@@ -76,6 +76,9 @@
   ],
   "dynamicallyLoaded": [
     "packages/daemon/src/execution/interaction/index.ts",
+    // The interaction-contract Vitest project loads these by path (globalSetup, setupFiles).
+    "test/integration/interaction-contract/coverage-registration.global-setup.ts",
+    "test/integration/interaction-contract/coverage-registration.ts",
     // The site's modules that Astro loads without an import Fallow can read: from an .astro
     // <script> block (hero.ts, dither-host.ts), as a worker URL (dither.worker.ts), by a path
     // in astro.config.mjs (routeData.ts) or by convention (ec.config.mjs, Expressive Code).
 
@@ -304,6 +304,8 @@ jobs:
         id: run-coverage
         env:
           OUTPUT_ECONOMY_BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+          # A loopback-dependent test fails here instead of skipping when bind is denied.
+          AGENT_DEVICE_REQUIRE_LOOPBACK_TESTS: '1'
         uses: ./.github/actions/run-gate
         with: { gate: unit-ci }
 
@@ -388,10 +390,6 @@ jobs:
         uses: ./.github/actions/run-gate
         with: { gate: concurrency-torture }
 
-      - name: Run provider-backed integration tests
-        uses: ./.github/actions/run-gate
-        with: { gate: provider-integration }
-
       - name: Check Provider-backed integration architecture progress
         uses: ./.github/actions/run-gate
         with: { gate: integration-progress }
 
@@ -18,13 +18,13 @@ on:
   workflow_dispatch:
     inputs:
       runs:
-        description: 'Number of seeded interleavings to sweep'
+        description: 'Number of seeded interleavings to sweep (at most 20000)'
         required: false
         default: '5000'
       seed-start:
-        description: 'First seed in the sweep'
+        description: 'First seed in the sweep (default: run number x 20000, a fresh range each run)'
         required: false
-        default: '0'
+        default: ''
 
 permissions:
   contents: read
@@ -39,8 +39,11 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     env:
-      TORTURE_RUNS: ${{ github.event.inputs.runs || '5000' }}
-      TORTURE_SEED_START: ${{ github.event.inputs.seed-start || '0' }}
+      # Job-level env would override a value written to GITHUB_ENV, so the step below sets both values.
+      RUNS_INPUT: ${{ github.event.inputs.runs || '5000' }}
+      SEED_START_INPUT: ${{ github.event.inputs.seed-start }}
+      # Each run owns the seed range [run_number * stride, run_number * stride + runs).
+      SEED_STRIDE: '20000'
       # Standard scheduled-lane artifact envelope (#1430) built via the shared
       # scripts/lib/lane-envelope.ts (commit, tool/configHash, seed range, result);
       # the seed sweep rides in the typed data payload. Emitted by the test and
@@ -53,6 +56,23 @@ jobs:
       - name: Setup toolchain
         uses: ./.github/actions/setup-node-pnpm
 
+      # A seed fully determines execution order, so a fixed range only re-proves old seeds.
+      # Without an explicit start, each run sweeps its own disjoint range.
+      - name: Choose the seed range
+        run: |
+          digits='^[0-9]+$'
+          if [[ ! "$RUNS_INPUT" =~ $digits ]] || (( 10#$RUNS_INPUT < 1 || 10#$RUNS_INPUT > SEED_STRIDE )); then
+            echo "::error::runs must be an integer from 1 to $SEED_STRIDE"
+            exit 1
+          fi
+          if [[ -n "$SEED_START_INPUT" && ! "$SEED_START_INPUT" =~ $digits ]]; then
+            echo "::error::seed-start must be a non-negative integer"
+            exit 1
+          fi
+          seed_start="${SEED_START_INPUT:-$((GITHUB_RUN_NUMBER * SEED_STRIDE))}"
+          echo "TORTURE_RUNS=$((10#$RUNS_INPUT))" >> "$GITHUB_ENV"
+          echo "TORTURE_SEED_START=$((10#$seed_start))" >> "$GITHUB_ENV"
+
       - name: Run concurrency torture sweep
         uses: ./.github/actions/run-gate
         with: { gate: concurrency-torture }
 
@@ -13,6 +13,9 @@
       "agent-device/remote-config": ["../../src/sdk/remote-config.ts"],
       "agent-device/install-source": ["../../src/sdk/install-source.ts"],
       "agent-device/android-adb": ["../../src/sdk/android-adb.ts"],
+      "agent-device/limrun": ["../../src/sdk/limrun.ts"],
+      "agent-device/plugins": ["../../src/sdk/plugins.ts"],
+      "agent-device/plugins/webdriver": ["../../src/sdk/plugin-webdriver.ts"],
       "agent-device/contracts": ["../../src/sdk/contracts.ts"],
       "agent-device/finders": ["../../src/sdk/finders.ts"],
       "agent-device/selectors": ["../../src/sdk/selectors.ts"],
 
@@ -1,8 +1,7 @@
-import fs from 'node:fs';
-import path from 'node:path';
 import { expect, test, vi } from 'vitest';
 import { AppError } from '@agent-device/kernel/errors';
 import {
+  createTestCaptureResource,
   makeDurableCaptureContext,
   makeDurableCaptureStartResult,
   testCaptureResource,
@@ -175,22 +174,25 @@ test('an unconfirmed failed-adoption cleanup blocks a replacement start in this
     cleanup: { status: 'cleanup-pending', reason: 'cleanup-unconfirmed' },
   });
   const primary = new AppError('CANCELED', 'request canceled');
-  const resourceDir = path.dirname(context.resourcePath);
-
-  try {
-    await expect(
-      testCaptureResource.adoptStarted({
-        ...context,
-        ...start,
-        throwIfCanceled: () => {
-          fs.chmodSync(resourceDir, 0o500);
-          throw primary;
-        },
-      }),
-    ).rejects.toBe(primary);
-  } finally {
-    fs.chmodSync(resourceDir, 0o700);
-  }
+  let writesFail = false;
+  const resource = createTestCaptureResource({
+    ...testCaptureStore,
+    write: (resourcePath, envelope) => {
+      if (writesFail) throw Object.assign(new Error('test write denied'), { code: 'EACCES' });
+      testCaptureStore.write(resourcePath, envelope);
+    },
+  });
+
+  await expect(
+    resource.adoptStarted({
+      ...context,
+      ...start,
+      throwIfCanceled: () => {
+        writesFail = true;
+        throw primary;
+      },
+    }),
+  ).rejects.toBe(primary);
 
   expect(() => context.admissionLedger.assertStartAllowed(context.device)).toThrow(/process-local/);
 });
 
@@ -1,9 +1,8 @@
-import fs from 'node:fs';
-import path from 'node:path';
 import { expect, test } from 'vitest';
 import { AppError } from '@agent-device/kernel/errors';
 import { adoptStartedDurableCapture } from './adoption.ts';
 import {
+  createTestCaptureDefinition,
   makeDurableCaptureContext,
   makeDurableCaptureStartResult,
   testCaptureDefinition,
@@ -88,30 +87,33 @@ test('a failed terminal transition preserves the primary error and reports it un
     cleanup: { status: 'cleanup-pending', reason: 'cleanup-unconfirmed' },
   });
   const primary = new AppError('CANCELED', 'request canceled');
-  const resourceDir = path.dirname(context.resourcePath);
+  let writesFail = false;
+  const definition = createTestCaptureDefinition({
+    ...testCaptureStore,
+    write: (resourcePath, envelope) => {
+      if (writesFail) throw Object.assign(new Error('test write denied'), { code: 'EACCES' });
+      testCaptureStore.write(resourcePath, envelope);
+    },
+  });
 
-  try {
-    await expect(
-      adoptStartedDurableCapture(
-        testCaptureDefinition,
-        {
-          ...context,
-          ...start,
-          throwIfCanceled: () => {
-            fs.chmodSync(resourceDir, 0o500);
-            throw primary;
-          },
+  await expect(
+    adoptStartedDurableCapture(
+      definition,
+      {
+        ...context,
+        ...start,
+        throwIfCanceled: () => {
+          writesFail = true;
+          throw primary;
         },
-        context.resourcePath,
-      ),
-    ).rejects.toBe(primary);
-  } finally {
-    fs.chmodSync(resourceDir, 0o700);
-  }
+      },
+      context.resourcePath,
+    ),
+  ).rejects.toBe(primary);
 
   expect(context.reportUndurableCleanup).toHaveBeenCalledWith(context.device, {
     confirmed: false,
-    reason: expect.stringMatching(/./),
+    reason: 'Test capture cleanup could not be confirmed',
   });
 });
 
 
@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { afterEach, test, vi } from 'vitest';
-import { closeLoopbackServer, supportsLoopbackBind } from '@agent-device/test-kit';
+import { closeLoopbackServer, skipWhenLoopbackUnavailable } from '@agent-device/test-kit';
 import { AppError } from '@agent-device/kernel/errors';
 import {
   isProcessAlive,
@@ -141,9 +141,7 @@ async function waitForExit(pid: number): Promise<void> {
 }
 
 async function withLoopback(t: { skip: (note: string) => void }): Promise<boolean> {
-  if (await supportsLoopbackBind()) return true;
-  t.skip('loopback listeners are not permitted in this environment');
-  return false;
+  return !(await skipWhenLoopbackUnavailable(t));
 }
 
 test('a drain that outlasts the old kill window is waited out, not signaled', async (t) => {
 
@@ -2,7 +2,7 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';
 import { afterEach, test, vi } from 'vitest';
-import { closeLoopbackServer, supportsLoopbackBind } from '@agent-device/test-kit';
+import { closeLoopbackServer, skipWhenLoopbackUnavailable } from '@agent-device/test-kit';
 import { AppError } from '@agent-device/kernel/errors';
 import { DAEMON_QUIESCE_COMMAND } from '@agent-device/daemon-contracts/daemon-resolution';
 import { DAEMON_STARTUP_EXIT_CODES } from '@agent-device/daemon-contracts/daemon-registration-owner';
@@ -95,9 +95,7 @@ async function failureOf(run: Promise<unknown>): Promise<AppError> {
 }
 
 async function withLoopback(t: { skip: (note: string) => void }): Promise<boolean> {
-  if (await supportsLoopbackBind()) return true;
-  t.skip('loopback listeners are not permitted in this environment');
-  return false;
+  return !(await skipWhenLoopbackUnavailable(t));
 }
 
 test('attach reports a missing daemon without starting one', async (t) => {
 
@@ -1,13 +1,13 @@
 import assert from 'node:assert/strict';
 import { test } from 'vitest';
-import { closeLoopbackServer, supportsLoopbackBind } from '@agent-device/test-kit';
+import { closeLoopbackServer, skipWhenLoopbackUnavailable } from '@agent-device/test-kit';
 import { okResult, startScriptedDaemon } from './explicit-lifecycle-fixture.ts';
 
 // The stand-in daemon is a loopback server on an ephemeral port, so anything else on the host that
 // probes listening ports can reach it. Only the client under test speaks `POST /rpc`.
 
 test('a stray request that is not a daemon request is refused and never recorded', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const daemon = await startScriptedDaemon(okResult({}));
   const base = `http://127.0.0.1:${daemon.port}`;
   try {
 
@@ -4,7 +4,7 @@ import { afterEach, test, vi } from 'vitest';
 import {
   closeLoopbackServer,
   createTestHostEnvironment,
-  supportsLoopbackBind,
+  skipWhenLoopbackUnavailable,
 } from '@agent-device/test-kit';
 import { AppError } from '@agent-device/kernel/errors';
 import { isProcessAlive } from '@agent-device/host-kit/process';
@@ -59,7 +59,7 @@ function request(command: string, flags: Record<string, unknown>) {
 }
 
 test('the first request ensures a missing daemon once and every request attaches to it', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   const fresh = await startScriptedDaemon(okResult({}));
   launchesFreshDaemonAt(spawn, paths, fresh.port);
@@ -83,7 +83,7 @@ test('the first request ensures a missing daemon once and every request attaches
 });
 
 test('an idle incompatible daemon is replaced, and the replacement is reported', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   const leaver = createDaemonLeaver();
   const stale = await startScriptedDaemon(draining, { afterRpc: leaver.leave });
@@ -117,7 +117,7 @@ test('an idle incompatible daemon is replaced, and the replacement is reported',
 });
 
 test('a busy incompatible daemon fails the request before it is sent and keeps running', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   const stale = await startScriptedDaemon(
     busy({ inFlightRequests: 0, sessions: 1, repairSessions: 0, leases: 0 }),
@@ -163,7 +163,7 @@ test('a remote connection passes through without ensuring or choosing a lifecycl
 });
 
 test('a one-shot replay on its own private daemon passes through, an explicit state dir does not', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   const fresh = await startScriptedDaemon(okResult({}));
   launchesFreshDaemonAt(spawn, paths, fresh.port);
@@ -184,7 +184,7 @@ test('a one-shot replay on its own private daemon passes through, an explicit st
 });
 
 test('a daemon that disappears between requests is ensured again before the next one is sent', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   const fresh = await startScriptedDaemon(okResult({}));
   launchesFreshDaemonAt(spawn, paths, fresh.port);
@@ -218,7 +218,7 @@ test('a daemon that disappears between requests is ensured again before the next
 });
 
 test('a registered daemon that answers nothing is replaced and reported as unreachable', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   // Both are bound before the dead one is closed, so the fresh daemon cannot be handed its port.
   const closed = await startScriptedDaemon(okResult({}));
@@ -242,7 +242,7 @@ test('a registered daemon that answers nothing is replaced and reported as unrea
 });
 
 test('a failed ensure is retried by the next request instead of being remembered', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   const stale = await startScriptedDaemon(
     busy({ inFlightRequests: 1, sessions: 0, repairSessions: 0, leases: 0 }),
@@ -278,7 +278,7 @@ test('a failed ensure is retried by the next request instead of being remembered
 });
 
 test('concurrent first requests share one ensure through the CLI and MCP transport', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   const fresh = await startScriptedDaemon(okResult({ via: 'fresh' }));
   launchesFreshDaemonAt(spawn, paths, fresh.port);
@@ -314,7 +314,7 @@ test('concurrent first requests share one ensure through the CLI and MCP transpo
 });
 
 test('a request canceled before it starts does not start a daemon', async (t) => {
-  if (!(await supportsLoopbackBind())) return t.skip('loopback listeners are not permitted');
+  if (await skipWhenLoopbackUnavailable(t)) return;
   const { stateDir, paths } = stateDirAndPaths();
   const fresh = await startScriptedDaemon(okResult({}));
   launchesFreshDaemonAt(spawn, paths, fresh.port);