sync::atomic::AtomicBool::new(false)));
+    assert_eq!(service.read()?.info().generation, 1);
+    assert_eq!(time(service.sandbox_clock.as_ref())?.wall, 1000);
+    Ok((
+        service,
+        DeviceFrameRequest2 {
+            scope_id,
+            handle: tunnel,
+            call_id: "socket-send".into(),
+            operation: DeviceFrameOperation2::Seal {
+                plaintext: b"socket frame".to_vec(),
+            },
+        },
+    ))
+}
+
 #[derive(Debug)]
 struct FailedClock;
 impl tinysecurity::approval::Clock for FailedClock {
@@ -92,6 +253,7 @@ fn clock_failure_invalidates_existing_device_authority_permanently()
         max_handles: 10,
         max_in_flight: 2,
         operations_per_minute: 100,
+        frames_per_minute: 12_000,
         max_ttl_ms: 100,
         max_message_bytes: 100,
         max_bootstrap_nonces: 10,
@@ -191,6 +353,7 @@ fn device_configuration() -> DeviceConfig2 {
         max_handles: 16,
         max_in_flight: 4,
         operations_per_minute: 4096,
+        frames_per_minute: 12_000,
         max_ttl_ms: 300_000,
         max_message_bytes: 1024,
         max_bootstrap_nonces: 64,
diff --git a/docs/module-crypto.md b/docs/module-crypto.md
index b5457b68..174f2457 100644
--- a/docs/module-crypto.md
+++ b/docs/module-crypto.md
@@ -27,8 +27,11 @@ frames and handles do not reach approval/audit payloads, errors, Debug or
 `PolicyInfo`.
 
 Explicit init bounds cover registrations, handles, concurrent reservations,
-per-scope rate, TTL, message bytes and retained bootstrap nonces. Reinit may
-change bounds without reimporting credentials or changing immutable subjects.
+per-scope control-operation rate, per-tunnel frame rate, TTL, message bytes and
+retained bootstrap nonces. `frames_per_minute` defaults to 12000 (200 frames per
+second), independently of `operations_per_minute`, and accepts 1 through 60000.
+Older device configs receive the default. Reinit may change bounds without
+reimporting credentials or changing immutable subjects.
 It invalidates all old handles; successful new-generation receipts issue new
 handles. Revoke removes dependent tunnels; scoped Cancel fences pending work.
 Bootstrap replay evidence survives alias issuance, Cancel and reinit and fails
@@ -36,6 +39,22 @@ closed at capacity. Clock rollback/unavailability faults device authority for
 that process. Shutdown closes owned credentials even when an SDK observer
 retains the connection. See the [owned cleanup and replay limits](../crates/tinysecurity-crypto/README.md#scoped-device-handles).
 
+Contract 1.23 adds confidential `DeviceFrame2` for streaming v2 frames. It
+accepts only a live tunnel handle returned by `ExecuteDevice2`; it cannot issue
+or extend a handle and checks scope, generation, TTL, revocation, per-tunnel
+frame rate and message bounds. It reuses the native v2 codec and direction-bound
+tunnel keys. Frame calls reuse the approved tunnel capability and need no new
+human receipt; handshake and acknowledgement operations remain on the approved
+Device2 path. The actual native module example exercises this member through
+confidential TinyBus dispatch.
+
+This fast-path does not complete the host device migration. Key and tunnel setup
+still goes through exact-human Device2 approval, and configured handles may live
+for at most five minutes. A later module capability must bind the existing
+paired-device authorization to session setup and renewal while preserving the
+current pairing UX and v2/v3/v4 wire behavior. Device2's exact approval path
+remains fail-closed until that owning-module work is complete.
+
 `device_native_contract` loads the hashed shared library and exercises actual
 confidential dispatch, verified approval/audit callback continuity, v2/v3/v4,
 replay/revoke, valid generation-two receipts, old-handle denial and SDK shutdown.
diff --git a/docs/module-subject-policies.md b/docs/module-subject-policies.md
index 7480c417..032eca27 100644
--- a/docs/module-subject-policies.md
+++ b/docs/module-subject-policies.md
@@ -12,7 +12,7 @@ references, not credentials, and registration is a trusted-host operation.
 
 `EvaluateScoped` and `CheckScoped` take a `PolicyId`, the verified
 `CallerContext` and the original call or checks. The caller's agent must equal
-the registered subject, so one tenant cannot use another's id. Decisions carry
+the registered subject, so one subject cannot use another's id. Decisions carry
 the module generation, the policy's lineage generation and a SHA-256 call
 fingerprint over the policy id, caller (excluding only the call instance) and
 the original call. The fingerprint correlates and binds a decision to its call;